@event4u/agent-config 14.6.0 → 14.8.0

package/src/scripts/_lib/bench_ab_workspace.ts

@@ -35,6 +35,8 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+
+import { pristine_tree_for } from './bench_ab_pinned_repo.js';
 import { fileURLToPath } from 'node:url';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -99,7 +101,14 @@ export function workspace_dir(task_id: string, arm: string, seed: number): strin
  * directory that is, never whether it is clean.
  */
 export function reset_fixture(task: Dict, arm: string, seed: number): [string, string] {
-    const fixture = path.join(FIXTURES_ROOT, String(task['fixture']));
+    // Delta #9: a task may pin an external repo at a SHA instead of naming an
+    // in-repo fixture. `pristine_tree_for` returns the tree either way, so the
+    // per-trial copy below — and every endpoint that diffs against the pristine
+    // tree — is unchanged by which kind of task this is.
+    const fixture = pristine_tree_for(task, { fixturesRoot: FIXTURES_ROOT });
+    if (fixture === null) {
+        throw new Error(`task ${String(task['id'])} declares neither a \`fixture\` nor a pinned \`repo\`/\`sha\``);
+    }
     const dest = workspace_dir(String(task['id']), arm, seed);
     if (fs.existsSync(dest)) {
         fs.rmSync(dest, { recursive: true, force: true });

package/src/scripts/_lib/envelope_grounding.ts

@@ -18,6 +18,7 @@ import { execFileSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { statePathFor } from '../before_complete_hook.js';
 import { git_common_dir } from './git_common_dir.js';
 import { gitEnv } from './git_env.js';
 
@@ -114,10 +115,9 @@ export interface Grounding extends RepoAnchor {
     last_verify: string | null;
 }
 
-const VERIFY_STATE_REL = path.join('agents', 'runtime', 'state', 'verify-before-complete.json');
 
 /**
- * The last verification this workspace recorded, as one line.
+ * The last verification THIS SESSION recorded, as one line.
  *
  * **What this is not:** an exit code. The roadmap step asked for "last verify
  * exit", and nothing in the tree records one — `before_complete_hook` stores
@@ -125,10 +125,34 @@ const VERIFY_STATE_REL = path.join('agents', 'runtime', 'state', 'verify-before-
  * worse than emitting less, so the field carries the command and its
  * timestamp and says so, rather than implying a pass/fail the source never
  * held.
+ *
+ * **Why the session id is a required parameter, not an optional one.** This
+ * function resolved `agents/runtime/state/verify-before-complete.json` for its
+ * whole life and returned `null` every time: the producer never wrote that
+ * path — pre-split it wrote `agents/state/verify-before-complete.json`, and
+ * after the per-session split it writes
+ * `agents/state/verify-before-complete/<digest>.json`. The `runtime/` segment
+ * was never a directory this state used, so the reader was dead on arrival
+ * rather than made dead by the split.
+ *
+ * The producer's state is now per-session, so a reader without a session id
+ * cannot address it — and there is no defensible fallback. Reading "whatever
+ * file is newest in the directory" would attribute a NEIGHBOURING session's
+ * verification to this envelope, which is the exact cross-session read the
+ * split exists to stop, and it would do it on the field a successor session
+ * uses to decide whether work was verified. So an absent id yields `null`, and
+ * the parameter is required so no caller can reach the dead behaviour by
+ * omission.
+ *
+ * The path comes from the producer's own builder (`statePathFor`), never from
+ * a literal repeated here: a copied path constant is what went stale, and
+ * copying it again with the correct value would only reset the clock on the
+ * same failure.
  */
-export function readLastVerify(root: string): string | null {
+export function readLastVerify(root: string, session_id: string | null): string | null {
+    if (typeof session_id !== 'string' || session_id.trim() === '') return null;
     try {
-        const raw = fs.readFileSync(path.join(root, VERIFY_STATE_REL), 'utf-8');
+        const raw = fs.readFileSync(path.join(root, statePathFor(session_id)), 'utf-8');
         const state = JSON.parse(raw) as Record<string, unknown>;
         const lv = state['last_verification'];
         if (typeof lv !== 'object' || lv === null || Array.isArray(lv)) return null;
@@ -136,14 +160,30 @@ export function readLastVerify(root: string): string | null {
         const command = typeof rec['command'] === 'string' ? rec['command'] : null;
         if (!command) return null;
         const at = typeof rec['at'] === 'string' ? rec['at'] : 'unknown time';
-        return `${command} @ ${at} (no exit status is recorded anywhere)`.slice(0, MAX_FIELD_CHARS);
+        // Collapse whitespace BEFORE slicing. A recorded command is whatever
+        // the operator ran, and a heredoc (`git commit -F - <<'MSG'`) records a
+        // multi-line string — so slicing to 200 chars kept the newlines, and
+        // `validateRecycleEnvelope`'s `isShortLine` rejects any value containing
+        // one. The result was that `session:recycle` refused its OWN
+        // machine-collected field: composing a valid envelope was impossible
+        // whenever the previous verification command spanned more than one line,
+        // and the error named `last_verify` without hinting that the composer
+        // had not supplied it. Reproduced 2026-08-21 on a 512-char heredoc.
+        const flat = `${command} @ ${at} (no exit status is recorded anywhere)`.replace(/\s+/g, ' ').trim();
+        return flat.slice(0, MAX_FIELD_CHARS);
     } catch {
         return null;
     }
 }
 
