@juzser/blacksmith 0.3.0 → 0.5.0

package/factory/orchestrator/dist/agentsSync.js

@@ -9,24 +9,44 @@
  * that box's business, and `--reset` restores what git HEAD says.
  *
  * SMITH_MAXTURNS_<ROLE> names the role upper-cased with `-` as `_`
- * (spec-reviewer → SMITH_MAXTURNS_SPEC_REVIEWER).
+ * (spec-reviewer → SMITH_MAXTURNS_SPEC_REVIEWER). BS_MAXTURNS_<ROLE> is the
+ * current spelling of the same variable (bs-rename, operator decision 3);
+ * SMITH_MAXTURNS_<ROLE> still works as a fallback, and BS_ wins when both are
+ * set for the same role.
  */
 import { readdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
+import { roleOfTemplateFile, templateFileFor } from './agentNames.js';
 import { SmithError } from './errors.js';
 import { GitCommandError, runGit, runGitRaw } from './git.js';
 import { AGENTS_DIR } from './paths.js';
 export class AgentsSyncError extends SmithError {
 }
 export const MAXTURNS_ENV_PREFIX = 'SMITH_MAXTURNS_';
+const BS_MAXTURNS_ENV_PREFIX = 'BS_MAXTURNS_';
 export function maxTurnsEnvName(role) {
     return `${MAXTURNS_ENV_PREFIX}${role.toUpperCase().replaceAll('-', '_')}`;
 }
+/**
+ * Recognises a `SMITH_MAXTURNS_<ROLE>` or `BS_MAXTURNS_<ROLE>` env name, and
+ * maps either spelling to the legacy-style name `byEnv` (below) is keyed by.
+ */
+function parseMaxTurnsEnvName(name) {
+    if (name.startsWith(BS_MAXTURNS_ENV_PREFIX)) {
+        return {
+            legacyName: `${MAXTURNS_ENV_PREFIX}${name.slice(BS_MAXTURNS_ENV_PREFIX.length)}`,
+            isBs: true,
+        };
+    }
+    if (name.startsWith(MAXTURNS_ENV_PREFIX))
+        return { legacyName: name, isBs: false };
+    return null;
+}
 const MAX_TURNS_LINE = /^maxTurns:[ \t]*(\S*)[ \t]*$/m;
 function listRoles(agentsDir) {
     return readdirSync(agentsDir)
-        .filter((name) => name.endsWith('.md'))
-        .map((name) => name.slice(0, -'.md'.length))
+        .map((name) => roleOfTemplateFile(name))
+        .filter((role) => role !== null)
         .sort();
 }
 /** The frontmatter block's bounds: the text between the leading `---` lines. */
@@ -54,6 +74,29 @@ function findMaxTurns(text, file) {
 function withMaxTurns(text, site, value) {
     return `${text.slice(0, site.from)}${value}${text.slice(site.to)}`;
 }
+/**
+ * The template's current `maxTurns:`, read fresh from disk — never cached,
+ * because `smith agents sync` may have rewritten the file since the caller
+ * last looked. Unlike `findMaxTurns`, this never throws: a role with no
+ * template, or a template with no `maxTurns:` line, is "cannot verify" for a
+ * caller like dispatchLint.ts, not a hard failure.
+ */
+export function readTemplateMaxTurns(agentsDir, role) {
+    const file = path.join(agentsDir, templateFileFor(role));
+    let text;
+    try {
+        text = readFileSync(file, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        return findMaxTurns(text, file).value;
+    }
+    catch {
+        return undefined;
+    }
+}
 function positiveInt(name, raw) {
     const value = /^[0-9]+$/.test(raw) ? Number(raw) : Number.NaN;
     if (!Number.isSafeInteger(value) || value <= 0) {
@@ -70,9 +113,10 @@ function apply(edits, dryRun) {
     return edits.map((edit) => edit.change);
 }
 /**
- * Rewrite `maxTurns:` for every role whose SMITH_MAXTURNS_<ROLE> is set
- * (non-empty). Every name and value is checked, and every target file read,
- * before anything is written: one bad entry refuses the whole sync.
