@juzser/blacksmith 0.4.0 → 0.5.0

package/README.md

@@ -125,7 +125,7 @@ provider.
 **The log is the source of truth**
 
 Every prompt, dispatch, gate result and error is an append-only event on disk.
-The dashboard is a projection of that log, and `smith db rebuild` reconstructs
+The dashboard is a projection of that log, and `bs db rebuild` reconstructs
 the entire database from the log alone. Nothing the factory did exists only in
 a chat transcript.
 
@@ -168,18 +168,27 @@ and two inside Claude Code:
 /plugin install blacksmith@blacksmith
 ```
 
-Then `smith init` in the project you want it to work on. That creates
+Two optional plugin modules come from the same marketplace, bs-mod (a live
+HUD of your epic above the prompt) and pr-mod (the repo's open pull requests),
+and [`docs/guide/mods.md`](docs/guide/mods.md) has what each needs:
+
+```
+/plugin install bs-mod@blacksmith
+/plugin install pr-mod@blacksmith
+```
+
+Then `bs init` in the project you want it to work on. That creates
 `.blacksmith/` beside your code — the event log, your epic plans, a roadmap and
-a `stack.yml` to answer — and writes nothing anywhere else; `SMITH_HOME` moves
+a `stack.yml` to answer — and writes nothing anywhere else; `BS_HOME` moves
 that root if you want one home for several projects. You now have `/bs`.
 
 **Both halves are required.** The package
 ([`@juzser/blacksmith`](https://www.npmjs.com/package/@juzser/blacksmith)) is the
-deterministic `smith` CLI; the plugin is `/bs` and the fourteen agent roles it
-dispatches. `smith` alone never gives you `/bs`, because Claude Code loads
+deterministic `bs` CLI; the plugin is `/bs` and the fourteen agent roles it
+dispatches. `bs` alone never gives you `/bs`, because Claude Code loads
 skills from a project's `.claude/`, your `~/.claude/`, or a plugin — never from
-`node_modules` — and a `/bs` with no `smith` on PATH can run nothing. Take
-`latest`: `0.1.0` predates `smith init` and keeps state inside its own install
+`node_modules` — and a `/bs` with no `bs` on PATH can run nothing. Take
+`latest`: `0.1.0` predates `bs init` and keeps state inside its own install
 directory, which the next `npm i` replaces.
 
 <details>
@@ -197,17 +206,21 @@ bash scripts/check.sh                   # the gate CI runs; ends in `== PASS ==`
 
 Open a Claude Code session in the clone and you have `/bs` already, from the
 checkout's own `.claude/` — **do not also install the plugin there.** You would
-get two of everything (`bs` and `blacksmith:bs`, `auditor` and
-`blacksmith:auditor`, once per role), pay the always-on cost twice, and the two
+get two of everything (`bs` and `blacksmith:bs`, `bs-auditor` and
+`blacksmith:bs-auditor`, once per role), pay the always-on cost twice, and the two
 copies are free to disagree: the plugin's is a pinned checkout of `main`, the
 project's is whatever branch you have out. `claude plugin disable blacksmith`
-settles it.
+settles it. It also turns off the prompt recorder in that clone, which only
+the plugin registers; a clone that wants its prompts recorded keeps the plugin
+enabled and accepts the double listing
+([INSTALL.md](INSTALL.md#the-install--bs-and-bs)).
 
 The dashboard is clone-only because `ui/` is in neither the tarball nor the
-plugin, so `smith ui serve` answers `ui.not-built` in an install and means it.
+plugin, so `bs ui serve` answers `ui.not-built` in an install and means it.
 Enforcement is clone-only because this repo's `.claude/settings.json` deny
-rules and its policy hook resolve paths against a checkout; the plugin ships no
-`hooks/hooks.json` and loads neither (`Hooks (0)`), since a `/bs` that asked
+rules and its policy hook resolve paths against a checkout; the plugin ships one
+`hooks/hooks.json`, holding only the non-blocking prompt-capture hook, and
+loads neither the deny rules nor the policy guard, since a `/bs` that asked
 you about every Bash command would be worse than one that asks about none. The
 rest of that port is scoped in
 [`docs/specs/plugin-port-scope.md`](docs/specs/plugin-port-scope.md).