-/** Collect every scripted field. Never throws — an unreadable fact is `null`. */
-export function collectGrounding(root: string): Grounding {
+/**
+ * Collect every scripted field. Never throws — an unreadable fact is `null`.
+ *
+ * `session_id` is required and forwarded to `readLastVerify` — see the reason
+ * stated there. A caller with no id in hand passes `null` and gets a `null`
+ * `last_verify`, which is the honest answer rather than a neighbour's.
+ */
+export function collectGrounding(root: string, session_id: string | null): Grounding {
     const anchor = collectRepoAnchor(root);
     const porcelain = git(root, ['status', '--porcelain']);
     if (porcelain === null) {
@@ -151,7 +191,7 @@ export function collectGrounding(root: string): Grounding {
         // this the one field in the module that asserts something it never
         // read — and it would assert it exactly when every sibling field is
         // null, so `describeDrift` is silent and nothing challenges it.
-        return { ...anchor, uncommitted_paths: [], status_summary: null, last_verify: readLastVerify(root) };
+        return { ...anchor, uncommitted_paths: [], status_summary: null, last_verify: readLastVerify(root, session_id) };
     }
     const lines = porcelain.split('\n').filter((l) => l.trim().length > 0);
     const paths = lines
@@ -165,7 +205,7 @@ export function collectGrounding(root: string): Grounding {
             lines.length === 0
                 ? 'clean working tree'
                 : `${lines.length} uncommitted path(s)${lines.length > MAX_PATHS ? `, first ${MAX_PATHS} listed` : ''}`,
-        last_verify: readLastVerify(root),
+        last_verify: readLastVerify(root, session_id),
     };
 }
 

package/src/scripts/_lib/installed_lock.ts

@@ -44,6 +44,13 @@ export interface LockfileData {
   agent_config_version?: string;
   installed_at?: string;
   tools: string[];
+  /**
+   * Content fingerprint of the host artefact layers this install wrote
+   * (`hostLayerFingerprint.fingerprintLayers`). Absent on every lockfile
+   * written before the single-delivery partition, which is why the partition
+   * predicate treats absence as "not verified" and keeps the full projection.
+   */
+  host_layer_fingerprint?: string;
 }
 
 export const LOCKFILE_ENV = "AGENT_CONFIG_INSTALLED_LOCK";
@@ -65,6 +72,7 @@ const _VERSION_RE = /^\s*agent_config_version\s*:\s*"?([^"\s]+)"?\s*$/;
 const _SCHEMA_RE = /^\s*schema_version\s*:\s*(\d+)\s*$/;
 const _LAYOUT_RE = /^\s*install_layout_version\s*:\s*(\d+)\s*$/;
 const _INSTALLED_AT_RE = /^\s*installed_at\s*:\s*"?([^"\s]+)"?\s*$/;
+const _FINGERPRINT_RE = /^\s*host_layer_fingerprint\s*:\s*"?([0-9a-f]{64})"?\s*$/;
 const _TOOL_RE = /^\s*-\s*([A-Za-z0-9_\-.]+)\s*$/;
 
 /** Expand a leading `~` like Python's `Path.expanduser()`. */
@@ -158,6 +166,12 @@ export function read_lockfile(path?: string | null): LockfileData | null {
       in_tools = false;
       continue;
     }
+    const fp_m = _FINGERPRINT_RE.exec(raw_line);
+    if (fp_m) {
+      data.host_layer_fingerprint = fp_m[1]!;
+      in_tools = false;
+      continue;
+    }
     if (raw_line.trim().startsWith("tools:")) {
       in_tools = true;
       continue;
@@ -186,14 +200,24 @@ function splitlines(text: string): string[] {
   return parts;
 }
 
