@juzser/blacksmith 0.3.0 → 0.4.0

package/factory/orchestrator/dist/epic.js

@@ -9,7 +9,7 @@ import { latestIntegrationCheck } from './integration.js';
 import { mcpBlockers } from './mcp.js';
 import { bareTaskId, latestPlanVersion, livePlanTasks, loadPlan } from './plan.js';
 import { enabledExternalProviders, nativeProviderName, runQuorumCase, } from './quorum.js';
-import { latestSpecReview, specReviewBlockers } from './spec.js';
+import { latestSpecReview, specReviewBlockers, taskSuccessors, } from './spec.js';
 import { TERMINAL_OK_TASK_STATUSES } from './taskStatus.js';
 import { auditWaveConcurrency, WAVE_VERDICTS, zeroedCounts, } from './waveConcurrency.js';
 import { RESERVED_TASK_ID } from './worktree.js';
@@ -47,6 +47,90 @@ import { RESERVED_TASK_ID } from './worktree.js';
  */
 /** The terminal-OK status that is a decision rather than a completion (D-120). */
 const WAIVED_TASK_STATUS = 'waived';
+/**
+ * A task a re-plan (`plan amend`) replaced with a successor task cut under a
+ * later plan version. `TERMINAL_TASK_STATUSES` (taskStatus.ts) already counts
+ * this as over; it is deliberately NOT in `TERMINAL_OK_TASK_STATUSES`, because
+ * "over" is not the same as "well" — the work only actually landed if the
+ * successor did. `resolveSupersededRow` below is what asks that question.
+ */
+const SUPERSEDED_TASK_STATUS = 'superseded';
+/**
+ * Follows a superseded task to whatever eventually carries its work, walking
+ * a possibly multi-hop chain (a successor can itself be superseded by a
+ * later amendment). Returns the first row in the chain that is not itself
+ * superseded, or `undefined` when the chain is missing a hop, names a task
+ * with no fold record, or cycles back on itself — every one of those reads
+ * as "no successor to vouch for this", the fail-closed answer.
+ *
+ * `successors` is folded off the event log (spec.ts's `taskSuccessors`), so
+ * its keys and values are whatever `plan-version-created` recorded — not
+ * necessarily bare (D-46/P9-29) — hence comparing through `bareTaskId` at
+ * every hop rather than assuming the map is pre-normalized.
+ */
+function resolveSupersededRow(epicId, taskId, tasks, successors) {
+    const bareSuccessors = new Map([...successors].map(([from, to]) => [bareTaskId(epicId, from), to]));
+    const visited = new Set([bareTaskId(epicId, taskId)]);
+    let currentId = bareTaskId(epicId, taskId);
+    for (;;) {
+        const nextId = bareSuccessors.get(currentId);
+        if (nextId === undefined)
+            return undefined;
+        const nextBare = bareTaskId(epicId, nextId);
+        if (visited.has(nextBare))
+            return undefined;
+        visited.add(nextBare);
+        const row = tasks.find((t) => bareTaskId(epicId, t.taskId) === nextBare);
+        if (row === undefined)
+            return undefined;
+        if (row.taskStatus !== SUPERSEDED_TASK_STATUS)
+            return row;
+        currentId = nextBare;
+    }
+}
+/**
+ * The `origin` taskEvents.ts's `emitFollowUpTask` stamps on a follow-up task:
+ * one minted for a finding no open task could own, rather than one a plan cut.
+ */
+const FOLLOW_UP_TASK_ORIGIN = 'escalation';
+/** The finding status that is the operator's decision not to fix (D-120). */
+const WAIVED_FINDING_STATUS = 'waived';
+/**
+ * Whether a follow-up task's whole reason to exist has been waived away. A
+ * follow-up is minted `todo` to own findings, and no event ever moves it to
+ * `waived` — the projector has no such write — so without this the operator
+ * waiving the only finding it owns (bs-audit-2's `followup-9a8f6ac7`) left the
+ * task holding the epic verdict forever, with nothing left to do and no verb
+ * that could say so.
+ *
+ * Deliberately narrow, the same reader-side shape as the superseded-successor
+ * rule above:
+ *   - only origin `escalation`: a planned task's `todo` is a claim about work
+ *     its spec still owes, which waiving a finding raised against it does not
+ *     discharge;
+ *   - at least one attributed finding: a follow-up that owns nothing is not
+ *     "all waived", it is unexplained, and absence must not vote yes (D-126);
+ *   - every attributed finding `waived`: one still open, or closed any other
+ *     way (a fix verified by a gate the task never ran), still blocks.
