@natjswenson/devlog 0.10.0 → 0.11.1

package/lib/assemble_post.mjs

@@ -0,0 +1,71 @@
+// Mechanical extraction of a post's fenced code blocks, in order, so the
+// SKILL.md Step 4 assemble-and-run check is a command instead of an honor
+// system: the audit of the first six runs found "copy the blocks into a
+// scratch dir and run them" was skipped whenever it was inconvenient, and two
+// posts shipped claiming "real output" over code that could not run.
+// `text` fences are expected OUTPUT, not code — they're listed but not written
+// as runnable files.
+import { writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseFrontmatter } from './lint_post.mjs';
+
+// Languages a post realistically fences; anything unknown falls back to .txt
+// so the block is still on disk for the agent to run by hand.
+const LANG_EXT = {
+  javascript: 'js', js: 'js', mjs: 'mjs', typescript: 'ts', ts: 'ts', jsx: 'jsx', tsx: 'tsx',
+  python: 'py', py: 'py',
+  bash: 'sh', sh: 'sh', shell: 'sh', zsh: 'sh',
+  json: 'json', yaml: 'yml', yml: 'yml', toml: 'toml',
+  html: 'html', css: 'css', svg: 'svg', xml: 'xml',
+  sql: 'sql', ruby: 'rb', go: 'go', rust: 'rs', java: 'java', c: 'c', cpp: 'cpp',
+  markdown: 'md', md: 'md', diff: 'diff', ini: 'ini', dockerfile: 'dockerfile', makefile: 'mk',
+};
+
+const OUTPUT_LANGS = new Set(['text', 'txt', 'console', 'output']);
+
+// Ordered fenced blocks of a post body (frontmatter excluded):
+// [{ index, lang, code, runnable }] — `runnable` is false for output-shaped
+// fences (`text` and friends), which readers compare against, not execute.
+export function assemblePost(content) {
+  const { body } = parseFrontmatter(content);
+  const blocks = [];
+  let current = null;
+  for (const line of body.split('\n')) {
+    const m = /^```(.*)$/.exec(line);
+    if (m && !current) {
+      current = { lang: m[1].trim().toLowerCase() || 'txt', lines: [] };
+    } else if (m && current) {
+      const lang = current.lang;
+      blocks.push({
+        index: blocks.length + 1,
+        lang,
+        code: current.lines.join('\n'),
+        runnable: !OUTPUT_LANGS.has(lang),
+      });
+      current = null;
+    } else if (current) {
+      current.lines.push(line);
+    }
+  }
+  return blocks;
+}
+
+// Write the runnable blocks to outDir as NN.<ext> and return a manifest of
+// everything (including the skipped output blocks) for the agent to execute
+// in order.
+export function writeAssembledBlocks(content, outDir) {
+  const blocks = assemblePost(content);
+  mkdirSync(outDir, { recursive: true });
+  const written = blocks.map((b) => {
+    if (!b.runnable) return { ...b, file: null };
+    const ext = LANG_EXT[b.lang] || 'txt';
+    const file = join(outDir, `${String(b.index).padStart(2, '0')}.${ext}`);
+    writeFileSync(file, b.code.endsWith('\n') || b.code === '' ? b.code : `${b.code}\n`);
+    return { index: b.index, lang: b.lang, runnable: true, file };
+  });
+  return {
+    blocks: written.map(({ code, ...rest }) => rest),
+    runnableCount: written.filter((b) => b.runnable).length,
+    outputBlockCount: written.filter((b) => !b.runnable).length,
+  };
+}

package/lib/cover_gen.mjs

@@ -77,7 +77,12 @@ export function mergeManifestEntries(cloneDir, config) {
   for (const p of (config.projects || [])) {
     const { entries, status, reason } = readProjectManifest(cloneDir, p.key);
     if (status === 'failed') throw new Error(reason);
-    for (const e of entries) merged.push({ ...e, project: p.key });
+    for (const e of entries) {
+      // Tombstoned rows (removed: true) are editorial retirements, not entries —
+      // they must never surface as backfill candidates or reference covers.
+      if (e && e.removed) continue;
+      merged.push({ ...e, project: p.key });
+    }
   }
   return merged;
 }

package/lib/lint_post.mjs

@@ -110,8 +110,42 @@ export function extractSourceUrls(sectionContent) {
   return urls;
 }
 
