@pmelab/gtd 46.0.0 → 48.0.0

package/src/cli/Program.test.ts

@@ -1685,7 +1685,6 @@ describe("runCommand — refuses in a repository with no commits", () => {
     check: { kind: "check", mode: "qa", file: ".gtd/TODO.md" },
     uncheck: { kind: "uncheck", file: ".gtd/REVIEW.md" },
     install: { kind: "install" },
-    loop: { kind: "loop" },
     contextHook: { kind: "contextHook" },
     summary: { kind: "summary" },
     base: { kind: "base" },

package/src/cli/Program.ts

@@ -163,7 +163,6 @@ export type Command =
     }
   | { readonly kind: "uncheck"; readonly file: string }
   | { readonly kind: "install" }
-  | { readonly kind: "loop" }
   | {
       readonly kind: "contextHook"
       readonly soft?: number
@@ -239,9 +238,6 @@ const runInstallCommand = (
     )
   })
 
-const runLoopCommand = (): Effect.Effect<void, Error, ToolCommands> =>
-  Effect.flatMap(ToolCommands, (tools) => tools.loop(selfGtd()))
-
 /**
  * `planLanding`'s result — a preview of what `gtd land` would do, plus the
  * combined `script` the driver runs to do it. `script` is
@@ -1221,7 +1217,6 @@ export const needsOf = (kind: Command["kind"]): Needs => {
   switch (kind) {
     case "lsp":
     case "install":
-    case "loop":
     case "contextHook":
     case "judgeRun":
     case "strays":
@@ -1240,7 +1235,6 @@ export const standaloneKinds = (): readonly Command["kind"][] => [
   "check",
   "uncheck",
   "install",
-  "loop",
   "contextHook",
   "judgeRun",
   "strays",
@@ -1311,8 +1305,6 @@ const dispatchVoidCommand = (
       return runUncheckCommand(command.file)
     case "install":
       return runInstallCommand(out)
-    case "loop":
-      return runLoopCommand()
     case "contextHook":
       return runContextHookCommand(command, out)
     case "summary":

package/src/cli/ToolCommands.ts

@@ -3,7 +3,7 @@ import type { Effect } from "effect"
 import type { UiSettings } from "../flows/index.js"
 import type { ContextHookRequest } from "../wire/index.js"
 
-/** How to run THIS gtd — a driver (the loop, the LSP) never reads a different version's state than the one it ships with. */
+/** How to run THIS gtd — a tool (the LSP) never reads a different version's state than the one it ships with. */
 export type SelfGtd = readonly [string, ...string[]]
 
 export interface UiRequest {
@@ -38,7 +38,6 @@ export class ToolCommands extends Context.Tag("ToolCommands")<
       out: { readonly write: (chunk: string) => void; readonly flush: () => void },
     ) => Effect.Effect<void, Error>
     readonly lsp: (gtd: SelfGtd) => Effect.Effect<void, Error>
-    readonly loop: (gtd: SelfGtd) => Effect.Effect<void, Error>
     /** The hook's stdout: a JSON document, or empty to let the turn go on. */
     readonly contextHook: (request: ContextHookRequest) => Effect.Effect<string, Error>
     readonly judge: (request: JudgeRequest) => Promise<string>

package/src/install/Install.ts

@@ -11,8 +11,15 @@ export CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1
 export BASH_DEFAULT_TIMEOUT_MS=1800000
 export BASH_MAX_TIMEOUT_MS=7200000
 
