@dzhechkov/harness-core 0.8.11 → 0.8.21

package/src/lead-shift-gate.ts

@@ -0,0 +1,145 @@
+/**
+ * Сторож смены лида: отказать в завершении хода, пока санкционированная работа не кончилась.
+ *
+ * ЗАЧЕМ ЭТО СУЩЕСТВУЕТ — два измеренных происшествия, второе после починки первого.
+ *
+ * 2026-08-29: простой ~4,5 часа. Лид «мониторил» задачи, чьи родители давно умерли, и считал
+ * очередь непустой. Лечением стало ПРАВИЛО в `.claude/rules/lead-idle-discipline.md`.
+ *
+ * 2026-09-03: простой **6 часов 24 минуты**. Лид отработал 19:16–23:15, написал утренний отчёт,
+ * ЗАВЕРШИЛ ХОД и молчал до 05:38. Очередь была не просто непустой — 352 открытые записи, и
+ * незакрытая работа была перечислена самим лидом абзацем выше в том же отчёте. Правило,
+ * написанное после первого случая, читалось каждый прогон и не сработало.
+ *
+ * Вывод, который и породил этот файл: **текст второго слоя лестницы стоимости обнаружения не
+ * ловит собственный молчаливый отказ.** Правило нельзя «не выполнить с ошибкой» — его можно
+ * только не вспомнить, и снаружи это неотличимо от выполнения. Поэтому решение переносится на
+ * слой 1: детерминированная функция, у которой есть красный тест.
+ *
+ * СТРУКТУРНАЯ ТРУДНОСТЬ, названная честно: завершение хода — это ОТСУТСТВИЕ дальнейших вызовов,
+ * а не событие. Перехватить «модель перестала работать» нельзя. Зато харнесс даёт шов `Stop`,
+ * который срабатывает на попытке закончить ход и умеет её ЗАБЛОКИРОВАТЬ. Этот файл — решающая
+ * половина такого гейта; вторая половина, тонкий адаптер, живёт в хуке.
+ *
+ * АТАКА, СЛОМАВШАЯ ПЕРВУЮ РЕДАКЦИЮ (Codex gpt-5.6-sol, xhigh, 2026-09-03, вердикт «НЕ СРАБОТАЕТ»).
+ * Первая редакция разрешала ПОВТОРНУЮ остановку автоматически — как защиту от зацикливания.
+ * Приём обхода: получить отказ, ответить «принято, продолжу», не сделать ни одного рабочего
+ * действия, остановиться снова — и второй раз пропускали. Итог был бы тот же простой плюс одна
+ * запись в журнале. Поэтому здесь повторная остановка разрешается НЕ ПО ФАКТУ ПОВТОРНОСТИ, а
+ * только по машинному свидетельству прогресса (см. `hasProgress`).
+ */
+
+/** Машинное свидетельство того, что между двумя попытками остановиться что-то произошло. */
+export interface ProgressEvidence {
+  /** `git rev-parse HEAD` на момент прошлой блокировки и сейчас. */
+  readonly headBefore?: string | undefined;
+  readonly headNow?: string | undefined;
+  /** sha256 от `git status --porcelain` — ловит правку, ещё не ставшую коммитом. */
+  readonly treeHashBefore?: string | undefined;
+  readonly treeHashNow?: string | undefined;
+  /** Идентификаторы живых фоновых задач тогда и сейчас. */
+  readonly liveTasksBefore?: readonly string[] | undefined;
+  readonly liveTasksNow?: readonly string[] | undefined;
+  /**
+   * Пункты очереди, закрытые между попытками, вместе с доказательством закрытия.
+   * `evidenceExists` считает ВЫЗЫВАЮЩИЙ, проверив путь или коммит на существование: закрытие
+   * без существующего доказательства прогрессом не считается, иначе «закрыть» станет строкой.
+   */
+  readonly closedItems?: readonly { readonly id: string; readonly evidenceExists: boolean }[] | undefined;
+}
+
+/** Состояние смены: что владелец санкционировал и в каком режиме идёт работа. */
+export interface LeadShift {
+  /** `autonomous` — владелец отпустил лида работать без присмотра; иначе сторож спит. */
+  readonly mode: 'autonomous' | 'interactive';
+  /** Открытых пунктов в санкционированной очереди. */
+  readonly openItems: number;
+  /** Живая работа: фоновые задачи, чьи родители ЖИВЫ. Пустой список — не повод спать. */
+  readonly liveWork: readonly string[];
+  /** Минут с последнего сообщения ЧЕЛОВЕКА. Свежий разговор — законная причина остановиться. */
+  readonly minutesSinceHuman: number;
+  /** Это повторная попытка остановиться после нашей же блокировки. */
+  readonly stopHookActive: boolean;
+  /** Сколько раз подряд мы уже блокировали в этой смене. */
+  readonly consecutiveBlocks: number;
+  /** Квитанция завершения из закрытого списка: владелец сказал стоп, очередь пуста, работа блокирована. */
+  readonly completionReceipt?: 'owner-stop' | 'queue-empty' | 'blocked-on-owner' | undefined;
+}
+
+/** Что сторож решил и почему. `reason` пишется в журнал инцидентов и показывается лиду. */
+export interface StopDecision {
+  readonly action: 'allow' | 'block' | 'escalate';
+  readonly reason: string;
+  /** Машинный код причины — для журнала и для тестов; текст `reason` меняется, код нет. */
+  readonly code:
+    | 'not-autonomous' | 'receipt' | 'live-work' | 'fresh-human' | 'queue-empty'
+    | 'idle-with-queue' | 'no-progress' | 'budget-exhausted';
+}
+
+/** Потолок блокировок подряд. Ниже харнессового потолка в 8, чтобы решение осталось нашим. */
+export const BLOCK_BUDGET = 3;
+
+/** Свежий разговор с человеком: остановиться сразу после его реплики — законно. */
+export const FRESH_HUMAN_MINUTES = 20;
+
+/**
+ * Было ли между двумя попытками остановиться хоть одно машинно заметное движение.
+ *
+ * Ответ «принято, продолжу работу» не меняет ни коммита, ни дерева, ни списка задач, ни очереди —
+ * и потому прогрессом не является. В этом весь смысл функции: она отличает СЛОВА от ДЕЙСТВИЙ.
+ */
+export function hasProgress(e: ProgressEvidence | undefined): boolean {
+  if (!e) return false;
+  if (e.headBefore && e.headNow && e.headBefore !== e.headNow) return true;
+  if (e.treeHashBefore && e.treeHashNow && e.treeHashBefore !== e.treeHashNow) return true;
+  const before = new Set(e.liveTasksBefore ?? []);
+  if ((e.liveTasksNow ?? []).some((id) => !before.has(id))) return true;
+  // Закрытие пункта считается прогрессом ТОЛЬКО с существующим доказательством: иначе достаточно
+  // объявить пункт закрытым, чтобы получить право замолчать.
+  if ((e.closedItems ?? []).some((c) => c.evidenceExists)) return true;
+  return false;
+}
+
+/**
+ * Решить, можно ли закончить ход.
+ *
+ * Порядок проверок load-bearing: сначала всё, что делает остановку ЗАКОННОЙ, и только потом
+ * запрет. Сторож, который сначала запрещает, будет отключён после первого же ложного срабатывания
+ * на правильной остановке — а отключённый сторож не ловит ничего.
+ */
+export function decideStop(shift: LeadShift, progress?: ProgressEvidence): StopDecision {
+  if (shift.mode !== 'autonomous') {
+    return { action: 'allow', code: 'not-autonomous', reason: 'смена не в автономном режиме — остановка не наше дело' };
+  }
+  if (shift.completionReceipt) {
+    return { action: 'allow', code: 'receipt', reason: `квитанция завершения: ${shift.completionReceipt}` };
+  }
+  if (shift.liveWork.length > 0) {
+    return { action: 'allow', code: 'live-work', reason: `живая работа: ${shift.liveWork.join(', ')}` };
+  }
+  if (shift.minutesSinceHuman < FRESH_HUMAN_MINUTES) {
+    return { action: 'allow', code: 'fresh-human', reason: `человек писал ${shift.minutesSinceHuman} мин назад — разговор идёт` };
+  }
+  if (shift.openItems === 0) {
+    return { action: 'allow', code: 'queue-empty', reason: 'очередь пуста' };
+  }
+  // Дальше — остановка при непустой очереди, без живой работы и без квитанции. Ровно этот случай
+  // произошёл 2026-09-03 и стоил 6 часов 24 минут.
+  if (shift.consecutiveBlocks >= BLOCK_BUDGET) {
+    return {
+      action: 'escalate',
+      code: 'budget-exhausted',
+      reason: `${shift.consecutiveBlocks} блокировки подряд без прогресса — будим владельца и разрешаем остановку`,
+    };
+  }
+  if (shift.stopHookActive && hasProgress(progress)) {
+    return { action: 'allow', code: 'no-progress', reason: 'после прошлой блокировки есть машинный прогресс' };
+  }
+  return {
+    action: 'block',
+    code: shift.stopHookActive ? 'no-progress' : 'idle-with-queue',
+    reason: shift.stopHookActive
+      ? `повторная остановка без единого машинного признака прогресса; открытых пунктов ${shift.openItems}`
+      : `в очереди ${shift.openItems} открытых пунктов, живой работы нет — ход не заканчивается`,
+  };
+}

