@open-agent-toolkit/cli 0.2.66 → 0.2.67

package/dist/commands/project/log/grammar.d.ts

@@ -13,7 +13,103 @@ export interface ProjectLogSection {
 }
 export declare function isProjectLogSectionMarker(line: string): boolean;
 export declare function isProjectLogEntryMarker(line: string): boolean;
+/**
+ * Every character JavaScript treats as a LineTerminator, and therefore every
+ * character a multiline `^` anchors after: LF, CR, U+2028 LINE SEPARATOR, and
+ * U+2029 PARAGRAPH SEPARATOR. VT, FF, and U+0085 NEL are deliberately absent —
+ * ECMAScript does not count them, so `^` does not match after them either.
+ *
+ * The set is exported rather than inlined because the append validator and this
+ * parser must enumerate exactly the same characters. A validator that split on
+ * fewer terminators than the parser anchored after is precisely how a body
+ * could smuggle a `## ` past validation and have it become a real section
+ * boundary, silently truncating the parsed entries region and voiding the
+ * completion seal.
+ */
+export declare const PROJECT_LOG_LINE_TERMINATOR_RE: RegExp;
+/**
+ * A *lone* line terminator: a carriage return not followed by a line feed, or a
+ * U+2028 / U+2029 separator.
+ *
+ * CRLF is deliberately excluded, and that carve-out is the whole point. Every
+ * reader in this module treats `\r\n` as exactly one boundary — `splitProjectLogLines`,
+ * the `/\r?\n/` scans, and `parseProjectLogEntries` — so a CRLF body has one
+ * reading and is accepted, as it was before this guard existed. A *lone* CR has
+ * two readings (a boundary to a multiline `^`, body text to everything here),
+ * and so do U+2028 and U+2029, so those stay refused.
+ *
+ * Written as one pattern rather than a strip-then-test so the rule is legible at
+ * the point of use: `\r(?!\n)` is "a carriage return that is not part of CRLF".
+ */
+export declare const PROJECT_LOG_LONE_TERMINATOR_RE: RegExp;
+/**
+ * Canonicalizes accepted line endings to LF.
+ *
+ * The command parses leniently and writes strictly: CRLF is accepted from a
+ * caller — a `--body -` fed from a file, tool output, or a pasted buffer — and
+ * stored as LF, so a log this command writes never contains a terminator other
+ * than LF. That makes the file's single reading a property of its bytes rather
+ * than of every reader agreeing about them, which is the weaker guarantee this
+ * module kept failing to hold.
+ *
+ * It is not needed to satisfy `rollup`'s `^…$/m` ledger scan: a multiline `$`
+ * matches before a CR as readily as before an LF, so that scan reads a CRLF log
+ * correctly and always did. Storing LF is a narrowing of what future readers
+ * must cope with, not a repair of a present disagreement.
+ */
+export declare function normalizeProjectLogLineEndings(value: string): string;
+/**
+ * Splits on every LineTerminator, treating CRLF as one boundary.
+ *
+ * Validators use this rather than a `/\r?\n/` split so that a lone CR, a
+ * U+2028, or a U+2029 starts a new line for validation just as it would for a
+ * regular expression's multiline `^`.
+ */
+export declare function splitProjectLogLines(content: string): string[];
+/**
+ * The log's `## ` section boundaries, where a boundary is a `## ` that begins
+ * the content or directly follows a line feed.
+ *
+ * LF is the only boundary on purpose. The previous `/^## [^\r\n]+/gm` anchored
+ * after all four LineTerminators while the append validator only split on
+ * `/\r?\n/`, so a judgment body reading `carrier<CR>## Injected` passed
+ * validation and then became a real section boundary — truncating `## Entries`
+ * so `check` reported an already-written seal as `sealed: false` and appends
+ * kept succeeding onto a sealed log. Anchoring on LF alone keeps this parser
+ * and `parseProjectLogEntries`, which splits its section on `/\r?\n/`, reading
+ * the same file the same way, and it holds for a log written by hand as well as one
+ * the command wrote.
