@dzhechkov/harness-core 0.8.10 → 0.8.20

package/src/index.ts

@@ -12,6 +12,39 @@ export const HARNESS_CORE_VERSION: string =
 
 export * from './skills.js';
 export * from './apply.js';
+export {
+  buildPublicSnapshot,
+  assertPublicSafe,
+  applyDeltaRule,
+  HOLD_CAP_DAYS,
+  PUBLIC_SCHEMA,
+  MIN_GROUP,
+  TTT_BUCKETS,
+  type PrivateRecord,
+  type PublicSnapshot,
+  type BuildResult,
+  type RefusalCode,
+  type EgressVerdict,
+  type DeltaOutcome,
+} from './backlog-public.js';
+
+export {
+  appendTransition,
+  readTransitions,
+  transitionLogPath,
+  type TransitionRow,
+} from './backlog-transitions.js';
+
+export {
+  decideStop,
+  hasProgress,
+  BLOCK_BUDGET,
+  FRESH_HUMAN_MINUTES,
+  type LeadShift,
+  type ProgressEvidence,
+  type StopDecision,
+} from './lead-shift-gate.js';
+
 export { bundleSkills } from './bundle.js';
 export type { BundleOptions, BundleResult, BundledSkill } from './bundle.js';
 export * from './targets.js';
@@ -75,6 +108,7 @@ export * from './trace-bundle.js';
 export { BLOBS as LOOP_BLOBS, LOOP_BLOB_NAMES, BLOB_COVERAGE_MANIFEST } from './loop-blobs.generated.js';
 export type { LoopBlob } from './loop-blobs.generated.js';
 export * from './sign.js';
+export * from './swarm-brief.js';
 export * from './skill-schema.js';
 export { createSkill } from './create-skill.js';
 export type { CreateSkillOptions, CreateSkillResult } from './create-skill.js';
@@ -83,8 +117,8 @@ export type { SyncUpstreamReport, UpstreamCheckResult, SourcesManifest, SourcePa
 export { sweepSkillDrift, syncCanonicalSkill } from './skill-drift.js';
 export { SKILL_INSTALL_ROOTS, SKILL_INSTALL_ROOT_BY_TARGET, DEV_SKILL_ROOT, TARGET_ENRICHMENT_ASSETS } from './skill-install-roots.js';
 export { stampCheckpointLine } from './checkpoint-stamp.js';
-export { TELEMETRY_VOCAB_VERSION, TELEMETRY_FIELDS, PROVISIONAL_TELEMETRY_FIELDS, LOCAL_FIELD_ALIASES, telemetryFieldFor } from './telemetry-vocabulary.js';
-export type { TelemetryField, FieldSource } from './telemetry-vocabulary.js';
+export { TELEMETRY_VOCAB_VERSION, TELEMETRY_FIELDS, PROVISIONAL_TELEMETRY_FIELDS, LOCAL_FIELD_ALIASES, RUN_OUTCOMES, telemetryFieldFor, runOutcomeOf } from './telemetry-vocabulary.js';
+export type { TelemetryField, FieldSource, RunOutcome } from './telemetry-vocabulary.js';
 export { planLedgerBackfill, LEDGER_FILL_SOURCE, AMBIGUOUS, resolveLedgerRunId } from './ledger-backfill.js';
 // project-skills root resolution (field report doc-25b): the ONE builder behind both the Step-0
 // probe and the PS_GUIDANCE paragraph, so the two can never look at different roots again.
@@ -92,7 +126,8 @@ export { projectSkillsOneRoot, projectSkillsProbeCommand } from './project-skill
 export type { LedgerBackfillPlan, LedgerBackfillRow, RunCostFacts } from './ledger-backfill.js';
 export type { SweepResult, DriftedSkill, SyncResult, SyncCanonicalOptions } from './skill-drift.js';
 export { benchmarkSkill, benchmarkSkills, compareSkills } from './benchmark.js';
-export { buildRegistry, searchRegistry, filterByCategory, skillPackBaseDirs, discoverSkillPackDirs, discoverVerifiablePackDirs } from './registry.js';
+export { buildRegistry, searchRegistry, filterByCategory, skillPackBaseDirs, discoverSkillPackDirs, discoverSkillCarryingDirs, discoverVerifiablePackDirs } from './registry.js';
+export { tokenize, stemToken, stems } from './stem.js';
 // Package skill-layout resolution (feature dz-install-npx-init) — the ONE seam that knows where an
 // npm package keeps its skills (flat / templates/.claude/skills / skills). `cmdInstall` calls it;
 // `dz init`/`dz registry` are the filed follow-up consumers.
@@ -191,8 +226,32 @@ export type {
 } from './vector-tier.js';
 export { runSetup, generateHooksConfig, generateAgentdbWriter, writerVersionOf, AGENTDB_WRITER_VERSION,
   agentdbStorePath, agentdbMcpStorePath, agentdbStoreSeparationProblem } from './setup.js';
-export { statuslineData, readFeatureAdrState, writeFeatureAdrState, featureAdrStateDir, featureAdrStatePath } from './statusline.js';
-export type { StatuslineData, FeatureAdrState, WriteFeatureAdrStateInput } from './statusline.js';
+export { countLearningStoreRowsReadonly } from './store-counts.js';
+export type { LearningStoreRowCounts } from './store-counts.js';
+export {
+  STORE_GUARD_VERSION,
+  STORE_COLLAPSE_MAX_FRACTION,
+  STORE_COLLAPSE_LAST_ROWS,
+  storeGuardPath,
+  storeSnapshotPath,
+  readStoreMark,
+  writeStoreMark,
+  resetStoreMark,
+  checkStoreHealth,
+} from './store-guard.js';
+export type {
+  StoreMark,
+  StoreHealth,
+  StoreHealthInput,
+  StoreHealthVerdict,
+  StoreCountSnapshot,
+  StoreCountSource,
+  StoreMarkObservation,
+  StoreMarkWriteOptions,
+  StoreResetReceipt,
+} from './store-guard.js';
+export { statuslineData, readFeatureAdrState, writeFeatureAdrState, featureAdrStateDir, featureAdrStatePath, writeFeatureAdrStateDetailed, renderFeatureAdrPhaseLine } from './statusline.js';
+export type { StatuslineData, StatuslineStoreHealth, FeatureAdrState, WriteFeatureAdrStateInput, WriteFeatureAdrStateResult } from './statusline.js';
 export {
   ETA_MAX_STAGE_MS,
   estimateEta,
@@ -361,6 +420,10 @@ export {
   amendmentsMissingFromPlan,
   amendmentSubject,
   extractTestTitles,
+  amendmentIdsIn,
+  amendmentSectionCount,
+  amendmentDeclarationAmbiguity,
+  mentionsAmendmentId,
 } from './amendment-trace.js';
 export {
   RECORD_MAX_LINE_CHARS,
@@ -371,7 +434,7 @@ export {
 export { decidePublishSigning, decidePostSigningVerification, decideSignableSet, publishSigningLine, signableSetLine } from './publish-signing.js';
 export type { PublishSigningVerdict, PublishSigningDecision, SignableSetDecision } from './publish-signing.js';
 export type { RecordKind, RecordVerdict, RecordDecision } from './run-records.js';
-export type { AmendmentRow, AmendmentVerdict, AmendmentResolution, AmendmentOutcome, AmendmentDecision, PlanCoverageGap } from './amendment-trace.js';
+export type { AmendmentAmbiguity, AmendmentRow, AmendmentVerdict, AmendmentResolution, AmendmentOutcome, AmendmentDecision, PlanCoverageGap } from './amendment-trace.js';
 // contract-checklist (ADR-001): pure extraction, canonical rendering, typed report parsing, and
 // exact per-item verification. Filesystem discovery/containment stays in harness-cli.
 export {
@@ -577,6 +640,7 @@ export {
   DEFAULT_REWRITE_ATTEMPTS,
   liveSegmentStart,
   classifyChainDefects,
+  CHAINED_JOURNALS,
 } from './event-chain.js';
 export type {
   ChainFields,
@@ -593,8 +657,10 @@ export type {
   VerifyEventChainOptions,
   ChainDefectAge,
   ChainDefectAges,
+  ChainedJournal,
 } from './event-chain.js';
 export { decideProvenance, environmentCanMintProvenance, publishArgv, discoverPackages, publishPackages, bumpPatch, compareVersions, findUnpackagedSkills, findUnpublishedWorkspaceFloors, orderByDependencies, syncReadmeVersion, isChangelogEntryLine, changelogRegion } from './publish.js';
+export * from './course-staleness.js';
 export { fetchAllDownloads } from './downloads.js';
 export type { PackageDownloads, DownloadsReport } from './downloads.js';
 export { discoverInstalled, checkUpgrades } from './upgrade.js';
@@ -775,10 +841,17 @@ export {
   codexQeDeclineReason,
   codexDeclineReason,
   parseCodexReviewResult,
+  resolveStageDecision,
+  effectiveSpec,
+  specFamily,
+  qeReasonForFamilies,
+  STAGE_DECISION_REASONS,
 } from './feature-adr-routing.js';
 export type {
   StageOpts,
   RoutingEnv,
+  StageDecision,
+  StageDecisionReason,
   CrossFamilyQeReport,
   ModeBScopeVerdict,
   PartitionedFindings,
@@ -809,6 +882,15 @@ export type {
   CodexQeDeclineDetail,
   CodexReviewResult,
 } from './feature-adr-routing.js';
+export {
+  STAGE_LINE_BLOB_VERSION,
+  STAGE_LINE_REASON_LABELS,
+  STAGE_LINE_BARRIER_STAGES,
+  renderStageIntentLine,
+  renderStageOutcomeLine,
+  renderStageLine,
+} from './stage-line.js';
+export type { StageLineDecision, StageLineOutcome, StageLineOutcomeState } from './stage-line.js';
 export {
   PARSER_SAFE_REGION_START,
   PARSER_SAFE_REGION_END,
@@ -961,7 +1043,8 @@ export {
 } from './epoch-replay.js';
 