+ *
+ * Attribution is `finding.task_id`. A finding routed to a follow-up is raised
+ * under it (attribution.ts's `reattributeFinding` re-mints the id before the
+ * raise), so `finding-reattributed` needs no second reading here. Ids compare
+ * bare (D-46/P9-29).
+ *
+ * Returns the findings that discharge the follow-up, or null on every branch
+ * the rule refuses, so the quorum prompt can NAME them instead of re-deriving
+ * the rule a second way.
+ */
+function clearedFollowUpFindings(epicId, row, findings) {
+    if (row.origin !== FOLLOW_UP_TASK_ORIGIN)
+        return null;
+    const bare = bareTaskId(epicId, row.taskId);
+    const owned = findings.filter((f) => bareTaskId(epicId, f.task_id) === bare);
+    return owned.length > 0 && owned.every((f) => f.finding_status === WAIVED_FINDING_STATUS)
+        ? owned
+        : null;
+}
 const GATE_OUTCOME_EVENT = 'gate-outcome';
 const TASK_RESULT_EVENT = 'task-result-recorded';
 /**
@@ -218,12 +302,43 @@ function integrationBlockers(epicId, integration) {
  * dropped so it can never be read as "it ran fine". It contributes nothing to
  * `blockers` — see {@link EpicConcurrency}.
  */
-export function summarizeEpic(epicId, tasks, findings, integration, mcp, specReview, goalCheck, plan = null, quarantined = [], concurrency = null) {
+export function summarizeEpic(epicId, tasks, findings, integration, mcp, specReview, goalCheck, plan = null, quarantined = [], concurrency = null, 
+/**
+ * Old task id -> the successor that superseded it (spec.ts's
+ * `taskSuccessors`, folded off every `plan-version-created` event this
+ * epic has). Defaults to empty: a caller that never threads it gets
+ * exactly today's behavior — every superseded task blocks, same as before
+ * this parameter existed.
+ */
+successors = new Map()) {
     const taskSummaries = tasks.map((t) => ({
         taskId: t.taskId,
         taskStatus: t.taskStatus,
     }));
-    const nonTerminal = taskSummaries.filter((t) => !TERMINAL_OK_TASK_STATUSES.has(t.taskStatus));
+    // A superseded task is terminal (taskStatus.ts's TERMINAL_TASK_STATUSES)
+    // but not terminal-OK by itself — it reads terminal-OK only when the
+    // successor that replaced it does, recursively (run.md's "completed/
+    // superseded/waived" is this rule, not a second one). A follow-up task whose
+    // every finding was waived reads terminal-OK too — clearedFollowUpFindings()
+    // — and is collected below so the prompt can explain the row it clears.
+    const clearedFollowUps = [];
+    const nonTerminal = taskSummaries.filter((t, i) => {
+        if (TERMINAL_OK_TASK_STATUSES.has(t.taskStatus))
+            return false;
+        if (t.taskStatus !== SUPERSEDED_TASK_STATUS) {
+            const cleared = clearedFollowUpFindings(epicId, tasks[i], findings);
+            if (cleared === null)
+                return true;
+            clearedFollowUps.push({
+                taskId: t.taskId,
+                taskStatus: t.taskStatus,
+                waivedFindingIds: cleared.map((f) => f.finding_id),
+            });
+            return false;
+        }
+        const successor = resolveSupersededRow(epicId, t.taskId, tasks, successors);
+        return successor === undefined || !TERMINAL_OK_TASK_STATUSES.has(successor.taskStatus);
+    });
     // D-138: only tasks claimed done are asked for evidence. One still in flight
     // has not been gated yet and already blocks for not being terminal-OK —
     // repeating it here would make an in-progress task read like a forged one.
@@ -304,13 +419,35 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
             : wellFormedObligationIds.filter((id) => {
                 const bare = bareTaskId(epicId, id);
                 const row = tasks.find((t) => bareTaskId(epicId, t.taskId) === bare);
-                const landed = row !== undefined &&
-                    TERMINAL_OK_TASK_STATUSES.has(row.taskStatus) &&
+                // An obligation named a task a LATER, separate amendment went on
+                // to supersede: the stored amends_task_ids is never rewritten
+                // (repairObligation refuses to renegotiate a well-formed
+                // obligation), so the id is resolved through its successor here,
+                // at evaluation time, instead. Only the LANDED-AT version comes
+                // from the successor row; the evidence transition() eventually
+                // re-checks (outstandingObligations, findings.ts) bare-compares
+                // AmendmentDischarge.taskId against the obligation's own
+                // amends_task_ids, so the taskId offered as proof has to stay the
+                // originally-named id (`row.taskId`) or that revalidation would
+                // never find a match and would refuse the discharge outright —
+                // the id is resolved for landing-status purposes only, never for
+                // the identity the obligation is matched by. The original row
+                // stands in unchanged (byte-identical to before this existed)
+                // whenever it was never superseded, or its chain does not
+                // resolve.