@@ -233,9 +246,9 @@ would rather drive it yourself, it is three commands:
 ```bash
 $EDITOR factory/policies/stack.yml   # your stack answers: language, frontend,
                                      # database, deploy target. `none` is fine.
-smith stack check                    # which answers the templates honour,
+bs stack check                       # which answers the templates honour,
                                      # which they only record, which they refuse
-smith new my-app --target-dir ~/code/my-app     # add --ui for a frontend
+bs new my-app --target-dir ~/code/my-app        # add --ui for a frontend
 ```
 
 The last call scaffolds (TS strict, Biome, Vitest, CI), installs, runs the
@@ -278,7 +291,7 @@ it is the ordinary loop: `/bs plan` against that epic, then `/bs run`, and
 closing the epic marks its findings fixed. There is no audit-specific run
 path; the command's value is the insight and the ranking.
 
-Underneath it is the `smith audit` family — `open`, `record`, `consolidate`,
+Underneath it is the `bs audit` family — `open`, `record`, `consolidate`,
 `decide`, `cut`, `resolve`, `close` — and
 [`docs/specs/audit-command-scope.md`](docs/specs/audit-command-scope.md) is the
 contract each of them keeps.
@@ -300,10 +313,10 @@ Day to day, from a Claude Code session opened in this repo:
 | `/bs lessons` | Review pending lesson candidates |
 | `/bs report` | Render the scribe's progress digest |
 
-Each of those is a playbook, not a script: the deterministic half is a `smith`
-command you can run yourself — `smith --help` lists all of them — and the
+Each of those is a playbook, not a script: the deterministic half is a `bs`
+command you can run yourself — `bs --help` lists all of them — and the
 judgment half is a Claude Code session the playbook dispatches. That is also
-the line between the two installs: the `smith` half travels in the package, the
+the line between the two installs: the `bs` half travels in the package, the
 playbooks are read from a clone.
 
 → **[The operator loop](docs/guide/operator-loop.md)** — the six steps, in the
@@ -319,7 +332,7 @@ v1. From there the loop admits a wave whose path claims do not overlap, sends
 researcher and UI/UX work ahead of code where the epic needs it, runs a coder
 and a tester in a worktree, grades the result against its own acceptance
 criteria, then puts it through the gates and a serial merge queue into
-`smith/<epic>/integration`. One epic, one integration PR, merged by you.
+`bs/<epic>/integration`. One epic, one integration PR, merged by you.
 
 → The pipeline diagram and the reasoning behind each stage:
 **[architecture §3 — The loop](docs/specs/black-smith-architecture.md#3-the-loop)**.
@@ -339,8 +352,10 @@ runs, plus branch protection — not by trust. Full rules:
   branch solely through the serial merge queue.
 - **No autonomous deploy or outbound sends.** Deploys, publishes and message
   sends each need per-invocation approval.
-- **Budgets are declared per role.** 4M tokens per epic with an alarm at 70%;
-  150K tokens and 400 diff lines per coder task. Fan-out is bounded by the
+- **Budgets are declared per role and sized per effort tier.** A medium epic
+  gets 16M tokens with an alarm at 70%, and a coder task 220K tokens and 700
+  diff lines; a small epic gets half the task numbers and 4M, a huge one
+  double and 32M. Fan-out is bounded by the
   claim graph, and `max_in_flight_tasks` is available on top of it, off by
   default. Which of these *block* versus *report* is spelled out in
   [`factory/policies/budgets.yml`](factory/policies/budgets.yml) — the task cap
@@ -351,11 +366,14 @@ a public issue.
 
 ## The dashboard
 
-Optional, and deliberately small: `/bs ui` (or `smith ui serve`) binds eleven
-read-only pages to `127.0.0.1`. They are a projection of the event log and
-nothing else — `smith db rebuild` reconstructs them from it, `smith stats`
-prints the same facts in a terminal, and nothing you click there dispatches an
-agent. The factory runs without ever opening it.
+Optional, and deliberately small: `/bs ui` (or `bs ui serve`) binds eleven
+read-only pages to `127.0.0.1`. They are a projection of the event log —
+`bs db rebuild` reconstructs them from it, `bs stats` prints the same facts in
+a terminal, and nothing you click there dispatches an agent. It also reads
+the local Claude Code session registry, transcripts and prompt history (read-only;
+`--claude-config-dir`, then `$CLAUDE_CONFIG_DIR`, then Claude Code's default),
+served as `GET /api/cli-sessions` to loopback requests only. The factory runs
+without ever opening the dashboard.
 
 <table>
 <tr valign="top">
@@ -386,14 +404,16 @@ shows you. It is part of the clone, not of the package.
 
 Phases 1–9 are built and merged: loop runner, worktree engine, gates, state and
 analytics, dashboard, self-extension, cross-provider judges, hardening. Phase 10
-is half in: `smith daemon` watches the factory in the background and its ops
+is half in: `bs daemon` watches the factory in the background and its ops
 runbook is written; the hosted UI stays deferred. Beside the phases, `/bs audit`
 is built: an existing project can be read on four axes and one epic cut from
 what you accept.
