@gobing-ai/spur 0.3.98 → 0.3.99

package/plugins/sp/lib/residual-scan.generated.d.mts

@@ -61,3 +61,8 @@ export declare function foldVerdict(
     maxFindings?: number,
 ): FoldResult;
 export declare function renderReport(wbs: string, items: ResidualItem[], attemptCount: number): string;
+export declare function verdictDisagreementNote(
+    runDir: string,
+    wbs: string,
+    fs: Pick<typeof import('node:fs'), 'existsSync' | 'readFileSync' | 'statSync'>,
+): string | null;

package/plugins/sp/lib/residual-scan.generated.mjs

@@ -3,7 +3,8 @@ import { join } from "node:path";
 import { createHash } from "node:crypto";
 var MARKER_PATTERN = /TODO|FIXME|XXX|HACK/;
 var PRIORITY_PATTERN = /^P[1-4]/;
-var NONE_FINDING = /^(none( found)?|no (findings?|issues?)( found)?|—)\s*(\(.*\))?\.?$/i;
+var RANGE_PRIORITY = /^P[1-4]\s*[\u2013\u2014-]\s*P?[1-4]/;
+var NONE_FINDING = /^(none( found)?|no (findings?|issues?)( found)?|\u2014)\s*(\(.*\))?\.?$/i;
 var DISPOSITION_HEADER = /^(Disposition|Action|Status|Resolution|Fixed)$/i;
 var RESOLVED_DISPOSITION = /^(FIXED|RESOLVED|DONE)\b/i;
 var DEFERRED_DISPOSITION = /^DEFER(RED)?\b/i;
@@ -60,7 +61,7 @@ function parseReviewFindings(taskContent) {
       const priority = (cells[priorityCol] ?? "").trim();
       const finding = (cells[findingCol] ?? "").trim();
       const disposition = dispositionCol === -1 ? "" : (cells[dispositionCol] ?? "").trim();
-      if (PRIORITY_PATTERN.test(priority) && !NONE_FINDING.test(finding) && finding.length > 0 && !RESOLVED_DISPOSITION.test(disposition)) {
+      if (PRIORITY_PATTERN.test(priority) && !RANGE_PRIORITY.test(priority) && !NONE_FINDING.test(finding) && finding.length > 0 && !RESOLVED_DISPOSITION.test(disposition)) {
         const location = locationOf(cells[locationCol] ?? "", finding);
         out.push(DEFERRED_DISPOSITION.test(disposition) ? { priority, location, text: finding, deferral: disposition } : { priority, location, text: finding });
       }
@@ -70,7 +71,7 @@ function parseReviewFindings(taskContent) {
   return out;
 }
 function splitRow(line) {
-  return line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+  return line.trim().replace(/^\|/, "").replace(/\|$/, "").split(/(?<!\\)\|/).map((c) => c.trim());
 }
 function parseDiffMarkers(addedLines) {
   return addedLines.filter((l) => !EXCLUDED_PATHS.some((p) => l.file.startsWith(p))).filter((l) => !l.text.includes(ALLOW_PRAGMA)).filter((l) => MARKER_PATTERN.test(l.text)).map((l) => ({ location: `${l.file}:${l.line}`, text: l.text.trim() }));
@@ -198,7 +199,8 @@ function renderReport(wbs, items, attemptCount) {
 function recordedVerdictPath(runDir, wbs, fs) {
   const evidence = join(runDir, "..", "memory", "evidence");
   const durable = join(evidence, `${wbs}-verdict.json`);
-  for (const path of [join(runDir, ".."), join(evidence, ".."), evidence, durable]) {
+  const run = join(runDir, `${wbs}-verdict.json`);
+  for (const path of [join(runDir, ".."), join(evidence, ".."), evidence, durable, run]) {
     try {
       if (fs.lstatSync(path).isSymbolicLink())
         throw new Error(`residual-scan: symlink evidence path: ${path}`);
@@ -207,9 +209,47 @@ function recordedVerdictPath(runDir, wbs, fs) {
         throw error;
     }
   }
-  return fs.existsSync(durable) ? durable : join(runDir, `${wbs}-verdict.json`);
+  if (!fs.existsSync(durable))
+    return run;
+  if (!fs.existsSync(run))
+    return durable;
+  const newer = (a, b) => mtimeOf(fs, b) > mtimeOf(fs, a) ? b : a;
+  return newer(run, durable);
+}
+function mtimeOf(fs, path) {
+  try {
+    return fs.statSync(path).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function verdictDisagreementNote(runDir, wbs, fs) {
+  const run = join(runDir, `${wbs}-verdict.json`);
+  const durable = join(runDir, "..", "memory", "evidence", `${wbs}-verdict.json`);
+  if (!fs.existsSync(run) || !fs.existsSync(durable))
+    return null;
+  const bytes = (path) => {
+    try {
+      return fs.statSync(path).isFile() ? fs.readFileSync(path, "utf8") : null;
+    } catch {
+      return null;
+    }
+  };
+  const runBytes = bytes(run);
+  if (runBytes === null || runBytes === bytes(durable))
+    return null;
+  const value = (path) => {
+    try {
+      return JSON.parse(bytes(path) ?? "{}").verdict ?? "?";
+    } catch {
+      return "?";
+    }
+  };
+  const winner = mtimeOf(fs, durable) > mtimeOf(fs, run) ? "durable" : "run";
+  return `residual-fold: ${wbs} verdict copies disagree — run=${run} (${value(run)}) durable=${durable} (${value(durable)})` + ` → chose ${winner} (newer mtime)`;
 }
 export {
+  verdictDisagreementNote,
   scanResiduals,
   renderReport,
   recordedVerdictPath,

