@deftai/directive-core 0.88.0 → 0.90.0

package/dist/release-publish/pipeline.js

@@ -1,10 +1,34 @@
+import { closedVerbEnvBypassKey, evaluateClosedVerb } from "../authz/closed-verb.js";
+import { listActiveHumanGrants, loadAuthzState, markGrantUsed } from "../authz/store.js";
+import { loadVerbClassification } from "../authz/verb-classification.js";
 import { EXIT_OK, EXIT_VIOLATION } from "../release/constants.js";
 import { editReleasePublish, viewRelease } from "./gh-api.js";
 export function emit(label, status) {
     process.stderr.write(`[publish] ${label}... ${status}\n`);
 }
+/**
+ * Fail-closed gate before draft→public (#1095 Wave 4).
+ * Allow only DEFT_ALLOW_RELEASE_PUBLISH=1 or a matching human-origin grant.
+ * Loads conventions/verb-classification.json from projectRoot when present.
+ * Test seam: pass grants / env via optional overrides on seams when present.
+ */
+export function evaluateReleasePublishGate(version, projectRoot, options = {}) {
+    // Production load of classification SoT (conventions/verb-classification.json).
+    const classification = loadVerbClassification(projectRoot);
+    const state = loadAuthzState(projectRoot);
+    const grants = options.grants ?? listActiveHumanGrants(projectRoot, state);
+    return evaluateClosedVerb({
+        verb: "release-publish",
+        target: version,
+        grants,
+        env: options.env ?? process.env,
+        projectRoot,
+        repo: options.repo ?? null,
+        classification,
+    });
+}
 export function runPublish(config, seams = {}) {
-    const { version, repo, dryRun } = config;
+    const { version, repo, dryRun, projectRoot } = config;
     const tag = `v${version}`;
     const viewLabel = `View ${tag} on ${repo}`;
     if (dryRun) {
@@ -26,6 +50,23 @@ export function runPublish(config, seams = {}) {
         return EXIT_OK;
     }
     emit(viewLabel, `OK (draft found at ${payload?.url ?? "<no url>"})`);
+    // Closed-verb gate: refuse draft→public without grant or env bypass (#1095).
+    const gateSeams = seams;
+    const gate = evaluateReleasePublishGate(version, projectRoot, {
+        grants: gateSeams.closedVerbGrants,
+        env: gateSeams.closedVerbEnv,
+        repo,
+    });
+    if (!gate.allowed) {
+        const bypassKey = gate.envBypassKey ??
+            closedVerbEnvBypassKey("release-publish", projectRoot) ??
+            "DEFT_ALLOW_RELEASE_PUBLISH";
+        emit(`Closed-verb gate release-publish ${tag}`, `FAIL (${gate.code}: ${gate.reason})`);
+        process.stderr.write(`[publish] denied code=${gate.code} — set ${bypassKey}=1 or ` +
+            `mint \`deft authz:grant -- --template release-publish --target ${version}\`\n`);
+        return EXIT_VIOLATION;
+    }
+    emit(`Closed-verb gate release-publish ${tag}`, `OK (${gate.code}${gate.humanApprovalRef !== null ? ` grant=${gate.humanApprovalRef}` : ""})`);
     const editLabel = `Edit ${tag} (--draft=false)`;
     const [ok, editReason] = editReleasePublish(version, repo, payload?.id ?? undefined, seams);
     if (!ok) {
@@ -40,6 +81,10 @@ export function runPublish(config, seams = {}) {
         return EXIT_VIOLATION;
     }
     emit(verifyLabel, `OK (${tag} is now public)`);
+    // Consume single-use grant after successful draft→public (#1095).
+    if (gate.humanApprovalRef !== null && gate.code === "closed-verb-allow") {
+        markGrantUsed(projectRoot, gate.humanApprovalRef);
+    }
     process.stderr.write(`Release ${tag} published successfully on ${repo}.\n`);
     return EXIT_OK;
 }