+ * Rewrite `maxTurns:` for every role whose BS_MAXTURNS_<ROLE> (or its legacy
+ * SMITH_MAXTURNS_<ROLE> fallback) is set (non-empty). Every name and value is
+ * checked, and every target file read, before anything is written: one bad
+ * entry refuses the whole sync.
  */
 export function syncAgentMaxTurns(options = {}) {
     const agentsDir = options.agentsDir ?? AGENTS_DIR;
@@ -80,22 +124,35 @@ export function syncAgentMaxTurns(options = {}) {
     const dryRun = options.dryRun ?? false;
     const roles = listRoles(agentsDir);
     const byEnv = new Map(roles.map((role) => [maxTurnsEnvName(role), role]));
-    const requested = [];
+    // Keyed by the legacy-style name, so a BS_ hit and a SMITH_ hit for the
+    // same role collide here rather than both queuing an edit. BS_MAXTURNS_
+    // always sorts before SMITH_MAXTURNS_ (`B` < `S`), so a later legacy hit
+    // for a role BS_ already claimed is dropped, not overwritten.
+    const byRole = new Map();
     for (const name of Object.keys(env).sort()) {
-        if (!name.startsWith(MAXTURNS_ENV_PREFIX))
+        const parsed = parseMaxTurnsEnvName(name);
+        if (!parsed)
             continue;
         const raw = env[name];
         if (raw === undefined || raw === '')
             continue;
-        const role = byEnv.get(name);
+        const role = byEnv.get(parsed.legacyName);
         if (role === undefined) {
             throw new AgentsSyncError('agents.unknown-role', `${name} names no agent template; valid roles: ${roles.join(', ')}.`, { variable: name, roles });
         }
-        requested.push({ role, env: name, to: positiveInt(name, raw) });
+        const existing = byRole.get(parsed.legacyName);
+        if (existing?.isBs && !parsed.isBs)
+            continue;
+        byRole.set(parsed.legacyName, {
+            role,
+            env: name,
+            to: positiveInt(name, raw),
+            isBs: parsed.isBs,
+        });
     }
-    requested.sort((a, b) => a.role.localeCompare(b.role));
+    const requested = [...byRole.values()].sort((a, b) => a.role.localeCompare(b.role));
     const edits = requested.map(({ role, env: name, to }) => {
-        const file = path.join(agentsDir, `${role}.md`);
+        const file = path.join(agentsDir, templateFileFor(role));
         const text = readFileSync(file, 'utf8');
         const site = findMaxTurns(text, file);
         return {
@@ -125,7 +182,7 @@ export function resetAgentMaxTurns(options = {}) {
         throw new AgentsSyncError('agents.reset-unavailable', `--reset needs git HEAD, but ${agentsDir} is not inside a git checkout.`, { agentsDir });
     }
     const edits = roles.map((role) => {
-        const file = path.join(agentsDir, `${role}.md`);
+        const file = path.join(agentsDir, templateFileFor(role));
         const rel = path.relative(topLevel, realpathSync(file)).split(path.sep).join('/');
         let committed;
         try {

package/factory/orchestrator/dist/artifacts.js

@@ -72,6 +72,37 @@ function contains(root, child) {
     const rel = path.relative(root, child);
     return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
 }
+/**
+ * Resolve one declared artifact path to an absolute, real, on-disk location
+ * inside `<artifactsDir>/<taskId>/`, for a reader that is about to open the
+ * bytes rather than merely check the declaration — the dashboard's artifact
+ * route, not the gate. Reuses `checkArtifacts`'s containment and realpath
+ * logic so the two agree about what "inside the home" means; returns `null`
+ * for anything that logic would flag (`..`, an absolute path, a symlink that
+ * escapes, a missing file) rather than a reason, since the only caller turns
+ * every reason into the same 404.
