@dzhechkov/harness-core 0.8.37 → 0.8.39

package/src/publish.ts

@@ -5,8 +5,9 @@
  * @packageDocumentation
  */
 
+import { maskMarkdown } from './markdown-masker.js';
 import { existsSync, readFileSync, writeFileSync, readdirSync, renameSync } from 'node:fs';
-import { join as pathJoin, relative as pathRelative, resolve as pathResolve } from 'node:path';
+import { join as pathJoin, relative as pathRelative, resolve as pathResolve, isAbsolute as pathIsAbsolute, sep as pathSep } from 'node:path';
 
 import { decidePublishSigning, decidePostSigningVerification } from './publish-signing.js';
 import { join } from 'node:path';
@@ -381,6 +382,24 @@ export function publishArgv(mode: ProvenanceMode, env: NodeJS.ProcessEnv): strin
   return decideProvenance(mode, env).useProvenance ? base + ' --provenance' : base;
 }
 
+/** Match substrings against package identity and path without including the checkout root. */
+export function matchesPublishFilter(
+  pkg: { name: string; dir: string },
+  filter: string,
+  monorepoRoot: string,
+): boolean {
+  const normalizedFilter = filter.replace(/\\/g, '/');
+  const relativeDir = pathRelative(pathResolve(monorepoRoot), pathResolve(pkg.dir));
+  // A foreign path must not reintroduce checkout ancestors into the match.
+  const outsideRoot = relativeDir === '..' || relativeDir.startsWith(`..${pathSep}`) || pathIsAbsolute(relativeDir);
+  // Only Windows spells separators with a backslash. On POSIX a backslash is a legal character
+  // INSIDE a directory name, so rewriting it here would invent a separator the filesystem does
+  // not have and over-select that package — the same class as the root-substring defect.
+  const comparableDir = pathSep === '\\' ? relativeDir.replace(/\\/g, '/') : relativeDir;
+  return pkg.name.includes(normalizedFilter)
+    || (!outsideRoot && comparableDir.includes(normalizedFilter));
+}
+
 /** Discover all publishable @dzhechkov packages. */
 export function discoverPackages(monorepoRoot: string): { name: string; dir: string; version: string }[] {
   const baseDir = join(monorepoRoot, 'packages', '@dzhechkov');
@@ -741,21 +760,20 @@ const REGION_END = /^ {0,3}#{1,2}\s/;
 
 /** Blank out fenced-code lines while PRESERVING line numbering, so a `## Status` or an entry-shaped
  *  line inside an example neither starts nor ends the region (the same fence blindness was found in
- *  another checker on the same day). */
+ *  another checker on the same day).
+ *
+ *  Scoping is DELEGATED to the canonical masker, not re-implemented. The local version this replaces
+ *  tracked only the marker CHARACTER and closed on any run of three or more, ignoring CommonMark's
+ *  rule that a closing fence may not be SHORTER than the opening one. MEASURED 2026-09-20: in a
+ *  README whose entry body quotes a markdown example as ````markdown … ```` , the inner ``` closed
+ *  the outer block early, the quoted `## Status` became visible, the region ENDED there, and the
+ *  body line below — `В `1.2.2` эта строка тела …` — lost protection. That is exactly the
+ *  2026-08-25 incident this function exists to stop: a record's body relabelled forward and shipped
+ *  to npm. `unclosed: 'hide'` preserves the local version's policy — an unclosed opener masks to
+ *  end of file, which is also the CommonMark reading.
+ */
 function maskFences(lines: readonly string[]): string[] {
-  const out: string[] = [];
-  let fence: string | null = null;
-  for (const line of lines) {
-    const open = /^ {0,3}(```+|~~~+)/.exec(line);
-    if (fence === null && open !== null && open[1] !== undefined) { fence = open[1][0] as string; out.push(''); continue; }
-    if (fence !== null) {
-      out.push('');
-      if (new RegExp('^ {0,3}' + fence + '{3,}\\s*$').test(line)) fence = null;
-      continue;
-    }
-    out.push(line);
-  }
-  return out;
+  return String(maskMarkdown(lines.join('\n'), { unclosed: 'hide' })).split('\n');
 }
 
 /**
@@ -883,10 +901,14 @@ export function publishPackages(
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
   });
 
+  if (opts.filter?.some((filter) => filter.length === 0)) {
+    throw new Error('publish: --filter requires non-empty package-name substrings (empty would match ALL packages)');
+  }
+
   const packages = discoverPackages(monorepoRoot);
   const results: PublishResult[] = [];
   const filtered = opts.filter && opts.filter.length > 0
-    ? packages.filter((p) => opts.filter!.some((f) => p.name.includes(f) || p.dir.includes(f)))
+    ? packages.filter((p) => opts.filter!.some((f) => matchesPublishFilter(p, f, monorepoRoot)))
     : packages;
   // Publish dependencies before dependents so pnpm rewrites workspace:* to the
   // freshly-bumped version, never a stale one (the harness-cli@0.3.122 breakage).

