@open-agent-toolkit/cli 0.2.65 → 0.2.67

package/dist/commands/pjm/remote/verification.js

@@ -0,0 +1,100 @@
+import { createHash } from 'node:crypto';
+const FIELD_ORDER = [
+    'title',
+    'description',
+    'priority',
+];
+export function buildVerificationRequestDigest(input) {
+    const fieldMask = normalizeFieldMask(input.requested.fieldMask);
+    return hashCanonical({
+        operationId: input.operationId,
+        fieldMask,
+        expected: Object.fromEntries(fieldMask.map((field) => [field, input.requested.expected[field]])),
+        attemptedRevisionDigest: input.revisionEvidence.attemptedRevisionDigest,
+    });
+}
+export function verifyRemotePostconditions(input) {
+    const fieldMask = normalizeFieldMask(input.requested.fieldMask);
+    for (const field of fieldMask) {
+        if (!Object.hasOwn(input.requested.expected, field)) {
+            throw new Error(`Requested field '${field}' has no expected value.`);
+        }
+    }
+    const requestDigest = buildVerificationRequestDigest(input);
+    if (input.priorVerification?.classification === 'verified' &&
+        input.priorVerification.requestDigest === requestDigest) {
+        return result('already-verified', 'durable-verification-match', requestDigest, [], false);
+    }
+    if (input.providerOutcome === 'rejected') {
+        return result('rejected', 'provider-rejected', requestDigest, unavailableFields(input, fieldMask), false);
+    }
+    if (input.providerOutcome === 'ambiguous') {
+        return result('uncertain', 'ambiguous-provider-outcome', requestDigest, unavailableFields(input, fieldMask), true);
+    }
+    if (input.revisionEvidence.readbackBaseRevisionDigest !==
+        input.revisionEvidence.attemptedRevisionDigest) {
+        return result('uncertain', 'revision-drift', requestDigest, unavailableFields(input, fieldMask), true);
+    }
+    if (!input.readback) {
+        return result('uncertain', 'missing-readback', requestDigest, unavailableFields(input, fieldMask), true);
+    }
+    const fields = fieldMask.map((field) => verifyField(field, input.requested.expected[field], input.readback));
+    const verifiedCount = fields.filter((field) => field.status === 'verified').length;
+    const unavailableCount = fields.filter((field) => field.status === 'unavailable').length;
+    if (verifiedCount === fields.length) {
+        return result('verified', 'postconditions-verified', requestDigest, fields, false);
+    }
+    if (verifiedCount > 0) {
+        return result('partial', 'partial-postconditions', requestDigest, fields, true);
+    }
+    if (unavailableCount > 0) {
+        return result('uncertain', 'incomplete-readback', requestDigest, fields, true);
+    }
+    return result('uncertain', 'postconditions-mismatched', requestDigest, fields, true);
+}
+function verifyField(field, expected, readback) {
+    const expectedHash = hashCanonical(expected);
+    if (readback.unavailableFields.includes(field) ||
+        !Object.hasOwn(readback.values, field)) {
+        return { field, expectedHash, observedHash: null, status: 'unavailable' };
+    }
+    const observed = readback.values[field];
+    return {
+        field,
+        expectedHash,
+        observedHash: hashCanonical(observed),
+        status: observed === expected ? 'verified' : 'mismatch',
+    };
+}
+function unavailableFields(input, fieldMask) {
+    return fieldMask.map((field) => ({
+        field,
+        expectedHash: hashCanonical(input.requested.expected[field]),
+        observedHash: null,
+        status: 'unavailable',
+    }));
+}
+function result(classification, reason, requestDigest, fields, requiresReconciliation) {
+    return {
+        classification,
+        reason,
+        requestDigest,
+        fields,
+        retryDisposition: requiresReconciliation
+            ? 'reconcile-required'
+            : 'not-applicable',
+        requiresReconciliation,
+    };
+}
+function normalizeFieldMask(fieldMask) {
+    const unique = new Set(fieldMask);
+    if (fieldMask.length === 0 || unique.size !== fieldMask.length) {
+        throw new Error('Verification field mask must be non-empty and unique.');
+    }
+    return FIELD_ORDER.filter((field) => unique.has(field));
+}
+function hashCanonical(value) {
+    return `sha256:${createHash('sha256')
+        .update(JSON.stringify(value))
+        .digest('hex')}`;
+}

