@biffo/cli 0.315.6 → 0.315.8

package/_skeletons/sibling-template/scripts/js-dependency-audit.sh

@@ -62,6 +62,50 @@
 # or the copies stop being interchangeable and `shared-sync.sh --check` starts
 # reporting drift that is really divergence.
 #
+# ## Pre-existing vs introduced (#2040)
+#
+# Every check above answers "can this audit be trusted" (network flake vs a
+# real finding). None of them answer WHEN the vulnerable version got there —
+# so a genuine high/critical advisory published overnight against a package
+# already sitting on `dev`, untouched by this diff, used to read identically
+# to a PR that actually introduced the vulnerable version. #1880 (2026-09-04)
+# tried to paper over exactly that by moving this whole check to a
+# `continue-on-error`, non-required job — which stopped a real per-PR finding
+# from blocking too, and produced ten separate biffo-fleet tickets and $86.72
+# of dispatch spend for two routine advisories that no PR under test could
+# have fixed (#2040's own cost accounting). `py-dependency-audit.sh` closed
+# this same gap for Python in #1673; this is the JS side of the same fix.
+#
+# The fix compares the ADVISORY IDS found against the SAME tree's pnpm audit
+# run against the PR's BASE branch, not against the diff itself: a PR can
+# leave pnpm-lock.yaml untouched while a sibling change moves a transitive
+# version, or the base branch may already carry the flagged version. An
+# advisory ID present in both base and head is pre-existing and does not
+# block; an advisory ID present only in head is introduced by this diff (a
+# new dependency, or an upgrade/downgrade into a vulnerable version) and
+# blocks exactly as before. This mirrors the issue's own "run against base
+# and head, diff the advisory IDs, fail on head-only" design rather than
+# hand-parsing pnpm-lock.yaml's YAML — `pnpm audit` already works against a
+# bare copy of just the lockfile with no install (verified directly against
+# this repo's own pnpm 9.15.9), so the base side is a second real audit
+# call, not a reimplementation of what `pnpm audit` already does.
+#
+# `GITHUB_BASE_REF` is the base branch name and is set ONLY for a
+# `pull_request`/`pull_request_target` event — empty on `push`,
+# `workflow_dispatch` and `merge_group`. That is deliberate, not a gap:
+# outside a PR there is no "diff" to attribute a finding to, so every finding
+# blocks exactly as before (the correct behaviour for `dev` itself, and for
+# the scheduled base-branch scan added alongside this file in #2040, which
+# wants every current finding reported, not just new ones).
+#
+# `origin/$GITHUB_BASE_REF` must already be a resolvable local ref for the
+# comparison to run at all — the `js` job's checkout uses `fetch-depth: 0`
+# precisely so it is (see that job's own comment). If it is NOT resolvable
+# (a shallow checkout, or a distributed copy of this script running
+# somewhere that checkout is missing), comparison fails CLOSED: every
+# finding blocks, same as before this fix, rather than silently waving a
+# real regression through because the check could not be performed.
+#
 # POSIX sh (the CI step runs `sh scripts/...`, i.e. dash) — no `pipefail`.
 set -u
 
