diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..c8175cd
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Every change needs an approving review from an author who did not write it.
+* @max578 @aidanmoller
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index b4bcebc..b5a98b8 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -9,6 +9,12 @@ Link the issue this closes, so that merging closes it:
 <!-- One or two sentences. The why matters more than the what, which the diff
      already shows. -->
 
+## Plan
+
+<!-- The plan.md this change implements (dev/work/<date>-<slug>/plan.md), and
+     any departure from it, recorded in the same commit as the change. A
+     change to the numerical core without a plan is a review finding. -->
+
 ## How it was checked
 
 <!-- Which of these ran, and what they said. A change to the numerical core
@@ -21,6 +27,7 @@ Link the issue this closes, so that merging closes it:
 - [ ] `R CMD check --as-cran`
 - [ ] `Rscript tools/oracle/check_fixture_provenance.R`, if any fixture changed
 - [ ] `NEWS.md` entry, for anything a user would notice
+- [ ] Any test, fixture or tolerance changed is listed here
 
 ## Anything left open
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..a408093
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,35 @@
+# Contributing
+
+`acir` is developed by its two authors under the process in `dev/PROCESS.md`.
+Contributions from outside are welcome and pass through the same stages.
+
+## Proposing a change
+
+Open an issue, or write an `intent.md` from `dev/work/_template/` in a new
+directory `dev/work/<date>-<slug>/` and open a pull request containing only
+it. An accepted intent is one whose pull request merges.
+
+## Building a change
+
+Write `plan.md` before code: the files that change, the order of work, the
+risks, and the proof that the change works. Commit it. Then make the change,
+and if the implementation departs from the plan, update the plan in the same
+commit.
+
+## Before opening a pull request
+
+Run the four gates in `dev/PROCESS.md` and quote their output in the pull
+request under *How it was checked*. A change to the numerical core needs the
+oracle tests, not only a green suite, because those are graded against a
+source this repository did not author.
+
+## Review
+
+Every pull request is reviewed under `REVIEW.md` and needs one approving
+review from an author who did not write it. Branch protection on
+`acir-package` and `main` enforces this and the required checks.
+
+## Reporting
+
+Bugs and numerical disagreements have issue templates under
+`.github/ISSUE_TEMPLATE/`. Security reports go through `SECURITY.md`.
diff --git a/REVIEW.md b/REVIEW.md
new file mode 100644
index 0000000..10c01d9
--- /dev/null
+++ b/REVIEW.md
@@ -0,0 +1,31 @@
+# Review policy
+
+This applies to every pull request into `acir-package` and `main`, and to
+every reviewer, human or automated. A review is a list of findings ranked by
+severity. Approval is a separate act, by an author who did not write the
+change, and branch protection requires it before a merge.
+
+## Three passes
+
+1. **Numbers.** Does any graded quantity move? Check the evidence register
+   (`acir/inst/evidence/register.csv`), the fixtures it names and their
+   tolerance classes. A test, fixture or tolerance that changed is a finding
+   whether or not the pull request declares it.
+2. **Code.** Logic errors and edge cases: short records, one-dimensional
+   against multi-dimensional states, the freeze paths, the generic-model
+   route against the library route. The provenance of any ported kernel.
+3. **Compliance.** Does the change match its `plan.md`, with departures
+   recorded in the same commit? Is there a `NEWS.md` entry for anything a
+   user would notice, and a register row for any new export?
+
+## Blocking against nit
+
+Blocking: a number outside its tolerance; a test weakened or removed; a gate
+bypassed; a fixture changed without provenance; a change to the numerical
+core without a plan. Everything about style, naming or wording is a nit.
+Report at most five nits and give the rest as a count.
+
+## Not reported
+
+Anything CI already enforces (lint, check, coverage, bench), generated files
+(`man/`, `NAMESPACE`), and the parents' code at the tag `parents-final`.
diff --git a/dev/PROCESS.md b/dev/PROCESS.md
new file mode 100644
index 0000000..9cb19a6
--- /dev/null
+++ b/dev/PROCESS.md
@@ -0,0 +1,97 @@
+# How `acir` is developed
+
+This document describes the development process of the repository: the
+stages a change passes through, the artefact each stage commits, the gate
+that closes it, and who decides. It follows the stage-and-artefact discipline
+of the AI-native software development lifecycle playbook (Claxton, 2026),
+adapted to a two-author scientific package whose deliverable is a numerical
+result graded against the method authors' reference implementation.
+
+Development uses AI coding assistance. The process below is what makes that
+assistance auditable: what was asked is committed before what was built, what
+was built is graded against a source its author did not write, and every
+change is approved by an author who did not make it. `dev/acir-process-rationale.md`
+records how the package was assembled before this process was written down;
+this process applies from 2026-09-02.
+
+## The stages
+
+| Stage | Artefact | Where it lives | Gate | Who decides |
+|:---|:---|:---|:---|:---|
+| Plan | `intent.md`: problem, proposed outcome, affected code, constraints, open questions | `dev/work/<date>-<slug>/intent.md` | accepted by the other author when its pull request merges | the authors |
+| Design | `spec.md`: requirements, design, flagged concerns | same directory; the package-level specification is `dev/specification.md` | flagged concerns resolved before engineering starts; the other author signs off | the authors |
+| Build | `plan.md`: files that change, order of work, risks, proof | same directory, committed before code; a departure is recorded in the same commit as the change that causes it | a reader unfamiliar with the change could implement it from the plan alone | the author of the change |
+| Test | the diff, its tests, the evidence register | `acir/tests/`, `acir/inst/evidence/register.csv`, `.github/workflows/` | the four gates below, locally before the pull request and again in CI | CI, deterministically |
+| Deploy | review findings ranked by severity | the pull-request thread, under `REVIEW.md` | one approving review from an author who did not write the change; branch protection enforces it | the reviewing author |
+| Maintain | incident record | a new `intent.md` | a bench breach or a numerical disagreement re-enters at Plan | the authors |
+
+## The four gates
+
+Every pull request into `acir-package` carries these, and CI runs them again.
+
+1. **Numbers.** Every fixture in `acir/inst/evidence/register.csv` at its
+   tolerance class, and the package's stored outputs on the reference records
+   within 1e-12 of their values before the change. A change that moves a
+   number beyond round-off is a change of method and is reviewed as one.
+2. **Time.** The Section 8 stages timed against the committed baseline
+   (`tools/bench/baseline.csv`) on the CI runner, relative to the runner
+   (`.github/workflows/bench.yaml`).
