@dzhechkov/harness-core 0.8.38 → 0.8.39

package/src/rake-analyzer.ts

@@ -15,6 +15,7 @@
  */
 
 import { existsSync, readFileSync, readdirSync, statSync, realpathSync } from 'node:fs';
+import { maskMarkdown } from './markdown-masker.js';
 import { join } from 'node:path';
 
 export type Severity = 'blocker' | 'high' | 'medium' | 'low' | 'unknown';
@@ -47,28 +48,67 @@ export interface RakeReport {
 }
 
 export interface RakeSignature { readonly id: string; readonly label: string; readonly patterns: readonly RegExp[] }
+export interface RakeSignatureSpec { readonly id: string; readonly label: string; readonly patterns: readonly string[]; readonly flags?: string }
+
+/**
+ * Decode the data-only signature table. This fails closed: stateful `g`/`y` patterns would make
+ * RegExp.test() depend on lastIndex, which breaks signatureOf's determinism.
+ */
+export function loadRakeSignatures(raw: unknown): readonly RakeSignature[] {
+  if (!Array.isArray(raw)) throw new Error('Rake signatures: expected an array');
+  const signatures = raw.map((entry, index): RakeSignature => {
+    const name = typeof entry === 'object' && entry !== null && typeof (entry as { id?: unknown }).id === 'string'
+      ? (entry as { id: string }).id
+      : `entry #${index}`;
+    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) throw new Error(`Rake signature ${name}: expected an object`);
+    const spec = entry as Partial<RakeSignatureSpec>;
+    if (typeof spec.id !== 'string' || spec.id === '') throw new Error(`Rake signature ${name}: missing id`);
+    if (typeof spec.label !== 'string' || spec.label === '') throw new Error(`Rake signature ${name}: missing label`);
+    if (!Array.isArray(spec.patterns) || spec.patterns.length === 0 || spec.patterns.some((p) => typeof p !== 'string' || p === '')) {
+      throw new Error(`Rake signature ${name}: patterns must be a non-empty string array`);
+    }
+    const flags = spec.flags ?? '';
+    if (typeof flags !== 'string') throw new Error(`Rake signature ${name}: flags must be a string`);
+    if (/[gy]/.test(flags)) throw new Error(`Rake signature ${name}: stateful g/y flags are forbidden`);
+    let patterns: RegExp[];
+    try { patterns = spec.patterns.map((pattern) => new RegExp(pattern, flags)); }
+    catch (error) { throw new Error(`Rake signature ${name}: invalid regular expression (${error instanceof Error ? error.message : String(error)})`); }
+    for (const pattern of patterns) Object.freeze(pattern);
+    return Object.freeze({ id: spec.id, label: spec.label, patterns: Object.freeze(patterns) });
+  });
+  return Object.freeze(signatures);
+}
 