@@ -118,12 +162,60 @@ failed=0
 # invocation has finished.
 #
 # `$1` is the directory, `$2` a human label, `$3` extra pnpm flags, `$4` the
-# result file this invocation must write its verdict to.
+# result file this invocation must write its verdict to, `$5` this tree's
+# pnpm-lock.yaml path relative to the repo root — used to look up the SAME
+# lockfile's advisories on the base branch (#2040) — never empty, every
+# caller passes one.
+#
+# Returns (on stdout) the set of advisory IDs recorded against the SAME
+# lockfile path on the PR's base branch, one per line — any severity, not
+# just high/critical, because presence is all classification needs. Prints
+# nothing and returns non-zero when a comparison genuinely cannot be made
+# (network/parse failure, a temp-dir failure) — the caller then treats every
+# finding as introduced, the same fail-closed default #1673 established for
+# Python. An empty base lockfile (the path did not exist on the base branch
+# at all — a brand-new lockfile or a brand-new vendored tree this diff
+# itself introduced) is NOT a failure: it prints nothing and returns 0,
+# because an empty set is the correct answer — there is nothing to be
+# pre-existing against, so every finding in a tree the base never had is
+# introduced by definition.
+_base_advisory_ids() {
+  lock_rel="$1"
+
+  base_content="$(git show "${BASE_REMOTE_REF}:${lock_rel}" 2>/dev/null)"
+  if [ -z "$base_content" ]; then
+    return 0
+  fi
+
+  workdir=$(mktemp -d "${TMPDIR:-/tmp}/js-dependency-audit-base.XXXXXX") || return 1
+  printf '%s' "$base_content" >"$workdir/pnpm-lock.yaml"
+
+  for attempt in $(seq 1 "$attempts"); do
+    # shellcheck disable=SC2086
+    base_out="$(cd "$workdir" && timeout "$AUDIT_TIMEOUT_SECS" pnpm audit --json --ignore-workspace 2>/dev/null)"
+    base_status=$?
+    if [ "$base_status" -eq 124 ]; then
+      [ "$attempt" -lt "$attempts" ] && sleep "$((attempt * 2))"
+      continue
+    fi
+    if printf '%s' "$base_out" | jq -e '.metadata.vulnerabilities' >/dev/null 2>&1; then
+      printf '%s' "$base_out" | jq -r '.advisories[]? | (.github_advisory_id // (.id|tostring))' 2>/dev/null
+      rm -rf "$workdir"
+      return 0
+    fi
+    [ "$attempt" -lt "$attempts" ] && sleep "$((attempt * 2))"
+  done
+
+  rm -rf "$workdir"
+  return 1
+}
+
 audit_dir() {
   dir="$1"
   label="$2"
   extra="$3"
   resultfile="$4"
+  lock_rel="$5"
 
   for attempt in $(seq 1 "$attempts"); do
     # printf, never echo: the CI step runs `sh scripts/...` i.e. dash, whose
@@ -172,10 +264,54 @@ audit_dir() {
       low="$(printf '%s' "$out" | jq '.metadata.vulnerabilities.low // 0')"
       total="$(printf '%s' "$out" | jq '.metadata.totalDependencies // 0')"
       if [ "$((high + crit))" -gt 0 ]; then
-        echo "::error::${label}: ${crit} critical + ${high} high advisory(ies) across ${total} package(s); registry answered ${seen_at}."
+        # Classify each qualifying (high/critical) advisory against the base
+        # branch's SAME lockfile before deciding to block (#2040). Written to
+        # a regular file, not a pipe, and read with `while read ... done <
+        # file` rather than `| while read`, for the same reason
+        # py-dependency-audit.sh's findings loop does: a pipeline runs the
+        # loop in a subshell, and a subshell's counter updates vanish the
+        # instant it exits.
+        findings_file="$(mktemp)"
+        printf '%s' "$out" | jq -r '.advisories[]? | select(.severity=="high" or .severity=="critical") | "\(.github_advisory_id // (.id|tostring))\t\(.severity)\t\(.module_name)"' >"$findings_file"
+
+        base_ids_file=""
+        base_available=0
+        if [ "$COMPARE_MODE" -eq 1 ]; then
+          candidate_ids="$(mktemp)"
+          if _base_advisory_ids "$lock_rel" >"$candidate_ids" 2>/dev/null; then
+            base_ids_file="$candidate_ids"
+            base_available=1
+          else
+            rm -f "$candidate_ids"
+          fi
+        fi
+
+        introduced_count=0
+        preexisting_count=0
+        while IFS="$(printf '\t')" read -r f_id f_sev f_mod; do
+          [ -z "$f_id" ] && continue
+          if [ "$base_available" -eq 1 ] && grep -qxF "$f_id" "$base_ids_file" 2>/dev/null; then
+            preexisting_count=$((preexisting_count + 1))
+            echo "::warning::${label}: ${f_mod} advisory ${f_id} (${f_sev}) is already present in ${BASE_REMOTE_REF}'s lockfile — pre-existing, not introduced by this diff (#2040)."
+          else
+            introduced_count=$((introduced_count + 1))
+            echo "::error::${label}: ${f_mod} advisory ${f_id} (${f_sev}) — new to this tree, or a version this diff introduced/upgraded (or a base-branch comparison was not possible)."
+          fi
+        done <"$findings_file"
+        rm -f "$findings_file"
+        [ -n "$base_ids_file" ] && rm -f "$base_ids_file"
+
         printf '%s' "$out" | jq '.advisories // .metadata.vulnerabilities' 2>/dev/null | head -c 4000
-        echo "fail" >"$resultfile"
-        return 1
+
+        if [ "$introduced_count" -gt 0 ]; then
+          echo "::error::${label}: ${introduced_count} critical/high advisory(ies) introduced or upgraded by this diff across ${total} package(s) (${preexisting_count} more pre-existing, not counted against it); registry answered ${seen_at}."
+          echo "fail" >"$resultfile"
+          return 1
+        fi
+
+        echo "${label}: ${preexisting_count} critical/high advisory(ies) found, all pre-existing on ${BASE_REMOTE_REF:-the base branch} and unrelated to this diff — not blocking (#2040); registry answered ${seen_at}."
+        echo "ok" >"$resultfile"
+        return 0
       fi
       # A bare "no advisories" is not falsifiable. State the population, the
       # severities that did NOT block, and when the registry was asked, so a
@@ -210,6 +346,23 @@ fi
 