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.98",
+    "version": "0.3.99",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/persist-out-check.mjs

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+// @bun
+
+// plugins/sp/scripts/persist-out-check.ts
+import { spawnSync } from "child_process";
+import { existsSync, readdirSync, readFileSync, statSync } from "fs";
+import { basename, dirname, isAbsolute, join, relative } from "path";
+var EVIDENCE_DIR = join(".spur", "memory", "evidence");
+var RUN_DIR = join(".spur", "run");
+var NAMED_CAP = 32;
+var PREFIX_CAP = 64;
+var EVIDENCE_CAP = 256;
+function wbsOfTaskFile(path) {
+  const m = /^(\d+)_/.exec(basename(path));
+  return m?.[1] ?? null;
+}
+function listFilesUnder(root, rel, cap) {
+  const dir = join(root, rel);
+  if (!existsSync(dir))
+    return [];
+  const out = [];
+  const walk = (cur) => {
+    for (const entry of readdirSync(cur, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const p = join(cur, entry.name);
+      if (entry.isDirectory()) {
+        if (!walk(p))
+          return false;
+      } else {
+        out.push(relative(root, p));
+        if (out.length > cap)
+          return false;
+      }
+    }
+    return true;
+  };
+  return walk(dir) ? out : null;
+}
+function listObligations(wtRoot, wbsList, runIds) {
+  const evidence = listFilesUnder(wtRoot, EVIDENCE_DIR, EVIDENCE_CAP);
+  if (evidence === null)
+    return null;
+  const out = [...evidence];
+  const prefixes = [...wbsList, ...runIds];
+  for (const prefix of prefixes) {
+    const dir = join(wtRoot, RUN_DIR);
+    if (!existsSync(dir))
+      continue;
+    let entries;
+    try {
+      entries = readdirSync(dir).sort();
+    } catch {
+      return null;
+    }
+    const owned = entries.filter((n) => n.startsWith(`${prefix}-`));
+    if (owned.length > PREFIX_CAP)
+      return null;
+    out.push(...owned.map((n) => join(RUN_DIR, n)));
+  }
+  return [...new Set(out)].sort();
+}
+function compareTrees(wtRoot, invokeRoot, files) {
+  const missing = [];
+  const divergent = [];
+  let ok = 0;
+  for (const rel of files) {
+    const wtPath = join(wtRoot, rel);
+    const invPath = join(invokeRoot, rel);
+    if (!existsSync(invPath)) {
+      missing.push(rel);
+      continue;
+    }
+    try {
+      const same = readFileSync(wtPath).equals(readFileSync(invPath));
+      if (same)
+        ok++;
+      else
+        divergent.push(rel);
+    } catch {
+      divergent.push(rel);
+    }
+  }
+  return { missing, divergent, ok };
+}
+function persistOutCheckUsage() {
+  return "usage: persist-out-check --from <worktree> [--task-file <path>]\u2026 [--run-id <id>]\u2026 [--root <invoke-tree>]";
+}
+function defaultInvokeRoot(cwd) {
+  try {
+    const run = spawnSync("git", ["-C", cwd, "rev-parse", "--git-common-dir"], { encoding: "utf8" });
+    const common = run.stdout.trim();
+    if (run.status === 0 && common)
+      return dirname(isAbsolute(common) ? common : join(cwd, common));
+  } catch {}
+  return cwd;
+}
+function main(argv, invokeRoot = defaultInvokeRoot(process.cwd())) {
+  let wtRoot = "";
+  const wbsList = [];
+  const runIds = [];
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--spur-bin") {
+      i++;
+    } else if (arg === "--from") {
+      wtRoot = argv[++i] ?? "";
+    } else if (arg === "--root") {
+      invokeRoot = argv[++i] ?? invokeRoot;
+    } else if (arg === "--task-file") {
+      const wbs = wbsOfTaskFile(argv[++i] ?? "");
+      if (wbs)
+        wbsList.push(wbs);
+    } else if (arg === "--run-id") {
+      const id = argv[++i] ?? "";
+      if (id)
+        runIds.push(id);
+    } else {
+      process.stderr.write(`${persistOutCheckUsage()}
+`);
+      return 2;
+    }
+  }
+  if (!wtRoot || !existsSync(wtRoot) || !statSync(wtRoot).isDirectory()) {
+    process.stderr.write(`${persistOutCheckUsage()}
+persist-out-check: --from must be an existing worktree directory
+`);
+    return 2;
+  }
+  const files = listObligations(wtRoot, wbsList, runIds);
+  if (files === null) {
+    process.stderr.write(`persist-out-check: BLOCKED \u2014 worktree evidence listing failed or exceeded caps (64/prefix, ${EVIDENCE_CAP} evidence files) \u2014 inspect by hand
+`);
+    return 1;
+  }
+  const { missing, divergent, ok } = compareTrees(wtRoot, invokeRoot, files);
+  const findings = [
+    ...missing.map((f) => `MISSING ${f}`),
+    ...divergent.map((f) => `DIVERGENT ${f} \u2014 reconcile by hand (persist-out never overwrites)`)
+  ];
+  for (const line of findings.slice(0, NAMED_CAP))
+    process.stdout.write(`${line}
+`);
+  if (findings.length > NAMED_CAP)
+    process.stdout.write(`\u2026 +${findings.length - NAMED_CAP} more
+`);
+  if (findings.length === 0) {
+    process.stdout.write(`persist-out-check: ok \u2014 ${ok} evidence file(s) persisted, nothing abandoned
+`);
+    return 0;
+  }
+  process.stderr.write(`persist-out-check: BLOCKED ${missing.length} missing, ${divergent.length} divergent \u2014 run inline-run-setup --persist-out --from <worktree> before worktree removal
+`);
+  return 1;
+}
+{
+  process.exit(main(process.argv.slice(2)));
+}
+export {
+  wbsOfTaskFile,
+  persistOutCheckUsage,
+  main,
+  listObligations,
+  defaultInvokeRoot,
+  compareTrees
+};