 // Run-process scorecard (feature dz-score, Reading C) — scores the DISCIPLINE of a feature-adr run
-// from its artifacts. Descriptive-only, permanently: it never gates.
+// from its artifacts and folds immutable receipts into a chained aggregate. Descriptive-only,
+// permanently: neither the single-run score nor the aggregate gates.
 export * from './score.js';
 export * from './recap.js';
 export * from './provenance.js';
@@ -1037,3 +1120,34 @@ export type {
   Register, Domain, OperatorProfile, ProfileReadResult, ProfileSyncResult,
   ProfileDriftVerdict, ProfileDriftResult,
 } from './profile.js';
+export * from './codex-invoke.js';
+export * from './skill-selection.js';
+
+// destructive-guard (feature destructive-command-guard, ADR-001) — pure pre-execution verdict on a
+// shell command. Refuses ONLY on a literal path into a protected store; `undecidable` is never
+// passed off as `refuse`.
+export { classifyDestructive, DESTRUCTIVE_RULES } from './destructive-guard.js';
+export type { DestructiveVerdict } from './destructive-guard.js';
+
+// The CONSUMER half (task T8): one decision for both hosts — the Claude PreToolUse hook
+// (`.claude/hooks/destructive-guard.cjs`) and the emitted Codex veto helper call the SAME function,
+// so a refusal is worded identically on both runtimes.
+export {
+  decideDestructiveHook,
+  DESTRUCTIVE_REFUSE_MARKER,
+  DESTRUCTIVE_WARN_MARKER,
+} from './destructive-guard-hook.js';
+export type { DestructiveHookDecision, DestructiveHookHost } from './destructive-guard-hook.js';
+
+// Delivery of the guard into OTHER projects (task T8, review round 3): the installable Claude hook
+// body + its registry entry, and the locator that lets an emitted body find the installation that
+// wrote it. Both hosts' bodies resolve harness-core by PATH, never by bare specifier.
+export {
+  generateClaudeDestructiveHook,
+  CLAUDE_DESTRUCTIVE_HOOK_COMMAND,
+  CLAUDE_DESTRUCTIVE_HOOK_MATCHER,
+  CLAUDE_DESTRUCTIVE_HOOK_RELPATH,
+  DZ_CLAUDE_HOOK_VERSION,
+} from './claude-hooks-assets.js';
+export type { ClaudeHookAssetOptions } from './claude-hooks-assets.js';
+export { harnessCoreDistDir, harnessCoreModuleDir } from './harness-core-location.js';

