diff --git a/tests/checks/80-cycle-fixture.sh b/tests/checks/80-cycle-fixture.sh
index e93a055..6b6da56 100644
--- a/tests/checks/80-cycle-fixture.sh
+++ b/tests/checks/80-cycle-fixture.sh
@@ -59,13 +59,21 @@ else
 fi
 
 # (i-b) AC3 (negative): the migration moved every other decomposing-node fixture
-# to `manifest.md`, so the retained cyclic alias must be the only `roadmap.md`
-# left under tests/fixtures/. A manifest-first resolver masks a stray duplicate,
-# so the fixture set is pinned explicitly; this names no migrated fixture's old
-# path (AC5), only the retained legacy alias the migration deliberately keeps.
-legacy_fixtures="$(find tests/fixtures -name roadmap.md 2>/dev/null | LC_ALL=C sort)"
+# to `manifest.md`, so the retained cyclic alias must be the only *stray*
+# `roadmap.md` left under tests/fixtures/ — excluding the single documented
+# deliberate exception, tests/fixtures/recursive-integrity/items/9203-spelling-both/roadmap.md,
+# a dual-spelling drift fixture owned by the recursive-integrity guard
+# (tests/checks/91-integrity-guard.sh, AC30). A manifest-first resolver masks a
+# stray duplicate, so the stray-alias set is pinned explicitly: it drops only that
+# one documented path and its remainder must still equal the retained legacy alias,
+# so any third/stray alias still fails. This names no migrated fixture's old path
+# (AC5), only the retained legacy alias the migration keeps and the deliberate
+# exception the integrity guard owns.
+DELIBERATE_ALIAS='tests/fixtures/recursive-integrity/items/9203-spelling-both/roadmap.md'
+legacy_fixtures="$(find tests/fixtures -name roadmap.md 2>/dev/null \
+  | grep -vxF -- "$DELIBERATE_ALIAS" | LC_ALL=C sort)"
 if [ "$legacy_fixtures" = "tests/fixtures/cyclic-roadmap/roadmap.md" ]; then
-  ok "AC13 the retained cyclic alias is the only roadmap.md fixture (AC3)"
+  ok "AC13 the retained cyclic alias is the only stray roadmap.md fixture (AC3)"
 else
   bad "AC13 unexpected roadmap.md fixture set (AC3): $(printf '%s' "$legacy_fixtures" | tr '\n' ' ')"
 fi
diff --git a/tests/checks/91-integrity-guard.sh b/tests/checks/91-integrity-guard.sh
new file mode 100644
index 0000000..c6aa471
--- /dev/null
+++ b/tests/checks/91-integrity-guard.sh
@@ -0,0 +1,805 @@
+#!/usr/bin/env bash
+#
+# AC30 — recursive merge-integrity invariant evaluation.
+#
+# The merge-integrity guard (docs/workflow.md -> "Merge conflicts" ->
+# "Merge-integrity guard", mirrored in .opencode/skill/merge-conflict/SKILL.md)
+# is prompt behaviour: the framework commits no checker. This area pins its
+# RECURSIVE shape to a committed fixture, the same way
+# tests/checks/80-cycle-fixture.sh pins the prompt-only CYCLIC-DEP rule. It
+# reimplements the invariant evaluation as a genuine recursive scan over
+# tests/fixtures/recursive-integrity/items/ — the top level against the
+# top-level items and every decomposing node against its own immediate children
+# — so an evaluation that flattens to two levels misses the depth-three
+# collision and fails per-node-eval.
+#
+# It is fixture-scoped test code, not a production checker: it implements no
+# command, is invoked by no framework command, and never reads live work/**.
+# Item references resolve inside the fixture root, which shadows the live work/
+# root. The suite is read-only and fresh-clone-clean.
+#
+# It references the sibling agreement areas that own overlapping literals by
+# name and re-asserts none of their literals: the recursive structure guard
+# 0001-recursive-structure-guard (the DUPLICATE-PREFIX / DUPLICATE-CHILD
+# derivation), tests/checks/10-readiness.sh, tests/checks/20-lifecycle.sh,
+# tests/checks/80-cycle-fixture.sh (the CYCLIC-DEP diagnostic and the
+# roadmap.md migration guard), tests/checks/85-conflict-guards.sh,
+# tests/checks/87-backtrack-guards.sh, tests/checks/88-renumber-sweep.sh (the
+# renumber prose rewrite lists), tests/checks/90-packaging.sh (the duplicated
+# inventory/count fact), and tests/checks/96-signature-sweep.sh.
+#
+# Reads only tests/fixtures/** and live surfaces (never work/**); sourced by
+# tests/run.sh, so it must not call exit. Prints ok/FAIL lines labelled AC30
+# plus a sub-area, so the mutation self-check (tests/mutation.sh) can name the
+# guard it trips: per-node-eval, structural-graph, spelling-drift, report-only,
+# renumber-sweep, fixture-existence, read-only-contract, mutation-staging,
+# no-duplication.
+
+echo "== AC30 recursive merge-integrity invariant evaluation =="
+
+FIG_ROOT="tests/fixtures/recursive-integrity"
+FIG_ITEMS="$FIG_ROOT/items"
+FIG_CANON_HEADER='| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |'
+
+# --- helpers ---------------------------------------------------------------
+
+# Resolve a decomposing node's manifest: its modern `manifest.md` spelling when
+# present, else the recognized deprecated alias `roadmap.md`, else nothing. Lets
+# the scan read either spelling without hardcoding a migrated fixture path.
+fig_manifest() {  # $1 = node directory; prints the manifest path, or nothing
+  local d="$1" base
+  for base in manifest roadmap; do
+    if [ -f "$d/$base.md" ]; then printf '%s\n' "$d/$base.md"; return 0; fi
+  done
+  return 1
+}
+
+# Declared `phase` value from the manifest frontmatter (empty when absent).
+fig_phase_of() {
+  awk '
+    NR == 1 && $0 == "---" { f = 1; next }
+    f && $0 == "---" { exit }
+    f && /^phase:/ {
+      v = $0
+      sub(/^phase:[ \t]*/, "", v)
+      gsub(/^[ \t]+|[ \t]+$/, "", v)
+      print v
+      exit
+    }
+  ' "$1"
+}
+
+# Parse a manifest Children table by header name (not fixed positions), so the
+# six-column header parses. Emits "<local-id>|<depends-on>" per data row.
+fig_children_rows() {
+  awk '
+    /^## Children[ \t]*$/ { insec = 1; next }
+    insec && /^## / { insec = 0 }
+    !insec { next }
+    /^\|/ {
+      n = split($0, a, "|")
+      if (!hdr) {
+        for (i = 2; i < n; i++) {
+          c = a[i]
+          gsub(/^[ \t]+|[ \t]+$/, "", c)
+          if (c != "") col[c] = i
+        }
+        hdr = 1
+        next
+      }
+      idcell = ""; dep = ""
+      if ("Local id" in col) idcell = a[col["Local id"]]
+      if ("Depends on" in col) dep = a[col["Depends on"]]
+      gsub(/^[ \t]+|[ \t]+$/, "", idcell)
+      gsub(/^[ \t]+|[ \t]+$/, "", dep)
+      if (idcell == "" || idcell ~ /^-+$/) next
+      print idcell "|" dep
+    }
+  ' "$1"
+}
+
+# The node's `## Open issues` block, through the next section heading. The
+# withdrawal record lives here; it names the retained child directory.
+fig_open_issues() {
+  awk '
+    /^## Open issues[ \t]*$/ { on = 1; next }
+    on && /^## / { exit }
+    on { print }
+  ' "$1"
+}
+
+# Trim each comma-separated token of a `Depends on` cell; one token per line.
+fig_dep_tokens() {
+  printf '%s' "$1" | awk -F',' '{
+    for (i = 1; i <= NF; i++) {
+      t = $i
+      gsub(/^[ \t]+|[ \t]+$/, "", t)
+      if (t != "") print t
+    }
+  }'
+}
+
+fig_has_line() {  # $1 = newline list, $2 = whole-line literal
+  printf '%s\n' "$1" | grep -qxF -- "$2"
+}
+
+# --- finding accumulators ---------------------------------------------------
+# Findings normalize to "CODE|<offender>[,<offender>]"; offenders are canonical
+# refs relative to items/, sorted. Three category globals keep one mutation
+# naming one sub-area.
+
+FIG_DUP=""
+FIG_GRAPH=""
+FIG_DRIFT=""
+
+fig_add_dup()   { FIG_DUP="$FIG_DUP
+$1"; }
+fig_add_graph() { FIG_GRAPH="$FIG_GRAPH
+$1"; }
+fig_add_drift() { FIG_DRIFT="$FIG_DRIFT
+$1"; }
+
+# Group same-parent prefixes and record a collision. $1 = code, $2 = newline
+# list of full offender refs (all sharing one parent). The immediate child's
+# 4-digit prefix is the last path segment's leading number.
+fig_check_dups() {
+  local code="$1" refs="$2" prefix member members cnt joined seg
+  local prefixes
+  prefixes="$(printf '%s\n' "$refs" \
+    | awk 'NF { n = split($0, seg, "/"); s = seg[n]; sub(/-.*/, "", s); print s }' \
+    | LC_ALL=C sort -u)"
+  for prefix in $prefixes; do
+    [ -n "$prefix" ] || continue
+    members=""
+    for member in $refs; do
+      [ -n "$member" ] || continue
+      seg="${member##*/}"
+      seg="${seg%%-*}"
+      if [ "$seg" = "$prefix" ]; then
+        members="$members
+$member"
+      fi
+    done
+    cnt="$(printf '%s\n' "$members" | grep -c '[^[:space:]]')"
+    if [ "$cnt" -ge 2 ]; then
+      joined="$(printf '%s\n' "$members" | grep '[^[:space:]]' | LC_ALL=C sort -u \
+        | awk 'NF { if (s != "") s = s ","; s = s $0 } END { print s }')"
+      fig_add_dup "$code|$joined"
+    fi
+  done
+}
+
+# --- recursive invariant scan ----------------------------------------------
+# Evaluate the invariant set for one node against its own immediate children,
+# then recurse into every child that is itself a decomposing node. The top-level
+# prefix grouping is done once by fig_scan_all.
+
+fig_scan_node() {  # $1 = canonical ref relative to items/, $2 = node directory
+  local ref="$1" dir="$2"
+  local man base phase rows opensec
+  local cdir localid
+  local dirs="" rowids="" childrefs=""
+
+  # A node holding both manifest spellings is drift; the modern spelling stays
+  # authoritative and neither file is merged, normalized, or deleted.
+  if [ -f "$dir/manifest.md" ] && [ -f "$dir/roadmap.md" ]; then
+    fig_add_drift "DRIFT-FACT|$ref"
+  fi
+
+  man="$(fig_manifest "$dir")" || return 0
+  base="${man##*/}"
+  base="${base%.md}"
+  phase="$(fig_phase_of "$man")"
+  # A manifest's spelling and its declared `phase` value must agree
+  # (manifest.md/manifest, roadmap.md/roadmap); a disagreement is drift.
+  if [ "$base" = "manifest" ] && [ "$phase" != "manifest" ]; then
+    fig_add_drift "DRIFT-FACT|$ref"
+  elif [ "$base" = "roadmap" ] && [ "$phase" != "roadmap" ]; then
+    fig_add_drift "DRIFT-FACT|$ref"
+  fi
+
+  rows="$(fig_children_rows "$man")"
+  opensec="$(fig_open_issues "$man")"
+
+  # Immediate child directories (NNNN-slug only).
+  for cdir in "$dir"/*/; do
+    [ -d "$cdir" ] || continue
+    localid="${cdir%/}"
+    localid="${localid##*/}"
+    case "$localid" in
+      [0-9][0-9][0-9][0-9]-*) : ;;
+      *) continue ;;
+    esac
+    dirs="$dirs
+$localid"
+  done
+
+  rowids="$(printf '%s\n' "$rows" | awk -F'|' 'NF { print $1 }')"
+
+  # MISSING-CHILD: a Children row whose child directory is absent.
+  local rid deprow dep d
+  for rid in $rowids; do
+    [ -n "$rid" ] || continue
+    if ! fig_has_line "$dirs" "$rid"; then
+      fig_add_graph "MISSING-CHILD|$ref/$rid"
+    fi
+  done
+
+  # UNLISTED-CHILD: a child directory absent from the table, unless the node's
+  # open issues name it as a deliberate withdrawal (report-only, never a fault).
+  for localid in $dirs; do
+    [ -n "$localid" ] || continue
+    if fig_has_line "$rowids" "$localid"; then continue; fi
+    if printf '%s\n' "$opensec" | grep -qF -- "$ref/$localid"; then continue; fi
+    fig_add_graph "UNLISTED-CHILD|$ref/$localid"
+  done
+
+  # DANGLING-DEP: a `Depends on` local id resolving to no row and no directory.
+  while IFS= read -r deprow; do
+    [ -n "$deprow" ] || continue
+    rid="${deprow%%|*}"
+    dep="${deprow#*|}"
+    [ -n "$dep" ] || continue
+    for d in $(fig_dep_tokens "$dep"); do
+      [ "$d" = "—" ] && continue
+      if fig_has_line "$rowids" "$d"; then continue; fi
+      fig_add_graph "DANGLING-DEP|$ref/$rid"
+    done
+  done <<EOF
+$rows
+EOF
+
+  # DUPLICATE-CHILD: two immediate children of THIS node sharing a 4-digit
+  # prefix, at whatever depth the node sits.