package/dist/commands/project/dispatch-ceiling/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/dispatch-ceiling/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAkB9B,OAAO,EAUL,KAAK,uBAAuB,EAY7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAC;AA6BzB,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAiC5C,UAAU,2BAA2B;IACnC,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7E,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AA0wFD,wBAAgB,mCAAmC,CACjD,SAAS,GAAE,OAAO,CAAC,2BAA2B,CAAM,GACnD,OAAO,CA0GT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/dispatch-ceiling/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAkB9B,OAAO,EAUL,KAAK,uBAAuB,EAY7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAC;AA6BzB,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAiC5C,UAAU,2BAA2B;IACnC,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7E,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AAkyFD,wBAAgB,mCAAmC,CACjD,SAAS,GAAE,OAAO,CAAC,2BAA2B,CAAM,GACnD,OAAO,CA0GT"}

package/dist/commands/project/dispatch-ceiling/index.js

@@ -8,6 +8,7 @@ import { normalizeDispatchMatrix } from '../../../config/dispatch-matrix.js';
 import { effectiveTerminalReviewerTarget, formatDispatchNotices, terminalReviewerNoticeForTarget, } from '../../../config/dispatch-notices.js';
 import { getDispatchPolicyChoices, managedDispatchPolicyValueList, renderDispatchPolicyChoicesMarkdown, } from '../../../config/dispatch-policy-options.js';
 import { resolveActiveProject, VALID_CLAUDE_DISPATCH_CEILINGS, VALID_CODEX_DISPATCH_CEILINGS, VALID_DISPATCH_MATRIX_TIERS, VALID_MANAGED_DISPATCH_POLICIES, isWorkflowDispatchCandidateLadder, isWorkflowDispatchFallbackRoute, toWorkflowDispatchCandidateLadder, validateDispatchRouteTarget, } from '../../../config/oat-config.js';
+import { getOwnKey, setOwnKey } from '../../../config/own-keys.js';
 import { resolveEffectiveConfig, } from '../../../config/resolve.js';
 import { resolveProjectRoot } from '../../../fs/paths.js';
 import TOML from '@iarna/toml';
@@ -141,13 +142,17 @@ function isProjectMatrixRecord(value) {
 }
 function toProjectMatrixCompatibility(rawMatrix, matrix) {
     const compatibility = {};
+    // The normalized matrix now keeps a provider named `__proto__` as an own
+    // key, so `Object.entries` yields it here: assignment would drop a scalar
+    // entry and install a tier map as this output's prototype.
     for (const [provider, providerValue] of Object.entries(matrix)) {
         if (typeof providerValue === 'string') {
-            compatibility[provider] = providerValue;
+            setOwnKey(compatibility, provider, providerValue);
             continue;
         }
-        const rawProvider = isProjectMatrixRecord(rawMatrix[provider])
-            ? rawMatrix[provider]
+        const rawProviderValue = getOwnKey(rawMatrix, provider);
+        const rawProvider = isProjectMatrixRecord(rawProviderValue)
+            ? rawProviderValue
             : {};
         const tiers = {};
         for (const [tier, cell] of Object.entries(providerValue)) {
@@ -167,7 +172,7 @@ function toProjectMatrixCompatibility(rawMatrix, matrix) {
             }
             tiers[matrixTier] = cell;
         }
-        compatibility[provider] = tiers;
+        setOwnKey(compatibility, provider, tiers);
     }
     return compatibility;
 }
@@ -346,7 +351,7 @@ function resolveProviderMatrixCell(provider, tier, resolvedConfig, projectMatrix
         { source: 'project-state', providers: projectMatrix },
     ];
     for (const layer of layers) {
-        const resolved = resolveProviderCellFromValue(provider, layer.providers?.[provider], tier, layer.source, escalationLevel);
+        const resolved = resolveProviderCellFromValue(provider, layer.providers ? getOwnKey(layer.providers, provider) : undefined, tier, layer.source, escalationLevel);
         if (resolved) {
             selected = resolved;
         }
@@ -371,7 +376,9 @@ function resolveProviderMatrixCellDefinition(provider, tier, resolvedConfig, pro
         { source: 'project-state', providers: projectMatrix },
     ];
     for (const layer of layers) {
-        const providerValue = layer.providers?.[provider];
+        const providerValue = layer.providers
+            ? getOwnKey(layer.providers, provider)
+            : undefined;
         if (typeof providerValue === 'string') {
             selected = null;
             continue;
@@ -1305,17 +1312,20 @@ function mergeEffectiveDispatchMatrix(resolvedConfig) {
         resolvedConfig.local.workflow?.dispatchCeiling?.providers,
     ];
     for (const providers of layers) {
+        // Provider names come from user config, which now preserves a key named
+        // `__proto__` as an own key, so `Object.entries` yields it here. Plain
+        // member access would reinstall it as this map's prototype and lose it.