+// Voice-contract bans that are safe to check deterministically (the fuller
+// contract — hedge words, staccato rhythm, closers — stays with the judge,
+// where context can tell a false positive from a violation). Phrases are the
+// user's own explicit bans from voice-notes.md.
+export const VOICE_BANNED_PHRASES = [
+  /\bhonestly,/i,
+  /\bI keep seeing\b/i,
+  /isn't a bug, it's/i,
+  /not a bug, a feature/i,
+  /\bthe problem isn't\b/i,
+  /here's what stuck with me/i,
+];
+
+// Sections whose text is template punctuation or verbatim quoted data, exempt
+// from voice rules per SKILL.md (the `## Sources` em dash is fixed template
+// punctuation; `## Changelog` quotes commit subjects as-is).
+const VOICE_EXEMPT_SECTIONS = new Set(['Sources', 'Changelog']);
+
+// Prose lines of the non-exempt sections: fenced code excluded.
+function voiceCheckableLines(sections) {
+  const out = [];
+  for (const s of sections) {
+    if (VOICE_EXEMPT_SECTIONS.has(s.heading)) continue;
+    let inFence = false;
+    for (const line of s.content.split('\n')) {
+      if (/^```/.test(line)) { inFence = !inFence; continue; }
+      if (!inFence) out.push({ heading: s.heading, line });
+    }
+  }
+  return out;
+}
+
 // Lint a post. Returns { ok, findings: [{ rule, message }] }.
-export function lintPost(content, { minSources = 3, filename = null } = {}) {
+// `voice: true` adds the deterministic voice-contract rules — opt-in so the
+// eval harness and non-voice callers keep their existing behavior.
+export function lintPost(content, { minSources = 3, filename = null, voice = false } = {}) {
   const findings = [];
   const add = (rule, message) => findings.push({ rule, message });
 
@@ -194,5 +228,17 @@ export function lintPost(content, { minSources = 3, filename = null } = {}) {
     add('fence-untagged', `Code fence at body line ${line} has no language tag.`);
   }
 
+  if (voice) {
+    for (const { heading, line } of voiceCheckableLines(sections)) {
+      if (line.includes('—')) {
+        add('voice-em-dash', `Em dash in \`## ${heading}\` prose ("${line.trim().slice(0, 60)}…") — the voice contract bans them; use a comma, semicolon, or split the sentence.`);
+      }
+      for (const re of VOICE_BANNED_PHRASES) {
+        const m = re.exec(line);
+        if (m) add('voice-banned-phrase', `Banned phrase "${m[0]}" in \`## ${heading}\` — rewrite per voice-notes.md.`);
+      }
+    }
+  }
+
   return { ok: findings.length === 0, findings };
 }

package/lib/publish_entry.mjs

@@ -5,7 +5,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, statSync, openSync, readSync, closeSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { RE_PROJECT_KEY, RE_FINAL_RELEASE, atomicWriteJSON } from './core.mjs';
-import { parseFrontmatter } from './lint_post.mjs';
+import { parseFrontmatter, splitSections } from './lint_post.mjs';
 
 const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
 
@@ -55,6 +55,81 @@ function sortEntries(entries) {
     String(b.date).localeCompare(String(a.date)) || compareVersionsDesc(a, b));
 }
 