package/plugins/sp/scripts/persist-out-check.ts

@@ -0,0 +1,185 @@
+#!/usr/bin/env bun
+/**
+ * persist-out-check — WT-4 pre-removal assertion for E71 persist-out (task 1067 R1).
+ *
+ * Before `git worktree remove`, verify the worktree's durable evidence would not be
+ * abandoned: every file the worktree owns under `.spur/run/` (`<wbs>-*` per forwarded
+ * task file, `<runId>-*` per forwarded run id) and the whole `.spur/memory/evidence/`
+ * tree must exist in the invoking tree with identical bytes. Missing files BLOCK the
+ * removal (persist-out was skipped or stale); divergent files block too (persist-out
+ * never overwrites — reconcile by hand per execution-batch.md). No new public CLI verb:
+ * this is a driver-side assertion step, not a corpus tool.
+ *
+ * ponytail: file-level comparison only — DB run rows and nested-run deep walks stay
+ * persist-out's job (`inline-run-setup --persist-out`); this checks the planes E71
+ * names as files. Listing caps (64/prefix, 256 evidence) refuse runaways by name.
+ *
+ * Node-builtin imports only; pure helpers are exported for tests. Exit 0 ok, 1
+ * blocked/divergent, 2 usage error. Normal output is the finding lines themselves.
+ */
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative } from 'node:path';
+
+const EVIDENCE_DIR = join('.spur', 'memory', 'evidence');
+const RUN_DIR = join('.spur', 'run');
+const NAMED_CAP = 32;
+const PREFIX_CAP = 64;
+const EVIDENCE_CAP = 256;
+
+/** Task files own their `<wbs>-*` evidence: leading digits before `_` in the basename. */
+export function wbsOfTaskFile(path: string): string | null {
+    const m = /^(\d+)_/.exec(basename(path));
+    return m?.[1] ?? null;
+}
+
+function listFilesUnder(root: string, rel: string, cap: number): string[] | null {
+    const dir = join(root, rel);
+    if (!existsSync(dir)) return [];
+    const out: string[] = [];
+    const walk = (cur: string): boolean => {
+        for (const entry of readdirSync(cur, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const p = join(cur, entry.name);
+            if (entry.isDirectory()) {
+                if (!walk(p)) return false;
+            } else {
+                out.push(relative(root, p));
+                if (out.length > cap) return false;
+            }
+        }
+        return true;
+    };
+    return walk(dir) ? out : null;
+}
+
+/**
+ * Evidence files the worktree owns: `.spur/memory/evidence/**` plus `.spur/run/<prefix>-*`
+ * direct children per task-file WBS / run id. Returns null on a cap overrun or a listing
+ * failure (not a directory, permission denied) — the caller refuses either way.
+ */
+export function listObligations(wtRoot: string, wbsList: string[], runIds: string[]): string[] | null {
+    const evidence = listFilesUnder(wtRoot, EVIDENCE_DIR, EVIDENCE_CAP);
+    if (evidence === null) return null;
+    const out = [...evidence];
+    const prefixes = [...wbsList, ...runIds];
+    for (const prefix of prefixes) {
+        const dir = join(wtRoot, RUN_DIR);
+        if (!existsSync(dir)) continue;
+        let entries: string[];
+        try {
+            entries = readdirSync(dir).sort();
+        } catch {
+            return null;
+        }
+        const owned = entries.filter((n) => n.startsWith(`${prefix}-`));
+        if (owned.length > PREFIX_CAP) return null;
+        out.push(...owned.map((n) => join(RUN_DIR, n)));
+    }
+    return [...new Set(out)].sort();
+}
+
+/** Classify obligations against the invoking tree: missing, divergent (byte-differs), or ok. */
+export function compareTrees(
+    wtRoot: string,
+    invokeRoot: string,
+    files: string[],
+): { missing: string[]; divergent: string[]; ok: number } {
+    const missing: string[] = [];
+    const divergent: string[] = [];
+    let ok = 0;
