diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 78d3565..c660d6e 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -42,13 +42,19 @@ packages; the production runtime remains Node-only and zero-dependency.
 
 ## Architecture — a four-layer config compiler with ONE source
 
-```
-                       source/rules.json  (canonical rules: git · testing · security · style)
-                                │           (+ source/substrate.json, source/mcp.json)
-                          forge sync  (emitter: content-hash + DO-NOT-EDIT headers)
-        ┌───────────────┬───────┴───────┬───────────────┬─────────────┐
-   Claude CLAUDE.md   Codex AGENTS.md  Cursor .mdc   Gemini settings  Aider .aider.conf.yml ...
-   (@AGENTS.md import)  (native)        /AGENTS.md    (context.fileName)  (read: AGENTS.md)
+```mermaid
+flowchart TD
+    S["source/ — rules.json · substrate.json · mcp.json"] -->|"forge sync: content-hash + DO-NOT-EDIT headers"| N["native configs: CLAUDE.md · AGENTS.md · .cursor · .gemini · .aider · …"]
+    subgraph L4["the four layers"]
+        T["tools — model-invoked skills"]
+        C["crew — sub-agents"]
+        G["guards — enforced hooks"]
+        M["mcp — atlas · substrate tools"]
+    end
+    S -. configures .-> L4
+    K["cortex lessons · recall facts · reuse artifacts<br/>design fingerprints · diagnoses"] --> LG[("PCM ledger — .forge/ledger/<br/>content-addressed claims")]
+    O["independent oracles<br/>tests · CI · human accept/revert"] -->|"move val"| LG
+    LG <-->|"git union-merge, conflict-free"| TM["teammate ledgers"]
 ```
 
 Layers map onto the Claude Code substrate, brand-named, and are emitted cross-tool:
@@ -143,7 +149,7 @@ forgekit/
   brand.json              # single FORGE_BRAND token + layer-name map
   README.md               # Start-Here index + one bootstrap command
   src/
-    cli.js                # init | sync | doctor | taste | learn-consolidate | brand
+    cli.js                # init | sync | doctor | substrate | ledger | reuse | … (`forge --help` for all)
     sync.js               # emitter (source → per-tool targets); hash + DO-NOT-EDIT
     doctor.js             # health checks
     emit/                 # one module per tool (claude, codex, cursor, gemini, aider, copilot, windsurf, zed, continue) + mcp
@@ -163,9 +169,9 @@ forgekit/
     substrate.json        # cognitive-substrate defaults (thresholds, routing, llm knobs)
     mcp.json              # MCP server definitions emitted into each tool
   global/                 # installs into ~/.forge, symlinked into ~/.claude
-    tools/ crew/ guards/ mcp/atlas/ recall/ lean/ statusline.sh settings.template.json
+    tools/ crew/ guards/ rules/ recall/ taste/ statusline.sh settings.template.json
   templates/project-layer/  # per-repo template (was hostlelo-project-layer)
-  plugin/                 # plugin.json + marketplace.json → point at global/ (no dup)
+  .claude-plugin/ .codex-plugin/  # plugin manifests → point at global/ + skills/ (no dup beyond the codex skill mirror)
   install.sh              # hardened: idempotent, symlink, backup, no curl|sh
   bin/                    # back-compat shims → src/cli.js
 ```
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9808ddf..367b34a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,17 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Changed
+
+- Docs consolidation pass: deduplicated cross-doc prose into single canonical homes
+  (the substrate README now points at the GUIDE's command reference, output table, and
+  honest-limits list instead of repeating them), added orientation diagrams
+  (ARCHITECTURE four-layer compiler + ledger, substrate-v2 phase graph with all phases
+  marked shipped, the GUIDE daily loop), brought the ROADMAP current, and refreshed the
+  model-facing skills/crew guidance for the v0.5.0 surface (`forge context`,
+  `forge imagine --run`, `forge diagnose`, `forge ledger blame`, `forge cost --stages`,
+  `forge uicheck design --taste`) without growing the skills' context payload.
+
 ## [0.5.0] - 2026-07-07
 
 ### Added
diff --git a/ROADMAP.md b/ROADMAP.md
index c34ecf2..2580d04 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -3,46 +3,42 @@
 Direction, not promises — shaped by the two field reports this project is grounded in
 (the SDLC pain-point map and the ecosystem landscape). Open a Discussion to weigh in.
 
-## Now (`master`)
+## Now (`master`, v0.5.0)
 Cross-tool config for nine agents (Claude Code, Codex, Cursor, Gemini, Aider, Copilot,
 Windsurf, Zed, Continue) plus MCP config for Roo & VS Code, verification layer
 (`forge verify`), security gate (`forge scan`), portable memory (`forge brain`), cost
-governor (`forge cost`), spec-as-contract drift (`forge spec`), goal-drift check
-(`forge anchor`), and the cognitive-substrate pre-action gate (`forge substrate`,
-`forge impact`). The full paper and evidence bundle live in
-[docs/cognitive-substrate/](./docs/cognitive-substrate/). See
-[CHANGELOG.md](./CHANGELOG.md) `[Unreleased]`.
+governor (`forge cost`, `--stages` for measured factors), spec-as-contract drift
+(`forge spec`), goal-drift check (`forge anchor`), the cognitive-substrate pre-action
+gate (`forge substrate`, `forge impact`) — **plus the whole Substrate v2 surface**:
+`forge ledger` (proof-carrying team memory), `forge reuse` (verified-code cache),
+`forge context` (budgeted assembly + completeness gate), `forge diagnose` (doom-loop),
+`forge imagine [--run]` (consequence simulation + sandboxed dry-run), `forge uicheck`
+v2 (fingerprints + design gate), and `forge dash`. The full paper and evidence bundle
+live in [docs/cognitive-substrate/](./docs/cognitive-substrate/). See
+[CHANGELOG.md](./CHANGELOG.md).
 
-## Next — Substrate v2 (the whitepaper, completed)
-The full plan lives in [docs/plans/substrate-v2/](./docs/plans/substrate-v2/00-overview.md):
-every paper faculty and mechanism mapped to an algorithm, unified by the
-**Proof-Carrying Memory (PCM) protocol** (ADR-0006) — every stored thing is a claim that
-carries its evidence, earns confidence only from independent oracles, and merges across
-teammates conflict-free (git-native CRDT ledger).
+## Shipped — Substrate v2 (all phases P0–P8, v0.5.0)
+The plan lives in [docs/plans/substrate-v2/](./docs/plans/substrate-v2/00-overview.md)
+(phase dependency graph + acceptance gates, all marked done): every paper faculty and
+mechanism mapped to an algorithm, unified by the **Proof-Carrying Memory (PCM)
+protocol** (ADR-0006) — every stored thing is a claim that carries its evidence, earns
+confidence only from independent oracles, and merges across teammates conflict-free
+(git-native CRDT ledger).
 