package/src/qe-bridge.ts

@@ -50,7 +50,10 @@ export const CLAUDE_BRIDGE_PROMPT_CEILING_CHARS = 200_000;
  */
 export const KNOWN_CLAUDE: Record<string, 1> = { opus: 1, sonnet: 1, haiku: 1 };
 
-/** The terminal verdict grammar: `QE-BRIDGE-SIGNOFF grade=<A-F> findings=<n>`. */
+/** The terminal verdict grammar: `QE-BRIDGE-SIGNOFF grade=<A-F, optionally + or -> findings=<n>`.
+ *  bridge-grade-grammar (ddf83072): a live Sonnet review wrote `grade=B-` in all three channels on
+ *  2026-09-17 06:52 and the whole 145-second review was discarded as no-grade-marker, while every
+ *  other consumer (round close, score, recap) already accepted modifiers. */
 export const BRIDGE_MARKER = 'QE-BRIDGE-SIGNOFF';
 
 /** The fenced block's info string. */
@@ -151,6 +154,14 @@ export interface BridgeSignoff {
   promptSha256: string;
   elapsedMs: number;
   emittedAt: string;
+  /** experiment-instrument FR-1/FR-3/T5 (ADR-001): the task identity of the slug's single open
+   *  round at the moment this signoff was emitted — filled by the cli (it owns `.dz/rounds/`), null
+   *  when there was no open round to fill from, never guessed. Optional so a signoff written before
+   *  this feature landed parses unchanged (NFR-1). */
+  taskId?: string | null;
+  /** experiment-instrument FR-1/FR-3/T5: present whenever `taskId` above was filled from a lookup —
+   *  names where it came from (`readOpenRoundTaskId`'s own source, r1-1/r1-2 extended to five values). */
+  taskIdSource?: 'open-round' | 'derived-legacy' | 'no-open-round' | 'ambiguous' | 'unavailable';
 }
 
 /** Where each channel was found, for the audit bundle: an auditor can re-derive the verdict from
@@ -337,7 +348,7 @@ export function defangSignoffEchoes(text: string): string {
   out = out.replace(/qe-bridge-signoff/gi, '[quoted-fence-label]');
   out = out.split(BRIDGE_EXTRACT_END).join('[quoted-boundary]');
   // Line-anchored verdict lines only — prose such as "upgrade the grade later" is untouched.
-  out = out.replace(/^([ \t>*~-]*)(?:\*{0,2}#{0,4}[ \t]*)?GRADE[ \t]*[:=—–-]?[ \t]*([A-F])\b/gim, '$1[quoted-grade] $2');
+  out = out.replace(/^([ \t>*~-]*)(?:\*{0,2}#{0,4}[ \t]*)?GRADE[ \t]*[:=—–-]?[ \t]*([A-F](?:[+-](?![ \t]*[A-F]\b))?)(?![A-Za-z])/gim, '$1[quoted-grade] $2');
   return out;
 }
 
@@ -402,13 +413,14 @@ export function buildBridgePrompt(
     'happen in this environment.',
     '',
     'Output format — ALL THREE parts are required, in this order, at the END of your answer:',
-    '  (a) your review prose, containing exactly ONE line that reads:  GRADE: <A-F>',
+    '  (a) your review prose, containing exactly ONE line that reads:  GRADE: ' + GRADE_PLACEHOLDER,
     '  (b) a fenced code block labelled ' + BRIDGE_FENCE_LABEL + ' whose body is JSON:',
-    '      {"grade":"<A-F>","findings":[{"n":1,"severity":"major","title":"…","file":"path","line":12}]}',
+    '      {"grade":"' + GRADE_PLACEHOLDER + '","findings":[{"n":1,"severity":"major","title":"…","file":"path","line":12}]}',
     '      A genuinely clean review writes "findings": [] — but it must WRITE it.',
-    '  (c) a final line, on its own:  ' + BRIDGE_MARKER + ' grade=<A-F> findings=<n>',
-    'The grade in all three places must be the SAME letter — ONE capital letter A, B, C, D, E or F,',
-    'with NO + or - suffix (write B, never B- or B+; a modifier makes the whole answer unparseable).',
+    '  (c) a final line, on its own:  ' + BRIDGE_MARKER + ' grade=' + GRADE_PLACEHOLDER + ' findings=<n>',
+    'The grade in all three places must be the SAME grade, character for character — one capital',
+    'letter A, B, C, D, E or F, optionally followed by + or -.',
+    'A modifier is fine (B+, B, B-) and is carried through verbatim; what breaks the parse is a RANGE (A-F), prose in place of the letter, or two channels disagreeing.',
     'Anything else is discarded as a failed call — an unparseable answer is treated as no review at',
     'all, never as a passing one.',
     '',
@@ -439,7 +451,14 @@ export function buildBridgePrompt(
 
