@juzser/blacksmith 0.3.0 → 0.5.0

package/factory/orchestrator/dist/daemon.js

@@ -12,7 +12,7 @@
 // already owns — budgetAlarm.ts for spend, agents-registry.ts for stalls,
 // scheduler.ts for work that is due. Nothing here re-derives them, so the
 // daemon and `smith status` can never disagree.
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { DEFAULT_STALE_HOURS, detectStale, foldAgents, } from './agents-registry.js';
 import { admitProposals, } from './autonomy.js';
@@ -20,10 +20,12 @@ import { checkBudgetAlarm } from './budgetAlarm.js';
 import { loadBudgetPolicy } from './budgets.js';
 import { loadCrosscheckPolicy } from './crosscheck.js';
 import { apply, foldTasks, rebuild } from './db/projector.js';
+import { epicBudgetPolicies } from './epicBudget.js';
 import { summariseEpicWidth, UNMEASURED_HINT } from './epicWidth.js';
 import { SmithError } from './errors.js';
-import { listSessionIds, mergeSessionLogs, parseEventId, readEvents, } from './events.js';
+import { listSessionIds, mergeSessionLogs, parseEventId } from './events.js';
 import { ageFindings, memoryOf } from './findingAge.js';
+import { LogCache } from './logCache.js';
 import { STATE_DAEMON_DIR, STATE_DB_PATH, STATE_EVENTS_DIR } from './paths.js';
 import { unwatchedProjects } from './projects.js';
 import { FACTORY_PROJECT } from './roadmap.js';
@@ -63,6 +65,20 @@ function admitFor(proposals, events, lens) {
 function staleSubject(agent) {
     return agent.taskId ?? agent.epicId ?? agent.agentId ?? agent.id;
 }
+/**
+ * The session an event id names, for a finding that has nothing better to key
+ * on than the id of the event that raised it. `null` on anything that is not
+ * a well-formed event id, rather than throwing — a proposal's origin is a
+ * nicety, not a fact `inspectSession` should die over.
+ */
+function originSessionId(eventId) {
+    try {
+        return parseEventId(eventId).sessionId;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Everything one session's lineage says about itself: spend against the epic
  * cap, dispatches nobody can be billed for, agents that never came back, and
@@ -73,7 +89,12 @@ function staleSubject(agent) {
  */
 export function inspectSession(sessionId, events, opts = {}) {
     const now = opts.now ?? new Date();
+    // An injected policy judges every epic; otherwise each epic is judged
+    // against budgets.yml sized for its own plan's effort tier.
     const budgetPolicy = opts.budgetPolicy ?? loadBudgetPolicy();
+    const policyForEpic = opts.budgetPolicy === undefined
+        ? epicBudgetPolicies(opts.planOpts === undefined ? {} : { planOpts: opts.planOpts })
+        : undefined;
     const schedulerPolicy = opts.schedulerPolicy ?? loadSchedulerPolicy();
     const staleHours = opts.staleHours ?? DEFAULT_STALE_HOURS;
     const findings = [];
@@ -89,7 +110,10 @@ export function inspectSession(sessionId, events, opts = {}) {
         if (typeof epicId === 'string')
             closedEpics.add(epicId);
     }
-    const budget = checkBudgetAlarm(events, budgetPolicy, { sessionId });
+    const budget = checkBudgetAlarm(events, budgetPolicy, {
+        sessionId,
+        ...(policyForEpic ? { policyForEpic } : {}),
+    });
     for (const epic of budget.epics) {
         // `under` is the only status that is an answer rather than a question.
         if (epic.status === 'under')
@@ -119,10 +143,24 @@ export function inspectSession(sessionId, events, opts = {}) {
         });
     }
     for (const agent of detectStale(foldAgents(events), now.toISOString(), staleHours)) {
+        // Same rule as the budget check above, and the same reason: a closed
+        // epic's dispatch cannot still be live, so flagging it would raise the
+        // same line every tick until the log is archived. `foldAgents`'s own
+        // epic-closed handling only closes an entry against the session that
+        // closed it (D-234) — a dispatch and the epic's close can sit in
+        // different sessions of one lineage, which is exactly the shape this
+        // tick's merged log hands here, so the same-session fold alone would
+        // miss it.
