@mmnto/cli 1.88.0 → 1.90.0

package/dist/commands/ecl-gc.js

@@ -0,0 +1,579 @@
+/**
+ * `totem ecl-gc` — ECL outbox retention prune (mmnto-ai/totem#2279; parent
+ * mmnto-ai/totem-strategy#700 / doctrine/ecl-discipline.md § 4.4).
+ *
+ * The binary-guaranteed cohort-wide replacement for the interim
+ * `scripts/prune-outbox.mjs`: it deletes an agent's OWN outbox dispatches once
+ * they age past the retention window N (default 14 days). Outbox dispatches are
+ * TRANSPORT, not archive — the durable record of whatever a dispatch carried
+ * lives in its home (rulings → ADRs / issues, work-state → the GH board,
+ * session history → `journal/`), so an aged courier file is disposable.
+ *
+ * SINGLE-WRITER INVARIANT (ADR-106): each agent prunes only its OWN
+ * `<repoRoot>/.totem/orchestration/<agent-id>/outbox/` — never a peer's, never
+ * the operator's chore. Self-resolution (Tenet-21 reuse of `resolveSelfSender`)
+ * makes pruning a peer structurally unreachable: the target path is composed
+ * from the resolved single agent-id and nothing else. This command NEVER reads
+ * or touches `journal/` (bounded-past record + MCP-indexed) or `processed/`
+ * (the handled-state cursor — erasing it makes consumed backlog re-read as
+ * unread) or any inbox / other seat. Scope is `outbox/` only.
+ *
+ * Safe by default: dry-run (list only) unless `--apply` is passed.
+ *
+ * COMPACTION (mmnto-ai/totem#2307; contract ADR-106 § A2 + ecl-discipline § 4.5,
+ * ratified strategy#826). `eclCompact` is the cursor-coupled processed-mark GC
+ * sibling of the prune above: it deletes an agent's OWN `processed/` marks that
+ * shadow nothing — a mark whose inbound dispatch its sender already swept per
+ * § 4.4. The retained cursor is `processed ∩ raw-addressed-inbound` (A2.1: the
+ * PRE-dedupe scan, never `pollMail`'s `inbound − processed` list). Deletion is
+ * licensed ONLY against a provably-complete poll (A2.2: full expected roster
+ * present, zero warnings, not truncated — else zero deletes), binds to exactly
+ * one seat (A2.3), and self-verifies via an immediate re-poll (A2.4). Unlike the
+ * prune's age window, compaction couples to the outbox lifecycle, not to time.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { cohortRepos, getErrorMessage, isPathSafeAgentId, TotemError } from '@mmnto/totem';
+import { pollMail, resolveSelfSender } from './mail.js';
+// ─── Constants ──────────────────────────────────────────
+const TAG = 'EclGc';
+/**
+ * Doctrine-ratified retention window (ecl-discipline.md § 4.4). A grace window,
+ * not a correctness boundary — durable content already lives in homes; N only
+ * bounds how long the courier lingers. 14d comfortably covers infrequent-
+ * session (operator-run vendor) seats so a prune never clips a dispatch a slow
+ * peer hasn't read.
+ */
+const DEFAULT_RETAIN_DAYS = 14;
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+/**
+ * Dual-form stamp acceptance ported verbatim from `scripts/prune-outbox.mjs`:
+ * the cohort emits both `YYYY-MM-DDTHHMMZ` (4-digit) and `YYYY-MM-DDTHHMMSSZ`
+ * (6-digit, `date -u +%Y-%m-%dT%H%M%SZ`). Matching only one form would silently
+ * skip the other (the verify-absence trap).
+ */
+const STAMP_RE = /^(\d{4}-\d{2}-\d{2}T\d{4}(?:\d{2})?Z)/;
+// ─── Pure helpers ───────────────────────────────────────
+/**
+ * Canonicalize either stamp form to a 14-digit `YYYYMMDDHHMMSS` key (seconds
+ * default to `00`) so mixed-length stamps compare correctly. Ported from
+ * `scripts/prune-outbox.mjs:toKey`.
+ */
+export function toStampKey(stamp) {
+    const digits = stamp.replace(/\D/g, '');
+    return digits.length === 12 ? `${digits}00` : digits;
+}
+/**
+ * Cutoff = `now − retainDays`, as a comparable 14-digit `YYYYMMDDHHMMSS` key.
+ * Derives from the injected `now` for determinism (Tenet 15). Ported from
+ * `scripts/prune-outbox.mjs:cutoffKey`.
