@cspeach/cli 1.1.27 → 1.1.28

package/dist/commands/plan-sap-pause.js

@@ -0,0 +1,105 @@
+import { buildResumeCommand } from './plan-resume.js';
+import { unreachableCode } from '../sap/unreachable.js';
+import { getAndResetSapUnreachable, unreachableCodeInText } from '../sap/reachability-state.js';
+import { recordFullNotice } from '../renderer/notice-log.js';
+export const SAP_PAUSE_LINE = "Can't reach the SAP system from this machine. Nothing is lost. Check network access, then press Enter to retry.";
+/** The line a paused build ends on (shared with later pause points). */
+export const PAUSED_LINE = 'Paused. To continue later: open CSPeach in this folder and choose Continue.';
+const RETRY_QUESTION = 'Press Enter to retry, or type stop: ';
+const STOP_WORDS = new Set(['stop', 'q', 'quit', 'exit']);
+/** The exact command that runs the interrupted step again (mode + audit flags kept). */
+export function resumeCommandFor(prepared) {
+    return buildResumeCommand(prepared.path)
+        + (prepared.mode ? ` --${prepared.mode}` : '')
+        + (prepared.auditFlag === 'off' ? ' --no-audit' : prepared.auditFlag === 'on' ? ' --audit' : '');
+}
+/**
+ * The pause itself failed (prompt aborted, probe threw): the user still gets
+ * one instruction on screen; the error text goes to the notices log.
+ */
+export function reportSapPauseFailure(prepared, err, log) {
+    recordFullNotice('plan', `SAP pause failed: ${err instanceof Error ? err.message : String(err)}`);
+    log('', PAUSED_LINE, `To run this step again: ${resumeCommandFor(prepared)}`);
+}
+/** One retry-or-stop question: Enter (or anything else) retries; "stop" / "q" stops. */
+export async function promptRetryOrStop(prompt, question = RETRY_QUESTION) {
+    const ans = String((await prompt(question)) ?? '').trim().toLowerCase();
+    return STOP_WORDS.has(ans) ? 'stop' : 'retry';
+}
+const CONTINUE_WORDS = new Set(['continue', 'c', 'go']);
+/** The question after a lock that did not clear: check again (Enter), go on anyway, or stop. */
+export const LOCKED_QUESTION = 'Press Enter to check again, type continue to go on anyway (the step will meet the lock itself), or type stop: ';
+/**
+ * The lock question. Enter (or anything else) checks again; "continue" runs
+ * the step anyway (its own write meets the lock); "stop" / "q" pauses.
+ */
+export async function promptLockedChoice(prompt) {
+    const ans = String((await prompt(LOCKED_QUESTION)) ?? '').trim().toLowerCase();
+    if (STOP_WORDS.has(ans))
+        return 'stop';
+    if (CONTINUE_WORDS.has(ans))
+        return 'continue';
+    return 'retry';
+}
+/**
+ * Show the pause line and wait until SAP answers again. True when SAP is back
+ * (the caller re-runs the step); false when the user stopped, or nobody is
+ * there to press Enter (headless never waits).
+ */
+export async function pauseUntilSapReachable(a) {
+    if (!a.interactive) {
+        a.log("Can't reach the SAP system from this machine. Nothing is lost.", PAUSED_LINE);
+        if (a.resumeCommand)
+            a.log(`To run this step again: ${a.resumeCommand}`);
+        return false;
+    }
+    for (;;) {
+        a.log('', SAP_PAUSE_LINE);
+        if ((await promptRetryOrStop(a.prompt)) === 'stop') {
+            a.log(PAUSED_LINE);
+            return false;
+        }
+        if (await a.probe())
+            return true;
+    }
+}
+/** Reachable unless the call fails with a network error (an HTTP error means SAP answered). */
+export function makeSapProbe(adt) {
+    return async () => {
+        try {
+            await adt.inactiveObjects();
+            return true;
+        }
+        catch (e) {
+            const code = unreachableCode(e) ?? unreachableCodeInText(String(e));
+            if (code)
+                recordFullNotice('plan', `SAP still unreachable on retry: ${code}`);
+            return !code;
+        }
+    };
+}
+/**
+ * After a plan step's turn: when a SAP tool hit an unreachable SAP and the
+ * step saved nothing, pause; on Enter (and SAP answering) queue the SAME step
+ * again. Always consumes the flag. 'resumed' = the step is queued (the run
+ * goes on); 'paused' = the user stopped (the run ends); 'none' = no pause.
