@juzser/blacksmith 0.2.0 → 0.4.0

package/factory/orchestrator/dist/lessons.js

@@ -34,7 +34,7 @@ import { foldLessons } from './db/projector.js';
 import { SmithError } from './errors.js';
 import { appendEvent, readLineageEvents } from './events.js';
 import { AGENTS_DIR, lessonsReadPath } from './paths.js';
-import { LESSON_SCOPES, parseLessons } from './severity.js';
+import { FILE_SCOPED_SCOPES, isFileScopedScope, LESSON_SCOPES, parseLessons, } from './severity.js';
 import { loadTaxonomy, validateTag } from './taxonomy.js';
 export class LessonsError extends SmithError {
 }
@@ -655,6 +655,26 @@ export function lessonsForDispatch(role, claimPaths, opts = {}) {
         warnings,
     };
 }
+// ---------------------------------------------------------------------------
+// (c) smith dream — decision-checkpoint extraction
+// ---------------------------------------------------------------------------
+/**
+ * The checkpoint roster, in scan order — the one place a checkpoint type is
+ * declared. `CheckpointType` is derived from it and `CHECKPOINT_EXTRACTORS` is
+ * a total `Record` over it, so a type named here without an extractor, or an
+ * extractor written without a name here, is a compile error rather than a scan
+ * that silently never runs.
+ *
+ * The order is load-bearing: `extractDecisionCheckpoints` takes the first
+ * extractor that claims an event and stops, so placing a new type ahead of an
+ * existing one decides which of the two wins.
+ */
+export const CHECKPOINT_TYPES = [
+    'plan-sign-off',
+    'waiver-decision',
+    'escalation',
+    'gate-block',
+];
 function planSignOffCheckpoint(event) {
     const { record } = event;
     // D-164: this used to demand `actor === 'operator'` exactly. Six of the
@@ -714,16 +734,17 @@ function gateBlockCheckpoint(event) {
         summary: `Gate blocked on ${record.task_id ?? 'unknown task'} (${p.reason ?? 'unspecified reason'})`,
     };
 }
-const CHECKPOINT_EXTRACTORS = [
-    planSignOffCheckpoint,
-    waiverDecisionCheckpoint,
-    escalationCheckpoint,
-    gateBlockCheckpoint,
-];
+const CHECKPOINT_EXTRACTORS = {
+    'plan-sign-off': planSignOffCheckpoint,
+    'waiver-decision': waiverDecisionCheckpoint,
+    escalation: escalationCheckpoint,
+    'gate-block': gateBlockCheckpoint,
+};
 /**
  * Deterministic scan for decision checkpoints (architecture §9.1: "what was
- * proposed, approved, modified, rejected — and why"): plan sign-offs, waiver
- * grants/denials, escalations (coordination.* errors), and gate blocks.
+ * proposed, approved, modified, rejected — and why"). `CHECKPOINT_TYPES` is
+ * the roster it walks, in that order, and the first extractor to claim an
+ * event owns it.
  */
 export function extractDecisionCheckpoints(events, since) {
     const sinceMs = since ? Date.parse(since) : null;
@@ -731,8 +752,8 @@ export function extractDecisionCheckpoints(events, since) {
     for (const event of events) {
         if (sinceMs !== null && Date.parse(event.record.ts) < sinceMs)
             continue;
-        for (const extractor of CHECKPOINT_EXTRACTORS) {
-            const checkpoint = extractor(event);
+        for (const checkpointType of CHECKPOINT_TYPES) {
+            const checkpoint = CHECKPOINT_EXTRACTORS[checkpointType](event);
             if (checkpoint) {
                 checkpoints.push(checkpoint);
                 break;
@@ -868,11 +889,18 @@ export async function dream(events, ctx, opts = {}, options = {}) {
 // (d) The operator's raise verb — P9-34
 // ---------------------------------------------------------------------------
 /**
- * Scopes whose compiled entry is matched against a file path by the
- * same-mistake gate (severity.ts's own FILE_SCOPED set — kept in sync by the
- * warnings below, which are the only thing that reads this).
+ * "claim-path, stack-wide and security" — severity.ts's ruling, read out for
+ * the warning below. The warning tells the operator what the same-mistake gate
+ * will do with their entry, so it has to name the scopes that gate actually
+ * matches; typing them into the sentence made this file's third-hand copy of a
+ * decision it does not own.