-function _render(version: string, tools: string[], installed_at: string): string {
+function _render(
+  version: string,
+  tools: string[],
+  installed_at: string,
+  fingerprint?: string | null,
+): string {
   const lines = [
     `schema_version: ${SCHEMA_VERSION}`,
     `install_layout_version: ${INSTALL_LAYOUT_VERSION}`,
     `agent_config_version: "${version}"`,
     `installed_at: "${installed_at}"`,
-    "tools:",
   ];
+  // Written BEFORE `tools:` so the sequence block stays last and the parser's
+  // in_tools state machine needs no extra exit condition.
+  if (fingerprint) {
+    lines.push(`host_layer_fingerprint: "${fingerprint}"`);
+  }
+  lines.push("tools:");
   for (const tool of tools) {
     lines.push(`  - ${tool}`);
   }
@@ -204,12 +228,26 @@ function _render(version: string, tools: string[], installed_at: string): string
 export function write_lockfile(
   version: string,
   tools: string[],
-  options: { path?: string | null; now?: Date | null } = {},
+  options: {
+    path?: string | null;
+    now?: Date | null;
+    /**
+     * Host-layer content fingerprint. Omit to write no fingerprint line at
+     * all — never write a placeholder: absence means "not verified" to the
+     * partition predicate, and a placeholder would mean "verified, wrongly".
+     */
+    host_layer_fingerprint?: string | null;
+  } = {},
 ): string {
   const target = options.path ?? lockfile_path();
   fs.mkdirSync(path.dirname(target), { recursive: true });
   const stamp = strftime_iso_z(options.now ?? new Date());
-  const rendered = _render(version, sorted_unique(tools), stamp);
+  const rendered = _render(
+    version,
+    sorted_unique(tools),
+    stamp,
+    options.host_layer_fingerprint ?? null,
+  );
   // Atomic write: tempfile in the same dir + rename. The same-dir constraint
   // keeps the rename atomic across all POSIX filesystems and Windows when the
   // file already exists.
@@ -316,7 +354,14 @@ export function migrate_layout(
   const version = existing.agent_config_version || current_package_version();
   const tools = [...(existing.tools ?? [])];
   const when = options.now ?? _parse_installed_at(existing.installed_at);
-  write_lockfile(version, tools, { path: target, now: when });
+  // Carry the fingerprint across the migration. Dropping it would silently
+  // demote a verified host layer to "not verified" and turn the partition off
+  // on the next build — a layout migration must not change delivery.
+  write_lockfile(version, tools, {
+    path: target,
+    now: when,
+    host_layer_fingerprint: existing.host_layer_fingerprint ?? null,
+  });
   return {
     from: from_v,
     to: INSTALL_LAYOUT_VERSION,

package/src/scripts/_lib/layer_overlap_notice.ts

@@ -28,12 +28,21 @@ import * as path from 'node:path';
 /**
  * Artefact types both host layers can carry.
  *
- * All four, matching `check_single_delivery` (R2 finding): this notice read three
+ * All five, matching `check_single_delivery` (R2 finding): this notice read three
  * where the gate reads four, so a subagent duplicated across layers was invisible
  * on one surface and reported on the other — two surfaces disagreeing about the
  * same question is worse than one surface being silent.
+ *
+ * `personas` was added 2026-08-21. Both lists had read four types while the
+ * installer's `_CLAUDE_SKILL_BUNDLE` (`install.ts:1916-1921`) ships
+ * rules · skills · commands · **personas** — so the one family this repository
+ * actually delivered from both layers was the one neither surface looked at
+ * (29 shared names on a freshly regenerated tree). The two lists stay
+ * hand-written and independent of the installer's on purpose: deriving the
+ * verifier's scope from the producer would make the check inherit the producer's
+ * omissions, which is the defect being closed here.
  */
-const TYPES = ['rules', 'skills', 'commands', 'agents'] as const;
+const TYPES = ['rules', 'skills', 'commands', 'personas', 'user-types', 'agents'] as const;
 
 /**
  * Count shared entry names per artefact type between the two layers.

