@dzhechkov/harness-core 0.8.38 → 0.8.40

package/src/round.ts

@@ -41,9 +41,28 @@ export interface RoundExecState {
 }
 
 /** Additive row shape accepted by the existing run-cost ledger readers. */
+/**
+ * The row this version WRITES. It is deliberately not the shape the FILE holds: the ledger is
+ * append-only, so rows written before a field existed do not carry it. Read a stored line as
+ * `unknown` and put it through {@link validateClosedRoundLedgerRow} or your own guard — typing a
+ * historical line with this interface and dereferencing a later field as a guaranteed string is the
+ * defect this note exists to prevent (named by cross-family review, Codex gpt-5.6-sol, 2026-09-21).
+ */
 export interface RoundLedgerRow {
   readonly slug: string;
   readonly stage: 'round';
+  /**
+   * This round's identity as a FIELD. It is also the first token of `note`, and that prefix is what
+   * the confirmation read greps for — but a key that lives inside prose can only be joined by
+   * parsing prose. MEASURED on the COMMITTED `.dz/feature-adr/run-cost-ledger.jsonl` at `488f596c`
+   * (backlog c60cc857, whose own numbers had gone stale): of 436 rows, 99 are `round`, and the
+   * round's own identity sat in a FIELD 0 times out of 99 while sitting inside `note` prose 99 times
+   * out of 99. Other id fields exist on those rows — 28 carry `taskId`, 76 carry `stateId` — but
+   * they identify the TASK and the STATE FILE, not the round's ledger identity; 22 carry none of
+   * `runId`/`taskId`/`stateId` (those three exactly — `runnerId`, the host, is on all 99).
+   * Reproducer and pinning commit: package README, section `roundId`.
+   */
+  readonly roundId: string;
   readonly tier: null;
   readonly coder: string | null;
   readonly reviewer: string | null;
@@ -552,6 +571,7 @@ export function closeRound(input: {
   const row: RoundLedgerRow = {
     slug: input.state.slug,
     stage: 'round',
+    roundId: marker,
     tier: null,
     coder: nonEmpty(input.coder) ? input.coder.trim() : null,
     reviewer,

package/src/run-records.ts

@@ -141,6 +141,17 @@ function priceLookup(modelId: string, table: Readonly<Record<string, LedgerPrice
   return best;
 }
 
+// instrument-round-b fix-round-1 (Codex r1 HIGH finding 3, ADR-001 D4 amended): `--no-strict` was a
+// BLANKET opt-out — since the one demonstrated automatic writer (the pipeline) always passed it, the
+// new strict-by-default was operationally empty for every real caller. Replaced by a NAMED, SCOPED
+// allowance: the caller states exactly which fields it expects to be incomplete
+// (`allowIncomplete`) and WHY, from a closed set of reason codes — an incomplete row is written only
+// when its actual incompleteness is a SUBSET of what was named AND the reason is recognized.
+// Growing the incompleteness beyond what was declared (e.g. `envelope` going missing tomorrow) is
+// refused, by construction, without anyone having to remember to tighten a flag.
+export const INCOMPLETE_REASON_CODES = ['sandbox-metrics-unavailable', 'manual-entry'] as const;
+export type IncompleteReasonCode = typeof INCOMPLETE_REASON_CODES[number];
+
 export type RecordKind = 'ledger' | 'training-pair';
 