+ */
+export async function handleSapUnreachableAfterPlanTurn(a) {
+    const code = getAndResetSapUnreachable();
+    if (!code || !a.prepared || a.persisted)
+        return 'none';
+    recordFullNotice('plan', `SAP unreachable during step ${a.prepared.nextPhaseId}: ${code}`);
+    const cmd = resumeCommandFor(a.prepared);
+    let ok;
+    try {
+        ok = await pauseUntilSapReachable({ ...a, resumeCommand: cmd });
+    }
+    catch (err) {
+        reportSapPauseFailure(a.prepared, err, a.log);
+        return 'paused';
+    }
+    if (!ok)
+        return 'paused';
+    a.queue(cmd);
+    return 'resumed';
+}

package/dist/commands/plan-startup.js

@@ -0,0 +1,218 @@
+import { readProjectFile } from '../projects/status.js';
+import { parsePlanContent } from '../projects/plan-schema.js';
+import { computeNextPhaseForRun, isPhaseSatisfiedForRun, phaseDisplayTitle, statusesFromItems, } from '../projects/plan-run.js';
+import { collectPlannedObjects, plannedObjectFacts, planGrantFactLines } from '../projects/plan-objects.js';
+import { adoptPlanTransportOnResume, buildResumeCommand, planBuildTransport } from './plan-resume.js';
+import { newestPlanFamilyFiles } from '../session/recap.js';
+import { getPlanGrant, installPlanGrant, planGrantAllowed } from '../approvals/plan-grant.js';
+import { DEFAULT_PLAN_MODE } from './plan-gate.js';
+/** Plans in the folder with a step left to build, newest first. */
+export function listUnfinishedPlans(workspaceDir, max = 5) {
+    const out = [];
+    for (const f of newestPlanFamilyFiles(workspaceDir)) {
+        if (out.length >= max)
+            break;
+        let env;
+        try {
+            env = readProjectFile(f.path);
+        }
+        catch {
+            continue;
+        }
+        if (env.artefactType !== 'plan')
+            continue;
+        const pc = parsePlanContent(env.content);
+        if (!pc.ok)
+            continue;
+        const phases = pc.content.phases;
+        const statuses = statusesFromItems(env.interaction.items, phases);
+        // A plan whose steps are all built (only its end-of-run check owed) has
+        // no step to continue; any resume picks the check up.
+        const next = computeNextPhaseForRun(phases, statuses);
+        if (!next)
+            continue;
+        const transport = planBuildTransport(phases);
+        out.push({
+            path: f.path,
+            planId: env.id,
+            title: env.title,
+            // "Done" = built in a run: a deferred check counts (it runs at the end).
+            done: phases.filter((p) => isPhaseSatisfiedForRun(statuses[p.id], p.audit)).length,
+            total: phases.length,
+            nextTitle: phaseDisplayTitle(next, phases),
+            objects: collectPlannedObjects(pc.content),
+            ...(transport ? { transport } : {}),
+        });
+    }
+    return out;
+}
+function progress(p) {
+    return `${p.done} of ${p.total} done, next: ${p.nextTitle ?? 'the independent check'}`;
+}
+export function continueQuestion(p) {
+    return `Continue '${p.title}' (${progress(p)})?`;
+}
+/** The object-list rows, the transport, and what the approval covers. */
+function objectListFacts(objects, transport, grantable) {
+    if (objects.length === 0)
+        return ['The plan does not list its SAP objects, so CSPeach asks before each write.'];
+    return [
+        `It will create or change these ${objects.length} SAP object${objects.length === 1 ? '' : 's'}:`,
+        ...plannedObjectFacts(objects).map((r) => `  ${r}`),
+        `Transport: ${transport ?? 'a new one for this build'}`,
+        ...(grantable ? planGrantFactLines() : ['CSPeach asks before each write.']),
+    ];
+}
+const OBJECT_LIST_FAILED = 'The object list could not be approved. Each SAP write asks first.';
+/**
+ * The plan ids whose object list was just offered by the startup Continue: the
+ * resume it submits must not ask again (one-shot, consumed by that resume).
+ */
+const offeredAtStartup = new Set();
+/**
+ * Plan ids whose typed resume opened on a re-audit pass (a crashed session
+ * left a check owed): the object list is offered on the hop that pass queues,
+ * once. Consumed by the next offer call for that plan.