+ */
+export function resolveArtifactPath(taskId, declaredPath, artifactsDir = STATE_ARTIFACTS_DIR) {
+    try {
+        const root = path.resolve(artifactsDir);
+        const home = homeUnder(root, taskId);
+        if (path.isAbsolute(declaredPath))
+            return null;
+        const resolved = path.resolve(home, declaredPath);
+        if (resolved === home || !contains(home, resolved))
+            return null;
+        if (!existsSync(resolved))
+            return null;
+        const realHome = realOf(home);
+        const real = realOf(resolved);
+        if (!contains(realHome, real))
+            return null;
+        return real;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Check every path a result declares as evidence. Relative paths resolve
  * against the task's home, so `coverage.txt` means the obvious thing and the

package/factory/orchestrator/dist/attribution.js

@@ -129,6 +129,9 @@ export async function routeFindings(items, options, ctx, opts = {}) {
  * Call this only once the finding has survived intake. A waived or refuted
  * finding minting a `todo` follow-up would block the epic verdict on a bug the
  * team already settled.
+ *
+ * `ctx.project`, when set, is stamped on the follow-up; without it the
+ * follow-up inherits the project the log holds for `routed.fromTaskId`.
  */
 export async function recordReattribution(routed, finding, ctx, opts = {}) {
     if (routed.attribution === 'gated')
@@ -139,6 +142,7 @@ export async function recordReattribution(routed, finding, ctx, opts = {}) {
             taskId: routed.taskId,
             objective: `Fix: ${finding.summary}`,
             claims: routed.claims,
+            fromTaskId: routed.fromTaskId,
         }, ctx, opts);
     }
     await appendEvent({

package/factory/orchestrator/dist/audit.js

@@ -32,11 +32,16 @@
 import { randomBytes } from 'node:crypto';
 import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
+import { resolveFindingOwner } from './claims.js';
 import { SmithError } from './errors.js';
-import { appendEvent } from './events.js';
+import { appendEvent, eventTaskId, readLineageEvents, } from './events.js';
 import { computeFingerprint, normalizeFilePath } from './findings.js';
 import { runGit } from './git.js';
 import { checkWorktreeImmutable, fingerprintWorktree, } from './immutability.js';
+import { isFactoryCheckout, SPECS_ACTIVE_DIR } from './paths.js';
+import { latestPlanVersion, livePlanTasks, loadPlan, planClaimedTasks, } from './plan.js';
+import { defaultKindFor, FACTORY_PROJECT } from './roadmap.js';
+import { bareTaskId, epicOfTaskId, isQualifiedTaskId } from './taskId.js';
 import { loadTaxonomy } from './taxonomy.js';
 export class AuditError extends SmithError {
 }
@@ -46,6 +51,30 @@ export class AuditError extends SmithError {
  * overlap is meaningful.
  */
 export const AUDIT_AXES = ['performance', 'code-quality', 'architecture', 'security'];
+/**
+ * `mintAuditId` (audit.ts) mints `<YYYYMMDD>-<8 hex>` — a day stamp and eight
+ * hex characters joined by "-", never a "/". Audit.md's "Declare the artifact
+ * before the call" names the task id an audit axis turn dispatches and
+ * reports against as `<audit-id>.<axis>`. An ordinary task id is always
+ * "<epic>/<bare>" (taskId.ts) — qualified with a "/" by construction — so the
+ * two shapes cannot collide: this checks the exact mint format, not just the
+ * absence of "/", so a coincidentally dotted bare task id still reads as
+ * ordinary rather than as an axis.
