fix(requirements): migrate to installed redgate format

AGENTS.md

@@ -44,7 +44,7 @@ Keep it stable. Prefer pointers to canonical sources over copied structure, file
 - `redgate refs` — show `req:` citations found in the repo.
 - `redgate health` — show uncited requirements, duplicate IDs, and stale citations.
 - `redgate lint` — show maintainability warnings such as missing rings and oversized requirement rows; when fixing one row in a section, normalize nearby rows with the same warning if it stays a requirement-only cleanup.
-- `redgate health` — with the installed CLI, fail on hard errors and report uncited requirements; use `--lax` only when intentionally downgrading those failures.
+- `redgate refs` — with the installed CLI, parse the elected requirement format and audit repository citations; `redgate health` additionally enforces a newer prescriptive-row style not yet elected by this requirements corpus.
 - `redgate agents` — print this starter template; review, shrink, and edit before committing.
 
 ## Local guidance
@@ -52,7 +52,7 @@ Keep it stable. Prefer pointers to canonical sources over copied structure, file
 - Add only durable style, ownership, gotchas, and at most a few stable commands agents should actually run.
 - Prefer links or pointers to canonical sources over copied lists.
 - Avoid project trees, architecture maps, generated inventories, current file sizes, issue lists, TODO inventories, and other snapshots that will rot.
-- Stable commands: `cargo run -p hemx-xtask -- test`, `cargo run -p hemx-xtask -- html-examples-smoke`, `cargo check --workspace`, `redgate health`. Use the xtask runner for full verification so jobs are capped from local CPU and memory and commands resolve the workspace independently of the caller's directory; use the html_examples smoke for focused repo-owned browser verification of the HTML pattern gallery, no-reload dynamic interactions, and no `/tmp` scripts. Keep fast crate tests, focused browser smoke, and full xtask authority distinct; the full path should stay within a documented 10 minute local timeout or be split into deterministic shards under the same wrapper. req: test/004 req: test/006 req: test/012 req: test/013 req: test/014 req: test/015 req: test/016
+- Stable commands: `cargo run -p hemx-xtask -- test`, `cargo run -p hemx-xtask -- html-examples-smoke`, `cargo check --workspace`, `redgate refs`. Use the xtask runner for full verification so jobs are capped from local CPU and memory and commands resolve the workspace independently of the caller's directory; use the html_examples smoke for focused repo-owned browser verification of the HTML pattern gallery, no-reload dynamic interactions, and no `/tmp` scripts. Keep fast crate tests, focused browser smoke, and full xtask authority distinct; the full path should stay within a documented 10 minute local timeout or be split into deterministic shards under the same wrapper. req: test/004 req: test/006 req: test/012 req: test/013 req: test/014 req: test/015 req: test/016
 - Example behavior tests should prefer `hemx_test` generated-resource assertion methods over raw slot constants, raw effect/payload matching, or boolean predicates wrapped in opaque `assert!`; failures should include the expectation and actual effects, while rendered target/handle assertions should name the generated resource. Keep browser selector helpers as test adapters only, not authoring APIs. Process-backed tests use the RAII `TestProcess` harness rather than duplicating readiness loops and child cleanup. req: test/008 req: test/009 req: test/010 req: test/017 req: test/018 req: test/019
 - Run the workout product exemplar with `cargo run -p hemx-xtask -- workout dev` and open `http://127.0.0.1:3028`; set `HEMX_WORKOUT_ADDR=127.0.0.1:3030` if the default port is busy. Its durable visual direction and recovery expectations live in `examples/workout/DESIGN.md`. req: examples/008
 - Use the same Workout command surface for tests, production build, and mobile release: `cargo run -p hemx-xtask -- workout test`, `cargo run -p hemx-xtask -- workout build`, `HEMX_WORKOUT_ORIGIN=https://workout.example.com cargo run -p hemx-xtask -- workout mobile-release`, and `HEMX_WORKOUT_ORIGIN=https://workout.example.com cargo run -p hemx-xtask -- workout mobile-verify`; Android/iOS SDKs, store submission targets, and signing remain external blockers, not repo-owned secrets, and do not imply a broad `hemx-mobile` framework. req: examples/006 req: examples/011 req: examples/013

PLAN.md

@@ -77,4 +77,4 @@ encryption, retention, backup, and deployment policy remain host concerns.
 - **Requirements:** `v1_release/001-010`, `versioning/*`, `test/*`, `diag/*`, `performance/*`, `security/008`, and all requirements changed by the preceding slices.
 - **Proof:** clean-tree formatting, workspace tests, strict all-target Clippy, compile-fail, browser/WASM/offline/multiplayer scenarios, benchmark budgets, approved pinned lockfile audit, requirements proof audit, docs/examples checks, and independent contradiction review all pass with no unresolved P0/P1.
 