  */
-const FILE_SCOPED_SCOPES = new Set(['claim-path', 'stack-wide', 'security']);
+function fileScopedScopeList() {
+    const scopes = [...FILE_SCOPED_SCOPES];
+    if (scopes.length <= 1)
+        return scopes.join('');
+    return `${scopes.slice(0, -1).join(', ')} and ${scopes[scopes.length - 1]}`;
+}
 /**
  * Everything that is legal but inert about `shape`, in the operator's words.
  *
@@ -889,12 +917,12 @@ const FILE_SCOPED_SCOPES = new Set(['claim-path', 'stack-wide', 'security']);
 function scopeMismatchWarnings(shape) {
     const warnings = [];
     if (shape.lessonType === 'rule' &&
-        FILE_SCOPED_SCOPES.has(shape.lessonScope) &&
+        isFileScopedScope(shape.lessonScope) &&
         !shape.findingCategory) {
         warnings.push('A file-scoped `rule` with no finding_category is injected at dispatch but can never escalate: severity.ts skips a category-less lesson.');
     }
-    if (shape.claimPath && !FILE_SCOPED_SCOPES.has(shape.lessonScope)) {
-        warnings.push(`claim_path is ignored for a ${shape.lessonScope}-scoped lesson — severity.ts only matches claim-path, stack-wide and security entries against a file.`);
+    if (shape.claimPath && !isFileScopedScope(shape.lessonScope)) {
+        warnings.push(`claim_path is ignored for a ${shape.lessonScope}-scoped lesson — severity.ts only matches ${fileScopedScopeList()} entries against a file.`);
     }
     // A selector on the wrong scope is never read back: lessonsForScope consults
     // exactly one field per scope. Warn rather than refuse — the entry is still

package/factory/orchestrator/dist/logCache.js

@@ -0,0 +1,291 @@
+// The daemon's fix for finding 50acc356: `runTick` used to call `readEvents`
+// for every session on every tick, re-reading and re-parsing every byte ever
+// written to every log, forever. This module is the one place that reads a
+// session log more than once in a process's lifetime, and it reads each log
+// exactly once per byte that was ever appended to it.
+//
+// The fingerprint that decides "did this log change" is taken from an OPEN
+// file descriptor's fstat, never a path stat: `stat(path)` can race a
+// concurrent writer (open, then unlink-and-replace, then stat sees the new
+// inode while a reader mid-read still holds the old one) in a way an fstat on
+// a handle already open for THIS read cannot.
+//
+// Per log, the cache keeps an OFFSET (the byte offset just past the last
+// consumed newline) and an ANCHOR (the bytes of the last complete line,
+// terminating newline included, occupying exactly
+// `[offset - anchor.length, offset)`). A grown file is read once, from
+// `offset - anchor.length` to the new end; only when the leading
+// `anchor.length` bytes of that read still equal the cached anchor is the
+// growth treated as a genuine append, and only the bytes after `offset` are
+// parsed. Every other outcome — a different dev/ino, a shrink, an anchor
+// mismatch, or a cached offset of 0 with no anchor at all — is a full
+// re-read from byte 0.
+//
+// RESIDUAL CONTRACT: session logs are append-only by design (`appendEvent`
+// only ever appends). This cache DETECTS truncation, replacement, and any
+// rewrite that changes the anchor's bytes or offset. It does NOT detect an
+// in-place rewrite, on the same inode, that happens to keep the anchor's
+// bytes — terminating newline included — sitting in the same
+// `[offset - anchor.length, offset)` window, nor a same-size rewrite that
+// lands inside one mtime tick. Both are out of scope: nothing in this repo
+// writes a session log that way, so this is stated as a limit rather than
+// implied to be full change detection.
+import { open } from 'node:fs/promises';
+import path from 'node:path';
+import { EventError } from './events.js';
+import { STATE_EVENTS_DIR } from './paths.js';
+function fpEqual(a, b) {
+    return a.dev === b.dev && a.ino === b.ino && a.size === b.size && a.mtimeMs === b.mtimeMs;
+}
+/** Whatever a thrown value has to say for itself, without assuming it is an Error. */
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Same algorithm as `events.ts`'s private `readEventsAtPath` — trim trailing
+ * whitespace, split on `\n`, drop empty lines, parse each survivor as JSON —
+ * copied rather than imported so this module never calls `readEvents` (the
+ * `readEventsCalls` seam stays truthfully zero) while still throwing the
+ * identical `events.unreadable-session-log` error other readers throw.