 export type RecordVerdict =
@@ -290,10 +301,22 @@ export function decideRecordWrite(input: {
   /** measurement-integrity FR-5/FR-6: rollout-log + price enrichment for a ledger row. Absent ⇒ zero
    *  behavior change (NFR-1). */
   enrich?: LedgerEnrichInput;
-  /** experiment-instrument FR-2/A3 (ADR-001): when `true`, an AUTO ledger row that would be written
-   *  `complete:false` is refused instead (exit 2, before any write) — a круг-B default candidate, opt-
-   *  in today so nothing that already writes incomplete auto rows starts failing underfoot (NFR-1). */
-  strict?: boolean;
+  /**
+   * instrument-round-b FR-4/A5 (ADR-001 D4), fix-round-1 (Codex r1 HIGH finding 3): an AUTO ledger
+   * row that would be written `complete:false` is refused (exit 2, before any write) UNLESS the
+   * actual incompleteness is fully covered by this NAMED, SCOPED allowance — the CLI's
+   * `--allow-incomplete <fields>`. A field this row is incomplete in that is NOT in this set still
+   * refuses, naming exactly the uncovered field(s). `--no-strict` (a blanket opt-out) is gone —
+   * see {@link INCOMPLETE_REASON_CODES}.
+   */
+  allowIncomplete?: readonly string[];
+  /**
+   * instrument-round-b fix-round-1 (Codex r1 HIGH finding 3): WHY the row is legitimately
+   * incomplete — the CLI's `--incomplete-reason <code>`, required alongside `allowIncomplete` and
+   * validated against the closed {@link INCOMPLETE_REASON_CODES} set. An unrecognized or absent
+   * reason refuses the write even when every incomplete field IS named in `allowIncomplete`.
+   */
+  incompleteReason?: string | null;
 }): RecordDecision {
   const { kind, payloadRaw, stage } = input;
   if (kind !== 'ledger' && kind !== 'training-pair') {
@@ -354,7 +377,20 @@ export function decideRecordWrite(input: {
   // carry `auto:true` too (not just gate on it transiently), so every downstream reader of the
   // PERSISTED line keeps seeing the same signal `shapeMismatch` already gated on above. A no-op when
   // the payload already said `auto:true` (shapeMismatch already refused any OTHER value).
-  if (kind === 'ledger' && input.auto === true) stamped['auto'] = true;
+  // Lead delta after Codex r2 (N1 HIGH): `auto:true` used to be indistinguishable between "the
+  // CLI-level trusted marker was present" and "a hand-built payload said so", so a manual row could
+  // read as an automatic one. STRIPPING the claim was tried and rejected: the minutes-delta contract
+  // (auto + runId) legitimately rides payload-declared auto rows, and 28 existing callers write
+  // them. So the claim SURVIVES and its PROVENANCE is recorded instead — `autoSource` is the field a
+  // reader filters on when it needs trusted automatic rows only.
+  if (kind === 'ledger') {
+    if (input.auto === true) {
+      stamped['auto'] = true;
+      stamped['autoSource'] = 'cli-flag';
+    } else if (stamped['auto'] === true) {
+      stamped['autoSource'] = 'payload-claim';
+    }
+  }
   const isGap = (v: unknown): boolean => v === null || v === undefined || (typeof v === 'string' && v.trim() === '');
   if (input.timestamp != null && input.timestamp !== '') {
     // An EMPTY STRING is a gap, not a value. Stamping only over null/undefined let
@@ -598,11 +634,43 @@ export function decideRecordWrite(input: {
       ? [...new Set([...existingReasons, ...incompleteReasons])]
       : incompleteReasons;
     const complete = mergedReasons.length === 0 && !existingWasIncomplete;
-    // A3: under `--strict`, incompleteness is a REFUSAL — before any write, the target untouched —
-    // rather than a loudly-marked write. Without `--strict` (the default today; круг-B may flip it),
-    // the row is still written, just honestly marked `complete:false` with its reasons.
-    if (input.strict === true && !complete) {
-      return refuse(`auto ledger row is incomplete (${mergedReasons.join(', ') || 'previously marked incomplete'}) — refused under --strict before any write`);
+    // A3/A5 (круг B, ADR-001 D4), fix-round-1 (Codex r1 HIGH finding 3, finding 9): incompleteness
+    // is a REFUSAL by DEFAULT, before any write — but the escape hatch is now a NAMED, SCOPED
+    // allowance, not a blanket flag: the row writes only when EVERY name in `mergedReasons` is
+    // covered by `input.allowIncomplete` AND `input.incompleteReason` is one of the closed
+    // {@link INCOMPLETE_REASON_CODES}. This is the load-bearing condition finding 9 asked for a
+    // real discriminating mutation against — an omitted allowance (the ordinary caller who never
+    // heard of this option) refuses exactly like круг B's original default; a caller naming the
+    // wrong reason, or a wider incompleteness than it declared, ALSO refuses.
+    // Lead delta after Codex r2 (N3 MEDIUM): the closed-list check used to live INSIDE the
+    // incomplete branch, so a COMPLETE row could carry `--incomplete-reason bogus` and be written
+    // with an unrecognized code sitting in its arguments. A supplied reason is validated whenever it
+    // is supplied, complete or not.
+    const suppliedReason = input.incompleteReason ?? null;
+    if (suppliedReason !== null && !(INCOMPLETE_REASON_CODES as readonly string[]).includes(suppliedReason)) {
+      return refuse(`--incomplete-reason ${JSON.stringify(suppliedReason)} is not a recognized reason code — expected one of ${INCOMPLETE_REASON_CODES.join(', ')}`);
+    }
+    if (!complete) {
+      const allowedFields = new Set(input.allowIncomplete ?? []);
+      const reason = suppliedReason;
+      const reasonKnown = reason !== null && (INCOMPLETE_REASON_CODES as readonly string[]).includes(reason);
+      // Lead delta after Codex r2 (N2 HIGH): a payload marked `complete:false` with NO concrete
+      // reasons cannot be covered by any allowance — the subset relation has nothing to check, so
+      // `uncovered` came out empty and the row slipped through. An unexplained incompleteness is a
+      // refusal: name the fields, or do not claim incompleteness.
+      if (mergedReasons.length === 0) {
+        return refuse('auto ledger row is marked `complete:false` but names no incompleteReasons — an allowance cannot cover an unnamed gap; list the incomplete field(s) or drop the claim');
+      }
+      const uncovered = mergedReasons.filter((r) => !allowedFields.has(r));
+      if (uncovered.length > 0 || !reasonKnown) {
+        if (reason === null && allowedFields.size === 0) {
+          return refuse(`auto ledger row is incomplete (${mergedReasons.join(', ') || 'previously marked incomplete'}) — refused by default; pass --allow-incomplete <fields> and --incomplete-reason <code> to permit a scoped incomplete write`);
+        }
+        if (!reasonKnown) {
+          return refuse(`--incomplete-reason ${JSON.stringify(reason)} is not a recognized reason code — expected one of ${INCOMPLETE_REASON_CODES.join(', ')}`);
+        }
+        return refuse(`auto ledger row is incomplete in field(s) not covered by --allow-incomplete: ${uncovered.join(', ')} (incomplete: ${mergedReasons.join(', ') || 'previously marked incomplete'})`);
+      }
     }
     stamped['complete'] = complete;
     if (!complete) stamped['incompleteReasons'] = mergedReasons.length > 0 ? mergedReasons : existingReasons;