+        if (agent.epicId !== null && closedEpics.has(agent.epicId))
+            continue;
         findings.push({
             kind: 'stale-agent',
             severity: 'attention',
-            sessionId,
+            // The dispatch's own session, not the tree's primary leaf: a fork
+            // asks inspectSession once for the whole tree, and the agent that
+            // never came back belongs to whichever session actually dispatched
+            // it.
+            sessionId: agent.sessionId,
             subject: staleSubject(agent),
             detail: `${agent.agentRole} (${agent.provider}/${agent.modelTier}) has been live for ` +
                 `${agent.liveHours.toFixed(1)}h with no result, error or supersession — past the ` +
@@ -142,23 +180,40 @@ export function inspectSession(sessionId, events, opts = {}) {
         findings.push({
             kind: 'spec-change',
             severity: proposal.blocking ? 'attention' : 'info',
-            sessionId,
+            // `proposalId` is the `spec-change-proposed` event's own id, so this is
+            // the session that actually raised the proposal — not the tree's
+            // primary leaf, which a fork may have picked for an unrelated sibling.
+            sessionId: originSessionId(proposal.proposalId) ?? sessionId,
             subject: proposal.taskId,
             detail: `${proposal.proposedBy} proposes amending ${proposal.criterionRef}: ${proposal.assumption} ` +
                 `(${proposal.severity}, ${proposal.blocking ? 'blocking' : 'non-blocking'}, ` +
-                `${proposal.sites.length} site(s)). Answer it with \`smith plan approve ` +
-                `${proposal.proposalId}\` or \`smith plan reject ${proposal.proposalId}\`.`,
+                `${proposal.sites.length} site(s)). Answer it with \`bs plan approve ` +
+                `${proposal.proposalId}\` or \`bs plan reject ${proposal.proposalId}\`.`,
         });
     }
-    const proposals = computeProposals({ events, now, policy: schedulerPolicy });
+    const proposals = computeProposals({
+        events,
+        now,
+        policy: schedulerPolicy,
+        ...(opts.resolveProjectForTaskRef === undefined
+            ? {}
+            : { resolveProjectForTaskRef: opts.resolveProjectForTaskRef }),
+        ...(opts.selfFallbackForTaskRef === undefined
+            ? {}
+            : { selfFallbackForTaskRef: opts.selfFallbackForTaskRef }),
+    });
     const admissions = admitFor(proposals, events, opts.admission);
+    // `TaskFoldRow.sessionId` is stamped once, the first time `touch()` builds
+    // the row, and never overwritten by a later touch — the task's origin
+    // session, not whichever one most recently merged or dispatched against it.
+    const taskSession = new Map(foldTasks(events).map((row) => [row.taskId, row.sessionId]));
     for (const [index, proposal] of proposals.entries()) {
         const admission = admissions[index];
         if (proposal.kind === 'recheck') {
             findings.push({
                 kind: 'recheck',
                 severity: 'info',
-                sessionId,
+                sessionId: taskSession.get(proposal.taskId) ?? sessionId,
                 subject: proposal.taskId,
                 detail: `Recheck due (${proposal.reasons.join(', ')}): ${proposal.mergeCount} later overlapping ` +
                     `merge(s), ${proposal.daysElapsed} day(s) elapsed, confidence ${proposal.confidence}.`,
@@ -172,17 +227,24 @@ export function inspectSession(sessionId, events, opts = {}) {
             // the discharge command below clears. Reported here and not in
             // inspectFactory because `issue-reported` lands in the error's own
             // session, so this lineage is the one that can answer it.
-            const project = proposal.project === FACTORY_PROJECT ? '' : ` (${proposal.project})`;
+            const project = proposal.project === null
+                ? ' (unresolved project)'
+                : proposal.project === FACTORY_PROJECT
+                    ? ''
+                    : ` (${proposal.project})`;
+            const projectPhrase = proposal.project === null ? 'an unresolved project' : `project ${proposal.project}`;
             findings.push({
                 kind: 'unreported-error',
                 severity: 'info',
-                sessionId,
+                // `report.session_id` — the session the error actually lives in, and
+                // the same one the detail text below already sends the operator to.