 /**
  * Known rake classes (extensible, data-only). Seeded from the classes that actually recur in this repo's
  * QE reports — that IS the dogfood. First match in order wins; unmatched → normalized-text bucket.
  */
-export const RAKE_SIGNATURES: readonly RakeSignature[] = [
-  { id: 'esm-require-footgun', label: 'ESM lazy require() undefined at runtime', patterns: [/require\(['"]node:/, /\besm\b.*require/i, /lazy require/i] },
-  { id: 'untested-adr-property', label: 'ADR-named safety property left untested', patterns: [/load-bearing.*(untested|not\s+tested|no\s+test)/i, /adr.*names.*(property|test)/i, /safety property.*test/i] },
-  { id: 'claim-check-fp', label: 'claim-check false positive / untagged count', patterns: [/claim-check.*(false positive|\bfp\b)/i, /untagged.*(count|claim)/i, /metric term/i] },
-  // "traversal" alone over-matches (AST/tree traversal); require a filesystem-scope token to CO-OCCUR
-  // (or a literal `../`) — cross-model QE caught the over-match.
-  { id: 'path-traversal', label: 'path not constrained to the repo (traversal)', patterns: [/\.\.\//, /(?=.*travers)(?=.*(repo|root|\bpath\b|director|\/etc\/))/i, /escapes.{0,12}repo/i] },
-  { id: 'silent-drop-or-inject', label: 'silent drop / silent injection (no report)', patterns: [/silent(ly)?\s+(drop|inject|discard|dropped)/i, /no silent (injection|caps|drop)/i] },
-  { id: 'swallow-generic-exception', label: 'generic except/catch swallows real bugs', patterns: [/except\s+Exception/i, /catch.*swallow/i, /generic (exception|catch)/i] },
-  { id: 'determinism-hole', label: 'non-deterministic output (unsorted/clock/random)', patterns: [/non-determinis/i, /determinism hole/i, /unsorted|not sorted/i] },
-  { id: 'cross-model-self-qe', label: 'coder self-QE instead of cross-model', patterns: [/self-qe/i, /coder.*(review|qe).*(itself|self)/i, /cross-model/i] },
-  { id: 'malformed-input-bypass', label: 'malformed input bypasses validation', patterns: [/array.*(pass|bypass)/i, /malformed.*(bypass|pass|manifest)/i, /typeof.*object/i] },
-];
-// Deep-freeze so an external caller can't inject a `/g`-flag regex whose `.test()` mutates lastIndex and
-// makes signatureOf non-deterministic (cross-model QE). None of the patterns above use `g`/`y`.
-for (const s of RAKE_SIGNATURES) { Object.freeze(s.patterns); Object.freeze(s); }
-Object.freeze(RAKE_SIGNATURES);
+/**
+ * Таблица живёт В ПАКЕТЕ, а не в `docs/`, и путь записан ровно как у близнеца
+ * `slop-lint.ts` → `../src/slop-markers.json`: из собранного `dist/` он указывает в `src/`,
+ * который входит в `files[]` и потому ПУБЛИКУЕТСЯ. Запись бэклога предлагала
+ * `docs/methodology/`, но чтение стоит на верхнем уровне модуля — в опубликованном пакете
+ * такого пути нет, и модуль упал бы ПРИ ИМПОРТЕ, утащив за собой каждого потребителя.
+ * Человекочитаемое описание схемы осталось в `docs/methodology/rake-signatures.md`.
+ */
+const RAKE_SIGNATURES_FILE = new URL('../src/rake-signatures.json', import.meta.url);
+export const RAKE_SIGNATURES = loadRakeSignatures(readRakeSignaturesFile(RAKE_SIGNATURES_FILE));
+
+/** Отдельный читатель, чтобы отсутствие или порча файла назывались СВОИМИ ИМЕНАМИ, а не
+ *  прилетали сырым ENOENT/SyntaxError из середины загрузки модуля. */
+function readRakeSignaturesFile(url: URL): unknown {
+  let raw: string;
+  try {
+    raw = readFileSync(url, 'utf8');
+  } catch (err) {
+    throw new Error(`rake-signatures: таблица не найдена по пути ${url.pathname} — пакет собран без src/? (${err instanceof Error ? err.message : String(err)})`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`rake-signatures: ${url.pathname} не разбирается как JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 
 const byStr = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0);
 const uniqSorted = (xs: readonly string[]): string[] => [...new Set(xs)].sort(byStr);
@@ -97,8 +137,8 @@ const toSeverity = (raw: string): Severity => SEV_MAP[raw.trim().toLowerCase()]
 const SITE_RE = /([\w./-]+\.(?:ts|js|tsx|jsx|py|go|md|json|yml|yaml):\d+)/;
 
 /** The signature of a finding: first matching rule, else the normalized-text bucket. */
-export function signatureOf(finding: Finding): { id: string; label: string } {
-  for (const s of RAKE_SIGNATURES) {
+export function signatureOf(finding: Finding, signatures: readonly RakeSignature[] = RAKE_SIGNATURES): { id: string; label: string } {
+  for (const s of signatures) {
     if (s.patterns.some((p) => p.test(finding.text))) return { id: s.id, label: s.label };
   }
   const key = normalizeText(finding.text);
@@ -115,13 +155,28 @@ export function signatureOf(finding: Finding): { id: string; label: string } {
  */
 export function extractFindings(markdown: string, source: string): Finding[] {
   const out: Finding[] = [];
+  // Строки ВНУТРИ блока кода находками не являются: отчёт QE регулярно показывает ПРИМЕР того,
+  // как писать не надо, и пример оформлен той же таблицей. ИЗМЕРЕНО 2026-09-19: отчёт с одной
+  // настоящей находкой и одной строкой-примером в ```-блоке давал ДВЕ находки.
+  // Маскировщик здесь ОБЩИЙ (`markdown-masker`), тот же, что у `amendment-trace` и у гейта K2 —
+  // запись 8b309a04 просила один проход на весь харнесс, а не третий собственный разбор.
+  // Решение «считать ли строку» принимается по МАСКЕ, а текст находки берётся из ИСХОДНИКА:
+  // маска сохраняет разбиение на строки, но не содержимое.
+  // ОДИН механизм: читаем МАСКУ. Маскировщик заменяет строки внутри блока кода филлером той же
+  // длины и не трогает остальные, поэтому отдельный список «пропустить замаскированные» был бы
+  // ВТОРОЙ защитой — и мутация, снимающая только её, осталась бы эквивалентной (проверено:
+  // 35 тестов из 35 зелёные при «снятой» починке). Ровно тот же капкан, что сегодня в гейте K2.
+  const maskLines = String(maskMarkdown(markdown)).split('\n');
   const push = (severity: Severity, text: string): void => {
     const t = text.replace(/\s+/g, ' ').trim();
     if (t.length < 8) return;                                  // too short to be a finding
     const site = SITE_RE.exec(t)?.[1];
     out.push(site ? { source, severity, text: t, site } : { source, severity, text: t });
   };
-  for (const line of markdown.split('\n')) {
+  const sourceLines = markdown.split('\n');
+  for (let i = 0; i < sourceLines.length; i++) {
+    // Читаем маску, а не исходник: строка, спрятанная блоком кода, до правил ниже не доходит.
+    const line = maskLines[i] ?? sourceLines[i] ?? '';
     // (a) table row: | ... | <sev> | <finding> | ...
     const cells = line.includes('|') ? line.split('|').map((c) => c.trim()) : null;
     if (cells && cells.length >= 4) {