         for (const [provider, value] of Object.entries(providers ?? {})) {
-            const previous = merged[provider];
-            merged[provider] =
-                typeof value === 'object' &&
-                    value !== null &&
-                    !Array.isArray(value) &&
-                    typeof previous === 'object' &&
-                    previous !== null &&
-                    !Array.isArray(previous)
-                    ? { ...previous, ...value }
-                    : value;
+            const previous = getOwnKey(merged, provider);
+            const mergedValue = typeof value === 'object' &&
+                value !== null &&
+                !Array.isArray(value) &&
+                typeof previous === 'object' &&
+                previous !== null &&
+                !Array.isArray(previous)
+                ? { ...previous, ...value }
+                : value;
+            setOwnKey(merged, provider, mergedValue);
         }
     }
     return merged;
@@ -1648,7 +1658,9 @@ function writeHumanResolution(context, resolution) {
     context.logger.info(`${label} dispatch policy: ${policyLabel(resolution.policy)}`);
     context.logger.info(`Resolved cap: ${resolution.value ?? 'none'}`);
     context.logger.info(`Source: ${sourceLabel(resolution.source)}`);
-    const providerResolution = resolution.providers[resolution.provider];
+    // `resolution.provider` is an open string union carrying a user-supplied
+    // `--provider` value, so an unowned prototype name must read as absent.
+    const providerResolution = getOwnKey(resolution.providers, resolution.provider);
     if (providerResolution) {
         context.logger.info(`Mode: ${providerResolution.mode} (${providerResolution.mechanism})`);
         context.logger.info(`Selection: ${providerResolution.selection.selectionMode}`);
@@ -1760,7 +1772,9 @@ function buildResolutionReport(resolution, options) {
     }
     const action = options.reportAction;
     const role = reportRole(action);
-    const providerResolution = resolution.providers[resolution.provider];
+    // `resolution.provider` is an open string union carrying a user-supplied
+    // `--provider` value, so an unowned prototype name must read as absent.
+    const providerResolution = getOwnKey(resolution.providers, resolution.provider);
     if (!providerResolution) {
         throw new Error(`Dispatch report resolution is missing provider data for "${resolution.provider}".`);
     }

package/dist/commands/project/log/append.d.ts

@@ -2,6 +2,7 @@ import { type CommandContext, type GlobalOptions } from '../../../app/command-co
 import { type ActiveProjectResolution } from '../../../config/oat-config.js';
 import { type ResolvedConfig } from '../../../config/resolve.js';
 import { Command } from 'commander';
+import { type ProjectLogSeal } from './check.js';
 export declare const PROJECT_LOG_FILENAME = "project-log.md";
 /**
  * Directory, relative to a project, that holds gate partial-finalization
@@ -34,6 +35,25 @@ export interface ProjectLogLockDependencies {
     now: () => number;
 }
 export declare function projectLogLockPath(logPath: string): string;
+/**
+ * Runs `mutate` with the log's advisory lock held, releasing it on every path.
+ *
+ * `required` is for mutations that rewrite the file. Running one of those
+ * without the lock is exactly the read/modify/write race this exists to close,
+ * so an unavailable lock refuses rather than proceeding: a loud, retryable
+ * failure that the caller reports is strictly better than a silent clobber of
+ * another writer's entry, and the recovery command replays the append safely.
+ *
+ * `best-effort` is for work that cannot lose an entry — committing does not
+ * rewrite the log — where holding the lock only keeps this process from racing
+ * its own sibling into `.git/index.lock`.
+ *
+ * Exported so `synthesize` enters the same critical section rather than a
+ * second one of its own: its whole-file rewrite races an overlapping append
+ * exactly as two appends race each other, and two locks would serialize
+ * neither.
+ */
+export declare function withProjectLogLock<T>(logPath: string, overrides: Partial<ProjectLogLockDependencies>, policy: 'required' | 'best-effort', mutate: () => Promise<T>): Promise<T>;
 export type GitLockFailureClass = 'transient-index-lock' | 'persistent-index-lock' | 'other';
 export type ProjectLogCommitOutcome = 'committed' | 'already-committed' | 'nothing-to-commit' | 'not-a-repo' | 'blocked-by-index-lock' | 'entry-missing-after-commit' | 'commit-unverified' | 'failed';
 export interface ProjectLogCommitResult {
@@ -186,11 +206,39 @@ export interface AppendProjectLogInput {
     versionNote?: string;
     idempotencyKey?: string;
 }
+/**
+ * Raised when an append that is not the completion seal targets a sealed log.