 WORKSPACE_ABS=$(pwd -P)
 
+# Decide once, for the whole run, whether a base-branch comparison is even
+# possible (#2040 — see the "Pre-existing vs introduced" docstring above
+# `set -u`). `GITHUB_BASE_REF` is only ever set by a
+# `pull_request`/`pull_request_target` event; everywhere else COMPARE_MODE
+# stays 0 and every finding blocks, unchanged from before this fix.
+BASE_REMOTE_REF=""
+COMPARE_MODE=0
+if [ -n "${GITHUB_BASE_REF:-}" ]; then
+  candidate="origin/${GITHUB_BASE_REF}"
+  if git rev-parse --verify --quiet "${candidate}^{commit}" >/dev/null 2>&1; then
+    BASE_REMOTE_REF="$candidate"
+    COMPARE_MODE=1
+  else
+    echo "::warning::js-dependency-audit: base branch is '${GITHUB_BASE_REF}' but '${candidate}' does not resolve locally (shallow checkout?) — cannot tell a pre-existing finding from one this diff introduced, so every finding will block, same as before #2040."
+  fi
+fi
+
 # shellcheck disable=SC2016
 ALL_LOCKS=$(find "$REPO_ROOT" \
   \( -name node_modules -o -name .git -o -name .worktrees \) -prune -o \
@@ -286,10 +439,14 @@ for lock in $ALL_LOCKS; do
   esac
   i=$((i + 1))
   resultfile="$TMP_DIR/result.$i"
+  # `find` was rooted at $REPO_ROOT, so $lock is always an absolute path
+  # under it — this strip is unconditional, unlike $rel's dir_abs case above
+  # (which also has to tolerate a symlink resolving outside the root).
+  lock_rel=${lock#"$REPO_ROOT"/}
   if [ "$dir_abs" = "$WORKSPACE_ABS" ]; then
-    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" "$resultfile" &
+    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" "$resultfile" "$lock_rel" &
   else
-    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" "$resultfile" &
+    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" "$resultfile" "$lock_rel" &
   fi
 done
 

