@juzser/blacksmith 0.3.0 → 0.5.0

package/factory/orchestrator/dist/epic.js

@@ -1,3 +1,4 @@
+import { isOperatorActor } from './actors.js';
 import { EPIC_CLOSED_EVENT_TYPE } from './agents-registry.js';
 import { loadCrosscheckPolicy } from './crosscheck.js';
 import { foldTasks } from './db/projector.js';
@@ -9,8 +10,9 @@ import { latestIntegrationCheck } from './integration.js';
 import { mcpBlockers } from './mcp.js';
 import { bareTaskId, latestPlanVersion, livePlanTasks, loadPlan } from './plan.js';
 import { enabledExternalProviders, nativeProviderName, runQuorumCase, } from './quorum.js';
-import { latestSpecReview, specReviewBlockers } from './spec.js';
-import { TERMINAL_OK_TASK_STATUSES } from './taskStatus.js';
+import { latestSpecReview, specReviewBlockers, taskSuccessors, } from './spec.js';
+import { TERMINAL_OK_TASK_STATUSES, TERMINAL_TASK_STATUSES } from './taskStatus.js';
+import { TASK_WAIVER_APPROVED_EVENT } from './waivers.js';
 import { auditWaveConcurrency, WAVE_VERDICTS, zeroedCounts, } from './waveConcurrency.js';
 import { RESERVED_TASK_ID } from './worktree.js';
 /**
@@ -47,6 +49,167 @@ import { RESERVED_TASK_ID } from './worktree.js';
  */
 /** The terminal-OK status that is a decision rather than a completion (D-120). */
 const WAIVED_TASK_STATUS = 'waived';
+/**
+ * A task a re-plan (`plan amend`) replaced with a successor task cut under a
+ * later plan version. `TERMINAL_TASK_STATUSES` (taskStatus.ts) already counts
+ * this as over; it is deliberately NOT in `TERMINAL_OK_TASK_STATUSES`, because
+ * "over" is not the same as "well" — the work only actually landed if the
+ * successor did. `resolveSupersededRow` below is what asks that question.
+ */
+const SUPERSEDED_TASK_STATUS = 'superseded';
+/**
+ * Follows a superseded task to whatever eventually carries its work, walking
+ * a possibly multi-hop chain (a successor can itself be superseded by a
+ * later amendment). Returns the first row in the chain that is not itself
+ * superseded, or `undefined` when the chain is missing a hop, names a task
+ * with no fold record, or cycles back on itself — every one of those reads
+ * as "no successor to vouch for this", the fail-closed answer.
+ *
+ * `successors` is folded off the event log (spec.ts's `taskSuccessors`), so
+ * its keys and values are whatever `plan-version-created` recorded — not
+ * necessarily bare (D-46/P9-29) — hence comparing through `bareTaskId` at
+ * every hop rather than assuming the map is pre-normalized.
+ */
+function resolveSupersededRow(epicId, taskId, tasks, successors) {
+    const bareSuccessors = new Map([...successors].map(([from, to]) => [bareTaskId(epicId, from), to]));
+    const visited = new Set([bareTaskId(epicId, taskId)]);
+    let currentId = bareTaskId(epicId, taskId);
+    for (;;) {
+        const nextId = bareSuccessors.get(currentId);
+        if (nextId === undefined)
+            return undefined;
+        const nextBare = bareTaskId(epicId, nextId);
+        if (visited.has(nextBare))
+            return undefined;
+        visited.add(nextBare);
+        const row = tasks.find((t) => bareTaskId(epicId, t.taskId) === nextBare);
+        if (row === undefined)
+            return undefined;
+        if (row.taskStatus !== SUPERSEDED_TASK_STATUS)
+            return row;
+        currentId = nextBare;
+    }
+}
+/**
+ * Terminal statuses that did not end well, apart from `superseded` (which is
+ * resolved through its successor instead). Derived from the two declared sets
+ * so a status classified there is classified here too.
+ */
+function endedNotOk(status) {
+    return (TERMINAL_TASK_STATUSES.has(status) &&
+        !TERMINAL_OK_TASK_STATUSES.has(status) &&
+        status !== SUPERSEDED_TASK_STATUS);
+}
+/**
+ * The blocker for an amend-pending finding with outstanding obligations. Ids
+ * that are simply not landed yet keep the original "waiting on" wording, so
+ * the common case reads exactly as before; every other id follows, in
+ * obligation order, with the reason it cannot land as things stand.