+  for localid in $dirs; do
+    [ -n "$localid" ] || continue
+    childrefs="$childrefs
+$ref/$localid"
+  done
+  fig_check_dups "DUPLICATE-CHILD" "$childrefs"
+
+  # Recurse into every child that is itself a decomposing node.
+  for localid in $dirs; do
+    [ -n "$localid" ] || continue
+    if fig_manifest "$dir/$localid" >/dev/null 2>&1; then
+      fig_scan_node "$ref/$localid" "$dir/$localid"
+    fi
+  done
+}
+
+fig_scan_all() {
+  local pd pname toprefs=""
+  for pd in "$FIG_ITEMS"/*/; do
+    [ -d "$pd" ] || continue
+    pname="${pd%/}"
+    pname="${pname##*/}"
+    case "$pname" in
+      [0-9][0-9][0-9][0-9]-*) : ;;
+      *) continue ;;
+    esac
+    toprefs="$toprefs
+$pname"
+  done
+  # DUPLICATE-PREFIX: two top-level items sharing a 4-digit prefix.
+  fig_check_dups "DUPLICATE-PREFIX" "$toprefs"
+  for pname in $toprefs; do
+    [ -n "$pname" ] || continue
+    fig_scan_node "$pname" "$FIG_ITEMS/$pname"
+  done
+}
+
+fig_block() {  # normalize a category accumulator to a sorted, deduped block
+  printf '%s\n' "$1" | grep -v '^$' | LC_ALL=C sort -u
+}
+
+# The three category blocks, one mutation per sub-area.
+fixture_duplicates() { fig_block "$FIG_DUP"; }
+fixture_graph()      { fig_block "$FIG_GRAPH"; }
+fixture_drift()      { fig_block "$FIG_DRIFT"; }
+
+fig_cmp() {  # $1 label, $2 expected, $3 actual
+  if [ "$2" = "$3" ]; then
+    ok "AC30 $1: matches the expected block"
+  else
+    bad "AC30 $1: diverged from the expected block"
+    printf '    expected:\n%s\n    actual:\n%s\n' "$2" "$3"
+  fi
+}
+
+# --- analyzers and expected outcome blocks ----------------------------------
+
+fig_scan_all
+
+ACT_DUP="$(fixture_duplicates)"
+ACT_GRAPH="$(fixture_graph)"
+ACT_DRIFT="$(fixture_drift)"
+
+# The reviewed expectation over the committed fixture: exactly the planted
+# duplicates, the structural graph faults (with the recorded withdrawal
+# excluded), and the two drift nodes. A two-level-only scan misses the
+# depth-three DUPLICATE-CHILD and diverges here.
+EXP_DUP="$(cat <<'EOF'
+DUPLICATE-CHILD|9211-deep/0001-mid/0001-alpha,9211-deep/0001-mid/0001-beta
+DUPLICATE-PREFIX|9210-dup-a,9210-dup-b
+EOF
+)"
+
+EXP_GRAPH="$(cat <<'EOF'
+DANGLING-DEP|9202-graph-faults/0003-dangling
+MISSING-CHILD|9202-graph-faults/0002-missing
+UNLISTED-CHILD|9202-graph-faults/0005-unlisted
+EOF
+)"
+
+EXP_DRIFT="$(cat <<'EOF'
+DRIFT-FACT|9203-spelling-both
+DRIFT-FACT|9204-phase-mismatch
+EOF
+)"
+
+# --- AC30 per-node-eval (AC2) -----------------------------------------------
+
+fig_cmp "per-node-eval" "$EXP_DUP" "$ACT_DUP"
+
+# The collision is attributed to its OWN node, not flattened to the top level:
+# both offenders carry the depth-three parent's canonical reference.
+if printf '%s\n' "$ACT_DUP" \
+  | grep -qF 'DUPLICATE-CHILD|9211-deep/0001-mid/0001-alpha,9211-deep/0001-mid/0001-beta'; then
+  ok "AC30 per-node-eval: the depth-three collision is attributed to 9211-deep/0001-mid"
+else
+  bad "AC30 per-node-eval: the depth-three collision is not attributed to 9211-deep/0001-mid"
+fi
+
+# --- AC30 structural-graph (AC3) --------------------------------------------
+
+fig_cmp "structural-graph" "$EXP_GRAPH" "$ACT_GRAPH"
+
+# The recorded withdrawal is report-only: it yields no UNLISTED-CHILD fault, so
+# a deliberate withdrawal is never counted as an accidental graph fault.
+if printf '%s\n' "$ACT_GRAPH" | grep -qF 'UNLISTED-CHILD|9202-graph-faults/0004-withdrawn'; then
+  bad "AC30 structural-graph: the recorded deliberate withdrawal was reported as UNLISTED-CHILD"
+else
+  ok "AC30 structural-graph: the recorded deliberate withdrawal yields no UNLISTED-CHILD fault"
+fi
+
+# --- AC30 spelling-drift (AC4) ----------------------------------------------
+
+fig_cmp "spelling-drift" "$EXP_DRIFT" "$ACT_DRIFT"
+
+# The modern `manifest.md` spelling is authoritative over the deprecated alias:
+# the evaluation resolves a dual-spelling node's manifest to the modern spelling,
+# never the alias, so the redundant `roadmap.md` is reported (above) and left
+# untouched. A resolver that preferred the alias would be wrong and is caught
+# here even though both files carry the same rows.
+FIG_DRIFT_MAN="$(fig_manifest "$FIG_ITEMS/9203-spelling-both")"
+if [ "$FIG_DRIFT_MAN" = "$FIG_ITEMS/9203-spelling-both/manifest.md" ]; then
+  ok "AC30 spelling-drift: the modern manifest is authoritative over the deprecated alias"
+else
+  bad "AC30 spelling-drift: the modern manifest is not authoritative (resolved '${FIG_DRIFT_MAN:-none}')"
+fi
+
+# The dual-spelling node keeps both files: the inconsistency is reported, never
+# merged, normalized, dropped, or auto-repaired, so neither spelling disappears.
+if [ -f "$FIG_ITEMS/9203-spelling-both/manifest.md" ] \
+   && [ -f "$FIG_ITEMS/9203-spelling-both/roadmap.md" ]; then
+  ok "AC30 spelling-drift: both spellings are retained, never dropped or auto-repaired"
+else
+  bad "AC30 spelling-drift: a dual-spelling file was dropped or auto-repaired"
+fi
+
+# --- AC30 report-only (AC5, AC2) --------------------------------------------
+# The merge-integrity guard commits no checker, so its report-only, non-fatal
+# contract lives only on the authority docs/workflow.md -> "### Merge-integrity
+# guard" and its operational mirror .opencode/skill/merge-conflict/SKILL.md.
+# Both surfaces are pinned here, by path; no sibling agreement area owns these
+# literals. The recursive authority phrases are pinned the same way: the
+# invariant set is evaluated at every node, no node's check depends on another's
+# (authority), and every node at every depth (skill).
+
+FIG_WF='docs/workflow.md'
+FIG_SKILL="$SKILL_DIR/merge-conflict/SKILL.md"
+
+# Authority block: docs/workflow.md -> "### Merge-integrity guard", through the
+# next heading at the same or a higher level.
+fig_mi_block() {
+  awk '
+    /^### Merge-integrity guard[ \t]*$/ { on = 1; next }
+    on && /^#{2,3} / { exit }
+    on { print }
+  ' "$1"
+}
+
+# Skill block: the reconcile procedure's post-merge integrity pass (step 6),
+# through the next numbered step, carrying the report-only contract sentence.
+fig_skill_post_block() {
+  awk '
+    /6\. \*\*Post-merge integrity pass/ { on = 1 }
+    on && /^7\. / { exit }
+    on { print }
+  ' "$1"
+}
+
+# Collapse a prose block to one line so a contract phrase that wraps across the
+# surface's line width still matches as one literal.
+fig_flat() { tr '\n' ' ' | tr -s ' '; }
+
+# fig_pin <label> <file> <block> <literal> <what>: assert the block carries the
+# literal; a missing file or an unreadable block fails (never skips). The
+# literal is matched with grep -F so a markdown-emphasis phrase matches exactly.
+fig_pin() {
+  local label="$1" file="$2" block="$3" literal="$4" what="$5"
+  if [ ! -f "$file" ]; then
+    bad "AC30 report-only: $label surface $file is missing; cannot pin $what"
+    return
+  fi
+  if [ -z "$block" ]; then
+    bad "AC30 report-only: $label block is not readable; cannot pin $what"
+    return
+  fi
+  if printf '%s\n' "$block" | grep -qF -- "$literal"; then
+    ok "AC30 report-only: $label pins $what"
+  else
+    bad "AC30 report-only: $label does not pin $what (missing '$literal')"
+  fi
+}
+
+FIG_MI_BLOCK="$(fig_mi_block "$FIG_WF" | fig_flat)"
+FIG_SKILL_POST="$(fig_skill_post_block "$FIG_SKILL" | fig_flat)"
+FIG_SKILL_ALL="$(cat "$FIG_SKILL" 2>/dev/null | fig_flat)"
+
+# Authority: the non-fatal / never-dropped / never-truncated / not-auto-repaired
+# / modifies-no-file contract, and the clean-tree no-findings / no-error clause.
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" '**non-fatal**' \
+  'the non-fatal finding contract'
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" '**never silently dropped**' \
+  'the never-silently-dropped contract'
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" '**never truncated**' \
+  'the never-truncated contract'
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" '**not auto-repaired**' \
+  'the not-auto-repaired contract'
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" '**modifies no file**' \
+  'the modifies-no-file contract'
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" 'report **no findings**' \
+  'the clean-tree reports-no-findings clause'
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" '**does not error**' \
+  'the clean-tree does-not-error clause'
+
+# The recursive authority phrases: the invariant set is evaluated at every node
+# and no node's check depends on another's (authority); the skill carries the
+# every-node-at-every-depth phrasing.
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" \
+  'The invariant set is evaluated at **every node** of the recursive tree' \
+  'the invariant-set-at-every-node authority phrase'
+fig_pin authority "$FIG_WF" "$FIG_MI_BLOCK" \
+  "no node's check depends on another's" \
+  'the node-independence authority phrase'
+fig_pin skill "$FIG_SKILL" "$FIG_SKILL_ALL" 'every node at every depth' \
+  'the every-node-at-every-depth recursive phrase'
+
+# Skill: the operational mirror's report-only contract.
+fig_pin skill "$FIG_SKILL" "$FIG_SKILL_POST" '**report-only**' \
+  'the report-only pass contract'
+fig_pin skill "$FIG_SKILL" "$FIG_SKILL_POST" 'the list is never truncated' \
+  'the never-truncated pass contract'
+fig_pin skill "$FIG_SKILL" "$FIG_SKILL_POST" '**modifies no file**' \
+  'the modifies-no-file pass contract'
+fig_pin skill "$FIG_SKILL" "$FIG_SKILL_POST" 'it never auto-repairs a violation' \
+  'the never-auto-repairs pass contract'
+
+# A clean tree reports no findings and does not error: re-scan the clean
+# 9201-clean node in isolation into a scratch accumulator; the combined block
+# must be empty. (The subshell keeps the real accumulators intact.)
+FIG_CLEAN="$(
+  FIG_DUP=""; FIG_GRAPH=""; FIG_DRIFT=""
+  fig_scan_node "9201-clean" "$FIG_ITEMS/9201-clean"
+  fig_block "$FIG_DUP"
+  fig_block "$FIG_GRAPH"
+  fig_block "$FIG_DRIFT"
+)"
+if [ -z "$FIG_CLEAN" ]; then
+  ok "AC30 report-only: the clean 9201-clean node yields empty findings and does not error"
+else
+  bad "AC30 report-only: the clean 9201-clean node produced findings: $FIG_CLEAN"
+fi
+
+# --- AC30 renumber-sweep (AC7, AC8, AC9) ------------------------------------
+# A completed whole-subtree renumber is pinned by the committed fixture
+# 9220-renamed-parent/: the new directory exists, the new reference appears in
+# every enumerated rewrite position, and the old local id / old canonical
+# reference appear NOWHERE. The presence assertions keep the absence assertion
+# from being vacuous on an empty tree. The rewrite positions are the ones the
+# authority (docs/artifact-conventions.md -> "Renumbering after a parallel
+# merge") and its operational mirror (.opencode/skill/merge-conflict/SKILL.md,
+# class (c) step 3) enumerate; the intermediate-manifest position is the
+# recursive specific tests/checks/88-renumber-sweep.sh does not own — it pins
+# the declaration bullets and the closing assertion — so only that one is pinned
+# on the surfaces here, referencing 88 by name and restating none of its
+# literals. The old-reference constants live only in this check, never in the
+# fixture, so the recursive literal scan is scoped to the fixture root and never
+# matches this file.
+
+FIG_RN_NODE="$FIG_ITEMS/9220-renamed-parent"
+FIG_RN_OLD_LOCAL='0001-old'
+FIG_RN_NEW_LOCAL='0002-new'
+FIG_RN_OLD_REF='9220-renamed-parent/0001-old'
+FIG_RN_NEW_REF='9220-renamed-parent/0002-new'
+
+# fig_rn_file_has <what> <file> <literal>: the file must exist and carry the
+# literal (fails, never skips, when the fixture file is absent).
