@dzhechkov/harness-core 0.7.3 → 0.7.5

package/src/publish.ts

@@ -89,6 +89,68 @@ function maxPublished(name: string, localVersion: string): string {
   return pub !== undefined && compareVersions(pub, localVersion) > 0 ? pub : localVersion;
 }
 
+// ── workspace-floor preflight (feature workspace-dep-protocol, Codex P1) ─────
+//
+// Sibling deps are declared `workspace:^`, and pnpm rewrites them at pack time to `^<the sibling's
+// DISK version>`. That version is not necessarily PUBLISHED: `--bump-only` stages versions on disk,
+// and a later `--filter`ed publish of just the dependent would ship a floor nobody can install —
+// the publish itself succeeds, and every consumer `npm install` then fails with ETARGET. Staged is
+// not shipped; this preflight makes the difference a refusal instead of a broken release.
+
+/**
+ * Pure half: which `workspace:`-declared deps of a package would pack to a floor that is neither
+ * being published in this batch nor already on the registry?
+ *
+ * Fail-closed by design: a probe that cannot answer (offline, 404) reports the floor as
+ * unpublished — a publish needs the network anyway, and refusing beats shipping ETARGET.
+ */
+export function findUnpublishedWorkspaceFloors(opts: {
+  readonly dependencies: Record<string, string> | undefined;
+  /** pnpm rewrites `workspace:` in peerDependencies at pack time too (Codex P2) — same hazard. */
+  readonly peerDependencies?: Record<string, string> | undefined;
+  /** name → version on DISK, for every package in the workspace (what pnpm packs the floor from). */
+  readonly workspaceVersions: ReadonlyMap<string, string>;
+  /**
+   * Names whose publish has LANDED (or, in a dry-run preview, would land) BEFORE this package.
+   * Static batch membership is not enough (Codex P1): a sibling that failed its own gates earlier
+   * in the batch has no published floor, and its dependents must fall through to the probe.
+   */
+  readonly batch: ReadonlySet<string>;
+  readonly probe: (name: string, version: string) => boolean;
+}): { name: string; version: string }[] {
+  const missing: { name: string; version: string }[] = [];
+  const seen = new Set<string>();
+  // Sections are inspected INDEPENDENTLY, never object-merged: a plain peer range for the same
+  // sibling would overwrite a `workspace:^` dependency entry in a spread, and pnpm still rewrites
+  // the dependency section — the protocol in EITHER section makes the floor pack from disk.
+  const entries = [...Object.entries(opts.dependencies ?? {}), ...Object.entries(opts.peerDependencies ?? {})];
+  for (const [dep, spec] of entries) {
+    if (!String(spec).startsWith('workspace:')) continue;
+    if (seen.has(dep)) continue;
+    seen.add(dep);
+    if (opts.batch.has(dep)) continue; // publishes before this package (deps-first order)
+    const version = opts.workspaceVersions.get(dep);
+    if (version === undefined) {
+      // A workspace: spec naming a package that is not in the workspace — pnpm pack would die on
+      // it anyway, but die HERE with a name, not mid-batch.
+      missing.push({ name: dep, version: '(not in workspace)' });
+      continue;
+    }
+    if (!opts.probe(dep, version)) missing.push({ name: dep, version });
+  }
+  return missing;
+}
+
+/** Registry probe: is exactly `name@version` published? Empty output / 404 / offline ⇒ no. */
+function versionPublished(name: string, version: string): boolean {
+  try {
+    const out = execSync(`npm view ${name}@${version} version`, { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8', timeout: 20000 }).trim();
+    return out === version;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * `execSync` throws an Error whose `.message` is only `Command failed: <cmd>` — the child's real output
  * (the `npm ERR!` lines that say WHY a publish failed) sits on `.stdout` / `.stderr` and was being
@@ -331,6 +393,13 @@ export function publishPackages(
     claimGate?: 'off' | 'warn' | 'error' | undefined;
     /** ADR-001: `auto` (default) decides from the environment; `on` fails where it cannot work. */
     provenance?: ProvenanceMode | undefined;
+    /**
+     * Floor probe injection for the workspace-floor preflight (see
+     * `findUnpublishedWorkspaceFloors`). Default: a real `npm view` probe, which runs only on LIVE
+     * publishes — dry-run stays offline, matching `maxPublished`. Injecting a probe also arms the
+     * preflight under dry-run, which is how the wiring test drives it without network.
+     */
+    probeFloor?: ((name: string, version: string) => boolean) | undefined;
   } = {},
 ): PublishReport {
   // Decide ONCE, before the batch: `--provenance` in an incapable environment must fail here, not on
@@ -346,6 +415,15 @@ export function publishPackages(
   // freshly-bumped version, never a stale one (the harness-cli@0.3.122 breakage).
   const ordered = orderByDependencies(filtered);
 