package/src/score.ts

@@ -20,6 +20,7 @@
  * PURE: the CLI reads the artifact files; this module only classifies.
  */
 
+import { maskMarkdown } from './markdown-masker.js';
 import { amendmentIdsIn } from './amendment-trace.js';
 import { QE_SEVERITIES, findInvalidQeVerdictLines, parseQeFindings, readQeVerdictLines, type QeFindingsRefusedRow, type QeFindingsSummary } from './qe-findings.js';
 
@@ -103,7 +104,13 @@ export function observabilityAnswer(architectureMarkdown: string | undefined | n
   // Fenced blocks are stripped FIRST: a `## Observability` inside an example fence is not a section
   // of this document, and accepting one is a false pass anybody could write by accident
   // (cross-family review, finding 1).
-  const text = String(architectureMarkdown ?? '').replace(/\r\n/g, '\n').replace(/^ {0,3}(```|~~~)[\s\S]*?^ {0,3}\1[^\n]*$/gm, '');
+  // Block scoping is DELEGATED to the canonical masker, not a local paired-fence regex. The regex
+  // it replaces required a MATCHING CLOSE, so an UNCLOSED fence stripped nothing at all and a
+  // `## Observability` quoted inside the example counted as a real section — MEASURED 2026-09-20,
+  // exactly the false pass the comment above warns about. `unclosed: 'hide'` is the CommonMark
+  // reading (an unclosed fence runs to end of document) and is the safe direction for a gate:
+  // a section that may be code must not be accepted as an answer.
+  const text = String(maskMarkdown(String(architectureMarkdown ?? '').replace(/\r\n/g, '\n'), { unclosed: 'hide' }));
   // CommonMark: up to three leading spaces, then #s, then REQUIRED whitespace. `##Observability` is
   // not a heading and must not pass; an indented one is, and must not be missed (finding 2).
   const headingRe = new RegExp('^ {0,3}#{1,6}[ \t]+' + OBSERVABILITY_SECTION + '\\b.*$', 'gim');