 /** Line-anchored marker. Leading quote/list decoration is allowed on purpose: a planted marker
  * SHOULD match the grammar — and then lose to the LAST one. Anchoring is the defence, not evasion. */
-const MARKER_LINE = /^[ \t>*~-]*QE-BRIDGE-SIGNOFF[ \t]+grade=([A-F])[ \t]+findings=(\d{1,6})[ \t]*$/gim;
+/** The grade placeholder the reviewer prompt shows in ALL THREE output slots. It lives in one
+ * constant because round-2 review (2026-09-18, HIGH #1 partial) found the opposite: the marker slot
+ * invited a modifier while the prose and JSON slots still read `<A-F>` — which is also the exact
+ * spelling of the RANGE the parser refuses, so the template taught the reviewer to write the one
+ * thing that breaks the parse. One spelling, three slots, no drift. */
+const GRADE_PLACEHOLDER = '<A-F, optionally with + or ->';
+
+const MARKER_LINE = /^[ \t>*~-]*QE-BRIDGE-SIGNOFF[ \t]+grade=([A-F][+-]?)[ \t]+findings=(\d{1,6})[ \t]*$/gim;
 
 /** Fenced `qe-bridge-signoff` block. */
 const SIGNOFF_FENCE = /^[ \t]*(?:`{3,}|~{3,})[ \t]*qe-bridge-signoff[ \t]*\r?\n([\s\S]*?)^[ \t]*(?:`{3,}|~{3,})[ \t]*$/gim;
@@ -530,7 +549,7 @@ export function parseBridgeOutput(
   // channel 1 — the LAST terminal marker line, which must be the FINAL content of the answer
   const marker = lastMatch(MARKER_LINE, text);
   if (marker === null) {
-    return fail('no-grade-marker', 'no `' + BRIDGE_MARKER + ' grade=<A-F> findings=<n>` line anywhere in ' + text.length + ' chars of reviewer output — text without a verdict marker is not a verdict');
+    return fail('no-grade-marker', 'no `' + BRIDGE_MARKER + ' grade=<A-F, optionally with + or -> findings=<n>` line anywhere in ' + text.length + ' chars of reviewer output — text without a verdict marker is not a verdict');
   }
   const markerGrade = String(marker[1]).toUpperCase();
   const markerCount = Number(marker[2]);
@@ -568,8 +587,8 @@ export function parseBridgeOutput(
   }
   const obj = parsedJson as Record<string, unknown>;
   const jsonGradeRaw = obj['grade'];
-  if (typeof jsonGradeRaw !== 'string' || !/^[A-Fa-f]$/.test(jsonGradeRaw.trim())) {
-    return fail('no-signoff-json', 'the fenced JSON block names no `grade` letter A-F (saw ' + JSON.stringify(jsonGradeRaw) + ')');
+  if (typeof jsonGradeRaw !== 'string' || !/^[A-Fa-f][+-]?$/.test(jsonGradeRaw.trim())) {
+    return fail('no-signoff-json', 'the fenced JSON block names no `grade` letter A-F (optionally with + or -) (saw ' + JSON.stringify(jsonGradeRaw) + ')');
   }
   const jsonGrade = jsonGradeRaw.trim().toUpperCase();
   const validated = validateFindings(obj['findings']);

package/src/rake-analyzer.ts

@@ -15,6 +15,7 @@
  */
 
 import { existsSync, readFileSync, readdirSync, statSync, realpathSync } from 'node:fs';
+import { maskMarkdown } from './markdown-masker.js';
 import { join } from 'node:path';
 
 export type Severity = 'blocker' | 'high' | 'medium' | 'low' | 'unknown';
@@ -47,28 +48,67 @@ export interface RakeReport {
 }
 