+ */
+export function cutoffKey(now, retainDays) {
+    const iso = new Date(now.getTime() - retainDays * MS_PER_DAY).toISOString();
+    // iso = 2026-06-16T22:13:32.088Z -> 20260616221332
+    return (iso.slice(0, 4) +
+        iso.slice(5, 7) +
+        iso.slice(8, 10) +
+        iso.slice(11, 13) +
+        iso.slice(14, 16) +
+        iso.slice(17, 19));
+}
+/**
+ * Classify a single directory entry against the cutoff. Safe-direction bias:
+ * anything whose age is not derivable from an eligible filename is KEPT +
+ * surfaced, never deleted (auto-deleting an un-ageable file is worse than
+ * letting it linger — mmnto-ai/totem-strategy#700 by-design). Non-file entries
+ * are checked FIRST so a directory named `*.md` can never reach a delete.
+ */
+export function classifyEntry(entry, cutoff) {
+    if (!entry.isFile) {
+        return { action: 'skip', reason: 'not a regular file' };
+    }
+    // Extension gate (spec-narrowed vs the port): only `.md` dispatches are
+    // prune-eligible; a `.tmp` / `.gitkeep` / other stray is surfaced, never
+    // deleted.
+    if (!entry.name.endsWith('.md')) {
+        return { action: 'skip', reason: 'not a .md dispatch' };
+    }
+    const m = STAMP_RE.exec(entry.name);
+    if (m === null) {
+        return { action: 'skip', reason: 'unparseable stamp' };
+    }
+    // Exact boundary is RETAINED: `< cutoff` prunes, `>= cutoff` keeps.
+    return toStampKey(m[1]) < cutoff ? { action: 'prune' } : { action: 'keep' };
+}
+/**
+ * Pure prune-plan classification: given a directory listing + a cutoff key,
+ * partition entries into prune / keep / skip. Deterministic order (filename
+ * sort) so the reported lists are stable across platforms.
+ */
+export function planPrune(entries, cutoff) {
+    const prune = [];
+    const skipped = [];
+    let kept = 0;
+    const ordered = [...entries].sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of ordered) {
+        const verdict = classifyEntry(entry, cutoff);
+        if (verdict.action === 'prune') {
+            prune.push(entry.name);
+        }
+        else if (verdict.action === 'keep') {
+            kept += 1;
+        }
+        else {
+            skipped.push({ file: entry.name, reason: verdict.reason });
+        }
+    }
+    return { prune, kept, skipped };
+}
+// ─── Core prune ─────────────────────────────────────────
+/**
+ * Programmatic entry point. Resolves the single self-agent, validates inputs,
+ * scans that agent's OWN outbox, and (under `--apply`) deletes the aged
+ * dispatches. Returns a structured `EclGcResult`.
+ *
+ * Throws ONLY on usage errors (unresolvable/ambiguous self, unsafe agent-id,
+ * invalid `--retain-days`), and always BEFORE any directory scan or deletion.
+ * Filesystem failures are NEVER thrown — a per-file delete failure is captured
+ * into `result.failed` (janitorial sensor, not a gate — Tenet 13).
+ */
+export function eclGc(opts = {}) {
+    const env = opts.env ?? process.env;
+    const repoRoot = path.resolve(opts.repoRoot ?? process.cwd());
+    const now = (opts.now ?? (() => new Date()))();
+    // Retain-days validation (usage error) — evaluated before any scan.
+    const retainDays = opts.retainDays ?? DEFAULT_RETAIN_DAYS;
+    if (!Number.isInteger(retainDays) || retainDays < 0) {
+        throw new TotemError('CONFIG_INVALID', `--retain-days must be a non-negative integer (got: ${String(retainDays)})`, 'pass --retain-days <n> with a whole number of days ≥ 0.');
+    }
+    // Self-resolution (Tenet-21 reuse — panel-mandated). `resolveSelfSender`
+    // picks the single writer (explicit > unambiguous self > throw). Its native
+    // message talks about "outbound dispatch"; rewrap into a prune-shaped usage
+    // error. Resolution + validation happen BEFORE any directory scan/deletion.
+    let agent;
+    try {
+        agent = resolveSelfSender(repoRoot, env, opts.agentId);
+    }
+    catch (err) {
+        throw new TotemError('CONFIG_INVALID', `cannot resolve a single agent whose outbox to prune: ${getErrorMessage(err)}`, 'set TOTEM_SELF_AGENT or pass --agent-id <agent-id>.', err);
+    }
+    // Defense-in-depth on a destructive path: the resolved id is a path segment
+    // in `.totem/orchestration/<agent>/outbox`. Reject anything that could escape
+    // it (traversal, separators, control/whitespace/win32-reserved chars).
