@open-agent-toolkit/cli 0.2.65 → 0.2.67

package/dist/commands/project/log/check.d.ts

@@ -5,8 +5,39 @@ import { type ProjectLogSection, type ProjectLogScope, type ProjectLogType } fro
 export declare const PROJECT_LOG_FILENAME = "project-log.md";
 export declare const SYNTHESIS_PENDING_HEADING = "## End-of-run synthesis (pending \u2014 do not skip at project completion)";
 export declare const SYNTHESIS_COMPLETE_HEADING = "## End-of-run synthesis";
+/**
+ * The completion seal a project log already carries.
+ *
+ * `count` is reported rather than collapsed so a log double-sealed before the
+ * seal append became idempotent stays legible instead of looking like a normal
+ * single-sealed log; `heading` is always the **first** seal, which is the one
+ * that actually closed the log.
+ */
+export interface ProjectLogSeal {
+    heading: string;
+    date: string;
+    keyed: boolean;
+    count: number;
+}
 export interface ProjectLogCheckResult {
-    status: 'ok' | 'absent' | 'synthesis_pending';
+    /**
+     * A *sealed* log deliberately keeps its ordinary status and carries `sealed`
+     * alongside it, because it is a healthy log that must keep routing normally —
+     * a distinct value there would break every `status: "ok"` route in
+     * `oat-project-complete/SKILL.md` and `oat-project-summary/SKILL.md`.
+     *
+     * `ambiguous` is the opposite case and is the one value that may join them.
+     * The log's markers have two readings, so no verdict below can be computed
+     * honestly: every other field is zeroed and must be treated as unknown, not as
+     * a finding. Breaking the routing is the point — both mutators already refuse
+     * this file, and `check` answering `ok` while they refuse is what let the
+     * completion gate trust a reader that disagreed with every writer.
+     */
+    status: 'ok' | 'absent' | 'synthesis_pending' | 'ambiguous';
+    /** Why the log has two readings, or null when it has one. */
+    ambiguity: string | null;
+    sealed: boolean;
+    seal: ProjectLogSeal | null;
     logPath: string | null;
     entryCounts: {
         structural: number;
@@ -60,7 +91,62 @@ export interface ProjectLogCheckCommandDependencies extends CheckProjectLogDepen
     resolveProjectRoot: (cwd: string) => Promise<string>;
 }
 export declare function findCanonicalProjectLogSynthesisSection(content: string): ProjectLogSynthesisSection;
+/**
+ * Parses the entries region into typed entries.
+ *
+ * The split is `/\r?\n/`, not `'\n'`. With a bare LF split every line of a
+ * CRLF log keeps a trailing `\r`, which no heading pattern can match — their
+ * `$` sits after a `[^·\r\n]+` run — so a CRLF log parsed to zero entries and
+ * an existing completion seal was invisible to `check` and to the append guard.
+ * A *lone* CR is still not a boundary, which is what keeps a body from forging
+ * a heading; only the CRLF pair is folded in.
+ */
 export declare function parseProjectLogEntries(content: string): ParsedProjectLog;
+/**
+ * Summarizes the completion seal carried by already-parsed entries.
+ *
+ * Seal identity is `isProjectLogSealEntry` and nothing else, so `check` and
+ * `append` cannot drift apart on what "sealed" means.
+ */
+export declare function summarizeProjectLogSeal(entries: readonly ParsedProjectLogEntry[]): ProjectLogSeal | null;
+/**
+ * Finds the completion seal in raw project-log content.
+ *
+ * `append` uses this so its refusal and `check`'s report are the same reading
+ * of the same file.
+ */
+/**
+ * The reason this log has two readings, or undefined when it has one.
+ *
+ * The single question `check`, `rollup`, both append paths and `synthesize` all
+ * ask before trusting a parse. It is one function rather than one call each,
+ * because a surface that asked a slightly different question is exactly how
+ * `rollup` came to rewrite `summary.md` from a log the other three refused,
+ * reporting output byte-identical to an empty log.