+ */
+const offerOwedAfterReaudit = new Set();
+/** Plan ids whose object list this function already showed in this session. */
+const objectListShown = new Set();
+async function grantObjectList(a) {
+    const g = { planId: a.planId, sessionId: a.sessionId, objects: a.objects, ...(a.transport ? { transport: a.transport } : {}) };
+    try {
+        if (a.grant) {
+            await a.grant(g);
+            return true;
+        }
+        if (await installPlanGrant({ ...g, ...(a.sapAlias ? { sapAlias: a.sapAlias } : {}) }))
+            return true;
+    }
+    catch { /* fall through */ }
+    a.log(OBJECT_LIST_FAILED);
+    return false;
+}
+function grantInstalledFor(planId, sessionId) {
+    const g = getPlanGrant();
+    return g !== null && g.planId === planId && g.sessionId === sessionId
+        && typeof g.expiresAt === 'number' && Date.now() < g.expiresAt;
+}
+export async function offerContinueAtStartup(a) {
+    const plans = listUnfinishedPlans(a.workspaceDir);
+    if (plans.length === 0)
+        return 'none';
+    const allowed = a.grantAllowed ?? planGrantAllowed;
+    let pick;
+    let grantable = false;
+    let approved = false;
+    if (plans.length === 1) {
+        const p = plans[0];
+        grantable = p.objects.length > 0 && await allowed(a.sapAlias).catch(() => false);
+        const v = await a.choose({
+            title: continueQuestion(p),
+            facts: objectListFacts(p.objects, p.transport, grantable),
+            choices: [{ value: 'continue', label: 'Continue' }, { value: 'later', label: 'Not now' }],
+        });
+        if (v === 'continue') {
+            pick = p;
+            approved = grantable;
+        }
+    }
+    else {
+        const v = await a.choose({
+            title: 'Continue an unfinished plan?',
+            facts: ['Newest first.'],
+            choices: [
+                ...plans.map((p, i) => ({ value: String(i), label: `${p.title} (${progress(p)})` })),
+                { value: 'later', label: 'Not now' },
+            ],
+        });
+        if (v !== null && /^\d+$/.test(v))
+            pick = plans[Number(v)];
+        // The list did not show the objects: the picked plan's list is shown now.
+        if (pick && pick.objects.length > 0) {
+            grantable = await allowed(a.sapAlias).catch(() => false);
+            if (grantable)
+                approved = await askObjectList(a.choose, pick.title, [], pick.objects, pick.transport);
+        }
+    }
+    if (!pick)
+        return 'declined';
+    offeredAtStartup.add(pick.planId);
+    if (approved) {
+        await grantObjectList({ ...a, planId: pick.planId, objects: pick.objects, ...(pick.transport ? { transport: pick.transport } : {}) });
+    }
+    a.submit(buildResumeCommand(pick.path));
+    return 'continued';
+}
+/** The object-list card. True on Yes. */
+async function askObjectList(choose, planTitle, lead, objects, transport) {
+    const v = await choose({
+        title: `Approve the object list for '${planTitle}'?`,
+        facts: [...lead, ...objectListFacts(objects, transport, true)],
+        choices: [{ value: 'yes', label: 'Yes' }, { value: 'no', label: 'No — ask before each write' }],
+    });
+    return v === 'yes';
+}
+/**
+ * F13 — before a typed `/abap-plan --resume` step in guarded mode: when the
+ * plan lists objects and no grant for it is installed, show the object list
+ * once. Yes installs the grant (same policy) and adopts the recorded
+ * transport; No runs the step with a card per write. Skipped on a
+ * chain-queued hop, in step mode (it keeps its own per-step prompt), for a
+ * re-audit-only pass, when the grant is not allowed, and for the resume the
+ * startup Continue submitted. A typed resume that opens on a re-audit pass
+ * (a crashed session left a check owed) moves the offer to the first step
+ * that pass queues: that one chain hop may show it, once, when no grant
+ * exists and the list was not shown yet in this session.
