chore(release): 6.3.1 — Fixes from the release review of 6.3.0, and two verdict-gate holes closed

Version 6.3.1 in plugin.json, package.json, package-lock.json and the
README badge; the 6.3.1 CHANGELOG section with its Doors list (all
two-way) and the Known issues from round 11 of the release review (WARN:
0 BLOCKER, 10 MAJOR; the operator chose to release with it on
2026-10-11).

Measured against 6.3.0 for the Doors list: the plan validator reports the
same errors and warnings for 233 plan files, the verdict gate gives the
same exit for 123 review files, and tests-only reads the same for 1408
plan steps, over the marketplace and the test repo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "voyage",
   "description": "Voyage — brief, research, plan, execute, review, continue. Contract-driven Claude Code pipeline. /trekbrief, /trekplan, and /trekreview each end by building a self-contained operator-annotation HTML (scripts/annotate.mjs, pencil-toggle annotation pattern): select text or click any element, pick intent (Fiks/Endre/Spørsmål), write comment, copy structured prompt, paste back, Claude revises the .md.",
-  "version": "6.3.0",
+  "version": "6.3.1",
   "author": {
     "name": "Kjell Tore Guttormsen"
   },

CHANGELOG.md

@@ -4,6 +4,113 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## v6.3.1 — 2026-10-11 — Fixes from the release review of 6.3.0, and two verdict-gate holes closed
+
+Rounds 7 to 10 of the release review of 6.3.0. Round 7 is the WARN 6.3.0 was
+released with, round 8 was BLOCK (1 BLOCKER), rounds 9 and 10 were WARN. Every
+fix began with a test that failed on the code before it. Suite 2236 (2234
+pass, 0 fail, 2 skipped).
+
+Nothing here asks anything of users. Measured against 6.3.0 over the
+marketplace and the test repo: the plan validator reports the same errors and
+warnings for all 233 plan files, the verdict gate gives the same exit for all
+123 review files, and tests-only reads the same for all 1408 plan steps.
+
+### Doors
+
+- two-way: tests-only is decided by the plan's `Files:` alone, and red proof no longer reads the step's diff (operator decision 2026-10-11) — a revert brings the diff check back; plans stay valid.
+- two-way: the `Files:` reader keeps a plain file beside a backticked path, reads numbered entries, and keeps a description together across commas and lines — it feeds only the `PLAN_STEP_TESTS_ONLY` warning and red proof's `tests_only`; a revert restores the 6.3.0 reading.
+- two-way: a trailing `# comment` is dropped from a backticked check too, so such a check now runs; one whose comment holds a double quote, `$`, a backtick or a backslash is refused out loud — 6.3.0 refused every backticked check with a comment, so nothing that ran stops running.
+- two-way: the verdict gate reads the last fenced block once and answers exit 2 unless its info string is exactly `json`, or when it is never closed; a `~~~` fence is a fence — a review written by `/trekreview` reads as before; a revert reopens the two holes under Fixed.
+- two-way: stops and timeouts, the release check's `--review`, `isMain` in every CLI, the test lock's command comparison, one fence reader, and cleanups — fixes; a revert restores the old behaviour.
+
+### Fixed
+
+- **Two verdict-gate holes, present in 6.3.0.** A review that ended with a
+  clean json block and then a block holding a BLOCK verdict, written as
+  `~~~json` or opened with more text after `json` on its line, passed with
+  exit 0: the gate did not see the second block. Both are exit 2 now.
+- **Tests-only steps.** The plan's `Files:` alone decides, and red proof,
+  `/trekexecute`, `step-implementer` and the handover contract say so. A change
+  already in the tree when the step began no longer counts against it, and a
+  plan outside `.claude/` reads the same.
+- **The `Files:` reader** keeps a plain file beside a backticked path
+  (", Dockerfile", "and Makefile"), reads a numbered entry (`1.` or `1)`) as an
+  entry, keeps a description together past a comma and onto the next line, and
+  starts a description at a plain file followed by a colon. Lowercase
+  `makefile`, `rakefile` and `justfile` are build files.
+- **Checks with a comment.** A trailing `# comment` is dropped in a backticked
+  check and in a command passed as written, so the words screened are the
+  words run. A comment with a double quote, `$`, a backtick or a backslash is
+  refused instead, because the executor hands the `Verify:` span to red proof,
+  the test lock and the done line inside double quotes. Every reader refuses it
+  out loud (`PLAN_VERIFICATION_NOT_RUNNABLE`, `BRIEF_SC_NOT_RUNNABLE`). A span
+  that is only a comment is not-a-command.
+- **Stops.** Red proof reports a command killed by its timeout as killed after
+  the timeout, not "could not start". The release check tells a timeout from
+  output past its buffer and from another signal. One reading of a stop
+  (`stoppedBy`) serves red proof, the criteria runner, the test lock, the done
+  line and the release check.
+- **Release check.** A relative `--review` is read in `--repo`, or from the
+  current directory when only that one exists. Two different files are exit 2,
+  never guessed, and one file reached through a symlinked `--repo` is one file.
+- **Every CLI uses one `isMain` helper.** Before, some did nothing and exited 0
+  when run through a symlink or a path with a space.
+- **Test lock.** It compares `--cmd` by its words and without its trailing
+  comment.
+- **One fence reader** for the gate and every reader of a trailing json block.
+  A fence closes only on a run at least as long as its opener, as in Markdown,
+  and CRLF and an indented fence read alike everywhere. A fence indented four
+  spaces or more still counts, on purpose: Markdown's rule made a BLOCKER block
+  inside a list item invisible.
+- **Cleanups.** The 15-minute timeout is defined once, the findings check reads
+  each cited file once per validation, and the guard writes its no-one-to-ask
+  refusal once.
+
+### Known issues
+
+Round 11 of the release review (`0f400d3..10ac9c5`) is WARN: 0 BLOCKER, 10
+MAJOR, 0 MINOR. All ten come from Claude Code's `/code-review`, which gives no
+category, so each enters as MAJOR. Voyage's two reviewers and
+`/security-review` found none. The operator chose to release 6.3.1 with it
+(2026-10-11). None of the ten lets a gate pass. The regressions below were
+checked by running them against 6.3.0. None of them occurs in the 1408 plan
+steps measured above.
+
+- The `Files:` reader still guesses paths from prose and misreads in both
+  directions. Two misreads are regressions from 6.3.0:
+  - A source file after a described test is dropped
+    ("`tests/a.test.mjs` - new test, src/a.mjs - the fix"). The step that
+    builds code then reads as tests-only and goes to the plan.
+  - A path that a description only mentions is read as a file ("covers the
+    parser in src/parse.mjs"). A step of only tests is then not caught and
+    goes through fix rounds (at most five, then the operator).
+
+  Red proof has no diff check behind the reader. The structural fix is to
+  require every path in `Files:` to be backticked. It changes the plan
+  contract and is left for a planned release.
+- A json block closed on the same line as its JSON is no longer read (a
+  regression from 6.3.0). The gate answers exit 2, and a reviewer is asked
+  again. An opener with a blank before `json` is not json either, as in 6.3.0.
+- A trailing comment with a double quote, `$`, a backtick or a backslash is
+  refused in every backticked check. That includes checks that never reach a
+  shell: a `## Verification` bullet, `Regression:`, `End-to-end:` and a brief
+  criterion. 6.3.0 refused these too.
+- Cleanups: a dead branch for a span that is only a comment, the comment
+  dropped up to four times per command, a re-export of the timeout that
+  nothing imports, and a test helper that copies a PATH lookup.
+- An engine run that was stopped and not counted in the verdict reported three
+  more, each checked by running:
+  - A backticked bare name such as `LICENSE`, alone on a line after a
+    description, is no longer read as a file. 6.3.0 read it.
+  - One unclosed fence earlier in a review hides the review's own json block
+    from the review validator. 6.3.0 found the block, and the gate answers
+    exit 2 there.
+  - An indented json example after a review's own block is read as the last
+    block, as in 6.3.0.
+- The example plan's steps 1-2 keep their tests-only warning (operator
+  decision 2026-10-09).
+
 ## v6.3.0 — 2026-10-11 — The executor is coupled to the review gate, three skills, and a drilled release runbook
 