+ */
 export declare function findProjectLogSections(content: string): ProjectLogSection[];
+/**
+ * Whether the log contains a heading that a `^…$/m` reader starts a line at but
+ * an LF-only reader does not — that is, whether the file has two readings.
+ *
+ * The two competing readers are enumerated rather than approximated: the
+ * pre-fix section scan `/^## [^\r\n]+/gm`, and `rollup.ts`'s ledger scan, which
+ * recognizes only the complete dated judgment grammar. A `### ` line that
+ * neither recognizes — `carrier<CR>### Notes` — is body text to every reader and
+ * is deliberately *not* flagged; refusing it would strand logs a previous
+ * release could legitimately have written.
+ *
+ * Mutators consult this and refuse rather than guess, because a file with two
+ * readings cannot answer "is this sealed?". Tightening the section parser to LF
+ * alone would otherwise silently *widen* such logs: a hand-written
+ * `preamble<U+2028>## Entries` used to parse, so its seal was found and a
+ * replayed seal was deduplicated, and under an LF-only reading the same file has
+ * no entries region, reports unsealed, and accepts a second seal. Refusing is
+ * the only resolution that is not weaker than the reading it replaces.
+ *
+ * CRLF is deliberately not caught, and the entries parser now earns that
+ * exemption rather than merely asserting it. The character immediately before a
+ * marker on a `\r\n`-terminated line is the LF, so a `## ` section boundary was
+ * always unambiguous; `### ` entries and the structural heading pattern were not,
+ * because their `$` cannot match before a trailing `\r`, so a CRLF log parsed to
+ * zero entries and an existing seal was invisible. `parseProjectLogEntries` now
+ * splits on `/\r?\n/`, which makes all three agree and makes "CRLF has exactly
+ * one reading" a fact about this module rather than a hope.
+ */
+export declare function containsAmbiguousProjectLogMarker(content: string): boolean;
 export declare function composeJudgmentHeading(input: {
     date: string;
     scope: ProjectLogScope;
@@ -25,4 +121,73 @@ export declare function composeStructuralHeading(input: {
     producer: string;
     ref: string;
 }): string;
+/**
+ * The producer and ref that together identify the completion seal — the last
+ * entry a project log may ever receive.
+ *
+ * Both fields are required. A `seal` ref from another producer is an ordinary
+ * structural entry, and an `oat-project-complete` entry with another ref is an
+ * ordinary lifecycle entry; treating either as a seal would let a foreign
+ * append freeze a log that was never completed.
+ */
+export declare const PROJECT_LOG_SEAL_PRODUCER = "oat-project-complete";
+export declare const PROJECT_LOG_SEAL_REF = "seal";
+/**
+ * The prefix of the seal's idempotency token (`oat-seal:<project>`).
+ *
+ * The token is what makes a replayed seal recognize its own entry, so it is
+ * prefixed rather than bare: a project name alone could occur in ordinary prose
+ * and match an unrelated body.
+ */
+export declare const PROJECT_LOG_SEAL_KEY_PREFIX = "oat-seal:";
+/**
+ * The single definition of "this entry is the completion seal", shared by the
+ * `check` probe and the `append` guard.
+ *
+ * Both callers route on this one predicate on purpose: two definitions of
+ * sealed is the regression that lets a log report itself unsealed to one
+ * command and sealed to the other.
+ */
+export declare function isProjectLogSealEntry(entry: {
+    producer: string;
+    ref: string;
+}): boolean;
+/**
+ * Whether a composed or parsed entry *heading* is the completion seal's.
+ *
+ * The heading-level counterpart of `isProjectLogSealEntry`, and it delegates to
+ * it rather than restating the rule. One predicate serves both directions —
+ * "is this request the seal?" and "does this already-appended heading name a
+ * seal?" — so the two can never drift into disagreeing about what a seal
+ * heading is. It reads the producer and ref back out of the heading text rather
+ * than from a caller's flags, which is the same normalization
+ * `parseProjectLogEntries` applies.