+    for (const rel of files) {
+        const wtPath = join(wtRoot, rel);
+        const invPath = join(invokeRoot, rel);
+        if (!existsSync(invPath)) {
+            missing.push(rel);
+            continue;
+        }
+        try {
+            const same = readFileSync(wtPath).equals(readFileSync(invPath));
+            if (same) ok++;
+            else divergent.push(rel);
+        } catch {
+            divergent.push(rel);
+        }
+    }
+    return { missing, divergent, ok };
+}
+
+export function persistOutCheckUsage(): string {
+    return 'usage: persist-out-check --from <worktree> [--task-file <path>]… [--run-id <id>]… [--root <invoke-tree>]';
+}
+
+/**
+ * The invoking tree is the MAIN repo root — never default to cwd: WT-4 runs from the
+ * worktree, and comparing the worktree against itself is a vacuous pass (caught live in
+ * task 1067 R4). `--git-common-dir` resolves to the shared `.git`, whose parent is the
+ * main tree; inside the main tree itself this falls back to cwd, which is correct there.
+ */
+export function defaultInvokeRoot(cwd: string): string {
+    try {
+        const run = spawnSync('git', ['-C', cwd, 'rev-parse', '--git-common-dir'], { encoding: 'utf8' });
+        const common = run.stdout.trim();
+        if (run.status === 0 && common) return dirname(isAbsolute(common) ? common : join(cwd, common));
+    } catch {
+        // git unavailable — fall through to cwd
+    }
+    return cwd;
+}
+
+export function main(argv: string[], invokeRoot = defaultInvokeRoot(process.cwd())): number {
+    let wtRoot = '';
+    const wbsList: string[] = [];
+    const runIds: string[] = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--spur-bin') {
+            i++;
+        } else if (arg === '--from') {
+            wtRoot = argv[++i] ?? '';
+        } else if (arg === '--root') {
+            invokeRoot = argv[++i] ?? invokeRoot;
+        } else if (arg === '--task-file') {
+            const wbs = wbsOfTaskFile(argv[++i] ?? '');
+            if (wbs) wbsList.push(wbs);
+        } else if (arg === '--run-id') {
+            const id = argv[++i] ?? '';
+            if (id) runIds.push(id);
+        } else {
+            process.stderr.write(`${persistOutCheckUsage()}\n`);
+            return 2;
+        }
+    }
+    if (!wtRoot || !existsSync(wtRoot) || !statSync(wtRoot).isDirectory()) {
+        process.stderr.write(
+            `${persistOutCheckUsage()}\npersist-out-check: --from must be an existing worktree directory\n`,
+        );
+        return 2;
+    }
+    const files = listObligations(wtRoot, wbsList, runIds);
+    if (files === null) {
+        process.stderr.write(
+            `persist-out-check: BLOCKED — worktree evidence listing failed or exceeded caps (64/prefix, ${EVIDENCE_CAP} evidence files) — inspect by hand\n`,
+        );
+        return 1;
+    }
+    const { missing, divergent, ok } = compareTrees(wtRoot, invokeRoot, files);
+    const findings = [
+        ...missing.map((f) => `MISSING ${f}`),
+        ...divergent.map((f) => `DIVERGENT ${f} — reconcile by hand (persist-out never overwrites)`),
+    ];
+    for (const line of findings.slice(0, NAMED_CAP)) process.stdout.write(`${line}\n`);
+    if (findings.length > NAMED_CAP) process.stdout.write(`… +${findings.length - NAMED_CAP} more\n`);
+    if (findings.length === 0) {
+        process.stdout.write(`persist-out-check: ok — ${ok} evidence file(s) persisted, nothing abandoned\n`);
+        return 0;
+    }
+    process.stderr.write(
+        `persist-out-check: BLOCKED ${missing.length} missing, ${divergent.length} divergent — run inline-run-setup --persist-out --from <worktree> before worktree removal\n`,
+    );
+    return 1;
+}
+
+if (import.meta.main) {
+    process.exit(main(process.argv.slice(2)));
+}