 export interface RakeSignature { readonly id: string; readonly label: string; readonly patterns: readonly RegExp[] }
+export interface RakeSignatureSpec { readonly id: string; readonly label: string; readonly patterns: readonly string[]; readonly flags?: string }
+
+/**
+ * Decode the data-only signature table. This fails closed: stateful `g`/`y` patterns would make
+ * RegExp.test() depend on lastIndex, which breaks signatureOf's determinism.
+ */
+export function loadRakeSignatures(raw: unknown): readonly RakeSignature[] {
+  if (!Array.isArray(raw)) throw new Error('Rake signatures: expected an array');
+  const signatures = raw.map((entry, index): RakeSignature => {
+    const name = typeof entry === 'object' && entry !== null && typeof (entry as { id?: unknown }).id === 'string'
+      ? (entry as { id: string }).id
+      : `entry #${index}`;
+    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) throw new Error(`Rake signature ${name}: expected an object`);
+    const spec = entry as Partial<RakeSignatureSpec>;
+    if (typeof spec.id !== 'string' || spec.id === '') throw new Error(`Rake signature ${name}: missing id`);
+    if (typeof spec.label !== 'string' || spec.label === '') throw new Error(`Rake signature ${name}: missing label`);
+    if (!Array.isArray(spec.patterns) || spec.patterns.length === 0 || spec.patterns.some((p) => typeof p !== 'string' || p === '')) {
+      throw new Error(`Rake signature ${name}: patterns must be a non-empty string array`);
+    }
+    const flags = spec.flags ?? '';
+    if (typeof flags !== 'string') throw new Error(`Rake signature ${name}: flags must be a string`);
+    if (/[gy]/.test(flags)) throw new Error(`Rake signature ${name}: stateful g/y flags are forbidden`);
+    let patterns: RegExp[];
+    try { patterns = spec.patterns.map((pattern) => new RegExp(pattern, flags)); }
+    catch (error) { throw new Error(`Rake signature ${name}: invalid regular expression (${error instanceof Error ? error.message : String(error)})`); }
+    for (const pattern of patterns) Object.freeze(pattern);
+    return Object.freeze({ id: spec.id, label: spec.label, patterns: Object.freeze(patterns) });
+  });
+  return Object.freeze(signatures);
+}
 
 /**
  * Known rake classes (extensible, data-only). Seeded from the classes that actually recur in this repo's
  * QE reports — that IS the dogfood. First match in order wins; unmatched → normalized-text bucket.
  */
-export const RAKE_SIGNATURES: readonly RakeSignature[] = [
-  { id: 'esm-require-footgun', label: 'ESM lazy require() undefined at runtime', patterns: [/require\(['"]node:/, /\besm\b.*require/i, /lazy require/i] },
-  { id: 'untested-adr-property', label: 'ADR-named safety property left untested', patterns: [/load-bearing.*(untested|not\s+tested|no\s+test)/i, /adr.*names.*(property|test)/i, /safety property.*test/i] },
-  { id: 'claim-check-fp', label: 'claim-check false positive / untagged count', patterns: [/claim-check.*(false positive|\bfp\b)/i, /untagged.*(count|claim)/i, /metric term/i] },
-  // "traversal" alone over-matches (AST/tree traversal); require a filesystem-scope token to CO-OCCUR
-  // (or a literal `../`) — cross-model QE caught the over-match.
-  { id: 'path-traversal', label: 'path not constrained to the repo (traversal)', patterns: [/\.\.\//, /(?=.*travers)(?=.*(repo|root|\bpath\b|director|\/etc\/))/i, /escapes.{0,12}repo/i] },
-  { id: 'silent-drop-or-inject', label: 'silent drop / silent injection (no report)', patterns: [/silent(ly)?\s+(drop|inject|discard|dropped)/i, /no silent (injection|caps|drop)/i] },
-  { id: 'swallow-generic-exception', label: 'generic except/catch swallows real bugs', patterns: [/except\s+Exception/i, /catch.*swallow/i, /generic (exception|catch)/i] },
-  { id: 'determinism-hole', label: 'non-deterministic output (unsorted/clock/random)', patterns: [/non-determinis/i, /determinism hole/i, /unsorted|not sorted/i] },
-  { id: 'cross-model-self-qe', label: 'coder self-QE instead of cross-model', patterns: [/self-qe/i, /coder.*(review|qe).*(itself|self)/i, /cross-model/i] },
-  { id: 'malformed-input-bypass', label: 'malformed input bypasses validation', patterns: [/array.*(pass|bypass)/i, /malformed.*(bypass|pass|manifest)/i, /typeof.*object/i] },
-];
-// Deep-freeze so an external caller can't inject a `/g`-flag regex whose `.test()` mutates lastIndex and
-// makes signatureOf non-deterministic (cross-model QE). None of the patterns above use `g`/`y`.
-for (const s of RAKE_SIGNATURES) { Object.freeze(s.patterns); Object.freeze(s); }
-Object.freeze(RAKE_SIGNATURES);
+/**
+ * Таблица живёт В ПАКЕТЕ, а не в `docs/`, и путь записан ровно как у близнеца
+ * `slop-lint.ts` → `../src/slop-markers.json`: из собранного `dist/` он указывает в `src/`,
+ * который входит в `files[]` и потому ПУБЛИКУЕТСЯ. Запись бэклога предлагала
+ * `docs/methodology/`, но чтение стоит на верхнем уровне модуля — в опубликованном пакете
+ * такого пути нет, и модуль упал бы ПРИ ИМПОРТЕ, утащив за собой каждого потребителя.
+ * Человекочитаемое описание схемы осталось в `docs/methodology/rake-signatures.md`.
+ */
+const RAKE_SIGNATURES_FILE = new URL('../src/rake-signatures.json', import.meta.url);
+export const RAKE_SIGNATURES = loadRakeSignatures(readRakeSignaturesFile(RAKE_SIGNATURES_FILE));
+
+/** Отдельный читатель, чтобы отсутствие или порча файла назывались СВОИМИ ИМЕНАМИ, а не
+ *  прилетали сырым ENOENT/SyntaxError из середины загрузки модуля. */
+function readRakeSignaturesFile(url: URL): unknown {
+  let raw: string;
+  try {
+    raw = readFileSync(url, 'utf8');
+  } catch (err) {
+    throw new Error(`rake-signatures: таблица не найдена по пути ${url.pathname} — пакет собран без src/? (${err instanceof Error ? err.message : String(err)})`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`rake-signatures: ${url.pathname} не разбирается как JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 
 const byStr = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
 const uniqSorted = (xs: readonly string[]): string[] => [...new Set(xs)].sort(byStr);
@@ -97,8 +137,8 @@ const toSeverity = (raw: string): Severity => SEV_MAP[raw.trim().toLowerCase()]
 const SITE_RE = /([\w./-]+\.(?:ts|js|tsx|jsx|py|go|md|json|yml|yaml):\d+)/;
 