 
-The CLI is on npm as `@juzser/blacksmith`, at `0.4.0` — two binaries,
-`smith` and `smith-run`, the second (since `0.2.0`) being what runs a
-rendered turn on a `cli` harness such as Codex. `0.1.1` was the first version that ran beside
+The CLI is on npm as `@juzser/blacksmith`, at `0.5.0`. Two binaries are
+the ones you run: `bs`, and `bs-run` (since `0.2.0`), which runs a rendered
+turn on a `cli` harness such as Codex. `bs-prompt-hook` is the lean hook
+entry that records operator prompts. `smith` and `smith-run` remain as
+deprecated aliases. `0.1.1` was the first version that ran beside
 you and knew it was a package, rather than out of the clone-shaped install
 `0.1.0` was. The package is the binaries and what they
 read. The dashboard, the docs, the test suite and `/bs` itself come from a
@@ -423,8 +443,9 @@ version in
 | [`docs/specs/audit-command-scope.md`](docs/specs/audit-command-scope.md) | What `/bs audit` promises an audited project, and why |
 | [`docs/specs/plugin-port-scope.md`](docs/specs/plugin-port-scope.md) | How `/bs` runs without a clone, and what the plugin leaves behind |
 | [`docs/guide/dashboard.md`](docs/guide/dashboard.md) | The dashboard tour |
+| [`docs/guide/mods.md`](docs/guide/mods.md) | The optional bs-mod HUD and pr-mod |
 | [`docs/runbooks/providers.md`](docs/runbooks/providers.md) | Setting up the cross-provider judges |
-| [`docs/runbooks/ops.md`](docs/runbooks/ops.md) | Running `smith daemon` unattended |
+| [`docs/runbooks/ops.md`](docs/runbooks/ops.md) | Running `bs daemon` unattended |
 | [`docs/README.md`](docs/README.md) | Everything else, one line each |
 
 Agents read [`AGENTS.md`](AGENTS.md) and [`CLAUDE.md`](CLAUDE.md) instead — this

package/factory/orchestrator/dist/agentNames.js

@@ -0,0 +1,43 @@
+/**
+ * The one place a role becomes a Claude Code subagent name, a template file
+ * name, and back. The role (`coder`) is data everywhere else: events,
+ * policies, ledgers, env names. Only the subagent carries the `bs-` prefix,
+ * so that it cannot collide with another plugin's or a user's `coder`.
+ */
+export const AGENT_PREFIX = 'bs-';
+/** `coder` -> `bs-coder`: what `subagent_type` and a template's `name:` carry. */
+export function agentNameFor(role) {
+    return `${AGENT_PREFIX}${role}`;
+}
+/** `coder` -> `bs-coder.md`: the template file under `.claude/agents/`. */
+export function templateFileFor(role) {
+    return `${agentNameFor(role)}.md`;
+}
+/** `bs-coder.md` -> `coder`; null for a file that is not a `bs-<role>.md` template. */
+export function roleOfTemplateFile(file) {
+    if (!file.endsWith('.md'))
+        return null;
+    return roleOfAgentType(file.slice(0, -'.md'.length), { bareAccepted: false });
+}
+/**
+ * What Claude Code puts in a hook's `agent_type` or a dispatch's
+ * `subagent_type` -> the role. Strips an optional `<namespace>:` and then the
+ * `bs-` prefix. For one transition the bare pre-prefix name (`reviewer`,
+ * `blacksmith:reviewer`) is accepted too, because a newer CLI can run with an
+ * older plugin still installed. Returns a *candidate* role, not a verified one:
+ * any other non-empty name (`general-purpose`) comes back as itself, so the
+ * caller must check the result against its own role set. Null only for an
+ * empty name, a bare `bs-` or `<ns>:`, or (with `bareAccepted: false`) a name
+ * without the prefix.
+ */
+export function roleOfAgentType(agentType, options = {}) {
+    const colon = agentType.lastIndexOf(':');
+    const name = colon === -1 ? agentType : agentType.slice(colon + 1);
+    if (name.startsWith(AGENT_PREFIX)) {
+        const role = name.slice(AGENT_PREFIX.length);
+        return role.length > 0 ? role : null;
+    }
+    if (options.bareAccepted === false)
+        return null;
+    return name.length > 0 ? name : null;
+}

package/factory/orchestrator/dist/agents-registry.js

@@ -289,15 +289,22 @@ export function foldAgents(events) {
         if (record.event_type === ERROR_EVENT_TYPE) {
             const payload = record.payload;
             // `task_ref` is this event's own spelling; eventTaskId covers the two
-            // the rest of the log uses (D-245).
