v1.6.0 - Enhance mode

Enhance mode, plus ten mechanical guards. The v1.5.0 loop could only find what was wrong; this release lets the same discipline be pointed at what could be better, and hardens the places the eval corpus showed a run could still mislead itself.

Added

• Enhance mode: /jeffy [N] enhance <topic> runs the loop against a stated topic instead of the defect rubric. Iteration 1 is an opportunity audit of the topic's surface; tasks are ranked by impact in the severity slot, worked one per iteration, each with an acceptance check observed to fail against the unimproved tree first. A new plan template, references/enhance-plan-default.md, carries the mode - the topic bounds the run the way the Operating envelope bounds a defect run, and an opportunity exists only if you can point at it. A defect found mid-run is recorded to Proposed and never filed at severity unless it blocks the task in flight, so an Enhance run cannot widen into an uninvited audit. The Stop hook, verify gate, checkpoints, journal, and evaluator gate are untouched and identical in both modes.
• Mode guard: an Enhance launch over a standard PLAN.md, and a standard launch over an Enhance one, are both refused - the two rank work differently and their ledgers must never mix in one set of state files. A PLAN.md with no ## Mode section is a user-authored plan and reads as standard. enhance with no topic is refused with usage text; an unbounded make-it-better run is the invented work the envelope exists to prevent.
• Closing-extension backstop: the +2 window buys the convergence sequence, not another round of work. When non-evaluator work refills the ledger inside the extension, the hook ends the run instead of re-feeding it; evaluator-filed tasks proceed under the one-transaction endgame. The finding rides the run report as the next run's first task.
• Truncator refusal: a Verify command whose last pipeline stage is head or tail is refused, at launch by pre-flight check 6 and again at the converged stop. Such a pipeline reports the truncator's exit status, so a red suite reads as green - the one shape that could have let a broken project converge.
• JEFFY_VERSION in the engine: stated in every RUN STATE line, announced at launch from the installed hook rather than the repo copy, and asked for in the bug-report template.
• Four launch pre-flight guards, all zero-iteration cost: core.autocrlf set to true on Windows (checkpoint diffs would show every line changed), a project that is a subdirectory of a larger git repo (checkpoints would commit the parent's tree), a nested project inside another Jeffy project, and a dirty tree whose modified paths are all symlinks (a cross-filesystem tree, not real changes).
• macOS CI leg: validate-macos on macos-latest. BSD sed, grep, and stat differ from GNU and nothing exercised them before. It found a real defect on its first run, below.
• The verify gate no longer needs GNU coreutils. The hook enforces the timeout with timeout, else gtimeout, else a shell watchdog, so the converged stop re-runs the project's verify command on a stock macOS exactly as it does everywhere else. The three validator scenario groups that used to skip without a timeout binary now run on every leg, and all three legs report the same 125 checks.

Fixed

• The static verify gates were disarmed on every Mac. Parsing the Command: line, the bash -n runnability check, and the truncator refusal all sat behind command -v timeout, so on a host without GNU coreutils none of them ran and the gate was skipped outright. A macOS user whose gate was pytest | tail -1 could converge over a red suite with no diagnostic - the exact failure the truncator refusal was written to stop. Only the run needs a timeout binary; the static checks now always execute. Found by the new macOS CI leg on its first run.

Changed

• Persistent probe batteries declare their paths. A battery under .jeffy/probes/ names the paths it owns; an iteration that touches one of those paths runs that battery in the same iteration, and a battery failure counts as a Verify failure. A battery that pins behaviour a fix changes is updated in that same iteration.
• A clean Testing score costs one isolated run. Scoring Testing None requires at least one test module executed on its own first - a suite green only as a whole hides order dependence and shared-fixture leakage.
• Generalising prose claims ship with their enumeration. A claim over a set of sites - the error names X, no temporary is left behind, reachable only when Y - ships in the same iteration with the enumeration of that set, and its executing check drives every enumerated site. For a claim about failures the enumeration is built by provoking a failure at every step of the operation, never by grepping the source for the calls it makes. If the enumeration cannot be produced that iteration, the sentence narrows to the single site actually verified.
• A fix re-executes the claims it invalidates. Before the checkpoint, the checks behind every prose claim and stated number in the state files, in the modules the diff touches, and in their direct siblings are re-run. A line number is never written into a state file - state the shape the enumerating command returns.
• README counts are derived, never transcribed. The validator computes the eval-receipt numbers from the evals table and fails on a mismatch, closing the class where a hand-typed number quietly goes stale.
• media/flowchart.mmd and both rendered PNGs redrawn for the extension backstop branch, with the REFILL edge on the re-feed path where the backstop actually fires. README gains a first-class Enhance mode section; README and SECURITY.md enumerate the new gates and the third CI leg; the validator grew to 125 behavioural checks on each CI leg.

Upgrading

Re-run the installer. It overwrites the skill folders in ~/.claude/skills and leaves the hook registration alone if it is already correct. Existing PLAN.md, BACKLOG.md, and JOURNAL.md files keep working; the loop-state schema is additive.

Every run now opens by naming its engine version. If you file a bug, include that line.