 Wave 2 of the practice build (five orders, merged 2026-10-09) and the fix round

README.md

@@ -2,7 +2,7 @@
 
 Contract-driven Claude Code pipeline: brief, research, plan, execute, review. Agent swarms, research triangulation, adversarial review, multi-session resumption.
 
-![Version](https://img.shields.io/badge/version-6.3.0-blue)
+![Version](https://img.shields.io/badge/version-6.3.1-blue)
 ![License](https://img.shields.io/badge/license-MIT-green)
 ![Platform](https://img.shields.io/badge/platform-Claude%20Code-purple)
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "voyage",
-  "version": "6.3.0",
+  "version": "6.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "voyage",
-      "version": "6.3.0",
+      "version": "6.3.1",
       "license": "MIT",
       "engines": {
         "node": ">=18"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "voyage",
-  "version": "6.3.0",
+  "version": "6.3.1",
   "private": true,
   "description": "Voyage — brief, research, plan, execute, review, continue. Contract-driven Claude Code pipeline. /trekbrief, /trekplan, and /trekreview each end by building a self-contained operator-annotation HTML (scripts/annotate.mjs, pencil-toggle annotation pattern): select text or click any heading/paragraph/list-item, pick intent (Fiks/Endre/Spørsmål), write comment, copy structured prompt, paste back, Claude revises the .md.",
   "type": "module",