+ */
+export declare function isProjectLogSealHeading(heading: string): boolean;
+/**
+ * The raw line of `content` that is a completion-seal heading, or undefined.
+ *
+ * Deliberately independent of `parseProjectLogEntries`: it answers "is a seal
+ * physically in this file?" where the parser answers "can this file's structure
+ * be read to contain a seal?". The gap between those two questions is the state
+ * every mutator must refuse, and all of them ask it the same way.
+ *
+ * The offset is returned alongside the text because callers must locate the
+ * seal, not merely recognize it: prose inside `## Entries` can quote a seal
+ * heading verbatim, so a substring test would place a seal that really sits
+ * under a later section inside the entries region and blame the wrong cause.
+ */
+export declare function findProjectLogSealHeadingLine(content: string): {
+    line: string;
+    index: number;
+} | undefined;
+/**
+ * Whether a seal body carries the canonical stand-alone seal token.
+ *
+ * `idempotencyToken` records the whole whitespace-delimited word containing a
+ * key, so a key glued to the varying completion timestamp never matches its own
+ * earlier append. A seal written before this convention carries no token at
+ * all, which is exactly why the seal is also recognized structurally.
+ */
+export declare function carriesProjectLogSealKey(body: string): boolean;
 //# sourceMappingURL=grammar.d.ts.map

package/dist/commands/project/log/grammar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grammar.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/grammar.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,YAC5B,KAAK,EACL,UAAU,EACV,aAAa,EACb,UAAU,CACF,CAAC;AACX,eAAO,MAAM,kBAAkB,YAAI,SAAS,EAAE,SAAS,CAAU,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,6BAA6B,WAAM,CAAC;AAEjD,eAAO,MAAM,mBAAmB,QACqE,CAAC;AACtG,eAAO,MAAM,qBAAqB,QACoC,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAO3E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,MAAM,CAET"}
+{"version":3,"file":"grammar.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/grammar.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,YAC5B,KAAK,EACL,UAAU,EACV,aAAa,EACb,UAAU,CACF,CAAC;AACX,eAAO,MAAM,kBAAkB,YAAI,SAAS,EAAE,SAAS,CAAU,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,6BAA6B,WAAM,CAAC;AAEjD,eAAO,MAAM,mBAAmB,QACqE,CAAC;AACtG,eAAO,MAAM,qBAAqB,QACoC,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,QAAuB,CAAC;AAEnE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,QAA4B,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE9D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAO3E;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc1E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAET;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,MAAM,CAET;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAChE,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAKV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAShE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAY7C;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ9D"}

package/dist/commands/project/log/grammar.js

@@ -15,17 +15,235 @@ export function isProjectLogSectionMarker(line) {
 export function isProjectLogEntryMarker(line) {
     return /^### .+$/.test(line);
 }
+/**
+ * Every character JavaScript treats as a LineTerminator, and therefore every
+ * character a multiline `^` anchors after: LF, CR, U+2028 LINE SEPARATOR, and
+ * U+2029 PARAGRAPH SEPARATOR. VT, FF, and U+0085 NEL are deliberately absent —
+ * ECMAScript does not count them, so `^` does not match after them either.
+ *
+ * The set is exported rather than inlined because the append validator and this
+ * parser must enumerate exactly the same characters. A validator that split on
+ * fewer terminators than the parser anchored after is precisely how a body
+ * could smuggle a `## ` past validation and have it become a real section
+ * boundary, silently truncating the parsed entries region and voiding the
+ * completion seal.
+ */
+export const PROJECT_LOG_LINE_TERMINATOR_RE = /[\n\r\u2028\u2029]/;
+/**
+ * A *lone* line terminator: a carriage return not followed by a line feed, or a
+ * U+2028 / U+2029 separator.