+            // the rest of the log uses (D-245). `agent_role` is the dispatch's own
+            // key and this event's usual spelling, but a hand-written one may only
+            // carry `agent` (the Result file's spelling), so either key alone still
+            // finds the role -- `agent_role` tried first because it was already
+            // this fold's only key before `agent` was added as a fallback, same
+            // reason task-result-recorded above tries `agent` first for its own
+            // history; not the same order, because each fold keeps its own.
             const taskId = eventTaskId(record) ?? payload.task_ref;
+            const role = payload.agent_role ?? payload.agent ?? null;
             if (taskId) {
-                closeOpen(open, taskId, payload.agent_role ?? null, event_id, record.ts, 'error');
+                closeOpen(open, taskId, role, event_id, record.ts, 'error');
             }
-            else if (payload.agent_role) {
+            else if (role) {
                 // Only with a role: a session-level error names nobody, and every
                 // epic-level agent stays where it was.
-                closeOpenEpicLevel(openEpicLevel, record.session_id, payload.agent_role, payload.epic_id, event_id, record.ts, 'error');
+                closeOpenEpicLevel(openEpicLevel, record.session_id, role, payload.epic_id, event_id, record.ts, 'error');
             }
             continue;
         }

package/factory/orchestrator/dist/agentsSync.js

@@ -9,24 +9,44 @@
  * that box's business, and `--reset` restores what git HEAD says.
  *
  * SMITH_MAXTURNS_<ROLE> names the role upper-cased with `-` as `_`
- * (spec-reviewer → SMITH_MAXTURNS_SPEC_REVIEWER).
+ * (spec-reviewer → SMITH_MAXTURNS_SPEC_REVIEWER). BS_MAXTURNS_<ROLE> is the
+ * current spelling of the same variable (bs-rename, operator decision 3);
+ * SMITH_MAXTURNS_<ROLE> still works as a fallback, and BS_ wins when both are
+ * set for the same role.
  */
 import { readdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
+import { roleOfTemplateFile, templateFileFor } from './agentNames.js';
 import { SmithError } from './errors.js';
 import { GitCommandError, runGit, runGitRaw } from './git.js';
 import { AGENTS_DIR } from './paths.js';
 export class AgentsSyncError extends SmithError {
 }
 export const MAXTURNS_ENV_PREFIX = 'SMITH_MAXTURNS_';
+const BS_MAXTURNS_ENV_PREFIX = 'BS_MAXTURNS_';
 export function maxTurnsEnvName(role) {
     return `${MAXTURNS_ENV_PREFIX}${role.toUpperCase().replaceAll('-', '_')}`;
 }
+/**
+ * Recognises a `SMITH_MAXTURNS_<ROLE>` or `BS_MAXTURNS_<ROLE>` env name, and
+ * maps either spelling to the legacy-style name `byEnv` (below) is keyed by.
+ */
+function parseMaxTurnsEnvName(name) {
+    if (name.startsWith(BS_MAXTURNS_ENV_PREFIX)) {
+        return {
+            legacyName: `${MAXTURNS_ENV_PREFIX}${name.slice(BS_MAXTURNS_ENV_PREFIX.length)}`,
+            isBs: true,
+        };
+    }
+    if (name.startsWith(MAXTURNS_ENV_PREFIX))
+        return { legacyName: name, isBs: false };
+    return null;
+}
 const MAX_TURNS_LINE = /^maxTurns:[ \t]*(\S*)[ \t]*$/m;
 function listRoles(agentsDir) {
     return readdirSync(agentsDir)
-        .filter((name) => name.endsWith('.md'))
-        .map((name) => name.slice(0, -'.md'.length))
+        .map((name) => roleOfTemplateFile(name))
+        .filter((role) => role !== null)
         .sort();
 }
 /** The frontmatter block's bounds: the text between the leading `---` lines. */
@@ -62,7 +82,7 @@ function withMaxTurns(text, site, value) {
  * caller like dispatchLint.ts, not a hard failure.
  */
 export function readTemplateMaxTurns(agentsDir, role) {
-    const file = path.join(agentsDir, `${role}.md`);
+    const file = path.join(agentsDir, templateFileFor(role));
     let text;
     try {
         text = readFileSync(file, 'utf8');
@@ -93,9 +113,10 @@ function apply(edits, dryRun) {
     return edits.map((edit) => edit.change);
 }
 /**
- * Rewrite `maxTurns:` for every role whose SMITH_MAXTURNS_<ROLE> is set
- * (non-empty). Every name and value is checked, and every target file read,
- * before anything is written: one bad entry refuses the whole sync.
