@possumtech/rummy 2.0.1 → 2.2.0

package/src/plugins/cli/cli.js

@@ -0,0 +1,146 @@
+import ProjectAgent from "../../agent/ProjectAgent.js";
+import File from "../file/file.js";
+
+const TERMINAL_STATUSES = new Set([200, 204, 413, 422, 499, 500]);
+
+// Inert unless RUMMY_PROMPT is set; see plugin README.
+export default class Cli {
+	#core;
+
+	constructor(core) {
+		this.#core = core;
+		core.on("boot.completed", this.#onBoot.bind(this));
+	}
+
+	async #onBoot({ db, hooks }) {
+		const prompt = process.env.RUMMY_PROMPT;
+		if (!prompt) return;
+
+		const model = process.env.RUMMY_MODEL;
+		if (!model) {
+			console.error("rummy-cli: RUMMY_MODEL is required");
+			process.exit(2);
+		}
+
+		const rawMode = process.env.RUMMY_MODE;
+		const mode = rawMode == null ? "act" : rawMode;
+		if (mode !== "ask" && mode !== "act") {
+			console.error(
+				`rummy-cli: RUMMY_MODE must be "ask" or "act" (got ${JSON.stringify(rawMode)})`,
+			);
+			process.exit(2);
+		}
+
+		// In-process CLI has no socket client to resolve proposals; default
+		// YOLO so any proposal-emitting tool auto-accepts. Operator can
+		// pass --RUMMY_YOLO=0 to opt out.
+		if (process.env.RUMMY_YOLO == null) process.env.RUMMY_YOLO = "1";
+
+		const projectRoot = process.cwd();
+		const alias = `cli_${Date.now()}`;
+
+		const projectAgent = new ProjectAgent(db, hooks);
+		const { projectId } = await projectAgent.init(alias, projectRoot);
+
+		// Operator-declared project surface (comma-separated literal paths,
+		// relative to project root). Files are ingested as entries with
+		// default visibility=archived; the model promotes specific
+		// entries via <get>. Decouples membership (constraint) from
+		// visibility (per-entry, model-controlled).
+		const projectFilesRaw = process.env.RUMMY_PROJECT_FILES;
+		if (projectFilesRaw) {
+			const patterns = projectFilesRaw
+				.split(",")
+				.map((s) => s.trim())
+				.filter(Boolean);
+			for (const pattern of patterns) {
+				await File.setConstraint(db, projectId, pattern, "add");
+			}
+		}
+
+		// Watchdog; overridable via --RUMMY_LOOP_TIMEOUT=<ms>. Drains
+		// the active loop before exit so SQLite, turn slices, and
+		// last_run.txt are durable on disk before the process dies —
+		// without this, harbor's outer asyncio.wait_for kills the
+		// docker exec mid-pipeline and the trial.log cp commands never
+		// run, leaving the post-mortem packet empty.
+		const timeoutMs = Number(process.env.RUMMY_LOOP_TIMEOUT);
+		const timer = setTimeout(async () => {
+			console.error(`rummy-cli: timed out after ${timeoutMs}ms — draining`);
+			try {
+				await projectAgent.shutdown();
+			} catch (err) {
+				console.error(`rummy-cli: drain failed: ${err.message}`);
+			}
+			process.exit(124);
+		}, timeoutMs);
+		timer.unref();
+
+		// stderr progress: log update entries as they land.
+		hooks.entry.created.on((entry) => {
+			if (entry?.scheme !== "update") return;
+			const turnMatch = entry.path?.match(/^log:\/\/turn_(\d+)\//);
+			if (!turnMatch) return;
+			const status = entry.attributes?.status ?? 102;
+			console.error(`[rummy-cli] turn ${turnMatch[1]} status=${status}`);
+		});
+
+		// Capture enriched terminal payload (status, cost, tokens, model)
+		// from ask.completed / act.completed. Only one fires for our run.
+		let runSummary = null;
+		const captureSummary = (payload) => {
+			if (payload.run !== alias) return;
+			runSummary = payload;
+		};
+		hooks.ask.completed.on(captureSummary);
+		hooks.act.completed.on(captureSummary);
+
+		const runFn =
+			mode === "act"
+				? projectAgent.act.bind(projectAgent)
+				: projectAgent.ask.bind(projectAgent);
+
+		try {
+			const result = await runFn(projectId, model, prompt, alias, {});
+			const { status } = result;
+			if (TERMINAL_STATUSES.has(status)) {
+				const text = await this.#findLatestSummary(db, alias);
+				if (text) process.stdout.write(`${text}\n`);
+			}
+			if (runSummary) {
+				process.stdout.write(
+					`__RUMMY_RUN_SUMMARY__ ${JSON.stringify({
+						run: runSummary.run,
+						status: runSummary.status,
+						turn: runSummary.turn,
+						turns: runSummary.turns,
+						cost: runSummary.cost,
+						tokens: runSummary.tokens,
+						model: runSummary.model,
+					})}\n`,
+				);
+			}
+			await new Promise((r) => setTimeout(r, 50));
+			process.exit(status === 200 ? 0 : 1);
+		} catch (err) {
+			console.error(`rummy-cli: run crashed: ${err.message}`);
+			process.exit(1);
+		}
+	}
+
+	async #findLatestSummary(db, alias) {
+		const runRow = await db.get_run_by_alias.get({ alias });
+		if (!runRow) return null;
+		const entries = await db.get_known_entries.all({ run_id: runRow.id });
+		const updates = entries
+			.filter(
+				(e) =>
+					e.scheme === "log" &&
+					/^log:\/\/turn_\d+\/update\//.test(e.path) &&
+					e.state === "resolved",
+			)
+			.toSorted((a, b) => a.turn - b.turn);
+		if (updates.length === 0) return null;
+		return updates.at(-1).body;
+	}
+}