+ */
+const AUDIT_AXIS_TASK_ID = new RegExp(`^\\d{8}-[0-9a-f]{8}\\.(${AUDIT_AXES.join('|')})$`);
+export function isAuditAxisTaskId(taskId) {
+    return AUDIT_AXIS_TASK_ID.test(taskId);
+}
+const AUDIT_AXIS_ROW_ID = new RegExp(`^\\d{8}-[0-9a-f]{8}\\.(${AUDIT_AXES.join('|')})(-[A-Za-z0-9-]+)?$`);
+/**
+ * Broader than `isAuditAxisTaskId`: also matches a re-run or cross-check turn
+ * dispatched under a suffixed id (`<audit-id>.performance-2`, `.security-codex`).
+ * Used only by the dashboard Kanban read to hide those rows; the judge gate
+ * keeps the exact matcher so its behaviour does not widen.
+ */
+export function isAuditAxisRowId(taskId) {
+    return AUDIT_AXIS_ROW_ID.test(taskId);
+}
 /** Spec §4.3's table, in the order that table is written. */
 export const AUDIT_STATUSES = ['raised', 'merged', 'accepted', 'declined', 'fixed'];
 /** Spec §4.4. Applied when the store is folded, not by a sweeper. */
@@ -251,11 +280,31 @@ export function foldAuditStore(lines, opts = {}) {
  * The fingerprints an axis may not raise again. This is the whole of the
  * dedupe half of §3.1 — `audit record` drops what this names and appends the
  * rest.
+ *
+ * Each suppressing finding contributes two fingerprints, not one. Its
+ * stored `finding.fingerprint` is whatever `computeFingerprint` produced
+ * *when the line was written* — widening that normalizer (issue #178) does
+ * not rewrite `findings.jsonl`, so a decline recorded before a normalizer
+ * fix keeps its old hash forever. The raised line still carries its own
+ * `file_path`/`axis`/`summary`, so recomputing the fingerprint with today's
+ * normalizer costs nothing and lets a pre-existing decline suppress a
+ * re-raise that only differs in what the new normalizer now strips — no
+ * store rewrite, no migration. When the stored hash and the recomputed one
+ * already agree (the common case), the second `add` is a no-op.
  */
 export function suppressedFingerprints(lines, opts = {}) {
-    return new Set(foldAuditStore(lines, opts)
-        .filter((finding) => finding.suppressesReraise)
-        .map((finding) => finding.fingerprint));
+    const set = new Set();
+    for (const finding of foldAuditStore(lines, opts)) {
+        if (!finding.suppressesReraise)
+            continue;
+        set.add(finding.fingerprint);
+        set.add(computeFingerprint({
+            filePath: finding.file_path,
+            category: finding.axis,
+            summary: finding.summary,
+        }));
+    }
+    return set;
 }
 function clusterOf(filePath, findings) {
     const members = findings.filter((finding) => finding.status !== 'merged');
@@ -376,7 +425,7 @@ export function readAuditManifest(projectDir) {
 function requireOpenAudit(projectDir) {
     const manifest = readAuditManifest(projectDir);
     if (manifest === undefined) {
-        throw new AuditError('audit.not-open', `no audit is open on ${path.resolve(projectDir)}: run \`smith audit open\` first`, { projectDir: path.resolve(projectDir), manifestPath: auditManifestPath(projectDir) });
+        throw new AuditError('audit.not-open', `no audit is open on ${path.resolve(projectDir)}: run \`bs audit open\` first`, { projectDir: path.resolve(projectDir), manifestPath: auditManifestPath(projectDir) });
     }
     return manifest;
 }
@@ -398,6 +447,39 @@ function mintAuditId(now) {
     const day = now.toISOString().slice(0, 10).replaceAll('-', '');
     return `${day}-${randomBytes(4).toString('hex')}`;
 }
+/**
+ * The name an audit calls `project` by, everywhere one is needed: the
+ * event's `project` field, the cut milestone's `- project:` line and goal
+ * sentence, and the cut spec's Project line.