package/src/rake-signatures.json

@@ -0,0 +1,98 @@
+[
+  {
+    "id": "esm-require-footgun",
+    "label": "ESM lazy require() undefined at runtime",
+    "patterns": ["require\\(['\\\"]node:", "\\besm\\b.*require", "lazy require"],
+    "flags": "i"
+  },
+  {
+    "id": "untested-adr-property",
+    "label": "ADR-named safety property left untested",
+    "patterns": ["load-bearing.*(untested|not\\s+tested|no\\s+test)", "adr.*names.*(property|test)", "safety property.*test"],
+    "flags": "i"
+  },
+  {
+    "id": "claim-check-fp",
+    "label": "claim-check false positive / untagged count",
+    "patterns": ["claim-check.*(false positive|\\bfp\\b)", "untagged.*(count|claim)", "metric term"],
+    "flags": "i"
+  },
+  {
+    "id": "path-traversal",
+    "label": "path not constrained to the repo (traversal)",
+    "patterns": ["\\.\\./", "(?=.*travers)(?=.*(repo|root|\\bpath\\b|director|/etc/))", "escapes.{0,12}repo"],
+    "flags": "i"
+  },
+  {
+    "id": "silent-drop-or-inject",
+    "label": "silent drop / silent injection (no report)",
+    "patterns": ["silent(ly)?\\s+(drop|inject|discard|dropped)", "no silent (injection|caps|drop)"],
+    "flags": "i"
+  },
+  {
+    "id": "swallow-generic-exception",
+    "label": "generic except/catch swallows real bugs",
+    "patterns": ["except\\s+Exception", "catch.*swallow", "generic (exception|catch)"],
+    "flags": "i"
+  },
+  {
+    "id": "determinism-hole",
+    "label": "non-deterministic output (unsorted/clock/random)",
+    "patterns": ["non-determinis", "determinism hole", "unsorted|not sorted"],
+    "flags": "i"
+  },
+  {
+    "id": "cross-model-self-qe",
+    "label": "coder self-QE instead of cross-model",
+    "patterns": ["self-qe", "coder.*(review|qe).*(itself|self)", "cross-model", "same-family.{0,40}(qe|review)", "cross-family.{0,60}(not obtained|did not happen|fell back)"],
+    "flags": "i"
+  },
+  {
+    "id": "malformed-input-bypass",
+    "label": "malformed input bypasses validation",
+    "patterns": ["array.*(pass|bypass)", "malformed.*(bypass|pass|manifest)", "typeof.*object"],
+    "flags": "i"
+  },
+  {
+    "id": "wiring-tail",
+    "label": "implementation wiring tail left unfinished",
+    "patterns": ["wiring[-\\s]tail", "wiring-хвост", "незавершённая проводка"],
+    "flags": "i"
+  },
+  {
+    "id": "canonical-copy-edit",
+    "label": "edit made in a canonical copy",
+    "patterns": ["canonical\\s+copy", "каноническ\\w*\\s+коп", "edited in the\\s+\\*\\*canonical\\*\\*\\s+copy"],
+    "flags": "i"
+  },
+  {
+    "id": "zero-or-partial-landing",
+    "label": "zero or partial implementation landing",
+    "patterns": ["zero\\s+code\\s+landed", "genuinely-not-landed", "step\\s*7.{0,50}did not land"],
+    "flags": "i"
+  },
+  {
+    "id": "corpus-preimage-not-repinned",
+    "label": "corpus preimage was not re-pinned",
+    "patterns": ["preimage.{0,80}(never|not).{0,30}re-?pinned", "(?:registry|corpus).{0,40}(?:find|anchor).{0,80}(never|not).{0,30}re-?pinned", "find.{0,10}string was never re-pinned"],
+    "flags": "i"
+  },
+  {
+    "id": "verdict-from-proxy",
+    "label": "verdict inferred from a proxy instead of the subject",
+    "patterns": ["(?:verdict|decision|grade).{0,60}proxy", "proxy.{0,60}(?:verdict|decision|grade|property)", "asserted a\\s+\\*\\*?proxy\\*\\*?.{0,80}not the\\s+\\*\\*?property"],
+    "flags": "i"
+  },
+  {
+    "id": "single-language-book-silence",
+    "label": "book result silently omitted for a single-language query",
+    "patterns": ["books are silent", "книги молчат", "book.{0,50}(silent|silence)"],
+    "flags": "i"
+  },
+  {
+    "id": "reserved-heading-collision",
+    "label": "reserved heading collision",
+    "patterns": ["(?:name|heading).{0,12}collision.{0,60}reused.{0,8}#{1,6}\\s", "reused.{0,8}#{1,6}\\s+scenario coverage", "заголов.{0,50}(?:collision|столкнов)"],
+    "flags": "i"
+  }
+]