+  // Workspace-floor preflight inputs: the full workspace version map (what pnpm would pack each
+  // floor from), and the names whose publish has LANDED so far in this run — grown as the loop
+  // proceeds, never assumed from batch membership (Codex P1: a sibling that failed its own gates
+  // has no published floor, and static membership would still have covered its dependents).
+  const workspaceVersions = new Map(packages.map((p) => [p.name, p.version]));
+  const landedInBatch = new Set<string>();
+  const armFloorPreflight = opts.bumpOnly !== true && (opts.dryRun !== true || opts.probeFloor !== undefined);
+  const probeFloor = opts.probeFloor ?? versionPublished;
+
   for (const pkg of ordered) {
     const oldVersion = pkg.version;
     // Bump from max(local, npm-published) so a locally-reverted version can't
@@ -370,6 +448,24 @@ export function publishPackages(
       continue;
     }
 
+    // Workspace-floor preflight (Codex P1, feature workspace-dep-protocol): a `workspace:^` dep
+    // packs to `^<sibling's DISK version>` — refuse if that floor is neither in this batch nor on
+    // the registry, or the publish succeeds and every consumer install dies with ETARGET.
+    if (armFloorPreflight) {
+      const manifest = JSON.parse(readFileSync(join(pkg.dir, 'package.json'), 'utf-8')) as { dependencies?: Record<string, string>; peerDependencies?: Record<string, string> };
+      const unpublishedFloors = findUnpublishedWorkspaceFloors({ dependencies: manifest.dependencies, peerDependencies: manifest.peerDependencies, workspaceVersions, batch: landedInBatch, probe: probeFloor });
+      if (unpublishedFloors.length > 0) {
+        results.push({
+          name: pkg.name,
+          oldVersion,
+          newVersion,
+          status: 'error',
+          error: `workspace floor(s) not published: ${unpublishedFloors.map((f) => `${f.name}@${f.version}`).join(', ')}. Publish the sibling(s) first or include them in --filter — a staged disk version is not a shipped one.`,
+        });
+        continue;
+      }
+    }
+
     // Pre-publish claim-check gate. Default `'warn'` per ADR-001: publishing SURFACES a
     // README's untagged claims by default, but `'warn'` NEVER changes publish status, so the
     // existing publish path is unaffected. `'error'` fails only THIS package when it carries a
@@ -405,6 +501,7 @@ export function publishPackages(
 
     if (opts.dryRun) {
       results.push({ name: pkg.name, oldVersion, newVersion, status: 'skipped', claimCheck: claimCheckSummary });
+      landedInBatch.add(pkg.name); // preview: this package passed its gates and WOULD land
       continue;
     }
 
@@ -511,6 +608,7 @@ export function publishPackages(
       });
 
       results.push({ name: pkg.name, oldVersion, newVersion, status: 'published', claimCheck: claimCheckSummary });
+      landedInBatch.add(pkg.name); // only an ACTUAL publish covers dependents (Codex P1)
     } catch (err) {
       // The version was written BEFORE build+publish; on any failure restore the
       // original package.json (and README, if we rewrote its version) so a failed

package/src/recall-hook-policy.ts

@@ -26,7 +26,9 @@
  *   where an irrelevant English one reaches 0.254. A single floor still works, with a thin 0.032
  *   margin; per-language floors triple it. Hence the defaults below.
  *
- * The turns that must stay silent do: `"спасибо"` scores 0.259, `"какой статус?"` 0.318 — both under
+ * The turns that must stay silent do (2026-07-09 numbers; re-measured 2026-08-24 — «спасибо» rose
+ * to 0.416 but is cut by the SIGNAL gate before any floor, and «какой статус?» rose to 0.386, which
+ * is what forced the recalibration above): both under
  * every floor here.
  *
  * @packageDocumentation
@@ -46,7 +48,18 @@ export interface RecallFloors {
  * slightly closer to any Latin text than two unrelated Latin texts are to each other — the baseline,
  * not the signal, is what shifts.
  */
-export const DEFAULT_RECALL_FLOORS: RecallFloors = { ru: 0.38, en: 0.31 };
+// RECALIBRATED 2026-08-24 on the LIVE 281-pattern store, end to end through `dz recall --json`
+// (the closeness feature made the true cosine visible, which is what exposed the drift): over the
+// probes that actually REACH the floor — the signal gate cuts "спасибо"/"thanks" first —
+//   ru: min(relevant)=0.409, max(irrelevant)=0.386 ("какой статус?", ABOVE the old 0.38 floor);
+//   en: min(relevant)=0.413, max(irrelevant)=0.332 (nonsense scored 0.327, above the old 0.31).
+// The 2026-07-09 floors were calibrated on 103 patterns; at 281 the irrelevant tail rose. The RU
+// window is now THIN (+0.023) — an honest limit, not a solved problem: it narrows again as the
+// store grows, and the next recalibration should follow the next major store growth.
+// en is 0.36 rather than the live midpoint 0.37 because the hermetic fixture's weakest relevant
+// probe sits at 0.369, and a floor above it would fail the calibration test that guards this file.
+// Probe set + raw results: test/fixtures/recall-floor-live-2026-08-24.json.
+export const DEFAULT_RECALL_FLOORS: RecallFloors = { ru: 0.40, en: 0.36 };
 