+ */
+function describeOutstandingObligations(findingId, version, outstanding) {
+    const target = version === undefined ? 'a recorded plan version' : `v${version}`;
+    const waiting = outstanding.filter((o) => o.reason.kind === 'pending').map((o) => o.id);
+    const parts = [];
+    if (waiting.length > 0)
+        parts.push(version === undefined
+            ? `waiting on ${waiting.join(', ')} to land terminal-OK`
+            : `waiting on ${waiting.join(', ')} to land terminal-OK at v${version} or later`);
+    for (const { id, reason } of outstanding) {
+        if (reason.kind === 'pending')
+            continue;
+        if (reason.kind === 'no-row') {
+            parts.push(`${id} has no task row in the event log, so nothing can land it as things stand`);
+            continue;
+        }
+        if (reason.kind === 'chain-unresolved') {
+            parts.push(`${id} is superseded, but its successor chain does not resolve, so it cannot land as things stand`);
+            continue;
+        }
+        const subject = reason.successorId ?? id;
+        const via = reason.successorId === undefined ? '' : `${id} is superseded by ${subject}; `;
+        switch (reason.kind) {
+            case 'successor-pending':
+                parts.push(`${via}${subject} has not landed terminal-OK (status: ${reason.status})`);
+                break;
+            case 'below-version':
+                parts.push(`${via}${subject} landed ${reason.status} at v${reason.landedAt}, below plan ` +
+                    `${target}, so it needs a re-cut`);
+                break;
+            case 'no-plan-version':
+                parts.push(`${via}${subject} landed ${reason.status} but carries no plan version, so it cannot ` +
+                    `be checked against ${target}`);
+                break;
+            case 'unversioned-amendment':
+                parts.push(`${via}${subject} landed ${reason.status}, but there is no amendment plan version ` +
+                    'to check it against');
+                break;
+            case 'ended':
+                parts.push(`${via}${subject} ended ${reason.status} and will not land as things stand without ` +
+                    'a retry or a re-cut');
+                break;
+        }
+    }
+    const head = version === undefined
+        ? 'is amend-pending but records no plan version, so no landing can discharge it as things stand'
+        : `is amend-pending on plan v${version}`;
+    return `Finding "${findingId}" ${head}: ${parts.join('; ')}.`;
+}
+/**
+ * The `origin` taskEvents.ts's `emitFollowUpTask` stamps on a follow-up task:
+ * one minted for a finding no open task could own, rather than one a plan cut.
+ */
+const FOLLOW_UP_TASK_ORIGIN = 'escalation';
+/** The finding status that is the operator's decision not to fix (D-120). */
+const WAIVED_FINDING_STATUS = 'waived';
+/**
+ * The closed finding states that leave a follow-up nothing to do: waived (the
+ * operator's decision), refuted (the claim was shown false) and fix-verified
+ * (another task's fix was verified). Open, confirmed, in-flight and amend
+ * states still block.
+ */
+const FOLLOW_UP_CLEARING_FINDING_STATUSES = new Set([
+    WAIVED_FINDING_STATUS,
+    'refuted',
+    'fix-verified',
+]);
+/**
+ * Whether a follow-up task's whole reason to exist has been waived away. A
+ * follow-up is minted `todo` to own findings, and no event ever moves it to
+ * `waived` — the projector has no such write — so without this the operator
+ * waiving the only finding it owns (bs-audit-2's `followup-9a8f6ac7`) left the
+ * task holding the epic verdict forever, with nothing left to do and no verb
+ * that could say so.
+ *
+ * Deliberately narrow, the same reader-side shape as the superseded-successor
+ * rule above:
+ *   - only origin `escalation`: a planned task's `todo` is a claim about work
+ *     its spec still owes, which waiving a finding raised against it does not
+ *     discharge;
+ *   - at least one attributed finding: a follow-up that owns nothing is not
+ *     "all waived", it is unexplained, and absence must not vote yes (D-126);
+ *   - every attributed finding waived, refuted or fix-verified
+ *     (FOLLOW_UP_CLEARING_FINDING_STATUSES): one still open, or closed any
+ *     other way (expired, amended), still blocks.
+ *
+ * Attribution is `finding.task_id`. A finding routed to a follow-up is raised
+ * under it (attribution.ts's `reattributeFinding` re-mints the id before the
+ * raise), so `finding-reattributed` needs no second reading here. Ids compare
+ * bare (D-46/P9-29).
+ *
+ * Returns the findings that discharge the follow-up, or null on every branch
+ * the rule refuses, so the quorum prompt can NAME them instead of re-deriving
+ * the rule a second way.
+ */
+function clearedFollowUpFindings(epicId, row, findings) {
+    if (row.origin !== FOLLOW_UP_TASK_ORIGIN)
+        return null;
+    const bare = bareTaskId(epicId, row.taskId);
+    const owned = findings.filter((f) => bareTaskId(epicId, f.task_id) === bare);
+    return owned.length > 0 &&
+        owned.every((f) => FOLLOW_UP_CLEARING_FINDING_STATUSES.has(f.finding_status))
+        ? owned
+        : null;
+}
 const GATE_OUTCOME_EVENT = 'gate-outcome';
 const TASK_RESULT_EVENT = 'task-result-recorded';
 /**
@@ -61,6 +224,8 @@ const TASK_RESULT_EVENT = 'task-result-recorded';
 export function withGateEvidence(tasks, events, epicId) {
     const gated = new Set();
     const recorded = new Set();
+    // Newest plan version each task's operator approval was given under.
+    const approved = new Map();
     for (const { record } of events) {
         if (!record.task_id)
             continue;
@@ -68,10 +233,23 @@ export function withGateEvidence(tasks, events, epicId) {
             gated.add(bareTaskId(epicId, record.task_id));
         else if (record.event_type === TASK_RESULT_EVENT)
             recorded.add(bareTaskId(epicId, record.task_id));
+        // `event append` is open to any actor, so the approval counts only when
+        // the operator wrote it.
+        else if (record.event_type === TASK_WAIVER_APPROVED_EVENT && isOperatorActor(record.actor)) {
+            const bare = bareTaskId(epicId, record.task_id);
+            approved.set(bare, Math.max(approved.get(bare) ?? record.plan_version, record.plan_version));
+        }
     }
     return tasks.map((t) => {
         const bare = bareTaskId(epicId, t.taskId);
-        return { ...t, gate: { gateOutcome: gated.has(bare), resultRecorded: recorded.has(bare) } };
+        // An approval answers the waiver the operator was shown: a row re-cut at a
+        // later plan version needs an approval given at that version or after.