package/dist/index.js

@@ -7632,10 +7632,6 @@ function rewriteDesignTokens(targetDir, tokens) {
       "    timeout-minutes: 20\n    defaults:\n      run:\n        working-directory: apps/frontend\n    steps:",
       "    timeout-minutes: 20\n    permissions:\n      contents: read\n      packages: read\n    defaults:\n      run:\n        working-directory: apps/frontend\n    steps:"
     );
-    yml = yml.replace(
-      "    continue-on-error: true\n    defaults:\n      run:\n        working-directory: apps/frontend\n    steps:",
-      "    continue-on-error: true\n    permissions:\n      contents: read\n      packages: read\n    defaults:\n      run:\n        working-directory: apps/frontend\n    steps:"
-    );
     yml = yml.replace(
       /( {6}- run: pnpm install --frozen-lockfile)\n(?! {8}env:)/g,
       "$1\n        env:\n          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.315.6",
+  "version": "0.315.8",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",
@@ -33,9 +33,7 @@
     "scripts/pgtest-diff-check.sh",
     "scripts/gate-coverage.sh",
     "scripts/verify.sh",
-    "scripts/runner-drop-forensics.mjs",
-    "scripts/practices-metrics.mjs",
-    "scripts/practices-corpus.mjs"
+    "scripts/runner-drop-forensics.mjs"
   ],
   "scripts": {
     "build": "tsup src/index.ts --format esm --dts --clean --external typescript",

package/scripts/runner-drop-forensics.mjs

@@ -14,10 +14,9 @@
  * reading of a red branch and the lazy one are indistinguishable, and #982
  * showed the estate had been counting these as broken code for months.
  *
- * `isRunnerKill` (in `practices-metrics.mjs`, imported below rather than
- * re-implemented) already answers *"did a runner die?"* from the run's own step
- * conclusions. It cannot answer *"why?"* — and "why" is what decides whether
- * anyone should be looking at the code at all.
+ * `isRunnerKill` below already answers *"did a runner die?"* from the run's own
+ * step conclusions. It cannot answer *"why?"* — and "why" is what decides
+ * whether anyone should be looking at the code at all.
  *
  * ## The join nobody had written
  *
@@ -61,7 +60,80 @@
 
 // @ts-check
 import { execFileSync } from 'node:child_process'
-import { isRunnerKill } from './practices-metrics.mjs'
+
+/**
+ * Step conclusions that mean the step **stopped without a verdict**.
+ *
+ * A dying runner produces two different signatures and #982 caught only the
+ * first, so `biffo-platform` kept two failures it had not earned:
+ *
+ * - `null` — the step was still executing when the lights went out. A deploy
+ *   frozen on "Package and deploy Lambda", six steps left `pending`.
+ * - `cancelled` — the step was stopped, and every later step reads `skipped`.
+ *   Two `biffo-platform` CI runs died 64 seconds in this way, on "Type check"
+ *   and "Lint".
+ *
+ * ## Why `cancelled` here is not an ordinary cancellation
+ *
+ * The obvious objection is that this launders someone hitting cancel, or a
+ * `cancel-in-progress` supersession. It does not, and the reason is structural:
+ * **those conclude the run `cancelled`**, which `isRunnerKill` is only ever
+ * reached for a run that concluded `failure`. A run that concluded `failure`
+ * while no step ever returned a verdict was therefore stopped by something
+ * that is not a cancellation.
+ *
+ * A step that hits `timeout-minutes` (20 since #980) is expected to be marked
+ * `failure` and so stays a real failure.
+ */
+const STOPPED_SHORT = new Set([null, undefined, 'cancelled'])
+
+/**
+ * Did this run fail because a **runner died**, rather than because a gate
+ * rejected the change? (#982)
+ *
+ * ## The hole this closes
+ *
+ * A killed or superseded run naturally concludes `cancelled`, which is not a
+ * defect. That reasoning is right and its coverage is only partial: **a runner
+ * killed mid-job reports `cancelled` only sometimes.** The rest of the time
+ * GitHub concludes the run `failure` with *no failing step* — the same
+ * physical event, a different label, and the second label was counted as if
+ * code had broken.
+ *
+ * Measured on `tabsii-com/tabsii-platform`, 2026-07-31: **all six** `dev`
+ * failures inspected had zero failing steps and 3–21 steps left incomplete. One
+ * deploy succeeded through thirteen steps and froze on "Package and deploy
+ * Lambda". Not one gate rejected a change.
+ *
+ * ## The rule, and why it errs the way it does
+ *
+ * A failed run is a runner kill when **no job reports a failing step** and **at
+ * least one failed job has a step that stopped without a verdict** — see
+ * {@link STOPPED_SHORT} for the two signatures that means, and why `cancelled`
+ * among them is not an ordinary cancellation. Both halves matter: the first
+ * says nothing rejected the change, the second says work was still outstanding
+ * when the lights went out.
+ *
+ * A failed run with no steps recorded at all is deliberately **not** classified
+ * as a kill. It stays a failure. That is the conservative direction for a
+ * counter-metric — it can still refute an experiment the author would prefer to
+ * confirm — and this module's whole purpose is to make that the default.
+ *
+ * A job that hits its `timeout-minutes` (20 since #980) marks the offending step
+ * `failure`, so a genuine hang stays a genuine failure and is not laundered
+ * through here.
+ *
+ * @param {Array<Record<string, any>>} jobs the `jobs` array of one run
+ * @returns {boolean}
+ */
+export function isRunnerKill(jobs) {
+  const failed = (jobs ?? []).filter((job) => job.conclusion === 'failure')
+  if (failed.length === 0) return false
+  const steps = failed.flatMap((job) => job.steps ?? [])
+  if (steps.length === 0) return false
+  if (steps.some((step) => step.conclusion === 'failure')) return false
+  return steps.some((step) => STOPPED_SHORT.has(step.conclusion))
+}
 