+                sessionId: proposal.sessionId,
                 subject: `error ${proposal.fingerprint}${project}`,
-                detail: `Error ${proposal.fingerprint} in project ${proposal.project} ` +
+                detail: `Error ${proposal.fingerprint} in ${projectPhrase} ` +
                     `(${proposal.errorClass}, task ${proposal.taskRef}, ${proposal.occurrences} occurrence(s)) ` +
                     'has no issue-reported event. Report it with ' +
-                    `\`smith issues report --session ${proposal.sessionId}\`; ` +
-                    `\`smith issues preview --session ${proposal.sessionId}\` is the dry run.`,
+                    `\`bs issues report --session ${proposal.sessionId}\`; ` +
+                    `\`bs issues preview --session ${proposal.sessionId}\` is the dry run.`,
                 ...(admission === undefined ? {} : { admission }),
             });
         }
@@ -208,6 +270,12 @@ export function inspectFactory(events, opts = {}) {
         policy,
         ...(opts.projectDirs === undefined ? {} : { projectDirs: opts.projectDirs }),
         ...(opts.readOutdated === undefined ? {} : { readOutdated: opts.readOutdated }),
+        ...(opts.resolveProjectForTaskRef === undefined
+            ? {}
+            : { resolveProjectForTaskRef: opts.resolveProjectForTaskRef }),
+        ...(opts.selfFallbackForTaskRef === undefined
+            ? {}
+            : { selfFallbackForTaskRef: opts.selfFallbackForTaskRef }),
     });
     const admissions = admitFor(proposals, events, opts.admission);
     for (const [index, proposal] of proposals.entries()) {
@@ -273,8 +341,8 @@ export function inspectFactory(events, opts = {}) {
                 detail: `The last epic this factory closed ran narrow: its widest wave was admitted for ` +
                     `${newest.widest.declared} tasks and ${newest.widest.observed} ran ` +
                     `(closed ${newest.closedAt}, ${width.serialized.length} of ${width.epics.length} ` +
-                    'closes read here are narrow). `smith epic width` reads every close back; ' +
-                    '`smith wave audit --session <id>` reads the waves behind a live one.',
+                    'closes read here are narrow). `bs epic width` reads every close back; ' +
+                    '`bs wave audit --session <id>` reads the waves behind a live one.',
             });
         }
         else if (width.hint === UNMEASURED_HINT) {
@@ -312,8 +380,8 @@ export function inspectFactory(events, opts = {}) {
             subject: ref.dir,
             detail: `${ref.self ? 'This clone' : `\`${ref.name}\`, built by this factory`} is not in ` +
                 'this pass, so nothing is reading its lockfile and no maintenance ' +
-                `proposal can ever name it. Add \`--project ${ref.dir}\` to \`smith daemon ` +
-                'run|start` (and to `smith scheduler run|admit`). `smith projects list` ' +
+                `proposal can ever name it. Add \`--project ${ref.dir}\` to \`bs daemon ` +
+                'run|start` (and to `bs scheduler run|admit`). `bs projects list` ' +
                 'prints the whole flag line.',
         });
     }
@@ -343,21 +411,29 @@ function errorMessage(err) {
 /**
  * One pass over the state directory.
  *
- * Two rules hold it together. It reads every log ONCE and folds lineages in
- * memory, so a five-session lineage reports one budget alarm rather than five
- * (D-119's argument, read from the other end). And no single unreadable log or
- * failed projection ends the tick: both become findings, because a watchdog
- * that dies on the first corrupt line is a watchdog that is silent exactly
- * when something is wrong.
+ * Two rules hold it together. It reads every log ONCE and folds each lineage
+ * TREE in memory — not once per leaf — so a five-session chain reports one
+ * budget alarm rather than five (D-119's argument, read from the other end),
+ * and a base session that forked into several wave children reports it once
+ * rather than once per sibling. And no single unreadable log or failed
+ * projection ends the tick: both become findings, because a watchdog that
+ * dies on the first corrupt line is a watchdog that is silent exactly when
+ * something is wrong.