+# gtd's paths, scripts and checks are relative to the repository root.
+cd "$(git rev-parse --show-toplevel)"
+
 beat=1
 while :; do
+  cost=
+  model=
+  judged_before="\${judged:-}"
+  judged=
   # One value per invocation: \`gtd next --json=<path>\` is a pure read (peek
   # or dispatch, indistinguishable, always safe to call again), so nothing is
   # lost by reading \`kind\`/\`idle\` as two separate calls rather than one
@@ -40,14 +47,22 @@ while :; do
     # \`gtd judge run\` and land the verdict via \`gtd judge answer\`. POSIX sh has
     # no pipefail, so each step is captured first and only piped on when it
     # succeeded; if \`gtd judge run\` fails or \`gtd judge answer\` rejects the
-    # verdict, its stderr reaches you and we fall through to the human hand-off.
+    # verdict, its stderr reaches you and the gate is handed to you — on the
+    # opening beat too, so it never lands unanswered — as it is when the gate
+    # we just answered comes straight back.
     message)
-      if [ -n "$(gtd next --json=judge)" ] &&
-        verdict="$(gtd judge --json | gtd judge run)" &&
-        script="$(printf '%s\\n' "$verdict" | gtd judge answer --json=script)"; then
-        printf '%s\\n' "$script" | sh
-        beat=$((beat + 1))
-        continue
+      if [ -n "$(gtd next --json=judge)" ]; then
+        state="$(gtd next --json=state)"
+        if [ "$state" != "$judged_before" ] &&
+          verdict="$(gtd judge --json | gtd judge run)" &&
+          script="$(printf '%s\\n' "$verdict" | gtd judge answer --json=script)"; then
+          printf '%s\\n' "$script" | sh
+          judged="$state"
+          beat=$((beat + 1))
+          continue
+        fi
+        gtd next
+        exit 0
       fi
       [ "$beat" = 1 ] || {
         gtd next
@@ -66,45 +81,83 @@ while :; do
       model="$(gtd next --json=model)"
       system="$(gtd next --json=system)"
       validate="$(gtd next --json=validate)"
+      context="$(gtd next --json=context)"
       log="$(gtd next --json=log)"
+      # Absolute, since the hook runs wherever the agent last cd'ed to.
+      case "$log" in /*) ;; *) log="$(git rev-parse --show-toplevel)/$log" ;; esac
       # \`model\` is a hint, not a model name — the bundled workflow ships
       # \`smart\` and \`base\`, which \`claude --model\` rejects. Resolve them
-      # with the variables \`gtd loop\` reads; unset, the hint is dropped and
-      # the agent runs its own default. Any other value is a real model name.
+      # from your environment; unset, the hint is dropped and the agent runs
+      # its own default. Any other value is a real model name.
       case "$model" in
         smart) model="\${GTD_LOOP_MODEL_SMART:-}" ;;
         base) model="\${GTD_LOOP_MODEL_BASE:-}" ;;
       esac
-      # The prompt embeds a full diff, so it goes to the agent over stdin,
-      # never as an argv positional — argv is capped (~1 MB on macOS, and
-      # POSIX guarantees only 4 KB, ARG_MAX), and a diff crosses that far
-      # sooner than you'd expect. Piping plain \`gtd next\` (not
-      # --json=content) means the diff is rendered once, for this input,
-      # rather than twice.
-      agent_turn() { gtd next | claude -p "$1" "$session_id" \\
-        \${model:+--model "$model"} \\
-        \${system:+--system-prompt "$system"} \\
-        --dangerously-skip-permissions >>"$log" 2>&1; }
+      # The step's context limit, as a Claude Code hook after every tool
+      # call and before compacting. Past \`hard\` it stops the turn and
+      # appends why to the stop file, so we land nothing and stop too.
+      soft="$(printf '%s' "$context" | sed -n 's/.*"soft":\\([0-9.]*\\).*/\\1/p')"
+      hard="$(printf '%s' "$context" | sed -n 's/.*"hard":\\([0-9.]*\\).*/\\1/p')"
+      window="\${GTD_LOOP_CONTEXT_WINDOW:-}"
+      case "$model" in *'[1m]'* | *'[1M]'*) window="\${window:-1000000}" ;; esac