 /**
  * How far outside a job's own start/finish window an eviction may fall and

package/scripts/verify.sh

@@ -460,9 +460,11 @@ fi
 # and NO_CI must not fire just because a repo has not adopted the split (a
 # sibling never will; an instance not yet upgraded past #1319 has not yet).
 # But if it EXISTS and cannot be READ, that is the identical #1218 shape as
-# ci.yml itself, and ci_has() must search it too or "practices-monotonic"
-# (moved into it) would silently stop being locally mirrored the moment it
-# left ci.yml -- covered less than verify.sh claims, with nothing saying so.
+# ci.yml itself, and ci_has() must search it too -- a check that lives ONLY
+# in release-guards.yml (any of the ones this repo's own header explains
+# moved here to avoid re-running the whole ci.yml matrix on a PR edit) would
+# otherwise silently stop being locally mirrored, covered less than verify.sh
+# claims, with nothing saying so.
 RELEASE_GUARDS_YML_UNREADABLE=""
 if [ -f .github/workflows/release-guards.yml ] && [ ! -r .github/workflows/release-guards.yml ]; then
   RELEASE_GUARDS_YML_UNREADABLE=1
@@ -1544,15 +1546,6 @@ fi
 [ -f scripts/check-orphan-ratchet-instance.test.sh ] &&
   run_check orphan-ratchet-instance-selftest sh scripts/check-orphan-ratchet-instance.test.sh
 
-# The append-only corpus guard (#778). CI runs it in Release Guards, and it was
-# invisible to the parity test until #897 widened the harvester -- it is neither
-# `pnpm`, `uv`, `terraform` nor `sh scripts/`, so the guard whose property is
-# "every CI check is in the gate or explicitly excluded" could not see it at all.
-# Measured 0.06s here, which is cheaper than every other check in this file.
-if [ -f scripts/practices-monotonic.mjs ]; then
-  ci_has "practices-monotonic" && run_check corpus-append-only node scripts/practices-monotonic.mjs
-fi
-
 # Terraform plan artefacts, refused by CONTENT (biffo-runners#1).
 #
 # A saved plan is a zip. `strings`/`grep` over it is a false-negative machine —