 /** Max hits injected into a turn. Three is the ADR default; more is noise, not context. */
 export const DEFAULT_RECALL_HOOK_LIMIT = 3;

package/src/recall-usage.ts

@@ -18,7 +18,7 @@
 // ReferenceError into `appendRecallUsage`'s own catch and returned **0 rows appended, silently**.
 // The Codex recall leg looked wired and correctly-silent for exactly the reason AM-4's forced-hit
 // canary exists to expose. Importing node: modules at the top costs nothing — they are built in.
-import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync } from 'node:fs';
+import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 import {
@@ -718,3 +718,46 @@ function readLogTailSync(file: string): LogTail {
     return EMPTY_LOG_TAIL;
   }
 }
+
+/**
+ * Recall events recorded for one run key — DISTINCT prompts, not rows.
+ *
+ * Why this exists: the /feature-adr live panel asserted `--recalled 3` as a LITERAL at three call
+ * sites, because the fallback writer that lights the panel had nowhere to get a real number. Now
+ * that `dz recall` records its own reads, the number is derivable — this is the derivation.
+ *
+ * Counted by `eventId`, not by row: one prompt that surfaced four lessons writes four rows sharing
+ * one eventId, and "recalled 4" would overstate what the operator did by a factor of hits-per-query.
+ * Rows predating eventIds (the log's schema grew) count one each — their rows WERE one-per-event.
+ *
+ * Returns null when the log cannot be read — the caller must record "unknown", never zero: an
+ * unreadable log and a run that recalled nothing are different facts (the dz sync 0/0 class).
+ */
+export function countRecallEventsForRun(projectRoot: string, runId: string): number | null {
+  const wanted = runId.trim();
+  if (wanted === '') return null;
+  const path = join(projectRoot, ...RECALL_USAGE_LOG_RELATIVE.split('/'));
+  if (!existsSync(path)) return 0;   // a real, readable absence: nothing has ever been recorded
+  let text: string;
+  try {
+    text = readFileSync(path, 'utf-8');
+  } catch {
+    return null;
+  }
+  const events = new Set<string>();
+  let preEventRows = 0;
+  for (const line of text.split('\n')) {
+    if (line.trim() === '') continue;
+    let row: Record<string, unknown>;
+    try {
+      row = JSON.parse(line) as Record<string, unknown>;
+    } catch {
+      continue;   // a torn row is the chain verifier's business, not a reason to fail the count
+    }
+    if (row['runId'] !== wanted) continue;
+    const ev = row['eventId'];
+    if (typeof ev === 'string' && ev !== '') events.add(ev);
+    else preEventRows += 1;
+  }
+  return events.size + preEventRows;
+}

package/src/score.ts

@@ -76,7 +76,12 @@ const NEGATION_RE = /\b(no|not|never|without|wasn'?t|isn'?t)\b/i;
  * `\bno\b` does NOT match "Nothing". Hedges like "skipped" stay out of both lists — they routinely
  * appear inside genuine evidence lines.
  */
-const NEGATION_QUANTIFIED_RE = /\b(no|not|never|without|nothing|none|neither|nor|nobody|wasn'?t|isn'?t)\b/i;
+// RU negation quantifiers joined 2026-08-24 with the RU live-markers (773185ca): a corpus where
+// 63% of traffic is Russian was screened by an English-only list — «ничего не измерено» would have
+// read as a live marker the moment ИЗМЕРЕНО joined the positives.
+// \b is ASCII-only in JS even under /u — «не» never matched through it (measured by the pin the
+// moment it was written). Unicode lookarounds carry the boundary instead.
+const NEGATION_QUANTIFIED_RE = /\b(no|not|never|without|nothing|none|neither|nor|nobody|wasn'?t|isn'?t)\b|(?<![\p{L}\p{N}])(не|нет|ни одного|ничего|никогда|без)(?![\p{L}\p{N}])/iu;
 