+3. **Hygiene.** `R CMD check --as-cran` at zero errors and zero warnings on
+   six platforms, lint clean, coverage not below the floor, fixture
+   provenance verified (`tools/oracle/check_fixture_provenance.R`).
+4. **Provenance.** Every ported kernel names its source file and function and
+   the tag it was taken from, in the roxygen and in `acir/NEWS.md`.
+
+## Verifying a change before opening a pull request
+
+Run from the repository root, with the package installed from source. Each
+command exits non-zero on failure, and its output is quoted in the pull
+request under *How it was checked*.
+
+```sh
+Rscript -e 'devtools::test("acir")'
+Rscript -e 'lintr::lint_package("acir")'
+R CMD build acir && R CMD check --as-cran acir_*.tar.gz
+Rscript tools/oracle/check_fixture_provenance.R
+```
+
+If a test fails, the fix is to the code. A change to a test, to a fixture or
+to a tolerance is a change to the evidence, is listed in the pull request,
+and is a review finding in its own right.
+
+## Correspondence to the playbook
+
+| Play in the playbook | Practice here | Status |
+|:---|:---|:---|
+| Capture as `intent.md` | `dev/work/<date>-<slug>/intent.md` | in use |
+| Requirements and design as `spec.md` | `dev/work/<date>-<slug>/spec.md`; package-level `dev/specification.md` | in use |
+| Plan before code, `plan.md` | `dev/work/<date>-<slug>/plan.md`, committed before the change | in use |
+| Institutional knowledge as agent configuration (`CLAUDE.md`, skills, hooks) | not part of this repository; each author's tooling configuration stays with that author | not used in the repository |
+| Parallel sessions in worktrees | one branch per work package, one writer per branch | in use |
+| Feedback loop before reporting done | the four gates, run locally and in CI | in use |
+| Continuous evaluation of agent configuration | not applicable to the repository | not used |
+| Review loop under a written policy | `REVIEW.md`; approval by a human author is required | in use |
+| Hooks as approval gates | branch protection on `acir-package` and `main`: pull request required, one approving review, nine required checks, no force push | in use, enforced by the host |
+| An agent inside CI/CD | not used; CI is deterministic | not used |
+| Control bands in maintenance | `bench.yaml` compares every run with `baseline.csv`; a breach is triaged by the authors and re-enters as an intent | in use, with a manual response |
+| Recurring security scans | not used; the package opens no network connection (`SECURITY.md`) | not used |
+| On-call automation | not applicable | not used |
+
+## What is measured
+
+Read from the pull-request history when needed, not automated: the share of
+pull requests whose checks pass on the first run, the time from a pull request
+opening to its first review, and whether the merged diff matches the committed
+plan. The bench workflow records the timing of every run as an artefact.
+
+## First recorded instance
+
+`dev/work/2026-09-01-performance/` is the performance work package: the
+intent and specification were recorded inside its plan at the time and are
+separated here, and the plan is the version approved on 2026-09-01 after
+review. Later work packages start from `dev/work/_template/`.
+
+## Reference
+
+Claxton, L. (2026, August 21). *The AI-native SDLC playbook*. Anthropic.
+https://claude.com/blog/the-ai-native-sdlc-playbook
diff --git a/dev/specification.md b/dev/specification.md
new file mode 100644
index 0000000..73eb7d3
--- /dev/null
+++ b/dev/specification.md
@@ -0,0 +1,404 @@
+# acir: specification of the core engine for assimilative causal inference
+Max Moldovan
+2026-08-28
+
+**Status.** Version 1.1, consolidated on 2026-08-28 from version 1.0 (same
+day) and its technical review by Aidan Moller; promoted into the repository on
+2026-09-02 with its content unchanged. This is the package-level specification
+that the work packages under `dev/work/` refine. Of the five decisions in its
+closing section: decision 2 was implemented (the parents were removed from the
+tree and retained at the tag `parents-final`); decision 1 was resolved as
+built, `method = "exact"` remaining the default of the influence range
+(`dev/acir-process-rationale.md`, section 4.7); decisions 3, 4 and 5 remain
+open, and decision 4 is among the open items in section 9 of that document.
+
+- [Summary](#summary)
+- [Provenance and the one rule](#sec-provenance)
+  - [What each source contributes](#what-each-source-contributes)
+  - [The scope rule](#the-scope-rule)
+  - [What is in version 1.0 and when](#what-is-in-version-10-and-when)
+- [Public interface](#sec-interface)
+  - [Where the functions of `aci` 0.0.30
+    go](#where-the-functions-of-aci-0030-go)
+- [Model contract](#sec-contract)
+- [Architecture](#sec-architecture)
+- [Numerical policies](#sec-policies)
+- [Evidence](#sec-evidence)
+- [Performance, revised](#sec-performance)
+- [Packaging, authorship and licences](#sec-packaging)
+- [Versioning, tags and the repository](#sec-versioning)
+- [Build plan, restated against the engine as built](#sec-plan)
+- [Consolidation record](#sec-record)
+- [Decisions](#sec-decisions)
+- [References](#references)
+
+# Summary
+
+`acir` is one R package that computes assimilative causal inference
+(ACI) for conditional Gaussian nonlinear systems exactly as the method’s
+authors define it: every quantity they compute in closed form, checked
+number by number against their published MATLAB programs, in base R with
+no dependencies beyond `stats` and `graphics`, and built so that later
+methods are callers of the engine rather than rewrites of it.
+
+It is the hybrid of `aciR` 0.2.3 (Max Moldovan) and `aci` 0.0.30 (Aidan
+Moller). Version 1.0 of this specification was written before either of
+us knew that a working merge of the two packages had already been
+completed on the `aci` side, blind to the specification. The technical
+review of v1.0 reports that the merge matches the scope rule, name,
+licence and numerical policies almost exactly, that it passes every
+`ACI_code` fixture (the v1.0 milestone `acir-v0.1.0`), and that it adds
+eight findings the specification lacked. This version consolidates the
+two: the specification is now stated against the engine as built, every
+review item is recorded as applied, revised or left for decision, and
+the build plan is restated as the audit of that engine plus the staged
+work that remains. The merged engine has not yet been run on this side
+(it is not on a shared branch), so its reported state is carried as
+reported until it is.