package/scripts/practices-corpus.mjs

@@ -1,202 +0,0 @@
-/**
- * Shared read/write helpers for the practices evidence corpus (#1132).
- *
- * ## Why a directory, not one shared file
- *
- * `docs/practices/evidence.jsonl` was a single file every concurrent session
- * appended to. N writers, one path — conflicts **by construction**, the same
- * class already fixed twice in this repo (`core.version` #423, the generated
- * tally block #953). The lever is the same: stop sharing the path. New rows go
- * into their own file under `docs/practices/evidence/`, one per entry, e.g.
- *
- *     docs/practices/evidence/2026-08-03-metric-denominator-blindness.json
- *
- * Two sessions writing on the same day still never collide — their filenames
- * differ.
- *
- * ## Migration: read both, split nothing
- *
- * Splitting the ~430 existing rows into ~430 files was rejected: it is more
- * expensive than the alternative for no benefit, and it would re-serialise a
- * file that must never be re-serialised (whole-file rewrites are the exact
- * defect being fixed). Instead `evidence.jsonl` is now a **frozen legacy
- * file** — nothing ever appends to it again — and the read side merges it
- * with the directory. See `practices-monotonic.mjs` for the guard that keeps
- * it frozen rather than shrunk.
- *
- * ## Ordering
- *
- * Filenames carry the date (`YYYY-MM-DD-slug.json`), so the read side sorts
- * the directory listing by filename rather than relying on directory order,
- * which the filesystem does not guarantee. Legacy rows keep their existing
- * file order (untouched) and sort BEFORE every directory row — they predate
- * all of them by construction.
- */
-
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-
-export const LEGACY_EVIDENCE = 'docs/practices/evidence.jsonl'
-export const EVIDENCE_DIR = 'docs/practices/evidence'
-
-/** The per-entry directory that goes with a legacy `.jsonl` path. */
-export function corpusDirFor(legacyFile) {
-  return legacyFile.replace(/\.jsonl$/, '')
-}
-
-/**
- * Parse the legacy newline-delimited JSON file, leniently: one malformed line
- * is dropped rather than failing the whole read. Matches the tolerance this
- * file's readers already had before #1132 (a scan for ranking, not a strict
- * audit — `readCorpusStrict` below is the strict counterpart).
- */
-export function readLegacyEvidence(file = LEGACY_EVIDENCE) {
-  if (!existsSync(file)) return []
-  return readFileSync(file, 'utf8')
-    .split('\n')
-    .filter((l) => l.trim() !== '')
-    .map((line) => {
-      try {
-        return JSON.parse(line)
-      } catch {
-        return null
-      }
-    })
-    .filter(Boolean)
-}
-
-/** `*.json` filenames directly under the evidence directory, sorted so date-prefixed names order chronologically. */
-export function listEvidenceFiles(dir = EVIDENCE_DIR) {
-  if (!existsSync(dir)) return []
-  return readdirSync(dir)
-    .filter((f) => f.endsWith('.json'))
-    .sort()
-}
-
-/** Every per-entry file, parsed, alongside the filename it came from — needed to rewrite a specific entry (e.g. `--enrich`). */
-export function readEvidenceDirEntries(dir = EVIDENCE_DIR) {
-  return listEvidenceFiles(dir)
-    .map((file) => {
-      try {
-        return { file, row: JSON.parse(readFileSync(join(dir, file), 'utf8')) }
-      } catch {
-        return null
-      }
-    })
-    .filter(Boolean)
-}
-
-/** Every per-entry file's row, sorted by filename. Malformed files are dropped, not fatal. */
-export function readEvidenceDir(dir = EVIDENCE_DIR) {
-  return readEvidenceDirEntries(dir).map((e) => e.row)
-}
-
-/**
- * The full corpus, lenient: legacy rows (their existing order, untouched)
- * followed by directory rows (sorted by filename). A concatenation, not a
- * merge — the two never name the same entry, so there is nothing to
- * reconcile.
- *
- * @param {string} legacyFile path to the legacy `.jsonl`; its sibling
- *   directory is derived from it (`corpusDirFor`)
- */
-export function readCorpus(legacyFile = LEGACY_EVIDENCE) {
-  return [...readLegacyEvidence(legacyFile), ...readEvidenceDir(corpusDirFor(legacyFile))]
-}
-
-/**
- * The full corpus, strict: throws on the first line or file that fails to
- * parse, and throws if neither the legacy file nor the directory has