+ *
+ * CRLF is deliberately excluded, and that carve-out is the whole point. Every
+ * reader in this module treats `\r\n` as exactly one boundary — `splitProjectLogLines`,
+ * the `/\r?\n/` scans, and `parseProjectLogEntries` — so a CRLF body has one
+ * reading and is accepted, as it was before this guard existed. A *lone* CR has
+ * two readings (a boundary to a multiline `^`, body text to everything here),
+ * and so do U+2028 and U+2029, so those stay refused.
+ *
+ * Written as one pattern rather than a strip-then-test so the rule is legible at
+ * the point of use: `\r(?!\n)` is "a carriage return that is not part of CRLF".
+ */
+export const PROJECT_LOG_LONE_TERMINATOR_RE = /\r(?!\n)|[\u2028\u2029]/;
+/**
+ * Canonicalizes accepted line endings to LF.
+ *
+ * The command parses leniently and writes strictly: CRLF is accepted from a
+ * caller — a `--body -` fed from a file, tool output, or a pasted buffer — and
+ * stored as LF, so a log this command writes never contains a terminator other
+ * than LF. That makes the file's single reading a property of its bytes rather
+ * than of every reader agreeing about them, which is the weaker guarantee this
+ * module kept failing to hold.
+ *
+ * It is not needed to satisfy `rollup`'s `^…$/m` ledger scan: a multiline `$`
+ * matches before a CR as readily as before an LF, so that scan reads a CRLF log
+ * correctly and always did. Storing LF is a narrowing of what future readers
+ * must cope with, not a repair of a present disagreement.
+ */
+export function normalizeProjectLogLineEndings(value) {
+    return value.replaceAll('\r\n', '\n');
+}
+/**
+ * Splits on every LineTerminator, treating CRLF as one boundary.
+ *
+ * Validators use this rather than a `/\r?\n/` split so that a lone CR, a
+ * U+2028, or a U+2029 starts a new line for validation just as it would for a
+ * regular expression's multiline `^`.
+ */
+export function splitProjectLogLines(content) {
+    return content.split(/\r\n|[\n\r\u2028\u2029]/);
+}
+/**
+ * The log's `## ` section boundaries, where a boundary is a `## ` that begins
+ * the content or directly follows a line feed.
+ *
+ * LF is the only boundary on purpose. The previous `/^## [^\r\n]+/gm` anchored
+ * after all four LineTerminators while the append validator only split on
+ * `/\r?\n/`, so a judgment body reading `carrier<CR>## Injected` passed
+ * validation and then became a real section boundary — truncating `## Entries`
+ * so `check` reported an already-written seal as `sealed: false` and appends
+ * kept succeeding onto a sealed log. Anchoring on LF alone keeps this parser
+ * and `parseProjectLogEntries`, which splits its section on `/\r?\n/`, reading
+ * the same file the same way, and it holds for a log written by hand as well as one
+ * the command wrote.
+ */
 export function findProjectLogSections(content) {
-    const matches = [...content.matchAll(/^## [^\r\n]+/gm)];
+    const matches = [...content.matchAll(/(?<=^|\n)## [^\r\n]+/g)];
     return matches.map((match, index) => ({
         heading: match[0],
         start: match.index,
         end: matches[index + 1]?.index ?? content.length,
     }));
 }
+/**
+ * The judgment-heading scan a `^…$/m` reader performs — the same pattern
+ * `rollup.ts` uses to key its ledger.
+ *
+ * Declared here so `containsAmbiguousProjectLogMarker` can ask the competing
+ * reader what *it* would see, rather than approximating it. `matchAll` builds a
+ * fresh regex per call, so the `g` flag's `lastIndex` is never shared.
+ */
+/**
+ * The single-character form of "a terminator other than LF", for testing the
+ * one character that precedes a match. A lookahead-based rule cannot be used on
+ * a lone character; it does not need to be, because the character before a
+ * heading on a CRLF line is the LF, so CRLF never reaches this test.