package/src/ledger-backfill.ts

@@ -59,7 +59,7 @@ export interface LedgerBackfillRow {
   readonly key: LedgerFillKey | null;
   readonly filled: readonly string[];
   /** Why nothing was filled. `null` when something was. */
-  readonly skipped: 'no-join-key' | 'no-host-record' | 'ambiguous-slug' | 'shared-run-claim' | 'already-complete' | 'malformed-line' | 'host-record-empty' | null;
+  readonly skipped: 'no-join-key' | 'no-host-record' | 'ambiguous-slug' | 'shared-run-claim' | 'already-complete' | 'malformed-line' | 'host-record-empty' | 'non-run-row' | null;
 }
 
 export interface LedgerBackfillPlan {
@@ -75,6 +75,17 @@ const FILLABLE = ['tokens', 'minutes', 'agents'] as const;
 
 const isNum = (v: unknown): v is number => typeof v === 'number' && Number.isFinite(v);
 
+/**
+ * fa-phase-statusline QE fix (P2, cross-family review of 656d6903): the ledger now carries
+ * per-PHASE telemetry rows (`kind:"phase"`, schema `feature-adr-phase/1`) alongside its run rows.
+ * The header's contract: the one-line-one-run invariant applies ONLY to rows WITHOUT a `kind`
+ * field, so any row that carries one is NOT a run row and must be invisible to the backfill —
+ * both to claimant counting (several phase rows under a slug were making a real cost row
+ * `shared-run-claim`, unfillable forever) and to filling (exactly one phase row under a slug could
+ * receive the whole run's token total — a fabrication by attribution).
+ */
+export const isNonRunRow = (r: Record<string, unknown>): boolean => typeof r['kind'] === 'string' && r['kind'] !== '';
+
 /**
  * Plan the fill. PURE: takes the ledger's raw lines and a runId→facts lookup, returns the new lines.
  * Nothing is read or written here — the caller owns the file and the atomic replace.
@@ -100,6 +111,7 @@ export function planLedgerBackfill(input: {
       const parsed: unknown = JSON.parse(raw);
       if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) continue;
       const r = parsed as Record<string, unknown>;
+      if (isNonRunRow(r)) continue; // phase rows are telemetry, never claimants
       if (FILLABLE.every((f) => isNum(r[f]))) continue;
       const rid = typeof r['runId'] === 'string' && r['runId'] !== '' ? r['runId'] : null;
       const slg = typeof r['slug'] === 'string' && r['slug'] !== '' ? r['slug'] : null;
@@ -129,6 +141,13 @@ export function planLedgerBackfill(input: {
 
     const runId = typeof row['runId'] === 'string' && row['runId'] !== '' ? row['runId'] : null;
     const slug = typeof row['slug'] === 'string' && row['slug'] !== '' ? row['slug'] : null;
+    if (isNonRunRow(row)) {
+      // A `kind`-carrying row (per-phase telemetry) has no run cost to fill — pass through
+      // unchanged and SAY so, never let it receive a run's numbers.
+      outLines.push(raw);
+      rows.push({ index, runId, slug, key: null, filled: [], skipped: 'non-run-row' });
+      return;
+    }
     const missing = FILLABLE.filter((f) => !isNum(row[f]));
     if (missing.length === 0) {
       outLines.push(raw);

package/src/loop-blobs.generated.ts

@@ -25,7 +25,7 @@ export interface LoopBlob {
   code: string;
 }
 
-export const LOOP_BLOB_NAMES = ["checkpoints","training-pairs","model-resolver","usage-probes","codex-dispatch","challenge-panel","trace","loop-semantics","ha-consult-router"] as const;
+export const LOOP_BLOB_NAMES = ["checkpoints","training-pairs","model-resolver","usage-probes","codex-dispatch","challenge-panel","stage-line","trace","loop-semantics","ha-consult-router"] as const;
 