package/src/scripts/_lib/md_section.ts

@@ -0,0 +1,129 @@
+/**
+ * Structural markdown section edits — anchored on a LINE, never on a substring.
+ *
+ * WHY THIS EXISTS. Measured 2026-08-20, and it was the single costliest error
+ * of that session. A script located a section with
+ * `text.index('## Acceptance criteria')` and sliced there. The first match was
+ * not the heading: it was a **quotation of that heading inside a step's prose**,
+ * one paragraph earlier. The slice cut mid-step, the document silently lost its
+ * risk register, and it took two calls to notice and two more to rebuild.
+ *
+ * Three properties made it expensive, and all three are generic:
+ *
+ *   1. the anchor was a substring, so content that *mentions* a heading is
+ *      indistinguishable from the heading;
+ *   2. the edit was destructive rather than checked — one match was assumed;
+ *   3. nothing verified the document's shape afterwards, so the loss was silent.
+ *
+ * This module closes all three. It refuses on zero matches and on more than
+ * one, because "take the first" is exactly the behaviour that failed. And
+ * `headings()` plus `assertShapePreserved()` make a dropped section loud.
+ */
+
+export class SectionError extends Error {}
+
+/** Every ATX heading in the document, in order, as `## Title` including hashes. */
+export function headings(text: string): string[] {
+    return text.split('\n').filter((l) => /^#{1,6}\s+\S/.test(l));
+}
+
+/** Line indices of a heading matched at LINE START and exactly. */
+function headingLines(lines: readonly string[], heading: string): number[] {
+    const want = heading.trim();
+    const out: number[] = [];
+    lines.forEach((l, i) => {
+        if (l.trim() === want) {
+            out.push(i);
+        }
+    });
+    return out;
+}
+
+/** The heading's own level, e.g. 2 for `## X`. */
+function levelOf(heading: string): number {
+    const m = /^(#{1,6})\s/.exec(heading.trim());
+    if (m === null) {
+        throw new SectionError(`not an ATX heading: ${JSON.stringify(heading)}`);
+    }
+    return (m[1] as string).length;
+}
+
+/**
+ * `[start, end)` line range of the section, from its heading up to the next
+ * heading of the same or a higher level (or EOF).
+ *
+ * Throws when the heading appears zero times or more than once — the caller
+ * decides what to do, and neither case may be silently resolved by taking the
+ * first hit.
+ */
+export function sectionRange(text: string, heading: string): [number, number] {
+    const lines = text.split('\n');
+    const hits = headingLines(lines, heading);
+    if (hits.length === 0) {
+        throw new SectionError(`heading not found at line start: ${JSON.stringify(heading)}`);
+    }
+    if (hits.length > 1) {
+        throw new SectionError(
+            `heading is ambiguous — ${String(hits.length)} occurrences at lines ` +
+                `${hits.map((h) => String(h + 1)).join(', ')}: ${JSON.stringify(heading)}`,
+        );
+    }
+    const start = hits[0] as number;
+    const level = levelOf(heading);
+    let end = lines.length;
+    for (let i = start + 1; i < lines.length; i++) {
+        const l = lines[i] as string;
+        const m = /^(#{1,6})\s+\S/.exec(l);
+        if (m !== null && (m[1] as string).length <= level) {
+            end = i;
+            break;
+        }
+    }
+    return [start, end];
+}
+
+/** The section's text, heading line included. */
+export function extractSection(text: string, heading: string): string {
+    const [s, e] = sectionRange(text, heading);
+    return text.split('\n').slice(s, e).join('\n');
+}
+
+/** Replace the section's body, heading line included, with `replacement`. */
+export function replaceSection(text: string, heading: string, replacement: string): string {
+    const lines = text.split('\n');
+    const [s, e] = sectionRange(text, heading);
+    return [...lines.slice(0, s), ...replacement.split('\n'), ...lines.slice(e)].join('\n');
+}
+
+/**
+ * Assert that an edit did not lose a section it was not meant to touch.
+ *
+ * `allowedRemoved` / `allowedAdded` name the headings the edit intends to
+ * change; anything else disappearing or appearing throws. This is the check
+ * that would have caught the measured failure at the moment it happened rather
+ * than two calls later.
+ */
+export function assertShapePreserved(
+    before: string,
+    after: string,
+    opts: { allowedRemoved?: readonly string[]; allowedAdded?: readonly string[] } = {},
+): void {
+    const norm = (h: string): string => h.trim();
+    const b = headings(before).map(norm);
+    const a = headings(after).map(norm);
+    const allowedRemoved = new Set((opts.allowedRemoved ?? []).map(norm));
+    const allowedAdded = new Set((opts.allowedAdded ?? []).map(norm));
+
+    const removed = b.filter((h) => !a.includes(h) && !allowedRemoved.has(h));
+    const added = a.filter((h) => !b.includes(h) && !allowedAdded.has(h));
+    if (removed.length > 0 || added.length > 0) {
+        const parts: string[] = [];
+        if (removed.length > 0) {
+            parts.push(`lost ${String(removed.length)}: ${removed.join(' · ')}`);
+        }
+        if (added.length > 0) {
+            parts.push(`gained ${String(added.length)}: ${added.join(' · ')}`);
+        }
+        throw new SectionError(`document shape changed unexpectedly — ${parts.join('; ')}`);
+    }
+}