-Phases (dependency-ordered; acceptance gates in the overview):
-- **P1 Ledger core** — claim store, Beta-posterior confidence, Eq. 3 retrieval;
-  cortex + recall migrate onto claim kinds.
-- **P2 Team memory** — `.forge/ledger/` union-merge over git; `forge ledger`.
-- **P3 Reuse cache** — proof-carrying artifact cache (`forge reuse`): verified code is
-  served with its evidence, revalidated against the atlas, demoted by outcomes.
-- **P4 Context assembly** — knapsack selection under a token budget + a set-cover
-  completeness gate that *computes* what's missing (`forge context`).
-- **P5 Loop closure** — outcome write-back band; doom-loop diagnosis + escalation;
-  imagination dry-run (impacted-test set cover + worktree sandbox); AST-tier atlas with
-  a mandatory impact gate; M3 partition planning, M4 CUSUM drift, M5 footprint metric,
-  M6 checkpoint cadence; outcome-calibrated routing.
-- **P6 UI quality gate** — design fingerprints, slop-distance + project-conformance
-  scoring, scale/palette conformance checks (`forge uicheck` v2, machine-readable taste).
-- **P7 `forge dash`** — local dashboard over the ledger, cost stages, cache, blast radius.
-- **P8 Evaluation** — measured per-stage cost report (target ~90 % composed; only
-  measured numbers get claimed — see [05-cost-model.md](./docs/plans/substrate-v2/05-cost-model.md)).
-
-Carried forward from the previous roadmap into these phases: calibration fixtures (P8),
-AST-backed impact (P5), Playwright testing (P6), MCP hygiene in `forge doctor` (P7).
+## Next
+- **Ledger read-path flip** — the ledger is the convergent *write* store today while
+  the legacy stores (`lessons/`, `recall`, `brain`) still serve reads; flip reads to be
+  ledger-first, then retire the legacy formats.
+- **Embeddings tier** — optional vector backend (ADR-0005 dependency tier, stdlib
+  fallback kept) for Eq. 3 retrieval and `forge reuse` near-match, where MinHash is
+  weak on short specs.
+- **Playwright loop** — drive a real browser in the UI gate: screenshot + interaction
+  checks feeding `forge uicheck` verdicts back as oracle evidence on design claims.
+- **Advisory → gated promotions** — outcome-calibrated routing weights, consolidation
+  promotion (ʿilm→fahm), M6 hazard estimates: advisory today, become blocking only
+  once fixtures measure them (overview §4 honesty register).
 
 ## Later / exploring
-- Optional embedding/vector backends for retrieval and cache near-match (ADR-0005 tier).
 - `forge verify` independent-review wired into CI with provenance gating.
 - Formal/semantic verification — documented as out-of-scope for now.
 - Parametric learning channel (LoRA distillation) — deliberately out of scope (ADR-0006).
diff --git a/docs/GUIDE.md b/docs/GUIDE.md
index e654d94..9f3dc7b 100644
--- a/docs/GUIDE.md
+++ b/docs/GUIDE.md
@@ -39,6 +39,17 @@ substrate** (`forge substrate` — the pre-action check). The full argument is t
 
 ## The everyday workflow
 
+The daily loop — every outcome an oracle observes lands in the team ledger, and the
+ledger informs the next task:
+
+```mermaid
+flowchart LR
+    W["work — substrate pre-checks,<br/>then edit"] --> O["oracles — forge verify ·<br/>imagine --run · CI · human accept/revert"]
+    O -->|"outcomes move claim val"| L[("team ledger<br/>.forge/ledger/")]
+    L <-->|"git + forge ledger merge"| T["teammates' ledgers"]
+    L -->|"lessons · facts · reuse hits"| W
+```
+
 ```bash
 cd your-project
 forge init                              # once per repo: emit every tool's config
@@ -79,6 +90,8 @@ Forge substrate — pre-action check
   route: Haiku 4.5 (simple) · complexity 0.15
     driven by: base cost of any task
 
+  context: complete — 4 required item(s), 1840/12000 tokens (`forge context` for the assembly)
+
   impact: 3 file(s) predicted
     - src/auth.js
     - src/login.js
@@ -400,10 +413,14 @@ Forge imagine — consequence simulation (pre-action)
   minimal dry-run suite (1) — run these, in this order:
     - test/auth.test.js
 
-  (sandboxed worktree dry-run of this suite lands as the P5 follow-up)
+  (measure it: re-run with --run — sandboxed worktree dry-run of HEAD)
 ```
 
-It also flags predicted breaks **no test covers** — the risk you can't dry-run away.
+Add **`--run`** to actually execute that suite in a sandboxed worktree of HEAD — the
+dry-run result lands as oracle evidence on the prediction. It refuses a dirty working
+tree (your uncommitted changes wouldn't be in the run); commit/stash first or pass
+`--allow-dirty` to knowingly measure the last commit. It also flags predicted breaks
+**no test covers** — the risk you can't dry-run away.
 
 ### `forge uicheck` — deterministic UI checks
 
@@ -590,8 +607,10 @@ real spend; the `cost-budget` guard warns when a day exceeds `FORGE_COST_CEILING
 session. For learned-from-mistakes memory, just work: Cortex captures recurring
 corrections on its own.
 
-**UI work.** `forge uicheck <fg> <bg>` for exact contrast; the `ui-workflow` and
-`taste` tools for the rest.
+**UI work.** `forge uicheck contrast <fg> <bg>` for exact contrast; `forge uicheck
+design <files> --taste <style>` as the anti-slop gate (mint the project fingerprint
+first: `forge uicheck fingerprint <files> --mint`); the `ui-workflow` and `taste`
+tools for the rest.
 
 ---
 
diff --git a/docs/cognitive-substrate/README.md b/docs/cognitive-substrate/README.md
index 07790c8..9df6519 100644
--- a/docs/cognitive-substrate/README.md
+++ b/docs/cognitive-substrate/README.md
@@ -109,6 +109,12 @@ output (see [Use it in a script](#use-it-in-a-script)).
 | `forge anchor "<goal>"` | Are my changes still on the stated goal? | flags changed files that drifted off-goal |
 | `forge verify` | Did it actually work? | runs the real tests/build, not the model's word |
 