 /** The signature of a finding: first matching rule, else the normalized-text bucket. */
-export function signatureOf(finding: Finding): { id: string; label: string } {
-  for (const s of RAKE_SIGNATURES) {
+export function signatureOf(finding: Finding, signatures: readonly RakeSignature[] = RAKE_SIGNATURES): { id: string; label: string } {
+  for (const s of signatures) {
     if (s.patterns.some((p) => p.test(finding.text))) return { id: s.id, label: s.label };
   }
   const key = normalizeText(finding.text);
@@ -115,13 +155,28 @@ export function signatureOf(finding: Finding): { id: string; label: string } {
  */
 export function extractFindings(markdown: string, source: string): Finding[] {
   const out: Finding[] = [];
+  // Строки ВНУТРИ блока кода находками не являются: отчёт QE регулярно показывает ПРИМЕР того,
+  // как писать не надо, и пример оформлен той же таблицей. ИЗМЕРЕНО 2026-09-19: отчёт с одной
+  // настоящей находкой и одной строкой-примером в ```-блоке давал ДВЕ находки.
+  // Маскировщик здесь ОБЩИЙ (`markdown-masker`), тот же, что у `amendment-trace` и у гейта K2 —
+  // запись 8b309a04 просила один проход на весь харнесс, а не третий собственный разбор.
+  // Решение «считать ли строку» принимается по МАСКЕ, а текст находки берётся из ИСХОДНИКА:
+  // маска сохраняет разбиение на строки, но не содержимое.
+  // ОДИН механизм: читаем МАСКУ. Маскировщик заменяет строки внутри блока кода филлером той же
+  // длины и не трогает остальные, поэтому отдельный список «пропустить замаскированные» был бы
+  // ВТОРОЙ защитой — и мутация, снимающая только её, осталась бы эквивалентной (проверено:
+  // 35 тестов из 35 зелёные при «снятой» починке). Ровно тот же капкан, что сегодня в гейте K2.
+  const maskLines = String(maskMarkdown(markdown)).split('\n');
   const push = (severity: Severity, text: string): void => {
     const t = text.replace(/\s+/g, ' ').trim();
     if (t.length < 8) return;                                  // too short to be a finding
     const site = SITE_RE.exec(t)?.[1];
     out.push(site ? { source, severity, text: t, site } : { source, severity, text: t });
   };
-  for (const line of markdown.split('\n')) {
+  const sourceLines = markdown.split('\n');
+  for (let i = 0; i < sourceLines.length; i++) {
+    // Читаем маску, а не исходник: строка, спрятанная блоком кода, до правил ниже не доходит.
+    const line = maskLines[i] ?? sourceLines[i] ?? '';
     // (a) table row: | ... | <sev> | <finding> | ...
     const cells = line.includes('|') ? line.split('|').map((c) => c.trim()) : null;
     if (cells && cells.length >= 4) {