  */
 export async function runTick(opts = {}) {
     const now = opts.now ?? new Date();
     const stateDir = opts.stateDir ?? STATE_EVENTS_DIR;
     const findings = [];
+    // No shared cache passed in: a fresh one is cold for every session, so this
+    // reads identically to the old `readEvents`-per-session loop — one full
+    // read per log, this call only.
+    const cache = opts.logCache ?? new LogCache();
     const logs = new Map();
+    const liveSessionIds = new Set();
     for (const sessionId of listSessionIds(stateDir)) {
+        liveSessionIds.add(sessionId);
         try {
-            logs.set(sessionId, await readEvents(sessionId, { stateDir }));
+            logs.set(sessionId, await cache.read(sessionId, { stateDir }));
         }
         catch (err) {
             findings.push({
@@ -369,6 +445,13 @@ export async function runTick(opts = {}) {
             });
         }
     }
+    // Sessions that disappear from `listSessionIds` are evicted here, on the
+    // next tick, so the cache's memory is bounded by live logs, not by
+    // history. Driven by the LISTED set, not the read-succeeded set: a session
+    // that is listed but unreadable this tick keeps its entry. On a fresh,
+    // unshared cache (`opts.logCache` undefined) this is a no-op -- nothing
+    // was cached to evict.
+    cache.retainOnly(liveSessionIds);
     const parentOf = new Map();
     for (const [sessionId, events] of logs) {
         const root = events.find((e) => e.record.event_type === ROOT_EVENT_TYPE);
@@ -390,17 +473,59 @@ export async function runTick(opts = {}) {
             ancestors.add(parent);
     }
     const leaves = [...logs.keys()].filter((id) => !ancestors.has(id)).sort();
-    const lineageOf = (leaf) => {
-        const chain = [];
+    // parentOf inverted: a session's immediate children among the sessions this
+    // tick loaded. Lets a shared ancestor's descendants be walked forward once,
+    // instead of re-walked backward once per leaf below it.
+    const childrenOf = new Map();
+    for (const [childId, parent] of parentOf) {
+        if (parent === null || !logs.has(parent))
+            continue;
+        const siblings = childrenOf.get(parent) ?? [];
+        siblings.push(childId);
+        childrenOf.set(parent, siblings);
+    }
+    // The furthest ancestor of `id` that this tick still holds a log for — the
+    // root of the tree `id` belongs to, and the same root for every session in
+    // that tree regardless of which leaf asks.
+    const rootOf = (id) => {
+        let current = id;
         const seen = new Set();
-        let current = leaf;
-        while (current !== null && logs.has(current) && !seen.has(current)) {
+        while (true) {
+            const parent = parentOf.get(current) ?? null;
+            if (parent === null || !logs.has(parent) || seen.has(current))
+                return current;
             seen.add(current);
-            chain.unshift(current);
-            current = parentOf.get(current) ?? null;
+            current = parent;
+        }
+    };
+    // Every session reachable from `root` by walking children — the whole tree
+    // a lineage forks into, not just the one leaf that happened to ask for it.
+    // Guarded like rootOf: a cycle in causal parents must cost a tick nothing,
+    // not grow this list until the process dies.
+    const treeSessions = (root) => {
+        const all = [root];
+        const seen = new Set(all);
+        for (let i = 0; i < all.length; i += 1) {
+            for (const child of childrenOf.get(all[i]) ?? []) {
+                if (seen.has(child))
+                    continue;
+                seen.add(child);
+                all.push(child);
+            }
         }
-        return chain.map((sessionId) => ({ sessionId, events: logs.get(sessionId) ?? [] }));
+        return all;
     };
+    // Leaves grouped by the tree they fork from. A base session with several
+    // wave children is one tree with several leaves — inspected once, not once
+    // per sibling, so the shared ancestor's findings are not re-emitted once
+    // per fork (the D-119 argument, which a single chain never forks to break).
