@juzser/blacksmith 0.4.0 → 0.5.0

package/factory/orchestrator/dist/cliName.js

@@ -0,0 +1,27 @@
+/**
+ * bs-rename, operator decision 3: `smith`/`smith-run` keep working as
+ * deprecated aliases of `bs`/`bs-run` for a transition period, each printing
+ * one deprecation line to stderr (never stdout -- stdout is parsed as JSON by
+ * playbooks) when invoked under the old name.
+ *
+ * Detection is argv[1]'s basename. `npm`/`pnpm`'s `bin` field creates one
+ * shim per key, and each is an unextended file (a symlink on POSIX) literally
+ * named after that key, sharing the same target script with its non-
+ * deprecated sibling -- so this reads back exactly what the operator typed to
+ * reach the running process, never the shared script file underneath it.
+ */
+import path from 'node:path';
+export function invokedName(argv1) {
+    return argv1 === undefined ? undefined : path.basename(argv1);
+}
+/**
+ * Writes the deprecation line when the current process was invoked as
+ * `legacyName`; a no-op for every other invocation, `currentName` included.
+ */
+export function warnIfLegacyName(argv1, legacyName, currentName, writeStderr = (text) => {
+    process.stderr.write(text);
+}) {
+    if (invokedName(argv1) !== legacyName)
+        return;
+    writeStderr(`${legacyName}: deprecated, use "${currentName}" instead -- ${legacyName} will be removed in a future release.\n`);
+}

package/factory/orchestrator/dist/crosscheck.js

@@ -12,11 +12,27 @@
 // backward compatibility with the Phase-1 scaffold (it predates the transport
 // split and no longer carries meaning on its own — `transport` is now the
 // field that actually selects behavior).
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
 import { parse as parseYaml } from 'yaml';
+import { readEnv } from './env.js';
 import { SmithError } from './errors.js';
 import { CROSSCHECK_POLICY_PATH } from './paths.js';
 import { apiKeyPresent, commandOnPath } from './preconditions.js';
+/**
+ * OpenRouter (https://openrouter.ai/api/v1) speaks the same OpenAI
+ * chat/completions wire format api-transport.ts already sends, so it plays
+ * two roles here without a new transport module:
+ *
+ * - Substitute: a default external provider (codex, deepseek) whose own
+ *   precondition is unmet on this box runs through OpenRouter instead, using
+ *   `openrouter_fallback.model` from crosscheck.yml — same provider name,
+ *   mode and gating power, `via: 'openrouter'` recorded for the log.
+ * - Extra judge: `OPENROUTER_MODELS` (comma-separated model ids) synthesizes
+ *   additional `openrouter:<model>` providers, `mode: shadow` by default.
+ */
+const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
+const OPENROUTER_API_KEY_ENV = 'OPENROUTER_API_KEY';
 export class CrosscheckError extends SmithError {
 }
 /**
@@ -246,6 +262,13 @@ function parseProvider(name, raw) {
             throw new CrosscheckError('crosscheck.invalid-provider', `Provider "${name}" has transport: cli but no command.`, { provider: name });
         }
         const command = quorumString(`providers.${name}.command`, raw.command);
+        // Computed unconditionally (not only under `auto`) so a substitution
+        // decision below can ask "can this provider run as declared" even when
+        // the file says `enabled: true` outright.
+        const preconditionMet = commandOnPath(command);
+        if (shouldSubstituteViaOpenrouter(declared, preconditionMet, raw.openrouter_fallback)) {
+            return substituteViaOpenrouter(name, mode, modelTier, raw.openrouter_fallback, enabledSource);
+        }
         return {
             name,
             kind: 'api',
@@ -254,7 +277,7 @@ function parseProvider(name, raw) {
             // binary runnable here. Not whether it is authenticated -- only a real
             // call knows that, so `auto` can still resolve true on a box where
             // `codex login` was never run, and the quorum records the failure.