package/src/recap.ts

@@ -351,16 +351,20 @@ export function buildRecap(facts: RecapFacts): RecapReport {
     const covered = coveredWindow(v, facts.window);
     const items = (facts.deliveries?.items ?? []).map(normaliseDelivery).filter((d) => withinWindow(covered, d.createdIso));
     const graded = items.filter((d): d is Extract<Delivery, { gradeStatus: 'unique' }> => d.gradeStatus === 'unique');
-    // fix-round-1: 'invalid' (a malformed QE-VERDICT attempt) is folded into the same printed bucket
-    // as 'ambiguous' — both are "no single grade can be trusted", just a different reason.
-    const ambiguous = items.filter((d) => d.gradeStatus === 'ambiguous' || d.gradeStatus === 'invalid');
+    // recap-invalid-bucket (backlog 3bd73eec): the two were printed as ONE number, so a reader could
+    // not tell "the report states two grades" from "the report's verdict line is malformed" — and the
+    // second is a FIXABLE authoring defect in our own artifact, while the first is a real
+    // disagreement between reviews. `dz score --slug` already separated them; recap now does too.
+    const ambiguous = items.filter((d) => d.gradeStatus === 'ambiguous');
+    const invalid = items.filter((d) => d.gradeStatus === 'invalid');
     const ungraded = items.filter((d) => d.gradeStatus === 'none' || d.gradeStatus === 'no-report');
     const lines = sectionLines(v, facts.window, (scope) => items.length === 0
       ? emptyOrUnavailable(v, `no feature directories were created in ${scope}`)
       : [
           `${items.length} feature director${items.length === 1 ? 'y' : 'ies'} created in ${scope}`,
           `${graded.length} carry a grade an independent review stated unambiguously${graded.length > 0 ? `: ${tally(graded.map((d) => d.grade))}` : ''}`,
-          `${ambiguous.length} have a report that states MORE THAN ONE grade or a malformed QE-VERDICT line — reported as ambiguous, never guessed`,
+          `${ambiguous.length} have a report that states MORE THAN ONE grade — reported as ambiguous, never guessed`,
+          `${invalid.length} have a findings table but a MALFORMED or missing QE-VERDICT line — the report cannot be read, which is a formatting problem rather than two reviews disagreeing`,
           `${ungraded.length} have no letter grade in their report, or no report at all`,
           'cadence is not value: this counts deliveries, not what they were worth',
         ]);

package/src/release.ts

@@ -25,7 +25,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import type { Dirent } from 'node:fs';
 import { join, relative } from 'node:path';
 
-import { discoverPackages, orderByDependencies } from './publish.js';
+import { discoverPackages, matchesPublishFilter, orderByDependencies } from './publish.js';
 import { planPackedInstallSmoke, judgePackedInstallSmoke } from './packed-install-smoke.js';
 import type { PackedInstallPlan, PackedInstallExecution } from './packed-install-smoke.js';
 
@@ -243,9 +243,14 @@ export function collectPackageFacts(monorepoRoot: string, filter?: readonly stri
   if (filter !== undefined && filter.length === 0) {
     throw new Error('release: --filter requires a non-empty list of package-name substrings (empty would match ALL packages)');
   }
+  // The twin of the publish guard: an empty ELEMENT matches every name, so the list being
+  // non-empty is not enough. Both doors must be shut or the weaker one becomes the entrance.
+  if (filter?.some((f) => f.length === 0)) {
+    throw new Error('release: --filter requires non-empty package-name substrings (empty would match ALL packages)');
+  }
   const discovered = discoverPackages(monorepoRoot);
   const selected =
-    filter === undefined ? discovered : discovered.filter((p) => filter.some((f) => p.name.includes(f) || p.dir.includes(f)));
+    filter === undefined ? discovered : discovered.filter((p) => filter.some((f) => matchesPublishFilter(p, f, monorepoRoot)));
   const ordered = orderByDependencies(selected);
 