+      hook="gtd context-hook\${soft:+ --soft $soft}\${hard:+ --hard $hard}\${window:+ --window $window}"
+      hooks="[{\\"hooks\\":[{\\"type\\":\\"command\\",\\"command\\":\\"$hook\\"}]}]"
+      settings="{\\"hooks\\":{\\"PostToolUse\\":$hooks,\\"PreCompact\\":$hooks}}"
+      stop="$log.context-stop"
+      rm -f "$stop"
+      # One turn, its prompt on stdin. The prompt embeds a full diff, so it
+      # never goes on argv — argv is capped (~1 MB on macOS, and POSIX
+      # guarantees only 4 KB, ARG_MAX), and a diff crosses that far sooner
+      # than you'd expect. Every turn passes the same $model/$system:
+      # whether \`claude --resume\` re-applies the original session's is a
+      # harness detail gtd cannot verify from outside. Its JSON envelope
+      # goes to the log, and its \`total_cost_usd\` adds up into $cost. An
+      # \`is_error\` envelope (max turns, an error mid-turn) or one another
+      # hook stopped fails the turn even at exit 0: landing it would land
+      # the failure as work. Only a turn that never ran (no envelope: the
+      # session flag was refused) is worth retrying under the other flag.
+      turn() {
+        out="$(GTD_LOOP_CONTEXT_STOP_FILE="$stop" claude -p "$@" \\
+          \${model:+--model "$model"} \\
+          \${system:+--system-prompt "$system"} \\
+          --settings "$settings" --output-format json \\
+          --dangerously-skip-permissions 2>>"$log")" && ok=0 || ok=$?
+        printf '%s\\n' "$out" >>"$log"
+        case "$out" in *'"type":"result"'*) ran=true ;; *) ran=false ;; esac
+        case "$out" in
+          *'"is_error":true'* | *'"terminal_reason":"hook_stopped"'*) ok=1 ;;
+        esac
+        usd="$(printf '%s\\n' "$out" | sed -n 's/.*"total_cost_usd":\\([0-9.eE+-]*\\).*/\\1/p' | tail -n 1)"
+        [ -z "$usd" ] || cost="$(awk -v a="\${cost:-0}" -v b="$usd" 'BEGIN { printf "%.6f", a + b }')"
+        [ "\${cost:-}" != 0.000000 ] || cost=
+        if [ -s "$stop" ]; then
+          cat "$stop" >&2
+          exit 1
+        fi
+        return "$ok"
+      }
+      # Plain \`gtd next\` (not --json=content) renders the diff once.
+      gtd next >"$log.prompt"
       if [ "\${resume:-}" = true ]
-      then agent_turn --resume || agent_turn --session-id
-      else agent_turn --session-id || agent_turn --resume
+      then first=--resume second=--session-id
+      else first=--session-id second=--resume
       fi
+      turn "$first" "$session_id" <"$log.prompt" ||
+        { [ "$ran" = false ] && turn "$second" "$session_id" <"$log.prompt"; } || {
+        echo "agent turn failed — see $log" >&2
+        exit 1
+      }
       n=0
       while [ -n "\${validate:-}" ] && ! fix="$(sh -c "$validate" 2>&1)"; do
         n=$((n + 1)) && [ "$n" -gt 3 ] && { printf '%s\\n' "$fix" >&2; exit 1; }
-        # $fix IS the fix prompt, verbatim — piped for the same reason the
-        # agent's own turn above is. Whether \`claude --resume\` re-applies the
-        # original session's model/system prompt is a harness detail gtd
-        # cannot verify from outside, so this passes the identical
-        # $model/$system on both calls rather than assume it does —
-        # otherwise this fix turn might silently fall back to Claude Code's
-        # own defaults while the turn that produced the file ran under the
-        # workflow's own model and persona.
-        printf '%s' "$fix" | claude -p --resume "$session_id" \\
-          \${model:+--model "$model"} \\
-          \${system:+--system-prompt "$system"} \\
-          --dangerously-skip-permissions >>"$log" 2>&1
-      done ;;
+        # $fix IS the fix prompt, verbatim.
+        printf '%s' "$fix" >"$log.prompt"
+        turn --resume "$session_id" <"$log.prompt" || {
+          echo "fix turn failed — see $log" >&2
+          exit 1
+        }
+      done
+      rm -f "$log.prompt" ;;
   esac
 