- * anything to read. For callers whose whole point is "never report a zero
- * that could actually be 'could not read this'" (`summariseFailOpenBacklog`)
- * — a corpus that half-parses must not silently look like a smaller valid
- * one.
- *
- * @param {string} legacyFile
- */
-export function readCorpusStrict(legacyFile = LEGACY_EVIDENCE) {
-  const dir = corpusDirFor(legacyFile)
-  const legacyExists = existsSync(legacyFile)
-  const dirFiles = listEvidenceFiles(dir)
-  if (!legacyExists && dirFiles.length === 0) {
-    throw new Error(`no corpus at ${legacyFile} or ${dir}`)
-  }
-  const legacyRows = legacyExists
-    ? readFileSync(legacyFile, 'utf8')
-        .split('\n')
-        .filter((l) => l.trim() !== '')
-        .map((l) => JSON.parse(l))
-    : []
-  const dirRows = dirFiles.map((f) => JSON.parse(readFileSync(join(dir, f), 'utf8')))
-  return [...legacyRows, ...dirRows]
-}
-
-/** Filename-safe token from a row's summary. */
-export function slugify(text) {
-  return String(text ?? '')
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .slice(0, 60)
-}
-
-/**
- * Write ONE new evidence entry as its own file. This is the write path every
- * future session uses — never append to `evidence.jsonl`, which is frozen.
- *
- * Refuses to overwrite an existing file: a collision means the slug needs to
- * be more specific, not that the earlier entry should be silently replaced.
- *
- * The refusal is an atomic `wx` create, not an `existsSync` check followed by
- * a write (#1222). This corpus has concurrent writers BY DESIGN — several
- * agent sessions run against this estate at once — so the window between a
- * check and a write is not theoretical here: two sessions writing the same
- * `date-slug` is the exact case the guard exists for, and the check-then-write
- * form lost the earlier entry rather than refusing. `EEXIST` is translated
- * back into the same message, so nothing else changes.
- *
- * @param {Record<string, any>} row
- * @param {{dir?: string, date?: string, slug?: string}} [opts]
- * @returns {string} the path written, relative to `opts.dir`'s base
- */
-export function writeEvidenceEntry(row, opts = {}) {
-  const dir = opts.dir ?? EVIDENCE_DIR
-  // `undefined` means "nobody said"; `null` means "known to be unknown". Both
-  // must reach the stored field as null rather than today's date.
-  //
-  // This used to read `opts.date ?? row.date ?? new Date()…` and write that
-  // single value to BOTH the filename and the row. The module docstring says
-  // the opposite in as many words — "Rows citing nothing keep `date: null` —
-  // never a guess, because a fabricated date would corrupt exactly the ranking
-  // this exists to enable" — and `--extract` even passes `date: row.date ??
-  // null` to say so explicitly. `null ?? today` discarded that.
-  //
-  // It was invisible while rows were extracted the day they were written, and
-  // surfaced on 2026-08-09 when extracting five rows also swept up eighteen
-  // older ones and stamped every one with that day. `--enrich` recovers real
-  // dates from the cited issues afterwards, and it can only do that for rows
-  // whose date is *absent*; a fabricated one looks recovered and is skipped.
-  const date = opts.date ?? row.date ?? null
-  const slug = opts.slug ?? slugify(row.summary) ?? 'entry'
-  mkdirSync(dir, { recursive: true })
-  // The filename is used only for sorting and uniqueness — every reader parses
-  // the JSON body — so an undated row says so here too, rather than carrying a
-  // date prefix that the data it contains denies.
-  const file = `${date ?? 'undated'}-${slug || 'entry'}.json`
-  const path = join(dir, file)
-  try {
-    writeFileSync(path, `${JSON.stringify({ ...row, date }, null, 2)}\n`, { flag: 'wx' })
-  } catch (err) {
-    if (err && err.code === 'EEXIST') {
-      throw new Error(`${path} already exists — choose a more specific slug or date`)
-    }
-    throw err
-  }
-  return path
-}
-
-/** Overwrite one already-existing per-entry file in place (e.g. `--enrich` filling in a date). Never touches the legacy file. */
-export function writeEvidenceFile(dir, file, row) {
-  mkdirSync(dir, { recursive: true })
-  writeFileSync(join(dir, file), `${JSON.stringify(row, null, 2)}\n`)
-}