+ */
+export async function offerObjectListOnResume(a) {
+    const env = a.prepared.envelope;
+    const fromStartup = offeredAtStartup.delete(env.id);
+    if (fromStartup)
+        return 'skipped';
+    if (a.prepared.reauditPhaseId) {
+        if (!a.planHop)
+            offerOwedAfterReaudit.add(env.id);
+        return 'skipped';
+    }
+    const owed = offerOwedAfterReaudit.delete(env.id);
+    if (a.planHop && !(owed && !objectListShown.has(env.id)))
+        return 'skipped';
+    if ((a.prepared.effectiveMode ?? DEFAULT_PLAN_MODE) !== 'guarded')
+        return 'skipped';
+    if (grantInstalledFor(env.id, a.sessionId))
+        return 'skipped';
+    const pc = parsePlanContent(env.content);
+    if (!pc.ok)
+        return 'skipped';
+    const content = pc.content;
+    const objects = collectPlannedObjects(content);
+    if (objects.length === 0)
+        return 'skipped';
+    if (!(await (a.grantAllowed ?? planGrantAllowed)(a.sapAlias).catch(() => false)))
+        return 'skipped';
+    const next = content.phases.find((p) => p.id === a.prepared.nextPhaseId);
+    const transport = planBuildTransport(content.phases);
+    const lead = next ? [`Next step: ${phaseDisplayTitle(next, content.phases)}`] : [];
+    objectListShown.add(env.id);
+    if (!(await askObjectList(a.choose, env.title, lead, objects, transport)))
+        return 'declined';
+    adoptPlanTransportOnResume(content.phases);
+    const ok = await grantObjectList({ ...a, planId: env.id, objects, ...(transport ? { transport } : {}) });
+    return ok ? 'approved' : 'declined';
+}
+export function inkStartupChooser() {
+    return async (q) => {
+        const { askConfirm } = await import('../ui/confirm-request.js');
+        const r = await askConfirm({ id: 'plan-continue', tag: 'QUESTION', title: q.title, facts: q.facts, choices: q.choices, initial: 0 });
+        return r.cancelled ? null : r.value;
+    };
+}
+export function classicStartupChooser(prompt, log) {
+    return async (q) => {
+        log('', q.title, ...q.facts.map((f) => `  ${f}`), ...q.choices.map((c, i) => `  ${i + 1}. ${c.label}`));
+        const ans = (await prompt(`Choose 1-${q.choices.length} (Enter = ${q.choices[0].label}): `)).trim();
+        const n = ans === '' ? 1 : Number(ans);
+        return Number.isInteger(n) && n >= 1 && n <= q.choices.length ? q.choices[n - 1].value : null;
+    };
+}

package/dist/config/loader.js

@@ -222,6 +222,9 @@ export async function loadConfig() {
             plan_audit: parsed.plan_audit === 'on' || parsed.plan_audit === 'off'
                 ? parsed.plan_audit
                 : undefined,
+            approvals: parsed.approvals === 'plan' || parsed.approvals === 'per-write'
+                ? parsed.approvals
+                : undefined,
             // audit_model: preserve only a non-empty string (trimmed); a wrong-type /
             // empty value collapses to undefined so resolveAuditModel reads the safe
             // Sonnet default. Mirrors the optional-key hygiene of plan_mode/render_smoke.
@@ -315,6 +318,8 @@ export async function loadConfig() {
         // callers see a genuine "absent" shape (treated as 'on').
         if (merged.plan_audit === undefined)
             delete merged.plan_audit;
+        if (merged.approvals === undefined)
+            delete merged.approvals;
         // Same for `audit_model`: absent-or-invalid must not serialise as
         // `audit_model = undefined` — drop the key so `config show` stays clean and
         // callers see a genuine "absent" shape (resolveAuditModel reads the default).
@@ -438,3 +443,7 @@ export async function saveConfig(config) {
     }
     await fs.writeFile(configFile(), toml.stringify(writable), 'utf-8');
 }
+/** The effective plan-run approval mode — absent/invalid ⇒ 'plan'. */
+export function effectiveApprovals(cfg) {
+    return cfg.approvals === 'per-write' ? 'per-write' : 'plan';
+}

package/dist/doctor/checks/forge-rules.js

@@ -1,33 +1,51 @@
 /**
- * Doctor check: forge-rules (C.2)
+ * Doctor check: forge-rules — READ-ONLY.
  *
- * Verifies that Rule 7 (auto-snapshot before write) and Rule 10
- * (auto-syntax-check after write) are enforced end-to-end against the
- * customer's SAP system.