+    const leavesByRoot = new Map();
+    for (const leaf of leaves) {
+        const root = rootOf(leaf);
+        const group = leavesByRoot.get(root) ?? [];
+        group.push(leaf);
+        leavesByRoot.set(root, group);
+    }
     // A tick reports the admission line by default, where `inspectSession` and
     // `inspectFactory` stay silent unless asked. The asymmetry is deliberate: a
     // caller who reaches for one function is answering their own question and
@@ -417,11 +542,18 @@ export async function runTick(opts = {}) {
         now,
         admission,
         ...(opts.budgetPolicy === undefined ? {} : { budgetPolicy: opts.budgetPolicy }),
+        ...(opts.planOpts === undefined ? {} : { planOpts: opts.planOpts }),
         ...(opts.schedulerPolicy === undefined ? {} : { schedulerPolicy: opts.schedulerPolicy }),
         ...(opts.staleHours === undefined ? {} : { staleHours: opts.staleHours }),
         ...(opts.projectDirs === undefined ? {} : { projectDirs: opts.projectDirs }),
         ...(opts.readOutdated === undefined ? {} : { readOutdated: opts.readOutdated }),
         ...(opts.readProjects === undefined ? {} : { readProjects: opts.readProjects }),
+        ...(opts.resolveProjectForTaskRef === undefined
+            ? {}
+            : { resolveProjectForTaskRef: opts.resolveProjectForTaskRef }),
+        ...(opts.selfFallbackForTaskRef === undefined
+            ? {}
+            : { selfFallbackForTaskRef: opts.selfFallbackForTaskRef }),
     };
     const projectDb = opts.projectDb ?? true;
     const dbPath = opts.dbPath ?? STATE_DB_PATH;
@@ -435,18 +567,57 @@ export async function runTick(opts = {}) {
         sessionId,
         subject: dbPath,
         detail: `The read-model refresh failed: ${errorMessage(err)}. The event log is unaffected — ` +
-            'it is the UI and `smith status` that are now stale.',
+            'it is the UI and `bs status` that are now stale.',
     });
-    for (const leaf of leaves) {
-        findings.push(...inspectSession(leaf, mergeSessionLogs(lineageOf(leaf)), inspectOpts));
-        if (!projectDb)
-            continue;
-        try {
-            await apply(dbPath, leaf, dbOpts);
-            projected += 1;
+    for (const [root, group] of leavesByRoot) {
+        // Sorted, so a forked tree attributes its shared findings to the same
+        // leaf on every tick, rather than whichever one Map iteration hands back
+        // first — the same determinism `leaves` itself already sorts for.
+        const primary = [...group].sort()[0];
+        const merged = mergeSessionLogs(treeSessions(root).map((sessionId) => ({ sessionId, events: logs.get(sessionId) ?? [] })));
+        findings.push(...inspectSession(primary, merged, inspectOpts));
+    }
+    // The signature a leaf's projection was last applied against: every
+    // session in its own upward chain, keyed by the fingerprint the cache read
+    // it at. Two ticks that see the same fingerprints for the same chain saw
+    // no change anywhere that leaf's own projection or lineage-scoped folds
+    // depend on, so re-applying would write the same rows a second time.
+    // `opts.logCache === undefined` opts a caller all the way out: with no
+    // cache to remember a signature against, every leaf is applied every tick,
+    // unchanged from before this cache existed.
+    const leafSignature = (leaf) => {
+        const chain = [];
+        const seen = new Set();
+        let current = leaf;
+        while (current !== null && !seen.has(current)) {
+            seen.add(current);
+            chain.push(current);
+            const parent = parentOf.get(current) ?? null;
+            current = parent !== null && logs.has(parent) ? parent : null;
         }
-        catch (err) {
-            findings.push(projectionFailed(leaf, err));
+        return chain
+            .map((id) => {
+            const fp = cache.fingerprintOf(id);
+            return fp === undefined ? `${id}:?` : `${id}:${fp.dev}.${fp.ino}.${fp.size}.${fp.mtimeMs}`;
+        })
+            .join('|');
+    };
+    const applyFn = opts.applyFn ?? apply;
+    if (projectDb) {
+        for (const leaf of leaves) {
+            const signature = opts.logCache === undefined ? undefined : leafSignature(leaf);
+            if (signature !== undefined && opts.logCache?.getAppliedSignature(leaf) === signature) {
+                continue;
+            }
+            try {
+                await applyFn(dbPath, leaf, dbOpts);
+                projected += 1;
+                if (signature !== undefined)
+                    opts.logCache?.setAppliedSignature(leaf, signature);
+            }
+            catch (err) {
+                findings.push(projectionFailed(leaf, err));
+            }
         }
     }
     // The read-model is not made of sessions alone. `milestones` is a full
@@ -479,6 +650,21 @@ export async function runTick(opts = {}) {
     // nothing still has repos to tend.