package/src/scripts/_lib/prune_empty_dirs.ts

@@ -0,0 +1,80 @@
+/**
+ * Remove empty directories under a root, deepest first.
+ *
+ * ## Why this exists as a shared helper
+ *
+ * A generator that stops writing into a tree leaves the tree's DIRECTORIES
+ * behind. Measured 2026-08-21 while extending the ADR-236 partition to the
+ * colon-form commands: after the generator was gated, `.claude/commands/`
+ * held **0 `.md` files and 40 empty cluster directories** — and
+ * `check_single_delivery` counts directory NAMES, so it still reported 40
+ * overlapping commands against a layer that delivered none. A partition that
+ * stops the writes and leaves the shape is invisible to the gate that is
+ * supposed to confirm it.
+ *
+ * `condense.ts` already carried this loop inline for the skills tree. It is
+ * lifted here rather than copied because the second caller is what turns an
+ * inline block into a shape two producers must agree on — and because
+ * `condense.ts` sits above `check_source_size_budget`'s ceiling, where a
+ * shrink-only ratchet refuses even a small addition.
+ *
+ * Best-effort by construction: a race or a permission error on one directory is
+ * swallowed, matching the inline original. Pruning is cleanup, never a gate.
+ *
+ * ## Symlinks: MEASURED, because a neutral review split on it
+ *
+ * One seat called an unguarded recursion a merge blocker (a directory symlink
+ * pointing at an ancestor would loop forever); the other called the finding
+ * false, on the grounds that `Dirent.isDirectory()` does not follow the target.
+ * A vote cannot settle that, so it was probed — `readdirSync(dir, {withFileTypes:
+ * true})` over a real symlink-to-directory on darwin, Node 26:
+ *
+ *     link  isDirectory=false  isSymbolicLink=true
+ *     real  isDirectory=true   isSymbolicLink=false
+ *
+ * `Dirent` carries `lstat` semantics, so the walk below cannot descend into a
+ * symlink at all and no loop is reachable — and no inode set is needed. The
+ * second seat was right. Recorded rather than fixed, so the next reader does not
+ * re-raise it: a defensive `!e.isSymbolicLink()` here would be dead code
+ * asserting something the type already guarantees.
+ *
+ * The same property is why this is safe on a tree of symlinks: `.claude/commands`
+ * holds symlinks into `src/domains/**`, and pruning must not follow one out of
+ * the tree it was pointed at.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** @returns the number of directories removed. */
+export function pruneEmptyDirs(root: string): number {
+    let removed = 0;
+    const walk = (dir: string): void => {
+        let entries: fs.Dirent[];
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        } catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.isDirectory()) walk(path.join(dir, e.name));
+        }
+        try {
+            if (fs.readdirSync(dir).length === 0) {
+                fs.rmdirSync(dir);
+                removed += 1;
+            }
+        } catch {
+            /* race or permission — cleanup is best-effort, mirrors the inline original */
+        }
+    };
+    let top: fs.Dirent[];
+    try {
+        top = fs.readdirSync(root, { withFileTypes: true });
+    } catch {
+        return 0;
+    }
+    for (const e of top) {
+        if (e.isDirectory()) walk(path.join(root, e.name));
+    }
+    return removed;
+}

package/src/scripts/_lib/scope_guard.sh

@@ -165,14 +165,37 @@ probe_tool() {
     local this_ver
     this_ver="$(this_version)"
 