+        const approvedAt = approved.get(bare);
+        return {
+            ...t,
+            gate: { gateOutcome: gated.has(bare), resultRecorded: recorded.has(bare) },
+            waiverApproved: approvedAt !== undefined && (t.planVersion === null || approvedAt >= t.planVersion),
+        };
     });
 }
 /**
@@ -92,6 +270,7 @@ export function summariseEpicConcurrency(waves) {
             observed: waves.reduce((max, wave) => Math.max(max, wave.peak), 0),
         },
         unobserved: waves.filter((wave) => wave.verdict === 'unobserved').map((wave) => wave.eventId),
+        unlinked: waves.filter((wave) => wave.verdict === 'unlinked').map((wave) => wave.eventId),
         problem: null,
     };
 }
@@ -101,6 +280,7 @@ const UNREADABLE_CONCURRENCY = (problem) => ({
     verdicts: zeroedCounts(WAVE_VERDICTS),
     widest: { declared: 0, observed: 0 },
     unobserved: [],
+    unlinked: [],
     problem,
 });
 /**
@@ -127,8 +307,7 @@ export function readEpicConcurrency(events, epicId) {
  * against the commit the branch is on now.
  */
 function integrationBlockers(epicId, integration) {
-    const branch = `smith/${epicId}/${RESERVED_TASK_ID}`;
-    const { check, headSha } = integration;
+    const { check, headSha, branch } = integration;
     if (check === null) {
         return [
             `Epic "${epicId}" has no integration-root check on record: no command has ever run against ${branch}. Per-task gates only ever saw a worktree (D-42).`,
@@ -217,17 +396,63 @@ function integrationBlockers(epicId, integration) {
  * measured how wide this epic ran, and it is projected as `null` rather than
  * dropped so it can never be read as "it ran fine". It contributes nothing to
  * `blockers` — see {@link EpicConcurrency}.
+ *
+ * `effort` is required for the same "no forgotten argument" reason as
+ * `integration` and `mcp`: it is `specReviewBlockers`'s only way to know a
+ * tier waived an absent closing review (run.md step 13), and a defaulted
+ * value here would either manufacture that green for every caller or refuse
+ * it for every caller — either way, silently. Positioned before the
+ * defaulted `plan`/`quarantined`/`concurrency`/`successors` tail so it reads
+ * as required alongside `goalCheck`, not folded into the optional group.
  */
-export function summarizeEpic(epicId, tasks, findings, integration, mcp, specReview, goalCheck, plan = null, quarantined = [], concurrency = null) {
+export function summarizeEpic(epicId, tasks, findings, integration, mcp, specReview, goalCheck, effort, plan = null, quarantined = [], concurrency = null, 
+/**
+ * Old task id -> the successor that superseded it (spec.ts's
+ * `taskSuccessors`, folded off every `plan-version-created` event this
+ * epic has). Defaults to empty: a caller that never threads it gets
+ * exactly today's behavior — every superseded task blocks, same as before
+ * this parameter existed.
+ */
+successors = new Map()) {
     const taskSummaries = tasks.map((t) => ({
         taskId: t.taskId,
         taskStatus: t.taskStatus,
     }));
-    const nonTerminal = taskSummaries.filter((t) => !TERMINAL_OK_TASK_STATUSES.has(t.taskStatus));
+    // A superseded task is terminal (taskStatus.ts's TERMINAL_TASK_STATUSES)
+    // but not terminal-OK by itself — it reads terminal-OK only when the
+    // successor that replaced it does, recursively (run.md's "completed/
+    // superseded/waived" is this rule, not a second one). A follow-up task whose
+    // every finding was waived reads terminal-OK too — clearedFollowUpFindings()
+    // — and is collected below so the prompt can explain the row it clears.
+    const clearedFollowUps = [];
+    const nonTerminal = taskSummaries.filter((t, i) => {
+        if (TERMINAL_OK_TASK_STATUSES.has(t.taskStatus))
+            return false;
+        if (t.taskStatus !== SUPERSEDED_TASK_STATUS) {
+            const cleared = clearedFollowUpFindings(epicId, tasks[i], findings);
+            if (cleared === null)
+                return true;
+            clearedFollowUps.push({
+                taskId: t.taskId,
+                taskStatus: t.taskStatus,
+                waivedFindingIds: cleared.map((f) => f.finding_id),
+            });
+            return false;
+        }
+        const successor = resolveSupersededRow(epicId, t.taskId, tasks, successors);
+        return successor === undefined || !TERMINAL_OK_TASK_STATUSES.has(successor.taskStatus);
+    });
     // D-138: only tasks claimed done are asked for evidence. One still in flight
     // has not been gated yet and already blocks for not being terminal-OK —
     // repeating it here would make an in-progress task read like a forged one.
-    const ungated = tasks.filter((t) => TERMINAL_OK_TASK_STATUSES.has(t.taskStatus) && !(t.gate.gateOutcome && t.gate.resultRecorded));
+    // A waived task is never gated by definition (D-120): it has its own
+    // register, the operator's recorded approval. Without one it is a status
+    // typed into a plan, and still blocks.