package/src/lead-shift-gate.ts

@@ -0,0 +1,145 @@
+/**
+ * Сторож смены лида: отказать в завершении хода, пока санкционированная работа не кончилась.
+ *
+ * ЗАЧЕМ ЭТО СУЩЕСТВУЕТ — два измеренных происшествия, второе после починки первого.
+ *
+ * 2026-08-29: простой ~4,5 часа. Лид «мониторил» задачи, чьи родители давно умерли, и считал
+ * очередь непустой. Лечением стало ПРАВИЛО в `.claude/rules/lead-idle-discipline.md`.
+ *
+ * 2026-09-03: простой **6 часов 24 минуты**. Лид отработал 19:16–23:15, написал утренний отчёт,
+ * ЗАВЕРШИЛ ХОД и молчал до 05:38. Очередь была не просто непустой — 352 открытые записи, и
+ * незакрытая работа была перечислена самим лидом абзацем выше в том же отчёте. Правило,
+ * написанное после первого случая, читалось каждый прогон и не сработало.
+ *
+ * Вывод, который и породил этот файл: **текст второго слоя лестницы стоимости обнаружения не
+ * ловит собственный молчаливый отказ.** Правило нельзя «не выполнить с ошибкой» — его можно
+ * только не вспомнить, и снаружи это неотличимо от выполнения. Поэтому решение переносится на
+ * слой 1: детерминированная функция, у которой есть красный тест.
+ *
+ * СТРУКТУРНАЯ ТРУДНОСТЬ, названная честно: завершение хода — это ОТСУТСТВИЕ дальнейших вызовов,
+ * а не событие. Перехватить «модель перестала работать» нельзя. Зато харнесс даёт шов `Stop`,
+ * который срабатывает на попытке закончить ход и умеет её ЗАБЛОКИРОВАТЬ. Этот файл — решающая
+ * половина такого гейта; вторая половина, тонкий адаптер, живёт в хуке.
+ *
+ * АТАКА, СЛОМАВШАЯ ПЕРВУЮ РЕДАКЦИЮ (Codex gpt-5.6-sol, xhigh, 2026-09-03, вердикт «НЕ СРАБОТАЕТ»).
+ * Первая редакция разрешала ПОВТОРНУЮ остановку автоматически — как защиту от зацикливания.
+ * Приём обхода: получить отказ, ответить «принято, продолжу», не сделать ни одного рабочего
+ * действия, остановиться снова — и второй раз пропускали. Итог был бы тот же простой плюс одна
+ * запись в журнале. Поэтому здесь повторная остановка разрешается НЕ ПО ФАКТУ ПОВТОРНОСТИ, а
+ * только по машинному свидетельству прогресса (см. `hasProgress`).
+ */
+
+/** Машинное свидетельство того, что между двумя попытками остановиться что-то произошло. */
+export interface ProgressEvidence {
+  /** `git rev-parse HEAD` на момент прошлой блокировки и сейчас. */
+  readonly headBefore?: string | undefined;
+  readonly headNow?: string | undefined;
+  /** sha256 от `git status --porcelain` — ловит правку, ещё не ставшую коммитом. */
+  readonly treeHashBefore?: string | undefined;
+  readonly treeHashNow?: string | undefined;
+  /** Идентификаторы живых фоновых задач тогда и сейчас. */
+  readonly liveTasksBefore?: readonly string[] | undefined;
+  readonly liveTasksNow?: readonly string[] | undefined;
+  /**
+   * Пункты очереди, закрытые между попытками, вместе с доказательством закрытия.
+   * `evidenceExists` считает ВЫЗЫВАЮЩИЙ, проверив путь или коммит на существование: закрытие
+   * без существующего доказательства прогрессом не считается, иначе «закрыть» станет строкой.
+   */
+  readonly closedItems?: readonly { readonly id: string; readonly evidenceExists: boolean }[] | undefined;
+}
+
+/** Состояние смены: что владелец санкционировал и в каком режиме идёт работа. */
+export interface LeadShift {
+  /** `autonomous` — владелец отпустил лида работать без присмотра; иначе сторож спит. */
+  readonly mode: 'autonomous' | 'interactive';
+  /** Открытых пунктов в санкционированной очереди. */
+  readonly openItems: number;
+  /** Живая работа: фоновые задачи, чьи родители ЖИВЫ. Пустой список — не повод спать. */
+  readonly liveWork: readonly string[];
+  /** Минут с последнего сообщения ЧЕЛОВЕКА. Свежий разговор — законная причина остановиться. */
+  readonly minutesSinceHuman: number;
+  /** Это повторная попытка остановиться после нашей же блокировки. */
+  readonly stopHookActive: boolean;
+  /** Сколько раз подряд мы уже блокировали в этой смене. */
+  readonly consecutiveBlocks: number;
+  /** Квитанция завершения из закрытого списка: владелец сказал стоп, очередь пуста, работа блокирована. */
+  readonly completionReceipt?: 'owner-stop' | 'queue-empty' | 'blocked-on-owner' | undefined;
+}
+
+/** Что сторож решил и почему. `reason` пишется в журнал инцидентов и показывается лиду. */
+export interface StopDecision {
+  readonly action: 'allow' | 'block' | 'escalate';
+  readonly reason: string;
+  /** Машинный код причины — для журнала и для тестов; текст `reason` меняется, код нет. */
+  readonly code:
+    | 'not-autonomous' | 'receipt' | 'live-work' | 'fresh-human' | 'queue-empty'
+    | 'idle-with-queue' | 'no-progress' | 'budget-exhausted';
+}
+
+/** Потолок блокировок подряд. Ниже харнессового потолка в 8, чтобы решение осталось нашим. */
+export const BLOCK_BUDGET = 3;
+
+/** Свежий разговор с человеком: остановиться сразу после его реплики — законно. */
+export const FRESH_HUMAN_MINUTES = 20;
+
+/**
+ * Было ли между двумя попытками остановиться хоть одно машинно заметное движение.
+ *
+ * Ответ «принято, продолжу работу» не меняет ни коммита, ни дерева, ни списка задач, ни очереди —
+ * и потому прогрессом не является. В этом весь смысл функции: она отличает СЛОВА от ДЕЙСТВИЙ.
+ */
+export function hasProgress(e: ProgressEvidence | undefined): boolean {
+  if (!e) return false;
+  if (e.headBefore && e.headNow && e.headBefore !== e.headNow) return true;
+  if (e.treeHashBefore && e.treeHashNow && e.treeHashBefore !== e.treeHashNow) return true;
+  const before = new Set(e.liveTasksBefore ?? []);
+  if ((e.liveTasksNow ?? []).some((id) => !before.has(id))) return true;
+  // Закрытие пункта считается прогрессом ТОЛЬКО с существующим доказательством: иначе достаточно
+  // объявить пункт закрытым, чтобы получить право замолчать.
+  if ((e.closedItems ?? []).some((c) => c.evidenceExists)) return true;
+  return false;
+}
+
+/**
+ * Решить, можно ли закончить ход.
+ *
+ * Порядок проверок load-bearing: сначала всё, что делает остановку ЗАКОННОЙ, и только потом
+ * запрет. Сторож, который сначала запрещает, будет отключён после первого же ложного срабатывания
+ * на правильной остановке — а отключённый сторож не ловит ничего.
+ */
+export function decideStop(shift: LeadShift, progress?: ProgressEvidence): StopDecision {
+  if (shift.mode !== 'autonomous') {
+    return { action: 'allow', code: 'not-autonomous', reason: 'смена не в автономном режиме — остановка не наше дело' };
+  }
+  if (shift.completionReceipt) {
+    return { action: 'allow', code: 'receipt', reason: `квитанция завершения: ${shift.completionReceipt}` };
+  }
+  if (shift.liveWork.length > 0) {
+    return { action: 'allow', code: 'live-work', reason: `живая работа: ${shift.liveWork.join(', ')}` };
+  }
+  if (shift.minutesSinceHuman < FRESH_HUMAN_MINUTES) {
+    return { action: 'allow', code: 'fresh-human', reason: `человек писал ${shift.minutesSinceHuman} мин назад — разговор идёт` };
+  }
+  if (shift.openItems === 0) {
+    return { action: 'allow', code: 'queue-empty', reason: 'очередь пуста' };
+  }
+  // Дальше — остановка при непустой очереди, без живой работы и без квитанции. Ровно этот случай
+  // произошёл 2026-09-03 и стоил 6 часов 24 минут.
+  if (shift.consecutiveBlocks >= BLOCK_BUDGET) {
+    return {
+      action: 'escalate',
+      code: 'budget-exhausted',
+      reason: `${shift.consecutiveBlocks} блокировки подряд без прогресса — будим владельца и разрешаем остановку`,
+    };
+  }
+  if (shift.stopHookActive && hasProgress(progress)) {
+    return { action: 'allow', code: 'no-progress', reason: 'после прошлой блокировки есть машинный прогресс' };
+  }
+  return {
+    action: 'block',
+    code: shift.stopHookActive ? 'no-progress' : 'idle-with-queue',
+    reason: shift.stopHookActive
+      ? `повторная остановка без единого машинного признака прогресса; открытых пунктов ${shift.openItems}`
+      : `в очереди ${shift.openItems} открытых пунктов, живой работы нет — ход не заканчивается`,
+  };
+}

package/src/ledger-backfill.ts

@@ -59,7 +59,7 @@ export interface LedgerBackfillRow {
   readonly key: LedgerFillKey | null;
   readonly filled: readonly string[];
   /** Why nothing was filled. `null` when something was. */
-  readonly skipped: 'no-join-key' | 'no-host-record' | 'ambiguous-slug' | 'shared-run-claim' | 'already-complete' | 'malformed-line' | 'host-record-empty' | null;
+  readonly skipped: 'no-join-key' | 'no-host-record' | 'ambiguous-slug' | 'shared-run-claim' | 'already-complete' | 'malformed-line' | 'host-record-empty' | 'non-run-row' | null;
 }
 
 export interface LedgerBackfillPlan {
@@ -75,6 +75,17 @@ const FILLABLE = ['tokens', 'minutes', 'agents'] as const;
 
 const isNum = (v: unknown): v is number => typeof v === 'number' && Number.isFinite(v);
 
+/**
+ * fa-phase-statusline QE fix (P2, cross-family review of 656d6903): the ledger now carries
+ * per-PHASE telemetry rows (`kind:"phase"`, schema `feature-adr-phase/1`) alongside its run rows.
+ * The header's contract: the one-line-one-run invariant applies ONLY to rows WITHOUT a `kind`
+ * field, so any row that carries one is NOT a run row and must be invisible to the backfill —
+ * both to claimant counting (several phase rows under a slug were making a real cost row
+ * `shared-run-claim`, unfillable forever) and to filling (exactly one phase row under a slug could
+ * receive the whole run's token total — a fabrication by attribution).
+ */
+export const isNonRunRow = (r: Record<string, unknown>): boolean => typeof r['kind'] === 'string' && r['kind'] !== '';
+
 /**
  * Plan the fill. PURE: takes the ledger's raw lines and a runId→facts lookup, returns the new lines.
  * Nothing is read or written here — the caller owns the file and the atomic replace.
@@ -100,6 +111,7 @@ export function planLedgerBackfill(input: {
       const parsed: unknown = JSON.parse(raw);
       if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
       const r = parsed as Record<string, unknown>;
+      if (isNonRunRow(r)) continue; // phase rows are telemetry, never claimants
       if (FILLABLE.every((f) => isNum(r[f]))) continue;
       const rid = typeof r['runId'] === 'string' && r['runId'] !== '' ? r['runId'] : null;
       const slg = typeof r['slug'] === 'string' && r['slug'] !== '' ? r['slug'] : null;
@@ -129,6 +141,13 @@ export function planLedgerBackfill(input: {
 
     const runId = typeof row['runId'] === 'string' && row['runId'] !== '' ? row['runId'] : null;
     const slug = typeof row['slug'] === 'string' && row['slug'] !== '' ? row['slug'] : null;
+    if (isNonRunRow(row)) {
+      // A `kind`-carrying row (per-phase telemetry) has no run cost to fill — pass through
+      // unchanged and SAY so, never let it receive a run's numbers.
+      outLines.push(raw);
+      rows.push({ index, runId, slug, key: null, filled: [], skipped: 'non-run-row' });
+      return;
+    }
     const missing = FILLABLE.filter((f) => !isNum(row[f]));
     if (missing.length === 0) {
       outLines.push(raw);

package/src/loop-blobs.generated.ts

@@ -25,7 +25,7 @@ export interface LoopBlob {
   code: string;
 }
 
-export const LOOP_BLOB_NAMES = ["checkpoints","training-pairs","model-resolver","usage-probes","codex-dispatch","challenge-panel","trace","loop-semantics","ha-consult-router"] as const;
+export const LOOP_BLOB_NAMES = ["checkpoints","training-pairs","model-resolver","usage-probes","codex-dispatch","challenge-panel","stage-line","trace","loop-semantics","ha-consult-router"] as const;
 