   # Read every value the landing needs BEFORE piping the script to \`sh\`:
@@ -114,7 +167,8 @@ while :; do
   # before the script runs and changes the tree out from under them.
   settled="$(gtd land --json=settled)"
   idle="$(gtd land --json=idle)"
-  gtd land --json=script | sh
+  # A prompt beat's turns record their cost, tagged with the model that ran.
+  gtd land --json=script \${cost:+--cost="$cost"} \${cost:+\${model:+--model="$model"}} | sh
   if [ "\${settled:-}" = true ]; then
     [ "\${idle:-}" = true ] && gtd next
     exit 0

package/src/testkit/Layers.ts

@@ -205,7 +205,6 @@ const missingTool = (name: string) => () =>
 const missingToolCommands: ToolCommands["Type"] = {
   ui: missingTool("ui"),
   lsp: missingTool("lsp"),
-  loop: missingTool("loop"),
   contextHook: missingTool("context-hook"),
   judge: () =>
     Promise.reject(

package/src/wire/ContextLimit.ts

@@ -1,4 +1,4 @@
-// The context-limit decision every driver shares: the loop's `gtd context-hook`
+// The context-limit decision every driver shares: `gtd context-hook`
 // and the Claude Code mod both answer a hook event through `contextHook`, so
 // the two cannot drift on thresholds, wording or which tokens count.
 