+    const hasGateRun = (t) => t.gate.gateOutcome && t.gate.resultRecorded;
+    const ungated = tasks.filter((t) => TERMINAL_OK_TASK_STATUSES.has(t.taskStatus) &&
+        t.taskStatus !== WAIVED_TASK_STATUS &&
+        !hasGateRun(t));
+    const unapprovedWaived = tasks.filter((t) => t.taskStatus === WAIVED_TASK_STATUS && !hasGateRun(t) && !t.waiverApproved);
     const ungatedTasks = ungated.map((t) => ({
         taskId: t.taskId,
         taskStatus: t.taskStatus,
@@ -301,17 +526,77 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
                 // silently read as done — null here, not [], is what distinguishes
                 // "nothing to wait on" from "waiting on nothing outstanding".
                 null
-            : wellFormedObligationIds.filter((id) => {
+            : wellFormedObligationIds.flatMap((id) => {
                 const bare = bareTaskId(epicId, id);
                 const row = tasks.find((t) => bareTaskId(epicId, t.taskId) === bare);
-                const landed = row !== undefined &&
-                    TERMINAL_OK_TASK_STATUSES.has(row.taskStatus) &&
+                // An obligation named a task a LATER, separate amendment went on
+                // to supersede: the stored amends_task_ids is never rewritten
+                // (repairObligation refuses to renegotiate a well-formed
+                // obligation), so the id is resolved through its successor here,
+                // at evaluation time, instead. Only the LANDED-AT version comes
+                // from the successor row; the evidence transition() eventually
+                // re-checks (outstandingObligations, findings.ts) bare-compares
+                // AmendmentDischarge.taskId against the obligation's own
+                // amends_task_ids, so the taskId offered as proof has to stay the
+                // originally-named id (`row.taskId`) or that revalidation would
+                // never find a match and would refuse the discharge outright —
+                // the id is resolved for landing-status purposes only, never for
+                // the identity the obligation is matched by. The original row
+                // stands in unchanged (byte-identical to before this existed)
+                // whenever it was never superseded, or its chain does not
+                // resolve.
+                const evidenceRow = row !== undefined && row.taskStatus === SUPERSEDED_TASK_STATUS
+                    ? (resolveSupersededRow(epicId, row.taskId, tasks, successors) ?? row)
+                    : row;
+                // Terminal-OK is shared by the discharge test and the reasons
+                // below; `landed` itself is unchanged.
+                const landedOk = evidenceRow !== undefined && TERMINAL_OK_TASK_STATUSES.has(evidenceRow.taskStatus);
+                const landed = landedOk &&
                     version !== undefined &&
-                    row.planVersion !== null &&
-                    row.planVersion >= version;
-                if (landed && row.planVersion !== null)
-                    satisfiedBy.push({ taskId: row.taskId, planVersion: row.planVersion });
-                return !landed;
+                    evidenceRow.planVersion !== null &&
+                    evidenceRow.planVersion >= version;
+                if (landed && evidenceRow.planVersion !== null && row !== undefined)
+                    satisfiedBy.push({
+                        taskId: row.taskId,
+                        planVersion: evidenceRow.planVersion,
+                    });
+                if (landed)
+                    return [];
+                // #251: which ids are outstanding is decided above and nowhere
+                // else; this only says why, so the blocker stops calling an id
+                // "waiting" when it cannot land as things stand.
+                if (row === undefined || evidenceRow === undefined)
+                    return [{ id, reason: { kind: 'no-row' } }];
+                if (row.taskStatus === SUPERSEDED_TASK_STATUS && evidenceRow === row)
+                    return [{ id, reason: { kind: 'chain-unresolved' } }];
+                const via = evidenceRow === row ? {} : { successorId: evidenceRow.taskId };
+                const status = evidenceRow.taskStatus;
+                if (landedOk && evidenceRow.planVersion === null)
+                    return [{ id, reason: { kind: 'no-plan-version', ...via, status } }];
+                if (landedOk && version === undefined)
+                    return [{ id, reason: { kind: 'unversioned-amendment', ...via, status } }];
+                if (landedOk && evidenceRow.planVersion !== null)
+                    return [
+                        {
+                            id,
+                            reason: {
+                                kind: 'below-version',
+                                ...via,
+                                status,
+                                landedAt: evidenceRow.planVersion,
+                            },
+                        },
+                    ];
+                if (endedNotOk(status))
+                    return [{ id, reason: { kind: 'ended', ...via, status } }];
+                if (evidenceRow !== row)
+                    return [
+                        {
+                            id,
+                            reason: { kind: 'successor-pending', successorId: evidenceRow.taskId, status },
+                        },
+                    ];
+                return [{ id, reason: { kind: 'pending' } }];
             });
         if (malformedObligations.length === 0 && outstanding !== null && outstanding.length === 0) {
             satisfiedAmendments.push({
@@ -338,7 +623,7 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
             findingBlockers.push(`Finding "${f.finding_id}" is amend-pending but names no task ids to wait on — it can never be discharged this way; check how it entered amend-pending.`);
         }
         else if (outstanding.length > 0) {
-            findingBlockers.push(`Finding "${f.finding_id}" is amend-pending on plan v${version}: waiting on ${outstanding.join(', ')} to land terminal-OK at v${version} or later.`);