package/src/sign.ts

@@ -769,3 +769,56 @@ export function decideVerifyPolicy(verdict: PackVerdict, requireSigning: boolean
     ? { action: 'fail', reason: 'pack is unsigned and --require-signing was passed' }
     : { action: 'report', reason: 'pack is unsigned — not verified' };
 }
+
+/**
+ * Файлы, которые npm НИКОГДА не кладёт в тарбол, а рабочее дерево несёт почти всегда.
+ * Список намеренно короткий: каждая позиция — не эвристика вкуса, а правило упаковщика или
+ * общепринятый файл разработки, отсутствующий в опубликованном артефакте.
+ */
+const DEV_TREE_MARKERS: readonly string[] = [
+  'node_modules',        // npm исключает ВСЕГДА, безусловно
+  '.git',
+  'tsconfig.json',
+  'tsconfig.tsbuildinfo',
+  'vitest.config.ts',
+  'vitest.config.mts',
+  'vitest.config.js',
+  'CHANGELOG.md',
+  'test',
+  'tests',
+];
+
+/**
+ * Объяснение к ПРОВАЛИВШЕЙСЯ проверке подписи, когда каталог похож на рабочее дерево.
+ *
+ * ЗАЧЕМ ЭТО СУЩЕСТВУЕТ. Манифест описывает ОПУБЛИКОВАННЫЙ ТАРБОЛ, а не рабочее дерево: при
+ * публикации package.json переписывается (`workspace:*` разворачивается, версия бампается), а
+ * файлы разработки отфильтровываются. Поэтому сверка неотфильтрованного дерева расходится
+ * ПО ПОСТРОЕНИЮ, и вывод выглядит как «подпись сломана» или «дерево подменили».
+ *
+ * ИЗМЕРЕНО 2026-09-01: обход 55 подписанных пакетов в рабочем дереве дал 54 отказа из 55, и за
+ * один день на это независимо попались ТРОЕ — ведущий агент и два роя; один внёс это в отчёт
+ * как системный дефект подписей, другой предложил завести задачу, третий чуть не поднял тревогу
+ * о взломе доверия. Инструмент, трижды за день обманувший опытного пользователя, дефектен сам.
+ *
+ * ПОЧЕМУ ЭТО ОБЪЯСНЕНИЕ, А НЕ КЛАССИФИКАЦИЯ. Соседний путь (обход установленных пакетов) считает
+ * исходным деревом всё, что лежит не под `node_modules`. Здесь так нельзя: законно распакованный
+ * тарбол в /tmp тоже лежит не под `node_modules`, и его объявили бы деревом. Поэтому функция
+ * НИЧЕГО НЕ УТВЕРЖДАЕТ о природе каталога — она НАЗЫВАЕТ НАЙДЕННЫЕ УЛИКИ и оставляет вывод
+ * человеку. Нет улик — нет и объяснения: молчание здесь честнее догадки.
+ *
+ * @param entries имена верхнего уровня в проверяемом каталоге
+ * @returns текст пояснения или null, если улик рабочего дерева не нашлось
+ */
+export function explainPackVerificationFailure(entries: readonly string[]): string | null {
+  const found = DEV_TREE_MARKERS.filter((marker) => entries.includes(marker));
+  if (found.length === 0) return null;
+  return [
+    '',
+    'Прежде чем читать это как подделку: манифест описывает ОПУБЛИКОВАННЫЙ ТАРБОЛ, а не рабочее дерево.',
+    `Этот каталог несёт файлы разработки, которых в тарболе нет: ${found.join(', ')}.`,
+    'При публикации package.json переписывается, а файлы разработки отфильтровываются, поэтому',
+    'сверка неотфильтрованного дерева расходится ПО ПОСТРОЕНИЮ — это не улика подделки.',
+    'Проверять надо артефакт: npm pack <имя>@<версия> → распаковать → dz verify-pack --pack <распакованное>.',
+  ].join('\n');
+}

package/src/skills-verify.ts

@@ -6,8 +6,8 @@
  * the PROPERTY (registration). This module makes the property observable.
  *
  * Two layers:
- *   L1 `scanSkillsLayout`  — instant, no Claude session: which names CAN register, plus the three
- *                            layout shapes that produced the 1.2.0 defect.
+ *   L1 `scanSkillsLayout`  — instant, no Claude session: names whose on-disk form passes the
+ *                            static checks, plus known issue shapes.
  *   L2 `parseInitFacts`    — the authoritative listing, parsed from the `system/init` event of
  *      + `classifyRegistration`  `claude -p --output-format stream-json --verbose`. No model prose.
  *
@@ -19,13 +19,15 @@ import { basename, isAbsolute, join, resolve } from 'node:path';
 