+ */
+const PRECEDING_NON_LINE_FEED_TERMINATOR_RE = /[\r\u2028\u2029]/;
+const JUDGMENT_HEADING_SCAN_RE = /^### (\d{4}-\d{2}-\d{2}) \u00b7 (project|general) \u00b7 (bug|friction|worked-well|feedback) \u00b7 ([^\u00b7\r\n]+)$/gm;
+/**
+ * Whether the log contains a heading that a `^…$/m` reader starts a line at but
+ * an LF-only reader does not — that is, whether the file has two readings.
+ *
+ * The two competing readers are enumerated rather than approximated: the
+ * pre-fix section scan `/^## [^\r\n]+/gm`, and `rollup.ts`'s ledger scan, which
+ * recognizes only the complete dated judgment grammar. A `### ` line that
+ * neither recognizes — `carrier<CR>### Notes` — is body text to every reader and
+ * is deliberately *not* flagged; refusing it would strand logs a previous
+ * release could legitimately have written.
+ *
+ * Mutators consult this and refuse rather than guess, because a file with two
+ * readings cannot answer "is this sealed?". Tightening the section parser to LF
+ * alone would otherwise silently *widen* such logs: a hand-written
+ * `preamble<U+2028>## Entries` used to parse, so its seal was found and a
+ * replayed seal was deduplicated, and under an LF-only reading the same file has
+ * no entries region, reports unsealed, and accepts a second seal. Refusing is
+ * the only resolution that is not weaker than the reading it replaces.
+ *
+ * CRLF is deliberately not caught, and the entries parser now earns that
+ * exemption rather than merely asserting it. The character immediately before a
+ * marker on a `\r\n`-terminated line is the LF, so a `## ` section boundary was
+ * always unambiguous; `### ` entries and the structural heading pattern were not,
+ * because their `$` cannot match before a trailing `\r`, so a CRLF log parsed to
+ * zero entries and an existing seal was invisible. `parseProjectLogEntries` now
+ * splits on `/\r?\n/`, which makes all three agree and makes "CRLF has exactly
+ * one reading" a fact about this module rather than a hope.
+ */
+export function containsAmbiguousProjectLogMarker(content) {
+    if (/(?<=[\r\u2028\u2029])## [^\r\n]+/.test(content)) {
+        return true;
+    }
+    for (const match of content.matchAll(JUDGMENT_HEADING_SCAN_RE)) {
+        const preceding = content[match.index - 1];
+        if (preceding !== undefined &&
+            PRECEDING_NON_LINE_FEED_TERMINATOR_RE.test(preceding)) {
+            return true;
+        }
+    }
+    return false;
+}
 export function composeJudgmentHeading(input) {
     return `### ${input.date} · ${input.scope} · ${input.type} · ${input.area}`;
 }
 export function composeStructuralHeading(input) {
     return `### ${input.date} · structural · ${input.producer} · ${input.ref}`;
 }
+/**
+ * The producer and ref that together identify the completion seal — the last
+ * entry a project log may ever receive.
+ *
+ * Both fields are required. A `seal` ref from another producer is an ordinary
+ * structural entry, and an `oat-project-complete` entry with another ref is an
+ * ordinary lifecycle entry; treating either as a seal would let a foreign
+ * append freeze a log that was never completed.
+ */
+export const PROJECT_LOG_SEAL_PRODUCER = 'oat-project-complete';
+export const PROJECT_LOG_SEAL_REF = 'seal';
+/**
+ * The prefix of the seal's idempotency token (`oat-seal:<project>`).
+ *
+ * The token is what makes a replayed seal recognize its own entry, so it is
+ * prefixed rather than bare: a project name alone could occur in ordinary prose
+ * and match an unrelated body.
+ */
+export const PROJECT_LOG_SEAL_KEY_PREFIX = 'oat-seal:';
+/**
+ * The single definition of "this entry is the completion seal", shared by the
+ * `check` probe and the `append` guard.