   return ordered.map((p) => {
@@ -727,7 +732,8 @@ export function outputTail(stdout: unknown, stderr: unknown, maxLines = 40, maxB
  * - `token`/`secret`/`password` (case-insensitive) as a `key: value` or `key=value` pair — the
  *   KEY survives, only the value is replaced;
  * - `Bearer <token>` HTTP auth headers;
- * - vendor-prefixed tokens: `npm_…`, `ghp_…`, `sk-…`, `AKIA…`;
+ * - vendor-prefixed tokens: `npm_…`, `ghp_…`, `github_pat_…`, `sk-…` (hyphenated forms whole), `AKIA…`;
+ * - JSON keys (`"token":"…"`) and env-style names ending in TOKEN/SECRET/PASSWORD/API_KEY;
  * - long opaque strings (base64/hex-ish, `[A-Za-z0-9+/=]{32,}`) that look like a key/secret even
  *   without a recognisable prefix.
  * Order matters: prefixed/labelled patterns run BEFORE the generic long-opaque-string pattern so
@@ -738,8 +744,16 @@ export function redactSecrets(text: string): string {
   out = out.replace(/\bBearer\s+\S+/gi, 'Bearer [redacted]');
   out = out.replace(/\bnpm_[A-Za-z0-9]+/g, '[redacted]');
   out = out.replace(/\bghp_[A-Za-z0-9]+/g, '[redacted]');
-  out = out.replace(/\bsk-[A-Za-z0-9]+/g, '[redacted]');
+  out = out.replace(/\bgithub_pat_[A-Za-z0-9_]+/g, '[redacted]');
+  // `sk-proj-…` (and any other hyphenated vendor form) is redacted WHOLE — the old `[A-Za-z0-9]+` stopped
+  // at the first hyphen and let the tail through (MEASURED 2026-09-13, backlog 2df653d9).
+  out = out.replace(/\bsk-[A-Za-z0-9_-]+/g, '[redacted]');
   out = out.replace(/\bAKIA[A-Za-z0-9]+/g, '[redacted]');
+  // JSON keys: `"token":"…"` has a quote between key and colon, so the labelled rule below never saw it.
+  out = out.replace(/"(token|secret|password|api[_-]?key|access[_-]?token)"\s*:\s*"[^"]*"/gi, '"$1":"[redacted]"');
+  // Env-style names that END in a secret word (`GITHUB_TOKEN=`, `NPM_ACCESS_TOKEN=`): `_` is a word
+  // character, so `\btoken` never matched them.
+  out = out.replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY))(\s*[:=]\s*)(\S+)/g, '$1$2[redacted]');
   out = out.replace(/\b(token|secret|password)(\s*[:=]\s*)(\S+)/gi, '$1$2[redacted]');
   out = out.replace(/\b[A-Za-z0-9+/=]{32,}\b/g, '[redacted]');
   return out;

package/src/reqe.ts

@@ -187,7 +187,17 @@ export interface ReqeSettlement {
 export function extractReportGrade(text: string): string | null {
   // the lookahead rejects RANGES in punctuation form (A-F, A/F) AND word form (A through F,
   // A to F) — Codex QE round-2 #6: 'GRADE A through F' must not read as grade A
-  const matches = [...String(text ?? '').matchAll(/^\s*(?:\*{0,2}#{0,4}\s*)?GRADE\s*[:=—–-]?\s*([A-F])\b(?!\s*(?:[-–—/]|through|to|thru)\s*[A-F]\b)/gim)];
+  // bridge-grade-grammar (backlog ddf83072): the rest of the instrument already speaks in modifiers —
+  // `dz round close --grade B-` is accepted and `dz recap` tallies `A-×21` — so a review that writes
+  // `GRADE B-` must be readable here too. The modifier is allowed ONLY when a letter does not follow
+  // it, because `GRADE A-F` is a RANGE (the boilerplate "GRADE A-F + findings"), not an A-minus.
+  // The dash class below is the UNICODE dash family, not just the ASCII hyphen (Codex review HIGH #2):
+  // a reviewer's editor turns `A-F` into `A−F` (U+2212) or `A‐F` (U+2010) without asking, and a range
+  // written that way used to read as a bare `A`. Any dash-family character following the letter means
+  // the text is not a plain grade, so the extractor refuses instead of guessing which half was meant —
+  // the same rule that makes `GRADE B-Critical` null. A modifier is only ever its ASCII form (`+`, `-`).
+  //   hyphen-minus - | hyphen ‐ | non-breaking ‑ | figure ‒ | en – | em — | horizontal bar ― | minus −
+  const matches = [...String(text ?? '').matchAll(/^\s*(?:\*{0,2}#{0,4}\s*)?GRADE\s*[:=‐-―−-]?\s*([A-F](?:[+-](?![ \t]*[A-F]\b))?)(?![A-Za-z])(?![ \t]*[-‐-―−])(?!\s*(?:through|to|thru)\s*[A-F]\b)/gim)];
   const distinct = new Set(matches.map((m) => (m[1] ?? '').toUpperCase()).filter((g) => g !== ''));
   if (distinct.size !== 1) return null;
   return [...distinct][0] ?? null;

package/src/run-records.ts

@@ -141,6 +141,17 @@ function priceLookup(modelId: string, table: Readonly<Record<string, LedgerPrice
   return best;
 }
 