+    # Field 6 is the duplicate-registration count, and it is printed on BOTH
+    # verdicts. It used to appear only on WARN, which required the two scopes to
+    # report the SAME version — and `installed_version_at` returns `unknown` for
+    # `~/.claude/…` because a host directory has no `package.json` beside it. So
+    # every real cross-scope install classified as DRIFT and the count never
+    # printed at all: the instrumentation was live and unreachable, which reads as
+    # coverage in a diff and is strictly worse than absent.
+    #
+    # Resolved 2026-08-20, road-to-single-delivery Phase 5, blocker
+    # `warn-path-unreachable-without-version-marker`, option (b). The council had
+    # already put the reasoning on record in the round that decided the partition:
+    # *"overlap reporting should not depend on version equality in the first
+    # place. Duplicate files can and should be reported whether versions match,
+    # drift, or are unknown."* A duplicate is a duplicate at any version pair.
+    #
+    # (a) — having the installer stamp a version beside every host layer — was the
+    # larger change and is NOT what shipped: it alters a consumer-facing surface to
+    # repair a reporting line. (c) — treating `unknown` as "same version" for the
+    # overlap half — was rejected because it weakens the DRIFT block itself.
+    #
+    # Wire compatibility: the DRIFT line gains a SIXTH field. The only structured
+    # consumer (`src/server/routes/wizard.ts`) destructures the first five and
+    # ignores the rest, so this is additive.
+    local overlap
+    overlap="$(count_overlap "$other_path" "$this_scope_path")"
     if [[ "$other_ver" == "unknown" ]] || [[ "$this_ver" == "unknown" ]] || [[ "$other_ver" != "$this_ver" ]]; then
-        printf 'DRIFT\t%s\t%s\t%s\t%s\n' "$tool" "$other_path" "$other_ver" "$this_ver"
+        printf 'DRIFT\t%s\t%s\t%s\t%s\t%s\n' "$tool" "$other_path" "$other_ver" "$this_ver" "$overlap"
     else
         # Same version, so no drift — but the duplicate registration is delivered
         # twice, and field 6 is what makes that cost visible at the moment of the
         # decision instead of only in a token census nobody runs.
-        local overlap
-        overlap="$(count_overlap "$other_path" "$this_scope_path")"
         printf 'WARN\t%s\t%s\t%s\t%s\t%s\n' "$tool" "$other_path" "$other_ver" "$this_ver" "$overlap"
     fi
 }

package/src/scripts/_lib/self_repair.ts

@@ -338,6 +338,25 @@ const COMPLAINT_PATTERNS: readonly RegExp[] = [
     /\byou (didn'?t|did not|failed to|ignored|forgot)\b/i,
     /\bthat'?s (wrong|not right|incorrect)\b/i,
     /\byou (worked|did (it|that)) (wrong|incorrectly)\b/i,
+    // Recurrence phrasings. A restated complaint often carries none of the fault
+    // words above — "das habe ich dir schon dreimal gesagt" names no fault at
+    // all — so without these the SECOND and THIRD report of a defect were
+    // silently not records, which is exactly when the occurrences counter
+    // carries the most signal.
+    //
+    // Every branch requires an explicit COUNT word next to a saying-verb, and
+    // that is the precision knob: "nochmal" / "wieder" / "again" are deliberately
+    // NOT counts, because a bare repetition word fires on a large share of
+    // ordinary prompts ("mach das nochmal") and a spurious record becomes a
+    // spurious PR. Ordinals and numerals only.
+    /\b(schon|bereits)[^.!?]{0,30}(zum (zweiten|dritten|vierten|fünften) mal|(zwei|drei|vier|fünf)mal|mehrmals|mehrfach|\d+ ?mal)[^.!?]{0,20}(gesagt|erwähnt|geschrieben|angesprochen)\b/i,
+    /\b(sage|sag|sagte)[^.!?]{0,30}(zum (zweiten|dritten|vierten|fünften) mal|(zwei|drei|vier|fünf)mal|mehrmals|mehrfach|\d+ ?mal)\b/i,
+    /\bwie oft (soll|muss|müssen)\b/i,
+    // Typographic AND ASCII apostrophe: the curly form is what a real prompt
+    // carries, and matching only the ASCII one is a dead branch on live input.
+    /\bi ?(have|['’]ve)? ?already (told|said)\b/i,
+    /\b(told|said) (you )?(this|that|it)? ?(\w+|\d+) times?\b/i,
+    /\bhow many times (do|must|should) i\b/i,
 ];
 
 // Phrasings that MATCH a complaint pattern but are not complaints — a curious