+ *
+ * Both callers route on this one predicate on purpose: two definitions of
+ * sealed is the regression that lets a log report itself unsealed to one
+ * command and sealed to the other.
+ */
+export function isProjectLogSealEntry(entry) {
+    return (entry.producer === PROJECT_LOG_SEAL_PRODUCER &&
+        entry.ref === PROJECT_LOG_SEAL_REF);
+}
+/**
+ * Whether a composed or parsed entry *heading* is the completion seal's.
+ *
+ * The heading-level counterpart of `isProjectLogSealEntry`, and it delegates to
+ * it rather than restating the rule. One predicate serves both directions —
+ * "is this request the seal?" and "does this already-appended heading name a
+ * seal?" — so the two can never drift into disagreeing about what a seal
+ * heading is. It reads the producer and ref back out of the heading text rather
+ * than from a caller's flags, which is the same normalization
+ * `parseProjectLogEntries` applies.
+ */
+export function isProjectLogSealHeading(heading) {
+    const parsed = STRUCTURAL_HEADING_RE.exec(heading);
+    return (parsed !== null &&
+        isProjectLogSealEntry({
+            producer: parsed[2].trim(),
+            ref: parsed[3].trim(),
+        }));
+}
+/**
+ * The raw line of `content` that is a completion-seal heading, or undefined.
+ *
+ * Deliberately independent of `parseProjectLogEntries`: it answers "is a seal
+ * physically in this file?" where the parser answers "can this file's structure
+ * be read to contain a seal?". The gap between those two questions is the state
+ * every mutator must refuse, and all of them ask it the same way.
+ *
+ * The offset is returned alongside the text because callers must locate the
+ * seal, not merely recognize it: prose inside `## Entries` can quote a seal
+ * heading verbatim, so a substring test would place a seal that really sits
+ * under a later section inside the entries region and blame the wrong cause.
+ */
+export function findProjectLogSealHeadingLine(content) {
+    let cursor = 0;
+    for (const line of splitProjectLogLines(content)) {
+        if (isProjectLogSealHeading(line.trim())) {
+            return { line, index: content.indexOf(line, cursor) };
+        }
+        // Advance past this line and the terminator that ended it. The terminator's
+        // width varies (CRLF is two units), so it is measured rather than assumed.
+        const next = content.indexOf(line, cursor) + line.length;
+        cursor = next + (content.startsWith('\r\n', next) ? 2 : 1);
+    }
+    return undefined;
+}
+/**
+ * Whether a seal body carries the canonical stand-alone seal token.
+ *
+ * `idempotencyToken` records the whole whitespace-delimited word containing a
+ * key, so a key glued to the varying completion timestamp never matches its own
+ * earlier append. A seal written before this convention carries no token at
+ * all, which is exactly why the seal is also recognized structurally.
+ */
+export function carriesProjectLogSealKey(body) {
+    return body
+        .split(/\s+/)
+        .some((word) => word.startsWith(PROJECT_LOG_SEAL_KEY_PREFIX) &&
+        word.length > PROJECT_LOG_SEAL_KEY_PREFIX.length);
+}

package/dist/commands/project/log/rollup.d.ts

@@ -14,12 +14,27 @@ export interface RollupProjectLogInput {
     summaryPath?: string;
     artifactTarget?: ProjectLogArtifactTarget;
 }
-export interface ProjectLogRollupResult {
+/** The outcome of a roll-up that actually read the log. */
+export interface ProjectLogRollupSuccess {
     status: 'ok' | 'failed';
     summarySection: 'written' | 'updated';
     ledgerOutcome: 'appended' | 'deduplicated' | 'skipped_permitted' | 'failed';
     entriesRolledUp: number;
 }
+export type ProjectLogRollupResult = ProjectLogRollupSuccess
+/**
+ * The log has two readings, so its entries cannot be rolled up honestly.