 function evidenceLinePositive(text: string, re: RegExp, negationRe: RegExp = NEGATION_RE): string | null {
   for (const line of text.split('\n')) {
@@ -137,7 +142,25 @@ export interface GradeReading {
  */
 export function readQeGrade(qeText: string): GradeReading {
   const found: string[] = [];
+  const lines = qeText.split('\n');
+  // Line offsets once, so each match maps to ITS line for the negation screen (67d7883d: the
+  // parser was negation-blind — «No Grade: B was assigned» contributed B and a cross-model PASS;
+  // the display-locator fix could not reach this because the GRADE rests here). The same
+  // deliberate trade as evidenceLinePositive: a genuine grade on a line that happens to carry a
+  // negation is SKIPPED (visible in `found`'s absence) rather than a negated line being COUNTED.
+  const lineStarts: number[] = [0];
+  for (let i = 0; i < lines.length - 1; i++) lineStarts.push((lineStarts[i] as number) + (lines[i] as string).length + 1);
+  // The screen covers the line PREFIX up to the match, not the whole line: «No Grade: B was
+  // assigned» negates BEFORE the grade; «**Grade: B** — no blockers remain» carries its negation
+  // AFTER, about something else entirely, and whole-line screening dropped that real, common
+  // phrase (caught by the standing display-locator pin the moment the sweep was «completed»).
+  const linePrefixOf = (idx: number): string => {
+    let lo = 0, hi = lineStarts.length - 1;
+    while (lo < hi) { const mid = (lo + hi + 1) >> 1; if ((lineStarts[mid] as number) <= idx) lo = mid; else hi = mid - 1; }
+    return qeText.slice(lineStarts[lo] as number, idx);
+  };
   for (const m of qeText.matchAll(new RegExp(GRADE_RE.source, 'g'))) {
+    if (NEGATION_QUANTIFIED_RE.test(linePrefixOf(m.index ?? 0))) continue;
     const g = normaliseGradeSign(m[1] as string);
     if (!found.includes(g)) found.push(g);
   }
@@ -226,14 +249,17 @@ export function scoreRun(slug: string, artifacts: RunArtifacts): RunScorecard {
   //    report is the cautionary case: "✅ (mechanism)" with no live evidence shipped a dead feature.
   //    POSITIVE (wave1-scorer-negation): "nothing was MEASURED" / "no reproducer was run" is the
   //    claim's exact opposite and used to score as proof of it (the crossrt-1 6/7 shape).
-  const live = evidenceLinePositive(qeText, /MEASURED|verified live|VERIFIED LIVE|reproducer/i, NEGATION_QUANTIFIED_RE);
+  // 773185ca: MEASURED-class markers in BOTH working languages. dz-recap carried 10× ИЗМЕРЕНО and
+  // 0× MEASURED and scored «всё выведено рассуждением» — the cyrillic-tokenizer class again.
+  const LIVE_MARKER_RE = /MEASURED|verified live|VERIFIED LIVE|reproducer|ИЗМЕРЕНО|МЕРЕНО|измерено|проверено живьём|живой прогон|репродьюсер/iu;
+  const live = evidenceLinePositive(qeText, LIVE_MARKER_RE, NEGATION_QUANTIFIED_RE);
   const liveAnywhere =
-    live ?? evidenceLinePositive(allText, /MEASURED|verified live|VERIFIED LIVE|reproducer/i, NEGATION_QUANTIFIED_RE);
+    live ?? evidenceLinePositive(allText, LIVE_MARKER_RE, NEGATION_QUANTIFIED_RE);
   add(
     'live-verification',
     'claims verified by running, not by reasoning',
     live !== null ? 'pass' : liveAnywhere !== null ? 'partial' : 'absent',
-    live ?? liveAnywhere ?? 'no MEASURED / verified-live / reproducer marker anywhere — every claim is inferred',
+    live ?? liveAnywhere ?? 'no MEASURED/ИЗМЕРЕНО/verified-live/reproducer marker anywhere — every claim is inferred',
   );
 
   // 5. README-first — the docs travelled in the same change.