+// Tombstoned rows have no date, so they'd sort arbitrarily among the live
+// feed rows — keep the live entries date-sorted and park tombstones at the end.
+function sortManifestEntries(entries) {
+  const live = entries.filter((e) => !(e && e.removed));
+  const removed = entries.filter((e) => e && e.removed);
+  return [...sortEntries(live), ...removed];
+}
+
+function readManifestIfExists(manifestPath) {
+  if (!existsSync(manifestPath)) return { entries: [] };
+  const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+  if (!manifest || !Array.isArray(manifest.entries)) {
+    throw new Error(`Malformed manifest at ${manifestPath}: expected { "entries": [...] }.`);
+  }
+  return manifest;
+}
+
+// Commit hashes referenced by a post's `## Changelog` section, normalized to
+// their 7-char short form so a short link text matches its full-hash URL.
+// Only hash-shaped tokens in link syntax count — `[abc1234](...)` texts and
+// `/commit/<hash>` URLs — never bare hex words in prose.
+export function extractChangelogHashes(body) {
+  const section = splitSections(body).find((s) => s.heading === 'Changelog');
+  const hashes = new Set();
+  if (!section) return hashes;
+  for (const m of section.content.matchAll(/\[([0-9a-f]{7,40})\]/g)) hashes.add(m[1].slice(0, 7));
+  for (const m of section.content.matchAll(/\/commit\/([0-9a-f]{7,40})\b/g)) hashes.add(m[1].slice(0, 7));
+  return hashes;
+}
+
+// A commit belongs to exactly one post's Changelog (SKILL.md 3b) — in a
+// monorepo, one commit range can feed several projects' releases, and letting
+// both posts list it produced twin entries with identical Changelogs. Walks
+// every live published entry in the clone and throws on the first collision.
+function assertNoChangelogCollision(cloneDir, project, version, draftBody) {
+  const draftHashes = extractChangelogHashes(draftBody);
+  if (draftHashes.size === 0) return;
+
+  let dirents;
+  try {
+    dirents = readdirSync(cloneDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const dirent of dirents) {
+    if (!dirent.isDirectory()) continue;
+    let manifest;
+    try {
+      manifest = readManifestIfExists(join(cloneDir, dirent.name, 'manifest.json'));
+    } catch {
+      continue; // a sibling project's broken manifest must not block this publish
+    }
+    for (const entry of manifest.entries) {
+      if (!entry || entry.removed || !entry.file) continue;
+      if (dirent.name === project && entry.version === version) continue; // self (idempotent republish)
+      const entryPath = join(cloneDir, dirent.name, entry.file);
+      if (!existsSync(entryPath)) continue;
+      let published;
+      try {
+        published = parseFrontmatter(readFileSync(entryPath, 'utf8'));
+      } catch {
+        continue;
+      }
+      for (const hash of extractChangelogHashes(published.body)) {
+        if (draftHashes.has(hash)) {
+          throw new Error(
+            `Commit ${hash} already appears in ${dirent.name}/${entry.file}'s Changelog — ` +
+            `a commit belongs to exactly one post's Changelog (SKILL.md 3b); drop it from this draft's Changelog.`
+          );
+        }
+      }
+    }
+  }
+}
+
 // `no` is a single sequence across ALL projects (issue numbers of one
 // publication, not per-project counters), but manifests are stored one per
 // project — so "next" means "scan every project's manifest under cloneDir and
@@ -104,16 +179,33 @@ export function publishEntry({ cloneDir, project, version, entryPath, coverImage
 
   const projectDir = join(cloneDir, project);
   const destPath = join(projectDir, `${version}.md`);
+  const manifestPath = join(projectDir, 'manifest.json');
+  const manifest = readManifestIfExists(manifestPath);
+
+  // Tombstone refusal comes before the file check: a tombstoned release's .md
+  // is gone by definition, and re-generating it is exactly the failure this
+  // state exists to prevent (an editorially moved/consolidated entry must
+  // never come back on a later run).
+  const tombstoned = manifest.entries.find((e) => e && e.removed && e.version === version);
+  if (tombstoned) {
+    throw new Error(
+      `Entry ${project}/${version} is tombstoned` +
+      (tombstoned.reason ? ` (${tombstoned.reason})` : '') +
+      ' — this release was editorially retired, refusing to republish.'
+    );
+  }
   if (existsSync(destPath)) {
     throw new Error(`Entry ${project}/${version}.md already exists — a cut release is immutable, refusing to overwrite.`);
   }
 
   const content = readFileSync(entryPath, 'utf8');
-  const { data } = parseFrontmatter(content);
+  const { data, body } = parseFrontmatter(content);
   if (!data || !data.title || !data.date || !data.summary) {
     throw new Error('Entry frontmatter must include title, date, and summary (run lint-post first).');
   }
 