+ *
+ * `startIndex` offsets the event id / line-number math for a delta parse:
+ * parsing only the newly appended tail of a log must still number its events
+ * (and report a malformed line's number) as if the whole file had been
+ * parsed at once.
+ */
+function parseCompleteLines(text, sessionId, filePath, startIndex) {
+    const lines = text
+        .trimEnd()
+        .split('\n')
+        .filter((line) => line.length > 0);
+    return lines.map((line, offset) => {
+        const index = startIndex + offset;
+        let record;
+        try {
+            record = JSON.parse(line);
+        }
+        catch (err) {
+            throw new EventError('events.unreadable-session-log', `Line ${index + 1} of ${filePath} is not JSON, so session "${sessionId}" cannot be read: ${errorText(err)}.`, { session_id: sessionId, path: filePath, line: index + 1 });
+        }
+        return { event_id: `${sessionId}#${index}`, record };
+    });
+}
+/**
+ * Parse a JSON pending tail — a well-formed JSON value with no terminating
+ * newline yet — into the one event it names. Throws the same
+ * `events.unreadable-session-log` error, with the same line number,
+ * `readEvents` would report for a malformed final line.
+ */
+function parsePendingTail(text, sessionId, filePath, index) {
+    let record;
+    try {
+        record = JSON.parse(text);
+    }
+    catch (err) {
+        throw new EventError('events.unreadable-session-log', `Line ${index + 1} of ${filePath} is not JSON, so session "${sessionId}" cannot be read: ${errorText(err)}.`, { session_id: sessionId, path: filePath, line: index + 1 });
+    }
+    return { event_id: `${sessionId}#${index}`, record };
+}
+const NEWLINE = 0x0a;
+/**
+ * Tail-detection and parse, applied to the RAW, untrimmed bytes of
+ * `tailBuf` — everything at and after `baseOffset` in the log.
+ *
+ * Locates the LAST `\n` in `tailBuf`: everything up to and including it is
+ * newline-terminated ("complete") lines, parsed and cached; everything after
+ * it is the candidate pending tail. A whitespace-only (or empty) candidate is
+ * no pending tail at all. `baseAnchor`/`baseOffset` are reused unchanged when
+ * `tailBuf` holds no newline — nothing newline-terminated was added, so
+ * nothing the entry remembers may advance.
+ */
+function parseTail(tailBuf, sessionId, filePath, baseOffset, baseIndex, baseAnchor, baseCachedEvents) {
+    const lastNL = tailBuf.lastIndexOf(NEWLINE);
+    let offset = baseOffset;
+    let anchor = baseAnchor;
+    let newComplete = [];
+    let pendingBuf;
+    if (lastNL === -1) {
+        pendingBuf = tailBuf;
+    }
+    else {
+        const completeBuf = tailBuf.subarray(0, lastNL + 1);
+        const prevNL = lastNL <= 0 ? -1 : tailBuf.lastIndexOf(NEWLINE, lastNL - 1);
+        const anchorStart = prevNL === -1 ? 0 : prevNL + 1;
+        anchor = Buffer.from(tailBuf.subarray(anchorStart, lastNL + 1));
+        offset = baseOffset + lastNL + 1;
+        newComplete = parseCompleteLines(completeBuf.toString('utf8'), sessionId, filePath, baseIndex);
+        pendingBuf = tailBuf.subarray(lastNL + 1);
+    }
+    const cachedEvents = newComplete.length === 0 ? [...baseCachedEvents] : [...baseCachedEvents, ...newComplete];
+    const pendingText = pendingBuf.toString('utf8');
+    if (pendingText.trim().length === 0) {
+        return { cachedEvents, events: cachedEvents, offset, anchor };
+    }
+    const pendingIndex = baseIndex + newComplete.length;
+    const pendingEvent = parsePendingTail(pendingText, sessionId, filePath, pendingIndex);
+    return { cachedEvents, events: [...cachedEvents, pendingEvent], offset, anchor };
+}
+const EMPTY_SEAM = {
+    opens: 0,
+    fstats: 0,
+    bytesRead: 0,
+    readEventsCalls: 0,
+    fullReparses: 0,
+};
+/**
+ * A reusable, package-internal cache of session event logs, keyed by a
+ * fingerprint taken from an open handle rather than a path stat.