+    if (!isPathSafeAgentId(agent)) {
+        throw new TotemError('CONFIG_INVALID', `invalid agent-id ${JSON.stringify(agent)} (path traversal, unsafe characters, or empty)`, 'pass a plain agent-id such as "totem-claude" (no path separators, "..", whitespace, or control characters).');
+    }
+    const dryRun = opts.apply !== true;
+    const outbox = path.join(repoRoot, '.totem', 'orchestration', agent, 'outbox');
+    const cutoff = cutoffKey(now, retainDays);
+    const warnings = [];
+    const result = {
+        agent,
+        retainDays,
+        dryRun,
+        outbox,
+        cutoffKey: cutoff,
+        pruned: [],
+        failed: [],
+        kept: 0,
+        skipped: [],
+        warnings,
+    };
+    // Missing outbox is the routine "nothing to prune" signal — clean empty
+    // result, never an error (the seat simply hasn't sent mail from this repo).
+    if (!fs.existsSync(outbox)) {
+        return result;
+    }
+    let dirents;
+    try {
+        dirents = fs.readdirSync(outbox, { withFileTypes: true });
+        // totem-context: intentional cleanup — an unreadable outbox (EACCES, raced removal) is surfaced as a warning and degrades to an empty prune rather than throwing; the prune is a janitorial sensor, not a gate (Tenet 13).
+    }
+    catch (err) {
+        warnings.push(`outbox read failed (${outbox}): ${getErrorMessage(err)}`);
+        return result;
+    }
+    const plan = planPrune(dirents.map((d) => ({ name: d.name, isFile: d.isFile() })), cutoff);
+    result.kept = plan.kept;
+    result.skipped = plan.skipped;
+    // Dry-run: report the would-prune set, delete nothing.
+    if (dryRun) {
+        result.pruned = plan.prune;
+        return result;
+    }
+    // Apply: unlink each aged dispatch. A single failed delete (EPERM, raced
+    // removal) is captured with per-item accounting and the loop continues —
+    // one bad file must never abort the prune (fail-soft, Tenet 4).
+    for (const file of plan.prune) {
+        try {
+            fs.unlinkSync(path.join(outbox, file));
+            result.pruned.push(file);
+            // totem-context: intentional cleanup — a per-file unlink failure is captured into result.failed and the loop continues; the wrapper turns a non-empty failed[] into exit 1 (partial-prune sensor), never a throw.
+        }
+        catch (err) {
+            result.failed.push({ file, error: getErrorMessage(err) });
+        }
+    }
+    return result;
+}
+// ─── CLI wrapper ────────────────────────────────────────
+/**
+ * Render an `EclGcResult`. With `json`, the structured result goes to stdout
+ * (hook-friendly clean stream). Otherwise a human summary goes to stderr via
+ * the standard CLI logger (agent, mode, pruned/kept counts, skipped-with-
+ * reasons, failed count) — mirrors `mail.ts`'s stderr `log` usage.
+ */
+export async function eclGcCommand(result, json) {
+    if (json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        return result;
+    }
+    const { log } = await import('../ui.js');
+    const mode = result.dryRun ? 'dry-run (list only — re-run with --apply to delete)' : 'apply';
+    const verb = result.dryRun ? 'would prune' : 'pruned';
+    log.info(TAG, `agent: ${result.agent} · retention ${result.retainDays}d · cutoff < ${result.cutoffKey}`);
+    log.info(TAG, `mode: ${mode}`);
+    log.info(TAG, `${verb} ${result.pruned.length}; kept ${result.kept}`);
+    if (result.skipped.length > 0) {
+        log.warn(TAG, `skipped ${result.skipped.length} non-dispatch entr(y/ies) — left untouched:`);
+        for (const s of result.skipped) {
+            log.warn(TAG, `  - ${s.file}: ${s.reason}`);
+        }
+    }
+    if (result.failed.length > 0) {
+        log.error('Totem Error', `FAILED ${result.failed.length} delete(s) — surfaced, non-blocking:`);
+        for (const f of result.failed) {
+            log.error('Totem Error', `  - ${f.file}: ${f.error}`);
+        }
+    }
+    for (const w of result.warnings) {
+        log.warn(TAG, w);
+    }
+    return result;
+}
+// ─── Compaction (ADR-106 § A2 / ecl-discipline § 4.5) ───
+const COMPACT_TAG = 'EclGc:compact';
+/** Local directory predicate (stat-based) — a repo/orch dir must be a real
+ * directory, not merely an existing path (a same-named file must not pass the
+ * A2.2 roster-presence check). Mirrors the resolver's private `isDirectory`. */
+function isDir(p) {
+    try {
+        return fs.statSync(p).isDirectory();
+        // totem-context: intentional fall-through — a stat failure (ENOENT, EACCES) is the "repo absent" signal the A2.2 roster gate consumes; rethrowing would force the gate to wrap a routine outcome.