+                const evidenceRow = row !== undefined && row.taskStatus === SUPERSEDED_TASK_STATUS
+                    ? (resolveSupersededRow(epicId, row.taskId, tasks, successors) ?? row)
+                    : row;
+                const landed = evidenceRow !== undefined &&
+                    TERMINAL_OK_TASK_STATUSES.has(evidenceRow.taskStatus) &&
                     version !== undefined &&
-                    row.planVersion !== null &&
-                    row.planVersion >= version;
-                if (landed && row.planVersion !== null)
-                    satisfiedBy.push({ taskId: row.taskId, planVersion: row.planVersion });
+                    evidenceRow.planVersion !== null &&
+                    evidenceRow.planVersion >= version;
+                if (landed && evidenceRow.planVersion !== null && row !== undefined)
+                    satisfiedBy.push({
+                        taskId: row.taskId,
+                        planVersion: evidenceRow.planVersion,
+                    });
                 return !landed;
             });
         if (malformedObligations.length === 0 && outstanding !== null && outstanding.length === 0) {
@@ -348,7 +485,17 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
         ...(taskSummaries.length === 0
             ? [`Epic "${epicId}" has no tasks in the event log — nothing to integrate.`]
             : []),
-        ...nonTerminal.map((t) => `Task "${t.taskId}" is not terminal-OK (status: ${t.taskStatus}).`),
+        ...nonTerminal.map((t) => {
+            const row = tasks.find((r) => r.taskId === t.taskId);
+            if (row?.origin === FOLLOW_UP_TASK_ORIGIN && t.taskStatus !== SUPERSEDED_TASK_STATUS)
+                return `Task "${t.taskId}" is a follow-up (origin: escalation) and is not terminal-OK (status: ${t.taskStatus}). Complete it, or waive every finding attributed to it — it clears once it owns at least one finding and all of them are waived.`;
+            if (t.taskStatus !== SUPERSEDED_TASK_STATUS)
+                return `Task "${t.taskId}" is not terminal-OK (status: ${t.taskStatus}).`;
+            const successor = resolveSupersededRow(epicId, t.taskId, tasks, successors);
+            return successor === undefined
+                ? `Task "${t.taskId}" is superseded but has no successor recorded in the log — it cannot be counted terminal-OK.`
+                : `Task "${t.taskId}" is superseded by "${successor.taskId}", which is not terminal-OK (status: ${successor.taskStatus}).`;
+        }),
         ...undispatchedTasks.map((t) => `Task "${t.taskId}" is in plan v${plan?.version} but has no events in the log — nothing records it as dispatched, let alone done (plan status: ${t.taskStatus}).`),
         ...ungated.map((t) => t.gate.gateOutcome
             ? `Task "${t.taskId}" is recorded ${t.taskStatus} and has a gate-outcome, but no task-result-recorded for it exists in the log. \`gate run\` writes both for the task it grades, so this outcome was written by hand — it is a claim, not a gate.`
@@ -378,6 +525,7 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
         undispatchedTasks,
         ungatedTasks,
         waivedTasks: taskSummaries.filter((t) => t.taskStatus === WAIVED_TASK_STATUS),
+        clearedFollowUps,
         openFindings,
         discretionaryFindings,
         satisfiedAmendments,
@@ -455,8 +603,21 @@ function mcpVerdict(mcp) {
  * and the exit code are the refutable part; the output is not.
  */
 export function epicVerdictJudgeRequest(summary, budget) {
+    // Keyed by taskId: a row in here is one clearedFollowUpFindings() cleared,
+    // so the roster line below can say so instead of printing the raw `todo`
+    // beside `Tasks not yet terminal-OK: 0` with nothing to explain the gap —
+    // the exact contradiction both external judges refuted in bs-audit-2.