+            findingBlockers.push(describeOutstandingObligations(f.finding_id, version, outstanding));
         }
     }
     const blockers = [
@@ -348,11 +633,22 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
         ...(taskSummaries.length === 0
             ? [`Epic "${epicId}" has no tasks in the event log — nothing to integrate.`]
             : []),
-        ...nonTerminal.map((t) => `Task "${t.taskId}" is not terminal-OK (status: ${t.taskStatus}).`),
+        ...nonTerminal.map((t) => {
+            const row = tasks.find((r) => r.taskId === t.taskId);
+            if (row?.origin === FOLLOW_UP_TASK_ORIGIN && t.taskStatus !== SUPERSEDED_TASK_STATUS)
+                return `Task "${t.taskId}" is a follow-up (origin: escalation) and is not terminal-OK (status: ${t.taskStatus}). Complete it, or close every finding attributed to it — it clears once it owns at least one finding and all of them are fixed, refuted or waived.`;
+            if (t.taskStatus !== SUPERSEDED_TASK_STATUS)
+                return `Task "${t.taskId}" is not terminal-OK (status: ${t.taskStatus}).`;
+            const successor = resolveSupersededRow(epicId, t.taskId, tasks, successors);
+            return successor === undefined
+                ? `Task "${t.taskId}" is superseded but has no successor recorded in the log — it cannot be counted terminal-OK.`
+                : `Task "${t.taskId}" is superseded by "${successor.taskId}", which is not terminal-OK (status: ${successor.taskStatus}).`;
+        }),
         ...undispatchedTasks.map((t) => `Task "${t.taskId}" is in plan v${plan?.version} but has no events in the log — nothing records it as dispatched, let alone done (plan status: ${t.taskStatus}).`),
         ...ungated.map((t) => t.gate.gateOutcome
             ? `Task "${t.taskId}" is recorded ${t.taskStatus} and has a gate-outcome, but no task-result-recorded for it exists in the log. \`gate run\` writes both for the task it grades, so this outcome was written by hand — it is a claim, not a gate.`
-            : `Task "${t.taskId}" is recorded ${t.taskStatus} with no gate-outcome in the log at all — nothing gated it. Run \`smith gate run\` for it, or supersede the record.`),
+            : `Task "${t.taskId}" is recorded ${t.taskStatus} with no gate-outcome in the log at all — nothing gated it. Run \`bs gate run\` for it, or supersede the record.`),
+        ...unapprovedWaived.map((t) => `Task "${t.taskId}" is waived without operator approval — no gate run backs it and no operator approval is recorded. Record one: \`bs waivers approve-task ${t.taskId} --note <why> --actor operator ...\`, or complete the task.`),
         ...findingBlockers,
         // A record the fold could not read is a finding of UNKNOWN status, and
         // the open/closed split above simply does not contain it. Treating it as
@@ -365,9 +661,16 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
         ...mcpBlockers(epicId, mcp),
         // The roster is what knows the live plan version, so the review's own
         // plan_version has something to be stale against (D-125).
-        ...specReviewBlockers(epicId, specReview, plan?.version ?? null),
+        ...specReviewBlockers(epicId, specReview, plan?.version ?? null, effort),
         ...goalCheckBlockers(epicId, goalCheck, plan?.version ?? null, plan?.tasks.map((t) => t.taskId) ?? []),
     ];
+    // Mirrors specReviewBlockers's own skip condition exactly (spec.ts): the
+    // one legal way an absent review casts no blocker. Recomputed here rather
+    // than threaded back out of specReviewBlockers because the fact is cheap
+    // and the alternative — parsing it back out of a blocker string — is not.
+    const closingSpecReviewSkippedByTier = specReview.review === null &&
+        effort.closingSpecReview === 'when-plan-amended' &&
+        (plan?.version ?? null) === 1;
     return {
         epicId,
         tasks: taskSummaries,
@@ -378,6 +681,7 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
         undispatchedTasks,
         ungatedTasks,
         waivedTasks: taskSummaries.filter((t) => t.taskStatus === WAIVED_TASK_STATUS),
+        clearedFollowUps,
         openFindings,
         discretionaryFindings,
         satisfiedAmendments,
@@ -386,6 +690,7 @@ export function summarizeEpic(epicId, tasks, findings, integration, mcp, specRev
         specReview,
         goalCheck,
         concurrency,
+        closingSpecReviewSkippedByTier,
         blockers,
         mechanicallyReady: blockers.length === 0,
     };
@@ -455,8 +760,21 @@ function mcpVerdict(mcp) {
  * and the exit code are the refutable part; the output is not.
  */
 export function epicVerdictJudgeRequest(summary, budget) {
+    // Keyed by taskId: a row in here is one clearedFollowUpFindings() cleared,
+    // so the roster line below can say so instead of printing the raw `todo`
+    // beside `Tasks not yet terminal-OK: 0` with nothing to explain the gap —
+    // the exact contradiction both external judges refuted in bs-audit-2.
+    const clearedFollowUpsByTaskId = new Map(summary.clearedFollowUps.map((c) => [c.taskId, c]));
     const taskLines = summary.tasks.length > 0
-        ? summary.tasks.map((t) => `  ${t.taskId}: ${t.taskStatus}`).join('\n')
+        ? summary.tasks
+            .map((t) => {
+            const cleared = clearedFollowUpsByTaskId.get(t.taskId);
+            return cleared === undefined
+                ? `  ${t.taskId}: ${t.taskStatus}`
+                : `  ${t.taskId}: ${t.taskStatus} — follow-up (origin: escalation) cleared by rule: ` +
+                    `every attributed finding closed — fixed, refuted or waived (${cleared.waivedFindingIds.join(', ')}); counted terminal-OK`;
+        })
+            .join('\n')
         : '  (no tasks)';
     // The plan's side of the roster, stated separately: these ids have no events
     // at all, so their status is what the plan claims, not what happened (D-126).
@@ -471,8 +789,7 @@ export function epicVerdictJudgeRequest(summary, budget) {
     // The assembled branch. `integrationBlockers` above holds the epic on every
     // shape but this one, so by the time a judge runs the check is present,
     // passing, and current — the refutable question left is what it RAN.