-            enabled: declared === 'auto' ? commandOnPath(command) : declared,
+            enabled: declared === 'auto' ? preconditionMet : declared,
             enabledSource,
             mode,
             modelTier,
@@ -271,13 +294,18 @@ function parseProvider(name, raw) {
             throw new CrosscheckError('crosscheck.invalid-provider', `Provider "${name}" has transport: api but is missing base_url/model/api_key_env.`, { provider: name });
         }
         const apiKeyEnv = quorumString(`providers.${name}.api_key_env`, raw.api_key_env);
+        // Computed unconditionally for the same reason as the cli branch above.
+        const preconditionMet = apiKeyPresent(apiKeyEnv);
+        if (shouldSubstituteViaOpenrouter(declared, preconditionMet, raw.openrouter_fallback)) {
+            return substituteViaOpenrouter(name, mode, modelTier, raw.openrouter_fallback, enabledSource);
+        }
         return {
             name,
             kind: 'api',
             transport: 'api',
             // Set and non-empty, which is all that is knowable without spending a
             // call; whether the key is VALID is not.
-            enabled: declared === 'auto' ? apiKeyPresent(apiKeyEnv) : declared,
+            enabled: declared === 'auto' ? preconditionMet : declared,
             enabledSource,
             mode,
             modelTier,
@@ -292,6 +320,85 @@ function parseProvider(name, raw) {
     }
     throw new CrosscheckError('crosscheck.invalid-provider', `Provider "${name}" is not kind: native and has no recognized transport (got "${String(raw.transport)}").`, { provider: name, transport: raw.transport });
 }
+/**
+ * Operator decision 1a's eligibility rule: a provider substitutes through
+ * OpenRouter when it is not explicitly turned off (`enabled: false` stays an
+ * opt-out, whether the reason is cost, policy, or "I don't want a
+ * substitute"), its own precondition failed on this box, the policy names a
+ * fallback model for it, and OPENROUTER_API_KEY is actually set here.
+ */
+function shouldSubstituteViaOpenrouter(declared, preconditionMet, fallback) {
+    return (declared !== false &&
+        !preconditionMet &&
+        Boolean(fallback) &&
+        apiKeyPresent(OPENROUTER_API_KEY_ENV));
+}
+function substituteViaOpenrouter(name, mode, modelTier, fallback, enabledSource) {
+    const model = quorumString(`providers.${name}.openrouter_fallback.model`, fallback.model);
+    return {
+        name,
+        kind: 'api',
+        transport: 'api',
+        enabled: true,
+        enabledSource,
+        mode,
+        modelTier,
+        baseUrl: OPENROUTER_BASE_URL,
+        model,
+        apiKeyEnv: OPENROUTER_API_KEY_ENV,
+        responseFormatJsonObject: fallback.response_format_json_object ?? true,
+        via: 'openrouter',
+    };
+}
+/**
+ * `OPENROUTER_MODELS` (comma-separated OpenRouter model ids) synthesizes
+ * extra judges, operator decision 1b: `openrouter:<model>` as the provider
+ * name (deterministic, so a repeated run of the same env names the same
+ * provider), `mode: shadow` unless a project/policy overlay promotes it.
+ */
+function envOpenrouterProviders() {
+    const raw = (process.env.OPENROUTER_MODELS ?? '').trim();
+    if (!raw)
+        return {};
+    const providers = {};
+    for (const model of raw
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean)) {
+        providers[`openrouter:${model}`] = {
+            kind: 'api',
+            transport: 'api',
+            enabled: 'auto',
+            mode: 'shadow',
+            model_tier: DEFAULT_MODEL_TIER,
+            base_url: OPENROUTER_BASE_URL,
+            model,
+            api_key_env: OPENROUTER_API_KEY_ENV,
+        };
+    }
+    return providers;
+}
+/** `<project-dir>/.blacksmith/crosscheck.yml` — mirrors auditStorePath()'s STORE_DIR pattern in audit.ts. */
+export function crosscheckOverlayPath(projectDir) {
+    return path.join(path.resolve(projectDir), '.blacksmith', 'crosscheck.yml');
+}
+/**
+ * The per-project overlay (config source 1, highest precedence): only a
+ * `providers:` map is legal here, merged by provider name over env and the
+ * shipped policy. Quorum rules and everything else stay repo policy, so any
+ * other top-level key is refused loudly rather than silently ignored.