+  assertNoChangelogCollision(cloneDir, project, version, body);
+
   mkdirSync(projectDir, { recursive: true });
   copyFileSync(entryPath, destPath);
 
@@ -128,15 +220,6 @@ export function publishEntry({ cloneDir, project, version, entryPath, coverImage
     writeFileSync(join(projectDir, coverFile), coverImageBuffer);
   }
 
-  const manifestPath = join(projectDir, 'manifest.json');
-  let manifest = { entries: [] };
-  if (existsSync(manifestPath)) {
-    manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-    if (!manifest || !Array.isArray(manifest.entries)) {
-      throw new Error(`Malformed manifest at ${manifestPath}: expected { "entries": [...] }.`);
-    }
-  }
-
   const file = `${version}.md`;
   // Idempotent: legacy manifests may already reference this file/version even
   // when the .md was missing — never duplicate an index row.
@@ -159,7 +242,7 @@ export function publishEntry({ cloneDir, project, version, entryPath, coverImage
       no,
       ...(coverFile ? { cover: { file: coverFile, bytes: coverImageBuffer.length } } : {}),
     });
-    manifest.entries = sortEntries(manifest.entries);
+    manifest.entries = sortManifestEntries(manifest.entries);
     atomicWriteJSON(manifestPath, manifest);
     manifestUpdated = true;
   }
@@ -167,6 +250,120 @@ export function publishEntry({ cloneDir, project, version, entryPath, coverImage
   return { written: destPath, manifestUpdated, coverWritten: !!coverFile, no };
 }
 