-    const branch = `smith/${summary.epicId}/${RESERVED_TASK_ID}`;
-    const { check, headSha } = summary.integration;
+    const { check, headSha, branch } = summary.integration;
     const integrationLines = check === null
         ? [`  There is no integration-root check on record for ${branch}.`]
         : [
@@ -535,6 +852,9 @@ export function epicVerdictJudgeRequest(summary, budget) {
                     `  Verdict per wave: ${WAVE_VERDICTS.map((v) => `${v} ${concurrency.verdicts[v]}`).join(', ')}`,
                     `  Waves with no dispatch on record: ${concurrency.unobserved.length}`,
                     ...listOr(concurrency.unobserved.map((id) => `  wave ${id}: admitted, and the log holds no dispatch on record for it`), '  (none — every admitted wave has work behind it)'),
+                    `  Waves whose work merged off-lineage (width unmeasured): ${concurrency.unlinked.length}`,
+                    ...listOr(concurrency.unlinked.map((id) => `  wave ${id}: admitted, and its work merged or dispatched off this epic's ` +
+                        'lineage — real work, but its width cannot be measured from here'), '  (none)'),
                 ];
     const prompt = [
         'You are an adversarial critic in an automated epic-close gate.',
@@ -573,17 +893,36 @@ export function epicVerdictJudgeRequest(summary, budget) {
         '  depend on one another has nothing to run side by side, and refuting on',
         '  width alone would make your verdict a constant rather than a measurement.',
         '  What is refutable here is a wave whose tasks were admitted and nothing',
-        '  shows them running: that is a declaration with no work behind it.',
+        '  shows them running: that is a declaration with no work behind it. A wave',
+        '  whose work merged off-lineage is not that — its work is real, only its',
+        '  width went unmeasured, and that is not grounds to refute the epic.',
         '',
         'Discretionary closures — decided by a person, not shown by the machine:',
         `Tasks waived rather than completed: ${summary.waivedTasks.length}`,
         ...listOr(summary.waivedTasks.map((t) => `  ${t.taskId}`)),
-        `Findings closed by waiver or amendment: ${summary.discretionaryFindings.length}`,
+        `Follow-ups cleared by waiving every finding they own: ${summary.clearedFollowUps.length}`,
+        ...listOr(summary.clearedFollowUps.map((c) => `  ${c.taskId} — waived findings: ${c.waivedFindingIds.join(', ')}`)),
+        // bs quorum misread: this line sits right above the satisfiedAmendments
+        // line below, and a cross-provider judge read "closed by ... amendment: 0"
+        // next to "this close marks them amended: N" as the digest contradicting
+        // itself. Both counts were right; this one counts closures a person
+        // already made BEFORE this close, the other counts what THIS close is
+        // about to transition -- the label has to say which side of "this close"
+        // it counts, not just what closed the finding.
+        `Findings already closed by waiver or amendment before this close: ${summary.discretionaryFindings.length}`,
         ...listOr(summary.discretionaryFindings.map(findingLine)),
-        `Amendments this close will discharge: ${summary.satisfiedAmendments.length}`,
-        ...listOr(summary.satisfiedAmendments.map((f) => `${findingLine(f)} — discharged by ${f.satisfiedBy
+        // bs #222: this line sits right under "Open findings: 0", and a
+        // cross-provider judge read the earlier "Amendments this close will
+        // discharge: N" wording as N open blockers -- the loop above already
+        // proved every one of these already landed (summarizeEpic keeps a
+        // still-outstanding amend-pending finding in openFindings/blockers
+        // instead, see the `outstanding.length > 0` branch), so the digest has
+        // to say the obligation is a done fact, not a debt: not open, not a
+        // blocker, only the status label this close still has to flip.
+        `Amend-pending findings already landed, not open, not a blocker — this close marks them amended: ${summary.satisfiedAmendments.length}`,
+        ...listOr(summary.satisfiedAmendments.map((f) => `${findingLine(f)} — already landed (${f.satisfiedBy
             .map((d) => `${d.taskId} at plan v${d.planVersion}`)
-            .join(', ')}` +
+            .join(', ')})` +
             // D-21 Part 4: a clean discharge must never read as ordinary when
             // the obligation it rested on was corrected -- the judge is the
             // reader this honesty requirement exists for.
@@ -621,7 +960,7 @@ export function epicVerdictJudgeRequest(summary, budget) {
  * gate.ts's DEFAULT_JUDGE_BUDGET; not imported from there since gate.ts doesn't export it and
  * epic.ts must not depend on gate.ts (parallel quorum_triggers hosts, not a hierarchy). */
 const DEFAULT_JUDGE_BUDGET = { timeout_ms: 120_000, max_output_bytes: 262_144 };
-function epicQuorumDecisionPayload(quorum, epicId, finderProvider, ready) {
+function epicQuorumDecisionPayload(quorum, epicId, finderProvider, ready, integrationHeadSha) {
     const gating = quorum.gating;
     return {
         task_id: `${epicId}/${RESERVED_TASK_ID}`,
@@ -629,6 +968,12 @@ function epicQuorumDecisionPayload(quorum, epicId, finderProvider, ready) {
         finding_id: null,
         trigger_reason: 'epic-final-verdict',
         finder_provider: finderProvider,
+        // The integration branch head this quorum ran against (issue #270).
+        // `closeEpic` reads this back to decide whether a later close can reuse
+        // this decision instead of paying for the quorum again. A decision from
+        // before this field existed carries no `integration_head` and is never
+        // reused (undefined matches no sha).
+        integration_head: integrationHeadSha,
         outcome: gating.outcome,
         decision: gating.outcome === 'decided' ? gating.decision : null,
         agreement: gating.outcome === 'decided' ? gating.agreement : null,
@@ -673,12 +1018,13 @@ function resolvePlanRoster(epicId, planOpts) {
     }
 }
 /**
- * Operator-invoked verdict for one epic: mechanical readiness first, then
- * (only when mechanically ready and it isn't free to skip) a cross-provider
- * quorum on the claim "this epic is ready to open its integration PR". Never
- * dispatches anything itself — the caller decides what to do with `go`/`hold`.