package/plugins/sp/scripts/residual-scan.mjs

@@ -17,7 +17,8 @@ import { join } from "node:path";
 import { createHash } from "node:crypto";
 var MARKER_PATTERN = /TODO|FIXME|XXX|HACK/;
 var PRIORITY_PATTERN = /^P[1-4]/;
-var NONE_FINDING = /^(none( found)?|no (findings?|issues?)( found)?|—)\s*(\(.*\))?\.?$/i;
+var RANGE_PRIORITY = /^P[1-4]\s*[\u2013\u2014-]\s*P?[1-4]/;
+var NONE_FINDING = /^(none( found)?|no (findings?|issues?)( found)?|\u2014)\s*(\(.*\))?\.?$/i;
 var DISPOSITION_HEADER = /^(Disposition|Action|Status|Resolution|Fixed)$/i;
 var RESOLVED_DISPOSITION = /^(FIXED|RESOLVED|DONE)\b/i;
 var DEFERRED_DISPOSITION = /^DEFER(RED)?\b/i;
@@ -74,7 +75,7 @@ function parseReviewFindings(taskContent) {
       const priority = (cells[priorityCol] ?? "").trim();
       const finding = (cells[findingCol] ?? "").trim();
       const disposition = dispositionCol === -1 ? "" : (cells[dispositionCol] ?? "").trim();
-      if (PRIORITY_PATTERN.test(priority) && !NONE_FINDING.test(finding) && finding.length > 0 && !RESOLVED_DISPOSITION.test(disposition)) {
+      if (PRIORITY_PATTERN.test(priority) && !RANGE_PRIORITY.test(priority) && !NONE_FINDING.test(finding) && finding.length > 0 && !RESOLVED_DISPOSITION.test(disposition)) {
         const location = locationOf(cells[locationCol] ?? "", finding);
         out.push(DEFERRED_DISPOSITION.test(disposition) ? { priority, location, text: finding, deferral: disposition } : { priority, location, text: finding });
       }
@@ -84,7 +85,7 @@ function parseReviewFindings(taskContent) {
   return out;
 }
 function splitRow(line) {
-  return line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+  return line.trim().replace(/^\|/, "").replace(/\|$/, "").split(/(?<!\\)\|/).map((c) => c.trim());
 }
 function parseDiffMarkers(addedLines) {
   return addedLines.filter((l) => !EXCLUDED_PATHS.some((p) => l.file.startsWith(p))).filter((l) => !l.text.includes(ALLOW_PRAGMA)).filter((l) => MARKER_PATTERN.test(l.text)).map((l) => ({ location: `${l.file}:${l.line}`, text: l.text.trim() }));
@@ -212,7 +213,8 @@ function renderReport(wbs, items, attemptCount) {
 function recordedVerdictPath(runDir, wbs, fs) {
   const evidence = join(runDir, "..", "memory", "evidence");
   const durable = join(evidence, `${wbs}-verdict.json`);
-  for (const path of [join(runDir, ".."), join(evidence, ".."), evidence, durable]) {
+  const run = join(runDir, `${wbs}-verdict.json`);
+  for (const path of [join(runDir, ".."), join(evidence, ".."), evidence, durable, run]) {
     try {
       if (fs.lstatSync(path).isSymbolicLink())
         throw new Error(`residual-scan: symlink evidence path: ${path}`);
@@ -221,7 +223,44 @@ function recordedVerdictPath(runDir, wbs, fs) {
         throw error;
     }
   }
-  return fs.existsSync(durable) ? durable : join(runDir, `${wbs}-verdict.json`);