+ *
+ * `path.basename(project)` names every OTHER project correctly, but this
+ * clone's own directory is not always named FACTORY_PROJECT
+ * (`blacksmith`) -- roadmap.ts's own note documents the real `black-smith`/
+ * `blacksmith` siblings this factory was built beside -- so a self-audit that
+ * used the basename wrote a name `collectProjects()` (projects.ts) had never
+ * seen, sent it looking for a checkout under this clone's own parent, and it
+ * found this very clone: registered a second time as a foreign, non-self ref
+ * that `--no-self` could not filter. Comparing against REPO_ROOT, resolved
+ * the same way `unwatchedProjects` (projects.ts) already does, is what tells
+ * "this clone, filed under its own directory name" from "a project that is
+ * genuinely named that".
+ */
+export function auditedProjectName(project) {
+    return isFactoryCheckout(project) ? FACTORY_PROJECT : path.basename(project);
+}
+/**
+ * The `- kind:` a cut milestone declares alongside auditedProjectName's
+ * `- project:` line. roadmap.ts's own parser fixes the two together
+ * (`roadmap.factory-kind-fixed`): a milestone naming FACTORY_PROJECT must be
+ * kind "factory", never "product". A cut that named a self-audit
+ * FACTORY_PROJECT but still wrote a hard-coded "product" kind would stamp a
+ * milestone that fails to parse the moment `loadRoadmap()` reads it back, so
+ * this feeds auditedProjectName's own answer through roadmap.ts's
+ * defaultKindFor rather than re-deriving it separately.
+ */
+export function auditedProjectKind(project) {
+    return defaultKindFor(auditedProjectName(project));
+}
 /**
  * The audit's events are ordinary events on the operator's session, stamped
  * with the project's name so the multi-project timeline can tell whose audit
@@ -412,7 +494,7 @@ function emit(eventType, project, ctx, opts, payload) {
         event_type: eventType,
         plan_version: ctx.planVersion,
         causal_parent: ctx.causalParent,
-        project: path.basename(project),
+        project: auditedProjectName(project),
         payload,
     }, opts);
 }
@@ -635,7 +717,7 @@ function cite(finding) {
 function renderMilestone(input, project, findings) {
     const audits = auditIdsOf(findings);
     const goal = [
-        `Cut from audit ${audits.join(', ')} of \`${path.basename(project)}\` (${findings.length} accepted finding${findings.length === 1 ? '' : 's'}: ${severityCounts(findings)}).`,
+        `Cut from audit ${audits.join(', ')} of \`${auditedProjectName(project)}\` (${findings.length} accepted finding${findings.length === 1 ? '' : 's'}: ${severityCounts(findings)}).`,
         'Each finding below is one acceptance criterion; the plan decides the tasks.',
         ...findings.map((finding) => `${cite(finding)}.`),
     ].join(' ');
@@ -644,8 +726,8 @@ function renderMilestone(input, project, findings) {
         `- id: ${input.epicId}`,
         '- status: planned',
         `- epics: [${input.epicId}]`,
-        `- project: ${path.basename(project)}`,
-        '- kind: product',
+        `- project: ${auditedProjectName(project)}`,
+        `- kind: ${auditedProjectKind(project)}`,
         `- goal: ${goal}`,
         '',
     ].join('\n');
@@ -673,9 +755,9 @@ function renderSpec(input, project, findings) {
         `# Epic spec — \`${input.epicId}\``,
         '',
         `- **Epic id** — \`${input.epicId}\``,
-        `- **Project** — \`${path.basename(project)}\` at \`${project}\`, and every worktree is placed beside that clone (\`AGENTS.md\` "Worktrees").`,
+        `- **Project** — \`${auditedProjectName(project)}\`; every worktree is placed beside the clone the run is handed (\`AGENTS.md\` "Worktrees").`,
         `- **Roadmap milestone** — \`${input.epicId}\` in \`factory/specs/roadmap.md\`.`,
-        `- **Provenance** — cut by \`smith audit cut\` from audit ${audits.join(', ')} (${findings.length} accepted finding${findings.length === 1 ? '' : 's'}: ${severityCounts(findings)}). Each finding carries this epic id in \`.blacksmith/findings.jsonl\`; \`smith audit resolve\` marks them fixed when the epic closes.`,