+ *
+ * Two shapes qualify. A heading that a `^…$/m` reader starts a line at and the
+ * line-feed-only parser does not; and a completion seal that is physically in
+ * the file but outside the region the parser reads, where "is this sealed?" has
+ * one answer to a human and another to the parser.
+ */
+export declare function findProjectLogAmbiguity(content: string, logPath: string): string | undefined;
+/**
+ * Explains a refusal caused by a seal the entries parser cannot reach, naming
+ * the actual obstruction.
+ *
+ * The first version of this message assumed the only way to hide a seal was to
+ * place it outside `## Entries`, and offered that remedy for a CRLF log whose
+ * seal sat exactly where it belonged — a remedy that did not apply and could
+ * not be followed, on the one path a completion run cannot get past.
+ *
+ * Shared by both mutators so one file cannot produce two different accounts of
+ * why it was refused.
+ */
+export declare function unreachableProjectLogSealError(logPath: string, content: string, seal: {
+    line: string;
+    index: number;
+}): Error;
+export declare function findProjectLogSeal(content: string): ProjectLogSeal | null;
 export declare function checkProjectLog(input: CheckProjectLogInput, overrides?: Partial<CheckProjectLogDependencies>): Promise<ProjectLogCheckResult>;
 export declare function createProjectLogCheckCommand(overrides?: Partial<ProjectLogCheckCommandDependencies>): Command;
 //# sourceMappingURL=check.d.ts.map

package/dist/commands/project/log/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/check.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAEnB,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,yBAAyB,+EACmC,CAAC;AAC1E,eAAO,MAAM,0BAA0B,4BAA4B,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,mBAAmB,CAAC;IAC9C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;KAC1C,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC7C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;CACnB,GACD;IACE,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,kCAAmC,SAAQ,2BAA2B;IACrF,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAwCD,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,MAAM,GACd,0BAA0B,CAkB5B;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAsDxE;AA8BD,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,SAAS,GAAE,OAAO,CAAC,2BAA2B,CAAM,GACnD,OAAO,CAAC,qBAAqB,CAAC,CAsChC;AA8CD,wBAAgB,4BAA4B,CAC1C,SAAS,GAAE,OAAO,CAAC,kCAAkC,CAAM,GAC1D,OAAO,CAkBT"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/check.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAUL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAEnB,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,yBAAyB,+EACmC,CAAC;AAC1E,eAAO,MAAM,0BAA0B,4BAA4B,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,mBAAmB,GAAG,WAAW,CAAC;IAC5D,6DAA6D;IAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;KAC1C,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC7C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IACE,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GACD;IACE,MAAM,EAAE,SAAS,CAAC;CACnB,GACD;IACE,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,kCAAmC,SAAQ,2BAA2B;IACrF,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AA2CD,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,MAAM,GACd,0BAA0B,CAkB5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAsDxE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,cAAc,GAAG,IAAI,CAcvB;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAgBpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC,KAAK,CAmBP;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAEzE;AA8BD,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,SAAS,GAAE,OAAO,CAAC,2BAA2B,CAAM,GACnD,OAAO,CAAC,qBAAqB,CAAC,CAkEhC;AA8DD,wBAAgB,4BAA4B,CAC1C,SAAS,GAAE,OAAO,CAAC,kCAAkC,CAAM,GAC1D,OAAO,CAkBT"}

package/dist/commands/project/log/check.js

@@ -6,7 +6,7 @@ import { resolveActiveProject, } from '../../../config/oat-config.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { resolveProjectRoot } from '../../../fs/paths.js';
 import { Command } from 'commander';
-import { findProjectLogSections, isProjectLogEntryMarker, JUDGMENT_HEADING_RE, PROJECT_LOG_TYPES, STRUCTURAL_HEADING_RE, } from './grammar.js';
+import { carriesProjectLogSealKey, containsAmbiguousProjectLogMarker, findProjectLogSealHeadingLine, findProjectLogSections, isProjectLogEntryMarker, isProjectLogSealEntry, JUDGMENT_HEADING_RE, PROJECT_LOG_TYPES, STRUCTURAL_HEADING_RE, } from './grammar.js';
 export const PROJECT_LOG_FILENAME = 'project-log.md';
 export const SYNTHESIS_PENDING_HEADING = '## End-of-run synthesis (pending — do not skip at project completion)';
 export const SYNTHESIS_COMPLETE_HEADING = '## End-of-run synthesis';
@@ -32,8 +32,10 @@ function emptyCounts() {
         scopeCounts: { project: 0, general: 0 },
     };
 }
+/** The heading that opens the region entries are parsed from. */
+const ENTRIES_HEADING = '## Entries';
 function entriesSection(content) {
-    const section = findProjectLogSections(content).find(({ heading }) => heading === '## Entries');
+    const section = findProjectLogSections(content).find(({ heading }) => heading === ENTRIES_HEADING);
     if (!section) {
         return '';
     }
@@ -54,8 +56,18 @@ export function findCanonicalProjectLogSynthesisSection(content) {
         section,
     };
 }
+/**
+ * Parses the entries region into typed entries.