package/src/rake-signatures.json

@@ -0,0 +1,98 @@
+[
+  {
+    "id": "esm-require-footgun",
+    "label": "ESM lazy require() undefined at runtime",
+    "patterns": ["require\\(['\\\"]node:", "\\besm\\b.*require", "lazy require"],
+    "flags": "i"
+  },
+  {
+    "id": "untested-adr-property",
+    "label": "ADR-named safety property left untested",
+    "patterns": ["load-bearing.*(untested|not\\s+tested|no\\s+test)", "adr.*names.*(property|test)", "safety property.*test"],
+    "flags": "i"
+  },
+  {
+    "id": "claim-check-fp",
+    "label": "claim-check false positive / untagged count",
+    "patterns": ["claim-check.*(false positive|\\bfp\\b)", "untagged.*(count|claim)", "metric term"],
+    "flags": "i"
+  },
+  {
+    "id": "path-traversal",
+    "label": "path not constrained to the repo (traversal)",
+    "patterns": ["\\.\\./", "(?=.*travers)(?=.*(repo|root|\\bpath\\b|director|/etc/))", "escapes.{0,12}repo"],
+    "flags": "i"
+  },
+  {
+    "id": "silent-drop-or-inject",
+    "label": "silent drop / silent injection (no report)",
+    "patterns": ["silent(ly)?\\s+(drop|inject|discard|dropped)", "no silent (injection|caps|drop)"],
+    "flags": "i"
+  },
+  {
+    "id": "swallow-generic-exception",
+    "label": "generic except/catch swallows real bugs",
+    "patterns": ["except\\s+Exception", "catch.*swallow", "generic (exception|catch)"],
+    "flags": "i"
+  },
+  {
+    "id": "determinism-hole",
+    "label": "non-deterministic output (unsorted/clock/random)",
+    "patterns": ["non-determinis", "determinism hole", "unsorted|not sorted"],
+    "flags": "i"
+  },
+  {
+    "id": "cross-model-self-qe",
+    "label": "coder self-QE instead of cross-model",
+    "patterns": ["self-qe", "coder.*(review|qe).*(itself|self)", "cross-model", "same-family.{0,40}(qe|review)", "cross-family.{0,60}(not obtained|did not happen|fell back)"],
+    "flags": "i"
+  },
+  {
+    "id": "malformed-input-bypass",
+    "label": "malformed input bypasses validation",
+    "patterns": ["array.*(pass|bypass)", "malformed.*(bypass|pass|manifest)", "typeof.*object"],
+    "flags": "i"
+  },
+  {
+    "id": "wiring-tail",
+    "label": "implementation wiring tail left unfinished",
+    "patterns": ["wiring[-\\s]tail", "wiring-хвост", "незавершённая проводка"],
+    "flags": "i"
+  },
+  {
+    "id": "canonical-copy-edit",
+    "label": "edit made in a canonical copy",
+    "patterns": ["canonical\\s+copy", "каноническ\\w*\\s+коп", "edited in the\\s+\\*\\*canonical\\*\\*\\s+copy"],
+    "flags": "i"
+  },
+  {
+    "id": "zero-or-partial-landing",
+    "label": "zero or partial implementation landing",
+    "patterns": ["zero\\s+code\\s+landed", "genuinely-not-landed", "step\\s*7.{0,50}did not land"],
+    "flags": "i"
+  },
+  {
+    "id": "corpus-preimage-not-repinned",
+    "label": "corpus preimage was not re-pinned",
+    "patterns": ["preimage.{0,80}(never|not).{0,30}re-?pinned", "(?:registry|corpus).{0,40}(?:find|anchor).{0,80}(never|not).{0,30}re-?pinned", "find.{0,10}string was never re-pinned"],
+    "flags": "i"
+  },
+  {
+    "id": "verdict-from-proxy",
+    "label": "verdict inferred from a proxy instead of the subject",
+    "patterns": ["(?:verdict|decision|grade).{0,60}proxy", "proxy.{0,60}(?:verdict|decision|grade|property)", "asserted a\\s+\\*\\*?proxy\\*\\*?.{0,80}not the\\s+\\*\\*?property"],
+    "flags": "i"
+  },
+  {
+    "id": "single-language-book-silence",
+    "label": "book result silently omitted for a single-language query",
+    "patterns": ["books are silent", "книги молчат", "book.{0,50}(silent|silence)"],
+    "flags": "i"
+  },
+  {
+    "id": "reserved-heading-collision",
+    "label": "reserved heading collision",
+    "patterns": ["(?:name|heading).{0,12}collision.{0,60}reused.{0,8}#{1,6}\\s", "reused.{0,8}#{1,6}\\s+scenario coverage", "заголов.{0,50}(?:collision|столкнов)"],
+    "flags": "i"
+  }
+]