package/src/tg-post.ts

@@ -0,0 +1,137 @@
+/**
+ * `dz tg-post` — the pure half: validate an approved draft against what Telegram will accept and
+ * what the channel's own accepted design demands.
+ *
+ * The design is NOT this module's to invent. features/genai-tweets-channel/ carries four ACCEPTED
+ * ADRs (2026-08-04): HTML mode, never MarkdownV2 (18 escapes against 3, one miss is a 400); the
+ * cadence rule "no posts 00:00-06:00 MSK"; link previews off by default because x.com previews in
+ * Telegram have been broken since 2022; and ADR-004's standing order — publishing stays MANUAL, and
+ * autonomous publishing means REVISING the ADR, not flipping a quiet flag. This module only makes
+ * those decisions checkable.
+ *
+ * PURE: no filesystem, no network, no clock — the timestamp arrives as a parameter, or the MSK
+ * night-window rule could not be tested at all.
+ */
+
+/** Tags Bot API accepts in HTML mode (verified against the live docs, Bot API 10.2). */
+export const TG_ALLOWED_TAGS: readonly string[] = [
+  'b', 'strong', 'i', 'em', 'u', 'ins', 's', 'strike', 'del', 'tg-spoiler',
+  'a', 'tg-emoji', 'code', 'pre', 'blockquote',
+];
+
+/** Hard ceiling for `sendMessage.text`, characters after entity parsing. */
+export const TG_TEXT_LIMIT = 4096;
+
+export interface TgHtmlIssue {
+  readonly kind: 'unknown-tag' | 'unclosed-tag' | 'stray-close' | 'bare-ampersand' | 'bare-angle' | 'over-limit' | 'empty';
+  readonly detail: string;
+}
+
+/**
+ * The character count Telegram limits: text WITHOUT the markup. An approximation is stated as one —
+ * entities like tg-emoji count differently — but a draft within this bound by a margin is safe, and
+ * the render prints the number so the author sees the headroom, not a verdict.
+ */
+export function tgVisibleLength(html: string): number {
+  return html.replace(/<[^>]*>/g, '').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&').length;
+}
+
+/**
+ * Everything wrong with a draft, or an empty list. One pass, every finding named — a validator that
+ * stops at the first fault sends the author around the loop once per mistake.
+ */
+export function tgPostHtmlIssues(html: string): TgHtmlIssue[] {
+  const issues: TgHtmlIssue[] = [];
+  const text = html.trim();
+  if (text === '') return [{ kind: 'empty', detail: 'the draft is empty — nothing to send' }];
+
+  // Tag balance over the allowed set. Telegram closes nothing for you: an unclosed <b> is a 400.
+  const stack: string[] = [];
+  const tagRe = /<(\/?)([a-zA-Z-]+)((?:\s+[a-zA-Z-]+(?:="[^"]*")?)*)\s*(\/?)>/g;
+  let covered = 0;
+  for (let m = tagRe.exec(text); m !== null; m = tagRe.exec(text)) {
+    covered += 1;
+    const closing = m[1] === '/';
+    const name = (m[2] as string).toLowerCase();
+    const expandable = name === 'blockquote';   // `<blockquote expandable>` is the ADR-003 body form
+    if (!TG_ALLOWED_TAGS.includes(name) && !expandable) {
+      issues.push({ kind: 'unknown-tag', detail: `<${name}> is not a Bot API HTML tag — Telegram answers 400 to tags it does not know` });
+      continue;
+    }
+    if (closing) {
+      if (stack.length === 0 || stack[stack.length - 1] !== name) {
+        issues.push({ kind: 'stray-close', detail: `</${name}> closes nothing that is open — tags must nest, not interleave` });
+      } else {
+        stack.pop();
+      }
+    } else if (m[4] !== '/') {
+      stack.push(name);
+    }
+  }
+  for (const open of stack) {
+    issues.push({ kind: 'unclosed-tag', detail: `<${open}> is never closed — Telegram closes nothing for you, this is a 400` });
+  }
+
+  // Bare & and < outside tags: HTML mode requires entity-escaping exactly these.
+  const outside = text.replace(/<[^>]*>/g, '');
+  if (/&(?!(lt|gt|amp|quot|#\d+|#x[0-9a-fA-F]+);)/.test(outside)) {
+    issues.push({ kind: 'bare-ampersand', detail: 'a bare & outside an entity — HTML mode needs &amp;' });
+  }
+  if (/</.test(outside.replace(/&lt;/g, ''))) {
+    issues.push({ kind: 'bare-angle', detail: 'a bare < that is not a known tag — Telegram reads it as markup and answers 400' });
+  }
+
+  const visible = tgVisibleLength(text);
+  if (visible > TG_TEXT_LIMIT) {
+    issues.push({ kind: 'over-limit', detail: `${visible} visible characters against the ${TG_TEXT_LIMIT} hard limit — cut ${visible - TG_TEXT_LIMIT}` });
+  }
+  void covered;
+  return issues;
+}
+
+export interface TgSendDecision {
+  readonly action: 'send' | 'refuse';
+  readonly reason: string;
+}
+
+/**
+ * May this draft go out NOW?
+ *
+ * The night window is ADR-003's cadence rule, encoded as a refusal with an explicit override rather
+ * than as advice: 00:00-06:00 MSK is when the channel's audience is asleep and its author is too —
+ * a send landing then is far more often a timezone mistake than an intention. `--night` states the
+ * intention; without it the refusal names the local MSK time it computed, so the operator can check
+ * the arithmetic instead of trusting it.
+ */
+export function decideTgSend(input: {
+  readonly issues: readonly TgHtmlIssue[];
+  readonly provenanceOutcome: 'allowed' | 'blocked' | 'not-established' | 'skipped';
+  readonly confirmed: boolean;
+  readonly nowUtcIso: string;
+  readonly nightOverride: boolean;
+}): TgSendDecision {
+  if (input.issues.length > 0) {
+    return { action: 'refuse', reason: `${input.issues.length} formatting issue(s) — Telegram would refuse or mangle this draft` };
+  }
+  // The provenance gate is not optional and "skipped" is not a pass: ADR-002 of the provenance
+  // feature — nothing leaves this machine citing a source that may not.
+  if (input.provenanceOutcome !== 'allowed') {
+    return {
+      action: 'refuse',
+      reason: input.provenanceOutcome === 'skipped'
+        ? 'no provenance manifest was checked — an unchecked draft is not an approved draft'
+        : `the provenance gate said ${input.provenanceOutcome} — nothing goes out citing a source that may not leave this machine`,
+    };
+  }
+  if (!input.confirmed) {
+    return { action: 'refuse', reason: 'publishing is MANUAL by the channel\'s own ADR-004 — pass --send --yes to state the decision out loud' };
+  }
+  const utc = Date.parse(input.nowUtcIso);
+  if (Number.isFinite(utc)) {
+    const mskHour = new Date(utc + 3 * 3600_000).getUTCHours();
+    if (mskHour < 6 && !input.nightOverride) {
+      return { action: 'refuse', reason: `it is ${String(mskHour).padStart(2, '0')}:xx MSK — the channel posts nothing between 00:00 and 06:00 MSK (ADR-003). Pass --night if this is deliberate` };
+    }
+  }
+  return { action: 'send', reason: 'formatted, provenance-cleared, confirmed, and inside posting hours' };
+}