+ * Rewrite `maxTurns:` for every role whose BS_MAXTURNS_<ROLE> (or its legacy
+ * SMITH_MAXTURNS_<ROLE> fallback) is set (non-empty). Every name and value is
+ * checked, and every target file read, before anything is written: one bad
+ * entry refuses the whole sync.
  */
 export function syncAgentMaxTurns(options = {}) {
     const agentsDir = options.agentsDir ?? AGENTS_DIR;
@@ -103,22 +124,35 @@ export function syncAgentMaxTurns(options = {}) {
     const dryRun = options.dryRun ?? false;
     const roles = listRoles(agentsDir);
     const byEnv = new Map(roles.map((role) => [maxTurnsEnvName(role), role]));
-    const requested = [];
+    // Keyed by the legacy-style name, so a BS_ hit and a SMITH_ hit for the
+    // same role collide here rather than both queuing an edit. BS_MAXTURNS_
+    // always sorts before SMITH_MAXTURNS_ (`B` < `S`), so a later legacy hit
+    // for a role BS_ already claimed is dropped, not overwritten.
+    const byRole = new Map();
     for (const name of Object.keys(env).sort()) {
-        if (!name.startsWith(MAXTURNS_ENV_PREFIX))
+        const parsed = parseMaxTurnsEnvName(name);
+        if (!parsed)
             continue;
         const raw = env[name];
         if (raw === undefined || raw === '')
             continue;
-        const role = byEnv.get(name);
+        const role = byEnv.get(parsed.legacyName);
         if (role === undefined) {
             throw new AgentsSyncError('agents.unknown-role', `${name} names no agent template; valid roles: ${roles.join(', ')}.`, { variable: name, roles });
         }
-        requested.push({ role, env: name, to: positiveInt(name, raw) });
+        const existing = byRole.get(parsed.legacyName);
+        if (existing?.isBs && !parsed.isBs)
+            continue;
+        byRole.set(parsed.legacyName, {
+            role,
+            env: name,
+            to: positiveInt(name, raw),
+            isBs: parsed.isBs,
+        });
     }
-    requested.sort((a, b) => a.role.localeCompare(b.role));
+    const requested = [...byRole.values()].sort((a, b) => a.role.localeCompare(b.role));
     const edits = requested.map(({ role, env: name, to }) => {
-        const file = path.join(agentsDir, `${role}.md`);
+        const file = path.join(agentsDir, templateFileFor(role));
         const text = readFileSync(file, 'utf8');
         const site = findMaxTurns(text, file);
         return {
@@ -148,7 +182,7 @@ export function resetAgentMaxTurns(options = {}) {
         throw new AgentsSyncError('agents.reset-unavailable', `--reset needs git HEAD, but ${agentsDir} is not inside a git checkout.`, { agentsDir });
     }
     const edits = roles.map((role) => {
-        const file = path.join(agentsDir, `${role}.md`);
+        const file = path.join(agentsDir, templateFileFor(role));
         const rel = path.relative(topLevel, realpathSync(file)).split(path.sep).join('/');
         let committed;
         try {

package/factory/orchestrator/dist/artifacts.js

@@ -72,6 +72,37 @@ function contains(root, child) {
     const rel = path.relative(root, child);
     return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
 }
+/**
+ * Resolve one declared artifact path to an absolute, real, on-disk location
+ * inside `<artifactsDir>/<taskId>/`, for a reader that is about to open the
+ * bytes rather than merely check the declaration — the dashboard's artifact
+ * route, not the gate. Reuses `checkArtifacts`'s containment and realpath
+ * logic so the two agree about what "inside the home" means; returns `null`
+ * for anything that logic would flag (`..`, an absolute path, a symlink that
+ * escapes, a missing file) rather than a reason, since the only caller turns
+ * every reason into the same 404.
+ */
+export function resolveArtifactPath(taskId, declaredPath, artifactsDir = STATE_ARTIFACTS_DIR) {
+    try {
+        const root = path.resolve(artifactsDir);
+        const home = homeUnder(root, taskId);
+        if (path.isAbsolute(declaredPath))
+            return null;
+        const resolved = path.resolve(home, declaredPath);
+        if (resolved === home || !contains(home, resolved))
+            return null;
+        if (!existsSync(resolved))
+            return null;
+        const realHome = realOf(home);
+        const real = realOf(resolved);
+        if (!contains(realHome, real))
+            return null;
+        return real;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Check every path a result declares as evidence. Relative paths resolve
  * against the task's home, so `coverage.txt` means the obvious thing and the

package/factory/orchestrator/dist/attribution.js

@@ -129,6 +129,9 @@ export async function routeFindings(items, options, ctx, opts = {}) {
  * Call this only once the finding has survived intake. A waived or refuted
  * finding minting a `todo` follow-up would block the epic verdict on a bug the
  * team already settled.