+    const clearedFollowUpsByTaskId = new Map(summary.clearedFollowUps.map((c) => [c.taskId, c]));
     const taskLines = summary.tasks.length > 0
-        ? summary.tasks.map((t) => `  ${t.taskId}: ${t.taskStatus}`).join('\n')
+        ? summary.tasks
+            .map((t) => {
+            const cleared = clearedFollowUpsByTaskId.get(t.taskId);
+            return cleared === undefined
+                ? `  ${t.taskId}: ${t.taskStatus}`
+                : `  ${t.taskId}: ${t.taskStatus} — follow-up (origin: escalation) cleared by rule: ` +
+                    `every attributed finding waived (${cleared.waivedFindingIds.join(', ')}); counted terminal-OK`;
+        })
+            .join('\n')
         : '  (no tasks)';
     // The plan's side of the roster, stated separately: these ids have no events
     // at all, so their status is what the plan claims, not what happened (D-126).
@@ -578,6 +739,8 @@ export function epicVerdictJudgeRequest(summary, budget) {
         'Discretionary closures — decided by a person, not shown by the machine:',
         `Tasks waived rather than completed: ${summary.waivedTasks.length}`,
         ...listOr(summary.waivedTasks.map((t) => `  ${t.taskId}`)),
+        `Follow-ups cleared by waiving every finding they own: ${summary.clearedFollowUps.length}`,
+        ...listOr(summary.clearedFollowUps.map((c) => `  ${c.taskId} — waived findings: ${c.waivedFindingIds.join(', ')}`)),
         `Findings closed by waiver or amendment: ${summary.discretionaryFindings.length}`,
         ...listOr(summary.discretionaryFindings.map(findingLine)),
         `Amendments this close will discharge: ${summary.satisfiedAmendments.length}`,
@@ -717,7 +880,11 @@ export async function runEpicVerdict(input, ctx, opts = {}) {
     // Off the same lineage `events` every other fact here came from — the
     // wave record is in that log already, so measuring width costs this call
     // no second read and no second command anyone has to remember to type.
-    readEpicConcurrency(events, input.epicId));
+    readEpicConcurrency(events, input.epicId), 
+    // Same lineage read again, no second I/O: which superseded task ids this
+    // epic's amendments paired with a replacement, so a chain of them can
+    // resolve to whatever is actually carrying the work now.
+    taskSuccessors(events, input.epicId));
     // Step 1 — mechanical_oracles_first, literally: a deterministic blocker is
     // final. Zero judge calls, zero events (read-only projection).
     if (!summary.mechanicallyReady) {

package/factory/orchestrator/dist/errorIssues.js

@@ -20,6 +20,10 @@ const BLOCKING_SEVERITY = 'S2-major';
 const GATE_OUTCOME_EVENT_TYPE = 'gate-outcome';
 const ERROR_LOGGED_EVENT_TYPE = 'error-logged';
 const TASK_ADDED_EVENT_TYPE = 'task-added';
+/** `agents-registry.ts`'s `DISPATCH_EVENT_TYPE`, hand-restated rather than
+ * imported -- this module's only imports are `node:crypto` and two local,
+ * type-only siblings, on purpose (see the file banner). */
+const DISPATCH_DECISION_EVENT_TYPE = 'dispatch_decision';
 /**
  * Source 2: `task_status: failed` is set in exactly one place in the whole
  * projector, `db/projector.ts`'s `case 'task-added'` arm copying
@@ -29,8 +33,6 @@ const TASK_ADDED_EVENT_TYPE = 'task-added';
  * carries no failure discriminator beyond that.
  */
 const TASK_FAILED_ERROR_CLASS = 'task.failed';
-/** Default project for an event stamped with none (events.ts's documented convention; the writer never sets it, only read helpers default it). */
-const DEFAULT_PROJECT = 'black-smith';
 function asString(value) {
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
@@ -118,20 +120,158 @@ const CANDIDATE_READERS = Object.freeze({
  * would be reported outside the window the operator asked about.
  */
 export const ISSUE_CANDIDATE_EVENT_TYPES = new Set(Object.keys(CANDIDATE_READERS));
+/** The row's task ref, off the envelope first and the payload second -- the same two places every `CandidateReader` above already looks. */
+function candidateTaskRef(record) {
+    const payload = (record.payload ?? {});
+    return asString(record.task_id) ?? asString(payload.task_ref);
+}
+/**
+ * Event types allowed to stamp a session's project for
+ * `sessionProjectStamps` below: the issue candidates themselves, plus
+ * `task-added` and `dispatch_decision` rows recording where a task was
+ * planned or dispatched. Deliberately excludes `issue-reported` and every
+ * other reporter-authored row -- those carry this module's own *guess* at a
+ * row's project (see `appendIssueReported` in `issueReporter.ts`), not an
+ * independent origin stamp, so folding them back in here would let one run's
+ * guess leak into the next run's resolution of an unrelated, unstamped row
+ * in the same session.