+fig_rn_file_has() {
+  local what="$1" file="$2" literal="$3"
+  if [ ! -f "$file" ]; then
+    bad "AC30 renumber-sweep: $what — fixture file $file is missing"
+    return
+  fi
+  if grep -qF -- "$literal" "$file"; then
+    ok "AC30 renumber-sweep: $what"
+  else
+    bad "AC30 renumber-sweep: $what (missing '$literal' in $file)"
+  fi
+}
+
+# Rewrite position: the directory name.
+if [ -d "$FIG_RN_NODE/$FIG_RN_NEW_LOCAL" ]; then
+  ok "AC30 renumber-sweep: the new directory $FIG_RN_NEW_LOCAL exists"
+else
+  bad "AC30 renumber-sweep: the new directory $FIG_RN_NEW_LOCAL is missing"
+fi
+
+# The owning manifest's `Children` row: `Local id` and `Canonical reference`.
+fig_rn_file_has "the owning manifest's Local id cell names $FIG_RN_NEW_LOCAL" \
+  "$FIG_RN_NODE/manifest.md" "| $FIG_RN_NEW_LOCAL |"
+fig_rn_file_has "the owning manifest's Canonical reference cell names $FIG_RN_NEW_REF" \
+  "$FIG_RN_NODE/manifest.md" "$FIG_RN_NEW_REF"
+# Every descendant artifact's `feature:` value.
+fig_rn_file_has "a descendant artifact's feature: value carries $FIG_RN_NEW_REF/0001-leaf" \
+  "$FIG_RN_NODE/$FIG_RN_NEW_LOCAL/0001-leaf/spec.md" "feature: $FIG_RN_NEW_REF/0001-leaf"
+# Every `parent:` value on the changed path.
+fig_rn_file_has "a descendant artifact's parent: value carries $FIG_RN_NEW_REF" \
+  "$FIG_RN_NODE/$FIG_RN_NEW_LOCAL/0001-leaf/spec.md" "parent: $FIG_RN_NEW_REF"
+# Every intermediate manifest's `Children` `Canonical reference` cell.
+fig_rn_file_has "the intermediate manifest's Canonical reference cell names $FIG_RN_NEW_REF/0001-leaf" \
+  "$FIG_RN_NODE/$FIG_RN_NEW_LOCAL/manifest.md" "$FIG_RN_NEW_REF/0001-leaf"
+# Every `Depends on` cell naming the new local id (its `conflicts-with` cell
+# follows, so the trailing `| — |` anchors the `Depends on` cell).
+fig_rn_file_has "the owning manifest's Depends on cell names $FIG_RN_NEW_LOCAL" \
+  "$FIG_RN_NODE/manifest.md" "| $FIG_RN_NEW_LOCAL | — |"
+# Every `conflicts-with` target naming the new local id.
+fig_rn_file_has "the follower's conflicts-with declaration names $FIG_RN_NEW_LOCAL" \
+  "$FIG_RN_NODE/0003-follower/design.md" "conflicts-with: \"$FIG_RN_NEW_LOCAL\""
+# The recorded ship/handoff path (branch flattened with `+`, per the branch
+# naming rule).
+fig_rn_file_has "the recorded ship branch names $FIG_RN_NEW_LOCAL" \
+  "$FIG_RN_NODE/0003-follower/ship.md" "+$FIG_RN_NEW_LOCAL"
+
+# Old-reference absence: a recursive literal scan over the whole fixture root.
+# A reintroduced old reference makes this fail and names the sub-area (AC8).
+fig_rn_scan_absent() {  # $1 literal: print matching files, or nothing
+  grep -rIlF -- "$1" "$FIG_ROOT" 2>/dev/null
+}
+
+FIG_RN_LEAK="$(fig_rn_scan_absent "$FIG_RN_OLD_REF")"
+if [ -z "$FIG_RN_LEAK" ]; then
+  ok "AC30 renumber-sweep: the old canonical reference $FIG_RN_OLD_REF appears nowhere under the fixture root"
+else
+  bad "AC30 renumber-sweep: the old canonical reference $FIG_RN_OLD_REF leaked into: $FIG_RN_LEAK"
+fi
+
+FIG_RN_LEAK="$(fig_rn_scan_absent "$FIG_RN_OLD_LOCAL")"
+if [ -z "$FIG_RN_LEAK" ]; then
+  ok "AC30 renumber-sweep: the old local id $FIG_RN_OLD_LOCAL appears nowhere under the fixture root"
+else
+  bad "AC30 renumber-sweep: the old local id $FIG_RN_OLD_LOCAL leaked into: $FIG_RN_LEAK"
+fi
+
+# The recursive surface pin 88 does not own: the intermediate manifest on the
+# changed path. The extractors mirror 88's (referenced by name); the literal is
+# 88's to restate, not this area's, so only the intermediate-manifest phrase is
+# pinned here.
+FIG_RN_CONV='docs/artifact-conventions.md'
+FIG_RN_SKILL_PATH="$SKILL_DIR/merge-conflict/SKILL.md"
+
+fig_rn_authority_block() {
+  awk '
+    /^### Renumbering after a parallel merge[ \t]*$/ { on = 1; next }
+    on && /^#{2,3} / { exit }
+    on { print }
+  ' "$1"
+}
+
+fig_rn_skill_block() {
+  awk '
+    /rewrite every reference/ { on = 1 }
+    on && /Assert that/ { print; exit }
+    on { print }
+  ' "$1"
+}
+
+FIG_RN_INTERMEDIATE="every intermediate manifest's** \`Children\` \`Canonical reference\` cell on the changed path"
+
+fig_rn_pin() {  # $1 label, $2 file, $3 flattened block, $4 literal, $5 what
+  local label="$1" file="$2" block="$3" literal="$4" what="$5"
+  if [ ! -f "$file" ]; then
+    bad "AC30 renumber-sweep: $label surface $file is missing; cannot pin $what"
+    return
+  fi
+  if [ -z "$block" ]; then
+    bad "AC30 renumber-sweep: $label block is not readable; cannot pin $what"
+    return
+  fi
+  if printf '%s\n' "$block" | grep -qF -- "$literal"; then
+    ok "AC30 renumber-sweep: $label names $what"
+  else
+    bad "AC30 renumber-sweep: $label does not name $what (missing '$literal')"
+  fi
+}
+
+FIG_RN_AUTH_BLOCK="$(fig_rn_authority_block "$FIG_RN_CONV" | fig_flat)"
+FIG_RN_SKILL_BLOCK="$(fig_rn_skill_block "$FIG_RN_SKILL_PATH" | fig_flat)"
+
+fig_rn_pin authority "$FIG_RN_CONV" "$FIG_RN_AUTH_BLOCK" "$FIG_RN_INTERMEDIATE" \
+  'the intermediate manifest on the changed path'
+fig_rn_pin skill "$FIG_RN_SKILL_PATH" "$FIG_RN_SKILL_BLOCK" "$FIG_RN_INTERMEDIATE" \
+  'the intermediate manifest on the changed path'
+
+# --- AC30 fixture-existence (AC1) -------------------------------------------
+# A required fixture file that is absent fails (never skips): a silently dropped
+# fixture would leave a finding block vacuous while the area still reported green.
+
+if [ -d "$FIG_ITEMS" ]; then
+  ok "AC30 fixture-existence: recursive-integrity fixture tree exists at $FIG_ITEMS"
+else
+  bad "AC30 fixture-existence: recursive-integrity fixture tree missing at $FIG_ITEMS"
+fi
+
+for fig_required in \
+  "$FIG_ITEMS/9201-clean/manifest.md" \
+  "$FIG_ITEMS/9202-graph-faults/manifest.md" \
+  "$FIG_ITEMS/9203-spelling-both/manifest.md" \
+  "$FIG_ITEMS/9203-spelling-both/roadmap.md" \
+  "$FIG_ITEMS/9204-phase-mismatch/manifest.md" \
+  "$FIG_ITEMS/9210-dup-a/manifest.md" \
+  "$FIG_ITEMS/9210-dup-b/manifest.md" \
+  "$FIG_ITEMS/9211-deep/manifest.md" \
+  "$FIG_ITEMS/9211-deep/0001-mid/manifest.md" \
+  "$FIG_ITEMS/9220-renamed-parent/manifest.md" \
+  "$FIG_ITEMS/9220-renamed-parent/0002-new/manifest.md" \
+  "$FIG_ITEMS/9220-renamed-parent/0002-new/0001-leaf/spec.md" \
+  "$FIG_ITEMS/9220-renamed-parent/0003-follower/design.md" \
+  "$FIG_ITEMS/9220-renamed-parent/0003-follower/ship.md"; do
+  if [ -f "$fig_required" ]; then
+    ok "AC30 fixture-existence: $fig_required exists"
+  else
+    bad "AC30 fixture-existence: $fig_required missing"
+  fi
+done
+
+# --- AC30 read-only-contract (AC1, AC12) ------------------------------------
+# The fixture is test data, never live state: it references no live work/ path
+# and carries no executable file. The area is sourced test code, not a committed
+# executable checker, and no committed command, agent, or skill references it —
+# the merge-integrity guard stays prompt behaviour with no committed checker.
+
+if [ -d "$FIG_ROOT" ] && ! grep -rq 'work/' "$FIG_ROOT" 2>/dev/null; then
+  ok "AC30 read-only-contract: fixture references no live work/ path"
+else
+  bad "AC30 read-only-contract: fixture references a live work/ path"
+fi
+
+fig_exec_files="$(find "$FIG_ROOT" -type f 2>/dev/null | while IFS= read -r fig_f; do
+  [ -n "$fig_f" ] && [ -x "$fig_f" ] && printf '%s\n' "$fig_f"
+done)"
+if [ -z "$fig_exec_files" ]; then
+  ok "AC30 read-only-contract: fixture tree contains no executable file"
+else
+  bad "AC30 read-only-contract: fixture tree contains an executable file: $(printf '%s ' $fig_exec_files)"
+fi
+
+FIG_CHECKS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+FIG_SELF="$FIG_CHECKS_DIR/91-integrity-guard.sh"
+if [ -f "$FIG_SELF" ] && [ ! -x "$FIG_SELF" ]; then
+  ok "AC30 read-only-contract: the area adds no committed executable checker"
+else
+  bad "AC30 read-only-contract: the area adds a committed executable checker"
+fi
+
+if ! grep -rqF '91-integrity-guard' .opencode/ 2>/dev/null; then
+  ok "AC30 read-only-contract: no committed command, agent, or skill references the area"
+else
+  bad "AC30 read-only-contract: a committed command, agent, or skill references the area"
+fi
+
+# --- AC30 mutation-staging (AC10) -------------------------------------------
+# The opt-in whole-suite mutation self-check stages each fixture root into its
+# scratch copy; the new root must be staged or its whole-suite runs fail once
+# this area exists (tests/checks/91-integrity-guard.sh lives in the copy).
+# The suite-documentation row and the per-rule mutation jobs remain
+# 0005-guard-registration-sweep's responsibility.
+#
+# Resolve mutation.sh through this check's own directory, never through the
+# process CWD: the mutation self-check runs the suite against a staged copy of
+# the live surfaces, and tests/mutation.sh is deliberately not staged, so a
+# CWD-relative path would fail the copy's whole-suite run.
+
+FIG_MUTATION="$FIG_CHECKS_DIR/../mutation.sh"
+if [ -f "$FIG_MUTATION" ] && grep -qF 'tests/fixtures/recursive-integrity' "$FIG_MUTATION"; then
+  ok "AC30 mutation-staging: tests/mutation.sh stages tests/fixtures/recursive-integrity"
+else
+  bad "AC30 mutation-staging: tests/mutation.sh does not stage tests/fixtures/recursive-integrity"
+fi
+
+# --- AC30 no-duplication (AC6, AC11) ----------------------------------------
+# This area extends the neighbouring agreement areas; it references them by name
+# and re-asserts none of the literals those areas already own. The forbidden
+# needles are assembled at run time from separate fragments so this assertion's
+# own source does not contain them contiguously and cannot match itself. The
+# name references are checked against the file header only, so the check is not
+# satisfied by the assertion text below.
+
+FIG_HEAD="$(sed -n '1,40p' "$FIG_SELF" 2>/dev/null)"
+
+for fig_area in 10-readiness 20-lifecycle 80-cycle-fixture 85-conflict-guards \
+  87-backtrack-guards 88-renumber-sweep 90-packaging 96-signature-sweep; do
+  if printf '%s\n' "$FIG_HEAD" | grep -qF -- "$fig_area"; then
+    ok "AC30 no-duplication: references tests/checks/$fig_area.sh by name"
+  else
+    bad "AC30 no-duplication: does not reference tests/checks/$fig_area.sh by name"
+  fi
+done
+
+if printf '%s\n' "$FIG_HEAD" | grep -qF -- '0001-recursive-structure-guard'; then
+  ok "AC30 no-duplication: references the structure guard 0001-recursive-structure-guard by name"
+else
+  bad "AC30 no-duplication: does not reference the structure guard 0001-recursive-structure-guard by name"
+fi
+
+fig_no_dup() {  # $1 forbidden literal, $2 owning area
+  if grep -qF -- "$1" "$FIG_SELF" 2>/dev/null; then
+    bad "AC30 no-duplication: re-asserts a literal owned by $2"
+  else
+    ok "AC30 no-duplication: does not re-assert a literal owned by $2"
+  fi
+}
+
+# 10-readiness — the readiness derivation and shipped-signal literals.