+// Editorially retire a release: after an entry is manually moved, consolidated,
+// or deleted in the target repo, its (project, version) identity must keep
+// suppressing generation forever — scan reports it as `entry-tombstoned` and
+// publish-entry refuses it. Creates the project manifest if the whole directory
+// was removed (the market-research case). Refuses to tombstone a LIVE entry
+// (its .md still on disk): move or delete the entry first, deliberately, then
+// tombstone the identity it left behind.
+export function tombstoneEntry({ cloneDir, project, version, reason }) {
+  if (!RE_PROJECT_KEY.test(project) || project.includes('..')) {
+    throw new Error(`Invalid project key: ${JSON.stringify(project)}`);
+  }
+  if (!RE_FINAL_RELEASE.test(version)) {
+    throw new Error(`Invalid version label (must be v<digits.digits...>): ${JSON.stringify(version)}`);
+  }
+  if (typeof reason !== 'string' || reason.trim() === '' || /[\x00-\x1f]/.test(reason)) {
+    throw new Error('A tombstone requires a non-empty --reason (where did the entry go, and why?).');
+  }
+  if (!existsSync(cloneDir)) throw new Error(`Clone directory not found: ${cloneDir}`);
+
+  const projectDir = join(cloneDir, project);
+  const manifestPath = join(projectDir, 'manifest.json');
+  const manifest = readManifestIfExists(manifestPath);
+
+  const idx = manifest.entries.findIndex((e) => e && e.version === version);
+  if (idx !== -1 && manifest.entries[idx].removed) {
+    return { tombstoned: false, already: true, project, version };
+  }
+
+  const file = `${version}.md`;
+  if (idx !== -1 && existsSync(join(projectDir, manifest.entries[idx].file || file))) {
+    throw new Error(
+      `${project}/${version} is a live published entry — tombstone marks an identity whose ` +
+      'file was editorially moved or deleted; remove/move the entry file first, then tombstone.'
+    );
+  }
+
+  const prior = idx !== -1 ? manifest.entries[idx] : null;
+  const row = {
+    version,
+    file: prior?.file || file,
+    removed: true,
+    reason: reason.trim(),
+    // A dead row that already held a frozen `no` keeps it — numbers are never
+    // reused, and dropping the max would let the next publish re-issue it.
+    ...(prior && Number.isInteger(prior.no) ? { no: prior.no } : {}),
+  };
+  if (idx !== -1) manifest.entries[idx] = row;
+  else manifest.entries.push(row);
+
+  mkdirSync(projectDir, { recursive: true });
+  manifest.entries = sortManifestEntries(manifest.entries);
+  atomicWriteJSON(manifestPath, manifest);
+  return { tombstoned: true, project, version, manifest: manifestPath };
+}
+
+// Post-publish metadata resync: entry prose edits are the user's call, but the
+// manifest's title/summary/date/tags (what the site index, RSS, and covers
+// read) previously had no legitimate way to follow — a hand-edited post left
+// them stale for hours while "rebuilds" chased phantom caches. Reads the
+// PUBLISHED .md in the clone and replaces exactly those four fields on its
+// manifest row. Never touches `no`, `version`, `file`, or `cover`; reports
+// `coverStale` so the caller knows a cover derived from the old title may need
+// regenerating.
+export function syncEntryFromFrontmatter({ cloneDir, project, slug }) {
+  if (!RE_PROJECT_KEY.test(project) || project.includes('..')) {
+    throw new Error(`Invalid project key: ${JSON.stringify(project)}`);
+  }
+  assertSafeSlug(slug);
+  if (!existsSync(cloneDir)) throw new Error(`Clone directory not found: ${cloneDir}`);
+
+  const projectDir = join(cloneDir, project);
+  const manifestPath = join(projectDir, 'manifest.json');
+  if (!existsSync(manifestPath)) {
+    throw new Error(`No manifest found for project "${project}" at ${manifestPath}`);
+  }
+  const manifest = readManifestIfExists(manifestPath);
+
+  const idx = manifest.entries.findIndex(
+    (e) => e && (e.version === slug || (e.file && e.file.replace(/\.md$/, '') === slug))
+  );
+  if (idx === -1) {
+    throw new Error(`No manifest row for ${project}/${slug} — nothing to sync.`);
+  }
+  const entry = manifest.entries[idx];
+  if (entry.removed) {
+    throw new Error(`${project}/${slug} is tombstoned — there is no entry to sync.`);
+  }
+
+  const entryFilePath = join(projectDir, entry.file);
+  if (!existsSync(entryFilePath)) {
+    throw new Error(`Published entry file not found at ${entryFilePath} — sync reads the clone's .md, not a draft.`);
+  }
+  const { data } = parseFrontmatter(readFileSync(entryFilePath, 'utf8'));
+  if (!data || !data.title || !data.date || !data.summary) {
+    throw new Error('Published entry frontmatter must include title, date, and summary (run lint-post on it first).');
+  }
+
+  const next = {
+    ...entry,
+    date: String(data.date),
+    title: String(data.title),
+    summary: String(data.summary),
+    tags: Array.isArray(data.tags) ? data.tags : [],
+  };
+  const changedFields = ['date', 'title', 'summary', 'tags'].filter(
+    (k) => JSON.stringify(entry[k]) !== JSON.stringify(next[k])
+  );
+  manifest.entries[idx] = next;
+  manifest.entries = sortManifestEntries(manifest.entries);
+  atomicWriteJSON(manifestPath, manifest);
+
+  return { synced: true, project, slug, changedFields, coverStale: !!entry.cover };
+}
+
 // Backfill path only: add a cover to an entry that was already published without one.
 // Never writes/reads <slug>.md, never pushes a new manifest row — its only mutation is the
 // `cover` field of an already-existing entry, keyed by that entry's version/file stem.

package/lib/scan.mjs

@@ -66,10 +66,11 @@ function git(projectPath, args) {
   return execArgs('git', ['-C', projectPath, ...args]);
 }
 