+    }
+    catch {
+        return false;
+    }
+}
+/** Read the `.md` mark basenames in a `processed/` (sub)dir. A missing dir is
+ * the routine "no marks here" signal (empty). A read FAILURE is a stop
+ * condition for the A2.2 gate — pushed to `warnings` so the gate goes red
+ * (an un-enumerable own cursor cannot be safely compacted). */
+function readMarkDir(dir, warnings) {
+    if (!fs.existsSync(dir))
+        return [];
+    try {
+        return fs.readdirSync(dir).filter((f) => f.endsWith('.md'));
+        // totem-context: intentional cleanup — a processed/ read failure (EACCES, raced rename) becomes a gate-reddening warning, never a throw; the compaction degrades to zero deletes (retain), the safe direction (A2.2).
+    }
+    catch (err) {
+        warnings.push(`processed/ scan failed (${dir}): ${getErrorMessage(err)}`);
+        return [];
+    }
+}
+/**
+ * Programmatic entry point for cursor-coupled processed-mark compaction. For a
+ * single resolved seat, deletes `processed/` marks whose inbound dispatch is
+ * absent from the RAW addressed-inbound set (A2.1) — but ONLY when discovery is
+ * provably complete (A2.2), and then self-verifies (A2.4).
+ *
+ * Throws ONLY on usage errors (unresolvable/ambiguous self, unsafe agent-id),
+ * always BEFORE any scan or deletion (exit-2 class, parity with `eclGc`). Every
+ * safety failure (incomplete roster, scan warning, truncation) is a STRUCTURED
+ * gate-red result with zero deletes, never a throw — the caller maps it to the
+ * compaction-abort exit code.
+ */
+export function eclCompact(opts = {}) {
+    const env = opts.env ?? process.env;
+    const repoRoot = path.resolve(opts.repoRoot ?? process.cwd());
+    const workspace = path.resolve(opts.workspace ?? env['TOTEM_WORKSPACE'] ?? path.dirname(repoRoot));
+    const expectedRepos = [...(opts.expectedRepos ?? cohortRepos())].sort();
+    // Single-writer target (A2.3): resolve EXACTLY one seat. Ambiguous/zero self
+    // is a usage error (parity with `eclGc`), thrown before any scan or delete.
+    let agent;
+    try {
+        agent = resolveSelfSender(repoRoot, env, opts.agentId);
+    }
+    catch (err) {
+        throw new TotemError('CONFIG_INVALID', `cannot resolve a single agent whose processed cursor to compact: ${getErrorMessage(err)}`, 'set TOTEM_SELF_AGENT or pass --agent-id <agent-id>.', err);
+    }
+    if (!isPathSafeAgentId(agent)) {
+        throw new TotemError('CONFIG_INVALID', `invalid agent-id ${JSON.stringify(agent)} (path traversal, unsafe characters, or empty)`, 'pass a plain agent-id such as "totem-claude" (no path separators, "..", whitespace, or control characters).');
+    }
+    const dryRun = opts.apply !== true;
+    const warnings = [];
+    // Own processed marks (single-writer: this seat's OWN cursor only, in this
+    // repo). `processed/` (direct) ∪ `processed/_broadcast/` (broadcast). Read
+    // first so the undeclared-roster hard-abort below can still report the count.
+    const processedBase = path.join(repoRoot, '.totem', 'orchestration', agent, 'processed');
+    const broadcastDir = path.join(processedBase, '_broadcast');
+    const directMarks = readMarkDir(processedBase, warnings);
+    const broadcastMarks = readMarkDir(broadcastDir, warnings);
+    const directSet = new Set(directMarks);
+    const broadcastSet = new Set(broadcastMarks);
+    const allMarks = new Set([...directMarks, ...broadcastMarks]);
+    // Safety corollary (codified contract strategy#828 / eb9ff5b — A2.2): an
+    // UNDECLARED (empty) roster gives the completeness gate nothing to assert
+    // against, so completeness cannot be proven. This is a HARD ABORT (fail-loud,
+    // non-zero exit — the caller maps `gateComplete=false` to exit 3), NOT a silent
+    // no-op that would let `processed/` accumulate unsignalled (Tenet 4). A genuine
+    // single-repo consumer opts into completeness-1 by DECLARING a 1-repo roster;
+    // the interim `cohortRepos()` default is non-empty for our cohort, so this
+    // guards the config-declared undeclared-consumer case (mmnto-ai/totem#2310).
+    // `rosterDeclared=false` is retained only to frame the operator message.