 /** Workflow files the regen-diff gate covers TODAY (AM-5 honest scope): exactly the files
  * carrying BEGIN BLOB markers. Stage B (whole-file regeneration of feature-adr.js) is a
@@ -61,11 +61,11 @@ export const BLOBS: Record<string, LoopBlob> = {
   "model-resolver": {
     name: "model-resolver",
     version: "1.0.0",
-    contentHash: "fcf8c1dfc4b5364adb6e532565953ef30d94a45070b2b903411170965a1fb372",
+    contentHash: "357a258796e553b2fbe94dfab26cf487a9fd189b4927836f261185215392dfaa",
     sourcePath: "packages/@dzhechkov/harness-core/src/feature-adr-routing.ts",
     requires: [],
     exports: ["specToOpts","resolveStageModel","KNOWN_CODEX","mergeOpts","stageLabel","modelLabel"],
-    code: "const STAGE_EFFORT = { override: {\n        router: 'medium',\n        requirements: 'medium',\n        research: 'medium',\n        adr: 'high',\n        ideation: 'medium',\n        ddd: 'high',\n        architecture: 'high',\n        plan: 'high',\n        code: 'medium',\n        qe: 'high',\n        fleet: 'medium',\n    } };\nfunction topCodexId(env) {\n    return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS.flagship;\n}\nconst KNOWN_CODEX = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };\nconst CODEX_TIERS = {\n    flagship: 'gpt-5.6-sol',\n    workhorse: 'gpt-5.6-terra',\n    'high-volume': 'gpt-5.6-luna',\n};\nfunction codexIdForTier(tier, env) {\n    return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS[tier];\n}\nconst BUDGET_PRESETS = {\n    normal: { claude: 'normal', codex: 'normal' },\n    eco: { claude: 'eco', codex: 'eco' },\n    hybrid: { claude: 'eco', codex: 'normal' },\n};\nfunction resolveBudgetMode(raw) {\n    if (raw === undefined)\n        return BUDGET_PRESETS.normal;\n    if (typeof raw === 'string') {\n        const preset = BUDGET_PRESETS[raw];\n        if (!preset)\n            throw new RangeError('budget: unknown preset \"' + raw + '\" — valid: normal|eco|hybrid');\n        return preset;\n    }\n    if (raw && typeof raw === 'object') {\n        const value = raw;\n        for (const key of Object.keys(value)) {\n            if (key !== 'claude' && key !== 'codex') {\n                throw new RangeError('budget: unknown family key \"' + key + '\" — valid: claude|codex');\n            }\n        }\n        for (const key of ['claude', 'codex']) {\n            const level = value[key];\n            if (level !== undefined && level !== 'normal' && level !== 'eco') {\n                throw new RangeError('budget.' + key + ': unknown level \"' + level + '\" — valid: normal|eco');\n            }\n        }\n        return {\n            claude: value.claude || 'normal',\n            codex: value.codex || 'normal',\n        };\n    }\n    throw new RangeError('budget: expected a preset name or {claude,codex} object, got ' + typeof raw);\n}\nconst CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };\nconst VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1, max: 1 };\nconst DEFAULT_MODELS = {\n    router: 'fable',\n    requirements: 'sonnet',\n    research: 'sonnet',\n    adr: 'opus',\n    ideation: 'sonnet',\n    ddd: 'opus',\n    architecture: 'opus',\n    plan: 'sonnet',\n    code: null,\n    qe: null,\n    fleet: 'sonnet',\n};\nconst ROUTING_TABLES = {\n    claude: {\n        claude: {\n            normal: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'fable', ideation: 'sonnet', ddd: 'fable', architecture: 'fable', plan: 'opus', code: 'sonnet', fleet: 'sonnet' },\n            eco: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'opus', ideation: 'sonnet', ddd: 'opus', architecture: 'opus', plan: 'sonnet', code: 'sonnet', fleet: 'sonnet' },\n        },\n        codex: { normal: {}, eco: {} },\n    },\n    codex: {\n        claude: {\n            normal: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },\n            eco: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },\n        },\n        codex: { normal: {}, eco: {} },\n    },\n};\nfunction codexCell(tier, effort, env) {\n    return 'codex:' + codexIdForTier(tier, env) + ':' + effort;\n}\nfunction budgetTable(primary, mode, env) {\n    const claudeHalf = ROUTING_TABLES[primary].claude[mode.claude];\n    let codexHalf;\n    if (primary === 'claude') {\n        const qeSpec = mode.codex === 'normal'\n            ? codexCell('flagship', 'high', env)\n            : codexCell('workhorse', 'medium', env);\n        codexHalf = { ...ROUTING_TABLES.claude.codex[mode.codex], qe: env.codexAvailable === false ? 'opus' : qeSpec };\n    }\n    else {\n        const normal = mode.codex === 'normal';\n        const design = codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'medium', env);\n        codexHalf = {\n            requirements: design,\n            research: design,\n            adr: design,\n            ideation: design,\n            ddd: design,\n            architecture: design,\n            plan: codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'low', env),\n            code: codexCell(normal ? 'flagship' : 'workhorse', 'medium', env),\n        };\n    }\n    return { ...claudeHalf, ...codexHalf };\n}\nfunction specToOpts(spec, env) {\n    const log = env.log || function () { };\n    if (!spec)\n        return {};\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        let id = parts[1] || env.CODEX_MODEL;\n        if (id !== 'auto' && !KNOWN_CODEX[id]) {\n            log('models: unknown codex id ' + id + ' — using ' + env.CODEX_MODEL);\n            id = env.CODEX_MODEL;\n        }\n        let reasoning = parts[2] || 'high';\n        if (!VALID_REASONING[reasoning]) {\n            throw new RangeError('models: invalid reasoning \"' + reasoning + '\" — valid: ' + Object.keys(VALID_REASONING).join('|'));\n        }\n        return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };\n    }\n    if (CLAUDE_NAMES[head])\n        return { model: head };\n    log('models: unknown spec ' + spec + ' — session-inherited');\n    return {};\n}\nfunction resolveCoderSpec(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return 'codex:' + env.CODEX_MODEL + ':high';\n    return 'opus';\n}\nfunction coderIsCodex(env) {\n    const codeSpec = env.MODELS.code;\n    if (codeSpec !== undefined && codeSpec !== null)\n        return String(codeSpec).split(':')[0] === 'codex';\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return true;\n    return env.primary === 'codex';\n}\nfunction resolveQeSpecForCoder(coderCodex, env) {\n    if (coderCodex)\n        return 'sonnet';\n    const CODEX_AVAILABLE = env.codexAvailable !== false;\n    if (!CODEX_AVAILABLE)\n        return 'opus';\n    const budget = resolveBudgetMode(env.budget);\n    return budget.codex === 'eco'\n        ? 'codex:' + codexIdForTier('workhorse', env) + ':medium'\n        : 'codex:' + codexIdForTier('flagship', env) + ':high';\n}\nfunction resolveQeSpec(env) {\n    return resolveQeSpecForCoder(coderIsCodex(env), env);\n}\nfunction routingRequested(env) {\n    return (Object.keys(env.MODELS).length > 0 ||\n        env.primary !== undefined ||\n        env.budget !== undefined ||\n        env.PLANNER === 'codex' ||\n        env.CODER === 'codex' ||\n        env.CODER === 'codex-fallback' ||\n        env.QE_REVIEWER === 'codex' ||\n        env.QE_REVIEWER === 'codex-fallback');\n}\nfunction resolveStageModel(stage, env) {\n    if (env.usageOverride) {\n        const r = (env.usageReasoning && env.usageReasoning[stage]) || STAGE_EFFORT.override[stage] || 'medium';\n        const o = specToOpts('codex:' + topCodexId(env) + ':' + r, env);\n        o._usageSwitched = true;\n        return o;\n    }\n    let spec = env.MODELS[stage];\n    if (spec === undefined) {\n        if (!routingRequested(env))\n            return {};\n        if (stage === 'code' && (env.CODER === 'codex' || env.CODER === 'codex-fallback')) {\n            return specToOpts(resolveCoderSpec(env), env);\n        }\n        if (stage === 'plan' && env.PLANNER === 'codex') {\n            return specToOpts('codex:' + env.CODEX_MODEL + ':high', env);\n        }\n        if (stage === 'qe') {\n            return specToOpts(resolveQeSpec(env), env);\n        }\n        const resolvedPrimary = env.primary || 'claude';\n        const cell = budgetTable(resolvedPrimary, resolveBudgetMode(env.budget), env)[stage];\n        spec = cell !== undefined ? cell : DEFAULT_MODELS[stage];\n    }\n    if (stage === 'code' && (spec === null || spec === undefined))\n        return specToOpts(resolveCoderSpec(env), env);\n    if (stage === 'qe' && (spec === null || spec === undefined))\n        return specToOpts(resolveQeSpec(env), env);\n    return specToOpts(spec, env);\n}\nfunction modelLabel(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue') {\n        const base = 'codex:' + opts.codexModel + ':' + opts._reasoning;\n        return opts._usageSwitched ? base + ' (usage-switched)' : base;\n    }\n    if (opts && opts.model)\n        return opts.model;\n    return 'session';\n}\nfunction stageLabel(base, opts) {\n    const m = modelLabel(opts);\n    return m === 'session' ? base : base + ' · ' + m;\n}\nfunction mergeOpts(base, extra) {\n    const out = {};\n    for (const k in base)\n        out[k] = base[k];\n    for (const k in extra)\n        out[k] = extra[k];\n    return out;\n}",