+ */
+const ORIGIN_STAMP_EVENT_TYPES = new Set([
+    ...ISSUE_CANDIDATE_EVENT_TYPES,
+    DISPATCH_DECISION_EVENT_TYPE,
+]);
+/**
+ * The session's project, from its origin-stamped rows only -- and only when
+ * every one of them agrees. Real sessions mix dozens of stamped rows with
+ * unstamped ones (evidence: a foreign project's session stamps some events
+ * and not others); a unanimous stamped sibling in the same session is strong
+ * evidence for an unstamped one. A session whose origin stamps disagree
+ * tells us nothing safe to guess, so it answers unresolved rather than
+ * picking whichever stamp happened to come first.
+ */
+function sessionProjectStamps(events) {
+    const bySession = new Map();
+    for (const { record } of events) {
+        if (!ORIGIN_STAMP_EVENT_TYPES.has(record.event_type))
+            continue;
+        const project = asString(record.project);
+        if (project === undefined)
+            continue;
+        const seen = bySession.get(record.session_id);
+        if (seen)
+            seen.add(project);
+        else
+            bySession.set(record.session_id, new Set([project]));
+    }
+    const stamps = new Map();
+    for (const [sessionId, projects] of bySession) {
+        if (projects.size !== 1)
+            continue;
+        const [project] = projects;
+        if (project !== undefined)
+            stamps.set(sessionId, project);
+    }
+    return stamps;
+}
+function taskAddedKey(sessionId, taskId) {
+    return `${sessionId}\u0000${taskId}`;
+}
+/** `task-added`'s own `payload.epic_id`, keyed by session and task id, so a bare ref (no epic segment) can still be widened to `<epic>/<ref>` before asking the resolver. */
+function taskAddedEpicIds(events) {
+    const out = new Map();
+    for (const { record } of events) {
+        if (record.event_type !== TASK_ADDED_EVENT_TYPE)
+            continue;
+        const taskId = asString(record.task_id);
+        const epicId = asString(record.payload?.epic_id);
+        if (taskId !== undefined && epicId !== undefined) {
+            out.set(taskAddedKey(record.session_id, taskId), epicId);
+        }
+    }
+    return out;
+}
+/**
+ * Widens a per-epic `ResolveProjectForTaskRef` into a `RowProjectResolver`
+ * with three session-scoped fallbacks a single task ref cannot answer alone,
+ * tried strictly in this order (S2-c):
+ *
+ * 1. `resolveProject`, the strict/direct resolver -- a bare ref (no epic
+ *    segment) tried again as `<epic>/<ref>` using the same session's own
+ *    `task-added` row when the bare ref alone cannot answer.
+ * 2. The session stamp: the ONE project every origin-stamped row in the same
+ *    session agrees on (`sessionProjectStamps`), when unanimous.
+ * 3. `selfFallback`, tried last and only when neither of the above could
+ *    answer -- same widening as step 1.
+ *
+ * Self-fallback sits last on purpose: it is "no plan says otherwise, and a
+ * plan exists locally for this epic, so guess this factory's own name" --
+ * the weakest of the three signals. A session's OWN unanimous stamp naming a
+ * DIFFERENT project is stronger evidence than that guess, and must not be
+ * overridden by it just because the same session also has an unrelated,
+ * unstamped row whose epic happens to have a local, unlabeled plan. Before
+ * this order existed, the self-fallback was folded into `resolveProject`
+ * itself (step 1) and so always outran the session stamp.
+ *
+ * Exported so `issueReporter.ts`'s `priorOpenReports` can apply the identical
+ * fallback to the same event snapshot.