 /** Workflow files the regen-diff gate covers TODAY (AM-5 honest scope): exactly the files
  * carrying BEGIN BLOB markers. Stage B (whole-file regeneration of feature-adr.js) is a
@@ -61,11 +61,11 @@ export const BLOBS: Record<string, LoopBlob> = {
   "model-resolver": {
     name: "model-resolver",
     version: "1.0.0",
-    contentHash: "fcf8c1dfc4b5364adb6e532565953ef30d94a45070b2b903411170965a1fb372",
+    contentHash: "357a258796e553b2fbe94dfab26cf487a9fd189b4927836f261185215392dfaa",
     sourcePath: "packages/@dzhechkov/harness-core/src/feature-adr-routing.ts",
     requires: [],
     exports: ["specToOpts","resolveStageModel","KNOWN_CODEX","mergeOpts","stageLabel","modelLabel"],
-    code: "const STAGE_EFFORT = { override: {\n        router: 'medium',\n        requirements: 'medium',\n        research: 'medium',\n        adr: 'high',\n        ideation: 'medium',\n        ddd: 'high',\n        architecture: 'high',\n        plan: 'high',\n        code: 'medium',\n        qe: 'high',\n        fleet: 'medium',\n    } };\nfunction topCodexId(env) {\n    return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS.flagship;\n}\nconst KNOWN_CODEX = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };\nconst CODEX_TIERS = {\n    flagship: 'gpt-5.6-sol',\n    workhorse: 'gpt-5.6-terra',\n    'high-volume': 'gpt-5.6-luna',\n};\nfunction codexIdForTier(tier, env) {\n    return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS[tier];\n}\nconst BUDGET_PRESETS = {\n    normal: { claude: 'normal', codex: 'normal' },\n    eco: { claude: 'eco', codex: 'eco' },\n    hybrid: { claude: 'eco', codex: 'normal' },\n};\nfunction resolveBudgetMode(raw) {\n    if (raw === undefined)\n        return BUDGET_PRESETS.normal;\n    if (typeof raw === 'string') {\n        const preset = BUDGET_PRESETS[raw];\n        if (!preset)\n            throw new RangeError('budget: unknown preset \"' + raw + '\" — valid: normal|eco|hybrid');\n        return preset;\n    }\n    if (raw && typeof raw === 'object') {\n        const value = raw;\n        for (const key of Object.keys(value)) {\n            if (key !== 'claude' && key !== 'codex') {\n                throw new RangeError('budget: unknown family key \"' + key + '\" — valid: claude|codex');\n            }\n        }\n        for (const key of ['claude', 'codex']) {\n            const level = value[key];\n            if (level !== undefined && level !== 'normal' && level !== 'eco') {\n                throw new RangeError('budget.' + key + ': unknown level \"' + level + '\" — valid: normal|eco');\n            }\n        }\n        return {\n            claude: value.claude || 'normal',\n            codex: value.codex || 'normal',\n        };\n    }\n    throw new RangeError('budget: expected a preset name or {claude,codex} object, got ' + typeof raw);\n}\nconst CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };\nconst VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1, max: 1 };\nconst DEFAULT_MODELS = {\n    router: 'fable',\n    requirements: 'sonnet',\n    research: 'sonnet',\n    adr: 'opus',\n    ideation: 'sonnet',\n    ddd: 'opus',\n    architecture: 'opus',\n    plan: 'sonnet',\n    code: null,\n    qe: null,\n    fleet: 'sonnet',\n};\nconst ROUTING_TABLES = {\n    claude: {\n        claude: {\n            normal: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'fable', ideation: 'sonnet', ddd: 'fable', architecture: 'fable', plan: 'opus', code: 'sonnet', fleet: 'sonnet' },\n            eco: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'opus', ideation: 'sonnet', ddd: 'opus', architecture: 'opus', plan: 'sonnet', code: 'sonnet', fleet: 'sonnet' },\n        },\n        codex: { normal: {}, eco: {} },\n    },\n    codex: {\n        claude: {\n            normal: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },\n            eco: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },\n        },\n        codex: { normal: {}, eco: {} },\n    },\n};\nfunction codexCell(tier, effort, env) {\n    return 'codex:' + codexIdForTier(tier, env) + ':' + effort;\n}\nfunction budgetTable(primary, mode, env) {\n    const claudeHalf = ROUTING_TABLES[primary].claude[mode.claude];\n    let codexHalf;\n    if (primary === 'claude') {\n        const qeSpec = mode.codex === 'normal'\n            ? codexCell('flagship', 'high', env)\n            : codexCell('workhorse', 'medium', env);\n        codexHalf = { ...ROUTING_TABLES.claude.codex[mode.codex], qe: env.codexAvailable === false ? 'opus' : qeSpec };\n    }\n    else {\n        const normal = mode.codex === 'normal';\n        const design = codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'medium', env);\n        codexHalf = {\n            requirements: design,\n            research: design,\n            adr: design,\n            ideation: design,\n            ddd: design,\n            architecture: design,\n            plan: codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'low', env),\n            code: codexCell(normal ? 'flagship' : 'workhorse', 'medium', env),\n        };\n    }\n    return { ...claudeHalf, ...codexHalf };\n}\nfunction specToOpts(spec, env) {\n    const log = env.log || function () { };\n    if (!spec)\n        return {};\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        let id = parts[1] || env.CODEX_MODEL;\n        if (id !== 'auto' && !KNOWN_CODEX[id]) {\n            log('models: unknown codex id ' + id + ' — using ' + env.CODEX_MODEL);\n            id = env.CODEX_MODEL;\n        }\n        let reasoning = parts[2] || 'high';\n        if (!VALID_REASONING[reasoning]) {\n            throw new RangeError('models: invalid reasoning \"' + reasoning + '\" — valid: ' + Object.keys(VALID_REASONING).join('|'));\n        }\n        return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };\n    }\n    if (CLAUDE_NAMES[head])\n        return { model: head };\n    log('models: unknown spec ' + spec + ' — session-inherited');\n    return {};\n}\nfunction resolveCoderSpec(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return 'codex:' + env.CODEX_MODEL + ':high';\n    return 'opus';\n}\nfunction coderIsCodex(env) {\n    const codeSpec = env.MODELS.code;\n    if (codeSpec !== undefined && codeSpec !== null)\n        return String(codeSpec).split(':')[0] === 'codex';\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return true;\n    return env.primary === 'codex';\n}\nfunction resolveQeSpecForCoder(coderCodex, env) {\n    if (coderCodex)\n        return 'sonnet';\n    const CODEX_AVAILABLE = env.codexAvailable !== false;\n    if (!CODEX_AVAILABLE)\n        return 'opus';\n    const budget = resolveBudgetMode(env.budget);\n    return budget.codex === 'eco'\n        ? 'codex:' + codexIdForTier('workhorse', env) + ':medium'\n        : 'codex:' + codexIdForTier('flagship', env) + ':high';\n}\nfunction resolveQeSpec(env) {\n    return resolveQeSpecForCoder(coderIsCodex(env), env);\n}\nfunction routingRequested(env) {\n    return (Object.keys(env.MODELS).length > 0 ||\n        env.primary !== undefined ||\n        env.budget !== undefined ||\n        env.PLANNER === 'codex' ||\n        env.CODER === 'codex' ||\n        env.CODER === 'codex-fallback' ||\n        env.QE_REVIEWER === 'codex' ||\n        env.QE_REVIEWER === 'codex-fallback');\n}\nfunction resolveStageModel(stage, env) {\n    if (env.usageOverride) {\n        const r = (env.usageReasoning && env.usageReasoning[stage]) || STAGE_EFFORT.override[stage] || 'medium';\n        const o = specToOpts('codex:' + topCodexId(env) + ':' + r, env);\n        o._usageSwitched = true;\n        return o;\n    }\n    let spec = env.MODELS[stage];\n    if (spec === undefined) {\n        if (!routingRequested(env))\n            return {};\n        if (stage === 'code' && (env.CODER === 'codex' || env.CODER === 'codex-fallback')) {\n            return specToOpts(resolveCoderSpec(env), env);\n        }\n        if (stage === 'plan' && env.PLANNER === 'codex') {\n            return specToOpts('codex:' + env.CODEX_MODEL + ':high', env);\n        }\n        if (stage === 'qe') {\n            return specToOpts(resolveQeSpec(env), env);\n        }\n        const resolvedPrimary = env.primary || 'claude';\n        const cell = budgetTable(resolvedPrimary, resolveBudgetMode(env.budget), env)[stage];\n        spec = cell !== undefined ? cell : DEFAULT_MODELS[stage];\n    }\n    if (stage === 'code' && (spec === null || spec === undefined))\n        return specToOpts(resolveCoderSpec(env), env);\n    if (stage === 'qe' && (spec === null || spec === undefined))\n        return specToOpts(resolveQeSpec(env), env);\n    return specToOpts(spec, env);\n}\nfunction modelLabel(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue') {\n        const base = 'codex:' + opts.codexModel + ':' + opts._reasoning;\n        return opts._usageSwitched ? base + ' (usage-switched)' : base;\n    }\n    if (opts && opts.model)\n        return opts.model;\n    return 'session';\n}\nfunction stageLabel(base, opts) {\n    const m = modelLabel(opts);\n    return m === 'session' ? base : base + ' · ' + m;\n}\nfunction mergeOpts(base, extra) {\n    const out = {};\n    for (const k in base)\n        out[k] = base[k];\n    for (const k in extra)\n        out[k] = extra[k];\n    return out;\n}",