+    code: "const STAGE_EFFORT = { override: {\n        router: 'medium',\n        requirements: 'medium',\n        research: 'medium',\n        adr: 'high',\n        ideation: 'medium',\n        ddd: 'high',\n        architecture: 'high',\n        plan: 'high',\n        code: 'medium',\n        qe: 'high',\n        fleet: 'medium',\n    } };\nfunction topCodexId(env) {\n    return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS.flagship;\n}\nconst KNOWN_CODEX = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };\nconst CODEX_TIERS = {\n    flagship: 'gpt-5.6-sol',\n    workhorse: 'gpt-5.6-terra',\n    'high-volume': 'gpt-5.6-luna',\n};\nfunction codexIdForTier(tier, env) {\n    return env.CODEX_MODEL !== 'auto' ? env.CODEX_MODEL : CODEX_TIERS[tier];\n}\nconst BUDGET_PRESETS = {\n    normal: { claude: 'normal', codex: 'normal' },\n    eco: { claude: 'eco', codex: 'eco' },\n    hybrid: { claude: 'eco', codex: 'normal' },\n};\nfunction resolveBudgetMode(raw) {\n    if (raw === undefined)\n        return BUDGET_PRESETS.normal;\n    if (typeof raw === 'string') {\n        const preset = BUDGET_PRESETS[raw];\n        if (!preset)\n            throw new RangeError('budget: unknown preset \"' + raw + '\" — valid: normal|eco|hybrid');\n        return preset;\n    }\n    if (raw && typeof raw === 'object') {\n        const value = raw;\n        for (const key of Object.keys(value)) {\n            if (key !== 'claude' && key !== 'codex') {\n                throw new RangeError('budget: unknown family key \"' + key + '\" — valid: claude|codex');\n            }\n        }\n        for (const key of ['claude', 'codex']) {\n            const level = value[key];\n            if (level !== undefined && level !== 'normal' && level !== 'eco') {\n                throw new RangeError('budget.' + key + ': unknown level \"' + level + '\" — valid: normal|eco');\n            }\n        }\n        return {\n            claude: value.claude || 'normal',\n            codex: value.codex || 'normal',\n        };\n    }\n    throw new RangeError('budget: expected a preset name or {claude,codex} object, got ' + typeof raw);\n}\nconst CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };\nconst VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1, max: 1 };\nconst DEFAULT_MODELS = {\n    router: 'fable',\n    requirements: 'sonnet',\n    research: 'sonnet',\n    adr: 'opus',\n    ideation: 'sonnet',\n    ddd: 'opus',\n    architecture: 'opus',\n    plan: 'sonnet',\n    code: null,\n    qe: null,\n    fleet: 'sonnet',\n};\nconst ROUTING_TABLES = {\n    claude: {\n        claude: {\n            normal: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'fable', ideation: 'sonnet', ddd: 'fable', architecture: 'fable', plan: 'opus', code: 'sonnet', fleet: 'sonnet' },\n            eco: { router: 'sonnet', requirements: 'sonnet', research: 'sonnet', adr: 'opus', ideation: 'sonnet', ddd: 'opus', architecture: 'opus', plan: 'sonnet', code: 'sonnet', fleet: 'sonnet' },\n        },\n        codex: { normal: {}, eco: {} },\n    },\n    codex: {\n        claude: {\n            normal: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },\n            eco: { router: 'sonnet', qe: 'sonnet', fleet: 'sonnet' },\n        },\n        codex: { normal: {}, eco: {} },\n    },\n};\nfunction codexCell(tier, effort, env) {\n    return 'codex:' + codexIdForTier(tier, env) + ':' + effort;\n}\nfunction budgetTable(primary, mode, env) {\n    const claudeHalf = ROUTING_TABLES[primary].claude[mode.claude];\n    let codexHalf;\n    if (primary === 'claude') {\n        const qeSpec = mode.codex === 'normal'\n            ? codexCell('flagship', 'high', env)\n            : codexCell('workhorse', 'medium', env);\n        codexHalf = { ...ROUTING_TABLES.claude.codex[mode.codex], qe: env.codexAvailable === false ? 'opus' : qeSpec };\n    }\n    else {\n        const normal = mode.codex === 'normal';\n        const design = codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'medium', env);\n        codexHalf = {\n            requirements: design,\n            research: design,\n            adr: design,\n            ideation: design,\n            ddd: design,\n            architecture: design,\n            plan: codexCell(normal ? 'flagship' : 'workhorse', normal ? 'high' : 'low', env),\n            code: codexCell(normal ? 'flagship' : 'workhorse', 'medium', env),\n        };\n    }\n    return { ...claudeHalf, ...codexHalf };\n}\nfunction specToOpts(spec, env) {\n    const log = env.log || function () { };\n    if (!spec)\n        return {};\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        let id = parts[1] || env.CODEX_MODEL;\n        if (id !== 'auto' && !KNOWN_CODEX[id]) {\n            log('models: unknown codex id ' + id + ' — using ' + env.CODEX_MODEL);\n            id = env.CODEX_MODEL;\n        }\n        let reasoning = parts[2] || 'high';\n        if (!VALID_REASONING[reasoning]) {\n            throw new RangeError('models: invalid reasoning \"' + reasoning + '\" — valid: ' + Object.keys(VALID_REASONING).join('|'));\n        }\n        return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };\n    }\n    if (CLAUDE_NAMES[head])\n        return { model: head };\n    log('models: unknown spec ' + spec + ' — session-inherited');\n    return {};\n}\nfunction resolveCoderSpec(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return 'codex:' + env.CODEX_MODEL + ':high';\n    return 'opus';\n}\nfunction coderIsCodex(env) {\n    const codeSpec = env.MODELS.code;\n    if (codeSpec !== undefined && codeSpec !== null)\n        return String(codeSpec).split(':')[0] === 'codex';\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return true;\n    return env.primary === 'codex';\n}\nfunction resolveQeSpecForCoder(coderCodex, env) {\n    if (coderCodex)\n        return 'sonnet';\n    const CODEX_AVAILABLE = env.codexAvailable !== false;\n    if (!CODEX_AVAILABLE)\n        return 'opus';\n    const budget = resolveBudgetMode(env.budget);\n    return budget.codex === 'eco'\n        ? 'codex:' + codexIdForTier('workhorse', env) + ':medium'\n        : 'codex:' + codexIdForTier('flagship', env) + ':high';\n}\nfunction resolveQeSpec(env) {\n    return resolveQeSpecForCoder(coderIsCodex(env), env);\n}\nfunction routingRequested(env) {\n    return (Object.keys(env.MODELS).length > 0 ||\n        env.primary !== undefined ||\n        env.budget !== undefined ||\n        env.PLANNER === 'codex' ||\n        env.CODER === 'codex' ||\n        env.CODER === 'codex-fallback' ||\n        env.QE_REVIEWER === 'codex' ||\n        env.QE_REVIEWER === 'codex-fallback');\n}\nfunction resolveStageModel(stage, env) {\n    return resolveStageDecision(stage, env).opts;\n}\nfunction specFamily(spec) {\n    return (spec && String(spec).split(':')[0] === 'codex') ? 'codex' : 'claude';\n}\nfunction qeReasonForFamilies(coderCodex, qeSpec) {\n    if (specFamily(qeSpec) === (coderCodex ? 'codex' : 'claude'))\n        return 'qe-same-family-degraded';\n    return 'qe-cross-family';\n}\nfunction effectiveSpec(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue')\n        return 'codex:' + opts.codexModel + ':' + opts._reasoning;\n    if (opts && opts.model)\n        return opts.model;\n    return null;\n}\nfunction specDegradation(spec, opts, env) {\n    if (!spec)\n        return null;\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        const requested = parts[1] || env.CODEX_MODEL;\n        if (opts.codexModel !== requested)\n            return 'codex-id-substituted';\n        return null;\n    }\n    if (!CLAUDE_NAMES[head])\n        return 'spec-unrecognised';\n    return null;\n}\nfunction decisionFor(base, spec, opts, env) {\n    const deg = specDegradation(spec, opts, env);\n    if (deg !