+fig_nd_a1='satisfied('
+fig_nd_a2='dep_local_id)'
+fig_no_dup "$fig_nd_a1$fig_nd_a2" 'tests/checks/10-readiness.sh'
+fig_nd_b1='presence is the sole'
+fig_nd_b2='shipped signal'
+fig_no_dup "$fig_nd_b1 $fig_nd_b2" 'tests/checks/10-readiness.sh'
+
+# 20-lifecycle — the derived-state table cells.
+fig_nd_c1='No spec'
+fig_nd_c2='.md?'
+fig_no_dup "$fig_nd_c1$fig_nd_c2" 'tests/checks/20-lifecycle.sh'
+
+# 80-cycle-fixture — the CYCLIC-DEP diagnostic and roadmap.md migration guard.
+fig_nd_d1='unexpected roadmap.md'
+fig_nd_d2='fixture set'
+fig_no_dup "$fig_nd_d1 $fig_nd_d2" 'tests/checks/80-cycle-fixture.sh'
+
+# 85-conflict-guards — the declared-conflict target grammar.
+fig_nd_e1='SiblingOrItem'
+fig_nd_e2='Ref'
+fig_no_dup "$fig_nd_e1$fig_nd_e2" 'tests/checks/85-conflict-guards.sh'
+
+# 87-backtrack-guards — the backtrack/reopen record literals.
+fig_nd_i1='resolves: '
+fig_nd_i2='Finding'
+fig_no_dup "$fig_nd_i1$fig_nd_i2" 'tests/checks/87-backtrack-guards.sh'
+
+# 88-renumber-sweep — the renumber prose rewrite lists.
+fig_nd_f1='no reference to the old'
+fig_nd_f2='canonical reference remains'
+fig_no_dup "$fig_nd_f1 $fig_nd_f2" 'tests/checks/88-renumber-sweep.sh'
+
+# 90-packaging — the duplicated inventory / count fact.
+fig_nd_g1='README '
+fig_nd_g2='Layout'
+fig_no_dup "$fig_nd_g1$fig_nd_g2" 'tests/checks/90-packaging.sh'
+
+# 96-signature-sweep — the command usage-string literals.
+fig_nd_h1='/build [item-ref'
+fig_nd_h2=' or task-id]'
+fig_no_dup "$fig_nd_h1$fig_nd_h2" 'tests/checks/96-signature-sweep.sh'
diff --git a/tests/fixtures/recursive-integrity/items/9201-clean/0001-leaf/.gitkeep b/tests/fixtures/recursive-integrity/items/9201-clean/0001-leaf/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9201-clean/manifest.md b/tests/fixtures/recursive-integrity/items/9201-clean/manifest.md
new file mode 100644
index 0000000..334dba8
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9201-clean/manifest.md
@@ -0,0 +1,35 @@
+---
+feature: 9201-clean
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Manifest — Fixture clean node
+
+## Initiative
+
+A committed test fixture, not a real work item. Its `Children` table is integral:
+every row resolves to its child directory, so the recursive merge-integrity
+evaluation guarded by `tests/checks/91-integrity-guard.sh` (`AC30`) reports no
+finding for it. It lives under `tests/`, never under the item tree, and is
+read-only.
+
+## Assumptions
+
+- Fixture data only; never shipped and never executed by `/status`.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-leaf | Clean leaf | Fixture scope for an integral node. | — | — | 9201-clean/0001-leaf |
+
+## Sequencing
+
+1. 0001-leaf
+
+## Open issues
+
+- None. The fixture is deliberately integral so the guard reports no finding.
diff --git a/tests/fixtures/recursive-integrity/items/9202-graph-faults/0001-present/.gitkeep b/tests/fixtures/recursive-integrity/items/9202-graph-faults/0001-present/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9202-graph-faults/0003-dangling/.gitkeep b/tests/fixtures/recursive-integrity/items/9202-graph-faults/0003-dangling/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9202-graph-faults/0004-withdrawn/.gitkeep b/tests/fixtures/recursive-integrity/items/9202-graph-faults/0004-withdrawn/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9202-graph-faults/0005-unlisted/.gitkeep b/tests/fixtures/recursive-integrity/items/9202-graph-faults/0005-unlisted/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9202-graph-faults/manifest.md b/tests/fixtures/recursive-integrity/items/9202-graph-faults/manifest.md
new file mode 100644
index 0000000..3bb539e
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9202-graph-faults/manifest.md
@@ -0,0 +1,42 @@
+---
+feature: 9202-graph-faults
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Manifest — Fixture structural graph faults
+
+## Initiative
+
+A committed test fixture, not a real work item. Its `Children` table and child
+directories deliberately exercise three structural graph faults — a row whose
+child directory is absent (`MISSING-CHILD`), a child directory absent from the
+table (`UNLISTED-CHILD`), and a `Depends on` local id that names no row and no
+directory (`DANGLING-DEP`) — plus a deliberate withdrawal that is report-only.
+It lives under `tests/`, never under the item tree, and is read-only.
+
+## Assumptions
+
+- Fixture data only; never shipped and never executed by `/status`.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-present | Present child | Row and directory both present. | — | — | 9202-graph-faults/0001-present |
+| 0002-missing | Missing child | Row whose child directory is absent. | — | — | 9202-graph-faults/0002-missing |
+| 0003-dangling | Dangling child | Depends on a local id with no row and no directory. | 0099-ghost | — | 9202-graph-faults/0003-dangling |
+
+## Sequencing
+
+1. 0001-present
+2. 0003-dangling
+
+## Open issues
+
+- **Withdrawn child — `0004-withdrawn`.** Withdrawn by user decision on 2026-10-14
+  and removed from the Children table and Sequencing above. Its directory
+  `9202-graph-faults/0004-withdrawn/` and spent local number are preserved; the
+  number is never reused. Rationale: fixture withdrawal. Former scope: fixture.
diff --git a/tests/fixtures/recursive-integrity/items/9203-spelling-both/0001-leaf/.gitkeep b/tests/fixtures/recursive-integrity/items/9203-spelling-both/0001-leaf/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9203-spelling-both/manifest.md b/tests/fixtures/recursive-integrity/items/9203-spelling-both/manifest.md
new file mode 100644
index 0000000..6b0f725
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9203-spelling-both/manifest.md
@@ -0,0 +1,36 @@
+---
+feature: 9203-spelling-both
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Manifest — Fixture dual manifest spelling
+
+## Initiative
+
+A committed test fixture, not a real work item. It holds both a modern
+`manifest.md` and the deprecated `roadmap.md` alias so the merge-integrity
+evaluation reports a `DRIFT-FACT` and treats this file as authoritative without
+merging, normalizing, or deleting the other. It lives under `tests/`, never
+under the item tree, and is read-only.
+
+## Assumptions
+
+- Fixture data only; the redundant `roadmap.md` is deliberate drift, never
+  auto-repaired.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-leaf | Drift leaf | Row and directory present on the dual-spelling node. | — | — | 9203-spelling-both/0001-leaf |
+
+## Sequencing
+
+1. 0001-leaf
+
+## Open issues
+
+- Deliberate dual spelling: `manifest.md` and `roadmap.md` both present.
diff --git a/tests/fixtures/recursive-integrity/items/9203-spelling-both/roadmap.md b/tests/fixtures/recursive-integrity/items/9203-spelling-both/roadmap.md
new file mode 100644
index 0000000..bfaf492
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9203-spelling-both/roadmap.md
@@ -0,0 +1,35 @@
+---
+feature: 9203-spelling-both
+phase: roadmap
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Roadmap — Fixture legacy alias kept alongside the modern manifest
+
+## Initiative
+
+A committed test fixture, not a real work item. This deprecated-alias spelling is
+deliberately retained beside the node's `manifest.md` so the merge-integrity
+evaluation reports a `DRIFT-FACT`; the modern spelling stays authoritative and
+this file is never merged, normalized, or deleted. It lives under `tests/`, never
+under the item tree, and is read-only.
+
+## Assumptions
+
+- Fixture data only; the redundancy is deliberate drift.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-leaf | Drift leaf | Row and directory present on the dual-spelling node. | — | — | 9203-spelling-both/0001-leaf |
+
+## Sequencing
+
+1. 0001-leaf
+
+## Open issues
+
+- None beyond the deliberate dual spelling recorded on the modern manifest.
diff --git a/tests/fixtures/recursive-integrity/items/9204-phase-mismatch/0001-leaf/.gitkeep b/tests/fixtures/recursive-integrity/items/9204-phase-mismatch/0001-leaf/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9204-phase-mismatch/manifest.md b/tests/fixtures/recursive-integrity/items/9204-phase-mismatch/manifest.md
new file mode 100644
index 0000000..deae6d9
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9204-phase-mismatch/manifest.md
@@ -0,0 +1,35 @@
+---
+feature: 9204-phase-mismatch
+phase: roadmap
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Manifest — Fixture phase/spelling mismatch
+
+## Initiative
+
+A committed test fixture, not a real work item. Its file is named for the modern
+`manifest.md` spelling but its declared `phase` value is the deprecated `roadmap`
+token, so the merge-integrity evaluation reports the spelling/`phase`
+disagreement as `DRIFT-FACT` and never silently normalizes it. It lives under
+`tests/`, never under the item tree, and is read-only.
+
+## Assumptions
+
+- Fixture data only; the mismatch is deliberate drift, never auto-repaired.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-leaf | Mismatch leaf | Row and directory present. | — | — | 9204-phase-mismatch/0001-leaf |
+
+## Sequencing
+
+1. 0001-leaf
+
+## Open issues
+
+- Deliberate mismatch: `manifest.md` spelling with `phase: roadmap`.
diff --git a/tests/fixtures/recursive-integrity/items/9210-dup-a/0001-x/.gitkeep b/tests/fixtures/recursive-integrity/items/9210-dup-a/0001-x/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9210-dup-a/manifest.md b/tests/fixtures/recursive-integrity/items/9210-dup-a/manifest.md
new file mode 100644
index 0000000..03d99c6
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9210-dup-a/manifest.md
@@ -0,0 +1,34 @@
+---
+feature: 9210-dup-a
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Manifest — Fixture top-level duplicate prefix A
+
+## Initiative
+
+A committed test fixture, not a real work item. Together with `9210-dup-b` it
+forms a top-level `NNNN` prefix collision (`DUPLICATE-PREFIX`) at the root of the
+recursive tree. It lives under `tests/`, never under the item tree, and is
+read-only.
+
+## Assumptions
+
+- Fixture data only; the shared `9210` prefix is deliberate.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-x | A leaf | Fixture scope for the duplicate-prefix pair. | — | — | 9210-dup-a/0001-x |
+
+## Sequencing
+
+1. 0001-x
+
+## Open issues
+
+- Deliberate top-level duplicate prefix with `9210-dup-b`.
diff --git a/tests/fixtures/recursive-integrity/items/9210-dup-b/0001-y/.gitkeep b/tests/fixtures/recursive-integrity/items/9210-dup-b/0001-y/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9210-dup-b/manifest.md b/tests/fixtures/recursive-integrity/items/9210-dup-b/manifest.md
new file mode 100644
index 0000000..bf24f0b
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9210-dup-b/manifest.md
@@ -0,0 +1,34 @@
+---
+feature: 9210-dup-b
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Manifest — Fixture top-level duplicate prefix B
+
+## Initiative
+
+A committed test fixture, not a real work item. Together with `9210-dup-a` it
+forms a top-level `NNNN` prefix collision (`DUPLICATE-PREFIX`) at the root of the
+recursive tree. It lives under `tests/`, never under the item tree, and is
+read-only.
+
+## Assumptions
+
+- Fixture data only; the shared `9210` prefix is deliberate.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-y | B leaf | Fixture scope for the duplicate-prefix pair. | — | — | 9210-dup-b/0001-y |
+
+## Sequencing
+
+1. 0001-y
+
+## Open issues
+
+- Deliberate top-level duplicate prefix with `9210-dup-a`.
diff --git a/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/.gitkeep b/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/0001-alpha/.gitkeep b/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/0001-alpha/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/0001-beta/.gitkeep b/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/0001-beta/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/manifest.md b/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/manifest.md
new file mode 100644
index 0000000..6ac8438
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9211-deep/0001-mid/manifest.md
@@ -0,0 +1,37 @@
+---
+feature: 9211-deep/0001-mid
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+parent: 9211-deep
+---
+
+# Manifest — Fixture depth-three collision node
+
+## Initiative
+
+A committed test fixture, not a real work item. Its two immediate children
+`0001-alpha` and `0001-beta` share the local `0001` prefix, forming a
+`DUPLICATE-CHILD` collision at depth three. It lives under `tests/`, never under
+the item tree, and is read-only.