+    if (expectedRepos.length === 0) {
+        return {
+            agent,
+            dryRun,
+            workspace,
+            expectedRepos,
+            rosterDeclared: false,
+            gateComplete: false,
+            gateReasons: [
+                'no cohort roster declared — compaction HARD-ABORTS (declare cohort repos, or a single-repo roster to opt into completeness-1)',
+            ],
+            rawInbound: 0,
+            marks: allMarks.size,
+            collectable: [],
+            collected: [],
+            retained: allMarks.size,
+            failed: [],
+            resurfaced: [],
+            verifyComplete: true,
+            warnings,
+        };
+    }
+    // A2.2 gate part 1 — every declared roster repo must be present AND actually
+    // SCANNED. A silently-absent cohort repo is the false-unread leak (a live mark
+    // in its unscanned outbox looks inert): N < M is a hard block, never a silent
+    // skip (Tenet 4). Coverage is checked against `pollMail`'s OWN scan predicate
+    // (mail.ts `enumerateOutboxes` visits a workspace child only if it is a
+    // directory whose name does not start with '.' and is not `node_modules`) — a
+    // roster entry the gate accepts but the scan would skip leaves its outbox
+    // unscanned, re-opening the leak (CodeRabbit). `--force-incomplete` waives a
+    // genuinely ABSENT repo, but never an unscannable-name declaration (that is a
+    // config error, not a known gap). Unreachable with the clean #611 roster
+    // today; hardens the config-declared future (mmnto-ai/totem#2310).
+    const forced = opts.forceIncomplete === true;
+    const missingRepos = expectedRepos.filter((repo) => !repo.startsWith('.') && repo !== 'node_modules' && !isDir(path.join(workspace, repo)));
+    const unscannableRepos = expectedRepos.filter((repo) => repo.startsWith('.') || repo === 'node_modules');
+    // A2.1 — raw addressed-inbound: the SAME mail scan the reader runs, halted at
+    // the pre-dedupe stage (`includeProcessed`), bound to EXACTLY this seat via a
+    // forced `TOTEM_SELF_AGENT` so the multi-seat coordinator union never leaks in
+    // (A2.3). `pollMail` never throws — fs failures land in `poll.warnings`.
+    const poll = pollMail({
+        repoRoot,
+        workspace,
+        maxScan: opts.maxScan,
+        includeProcessed: true,
+        env: { ...env, TOTEM_SELF_AGENT: agent },
+    });
+    warnings.push(...poll.warnings);
+    const rawBasenames = new Set(poll.mail.map((m) => m.file));
+    // A2.2 gate: roster present (or forced) AND every roster name scannable AND
+    // zero scan/read warnings AND not truncated. `--force-incomplete` waives the
+    // absent-repo arm only — an unscannable-name declaration, scan warnings, and
+    // truncation stay hard aborts (a config error / broken read is not a
+    // known-absent repo). A forced-past missing repo is still surfaced (loud).
+    const gateComplete = (missingRepos.length === 0 || forced) &&
+        unscannableRepos.length === 0 &&
+        warnings.length === 0 &&
+        !poll.truncated;
+    const gateReasons = [
+        ...missingRepos.map((r) => `expected cohort repo missing from workspace: ${r}${forced ? ' (proceeding — --force-incomplete)' : ''}`),
+        ...unscannableRepos.map((r) => `declared cohort repo is unscannable (name filtered by the workspace scan): ${r}`),
+        ...warnings,
+        ...(poll.truncated ? [`scan truncated at ${poll.scanned} files (MAX_SCAN)`] : []),
+    ];
+    // Collectable = own marks whose dispatch is ABSENT from raw addressed-inbound.
+    // The raw set is the union of to:S ∪ broadcast (this seat forced; broadcast
+    // always matches), which mirrors `pollMail`'s recipient-class-blind basename
+    // filter — so a mark in EITHER store shadows a live dispatch of that basename;
+    // union retention is the sound match (codex panel). Deterministic order.
+    const collectable = [...allMarks].filter((m) => !rawBasenames.has(m)).sort();
+    const result = {
+        agent,
+        dryRun,
+        workspace,
+        expectedRepos,
+        rosterDeclared: true,
+        gateComplete,
+        gateReasons,
+        rawInbound: rawBasenames.size,
+        marks: allMarks.size,
+        collectable,
+        collected: [],
+        retained: allMarks.size,
+        failed: [],
+        resurfaced: [],
+        verifyComplete: true,
+        warnings,
+    };
+    // Never delete in dry-run OR when the gate is red. A collectable set computed
+    // from an INCOMPLETE poll is unreliable by construction (the A2.2 point), so a
+    // gate-red run does not even surface it as would-collect (uncertain ⇒ retain).
+    if (dryRun || !gateComplete) {
+        if (!gateComplete) {
+            result.collectable = [];
+        }
+        else {
+            // Dry-run + gate green: `retained` reflects the WOULD-survive count so the
+            // JSON payload matches the human display and the apply-path semantics —
+            // never reads as "total marks" in dry-run (greptile).
+            result.retained = allMarks.size - result.collectable.length;
+        }
+        return result;
+    }
+    // Apply + gate green: delete each inert mark from whichever store holds it. A
+    // per-file unlink failure leaves a lingering INERT mark (bounded storage,
+    // safe) — captured with per-item accounting, non-fatal (janitorial exit-1
+    // class), never a throw.