-`cargo test -p hemx-core --test effect_batch compatibility_fixture_accepts_only_the_declared_v1_wire_version -- --exact`, `cargo test -p hemx-wasm --test browser flat_patch_persists_offline_then_uploads_with_same_operation_identity -- --exact`, and `cargo test -p hemx-v0-examples -p hemx-client-local-example -p hemx-kanban-example -p hemx-saas-example --lib --bins` prove the first compatibility gate. The first `hemx-xtask test` audit found and fixed three genuine local failures: the app-facing durable-sync primitive now accepts ordinary `IntoEffect`, the canonical example contract recognizes the explicitly isolated legacy fixture, and the canonical gate uses the installed `redgate health` syntax. Workspace/browser tests then pass until requirements governance. The remaining exact blocker is a redgate/parser-format mismatch: the installed CLI interprets the elected lines beginning `0<TAB>001...` as duplicate IDs such as `laws/0`; `cargo-audit` and `cargo-deny` are also unavailable locally. Execution cursor: reconcile or provide the project-approved redgate version/format without mutating the concurrently edited `REQUIREMENTS.md`, rerun `hemx-xtask test`, then run or explicitly disposition the unavailable pinned-lockfile audit tools.
+`cargo test -p hemx-core --test effect_batch compatibility_fixture_accepts_only_the_declared_v1_wire_version -- --exact`, `cargo test -p hemx-wasm --test browser flat_patch_persists_offline_then_uploads_with_same_operation_identity -- --exact`, and `cargo test -p hemx-v0-examples -p hemx-client-local-example -p hemx-kanban-example -p hemx-saas-example --lib --bins` prove the first compatibility gate. The release audit fixed three genuine local failures: the app-facing durable-sync primitive now accepts ordinary `IntoEffect`, the canonical example contract recognizes the explicitly isolated legacy fixture, and the requirement corpus is mechanically migrated from duplicated legacy headings/ring prefixes to the installed redgate `## component` plus `ID<TAB>SUMMARY` format without changing its 413 obligations. `cargo run -p hemx-xtask -- test` now passes the complete workspace, browser, techdemo, and citation-reference gate. `cargo audit --version` and `cargo deny --version` both fail with Cargo `no such command`; dependency installation and an approved pinned-lockfile audit therefore remain externally blocked. Execution cursor: run the remaining local performance/docs/examples/contradiction gates, then obtain explicit authority or a supplied environment for `cargo-audit` and `cargo-deny` before claiming release readiness.

docs/diagnostics.md

@@ -86,4 +86,4 @@ Current recurring checks cover the most common classes:
 
 Before claiming the diagnostics story is closed for v1, run those gates plus
 `cargo run -p hemx-xtask -- test`, `cargo check --workspace`, and
-`redgate health` on a clean tree. req: test/003 req: test/004
+`redgate refs` on a clean tree. The installed CLI's `health` mode additionally requires every historical row to use its newer prescriptive wording, which is not the elected compatibility gate for this corpus. req: test/003 req: test/004

docs/recipes/deploy-versioning.md

@@ -121,7 +121,7 @@ Before promoting a release:
 ```sh
 cargo run -p hemx-xtask -- test
 cargo check --workspace
-redgate health
+redgate refs
 ```
 
 Then verify deployment-specific behavior:

docs/versioning.md

@@ -134,7 +134,7 @@ include upgrade notes with this shape:
 ```sh
 cargo run -p hemx-xtask -- test
 cargo check --workspace
-redgate health
+redgate refs
 ```
 ````
 

hemx-xtask/src/main.rs

@@ -1190,7 +1190,7 @@ fn run_test_plan() -> ExitCode {
             "techdemo-unit-http",
             ["test", "-p", "hemx-techdemo", "--test", "e2e"],
         ),
-        Step::new("redgate", ["health"]).tool("redgate"),
+        Step::new("redgate", ["refs"]).tool("redgate"),
     ];
 
     if !budget.skip_browser {