== null)\n        return { opts: opts, spec: effectiveSpec(opts), reason: deg };\n    return { opts: opts, spec: effectiveSpec(opts), reason: base };\n}\nfunction decideFromSpec(base, stage, spec, env) {\n    if (stage === 'code' && (spec === null || spec === undefined)) {\n        const s = resolveCoderSpec(env);\n        return decisionFor(base, s, specToOpts(s, env), env);\n    }\n    if (stage === 'qe' && (spec === null || spec === undefined)) {\n        const s = resolveQeSpec(env);\n        return decisionFor(base, s, specToOpts(s, env), env);\n    }\n    return decisionFor(base, spec, specToOpts(spec, env), env);\n}\nfunction resolveStageDecision(stage, env) {\n    if (env.usageOverride) {\n        const r = (env.usageReasoning && env.usageReasoning[stage]) || STAGE_EFFORT.override[stage] || 'medium';\n        const s = 'codex:' + topCodexId(env) + ':' + r;\n        const o = specToOpts(s, env);\n        o._usageSwitched = true;\n        return decisionFor('usage-override', s, o, env);\n    }\n    const spec = env.MODELS[stage];\n    if (spec !== undefined)\n        return decideFromSpec('explicit-models', stage, spec, env);\n    if (!routingRequested(env))\n        return { opts: {}, spec: null, reason: 'routing-not-requested' };\n    if (stage === 'code' && (env.CODER === 'codex' || env.CODER === 'codex-fallback')) {\n        const s = resolveCoderSpec(env);\n        return decisionFor('coder-knob-codex', s, specToOpts(s, env), env);\n    }\n    if (stage === 'plan' && env.PLANNER === 'codex') {\n        const s = 'codex:' + env.CODEX_MODEL + ':high';\n        return decisionFor('planner-knob-codex', s, specToOpts(s, env), env);\n    }\n    if (stage === 'qe') {\n        const s = resolveQeSpec(env);\n        return decisionFor(qeReasonForFamilies(coderIsCodex(env), s), s, specToOpts(s, env), env);\n    }\n    const resolvedPrimary = env.primary || 'claude';\n    const cell = budgetTable(resolvedPrimary, resolveBudgetMode(env.budget), env)[stage];\n    if (cell !== undefined)\n        return decideFromSpec('budget-table-cell', stage, cell, env);\n    return decideFromSpec('default-models', stage, DEFAULT_MODELS[stage], env);\n}\nfunction modelLabel(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue') {\n        const base = 'codex:' + opts.codexModel + ':' + opts._reasoning;\n        return opts._usageSwitched ? base + ' (usage-switched)' : base;\n    }\n    if (opts && opts.model)\n        return opts.model;\n    return 'session';\n}\nfunction stageLabel(base, opts) {\n    const m = modelLabel(opts);\n    return m === 'session' ? base : base + ' · ' + m;\n}\nfunction mergeOpts(base, extra) {\n    const out = {};\n    for (const k in base)\n        out[k] = base[k];\n    for (const k in extra)\n        out[k] = extra[k];\n    return out;\n}",
   },
   "usage-probes": {
     name: "usage-probes",
@@ -94,6 +94,15 @@ export const BLOBS: Record<string, LoopBlob> = {
     exports: ["CHALLENGE_QUESTIONS","CHALLENGE_VERDICT_SCHEMA","buildChallengeBrief","sanitizeFinding","sanitizeVerdict","findingsNeedingCrossValidation","confirmedVerdict","renderVerdict","pickAdversaryModel","classifyModelFamily"],
     code: "const SEV_RANK = { P0: 3, P1: 2, P2: 1 };\nconst VALID_CID = new Set(['C1', 'C2', 'C3', 'C4', 'C5', 'C6', 'C7', 'C8']);\nconst isValidSeverity = (s) => s === 'P0' || s === 'P1' || s === 'P2';\nconst CHALLENGE_QUESTIONS = Object.freeze([\n    Object.freeze({\n        id: 'C1',\n        title: 'Architecture anti-cement',\n        prompt: 'Does this plan cement a NEW bad pattern, a wrong boundary, or a shortcut that later work will be ' +\n            'forced to copy? Check it against the product map + vision. IMPORTANT: deviating from a pattern that ' +\n            'is REGISTERED in the accepted-degradations registry is NOT a finding — that debt is already owned. ' +\n            'A genuinely new degradation the plan introduces → name it and propose it for the registry.',\n    }),\n    Object.freeze({\n        id: 'C2',\n        title: 'Production-ready',\n        prompt: 'Where would this fall over in production? Missing error handling, unhandled failure modes, ' +\n            'resource leaks, missing observability, config/secret handling, migration/rollback. Name the ' +\n            'concrete input or condition that breaks it, not a general worry.',\n    }),\n    Object.freeze({\n        id: 'C3',\n        title: 'Test sufficiency + honesty (both ways)',\n        prompt: 'Attack the test plan from BOTH sides. Under-testing: which claim — especially a safety property the ' +\n            'ADR NAMES (\"never X\") — has no falsifying test? A test that cannot fail (a wrapper, a tautology, ' +\n            'asserting the mock) is not coverage. Over-testing: which tests are theater — restating the ' +\n            'implementation, testing the framework, brittle snapshots that verify nothing a user cares about?',\n    }),\n    Object.freeze({\n        id: 'C4',\n        title: 'Overengineering sweep',\n        prompt: 'What in this plan is built for a requirement nobody stated? Speculative generality, an abstraction ' +\n            'with one caller, a config knob no one asked for, a plugin seam for a single case. For each: what is ' +\n            'the simpler thing that meets the ACTUAL requirement?',\n    }),\n    Object.freeze({\n        id: 'C5',\n        title: 'Silent decisions',\n        prompt: 'Which load-bearing decisions did the plan make WITHOUT surfacing them as a decision? A default that ' +\n            'is really a policy, a chosen tradeoff presented as the only option, a dependency added in passing. ' +\n            'Each silent decision the owner did not get to refuse is a finding.',\n    }),\n    Object.freeze({\n        id: 'C6',\n        title: 'Runtime consistency',\n        prompt: 'Will this behave consistently with how the rest of the system already works — same error shape, ' +\n            'same config source, same module/ESM conventions, same logging, same naming? Point to the specific ' +\n            'existing convention the plan contradicts.',\n    }),\n    Object.freeze({\n        id: 'C7',\n        title: 'Scope',\n        prompt: 'Is the plan more than ~1.5× the size the request actually needs? If so, what is the concrete cut ' +\n            'list — which files/steps/abstractions to drop to hit the real requirement — and what is genuinely ' +\n            'load-bearing and must stay?',\n    }),\n    Object.freeze({\n        id: 'C8',\n        title: 'Executability',\n        prompt: 'Could an executor who is NOT the plan author complete every step without coming back to ask what was ' +\n            'meant? Find the steps that are under-specified, assume unstated context, or hide a research task ' +\n            'behind an imperative verb (\"integrate X\", \"wire up Y\") with no concrete how.',\n    }),\n]);\nconst CHALLENGE_VERDICT_SCHEMA = Object.freeze({\n    type: 'object',\n    required: ['findings', 'summary'],\n    properties: {\n        findings: {\n            type: 'array',\n            items: {\n                type: 'object',\n                required: ['c', 'severity', 'title', 'why'],\n                properties: {\n                    c: { type: 'string', enum: ['C1', 'C2', 'C3', 'C4', 'C5', 'C6', 'C7', 'C8'] },\n                    severity: { type: 'string', enum: ['P0', 'P1', 'P2'] },\n                    title: { type: 'string' },\n                    why: { type: 'string', description: 'concrete failing input/condition, not a general worry' },\n                    where: { type: 'string', description: 'plan section / file:line if locatable' },\n                },\n            },\n        },\n        summary: { type: 'string' },\n    },\n});\nconst HR = '─'.repeat(72);\nconst section = (title, body) => body === undefined ? `## ${title}\\n(not provided — panel runs with less calibration)\\n` : `## ${title}\\n${body}\\n`;\nfunction buildChallengeBrief(ctx) {\n    const lines = [];\n    lines.push('# CHALLENGE PANEL — adversarial plan-gate');\n    lines.push('');\n    lines.push('You are a FRESH adversarial reviewer. You did NOT write this plan. Your job is to BREAK it, not to ' +\n        'confirm it — find the concrete way each answer fails, or state plainly that you could not. A finding ' +\n        'is a specific failing input/condition/omission, never a general worry. Every P0/P1 you raise will be ' +\n        'independently cross-validated, so do not pad — theory that cannot be reproduced will be dropped.');\n    lines.push('');\n    lines.push(HR);\n    lines.push(section('PLAN UNDER REVIEW (' + ctx.planPath + ')', ctx.plan === '' ? undefined : ctx.plan));\n    