+The wider v0.5 surface — `forge context` (budgeted assembly + completeness gate),
+`forge imagine [--run]` (predicted breaks + minimal dry-run suite), `forge diagnose`
+(doom-loop), `forge ledger` / `forge reuse` (proof-carrying memory + code cache), and
+`forge uicheck` (the design gate) — is documented with real outputs in
+[docs/GUIDE.md → Command reference](../GUIDE.md#command-reference).
+
 Real output for the two most-used:
 
 ```console
@@ -132,34 +138,21 @@ $ forge impact verifyToken
 
 ## Read the result (what to do)
 
-| Field | What it means | Do this |
-| --- | --- | --- |
-| `okToProceed: false` | task is under-specified | ask the `assumption.questions`, don't guess |
-| `route.tier` | cheapest capable model | start there; only escalate if a verifier fails |
-| `impact.impactedFiles` | predicted blast radius | read these before editing |
-| `scope.clusters` | independent vs. coupled work | split independent groups into separate sessions |
-| `memory.advisory` | past lessons for this area | context, not law — tests override it |
-| `verification.checklist` | how to prove it works | run it, show the output, then say "done" |
+Field-by-field: what each verdict means and the action to take —
+[docs/GUIDE.md → Reading substrate output](../GUIDE.md#reading-substrate-output).
+The short version: `ASK FIRST` means ask, `route` means start cheap, `impact` means
+read those files first, and `verify` means show the output before saying "done".
 
 ---
 
 ## In other AI tools
 
 Tools without a hook surface get the substrate two ways, both written by `forge init`:
-
-1. **A rule in their config** (`AGENTS.md`, `.cursor/rules`, `GEMINI.md`, …): *"Before
-   ambiguous, expensive, multi-file, or mutating work, run `forge substrate "<task>" --json`
-   (or the MCP tool `substrate_check`). If `okToProceed` is false, ask the questions first."*
-
-2. **MCP tools** any MCP-capable agent can call directly:
-
-   | MCP tool | Does |
-   | --- | --- |
-   | `substrate_check` | full pre-action check |
-   | `assumption_gate` | ask/proceed + questions |
-   | `predict_impact` | blast radius |
-   | `route_task` | model recommendation |
-   | `scope_files` | independent vs. coupled |
+a rule in their native config telling the agent to run `forge substrate "<task>" --json`
+before ambiguous/expensive/mutating work, and MCP tools (`substrate_check`,
+`assumption_gate`, `predict_impact`, `route_task`, `scope_files`) any MCP-capable agent
+can call directly. Details + the exact rule wording:
+[docs/GUIDE.md → Auto-use inside an agent](../GUIDE.md#auto-use-inside-an-agent).
 
 Forge never pretends it can force a hook into a tool that has none — it's ambient on Claude
 Code, and agent-invoked everywhere else.
@@ -228,13 +221,10 @@ auditable. Off by default; the ambient Claude Code hook stays deterministic unle
 
 ## Honest limits
 
-Heuristic, not benchmarked; the graph is regex-approximate (conservative, not a sound call
-graph); assumption detection is lexical by default (opt into a verified LLM refinement with
-`FORGE_LLM=1` — see above); auto-run needs a hook surface (ambient on Claude Code,
-agent-invoked elsewhere). What's *asserted* is safe to gate on (repo grounding, graph
-traversal, scope, routing arithmetic, test commands); everything else is *advisory* — including
-every LLM proposal, which is verified against the repo/graph/tests before it counts and is
-never trusted blind. Tests and human corrections always win. Full list:
+Heuristic, not benchmarked; the graph is regex-approximate; assumption detection is
+lexical by default (`FORGE_LLM=1` adds the verified refinement above — proposals are
+checked against the repo/graph/tests before they count, never trusted blind); auto-run
+needs a hook surface. Tests and human corrections always win. The full, canonical list:
 [docs/GUIDE.md → Honest limits](../GUIDE.md#honest-limits).
 
 ---
@@ -249,8 +239,9 @@ never trusted blind. Tests and human corrections always win. Full list:
 - **[Ecosystem map](./ecosystem_map.md)** — each capability vs. the real 2026 tool stack
 - **[Prototype source](../../research/python-prototypes/)** — the auditable Python originals
 
-**How the paper maps to what ships (all 11):** memory → `recall`/`cortex` · learning →
-`cortex` · imagination → `impact` · self-correction → `verify`/`doom-loop` ·
-impact-awareness → `atlas`/`impact` · M1 routing → `route` · M2 assumption gate →
-`preflight` · M3 decomposition → `scope` · M4 goal-anchoring → `anchor` · M5 minimality →
-`lean`/`substrate` · M6 verification → `verify`/`substrate`.
+**How the paper maps to what ships (all 11):** memory → `recall`/`cortex`/`ledger` ·
+learning → `cortex` + ledger oracles · imagination → `imagine [--run]`/`impact` ·
+self-correction → `verify`/`diagnose` · impact-awareness → `atlas`/`impact` · M1 routing →
+`route` · M2 assumption gate → `preflight`/`context` · M3 decomposition → `scope` ·
+M4 goal-anchoring → `anchor` · M5 minimality → `lean`/`uicheck design` · M6 verification →
+`verify`/`substrate`.
diff --git a/docs/plans/substrate-v2/00-overview.md b/docs/plans/substrate-v2/00-overview.md
index 3fef997..5bc0ec4 100644
--- a/docs/plans/substrate-v2/00-overview.md
+++ b/docs/plans/substrate-v2/00-overview.md
@@ -1,7 +1,10 @@
 # Substrate v2 — completing the whitepaper, and the Proof-Carrying Memory protocol
 
-> Status: **P0 — specification** · Owner: forgekit core · Companion to
-> [docs/cognitive-substrate/](../../cognitive-substrate/) (the paper this plan completes)
+> Status: **shipped — all phases P0–P8 landed in v0.5.0** · Owner: forgekit core · Companion to
+> [docs/cognitive-substrate/](../../cognitive-substrate/) (the paper this plan completes).
+> What remains (deferred, tracked in [ROADMAP.md](../../../ROADMAP.md)): the ledger
+> read-path flip (legacy stores still serve reads), the optional embeddings tier
+> (ADR-0005), and a Playwright-driven browser loop for the UI gate.
 
 ForgeKit v0.4 implements roughly half of the committed whitepaper — the two prototyped
 mechanisms (M1 routing, M2 assumption gate), an approximate impact atlas, and an advisory
@@ -60,19 +63,34 @@ structure this plan assigns it. Nothing is left as prose-only discipline.
 ## 3. Phase roadmap
 
 Phases are dependency-ordered; each has an acceptance gate. P1 is the keystone — every
-later phase stores its state as PCM claims.
+later phase stores its state as PCM claims. **All phases have shipped** (v0.5.0):
+
+```mermaid
+flowchart LR
+    P0["P0 specs ✅"] --> P1["P1 ledger core ✅"]
+    P1 --> P2["P2 team sync ✅"]
+    P1 --> P3["P3 reuse cache ✅"]
+    P1 --> P4["P4 context assembly ✅"]
+    P1 --> P6["P6 UI quality gate ✅"]
+    P4 --> P5["P5 loop closure ✅"]
+    P2 --> P7["P7 dashboard ✅"]
+    P5 --> P7
+    P6 --> P7
+    P3 --> P8["P8 evaluation ✅"]
+    P5 --> P8
+```
 
 | Phase | Delivers | Depends on | Acceptance |
 |---|---|---|---|
-| **P0** (this PR) | Specs 00–08, ADR-0005, ADR-0006, ROADMAP update | — | Docs merged; referenced paths resolve; no source changes |
-| **P1 Ledger core** | `src/ledger.js` (claim store, canonical hashing, Beta confidence, Eq. 3 retrieval, decay/prune); migrate `src/lessons.js` + `src/lessons_store.js` + `src/recall.js` onto claim kinds | P0 | All existing cortex/recall tests green on the new store; property tests: id stability, decay monotonicity |