+    for (const name of collectable) {
+        let anyDeleted = false;
+        let anyFailed = false;
+        if (directSet.has(name)) {
+            try {
+                fs.unlinkSync(path.join(processedBase, name));
+                anyDeleted = true;
+                // totem-context: intentional cleanup — a per-mark unlink failure is captured into result.failed and the loop continues; the wrapper maps a non-empty failed[] to the janitorial exit code, never a throw.
+            }
+            catch (err) {
+                result.failed.push({ file: name, error: getErrorMessage(err) });
+                anyFailed = true;
+            }
+        }
+        if (broadcastSet.has(name)) {
+            try {
+                fs.unlinkSync(path.join(broadcastDir, name));
+                anyDeleted = true;
+                // totem-context: intentional cleanup — see the direct-store unlink above; dual placement so the rule fires on either catch line.
+            }
+            catch (err) {
+                result.failed.push({ file: `_broadcast/${name}`, error: getErrorMessage(err) });
+                anyFailed = true;
+            }
+        }
+        // Count as collected ONLY when fully removed from every store it was in. A
+        // dual-store mark whose one arm failed still persists on disk (kept in
+        // `failed`, out of `collected`) — so `collected` and `failed` never overlap
+        // and `retained` stays an accurate on-disk count (greptile).
+        if (anyDeleted && !anyFailed)
+            result.collected.push(name);
+    }
+    result.retained = allMarks.size - result.collected.length;
+    // A2.4 falsifier (in-command): immediately re-poll the SAME seat and assert NO
+    // previously-handled dispatch re-surfaces as unread. A resurfaced basename ∈
+    // the pre-compaction mark set means a LIVE mark was collected — the gate was
+    // too weak; the caller maps a non-empty `resurfaced` to the abort exit code.
+    // The re-poll inherits `maxScan` so it can never be MORE truncated than the
+    // discovery poll that passed the gate (CodeRabbit).
+    const verify = pollMail({
+        repoRoot,
+        workspace,
+        maxScan: opts.maxScan,
+        env: { ...env, TOTEM_SELF_AGENT: agent },
+    });
+    result.resurfaced = verify.mail
+        .map((m) => m.file)
+        .filter((f) => allMarks.has(f))
+        .sort();
+    // The A2.4 verdict is trustworthy only if the re-poll itself was complete: a
+    // truncated or warned verify could miss a resurfaced dispatch beyond its
+    // horizon and read as clean. An untrustworthy verify is a hard failure — we
+    // deleted marks and cannot confirm no resurface (CodeRabbit).
+    result.verifyComplete = !verify.truncated && verify.warnings.length === 0;
+    return result;
+}
+/**
+ * Render an `EclCompactResult`. `--json` → structured stdout; otherwise a human
+ * summary to stderr. A red gate reports the reasons + zero deletes; a tripped
+ * A2.4 falsifier and per-mark delete failures are surfaced via the error logger.
+ */
+export async function eclCompactCommand(result, json) {
+    if (json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        return result;
+    }
+    const { log } = await import('../ui.js');
+    const mode = result.dryRun ? 'dry-run (list only — re-run with --apply to delete)' : 'apply';
+    log.info(COMPACT_TAG, `agent: ${result.agent} · roster ${result.expectedRepos.length} repo(s) · mode: ${mode}`);
+    if (!result.gateComplete) {
+        // HARD ABORT (fail-loud, exit 3), never a silent skip — covers a declared
+        // roster that is incomplete AND the no-declared-roster case alike; the
+        // specific reason ("no cohort roster declared" vs a missing/unscannable
+        // repo, warning, or truncation) is carried in `gateReasons` (strategy#828).
+        log.warn(COMPACT_TAG, `A2.2 completeness gate NOT met — retained all ${result.marks} mark(s), deleted 0:`);
+        for (const r of result.gateReasons)
+            log.warn(COMPACT_TAG, `  - ${r}`);
+        return result;
+    }
+    // Gate green. When forced past a missing repo (the only way gateReasons is
+    // non-empty here), surface it LOUDLY — deletes proceeded despite an incomplete
+    // workspace at the operator's explicit request.
+    if (result.gateReasons.length > 0) {
+        log.warn(COMPACT_TAG, `proceeded despite an incomplete workspace (--force-incomplete):`);
+        for (const r of result.gateReasons)
+            log.warn(COMPACT_TAG, `  - ${r}`);
+    }
+    const verb = result.dryRun ? 'would collect' : 'collected';
+    const collectN = result.dryRun ? result.collectable.length : result.collected.length;
+    // `result.retained` is now accurate in every path (dry-run reflects would-
+    // survive; apply reflects on-disk after partial-failure accounting).