+ */
+export function withSessionFallback(events, resolveProject, selfFallback = () => null) {
+    const stamps = sessionProjectStamps(events);
+    const epicIds = taskAddedEpicIds(events);
+    const tryResolve = (resolve, taskRef, sessionId) => {
+        if (taskRef === undefined)
+            return null;
+        const direct = resolve(taskRef);
+        if (direct !== null)
+            return direct;
+        if (sessionId === undefined)
+            return null;
+        const epicId = epicIds.get(taskAddedKey(sessionId, taskRef));
+        if (epicId === undefined)
+            return null;
+        return resolve(`${epicId}/${taskRef}`);
+    };
+    return (taskRef, sessionId) => {
+        const direct = tryResolve(resolveProject, taskRef, sessionId);
+        if (direct !== null)
+            return direct;
+        if (sessionId !== undefined) {
+            const stamp = stamps.get(sessionId);
+            if (stamp !== undefined)
+                return stamp;
+        }
+        return tryResolve(selfFallback, taskRef, sessionId);
+    };
+}
 /** One event to a `Candidate`, or `'ignore'` when no source claims its event type at all. */
-function toCandidate(event) {
+function toCandidate(event, resolveRow) {
     const { record } = event;
     const read = CANDIDATE_READERS[record.event_type];
     if (!read)
         return 'ignore';
+    const stamped = asString(record.project);
+    const taskRef = candidateTaskRef(record);
+    const sessionId = asString(record.session_id);
+    const project = stamped ?? resolveRow(taskRef, sessionId);
     return read(event, {
         payload: record.payload ?? {},
-        project: asString(record.project) ?? DEFAULT_PROJECT,
-        sessionId: asString(record.session_id),
+        project,
+        sessionId,
         planVersion: asNumber(record.plan_version) ?? null,
         ts: asString(record.ts),
     });
 }
+/**
+ * A row whose project cannot be resolved at all still needs a stable
+ * fingerprint-grouping key -- otherwise two unrelated foreign projects'
+ * rows sharing `(source, error_class, task_ref)` would incorrectly group
+ * together and leak one row's session/epic/severity metadata onto the
+ * other's report, inside this factory's own private log (both rows are
+ * always skipped before anything is filed publicly, but the log itself
+ * should stay correct). `task_ref` alone already disambiguates in practice
+ * (refs are namespaced by epic id), so a single fixed sentinel is enough.
+ */
+const UNRESOLVED_PROJECT_FINGERPRINT_KEY = '\u0000unresolved-project\u0000';
 /**
  * The first 16 hex characters of a SHA-256 over the NUL-joined tuple
  * `project`, `source`, `error_class`, `task_ref`. Deliberately excludes
@@ -140,27 +280,52 @@ function toCandidate(event) {
  * and including any of them would open one issue per round instead of one.
  */
 function computeFingerprint(project, source, errorClass, taskRef) {
-    const material = [project, source, errorClass, taskRef].join('\0');
+    const material = [
+        project ?? UNRESOLVED_PROJECT_FINGERPRINT_KEY,
+        source,
+        errorClass,
+        taskRef,
+    ].join('\0');
     return createHash('sha256').update(material).digest('hex').slice(0, 16);
 }
 /**
  * Fold a stored event sequence into reportable errors. Pure: two calls with
  * identical input return byte-identical output. `now` is threaded in rather
  * than read off the clock; nothing in this contract branches on it yet.
+ *
+ * `resolveProject` and `selfFallback` both default to "no answer" so the
+ * ~50 existing call sites across this module's own tests and
+ * `issueReporter.ts`'s need no change. An unstamped row still unresolved
+ * after `withSessionFallback`'s three fallbacks reports `project: null`
+ * rather than this factory's own name -- `isProjectEnabled` is never asked
+ * about a row it cannot identify, and the decision to skip filing it
+ * belongs to `issueReporter.ts`, the one caller that goes on to call `gh`.
+ *
+ * `scopeEvents` defaults to `events` itself -- the session-stamp/`task-added`
+ * maps `withSessionFallback` builds read the same rows this fold iterates,
+ * same as before this parameter existed. A caller that narrows `events` to a
+ * candidate WINDOW (`cli.ts`'s `--epic`/`--since`) passes the full, unscoped
+ * lineage here instead (S3), so a session-mate's stamp sitting outside that
+ * window still counts as evidence for a row inside it -- scoping which rows
+ * get REPORTED must not also scope which rows get CONSULTED, or the same
+ * unstamped row resolves to a different project (and hashes a different
+ * fingerprint, S1-b) depending on whether the caller happened to pass
+ * `--epic`.