lines.push(section('PRODUCT VISION (boundaries + principles)', ctx.vision));\n    lines.push(section('TESTING POLICY (what \"done\" + honest tests mean here)', ctx.testing));\n    lines.push(section('PRODUCT MAP (subsystems + existing conventions)', ctx.map));\n    lines.push(section('ACCEPTED-DEGRADATIONS REGISTRY (deviating from THESE is NOT a finding)', ctx.degradations));\n    lines.push(section('CODE HINTS', ctx.codeHints));\n    lines.push(HR);\n    lines.push('');\n    lines.push('## Ask each question in \"break it, don\\'t confirm it\" mode');\n    for (const q of CHALLENGE_QUESTIONS) {\n        lines.push('');\n        lines.push(`### ${q.id} — ${q.title}`);\n        lines.push(q.prompt);\n    }\n    lines.push('');\n    lines.push(HR);\n    lines.push('## Output');\n    lines.push('Return findings tagged by C-number with severity P0 (would ship a serious defect / cements bad ' +\n        'architecture), P1 (real gap, fix before code), or P2 (worth noting). For each: a concrete `why` ' +\n        '(the failing input/condition) and `where` if locatable. Then a one-paragraph `summary`. This gate ' +\n        'ADVISES — it does not block; the owner decides.');\n    lines.push('');\n    lines.push('Verdict JSON schema: ' + JSON.stringify(CHALLENGE_VERDICT_SCHEMA));\n    return lines.join('\\n');\n}\nfunction sanitizeFinding(raw) {\n    if (raw === null || typeof raw !== 'object')\n        return null;\n    const r = raw;\n    if (typeof r.c !== 'string' || !VALID_CID.has(r.c))\n        return null;\n    if (!isValidSeverity(r.severity))\n        return null;\n    if (typeof r.title !== 'string' || r.title === '')\n        return null;\n    if (typeof r.why !== 'string' || r.why === '')\n        return null;\n    const out = { c: r.c, severity: r.severity, title: r.title, why: r.why };\n    return typeof r.where === 'string' && r.where !== '' ? { ...out, where: r.where } : out;\n}\nfunction sanitizeVerdict(raw) {\n    if (raw === null || typeof raw !== 'object')\n        return null;\n    const r = raw;\n    if (!Array.isArray(r.findings))\n        return null;\n    const findings = r.findings.map(sanitizeFinding).filter((f) => f !== null);\n    return { findings, summary: typeof r.summary === 'string' ? r.summary : '' };\n}\nfunction findingsNeedingCrossValidation(v) {\n    return [...v.findings]\n        .filter((f) => f.severity === 'P0' || f.severity === 'P1')\n        .sort(cmpFinding);\n}\nfunction cmpFinding(a, b) {\n    const s = SEV_RANK[b.severity] - SEV_RANK[a.severity];\n    if (s !== 0)\n        return s;\n    if (a.c !== b.c)\n        return a.c < b.c ? -1 : 1;\n    return a.title < b.title ? -1 : a.title > b.title ? 1 : 0;\n}\nfunction confirmedVerdict(v, realFlags) {\n    const need = findingsNeedingCrossValidation(v);\n    const kept = v.findings.filter((f) => f.severity === 'P2');\n    need.forEach((f, i) => {\n        if (realFlags[i] === true)\n            kept.push({ ...f, crossValidated: true });\n    });\n    kept.sort(cmpFinding);\n    return { findings: kept, summary: v.summary };\n}\nfunction renderVerdict(v) {\n    if (v.findings.length === 0) {\n        return `Challenge panel: no cross-validated findings. ${v.summary}`.trim();\n    }\n    const byId = (s) => v.findings.filter((f) => f.severity === s).sort(cmpFinding);\n    const out = ['Challenge panel verdict (advisory — you decide):', ''];\n    for (const sev of ['P0', 'P1', 'P2']) {\n        const group = byId(sev);\n        if (group.length === 0)\n            continue;\n        out.push(`### ${sev} (${group.length})`);\n        for (const f of group) {\n            const cv = f.crossValidated ? ' ✓cross-validated' : '';\n            const where = f.where ? ` [${f.where}]` : '';\n            out.push(`- ${f.c} ${f.title}${where}${cv}`);\n            out.push(`  why: ${f.why}`);\n        }\n        out.push('');\n    }\n    out.push(v.summary);\n    return out.join('\\n').trim();\n}\nfunction pickAdversaryModel(plannerModel) {\n    const fam = classifyModelFamily(plannerModel);\n    if (fam === 'claude')\n        return { model: 'codex', note: `plan authored on ${plannerModel} (Claude) → Codex adversary (cross-family)` };\n    if (fam === 'openai')\n        return { model: 'claude', note: `plan authored on ${plannerModel} (OpenAI/Codex) → fresh Claude adversary (cross-family)` };\n    return { model: 'claude', note: `plan author family UNKNOWN (${plannerModel}) → Claude adversary by default; verify it is cross-family before trusting the verdict` };\n}\nfunction classifyModelFamily(model) {\n    const m = String(model).toLowerCase();\n    if (/claude|opus|sonnet|haiku|fable/.test(m))\n        return 'claude';\n    if (/codex|gpt|openai|\\bo[1-9]\\b/.test(m))\n        return 'openai';\n    return 'unknown';\n}",
   },
+  "stage-line": {
+    name: "stage-line",
+    version: "2.0.0",
+    contentHash: "3b921b7b8a38edc8ed7ec544eb792e1f14db1872b87d9bcf3c2daa5839c90675",
+    sourcePath: "packages/@dzhechkov/harness-core/src/stage-line.ts",
+    requires: [],
+    exports: ["STAGE_LINE_REASON_LABELS","STAGE_LINE_BARRIER_STAGES","renderStageIntentLine","renderStageOutcomeLine","renderStageLine"],
+    code: "const STAGE_LINE_REASON_LABELS = {\n    'usage-override': 'usage override (Claude limit pressure)',\n    'explicit-models': 'explicit args.models',\n    'routing-not-requested': 'routing not requested',\n    'coder-knob-codex': 'coder knob = codex',\n    'planner-knob-codex': 'planner knob = codex',\n    'qe-cross-family': 'cross-family QE (the coder never self-reviews)',\n    'budget-table-cell': 'budget table cell',\n    'default-models': 'default models table',\n    'codex-id-substituted': 'unknown codex id — substituted',\n    'spec-unrecognised': 'unrecognised spec — session-inherited',\n    'coder-fallback': 'coder fallback ladder',\n    'codex-unsupported-at-dispatch': 'codex unsupported at this dispatch — Claude',\n    'fallback-after-no-deliverable': 'fallback — the previous rung delivered nothing',\n    'precision-second-pass': 'independent precision second pass',\n    'auto-cost': 'learned-cost routing',\n    'qe-same-family-degraded': 'same-family QE — cross-family review NOT obtained',\n    'challenge-panel': 'adversarial plan-gate panel',\n    'codex-probe-failed': 'codex probe found no usable id — Claude',\n    'codex-refused-before-dispatch': 'codex refused before dispatching — nothing ran',\n    'fallback-rung': 'fallback rung (prior outcome reported separately)',\n};\nconst STAGE_LINE_BARRIER_STAGES = {\n    code: 1,\n    plan: 1,\n    requirements: 1,\n    adr: 1,\n    ideation: 1,\n    architecture: 1,\n};\nfunction renderStagePrefix(stage, decision) {\n    let model = 'session';\n    if (decision && decision.spec)\n        model = decision.spec;\n    return '▸ ' + stage + ' · ' + model;\n}\nfunction renderStageIntentLine(stage, decision) {\n    let signature = '';\n    if (decision) {\n        const labelled = STAGE_LINE_REASON_LABELS[decision.reason];\n        if (labelled)\n            signature = labelled;\n    }\n    if (!signature) {\n        signature = 'unlabelled branch';\n        if (decision && decision.reason)\n            signature = 'unlabelled branch: ' + decision.reason;\n    }\n    let line = renderStagePrefix(stage, decision) + ' · ' + signature;\n    if (STAGE_LINE_BARRIER_STAGES[stage] && decision && decision.opts && decision.opts.agentType === 'codex:codex-rescue') {\n        line = line + ' · landed barrier';\n    }\n    return line + ' · intent';\n}\nfunction renderStageOutcomeLine(stage, decision, outcome) {\n    let model = 'session';\n    if (decision && decision.spec)\n        model = decision.spec;\n    let label = 'dispatched';\n    if (outcome && outcome.state === 'probe-failed')\n        label = 'probe found no usable model';\n    else if (outcome && outcome.state === 'refused-before-dispatch')\n        label = 'refused before dispatch';\n    let line = '◆ ' + stage + ' · ' + model + ' · outcome: ' + label;\n    if (outcome && outcome.state === 'refused-before-dispatch' && outcome.reason === 'codex-unsupported-at-dispatch') {\n        line = line + ' · codex agent type unsupported';\n    }\n    else if (outcome && outcome.state === 'refused-before-dispatch' && outcome.reason) {\n        line = line + ' · reason: ' + outcome.reason;\n    }\n    return line;\n}\nfunction renderStageLine(stage, decision) {\n    const intent = renderStageIntentLine(stage, decision);\n    return intent.slice(0, intent.length - ' · intent'.length);\n}",
+  },
   "trace": {
     name: "trace",
     version: "1.1.0",