 // ── Layer 1: static layout scan ─────────────────────────────────────
 
-/** The three non-registrable shapes, all observed in the health-advisor 1.2.0 defect. */
+/** The seven static issue shapes this scanner reports. */
 export type SkillIssueKind =
   | 'no-skill-md'          // a skill dir with no SKILL.md at depth 1 → never registers
   | 'buried-skill-md'      // a SKILL.md at depth >= 2 → the loader does not scan that deep
   | 'plugin-manifest-trap' // .claude-plugin/plugin.json under .claude/skills → does NOT auto-register
   | 'wildcard-allowed-tools' // `allowed-tools: *` → every tool granted; a FINDING (see below)
-  | 'empty-allowed-tools';   // `allowed-tools:` with no value → looks restrictive, restricts nothing
+  | 'empty-allowed-tools'    // `allowed-tools:` with no value → looks restrictive, restricts nothing
+  | 'missing-frontmatter-fence' // measured absent from the registry without an opening `---`
+  | 'missing-description';      // measured absent from the registry without a non-empty description
 
 export interface SkillLayoutFinding {
   readonly dir: string;
@@ -38,7 +40,10 @@ export interface StaticScan {
   readonly projectDir: string;
   readonly skillsRoot: string;
   readonly exists: boolean;
-  /** Names that CAN register: a dir with SKILL.md exactly one level deep. */
+  /**
+   * Bare skill names whose on-disk form passes static layout and measured frontmatter checks.
+   * Actual registration is established only by the Layer-2 session listing.
+   */
   readonly registrable: readonly string[];
   /** Load-blocking problems: these make the verdict FAIL. */
   readonly findings: readonly SkillLayoutFinding[];
@@ -228,6 +233,39 @@ export function parseAllowedTools(markdown: string): AllowedToolsState {
   return { state: 'listed', values, wildcard: values.includes('*') };
 }
 
+type SkillFrontmatterIssue = 'missing-frontmatter-fence' | 'missing-description';
+
+/**
+ * Read the registration-relevant frontmatter fields, line by line and only before its closing fence.
+ * Scanning the whole file would let `description:` in skill documentation suppress a real finding,
+ * the same false-positive/false-negative boundary guarded by `parseAllowedTools` above.
+ *
+ * The two conditions are measured as absence from the registry, not refusal of invocation. Each
+ * measurement used a fresh session, so it also does not establish appearance in the same response
+ * without a restart.
+ */
+function findSkillFrontmatterIssue(markdown: string): SkillFrontmatterIssue | null {
+  const lines = markdown.split(/\r?\n/);
+  // NO explicit BOM strip, and that is deliberate: `String.prototype.trim()` already removes U+FEFF
+  // (it is <ZWNBSP>, part of the WhiteSpace production), so a BOM-prefixed fence compares equal to
+  // a bare one. MEASURED 2026-09-19: adding a strip left the mutant "don't strip" 70/70 green —
+  // dead code. The tolerance is pinned by a test instead, so replacing `trim()` with anything
+  // stricter goes red rather than silently rejecting every BOM-prefixed skill.
+  if (lines[0]?.trim() !== '---') return 'missing-frontmatter-fence';
+
+  let description: string | null = null;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i] ?? '';
+    if (line.trim() === '---') break;
+    const match = /^description:(.*)$/.exec(line);
+    if (match) {
+      description = match[1] ?? '';
+      break;
+    }
+  }
+  return description === null || description.trim() === '' ? 'missing-description' : null;
+}
+
 /**
  * Privilege findings for one skill directory.
  *
@@ -426,16 +464,38 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
     const isPluginContainer = hasPluginManifest(dir);
     const bucket = isPluginContainer ? advisories : findings;
 