+    code: "const STAGE_EFFORT = { override: {\n        router: 'medium',\n        requirements: 'medium',\n        research: 'medium',\n        adr: 'high',\n        ideation: 'medium',\n        ddd: 'high',\n        architecture: 'high',\n        plan: 'high',\n        code: 'medium',\n        qe: 'high',\n        fleet: 'medium',\n    } };\nfunction topCodexId(env) {\n    return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS.flagship;\n}\nconst KNOWN_CODEX = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };\nconst CODEX_TIERS = {\n    flagship: 'gpt-5.6-sol',\n    workhorse: 'gpt-5.6-terra',\n    'high-volume': 'gpt-5.6-luna',\n};\nfunction codexIdForTier(tier, env) {\n    return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS[tier];\n}\nconst BUDGET_PRESETS = {\n    normal: { claude: 'normal', codex: 'normal' },\n    eco: { claude: 'eco', codex: 'eco' },\n    hybrid: { claude: 'eco', codex: 'normal' },\n};\nfunction resolveBudgetMode(raw) {\n    if (raw === undefined)\n        return BUDGET_PRESETS.normal;\n    if (typeof raw === 'string') {\n        const preset = BUDGET_PRESETS[raw];\n        if (!preset)\n            throw new RangeError('budget: unknown preset \"' + raw + '\" — valid: normal|eco|hybrid');\n        return preset;\n    }\n    if (raw && typeof raw === 'object') {\n        const value = raw;\n        for (const key of Object.keys(value)) {\n            if (key !== 'claude' && key !== 'codex') {\n                throw new RangeError('budget: unknown family key \"' + key + '\" — valid: claude|codex');\n            }\n        }\n        for (const key of ['claude', 'codex']) {\n            const level = value[key];\n            if (level !== undefined && level !== 'normal' && level !== 'eco') {\n                throw new RangeError('budget.' + key + ': unknown level \"' + level + '\" — valid: normal|eco');\n            }\n        }\n        return {\n            claude: value.claude || 'normal',\n            codex: value.codex || 'normal',\n        };\n    }\n    throw new RangeError('budget: expected a preset name or {claude,codex} object, got ' + typeof raw);\n}\nconst CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };\nconst VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1, max: 1 };\nconst DEFAULT_MODELS = {\n    router: 'fable',\n    requirements: 'sonnet',\n    research: 'sonnet',\n    adr: 'opus',\n    ideation: 'sonnet',\n    ddd: 'opus',\n    architecture: 'opus',\n    plan: 'sonnet',\n    code: null,\n    qe: null,\n    fleet: 'sonnet',\n};\nconst ROUTING_TABLES = {\n    claude: {\n        claude: {\n            normal: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'fable', ideation: 'sonnet', ddd: 'fable', architecture: 'fable', plan: 'opus', code: 'sonnet', fleet: 'sonnet' },\n            eco: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'opus', ideation: 'sonnet', ddd: 'opus', architecture: 'opus', plan: 'sonnet', code: 'sonnet', fleet: 'sonnet' },\n        },\n        codex: { normal: {}, eco: {} },\n    },\n    codex: {\n        claude: {\n            normal: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },\n            eco: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },\n        },\n        codex: { normal: {}, eco: {} },\n    },\n};\nfunction codexCell(tier, effort, env) {\n    return 'codex:' + codexIdForTier(tier, env) + ':' + effort;\n}\nfunction budgetTable(primary, mode, env) {\n    const claudeHalf = ROUTING_TABLES[primary].claude[mode.claude];\n    let codexHalf;\n    if (primary === 'claude') {\n        const qeSpec = mode.codex === 'normal'\n            ? codexCell('flagship', 'high', env)\n            : codexCell('workhorse', 'medium', env);\n        codexHalf = { ...ROUTING_TABLES.claude.codex[mode.codex], qe: env.codexAvailable === false ? 'opus' : qeSpec };\n    }\n    else {\n        const normal = mode.codex === 'normal';\n        const design = codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'medium', env);\n        codexHalf = {\n            requirements: design,\n            research: design,\n            adr: design,\n            ideation: design,\n            ddd: design,\n            architecture: design,\n            plan: codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'low', env),\n            code: codexCell(normal ? 'flagship' : 'workhorse', 'medium', env),\n        };\n    }\n    return { ...claudeHalf, ...codexHalf };\n}\nfunction specToOpts(spec, env) {\n    const log = env.log || function () { };\n    if (!spec)\n        return {};\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        let id = parts[1] || env.CODEX_MODEL;\n        if (id !== 'auto' && !KNOWN_CODEX[id]) {\n            log('models: unknown codex id ' + id + ' — using ' + env.CODEX_MODEL);\n            id = env.CODEX_MODEL;\n        }\n        let reasoning = parts[2] || 'high';\n        if (!VALID_REASONING[reasoning]) {\n            throw new RangeError('models: invalid reasoning \"' + reasoning + '\" — valid: ' + Object.keys(VALID_REASONING).join('|'));\n        }\n        return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };\n    }\n    if (CLAUDE_NAMES[head])\n        return { model: head };\n    log('models: unknown spec ' + spec + ' — session-inherited');\n    return {};\n}\nfunction resolveCoderSpec(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return 'codex:' + env.CODEX_MODEL + ':high';\n    return 'opus';\n}\nfunction coderIsCodex(env) {\n    const codeSpec = env.MODELS.code;\n    if (codeSpec !== undefined && codeSpec !== null)\n        return String(codeSpec).split(':')[0] === 'codex';\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return true;\n    return env.primary === 'codex';\n}\nfunction resolveQeSpecForCoder(coderCodex, env) {\n    if (coderCodex)\n        return 'sonnet';\n    const CODEX_AVAILABLE = env.codexAvailable !== false;\n    if (!CODEX_AVAILABLE)\n        return 'opus';\n    const budget = resolveBudgetMode(env.budget);\n    return budget.codex === 'eco'\n        ? 'codex:' + codexIdForTier('workhorse', env) + ':medium'\n        : 'codex:' + codexIdForTier('flagship', env) + ':high';\n}\nfunction resolveQeSpec(env) {\n    return resolveQeSpecForCoder(coderIsCodex(env), env);\n}\nfunction routingRequested(env) {\n    return (Object.keys(env.MODELS).length > 0 ||\n        env.primary !== undefined ||\n        env.budget !== undefined ||\n        env.PLANNER === 'codex' ||\n        env.CODER === 'codex' ||\n        env.CODER === 'codex-fallback' ||\n        env.QE_REVIEWER === 'codex' ||\n        env.QE_REVIEWER === 'codex-fallback');\n}\nfunction resolveStageModel(stage, env) {\n    return resolveStageDecision(stage, env).opts;\n}\nfunction specFamily(spec) {\n    return (spec && String(spec).split(':')[0] === 'codex') ? 'codex' : 'claude';\n}\nfunction qeReasonForFamilies(coderCodex, qeSpec) {\n    if (specFamily(qeSpec) === (coderCodex ? 'codex' : 'claude'))\n        return 'qe-same-family-degraded';\n    return 'qe-cross-family';\n}\nfunction effectiveSpec(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue')\n        return 'codex:' + opts.codexModel + ':' + opts._reasoning;\n    if (opts && opts.model)\n        return opts.model;\n    return null;\n}\nfunction specDegradation(spec, opts, env) {\n    if (!spec)\n        return null;\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        const requested = parts[1] || env.CODEX_MODEL;\n        if (opts.codexModel !== requested)\n            return 'codex-id-substituted';\n        return null;\n    }\n    if (!CLAUDE_NAMES[head])\n        return 'spec-unrecognised';\n    return null;\n}\nfunction decisionFor(base, spec, opts, env) {\n    const deg = specDegradation(spec, opts, env);\n    if (deg !