package/src/recap.ts

@@ -351,16 +351,20 @@ export function buildRecap(facts: RecapFacts): RecapReport {
     const covered = coveredWindow(v, facts.window);
     const items = (facts.deliveries?.items ?? []).map(normaliseDelivery).filter((d) => withinWindow(covered, d.createdIso));
     const graded = items.filter((d): d is Extract<Delivery, { gradeStatus: 'unique' }> => d.gradeStatus === 'unique');
-    // fix-round-1: 'invalid' (a malformed QE-VERDICT attempt) is folded into the same printed bucket
-    // as 'ambiguous' — both are "no single grade can be trusted", just a different reason.
-    const ambiguous = items.filter((d) => d.gradeStatus === 'ambiguous' || d.gradeStatus === 'invalid');
+    // recap-invalid-bucket (backlog 3bd73eec): the two were printed as ONE number, so a reader could
+    // not tell "the report states two grades" from "the report's verdict line is malformed" — and the
+    // second is a FIXABLE authoring defect in our own artifact, while the first is a real
+    // disagreement between reviews. `dz score --slug` already separated them; recap now does too.
+    const ambiguous = items.filter((d) => d.gradeStatus === 'ambiguous');
+    const invalid = items.filter((d) => d.gradeStatus === 'invalid');
     const ungraded = items.filter((d) => d.gradeStatus === 'none' || d.gradeStatus === 'no-report');
     const lines = sectionLines(v, facts.window, (scope) => items.length === 0
       ? emptyOrUnavailable(v, `no feature directories were created in ${scope}`)
       : [
           `${items.length} feature director${items.length === 1 ? 'y' : 'ies'} created in ${scope}`,
           `${graded.length} carry a grade an independent review stated unambiguously${graded.length > 0 ? `: ${tally(graded.map((d) => d.grade))}` : ''}`,
-          `${ambiguous.length} have a report that states MORE THAN ONE grade or a malformed QE-VERDICT line — reported as ambiguous, never guessed`,
+          `${ambiguous.length} have a report that states MORE THAN ONE grade — reported as ambiguous, never guessed`,
+          `${invalid.length} have a findings table but a MALFORMED or missing QE-VERDICT line — the report cannot be read, which is a formatting problem rather than two reviews disagreeing`,
           `${ungraded.length} have no letter grade in their report, or no report at all`,
           'cadence is not value: this counts deliveries, not what they were worth',
         ]);

package/src/release.ts

@@ -25,7 +25,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import type { Dirent } from 'node:fs';
 import { join, relative } from 'node:path';
 
-import { discoverPackages, orderByDependencies } from './publish.js';
+import { discoverPackages, matchesPublishFilter, orderByDependencies } from './publish.js';
 import { planPackedInstallSmoke, judgePackedInstallSmoke } from './packed-install-smoke.js';
 import type { PackedInstallPlan, PackedInstallExecution } from './packed-install-smoke.js';
 
@@ -243,9 +243,14 @@ export function collectPackageFacts(monorepoRoot: string, filter?: readonly stri
   if (filter !== undefined && filter.length === 0) {
     throw new Error('release: --filter requires a non-empty list of package-name substrings (empty would match ALL packages)');
   }
+  // The twin of the publish guard: an empty ELEMENT matches every name, so the list being
+  // non-empty is not enough. Both doors must be shut or the weaker one becomes the entrance.
+  if (filter?.some((f) => f.length === 0)) {
+    throw new Error('release: --filter requires non-empty package-name substrings (empty would match ALL packages)');
+  }
   const discovered = discoverPackages(monorepoRoot);
   const selected =
-    filter === undefined ? discovered : discovered.filter((p) => filter.some((f) => p.name.includes(f) || p.dir.includes(f)));
+    filter === undefined ? discovered : discovered.filter((p) => filter.some((f) => matchesPublishFilter(p, f, monorepoRoot)));
   const ordered = orderByDependencies(selected);
 