+    // Read under a guard, exactly like scanSkillPrivileges: an unreadable SKILL.md is another
+    // check's business, and this scanner's contract is to REPORT findings, never to throw out of
+    // the whole sweep over one bad file.
+    let frontmatterIssue: SkillFrontmatterIssue | null = null;
+    if (registers) {
+      try {
+        frontmatterIssue = findSkillFrontmatterIssue(readFileSync(join(dir, 'SKILL.md'), 'utf8'));
+      } catch {
+        frontmatterIssue = null;
+      }
+    }
+    if (frontmatterIssue) {
+      findings.push({
+        dir: name,
+        kind: frontmatterIssue,
+        detail: frontmatterIssue === 'missing-frontmatter-fence'
+          ? 'SKILL.md has no opening frontmatter fence — measured absent from the registry without it'
+          : 'SKILL.md has no non-empty frontmatter description — measured absent from the registry without one',
+      });
+    }
+
     // Права проверяются у КАЖДОГО навыка с читаемым SKILL.md, включая одно-навыковый плагин: щедрая
     // выдача не становится безопаснее оттого, что навык лежит в контейнере.
     if (registers) scanSkillPrivileges(dir, name, findings, advisories);
 
-    if (registers && !isPluginContainer) {
-      registrable.push(name);
-    } else if (registers && isPluginContainer) {
+    if (registers) {
+      if (!isPluginContainer && !frontmatterIssue) {
+        registrable.push(name);
+      }
       // A single-skill plugin: it has a depth-1 SKILL.md AND a manifest, so it registers NAMESPACED.
       // Expecting the bare directory name here was a false FAIL (QE5 #2); the container check below
-      // accepts either form.
+      // accepts either form. A frontmatter finding likewise keeps the bare name out of registrable.
     } else {
       // A dir with no markdown was never meant to be a skill — advisory, not a failure (QE5 #7).
       const intended = looksLikeSkillDir(dir);

package/src/store-guard-prune.ts

@@ -0,0 +1,81 @@
+import { sep } from 'node:path';
+
+export type StoreGuardPruneBucket = 'stale-temp' | 'live' | 'gone-outside-tmp' | 'unreadable';
+
+export interface StoreGuardPruneEntry {
+  readonly file: string;
+  readonly project: string | null;
+  readonly bytes: number;
+  readonly bucket: StoreGuardPruneBucket;
+}
+
+export interface StoreGuardPrunePlan {
+  readonly entries: readonly StoreGuardPruneEntry[];
+  readonly counts: Readonly<Record<StoreGuardPruneBucket, number>>;
+  readonly reclaimableBytes: number;
+}
+
+export interface StoreGuardPruneDeps {
+  readonly exists: (path: string) => boolean;
+  readonly tmpDirs: readonly string[];
+}
+
+/**
+ * A temp-root candidate that authorizes deletion must be a REAL directory path, never the filesystem
+ * root or an empty string. MEASURED 2026-09-20 (cross-family review, P1): `TMPDIR=/` makes
+ * `os.tmpdir()` return the single character `"/"` (node strips a trailing slash only when the path is
+ * longer than one character), and `isUnder` then matches EVERY absolute path — so every
+ * `gone-outside-tmp` mark, which FR-3 exists to protect, would be classified `stale-temp` and deleted.
+ * A degenerate candidate authorizes nothing and is dropped here, in the pure half, where it is testable.
+ */
+function isUsableTmpDir(tmpDir: string): boolean {
+  const trimmed = tmpDir.trim();
+  return trimmed.length > 1 && trimmed !== sep && trimmed !== '/';
+}
+
+function isUnder(project: string, tmpDir: string): boolean {
+  const prefix = tmpDir.endsWith(sep) ? tmpDir : `${tmpDir}${sep}`;
+  return project === tmpDir || project.startsWith(prefix);
+}
+
+export function planStoreGuardPrune(
+  input: readonly { readonly file: string; readonly bytes: number; readonly text: string }[],
+  deps: StoreGuardPruneDeps,
+): StoreGuardPrunePlan {
+  const counts: Record<StoreGuardPruneBucket, number> = {
+    'stale-temp': 0,
+    live: 0,
+    'gone-outside-tmp': 0,
+    unreadable: 0,
+  };
+  let reclaimableBytes = 0;
+
+  const entries = input.map(({ file, bytes, text }): StoreGuardPruneEntry => {
+    let value: unknown;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      counts.unreadable += 1;
+      return { file, project: null, bytes, bucket: 'unreadable' };
+    }
+
+    if (typeof value !== 'object' || value === null
+      || typeof (value as { project?: unknown }).project !== 'string'
+      || (value as { project: string }).project.length === 0) {
+      counts.unreadable += 1;
+      return { file, project: null, bytes, bucket: 'unreadable' };
+    }
+
+    const project = (value as { project: string }).project;
+    const bucket: StoreGuardPruneBucket = deps.exists(project)
+      ? 'live'
+      : deps.tmpDirs.filter(isUsableTmpDir).some((tmpDir) => isUnder(project, tmpDir))
+        ? 'stale-temp'
+        : 'gone-outside-tmp';
+    counts[bucket] += 1;
+    if (bucket === 'stale-temp') reclaimableBytes += bytes;
+    return { file, project, bytes, bucket };
+  });
+
+  return { entries, counts, reclaimableBytes };
+}