package/dist/scope/audit-log.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync, writeSync, } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { resolveTriageCachePath } from "../triage/cache-path.js";
 import { utcNowIso } from "./vbrief-json.js";
 export class ScopeAuditLogError extends Error {
@@ -28,6 +29,12 @@ const DEMOTE_META_REQUIRED = [
     "demoted_from",
 ];
 let threadLock = false;
+/** Ensure parent exists and return it as the containment root for log writes. */
+function containmentRootForLog(logPath) {
+    const parent = dirname(logPath);
+    mkdirSync(parent, { recursive: true });
+    return resolve(parent);
+}
 function replacerSortKeys(_key, value) {
     if (typeof value === "object" && value !== null && !Array.isArray(value)) {
         const sorted = {};
@@ -97,34 +104,16 @@ export function canonicalLogPath(projectRoot) {
     // Layout-aware (#1703): triage working-set under `.triage-cache/`.
     return resolveTriageCachePath(resolve(projectRoot), "scope-lifecycle.jsonl");
 }
-function withAppendLock(logPath, fn) {
-    const lockPath = `${logPath}.lock`;
-    mkdirSync(dirname(logPath), { recursive: true });
+function withAppendLock(fn) {
     while (threadLock) {
         /* spin-wait for in-process serialization */
     }
     threadLock = true;
-    let fd = null;
     try {
-        fd = openSync(lockPath, "a+");
-        if (readFileSync(lockPath).length === 0) {
-            writeSync(fd, "\0");
-        }
         fn();
     }
     finally {
         threadLock = false;
-        if (fd !== null) {
-            closeSync(fd);
-        }
-        try {
-            if (existsSync(lockPath)) {
-                unlinkSync(lockPath);
-            }
-        }
-        catch {
-            /* best-effort lock cleanup */
-        }
     }
 }
 /** Validate and append an audit entry; returns decision_id. */
@@ -134,10 +123,16 @@ export function append(entry, logPath) {
     }
     validateEntry(entry);
     const logFile = resolve(logPath);
-    mkdirSync(join(logFile, ".."), { recursive: true });
+    const root = containmentRootForLog(logFile);
     const line = JSON.stringify(entry, replacerSortKeys);
-    withAppendLock(logFile, () => {
-        writeFileSync(logFile, `${line}\n`, { encoding: "utf8", flag: "a" });
+    // #2980 wave B: product write sink routes through containedWrite.
+    withAppendLock(() => {
+        containedWrite({
+            root,
+            target: logFile,
+            data: `${line}\n`,
+            mode: "append",
+        });
     });
     return String(entry.decision_id);
 }

package/dist/scope/decompose.js

@@ -6,10 +6,11 @@
  * A caller supplies a draft with child story definitions; this module validates
  * that draft, writes the child story vBRIEFs, and updates the parent scope references.
  */
-import { accessSync, constants, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { referenceTypeMatches } from "@deftai/directive-types";
-import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
+import { containedWrite } from "../fs/contained-write.js";
+import { ProjectionContainmentError } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, LEGACY_ARTIFACT_DIR, MIGRATED_ARTIFACT_DIR, resolveLifecycleRoot, } from "../layout/resolve.js";
 import { referenceWithDefaultTrust, slugify } from "../vbrief-build/build.js";
 import { EMITTED_VBRIEF_VERSION } from "../vbrief-build/constants.js";
@@ -54,9 +55,13 @@ function loadJson(path) {
     return data;
 }
 function writeJson(projectRoot, path, data) {
-    assertWriteTargetSafe(projectRoot, path);
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, formatBriefJson(data), "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    containedWrite({
+        root: resolve(projectRoot),
+        target: path,
+        data: formatBriefJson(data),
+        mode: "replace",
+    });
 }
 // ---------------------------------------------------------------------------
 // Story quality helpers (ported from _vbrief_story_quality.py)

package/dist/scope/decomposed-refs.js

@@ -1,6 +1,7 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { referenceTypeMatches } from "@deftai/directive-types";
+import { containedWrite } from "../fs/contained-write.js";
 import { formatBriefJson } from "./vbrief-json.js";
 import { collectChildUris, collectPlanRefs, resolveVbriefRef } from "./vbrief-ref.js";
 function rewriteOnePlanRef(value, oldParentResolved, newParentRel, vbriefDir) {
@@ -53,7 +54,14 @@ function rewriteParentChildReference(parentPath, oldChildResolved, newChildRel,
     }
     if (changed) {
         try {
-            writeFileSync(parentPath, formatBriefJson(parentData), "utf8");
+            // #2980 wave D: product write sink routes through containedWrite.
+            const dir = dirname(parentPath);
+            containedWrite({
+                root: resolve(dir),
+                target: parentPath,
+                data: formatBriefJson(parentData),
+                mode: "replace",
+            });
         }
         catch {
             return false;
@@ -127,7 +135,14 @@ function rewriteChildParentReference(childPath, oldParentResolved, newParentRel,
     }
     if (changed) {
         try {
-            writeFileSync(childPath, formatBriefJson(childData), "utf8");
+            // #2980 wave D: product write sink routes through containedWrite.
+            const dir = dirname(childPath);
+            containedWrite({
+                root: resolve(dir),
+                target: childPath,
+                data: formatBriefJson(childData),
+                mode: "replace",
+            });
         }
         catch {
             return false;