+ *
+ * This is a throw rather than a fourth `ProjectLogAppendResult` variant because
+ * every in-tree caller of `appendProjectLog` runs *before* the seal: the gate's
+ * partial-finalization receipt narrows the result's `status` into its own
+ * `'appended' | 'already-appended'` field, so widening the union would force a
+ * change on a caller that can never legitimately reach this state. Throwing
+ * refuses that caller too — the command layer maps this to
+ * `status: 'sealed'` with a non-zero exit, and any other caller fails loudly
+ * instead of silently appending past the seal.
+ */
+export declare class ProjectLogSealedError extends Error {
+    readonly logPath: string;
+    readonly seal: ProjectLogSeal;
+    /**
+     * `action` names the refused mutation so `synthesize`, which rewrites rather
+     * than appends, reports what it actually declined. It defaults to `append`,
+     * which is the wording every existing caller and its pinned control expect.
+     */
+    constructor(logPath: string, seal: ProjectLogSeal, action?: string);
+}
 export type ProjectLogAppendResult = {
     status: 'appended';
     logPath: string;
     heading: string;
     created: boolean;
+    /**
+     * Present and true when the accepted `--body` carried CRLF and was stored
+     * as LF. The command reports it rather than normalizing silently, because
+     * the bytes on disk then differ from the bytes the caller passed.
+     */
+    normalizedLineEndings?: true;
 } | {
     status: 'already-appended';
     logPath: string;

package/dist/commands/project/log/append.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/append.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAI9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAGrD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,eAAO,MAAM,kCAAkC,EAAE,SAAS,MAAM,EAAe,CAAC;AAuBhF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAC9C,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AA+CD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAM1D;AA8RD,MAAM,MAAM,mBAAmB,GAC3B,sBAAsB,GACtB,uBAAuB,GACvB,OAAO,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAC/B,WAAW,GACX,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,uBAAuB,GACvB,4BAA4B,GAC5B,mBAAmB,GACnB,QAAQ,CAAC;AAEb,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC;;;;OAIG;IACH,IAAI,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;CACtD;AAoGD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,oBAAoB,CAAC,EAAE,MAAM,GAC5B,mBAAmB,CAWrB;AAuCD;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AA4CzE;;;;;;;GAOG;AACH,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,yBAAyB,CAAC,CAOpC;AA2ND;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,SAAS,GAAE,OAAO,CAAC,4BAA4B,CAAM,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAkBjC;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAwBpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAC9C,YAAY,EAAE,uBAAuB,CAAC;IACtC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB,GACD;IACE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;CAChB,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;CAC5B,CAAC;AAEN,MAAM,WAAW,4BAA4B;IAC3C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7E,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KACpB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC3C;AA+BD,MAAM,WAAW,mCAAoC,SAAQ,4BAA4B;IACvF,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAwND,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,MAAM,CAOR;AAyCD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,SAAS,GAAE,OAAO,CAAC,4BAA4B,CAAM,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAQjC;AAsUD,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,OAAO,CAAC,mCAAmC,CAAM,GAC3D,OAAO,CAuDT"}
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/append.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAI9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,SAAS,CAAC;AAqBjB,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAGrD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,eAAO,MAAM,kCAAkC,EAAE,SAAS,MAAM,EAAe,CAAC;AAuBhF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAC9C,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AA+CD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAM1D;AA8PD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,CAAC,0BAA0B,CAAC,EAC9C,MAAM,EAAE,UAAU,GAAG,aAAa,EAClC,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED,MAAM,MAAM,mBAAmB,GAC3B,sBAAsB,GACtB,uBAAuB,GACvB,OAAO,CAAC;AAEZ,MAAM,MAAM,uBAAuB,GAC/B,WAAW,GACX,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,uBAAuB,GACvB,4BAA4B,GAC5B,mBAAmB,GACnB,QAAQ,CAAC;AAEb,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC;;;;OAIG;IACH,IAAI,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC1C;;;;OAIG;IACH,