+
+## Assumptions
+
+- Fixture data only; the same-parent collision is deliberate.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-alpha | Alpha grandchild | First colliding grandchild. | — | — | 9211-deep/0001-mid/0001-alpha |
+| 0001-beta | Beta grandchild | Second colliding grandchild. | — | — | 9211-deep/0001-mid/0001-beta |
+
+## Sequencing
+
+1. 0001-alpha
+2. 0001-beta
+
+## Open issues
+
+- Deliberate same-parent `0001` collision between the two grandchildren.
diff --git a/tests/fixtures/recursive-integrity/items/9211-deep/manifest.md b/tests/fixtures/recursive-integrity/items/9211-deep/manifest.md
new file mode 100644
index 0000000..b25eecf
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9211-deep/manifest.md
@@ -0,0 +1,36 @@
+---
+feature: 9211-deep
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Manifest — Fixture depth-three collision root
+
+## Initiative
+
+A committed test fixture, not a real work item. Its child `0001-mid` is itself a
+decomposing node whose two children (`0001-alpha`, `0001-beta`) share a local
+`0001` prefix, so the collision sits at depth three and is detected only by a
+recursive scan that evaluates each node against its own immediate children. It
+lives under `tests/`, never under the item tree, and is read-only.
+
+## Assumptions
+
+- Fixture data only; the depth-three collision is deliberate.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-mid | Intermediate node | A nested decomposing node carrying the colliding grandchildren. | — | — | 9211-deep/0001-mid |
+
+## Sequencing
+
+1. 0001-mid
+
+## Open issues
+
+- Deliberate same-parent collision between the intermediate node's children at
+  depth three.
diff --git a/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0002-new/0001-leaf/spec.md b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0002-new/0001-leaf/spec.md
new file mode 100644
index 0000000..edab723
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0002-new/0001-leaf/spec.md
@@ -0,0 +1,37 @@
+---
+feature: 9220-renamed-parent/0002-new/0001-leaf
+phase: spec
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+parent: 9220-renamed-parent/0002-new
+---
+
+# Fixture spec — 9220-renamed-parent/0002-new/0001-leaf
+
+A committed test fixture, not a real work item. Its `feature:` and `parent:`
+values both carry the new path produced by a completed whole-subtree renumber,
+so the renumber guard (`tests/checks/91-integrity-guard.sh`, AC30) can assert
+every descendant artifact's reference was rewritten.
+
+## Problem
+
+Fixture only.
+
+## Goals
+
+- Carry the new canonical reference after the renumber.
+
+## Non-goals
+
+- None.
+
+## User stories
+
+- **As a** fixture, **I want** the new reference, **so that** the renumber guard
+  can assert it.
+
+## Acceptance criteria
+
+1. **AC1** — Given the fixture, when it is scanned, then only the new reference
+   is present.
diff --git a/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0002-new/manifest.md b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0002-new/manifest.md
new file mode 100644
index 0000000..31aeeae
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0002-new/manifest.md
@@ -0,0 +1,37 @@
+---
+feature: 9220-renamed-parent/0002-new
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+parent: 9220-renamed-parent
+---
+
+# Manifest — Fixture intermediate manifest on the changed path
+
+## Initiative
+
+A committed test fixture, not a real work item. It is the **intermediate
+manifest** on the changed path of a completed whole-subtree renumber: its own
+`Children` row's `Canonical reference` cell already carries the new path, so the
+renumber guard (`tests/checks/91-integrity-guard.sh`, AC30) can assert the
+intermediate manifest is not left stale. It lives under `tests/`, never under the
+item tree, and is read-only.
+
+## Assumptions
+
+- Fixture data only; the new reference is deliberate and complete.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0001-leaf | Renamed leaf | A descendant artifact whose `feature:` and `parent:` values carry the new path. | — | — | 9220-renamed-parent/0002-new/0001-leaf |
+
+## Sequencing
+
+1. 0001-leaf
+
+## Open issues
+
+- None. The intermediate manifest already names the new canonical reference.
diff --git a/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0003-follower/design.md b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0003-follower/design.md
new file mode 100644
index 0000000..6d1b565
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0003-follower/design.md
@@ -0,0 +1,45 @@
+---
+feature: 9220-renamed-parent/0003-follower
+phase: design
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+parent: 9220-renamed-parent
+conflicts-with: "0002-new"
+---
+
+# Fixture design — 9220-renamed-parent/0003-follower
+
+A committed test fixture, not a real work item. Its `conflicts-with` declaration
+names the new local id `0002-new` (formerly the old local id) as a sibling
+target, so the renumber guard (`tests/checks/91-integrity-guard.sh`, AC30) can
+assert the declaration reference was rewritten by a completed whole-subtree
+renumber.
+
+## Summary
+
+Fixture only: the declared target was updated from the old local id to the new.
+
+## Approach
+
+None; fixture data.
+
+## Alternatives considered
+
+- None.
+
+## Interfaces and data model
+
+None.
+
+## Affected areas
+
+None.
+
+## Risks and mitigations
+
+- None.
+
+## Test strategy
+
+Pin the rewritten `conflicts-with` reference.
diff --git a/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0003-follower/ship.md b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0003-follower/ship.md
new file mode 100644
index 0000000..9671a94
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/0003-follower/ship.md
@@ -0,0 +1,25 @@
+---
+feature: 9220-renamed-parent/0003-follower
+phase: ship
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+parent: 9220-renamed-parent
+---
+
+# Ship record — 9220-renamed-parent/0003-follower
+
+A committed test fixture, not a real work item. Its recorded branch/handoff path
+names the new canonical reference produced by a completed whole-subtree
+renumber, so the renumber guard (`tests/checks/91-integrity-guard.sh`, AC30) can
+assert the shipped path was rewritten and no reference to the old canonical
+reference remains.
+
+- Branch: `ship/9220-renamed-parent+0002-new`
+- PR: not created (fixture)
+- Commits: fixture
+
+## Reconcile
+
+- Result: no-op (fixture).
+- Re-verification: not applicable (fixture).
diff --git a/tests/fixtures/recursive-integrity/items/9220-renamed-parent/manifest.md b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/manifest.md
new file mode 100644
index 0000000..9786aa1
--- /dev/null
+++ b/tests/fixtures/recursive-integrity/items/9220-renamed-parent/manifest.md
@@ -0,0 +1,42 @@
+---
+feature: 9220-renamed-parent
+phase: manifest
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+# Manifest — Fixture completed whole-subtree renumber
+
+## Initiative
+
+A committed test fixture, not a real work item. It represents a **completed**
+whole-subtree renumber: the child formerly numbered `0001-*` now exists as the
+new local id `0002-new`, and its old local id and old canonical reference appear
+nowhere in the fixture. Its `Children` table already carries the rewritten `Local
+id` and `Canonical reference` cells, and the sibling `0003-follower`'s `Depends
+on` cell already names the new local id, so the renumber guard
+(`tests/checks/91-integrity-guard.sh`, AC30) can assert the rewrite is complete
+by a recursive literal scan. It lives under `tests/`, never under the item tree,
+and is read-only.
+
+## Assumptions
+
+- Fixture data only; the renumber is complete and deliberate, never re-applied.
+
+## Children
+
+| Local id | Title | Scope | Depends on | conflicts-with | Canonical reference |
+| -------- | ----- | ----- | ---------- | -------------- | ------------------- |
+| 0002-new | Renamed node | The renumbered node, formerly the old local id, now an intermediate decomposing manifest on the changed path. | — | — | 9220-renamed-parent/0002-new |
+| 0003-follower | Follower node | A sibling whose `Depends on`, declared conflict, and ship path name the new local id. | 0002-new | — | 9220-renamed-parent/0003-follower |
+
+## Sequencing
+
+1. 0002-new
+2. 0003-follower
+
+## Open issues
+
+- None. The fixture is a completed renumber: no stale reference to the old local
+  id or old canonical reference remains.
diff --git a/tests/mutation.sh b/tests/mutation.sh
index ce3fccd..f0d2686 100755
--- a/tests/mutation.sh
+++ b/tests/mutation.sh
@@ -119,6 +119,7 @@ stage_copy() {  # $1 = destination copy root
   cp -R "$REPO_ROOT/tests/fixtures/cyclic-roadmap" "$copy/tests/fixtures/cyclic-roadmap"
   cp -R "$REPO_ROOT/tests/fixtures/declared-conflicts" "$copy/tests/fixtures/declared-conflicts"
   cp -R "$REPO_ROOT/tests/fixtures/backtracking" "$copy/tests/fixtures/backtracking"
+  cp -R "$REPO_ROOT/tests/fixtures/recursive-integrity" "$copy/tests/fixtures/recursive-integrity"
   cp -R "$REPO_ROOT/tests/fixtures/recursive-structure" "$copy/tests/fixtures/recursive-structure"
 }
 
diff --git a/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/backtracks.md b/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/backtracks.md
new file mode 100644
index 0000000..befce82
--- /dev/null
+++ b/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/backtracks.md
@@ -0,0 +1,146 @@
+---
+feature: 0015-recursive-workflow-guards/0004-recursive-integrity-guard
+record: backtracks
+created: 2026-10-14
+updated: 2026-10-14
+---
+
+## Finding 1 — 2026-10-14
+
+- detecting phase: `/build`
+- target phase: `/plan`
+- affected: `design.md`, `tasks.md`
+- evidence: `design.md:59` mandates a fixture node `9203-spelling-both/` holding
+  **both** `manifest.md` and the deprecated `roadmap.md` alias, and `tasks.md:17`
+  (`T1`) instructs authoring it, with `T1`'s `Verify:` (`tasks.md:18`) requiring
+  `bash tests/run.sh` to exit 0. But the committed area
+  `tests/checks/80-cycle-fixture.sh:66-71` (`AC13`, the `0012-roadmap-deprecation`
+  migration guard) asserts that `find tests/fixtures -name roadmap.md` returns
+  exactly one path — `tests/fixtures/cyclic-roadmap/roadmap.md` — and fails
+  otherwise. After authoring the `T1` fixture, `bash tests/run.sh` prints
+  `FAIL  AC13 unexpected roadmap.md fixture set (AC3):
+  tests/fixtures/cyclic-roadmap/roadmap.md
+  tests/fixtures/recursive-integrity/items/9203-spelling-both/roadmap.md`
+  (`TOTAL: 502 passed, 1 failed`) and exits 1. Verified the assertion is unchanged
+  on `origin/main`, and it is the only whole-fixture-set `roadmap.md` assertion in
+  the suite. This contradicts `spec.md` AC11 ("every existing agreement area still
+  passes") and the design's own "Backward compatibility … `bash tests/run.sh` …
+  stay green". The builder cannot resolve it in scope: `spec.md`'s non-goals
+  forbid re-pinning what the existing areas own (the cycle area), and the design's
+  "Affected areas" lists only `tests/checks/89-integrity-guard.sh`,
+  `tests/fixtures/recursive-integrity/**`, and `tests/mutation.sh`. The design's
+  §"Affected areas"/backward-compatibility claim is therefore inconsistent with
+  its §"Fixture tree (integrity half)".
+- status: open
+
+Recorded by the `/build` phase while selecting `T1`; the `design.md`, `tasks.md`,
+and `spec.md` artifacts owned by other phases were not edited, and `T1` remains
+unchecked. Nothing downstream was stale-marked on this item: `verify.md` and
+`review.md` do not exist, and `design.md`/`tasks.md` are the found-against target
+artifacts (revised, not marked). The sanctioned route is
+`/plan 0015-recursive-workflow-guards/0004-recursive-integrity-guard` to
+reconcile the dual-spelling fixture with the committed `AC13` whole-set assertion
+— for example by scoping an update to `tests/checks/80-cycle-fixture.sh` to this
+item (or to a sibling guard), by moving the deliberate drift alias out of the
+`tests/fixtures/**` `find` root, or by having the plan state which phase owns the
+assertion's relaxation — so that `bash tests/run.sh` exits 0 with the fixture
+present. The `9204-phase-mismatch` node already exercises AC4's "manifest
+spelling disagrees with its declared `phase` value" arm; the open question the
+plan must settle is how (or whether) to keep the "both manifest spellings" arm
+without breaking the committed migration guard.
+
+## Resolution 1 — 2026-10-14
+
+- resolves: Finding 1
+- revision: The plan now owns the reconciliation instead of leaving the
+  dual-spelling fixture and the committed AC13 guard in conflict. `design.md`
+  gains a "Reconciling the deliberate dual-spelling fixture with the committed
+  AC13 guard" subsection that narrows `tests/checks/80-cycle-fixture.sh`'s AC13
+  whole-set `roadmap.md` assertion to exclude the one documented deliberate path
+  `tests/fixtures/recursive-integrity/items/9203-spelling-both/roadmap.md`
+  (`find … -name roadmap.md | grep -vxF <path>`), keeping the remainder's
+  exact-equality against the retained cyclic alias so any *third* alias still
+  fails; the cycle diagnostic and `job_8` are untouched. The edit is a focused
+  single-item change, not a shared append-only registry, so `design.md`'s
+  `conflicts-with` stays the parent cell's two registries (`tests/README.md`,
+  `tests/mutation.sh`) and no `DRIFT-FACT` is created. "Affected areas",
+  "Backward compatibility" (no longer "purely additive"), the "AC13 migration
+  guard weakened" risk, and the AC4/AC11 test-strategy rows were updated.
+  `tasks.md` inserts a new first task `T1` (narrow the AC13 assertion, verified
+  green independently and sensitive to a scratch third alias) and renumbers the
+  fixture/check/staging tasks to `T2`–`T9`, with the integrity-fixture task now
+  depending on `T1` and its `Verify:` requiring `bash tests/run.sh` to exit 0 with
+  the dual-spelling fixture present.   `spec.md` was not edited; no artifact was
+  marked `stale:` (none was downstream of `/plan`).