+        `- **Provenance** — cut by \`bs audit cut\` from audit ${audits.join(', ')} (${findings.length} accepted finding${findings.length === 1 ? '' : 's'}: ${severityCounts(findings)}). Each finding carries this epic id in \`.blacksmith/findings.jsonl\`; \`bs audit resolve\` marks fixed only the ones a task in this plan still claims, and leaves the rest \`deferred\`.`,
         '',
         '## What this epic is',
         '',
@@ -734,24 +816,166 @@ export async function cutAudit(projectDir, input, ctx, opts = {}) {
     };
 }
 /**
- * `audit resolve <project-dir> --epic <epic-id>`. Appends a `fixed` line for
- * every finding the epic carried. Called from `/bs run`'s epic-close step, so
- * it is repeatable; an epic no finding carries is refused, because the likely
- * cause is a typo and a silent no-op would leave every finding open.
+ * The epic's newest plan, however `resolveOpts` asks for it found. Refuses
+ * rather than guesses: `resolveAudit` must never treat "I could not find a
+ * plan" as "nothing is claimed", because that reading marks every carried
+ * finding fixed.
+ */
+function resolveEpicPlan(epicId, resolveOpts) {
+    if (resolveOpts.plan !== undefined)
+        return resolveOpts.plan;
+    const planOpts = resolveOpts.planOpts ?? {};
+    const version = latestPlanVersion(epicId, planOpts);
+    if (version === null) {
+        const searchedDir = path.join(planOpts.specsDir ?? SPECS_ACTIVE_DIR, epicId);
+        throw new AuditError('audit.no-plan', `no plan found for epic ${epicId}: \`audit resolve\` only marks a finding fixed when some plan task claims its file, so a missing plan cannot be treated as an empty one. Searched ${searchedDir}. If this epic's plans live elsewhere, pass --specs-dir <dir> naming the directory they live in, or --plan <plan.json> to point at one directly.`, { epic: epicId });
+    }
+    return loadPlan(epicId, version, planOpts);
+}
+/**
+ * `--except` entries against the epic's carried fingerprints, full or a
+ * unique prefix — the same latitude other audit verbs give a fingerprint
+ * argument. A value that matches nothing is refused as a likely typo (same
+ * spirit as `audit.unknown-epic`); one whose prefix matches more than one
+ * carried fingerprint is refused rather than guessed.
  */
-export async function resolveAudit(projectDir, epicId, ctx, opts = {}) {
+function matchExceptFingerprints(except, carried, epicId) {
+    const known = carried.map((finding) => finding.fingerprint);
+    const matched = new Set();
+    for (const value of except) {
+        if (known.includes(value)) {
+            matched.add(value);
+            continue;
+        }
+        const candidates = known.filter((fingerprint) => fingerprint.startsWith(value));
+        if (candidates.length === 1) {
+            matched.add(candidates[0]);
+            continue;
+        }
+        if (candidates.length > 1) {
+            throw new AuditError('audit.ambiguous-except', `--except ${value} matches ${candidates.length} findings epic ${epicId} carries: ${candidates.join(', ')}`, { epic: epicId, value, candidates });
+        }
+        throw new AuditError('audit.unknown-finding', `--except ${value} matches no finding epic ${epicId} carries`, { epic: epicId, value });
+    }
+    return matched;
+}
+/**
+ * Every task id a `wave-merged` event says landed on the epic's integration
+ * branch — the merge queue's `emitWaveMerged` (`taskEvents.ts`) is the one
+ * writer, so this is "this task's change shipped," not a guess reconstructed
+ * from gate or task-result events. Both fields it may carry are read: the
+ * `payload.task_ids` array `emitWaveMerged` always sets, and the envelope
+ * `task_id` some hand-appended events set alone (`db/projector.ts`'s
+ * `waveTaskIds` comment: reading only one of the two silently dropped merges
+ * during the dogfood run).