+  if (!fs.existsSync(durable))
+    return run;
+  if (!fs.existsSync(run))
+    return durable;
+  const newer = (a, b) => mtimeOf(fs, b) > mtimeOf(fs, a) ? b : a;
+  return newer(run, durable);
+}
+function mtimeOf(fs, path) {
+  try {
+    return fs.statSync(path).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function verdictDisagreementNote(runDir, wbs, fs) {
+  const run = join(runDir, `${wbs}-verdict.json`);
+  const durable = join(runDir, "..", "memory", "evidence", `${wbs}-verdict.json`);
+  if (!fs.existsSync(run) || !fs.existsSync(durable))
+    return null;
+  const bytes = (path) => {
+    try {
+      return fs.statSync(path).isFile() ? fs.readFileSync(path, "utf8") : null;
+    } catch {
+      return null;
+    }
+  };
+  const runBytes = bytes(run);
+  if (runBytes === null || runBytes === bytes(durable))
+    return null;
+  const value = (path) => {
+    try {
+      return JSON.parse(bytes(path) ?? "{}").verdict ?? "?";
+    } catch {
+      return "?";
+    }
+  };
+  const winner = mtimeOf(fs, durable) > mtimeOf(fs, run) ? "durable" : "run";
+  return `residual-fold: ${wbs} verdict copies disagree — run=${run} (${value(run)}) durable=${durable} (${value(durable)})` + ` → chose ${winner} (newer mtime)`;
 }
 
 // plugins/sp/lib/spur-bin.ts
@@ -337,9 +376,7 @@ function loadTask(env, spurBinFlag, wbs, root) {
   const featureId = [parsed.feature_id, parsed.frontmatter?.feature_id].find((v) => typeof v === "string") ?? "";
   return { content: typeof parsed.content === "string" ? parsed.content : "", featureId };
 }
-function loadVerdict(runDir, wbs) {
-  return JSON.parse(fs.readFileSync(recordedVerdictPath(runDir, wbs, fs), "utf8"));
-}
+var loadVerdict = (runDir, wbs) => JSON.parse(fs.readFileSync(recordedVerdictPath(runDir, wbs, fs), "utf8"));
 function scanMode(opts, env, io) {
   const runDir = join2(opts.root, ".spur", "run");
   fs.mkdirSync(runDir, { recursive: true });
@@ -355,6 +392,10 @@ function foldMode(opts, _env, io) {
   const runDir = join2(opts.root, ".spur", "run");
   const scan = JSON.parse(fs.readFileSync(join2(runDir, `${opts.wbs}-residuals.json`), "utf8"));
   const target = recordedVerdictPath(runDir, opts.wbs, fs);
+  const note = verdictDisagreementNote(runDir, opts.wbs, fs);
+  if (note !== null)
+    io.out(`${note}
+`);
   const verdict = loadVerdict(runDir, opts.wbs);
   const findingsPath = join2(runDir, `${opts.wbs}-test-gate.findings`);
   const fold = foldVerdict(verdict, scan, fs.existsSync(findingsPath) ? fs.readFileSync(findingsPath, "utf8") : "");
@@ -469,6 +510,7 @@ function main(argv, env = getEnvVars(), options = {}) {
 }
 process.exit(main(process.argv.slice(2)));
 export {
+  verdictDisagreementNote,
   scanResiduals2 as scanResiduals,
   renderReport,
   recordedVerdictPath,