package/src/loop-lint.ts

@@ -22,7 +22,7 @@
  */
 
 import { createHash } from 'node:crypto';
-import { toLintProjection, JOIN_POLICIES, QUORUM_RE, type LoopPlan, type LintProjection } from './loop-plan.js';
+import { toLintProjection, stepIdent, JOIN_POLICIES, QUORUM_RE, type LoopPlan, type LintProjection } from './loop-plan.js';
 import type { LoopBlob } from './loop-blobs.generated.js';
 
 export type LintVerdict = 'pass' | 'fail' | 'inconclusive';
@@ -584,6 +584,29 @@ export const TOOL_PERIMETER_ENTRY_RE = /^[a-z][a-z0-9-]*(:[a-z][a-z0-9-]*)+$/;
  * exactly where cfr-pipeline runs it. Plan-less scripts report `inconclusive` (`no-plan-binding`)
  * like every other plan-anchored rule — never a silent pass.
  */
+/**
+ * Текст массива промпта одного шага: содержимое `const P_<ident> = [ … ]` со сбалансированными
+ * скобками. `null`, если такого массива в скрипте нет.
+ *
+ * Скобки считаются, а не ищется первая `]`: строки договора содержат запятые и текст, а соседний
+ * шаг начинается сразу за концом массива — обрыв по первой скобке склеил бы соседей.
+ */
+function promptArrayRegion(code: string, ident: string): string | null {
+  const head = new RegExp(`const\\s+P_${ident.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*\\[`).exec(code);
+  if (head === null) return null;
+  const open = head.index + head[0].length - 1;
+  let depth = 0;
+  for (let i = open; i < code.length; i += 1) {
+    const ch = code[i];
+    if (ch === '[') depth += 1;
+    else if (ch === ']') {
+      depth -= 1;
+      if (depth === 0) return code.slice(open + 1, i);
+    }
+  }
+  return null;   // массив не закрыт — область не установлена, и выдумывать её нельзя
+}
+
 function ruleToolPerimeterDeclared(ctx: Ctx): LintFinding[] {
   if (ctx.projection === null) return noPlan('tool-perimeter-declared');
   const sev: LintSeverity = ctx.mode === 'require-plan' ? 'fail' : 'warn';
@@ -604,13 +627,35 @@ function ruleToolPerimeterDeclared(ctx: Ctx): LintFinding[] {
       }
       seen.add(entry);
     }
-    // script cross-check: the rendered contract line must agree with the DECLARED array — a plan
-    // edit that never re-rendered would otherwise pass on the plan half alone.
-    if (f.tools.length > 0) {
-      const expected = 'declared MCP tool allowlist (plan tools): ' + f.tools.join(', ') + ' — use NOTHING outside it.';
-      if (!ctx.script.includes(expected)) {
-        out.push({ rule: 'tool-perimeter-declared', severity: sev, message: `step ${f.id}: the rendered script carries no contract line matching the declared perimeter [${f.tools.join(', ')}] — the script is stale against the plan, or the perimeter is decorative`, anchor: f.id });
+    // ПЕРЕКРЁСТНАЯ ПРОВЕРКА СО СКРИПТОМ — В ОБЛАСТИ ЭТОГО ШАГА И БЕЗ КОММЕНТАРИЕВ.
+    //
+    // Три слабости прежней редакции, все ПОДТВЕРЖДЕНЫ ревью (бэклог 6b351420) и воспроизведены:
+    //   (а) проверка шла только при `tools.length > 0` — сжатие периметра до `[]` без ре-рендера
+    //       оставляло в скрипте СТАРУЮ строку договора, и правило молчало;
+    //   (б) `ctx.script.includes` искал ГЛОБАЛЬНО — потерянная строка одного шага удовлетворялась
+    //       одинаковым периметром ДРУГОГО шага;
+    //   (в) искали в `ctx.script`, а не в `ctx.code`, поэтому строка договора, перенесённая в
+    //       `//`-комментарий, проходила как настоящая.
+    //
+    // ОБЛАСТЬ ШАГА — ЭТО ЕГО МАССИВ ПРОМПТА `const P_<ident> = [ … ]`, а НЕ область между
+    // маркерами `BEGIN/END step:<id>`. Измерено на отрендеренном плане: строка договора шага
+    // `lane`, раздаваемого веером, лежит в области шага `fan` — привязка к маркерам дала бы
+    // ложное нарушение на каждом веерном шаге.
+    const PERIMETER_PREFIX = 'declared MCP tool allowlist (plan tools): ';
+    const region = promptArrayRegion(ctx.code, stepIdent(f.id));
+    if (region === null && f.tools.length > 0) {
+      // Периметр ОБЪЯВЛЕН, а сверять его не с чем: у шага нет массива промпта в скрипте. Для шага
+      // с ПУСТЫМ периметром отсутствие области — не находка: противоречить там нечему, и краснеть
+      // на всяком ненарендеренном скрипте значило бы изобретать нарушения.
+      out.push({ rule: 'tool-perimeter-declared', severity: sev, message: `step ${f.id}: the script carries no \`const P_${stepIdent(f.id)} = [ … ]\` prompt array — a declared perimeter [${f.tools.join(', ')}] cannot be cross-checked against it at all`, anchor: f.id });
+    } else if (region !== null && f.tools.length > 0) {
+      const expected = PERIMETER_PREFIX + f.tools.join(', ') + ' — use NOTHING outside it.';
+      if (!region.includes(expected)) {
+        out.push({ rule: 'tool-perimeter-declared', severity: sev, message: `step ${f.id}: the step's own prompt carries no contract line matching the declared perimeter [${f.tools.join(', ')}] — the script is stale against the plan, or the perimeter is decorative`, anchor: f.id });
       }
+    } else if (region !== null && region.includes(PERIMETER_PREFIX)) {
+      // Периметр сжали до пустого, а строка договора осталась: скрипт разрешает больше, чем план.
+      out.push({ rule: 'tool-perimeter-declared', severity: sev, message: `step ${f.id}: the plan declares an EMPTY tool perimeter, but the step's prompt still carries a tool-allowlist contract line — the script was not re-rendered and grants more than the plan allows`, anchor: f.id });
     }
   }
   return out;

package/src/loop-plan-graph.ts

@@ -34,7 +34,72 @@ export type InterfaceGraph = ReadonlyMap<string, readonly GraphField[]>;
 