package/src/usage.ts

@@ -146,6 +146,11 @@ export interface UsageLimits {
   readonly sessionBlockHours?: number;
   readonly calibratedAt?: string;
   readonly source?: string;
+  /** Routing must not read the estimated pcts (ADR-001 usage-honesty, FR-3). Legacy
+   *  `_disabledReason` free-text also reads as true — the note WAS the switch, now it is data. */
+  readonly routingDisabled?: boolean;
+  /** Account identity captured at calibration time (FR-4); a login change stales the calibration. */
+  readonly calibrationAccount?: string | null;
 }
 
 export interface UsageModelEstimate {
@@ -178,6 +183,21 @@ export interface UsageEstimate {
   /** Traceability for tests and calibration diagnostics. */
   readonly sessionStartedAt: string | null;
   readonly weeklyStartedAt: string | null;
+  /**
+   * Why the routed pcts are null (ADR-001 usage-honesty): empty ⇔ the numbers are established.
+   * `scan-empty` — recent transcripts exist yet the scan extracted nothing (instrument failure);
+   * `window-miss:*` — samples exist but the configured window filtered them all (misaligned
+   * anchor); `routing-disabled` — config says the estimates must not steer; `calibration-stale` —
+   * the account changed since calibration. A zero pct is legitimate ONLY on a machine with no
+   * recent transcripts at all.
+   */
+  readonly notEstablished: readonly UsageNotEstablishedReason[];
+  /**
+   * The raw estimates when the routed pcts are nulled by `routing-disabled`/`calibration-stale` —
+   * for HUMAN eyes (recalled lesson: an estimated pct must never drive routing until its window is
+   * verified against the provider). Absent when the top-level pcts already carry the numbers.
+   */
+  readonly estimatesNotForRouting?: { readonly sessionPct: number | null; readonly weeklyPct: number | null };
 }
 
 export interface UsageCalibrationInput {
@@ -211,6 +231,8 @@ interface MutableUsageLimits {
   sessionBlockHours?: number;
   calibratedAt?: string;
   source?: string;
+  routingDisabled?: boolean;
+  calibrationAccount?: string | null;
 }
 
 const WEEKDAY_TO_DAY: Record<string, number> = {
@@ -337,10 +359,59 @@ export function normalizeClaudeUsageModelKey(raw: unknown): ClaudeUsageModel | n
   return (CLAUDE_USAGE_MODELS as readonly string[]).includes(key) ? (key as ClaudeUsageModel) : null;
 }
 