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;CACtD;AAoGD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,oBAAoB,CAAC,EAAE,MAAM,GAC5B,mBAAmB,CAWrB;AAuCD;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AA4CzE;;;;;;;GAOG;AACH,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,yBAAyB,CAAC,CAOpC;AA2ND;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,SAAS,GAAE,OAAO,CAAC,4BAA4B,CAAM,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAkBjC;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAwBpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAC9C,YAAY,EAAE,uBAAuB,CAAC;IACtC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;;OAIG;IACH,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,SAAW,EAOnE;CACF;AAED,MAAM,MAAM,sBAAsB,GAC9B;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,IAAI,CAAC;CAC9B,GACD;IACE,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;CAChB,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;CAC5B,CAAC;AAEN,MAAM,WAAW,4BAA4B;IAC3C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7E,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KACpB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC3C;AA+BD,MAAM,WAAW,mCAAoC,SAAQ,4BAA4B;IACvF,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AA+PD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,MAAM,CAOR;AAyCD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,SAAS,GAAE,OAAO,CAAC,4BAA4B,CAAM,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAQjC;AA0bD,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,OAAO,CAAC,mCAAmC,CAAM,GAC3D,OAAO,CAyDT"}

package/dist/commands/project/log/append.js

@@ -12,7 +12,8 @@ import { resolveAssetsRoot } from '../../../fs/assets.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { resolveProjectRoot } from '../../../fs/paths.js';
 import { Command } from 'commander';
-import { composeJudgmentHeading, composeStructuralHeading, isProjectLogEntryMarker, isProjectLogSectionMarker, PROJECT_LOG_AREA_MAX_LENGTH, PROJECT_LOG_HEADING_DELIMITER, PROJECT_LOG_SCOPES, PROJECT_LOG_TYPES, } from './grammar.js';
+import { findProjectLogAmbiguity, findProjectLogSeal, unreachableProjectLogSealError, } from './check.js';
+import { composeJudgmentHeading, composeStructuralHeading, containsAmbiguousProjectLogMarker, isProjectLogEntryMarker, findProjectLogSealHeadingLine, isProjectLogSealHeading, isProjectLogSectionMarker, PROJECT_LOG_AREA_MAX_LENGTH, PROJECT_LOG_HEADING_DELIMITER, PROJECT_LOG_LINE_TERMINATOR_RE, PROJECT_LOG_LONE_TERMINATOR_RE, PROJECT_LOG_SCOPES, PROJECT_LOG_TYPES, normalizeProjectLogLineEndings, splitProjectLogLines, } from './grammar.js';
 export const PROJECT_LOG_FILENAME = 'project-log.md';
 const SYNTHESIS_HEADING_PREFIX = '\n## End-of-run synthesis';
 /**
@@ -331,8 +332,13 @@ function releaseProjectLogLock(handle) {
  * `best-effort` is for work that cannot lose an entry — committing does not
  * rewrite the log — where holding the lock only keeps this process from racing
  * its own sibling into `.git/index.lock`.
+ *
+ * Exported so `synthesize` enters the same critical section rather than a
+ * second one of its own: its whole-file rewrite races an overlapping append
+ * exactly as two appends race each other, and two locks would serialize
+ * neither.
  */
-async function withProjectLogLock(logPath, overrides, policy, mutate) {
+export async function withProjectLogLock(logPath, overrides, policy, mutate) {
     const handle = await acquireProjectLogLock(logPath, overrides);
     if (!handle.held && policy === 'required') {
         throw new Error(`Timed out waiting for the project log lock at ${handle.path}. Another writer is holding it; retry once it finishes.`);
@@ -794,6 +800,33 @@ export function findProjectLogEntryByIdempotencyKey(content, key, body) {
     }
     return undefined;
 }
+/**
+ * Raised when an append that is not the completion seal targets a sealed log.
+ *
+ * This is a throw rather than a fourth `ProjectLogAppendResult` variant because
+ * every in-tree caller of `appendProjectLog` runs *before* the seal: the gate's
+ * partial-finalization receipt narrows the result's `status` into its own
+ * `'appended' | 'already-appended'` field, so widening the union would force a
+ * change on a caller that can never legitimately reach this state. Throwing
+ * refuses that caller too — the command layer maps this to
+ * `status: 'sealed'` with a non-zero exit, and any other caller fails loudly
+ * instead of silently appending past the seal.
+ */
+export class ProjectLogSealedError extends Error {
+    logPath;
+    seal;
+    /**
+     * `action` names the refused mutation so `synthesize`, which rewrites rather
+     * than appends, reports what it actually declined. It defaults to `append`,
+     * which is the wording every existing caller and its pinned control expect.