package/src/plugins/cloudflare/cloudflare.js

@@ -0,0 +1,136 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import msg from "../../agent/messages.js";
+import { chatCompletionStream } from "../../llm/openaiStream.js";
+
+const FETCH_TIMEOUT = Number(process.env.RUMMY_FETCH_TIMEOUT);
+
+const PROVIDER = "@cf";
+
+// Repo-root-relative key file. Resolved relative to this source file so
+// CWD changes during runs (programbench/tbench cd into workspaces) don't
+// break the lookup. Plugin is inert if the file is missing OR if
+// CLOUDFLARE_ACCOUNT_ID is unset (the API path is account-scoped).
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function resolveKeyFile() {
+	return process.env.RUMMY_CLOUDFLARE_KEY_FILE
+		? process.env.RUMMY_CLOUDFLARE_KEY_FILE
+		: join(__dirname, "..", "..", "..", "cloudflare.key");
+}
+
+// Inert unless cloudflare.key exists and CLOUDFLARE_ACCOUNT_ID is set.
+// Matches model aliases starting with `@cf/` — Cloudflare Workers AI's
+// own namespace, used verbatim with no prefix stripping
+// (`@cf/google/gemma-4-26b-a4b-it`).
+//
+// Uses Cloudflare's OpenAI-compatible endpoint
+// (`/v1/chat/completions`) so the streaming SSE accumulator is shared
+// with the other OpenAI-shaped providers. Context-size lookups go to
+// the native models-search API which exposes `properties` including
+// the model's context window.
+export default class Cloudflare {
+	#apiKey;
+	#accountId;
+	#contextCache = new Map();
+
+	constructor(core) {
+		const accountId = process.env.CLOUDFLARE_ACCOUNT_ID;
+		if (!accountId) return;
+		const keyFile = resolveKeyFile();
+		if (!existsSync(keyFile)) return;
+		const raw = readFileSync(keyFile, "utf8").trim();
+		if (!raw) return;
+		this.#apiKey = raw;
+		this.#accountId = accountId;
+
+		core.hooks.llm.providers.push({
+			name: "cloudflare",
+			matches: (model) => model.split("/")[0] === PROVIDER,
+			completion: (messages, model, options) =>
+				this.#completion(messages, model, options),
+			getContextSize: (model) => this.#getContextSize(model),
+		});
+	}
+
+	#baseUrl() {
+		return `https://api.cloudflare.com/client/v4/accounts/${this.#accountId}/ai`;
+	}
+
+	async #completion(messages, model, options = {}) {
+		const body = { model, messages };
+		if (options.maxTokens !== undefined) body.max_tokens = options.maxTokens;
+		if (options.temperature !== undefined)
+			body.temperature = options.temperature;
+
+		const timeoutSignal = AbortSignal.timeout(FETCH_TIMEOUT);
+		const signal = options.signal
+			? AbortSignal.any([options.signal, timeoutSignal])
+			: timeoutSignal;
+
+		const headers = { Authorization: `Bearer ${this.#apiKey}` };
+
+		try {
+			return await chatCompletionStream({
+				url: `${this.#baseUrl()}/v1/chat/completions`,
+				headers,
+				body,
+				signal,
+			});
+		} catch (err) {
+			if (err.status === 401 || err.status === 403) {
+				throw new Error(
+					msg("error.cloudflare_auth", {
+						status: `${err.status} - ${err.body}`,
+					}),
+				);
+			}
+			if (err.status) {
+				throw new Error(
+					msg("error.cloudflare_api", {
+						status: `${err.status} - ${err.body}`,
+					}),
+				);
+			}
+			throw err;
+		}
+	}
+
+	async #getContextSize(model) {
+		if (this.#contextCache.has(model)) return this.#contextCache.get(model);
+
+		// Cloudflare's models-search returns model metadata including
+		// `properties` (an array with `property_id` / `value` pairs).
+		// `context_window` (or `max_input_tokens` on some entries) is
+		// the field we want.
+		const url = `${this.#baseUrl()}/models/search?search=${encodeURIComponent(model)}`;
+		const res = await fetch(url, {
+			headers: { Authorization: `Bearer ${this.#apiKey}` },
+			signal: AbortSignal.timeout(FETCH_TIMEOUT),
+		});
+		if (!res.ok) {
+			throw new Error(
+				msg("error.cloudflare_models_failed", { model, status: res.status }),
+			);
+		}
+		const data = await res.json();
+		const entry = data.result.find((m) => m.name === model);
+		if (!entry) {
+			throw new Error(msg("error.cloudflare_model_not_found", { model }));
+		}
+		const props = entry.properties;
+		// Prefer `context_window` (full prompt+output combined) over
+		// `max_input_tokens` (input-only). Some Cloudflare entries have
+		// both, some only one. Picking the larger one is wrong (would
+		// pick input cap when context is what we want); explicit priority.
+		const ctxProp =
+			props.find((p) => p.property_id === "context_window") ??
+			props.find((p) => p.property_id === "max_input_tokens");
+		const ctx = ctxProp ? Number(ctxProp.value) : null;
+		if (!ctx) {
+			throw new Error(msg("error.cloudflare_no_context_length", { model }));
+		}
+		this.#contextCache.set(model, ctx);
+		return ctx;
+	}
+}