   return ordered.map((p) => {
@@ -727,7 +732,8 @@ export function outputTail(stdout: unknown, stderr: unknown, maxLines = 40, maxB
  * - `token`/`secret`/`password` (case-insensitive) as a `key: value` or `key=value` pair — the
  *   KEY survives, only the value is replaced;
  * - `Bearer <token>` HTTP auth headers;
- * - vendor-prefixed tokens: `npm_…`, `ghp_…`, `sk-…`, `AKIA…`;
+ * - vendor-prefixed tokens: `npm_…`, `ghp_…`, `github_pat_…`, `sk-…` (hyphenated forms whole), `AKIA…`;
+ * - JSON keys (`"token":"…"`) and env-style names ending in TOKEN/SECRET/PASSWORD/API_KEY;
  * - long opaque strings (base64/hex-ish, `[A-Za-z0-9+/=]{32,}`) that look like a key/secret even
  *   without a recognisable prefix.
  * Order matters: prefixed/labelled patterns run BEFORE the generic long-opaque-string pattern so
@@ -738,8 +744,16 @@ export function redactSecrets(text: string): string {
   out = out.replace(/\bBearer\s+\S+/gi, 'Bearer [redacted]');
   out = out.replace(/\bnpm_[A-Za-z0-9]+/g, '[redacted]');
   out = out.replace(/\bghp_[A-Za-z0-9]+/g, '[redacted]');
-  out = out.replace(/\bsk-[A-Za-z0-9]+/g, '[redacted]');
+  out = out.replace(/\bgithub_pat_[A-Za-z0-9_]+/g, '[redacted]');
+  // `sk-proj-…` (and any other hyphenated vendor form) is redacted WHOLE — the old `[A-Za-z0-9]+` stopped
+  // at the first hyphen and let the tail through (MEASURED 2026-09-13, backlog 2df653d9).
+  out = out.replace(/\bsk-[A-Za-z0-9_-]+/g, '[redacted]');
   out = out.replace(/\bAKIA[A-Za-z0-9]+/g, '[redacted]');
+  // JSON keys: `"token":"…"` has a quote between key and colon, so the labelled rule below never saw it.
+  out = out.replace(/"(token|secret|password|api[_-]?key|access[_-]?token)"\s*:\s*"[^"]*"/gi, '"$1":"[redacted]"');
+  // Env-style names that END in a secret word (`GITHUB_TOKEN=`, `NPM_ACCESS_TOKEN=`): `_` is a word
+  // character, so `\btoken` never matched them.
+  out = out.replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY))(\s*[:=]\s*)(\S+)/g, '$1$2[redacted]');
   out = out.replace(/\b(token|secret|password)(\s*[:=]\s*)(\S+)/gi, '$1$2[redacted]');
   out = out.replace(/\b[A-Za-z0-9+/=]{32,}\b/g, '[redacted]');
   return out;

package/src/reqe.ts

@@ -187,7 +187,17 @@ export interface ReqeSettlement {
 export function extractReportGrade(text: string): string | null {
   // the lookahead rejects RANGES in punctuation form (A-F, A/F) AND word form (A through F,
   // A to F) — Codex QE round-2 #6: 'GRADE A through F' must not read as grade A
-  const matches = [...String(text ?? '').matchAll(/^\s*(?:\*{0,2}#{0,4}\s*)?GRADE\s*[:=—–-]?\s*([A-F])\b(?!\s*(?:[-–—/]|through|to|thru)\s*[A-F]\b)/gim)];
+  // bridge-grade-grammar (backlog ddf83072): the rest of the instrument already speaks in modifiers —
+  // `dz round close --grade B-` is accepted and `dz recap` tallies `A-×21` — so a review that writes
+  // `GRADE B-` must be readable here too. The modifier is allowed ONLY when a letter does not follow
+  // it, because `GRADE A-F` is a RANGE (the boilerplate "GRADE A-F + findings"), not an A-minus.
+  // The dash class below is the UNICODE dash family, not just the ASCII hyphen (Codex review HIGH #2):
+  // a reviewer's editor turns `A-F` into `A−F` (U+2212) or `A‐F` (U+2010) without asking, and a range
+  // written that way used to read as a bare `A`. Any dash-family character following the letter means
+  // the text is not a plain grade, so the extractor refuses instead of guessing which half was meant —
+  // the same rule that makes `GRADE B-Critical` null. A modifier is only ever its ASCII form (`+`, `-`).
+  //   hyphen-minus - | hyphen ‐ | non-breaking ‑ | figure ‒ | en – | em — | horizontal bar ― | minus −
+  const matches = [...String(text ?? '').matchAll(/^\s*(?:\*{0,2}#{0,4}\s*)?GRADE\s*[:=‐-―−-]?\s*([A-F](?:[+-](?![ \t]*[A-F]\b))?)(?![A-Za-z])(?![ \t]*[-‐-―−])(?!\s*(?:through|to|thru)\s*[A-F]\b)/gim)];
   const distinct = new Set(matches.map((m) => (m[1] ?? '').toUpperCase()).filter((g) => g !== ''));
   if (distinct.size !== 1) return null;
   return [...distinct][0] ?? null;