+     */
+    constructor(logPath, seal, action = 'append') {
+        super(`No project-log ${action} may follow the completion seal (${seal.heading}) in ${logPath}.`);
+        this.name = 'ProjectLogSealedError';
+        this.logPath = logPath;
+        this.seal = seal;
+    }
+}
 const DEFAULT_APPEND_DEPENDENCIES = {
     resolveActiveProject,
     resolveEffectiveConfig,
@@ -825,7 +858,7 @@ function validateSingleLine(value, option, maxLength = PROJECT_LOG_AREA_MAX_LENG
     if (!normalized) {
         throw new Error(`${option} is required and must be a non-empty single line.`);
     }
-    if (/[\r\n]/.test(value ?? '')) {
+    if (PROJECT_LOG_LINE_TERMINATOR_RE.test(value ?? '')) {
         throw new Error(`${option} must be a single line without newline characters.`);
     }
     if (normalized.length > maxLength) {
@@ -846,16 +879,43 @@ function validateVersionNote(value) {
     }
     return validateSingleLine(value, '--version-note', Number.MAX_SAFE_INTEGER);
 }
+/**
+ * Whether any line of `body` is a `## ` or `### ` marker the command owns.
+ *
+ * The split is `splitProjectLogLines` rather than `/\r?\n/` so validation
+ * enumerates exactly the LineTerminators a regular expression's multiline `^`
+ * anchors after. Splitting on fewer of them was the injection: a body reading
+ * `carrier<CR>## Injected` was one unbroken line here and so passed, while the
+ * section parser saw a real `## ` boundary and truncated the entries region,
+ * voiding an already-written completion seal.
+ */
 function containsCommandOwnedMarker(body) {
-    return body
-        .split(/\r?\n/)
-        .some((line) => isProjectLogSectionMarker(line) || isProjectLogEntryMarker(line));
+    return splitProjectLogLines(body).some((line) => isProjectLogSectionMarker(line) || isProjectLogEntryMarker(line));
 }
 function validateEntry(input, date) {
-    const body = input.body?.trim();
-    if (!body) {
+    // The lone-terminator rule is tested against the *raw* body, before trimming.
+    // `String.prototype.trim` strips CR, LF, U+2028 and U+2029 as whitespace, so a
+    // body edge-terminated by one of them — `'ab\r'`, `'\rabc'` — never reached
+    // the test and appended with the terminator silently removed, while the error
+    // text said such a body is not accepted. Refusing it narrows what is accepted,
+    // which is the safe direction, and makes the message true.
+    const raw = input.body ?? '';
+    const supplied = raw.trim();
+    if (!supplied) {
         throw new Error('--body is required and must contain non-whitespace text.');
     }
+    // Parse leniently, write strictly: CRLF is accepted from the caller and stored
+    // as LF, so no log this command writes ever carries a terminator other than
+    // LF.
+    //
+    // The lone-terminator rule below is deliberately applied to `raw`: before
+    // trimming, and before normalization. Normalizing first would launder `\r\r\n` — a lone CR
+    // followed by a CRLF — into `\r\n`, which passes the rule and leaves a CR in
+    // the stored bytes, because one `replaceAll` pass cannot re-examine the CR it
+    // just exposed. Refusing at the door means every CR that reaches
+    // normalization is already part of a CRLF, and one pass is then exact.
+    const normalized = supplied.includes('\r\n');
+    const body = normalizeProjectLogLineEndings(supplied);
     const versionNote = validateVersionNote(input.versionNote);
     if (input.structural) {
         if (input.type !== undefined ||
@@ -863,7 +923,7 @@ function validateEntry(input, date) {
             input.area !== undefined) {
             throw new Error('--structural cannot be combined with judgment flags --type, --scope, or --area.');
         }
-        if (/[\r\n]/.test(body)) {
+        if (PROJECT_LOG_LINE_TERMINATOR_RE.test(body)) {
             throw new Error('--body for structural entries must be one line without newline characters.');
         }
         if (containsCommandOwnedMarker(body)) {
@@ -875,6 +935,7 @@ function validateEntry(input, date) {
             heading: composeStructuralHeading({ date, producer, ref }),
             body,
             versionNote,
+            normalized,
         };
     }
     if (input.producer !== undefined || input.ref !== undefined) {
@@ -892,6 +953,12 @@ function validateEntry(input, date) {
     if (!PROJECT_LOG_SCOPES.includes(input.scope)) {
         throw new Error(`Invalid --scope '${input.scope}'; accepted values: ${PROJECT_LOG_SCOPES.join(' | ')}.`);
     }
+    // Tested against `raw`: before trimming, and before normalization. Trimming
+    // hides an edge terminator; normalizing first launders `\r\r\n` into
+    // `\r\n`, which passes this rule and leaves a carriage return in the bytes.