== null)\n        return { opts: opts, spec: effectiveSpec(opts), reason: deg };\n    return { opts: opts, spec: effectiveSpec(opts), reason: base };\n}\nfunction decideFromSpec(base, stage, spec, env) {\n    if (stage === 'code' && (spec === null || spec === undefined)) {\n        const s = resolveCoderSpec(env);\n        return decisionFor(base, s, specToOpts(s, env), env);\n    }\n    if (stage === 'qe' && (spec === null || spec === undefined)) {\n        const s = resolveQeSpec(env);\n        return decisionFor(base, s, specToOpts(s, env), env);\n    }\n    return decisionFor(base, spec, specToOpts(spec, env), env);\n}\nfunction resolveStageDecision(stage, env) {\n    if (env.usageOverride) {\n        const r = (env.usageReasoning && env.usageReasoning[stage]) || STAGE_EFFORT.override[stage] || 'medium';\n        const s = 'codex:' + topCodexId(env) + ':' + r;\n        const o = specToOpts(s, env);\n        o._usageSwitched = true;\n        return decisionFor('usage-override', s, o, env);\n    }\n    const spec = env.MODELS[stage];\n    if (spec !== undefined)\n        return decideFromSpec('explicit-models', stage, spec, env);\n    if (!routingRequested(env))\n        return { opts: {}, spec: null, reason: 'routing-not-requested' };\n    if (stage === 'code' && (env.CODER === 'codex' || env.CODER === 'codex-fallback')) {\n        const s = resolveCoderSpec(env);\n        return decisionFor('coder-knob-codex', s, specToOpts(s, env), env);\n    }\n    if (stage === 'plan' && env.PLANNER === 'codex') {\n        const s = 'codex:' + env.CODEX_MODEL + ':high';\n        return decisionFor('planner-knob-codex', s, specToOpts(s, env), env);\n    }\n    if (stage === 'qe') {\n        const s = resolveQeSpec(env);\n        return decisionFor(qeReasonForFamilies(coderIsCodex(env), s), s, specToOpts(s, env), env);\n    }\n    const resolvedPrimary = env.primary || 'claude';\n    const cell = budgetTable(resolvedPrimary, resolveBudgetMode(env.budget), env)[stage];\n    if (cell !== undefined)\n        return decideFromSpec('budget-table-cell', stage, cell, env);\n    return decideFromSpec('default-models', stage, DEFAULT_MODELS[stage], env);\n}\nfunction modelLabel(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue') {\n        const base = 'codex:' + opts.codexModel + ':' + opts._reasoning;\n        return opts._usageSwitched ? base + ' (usage-switched)' : base;\n    }\n    if (opts && opts.model)\n        return opts.model;\n    return 'session';\n}\nfunction stageLabel(base, opts) {\n    const m = modelLabel(opts);\n    return m === 'session' ? base : base + ' · ' + m;\n}\nfunction mergeOpts(base, extra) {\n    const out = {};\n    for (const k in base)\n        out[k] = base[k];\n    for (const k in extra)\n        out[k] = extra[k];\n    return out;\n}",
   },
   "usage-probes": {
     name: "usage-probes",
@@ -94,6 +94,15 @@ export const BLOBS: Record<string, LoopBlob> = {
     exports: ["CHALLENGE_QUESTIONS","CHALLENGE_VERDICT_SCHEMA","buildChallengeBrief","sanitizeFinding","sanitizeVerdict","findingsNeedingCrossValidation","confirmedVerdict","renderVerdict","pickAdversaryModel","classifyModelFamily"],
     code: "const SEV_RANK = { P0: 3, P1: 2, P2: 1 };\nconst VALID_CID = new Set(['C1', 'C2', 'C3', 'C4', 'C5', 'C6', 'C7', 'C8']);\nconst isValidSeverity = (s) => s === 'P0' || s === 'P1' || s === 'P2';\nconst CHALLENGE_QUESTIONS = Object.freeze([\n    Object.freeze({\n        id: 'C1',\n        title: 'Architecture anti-cement',\n        prompt: 'Does this plan cement a NEW bad pattern, a wrong boundary, or a shortcut that later work will be ' +\n            'forced to copy? Check it against the product map + vision. IMPORTANT: deviating from a pattern that ' +\n            'is REGISTERED in the accepted-degradations registry is NOT a finding — that debt is already owned. ' +\n            'A genuinely new degradation the plan introduces → name it and propose it for the registry.',\n    }),\n    Object.freeze({\n        id: 'C2',\n        title: 'Production-ready',\n        prompt: 'Where would this fall over in production? Missing error handling, unhandled failure modes, ' +\n            'resource leaks, missing observability, config/secret handling, migration/rollback. Name the ' +\n            'concrete input or condition that breaks it, not a general worry.',\n    }),\n    Object.freeze({\n        id: 'C3',\n        title: 'Test sufficiency + honesty (both ways)',\n        prompt: 'Attack the test plan from BOTH sides. Under-testing: which claim — especially a safety property the ' +\n            'ADR NAMES (\"never X\") — has no falsifying test? A test that cannot fail (a wrapper, a tautology, ' +\n            'asserting the mock) is not coverage. Over-testing: which tests are theater — restating the ' +\n            'implementation, testing the framework, brittle snapshots that verify nothing a user cares about?',\n    }),\n    Object.freeze({\n        id: 'C4',\n        title: 'Overengineering sweep',\n        prompt: 'What in this plan is built for a requirement nobody stated? Speculative generality, an abstraction ' +\n            'with one caller, a config knob no one asked for, a plugin seam for a single case. For each: what is ' +\n            'the simpler thing that meets the ACTUAL requirement?',\n    }),\n    Object.freeze({\n        id: 'C5',\n        title: 'Silent decisions',\n        prompt: 'Which load-bearing decisions did the plan make WITHOUT surfacing them as a decision? A default that ' +\n            'is really a policy, a chosen tradeoff presented as the only option, a dependency added in passing. ' +\n            'Each silent decision the owner did not get to refuse is a finding.',\n    }),\n    Object.freeze({\n        id: 'C6',\n        title: 'Runtime consistency',\n        prompt: 'Will this behave consistently with how the rest of the system already works — same error shape, ' +\n            'same config source, same module/ESM conventions, same logging, same naming? Point to the specific ' +\n            'existing convention the plan contradicts.',\n    }),\n    Object.freeze({\n        id: 'C7',\n        title: 'Scope',\n        prompt: 'Is the plan more than ~1.5× the size the request actually needs? If so, what is the concrete cut ' +\n            'list — which files/steps/abstractions to drop to hit the real requirement — and what is genuinely ' +\n            'load-bearing and must stay?',\n    }),\n    Object.freeze({\n        id: 'C8',\n        title: 'Executability',\n        prompt: 'Could an executor who is NOT the plan author complete every step without coming back to ask what was ' +\n            'meant? Find the steps that are under-specified, assume unstated context, or hide a research task ' +\n            'behind an imperative verb (\"integrate X\", \"wire up Y\") with no concrete how.',\n    }),\n]);\nconst CHALLENGE_VERDICT_SCHEMA = Object.freeze({\n    type: 'object',\n    required: ['findings', 'summary'],\n    properties: {\n        findings: {\n            type: 'array',\n            items: {\n                type: 'object',\n                required: ['c', 'severity', 'title', 'why'],\n                properties: {\n                    c: { type: 'string', enum: ['C1', 'C2', 'C3', 'C4', 'C5', 'C6', 'C7', 'C8'] },\n                    severity: { type: 'string', enum: ['P0', 'P1', 'P2'] },\n                    title: { type: 'string' },\n                    why: { type: 'string', description: 'concrete failing input/condition, not a general worry' },\n                    where: { type: 'string', description: 'plan section / file:line if locatable' },\n                },\n            },\n        },\n        summary: { type: 'string' },\n    },\n});\nconst HR = '─'.repeat(72);\nconst section = (title, body) => body === undefined ? `## ${title}\\n(not provided — panel runs with less calibration)\\n` : `## ${title}\\n${body}\\n`;\nfunction buildChallengeBrief(ctx) {\n    const lines = [];\n    lines.push('# CHALLENGE PANEL — adversarial plan-gate');\n    lines.push('');\n    lines.push('You are a FRESH adversarial reviewer. You did NOT write this plan. Your job is to BREAK it, not to ' +\n        'confirm it — find the concrete way each answer fails, or state plainly that you could not. A finding ' +\n        'is a specific failing input/condition/omission, never a general worry. Every P0/P1 you raise will be ' +\n        'independently cross-validated, so do not pad — theory that cannot be reproduced will be dropped.');\n    lines.push('');\n    lines.push(HR);\n    lines.push(section('PLAN UNDER REVIEW (' + ctx.planPath + ')', ctx.plan === '' ? undefined : ctx.plan));\n    