-| **P2 Team sync** | `.forge/ledger/` git layout, union-merge driver, `forge ledger merge\|verify\|blame` | P1 | Three-way merge fuzz: any interleaving of two ledgers converges byte-identically (semilattice test) |
-| **P3 Reuse cache** | `forge reuse` — fingerprint, exact/near lookup, atlas revalidation, eviction | P1 | Cache hit returns artifact + evidence; stale-interface artifact refused; hit/miss metrics emitted |
-| **P4 Context assembly** | `forge context` — candidate scoring, knapsack selection, required-set completeness gate; wired into `src/substrate.js` + hooks | P1 | Gate emits computed missing-set on incomplete context; token budget never exceeded |
-| **P5 Loop closure** | Outcome write-back band; doom-loop diagnosis + escalation; imagination dry-run; M3/M4/M5/M6 extensions | P1, P4 | Revert/test outcomes visibly move `val` of informing claims; repeated failure signature halts with a diagnosis claim |
-| **P6 UI quality gate** | `forge uicheck` v2: design fingerprints, slop distance, scale conformance; machine-readable taste constraints | P1 | Known-template fixture flagged; project-conformant fixture passes; zero LLM calls in the gate |
-| **P7 Dashboard** | `forge dash` — local server + self-contained HTML over `.forge/` stores | P1–P6 (reads their stores) | Renders ledger, cost meter, cache rate, blast radius offline |
-| **P8 Evaluation** | Extend `src/eval.js`: cost-stage measurement, cache-hit-rate harness, honest report | P3–P5 | A measured (not asserted) end-to-end cost figure per stage, published in reports/ |
+| **P0** ✅ (this PR) | Specs 00–08, ADR-0005, ADR-0006, ROADMAP update | — | Docs merged; referenced paths resolve; no source changes |
+| **P1 Ledger core** ✅ | `src/ledger.js` (claim store, canonical hashing, Beta confidence, Eq. 3 retrieval, decay/prune); migrate `src/lessons.js` + `src/lessons_store.js` + `src/recall.js` onto claim kinds | P0 | All existing cortex/recall tests green on the new store; property tests: id stability, decay monotonicity |
+| **P2 Team sync** ✅ | `.forge/ledger/` git layout, union-merge driver, `forge ledger merge\|verify\|blame` | P1 | Three-way merge fuzz: any interleaving of two ledgers converges byte-identically (semilattice test) |
+| **P3 Reuse cache** ✅ | `forge reuse` — fingerprint, exact/near lookup, atlas revalidation, eviction | P1 | Cache hit returns artifact + evidence; stale-interface artifact refused; hit/miss metrics emitted |
+| **P4 Context assembly** ✅ | `forge context` — candidate scoring, knapsack selection, required-set completeness gate; wired into `src/substrate.js` + hooks | P1 | Gate emits computed missing-set on incomplete context; token budget never exceeded |
+| **P5 Loop closure** ✅ | Outcome write-back band; doom-loop diagnosis + escalation; imagination dry-run; M3/M4/M5/M6 extensions | P1, P4 | Revert/test outcomes visibly move `val` of informing claims; repeated failure signature halts with a diagnosis claim |
+| **P6 UI quality gate** ✅ | `forge uicheck` v2: design fingerprints, slop distance, scale conformance; machine-readable taste constraints | P1 | Known-template fixture flagged; project-conformant fixture passes; zero LLM calls in the gate |
+| **P7 Dashboard** ✅ | `forge dash` — local server + self-contained HTML over `.forge/` stores | P1–P6 (reads their stores) | Renders ledger, cost meter, cache rate, blast radius offline |
+| **P8 Evaluation** ✅ | Extend `src/eval.js`: cost-stage measurement, cache-hit-rate harness, honest report | P3–P5 | A measured (not asserted) end-to-end cost figure per stage, published in reports/ |
 
 ## 4. Honesty register (the paper's own discipline, applied to this plan)
 
diff --git a/global/crew/independent-reviewer.md b/global/crew/independent-reviewer.md
index e6cc514..964cc4c 100644
--- a/global/crew/independent-reviewer.md
+++ b/global/crew/independent-reviewer.md
@@ -22,6 +22,8 @@ Rules:
 - Every finding cites `file:line` and a concrete failure scenario (inputs → wrong
   result). A finding you can't ground in the diff is not a finding — prefer to refute.
 - You are independent: do not rationalize the change the way its author's context would.
+- A reused artifact or cited ledger claim: verify provenance with `forge ledger
+  blame <id-prefix>` — trust the oracle history, not the author's say-so.
 
 Output: **VERDICT** (block | allow), then findings ranked most-severe first, then one
 line naming what would flip a block to allow. Keep it tight.
diff --git a/global/crew/verifier.md b/global/crew/verifier.md
index f17333d..844e93f 100644
--- a/global/crew/verifier.md
+++ b/global/crew/verifier.md
@@ -16,6 +16,8 @@ Check for:
 - Anything changed outside the task's stated scope.
 
 Where possible, run the project's tests/build/linter and report the actual result.
+For test selection, `forge imagine "<the change>" --run` computes the minimal
+covering test suite and dry-runs it in a sandboxed worktree — run that first.
 
 Output:
 - **Verdict:** ship / fix-first / needs-discussion.
diff --git a/global/tools/cognitive-substrate/SKILL.md b/global/tools/cognitive-substrate/SKILL.md
index 5575f99..0bc7f8b 100644
--- a/global/tools/cognitive-substrate/SKILL.md
+++ b/global/tools/cognitive-substrate/SKILL.md
@@ -16,12 +16,9 @@ blast radius, decompose scope, surface past lessons, and plan verification — *
 
 ## When to run it
 
-Trigger on any ambiguous, expensive, multi-file, or mutating task: edit/refactor/fix/design
-production code, integrate a feature, choose model effort, inspect blast radius, or when a
-request is vague. Skip it for one-line, well-specified fixes.
-
-> In Claude Code this fires automatically on every prompt (UserPromptSubmit hook). In other
-> agents, run it yourself with the CLI, or call the MCP tool `substrate_check`.
+Any ambiguous, expensive, multi-file, or mutating task. Skip one-line, well-specified fixes.
+In Claude Code it fires automatically on every prompt (UserPromptSubmit hook); in other
+agents run the CLI yourself, or call the MCP tool `substrate_check`.
 
 ## Run
 
@@ -40,31 +37,19 @@ forge substrate "<task>" --json     # full contract; use the fields below
 
 ## Worked example
 
-```console
-$ forge substrate "make the auth better"
-  proceed: ASK FIRST
-  assumption: high risk · completeness 0.23
-  clarify:
-    - What exactly should this produce, and how will we know it is correct?
-```
-
-→ Under-specified. Ask the clarify question instead of editing.
-
-```console
-$ forge substrate "Change verifyToken in src/auth.js to require length > 20; update tests"
-  proceed: yes
-  impact: 3 file(s) predicted
-    - src/auth.js
-    - src/login.js      (importer you did not name)
-    - src/session.js    (importer you did not name)
-```
-
-→ Cleared to proceed, but review the two coupled importers first.
+`forge substrate "make the auth better"` → `proceed: ASK FIRST` + clarify
+questions: ask them instead of editing. A clear task returns `proceed: yes` plus
+the impacted files — including importers you didn't name.
 
-## Single-mechanism commands
+## Deeper single checks
 
 `forge preflight "<task>"` (assumptions) · `forge route "<task>"` (model tier) ·
-`forge impact <symbol|file>` (blast radius) · `forge scope <file…>` (decomposition).
+`forge impact <symbol|file>` (blast radius) · `forge scope <file…>` (decomposition) ·
+`forge context "<task>"` (budgeted context assembly; *computes* what's missing) ·
+`forge imagine "<task>" [--run]` (predicted breaks + minimal covering test suite;