+
+# Provenance and the one rule
+
+## What each source contributes
+
+| Source | Contributes to `acir` | Checked against |
+|----|----|----|
+| Andreou, Chen and Bollt (2026), `ACI_code` (MIT, Marios Andreou) | filter, smoother, causal measure with signal and dispersion parts, fixed-lag online smoother, forward influence range, conditional question by masking, the dyad, predator-prey and ENSO systems including the scalar ENSO partitions and the T_C zeroth-order case | stored outputs of the authors’ scripts (173 graded rows in the comparison; the engine adds source-derived fixtures for the partitions and the T_C case) |
+| Andreou and Chen (2026), `FBCIR_code` (MIT, Marios Andreou; commit f9fe922, 2026-07-27) | backward influence range with the Theorem 1 approximation and its validity gate, coloured noise by state augmentation, the covariance regularisation practice, the tipping, multiscale, Lorenz-84 and topographic systems | outputs generated by running the authors’ scripts locally (the first, `climate_tipping_y_bifurcation_driven.m`, ran in 193 s on base MATLAB on 2026-08-28) |
+| Andreou and Chen (2025), the CGNS tutorial; Jiang, Andreou, Reich and Chen (2026), `EnKBS` (MIT, Zhang Jiang; commit 8e1c284, 2026-05-02) | closed-form hidden-path sampling, backward and forward, with correlated noise; the Lorenz-84 and Lorenz-96 systems | the closed-form sampler script in `EnKBS`, run locally with its draws recorded |
+| Andreou, Chen and Li (2026) | information-theoretic lag selection, tail bound, per-step contraction certificate | the paper’s equations (exact relations) |
+| `aciR` 0.2.3 | the checked implementation of the first row; the fixtures, manifest and checking tools; the ledgers; the interface style | the second implementation, pinned from a tag |
+| `aci` 0.0.30 | the model contract, one-time evaluation, backward range, sampling, lag diagnostics, example systems, typed conditions; the merge itself | the second implementation, pinned from a tag |
+
+## The scope rule
+
+Everything the authors compute in closed form inside the conditional
+Gaussian class belongs in the engine. Everything they compute by
+ensemble or by learning is a caller, behind a socket whose contract the
+engine fixes. Outside the linear-Gaussian and conditionally Gaussian
+classes there is no finite-dimensional exact filter, so “approximate the
+model and solve exactly” is the engine’s business and “keep the model
+and solve approximately” is the backend’s; the two meet on overlap
+models, where the engine is the backend’s oracle.
+
+## What is in version 1.0 and when
+
+The release is staged by the MATLAB-backed families, in the order
+agreed: `ACI_code` first, then the `FBCIR_code` closed forms, then the
+`EnKBS` closed-form sampler, with the paper-derived items (contraction
+certificate, pathways system) staged after the families they belong
+with.
+
+| Component | Closed form | Stage | Source of the check |
+|----|----|----|----|
+| filter and smoother, one or many hidden variables | yes | built | `ACI_code` outputs |
+| causal measure, signal and dispersion parts (`d - log1p(d)` spread term) | yes | built | `ACI_code` outputs |
+| fixed-lag online smoother via closed-form auxiliaries | yes | built | `ACI_code` outputs |
+| tail bound | yes | built | Andreou, Chen and Li, eq. 3.19 |
+| contraction certificate, lag selection | yes | staged with the paper-derived items | eq. 3.18 |
+| forward range: subjective; objective by the approximation, by the exact closed form, and by the reference quadrature | yes | built | `ACI_code` outputs including the exact-definition files |
+| backward range, Theorem 1 approximation, validity gate | yes | staged (`FBCIR_code` family; patch applies and passes against the current tree) | `FBCIR_code` run locally |
+| conditional question by masking and by model reduction | yes | built, named separately | `ACI_code` conditional scripts; a structural equivalence criterion plus a measured counterexample |
+| hidden-path sampling, backward and forward | yes | staged (`EnKBS` family) | `EnKBS` sampler run locally, draws recorded |
+| coloured noise by state augmentation | yes | staged (`FBCIR_code` family) | `FBCIR_code` tipping scripts |
+| example systems: dyad, predator-prey, ENSO (all partitions, T_C) | n/a | built | `ACI_code` scripts |
+| example systems: tipping triad, multiscale, Lorenz-84, Lorenz-96, topographic | n/a | staged with their families | `FBCIR_code`, `EnKBS` scripts |
+| example system: pathways | n/a | staged with the paper-derived items | simulation (no code published) |
+| covariance policy (section *Numerical policies*) | n/a | built (strict); FBCIR regulariser staged | `shared_helper.m` practice, as a compatibility mode |
+| batch axis (many records per pass) | n/a | its own staged change, gated, not a release gate | bit-identity to separate runs; timings |
+| formula front end | n/a | 1.1 | interface only |
+| closed-form model fitting in the class | yes | 1.1 | identity to maximum likelihood on a linear model |
+| ensemble family; discovery; extremes; surrogates; twins | no | sockets and callers, staged reserve | their own registers |
+
+# Public interface
+
+Seven verbs, three low-level functions, the model library, and methods,
+in the `aciR` style with paper notation (`L_x`, `f_x`, `L_y`, `f_y`,
+`S_xoS_x`, `S_yoS_y`, `S_yoS_x`), so a reader can diff the R against the
+MATLAB symbol by symbol. The review confirms this surface is adopted and
+the rename is in progress.
+
+| Verb | Signature | Notes from the consolidation |
+|----|----|----|
+| `aci_model()` | `(L_x, f_x, L_y, f_y, S_xoS_x, S_yoS_y, S_yoS_x = 0, k = 1L, l = 1L, x0, y0, blocks = NULL, phase = c("consistent", "shifted"), label, parameters)` | `phase = "shifted"` reproduces the climate-model script’s coefficient phase; see section *Model contract* |
+| `aci_simulate()` | `(model, n, dt, seed = NULL, scheme = c("euler", "milstein"), increments = NULL)` | divergence guard; random state restored; increments returned now, accepted as input with the sampling stage |
+| `aci()` | `(x, model, dt, mu0 = NULL, R0, time = NULL, batch = NULL, literal = FALSE)` | `literal = TRUE` reproduces a reference script’s source defects (section *Evidence*); `batch` arrives with the batch-axis change |
+| `aci_online()` | `(result, lag = Inf, select = c("none", "information"), tol = 1e-8)` | `tol` is the adaptive-truncation tolerance, a documented default; fixtures compare at `tol = 0` |
+| `aci_range()` | `(result, direction = c("forward", "backward"), definition = c("objective", "subjective"), method = c("approximation", "exact", "reference"), epsilon, nodes = NULL, horizon, margin = NULL, table = FALSE)` | `epsilon` serves only the reporting thresholds and `nodes` only the quadrature grid (the dual use produced a negative objective in testing); four range states: resolved, censored, below threshold, insufficient; `margin` retained as this package’s own saturation guard, documented as having no reference counterpart; the default `method` is a decision item (section *Decisions*) |
+| `aci_conditional()` | `(result_or_model, given, method = c("mask", "reduce"), first_step = c("uniform", "matlab"))` | `first_step = "matlab"` reproduces the reference scripts’ unmasked first slice |
+| `aci_sample()` | `(result, n, direction = c("backward", "forward"), seed = NULL, increments = NULL)` | staged with the `EnKBS` family |
+| `aci_filter()`, `aci_smoother()`, `aci_metric()` | as in `aciR` | kept exported |
+| the `aci_*_model()` constructors and `aci_add_ou_noise()` |  | `ACI_code` systems built; the others staged with their families |
+| `print`, `summary`, `plot`, `as.data.frame` |  | plain data frames out |
+
+## Where the functions of `aci` 0.0.30 go
+
+The review reports per-function dispositions for all 75 exports,
+agreeing with the v1.0 mapping, and names three that should not survive
+(one dead, one that disclaims its own provenance, one stub). The v1.0
+table stands as the public mapping; the three names are to be listed in
+the engine’s NEWS so the removal is traceable.