+ *
+ * `ctx.project`, when set, is stamped on the follow-up; without it the
+ * follow-up inherits the project the log holds for `routed.fromTaskId`.
  */
 export async function recordReattribution(routed, finding, ctx, opts = {}) {
     if (routed.attribution === 'gated')
@@ -139,6 +142,7 @@ export async function recordReattribution(routed, finding, ctx, opts = {}) {
             taskId: routed.taskId,
             objective: `Fix: ${finding.summary}`,
             claims: routed.claims,
+            fromTaskId: routed.fromTaskId,
         }, ctx, opts);
     }
     await appendEvent({

package/factory/orchestrator/dist/audit.js

@@ -34,13 +34,14 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileS
 import path from 'node:path';
 import { resolveFindingOwner } from './claims.js';
 import { SmithError } from './errors.js';
-import { appendEvent } from './events.js';
+import { appendEvent, eventTaskId, readLineageEvents, } from './events.js';
 import { computeFingerprint, normalizeFilePath } from './findings.js';
 import { runGit } from './git.js';
 import { checkWorktreeImmutable, fingerprintWorktree, } from './immutability.js';
 import { isFactoryCheckout, SPECS_ACTIVE_DIR } from './paths.js';
-import { latestPlanVersion, loadPlan, planClaimedTasks, } from './plan.js';
+import { latestPlanVersion, livePlanTasks, loadPlan, planClaimedTasks, } from './plan.js';
 import { defaultKindFor, FACTORY_PROJECT } from './roadmap.js';
+import { bareTaskId, epicOfTaskId, isQualifiedTaskId } from './taskId.js';
 import { loadTaxonomy } from './taxonomy.js';
 export class AuditError extends SmithError {
 }
@@ -50,6 +51,30 @@ export class AuditError extends SmithError {
  * overlap is meaningful.
  */
 export const AUDIT_AXES = ['performance', 'code-quality', 'architecture', 'security'];
+/**
+ * `mintAuditId` (audit.ts) mints `<YYYYMMDD>-<8 hex>` — a day stamp and eight
+ * hex characters joined by "-", never a "/". Audit.md's "Declare the artifact
+ * before the call" names the task id an audit axis turn dispatches and
+ * reports against as `<audit-id>.<axis>`. An ordinary task id is always
+ * "<epic>/<bare>" (taskId.ts) — qualified with a "/" by construction — so the
+ * two shapes cannot collide: this checks the exact mint format, not just the
+ * absence of "/", so a coincidentally dotted bare task id still reads as
+ * ordinary rather than as an axis.
+ */
+const AUDIT_AXIS_TASK_ID = new RegExp(`^\\d{8}-[0-9a-f]{8}\\.(${AUDIT_AXES.join('|')})$`);
+export function isAuditAxisTaskId(taskId) {
+    return AUDIT_AXIS_TASK_ID.test(taskId);
+}
+const AUDIT_AXIS_ROW_ID = new RegExp(`^\\d{8}-[0-9a-f]{8}\\.(${AUDIT_AXES.join('|')})(-[A-Za-z0-9-]+)?$`);
+/**
+ * Broader than `isAuditAxisTaskId`: also matches a re-run or cross-check turn
+ * dispatched under a suffixed id (`<audit-id>.performance-2`, `.security-codex`).
+ * Used only by the dashboard Kanban read to hide those rows; the judge gate
+ * keeps the exact matcher so its behaviour does not widen.