+ *
+ * One instance is meant to live across many `runTick` calls (the daemon's
+ * long-running loop holds one for its whole run); a fresh instance is always
+ * cold, so `runTick` with no shared cache reads exactly what `readEvents`
+ * would have — this is an optimization for the repeat-tick case, not a
+ * change in what any single read returns.
+ */
+export class LogCache {
+    entries = new Map();
+    appliedSignatures = new Map();
+    counters;
+    /** `seam` lets a caller inject (and so share, or directly assert on) the counting object. */
+    constructor(seam) {
+        this.counters = seam ?? { ...EMPTY_SEAM };
+    }
+    logPath(sessionId, opts) {
+        return path.join(opts.stateDir ?? STATE_EVENTS_DIR, `${sessionId}.jsonl`);
+    }
+    /** This session's log, read through the cache. */
+    async read(sessionId, opts = {}) {
+        const filePath = this.logPath(sessionId, opts);
+        let handle;
+        try {
+            handle = await open(filePath, 'r');
+            this.counters.opens += 1;
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                // The previous entry, if any, is left untouched — same rule as a
+                // read that throws below. A log that has vanished (and may come
+                // back) is not the same fact as a log this cache has never seen.
+                return [];
+            }
+            throw err;
+        }
+        try {
+            const stats = await handle.stat();
+            this.counters.fstats += 1;
+            const fp = {
+                dev: stats.dev,
+                ino: stats.ino,
+                size: stats.size,
+                mtimeMs: stats.mtimeMs,
+            };
+            const cached = this.entries.get(sessionId);
+            if (cached !== undefined && fpEqual(fp, cached.fp)) {
+                return cached.events;
+            }
+            // Append-only is verified, never inferred from size: the incremental
+            // path is only even attempted when the anchor byte-for-byte matches
+            // what the file now holds at the same window.
+            const canAttemptIncremental = cached !== undefined &&
+                fp.dev === cached.fp.dev &&
+                fp.ino === cached.fp.ino &&
+                cached.anchor.length > 0 &&
+                fp.size >= cached.offset;
+            if (canAttemptIncremental) {
+                // biome-ignore lint/style/noNonNullAssertion: canAttemptIncremental narrows `cached`.
+                const entry = cached;
+                const start = entry.offset - entry.anchor.length;
+                const readLen = fp.size - start;
+                const buf = Buffer.alloc(readLen);
+                const { bytesRead } = await handle.read(buf, 0, readLen, start);
+                this.counters.bytesRead += bytesRead;
+                const slice = buf.subarray(0, bytesRead);
+                if (slice.subarray(0, entry.anchor.length).equals(entry.anchor)) {
+                    const tailBuf = slice.subarray(entry.anchor.length);
+                    const parsed = parseTail(tailBuf, sessionId, filePath, entry.offset, entry.cachedEvents.length, entry.anchor, entry.cachedEvents);
+                    this.entries.set(sessionId, {
+                        fp,
+                        offset: parsed.offset,
+                        anchor: parsed.anchor,
+                        cachedEvents: parsed.cachedEvents,
+                        events: parsed.events,
+                    });
+                    return parsed.events;
+                }
+                // Anchor mismatch: a same-size-or-larger rewrite that is not a
+                // genuine append. Fall through to a full re-read.
+            }
+            this.counters.fullReparses += 1;
+            const whole = await handle.readFile();
+            this.counters.bytesRead += whole.length;
+            const parsed = parseTail(whole, sessionId, filePath, 0, 0, Buffer.alloc(0), []);
+            this.entries.set(sessionId, {
+                fp,
+                offset: parsed.offset,
+                anchor: parsed.anchor,
+                cachedEvents: parsed.cachedEvents,
+                events: parsed.events,
+            });
+            return parsed.events;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    /** The `event_id` of this session's last event, or `null` for empty/absent. */
+    async lastEventId(sessionId, opts = {}) {
+        const events = await this.read(sessionId, opts);
+        return events.length === 0 ? null : events[events.length - 1].event_id;
+    }
+    /**
+     * The fingerprint this cache last read for `sessionId`, or `undefined` if
+     * it has never been read through this cache. Lets a caller (the daemon's
+     * apply-skip below) build a cheap in-memory signature over a set of
+     * sessions without re-reading any of them.