+    if (PROJECT_LOG_LONE_TERMINATOR_RE.test(raw)) {
+        throw new Error('--body for judgment entries must break lines with line feeds or CRLF; a lone carriage return and the U+2028 and U+2029 separators are not accepted.');
+    }
     if (containsCommandOwnedMarker(body)) {
         throw new Error('--body for judgment entries must not contain command-owned level-two or level-three Markdown headings.');
     }
@@ -905,6 +972,7 @@ function validateEntry(input, date) {
         }),
         body,
         versionNote,
+        normalized,
     };
 }
 /**
@@ -1000,30 +1068,114 @@ async function appendLockedProjectLog(input, dependencies, logPath) {
         }
     }
     const date = dependencies.now().toISOString().slice(0, 10);
-    const { heading, body, versionNote } = validateEntry(input, date);
+    const { heading, body, versionNote, normalized } = validateEntry(input, date);
     const idempotencyKey = validateIdempotencyKey(input.idempotencyKey, body);
     let created = false;
-    if (logExists && idempotencyKey !== undefined) {
-        const existing = findProjectLogEntryByIdempotencyKey(await dependencies.readLog(logPath), idempotencyKey, body);
-        if (existing !== undefined) {
-            // Append-only order is preserved (DR-260714): a replay observes the
-            // entry it already wrote instead of writing a second one.
-            return {
-                status: 'already-appended',
-                logPath,
-                heading: existing,
-                created: false,
-            };
+    if (logExists) {
+        const content = await dependencies.readLog(logPath);
+        // A log whose markers two readers resolve differently cannot answer
+        // "is this sealed?", so nothing may be written onto it until a human
+        // resolves it. This refusal is what keeps the LF-only section parser from
+        // widening such a log: without it, a pre-existing `preamble<U+2028>##
+        // Entries` stops parsing, reports unsealed, and accepts a second seal.
+        const ambiguity = findProjectLogAmbiguity(content, logPath);
+        if (ambiguity !== undefined) {
+            throw new Error(ambiguity);
+        }
+        const seal = findProjectLogSeal(content);
+        // The parser found no seal, but the raw text may still hold a seal heading
+        // it cannot reach — a log with no `## Entries` section, or a seal below
+        // another `## ` section. Writing onto such a log is the outcome that must
+        // never happen, and reporting it unsealed would contradict what is plainly
+        // in the file, so both branches below fail closed on it.
+        //
+        // Refusing is never weaker than the reading it replaces: the pre-fix code
+        // answered these logs `already-appended` and wrote nothing when a key
+        // happened to match, and appended past the seal when it did not.
+        const unreachableSeal = seal === null ? findProjectLogSealHeadingLine(content) : undefined;
+        // Read the requested identity back out of the composed heading, so the
+        // comparison runs on the same normalized producer/ref the parser reads out
+        // of the log.
+        const requestsSeal = isProjectLogSealHeading(heading);
+        // The seal routes on structure before the generic keyed short-circuit, and
+        // is never suppressed by it. `idempotencyToken` matches any whole word
+        // equal to the key *anywhere* in the log, so with the keyed scan first a
+        // single ordinary entry whose prose happened to mention `oat-seal:<project>`
+        // answered the completion seal with `already-appended` naming that entry —
+        // no seal was written, the log stayed open to every later append, and the
+        // completing agent saw success. Structural recognition cannot collide that
+        // way, and the keyed fallback below is admitted only when it names a seal,
+        // so an `already-appended` seal always reports a seal heading.
+        if (requestsSeal) {
+            if (seal !== null) {
+                // The seal is idempotent by structure, not only by key: a log sealed
+                // before the keyed convention carries no token to match, and a resumed
+                // completion must still observe the existing seal rather than write a
+                // second one.
+                return {
+                    status: 'already-appended',
+                    logPath,
+                    heading: seal.heading,
+                    created: false,
+                };
+            }
+            if (unreachableSeal !== undefined) {
+                throw unreachableProjectLogSealError(logPath, content, unreachableSeal);
+            }
+        }
+        else {
+            // Recognizing an entry this key already wrote comes before the sealed
+            // guard, and deliberately so: it appends nothing, and the entry it finds
+            // necessarily predates any later seal. Refusing it would turn the gate's
+            // idempotent recovery replay into a hard failure on every project that
+            // has since been completed.