+ *
+ * A separate member rather than an extra field, because the success member's
+ * counts would otherwise have to be filled in with zeros — and reporting
+ * `entriesRolledUp: 0` for an unreadable log is exactly the conflation this
+ * refusal exists to remove: it was byte-identical to the output for an empty
+ * one.
+ */
+ | {
+    status: 'ambiguous';
+    ambiguity: string;
+};
 export interface RollupProjectLogDependencies {
     resolveActiveProject: (repoRoot: string) => Promise<ActiveProjectResolution>;
     resolveEffectiveConfig: (repoRoot: string, userConfigDir: string, env?: NodeJS.ProcessEnv) => Promise<ResolvedConfig>;

package/dist/commands/project/log/rollup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rollup.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/rollup.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAG9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,mCAAmC,EAAE,wBAGjD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,wBAAwB,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,IAAI,GAAG,QAAQ,CAAC;IACxB,cAAc,EAAE,SAAS,GAAG,SAAS,CAAC;IACtC,aAAa,EAAE,UAAU,GAAG,cAAc,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC5E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7E,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KACpB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,mCAAoC,SAAQ,4BAA4B;IACvF,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAiFD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,IAAI,CAChB,4BAA4B,EAC5B,wBAAwB,CACK,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAiBjC;AAoED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,SAAS,GAAE,OAAO,CAAC,4BAA4B,CAAM,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAyCjC;AAmDD,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,OAAO,CAAC,mCAAmC,CAAM,GAC3D,OAAO,CAoBT"}
+{"version":3,"file":"rollup.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/rollup.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAG9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,mCAAmC,EAAE,wBAGjD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,wBAAwB,CAAC;CAC3C;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,IAAI,GAAG,QAAQ,CAAC;IACxB,cAAc,EAAE,SAAS,GAAG,SAAS,CAAC;IACtC,aAAa,EAAE,UAAU,GAAG,cAAc,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC5E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB;AACzB;;;;;;;;GAQG;GACD;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,4BAA4B;IAC3C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7E,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KACpB,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,mCAAoC,SAAQ,4BAA4B;IACvF,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAiFD,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,IAAI,CAChB,4BAA4B,EAC5B,wBAAwB,CACK,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAiBjC;AAoED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,SAAS,GAAE,OAAO,CAAC,4BAA4B,CAAM,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAqDjC;AA4DD,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,OAAO,CAAC,mCAAmC,CAAM,GAC3D,OAAO,CAoBT"}

package/dist/commands/project/log/rollup.js

@@ -8,7 +8,7 @@ import { resolveEffectiveConfig } from '../../../config/resolve.js';
 import { dirExists, fileExists } from '../../../fs/io.js';
 import { resolveProjectRoot } from '../../../fs/paths.js';
 import { Command } from 'commander';
-import { parseProjectLogEntries, PROJECT_LOG_FILENAME, } from './check.js';
+import { findProjectLogAmbiguity, parseProjectLogEntries, PROJECT_LOG_FILENAME, } from './check.js';
 const DEFAULT_LEDGER_PATH = '.oat/repo/reference/project-observations.md';
 const WORKFLOW_OBSERVATIONS_HEADING = '## Workflow Observations';
 export const DEFAULT_PROJECT_LOG_ARTIFACT_TARGET = {
@@ -145,7 +145,17 @@ export async function rollupProjectLog(input, overrides = {}) {
     if (!(await fileExists(summaryPath))) {
         throw new Error(`summary.md does not exist: ${summaryPath}. Author the project summary before roll-up.`);
     }
-    const parsed = parseProjectLogEntries(await readFile(logPath, 'utf8'));
+    const content = await readFile(logPath, 'utf8');
+    // The same question `check`, both append paths and `synthesize` ask, asked
+    // before anything is written. `rollup` was the one surface without it: on a
+    // log the other four refused it rewrote `summary.md` and reported
+    // `status: "ok"` with `entriesRolledUp: 0`, indistinguishable from a clean
+    // empty log. It is a public command an operator can run directly.