package/dist/scope/demote.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleFolder } from "../layout/resolve.js";
 import { stripTrailingPathSeparators } from "../text/redos-safe.js";
@@ -85,7 +86,13 @@ export function demoteOne(filePath, projectRoot, reason, options = {}) {
     const timestamp = utcNowIso(now);
     planObj.status = TARGET_STATUS;
     planObj.updated = timestamp;
-    writeFileSync(resolved, formatBriefJson(data), "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    containedWrite({
+        root: resolve(projectRoot),
+        target: resolved,
+        data: formatBriefJson(data),
+        mode: "replace",
+    });
     const vbriefRoot = dirname(dirname(resolved));
     const targetDir = join(vbriefRoot, TARGET_FOLDER);
     mkdirSync(targetDir, { recursive: true });

package/dist/scope/undo.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync } from "node:fs";
 import { basename, join, relative, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { append, canonicalLogPath, newDecisionId, readAll } from "./audit-log.js";
@@ -185,7 +186,13 @@ function moveAndFlip(srcFile, destFolder, newStatus, timestamp, projectRoot) {
     const planObj = plan;
     planObj.status = newStatus;
     planObj.updated = timestamp;
-    writeFileSync(srcFile, formatBriefJson(data), "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    containedWrite({
+        root: resolve(projectRoot),
+        target: srcFile,
+        data: formatBriefJson(data),
+        mode: "replace",
+    });
     mkdirSync(destFolder, { recursive: true });
     const destPath = join(destFolder, basename(srcFile));
     renameSync(srcFile, destPath);

package/dist/session/index.d.ts

@@ -1,8 +1,10 @@
 export * from "./git.js";
 export * from "./json.js";
 export * from "./posture.js";
+export * from "./process-cost.js";
 export * from "./resume-conditions.js";
 export * from "./ritual-sentinel.js";
+export * from "./session-ready.js";
 export * from "./session-start.js";
 export * from "./session-start-hook.js";
 export * from "./time.js";

package/dist/session/index.js

@@ -1,8 +1,10 @@
 export * from "./git.js";
 export * from "./json.js";
 export * from "./posture.js";
+export * from "./process-cost.js";
 export * from "./resume-conditions.js";
 export * from "./ritual-sentinel.js";
+export * from "./session-ready.js";
 export * from "./session-start.js";
 export * from "./session-start-hook.js";
 export * from "./time.js";

package/dist/session/process-cost-constants.d.ts

@@ -0,0 +1,9 @@
+/** Canonical process-cost event names for ceremony observability (#2994). */
+export declare const PROCESS_COST_EVENT_NAMES: {
+    readonly sessionStart: "session:start";
+    readonly sessionRitualBlocked: "session:ritual-blocked";
+};
+export type ProcessCostEventName = (typeof PROCESS_COST_EVENT_NAMES)[keyof typeof PROCESS_COST_EVENT_NAMES];
+/** Required payload keys per process-cost event (merged into lifecycle/events). */
+export declare const PROCESS_COST_REQUIRED_PAYLOAD: Readonly<Record<string, readonly string[]>>;
+//# sourceMappingURL=process-cost-constants.d.ts.map

package/dist/session/process-cost-constants.js

@@ -0,0 +1,11 @@
+/** Canonical process-cost event names for ceremony observability (#2994). */
+export const PROCESS_COST_EVENT_NAMES = {
+    sessionStart: "session:start",
+    sessionRitualBlocked: "session:ritual-blocked",
+};
+/** Required payload keys per process-cost event (merged into lifecycle/events). */
+export const PROCESS_COST_REQUIRED_PAYLOAD = {
+    [PROCESS_COST_EVENT_NAMES.sessionStart]: ["ceremony_tier", "duration_ms", "exit_code"],
+    [PROCESS_COST_EVENT_NAMES.sessionRitualBlocked]: ["tool_name", "code"],
+};
+//# sourceMappingURL=process-cost-constants.js.map