+ *
+ * The split is `/\r?\n/`, not `'\n'`. With a bare LF split every line of a
+ * CRLF log keeps a trailing `\r`, which no heading pattern can match — their
+ * `$` sits after a `[^·\r\n]+` run — so a CRLF log parsed to zero entries and
+ * an existing completion seal was invisible to `check` and to the append guard.
+ * A *lone* CR is still not a boundary, which is what keeps a body from forging
+ * a heading; only the CRLF pair is folded in.
+ */
 export function parseProjectLogEntries(content) {
-    const lines = entriesSection(content).split('\n');
+    const lines = entriesSection(content).split(/\r?\n/);
     const entries = [];
     const grammarViolations = [];
     for (let index = 0; index < lines.length; index += 1) {
@@ -101,6 +113,90 @@ export function parseProjectLogEntries(content) {
     }
     return { entries, grammarViolations };
 }
+/**
+ * Summarizes the completion seal carried by already-parsed entries.
+ *
+ * Seal identity is `isProjectLogSealEntry` and nothing else, so `check` and
+ * `append` cannot drift apart on what "sealed" means.
+ */
+export function summarizeProjectLogSeal(entries) {
+    const seals = entries.filter((entry) => entry.class === 'structural' && isProjectLogSealEntry(entry));
+    const first = seals[0];
+    if (first === undefined) {
+        return null;
+    }
+    return {
+        heading: first.heading,
+        date: first.date,
+        keyed: carriesProjectLogSealKey(first.body),
+        count: seals.length,
+    };
+}
+/**
+ * Finds the completion seal in raw project-log content.
+ *
+ * `append` uses this so its refusal and `check`'s report are the same reading
+ * of the same file.
+ */
+/**
+ * The reason this log has two readings, or undefined when it has one.
+ *
+ * The single question `check`, `rollup`, both append paths and `synthesize` all
+ * ask before trusting a parse. It is one function rather than one call each,
+ * because a surface that asked a slightly different question is exactly how
+ * `rollup` came to rewrite `summary.md` from a log the other three refused,
+ * reporting output byte-identical to an empty log.
+ *
+ * Two shapes qualify. A heading that a `^…$/m` reader starts a line at and the
+ * line-feed-only parser does not; and a completion seal that is physically in
+ * the file but outside the region the parser reads, where "is this sealed?" has
+ * one answer to a human and another to the parser.
+ */
+export function findProjectLogAmbiguity(content, logPath) {
+    if (containsAmbiguousProjectLogMarker(content)) {
+        return `Project log ${logPath} has a '## ' heading, or a dated '### ' entry heading, starting a line after a carriage return, U+2028, or U+2029 rather than a line feed, so its structure has two readings and no seal or count can be reported honestly. Replace those line terminators with line feeds.`;
+    }
+    if (findProjectLogSeal(content) === null) {
+        const unreachableSeal = findProjectLogSealHeadingLine(content);
+        if (unreachableSeal !== undefined) {
+            // Delegated so the precise diagnosis — which of the two obstructions this
+            // is — survives being reached through the shared predicate. Collapsing
+            // both causes into one sentence here would undo the round that made the
+            // remedy actionable.