package/src/sweep-failure-classify.ts

@@ -0,0 +1,88 @@
+/**
+ * Различитель красных обхода: ЛОГИЧЕСКИЙ отказ против отказа ПОД НАГРУЗКОЙ.
+ *
+ * ЗАЧЕМ. Запись 9e48a975 установила класс: набор harness-core детерминирован В ОДИНОЧКУ и
+ * краснеет ТОЛЬКО под параллельной нагрузкой (пять последовательных прогонов — ноль красных;
+ * те же тесты под фоновым вторым набором — красные поодиночке и в разных сочетаниях).
+ * Подпись класса: тест (а) читает собранный `dist`, (б) порождает процессы, (в) несёт явный
+ * таймаут, близкий к измеренному времени.
+ *
+ * ИЗМЕРЕНО 2026-09-19, новый экземпляр того же класса: `scout` прошёл в одном обходе и упал в
+ * следующем через 17 минут — `deep-analyzer.test.ts`, `Test timed out in 5000ms`, 192 из 193
+ * зелёные; тот же файл в одиночку 5 из 5. Единственное различие между прогонами — загрузка
+ * машины (подкачка 2342 → 2671 МБ).
+ *
+ * Класс диагностирован, но МЕХАНИЗМА не имел: каждый экземпляр стоил ручного разбора. Этот
+ * модуль — чистая половина механизма: он извлекает из журнала обхода ИМЕНА упавших файлов и
+ * классифицирует результат ПЕРЕПРОГОНА В ОДИНОЧКУ. Запуск живёт в скрипте, здесь его нет.
+ *
+ * ТРЁХЗНАЧНОСТЬ ОБЯЗАТЕЛЬНА. Перепрогон, который не удалось выполнить, — это НЕ «прошёл»;
+ * прибор, который не смог посмотреть, не имеет права на вердикт.
+ */
+
+/** Вердикт перепрогона одного файла в одиночку. */
+export type RerunVerdict = 'does-not-reproduce-alone' | 'reproduces-alone' | 'inconclusive';
+
+/**
+ * Имена упавших тестовых файлов из журнала набора. Понимает ОБА формата, которые даёт обход:
+ *   vitest    ` FAIL  test/x.test.ts > describe > it`
+ *   node:test `    location: '/abs/.../test/x.test.mjs:95:1'`
+ *
+ * Пути приводятся к виду, относительному каталогу пакета, потому что перепрогон запускается
+ * из него. Порядок сохраняется, дубликаты убираются: один файл перепрогоняется один раз.
+ */
+export function parseFailedTestFiles(logText: string, packageDir?: string): string[] {
+  const out: string[] = [];
+  const seen = new Set<string>();
+  const add = (raw: string): void => {
+    let p = raw.trim();
+    if (packageDir !== undefined && p.startsWith(packageDir)) {
+      p = p.slice(packageDir.length).replace(/^\/+/, '');
+    }
+    // Абсолютный путь к ЧУЖОМУ пакету перепрогонять нельзя: он не относителен нашему каталогу.
+    if (p.startsWith('/')) return;
+    if (p === '' || seen.has(p)) return;
+    seen.add(p);
+    out.push(p);
+  };
+  for (const line of logText.split('\n')) {
+    const vitest = /^\s*FAIL\s+(?:\|[^|]*\|\s*)?(\S+\.(?:test|spec)\.[cm]?[jt]s)\b/.exec(line);
+    if (vitest?.[1] !== undefined) { add(vitest[1]); continue; }
+    const node = /location:\s*'([^']+\.(?:test|spec)\.[cm]?[jt]s):\d+/.exec(line);
+    if (node?.[1] !== undefined) { add(node[1]); }
+  }
+  return out;
+}
+
+/**
+ * Вердикт по исходу перепрогона.
+ *
+ * @param sweepFailed упал ли файл в обходе (иначе классифицировать нечего)
+ * @param rerun       результат одиночного прогона, или null если запустить не удалось
+ */
+export function classifyRerun(
+  sweepFailed: boolean,
+  rerun: { readonly exitCode: number; readonly ranAnyTest: boolean } | null,
+): RerunVerdict {
+  if (!sweepFailed) return 'inconclusive';
+  if (rerun === null) return 'inconclusive';
+  // «Ни одного теста не запустилось» — это не зелёный прогон, а несостоявшаяся проба: так
+  // выглядит и опечатка в пути, и набор, который не грузится. Читать это как «прошёл» значит
+  // объявить файл нагрузочно-зависимым на основании того, что его никто не проверил.
+  if (!rerun.ranAnyTest) return 'inconclusive';
+  return rerun.exitCode === 0 ? 'does-not-reproduce-alone' : 'reproduces-alone';
+}
+
+/** Человеческая расшифровка вердикта — одна строка, называющая, что делать дальше. */
+export function describeVerdict(verdict: RerunVerdict): string {
+  if (verdict === 'does-not-reproduce-alone') {
+    // НЕ «зависит от нагрузки»: у зелёного одиночного прогона есть ДВЕ причины, и различить их
+    // перепрогоном нельзя — нагрузка обхода ЛИБО починка, внесённая уже после него. Называть
+    // одну из двух значило бы выдать догадку за измерение.
+    return 'в одиночку ЗЕЛЁНЫЙ — либо отказ зависел от нагрузки обхода, либо починка легла после него; перепрогон эти две причины не различает';
+  }
+  if (verdict === 'reproduces-alone') {
+    return 'в одиночку ТОЖЕ красный — настоящий дефект, нагрузка ни при чём';
+  }
+  return 'НЕ УСТАНОВЛЕНО — перепрогон не состоялся; это не «прошёл»';
+}