package/dist/session/process-cost.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Local process-cost ceremony events (#2994).
+ *
+ * Always-on, best-effort appends to `.deft-cache/events.jsonl`.
+ * Not gated on valueFeedback (distinct from #1709 attribution).
+ * No remote / Product Insights upload (#2603 not required).
+ *
+ * Types are declared locally (not imported from session-start) so this module
+ * does not form an import cycle with session-start call sites.
+ */
+import { type BehavioralEventRecord } from "../lifecycle/events.js";
+export { PROCESS_COST_EVENT_NAMES, PROCESS_COST_REQUIRED_PAYLOAD, type ProcessCostEventName, } from "./process-cost-constants.js";
+/** Ceremony tier labels mirror session-start cold|rearm (#2992 / #2994). */
+export type ProcessCostCeremonyTier = "cold" | "rearm";
+export interface ProcessCostStepTiming {
+    readonly name: string;
+    readonly duration_ms: number;
+    readonly skipped?: boolean;
+}
+export interface EmitProcessCostOptions {
+    readonly projectRoot: string;
+    /**
+     * Optional explicit log path for tests.
+     * When omitted, `emit` resolves via DEFT_EVENT_LOG then `.deft-cache/events.jsonl`
+     * (must not pre-resolve the default here or DEFT_EVENT_LOG is bypassed).
+     */
+    readonly logPath?: string | null;
+}
+export interface SessionStartProcessCostInput {
+    readonly ceremonyTier: ProcessCostCeremonyTier;
+    readonly durationMs: number;
+    readonly exitCode: number;
+    readonly ready?: boolean;
+    readonly optionalNetwork?: boolean;
+    readonly steps?: readonly ProcessCostStepTiming[];
+}
+export interface SessionRitualBlockedProcessCostInput {
+    readonly toolName: string;
+    readonly code?: string;
+    readonly recoveryTier?: "cold" | "rearm";
+    readonly detail?: string;
+}
+/**
+ * Emit `session:start` after cold/re-arm ceremony completes (or fails early).
+ * Returns null on any failure (telemetry must not interrupt session:start).
+ */
+export declare function emitSessionStartProcessCost(input: SessionStartProcessCostInput, options: EmitProcessCostOptions): BehavioralEventRecord | null;
+/**
+ * Emit `session:ritual-blocked` on PreToolUse ritual-not-ready deny.
+ * Returns null on any failure (telemetry must not change deny verdict).
+ */
+export declare function emitSessionRitualBlockedProcessCost(input: SessionRitualBlockedProcessCostInput, options: EmitProcessCostOptions): BehavioralEventRecord | null;
+//# sourceMappingURL=process-cost.d.ts.map