+// instrument-round-b fix-round-1 (Codex r1 HIGH finding 3, ADR-001 D4 amended): `--no-strict` was a
+// BLANKET opt-out — since the one demonstrated automatic writer (the pipeline) always passed it, the
+// new strict-by-default was operationally empty for every real caller. Replaced by a NAMED, SCOPED
+// allowance: the caller states exactly which fields it expects to be incomplete
+// (`allowIncomplete`) and WHY, from a closed set of reason codes — an incomplete row is written only
+// when its actual incompleteness is a SUBSET of what was named AND the reason is recognized.
+// Growing the incompleteness beyond what was declared (e.g. `envelope` going missing tomorrow) is
+// refused, by construction, without anyone having to remember to tighten a flag.
+export const INCOMPLETE_REASON_CODES = ['sandbox-metrics-unavailable', 'manual-entry'] as const;
+export type IncompleteReasonCode = typeof INCOMPLETE_REASON_CODES[number];
+
 export type RecordKind = 'ledger' | 'training-pair';
 
 export type RecordVerdict =
@@ -290,10 +301,22 @@ export function decideRecordWrite(input: {
   /** measurement-integrity FR-5/FR-6: rollout-log + price enrichment for a ledger row. Absent ⇒ zero
    *  behavior change (NFR-1). */
   enrich?: LedgerEnrichInput;
-  /** experiment-instrument FR-2/A3 (ADR-001): when `true`, an AUTO ledger row that would be written
-   *  `complete:false` is refused instead (exit 2, before any write) — a круг-B default candidate, opt-
-   *  in today so nothing that already writes incomplete auto rows starts failing underfoot (NFR-1). */
-  strict?: boolean;
+  /**
+   * instrument-round-b FR-4/A5 (ADR-001 D4), fix-round-1 (Codex r1 HIGH finding 3): an AUTO ledger
+   * row that would be written `complete:false` is refused (exit 2, before any write) UNLESS the
+   * actual incompleteness is fully covered by this NAMED, SCOPED allowance — the CLI's
+   * `--allow-incomplete <fields>`. A field this row is incomplete in that is NOT in this set still
+   * refuses, naming exactly the uncovered field(s). `--no-strict` (a blanket opt-out) is gone —
+   * see {@link INCOMPLETE_REASON_CODES}.
+   */
+  allowIncomplete?: readonly string[];
+  /**
+   * instrument-round-b fix-round-1 (Codex r1 HIGH finding 3): WHY the row is legitimately
+   * incomplete — the CLI's `--incomplete-reason <code>`, required alongside `allowIncomplete` and
+   * validated against the closed {@link INCOMPLETE_REASON_CODES} set. An unrecognized or absent
+   * reason refuses the write even when every incomplete field IS named in `allowIncomplete`.
+   */
+  incompleteReason?: string | null;
 }): RecordDecision {
   const { kind, payloadRaw, stage } = input;
   if (kind !== 'ledger' && kind !== 'training-pair') {
@@ -354,7 +377,20 @@ export function decideRecordWrite(input: {
   // carry `auto:true` too (not just gate on it transiently), so every downstream reader of the
   // PERSISTED line keeps seeing the same signal `shapeMismatch` already gated on above. A no-op when
   // the payload already said `auto:true` (shapeMismatch already refused any OTHER value).
-  if (kind === 'ledger' && input.auto === true) stamped['auto'] = true;
+  // Lead delta after Codex r2 (N1 HIGH): `auto:true` used to be indistinguishable between "the
+  // CLI-level trusted marker was present" and "a hand-built payload said so", so a manual row could
+  // read as an automatic one. STRIPPING the claim was tried and rejected: the minutes-delta contract
+  // (auto + runId) legitimately rides payload-declared auto rows, and 28 existing callers write
+  // them. So the claim SURVIVES and its PROVENANCE is recorded instead — `autoSource` is the field a
+  // reader filters on when it needs trusted automatic rows only.
+  if (kind === 'ledger') {
+    if (input.auto === true) {
+      stamped['auto'] = true;
+      stamped['autoSource'] = 'cli-flag';
+    } else if (stamped['auto'] === true) {
+      stamped['autoSource'] = 'payload-claim';
+    }
+  }
   const isGap = (v: unknown): boolean => v === null || v === undefined || (typeof v === 'string' && v.trim() === '');
   if (input.timestamp != null && input.timestamp !== '') {
     // An EMPTY STRING is a gap, not a value. Stamping only over null/undefined let
@@ -598,11 +634,43 @@ export function decideRecordWrite(input: {
       ? [...new Set([...existingReasons, ...incompleteReasons])]