+     */
+    fingerprintOf(sessionId) {
+        return this.entries.get(sessionId)?.fp;
+    }
+    /**
+     * The signature this cache last recorded a projector `apply()` against for
+     * `leaf` (`setAppliedSignature`'s argument), so the daemon can skip a
+     * redundant apply when nothing in the leaf's lineage changed since.
+     */
+    getAppliedSignature(leaf) {
+        return this.appliedSignatures.get(leaf);
+    }
+    setAppliedSignature(leaf, signature) {
+        this.appliedSignatures.set(leaf, signature);
+    }
+    /**
+     * Evicts every key not in `liveSessionIds` from both `entries` and
+     * `appliedSignatures`, so the cache's memory is bounded by live logs, not
+     * by history. `runTick` calls this once per tick with the session ids
+     * `listSessionIds` just returned -- the LISTED set, not the set of
+     * sessions whose read succeeded this tick -- so a session that is listed
+     * but unreadable keeps its entry (a read that throws leaves the entry
+     * untouched; eviction is the tick's decision, driven by the listing, not
+     * the read). A session that vanishes and later reappears loses both its
+     * fingerprint and its applied signature, so it is read cold and its leaf
+     * is re-applied. One pass over each map's own keys; no file I/O.
+     */
+    retainOnly(liveSessionIds) {
+        for (const sessionId of this.entries.keys()) {
+            if (!liveSessionIds.has(sessionId))
+                this.entries.delete(sessionId);
+        }
+        for (const leaf of this.appliedSignatures.keys()) {
+            if (!liveSessionIds.has(leaf))
+                this.appliedSignatures.delete(leaf);
+        }
+    }
+}
+/**
+ * The public factory. `dist/logCache.js` exports this, the `LogCache` type
+ * it returns, and the `LogCacheSeam` type its optional argument takes — the
+ * three names a consumer (task 3's dashboard wiring) imports to inject a
+ * counting cache elsewhere.
+ */
+export function createLogCache(seam) {
+    return new LogCache(seam);
+}

package/factory/orchestrator/dist/paths.js

@@ -11,6 +11,16 @@ const here = path.dirname(fileURLToPath(import.meta.url));
  * assets ships in the tarball. `packaging.test.ts` holds that claim.
  */
 export const REPO_ROOT = path.resolve(here, '..', '..', '..');
+/**
+ * Is `dir` this factory's own checkout, resolved rather than compared raw so
+ * a trailing slash or a relative path names the same answer. `audit.ts`
+ * (`auditedProjectName`) and `projects.ts` (`unwatchedProjects`) both need to
+ * tell "this clone, filed under its own directory name" from "a project that
+ * is genuinely named that" and used to each spell the comparison themselves.
+ */
+export function isFactoryCheckout(dir) {
+    return path.resolve(dir) === path.resolve(REPO_ROOT);
+}
 /**
  * Is this module running out of the blacksmith clone, or out of an installed
  * copy of the package?

package/factory/orchestrator/dist/plan.js

@@ -6,6 +6,7 @@ import { SmithError } from './errors.js';
 import { topoSort } from './graph.js';
 import { SPECS_ACTIVE_DIR } from './paths.js';
 import { compileSchemas, validateRecord, } from './schemas.js';
+import { epicOfTaskId } from './taskId.js';
 import { loadTaxonomy, TaxonomyError, validateRequiredDimensions, } from './taxonomy.js';
 export class PlanError extends SmithError {
 }
@@ -133,6 +134,122 @@ export function loadPlan(epicId, version, opts = {}) {
     }
     return JSON.parse(readFileSync(filePath, 'utf8'));
 }
+/**
+ * A task ref's project, read off its own epic's latest plan version -- the
+ * D-246 precedent (`db/projector.ts`'s `planProjectResolver`, for the board)
+ * restated here so `errorIssues.ts` can answer the same question without
+ * importing anything database-shaped (`test/cliBoot.test.ts` pins `cli.ts`'s
+ * built module graph off drizzle/sqlite entirely, and `cli.ts` statically
+ * imports the error-issue reporter).