     const all = [...logs.entries()].map(([sessionId, events]) => ({ sessionId, events }));
     findings.push(...inspectFactory(mergeSessionLogs(all), inspectOpts));
+    // The loop's own memory file failed to read this tick (see `TickOptions`).
+    // Filed as a finding, not swallowed: an operator watching the report is the
+    // one person who can tell whether "everything reads as new" is real churn
+    // or this.
+    if (opts.memoryUnreadable !== undefined) {
+        findings.push({
+            kind: 'unreadable-state',
+            severity: 'attention',
+            sessionId: null,
+            subject: opts.memoryUnreadable.path,
+            detail: `${opts.memoryUnreadable.path} exists but cannot be read ` +
+                `(${opts.memoryUnreadable.reason}): memory was read as empty, so every ` +
+                'standing finding is dated as new this tick.',
+        });
+    }
     const aged = ageFindings(opts.memory ?? {}, findings, now);
     return {
         at: now.toISOString(),
@@ -497,21 +683,66 @@ export function lockPath(dir) {
 export function statusPath(dir) {
     return path.join(dir, STATUS_FILE);
 }
-function readJsonFile(filePath) {
-    if (!existsSync(filePath))
-        return null;
+/**
+ * Recoverable failure to read a daemon state file — a corrupt `daemon.pid`,
+ * `status.json` or `findings.json`. Always names the file and the reason, and
+ * always the same recovery: nothing here suggests `smith daemon stop`, which
+ * reads the same file and refuses it the same way.
+ */
+function unreadableState(filePath, reason) {
+    return new DaemonError('daemon.unreadable-state', `${filePath} exists but cannot be read (${reason}), so it is not treated as ` +
+        'absent. Confirm no `bs daemon run` process is using this directory, ' +
+        'then delete the file.', { path: filePath, reason });
+}
+function isRecordShape(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isLockShape(value) {
+    return isRecordShape(value) && typeof value.pid === 'number';
+}
+/**
+ * Read and parse one state file, or null when there was none.
+ *
+ * ABSENT and UNREADABLE are two different outcomes, not one. ABSENT is
+ * `readFileSync` throwing ENOENT — the ordinary "no daemon has run here yet"
+ * case, answered with null. Everything else — a permission error, a
+ * `JSON.parse` failure, or a parsed value the wrong shape for `T` — is
+ * UNREADABLE: the file exists, so silently treating it as absent would let a
+ * corrupt lock be taken over, a corrupt `status.json` read as "not running",
+ * or a corrupt memory read as empty, none of which is true. Reading the file
+ * directly and catching ENOENT (rather than `existsSync` then `readFileSync`)
+ * also closes the gap where the file could vanish between the two calls.
+ */
+function readJsonFile(filePath, isValidShape) {
+    let raw;
     try {
-        return JSON.parse(readFileSync(filePath, 'utf8'));
+        raw = readFileSync(filePath, 'utf8');
     }
-    catch {
-        return null;
+    catch (err) {
+        const code = err.code;
+        if (code === 'ENOENT')
+            return null;
+        throw unreadableState(filePath, code ?? errorMessage(err));
     }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw unreadableState(filePath, errorMessage(err));
+    }
+    if (!isValidShape(parsed))
+        throw unreadableState(filePath, 'unexpected shape');
+    return parsed;
 }
+/**
+ * Null when there is no lock to read. Throws `daemon.unreadable-state` when
+ * the file exists but cannot be parsed, or parses to something without a
+ * numeric `pid` — a half-written file from a crash mid-write looks exactly
+ * like this, and it must not be mistaken for "nobody is running".