+
+# Model contract
+
+A conditional Gaussian nonlinear system with observed block `x` (k
+variables) and hidden block `y` (l variables):
+
+$$\mathrm{d}x = \big(f_x(t, x) + L_x(t, x)\, y\big)\,\mathrm{d}t + \Sigma_x(t, x)\,\mathrm{d}W_1,
+\qquad
+\mathrm{d}y = \big(f_y(t, x) + L_y(t, x)\, y\big)\,\mathrm{d}t + \Sigma_y(t, x)\,\mathrm{d}W_2,$$
+
+with optional correlated noise through `S_yoS_x`. Coefficients are
+accepted as functions of the observed row, as arrays on the grid, or by
+name from the library; at 1.1, as a formula. All compile once to arrays
+on the grid, the precision path of the observation Gram matrix, flags,
+and a fingerprint. Validation before any arithmetic: shape agreement,
+linearity in `y`, positive semi-definite joint noise covariance,
+consistent grid. Failure raises a typed condition naming the check.
+
+**Compatibility switches, all off by default.** The engine’s defaults
+are the consistent model; each switch reproduces one recorded behaviour
+of a reference script so that its outputs can be matched exactly.
+
+| Switch | Reproduces | Measured effect of the reference behaviour |
+|----|----|----|
+| `phase = "shifted"` | the climate-model script’s coefficient phase (coefficient at index j applied one step off the consistent convention) | filter mean about 1e-3, ACI about 2.6e-2 on the T_C case; the review measured and documented the delta rather than building the switch, and is open to building it; this version asks for it, since script-exact replay is the package’s claim |
+| `first_step = "matlab"` in `aci_conditional()` | the conditional scripts’ unmasked first mask slice (the full pseudo-inverse fills slice one before the target-only overwrite) | filter mean moves 0.108 at step 2; integrated ACI 1.4 percent |
+| `literal = TRUE` | two source defects in the ENSO scripts (section *Evidence*, findings 1 and 2) | up to a doubling of time-integrated ACI on a 14-model-year window (finding 2); covariances unaffected |
+
+The state-time convention (the coefficient at index j belongs to the
+state at t_j) is the default. `blocks` declares block structure for
+block-wise recursions.
+
+# Architecture
+
+Five layers (interface; one-time evaluation; engine; results; evidence)
+and seven code blocks (model compiler; recursion driver; step kernels;
+Gaussian information; range; conditional; results and evidence), as in
+v1.0. Target size about 6,000 lines of R excluding tests.
+
+**Measured design decisions** (base R 4.5.2, medians of five; scripts
+and outputs under `comparison/core_engine/strategy/`):
+
+| Question | Measurement | Decision |
+|----|----|----|
+| batch axis for the scalar kernel | 3,000 steps: 1 record 6 ms, 10 8 ms, 100 29 ms, 1,000 164 ms; bit-identical to separate runs | adopt, as its own gated change after the audit (the review’s staging: large blast radius into a verified engine) |
+| batch axis for a matrix hidden state | l = 2: 100 records cost 2.9 times one; l = 6: 7.7 times | arrays for P \> 1, the dense path for P = 1, both graded identical |
+| a step-closure driver | 0.70 microseconds per step inline, 1.07 through a closure | code template for scalar kernels, runtime driver for matrix kernels |
+
+Two levers designed and gated, not measured: the influence range formed
+for a block of reporting times with the lag as the loop; the
+constant-coefficient shortcut. The compiled inner loop stays out.
+
+# Numerical policies
+
+- **Closed forms only.** As in v1.0, with one revision: the exact
+  objective range has a closed form (the running-maximum sum over lags),
+  which the engine implements as `method = "exact"`; the reference’s
+  Simpson quadrature over the threshold grid (513 nodes by default) is
+  `method = "reference"`, and the paper’s efficient formula is
+  `method = "approximation"`. The exact value and the reference
+  quadrature differ by about 5e-4 on the objective-bridge comparison, a
+  discretisation gap, recorded.
+- **Covariance policy, revised.** The default is strict: a covariance
+  that fails the positive-definiteness check stops with `aci_error_spd`
+  naming the step. An eigenvalue floor is opt-in, explicit and counted.
+  The reference’s regulariser (`FBCIR_code/shared_helper.m`: real
+  projection, symmetrisation, floor at `eps(max(1, max |lambda|))`,
+  spectral reconstruction) is provided as the compatibility regulariser
+  for the `FBCIR_code` family and its fixtures. Basis: the review
+  measured zero floor activations in 4.37 million covariance updates
+  across every published case, and one stress case in which an always-on
+  floor silently replaced a variance of -1.07e13 with 1e-12 and
+  completed. `ACI_code` has no regulariser.
+- **Tolerances.** `|a - b| <= atol + rtol |b|`, both 1e-12 for linear
+  quantities and 1e-11 for logarithmic ones; bit-identical matches
+  recorded as such. Adaptive truncation in the online smoother
+  (`tol = 1e-8`, the documented default) is switched off (`tol = 0`)
+  when comparing against stored outputs; at `tol = 0` the streaming and
+  table range routes agree at machine precision (maximum 4.7e-16;
+  subjective read-outs bit-identical), which closes the 2.2e-7 item of
+  v1.0 as a documented default, not a defect.
+- **Randomness.** Seed argument, caller’s random state restored, drawn
+  increments returned; increments accepted as input from the sampling
+  stage onwards. A MATLAB seed does not reproduce an R draw, so
+  fixed-increment fixtures ship the increments.