  */
-export function foldErrorEvents(events, now, isProjectEnabled) {
+export function foldErrorEvents(events, now, isProjectEnabled, resolveProject = () => null, selfFallback = () => null, scopeEvents = events) {
     void now;
+    const resolveRow = withSessionFallback(scopeEvents, resolveProject, selfFallback);
     const candidates = [];
     let skipped = 0;
     for (const event of events) {
-        const outcome = toCandidate(event);
+        const outcome = toCandidate(event, resolveRow);
         if (outcome === 'ignore')
             continue;
         if (outcome === null) {
             skipped += 1;
             continue;
         }
-        if (!isProjectEnabled(outcome.project))
+        if (outcome.project !== null && !isProjectEnabled(outcome.project))
             continue;
         candidates.push(outcome);
     }
@@ -245,7 +410,7 @@ export function renderBody(fields) {
         `Session: ${fields.session_id}`,
         `Epic: ${fields.epic_id ?? '(none)'}`,
         `Plan version: ${fields.plan_version ?? '(unknown)'}`,
-        `Project: ${fields.project}`,
+        `Project: ${fields.project ?? '(unknown)'}`,
         `Source: ${fields.source}`,
         fingerprintLine(fields.fingerprint),
         '',

package/factory/orchestrator/dist/events.js

@@ -471,8 +471,28 @@ function validateResultArtifactsShape(record) {
         errors: [{ path: '/artifacts', message: `must be an array, got ${typeof artifacts}` }],
     });
 }
+/**
+ * `error-logged`'s task_id (D-245: envelope or payload, envelope wins) names
+ * exactly one task, the same rule taxonomy.ts enforces for `task_ref` — but
+ * `task_id` is schema-typed as a plain string, so no taxonomy rule ever sees
+ * it, and a comma-joined "epic-1/task-1,epic-1/task-2" passed straight
+ * through. db/projector.ts's fold read that string as a single task id and
+ * minted a phantom row for it that stayed `todo` forever. Checked here,
+ * beside validateResultArtifactsShape, for the same reason: the shape a
+ * later reader assumes is not one the event schema or taxonomy already rule
+ * out.
+ */
+function validateErrorLoggedTaskIdShape(record) {
+    if (record.event_type !== 'error-logged')
+        return;
+    const taskId = eventTaskId(record);
+    if (taskId === null || !taskId.includes(','))
+        return;
+    throw new EventError('events.multi-value-task-id', `Event "error-logged" names more than one task in its task_id ("${taskId}"). Log one error-logged event per task instead.`, { event_type: record.event_type, task_id: taskId });
+}
 function validateTypedPayload(schemas, taxonomy, record) {
     validateResultArtifactsShape(record);
+    validateErrorLoggedTaskIdShape(record);
     const schemaName = TYPED_PAYLOAD_SCHEMAS[record.event_type];
     if (schemaName === undefined)
         return;
@@ -524,19 +544,47 @@ async function validateCausalParent(input, opts, existing) {
         throw new EventError('events.unknown-causal-parent', `causal_parent "${input.causal_parent}" does not reference an existing event in session "${parent.sessionId}" (it holds ${parentEvents.length}).`, { causal_parent: input.causal_parent, session_id: parent.sessionId });
     }
 }
+// EventInput requires causal_parent, so inside the orchestrator undefined is
+// unreachable. It is reachable from outside: every event appended through the
+// CLI crosses a JSON boundary where the type guarantees nothing, and omitting
+// a field is the likeliest way a hand-written event is malformed. This used
+// to compare against `null` alone, so an omitted parent fell through into
+// parseEventId(undefined) and reached the caller as a raw TypeError with no
+// `code` — the one shape produced by accident was the one shape with nothing
+// to branch on. Normalise once so every caller reads the same guard.
+function requireCausalParentPresence(eventType, causalParent) {
+    if (causalParent === null && eventType !== ROOT_EVENT_TYPE) {
+        throw new EventError('events.missing-causal-parent', `causal_parent may only be null for "${ROOT_EVENT_TYPE}" events (got event_type "${eventType}").`, { event_type: eventType });
+    }
+}
+/**
+ * Validate an event's envelope — the same causal_parent checks `appendEvent`
+ * runs immediately before it writes — without appending anything.
+ *
+ * `queue.ts`'s `step`/`batchStep` and `integration.ts`'s check suite each do
+ * real work of their own (a rebase and a no-ff merge; a full check run) ahead
+ * of their own first append, so a bad `--causal-parent` used to surface only
+ * there — after the git work had already landed for real, with no event to
+ * show for it. A retry then found the branch already advanced and reported it
+ * as stuck. Calling this first, before any of that work starts, means a bad
+ * envelope is refused with nothing done yet to undo.
+ *
+ * Only the causal_parent rules and the session-id shape are checked here. The
+ * event schema, the taxonomy and typed payloads are not: a caller whose payload
+ * could fail those must not treat a pass as "the append will succeed".