+    log.info(COMPACT_TAG, `${verb} ${collectN} inert mark(s); retained ${result.retained} of ${result.marks}; raw addressed-inbound ${result.rawInbound}`);
+    if (result.failed.length > 0) {
+        log.error('Totem Error', `FAILED ${result.failed.length} mark delete(s) — surfaced, non-blocking:`);
+        for (const f of result.failed)
+            log.error('Totem Error', `  - ${f.file}: ${f.error}`);
+    }
+    if (result.resurfaced.length > 0) {
+        log.error('Totem Error', `A2.4 FALSIFIER TRIPPED — ${result.resurfaced.length} handled dispatch(es) re-surfaced as unread (a live mark was collected):`);
+        for (const f of result.resurfaced)
+            log.error('Totem Error', `  - ${f}`);
+    }
+    if (!result.verifyComplete) {
+        log.error('Totem Error', 'A2.4 self-check UNTRUSTWORTHY — the post-compact re-poll was truncated or warned; a resurfaced dispatch beyond its horizon cannot be ruled out.');
+    }
+    for (const w of result.warnings)
+        log.warn(COMPACT_TAG, w);
+    return result;
+}
+/**
+ * Combined prune+compact exit-code contract (codex panel, mmnto-ai/totem#2307).
+ * Pure so the precedence is unit-testable independent of the CLI wrapper. The
+ * usage code `2` is NOT modeled here — it is the thrown-error path the wrapper
+ * catches around this call. Precedence: `3` (compaction abort — A2.2 gate red or
+ * A2.4 falsifier tripped) outranks `1` (partial janitorial delete failure, from
+ * either phase), which outranks `0` (clean). So a prune-partial + compact-abort
+ * is `3`, with the prune count still carried in the structured result.
+ */
+export function resolveEclGcExitCode(prune, compact) {
+    if (compact !== undefined) {
+        // A2.4 falsifier tripped — OR an untrustworthy (truncated/warned) re-poll
+        // that cannot confirm no resurface — is always a hard failure.
+        if (compact.resurfaced.length > 0 || !compact.verifyComplete)
+            return 3;
+        // Any incomplete gate is a HARD ABORT (non-zero) — a declared roster that is
+        // incomplete (missing/unscannable repo, scan warning, truncation) AND the
+        // no-declared-roster case alike: absent a completeness expectation there is
+        // nothing to prove against, so the contract fails LOUD, never a silent no-op
+        // that lets `processed/` accumulate unsignalled (strategy#828 / eb9ff5b —
+        // A2.2 no-roster hard-abort corollary; Tenet 4).
+        if (!compact.gateComplete)
+            return 3;
+    }
+    if (prune.failed.length > 0 || (compact?.failed.length ?? 0) > 0) {
+        return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=ecl-gc.js.map

package/dist/commands/ecl-gc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecl-gc.js","sourceRoot":"","sources":["../../src/commands/ecl-gc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE3F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAExD,2DAA2D;AAE3D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AA2CzD,2DAA2D;AAE3D;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAS,EAAE,UAAkB;IACrD,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,mDAAmD;IACnD,OAAO,CACL,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAClB,CAAC;AACJ,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,MAAc;IAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,WAAW;IACX,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzD,CAAC;IACD,oEAAoE;IACpE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC/E,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,OAAuB,EAAE,MAAc;IAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,2DAA2D;AAE3D;;;;;;;;;GASG;AACH,MAAM,UAAU,KAAK,CAAC,OAAqB,EAAE;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAE/C,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,sDAAsD,MAAM,CAAC,UAAU,CAAC,GAAG,EAC3E,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,wDAAwD,eAAe,CAAC,GAAG,CAAC,EAAE,EAC9E,qDAAqD,EACrD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gDAAgD,EACzF,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAgB;QAC1B,KAAK;QACL,UAAU;QACV,MAAM;QACN,MAAM;QACN,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,CAAC;QACP,OAAO,EAAE,EAAE;QACX,QAAQ;KACT,CAAC;IAEF,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,2NAA2N;IAC7N,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,uBAAuB,MAAM,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CACpB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAC1D,MAAM,CACP,CAAC;IACF,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE9B,uDAAuD;IACvD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,gEAAgE;IAChE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,kNAAkN;QACpN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2DAA2D;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAmB,EAAE,IAAa;IACnE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtD,GAAG,CAAC,IAAI,CACN,GAAG,EACH,UAAU,MAAM,CAAC,KAAK,gBAAgB,MAAM,CAAC,UAAU,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAC1F,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,6CAA6C,CAAC,CAAC;QAC7F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,CAAC,MAAM,sCAAsC,CAAC,CAAC;QAC/F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2DAA2D;AAE3D,MAAM,WAAW,GAAG,eAAe,CAAC;AAEpC;;gFAEgF;AAChF,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,kMAAkM;IACpM,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;+DAG+D;AAC/D,SAAS,WAAW,CAAC,GAAW,EAAE,QAAkB;IAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,sNAAsN;IACxN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,2BAA2B,