package/dist/session/process-cost.js

@@ -0,0 +1,82 @@
+/**
+ * Local process-cost ceremony events (#2994).
+ *
+ * Always-on, best-effort appends to `.deft-cache/events.jsonl`.
+ * Not gated on valueFeedback (distinct from #1709 attribution).
+ * No remote / Product Insights upload (#2603 not required).
+ *
+ * Types are declared locally (not imported from session-start) so this module
+ * does not form an import cycle with session-start call sites.
+ */
+import { emit } from "../lifecycle/events.js";
+import { PROCESS_COST_EVENT_NAMES } from "./process-cost-constants.js";
+export { PROCESS_COST_EVENT_NAMES, PROCESS_COST_REQUIRED_PAYLOAD, } from "./process-cost-constants.js";
+/**
+ * Emit `session:start` after cold/re-arm ceremony completes (or fails early).
+ * Returns null on any failure (telemetry must not interrupt session:start).
+ */
+export function emitSessionStartProcessCost(input, options) {
+    try {
+        const payload = {
+            ceremony_tier: input.ceremonyTier,
+            duration_ms: input.durationMs,
+            exit_code: input.exitCode,
+        };
+        if (input.ready !== undefined) {
+            payload.ready = input.ready;
+        }
+        if (input.optionalNetwork !== undefined) {
+            payload.optional_network = input.optionalNetwork;
+        }
+        if (input.steps !== undefined) {
+            payload.steps = input.steps.map((step) => {
+                const entry = {
+                    name: step.name,
+                    duration_ms: step.duration_ms,
+                };
+                if (step.skipped === true) {
+                    entry.skipped = true;
+                }
+                return entry;
+            });
+        }
+        // Pass logPath only when caller overrides; otherwise emit honors DEFT_EVENT_LOG.
+        const emitOptions = { projectRoot: options.projectRoot };
+        if (options.logPath !== undefined) {
+            emitOptions.logPath = options.logPath;
+        }
+        return emit(PROCESS_COST_EVENT_NAMES.sessionStart, payload, emitOptions);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Emit `session:ritual-blocked` on PreToolUse ritual-not-ready deny.
+ * Returns null on any failure (telemetry must not change deny verdict).
+ */
+export function emitSessionRitualBlockedProcessCost(input, options) {
+    try {
+        const payload = {
+            tool_name: input.toolName,
+            code: input.code ?? "ritual-not-ready",
+        };
+        if (input.recoveryTier !== undefined) {
+            payload.recovery_tier = input.recoveryTier;
+        }
+        if (input.detail !== undefined && input.detail.length > 0) {
+            // Cap free-form detail so JSONL lines stay bounded.
+            payload.detail =
+                input.detail.length > 240 ? `${input.detail.slice(0, 237)}...` : input.detail;
+        }
+        const emitOptions = { projectRoot: options.projectRoot };
+        if (options.logPath !== undefined) {
+            emitOptions.logPath = options.logPath;
+        }
+        return emit(PROCESS_COST_EVENT_NAMES.sessionRitualBlocked, payload, emitOptions);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=process-cost.js.map

package/dist/session/release-availability.js

@@ -1,9 +1,10 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
 import { locateManifest, parseInstallManifest } from "../doctor/manifest.js";
 import { runningInsideDeftRepo } from "../doctor/paths.js";
 import { evaluateReleaseAvailability } from "../doctor/release-availability.js";
+import { containedWrite } from "../fs/contained-write.js";
 import { resolveTriageCachePath } from "../triage/cache-path.js";
 const THROTTLE_MS = 24 * 60 * 60 * 1000;
 const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
@@ -56,10 +57,29 @@ function isThrottled(state, latestVersion, now) {
     return Number.isFinite(notifiedAt) && now.getTime() - notifiedAt < THROTTLE_MS;
 }
 function defaultWriteState(path, content) {
-    mkdirSync(dirname(path), { recursive: true });
-    const temporary = `${path}.${process.pid}.tmp`;
-    writeFileSync(temporary, content, "utf8");
-    renameSync(temporary, path);
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true });
+    const tmpBase = `${basename(path)}.${process.pid}.tmp`;
+    const temporary = join(dir, tmpBase);
+    try {
+        // #2980 wave D: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(dir),
+            target: tmpBase,
+            data: content,
+            mode: "create",
+        });
+        renameSync(temporary, path);
+    }
+    catch (err) {
+        try {
+            rmSync(temporary, { force: true });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+        throw err;
+    }
 }
 /**
  * Probe the public npm registry separately from doctor. Doctor stays offline

package/dist/session/ritual-sentinel.d.ts

@@ -30,6 +30,8 @@ export interface RitualStepInput {
     readonly exitCode?: number | null;
     readonly message?: string | null;
     readonly command?: readonly string[] | null;
+    /** Wall-clock ms for this step when measured (#2991). */
+    readonly durationMs?: number | null;
 }
 export declare function ritualStatePath(projectRoot: string): string;
 export declare function ritualStep(input: RitualStepInput): Record<string, unknown>;
@@ -53,10 +55,13 @@ export interface MarkRitualStaleAfterCompactResult {
 /**
  * Invalidate an existing mutation ritual after host context compaction/resume (#2113).
  * Reuses ritual-state age semantics — no parallel policy stack.
+ * Marks rearm_needed so recovery messaging prefers session:start --rearm when cold is unnecessary (#2992).
  */
 export declare function markRitualStaleAfterCompact(projectRoot: string, input?: {
     now?: Date;
 }): MarkRitualStaleAfterCompactResult;
+/** Whether ritual-state.json marks compact/age recovery as re-arm preferred (#2992). */
+export declare function ritualStateMarksRearmNeeded(state: RitualState): boolean;
 export declare function recordRitualStep(projectRoot: string, input: {
     tier: "quick" | "gated";
     stepName: string;