+`--run` dry-runs it in a sandboxed worktree) ·
+`forge diagnose "<error>"` (doom-loop: 3× the same failure signature = stop retrying,
+escalate one tier with the minted diagnosis claim at the head of the prompt).
 MCP equivalents: `assumption_gate`, `route_task`, `predict_impact`, `scope_files`.
 
 For the full guide (how it works, extending it, the honesty boundary) and the white paper,
diff --git a/global/tools/cognitive-substrate/references/capability-map.md b/global/tools/cognitive-substrate/references/capability-map.md
index 71c6511..1eca342 100644
--- a/global/tools/cognitive-substrate/references/capability-map.md
+++ b/global/tools/cognitive-substrate/references/capability-map.md
@@ -2,16 +2,16 @@
 
 | Paper capability | Forge surface | Guarantee |
 | --- | --- | --- |
-| Memory | `forge recall`, `forge cortex` | File-backed facts/lessons are persisted and auditable. |
-| Learning | `forge cortex` | External outcomes update lessons; model weights do not change. |
-| Imagination | `forge impact`, `forge substrate` | Static graph simulates possible blast radius. |
-| Self-correction | `forge verify`, doom-loop guard | Tests/builds beat model claims. |
+| Memory | `forge recall`, `forge cortex`, `forge ledger` | Facts/lessons persist as content-addressed ledger claims; `forge ledger blame` shows provenance. |
+| Learning | `forge cortex`, ledger oracles | External outcomes (tests, CI, human accept/revert) move claim confidence; model weights do not change. |
+| Imagination | `forge imagine [--run]`, `forge impact` | Predicted breaks + minimal covering test suite; `--run` dry-runs it in a sandboxed worktree. |
+| Self-correction | `forge verify`, `forge diagnose` | Tests/builds beat model claims; 3× the same failure signature mints a diagnosis + escalation. |
 | Impact-awareness | `forge atlas`, `forge impact` | Known symbols/files and likely dependents are surfaced. |
 | M1 routing | `forge route` | Transparent model-tier recommendation. |
-| M2 assumption gate | `forge preflight`, `forge substrate` | Under-specified tasks return questions. |
+| M2 assumption gate | `forge preflight`, `forge context` | Under-specified tasks return *computed* missing-set questions. |
 | M3 decomposition | `forge scope` | Import clusters show independent vs coupled files. |
-| M4 goal anchoring | `forge substrate` | One pre-action summary anchors goal, risk, and verification. |
-| M5 anti-over-engineering | `forge substrate`, `lean-guard` | Broad/underspecified work gets minimality warnings. |
+| M4 goal anchoring | `forge anchor`, `forge substrate` | Changed files are checked against the stated goal. |
+| M5 anti-over-engineering | `forge lean`, `forge uicheck design` | Footprint vs ask; UI slop-distance + fingerprint conformance gate. |
 | M6 inline verification | `forge verify` | External checks are required before done. |
 
 Limits: static graph edges are conservative; memory relevance and model routing are advisory; non-hook tools cannot be forcibly blocked.
diff --git a/global/tools/cost-guard/SKILL.md b/global/tools/cost-guard/SKILL.md
index c847f27..f174bdb 100644
--- a/global/tools/cost-guard/SKILL.md
+++ b/global/tools/cost-guard/SKILL.md
@@ -25,28 +25,24 @@ deliberately.
 - **Scope investigations.** Never say "investigate X" unbounded — name the files
   or the question, or hand it to `scout`.
 
-## Model choice (balanced)
-- Default working model handles implementation.
-- Cheap model (`scout`) for search/triage/enumeration.
-- Reserve the top model for genuinely hard reasoning, not routine edits.
+## Model choice + measurement
+- `forge route "<task>"` names the cheapest capable tier before you pick a model;
+  escalate only after an external verifier fails.
+- Cheap model (`scout`) for search/triage/enumeration; reserve the top model for
+  genuinely hard reasoning, not routine edits.
+- `forge cost` shows real per-day spend; **`forge cost --stages`** shows the
+  measured per-stage savings (gate / cache / route / context) from
+  `.forge/metrics.jsonl` — a stage with no events says "no data", never a default.
+- `forge reuse query "<spec>"` before regenerating: a hit is verified code you
+  already paid for.
 
 ## Prompt-cache hygiene
-Claude Code caches by exact request *prefix* (system prompt → project context →
-conversation). A change high in the prefix recomputes everything after it — a
-slow, expensive turn. Keep the cache warm:
-- **Pick model + connect MCP servers at session start.** Switching model mid-task
-  (incl. `opusplan` plan-mode toggles) recomputes the whole history — each model
-  has its own cache. This config pins a fixed model to avoid that.
-- **Save `/compact` for natural breaks** between tasks, not mid-task. To abandon a
-  path, prefer `/rewind` (truncates to an already-cached prefix) over `/compact`
-  (builds a new one).
-- **Don't add bare-tool deny rules mid-session** (e.g. deny `Bash`/`WebFetch`) —
-  that changes the tool set and busts the system-prompt layer. Scoped rules like
-  `Bash(rm *)` are cache-safe.
-- **Editing CLAUDE.md/output-style mid-session** is cache-safe but *doesn't apply*
-  until `/clear` or restart — so edit, then restart to pick it up.
-- Watch the status line's `⚡NN%` cache indicator: green is healthy; if it stays
-  low turn after turn, something in your prefix keeps changing.
+Claude Code caches by exact request *prefix*; a change high in the prefix
+recomputes everything after it. Pick model + MCP servers at session start
+(switching mid-task busts the cache); save `/compact` for natural breaks and
+prefer `/rewind` to abandon a path; don't add bare-tool deny rules mid-session
+(scoped rules like `Bash(rm *)` are cache-safe); watch the status line's `⚡NN%`
+indicator — if it stays low turn after turn, your prefix keeps changing.
 
 ## Fan-out for big batches
 For repetitive edits across many files, generate the file list first, test the
diff --git a/global/tools/design-md/SKILL.md b/global/tools/design-md/SKILL.md
index c09163c..b87442c 100644
--- a/global/tools/design-md/SKILL.md
+++ b/global/tools/design-md/SKILL.md
@@ -8,15 +8,13 @@ description: Create and maintain a per-project DESIGN.md that pins the ONE visua
 The fix for "UI comes out inconsistent" is a single written source of visual
 truth per project. `ui-workflow` says pick one direction — `DESIGN.md` is where
 that direction lives so every session and screen obeys the same rules.
+`forge taste <style>` writes a managed one from Forge's menu; hand-write it only
+for a bespoke direction.
 
-## When to create it
-At the start of UI work on a repo, or the first time output drifts. One file at
-repo root: `DESIGN.md`. Reference it from the project `CLAUDE.md`
-(`See @DESIGN.md for visual rules`) so Claude loads it.
-
-## Keep it tight (it's read often)
-Concrete rules and tokens, not adjectives. "Primary #4F46E5, 8pt spacing scale,
-Inter" — not "modern and clean". Prune anything Claude already gets right.
+Create it at the start of UI work, or the first time output drifts. One file at
+repo root; reference it from the project `CLAUDE.md` (`See @DESIGN.md for visual
+rules`) so Claude loads it. Keep it tight: concrete rules and tokens, not
+adjectives — "Primary #4F46E5, 8pt spacing scale, Inter", not "modern and clean".
 
 ## Template
 ```markdown
@@ -32,7 +30,7 @@ One sentence + 1-2 reference links/screenshots. The single aesthetic. Don't mix.
 - Breakpoints: mobile / tablet / desktop widths
 