+ *
+ * Never throws and never guesses: an id with no epic segment, an epic with
+ * no plan on disk, and an unreadable or unparseable plan file all answer
+ * `null` alike, on purpose -- "cannot tell" and "the plan has no project" are
+ * the same non-answer to a caller that must never turn either one into this
+ * factory's own name. Answers cache by epic id for the resolver's lifetime,
+ * since one `issues report` run reads the same epic's plan for every row
+ * that epic contributed.
+ */
+export function planProjectResolverForTaskRef(opts = {}) {
+    const cache = new Map();
+    return (taskRef) => {
+        const epicId = epicOfTaskId(taskRef);
+        if (epicId === null)
+            return null;
+        const cached = cache.get(epicId);
+        if (cached !== undefined)
+            return cached;
+        let project = null;
+        try {
+            const version = latestPlanVersion(epicId, opts);
+            if (version !== null)
+                project = loadPlan(epicId, version, opts).project ?? null;
+        }
+        catch {
+            // Unreadable or unparseable plan file: no answer, not a crash.
+        }
+        cache.set(epicId, project);
+        return project;
+    };
+}
+/**
+ * Whether `opts.specsDir` names THIS checkout's own specs/active tree --
+ * absent (so `planFilePath`/`latestPlanVersion` fall back to
+ * `SPECS_ACTIVE_DIR` themselves) or an explicit path that resolves to the
+ * same directory. Only then is a plan found there, naming no project,
+ * evidence of "self": `--specs-dir` is also how a caller points this
+ * resolver at a DIFFERENT checkout's specs tree entirely -- `issueInputs`'s
+ * own doc comment names "the daemon's own event log and a target checkout's
+ * specs tree" as an intended use -- and a plan found THERE naming no project
+ * is that other project's own silence, not this factory's (S2-b).
+ */
+function isSelfSpecsDir(opts) {
+    return opts.specsDir === undefined || path.resolve(opts.specsDir) === SPECS_ACTIVE_DIR;
+}
+/**
+ * The self-fallback half of `planProjectResolverForTaskRefOrSelf`, on its
+ * own: a plan found on disk for the epic that simply declares no `project`
+ * field IS this factory's own project, by construction -- only this
+ * checkout's own epics have a plan under `specs/active` at all, so finding
+ * one there is itself the "self" signal a foreign epic's plan (which lives
+ * in the foreign project's own specs tree, never this one) can never
+ * produce. An epic with no plan on disk anywhere, or a bare ref with no
+ * epic segment, answers `null` -- "cannot tell whose project this is" --
+ * because plan.ts must not be the module that hardcodes this factory's
+ * name; the caller supplies it.
+ *
+ * That "only this checkout's own epics" premise holds only while `opts`
+ * actually points at this checkout's own specs/active tree
+ * (`isSelfSpecsDir`, S2-b): a caller that redirected `--specs-dir` at some
+ * OTHER checkout's specs tree gets no self-fallback at all, `null` only,
+ * because a plan found there naming no project is that other checkout's own
+ * silence, not this factory's.
+ *
+ * Exported as its own resolver, separate from `planProjectResolverForTaskRef`
+ * (S2-c): production callers (`cli.ts`'s `issueInputs`) hand the two to
+ * `withSessionFallback`/`foldErrorEvents` as DISTINCT tiers -- the strict
+ * resolver first, then a session's own unanimous stamp, and only then this
+ * guess -- so a session-mate's real stamp naming a different project
+ * outranks this weakest signal rather than losing to it, which is what
+ * happened when the two were folded into one resolver and tried together as
+ * a single first tier.