+ * 2026-10-04 — doctor is a diagnostic and must never change a customer's SAP
+ * system. This check used to create a probe report Z_CSPEACH_DOCTOR_PROBE in
+ * $TMP, lock it, write its source, run a syntax check and delete it, to show
+ * that Rule 7 (snapshot before write) and Rule 10 (syntax check after write)
+ * fire. Both rules live in the sap-client write path (AdtClient.setSource)
+ * and are proven by its own tests; what can differ per laptop and per system
+ * is whether their two dependencies are there:
+ *  - Rule 7: the local snapshot store (~/.cspeach/snapshots) can be written;
+ *  - Rule 10: the system offers the ADT syntax-check endpoint (checkruns),
+ *    read from the discovery document with a plain GET.
+ * That is what this check now answers.
  *
- * DEVIATION FROM PLAN: calls AdtClient.setSource directly, NOT the CLI
- * sap_set_source tool handler. Reasons:
- *  - The CLI handler requires an approval_id JWT (minted by request_approval).
- *    Doctor is non-interactive — minting an internal JWT adds complexity.
- *  - A known regression in the CLI handler (memory/project_phase3_lite_regression.md)
- *    causes double-dispatch that would always red this check.
- *  - Rule 7 (AUTO-SNAPSHOT at ~line 1994) and Rule 10 (AUTO-SYNTAX-CHECK at
- *    ~line 2114) live inside AdtClient.setSource itself. Calling AdtClient
- *    directly still exercises the full rule pipeline.
+ * What doctor can no longer tell: whether this SAP user is allowed to create
+ * and change objects (the old probe failed with 401/403 when not). The first
+ * real write in a session still reports that, with its own approval.
  */
+import { promises as fs, constants as fsc } from 'node:fs';
+import path from 'node:path';
 import { loadConfig } from '../../config/loader.js';
 import { getConnection } from '../../sap/connection-manager.js';
-import { AdtClient, snapshots } from '@cspeach/sap-client';
+import { snapshots } from '@cspeach/sap-client';
 import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
-import { verifySyntax } from '../../tools/verify.js';
-const PROBE_NAME = 'Z_CSPEACH_DOCTOR_PROBE';
-const PROBE_PACKAGE = '$TMP';
-const PROBE_SOURCE = `REPORT ${PROBE_NAME}.\nWRITE / 'cspeach doctor probe — safe to delete'.`;
+const DISCOVERY_PATH = '/sap/bc/adt/discovery';
+const CHECKRUNS = '/sap/bc/adt/checkruns';
+/** The snapshot folder, or its nearest existing parent, is writable. */
+async function snapshotStoreWritable(dir) {
+    let cur = path.resolve(dir);
+    for (;;) {
+        try {
+            await fs.access(cur, fsc.W_OK);
+            return true;
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                return false;
+            const up = path.dirname(cur);
+            if (up === cur)
+                return false;
+            cur = up;
+        }
+    }
+}
 export async function checkForgeRules() {
     const cfg = await loadConfig();
-    // Standalone mode ONLY — the Rule 7/10 probe needs a live system, and an
-    // opted-in paste-mode user has none. Everything below (including the
-    // no-alias skip) is unchanged.
+    // Standalone mode — no live system, nothing to check.
     if (sapChecksSkipped(cfg))
         return standaloneSkip('forge-rules');
     const aliases = Object.keys(cfg.sap);
@@ -40,79 +58,43 @@ export async function checkForgeRules() {
             hint: 'Run: cspeach config add-sap',
         };
     }
+    // Rule 7 — local, no SAP call.
+    const snapDir = snapshots.getDefaultSnapshotDir();
+    if (!(await snapshotStoreWritable(snapDir))) {
+        return {
+            name: 'forge-rules',
+            ok: false,
+            message: `Rule 7: snapshot folder is not writable (${snapDir})`,
+            hint: 'Writes to SAP are refused until the snapshot folder can be written. Check the folder permissions.',
+        };
+    }
+    // Rule 10 — one GET of the discovery document.
     const alias = aliases[0];
     const conn = await getConnection(alias, cfg.sap[alias]);
-    const adt = new AdtClient(conn);
-    // Cleanup: delete a leftover probe from a prior failed run, best-effort.
-    try {
-        await adt.deleteObject('PROG', PROBE_NAME);
-    }
-    catch { /* best-effort */ }
-    try {
-        // Step 1: Create the probe shell (PROG in $TMP).