+ */
+export function loadProjectProviderOverlay(projectDir) {
+    const filePath = crosscheckOverlayPath(projectDir);
+    if (!existsSync(filePath))
+        return {};
+    const doc = (parseYaml(readFileSync(filePath, 'utf8')) ?? {});
+    const extraKeys = Object.keys(doc).filter((key) => key !== 'providers');
+    if (extraKeys.length > 0) {
+        throw new CrosscheckError('crosscheck.invalid-overlay', `${filePath} may only set "providers" -- rejected ${extraKeys.map((key) => JSON.stringify(key)).join(', ')}. Quorum rules and every other crosscheck.yml knob stay repo policy; only which providers run is a per-project decision.`, { file: filePath, keys: extraKeys });
+    }
+    return doc.providers ?? {};
+}
 /**
  * The isolation pair list, rebuilt entry by entry for quorumPairs()' reason:
  * a half-readable list is the same hole as no list. An empty list stays legal
@@ -359,9 +466,27 @@ export function parseCrosscheckPolicy(yamlText, options = {}) {
     if (!doc.providers || Object.keys(doc.providers).length === 0) {
         throw new CrosscheckError('crosscheck.invalid-policy', 'crosscheck.yml has no providers.');
     }
+    const declaredProviders = doc.providers;
+    const envProviders = envOpenrouterProviders();
+    const overlay = options.providerOverlay ?? {};
+    const names = new Set([
+        ...Object.keys(declaredProviders),
+        ...Object.keys(envProviders),
+        ...Object.keys(overlay),
+    ]);
     const providers = {};
-    for (const [name, raw] of Object.entries(doc.providers)) {
-        const config = parseProvider(name, raw ?? {});
+    for (const name of names) {
+        const fromPolicy = declaredProviders[name];
+        const fromEnv = envProviders[name];
+        const fromOverlay = overlay[name];
+        const merged = {
+            ...(fromPolicy ?? {}),
+            ...(fromEnv ?? {}),
+            ...(fromOverlay ?? {}),
+        };
+        const configSource = fromOverlay ? 'project' : fromEnv ? 'env' : 'policy';
+        const parsed = parseProvider(name, merged);
+        const config = parsed.kind === 'native' ? parsed : { ...parsed, configSource };
         providers[name] =
             options.offline && config.kind !== 'native'
                 ? // The switch is the decider now, and says so: a reader that saw
@@ -391,8 +516,9 @@ export function parseCrosscheckPolicy(yamlText, options = {}) {
     };
 }
 /**
- * Reads the policy, honouring `SMITH_CROSSCHECK_OFFLINE`: set it to anything
- * non-empty and no external provider can be invoked, whatever the file says.
+ * Reads the policy, honouring `BS_CROSSCHECK_OFFLINE` (or its legacy
+ * `SMITH_CROSSCHECK_OFFLINE` fallback): set it to anything non-empty and no
+ * external provider can be invoked, whatever the file says.
  *
  * The switch is read here rather than passed down from each call site because
  * the property it protects is process-wide — "this process makes no judge
@@ -401,7 +527,9 @@ export function parseCrosscheckPolicy(yamlText, options = {}) {
  * built binary as a subprocess; nothing else would reach them.
  */
 export function loadCrosscheckPolicy(filePath = CROSSCHECK_POLICY_PATH, options = {}) {
+    const { projectDir, ...rest } = options;
     return parseCrosscheckPolicy(readFileSync(filePath, 'utf8'), {
-        offline: options.offline ?? Boolean(process.env.SMITH_CROSSCHECK_OFFLINE),
+        offline: rest.offline ?? Boolean(readEnv(process.env, 'SMITH_CROSSCHECK_OFFLINE')),
+        providerOverlay: projectDir ? loadProjectProviderOverlay(projectDir) : rest.providerOverlay,
     });
 }

package/factory/orchestrator/dist/daemon.js

@@ -12,7 +12,7 @@
 // already owns — budgetAlarm.ts for spend, agents-registry.ts for stalls,
 // scheduler.ts for work that is due. Nothing here re-derives them, so the
 // daemon and `smith status` can never disagree.