+            return unreachableProjectLogSealError(logPath, content, unreachableSeal)
+                .message;
+        }
+    }
+    return undefined;
+}
+/**
+ * Explains a refusal caused by a seal the entries parser cannot reach, naming
+ * the actual obstruction.
+ *
+ * The first version of this message assumed the only way to hide a seal was to
+ * place it outside `## Entries`, and offered that remedy for a CRLF log whose
+ * seal sat exactly where it belonged — a remedy that did not apply and could
+ * not be followed, on the one path a completion run cannot get past.
+ *
+ * Shared by both mutators so one file cannot produce two different accounts of
+ * why it was refused.
+ */
+export function unreachableProjectLogSealError(logPath, content, seal) {
+    // Compared by offset, not by substring membership: prose inside `## Entries`
+    // can quote a seal heading verbatim, and a membership test would then report a
+    // seal that really sits under a later section as correctly placed, sending the
+    // operator to rewrite line terminators that were never the obstruction.
+    const entries = findProjectLogSections(content).find(({ heading }) => heading === ENTRIES_HEADING);
+    const outsideEntries = entries === undefined ||
+        seal.index < entries.start ||
+        seal.index >= entries.end;
+    return new Error(`Project log ${logPath} already carries the completion-seal heading '${seal.line.trim()}', but the entries parser cannot reach it, so whether the log is sealed has two answers and nothing may be read from it or written to it with confidence. ${outsideEntries
+        ? `The seal sits outside the '${ENTRIES_HEADING}' section; move it under that heading, then retry.`
+        : 'The seal is under the correct heading, so the obstruction is its line terminators; rewrite the log with line feeds, then retry.'}`);
+}
+export function findProjectLogSeal(content) {
+    return summarizeProjectLogSeal(parseProjectLogEntries(content).entries);
+}
 async function resolveTargetProject(input, dependencies) {
     if (input.project) {
         const projectPath = isAbsolute(input.project)
@@ -125,6 +221,9 @@ export async function checkProjectLog(input, overrides = {}) {
     if (!(await fileExists(logPath))) {
         return {
             status: 'absent',
+            ambiguity: null,
+            sealed: false,
+            seal: null,
             logPath: null,
             ...emptyCounts(),
             lastEntryDate: null,
@@ -133,6 +232,24 @@ export async function checkProjectLog(input, overrides = {}) {
         };
     }
     const content = await readFile(logPath, 'utf8');
+    // Fail closed, exactly as every other surface does on this same file. `check`
+    // used to be the one reader that always produced a confident verdict: on a
+    // `preamble<U+2028>## Entries` log it answered `sealed` and count fields the
+    // writers refused to act on, and the completion gate keys on those fields.