+- **Parallelism.** Outer loops only, one L’Ecuyer stream per unit,
+  arriving with the batch-axis change.
+
+# Evidence
+
+**Register.** One row per feature, shipped as
+`inst/evidence/register.csv`, rendered in the validation vignette, and
+enforced by a build-failing coverage test (adopted by the review).
+**Gate liveness**: every gate shown to fail once on an induced
+violation, recorded (adopted).
+
+**Stored outputs.** `ACI_code` present; `FBCIR_code` and the `EnKBS`
+sampler generated locally through the harness with the toolbox-shim
+route (adopted by the review as the right unblock): the Statistics,
+Econometrics and Signal Processing calls in five scripts sit in plotting
+and diagnostic blocks feeding no assimilation quantity, so plain-MATLAB
+shims for `ksdensity`, `normpdf`, `skewness`, `autocorr` and `xcorr` let
+every script run whole on base MATLAB; the harness records which shims
+were active, and no shimmed value enters a fixture.
+
+**Reference-source findings and the source-defect policy.** The review
+found, and the engine records, five properties of the reference scripts
+that a literal reproduction would inherit. Policy: each is a register
+row; the engine’s default is the consistent behaviour; the literal
+behaviour is reproducible under the switches of section
+*Model contract*; the harness’s
+run-the-scripts stage treats finding 1 as a known source defect rather
+than a harness failure. Whether and how the authors are told is a
+separate decision (section
+*Decisions*).
+
+| \# | Finding | Engine behaviour |
+|----|----|----|
+| 1 | `ENSO_model_cond_ACI_tau_unobs.m` references `f_y_s` (lines 1455, 1484) without defining it; the script errors standalone; the intended value is 0 | default 0; `literal = TRUE` reproduces the reference’s intent under the compatibility flag; the harness records the defect |
+| 2 | `ENSO_model_cond_ACI_T_C_unobs.m` omits `gamma_C * h_W` from the assimilation `f_y` (lines 1053, 1151) while its own simulator includes it (line 1124) | default consistent model; `literal = TRUE` reproduces the script (+102 percent time-integrated ACI on a 14-model-year window; covariances bit-identical) |
+| 3 | the conditional scripts leave the first mask slice unmasked | `first_step = "matlab"` |
+| 4 | the 173-row fixture set omitted the scalar ENSO partitions and the T_C zeroth-order case | both implemented and graded in the engine with source-derived fixtures; T_C as a distinct k = 2 model with simulator and inference parameterisations held separately |
+| 5 | the tau script’s reduced observation set is a different quantity from the full set (time-resolved ACI differs by up to 0.78 against a mean level of 0.25; the time average agrees within 0.5 percent) | both named in the engine, reduced as the script default; the register’s ENSO row splits accordingly |
+
+**Second implementations.** `aciR` 0.2.3 and `aci` 0.0.30 are compared
+with `acir` on every shared quantity in continuous integration,
+installed from the tag that marks their last state (section
+*Versioning, tags and the repository*). The review
+reports that everywhere the two parents’ contracts match they agree at
+machine precision, so component selection in the merge was by measured
+efficiency and interface.
+
+**Audit of the engine as built.** Before the staged work resumes, the
+merged engine is run on this side: the suite (reported 6,236 tests, 0
+failures), `R CMD check` with the three vignettes, the register coverage
+test, the gate-liveness record, and the full harness against the
+`ACI_code` fixtures at the tolerances above. The reported state is
+carried as reported until then.
+
+# Performance, revised
+
+Timings are tracked, not gated. Continuous integration records the
+stages of v1.0’s table on every run and warns on a regression beyond 25
+percent against the recorded baseline; no acceptance threshold fails the
+build until the range and the 20,001-step rows have been measured on the
+exact workloads the budgets name. The filter and smoother rows are
+reported well inside the v1.0 budgets.
+
+# Packaging, authorship and licences
+
+Unchanged from v1.0 and confirmed by the review: `acir`, MIT,
+`Imports: graphics, stats`, no compiled code, Aidan Moller and Max
+Moldovan as authors, Marios Andreou and Zhang Jiang as copyright holders
+for the reference implementations, `simps.m` never ported, notices in
+`inst/COPYRIGHTS` (the review verified that `LICENSE.md` does not ship
+in the built package), every help page citing its equation. The
+maintainer (`cre`, one name by CRAN’s rule) is settled at submission.
+
+# Versioning, tags and the repository
+
+**A constraint v1.0 missed.** `acir/` and `aciR/` collide as paths on
+case-insensitive filesystems (macOS, Windows): a tree holding both
+cannot be checked out there. The side-by-side layout of v1.0 is
+therefore not available.
+
+**Route, proposed by the review, pending sign-off.** A branch on
+`biometryhub/ACI` adds `acir/` and removes `aci/` and `aciR/`, keeping
+the root-level documentation, merged by pull request after review. The
+last both-parents state is tagged before the removal commit, so the old
+trees stay one checkout away and the full history remains; the second-
+implementation comparisons install the parents from that tag. The root
+README explains that `acir` is the hybrid of the two and names the tag.
+
+**Alternative, if the parents should stay visible in the working tree.**
+Move them to `parents/aciR` and `parents/aci` (no collision), at the
+cost of a three-package tree and continuous-integration matrix.
+
+**Versions and tags.** `Version: 0.0.0.9000` while developing;
+package-prefixed parity tags `acir-v0.1.0` (every `ACI_code` fixture
+through `acir`, which the review reports as the existing build),
+`acir-v0.2.0` (the `FBCIR_code` and sampler fixtures pass),
+`acir-v1.0.0` for CRAN. The project site follows `acir` from its first
+tag.
+
+# Build plan, restated against the engine as built
+
+| Step | Content | Gate | Hours |
+|----|----|----|----|
+| A audit | run the merged engine here: suite, check, harness against every `ACI_code` fixture, register coverage test, gate-liveness record; reconcile the v1.0 mapping with the engine’s dispositions; list the three removed exports | every reported number reproduced on this side | 6 |
+| B tag and branch | tag the last both-parents state; branch with `acir/` added and the parents removed; continuous integration for one package plus the pinned parents | check clean on the branch; comparisons green | 4 |
+| WP1 stored outputs | remaining `FBCIR_code` scripts and the `EnKBS` sampler through the harness with shims (the first tipping script is done) | re-running any script reproduces its output at difference zero; finding 1 handled as a known defect | 8 |
+| WP2 grade `aci` first | `aci` 0.0.30 against the new outputs | a verdict per quantity | 4 |
+| WP5 backward range | apply the staged patch; `method` and the four states; `nodes` split from `epsilon` | `FBCIR_code` fixture at tolerance | 8 |
+| WP6 sampling | apply the staged patch; increments as input | seeded draws match the `EnKBS` sampler | 8 |
+| WP7 certificate and lag selection | with the paper-derived items | equations reproduced | 3 |
+| WP8 model library and coloured noise | `FBCIR_code` and `EnKBS` systems, pathways | replayed draws or known answers | 8 |
+| C batch axis | its own gated change | bit-identity; timings tracked | 12 |
+| WP9 shortcut, streams, identity tests | with the batch axis | equal to the full run; identical across cores | 4 |
+| WP10 site | documentation is reported done; the site remains | site builds from the tag | 4 |
+| WP11 release 1.0.0 | checklist with evidence paths; CRAN | every line ticked | 4 |
+
+About 73 focused hours remain against v1.0’s 100, before the audit’s
+findings. Hours, not dates.