package/dist/session/ritual-sentinel.js

@@ -1,5 +1,6 @@
-import { closeSync, existsSync, fdatasyncSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, writeSync, } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, } from "node:fs";
 import { join, relative, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { hasArtifactSuffix, LEGACY_ARTIFACT_DIR, MIGRATED_ARTIFACT_DIR, } from "../layout/resolve.js";
 import { stableJson } from "./json.js";
 import { RITUAL_STATE_CONTRACT } from "./posture.js";
@@ -34,6 +35,9 @@ export function ritualStep(input) {
     if (input.command && input.command.length > 0) {
         payload.command = input.command.map(String);
     }
+    if (input.durationMs !== null && input.durationMs !== undefined) {
+        payload.duration_ms = Math.max(0, Math.round(input.durationMs));
+    }
     return payload;
 }
 export function newRitualStatePayload(input) {
@@ -92,24 +96,30 @@ function validateSteps(raw, key) {
     return [steps, null];
 }
 function atomicWriteJson(targetPath, payload, prefix) {
-    mkdirSync(join(targetPath, ".."), { recursive: true });
     const dir = join(targetPath, "..");
-    const tmpName = join(dir, `${prefix}${process.pid}.json.tmp`);
-    const fd = openSync(tmpName, "w");
+    mkdirSync(dir, { recursive: true });
+    const tmpBase = `${prefix}${process.pid}.json.tmp`;
+    const tmpName = join(dir, tmpBase);
+    const text = `${stableJson(payload, 2)}\n`;
     try {
-        const text = `${stableJson(payload, 2)}\n`;
-        writeSync(fd, text, undefined, "utf8");
+        // #2980 wave D: ritual-state product write routes through containedWrite.
+        containedWrite({
+            root: resolve(dir),
+            target: tmpBase,
+            data: text,
+            mode: "create",
+        });
+        renameSync(tmpName, targetPath);
+    }
+    catch (err) {
         try {
-            fdatasyncSync(fd);
+            rmSync(tmpName, { force: true });
         }
         catch {
-            // best-effort
+            /* best-effort cleanup */
         }
+        throw err;
     }
-    finally {
-        closeSync(fd);
-    }
-    renameSync(tmpName, targetPath);
 }
 export function readRitualState(projectRoot) {
     const stateFile = ritualStatePath(projectRoot);
@@ -189,6 +199,7 @@ export const RITUAL_STALE_EPOCH = new Date("1970-01-01T00:00:00Z");
 /**
  * Invalidate an existing mutation ritual after host context compaction/resume (#2113).
  * Reuses ritual-state age semantics — no parallel policy stack.
+ * Marks rearm_needed so recovery messaging prefers session:start --rearm when cold is unnecessary (#2992).
  */
 export function markRitualStaleAfterCompact(projectRoot, input = {}) {
     const now = input.now ?? new Date();
@@ -204,14 +215,21 @@ export function markRitualStaleAfterCompact(projectRoot, input = {}) {
     const payload = { ...state.raw };
     payload.started_at = timestampIso(RITUAL_STALE_EPOCH);
     payload.compact_resume_at = timestampIso(now);
+    // #2992: compact invalidates the ritual clock only — prefer re-arm recovery when worktree/HEAD allow.
+    payload.rearm_needed = true;
     writeRitualState(projectRoot, payload);
     return {
         changed: true,
         statePath,
-        message: "Marked session ritual stale after context compaction; run session:start and " +
+        message: "Marked session ritual re-arm needed after context compaction; run " +
+            "session:start --rearm (or full session:start if worktree/HEAD changed) and " +
             "verify:session-ritual -- --tier=gated before direct writes.",
     };
 }
+/** Whether ritual-state.json marks compact/age recovery as re-arm preferred (#2992). */
+export function ritualStateMarksRearmNeeded(state) {
+    return state.raw.rearm_needed === true || typeof state.raw.compact_resume_at === "string";
+}
 export function recordRitualStep(projectRoot, input) {
     const [state, err] = readRitualState(projectRoot);
     if (state === null) {