+ */
 export function readLock(dir) {
-    const lock = readJsonFile(lockPath(dir));
-    if (lock === null || typeof lock.pid !== 'number')
-        return null;
-    return lock;
+    return readJsonFile(lockPath(dir), isLockShape);
 }
 /** `kill(pid, 0)` — EPERM means a process exists that this user may not signal. */
 export function processIsAlive(pid) {
@@ -525,14 +756,20 @@ export function processIsAlive(pid) {
 }
 /**
  * Claim `dir` for `lock.pid`, returning the lock this one displaced (null when
- * there was nothing to displace, or nothing readable).
+ * there was nothing to displace).
  *
  * Two daemons ticking the same state dir would double every projection write
  * and every finding, so a live incumbent is refused. A DEAD incumbent is not:
  * a crashed daemon leaves its pid file behind, and refusing to start until a
- * human runs `rm` would make the first crash permanent. Likewise an
- * unparseable file — half a JSON document is what a crash mid-write looks
- * like, and it is evidence of a dead writer, not a live one.
+ * human runs `rm` would make the first crash permanent.
+ *
+ * An UNREADABLE incumbent is refused rather than taken over: an unparseable
+ * file could be a crash mid-write, but it could also be a live daemon's lock
+ * a filesystem fault damaged out from under it, and the two are not
+ * distinguishable from the bytes alone. `readLock` throws
+ * `daemon.unreadable-state` in that case, and this function does not catch
+ * it — the throw happens before anything is written, so the file's bytes are
+ * left exactly as found.
  */
 export function acquireLock(dir, lock, opts = {}) {
     const isAlive = opts.isAlive ?? processIsAlive;
@@ -550,14 +787,28 @@ export function acquireLock(dir, lock, opts = {}) {
     const incumbent = readLock(dir);
     if (incumbent !== null && isAlive(incumbent.pid)) {
         throw new DaemonError('daemon.already-running', `A daemon (pid ${incumbent.pid}, started ${incumbent.startedAt}) already holds ${file}. ` +
-            'Stop it with `smith daemon stop` before starting another.', { pid: incumbent.pid, lock_path: file });
+            'Stop it with `bs daemon stop` before starting another.', { pid: incumbent.pid, lock_path: file });
     }
     writeFileSync(file, body, 'utf8');
     return incumbent;
 }
-/** True when this call removed the lock; false when it belongs to someone else. */
+/**
+ * True when this call removed the lock; false when it belongs to someone
+ * else, or cannot be read at all.
+ *
+ * Never throws, unlike every other reader of this file: it runs from
+ * `runDaemon`'s `finally`, where a throw would replace the loop's own
+ * outcome — a tick that failed would be reported instead as "could not
+ * release the lock", losing the failure that actually mattered.
+ */
 export function releaseLock(dir, pid) {
-    const lock = readLock(dir);
+    let lock;
+    try {
+        lock = readLock(dir);
+    }
+    catch {
+        return false;
+    }
     if (lock === null || lock.pid !== pid)
         return false;
     rmSync(lockPath(dir), { force: true });
@@ -574,8 +825,9 @@ export function writeStatus(dir, report) {
     writeFileSync(tmp, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
     renameSync(tmp, target);
 }
+/** Throws `daemon.unreadable-state` when the file exists but cannot be parsed. */
 export function readStatus(dir) {
-    return readJsonFile(statusPath(dir));
+    return readJsonFile(statusPath(dir), isRecordShape);
 }
 // ---------------------------------------------------------------------------
 // The finding memory
@@ -587,15 +839,18 @@ export function memoryPath(dir) {
  * The only state this daemon carries across ticks, and deliberately the least
  * it could carry: identity -> when it was first seen.
  *
- * Missing or corrupt reads as empty rather than throwing, for the same reason
- * `unreadable-log` is a finding and not a crash. A watchdog that dies over its
- * own scratch file is silent exactly when something is wrong, and the cost of
- * losing this one is a single tick that calls every standing finding new.