+    const ambiguity = findProjectLogAmbiguity(content, logPath);
+    if (ambiguity !== undefined) {
+        return {
+            status: 'ambiguous',
+            ambiguity,
+            sealed: false,
+            seal: null,
+            logPath,
+            ...emptyCounts(),
+            lastEntryDate: null,
+            synthesisPending: false,
+            grammarViolations: [],
+        };
+    }
     const parsed = parseProjectLogEntries(content);
     const counts = emptyCounts();
     for (const entry of parsed.entries) {
@@ -145,8 +262,12 @@ export async function checkProjectLog(input, overrides = {}) {
         }
     }
     const synthesisPending = findProjectLogSections(content).some(({ heading }) => heading === SYNTHESIS_PENDING_HEADING);
+    const seal = summarizeProjectLogSeal(parsed.entries);
     return {
         status: synthesisPending ? 'synthesis_pending' : 'ok',
+        ambiguity: null,
+        sealed: seal !== null,
+        seal,
         logPath,
         ...counts,
         lastEntryDate: parsed.entries.at(-1)?.date ?? null,
@@ -161,14 +282,27 @@ async function runCheckCommand(options, context, dependencies) {
         if (context.json) {
             context.logger.json(result);
         }
+        else if (result.status === 'ambiguous') {
+            context.logger.error(result.ambiguity ?? 'Project log has two readings.');
+        }
         else {
             context.logger.info(result.status === 'absent'
                 ? 'Project log: absent'
                 : `Project log: ${result.status}; entries: ${result.entryCounts.structural +
-                    PROJECT_LOG_TYPES.reduce((total, type) => total + result.entryCounts.judgment[type], 0)}`);
+                    PROJECT_LOG_TYPES.reduce((total, type) => total + result.entryCounts.judgment[type], 0)}${result.seal
+                    ? `; sealed${result.seal.count > 1
+                        ? ` (${result.seal.count} seal entries)`
+                        : ''}`
+                    : ''}`);
         }
+        // An ambiguous log exits non-zero whether or not synthesis was required: a
+        // caller that only checks the exit status must not read this as a clean log,
+        // and both mutators refuse the same file.
         process.exitCode =
-            options.requireSynthesis && result.synthesisPending ? 1 : 0;
+            result.status === 'ambiguous' ||
+                (options.requireSynthesis === true && result.synthesisPending)
+                ? 1
+                : 0;
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/dist/commands/project/log/grammar.d.ts

@@ -13,7 +13,103 @@ export interface ProjectLogSection {
 }
 export declare function isProjectLogSectionMarker(line: string): boolean;
 export declare function isProjectLogEntryMarker(line: string): boolean;
+/**
+ * Every character JavaScript treats as a LineTerminator, and therefore every
+ * character a multiline `^` anchors after: LF, CR, U+2028 LINE SEPARATOR, and
+ * U+2029 PARAGRAPH SEPARATOR. VT, FF, and U+0085 NEL are deliberately absent —
+ * ECMAScript does not count them, so `^` does not match after them either.
+ *
+ * The set is exported rather than inlined because the append validator and this
+ * parser must enumerate exactly the same characters. A validator that split on
+ * fewer terminators than the parser anchored after is precisely how a body
+ * could smuggle a `## ` past validation and have it become a real section
+ * boundary, silently truncating the parsed entries region and voiding the
+ * completion seal.
+ */
+export declare const PROJECT_LOG_LINE_TERMINATOR_RE: RegExp;
+/**
+ * A *lone* line terminator: a carriage return not followed by a line feed, or a
+ * U+2028 / U+2029 separator.
+ *
+ * CRLF is deliberately excluded, and that carve-out is the whole point. Every
+ * reader in this module treats `\r\n` as exactly one boundary — `splitProjectLogLines`,
+ * the `/\r?\n/` scans, and `parseProjectLogEntries` — so a CRLF body has one
+ * reading and is accepted, as it was before this guard existed. A *lone* CR has
+ * two readings (a boundary to a multiline `^`, body text to everything here),
+ * and so do U+2028 and U+2029, so those stay refused.
+ *
+ * Written as one pattern rather than a strip-then-test so the rule is legible at
+ * the point of use: `\r(?!\n)` is "a carriage return that is not part of CRLF".
+ */
+export declare const PROJECT_LOG_LONE_TERMINATOR_RE: RegExp;
+/**
+ * Canonicalizes accepted line endings to LF.
+ *
+ * The command parses leniently and writes strictly: CRLF is accepted from a
+ * caller — a `--body -` fed from a file, tool output, or a pasted buffer — and
+ * stored as LF, so a log this command writes never contains a terminator other
+ * than LF. That makes the file's single reading a property of its bytes rather
+ * than of every reader agreeing about them, which is the weaker guarantee this
+ * module kept failing to hold.