+ * The read-only half of `runEpicVerdict`: fold the lineage into the one
+ * `EpicSummary` every verdict is computed from. Split out so `closeEpic` can
+ * read the same summary and the same lineage events without re-running
+ * `runEpicVerdict`'s quorum step when it decides to reuse a prior decision
+ * (issue #270).
  */
-export async function runEpicVerdict(input, ctx, opts = {}) {
+async function computeEpicSummary(input, ctx, opts) {
     // Lineage (D-119). An epic is not a session: `validateCausalParent`'s own
     // header calls chaining a fresh session onto a full one "the documented way
     // to run a large epic", and this verdict read one session. Split the real
@@ -701,6 +1047,7 @@ export async function runEpicVerdict(input, ctx, opts = {}) {
     const summary = summarizeEpic(input.epicId, tasks, findings, {
         check: latestIntegrationCheck(events, input.epicId),
         headSha: input.integrationHeadSha,
+        branch: input.integrationBranch,
     }, input.mcp, 
     // Folded from the log this call already read, and pinned to the same head
     // as the integration check: the closing spec review reads the assembled
@@ -708,21 +1055,44 @@ export async function runEpicVerdict(input, ctx, opts = {}) {
     {
         review: latestSpecReview(events, input.epicId),
         headSha: input.integrationHeadSha,
+        branch: input.integrationBranch,
     }, 
     // Same shape, other axis: the recorded check comes from the log this call
     // already read, and the goal it is measured against comes from the
     // roadmap the caller resolved — a check is only evidence about the text it
     // read, so the pair is what makes "current" decidable.
-    { check: latestGoalCheck(events, input.epicId), goal: input.goal }, resolvePlanRoster(input.epicId, input.planOpts ?? {}), skipped, 
+    { check: latestGoalCheck(events, input.epicId), goal: input.goal }, input.effort, resolvePlanRoster(input.epicId, input.planOpts ?? {}), skipped, 
     // Off the same lineage `events` every other fact here came from — the
     // wave record is in that log already, so measuring width costs this call
     // no second read and no second command anyone has to remember to type.
-    readEpicConcurrency(events, input.epicId));
+    readEpicConcurrency(events, input.epicId), 
+    // Same lineage read again, no second I/O: which superseded task ids this
+    // epic's amendments paired with a replacement, so a chain of them can
+    // resolve to whatever is actually carrying the work now.
+    taskSuccessors(events, input.epicId));
+    return { events, summary };
+}
+/**
+ * Operator-invoked verdict for one epic: mechanical readiness first, then
+ * (only when mechanically ready and it isn't free to skip) a cross-provider
+ * quorum on the claim "this epic is ready to open its integration PR". Never
+ * dispatches anything itself — the caller decides what to do with `go`/`hold`.
+ */
+export async function runEpicVerdict(input, ctx, opts = {}) {
+    const { summary } = await computeEpicSummary(input, ctx, opts);
     // Step 1 — mechanical_oracles_first, literally: a deterministic blocker is
     // final. Zero judge calls, zero events (read-only projection).
     if (!summary.mechanicallyReady) {
         return { outcome: 'hold', epicId: input.epicId, summary, reason: 'mechanical-blockers' };
     }
+    return runEpicQuorumVerdict(input, ctx, opts, summary);
+}
+/**
+ * Steps 2-5 of `runEpicVerdict`, pulled out so `closeEpic` can skip straight
+ * to them with an `EpicSummary` it already has (and so it can skip them
+ * entirely when it reuses a prior decision instead, issue #270).
+ */
+async function runEpicQuorumVerdict(input, ctx, opts, summary) {
     const policy = input.crosscheck?.policy ?? loadCrosscheckPolicy();
     const providers = enabledExternalProviders(policy);
     // Step 2 — zero-cost-by-default short-circuit, see module header §4.
@@ -766,16 +1136,54 @@ export async function runEpicVerdict(input, ctx, opts = {}) {
             : { outcome: 'go', epicId: input.epicId, summary, quorum };
     }
     // Step 5 — emit exactly once, for any case that actually ran a quorum.
-    await appendEvent({
+    const stored = await appendEvent({
         session_id: ctx.sessionId,
         actor: ctx.actor ?? 'system',
         event_type: 'quorum-decision',
         task_id: `${input.epicId}/${RESERVED_TASK_ID}`,
         plan_version: ctx.planVersion,
         causal_parent: ctx.causalParent,
-        payload: epicQuorumDecisionPayload(quorum, input.epicId, nativeProvider, outcome.outcome === 'go'),
+        payload: epicQuorumDecisionPayload(quorum, input.epicId, nativeProvider, outcome.outcome === 'go', input.integrationHeadSha),
     }, opts);
-    return outcome;
+    return { ...outcome, event_id: stored.event_id };
+}
+/**
+ * Issue #270: `epic close` used to re-run `runEpicVerdict` unconditionally,
+ * paying for the external quorum a second time on the same integration head
+ * `epic verdict` just paid for. This looks for a prior `go` decision this
+ * close can stand on instead.
+ *
+ * Reuse requires the latest event in the lineage to BE that decision — i.e.
+ * nothing was appended between the verdict call that wrote it and this close
+ * — rather than independently re-proving every mechanical input the quorum
+ * depended on unchanged. The two are not quite the same (`mcp`/`goal` are
+ * resolved from the roadmap, not the event log), but cheaply reading "did
+ * anything happen since" and refusing reuse the moment it did is the
+ * conservative side of that gap, and this is the acceptable approximation
+ * the task spec calls for when the exact proof is not cheap.
+ *
+ * A decision from before `integration_head` existed carries no such field
+ * and is never reused — `undefined` matches no sha. Same for a `hold`
+ * (`ready: false`): only a `go` is ever stood on without re-asking.