package/src/workflow-run-dispatch.ts

@@ -11,6 +11,7 @@
  * a convention whose reason is lost is the next thing somebody "cleans up".
  */
 
+import { CODEX_EXEC_PROMPT_CEILING_CHARS } from './feature-adr-routing.js';
 import type { Deliverable } from './loop-plan.js';
 import { claudeProbeArgs, claudeReviewArgs, extractClaudeResult, interpretClaudeProbe, type BridgeFamily } from './qe-bridge.js';
 import type { WfRunReason } from './workflow-run.js';
@@ -149,13 +150,24 @@ export const CODEX_SCOPING_PREFIX =
   'Answer directly from this prompt text alone; no commands, no files, no tools.';
 
 /**
- * The REAL prompt ceiling for `codex exec`.
+ * The REAL prompt ceiling for `codex exec` — RE-EXPORTED, never re-declared.
  *
  * The folk value 1200 is refuted history: it came from an era when the prompt travelled through a
  * fire-and-forget wrapper. Over-ceiling ⇒ a LOUD `prompt-over-ceiling`, never truncation — a
  * truncated prompt produces a confident answer to a question nobody asked.
+ *
+ * ONE NUMBER, ONE DEFINITION. Until 2026-09-20 this module declared its own `= 24_000` beside the
+ * one in `feature-adr-routing.ts`, and NOTHING compared them: no test imported both, so the two
+ * could diverge in silence and `codexExecPlan` would route to Claude at a different threshold than
+ * `makeCodexExecDispatcher` rejects at. Measured: `feature-adr-codex-dispatch.test.ts` asserts only
+ * `> 4000`, and the mirror guard in `codex-scoped-review.test.ts` ties routing.ts to the four
+ * workflow copies but knows nothing about this file.
+ *
+ * The definition lives in `feature-adr-routing.ts` and not here because THAT module is lifted
+ * verbatim into the workflow sandbox by `scripts/gen-loop-blobs.mjs` and therefore may not import
+ * anything. The dependency can only point this way.
  */
-export const CODEX_EXEC_PROMPT_CEILING_CHARS = 24_000;
+export { CODEX_EXEC_PROMPT_CEILING_CHARS };
 
 /**
  * argv for one codex dispatch. The prompt travels as ONE argv element (no shell, no quoting), and