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { DEFAULT_STALE_HOURS, detectStale, foldAgents, } from './agents-registry.js';
 import { admitProposals, } from './autonomy.js';
@@ -20,6 +20,7 @@ import { checkBudgetAlarm } from './budgetAlarm.js';
 import { loadBudgetPolicy } from './budgets.js';
 import { loadCrosscheckPolicy } from './crosscheck.js';
 import { apply, foldTasks, rebuild } from './db/projector.js';
+import { epicBudgetPolicies } from './epicBudget.js';
 import { summariseEpicWidth, UNMEASURED_HINT } from './epicWidth.js';
 import { SmithError } from './errors.js';
 import { listSessionIds, mergeSessionLogs, parseEventId } from './events.js';
@@ -88,7 +89,12 @@ function originSessionId(eventId) {
  */
 export function inspectSession(sessionId, events, opts = {}) {
     const now = opts.now ?? new Date();
+    // An injected policy judges every epic; otherwise each epic is judged
+    // against budgets.yml sized for its own plan's effort tier.
     const budgetPolicy = opts.budgetPolicy ?? loadBudgetPolicy();
+    const policyForEpic = opts.budgetPolicy === undefined
+        ? epicBudgetPolicies(opts.planOpts === undefined ? {} : { planOpts: opts.planOpts })
+        : undefined;
     const schedulerPolicy = opts.schedulerPolicy ?? loadSchedulerPolicy();
     const staleHours = opts.staleHours ?? DEFAULT_STALE_HOURS;
     const findings = [];
@@ -104,7 +110,10 @@ export function inspectSession(sessionId, events, opts = {}) {
         if (typeof epicId === 'string')
             closedEpics.add(epicId);
     }
-    const budget = checkBudgetAlarm(events, budgetPolicy, { sessionId });
+    const budget = checkBudgetAlarm(events, budgetPolicy, {
+        sessionId,
+        ...(policyForEpic ? { policyForEpic } : {}),
+    });
     for (const epic of budget.epics) {
         // `under` is the only status that is an answer rather than a question.
         if (epic.status === 'under')
@@ -178,8 +187,8 @@ export function inspectSession(sessionId, events, opts = {}) {
             subject: proposal.taskId,
             detail: `${proposal.proposedBy} proposes amending ${proposal.criterionRef}: ${proposal.assumption} ` +
                 `(${proposal.severity}, ${proposal.blocking ? 'blocking' : 'non-blocking'}, ` +
-                `${proposal.sites.length} site(s)). Answer it with \`smith plan approve ` +
-                `${proposal.proposalId}\` or \`smith plan reject ${proposal.proposalId}\`.`,
+                `${proposal.sites.length} site(s)). Answer it with \`bs plan approve ` +
+                `${proposal.proposalId}\` or \`bs plan reject ${proposal.proposalId}\`.`,
         });
     }
     const proposals = computeProposals({
@@ -234,8 +243,8 @@ export function inspectSession(sessionId, events, opts = {}) {
                 detail: `Error ${proposal.fingerprint} in ${projectPhrase} ` +
                     `(${proposal.errorClass}, task ${proposal.taskRef}, ${proposal.occurrences} occurrence(s)) ` +
                     'has no issue-reported event. Report it with ' +
-                    `\`smith issues report --session ${proposal.sessionId}\`; ` +
-                    `\`smith issues preview --session ${proposal.sessionId}\` is the dry run.`,
+                    `\`bs issues report --session ${proposal.sessionId}\`; ` +
+                    `\`bs issues preview --session ${proposal.sessionId}\` is the dry run.`,
                 ...(admission === undefined ? {} : { admission }),
             });
         }
@@ -332,8 +341,8 @@ export function inspectFactory(events, opts = {}) {
                 detail: `The last epic this factory closed ran narrow: its widest wave was admitted for ` +
                     `${newest.widest.declared} tasks and ${newest.widest.observed} ran ` +
                     `(closed ${newest.closedAt}, ${width.serialized.length} of ${width.epics.length} ` +
-                    'closes read here are narrow). `smith epic width` reads every close back; ' +
-                    '`smith wave audit --session <id>` reads the waves behind a live one.',
+                    'closes read here are narrow). `bs epic width` reads every close back; ' +