-// Scan one project's local clone. Pure git — the caller supplies the set of
-// entry filenames that already exist in the target repo (existingFiles), so
-// this function stays testable against throwaway fixture repos.
-export function scanProject(project, { branch = 'main', fetch = true, existingFiles = new Set() } = {}) {
+// Scan one project's local clone. Pure git — the caller supplies what already
+// exists in the target repo (`existing`: entry filenames, live manifest
+// versions, and tombstoned versions), so this function stays testable against
+// throwaway fixture repos.
+export function scanProject(project, { branch = 'main', fetch = true, existing = emptyExisting() } = {}) {
   const out = {
     key: project.key,
     label: project.label || project.key,
@@ -119,7 +120,14 @@ export function scanProject(project, { branch = 'main', fetch = true, existingFi
 
   for (let i = 0; i < releases.length; i++) {
     const { tag, version } = releases[i];
-    if (existingFiles.has(`${version}.md`)) {
+    // Tombstone check comes first: a tombstoned row also carries a `file`
+    // field, so the entry-exists check below would otherwise mask the more
+    // specific reason.
+    if (existing.removedVersions.has(version)) {
+      out.skippedTags.push({ tag, reason: 'entry-tombstoned' });
+      continue;
+    }
+    if (existing.versions.has(version) || existing.files.has(`${version}.md`)) {
       out.skippedTags.push({ tag, reason: 'entry-exists' });
       continue;
     }
@@ -185,22 +193,65 @@ function splitLogLine(line) {
   return [hash, subject, date];
 }
 
-// Which entry files already exist in the target repo for one project — a
-// single `gh api` directory listing (vs. the old one-probe-per-tag pattern).
-// Returns { files: Set, status: 'ok' | 'empty' | 'failed' }: a 404 means the
-// project has no entries yet; any other failure is surfaced so the caller
-// knows the entry-exists filter may be incomplete (publish-entry still refuses
-// overwrites against the fresh clone, so a stale scan cannot clobber anything).
+export function emptyExisting() {
+  return { files: new Set(), versions: new Set(), removedVersions: new Set(), entries: [] };
+}
+
+// What already exists in the target repo for one project. Entry identity is
+// project+version in the MANIFEST, not a filename: manifest rows survive
+// editorial file moves/consolidations, and a tombstoned row (`removed: true`)
+// keeps suppressing generation even after its .md is gone — the failure class
+// that re-armed three deleted entries in the first six runs. Fetches the
+// project's manifest.json (one `gh api` call); falls back to a directory
+// listing for legacy dirs with entries but no manifest yet.
+// Returns { files: Set, versions: Set, removedVersions: Set,
+//           entries: [{version, title, tags}] (live rows only),
+//           status: 'ok' | 'empty' | 'failed' }: 'empty' means the project has
+// no entries yet; 'failed' is surfaced so the caller knows the entry-exists
+// filter may be incomplete (publish-entry still refuses overwrites against the
+// fresh clone, so a stale scan cannot clobber anything).
 export function fetchExistingEntries(targetRepo, branch, projectKey, targetDir = '') {
   const contentPath = targetDir ? `${targetDir}/${projectKey}` : projectKey;
+  const m = spawnArgs('gh', ['api', `repos/${targetRepo}/contents/${contentPath}/manifest.json?ref=${branch}`, '--jq', '.content']);
+  if (m.status === 0) {
+    let manifest = null;
+    try {
+      manifest = JSON.parse(Buffer.from(m.stdout.replace(/\s/g, ''), 'base64').toString('utf8'));
+    } catch {
+      // Malformed manifest content — fall through to the directory listing.
+    }
+    if (manifest && Array.isArray(manifest.entries)) {
+      const out = { ...emptyExisting(), status: 'ok' };
+      for (const e of manifest.entries) {
+        if (!e) continue;
+        if (typeof e.file === 'string') out.files.add(e.file);
+        if (typeof e.version !== 'string' || e.version === '') continue;
+        if (e.removed) {
+          out.removedVersions.add(e.version);
+        } else {
+          out.versions.add(e.version);
+          out.entries.push({
+            version: e.version,
+            title: typeof e.title === 'string' ? e.title : null,
+            tags: Array.isArray(e.tags) ? e.tags : [],
+          });
+        }
+      }
+      return out;
+    }
+  } else if (!/HTTP 404|Not Found/i.test(m.stderr)) {
+    return { ...emptyExisting(), status: 'failed' };
+  }
+
+  // No manifest (or unparseable): legacy directory listing.
   const r = spawnArgs('gh', ['api', `repos/${targetRepo}/contents/${contentPath}?ref=${branch}`, '--jq', '.[].name']);
   if (r.status === 0) {
-    return { files: new Set(r.stdout.split('\n').filter(Boolean)), status: 'ok' };
+    return { ...emptyExisting(), files: new Set(r.stdout.split('\n').filter(Boolean)), status: 'ok' };
   }
   if (/HTTP 404|Not Found/i.test(r.stderr)) {
-    return { files: new Set(), status: 'empty' };
+    return { ...emptyExisting(), status: 'empty' };
   }
-  return { files: new Set(), status: 'failed' };
+  return { ...emptyExisting(), status: 'failed' };
 }
 