+ */
+export function isAuditAxisRowId(taskId) {
+    return AUDIT_AXIS_ROW_ID.test(taskId);
+}
 /** Spec §4.3's table, in the order that table is written. */
 export const AUDIT_STATUSES = ['raised', 'merged', 'accepted', 'declined', 'fixed'];
 /** Spec §4.4. Applied when the store is folded, not by a sweeper. */
@@ -400,7 +425,7 @@ export function readAuditManifest(projectDir) {
 function requireOpenAudit(projectDir) {
     const manifest = readAuditManifest(projectDir);
     if (manifest === undefined) {
-        throw new AuditError('audit.not-open', `no audit is open on ${path.resolve(projectDir)}: run \`smith audit open\` first`, { projectDir: path.resolve(projectDir), manifestPath: auditManifestPath(projectDir) });
+        throw new AuditError('audit.not-open', `no audit is open on ${path.resolve(projectDir)}: run \`bs audit open\` first`, { projectDir: path.resolve(projectDir), manifestPath: auditManifestPath(projectDir) });
     }
     return manifest;
 }
@@ -429,7 +454,7 @@ function mintAuditId(now) {
  *
  * `path.basename(project)` names every OTHER project correctly, but this
  * clone's own directory is not always named FACTORY_PROJECT
- * (`black-smith`) -- roadmap.ts's own note documents the real `black-smith`/
+ * (`blacksmith`) -- roadmap.ts's own note documents the real `black-smith`/
  * `blacksmith` siblings this factory was built beside -- so a self-audit that
  * used the basename wrote a name `collectProjects()` (projects.ts) had never
  * seen, sent it looking for a checkout under this clone's own parent, and it
@@ -730,9 +755,9 @@ function renderSpec(input, project, findings) {
         `# Epic spec — \`${input.epicId}\``,
         '',
         `- **Epic id** — \`${input.epicId}\``,
-        `- **Project** — \`${auditedProjectName(project)}\` at \`${project}\`, and every worktree is placed beside that clone (\`AGENTS.md\` "Worktrees").`,
+        `- **Project** — \`${auditedProjectName(project)}\`; every worktree is placed beside the clone the run is handed (\`AGENTS.md\` "Worktrees").`,
         `- **Roadmap milestone** — \`${input.epicId}\` in \`factory/specs/roadmap.md\`.`,
-        `- **Provenance** — cut by \`smith audit cut\` from audit ${audits.join(', ')} (${findings.length} accepted finding${findings.length === 1 ? '' : 's'}: ${severityCounts(findings)}). Each finding carries this epic id in \`.blacksmith/findings.jsonl\`; \`smith audit resolve\` marks fixed only the ones a task in this plan still claims, and leaves the rest \`deferred\`.`,
+        `- **Provenance** — cut by \`bs audit cut\` from audit ${audits.join(', ')} (${findings.length} accepted finding${findings.length === 1 ? '' : 's'}: ${severityCounts(findings)}). Each finding carries this epic id in \`.blacksmith/findings.jsonl\`; \`bs audit resolve\` marks fixed only the ones a task in this plan still claims, and leaves the rest \`deferred\`.`,
         '',
         '## What this epic is',
         '',
@@ -834,28 +859,111 @@ function matchExceptFingerprints(except, carried, epicId) {
     }
     return matched;
 }
+/**
+ * Every task id a `wave-merged` event says landed on the epic's integration
+ * branch — the merge queue's `emitWaveMerged` (`taskEvents.ts`) is the one
+ * writer, so this is "this task's change shipped," not a guess reconstructed
+ * from gate or task-result events. Both fields it may carry are read: the
+ * `payload.task_ids` array `emitWaveMerged` always sets, and the envelope
+ * `task_id` some hand-appended events set alone (`db/projector.ts`'s
+ * `waveTaskIds` comment: reading only one of the two silently dropped merges
+ * during the dogfood run).
+ */
+function mergedTaskIds(events) {
+    const ids = new Set();
+    for (const { record } of events) {
+        if (record.event_type !== 'wave-merged')
+            continue;
+        const payloadIds = record.payload.task_ids;
+        if (Array.isArray(payloadIds)) {
+            for (const id of payloadIds) {
+                if (typeof id === 'string' && id.length > 0)
+                    ids.add(id);
+            }
+        }
+        const taskId = eventTaskId(record);
+        if (taskId !== null)
+            ids.add(taskId);
+    }
+    return ids;
+}
+/**
+ * Claims of a plan task that is `superseded` in the newest plan but whose
+ * change already merged into the epic's integration branch before a later
+ * replan superseded it — the false negative `planClaimedTasks` alone cannot
+ * see, because `livePlanTasks` drops every dead id whether or not its work
+ * ever shipped.
+ *
+ * A task superseded BEFORE it merged must still not count: that is the
+ * "operator scoped the plan narrower on purpose" case this function's caller
+ * already protects, and `merged` (built only from `wave-merged` events) is
+ * empty for it. A same-id supersede (D-121) is excluded too, via `liveIds` —
+ * its live successor is already in `planClaimedTasks`, so counting the dead
+ * copy again would only repeat the same claims under a second entry.
+ *
+ * A merged id counts only when it is qualified under THIS epic
+ * (`epicOfTaskId(id) === epicId`) and its bare half matches the plan task's.