       : incompleteReasons;
     const complete = mergedReasons.length === 0 && !existingWasIncomplete;
-    // A3: under `--strict`, incompleteness is a REFUSAL — before any write, the target untouched —
-    // rather than a loudly-marked write. Without `--strict` (the default today; круг-B may flip it),
-    // the row is still written, just honestly marked `complete:false` with its reasons.
-    if (input.strict === true && !complete) {
-      return refuse(`auto ledger row is incomplete (${mergedReasons.join(', ') || 'previously marked incomplete'}) — refused under --strict before any write`);
+    // A3/A5 (круг B, ADR-001 D4), fix-round-1 (Codex r1 HIGH finding 3, finding 9): incompleteness
+    // is a REFUSAL by DEFAULT, before any write — but the escape hatch is now a NAMED, SCOPED
+    // allowance, not a blanket flag: the row writes only when EVERY name in `mergedReasons` is
+    // covered by `input.allowIncomplete` AND `input.incompleteReason` is one of the closed
+    // {@link INCOMPLETE_REASON_CODES}. This is the load-bearing condition finding 9 asked for a
+    // real discriminating mutation against — an omitted allowance (the ordinary caller who never
+    // heard of this option) refuses exactly like круг B's original default; a caller naming the
+    // wrong reason, or a wider incompleteness than it declared, ALSO refuses.
+    // Lead delta after Codex r2 (N3 MEDIUM): the closed-list check used to live INSIDE the
+    // incomplete branch, so a COMPLETE row could carry `--incomplete-reason bogus` and be written
+    // with an unrecognized code sitting in its arguments. A supplied reason is validated whenever it
+    // is supplied, complete or not.
+    const suppliedReason = input.incompleteReason ?? null;
+    if (suppliedReason !== null && !(INCOMPLETE_REASON_CODES as readonly string[]).includes(suppliedReason)) {
+      return refuse(`--incomplete-reason ${JSON.stringify(suppliedReason)} is not a recognized reason code — expected one of ${INCOMPLETE_REASON_CODES.join(', ')}`);
+    }
+    if (!complete) {
+      const allowedFields = new Set(input.allowIncomplete ?? []);
+      const reason = suppliedReason;
+      const reasonKnown = reason !== null && (INCOMPLETE_REASON_CODES as readonly string[]).includes(reason);
+      // Lead delta after Codex r2 (N2 HIGH): a payload marked `complete:false` with NO concrete
+      // reasons cannot be covered by any allowance — the subset relation has nothing to check, so
+      // `uncovered` came out empty and the row slipped through. An unexplained incompleteness is a
+      // refusal: name the fields, or do not claim incompleteness.
+      if (mergedReasons.length === 0) {
+        return refuse('auto ledger row is marked `complete:false` but names no incompleteReasons — an allowance cannot cover an unnamed gap; list the incomplete field(s) or drop the claim');
+      }
+      const uncovered = mergedReasons.filter((r) => !allowedFields.has(r));
+      if (uncovered.length > 0 || !reasonKnown) {
+        if (reason === null && allowedFields.size === 0) {
+          return refuse(`auto ledger row is incomplete (${mergedReasons.join(', ') || 'previously marked incomplete'}) — refused by default; pass --allow-incomplete <fields> and --incomplete-reason <code> to permit a scoped incomplete write`);
+        }
+        if (!reasonKnown) {
+          return refuse(`--incomplete-reason ${JSON.stringify(reason)} is not a recognized reason code — expected one of ${INCOMPLETE_REASON_CODES.join(', ')}`);
+        }
+        return refuse(`auto ledger row is incomplete in field(s) not covered by --allow-incomplete: ${uncovered.join(', ')} (incomplete: ${mergedReasons.join(', ') || 'previously marked incomplete'})`);
+      }
     }
     stamped['complete'] = complete;
     if (!complete) stamped['incompleteReasons'] = mergedReasons.length > 0 ? mergedReasons : existingReasons;

package/src/score.ts

@@ -20,6 +20,7 @@
  * PURE: the CLI reads the artifact files; this module only classifies.
  */
 
+import { maskMarkdown } from './markdown-masker.js';
 import { amendmentIdsIn } from './amendment-trace.js';
 import { QE_SEVERITIES, findInvalidQeVerdictLines, parseQeFindings, readQeVerdictLines, type QeFindingsRefusedRow, type QeFindingsSummary } from './qe-findings.js';
 