 ## Components
-- Library: <shadcn/ui via MCP | project components> — reuse, don't hand-roll
+- Library: <project components / component system> — reuse, don't hand-roll
 - Buttons/inputs/cards: variants + states (default/hover/focus/disabled) rules
 - Density, alignment, and layout grid rules
 
@@ -48,8 +46,9 @@ hit targets ≥ 44px.
 Links to the reference site(s)/Figma this design matches.
 ```
 
-## Use it
-- Building UI: load DESIGN.md, follow it exactly, pull components via the shadcn
-  MCP / project library, then run `ui-workflow`'s screenshot-verify against the
-  DESIGN.md references and the `frontend-verifier` agent.
-- When the user approves a new visual decision, update DESIGN.md so it sticks.
+## Enforce it (prose steers; the gate checks)
+Once real UI matches the direction, mint its fingerprint:
+`forge uicheck fingerprint <ui files> --mint`. Then `forge uicheck design <files>
+--taste <style>` gates new UI against the taste constraints + project fingerprint
+(a Forge-managed DESIGN.md is picked up automatically). When the user approves a
+new visual decision, update DESIGN.md and re-mint so it sticks.
diff --git a/global/tools/recall/SKILL.md b/global/tools/recall/SKILL.md
index aca5b61..4e26175 100644
--- a/global/tools/recall/SKILL.md
+++ b/global/tools/recall/SKILL.md
@@ -6,14 +6,15 @@ description: Forge's cross-session memory. Use when the user says "remember this
 # recall — durable cross-session memory
 
 File-based memory shared across every session and tool. The `recall-load` guard
-injects the index at session start — you don't fetch it.
+injects the index at session start — you don't fetch it. Facts also land as
+claims in the team ledger (`.forge/ledger/`): conflict-free merge across
+teammates, provenance via `forge ledger blame <id-prefix>`.
 
 ## When to record
 Only durable, non-obvious facts that will matter in a FUTURE session:
 - Environment quirks (required env vars, non-standard build/run commands).
 - Architectural decisions and the WHY behind them.
 - Gotchas that already bit someone ("X fails unless Y first").
-- Stable goals/constraints not derivable from the code.
 
 Never record: things obvious from the code, transient task state, or anything
 secret/PII. `forge recall add` refuses credential-looking content — store a pointer
diff --git a/global/tools/self-improve/SKILL.md b/global/tools/self-improve/SKILL.md
index 3b7cecc..829ebbc 100644
--- a/global/tools/self-improve/SKILL.md
+++ b/global/tools/self-improve/SKILL.md
@@ -6,43 +6,39 @@ description: Self-correction and cross-session learning loop. Use when a check f
 # Self-improve
 
 Honest scope: you can't reinforcement-learn a hosted model's weights in a config.
-What IS real and works here is **experiential (in-context) learning** — correct
-within the session, and persist durable lessons so the next session starts better.
-Two loops:
+What works is **experiential learning** — correct within the session, persist
+durable lessons for the next one. Two loops:
 
 ## Loop A — self-correct (within a session)
 Close the loop yourself instead of waiting for the user to catch errors:
 1. Run a check that returns pass/fail: tests, build, typecheck, lint, or a
-   screenshot diff (UI). 
+   screenshot diff (UI).
 2. On fail, read the actual error and diagnose the **root cause** — don't patch
-   the symptom or suppress it.
+   the symptom or suppress it. Record it: `forge diagnose "<error>" --file <f>`.
 3. Fix, then re-run the same check. Show the evidence (command + result).
-4. Cap it: after ~3 failed attempts on the same check, STOP looping. Summarize
-   what you tried, and either `/clear` and restart with a sharper prompt or ask
-   one specific question. Repeated failed patches pollute context and make it
-   worse (Claude Code also force-stops a Stop-hook check after 8 blocks).
+4. Cap it: `forge diagnose` counts recurrences — the 3rd identical failure
+   signature mints a **diagnosis claim** in the team ledger and says STOP.
+   Don't keep retrying: state the diagnosis (`forge ledger show <id>`), add what
+   you tried, and escalate ONE model tier with the diagnosis at the head of the
+   new prompt — never a bare "try again, but more expensive". Repeated failed
+   patches pollute context and make it worse.
 Use the `verifier` / `frontend-verifier` subagents for an independent check on
 non-trivial diffs.
 
 ## Loop B — capture the lesson (across sessions)
 When something was non-obvious — the user corrected you twice on the same point,
 or a fix depended on a project gotcha — record it so it's not re-learned next time:
-- Persist it with the installed memory stack (`remember` / episodic-memory) or, for
-  project facts, a one-line entry in the repo's `AGENTS.md` / `CLAUDE.md`.
+- Cortex captures recurring corrections on its own as you work; for explicit
+  facts, `forge recall add "<name>" "<fact>"` (or a one-line entry in the repo's
+  `AGENTS.md`).
 - Keep it a rule, not a story: "In <project>, X fails unless Y — do Y first."
 - Never store secrets/PII. Delete lessons that turn out wrong.
-On the next session, the memory system reloads these, so past mistakes don't repeat.
+Lessons and facts land as claims in `.forge/ledger/` — confidence moves only when
+independent oracles (tests, CI, human accept/revert) confirm or refute them, and
+`forge ledger blame <id>` shows that history.
 
 ## What "self-evolving" honestly means here
-- **Code knowledge** self-updates via Graphify's post-commit hook (`graphify hook
-  install`) — the project graph stays current as you commit. That's a real,
-  working self-evolving artifact.
-- **Behaviour** improves through Loop B (captured lessons) + your `rules/` and
-  `AGENTS.md`, which you refine when a correction recurs.
-- Anything promising weight-level RL / self-training of Claude from a local config
-  is overstating it — treat those claims with `tech-selector` skepticism.
-
-## Note