+ */
+export async function validateEventEnvelope(input, opts = {}) {
+    const causalParent = input.causal_parent ?? null;
+    requireCausalParentPresence(input.event_type, causalParent);
+    if (causalParent === null)
+        return;
+    const filePath = logPath(input.session_id, opts);
+    const existing = await readEventsAtPath(filePath, input.session_id);
+    await validateCausalParent(input, opts, existing);
+}
 async function appendEventLocked(input, opts, filePath) {
-    // EventInput requires causal_parent, so inside the orchestrator undefined is
-    // unreachable. It is reachable from outside: every event appended through the
-    // CLI crosses a JSON boundary where the type guarantees nothing, and omitting
-    // a field is the likeliest way a hand-written event is malformed. Both guards
-    // below used to compare against `null` alone, so an omitted parent fell
-    // through them into parseEventId(undefined) and reached the caller as a raw
-    // TypeError with no `code` — the one shape produced by accident was the one
-    // shape with nothing to branch on. Normalise once so both guards read it.
     const causalParent = input.causal_parent ?? null;
-    if (causalParent === null && input.event_type !== ROOT_EVENT_TYPE) {
-        throw new EventError('events.missing-causal-parent', `causal_parent may only be null for "${ROOT_EVENT_TYPE}" events (got event_type "${input.event_type}").`, { event_type: input.event_type });
-    }
+    requireCausalParentPresence(input.event_type, causalParent);
     await mkdir(path.dirname(filePath), { recursive: true });
     const existing = await readEventsAtPath(filePath, input.session_id);
     if (causalParent !== null) {

package/factory/orchestrator/dist/findings.js

@@ -250,7 +250,9 @@ function escapeRegExp(text) {
  * forms) — never a bare `:digits` anywhere in the text. A blanket
  * `:\d+` strip is wrong: free-text like "debug endpoint exposed on :8080"
  * would collide with an unrelated ":9090" finding (reproduced regression,
- * reviewer finding #3).
+ * reviewer finding #3). The line number may itself be a range
+ * (`Widget.tsx:1549-1576`), which a re-review reports as often as a single
+ * line (issue #178).
  */
 function stripPathLineRef(summary, filePath) {
     const forwardSlashPath = filePath.replace(/\\/g, '/');
@@ -259,16 +261,37 @@ function stripPathLineRef(summary, filePath) {
     for (const candidate of candidates) {
         if (!candidate)
             continue;
-        const pattern = new RegExp(`${escapeRegExp(candidate)}:\\d+(?::\\d+)?`, 'g');
+        const pattern = new RegExp(`${escapeRegExp(candidate)}:\\d+(?:[-–—]\\d+)?(?::\\d+)?`, 'g');
         result = result.replace(pattern, candidate);
     }
     return result;
 }
+/**
+ * A `lines N-M` / `lines N–M` (en dash) / `line N to line M` range — the
+ * shape a judge describing a large component actually writes, and the one
+ * the original single `line N` strip below never covered (issue #178).
+ * Anchored on the word "line"/"lines" immediately before the numbers, so
+ * free-text numerics elsewhere in the sentence are never touched.
+ */
+const LINE_SPAN_RE = /\blines?\s+\d[\d,]*\s*(?:[-–—]|to(?:\s+lines?)?)\s*\d[\d,]*\b/g;
+/**
+ * `~5,050-line` / `6,720-line` — a size given as a hyphenated adjective
+ * before "line"/"component"/"file"/etc, approximate or exact. Only the
+ * `<number>-line` token is removed; the noun it modifies is untouched, and
+ * a hyphenated count before any OTHER noun (`3-day`, `5-retry`) is left
+ * alone — it is not a line reference.
+ */
+const LINE_COUNT_RE = /~?\d[\d,]*-line\b/g;
+/** `L1549-L6600` — a GitHub-style permalink line range, bare or after `#`. */
+const GITHUB_LINE_RANGE_RE = /\bl\d+-l\d+\b/g;
 /** lowercase, whitespace collapsed (spec wording; path-anchored line refs stripped by the caller). */
 function normalizeSummary(summary) {
     return summary
         .toLowerCase()
+        .replace(LINE_SPAN_RE, '')
         .replace(/\bline\s+\d+\b/g, '')
+        .replace(LINE_COUNT_RE, '')
+        .replace(GITHUB_LINE_RANGE_RE, '')
         .replace(/\s+/g, ' ')
         .trim();
 }