+
+# Consolidation record
+
+Every item of the review, with its disposition.
+
+| Review item | Disposition | Reason |
+|----|----|----|
+| findings 1 to 5 (source defects, first slice, missing fixtures, reduced observation set) | applied | verified against source or measured by the review; each becomes a register row and a compatibility switch |
+| finding 6 (2.2e-7 route disagreement) | applied, closed | adaptive truncation at its documented default; machine precision at `tol = 0` |
+| finding 7 (exact objective has a closed form) | applied as a method; the default left for decision | the engine’s claim is script-exact replay, so the reference outputs must remain the comparable default or an explicit option; see section *Decisions* |
+| finding 8 (margin, epsilon roles, range states) | applied | `margin` documented as the package’s own guard; `nodes` split from `epsilon`; four states |
+| batch axis, gate liveness, shipped register, shim route | adopted by the review | staged as the review proposes |
+| covariance default strict, opt-in floor, FBCIR regulariser as compatibility | applied | the review’s measurements; an always-on floor that completes on a variance of -1.07e13 is worse than a stop |
+| performance as regression tracking | applied | the range and long-record rows are unmeasured on the exact workloads |
+| paper-derived items staged after the MATLAB-backed families | applied | staging, not technical |
+| maintainer at submission | applied |  |
+| shifted-phase switch not built, delta documented instead | revised: build it | script-exact replay is the package’s claim; the delta is measured, so the switch is small and its gate exists |
+| repository route with tagged removal | applied in principle, pending sign-off | forced by the path collision; the alternative is recorded |
+| three exports that should not survive | applied, names requested | traceability in NEWS |
+
+# Decisions
+
+1.  Default `method` of `aci_range()`: `"approximation"` (the
+    reference’s primary output, this version’s recommendation), or
+    `"exact"` (the engine’s current default, the closed form the
+    reference does not compute).
+2.  Repository route: tagged removal of the parents (recommended), or
+    `parents/` in the working tree.
+3.  Build the `phase = "shifted"` switch (recommended) or keep the
+    documented delta.
+4.  Whether the two ENSO source findings (1 and 2) are communicated to
+    the authors, and by whom.
+5.  Maintainer name at submission.
+
+# References
+
+Andreou, M., Chen, N. and Bollt, E. (2026). Assimilative causal
+inference. *Nature Communications*, 17, 1854.
+https://doi.org/10.1038/s41467-026-68568-0. Code:
+https://github.com/marandmath/ACI_code.
+
+Andreou, M. and Chen, N. (2026). Forward and backward causal influence
+ranges. arXiv:2510.21889. Code:
+https://github.com/marandmath/FBCIR_code.
+
+Andreou, M. and Chen, N. (2025). A tutorial on conditional Gaussian
+nonlinear systems. *Entropy*, 27(1), 2. arXiv:2410.24056.
+
+Andreou, M., Chen, N. and Li, Y. (2026). Online smoothing for
+conditional Gaussian nonlinear systems. *Journal of Nonlinear Science*,
+36(4), 71. https://doi.org/10.1007/s00332-026-10271-x.
+
+Jiang, Z., Andreou, M., Reich, S. and Chen, N. (2026). Ensemble
+Kalman-Bucy smoothing for assimilative causal inference.
+arXiv:2604.25157. Code: https://github.com/jiangzh67/EnKBS.
+
+Moser, J., Chen, N. and Andreou, M. (2026). Assimilative causal
+inference for extreme events. arXiv:2605.22692.
+
+Moller, A. (2026). Review of the acir specification (v1.0, 2026-08-28).
+Review document acir-spec-for-review-v1.0 AM-response 2026-08-28, this
+directory.
diff --git a/dev/work/2026-09-01-performance/intent.md b/dev/work/2026-09-01-performance/intent.md
new file mode 100644
index 0000000..0486dbb
--- /dev/null
+++ b/dev/work/2026-09-01-performance/intent.md
@@ -0,0 +1,54 @@
+# Intent: bring every Section 8 stage of `acir` inside its performance budget
+
+Author: Max Moldovan. Status: accepted 2026-09-01, with the plan that carried
+it, reviewed by Aidan Moller.
+
+Consolidated on 2026-09-02 from the performance plan v0.1 (2026-08-31), where
+this intent was first recorded, and from the review of its v0.2.
+
+## Problem
+
+`acir` was set up to take the best of its two parents: the scope and model
+interface of `aci`, the speed and evidence of `aciR`. The first half is done:
+the package agrees with the authors' MATLAB to 1e-14 on the filter, smoother,
+metric, online smoother and influence range. The second half is not. Measured
+on 2026-08-31 on the authors' dyad record (N = 3,000):
+
+| Stage | Budget | `acir` | Verdict |
+|:---|---:|---:|:---|
+| influence range, all anchors | 0.40 s | 106.8 s | fails by about 270x; `aciR` does the same task in 0.28 s with the same numbers to 1.4e-14 |
+| filter, model supplied as closures | 0.02 s | 0.142 s | passes only on the library route (0.022 s) |
+| smoother, model supplied as closures | 0.02 s | 0.110 s | same (0.009 s on the library route) |
+| online smoother, all lags | 0.25 s | 0.264 s | passes, two to five times faster than MATLAB |
+| climate model, 20,001 steps, filter | 0.7 s | not measured | open |
+
+## Proposed outcome
+
+Every Section 8 stage of the specification inside its budget on the reference
+records, in base R with no compiled inner loop, with no graded number moved
+beyond round-off and no interface changed. A release that fails its own range
+budget by two orders of magnitude is not the package that was set out to be
+built, so the 0.1.0 tag waits for the range.