+
+## Finding 2 — 2026-10-14
+
+- detecting phase: `/build`
+- target phase: `/plan`
+- affected: `design.md`, `tasks.md`
+- evidence: `review.md` [M1] found the new agreement area
+  `tests/checks/89-integrity-guard.sh` collides on its numeric prefix with the
+  already-merged sibling `tests/checks/89-recursive-status-guards.sh`
+  (confirmed present on `origin/main` via `git show origin/main:tests/checks`),
+  so once both merge two distinct areas share the `89-` stem.
+  `tests/README.md` → "Area selection" (`tests/README.md:43-50`) defines a
+  name-prefix selector matching two or more areas as a **setup error**
+  ("ambiguous" — one matching none is "unknown"), so `FRAMEWORK_TEST_AREAS=89`
+  (and any `89` prefix selector) exits 2; the suite's selector convention is a
+  unique stem. `design.md:36` and `design.md:224` fix the filename
+  `tests/checks/89-integrity-guard.sh`, and `tasks.md:12-16` states the check
+  filename "is fixed by `design.md`; no task below re-decides them", so `/build`
+  may not rename it. The design's own risk note (`design.md:275-279`) accepted the
+  collision as "only an area-selector ambiguity, not a suite failure"; the review
+  found that acceptance wrong and the collision unresolved in the committed
+  state, since `0005-guard-registration-sweep`'s scope
+  (`work/0015-recursive-workflow-guards/manifest.md:127`) covers only the
+  `tests/README.md` Checks row and the mutation jobs, not renaming this area's
+  check. The design's chosen check filename and its risk handling are therefore
+  wrong and must be revised by their owner — for example to the free prefix
+  `tests/checks/91-integrity-guard.sh`, keeping the `AC30` token and sub-area
+  labels unchanged — not re-decided by `/build`.
+- status: open
+
+Recorded by the `/build` phase while addressing `review.md` [M1]. The
+`design.md`, `tasks.md`, and `spec.md` artifacts owned by other phases were not
+edited; the completed tasks in `tasks.md` were left checked — the fault is a
+design-chosen filename (the area name is `design.md`'s declared public surface
+for `0005`), not an unimplemented task, and the `/plan` revision owns the
+`tasks.md` update. The review's rename recommendation changes that design-fixed
+interface, so the sanctioned route is
+`/plan 0015-recursive-workflow-guards/0004-recursive-integrity-guard`. Per the
+reverse-edge rule, the downstream artifacts `verify.md` and `review.md` are marked
+`stale: design` in their frontmatter; both remain on disk, recoverable, and are
+re-run forward after the revision.
+
+## Resolution 2 — 2026-10-14
+
+- resolves: Finding 2
+- revision: The plan renames the new area off the collided `89-` numeric stem to
+  the free `91-integrity-guard.sh` instead of leaving the collision for `0005`
+  (whose scope covers only the `tests/README.md` row and the mutation jobs).
+  `design.md` updates the Summary, Approach ("New agreement area"), Interfaces,
+  Affected areas, and the test-strategy selector strings to the `91-` name;
+  rewrites the former "Filename/prefix collision" risk — whose "only an
+  area-selector ambiguity, not a suite failure" acceptance the review correctly
+  found wrong — into a resolved-by-rename risk plus a leftover-reference risk;
+  adds a "Defer the area rename to `0005`" rejected alternative; and adds a
+  "Renaming the area off the collided `89-` stem" subsection that verifies the
+  `91-` stem is free against `origin/main:tests/checks` and enumerates the full
+  reference sweep — the check file's own name, its `FIG_SELF` resolver, its
+  `.opencode/` self-reference scan literal, its header comment, the
+  `tests/checks/80-cycle-fixture.sh:66` AC13 cross-reference, and the six
+  fixture-prose references under `tests/fixtures/recursive-integrity/` (the
+  review named only three of these). The `AC30` token and every sub-area label
+  are unchanged, so the `0005` mapping surface is untouched. `tasks.md` updates
+  the fixed-filename preamble, folds the rename and the full sweep into `T4`
+  (adding `grep -rF '89-integrity-guard' tests/` prints nothing to its
+  `Verify:`), updates the `T5`–`T7`/`T9` `Verify:` selectors to
+  `91-integrity-guard`, and re-opens `T4`–`T7` and `T9` (their deliverables or
+  verification named the old area); `T1`–`T3` and `T8` stay checked — their
+  substantive deliverables are unchanged and `T4` sweeps the incidental
+  references in their files. `spec.md` was not edited. No artifact was marked
+  `stale:` by this revision: `design.md`/`tasks.md` are the found-against target
+  (revised, not marked), and `verify.md`/`review.md` already carry the
+  reverse-edge `stale: design` marker, which their owning phases clear on re-run.
diff --git a/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/review.md b/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/review.md
new file mode 100644
index 0000000..f1c4251
--- /dev/null
+++ b/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/review.md
@@ -0,0 +1,128 @@
+---
+feature: 0015-recursive-workflow-guards/0004-recursive-integrity-guard
+phase: review
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+parent: 0015-recursive-workflow-guards
+---
+
+# Review — Committed recursive merge-integrity and renumber guards
+
+## Verdict
+
+**approve** — the change is correct, well-scoped, and every acceptance criterion
+is met; the prior review's only finding (the `89-` area-prefix collision) is
+resolved by the plan revision's rename to the free `91-` stem, and no finding of
+any severity survives this pass.
+
+## Challenges adjudicated
+
+None. `work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/challenges.md`
+does not exist, so there is no open challenge against any `review.md` finding to
+adjudicate. This is the forward re-review after the `/plan` revision recorded as
+`backtracks.md` Resolution 2; the on-disk `review.md` was `stale: design` and is
+superseded by this fresh pass, which clears that marker.
+
+## Base ref and diff
+
+The implementation is **uncommitted** on the plan branch; `HEAD` is the plan
+commit and equals the merge base with `origin/main`, so `origin/main...HEAD`
+carries no code change. The reviewable change is the working tree versus `HEAD`
+plus the untracked files.
+
+| Command | Result |
+| ------- | ------ |
+| `git rev-parse HEAD` | `39738ecc7b15501753585007c5e5f0df4e25c514` |
+| `git merge-base HEAD origin/main` | `39738ec` (== `HEAD`) |
+| `git log --oneline HEAD..origin/main` | 22 commits — siblings `0001`/`0002`/`0003` and their plan/publication merges |
+| `git diff HEAD --stat` | `tests/checks/80-cycle-fixture.sh` (+15/-6), `tests/mutation.sh` (+1), `work/.../tasks.md` (+5/-5) |
+| `git status --porcelain` | the 3 modified files above, plus untracked `tests/checks/91-integrity-guard.sh`, `tests/fixtures/recursive-integrity/`, `work/.../backtracks.md`, `work/.../verify.md`, `work/.../review.md` |
+| `git show origin/main:tests/checks` | siblings present incl. `81-recursive-structure-guard.sh`, `89-recursive-status-guards.sh`; no `91-` area |
+
+I read the full new check (`tests/checks/91-integrity-guard.sh`, 805 lines), all
+25 committed fixture files, the two changed test files, the sibling guards on
+`origin/main`, and the four authority surfaces the area pins (`docs/workflow.md`
+→ `### Merge-integrity guard`, `.opencode/skill/merge-conflict/SKILL.md`,
+`docs/artifact-conventions.md` → `### Renumbering after a parallel merge`,
+`tests/checks/88-renumber-sweep.sh`). The sandbox denies executing the suite, so
+the suite result is the tester's evidence plus my static trace (see "Not
+reviewed").
+
+## Findings
+
+### Blockers
+
+- None.
+
+### Major
+
+- None.
+
+### Minor
+
+- None.
+
+### Nits
+
+- None.
+
+## Questions (non-blocking; recorded, not classified)
+
+- **`DANGLING-DEP` predicate breadth.** The authority defines `DANGLING-DEP` as a
+  `Depends on` naming a local id with no child directory **or** no table row
+  (`docs/workflow.md` → "Merge-integrity guard" invariant table;
+  `.opencode/skill/merge-conflict/SKILL.md:121`). The area's predicate
+  (`tests/checks/91-integrity-guard.sh:237-250`) tests only the **row** half
+  (`fig_has_line "$rowids" "$d"`), so a `Depends on` naming an existing row whose
+  directory is absent is not reported; `design.md` describes the analyzer as
+  resolving against "rows **and** directories". `spec.md` AC3 words its sample as
+  a local id that "names no row and no directory" (`0099-ghost`), which is
+  exercised, so the criterion is met. Is the narrower predicate the intended pin,
+  or should the area also cover the "row present, directory absent" arm? Recorded
+  as a question, not a defect, because the spec's chosen sample does not require
+  the broader arm.
+- **Withdrawal-record fidelity.** The fixture records the deliberate withdrawal as
+  `9202-graph-faults/0004-withdrawn/`
+  (`tests/fixtures/recursive-integrity/items/9202-graph-faults/manifest.md:39-42`)
+  rather than the `manifest.md` template's `work/<parent>/<MMMM-slug>/` shape,
+  because the area's `read-only-contract` forbids the literal `work/` in the
+  fixture root. Recognition is a substring match
+  (`tests/checks/91-integrity-guard.sh:233`) and still works on the faithful
+  `work/<parent>/<child>/` shape. Is the divergence acceptable, or should the
+  fixture carry the faithful path with a read-only exemption? AC3's report-only
+  requirement holds either way.
+
+## Acceptance criteria coverage
+
+| Criterion | Result | Evidence |
+| --------- | ------ | -------- |
+| AC1 — fixture-based, fresh-clone safe, fails not skips | **met** | `AC30 fixture-existence` asserts the tree plus 14 required files (`91-integrity-guard.sh:645-675`); `AC30 read-only-contract` asserts no live `work/` path, no executable fixture file or self, no `.opencode/` reference (`:677-710`); no shell `exit`, `curl`, `wget`, `gh`, or writing redirection in the file. |
+| AC2 — independent per-node evaluation; depth-3 fault named | **met** | `fig_scan_node` recurses per node (`:177-268`); `EXP_DUP` carries the depth-3 `DUPLICATE-CHILD` and the attribution assertion (`:342-351`). I traced the analyzer over every fixture node and the three expected blocks reproduce exactly. |
+| AC3 — `MISSING-CHILD`/`UNLISTED-CHILD`/`DANGLING-DEP` + report-only withdrawal | **met** | `EXP_GRAPH` (`:327-332`) names all three; the `0004-withdrawn` directory is excluded from `UNLISTED-CHILD` by the open-issues record (`:228-235`, `:357-363`). |
+| AC4 — dual spelling + phase mismatch `DRIFT-FACT`; modern authoritative; no drop/merge | **met** | `EXP_DRIFT` (`:334-338`); the authoritative-resolver assertion (`:374-379`) and both-files-retained assertion (`:381-388`). |
+| AC5 — report-only / non-fatal / never-truncated / no-file-modified; clean tree empty | **met** | `fig_pin` pins the authority literals (`:452-465`) and skill literals (`:480-487`); the clean `9201-clean` node yields an empty block (`:489-503`). |
+| AC6 — sibling-owned invariants referenced, not re-pinned | **met** | Header references (`:21-29`); `AC30 no-duplication` header list plus 9 assembled forbidden-literal scans (`:731-805`). I confirmed none of the assembled needles occurs in the file. |
+| AC7 — completed whole-subtree renumber leaves no stale reference | **met** | Presence in all 9 rewrite positions (`:521-573`) plus recursive old-ref/old-local absence scans (`:575-593`); the fixture contains no `0001-old` (confirmed by search). |
+| AC8 — renumber assertion is sensitive | **met** | Reintroducing an old reference makes `fig_rn_scan_absent` emit `bad "AC30 renumber-sweep: ... leaked into ..."` (`:575-593`), so the area exits non-zero and names the sub-area; proven in scratch (`verify.md` M8). The committed mutation job is `0005`'s by design (`spec.md` AC10). |
+| AC9 — recursive renumber contract pins | **met** | The intermediate-manifest phrase is pinned on both surfaces (`:618-643`); the `88`-owned closing literal is not restated, per `AC30 no-duplication`. |
+| AC10 — stable token, sub-areas, mutation staging | **met** | Every emitted assertion is `AC30 <sub-area>`; all 9 declared sub-areas appear (73 assertions total, matching `verify.md`); `tests/mutation.sh:122` stages the fixture root and `AC30 mutation-staging` asserts it (`:712-729`). |
+| AC11 — no duplication; existing areas stay green | **met** (static + tester evidence) | The only suite edit besides the new area is the design-sanctioned narrowing of `80-cycle-fixture.sh`'s AC13 whole-set `roadmap.md` assertion, excluding exactly the one documented path (`80-cycle-fixture.sh:61-79`); the remainder still equals the retained cyclic alias, and I confirmed it is the only whole-fixture-set `roadmap.md` scan and that no sibling fixture root on `origin/main` adds a `roadmap.md` (so the merged tree has exactly the two expected aliases). Tester reports 576/0/0 and a 727-pass merged simulation; I did not re-run the suite. |
+| AC12 — scope and purity | **met** | Diff limited to `tests/**` plus this work item; no live doc, prompt, command, agent, skill, `phase` value, state file, or production checker; no new dependency, network, or `gh`. |
+
+## Not reviewed
+
+- **Independent suite execution.** The sandbox denies running `bash tests/run.sh`
+  / `tests/mutation.sh`, so AC11's "existing areas stay green" rests on the
+  tester's `verify.md` results and on my static trace (which I walked line by line
+  against the fixtures and the four authority surfaces it pins). The 727-pass
+  merged-tree simulation in `verify.md` was not reproduced.