+            if (idempotencyKey !== undefined) {
+                const existing = findProjectLogEntryByIdempotencyKey(content, idempotencyKey, body);
+                if (existing !== undefined) {
+                    // Append-only order is preserved (DR-260714): a replay observes the
+                    // entry it already wrote instead of writing a second one.
+                    return {
+                        status: 'already-appended',
+                        logPath,
+                        heading: existing,
+                        created: false,
+                    };
+                }
+            }
+            if (seal !== null) {
+                throw new ProjectLogSealedError(logPath, seal);
+            }
+            // The same refusal the seal path makes, on the same file. Leaving it out
+            // of this branch is what let a log whose seal the parser could not reach
+            // hard-fail the completion seal while still accepting ordinary content
+            // past that seal — the two writers disagreeing about one file.
+            if (unreachableSeal !== undefined) {
+                throw unreachableProjectLogSealError(logPath, content, unreachableSeal);
+            }
         }
     }
     if (!logExists) {
         const assetsRoot = await dependencies.resolveAssetsRoot();
         const template = await readFile(join(assetsRoot, 'templates', PROJECT_LOG_FILENAME), 'utf8');
-        await dependencies.writeLog(logPath, instantiateProjectLogTemplate(template, basename(dirname(logPath)), date));
+        const instantiated = instantiateProjectLogTemplate(template, basename(dirname(logPath)), date);
+        // The project directory's basename lands in the template's title line, so a
+        // directory named `demo<U+2028>## Notes` would create a log this command
+        // then refuses on its next append. A mutator must never write content it
+        // would decline to read.
+        if (containsAmbiguousProjectLogMarker(instantiated)) {
+            throw new Error(`Project name ${basename(dirname(logPath))} would put a '## ' heading after a carriage return, U+2028, or U+2029 in the new log's title, leaving a file with two readings. Rename the project directory using line feeds only.`);
+        }
+        await dependencies.writeLog(logPath, instantiated);
         created = true;
     }
     await appendEntry(logPath, heading, body, versionNote, dependencies);
-    return { status: 'appended', logPath, heading, created };
+    return {
+        status: 'appended',
+        logPath,
+        heading,
+        created,
+        ...(normalized ? { normalizedLineEndings: true } : {}),
+    };
 }
 async function samePath(left, right) {
     if (resolve(left) === resolve(right)) {
@@ -1169,12 +1321,35 @@ async function runAppendCommand(options, context, dependencies) {
                 receiptPath = candidate;
             }
         }
-        const result = await appendProjectLog({
-            repoRoot,
-            home: context.home,
-            ...options,
-            body,
-        }, dependencies);
+        let result;
+        try {
+            result = await appendProjectLog({
+                repoRoot,
+                home: context.home,
+                ...options,
+                body,
+            }, dependencies);
+        }
+        catch (error) {
+            if (!(error instanceof ProjectLogSealedError)) {
+                throw error;
+            }
+            // A terminal refusal, reported in the same shape as the error path below
+            // so a caller reading JSON can tell a sealed log from a malformed append.
+            if (context.json) {
+                context.logger.json({
+                    status: 'sealed',
+                    logPath: error.logPath,
+                    heading: error.seal.heading,
+                    message: error.message,
+                });
+            }
+            else {
+                context.logger.error(error.message);
+            }
+            process.exitCode = 1;
+            return;
+        }
         let commit;
         let receiptRemoved = false;
         if (options.commit && result.status !== 'skipped') {
@@ -1249,7 +1424,9 @@ Entry contract:
   High-value judgments may use Observation:, Impact:, and Recommendation: fields.
   Structural bodies are one line and reference artifacts by path instead of inlining them.
   Add --version-note for tool-related observations.
-  Pass --idempotency-key with --commit to finalize a gate partial-finalization receipt; a replay reports already-appended instead of duplicating the entry.
+  Pass --idempotency-key so a replay reports already-appended instead of duplicating the entry; the key must appear in --body as its own word. Adding --commit also finalizes a gate partial-finalization receipt.
+  The completion seal (--structural --producer oat-project-complete --ref seal) dedupes on its own, and every append carrying new content onto a sealed log is refused.
+  A replay recognized by its own --idempotency-key still reports already-appended on a sealed log and writes nothing.
   Never record secret values (tokens, keys, signed URLs, or credentials); reference secrets by name or source.
   Prior entries are never edited or struck through. Append a new judgment entry that references and explains a correction.