+ */
+function findReusableQuorumDecision(events, epicId, currentHeadSha) {
+    if (currentHeadSha === null || events.length === 0)
+        return null;
+    const last = events[events.length - 1];
+    if (last === undefined)
+        return null;
+    if (last.record.event_type !== 'quorum-decision')
+        return null;
+    if (last.record.task_id !== `${epicId}/${RESERVED_TASK_ID}`)
+        return null;
+    const payload = last.record.payload;
+    if (payload.trigger_reason !== 'epic-final-verdict')
+        return null;
+    if (payload.integration_head !== currentHeadSha)
+        return null;
+    if (payload.ready !== true)
+        return null;
+    return { eventId: last.event_id };
 }
 /**
  * D-43/P9-27. Everything above is a read-only probe, and that is the point:
@@ -907,6 +1315,13 @@ function epicSummaryPayload(summary) {
                 reviewed_by: review.reviewedBy,
                 finding_count: review.findingIds.length,
             },
+        // A skipped review and a clean one are not the same fact (run.md step
+        // 13): spec_review reads identically (null) in both "nothing ran because
+        // nothing was owed" and "nothing ran because none was on record" cases,
+        // so this field is what tells them apart. Always projected, for the same
+        // reason as spec_review itself — a reader must not have to infer "was
+        // this waived by tier" from an absent key.
+        closing_spec_review_skipped_by_tier: summary.closingSpecReviewSkippedByTier,
         // Projected even at zero, and even as null, for the reason plan_version
         // gives above. This is the only record that outlives the close, and the
         // question it answers — did this epic actually run its plan in parallel,
@@ -921,6 +1336,7 @@ function epicSummaryPayload(summary) {
                 verdicts: { ...summary.concurrency.verdicts },
                 widest: { ...summary.concurrency.widest },
                 unobserved: [...summary.concurrency.unobserved],
+                unlinked: [...summary.concurrency.unlinked],
                 problem: summary.concurrency.problem,
             },
         mechanically_ready: summary.mechanicallyReady,
@@ -936,8 +1352,9 @@ export async function closeEpic(input, ctx, opts = {}) {
     // else. The question here is "does THIS session have a log", and only this
     // session's log answers it; a lineage read would be asking whether some
     // ancestor exists, which is not what the refusal below says. Nothing is lost
-    // — every DECISION this function makes comes from runEpicVerdict, and that
-    // reads the lineage.
+    // — every DECISION this function makes comes from computeEpicSummary and
+    // runEpicQuorumVerdict (or a reused quorum decision), and those read the
+    // lineage.
     const events = await readEvents(ctx.sessionId, opts);
     if (events.length === 0) {
         throw new EpicCloseError('epic.unknown-session', `Refusing to close "${input.epicId}" against session "${ctx.sessionId}", which has no event log: the close would be the first line of a log nobody is reading.`, { epicId: input.epicId, sessionId: ctx.sessionId });
@@ -946,7 +1363,37 @@ export async function closeEpic(input, ctx, opts = {}) {
     if (input.overrideRationale !== undefined && rationale === '') {
         throw new EpicCloseError('epic.close-refused', `Refusing to close "${input.epicId}" with a blank override rationale: the reason is the whole point of recording the override.`, { epicId: input.epicId });
     }
-    const verdict = await runEpicVerdict(input, ctx, opts);
+    // Issue #270: compute the same summary `runEpicVerdict` would, then — only
+    // when it is mechanically ready — look for a `go` quorum-decision already
+    // on record for this exact integration head before paying for a fresh
+    // quorum. A decision this call stands on is referenced by event id in the
+    // `epic-closed` payload below rather than re-run.
+    const { events: lineageEvents, summary: closeSummary } = await computeEpicSummary(input, ctx, opts);
+    let verdict;
+    let reusedQuorumEventId = null;
+    if (!closeSummary.mechanicallyReady) {
+        verdict = {
+            outcome: 'hold',
+            epicId: input.epicId,
+            summary: closeSummary,
+            reason: 'mechanical-blockers',
+        };
+    }
+    else {
+        const reusable = findReusableQuorumDecision(lineageEvents, input.epicId, input.integrationHeadSha);
+        if (reusable) {
+            reusedQuorumEventId = reusable.eventId;
+            verdict = {
+                outcome: 'go',
+                epicId: input.epicId,
+                summary: closeSummary,
+                event_id: reusable.eventId,
+            };
+        }
+        else {
+            verdict = await runEpicQuorumVerdict(input, ctx, opts, closeSummary);
+        }
+    }
     const blockers = verdict.outcome === 'hold' ? verdict.summary.blockers : [];
     if (verdict.outcome === 'hold' && rationale === '') {
         throw new EpicCloseError('epic.close-refused', `Refusing to close "${input.epicId}": the verdict is hold (${verdict.reason}). Pass --override-rationale to close over it.\n${blockers.map((b) => `  - ${b}`).join('\n')}`, { epicId: input.epicId, reason: verdict.reason, blockers });
@@ -988,6 +1435,11 @@ export async function closeEpic(input, ctx, opts = {}) {
             override_rationale: closedBy === 'operator-override' ? rationale : null,
             blockers,
             summary: epicSummaryPayload(verdict.summary),
+            // Issue #270: the quorum-decision this close stood on, by event id —
+            // present whether it ran fresh just now or was reused unchanged, null
+            // when no quorum ever ran (e.g. zero-cost default config).
+            quorum_decision_event_id: verdict.event_id ?? null,
+            quorum_decision_reused: reusedQuorumEventId !== null,
         },
     }, opts);
     return {