+/** Recursive .jsonl collector under a subagents tree — bounded depth, lstat-guarded. */
+function walkTranscriptTree(dir: string, depthLeft: number, out: Array<{ path: string; mtimeMs: number }>): void {
+  if (depthLeft <= 0) return;
+  let entries: string[];
+  try {
+    if (!lstatSync(dir).isDirectory()) return; // symlinked dir ⇒ not walked
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    const p = join(dir, e);
+    if (e.endsWith('.jsonl')) {
+      const m = regularFileMtime(p);
+      if (m !== null) out.push({ path: p, mtimeMs: m });
+    } else {
+      walkTranscriptTree(p, depthLeft - 1, out);
+    }
+  }
+}
+
 /**
  * The `~/.claude/projects` root (the account-wide transcript store). Overridable via
  * `DZ_CLAUDE_PROJECTS_ROOT` — used by tests to point at a temp tree. Never throws.
  */
+/**
+ * The logged-in account identity, from `~/.claude.json` (oauthAccount email or uuid). Honest null
+ * when unreadable/absent — and null==null is NOT an account change (machines that never expose it
+ * keep the pre-FR-4 behavior). Never throws.
+ */
+export function readClaudeAccountId(): string | null {
+  try {
+    const raw = JSON.parse(readFileSync(join(homedir(), '.claude.json'), 'utf-8')) as {
+      oauthAccount?: { emailAddress?: unknown; accountUuid?: unknown };
+    };
+    const email = raw.oauthAccount?.emailAddress;
+    if (typeof email === 'string' && email !== '') return email;
+    const uuid = raw.oauthAccount?.accountUuid;
+    if (typeof uuid === 'string' && uuid !== '') return uuid;
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/** Closed set of not-established reasons (ADR-001). */
+export type UsageNotEstablishedReason =
+  | 'scan-empty'
+  | 'window-miss:weekly'
+  | 'routing-disabled'
+  | 'calibration-stale:account-changed'
+  | 'calibration-stale:account-unverifiable';
+
 export function claudeProjectsRoot(): string {
   const override = process.env['DZ_CLAUDE_PROJECTS_ROOT'];
   if (typeof override === 'string' && override.length > 0) return override;
@@ -387,6 +458,12 @@ export function readUsageLimits(projectRoot: string): UsageLimits {
 
     if (typeof u['calibratedAt'] === 'string') out.calibratedAt = u['calibratedAt'];
     if (typeof u['source'] === 'string') out.source = u['source'];
+    // routingDisabled: the boolean is authoritative; the legacy free-text note counts as true so
+    // the fleet's existing config disables TODAY, without an edit.
+    if (u['routingDisabled'] === true || typeof u['_disabledReason'] === 'string') out.routingDisabled = true;
+    if (typeof u['calibrationAccount'] === 'string' || u['calibrationAccount'] === null) {
+      out.calibrationAccount = u['calibrationAccount'] as string | null;
+    }
     return out;
   } catch {
     return {};
@@ -440,22 +517,15 @@ function listTranscriptFiles(root: string): Array<{ path: string; mtimeMs: numbe
       continue;
     }
     for (const f of files) {
-      // A session's SUBAGENT transcripts live one level deeper — `<session>/subagents/*.jsonl` — and
-      // carry real, non-duplicated usage that was silently excluded (MEASURED: 27 such files on this
-      // machine). Their tokens are spent exactly like the main loop's.
+      // A session's SUBAGENT transcripts live under `<session>/subagents/` and carry real,
+      // non-duplicated usage that was silently excluded (MEASURED: 27 such files in the first
+      // round). The walk is RECURSIVE with a depth cap: workflow agents write to
+      // `subagents/workflows/wf_*/agent-*.jsonl` — one level deeper than the first fix reached —
+      // and that blind spot alone hid 283.62M weighted tokens across 551 files (MEASURED
+      // 2026-08-24, 7-day window, this machine). Depth 4 covers today's deepest layout plus one
+      // future level; lstat at EVERY step keeps symlinked directories unwalked.
       if (!f.endsWith('.jsonl')) {
-        const nested = join(projDir, f, 'subagents');
-        try {
-          if (!lstatSync(nested).isDirectory()) continue; // no symlinked session/subagent dirs
-          for (const sf of readdirSync(nested)) {
-            if (!sf.endsWith('.jsonl')) continue;
-            const sp = join(nested, sf);
-            const m = regularFileMtime(sp);
-            if (m !== null) out.push({ path: sp, mtimeMs: m });
-          }
-        } catch {
-          /* not a session dir — skip */
-        }
+        walkTranscriptTree(join(projDir, f, 'subagents'), 4, out);
         continue;
       }
       const p = join(projDir, f);
@@ -618,11 +688,13 @@ export function computeUsage(projectRoot: string, now?: number): UsageEstimate {
 
   const samples: Sample[] = [];
   const seen = new Set<string>();
+  let scanFileCount = 0;
   try {
     const files = listTranscriptFiles(claudeProjectsRoot());
     for (const f of files) {
       // mtime prefilter: a file last written before every relevant cutoff cannot contribute.
       if (f.mtimeMs < scanCutoff) continue;
+      scanFileCount += 1;
       extractSamples(f.path, scanCutoff, samples, seen);
     }
   } catch {
@@ -660,11 +732,46 @@ export function computeUsage(projectRoot: string, now?: number): UsageEstimate {
     }
   }
 