+                    '`bs wave audit --session <id>` reads the waves behind a live one.',
             });
         }
         else if (width.hint === UNMEASURED_HINT) {
@@ -371,8 +380,8 @@ export function inspectFactory(events, opts = {}) {
             subject: ref.dir,
             detail: `${ref.self ? 'This clone' : `\`${ref.name}\`, built by this factory`} is not in ` +
                 'this pass, so nothing is reading its lockfile and no maintenance ' +
-                `proposal can ever name it. Add \`--project ${ref.dir}\` to \`smith daemon ` +
-                'run|start` (and to `smith scheduler run|admit`). `smith projects list` ' +
+                `proposal can ever name it. Add \`--project ${ref.dir}\` to \`bs daemon ` +
+                'run|start` (and to `bs scheduler run|admit`). `bs projects list` ' +
                 'prints the whole flag line.',
         });
     }
@@ -533,6 +542,7 @@ export async function runTick(opts = {}) {
         now,
         admission,
         ...(opts.budgetPolicy === undefined ? {} : { budgetPolicy: opts.budgetPolicy }),
+        ...(opts.planOpts === undefined ? {} : { planOpts: opts.planOpts }),
         ...(opts.schedulerPolicy === undefined ? {} : { schedulerPolicy: opts.schedulerPolicy }),
         ...(opts.staleHours === undefined ? {} : { staleHours: opts.staleHours }),
         ...(opts.projectDirs === undefined ? {} : { projectDirs: opts.projectDirs }),
@@ -557,7 +567,7 @@ export async function runTick(opts = {}) {
         sessionId,
         subject: dbPath,
         detail: `The read-model refresh failed: ${errorMessage(err)}. The event log is unaffected — ` +
-            'it is the UI and `smith status` that are now stale.',
+            'it is the UI and `bs status` that are now stale.',
     });
     for (const [root, group] of leavesByRoot) {
         // Sorted, so a forked tree attributes its shared findings to the same
@@ -640,6 +650,21 @@ export async function runTick(opts = {}) {
     // nothing still has repos to tend.
     const all = [...logs.entries()].map(([sessionId, events]) => ({ sessionId, events }));
     findings.push(...inspectFactory(mergeSessionLogs(all), inspectOpts));
+    // The loop's own memory file failed to read this tick (see `TickOptions`).
+    // Filed as a finding, not swallowed: an operator watching the report is the
+    // one person who can tell whether "everything reads as new" is real churn
+    // or this.
+    if (opts.memoryUnreadable !== undefined) {
+        findings.push({
+            kind: 'unreadable-state',
+            severity: 'attention',
+            sessionId: null,
+            subject: opts.memoryUnreadable.path,
+            detail: `${opts.memoryUnreadable.path} exists but cannot be read ` +
+                `(${opts.memoryUnreadable.reason}): memory was read as empty, so every ` +
+                'standing finding is dated as new this tick.',
+        });
+    }
     const aged = ageFindings(opts.memory ?? {}, findings, now);
     return {
         at: now.toISOString(),
@@ -658,21 +683,66 @@ export function lockPath(dir) {
 export function statusPath(dir) {
     return path.join(dir, STATUS_FILE);
 }
-function readJsonFile(filePath) {
-    if (!existsSync(filePath))
-        return null;
+/**
+ * Recoverable failure to read a daemon state file — a corrupt `daemon.pid`,
+ * `status.json` or `findings.json`. Always names the file and the reason, and
+ * always the same recovery: nothing here suggests `smith daemon stop`, which
+ * reads the same file and refuses it the same way.
+ */
+function unreadableState(filePath, reason) {
+    return new DaemonError('daemon.unreadable-state', `${filePath} exists but cannot be read (${reason}), so it is not treated as ` +
+        'absent. Confirm no `bs daemon run` process is using this directory, ' +
+        'then delete the file.', { path: filePath, reason });
+}
+function isRecordShape(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isLockShape(value) {
+    return isRecordShape(value) && typeof value.pid === 'number';
+}
+/**
+ * Read and parse one state file, or null when there was none.