lines.push(section('PRODUCT VISION (boundaries + principles)', ctx.vision));\n    lines.push(section('TESTING POLICY (what \"done\" + honest tests mean here)', ctx.testing));\n    lines.push(section('PRODUCT MAP (subsystems + existing conventions)', ctx.map));\n    lines.push(section('ACCEPTED-DEGRADATIONS REGISTRY (deviating from THESE is NOT a finding)', ctx.degradations));\n    lines.push(section('CODE HINTS', ctx.codeHints));\n    lines.push(HR);\n    lines.push('');\n    lines.push('## Ask each question in \"break it, don\\'t confirm it\" mode');\n    for (const q of CHALLENGE_QUESTIONS) {\n        lines.push('');\n        lines.push(`### ${q.id} — ${q.title}`);\n        lines.push(q.prompt);\n    }\n    lines.push('');\n    lines.push(HR);\n    lines.push('## Output');\n    lines.push('Return findings tagged by C-number with severity P0 (would ship a serious defect / cements bad ' +\n        'architecture), P1 (real gap, fix before code), or P2 (worth noting). For each: a concrete `why` ' +\n        '(the failing input/condition) and `where` if locatable. Then a one-paragraph `summary`. This gate ' +\n        'ADVISES — it does not block; the owner decides.');\n    lines.push('');\n    lines.push('Verdict JSON schema: ' + JSON.stringify(CHALLENGE_VERDICT_SCHEMA));\n    return lines.join('\\n');\n}\nfunction sanitizeFinding(raw) {\n    if (raw === null || typeof raw !== 'object')\n        return null;\n    const r = raw;\n    if (typeof r.c !== 'string' || !VALID_CID.has(r.c))\n        return null;\n    if (!isValidSeverity(r.severity))\n        return null;\n    if (typeof r.title !== 'string' || r.title === '')\n        return null;\n    if (typeof r.why !== 'string' || r.why === '')\n        return null;\n    const out = { c: r.c, severity: r.severity, title: r.title, why: r.why };\n    return typeof r.where === 'string' && r.where !== '' ? { ...out, where: r.where } : out;\n}\nfunction sanitizeVerdict(raw) {\n    if (raw === null || typeof raw !== 'object')\n        return null;\n    const r = raw;\n    if (!Array.isArray(r.findings))\n        return null;\n    const findings = r.findings.map(sanitizeFinding).filter((f) => f !== null);\n    return { findings, summary: typeof r.summary === 'string' ? r.summary : '' };\n}\nfunction findingsNeedingCrossValidation(v) {\n    return [...v.findings]\n        .filter((f) => f.severity === 'P0' || f.severity === 'P1')\n        .sort(cmpFinding);\n}\nfunction cmpFinding(a, b) {\n    const s = SEV_RANK[b.severity] - SEV_RANK[a.severity];\n    if (s !== 0)\n        return s;\n    if (a.c !== b.c)\n        return a.c < b.c ? -1 : 1;\n    return a.title < b.title ? -1 : a.title > b.title ? 1 : 0;\n}\nfunction confirmedVerdict(v, realFlags) {\n    const need = findingsNeedingCrossValidation(v);\n    const kept = v.findings.filter((f) => f.severity === 'P2');\n    need.forEach((f, i) => {\n        if (realFlags[i] === true)\n            kept.push({ ...f, crossValidated: true });\n    });\n    kept.sort(cmpFinding);\n    return { findings: kept, summary: v.summary };\n}\nfunction renderVerdict(v) {\n    if (v.findings.length === 0) {\n        return `Challenge panel: no cross-validated findings. ${v.summary}`.trim();\n    }\n    const byId = (s) => v.findings.filter((f) => f.severity === s).sort(cmpFinding);\n    const out = ['Challenge panel verdict (advisory — you decide):', ''];\n    for (const sev of ['P0', 'P1', 'P2']) {\n        const group = byId(sev);\n        if (group.length === 0)\n            continue;\n        out.push(`### ${sev} (${group.length})`);\n        for (const f of group) {\n            const cv = f.crossValidated ? ' ✓cross-validated' : '';\n            const where = f.where ? ` [${f.where}]` : '';\n            out.push(`- ${f.c} ${f.title}${where}${cv}`);\n            out.push(`  why: ${f.why}`);\n        }\n        out.push('');\n    }\n    out.push(v.summary);\n    return out.join('\\n').trim();\n}\nfunction pickAdversaryModel(plannerModel) {\n    const fam = classifyModelFamily(plannerModel);\n    if (fam === 'claude')\n        return { model: 'codex', note: `plan authored on ${plannerModel} (Claude) → Codex adversary (cross-family)` };\n    if (fam === 'openai')\n        return { model: 'claude', note: `plan authored on ${plannerModel} (OpenAI/Codex) → fresh Claude adversary (cross-family)` };\n    return { model: 'claude', note: `plan author family UNKNOWN (${plannerModel}) → Claude adversary by default; verify it is cross-family before trusting the verdict` };\n}\nfunction classifyModelFamily(model) {\n    const m = String(model).toLowerCase();\n    if (/claude|opus|sonnet|haiku|fable/.test(m))\n        return 'claude';\n    if (/codex|gpt|openai|\\bo[1-9]\\b/.test(m))\n        return 'openai';\n    return 'unknown';\n}",
   },
+  "stage-line": {
+    name: "stage-line",
+    version: "2.0.0",
+    contentHash: "3b921b7b8a38edc8ed7ec544eb792e1f14db1872b87d9bcf3c2daa5839c90675",
+    sourcePath: "packages/@dzhechkov/harness-core/src/stage-line.ts",
+    requires: [],
+    exports: ["STAGE_LINE_REASON_LABELS","STAGE_LINE_BARRIER_STAGES","renderStageIntentLine","renderStageOutcomeLine","renderStageLine"],
+    code: "const STAGE_LINE_REASON_LABELS = {\n    'usage-override': 'usage override (Claude limit pressure)',\n    'explicit-models': 'explicit args.models',\n    'routing-not-requested': 'routing not requested',\n    'coder-knob-codex': 'coder knob = codex',\n    'planner-knob-codex': 'planner knob = codex',\n    'qe-cross-family': 'cross-family QE (the coder never self-reviews)',\n    'budget-table-cell': 'budget table cell',\n    'default-models': 'default models table',\n    'codex-id-substituted': 'unknown codex id — substituted',\n    'spec-unrecognised': 'unrecognised spec — session-inherited',\n    'coder-fallback': 'coder fallback ladder',\n    'codex-unsupported-at-dispatch': 'codex unsupported at this dispatch — Claude',\n    'fallback-after-no-deliverable': 'fallback — the previous rung delivered nothing',\n    'precision-second-pass': 'independent precision second pass',\n    'auto-cost': 'learned-cost routing',\n    'qe-same-family-degraded': 'same-family QE — cross-family review NOT obtained',\n    'challenge-panel': 'adversarial plan-gate panel',\n    'codex-probe-failed': 'codex probe found no usable id — Claude',\n    'codex-refused-before-dispatch': 'codex refused before dispatching — nothing ran',\n    'fallback-rung': 'fallback rung (prior outcome reported separately)',\n};\nconst STAGE_LINE_BARRIER_STAGES = {\n    code: 1,\n    plan: 1,\n    requirements: 1,\n    adr: 1,\n    ideation: 1,\n    architecture: 1,\n};\nfunction renderStagePrefix(stage, decision) {\n    let model = 'session';\n    if (decision && decision.spec)\n        model = decision.spec;\n    return '▸ ' + stage + ' · ' + model;\n}\nfunction renderStageIntentLine(stage, decision) {\n    let signature = '';\n    if (decision) {\n        const labelled = STAGE_LINE_REASON_LABELS[decision.reason];\n        if (labelled)\n            signature = labelled;\n    }\n    if (!signature) {\n        signature = 'unlabelled branch';\n        if (decision && decision.reason)\n            signature = 'unlabelled branch: ' + decision.reason;\n    }\n    let line = renderStagePrefix(stage, decision) + ' · ' + signature;\n    if (STAGE_LINE_BARRIER_STAGES[stage] && decision && decision.opts && decision.opts.agentType === 'codex:codex-rescue') {\n        line = line + ' · landed barrier';\n    }\n    return line + ' · intent';\n}\nfunction renderStageOutcomeLine(stage, decision, outcome) {\n    let model = 'session';\n    if (decision && decision.spec)\n        model = decision.spec;\n    let label = 'dispatched';\n    if (outcome && outcome.state === 'probe-failed')\n        label = 'probe found no usable model';\n    else if (outcome && outcome.state === 'refused-before-dispatch')\n        label = 'refused before dispatch';\n    let line = '◆ ' + stage + ' · ' + model + ' · outcome: ' + label;\n    if (outcome && outcome.state === 'refused-before-dispatch' && outcome.reason === 'codex-unsupported-at-dispatch') {\n        line = line + ' · codex agent type unsupported';\n    }\n    else if (outcome && outcome.state === 'refused-before-dispatch' && outcome.reason) {\n        line = line + ' · reason: ' + outcome.reason;\n    }\n    return line;\n}\nfunction renderStageLine(stage, decision) {\n    const intent = renderStageIntentLine(stage, decision);\n    return intent.slice(0, intent.length - ' · intent'.length);\n}",
+  },
   "trace": {
     name: "trace",
     version: "1.1.0",