 // Full scan across the configured projects. `getExisting` is injectable for
@@ -219,9 +270,15 @@ export function scanAll(config, { projectKey = null, fetch = true, getExisting =
   }
 
   const results = projects.map((project) => {
-    const existing = getExisting(config.targetRepo, branch, project.key, config.targetDir || '');
-    const scanned = scanProject(project, { branch, fetch, existingFiles: existing.files });
+    // Normalized so an injected getExisting returning a partial shape (e.g. a
+    // legacy { files, status } double) can't crash the tombstone checks.
+    const existing = { ...emptyExisting(), status: 'ok', ...getExisting(config.targetRepo, branch, project.key, config.targetDir || '') };
+    const scanned = scanProject(project, { branch, fetch, existing });
     scanned.existenceCheck = existing.status;
+    // Live catalog rows for this project — the skill's topic-dedup input
+    // ("don't re-teach a guide the catalog already covers"), free with the
+    // manifest fetch above.
+    scanned.publishedEntries = existing.entries;
     return scanned;
   });
 
@@ -237,3 +294,25 @@ export function scanAll(config, { projectKey = null, fetch = true, getExisting =
     totalNewReleases: results.reduce((n, p) => n + p.newReleases.length, 0),
   };
 }
+
+// Compact plan-table view of a scanAll result: per release, drop the commit
+// list and diffstat (the bulky parts) for a commitCount; collapse skippedTags
+// to per-reason counts. publishedEntries stays — it's small and the skill's
+// topic-dedup input. Full detail remains one `scan --project <key>` away.
+export function summarizeScan(result) {
+  if (result.error) return result;
+  return {
+    ...result,
+    projects: result.projects.map((p) => ({
+      ...p,
+      newReleases: p.newReleases.map(({ commits, diffstat, ...release }) => ({
+        ...release,
+        commitCount: commits.length,
+      })),
+      skippedTags: p.skippedTags.reduce((acc, { reason }) => {
+        acc[reason] = (acc[reason] || 0) + 1;
+        return acc;
+      }, {}),
+    })),
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@natjswenson/devlog",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Release dev log generator \u2014 Claude Code skill + preview app for publishing version-release dev logs, written in your voice, to your site",
   "license": "MIT",
   "author": "Nate Swenson",
@@ -46,7 +46,9 @@
   },
   "scripts": {
     "test": "node --test \"tests/**/*.test.mjs\"",
-    "audit": "npm audit --audit-level=moderate"
+    "audit": "npm audit --audit-level=moderate",
+    "prepack": "cp ../../README.md ../../LICENSE ../../CHANGELOG.md .",
+    "postpack": "rm -f README.md LICENSE CHANGELOG.md"
   },
   "dependencies": {
     "@vitejs/plugin-react": "6.0.1",