+ */
+function mergedTaskIds(events) {
+    const ids = new Set();
+    for (const { record } of events) {
+        if (record.event_type !== 'wave-merged')
+            continue;
+        const payloadIds = record.payload.task_ids;
+        if (Array.isArray(payloadIds)) {
+            for (const id of payloadIds) {
+                if (typeof id === 'string' && id.length > 0)
+                    ids.add(id);
+            }
+        }
+        const taskId = eventTaskId(record);
+        if (taskId !== null)
+            ids.add(taskId);
+    }
+    return ids;
+}
+/**
+ * Claims of a plan task that is `superseded` in the newest plan but whose
+ * change already merged into the epic's integration branch before a later
+ * replan superseded it — the false negative `planClaimedTasks` alone cannot
+ * see, because `livePlanTasks` drops every dead id whether or not its work
+ * ever shipped.
+ *
+ * A task superseded BEFORE it merged must still not count: that is the
+ * "operator scoped the plan narrower on purpose" case this function's caller
+ * already protects, and `merged` (built only from `wave-merged` events) is
+ * empty for it. A same-id supersede (D-121) is excluded too, via `liveIds` —
+ * its live successor is already in `planClaimedTasks`, so counting the dead
+ * copy again would only repeat the same claims under a second entry.
+ *
+ * A merged id counts only when it is qualified under THIS epic
+ * (`epicOfTaskId(id) === epicId`) and its bare half matches the plan task's.
+ * `taskIdsMatch`'s cross-spelling fallback is deliberately not used here: a
+ * `wave-merged` payload carries no `epic_id`, and `readLineageEvents` is not
+ * epic-scoped, so a bare id in the lineage could belong to a legacy
+ * pre-D-46 session or to a different epic that merged waves in the same
+ * lineage. Trusting a bare match would mark a finding `fixed` when nothing
+ * in *this* epic actually shipped — the wrong direction for an operation
+ * that must never be unsure in the optimistic direction. A bare merged id is
+ * therefore ignored, same as before this file learned about merges at all.
+ */
+function mergedSupersededClaims(plan, merged, epicId) {
+    if (merged.size === 0)
+        return [];
+    const liveIds = new Set(livePlanTasks(plan).map((task) => task.task_id));
+    const mergedBareIds = new Set([...merged]
+        .filter((id) => isQualifiedTaskId(id) && epicOfTaskId(id) === epicId)
+        .map((id) => bareTaskId(id)));
+    const claimed = new Map();
+    for (const task of plan.tasks) {
+        if (task.task_status !== 'superseded')
+            continue;
+        if (liveIds.has(task.task_id))
+            continue;
+        if (claimed.has(task.task_id))
+            continue;
+        if (mergedBareIds.has(bareTaskId(task.task_id)))
+            claimed.set(task.task_id, task);
+    }
+    return [...claimed.values()]
+        .filter((task) => Array.isArray(task.claims))
+        .map((task) => ({ task_id: task.task_id, claims: task.claims }));
+}
+/**
+ * `audit resolve <project-dir> --epic <epic-id>`. Appends a `fixed` line only
+ * for a carried finding some task in the epic's newest plan still claims
+ * (`resolveFindingOwner`, D-41/P9-24), OR a task the plan now shows
+ * `superseded` whose change already merged into the epic's integration
+ * branch before it was superseded (`mergedSupersededClaims`) — a task
+ * superseded before it ever merged delivered nothing, so it is not counted
+ * either way. An operator who scoped the plan narrower than the audit
+ * deferred the rest on purpose, and marking them fixed anyway would erase
+ * that choice. Unclaimed findings stay exactly as they were and come back in
+ * `deferred`; `--except` forces specific fingerprints there even when a task
+ * claims them. Called from `/bs run`'s epic-close step, so it is repeatable;
+ * an epic no finding carries is refused, because the likely cause is a typo
+ * and a silent no-op would leave every finding open. A plan that cannot be
+ * found is refused too (`audit.no-plan`): being unsure must never mark
+ * anything fixed.