+ *
+ * It is not needed to satisfy `rollup`'s `^…$/m` ledger scan: a multiline `$`
+ * matches before a CR as readily as before an LF, so that scan reads a CRLF log
+ * correctly and always did. Storing LF is a narrowing of what future readers
+ * must cope with, not a repair of a present disagreement.
+ */
+export declare function normalizeProjectLogLineEndings(value: string): string;
+/**
+ * Splits on every LineTerminator, treating CRLF as one boundary.
+ *
+ * Validators use this rather than a `/\r?\n/` split so that a lone CR, a
+ * U+2028, or a U+2029 starts a new line for validation just as it would for a
+ * regular expression's multiline `^`.
+ */
+export declare function splitProjectLogLines(content: string): string[];
+/**
+ * The log's `## ` section boundaries, where a boundary is a `## ` that begins
+ * the content or directly follows a line feed.
+ *
+ * LF is the only boundary on purpose. The previous `/^## [^\r\n]+/gm` anchored
+ * after all four LineTerminators while the append validator only split on
+ * `/\r?\n/`, so a judgment body reading `carrier<CR>## Injected` passed
+ * validation and then became a real section boundary — truncating `## Entries`
+ * so `check` reported an already-written seal as `sealed: false` and appends
+ * kept succeeding onto a sealed log. Anchoring on LF alone keeps this parser
+ * and `parseProjectLogEntries`, which splits its section on `/\r?\n/`, reading
+ * the same file the same way, and it holds for a log written by hand as well as one
+ * the command wrote.
+ */
 export declare function findProjectLogSections(content: string): ProjectLogSection[];
+/**
+ * Whether the log contains a heading that a `^…$/m` reader starts a line at but
+ * an LF-only reader does not — that is, whether the file has two readings.
+ *
+ * The two competing readers are enumerated rather than approximated: the
+ * pre-fix section scan `/^## [^\r\n]+/gm`, and `rollup.ts`'s ledger scan, which
+ * recognizes only the complete dated judgment grammar. A `### ` line that
+ * neither recognizes — `carrier<CR>### Notes` — is body text to every reader and
+ * is deliberately *not* flagged; refusing it would strand logs a previous
+ * release could legitimately have written.
+ *
+ * Mutators consult this and refuse rather than guess, because a file with two
+ * readings cannot answer "is this sealed?". Tightening the section parser to LF
+ * alone would otherwise silently *widen* such logs: a hand-written
+ * `preamble<U+2028>## Entries` used to parse, so its seal was found and a
+ * replayed seal was deduplicated, and under an LF-only reading the same file has
+ * no entries region, reports unsealed, and accepts a second seal. Refusing is
+ * the only resolution that is not weaker than the reading it replaces.
+ *
+ * CRLF is deliberately not caught, and the entries parser now earns that
+ * exemption rather than merely asserting it. The character immediately before a
+ * marker on a `\r\n`-terminated line is the LF, so a `## ` section boundary was
+ * always unambiguous; `### ` entries and the structural heading pattern were not,
+ * because their `$` cannot match before a trailing `\r`, so a CRLF log parsed to
+ * zero entries and an existing seal was invisible. `parseProjectLogEntries` now
+ * splits on `/\r?\n/`, which makes all three agree and makes "CRLF has exactly
+ * one reading" a fact about this module rather than a hope.
+ */
+export declare function containsAmbiguousProjectLogMarker(content: string): boolean;
 export declare function composeJudgmentHeading(input: {
     date: string;
     scope: ProjectLogScope;
@@ -25,4 +121,73 @@ export declare function composeStructuralHeading(input: {
     producer: string;
     ref: string;
 }): string;
+/**
+ * The producer and ref that together identify the completion seal — the last
+ * entry a project log may ever receive.
+ *
+ * Both fields are required. A `seal` ref from another producer is an ordinary
+ * structural entry, and an `oat-project-complete` entry with another ref is an
+ * ordinary lifecycle entry; treating either as a seal would let a foreign
+ * append freeze a log that was never completed.