 /** Brace-matched interface extraction. A regex-only scan truncates at the first nested brace
  * (inline object fields are everywhere in this file), so bodies are cut by depth counting. */
-export function parseInterfaceGraph(source: string): InterfaceGraph {
+/**
+ * Убрать из текста КОММЕНТАРИИ и СОДЕРЖИМОЕ строковых литералов, сохранив длину и переводы строк.
+ *
+ * ЗАЧЕМ, с воспроизведёнными случаями (ИЗМЕРЕНО 2026-09-04, бэклог f23e97dc). Разбор считал скобки
+ * и точки с запятой по СЫРОМУ тексту, и четыре конструкции давали ТИХО НЕВЕРНЫЙ граф — а граф
+ * решает, достижим ли интерфейс, то есть живой он или мёртвый:
+ *
+ *   • `interface X { note: "смотри Y"; }` — упоминание Y ВНУТРИ строки становилось НАСТОЯЩИМ
+ *     ребром. Мёртвый интерфейс выглядел живым: ложно-зелёное в проверке достижимости.
+ *   • `interface X { note: "a; ref: Y"; }` — точка с запятой внутри строки резала запись, и
+ *     появлялось призрачное поле `ref` со своим ребром.
+ *   • `interface X { // закрывает } раньше\n ref: Y; }` — закрывающая скобка в комментарии
+ *     обрезала тело, и настоящее ребро ТЕРЯЛОСЬ: живой интерфейс выглядел мёртвым.
+ *   • `interface X { kind: "{"; ref: Y; }` — открывающая скобка в строке раздувала тело так, что
+ *     интерфейс вовсе исчезал из графа.
+ *
+ * ДЛИНА СОХРАНЯЕТСЯ НАМЕРЕННО: разбор ниже работает индексами по этому же тексту, и замена на
+ * строку другой длины сдвинула бы каждую последующую позицию. Переводы строк сохраняются, чтобы
+ * номера строк оставались верными, если их когда-нибудь понадобится сообщить.
+ */
+function stripCommentsAndStrings(source: string): string {
+  const out = source.split('');
+  const blank = (from: number, to: number): void => {
+    for (let i = from; i < to && i < out.length; i += 1) {
+      if (out[i] !== '\n') out[i] = ' ';
+    }
+  };
+  let i = 0;
+  while (i < source.length) {
+    const two = source.slice(i, i + 2);
+    if (two === '//') {
+      const end = source.indexOf('\n', i);
+      blank(i, end === -1 ? source.length : end);
+      i = end === -1 ? source.length : end;
+      continue;
+    }
+    if (two === '/*') {
+      const end = source.indexOf('*/', i + 2);
+      const stop = end === -1 ? source.length : end + 2;
+      blank(i, stop);
+      i = stop;
+      continue;
+    }
+    const ch = source[i];
+    if (ch === '"' || ch === "'" || ch === '`') {
+      let j = i + 1;
+      while (j < source.length) {
+        if (source[j] === '\\') { j += 2; continue; }   // экранированный символ не закрывает строку
+        if (source[j] === ch) break;
+        j += 1;
+      }
+      // Гасится СОДЕРЖИМОЕ, а кавычки остаются: тип `"a" | "b"` обязан выглядеть как тип, а не
+      // как склеенное слово.
+      blank(i + 1, Math.min(j, source.length));
+      i = Math.min(j + 1, source.length);
+      continue;
+    }
+    i += 1;
+  }
+  return out.join('');
+}
+
+export function parseInterfaceGraph(rawSource: string): InterfaceGraph {
+  // Комментарии и содержимое строк гасятся ДО подсчёта скобок: иначе `}` в комментарии обрезает
+  // тело, `{` в строке его раздувает, а имя интерфейса внутри строки становится ребром графа.
+  const source = stripCommentsAndStrings(rawSource);
   const names = new Set<string>();
   const headRe = /(?:^|\n)\s*(?:export\s+)?interface\s+([A-Za-z_$][\w$]*)/g;
   for (let m = headRe.exec(source); m !== null; m = headRe.exec(source)) names.add(m[1]!);

package/src/loop-trace.ts

@@ -23,6 +23,7 @@
  * consumed by `dz workflow-trace` and by the fitness suite (same runInvariants, two call sites).
  */
 
+import { isNonRunRow } from './ledger-backfill.js';
 import type { TraceProjection } from './loop-plan.js';
 
 /** Blob version stamp for the emitter half (read by scripts/gen-loop-blobs.mjs). */
@@ -941,10 +942,21 @@ export function assembleTimeline(input: {
     }
   }
   if (input.ledger) {
+    // The source is declared even when every row is filtered out: the file WAS read, and saying so
+    // is the difference between "no cost rows" and "no ledger".
     sources.push('ledger');
     for (const line of input.ledger.split('\n')) {
       const t = line.trim();
-      if (t !== '') rows.push({ seq: 0, kind: 'ledger', label: 'cost', detail: t.slice(0, 160), wallTime: null });
+      if (t === '') continue;
+      // AM-4: `kind`-carrying rows are per-phase TELEMETRY, not cost. Labelling one `cost` in a run
+      // timeline states a cost claim the row does not make — MEASURED 2026-09-06 as a real defect,
+      // not a hypothetical. A malformed line is still shown: unparseable is not "not a cost row".
+      try {
+        const parsed: unknown = JSON.parse(t);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)
+          && isNonRunRow(parsed as Record<string, unknown>)) continue;
+      } catch { /* unparseable → keep it visible, exactly as before */ }
+      rows.push({ seq: 0, kind: 'ledger', label: 'cost', detail: t.slice(0, 160), wallTime: null });
     }
   }
   if (Array.isArray(input.usageEvents)) {

package/src/managed-hooks.ts

@@ -8,8 +8,8 @@
  * obvious way to write it and the wrong one.
  *
  * What differs between the targets is ONLY the attribution predicate, so that is the parameter:
- * the Claude path passes its historical substring list verbatim (bytes must not move — AM-3), the
- * Codex path passes sha-over-manifest (ADR-001 §3: dz never deletes what it cannot prove it wrote).
+ * the Claude path passes its historical command identities, the Codex path passes sha-over-manifest
+ * (ADR-001 §3), and both salvage foreign handlers that share a matcher group with an owned handler.
  *
  * The plan (AM-37) is explicit that the extracted block has **three** outputs, not one: the merged
  * body, the REPORT tail string, and the no-write path (`changed === false`). A golden test on the
@@ -69,10 +69,9 @@ export interface MergeManagedHookOptions {
    * Per-HANDLER salvage for an entry `isManaged` claimed. Given an OWNED entry, return it rebuilt
    * from only the handlers that are NOT ours, or `null` when every handler was ours.
    *
-   * Optional, and absent means the historical whole-entry behaviour — the Claude path passes
-   * nothing and is byte-identical to before (AM-3). The Codex path passes it because attribution at
-   * matcher-group granularity deleted a foreign handler that merely shared a group with dz's
-   * (independent review, finding 6).
+   * Optional, and absent means the historical whole-entry behaviour. Both live registry paths pass
+   * it because attribution at matcher-group granularity would delete a foreign handler that merely
+   * shared a group with dz's (Codex finding 6; Claude delivery review round 19).
    */
   readonly retainForeign?: (entry: ManagedHookEntry, event: string) => ManagedHookEntry | null;
   /** e.g. `'agentdb'` → `merged agentdb hooks (user hooks preserved)`. */

package/src/model-recommender.ts

@@ -54,8 +54,12 @@ const RULE_TEXT =
 
 /** `codex:gpt-5.5:xhigh (usage-switched)` → `gpt-5.5`; claude ids pass through; unknown → null. */
 export function normalizeModelId(raw: unknown): string | null {
-  if (typeof raw !== 'string' || raw === '') return null;
-  let id = raw.replace(/ \(usage-switched\)$/, '').trim();
+  if (typeof raw !== 'string' || raw.trim() === '') return null;
+  // ОБРЕЗКА ИДЁТ ПЕРВОЙ. Прежде метка снималась якорем `$` по СЫРОЙ строке, и один хвостовой
+  // пробел — `codex:gpt-5.5:xhigh (usage-switched) ` — делал весь образец неопознанным (null),
+  // то есть телеметрия молча теряла запись. ИЗМЕРЕНО 2026-09-04: без пробела «gpt-5.5», с
+  // пробелом null.
+  let id = raw.trim().replace(/\s*\(usage-switched\)$/, '').trim();
   const codex = /^codex:([^:]+)(?::[a-z]+)?$/.exec(id);
   if (codex !== null) id = codex[1]!;
   return COST_LADDER.some((r) => r.id === id) ? id : null;
@@ -94,7 +98,14 @@ export function harvestStageOutcomes(records: readonly unknown[]): Harvest {
     if (grade === null) { skipped.noGrade += 1; continue; }
     // Full canonical JSON is intentional: the former 40-character prefix merged distinct records
     // whose stage names shared a long prefix, manufacturing idempotency across different runs.
-    const runId = typeof source['runId'] === 'string' ? source['runId'] : `models:${JSON.stringify(modelsUsed)}`;
+    // ПУСТОЙ runId — НЕ ИДЕНТИФИКАТОР. Прежде проверка была `typeof === 'string'`, и пустая строка
+    // принималась: ВСЕ такие записи схлопывались в один «прогон», а число прогонов и признак
+    // «скормлено» считались по нему. Отсутствующий и пустой теперь одинаково уходят на запасной
+    // ключ по составу моделей.
+    const rawRunId = source['runId'];
+    const runId = typeof rawRunId === 'string' && rawRunId.trim() !== ''
+      ? rawRunId.trim()
+      : `models:${JSON.stringify(modelsUsed)}`;
     const ts = typeof source['timestamp'] === 'string' ? source['timestamp'] : null;
     const tier = typeof result['tier'] === 'string' && result['tier'] !== '' ? result['tier'] : 'unknown';
     let contributed = false;