+- **Pre-ship reconcile.** The branch is behind `origin/main`; the merge-forward —
+  including the declared class-(a) `tests/mutation.sh` staged-copy conflict that
+  must retain both the sibling's `recursive-structure` line and this item's
+  `recursive-integrity` line — and the post-merge integrity pass are the
+  shipper's and out of scope here.
+- **The `tests/README.md` Checks row and the per-rule mutation jobs** — deferred
+  to `0005-guard-registration-sweep` by `spec.md`/`design.md`.
+- **Manual/LLM-run residuals** (a live `/status` render, a real `/ship` reconcile,
+  an actual `git mv`, the renumber no-op) — documented, not executable in CI.
diff --git a/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/tasks.md b/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/tasks.md
index 3cd3bc4..90de025 100644
--- a/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/tasks.md
+++ b/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/tasks.md
@@ -39,15 +39,15 @@ sweeps the incidental area references in `T1`–`T3`'s files.
       the four child dirs; `grep -c '^| 0' tests/fixtures/recursive-integrity/items/9202-graph-faults/manifest.md` shows the rows).
 - [x] **T3** — Author the renumber fixture `9220-renamed-parent/`: `manifest.md` with a `0002-new` row (Local id + Canonical reference `9220-renamed-parent/0002-new`) and a `0003-follower` row with `Depends on: 0002-new`; the intermediate `0002-new/manifest.md`; a descendant `0001-leaf/spec.md` carrying the new `feature:` and `parent:` values; `0003-follower/design.md` with `conflicts-with: 0002-new`; and `0003-follower/ship.md` recording a handoff path naming the new reference. The old local id `0001-old` and old canonical reference `9220-renamed-parent/0001-old` must appear nowhere in the fixture. [AC7] [depends: T2]
       Verify: `bash tests/run.sh` exits 0 and `grep -rF '0001-old' tests/fixtures/recursive-integrity/` prints nothing (exit 1).
-- [ ] **T4** — Rename the area to `tests/checks/91-integrity-guard.sh` (off the collided `89-` stem) and sweep every reference: `mv tests/checks/89-integrity-guard.sh tests/checks/91-integrity-guard.sh`; set `FIG_SELF="$FIG_CHECKS_DIR/91-integrity-guard.sh"`; change the `.opencode/` self-reference scan literal to `91-integrity-guard`; update the header comment; and rewrite the remaining `89-integrity-guard` references — the `tests/checks/80-cycle-fixture.sh` AC13 cross-reference (`80-cycle-fixture.sh:66`) and the six fixture-prose references under `tests/fixtures/recursive-integrity/` — enumerated in `design.md` → "Renaming the area off the collided `89-` stem". Keep the header (naming the areas deferred to), the Bash 3.2-compatible helpers, and the recursive analyzer (`fig_manifest`, `fig_children_rows`, `fig_scan_node`, top-level prefix grouping) that emits normalized `CODE|offender[,offender]` findings into the three category blocks `fixture_duplicates`, `fixture_graph`, and `fixture_drift`; compare each against its reviewed expected block, labelled `AC30 per-node-eval`, `AC30 structural-graph`, and `AC30 spelling-drift`; assert the depth-3 collision is attributed to `9211-deep/0001-mid` and that `9202-graph-faults/0004-withdrawn` yields no `UNLISTED-CHILD` fault. [AC2] [AC3] [AC4] [depends: T2]
+- [x] **T4** — Rename the area to `tests/checks/91-integrity-guard.sh` (off the collided `89-` stem) and sweep every reference: `mv tests/checks/89-integrity-guard.sh tests/checks/91-integrity-guard.sh`; set `FIG_SELF="$FIG_CHECKS_DIR/91-integrity-guard.sh"`; change the `.opencode/` self-reference scan literal to `91-integrity-guard`; update the header comment; and rewrite the remaining `89-integrity-guard` references — the `tests/checks/80-cycle-fixture.sh` AC13 cross-reference (`80-cycle-fixture.sh:66`) and the six fixture-prose references under `tests/fixtures/recursive-integrity/` — enumerated in `design.md` → "Renaming the area off the collided `89-` stem". Keep the header (naming the areas deferred to), the Bash 3.2-compatible helpers, and the recursive analyzer (`fig_manifest`, `fig_children_rows`, `fig_scan_node`, top-level prefix grouping) that emits normalized `CODE|offender[,offender]` findings into the three category blocks `fixture_duplicates`, `fixture_graph`, and `fixture_drift`; compare each against its reviewed expected block, labelled `AC30 per-node-eval`, `AC30 structural-graph`, and `AC30 spelling-drift`; assert the depth-3 collision is attributed to `9211-deep/0001-mid` and that `9202-graph-faults/0004-withdrawn` yields no `UNLISTED-CHILD` fault. [AC2] [AC3] [AC4] [depends: T2]
       Verify: `FRAMEWORK_TEST_AREAS=91-integrity-guard bash tests/run.sh` exits 0 and prints the three `AC30` labelled blocks with no `FAIL`; `grep -rF '89-integrity-guard' tests/` prints nothing.
-- [ ] **T5** — Add the `report-only` sub-area: pin the non-fatal / never-truncated / not-auto-repaired / modifies-no-file contract on `docs/workflow.md` → "Merge-integrity guard" and the operational mirror `.opencode/skill/merge-conflict/SKILL.md`; assert the clean `9201-clean` node yields empty findings and does not error; and pin the recursive authority phrases (the invariant set is evaluated at every node; no node's check depends on another's; every node at every depth). Reference the pinned surfaces by path; restate no sibling literal. [AC5] [AC2] [depends: T4]
+- [x] **T5** — Add the `report-only` sub-area: pin the non-fatal / never-truncated / not-auto-repaired / modifies-no-file contract on `docs/workflow.md` → "Merge-integrity guard" and the operational mirror `.opencode/skill/merge-conflict/SKILL.md`; assert the clean `9201-clean` node yields empty findings and does not error; and pin the recursive authority phrases (the invariant set is evaluated at every node; no node's check depends on another's; every node at every depth). Reference the pinned surfaces by path; restate no sibling literal. [AC5] [AC2] [depends: T4]
       Verify: `FRAMEWORK_TEST_AREAS=91-integrity-guard bash tests/run.sh` exits 0 with the `AC30 report-only` lines present and passing.
-- [ ] **T6** — Add the `renumber-sweep` sub-area: assert the fixture's new directory exists and contains the new reference in each enumerated rewrite position (directory, `feature:`, `parent:`, owning manifest `Local id`/`Canonical reference`, intermediate manifest `Canonical reference`, `Depends on`, `conflicts-with`, ship path), and assert by a recursive literal scan that the old local id and old canonical reference appear nowhere under `tests/fixtures/recursive-integrity/`; pin that `docs/artifact-conventions.md` and `.opencode/skill/merge-conflict/SKILL.md` name the intermediate manifest on the changed path, referencing `tests/checks/88-renumber-sweep.sh` by name and restating none of its literals. [AC7] [AC8] [AC9] [depends: T3] [depends: T4]
+- [x] **T6** — Add the `renumber-sweep` sub-area: assert the fixture's new directory exists and contains the new reference in each enumerated rewrite position (directory, `feature:`, `parent:`, owning manifest `Local id`/`Canonical reference`, intermediate manifest `Canonical reference`, `Depends on`, `conflicts-with`, ship path), and assert by a recursive literal scan that the old local id and old canonical reference appear nowhere under `tests/fixtures/recursive-integrity/`; pin that `docs/artifact-conventions.md` and `.opencode/skill/merge-conflict/SKILL.md` name the intermediate manifest on the changed path, referencing `tests/checks/88-renumber-sweep.sh` by name and restating none of its literals. [AC7] [AC8] [AC9] [depends: T3] [depends: T4]
       Verify: `FRAMEWORK_TEST_AREAS=91-integrity-guard bash tests/run.sh` exits 0 with the `AC30 renumber-sweep` lines passing.
-- [ ] **T7** — Add the structural assertions: `fixture-existence` fails (never skips) when a required fixture file is missing; `read-only-contract` asserts the fixture references no live `work/` path and adds no committed executable checker; `mutation-staging` asserts `tests/mutation.sh`'s staged-copy list names `tests/fixtures/recursive-integrity`; `no-duplication` asserts the header references `10-readiness`, `20-lifecycle`, `80-cycle-fixture`, `85-conflict-guards`, `87-backtrack-guards`, `88-renumber-sweep`, `90-packaging`, `96-signature-sweep`, and the structure guard `0001-recursive-structure-guard` by name and re-asserts none of their owned literals. Every assertion carries the `AC30` token. [AC1] [AC6] [AC10] [AC11] [depends: T4]
+- [x] **T7** — Add the structural assertions: `fixture-existence` fails (never skips) when a required fixture file is missing; `read-only-contract` asserts the fixture references no live `work/` path and adds no committed executable checker; `mutation-staging` asserts `tests/mutation.sh`'s staged-copy list names `tests/fixtures/recursive-integrity`; `no-duplication` asserts the header references `10-readiness`, `20-lifecycle`, `80-cycle-fixture`, `85-conflict-guards`, `87-backtrack-guards`, `88-renumber-sweep`, `90-packaging`, `96-signature-sweep`, and the structure guard `0001-recursive-structure-guard` by name and re-asserts none of their owned literals. Every assertion carries the `AC30` token. [AC1] [AC6] [AC10] [AC11] [depends: T4]
       Verify: `FRAMEWORK_TEST_AREAS=91-integrity-guard bash tests/run.sh` exits 0 with the `fixture-existence`, `read-only-contract`, `mutation-staging`, and `no-duplication` lines present and passing.
 - [x] **T8** — Add the new fixture root to `tests/mutation.sh`'s `stage_copy()` as one additive `cp -R "$REPO_ROOT/tests/fixtures/recursive-integrity" "$copy/tests/fixtures/recursive-integrity"` line beside the existing fixture copies. Do not add mutation jobs or change `JOB_COUNT`; those remain `0005-guard-registration-sweep`'s. [AC10] [depends: T2]
       Verify: `bash tests/mutation.sh` exits 0 (the whole-suite clean copy passes with the fixture staged) and `grep -F 'recursive-integrity' tests/mutation.sh` matches the new line.
-- [ ] **T9** — Run the full suite and prove the renumber assertion is sensitive and the scope is clean. [AC8] [AC11] [AC12] [depends: T5] [depends: T6] [depends: T7] [depends: T8]
+- [x] **T9** — Run the full suite and prove the renumber assertion is sensitive and the scope is clean. [AC8] [AC11] [AC12] [depends: T5] [depends: T6] [depends: T7] [depends: T8]
       Verify: `bash tests/run.sh` exits 0 (all areas green, including `80-cycle-fixture`); in a scratch copy of `tests/` (never the repository) reintroduce `9220-renamed-parent/0001-old` into one fixture file and run `FRAMEWORK_TEST_AREAS=91-integrity-guard bash tests/run.sh <scratch-root>` — it must exit non-zero and print a line containing `AC30 renumber-sweep`; and `git diff --name-only` lists only files under `tests/` plus this work item.
diff --git a/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/verify.md b/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/verify.md
new file mode 100644
index 0000000..d2ca963
--- /dev/null
+++ b/work/0015-recursive-workflow-guards/0004-recursive-integrity-guard/verify.md
@@ -0,0 +1,146 @@
+---
+feature: 0015-recursive-workflow-guards/0004-recursive-integrity-guard
+phase: test
+status: final
+created: 2026-10-14
+updated: 2026-10-14
+parent: 0015-recursive-workflow-guards
+notes: "Fresh verification pass after the /plan revision (backtracks.md Resolution 2) renamed the area to tests/checks/91-integrity-guard.sh and re-opened T4-T7/T9. No challenges.md exists for this item, so no adjudication was pending. The prior verify.md was stale (stale: design); this pass re-runs everything against the renamed area and independently reproduces the sensitivity battery. No production code was modified and no test was weakened, skipped, or deleted."
+---
+
+# Verification — Committed recursive merge-integrity and renumber guards
+
+## Commands run
+
+All commands run from the repository root. Scratch copies live under the
+git-ignored `scratch/` and were removed afterwards. The working tree is the
+uncommitted implementation on the plan branch; `HEAD` is the plan commit and is
+an ancestor of `origin/main`.