+ */
+export async function resolveAudit(projectDir, epicId, ctx, opts = {}, resolveOpts = {}) {
     const project = path.resolve(projectDir);
     const carried = foldAuditStore(readAuditStore(project)).filter((finding) => finding.epic === epicId);
     if (carried.length === 0) {
-        throw new AuditError('audit.unknown-epic', `no finding in ${auditStorePath(project)} carries epic ${epicId}: was it cut with \`smith audit cut\`?`, { epic: epicId });
+        throw new AuditError('audit.unknown-epic', `no finding in ${auditStorePath(project)} carries epic ${epicId}: was it cut with \`bs audit cut\`?`, { epic: epicId });
     }
     const open = carried.filter((finding) => finding.status !== 'fixed');
+    const plan = resolveEpicPlan(epicId, resolveOpts);
+    const lineage = await readLineageEvents(ctx.sessionId, opts);
+    const claimedTasks = [
+        ...planClaimedTasks(plan),
+        ...mergedSupersededClaims(plan, mergedTaskIds(lineage), epicId),
+    ];
+    const except = matchExceptFingerprints(resolveOpts.except ?? [], carried, epicId);
+    const toFix = open.filter((finding) => !except.has(finding.fingerprint) &&
+        resolveFindingOwner(finding.file_path, claimedTasks).owner !== 'unclaimed');
+    const toFixFingerprints = new Set(toFix.map((finding) => finding.fingerprint));
+    const deferred = open.filter((finding) => !toFixFingerprints.has(finding.fingerprint));
     const stored = await emit('audit-resolved', project, ctx, opts, {
         epic: epicId,
-        fixed: open.map((finding) => finding.fingerprint),
+        fixed: toFix.map((finding) => finding.fingerprint),
+        deferred: deferred.map((finding) => finding.fingerprint),
     });
     const ts = new Date().toISOString();
-    appendAuditLines(project, open.map((finding) => ({
+    appendAuditLines(project, toFix.map((finding) => ({
         fingerprint: finding.fingerprint,
         status: 'fixed',
         ts,
@@ -761,10 +985,11 @@ export async function resolveAudit(projectDir, epicId, ctx, opts = {}) {
     })));
     return {
         epic: epicId,
-        fixed: open.map((finding) => finding.fingerprint),
+        fixed: toFix.map((finding) => finding.fingerprint),
         already: carried
             .filter((finding) => finding.status === 'fixed')
             .map((finding) => finding.fingerprint),
+        deferred: deferred.map((finding) => finding.fingerprint),
         event_id: stored.event_id,
     };
 }

package/factory/orchestrator/dist/autonomy.js

@@ -79,11 +79,15 @@ function securityFields(proposal, ctx) {
         case 'growth-review-due':
             return [];
         case 'error-report':
-            // Refused ahead of the keyword match; listed so the switch stays exhaustive.
+            // Refused ahead of the keyword match (see classify() below); listed so
+            // the switch stays exhaustive. proposal.project is only ever null when
+            // errorIssues.ts's fail-closed fold could not resolve one, which this
+            // branch never actually returns for -- see classify()'s early
+            // 'tracker-write-never-auto' refusal for every 'error-report' kind.
             return [
                 { field: 'task ref', value: proposal.taskRef },
                 { field: 'error class', value: proposal.errorClass },
-                { field: 'project', value: proposal.project },
+                { field: 'project', value: proposal.project ?? '(unresolved)' },
             ];
     }
 }