+ */
+export declare const PROJECT_LOG_SEAL_PRODUCER = "oat-project-complete";
+export declare const PROJECT_LOG_SEAL_REF = "seal";
+/**
+ * The prefix of the seal's idempotency token (`oat-seal:<project>`).
+ *
+ * The token is what makes a replayed seal recognize its own entry, so it is
+ * prefixed rather than bare: a project name alone could occur in ordinary prose
+ * and match an unrelated body.
+ */
+export declare const PROJECT_LOG_SEAL_KEY_PREFIX = "oat-seal:";
+/**
+ * The single definition of "this entry is the completion seal", shared by the
+ * `check` probe and the `append` guard.
+ *
+ * Both callers route on this one predicate on purpose: two definitions of
+ * sealed is the regression that lets a log report itself unsealed to one
+ * command and sealed to the other.
+ */
+export declare function isProjectLogSealEntry(entry: {
+    producer: string;
+    ref: string;
+}): boolean;
+/**
+ * Whether a composed or parsed entry *heading* is the completion seal's.
+ *
+ * The heading-level counterpart of `isProjectLogSealEntry`, and it delegates to
+ * it rather than restating the rule. One predicate serves both directions —
+ * "is this request the seal?" and "does this already-appended heading name a
+ * seal?" — so the two can never drift into disagreeing about what a seal
+ * heading is. It reads the producer and ref back out of the heading text rather
+ * than from a caller's flags, which is the same normalization
+ * `parseProjectLogEntries` applies.
+ */
+export declare function isProjectLogSealHeading(heading: string): boolean;
+/**
+ * The raw line of `content` that is a completion-seal heading, or undefined.
+ *
+ * Deliberately independent of `parseProjectLogEntries`: it answers "is a seal
+ * physically in this file?" where the parser answers "can this file's structure
+ * be read to contain a seal?". The gap between those two questions is the state
+ * every mutator must refuse, and all of them ask it the same way.
+ *
+ * The offset is returned alongside the text because callers must locate the
+ * seal, not merely recognize it: prose inside `## Entries` can quote a seal
+ * heading verbatim, so a substring test would place a seal that really sits
+ * under a later section inside the entries region and blame the wrong cause.
+ */
+export declare function findProjectLogSealHeadingLine(content: string): {
+    line: string;
+    index: number;
+} | undefined;
+/**
+ * Whether a seal body carries the canonical stand-alone seal token.
+ *
+ * `idempotencyToken` records the whole whitespace-delimited word containing a
+ * key, so a key glued to the varying completion timestamp never matches its own
+ * earlier append. A seal written before this convention carries no token at
+ * all, which is exactly why the seal is also recognized structurally.
+ */
+export declare function carriesProjectLogSealKey(body: string): boolean;
 //# sourceMappingURL=grammar.d.ts.map

package/dist/commands/project/log/grammar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grammar.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/grammar.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,YAC5B,KAAK,EACL,UAAU,EACV,aAAa,EACb,UAAU,CACF,CAAC;AACX,eAAO,MAAM,kBAAkB,YAAI,SAAS,EAAE,SAAS,CAAU,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,6BAA6B,WAAM,CAAC;AAEjD,eAAO,MAAM,mBAAmB,QACqE,CAAC;AACtG,eAAO,MAAM,qBAAqB,QACoC,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAO3E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,MAAM,CAET"}
+{"version":3,"file":"grammar.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/grammar.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,YAC5B,KAAK,EACL,UAAU,EACV,aAAa,EACb,UAAU,CACF,CAAC;AACX,eAAO,MAAM,kBAAkB,YAAI,SAAS,EAAE,SAAS,CAAU,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,6BAA6B,WAAM,CAAC;AAEjD,eAAO,MAAM,mBAAmB,QACqE,CAAC;AACtG,eAAO,MAAM,qBAAqB,QACoC,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,QAAuB,CAAC;AAEnE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,QAA4B,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE9D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAO3E;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc1E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,MAAM,CAET;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAChE,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAKV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAShE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAY7C;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ9D"}