package/src/workflows/cleanup/cleanup.test.ts

@@ -90,6 +90,13 @@ describe("the cleanup guard over every later agent turn", () => {
     "build.health.check": () => undefined,
   }
 
+  // One lens finding, judged mechanical, so it reaches the fix turn.
+  const MECHANICAL: Actors = {
+    "build.quality.correctness.reviewing": (_, r) =>
+      r.write(".gtd/QUALITY.md", "# Quality\n\n## a finding\n\nFix it.\n"),
+    "build.quality.triage": () => '[{"id":"Q1","answer":"mechanical","p":0.9}]',
+  }
+
   // Without the shipped access rules, which would refuse a source write from a read-only turn first: the guard is the second line.
   const NO_ACCESS = CONFIG.replace("  access,\n", "")
 
@@ -185,15 +192,11 @@ describe("the cleanup guard over every later agent turn", () => {
     ).rejects.toThrow("src/b.ts:1 still names GTD_FLAG_LIVE")
   })
 
-  it("refuses the first fix after escalating quality findings that re-adds the env var", async () => {
+  it("refuses a quality fix turn that re-adds the env var", async () => {
     await expect(
       driven(guarded("correctness", NO_ACCESS), {
-        "build.quality.correctness.reviewing": (_, r) =>
-          r.write(".gtd/QUALITY.md", "- a finding\n"),
-        "build.fix.quality.fixing": () => undefined,
-        "build.health.describe": () => undefined,
-        "build.health.stop": () => undefined,
-        "build.fix": (_, r) => r.write("src/b.ts", NAMED),
+        ...MECHANICAL,
+        "build.fix.quality.fixing": (_, r) => r.write("src/b.ts", NAMED),
       }),
     ).rejects.toThrow("src/b.ts:1 still names GTD_FLAG_LIVE")
   })
@@ -209,8 +212,7 @@ describe("the cleanup guard over every later agent turn", () => {
   it("refuses a quality fix turn that restores the registry entry", async () => {
     await expect(
       driven(guarded("correctness"), {
-        "build.quality.correctness.reviewing": (_, r) =>
-          r.write(".gtd/QUALITY.md", "- a finding\n"),
+        ...MECHANICAL,
         "build.fix.quality.fixing": (_, r) => r.write("src/flags/index.ts", REGISTRY),
       }),
     ).rejects.toThrow('still declares flag "live"')

package/src/workflows/feature/feature.ts

@@ -9,9 +9,10 @@ import {
   slice,
   start,
 } from "../../flows/index.js"
-import { gate, healthy } from "../shared/health.js"
+import { gate } from "../shared/health.js"
+import { joinReports, type LensReport } from "../shared/lenses.js"
 import { flagModeOn, shipped } from "../shared/options.js"
-import { FEEDBACK, fixCheck, QUALITY, REQUIREMENTS } from "../shared/steps.js"
+import { FEEDBACK, REQUIREMENTS } from "../shared/steps.js"
 import { refusePendingHandOff, tail } from "../shared/tail.js"
 import * as t from "../shared/text.js"
 import {
@@ -36,7 +37,8 @@ import { recordRisk, riskTierOn, type RiskTier } from "./tier.js"
 // green-baseline gate → design → per slice of the criteria, a naive pass,
 // judged with `flagMode` on: it lands as the implementation, or (refactoring
 // first when the judge asks) is built fresh from → the health loop → the
-// quality lap → after the last slice, human review of the whole change, which
+// triaged quality lap, whose leftovers are carried on → after the last slice,
+// human review of the whole change and every slice's findings, which
 // signs off (the episode ends back at `idle`) or sends a design → implement
 // lap.
 