package/src/loop-lint.ts

@@ -22,7 +22,7 @@
  */
 
 import { createHash } from 'node:crypto';
-import { toLintProjection, JOIN_POLICIES, QUORUM_RE, type LoopPlan, type LintProjection } from './loop-plan.js';
+import { toLintProjection, stepIdent, JOIN_POLICIES, QUORUM_RE, type LoopPlan, type LintProjection } from './loop-plan.js';
 import type { LoopBlob } from './loop-blobs.generated.js';
 
 export type LintVerdict = 'pass' | 'fail' | 'inconclusive';
@@ -584,6 +584,29 @@ export const TOOL_PERIMETER_ENTRY_RE = /^[a-z][a-z0-9-]*(:[a-z][a-z0-9-]*)+$/;
  * exactly where cfr-pipeline runs it. Plan-less scripts report `inconclusive` (`no-plan-binding`)
  * like every other plan-anchored rule — never a silent pass.
  */
+/**
+ * Текст массива промпта одного шага: содержимое `const P_<ident> = [ … ]` со сбалансированными
+ * скобками. `null`, если такого массива в скрипте нет.
+ *
+ * Скобки считаются, а не ищется первая `]`: строки договора содержат запятые и текст, а соседний
+ * шаг начинается сразу за концом массива — обрыв по первой скобке склеил бы соседей.
+ */
+function promptArrayRegion(code: string, ident: string): string | null {
+  const head = new RegExp(`const\\s+P_${ident.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*\\[`).exec(code);
+  if (head === null) return null;
+  const open = head.index + head[0].length - 1;
+  let depth = 0;
+  for (let i = open; i < code.length; i += 1) {
+    const ch = code[i];
+    if (ch === '[') depth += 1;
+    else if (ch === ']') {
+      depth -= 1;
+      if (depth === 0) return code.slice(open + 1, i);
+    }
+  }
+  return null;   // массив не закрыт — область не установлена, и выдумывать её нельзя
+}
+
 function ruleToolPerimeterDeclared(ctx: Ctx): LintFinding[] {
   if (ctx.projection === null) return noPlan('tool-perimeter-declared');
   const sev: LintSeverity = ctx.mode === 'require-plan' ? 'fail' : 'warn';
@@ -604,13 +627,35 @@ function ruleToolPerimeterDeclared(ctx: Ctx): LintFinding[] {
       }
       seen.add(entry);
     }
-    // script cross-check: the rendered contract line must agree with the DECLARED array — a plan
-    // edit that never re-rendered would otherwise pass on the plan half alone.
-    if (f.tools.length > 0) {
-      const expected = 'declared MCP tool allowlist (plan tools): ' + f.tools.join(', ') + ' — use NOTHING outside it.';
-      if (!ctx.script.includes(expected)) {
-        out.push({ rule: 'tool-perimeter-declared', severity: sev, message: `step ${f.id}: the rendered script carries no contract line matching the declared perimeter [${f.tools.join(', ')}] — the script is stale against the plan, or the perimeter is decorative`, anchor: f.id });
+    // ПЕРЕКРЁСТНАЯ ПРОВЕРКА СО СКРИПТОМ — В ОБЛАСТИ ЭТОГО ШАГА И БЕЗ КОММЕНТАРИЕВ.
+    //
+    // Три слабости прежней редакции, все ПОДТВЕРЖДЕНЫ ревью (бэклог 6b351420) и воспроизведены:
+    //   (а) проверка шла только при `tools.length > 0` — сжатие периметра до `[]` без ре-рендера
+    //       оставляло в скрипте СТАРУЮ строку договора, и правило молчало;
+    //   (б) `ctx.script.includes` искал ГЛОБАЛЬНО — потерянная строка одного шага удовлетворялась
+    //       одинаковым периметром ДРУГОГО шага;
+    //   (в) искали в `ctx.script`, а не в `ctx.code`, поэтому строка договора, перенесённая в
+    //       `//`-комментарий, проходила как настоящая.
+    //
+    // ОБЛАСТЬ ШАГА — ЭТО ЕГО МАССИВ ПРОМПТА `const P_<ident> = [ … ]`, а НЕ область между
+    // маркерами `BEGIN/END step:<id>`. Измерено на отрендеренном плане: строка договора шага
+    // `lane`, раздаваемого веером, лежит в области шага `fan` — привязка к маркерам дала бы
+    // ложное нарушение на каждом веерном шаге.
+    const PERIMETER_PREFIX = 'declared MCP tool allowlist (plan tools): ';
+    const region = promptArrayRegion(ctx.code, stepIdent(f.id));
+    if (region === null && f.tools.length > 0) {
+      // Периметр ОБЪЯВЛЕН, а сверять его не с чем: у шага нет массива промпта в скрипте. Для шага
+      // с ПУСТЫМ периметром отсутствие области — не находка: противоречить там нечему, и краснеть
+      // на всяком ненарендеренном скрипте значило бы изобретать нарушения.
+      out.push({ rule: 'tool-perimeter-declared', severity: sev, message: `step ${f.id}: the script carries no \`const P_${stepIdent(f.id)} = [ … ]\` prompt array — a declared perimeter [${f.tools.join(', ')}] cannot be cross-checked against it at all`, anchor: f.id });
+    } else if (region !== null && f.tools.length > 0) {
+      const expected = PERIMETER_PREFIX + f.tools.join(', ') + ' — use NOTHING outside it.';
+      if (!region.includes(expected)) {
+        out.push({ rule: 'tool-perimeter-declared', severity: sev, message: `step ${f.id}: the step's own prompt carries no contract line matching the declared perimeter [${f.tools.join(', ')}] — the script is stale against the plan, or the perimeter is decorative`, anchor: f.id });
       }
+    } else if (region !== null && region.includes(PERIMETER_PREFIX)) {
+      // Периметр сжали до пустого, а строка договора осталась: скрипт разрешает больше, чем план.
+      out.push({ rule: 'tool-perimeter-declared', severity: sev, message: `step ${f.id}: the plan declares an EMPTY tool perimeter, but the step's prompt still carries a tool-allowlist contract line — the script was not re-rendered and grants more than the plan allows`, anchor: f.id });
     }
   }
   return out;