-        await adt.createObject('PROG', PROBE_NAME, PROBE_PACKAGE, 'cspeach doctor probe');
-    }
-    catch (err) {
-        const msg = String(err);
-        if (msg.includes('401') || msg.includes('403')) {
-            return {
-                name: 'forge-rules',
-                ok: false,
-                skipped: true,
-                message: 'write probe not permitted',
-                hint: `User ${alias} can't write to ${PROBE_PACKAGE} — Rule 7/10 not verified. Configure a probe_package or grant write permissions.`,
-            };
-        }
+    const r = await conn.get(DISCOVERY_PATH, 'application/atomsvc+xml');
+    if (r.status === 401 || r.status === 403) {
         return {
             name: 'forge-rules',
             ok: false,
-            message: `probe-create failed: ${msg.slice(0, 120)}`,
+            skipped: true,
+            message: `Rule 10 not verified: ${alias} answered HTTP ${r.status} on ADT discovery`,
+            hint: `Check the SAP user's ADT authorisations on ${alias}.`,
         };
     }
-    try {
-        // Capture snapshot count before write.
-        const snapsBefore = await snapshots.list('PROG', PROBE_NAME);
-        // Step 2: setSource — exercises Rule 7 (auto-snapshot) + Rule 10 (auto-syntax-check)
-        // inside AdtClient. Bypasses the CLI handler intentionally — see file header.
-        await adt.setSource('PROG', PROBE_NAME, PROBE_SOURCE);
-        // Step 3: Verify Rule 7 fired — snapshot count should have increased.
-        const snapsAfter = await snapshots.list('PROG', PROBE_NAME);
-        if (snapsAfter.length <= snapsBefore.length) {
-            return {
-                name: 'forge-rules',
-                ok: false,
-                message: `Rule 7 not enforced: snapshot count did not increase (was ${snapsBefore.length}, now ${snapsAfter.length})`,
-            };
-        }
-        // Step 4: Verify Rule 10 fired — syntax was checked. Re-run syntaxCheck and confirm clean.
-        // Re-review item 2 — through verifySyntax (fail closed): a check that did
-        // not run is ok:false with its reason, never a throw out of collectChecks.
-        const syntax = await verifySyntax(adt, PROBE_NAME, 'PROG');
-        if (syntax.didNotRun !== undefined) {
-            return {
-                name: 'forge-rules',
-                ok: false,
-                message: `Rule 10: syntax check did not run: ${syntax.didNotRun.replace(/^Syntax check did not run:?\s*/i, '')}`,
-            };
-        }
-        if (!syntax.ok) {
-            return {
-                name: 'forge-rules',
-                ok: false,
-                message: `Rule 10: syntax check returned errors on probe: ${syntax.errors[0] ?? 'unknown'}`,
-            };
-        }
+    if (r.status < 200 || r.status >= 300) {
+        return { name: 'forge-rules', ok: false, message: `Rule 10 not verified: ADT discovery returned HTTP ${r.status} on ${alias}` };
+    }
+    if (!r.body.includes(CHECKRUNS)) {
         return {
             name: 'forge-rules',
-            ok: true,
-            message: `Rule 7 (snapshot) + Rule 10 (syntax check) verified on ${PROBE_NAME}`,
+            ok: false,
+            message: `Rule 10: ${alias} does not offer the ADT syntax check (${CHECKRUNS})`,
+            hint: 'Writes are refused when the syntax check cannot run. Ask your basis team to enable ADT check runs.',
         };
     }
-    finally {
-        // Always cleanup, success or failure.
-        try {
-            await adt.deleteObject('PROG', PROBE_NAME);
-        }
-        catch { /* best-effort */ }
-    }
+    return {
+        name: 'forge-rules',
+        ok: true,
+        message: `Rule 7 (snapshot folder) + Rule 10 (syntax check on ${alias}) ready — read-only check, nothing written`,
+    };
 }

package/dist/doctor/run.js

@@ -85,10 +85,10 @@ export function formatDoctorRows(checks) {
     return lines;
 }
 /**
- * Re-review 2 item 3 — the forge-rules probe writes to SAP (create, lock,
- * write, snapshot list, delete); any throw there (lock refused, snapshot
- * store unreadable, connection drop) is a failed row with a readable one-line
- * message, never a crashed doctor run.
+ * Re-review 2 item 3 — any throw inside the forge-rules check (login refused,
+ * connection drop) is a failed row with a readable one-line message, never a
+ * crashed doctor run. The check is read-only since 2026-10-04 (one discovery
+ * GET; it never writes to SAP).
  */
 async function safeForgeRules() {
     try {