+    const ambiguity = findProjectLogAmbiguity(content, logPath);
+    if (ambiguity !== undefined) {
+        return { status: 'ambiguous', ambiguity };
+    }
+    const parsed = parseProjectLogEntries(content);
     const summaryUpdate = writeSummarySection(await readFile(summaryPath, 'utf8'), artifactTarget.summaryHeading ?? WORKFLOW_OBSERVATIONS_HEADING, renderEntries(parsed.entries));
     await writeFile(summaryPath, summaryUpdate.content, 'utf8');
     const ledgerOutcome = await rollupLedger(input, parsed.entries, dependencies);
@@ -165,6 +175,16 @@ async function runRollupCommand(options, context, dependencies) {
             project: options.project,
             summaryPath: options.summaryPath,
         }, dependencies);
+        if (result.status === 'ambiguous') {
+            if (context.json) {
+                context.logger.json(result);
+            }
+            else {
+                context.logger.error(result.ambiguity);
+            }
+            process.exitCode = 1;
+            return;
+        }
         if (context.json) {
             context.logger.json(result);
         }

package/dist/commands/project/log/synthesize.d.ts

@@ -1,6 +1,7 @@
 import { type CommandContext, type GlobalOptions } from '../../../app/command-context.js';
 import { type ActiveProjectResolution } from '../../../config/oat-config.js';
 import { Command } from 'commander';
+import { type ProjectLogLockDependencies } from './append.js';
 export interface SynthesizeProjectLogInput {
     repoRoot: string;
     project?: string;
@@ -9,9 +10,24 @@ export interface SynthesizeProjectLogInput {
 export interface ProjectLogSynthesizeResult {
     status: 'synthesized';
     logPath: string;
+    /**
+     * Present and true when the accepted `--body` carried CRLF and was stored as
+     * LF, so the bytes on disk differ from the bytes the caller passed.
+     */
+    normalizedLineEndings?: true;
 }
 export interface SynthesizeProjectLogDependencies {
     resolveActiveProject: (repoRoot: string) => Promise<ActiveProjectResolution>;
+    /**
+     * The log's own read/write primitives, mirroring `appendProjectLog`.
+     * Injectable so a test can hold this writer inside its rewrite window while
+     * another enters, which is the only way to prove the serialization rather
+     * than assert it.
+     */
+    readLog: (path: string) => Promise<string>;
+    writeLog: (path: string, content: string) => Promise<void>;
+    /** Advisory-lock overrides for the synthesis window. */
+    lock: Partial<ProjectLogLockDependencies>;
 }
 export interface ProjectLogSynthesizeCommandDependencies extends SynthesizeProjectLogDependencies {
     buildCommandContext: (options: GlobalOptions) => CommandContext;

package/dist/commands/project/log/synthesize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"synthesize.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/synthesize.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gCAAgC;IAC/C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,uCAAwC,SAAQ,gCAAgC;IAC/F,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AA+CD,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,SAAS,GAAE,OAAO,CAAC,gCAAgC,CAAM,GACxD,OAAO,CAAC,0BAA0B,CAAC,CAwDrC;AAqCD,wBAAgB,iCAAiC,CAC/C,SAAS,GAAE,OAAO,CAAC,uCAAuC,CAAM,GAC/D,OAAO,CAeT"}
+{"version":3,"file":"synthesize.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/log/synthesize.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAEL,KAAK,0BAA0B,EAEhC,MAAM,UAAU,CAAC;AAkBlB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,wDAAwD;IACxD,IAAI,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,uCAAwC,SAAQ,gCAAgC;IAC/F,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAoDD,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,SAAS,GAAE,OAAO,CAAC,gCAAgC,CAAM,GACxD,OAAO,CAAC,0BAA0B,CAAC,CAkDrC;AA+HD,wBAAgB,iCAAiC,CAC/C,SAAS,GAAE,OAAO,CAAC,uCAAuC,CAAM,GAC/D,OAAO,CAeT"}