-An automated `continuous-learning` Stop hook is already installed but `skills/learned/`
-is empty (it hasn't been producing lessons). This explicit skill is the reliable
-path; the automated hook can be debugged separately if you want it too.
+Code knowledge stays current via the atlas (`forge atlas build`); behaviour
+improves through Loop B, and the ledger demotes lessons that stop earning
+confirmations. Anything promising weight-level RL from a local config is
+overstating it — treat those claims with `tech-selector` skepticism.
diff --git a/global/tools/taste/SKILL.md b/global/tools/taste/SKILL.md
index c6130b0..8c7e689 100644
--- a/global/tools/taste/SKILL.md
+++ b/global/tools/taste/SKILL.md
@@ -5,18 +5,22 @@ description: Pick a visual design direction for a repo from Forge's menu (minima
 
 # taste — choose one design direction
 
-Forge ships a MENU of visual directions; each repo pins exactly ONE (consistency),
-chosen from the menu (optionality).
+Forge ships a MENU of visual directions; each repo pins exactly ONE.
 
 - `forge taste` — list the available styles.
 - `forge taste <style>` — write that style's spec to this repo's `DESIGN.md`.
 
-Because the shared rules tell every tool to "follow DESIGN.md if present," setting a
-taste once makes Claude Code, Cursor, Codex, Gemini, and the rest all build in that
-direction. Switch anytime with `forge taste <other>` (it regenerates DESIGN.md).
+The shared rules tell every tool to "follow DESIGN.md if present," so setting a
+taste once steers Claude Code, Cursor, Codex, Gemini, and the rest. Switch anytime
+with `forge taste <other>` (it regenerates DESIGN.md).
 
 Styles: minimalist (restraint) · brutalist (raw/high-contrast) · editorial
 (magazine/typographic) · playful (friendly/rounded) · corporate (trustworthy/AA).
 
+Each style ships machine-readable constraints: prose steers generation, but
+`forge uicheck design <files> --taste <style>` *checks* the result (style
+auto-detected from a Forge-managed DESIGN.md). Mint the project fingerprint from
+approved UI — `forge uicheck fingerprint <files> --mint` — to gate conformance too.
+
 Don't hand-edit a Forge-managed DESIGN.md — re-run `forge taste`, or delete the
 marker line to take it over yourself.
diff --git a/global/tools/ui-workflow/SKILL.md b/global/tools/ui-workflow/SKILL.md
index 49f7cf7..0d55c34 100644
--- a/global/tools/ui-workflow/SKILL.md
+++ b/global/tools/ui-workflow/SKILL.md
@@ -5,41 +5,40 @@ description: Reliable workflow for building or fixing UI so results look intenti
 
 # UI workflow
 
-UI is unreliable when taste is vague and there's no visual check. Fix both: lock
-one visual direction, build on a real component system, then verify with a
-screenshot instead of guessing.
+UI is unreliable when taste is vague and there's no check. Fix both: lock ONE
+visual direction, build on the project's real components, then verify with the
+deterministic design gate and a screenshot instead of guessing.
 
-## 0. Pick ONE direction — don't stack taste skills
-This machine has many competing "taste"/design skills (ui-ux-pro-max,
-design-taste-frontend, high-end-visual-design, minimalist-ui,
-industrial-brutalist-ui, stitch-design-taste, brandkit, …). Using several at once
-produces muddy, inconsistent output. For a given project, choose **one** taste
-source and stick to it. If unsure, ask the user for a reference (a URL or
-screenshot) and match that.
+## 0. Pick ONE direction — don't stack taste sources
+Competing taste/design skills produce muddy, inconsistent output. Per project,
+choose **one** source of visual truth: the repo's `DESIGN.md` (create it with
+`forge taste <style>` or the `design-md` tool), or a reference URL/screenshot
+from the user. If none exists, ask.
 
 ## 1. Ground the components (current APIs, not memory)
-- Reuse the project's existing components and design tokens first.
-- For shadcn/ui: use the **shadcn MCP** (`get_component`, `get_block`, `list_blocks`,
-  `apply_theme`) to pull real, current component code — don't hand-write it.
-- For any library's props/API, confirm via **Context7** rather than recalling it.
-- New visuals (icons, imagery): use the imagegen/frontend skills already installed
-  rather than inventing SVGs.
+- Reuse the project's existing components and design tokens first —
+  `forge atlas query <Component>` finds them.
+- Confirm any library's props/API against current docs, not recall; vet new
+  dependencies with `tech-selector`.
 
 ## 2. Build
-- Match the project's stack (most of yours are Next.js). Tailwind + a component
-  system (shadcn/Radix) over bespoke CSS unless the project says otherwise.
+- Match the project's stack and component system over bespoke CSS.
 - Accessibility is not optional: labels, focus states, contrast, keyboard nav.
-  Run the installed web-design-guidelines/accessibility skills on the result.
 
-## 3. Verify visually (the step that makes UI reliable)
-- Render it and **screenshot** with the Playwright or chrome-devtools MCP (both
-  installed). Check desktop AND a mobile width.
-- Compare against the reference/design. List concrete differences (spacing,
-  hierarchy, color, alignment) and fix them. Iterate until it matches — don't
-  declare it done from the code alone.
-- For a second opinion, hand the screenshot + reference to the `frontend-verifier`
-  subagent.
+## 3. Verify (the step that makes UI reliable)
+- **Deterministic gate first:** `forge uicheck design <files> --taste <style>`
+  (exit 1 on fail) — slop distance to generic templates must stay HIGH,
+  conformance to the project's minted fingerprint must stay LOW, spacing/radius/
+  shadow on scale. Failures are per-feature edits, not a score. If the repo has
+  no fingerprint yet, mint one from approved UI:
+  `forge uicheck fingerprint <files> --mint`.
+- `forge uicheck contrast <fg> <bg>` for exact WCAG math — never eyeball it.
+- **Then screenshot:** render at desktop AND mobile widths, compare against the