@@ -63,10 +65,12 @@ export const buildFeature = async (firstBase: string): Promise<void> => {
   const one = slices.length === 1
   // A steer may delete every criterion of a later slice: there is nothing to build there.
   const built = (i: number): boolean => sliceIds(sliceCriteria(slices, i))?.length !== 0
+  const reports: { slice: string; report: LensReport }[] = []
   for (const i of slices.keys()) {
     if (!built(i)) continue
     const n = one ? "" : `-${i + 1}`
     await buildSlice(i === 0 ? firstBase : head(), {
+      number: `${i + 1}`,
       tier,
       criteria: sliceCriteria(slices, i),
       refactor: `refactor${n}`,
@@ -76,6 +80,7 @@ export const buildFeature = async (firstBase: string): Promise<void> => {
       // Every slice but the one is built unreviewed, so the review covers them all.
       reviewBase: one ? undefined : firstBase,
       handedOut,
+      laps: reports,
     })
   }
 }
@@ -88,6 +93,8 @@ const gather = (handedOut: Set<string>): readonly string[] => {
 }
 
 interface SliceBuild {
+  /** The slice's number, from 1. */
+  readonly number: string
   readonly tier: RiskTier | undefined
   readonly criteria: CriteriaSlice | undefined
   readonly refactor: string
@@ -97,6 +104,8 @@ interface SliceBuild {
   readonly reviewBase?: string | undefined
   /** Every criterion ID handed out so far; the slice adds those a steer adds. */
   readonly handedOut: Set<string>
+  /** Each earlier slice's lap report, by slice number, for the review after the last one. */
+  readonly laps: { slice: string; report: LensReport }[]
 }
 
 /** A naive pass (judged only with `flagMode` on), then implement and the quality lap; after the last slice, the review. */
@@ -127,37 +136,38 @@ const buildSlice = async (sliceBase: string, build: SliceBuild): Promise<void> =
     if (more) {
       // The criteria stay in the tree for the next slice; no quality fix may move them.
       const guard = () => requireCriteriaFrozen(REQUIREMENTS)
-      await tail(settleQuality, { green: true, lensBase: base, guard, guardRests: false })
+      // No gate between slices: what the lap left waits for the review after the last one.
+      const report = await tail(async (_, report) => report, {
+        green: true,
+        lensBase: base,
+        guard,
+        guardRests: false,
+      })
+      build.laps.push({ slice: build.number, report })
       return
     }
     const reviewBase = build.reviewBase ?? base
-    await featureFeedback(await reviewedTail(reviewBase, base), base, { closed, used })
+    const outcome = await reviewedTail(reviewBase, base, { slice: build.number, laps: build.laps })
+    await featureFeedback(outcome, base, { closed, used })
   })
 }
 
-// Between slices nothing reviews the lap's leftovers, and the next lap appends to the file.
-// Empty counts as resolved, as the lap reads it.
-const settleQuality = async (): Promise<void> => {
-  let rested = false
-  while ((read(QUALITY) ?? "").length > 0) {
-    rested = true
-    await human("quality-unresolved", {
-      message: t.qualityUnresolvedMessage(),
-      label: "Quality findings left unresolved",
-      file: QUALITY,
-    })
-  }
-  // The person may have fixed code by hand there; nothing else checks it before the review.
-  if (rested) await healthy(() => fixCheck())
-}
-
-/** The triaged quality lap, then the human review since `base`. */
-const reviewedTail = (base: string, lensBase: string): Promise<ReviewOutcome> =>
-  tail((escalations, report) => humanReview(base, escalations, { report }), {
-    green: true,
-    lensBase,
-    triage: true,
-  })
+/** The quality lap of slice `last.slice`, then the human review since `base`, listing what earlier slices' `laps` left too. */
+const reviewedTail = (
+  base: string,
+  lensBase: string,
+  last: { readonly slice: string; readonly laps: SliceBuild["laps"] } = { slice: "", laps: [] },
+): Promise<ReviewOutcome> =>
+  tail(
+    (escalations, report) =>
+      humanReview(base, escalations, {
+        report:
+          last.laps.length === 0
+            ? report
+            : joinReports([...last.laps, { slice: last.slice, report }]),
+      }),
+    { green: true, lensBase },
+  )
 
 // seam.naive / seam.judge never run on a feedback lap: its design → implement is built unjudged
 // and unrefactored, held to every criterion's coverage since the process start.

package/src/workflows/feature/lens-review.feature

@@ -74,6 +74,7 @@ Feature: the quality lenses are the only agentic review
       Should subtract round? The criterion does not say.
       """
     And step "build.quality.sorting" runs its script
+    And step "build.quality.closing" runs its script
     And step "build.review.composing" runs its script
 