+ * `taskIdsMatch`'s cross-spelling fallback is deliberately not used here: a
+ * `wave-merged` payload carries no `epic_id`, and `readLineageEvents` is not
+ * epic-scoped, so a bare id in the lineage could belong to a legacy
+ * pre-D-46 session or to a different epic that merged waves in the same
+ * lineage. Trusting a bare match would mark a finding `fixed` when nothing
+ * in *this* epic actually shipped — the wrong direction for an operation
+ * that must never be unsure in the optimistic direction. A bare merged id is
+ * therefore ignored, same as before this file learned about merges at all.
+ */
+function mergedSupersededClaims(plan, merged, epicId) {
+    if (merged.size === 0)
+        return [];
+    const liveIds = new Set(livePlanTasks(plan).map((task) => task.task_id));
+    const mergedBareIds = new Set([...merged]
+        .filter((id) => isQualifiedTaskId(id) && epicOfTaskId(id) === epicId)
+        .map((id) => bareTaskId(id)));
+    const claimed = new Map();
+    for (const task of plan.tasks) {
+        if (task.task_status !== 'superseded')
+            continue;
+        if (liveIds.has(task.task_id))
+            continue;
+        if (claimed.has(task.task_id))
+            continue;
+        if (mergedBareIds.has(bareTaskId(task.task_id)))
+            claimed.set(task.task_id, task);
+    }
+    return [...claimed.values()]
+        .filter((task) => Array.isArray(task.claims))
+        .map((task) => ({ task_id: task.task_id, claims: task.claims }));
+}
 /**
  * `audit resolve <project-dir> --epic <epic-id>`. Appends a `fixed` line only
  * for a carried finding some task in the epic's newest plan still claims
- * (`resolveFindingOwner`, D-41/P9-24) — an operator who scoped the plan
- * narrower than the audit deferred the rest on purpose, and marking them
- * fixed anyway would erase that choice. Unclaimed findings stay exactly as
- * they were and come back in `deferred`; `--except` forces specific
- * fingerprints there even when a task claims them. Called from `/bs run`'s
- * epic-close step, so it is repeatable; an epic no finding carries is
- * refused, because the likely cause is a typo and a silent no-op would leave
- * every finding open. A plan that cannot be found is refused too
- * (`audit.no-plan`): being unsure must never mark anything fixed.
+ * (`resolveFindingOwner`, D-41/P9-24), OR a task the plan now shows
+ * `superseded` whose change already merged into the epic's integration
+ * branch before it was superseded (`mergedSupersededClaims`) — a task
+ * superseded before it ever merged delivered nothing, so it is not counted
+ * either way. An operator who scoped the plan narrower than the audit
+ * deferred the rest on purpose, and marking them fixed anyway would erase
+ * that choice. Unclaimed findings stay exactly as they were and come back in
+ * `deferred`; `--except` forces specific fingerprints there even when a task
+ * claims them. Called from `/bs run`'s epic-close step, so it is repeatable;
+ * an epic no finding carries is refused, because the likely cause is a typo
+ * and a silent no-op would leave every finding open. A plan that cannot be
+ * found is refused too (`audit.no-plan`): being unsure must never mark
+ * anything fixed.
  */
 export async function resolveAudit(projectDir, epicId, ctx, opts = {}, resolveOpts = {}) {
     const project = path.resolve(projectDir);
     const carried = foldAuditStore(readAuditStore(project)).filter((finding) => finding.epic === epicId);
     if (carried.length === 0) {
-        throw new AuditError('audit.unknown-epic', `no finding in ${auditStorePath(project)} carries epic ${epicId}: was it cut with \`smith audit cut\`?`, { epic: epicId });
+        throw new AuditError('audit.unknown-epic', `no finding in ${auditStorePath(project)} carries epic ${epicId}: was it cut with \`bs audit cut\`?`, { epic: epicId });
     }
     const open = carried.filter((finding) => finding.status !== 'fixed');
     const plan = resolveEpicPlan(epicId, resolveOpts);
-    const claimedTasks = planClaimedTasks(plan);
+    const lineage = await readLineageEvents(ctx.sessionId, opts);
+    const claimedTasks = [
+        ...planClaimedTasks(plan),
+        ...mergedSupersededClaims(plan, mergedTaskIds(lineage), epicId),
+    ];
     const except = matchExceptFingerprints(resolveOpts.except ?? [], carried, epicId);
     const toFix = open.filter((finding) => !except.has(finding.fingerprint) &&
         resolveFindingOwner(finding.file_path, claimedTasks).owner !== 'unclaimed');