+
+| Command | Result | Notes |
+| ------- | ------ | ----- |
+| `bash tests/run.sh` | PASS | 576 passed, 0 failed, 0 skipped (exit 0) |
+| `FRAMEWORK_TEST_AREAS=91-integrity-guard bash tests/run.sh` | PASS | 73 passed, 0 failed, 0 skipped (exit 0) |
+| `FRAMEWORK_TEST_AREAS=80-cycle-fixture bash tests/run.sh` | PASS | 18 passed, 0 failed, 0 skipped (exit 0) |
+| `bash tests/mutation.sh` | PASS | 30 mutations caught and named, 0 failed; clean-copy run 574 pass / 0 fail / 2 skip; exit 0 |
+| full suite against a no-`work/` copy (`bash <copy>/tests/run.sh <copy>`) | PASS | 576 passed, 0 failed, 0 skipped — fresh-clone safety |
+| merged-state sim (`git archive origin/main` + this item's files → suite) | PASS | 727 passed, 0 failed, 0 skipped (exit 0) |
+| merged-state selectors `89`, `91`, `81` | PASS | each resolves uniquely (66 / 73 / 37 assertions, exit 0); no `89-` collision |
+| `grep -rF '89-integrity-guard' tests/` | PASS | no output (exit 1) — rename sweep complete |
+| `git diff --name-only` / `git status --porcelain` | PASS | only `tests/**` plus this work item (scope, AC12) |
+| independent mutation battery (below) | PASS | 18/18 planted regressions failed the area and named the expected `AC30 <sub-area>` |
+
+The `91-` area emits 73 assertions across all nine declared sub-areas
+(`per-node-eval`, `structural-graph`, `spelling-drift`, `report-only`,
+`renumber-sweep`, `fixture-existence`, `read-only-contract`, `mutation-staging`,
+`no-duplication`); every emitted line carries the `AC30` token.
+
+## Acceptance coverage
+
+| Criterion | Test(s) | Result |
+| --------- | ------- | ------ |
+| AC1 — fixture-based, fresh-clone safe, fails not skips on a missing fixture | `AC30 fixture-existence` (tree + 14 required files); `AC30 read-only-contract` (no live `work/` path, no executable file, no committed checker, no `.opencode` reference); full suite against a no-`work/` copy. Sensitivity: removing a required fixture → `FAIL AC30 fixture-existence` (exit 1, not skip) | PASS |
+| AC2 — independent per-node evaluation; depth-3 fault caught and attributed | `AC30 per-node-eval` expected block; `AC30 per-node-eval: the depth-three collision is attributed to 9211-deep/0001-mid`. Sensitivity: removing the intermediate manifest breaks recursion → block diverges; adding a third same-prefix top-level node diverges the block | PASS |
+| AC3 — structural graph faults + deliberate withdrawal report-only | `AC30 structural-graph` expected block (`DANGLING-DEP`, `MISSING-CHILD`, `UNLISTED-CHILD`); `AC30 structural-graph: the recorded deliberate withdrawal yields no UNLISTED-CHILD fault`. Sensitivity: deleting the unlisted dir, or adding an unrecorded stray child dir, diverges the block | PASS |
+| AC4 — manifest-spelling drift; modern spelling authoritative; no drop/merge/repair | `AC30 spelling-drift` expected block (`9203-spelling-both`, `9204-phase-mismatch`); `AC30 spelling-drift: the modern manifest is authoritative over the deprecated alias`; `AC30 spelling-drift: both spellings are retained, never dropped or auto-repaired`; `FRAMEWORK_TEST_AREAS=80-cycle-fixture` green. Sensitivity: dropping the alias or fixing the phase mismatch diverges the block; flipping the resolver to prefer the alias fails the authority assertion | PASS |
+| AC5 — report-only, non-fatal, never-truncated, no-file-modified contract; clean tree empty | `AC30 report-only`: authority pins (`**non-fatal**`, `**never silently dropped**`, `**never truncated**`, `**not auto-repaired**`, `**modifies no file**`, `report **no findings**`, `**does not error**`), skill pins (`**report-only**`, `the list is never truncated`, `**modifies no file**`, `it never auto-repairs a violation`), and the clean `9201-clean` node yields empty findings. Sensitivity: removing an authority/skill literal fails the pin | PASS |
+| AC6 — sibling-owned invariants referenced, not re-pinned | `AC30 no-duplication`: header references to `10-readiness`, `20-lifecycle`, `80-cycle-fixture`, `85-conflict-guards`, `87-backtrack-guards`, `88-renumber-sweep`, `90-packaging`, `96-signature-sweep`, `0001-recursive-structure-guard`; 9 forbidden-literal scans. Sensitivity: removing a header reference or appending an owned literal fails the assertion | PASS |
+| AC7 — completed whole-subtree renumber leaves no stale reference | `AC30 renumber-sweep` presence assertions in all nine rewrite positions (directory, `feature:`, `parent:`, owning manifest `Local id`/`Canonical reference`, intermediate manifest `Canonical reference`, `Depends on`, `conflicts-with`, ship/handoff branch) plus the recursive old-reference absence scans. Sensitivity: reintroducing the old canonical ref into any fixture file fails the scan | PASS |
+| AC8 — renumber assertion is sensitive | scratch-only: reintroducing `9220-renamed-parent/0001-old` into one fixture file made the area exit 1 naming `AC30 renumber-sweep`. No committed test pins this in this item — the registered mutation job is `0005`'s (design test-strategy row; spec AC10). See residual risk | MANUAL (scratch-verified) |
+| AC9 — recursive renumber contract pins (intermediate manifest + reference-not-restate) | `AC30 renumber-sweep: authority names the intermediate manifest on the changed path`; `AC30 renumber-sweep: skill names the intermediate manifest on the changed path`; the `88-renumber-sweep` closing literal is *not* restated (`no-duplication` forbids it). Sensitivity: breaking the intermediate-manifest phrase on either surface fails the pin | PASS |
+| AC10 — stable token, named sub-areas, mutation staging | every emitted assertion is `AC30 <sub-area>`; all nine declared sub-areas appear; `AC30 mutation-staging: tests/mutation.sh stages tests/fixtures/recursive-integrity`. Sensitivity: de-staging the line fails the assertion | PASS |
+| AC11 — no duplication; existing areas stay green | `bash tests/run.sh` green (576 pass); `AC30 no-duplication`; `FRAMEWORK_TEST_AREAS=80-cycle-fixture` green (18 pass); merged-state simulation green (727 pass); a third stray `roadmap.md` still fails the relaxed `AC13` guard. Sensitivity: header/forbidden-literal mutations caught | PASS |
+| AC12 — scope and purity | manual: `git status --porcelain` shows only `tests/checks/80-cycle-fixture.sh`, `tests/mutation.sh`, `tests/checks/91-integrity-guard.sh`, `tests/fixtures/recursive-integrity/**` (all `tests/**`) plus `work/.../tasks.md` and the item's `backtracks.md`/`verify.md`/`review.md`. No live doc, prompt, command, agent, skill, `phase` value, state file, or production checker added; no new dependency, network, or `gh` call; the check has no shell `exit`, no file-writing redirection, no `curl`/`wget`/`gh`/`git`, and no `mapfile`/associative arrays | MANUAL (inspection) |
+
+### Independent mutation battery (staged under `scratch/`, each on a fresh copy)
+
+| # | Planted regression | Area | Expected / observed |
+| - | ------------------ | ---- | ------------------- |
+| M1 | remove `9211-deep/0001-mid/manifest.md` (breaks recursion) | 91 | `AC30 per-node-eval` FAIL, exit 1 |
+| M2 | delete `9202-graph-faults/0005-unlisted` | 91 | `AC30 structural-graph` FAIL |
+| M3 | add an unrecorded stray child dir `9202-graph-faults/0006-stray` | 91 | `AC30 structural-graph` FAIL |
+| M4 | remove `9203-spelling-both/roadmap.md` | 91 | `AC30 spelling-drift` FAIL |
+| M5 | fix `9204-phase-mismatch` (`phase: roadmap` → `manifest`) | 91 | `AC30 spelling-drift` FAIL |
+| M6 | flip the area's resolver to prefer the alias | 91 | `AC30 spelling-drift` (authority) FAIL |
+| M7 | remove a required fixture (`0003-follower/ship.md`) | 91 | `AC30 fixture-existence` FAIL (not skip) |
+| M8 | reintroduce old canonical ref `9220-renamed-parent/0001-old` | 91 | `AC30 renumber-sweep` FAIL |
+| M9 | add a third same-prefix top-level node `9210-dup-c` | 91 | `AC30 per-node-eval` FAIL |
+| M10 | remove the `88-renumber-sweep` header reference | 91 | `AC30 no-duplication` FAIL |
+| M11 | remove the `0001-recursive-structure-guard` header reference | 91 | `AC30 no-duplication` FAIL |
+| M12 | append the `88`-owned closing literal | 91 | `AC30 no-duplication` FAIL |
+| M13 | de-stage `recursive-integrity` from `tests/mutation.sh` | 91 | `AC30 mutation-staging` FAIL |
+| M14 | add a live `work/` path to a fixture file | 91 | `AC30 read-only-contract` FAIL |
+| M15 | `chmod +x` the check file | 91 | `AC30 read-only-contract` FAIL |
+| M16 | break the authority's intermediate-manifest phrase | 91 | `AC30 renumber-sweep` FAIL |
+| M17 | break the skill's intermediate-manifest phrase | 91 | `AC30 renumber-sweep` FAIL |
+| M18 | add a third stray `roadmap.md` under `tests/fixtures/` | 80 | `AC13 unexpected roadmap.md fixture set` FAIL |
+
+Every mutation failed the suite (exit 1) and named the expected sub-area/token,
+so the assertions are sensitive rather than vacuous.
+
+## Gaps and residual risk
+
+- **AC8 committed sensitivity is deferred to `0005`.** The design's test-strategy
+  row routes the registered renumber mutation job to
+  `0005-guard-registration-sweep`, and this item's non-goals defer the mutation
+  jobs. The assertion's sensitivity was confirmed in a scratch copy only (M8);
+  no committed test in this item's own area fails on a reintroduced old reference
+  when run as the default suite. This is a documented residual, not a defect.
+- **Bash 3.2 compatibility is static.** The host shell is GNU bash 5.2; the area
+  contains no associative arrays, `mapfile`/`readarray`, or empty-array expansion
+  under `set -u`, matching the harness constraint, but was not executed under a
+  true 3.2.
+- **`read-only`/`no-network` are structural, not sandbox-intercepted.** They are
+  asserted by inspection (no file writes, no `curl`/`wget`/`gh`/`git`, no shell
+  `exit`, no exec bit, no writing redirection) and by a fresh-clone run; no
+  syscall sandbox was used.
+- **Graph faults and drift are planted only on top-level nodes.** The recursive
+  per-node evaluation is proven by the depth-three `DUPLICATE-CHILD` (AC2) and by
+  the intermediate manifest on the renumber path (AC7/AC9), but no *nested* node
+  carries a `MISSING-CHILD`/`UNLISTED-CHILD`/`DANGLING-DEP`/`DRIFT-FACT` fault, so
+  an evaluation that flattened only those arms to the top level would not be
+  caught by the committed fixture. AC2's stated observable (the deepest-level
+  fault caught and named) and AC3's stated sample (a decomposing node, not
+  necessarily nested) are both met; this is noted as a follow-up suggestion, not
+  a defect against the acceptance criteria.
+- **`DANGLING-DEP` predicate covers the "no row" half only.** The authority
+  (`.opencode/skill/merge-conflict/SKILL.md:121`) defines `DANGLING-DEP` as "a
+  local id with no child directory **or** no table row"; the area's predicate
+  tests only the row half. AC3 words its sample as a `Depends on` that "names no
+  row and no directory" (`0099-ghost`), which is exercised. The "row present,
+  directory absent" arm is unexercised — recorded as a residual, matching the
+  review's non-blocking question.
+- **Reverse phase-mismatch arm unexercised.** `9204-phase-mismatch` exercises
+  `manifest.md` + `phase: roadmap`; the reverse (`roadmap.md` +
+  `phase: manifest`) is coded in the guard (`91-integrity-guard.sh:197`) but not
+  fixture-exercised. AC4 requires only that "the manifest spelling disagrees with
+  its declared `phase` value" be detected, which is covered.
+- **Withdrawal record shape diverges from the template.** The fixture records the
+  withdrawal as `9202-graph-faults/0004-withdrawn/` rather than the template's
+  `work/<parent>/<MMMM-slug>/`, because the area's `read-only-contract` forbids
+  the literal `work/` in the fixture root. Recognition is a substring match and
+  works on the real `work/<parent>/<child>/` shape; AC3 does not mandate the
+  prefix. Recorded as a residual (also the review's second non-blocking
+  question).
+- **Branch is behind `origin/main`.** HEAD is the plan commit; `origin/main` has
+  advanced with the sibling guards. The merged-state simulation
+  (`origin/main` + this item's files, with both `tests/mutation.sh` staged-copy
+  lines kept) runs green (727 pass, 0 fail), and the `89`/`91`/`81` selectors
+  each resolve uniquely once merged. The `tests/mutation.sh` staged-copy additions
+  from this item and the sibling `0001` are the declared class-(a) shared-surface
+  conflict the shipper reconciles; the correct merged form was simulated.
+- **Manual/LLM-run residuals (not faked by static assertions).** A live `/status`
+  render, a real `/ship` reconcile/post-merge integrity pass, an actual `git mv`,
+  and the renumber no-op case require running a phase and remain documented manual
+  residuals, consistent with the cycle/conflict/backtrack guard areas.
+- **No test was weakened, skipped, or deleted to obtain a pass.** The only suite
+  edit besides the new area is the design-sanctioned narrowing of
+  `tests/checks/80-cycle-fixture.sh`'s AC13 whole-set assertion, which still fails
+  on any third/stray alias (M18).
+
+## Not covered / out of scope
+
+- The `tests/README.md` Checks row/mapping paragraph and the per-rule mutation
+  jobs are `0005-guard-registration-sweep`'s responsibility by design and are not
+  asserted here.
+- No challenges were pending: `challenges.md` does not exist for this item.