+  // ── Establishment gate (ADR-001): a number may only flow to the routed pct fields when the
+  // scan actually established it. Fail-closed in exactly four named ways; the raw estimates stay
+  // visible to humans under estimatesNotForRouting when policy (not measurement) nulls them.
+  const reasons: UsageNotEstablishedReason[] = [];
+  const recentFiles = scanFileCount > 0;
+  if (recentFiles && samples.length === 0) reasons.push('scan-empty');
+  // An IDLE session inside a busy week (block 0, weekly > 0) is a MEASURED zero, not a miss — the
+  // first cut of this gate flagged it and four standing tests rightly reddened. Second narrowing
+  // (cross-family review): a week that JUST reset over an idle machine still scans pre-reset
+  // samples (the session cutoff reaches 10h back), and weekly 0 is then a healthy fresh week. The
+  // true miss signature needs a sample AT or PAST the window start that the window still refuses —
+  // future-stamped (clock skew) or beyond-reset (stale anchor) — exactly d3639bf0's shape.
+  if (
+    weeklyWindow !== null &&
+    weeklyTokens <= 0 &&
+    samples.some((smp) => smp.ts >= weeklyWindow.startedAtMs)
+  ) {
+    reasons.push('window-miss:weekly');
+  }
+  if (limits.routingDisabled === true) reasons.push('routing-disabled');
+  const account = readClaudeAccountId();
+  if (limits.calibrationAccount !== undefined && limits.calibrationAccount !== null) {
+    // A stored identity DEMANDS verification (cross-family review: null-current was fail-open —
+    // an unreadable ~/.claude.json silently reused another account's calibration). A stored null
+    // stays exempt: those machines never claimed an identity to verify.
+    if (account === null) reasons.push('calibration-stale:account-unverifiable');
+    else if (account !== limits.calibrationAccount) reasons.push('calibration-stale:account-changed');
+  }
+  const rawSessionPct = pct(block.tokens, limits.sessionTokenLimit);
+  const rawWeeklyPct = weeklyPct;
+  const measurementBroken = reasons.some((r) => r === 'scan-empty' || r.startsWith('window-miss'));
+  const policyNulled = reasons.some((r) => r === 'routing-disabled' || r.startsWith('calibration-stale'));
+  const gatedSessionPct = measurementBroken || policyNulled ? null : rawSessionPct;
+  const gatedWeeklyPct = measurementBroken || policyNulled ? null : rawWeeklyPct;
+
   return {
     sessionTokens: block.tokens,
     weeklyTokens,
-    sessionPct: pct(block.tokens, limits.sessionTokenLimit),
-    weeklyPct,
+    sessionPct: gatedSessionPct,
+    weeklyPct: gatedWeeklyPct,
     sessionResetsAt: block.resetsAtMs === null ? null : new Date(block.resetsAtMs).toISOString(),
     weeklyResetsAt: weeklyWindow === null ? null : new Date(weeklyWindow.resetsAtMs).toISOString(),
     estimated: true,
@@ -673,6 +780,10 @@ export function computeUsage(projectRoot: string, now?: number): UsageEstimate {
     ...(weeklyBindingModel !== undefined ? { weeklyBindingModel } : {}),
     sessionStartedAt: block.startedAtMs === null ? null : new Date(block.startedAtMs).toISOString(),
     weeklyStartedAt: weeklyWindow === null ? null : new Date(weeklyWindow.startedAtMs).toISOString(),
+    notEstablished: reasons,
+    ...(policyNulled && !measurementBroken
+      ? { estimatesNotForRouting: { sessionPct: rawSessionPct, weeklyPct: rawWeeklyPct } }
+      : {}),
   };
 }
 
@@ -782,6 +893,10 @@ export function deriveUsageCalibration(
   if (changes.length > 0) {
     after.calibratedAt = input.calibratedAt;
     after.source = input.source;
+    // FR-4: a calibration is a claim about ONE account's limits. Stamp whose — a later login under
+    // a different identity then stales it by itself (the 2026-08-24 re-login is the reproducer:
+    // the old anchor kept printing 55% on the new account).
+    after.calibrationAccount = readClaudeAccountId();
   }
 
   return { before, after, changes, skipped };