package/plugins/sp/scripts/residual-scan.ts

@@ -115,9 +115,8 @@ function loadTask(env: ScanEnv, spurBinFlag: string | undefined, wbs: string, ro
         [parsed.feature_id, parsed.frontmatter?.feature_id].find((v): v is string => typeof v === 'string') ?? '';
     return { content: typeof parsed.content === 'string' ? parsed.content : '', featureId };
 }
-function loadVerdict(runDir: string, wbs: string): VerdictFile {
-    return JSON.parse(fs.readFileSync(core.recordedVerdictPath(runDir, wbs, fs), 'utf8'));
-}
+const loadVerdict = (runDir: string, wbs: string): VerdictFile =>
+    JSON.parse(fs.readFileSync(core.recordedVerdictPath(runDir, wbs, fs), 'utf8'));
 function scanMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     const runDir = join(opts.root, '.spur', 'run');
     fs.mkdirSync(runDir, { recursive: true });
@@ -135,6 +134,8 @@ function foldMode(opts: ParsedArgs, _env: ScanEnv, io: ScanIo): number {
         fs.readFileSync(join(runDir, `${opts.wbs}-residuals.json`), 'utf8'),
     ) as core.ResidualArtifact;
     const target = core.recordedVerdictPath(runDir, opts.wbs, fs);
+    const note = core.verdictDisagreementNote(runDir, opts.wbs, fs);
+    if (note !== null) io.out(`${note}\n`);
     const verdict = loadVerdict(runDir, opts.wbs);
     const findingsPath = join(runDir, `${opts.wbs}-test-gate.findings`);
     const fold = core.foldVerdict(

package/plugins/sp/scripts/task-diffstat.mjs

@@ -3,7 +3,7 @@
 
 // plugins/sp/scripts/task-diffstat.ts
 import { spawnSync } from "child_process";
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { fstatSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "fs";
 import { join } from "path";
 
 // plugins/sp/lib/env.ts
@@ -85,10 +85,14 @@ function runDiffstat(env, options = {}, git = defaultGitRunner(options.cwd)) {
     process.stderr.write(`task-diffstat: ${reason} \u2014 failing safe (sensitive)
 `);
     const row2 = { files: 0, insertions: 0, deletions: 0, paths: [], sensitive: true };
-    writeFileSync(abs(relResult), `${JSON.stringify(row2)}
-`);
+    writeArtifact(abs(relResult), row2);
     return { ...row2, resultFile: relResult, exitCode: 0 };
   };
+  let stdoutIsArtifact = false;
+  try {
+    const [out, art] = [fstatSync(1), statSync(abs(relResult))];
+    stdoutIsArtifact = out.dev === art.dev && out.ino === art.ino;
+  } catch {}
   let base = "";
   try {
     base = readFileSync(abs(join(relRun, `${wbs}-base.sha`)), "utf8").trim();
@@ -125,9 +129,17 @@ function runDiffstat(env, options = {}, git = defaultGitRunner(options.cwd)) {
   const all = [...paths].filter((p) => p.length > 0).sort();
   const sensitive = all.some((p) => sensitiveReasonForPath(p) !== null);
   const row = { files: all.length, insertions, deletions, paths: all, sensitive };
-  writeFileSync(abs(relResult), `${JSON.stringify(row)}
+  writeArtifact(abs(relResult), row);
+  if (stdoutIsArtifact)
+    process.stderr.write(`task-diffstat: stdout redirected onto the artifact \u2014 kept; redirect stdout elsewhere
+`);
+  return { ...row, resultFile: relResult, exitCode: stdoutIsArtifact ? 1 : 0 };
+}
+function writeArtifact(absPath, row) {
+  const tmp = `${absPath}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(row)}
 `);
-  return { ...row, resultFile: relResult, exitCode: 0 };
+  renameSync(tmp, absPath);
 }
 var TASK_DIFFSTAT_USAGE = "usage: task-diffstat  (env: wbs)";
 function main(argv, env = getEnvVars(), options = {}) {