   Scenario: a mechanical finding is fixed and listed, noise dropped and listed, a design one noted
@@ -184,7 +185,8 @@ Feature: the quality lenses are the only agentic review
       gtd(agent): build.fix.quality.fixing
       gtd(agent): build.fix.quality.fixing
       gtd(agent): build.fix.quality.fixing → build.health.check
-      gtd(check): build.health.check → build.review.composing
+      gtd(check): build.health.check → build.quality.closing
+      gtd(check): build.quality.closing → build.review.composing
       gtd(check): build.review.composing → build.review.await-review
       """
 

package/src/workflows/feature/slice-findings.feature

@@ -0,0 +1,198 @@
+@inmem
+Feature: every slice's quality lap is triaged, and its leftovers wait for the review
+
+  A judge sorts each slice's findings like the last slice's (see
+  `lens-review.feature`): mechanical ones are fixed, noise is dropped, design
+  ones are never sent to the fixer. Nothing between slices asks a person
+  anything — what a lap leaves is carried to the review after the last slice,
+  each finding naming its slice and lens.
+
+  Background:
+    Given the shipped workflows, as gtd install scaffolds them
+    And an environment variable "GTD_QUALITYREVIEWS" set to "correctness"
+    And an environment variable "GTD_FLAGMODE" set to "false"
+    And an environment variable "GTD_SLICEMAXCRITERIA" set to "1"
+    And a file "src/calc.ts" with:
+      """
+      export const add = (a: number, b: number) => a + b
+      """
+    And the working tree is committed as "feat: add calculator"
+    And a file "TODO.md" with:
+      """
+      # More arithmetic
+
+      subtract and multiply.
+      """
+    And step "unwind" changes nothing
+    And step "start-gate.check" changes nothing
+    And step "design.triage" writes ".gtd/REQUIREMENTS.md" with:
+      """
+      # Requirements
+
+      ## Acceptance Criteria
+
+      - AC-1: subtract(a, b) returns a - b.
+      - AC-2: multiply(a, b) returns a * b.
+      """
+    And step "design.gate.answer" changes nothing
+    And step "design.slicing" writes ".gtd/SLICES.md" with:
+      """
+      # Slices
+
+      ## Subtract
+
+      - AC-1
+
+      ## Multiply
+
+      - AC-2
+      """
+    And step "seam.naive", when prompted with "This slice builds AC-1 only", writes "src/sub.test.ts" with:
+      """
+      it("[AC-1] subtracts", () => {})
+      """
+    And step "seam.naive", when prompted with "This slice builds AC-2 only", writes "src/mul.test.ts" with:
+      """
+      it("[AC-2] multiplies", () => {})
+      """
+    And step "seam.check" changes nothing
+    And step "implement.applying" runs its script
+    And step "implement.health.check" changes nothing
+    And step "implement.closing" runs its script
+    And judge step "implement.coverage", when its questions contain "AC-1", answers:
+      """
+      [{"id":"AC-1","answer":"yes","p":0.9}]
+      """
+    And judge step "implement.coverage", when its questions contain "AC-2", answers:
+      """
+      [{"id":"AC-2","answer":"yes","p":0.9}]
+      """
+    And step "build.quality.sorting" runs its script
+    And step "build.quality.closing" runs its script
+    And step "build.health.check" changes nothing
+    And step "build.review.composing" runs its script
+
+  Scenario: a finding questioning a criterion reaches the final review, never the fixer
+    Given step "build.quality.correctness.reviewing" writes ".gtd/QUALITY.md" with:
+      """
+      # Quality
+
+      ## AC-1 ignores floating point
+
+      Should subtract round? The criterion does not say.
+      """
+    And judge step "build.quality.triage" answers:
+      """
+      [{"id":"Q1","answer":"design","p":0.9}]
+      """
+    When the process is driven
+    Then the process rests at "build.review.await-review"
+    And no commit body contains "build.fix.quality.fixing"
+    And ".gtd/QUALITY.md" does not exist
+    And ".gtd/REVIEW.md" contains:
+      """
+      ## AC-1 ignores floating point
+
+      _From slice 1, lens correctness._
+
+      Should subtract round? The criterion does not say.
+      """
+    And ".gtd/REVIEW.md" contains:
+      """
+      ## AC-1 ignores floating point (2)
+
+      _From slice 2, lens correctness._
+      """
+    And the commit subjects end with:
+      """
+      gtd(check): implement.closing → build.quality.correctness.reviewing
+      gtd(agent): build.quality.correctness.reviewing → build.quality.triage
+      gtd(judge): build.quality.triage → build.quality.sorting
+      gtd(check): build.quality.sorting → seam.naive
+      gtd(agent): seam.naive → seam.check
+      gtd(check): seam.check → implement.applying
+      gtd(check): implement.applying → implement.health.check
+      gtd(check): implement.health.check → implement.coverage
+      gtd(judge): implement.coverage → implement.closing
+      gtd(check): implement.closing → build.quality.correctness.reviewing
+      gtd(agent): build.quality.correctness.reviewing → build.quality.triage
+      gtd(judge): build.quality.triage → build.quality.sorting
+      gtd(check): build.quality.sorting → build.review.composing
+      gtd(check): build.review.composing → build.review.await-review
+      """
+
+  Scenario: a mechanical finding the fix cap leaves in an early slice is carried, never escalated
+    Given step "build.quality.correctness.reviewing" writes ".gtd/QUALITY.md" with:
+      """
+      # Quality
+
+      ## subtract has no negative test
+
+      Add a test subtracting a larger number.
+      """
+    And judge step "build.quality.triage" answers:
+      """
+      [{"id":"Q1","answer":"mechanical","p":0.9}]
+      """
+    And step "build.fix.quality.fixing" changes nothing
+    When the process is driven
+    Then the process rests at "build.review.await-review"
+    And no commit body contains "build.health.describe"
+    And ".gtd/REVIEW.md" contains:
+      """
+      ## subtract has no negative test
+
+      _From slice 1, lens correctness._
+
+      _The fixer left this unresolved._
+      """
+    And the commit subjects end with:
+      """
+      gtd(check): implement.closing → build.quality.correctness.reviewing
+      gtd(agent): build.quality.correctness.reviewing → build.quality.triage
+      gtd(judge): build.quality.triage → build.fix.quality.fixing
+      gtd(agent): build.fix.quality.fixing
+      gtd(agent): build.fix.quality.fixing
+      gtd(agent): build.fix.quality.fixing → build.health.check
+      gtd(check): build.health.check → build.quality.closing
+      gtd(check): build.quality.closing → seam.naive
+      gtd(agent): seam.naive → seam.check
+      gtd(check): seam.check → implement.applying
+      gtd(check): implement.applying → implement.health.check
+      gtd(check): implement.health.check → implement.coverage
+      gtd(judge): implement.coverage → implement.closing
+      gtd(check): implement.closing → build.quality.correctness.reviewing
+      gtd(agent): build.quality.correctness.reviewing → build.quality.triage
+      gtd(judge): build.quality.triage → build.fix.quality.fixing
+      gtd(agent): build.fix.quality.fixing
+      gtd(agent): build.fix.quality.fixing
+      gtd(agent): build.fix.quality.fixing → build.health.check
+      gtd(check): build.health.check → build.quality.closing
+      gtd(check): build.quality.closing → build.review.composing
+      gtd(check): build.review.composing → build.review.await-review
+      """
+
+  Scenario: the final review lists every slice's fixes with their commits
+    Given step "build.quality.correctness.reviewing" writes ".gtd/QUALITY.md" with:
+      """
+      # Quality
+
+      ## subtract has no negative test
+
+      Add a test subtracting a larger number.
+      """
+    And judge step "build.quality.triage" answers:
+      """
+      [{"id":"Q1","answer":"mechanical","p":0.9}]
+      """
+    And step "build.fix.quality.fixing" writes "src/edge.test.ts" with:
+      """
+      it("subtracts a larger number", () => {})
+      """
+    And step "build.fix.quality.fixing" deletes ".gtd/QUALITY.md"
+    When the process is driven
+    Then the process rests at "build.review.await-review"
+    And ".gtd/REVIEW.md" contains ", slice 1, lens correctness)"
+    And ".gtd/REVIEW.md" contains ", slice 2, lens correctness)"
+    And ".gtd/REVIEW.md" contains the short hash of the commit "gtd(agent): build.fix.quality.fixing → build.health.check"
+    And no commit body contains "build.quality.closing"