package/skill-invariants.json

@@ -81,6 +81,26 @@
       "pattern": "this interactive review IS the quality gate for the cover",
       "rationale": "The rendered cover must be shown to the user before push, the same way Step 4 gates the prose — losing this line reopens publishing an unreviewed cover."
     },
+    {
+      "id": "ground-truth-gate",
+      "pattern": "verify each one with a git command run NOW",
+      "rationale": "The 6-run audit found a post that published a provably false premise about the author's own repo (resume/v1.0.1: 'two of four packages never got tags' — all four existed). Every repo-fact claim must be re-verified against git in-session before publish; losing this line reopens the fabricated-premise path."
+    },
+    {
+      "id": "no-unrun-output",
+      "pattern": "never label output as real[\\s\\S]{0,120}unless the command that produced it ran in\\s+this session",
+      "rationale": "Two audited posts claimed 'real output' over commands that never ran (v0.6.0's phantom fixtures, v0.10.0's internally-impossible scan table). Output honesty must be a hard rule, not a stylistic preference."
+    },
+    {
+      "id": "tombstone-never-republish",
+      "pattern": "editorially retired[\\s\\S]{0,80}skip it silently, never regenerate",
+      "rationale": "Deleted/moved entries re-armed generation three times in the first six runs (ghostwriter v0.8.1 twice, market-research v0.1.0). The tombstoned state must always mean 'never regenerate'."
+    },
+    {
+      "id": "one-commit-one-changelog",
+      "pattern": "refuses a draft whose Changelog repeats a commit",
+      "rationale": "Monorepo twin releases shipped identical Changelogs (resume v1.0.1 + ghostwriter v0.8.1); a commit belongs to exactly one post's Changelog and publish-entry enforces it."
+    },
     {
       "id": "cover-custom-illustration",
       "pattern": "cover that just re-renders the title in large text is a failure",
@@ -95,5 +115,30 @@
       "rationale": "The catalog-icon/hero-zone overlap check must stay wired into renderCoverImage() — losing it silently reopens the gap where a catalog icon (or two, connected by a line) can stand in for the required bespoke hero illustration."
     }
   ],
-  "cli_commands_referenced": ["scan", "lint-post", "publish-entry", "add-project", "remove-project", "set", "config", "init", "cover-context", "render-cover"]
+  "cli_commands_referenced": [
+    "scan",
+    "lint-post",
+    "publish-entry",
+    "add-project",
+    "remove-project",
+    "set",
+    "config",
+    "init",
+    "cover-context",
+    "render-cover",
+    "tombstone",
+    "sync-entry",
+    "assemble-post"
+  ],
+  "_baseline_comment": "Baseline eval sets: deterministic, offline, $0 checks pinned against artifacts from real local runs. These gate `ci / devlog` alongside the unit tests. Every entry names the test that enforces it so tools/lint_baseline.py can verify the declaration is not aspirational.",
+  "baseline": [
+    {
+      "id": "published-entries-still-lint-clean",
+      "kind": "corpus",
+      "test": "tests/baseline.test.mjs",
+      "corpus_glob": "evals/baseline/published/*.md",
+      "min_corpus": 8,
+      "rationale": "tests/lint_post.test.mjs unit-tests each rule against small crafted inputs and tests/evals.test.mjs drives the good/bad/irreproducible fixtures through the judge. All of those are hand-authored to exercise the rules; none answers whether the linter still accepts the real thing. evals/baseline/published/ holds eight entries copied verbatim from natejswenson.io — posts that went through the full pipeline, were reviewed, and are live — so 'this passes' means 'a human shipped this and stands behind it'. A rule that grows too strict starts rejecting work like this, and the cost lands at publish time on a real release. Deliberately a CURATED subset: of 61 published entries only 17 satisfy today's contract, the rest predating rules that landed later (the 5-10 tags-count range especially). Those are stale, not bad — asserting over all 61 would encode 'the linter must accept its own history', a different and wrong requirement. Paired negative assertions (bad-post.md must still produce findings; the three required-section rules must still fire) stop the corpus passing vacuously against a linter that returned nothing."
+    }
+  ]
 }