+ *
+ * ABSENT and UNREADABLE are two different outcomes, not one. ABSENT is
+ * `readFileSync` throwing ENOENT — the ordinary "no daemon has run here yet"
+ * case, answered with null. Everything else — a permission error, a
+ * `JSON.parse` failure, or a parsed value the wrong shape for `T` — is
+ * UNREADABLE: the file exists, so silently treating it as absent would let a
+ * corrupt lock be taken over, a corrupt `status.json` read as "not running",
+ * or a corrupt memory read as empty, none of which is true. Reading the file
+ * directly and catching ENOENT (rather than `existsSync` then `readFileSync`)
+ * also closes the gap where the file could vanish between the two calls.
+ */
+function readJsonFile(filePath, isValidShape) {
+    let raw;
     try {
-        return JSON.parse(readFileSync(filePath, 'utf8'));
+        raw = readFileSync(filePath, 'utf8');
     }
-    catch {
-        return null;
+    catch (err) {
+        const code = err.code;
+        if (code === 'ENOENT')
+            return null;
+        throw unreadableState(filePath, code ?? errorMessage(err));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
     }
+    catch (err) {
+        throw unreadableState(filePath, errorMessage(err));
+    }
+    if (!isValidShape(parsed))
+        throw unreadableState(filePath, 'unexpected shape');
+    return parsed;
 }
+/**
+ * Null when there is no lock to read. Throws `daemon.unreadable-state` when
+ * the file exists but cannot be parsed, or parses to something without a
+ * numeric `pid` — a half-written file from a crash mid-write looks exactly
+ * like this, and it must not be mistaken for "nobody is running".
+ */
 export function readLock(dir) {
-    const lock = readJsonFile(lockPath(dir));
-    if (lock === null || typeof lock.pid !== 'number')
-        return null;
-    return lock;
+    return readJsonFile(lockPath(dir), isLockShape);
 }
 /** `kill(pid, 0)` — EPERM means a process exists that this user may not signal. */
 export function processIsAlive(pid) {
@@ -686,14 +756,20 @@ export function processIsAlive(pid) {
 }
 /**
  * Claim `dir` for `lock.pid`, returning the lock this one displaced (null when
- * there was nothing to displace, or nothing readable).
+ * there was nothing to displace).
  *
  * Two daemons ticking the same state dir would double every projection write
  * and every finding, so a live incumbent is refused. A DEAD incumbent is not:
  * a crashed daemon leaves its pid file behind, and refusing to start until a
- * human runs `rm` would make the first crash permanent. Likewise an
- * unparseable file — half a JSON document is what a crash mid-write looks
- * like, and it is evidence of a dead writer, not a live one.
+ * human runs `rm` would make the first crash permanent.
+ *
+ * An UNREADABLE incumbent is refused rather than taken over: an unparseable
+ * file could be a crash mid-write, but it could also be a live daemon's lock
+ * a filesystem fault damaged out from under it, and the two are not
+ * distinguishable from the bytes alone. `readLock` throws
+ * `daemon.unreadable-state` in that case, and this function does not catch
+ * it — the throw happens before anything is written, so the file's bytes are
+ * left exactly as found.
  */
 export function acquireLock(dir, lock, opts = {}) {
     const isAlive = opts.isAlive ?? processIsAlive;
@@ -711,14 +787,28 @@ export function acquireLock(dir, lock, opts = {}) {
     const incumbent = readLock(dir);
     if (incumbent !== null && isAlive(incumbent.pid)) {
         throw new DaemonError('daemon.already-running', `A daemon (pid ${incumbent.pid}, started ${incumbent.startedAt}) already holds ${file}. ` +
-            'Stop it with `smith daemon stop` before starting another.', { pid: incumbent.pid, lock_path: file });
+            'Stop it with `bs daemon stop` before starting another.', { pid: incumbent.pid, lock_path: file });
     }
     writeFileSync(file, body, 'utf8');
     return incumbent;
 }
-/** True when this call removed the lock; false when it belongs to someone else. */
+/**
+ * True when this call removed the lock; false when it belongs to someone
+ * else, or cannot be read at all.
+ *
+ * Never throws, unlike every other reader of this file: it runs from
+ * `runDaemon`'s `finally`, where a throw would replace the loop's own
+ * outcome — a tick that failed would be reported instead as "could not
+ * release the lock", losing the failure that actually mattered.