+
+## Affected code and users
+
+The scalar path of the influence range and the lag table (`R/aci-cir.R`,
+`R/aci-online-smoother.R`); the adaptive freeze on the matrix path; the
+generic-model realiser; the benchmark under `tools/bench/` and its workflow;
+the placement of the 0.1.0 tag. Users notice only speed.
+
+## Constraints
+
+The scope rule (closed forms only). Every fixture in the evidence register at
+its tolerance, and the stored outputs on the reference records within 1e-12
+before and after. `R CMD check --as-cran` at zero errors and zero warnings.
+Every ported kernel names its source in `aciR` 0.2.3 at the tag
+`parents-final`. `R/` is in Aidan's lane; ported kernels arrive as a draft
+branch.
+
+## Open questions at acceptance
+
+Whether rows built from cumulative logarithms cancel on the 20,001-step
+climate record. How many exact-equality assertions the change of summation
+order moves. Whether the tag should wait for the range at all. All three were
+settled in the review of the plan and are recorded in `plan.md`.
diff --git a/dev/work/2026-09-01-performance/plan.md b/dev/work/2026-09-01-performance/plan.md
new file mode 100644
index 0000000..cb16bcd
--- /dev/null
+++ b/dev/work/2026-09-01-performance/plan.md
@@ -0,0 +1,109 @@
+# Plan: the performance work package (from intent.md 2026-09-01)
+
+Status: approved 2026-09-01 by Aidan Moller, on v0.3 of the plan, after his
+review of v0.2. v0.1 was written on 2026-08-31.
+
+Evidence files named below as `comparison/...` are the authors' working
+records and are not in this repository; the numbers they support are restated
+in the pull-request descriptions and in `tools/bench/baseline.csv`.
+
+## Order of work
+
+Each step is measured by the one before it, so the order is not negotiable.
+
+| Step | Change | Closes | Lane |
+|:---|:---|:---|:---|
+| PR-4 | Performance tracking: a benchmark script over the Section 8 stages on the reference records, a committed baseline, a CI job that records and warns at +25% | the instrument | Max |
+| PR-5 | Scalar range rows vectorised: the cumulative-log row construction of `aciR` ported into the streamed range and the scalar lag table, cumulative sums blocked every 512 steps; on the scalar path the adaptive truncation becomes a cut by index with the tail estimate kept; the 79 exact-equality assertions restated to tolerance and the resummation declared; the worst case added to the tests | mechanism 1 on the scalar path, the 270x; the scalar half of mechanism 2 | Aidan's `R/`, from a draft branch with the ported kernels and tests |
+| PR-6 | Adaptive freeze made cheap on the matrix path: no bound recursions when nothing can freeze, no numerical core touched | mechanism 2 | Aidan |
+| PR-7 | Realiser cache on the generic-model route, keyed on the specification's fingerprint | mechanism 3 | Aidan |
+| PR-8 | Batch axis for matrix systems: all active anchors' update matrices advanced per step as one array operation | mechanism 1 where logarithms do not apply | joint |
+| PR-9 | Climate-model filter to its budget: per-step allocations removed from the matrix kernel | the last budget | Aidan |
+| PR-10 | Budgets become gates: the warnings of PR-4 fail the build, the baseline re-committed | regression-proofing | Max |
+
+The 0.1.0 tag sits after PR-5.
+
+## Files that change
+
+| Step | Files |
+|:---|:---|
+| PR-4 | `tools/bench/bench_reference.R` (new), `tools/bench/baseline.csv` (new), `.github/workflows/bench.yaml` (new) |
+| PR-5 | `acir/R/aci-cir-rows.R` (new), `acir/R/aci-cir.R`, `acir/R/aci-online-smoother.R`, `acir/tests/testthat/test-32-scalar-rows.R` (new), the four test files holding the 79 assertions, `acir/inst/evidence/register.csv`, `acir/NEWS.md` |
+| PR-6 to PR-9 | named in each step's own plan when it is written; the areas are the matrix-path freeze, the realiser, the matrix kernel |
+| PR-10 | `.github/workflows/bench.yaml`, `tools/bench/baseline.csv` |
+
+## Risks
+
+- The resummation moves bits. Counted: 79 exact-equality assertions across
+  test-04 (4), test-18 (19), test-20 (8) and test-23 (48). They are restated
+  as tolerance assertions and the change is declared.
+- Cumulative logarithms cancel on long records. Measured; blocked sums
+  restarted every 512 steps err by 3.6e-15 where the plain form errs by
+  1.6e-12 at N = 20,000. The blocked form is used and the worst case is
+  tested.
+- The CI runner is slower than the development machine, so seconds-budgets
+  written on one fail on the other. Timing is relative to the runner's own
+  baseline.
+- A check that passes on the machine it was written on may not pass
+  elsewhere; every step runs the full six-platform matrix before it merges.
+
+## Proof
+
+1. **Numbers.** Every fixture in `acir/inst/evidence/register.csv` at its
+   tolerance, and the package's stored outputs on the reference records
+   before and after the change within 1e-12. A change that moves a number
+   beyond round-off is not a performance change and is refused as one.
+2. **Time.** The PR-4 table on the CI runner against the committed baseline,
+   relative to the runner. Warn at +25% until PR-10, fail after.
+3. **Hygiene.** `R CMD check --as-cran` at zero errors and zero warnings,
+   coverage not below the floor, the evidence register updated where a check
+   method changed.
+4. **Provenance.** Every ported kernel names its source (`aciR` 0.2.3, file
+   and function) in the roxygen and in `NEWS.md`, against the tag
+   `parents-final`.
+
+## Changes from v0.2, after review
+
+The review of v0.2 (2026-09-01) raised four points. Each was checked against
+the tree before being taken.
+
+1. The vignette was not the reason to gate the tag: the introductory vignette
+   subsamples to 41 anchors on a 1,001-point record and builds in about three
+   seconds in CI. Taken: the tag is placed on the budget argument.
+2. PR-5 moves bits. Taken: the 79 assertions are restated as tolerance
+   assertions inside PR-5, and the resummation is declared.
+3. Cumulative logs need a cancellation test. Taken: the blocked form is in
+   PR-5's scope and the worst case is in its test set, with the measurements
+   recorded in `spec.md`.
+4. PR-5 and PR-7 overlapped on the scalar path. Taken: the scalar cut is
+   folded into PR-5, and the matrix-path freeze fix moves ahead of the
+   realiser cache.
+
+## What approval means
+
+Approving this plan approves the order 4 to 10 as revised, the four gates,
+the PR-5 lane arrangement, and the placement of the 0.1.0 tag after PR-5.
+Nothing in it changes a number, an interface, or the specification's scope
+rule.