@@ -103,7 +104,13 @@ export function observabilityAnswer(architectureMarkdown: string | undefined | n
   // Fenced blocks are stripped FIRST: a `## Observability` inside an example fence is not a section
   // of this document, and accepting one is a false pass anybody could write by accident
   // (cross-family review, finding 1).
-  const text = String(architectureMarkdown ?? '').replace(/\r\n/g, '\n').replace(/^ {0,3}(```|~~~)[\s\S]*?^ {0,3}\1[^\n]*$/gm, '');
+  // Block scoping is DELEGATED to the canonical masker, not a local paired-fence regex. The regex
+  // it replaces required a MATCHING CLOSE, so an UNCLOSED fence stripped nothing at all and a
+  // `## Observability` quoted inside the example counted as a real section — MEASURED 2026-09-20,
+  // exactly the false pass the comment above warns about. `unclosed: 'hide'` is the CommonMark
+  // reading (an unclosed fence runs to end of document) and is the safe direction for a gate:
+  // a section that may be code must not be accepted as an answer.
+  const text = String(maskMarkdown(String(architectureMarkdown ?? '').replace(/\r\n/g, '\n'), { unclosed: 'hide' }));
   // CommonMark: up to three leading spaces, then #s, then REQUIRED whitespace. `##Observability` is
   // not a heading and must not pass; an indented one is, and must not be missed (finding 2).
   const headingRe = new RegExp('^ {0,3}#{1,6}[ \t]+' + OBSERVABILITY_SECTION + '\\b.*$', 'gim');

package/src/sign.ts

@@ -769,3 +769,56 @@ export function decideVerifyPolicy(verdict: PackVerdict, requireSigning: boolean
     ? { action: 'fail', reason: 'pack is unsigned and --require-signing was passed' }
     : { action: 'report', reason: 'pack is unsigned — not verified' };
 }
+
+/**
+ * Файлы, которые npm НИКОГДА не кладёт в тарбол, а рабочее дерево несёт почти всегда.
+ * Список намеренно короткий: каждая позиция — не эвристика вкуса, а правило упаковщика или
+ * общепринятый файл разработки, отсутствующий в опубликованном артефакте.
+ */
+const DEV_TREE_MARKERS: readonly string[] = [
+  'node_modules',        // npm исключает ВСЕГДА, безусловно
+  '.git',
+  'tsconfig.json',
+  'tsconfig.tsbuildinfo',
+  'vitest.config.ts',
+  'vitest.config.mts',
+  'vitest.config.js',
+  'CHANGELOG.md',
+  'test',
+  'tests',
+];
+
+/**
+ * Объяснение к ПРОВАЛИВШЕЙСЯ проверке подписи, когда каталог похож на рабочее дерево.
+ *
+ * ЗАЧЕМ ЭТО СУЩЕСТВУЕТ. Манифест описывает ОПУБЛИКОВАННЫЙ ТАРБОЛ, а не рабочее дерево: при
+ * публикации package.json переписывается (`workspace:*` разворачивается, версия бампается), а
+ * файлы разработки отфильтровываются. Поэтому сверка неотфильтрованного дерева расходится
+ * ПО ПОСТРОЕНИЮ, и вывод выглядит как «подпись сломана» или «дерево подменили».
+ *
+ * ИЗМЕРЕНО 2026-09-01: обход 55 подписанных пакетов в рабочем дереве дал 54 отказа из 55, и за
+ * один день на это независимо попались ТРОЕ — ведущий агент и два роя; один внёс это в отчёт
+ * как системный дефект подписей, другой предложил завести задачу, третий чуть не поднял тревогу
+ * о взломе доверия. Инструмент, трижды за день обманувший опытного пользователя, дефектен сам.
+ *
+ * ПОЧЕМУ ЭТО ОБЪЯСНЕНИЕ, А НЕ КЛАССИФИКАЦИЯ. Соседний путь (обход установленных пакетов) считает
+ * исходным деревом всё, что лежит не под `node_modules`. Здесь так нельзя: законно распакованный
+ * тарбол в /tmp тоже лежит не под `node_modules`, и его объявили бы деревом. Поэтому функция
+ * НИЧЕГО НЕ УТВЕРЖДАЕТ о природе каталога — она НАЗЫВАЕТ НАЙДЕННЫЕ УЛИКИ и оставляет вывод
+ * человеку. Нет улик — нет и объяснения: молчание здесь честнее догадки.
+ *
+ * @param entries имена верхнего уровня в проверяемом каталоге
+ * @returns текст пояснения или null, если улик рабочего дерева не нашлось
+ */
+export function explainPackVerificationFailure(entries: readonly string[]): string | null {
+  const found = DEV_TREE_MARKERS.filter((marker) => entries.includes(marker));
+  if (found.length === 0) return null;
+  return [
+    '',
+    'Прежде чем читать это как подделку: манифест описывает ОПУБЛИКОВАННЫЙ ТАРБОЛ, а не рабочее дерево.',
+    `Этот каталог несёт файлы разработки, которых в тарболе нет: ${found.join(', ')}.`,
+    'При публикации package.json переписывается, а файлы разработки отфильтровываются, поэтому',
+    'сверка неотфильтрованного дерева расходится ПО ПОСТРОЕНИЮ — это не улика подделки.',
+    'Проверять надо артефакт: npm pack <имя>@<версия> → распаковать → dz verify-pack --pack <распакованное>.',
+  ].join('\n');
+}