+ * Absent reads as empty — the ordinary first-tick case. Corrupt throws
+ * `daemon.unreadable-state`: `runDaemon`'s `tickWithMemory` is the one caller
+ * that catches it, and turns it into a finding of its own (`TickOptions`'s
+ * `memoryUnreadable`) rather than swallowing it, because a watchdog that
+ * dies over its own scratch file is silent exactly when something is wrong,
+ * but one that quietly reads it as empty hides the same fact from the report
+ * meant to surface it.
  */
 export function readFindingMemory(dir) {
-    return readJsonFile(memoryPath(dir)) ?? {};
+    return readJsonFile(memoryPath(dir), isRecordShape) ?? {};
 }
-/** tmp-then-rename, like the status file: a half-written memory reads as none. */
+/** tmp-then-rename, like the status file: a crash mid-write leaves the old file whole. */
 export function writeFindingMemory(dir, memory) {
     mkdirSync(dir, { recursive: true });
     const target = memoryPath(dir);
@@ -683,10 +938,15 @@ export async function runDaemon(opts) {
     const tick = opts.tick ?? runTick;
     const sleep = opts.sleep ?? defaultSleep;
     const shouldContinue = opts.shouldContinue ?? (() => true);
+    // One cache for the whole run: this is the loop finding 50acc356 is about
+    // — the process that survives long enough for "every tick re-reads every
+    // byte ever written" to matter.
+    const logCache = opts.logCache ?? new LogCache();
     acquireLock(opts.dir, { pid, startedAt, intervalSeconds }, opts.isAlive === undefined ? {} : { isAlive: opts.isAlive });
     const tickOptions = {
         ...(opts.now === undefined ? {} : { now: opts.now }),
         ...(opts.budgetPolicy === undefined ? {} : { budgetPolicy: opts.budgetPolicy }),
+        ...(opts.planOpts === undefined ? {} : { planOpts: opts.planOpts }),
         ...(opts.schedulerPolicy === undefined ? {} : { schedulerPolicy: opts.schedulerPolicy }),
         ...(opts.staleHours === undefined ? {} : { staleHours: opts.staleHours }),
         ...(opts.projectDirs === undefined ? {} : { projectDirs: opts.projectDirs }),
@@ -695,12 +955,37 @@ export async function runDaemon(opts) {
         ...(opts.projectDb === undefined ? {} : { projectDb: opts.projectDb }),
         ...(opts.dbPath === undefined ? {} : { dbPath: opts.dbPath }),
         ...(opts.dbOpts === undefined ? {} : { dbOpts: opts.dbOpts }),
+        ...(opts.applyFn === undefined ? {} : { applyFn: opts.applyFn }),
+        logCache,
     };
     // Read from disk rather than held in a variable, so a daemon restarted by
     // cron or by the operator picks up where the last process stopped. A tick
     // knows nothing about the interval it runs on; this is what joins two.
+    //
+    // `readFindingMemory` throws `daemon.unreadable-state` for a corrupt file
+    // (never for an absent one). That is the ONE failure this catches: the
+    // tick still runs, with an empty memory and `memoryUnreadable` set so the
+    // loss shows up as a finding in the very report it affected, rather than
+    // failing the loop over its own scratch file (D-21).
     const tickWithMemory = async () => {
-        const report = await tick({ ...tickOptions, memory: readFindingMemory(opts.dir) });
+        let memory = {};
+        let memoryUnreadable;
+        try {
+            memory = readFindingMemory(opts.dir);
+        }
+        catch (err) {
+            if (!(err instanceof DaemonError) || err.code !== 'daemon.unreadable-state')
+                throw err;
+            memoryUnreadable = {
+                path: String(err.details.path),
+                reason: String(err.details.reason),
+            };
+        }
+        const report = await tick({
+            ...tickOptions,
+            memory,
+            ...(memoryUnreadable === undefined ? {} : { memoryUnreadable }),
+        });
         writeStatus(opts.dir, report);
         writeFindingMemory(opts.dir, memoryOf(report.findings));
         return report;