+ */
 export function releaseLock(dir, pid) {
-    const lock = readLock(dir);
+    let lock;
+    try {
+        lock = readLock(dir);
+    }
+    catch {
+        return false;
+    }
     if (lock === null || lock.pid !== pid)
         return false;
     rmSync(lockPath(dir), { force: true });
@@ -735,8 +825,9 @@ export function writeStatus(dir, report) {
     writeFileSync(tmp, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
     renameSync(tmp, target);
 }
+/** Throws `daemon.unreadable-state` when the file exists but cannot be parsed. */
 export function readStatus(dir) {
-    return readJsonFile(statusPath(dir));
+    return readJsonFile(statusPath(dir), isRecordShape);
 }
 // ---------------------------------------------------------------------------
 // The finding memory
@@ -748,15 +839,18 @@ export function memoryPath(dir) {
  * The only state this daemon carries across ticks, and deliberately the least
  * it could carry: identity -> when it was first seen.
  *
- * Missing or corrupt reads as empty rather than throwing, for the same reason
- * `unreadable-log` is a finding and not a crash. A watchdog that dies over its
- * own scratch file is silent exactly when something is wrong, and the cost of
- * losing this one is a single tick that calls every standing finding new.
+ * Absent reads as empty — the ordinary first-tick case. Corrupt throws
+ * `daemon.unreadable-state`: `runDaemon`'s `tickWithMemory` is the one caller
+ * that catches it, and turns it into a finding of its own (`TickOptions`'s
+ * `memoryUnreadable`) rather than swallowing it, because a watchdog that
+ * dies over its own scratch file is silent exactly when something is wrong,
+ * but one that quietly reads it as empty hides the same fact from the report
+ * meant to surface it.
  */
 export function readFindingMemory(dir) {
-    return readJsonFile(memoryPath(dir)) ?? {};
+    return readJsonFile(memoryPath(dir), isRecordShape) ?? {};
 }
-/** tmp-then-rename, like the status file: a half-written memory reads as none. */
+/** tmp-then-rename, like the status file: a crash mid-write leaves the old file whole. */
 export function writeFindingMemory(dir, memory) {
     mkdirSync(dir, { recursive: true });
     const target = memoryPath(dir);
@@ -852,6 +946,7 @@ export async function runDaemon(opts) {
     const tickOptions = {
         ...(opts.now === undefined ? {} : { now: opts.now }),
         ...(opts.budgetPolicy === undefined ? {} : { budgetPolicy: opts.budgetPolicy }),
+        ...(opts.planOpts === undefined ? {} : { planOpts: opts.planOpts }),
         ...(opts.schedulerPolicy === undefined ? {} : { schedulerPolicy: opts.schedulerPolicy }),
         ...(opts.staleHours === undefined ? {} : { staleHours: opts.staleHours }),
         ...(opts.projectDirs === undefined ? {} : { projectDirs: opts.projectDirs }),
@@ -866,8 +961,31 @@ export async function runDaemon(opts) {
     // Read from disk rather than held in a variable, so a daemon restarted by
     // cron or by the operator picks up where the last process stopped. A tick
     // knows nothing about the interval it runs on; this is what joins two.
+    //
+    // `readFindingMemory` throws `daemon.unreadable-state` for a corrupt file
+    // (never for an absent one). That is the ONE failure this catches: the
+    // tick still runs, with an empty memory and `memoryUnreadable` set so the
+    // loss shows up as a finding in the very report it affected, rather than
+    // failing the loop over its own scratch file (D-21).
     const tickWithMemory = async () => {
-        const report = await tick({ ...tickOptions, memory: readFindingMemory(opts.dir) });
+        let memory = {};
+        let memoryUnreadable;
+        try {
+            memory = readFindingMemory(opts.dir);
+        }
+        catch (err) {
+            if (!(err instanceof DaemonError) || err.code !== 'daemon.unreadable-state')
+                throw err;
+            memoryUnreadable = {
+                path: String(err.details.path),
+                reason: String(err.details.reason),
+            };
+        }
+        const report = await tick({
+            ...tickOptions,
+            memory,
+            ...(memoryUnreadable === undefined ? {} : { memoryUnreadable }),
+        });
         writeStatus(opts.dir, report);
         writeFindingMemory(opts.dir, memoryOf(report.findings));
         return report;