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAyFD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B,EAAE;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAC5B,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CACnE,CAAC;IACF,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAExE,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,oEAAoE,eAAe,CAAC,GAAG,CAAC,EAAE,EAC1F,qDAAqD,EACrD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAClB,gBAAgB,EAChB,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gDAAgD,EACzF,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;IAE9D,yEAAyE;IACzE,0EAA0E;IAC1E,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK;YACL,MAAM;YACN,SAAS;YACT,aAAa;YACb,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE;gBACX,+HAA+H;aAChI;YACD,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,QAAQ,CAAC,IAAI;YACpB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,IAAI;YACpB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC;IAC7C,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CACvC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CACzF,CAAC;IACF,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,cAAc,CAC1D,CAAC;IAEF,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC;QACpB,QAAQ;QACR,SAAS;QACT,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI;QACtB,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACzC,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3D,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,2EAA2E;IAC3E,MAAM,YAAY,GAChB,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC;QACrC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC7B,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,IAAI,CAAC,SAAS,CAAC;IAClB,MAAM,WAAW,GAAG;QAClB,GAAG,YAAY,CAAC,GAAG,CACjB,CAAC,CAAC,EAAE,EAAE,CACJ,gDAAgD,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3G;QACD,GAAG,gBAAgB,CAAC,GAAG,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,8EAA8E,CAAC,EAAE,CACzF;QACD,GAAG,QAAQ;QACX,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;IAEF,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,WAAW,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7E,MAAM,MAAM,GAAqB;QAC/B,KAAK;QACL,MAAM;QACN,SAAS;QACT,aAAa;QACb,cAAc,EAAE,IAAI;QACpB,YAAY;QACZ,WAAW;QACX,UAAU,EAAE,YAAY,CAAC,IAAI;QAC7B,KAAK,EAAE,QAAQ,CAAC,IAAI;QACpB,WAAW;QACX,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,EAAE;QACd,cAAc,EAAE,IAAI;QACpB,QAAQ;KACT,CAAC;IAEF,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,2EAA2E;YAC3E,wEAAwE;YACxE,sDAAsD;YACtD,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,yBAAyB;IACzB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC9C,UAAU,GAAG,IAAI,CAAC;gBAClB,0MAA0M;YAC5M,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChE,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,UAAU,GAAG,IAAI,CAAC;gBAClB,iIAAiI;YACnI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,IAAI,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChF,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,UAAU,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IAE1D,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC;QACtB,QAAQ;QACR,SAAS;QACT,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9B,IAAI,EAAE,CAAC;IACV,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,CAAC,cAAc,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IAE1E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAwB,EACxB,IAAa;IAEb,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7F,GAAG,CAAC,IAAI,CACN,WAAW,EACX,UAAU,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,aAAa,CAAC,MAAM,oBAAoB,IAAI,EAAE,CACzF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,4EAA4E;QAC5E,GAAG,CAAC,IAAI,CACN,WAAW,EACX,iDAAiD,MAAM,CAAC,KAAK,sBAAsB,CACpF,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,2EAA2E;IAC3E,+EAA+E;IAC/E,gDAAgD;IAChD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,iEAAiE,CAAC,CAAC;QACzF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACrF,2EAA2E;IAC3E,qEAAqE;IACrE,GAAG,CAAC,IAAI,CACN,WAAW,EACX,GAAG,IAAI,IAAI,QAAQ,4BAA4B,MAAM,CAAC,QAAQ,OAAO,MAAM,CAAC,KAAK,2BAA2B,MAAM,CAAC,UAAU,EAAE,CAChI,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,CACP,aAAa,EACb,UAAU,MAAM,CAAC,MAAM,CAAC,MAAM,2CAA2C,CAC1E,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,CACP,aAAa,EACb,4BAA4B,MAAM,CAAC,UAAU,CAAC,MAAM,0EAA0E,CAC/H,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU;YAAE,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,GAAG,CAAC,KAAK,CACP,aAAa,EACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,OAA6F;IAE7F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO,CAAC,CAAC;QACvE,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/ecl-gc.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Tests for `totem ecl-gc` (mmnto-ai/totem#2279; parent mmnto-ai/totem-strategy#700).
+ *
+ * Filesystem-driven with an injected clock: every test builds a fresh
+ * `<tmp>/.totem/orchestration/<agent>/outbox/` tree, exercises `eclGc`, and
+ * asserts on the structured `EclGcResult` AND on the on-disk aftermath (which
+ * files survived). The safety rows (peer immunity, non-outbox trees untouched,
+ * ambiguity-throws-before-deletion, exact-boundary retention) are written to
+ * FAIL if their guard were removed — see the per-test non-vacuity notes.
+ */
+export {};
+//# sourceMappingURL=ecl-gc.test.d.ts.map

package/dist/commands/ecl-gc.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecl-gc.test.d.ts","sourceRoot":"","sources":["../../src/commands/ecl-gc.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}