+ */
+export function planSelfFallbackForTaskRef(selfProject, opts = {}) {
+    const selfEligible = isSelfSpecsDir(opts);
+    const hasPlanCache = new Map();
+    return (taskRef) => {
+        if (!selfEligible)
+            return null;
+        const epicId = epicOfTaskId(taskRef);
+        if (epicId === null)
+            return null;
+        let hasPlan = hasPlanCache.get(epicId);
+        if (hasPlan === undefined) {
+            hasPlan = latestPlanVersion(epicId, opts) !== null;
+            hasPlanCache.set(epicId, hasPlan);
+        }
+        return hasPlan ? selfProject : null;
+    };
+}
+/**
+ * `planProjectResolverForTaskRef` composed with `planSelfFallbackForTaskRef`
+ * as a single resolver, direct answer first and self-fallback second, for
+ * callers that want the OLD combined behavior (both tiers tried back to
+ * back, with nothing -- such as a session stamp -- able to sit between
+ * them). Kept for callers that do not need the S2-c tier split; `cli.ts`'s
+ * `issueInputs` no longer uses this, it hands the two halves to
+ * `withSessionFallback` separately instead.
+ */
+export function planProjectResolverForTaskRefOrSelf(selfProject, opts = {}) {
+    const resolve = planProjectResolverForTaskRef(opts);
+    const selfFallback = planSelfFallbackForTaskRef(selfProject, opts);
+    return (taskRef) => {
+        const direct = resolve(taskRef);
+        if (direct !== null)
+            return direct;
+        return selfFallback(taskRef);
+    };
+}
 /**
  * Reduce an `output_schema_ref` to the name the compiled schema set knows it
  * by. `compileSchemas` keys on filename-minus-`.schema.json`, so a path, a
@@ -175,12 +292,16 @@ const GLOB_CHARS = /[*?[{]/;
 /**
  * A `keeps_exports` promise is a file the task swears to keep the exports of,
  * and the post-run verifier reads it back against the task's diff. Three
- * things make a promise unverifiable, and each is caught here, at plan time:
+ * things make a promise unverifiable at plan time, and each is caught here:
  * a pattern (the verifier diffs one file, not a glob), a file outside the
  * task's claims (the task cannot edit it, so its diff never shows it), and a
- * file listed twice (which entry did the verifier report?). Shape is the
- * schema's business; when the schema already rejected the field, this reads
- * nothing and reports nothing, so the operator sees one error, not two.
+ * file listed twice (which entry did the verifier report?). A fourth is not
+ * knowable here and is answered where it is knowable: a promise on a file the
+ * symbol scanner does not speak for reads back `unverified`, not `kept`
+ * (impact.ts collectExportDiffs) — because whether this repo's scanner can
+ * parse that file is a fact about the checkout, not about the plan. Shape is
+ * the schema's business; when the schema already rejected the field, this
+ * reads nothing and reports nothing, so the operator sees one error, not two.
  */
 function unkeptPromises(t, schemaIssues) {
     const promises = t.keeps_exports;
@@ -505,6 +626,19 @@ export function livePlanTasks(plan) {
     }
     return live;
 }
+/**
+ * The plan's tasks in the shape `resolveFindingOwner` reads: only the live
+ * (D-126) ones, and only the `claims` field ownership resolution needs. This
+ * is `livePlanTasks` restated as claims rather than full specs, so a caller
+ * asking "does some task in this plan still claim that file?" (`audit
+ * resolve`) gets the same live/superseded rule `epic verdict` does, not the
+ * raw `plan.tasks` array that also holds every amendment left behind.
+ */
+export function planClaimedTasks(plan) {
+    return livePlanTasks(plan)
+        .filter((task) => Array.isArray(task.claims))
+        .map((task) => ({ task_id: task.task_id, claims: task.claims }));
+}
 /**
  * What makes two records the same *spec*: everything except the version stamp
  * and the workflow status. `nextVersion` rewrites `plan_version` on every

package/factory/orchestrator/dist/planQuorum.js

@@ -192,7 +192,7 @@ const DEFAULT_JUDGE_BUDGET = { timeout_ms: 120_000, max_output_bytes: 262_144 };
  * case/token budgets, each task's acceptance criteria and nonfunctional
  * clauses, edge count, fired triggers with their evidence) — never file
  * contents, never a diff. The criteria are part of the claim, not evidence
- * for it: FD-46 (csb-signing-policy-1) had both external critics refute
+ * for it: FD-46 had both external critics refute
  * plan-v1 for missing a case its task already listed as a criterion, because
  * the prompt showed them the objective and nothing under it. The tasks it
  * lists are `livePlanTasks`, not `plan.tasks`: this prompt is the whole of