+
+## Departures
+
+Recorded 2026-09-02.
+
+- **PR-5b added**, stacked on PR-5: the online smoother's auxiliaries on the
+  scalar path formed as vector arithmetic by the same construction, so that
+  the lag table and the online smoother share one row builder. Not in the
+  approved order; carried as its own pull request with the same four gates.
+- **A CI chore added**: every push to `acir-package` runs the full check
+  matrix, and the site is published from `main` only. Not in the approved
+  order; no numerical code touched.
+
+## Status
+
+| Step | Pull request | State |
+|:---|:---|:---|
+| PR-4 | #6 | merged 2026-09-01 |
+| PR-5 | #7 | open, checks green |
+| PR-5b | #8 | open, stacked on #7, checks green |
+| CI chore | #9 | open, checks green |
+| PR-6 to PR-10 | | not started |
diff --git a/dev/work/2026-09-01-performance/spec.md b/dev/work/2026-09-01-performance/spec.md
new file mode 100644
index 0000000..807f142
--- /dev/null
+++ b/dev/work/2026-09-01-performance/spec.md
@@ -0,0 +1,67 @@
+# Specification: the performance work package
+
+From `intent.md` (2026-09-01). Status: signed off 2026-09-01 by Aidan Moller
+as part of the plan's approval.
+
+## Requirements
+
+1. Every Section 8 stage of the core-engine specification within its budget on
+   the reference records, measured on the CI runner relative to a committed
+   baseline.
+2. No graded number moved beyond round-off: every register fixture at its
+   tolerance class, and the stored outputs on the reference records within
+   1e-12 of their values before the change.
+3. No interface changed and no change to the scope rule.
+4. Base R, no compiled inner loop.
+5. Every ported kernel names its source file, function and tag.
+
+## Design
+
+Three mechanisms account for the shortfall, and each has a fix in code the
+project already owns.
+
+1. **The range walks the divergence table one cell at a time.** An R loop
+   evaluates one relative entropy per (anchor, lag) cell, about 26
+   microseconds over some four million cells. On the scalar path each
+   anchor's whole row is one vectorised expression in the cumulative
+   logarithms of the update factors, so the same work runs as vector
+   arithmetic. The cumulative sums are blocked, restarted every 512 steps,
+   so that differencing them never cancels. The adaptive truncation becomes a
+   cut of the row by index, and the tail estimate is kept.
+2. **The adaptive freeze costs more than it saves when nothing freezes.** On
+   the dyad record it retained 1,499 of 1,500 lags and took 142 s against
+   107 s for the full table. On the matrix path the bound recursions are
+   skipped when nothing can freeze.
+3. **The generic-model route realises coefficients on every call.** A model
+   supplied as closures is evaluated at every grid point each time a verb
+   runs; the library route caches its realisation and meets the budget. A
+   cache on the generic route is keyed on the fingerprint the specification
+   already defines.
+
+Where logarithms do not apply, on matrix systems, all active anchors' update
+matrices are advanced per step as one array operation; the measured spikes
+were 2.9x to 7.7x for matrix systems and 27x for a thousand scalar records.
+
+## Acceptance
+
+The four gates every performance pull request carries: numbers (requirement
+2), time (the benchmark against the baseline, warn at +25% until the gates
+become failures), hygiene (`R CMD check --as-cran` at 0/0, coverage not below
+the floor, the register updated where a check method changed), provenance
+(requirement 5). The scalar-row change adds the worst case to its test set: a
+long record, a short window, near-equal covariances.
+
+## Flagged concerns, resolved at review
+
+- The change of summation order moves bits: 79 exact-equality assertions
+  across four test files pin route-to-route agreement. Restated as tolerance
+  assertions inside the change, with the resummation declared in the
+  pull request.
+- Cumulative logarithms cancel on long records: measured on synthetic update
+  factors in (0.90, 0.9995), differenced cumulative logs err by 1.8e-13 at
+  N = 3,000, 1.6e-12 at N = 20,000 and 9.0e-12 at N = 100,000, so the climate
+  record would breach the 1e-12 gate. Blocked sums restarted every 512 steps
+  err by 3.6e-15. The blocked form is in scope.
+- Two changes overlapped on the scalar path. The scalar cut is folded into the
+  row change, and the matrix-path freeze fix moves ahead of the cache since
+  it touches no numerical core.
diff --git a/dev/work/_template/intent.md b/dev/work/_template/intent.md
new file mode 100644
index 0000000..8cc2756
--- /dev/null
+++ b/dev/work/_template/intent.md
@@ -0,0 +1,24 @@
+# Intent: <one line, what the change is for>
+
+Author: <name>. Status: draft | accepted <date>.
+
+## Problem
+
+What is wrong or missing, measured where possible, with the record and the
+numbers.
+
+## Proposed outcome
+
+What better looks like, stated so that it can be checked.
+
+## Affected code and users
+
+Files, functions, fixtures, workflows, and who notices.
+
+## Constraints
+
+What must not change: numbers, interfaces, the scope rule, provenance.
+
+## Open questions
+
+What is not yet decided, and who decides it.
diff --git a/dev/work/_template/plan.md b/dev/work/_template/plan.md
new file mode 100644
index 0000000..2e3ee50
--- /dev/null
+++ b/dev/work/_template/plan.md
@@ -0,0 +1,24 @@
+# Plan: <the change> (from intent.md <date>)
+
+Status: approved <date> by <name>.
+
+## Files that change
+
+One line per file: path, new or changed, what changes.
+
+## Order of work
+
+Numbered steps, each measured by the one before it where that applies.
+
+## Risks
+
+What could break and what is done about it.
+
+## Proof
+
+The tests, fixtures and timings that show the change works, named.
+
+## Departures
+
+Recorded in the same commit as the change that caused them. Empty at
+approval.
diff --git a/dev/work/_template/spec.md b/dev/work/_template/spec.md
new file mode 100644
index 0000000..8af5ace
--- /dev/null
+++ b/dev/work/_template/spec.md
@@ -0,0 +1,22 @@
+# Specification: <the change>
+
+From `intent.md` (<date>). Status: draft | signed off <date> by <name>.
+
+## Requirements
+
+What the change must do, numbered, each checkable.
+
+## Design
+
+How it does it: the mechanism, the code path, the alternative not taken and
+why.
+
+## Acceptance
+
+The gates this change passes to be done: numbers, time, hygiene, provenance,
+plus anything specific to it.
+
+## Flagged concerns
+
+Anything that contradicts a policy, a budget or an interface, resolved with
+the person who owns it before engineering starts.