+  reference/DESIGN.md, list concrete differences (spacing, hierarchy, color,
+  alignment) and fix. For a second opinion, hand the screenshot + reference to
+  the `frontend-verifier` subagent.
 
 ## Done =
-Matches the reference at both breakpoints, passes accessibility checks, uses the
-project's tokens/components, and you've shown the final screenshot as evidence.
+Passes `forge uicheck design`, matches the reference at both breakpoints, passes
+accessibility checks, uses the project's tokens/components, and you've shown the
+final screenshot as evidence.
diff --git a/skills/cognitive-substrate/SKILL.md b/skills/cognitive-substrate/SKILL.md
index 5575f99..0bc7f8b 100644
--- a/skills/cognitive-substrate/SKILL.md
+++ b/skills/cognitive-substrate/SKILL.md
@@ -16,12 +16,9 @@ blast radius, decompose scope, surface past lessons, and plan verification — *
 
 ## When to run it
 
-Trigger on any ambiguous, expensive, multi-file, or mutating task: edit/refactor/fix/design
-production code, integrate a feature, choose model effort, inspect blast radius, or when a
-request is vague. Skip it for one-line, well-specified fixes.
-
-> In Claude Code this fires automatically on every prompt (UserPromptSubmit hook). In other
-> agents, run it yourself with the CLI, or call the MCP tool `substrate_check`.
+Any ambiguous, expensive, multi-file, or mutating task. Skip one-line, well-specified fixes.
+In Claude Code it fires automatically on every prompt (UserPromptSubmit hook); in other
+agents run the CLI yourself, or call the MCP tool `substrate_check`.
 
 ## Run
 
@@ -40,31 +37,19 @@ forge substrate "<task>" --json     # full contract; use the fields below
 
 ## Worked example
 
-```console
-$ forge substrate "make the auth better"
-  proceed: ASK FIRST
-  assumption: high risk · completeness 0.23
-  clarify:
-    - What exactly should this produce, and how will we know it is correct?
-```
-
-→ Under-specified. Ask the clarify question instead of editing.
-
-```console
-$ forge substrate "Change verifyToken in src/auth.js to require length > 20; update tests"
-  proceed: yes
-  impact: 3 file(s) predicted
-    - src/auth.js
-    - src/login.js      (importer you did not name)
-    - src/session.js    (importer you did not name)
-```
-
-→ Cleared to proceed, but review the two coupled importers first.
+`forge substrate "make the auth better"` → `proceed: ASK FIRST` + clarify
+questions: ask them instead of editing. A clear task returns `proceed: yes` plus
+the impacted files — including importers you didn't name.
 
-## Single-mechanism commands
+## Deeper single checks
 
 `forge preflight "<task>"` (assumptions) · `forge route "<task>"` (model tier) ·
-`forge impact <symbol|file>` (blast radius) · `forge scope <file…>` (decomposition).
+`forge impact <symbol|file>` (blast radius) · `forge scope <file…>` (decomposition) ·
+`forge context "<task>"` (budgeted context assembly; *computes* what's missing) ·
+`forge imagine "<task>" [--run]` (predicted breaks + minimal covering test suite;
+`--run` dry-runs it in a sandboxed worktree) ·
+`forge diagnose "<error>"` (doom-loop: 3× the same failure signature = stop retrying,
+escalate one tier with the minted diagnosis claim at the head of the prompt).
 MCP equivalents: `assumption_gate`, `route_task`, `predict_impact`, `scope_files`.
 
 For the full guide (how it works, extending it, the honesty boundary) and the white paper,
diff --git a/skills/cognitive-substrate/references/capability-map.md b/skills/cognitive-substrate/references/capability-map.md
index 71c6511..1eca342 100644
--- a/skills/cognitive-substrate/references/capability-map.md
+++ b/skills/cognitive-substrate/references/capability-map.md
@@ -2,16 +2,16 @@
 
 | Paper capability | Forge surface | Guarantee |
 | --- | --- | --- |
-| Memory | `forge recall`, `forge cortex` | File-backed facts/lessons are persisted and auditable. |
-| Learning | `forge cortex` | External outcomes update lessons; model weights do not change. |
-| Imagination | `forge impact`, `forge substrate` | Static graph simulates possible blast radius. |
-| Self-correction | `forge verify`, doom-loop guard | Tests/builds beat model claims. |
+| Memory | `forge recall`, `forge cortex`, `forge ledger` | Facts/lessons persist as content-addressed ledger claims; `forge ledger blame` shows provenance. |
+| Learning | `forge cortex`, ledger oracles | External outcomes (tests, CI, human accept/revert) move claim confidence; model weights do not change. |
+| Imagination | `forge imagine [--run]`, `forge impact` | Predicted breaks + minimal covering test suite; `--run` dry-runs it in a sandboxed worktree. |
+| Self-correction | `forge verify`, `forge diagnose` | Tests/builds beat model claims; 3× the same failure signature mints a diagnosis + escalation. |
 | Impact-awareness | `forge atlas`, `forge impact` | Known symbols/files and likely dependents are surfaced. |
 | M1 routing | `forge route` | Transparent model-tier recommendation. |
-| M2 assumption gate | `forge preflight`, `forge substrate` | Under-specified tasks return questions. |
+| M2 assumption gate | `forge preflight`, `forge context` | Under-specified tasks return *computed* missing-set questions. |
 | M3 decomposition | `forge scope` | Import clusters show independent vs coupled files. |
-| M4 goal anchoring | `forge substrate` | One pre-action summary anchors goal, risk, and verification. |
-| M5 anti-over-engineering | `forge substrate`, `lean-guard` | Broad/underspecified work gets minimality warnings. |
+| M4 goal anchoring | `forge anchor`, `forge substrate` | Changed files are checked against the stated goal. |
+| M5 anti-over-engineering | `forge lean`, `forge uicheck design` | Footprint vs ask; UI slop-distance + fingerprint conformance gate. |
 | M6 inline verification | `forge verify` | External checks are required before done. |
 
 Limits: static graph edges are conservative; memory relevance and model routing are advisory; non-hook tools cannot be forcibly blocked.