package/src/plugins/cp/cp.js

@@ -1,4 +1,5 @@
 import Entries from "../../agent/Entries.js";
+import { storePatternResult } from "../helpers.js";
 import docs from "./cpDoc.js";
 
 export default class Cp {
@@ -24,25 +25,60 @@ export default class Cp {
 			? entry.attributes.visibility
 			: undefined;
 
+		// Manifest: list what would be copied without performing the cp.
+		if (entry.attributes.manifest !== undefined) {
+			const matches = await store.getEntriesByPattern(runId, path);
+			await storePatternResult(store, runId, turn, "cp", path, null, matches, {
+				manifest: true,
+				loopId,
+				attributes: { path, to },
+			});
+			return;
+		}
+
 		const source = await store.getBody(runId, path);
 		if (source === null) return;
+		// Tags propagate: explicit `tags=` on the cp wins; otherwise the
+		// destination inherits the source entry's tags. Same shape as
+		// visibility — explicit attr overrides, default inherits.
+		let destTags = null;
+		if (typeof entry.attributes.tags === "string") {
+			destTags = entry.attributes.tags;
+		} else {
+			const sourceAttrs = await store.getAttributes(runId, path);
+			if (sourceAttrs && typeof sourceAttrs.tags === "string") {
+				destTags = sourceAttrs.tags;
+			}
+		}
 
 		const destScheme = Entries.scheme(to);
 		const existing = await store.getBody(runId, to);
 		const warning =
-			existing !== null && destScheme !== null
-				? `Overwrote existing entry at ${to}`
-				: null;
+			existing !== null ? `Overwrote existing entry at ${to}` : null;
 
 		const body = `${path} ${to}`;
 		if (destScheme === null) {
+			// Bare-file destination: hand the shared materializer (set.js
+			// #materializeFile, gated on attrs.path + attrs.patched) the
+			// authoritative new body so it writes the source content to
+			// disk on accept. Without this the proposal accepted but no
+			// file landed — the model's "<cp src dest> then <set dest>
+			// SEARCH/REPLACE" sequence silently no-op'd at materialize.
 			await store.set({
 				runId,
 				turn,
 				path: entry.resultPath,
 				body,
 				state: "proposed",
-				attributes: { from: path, to, isMove: false, warning },
+				attributes: {
+					from: path,
+					to,
+					isMove: false,
+					warning,
+					path: to,
+					patched: source,
+					visibility,
+				},
 				loopId,
 			});
 		} else {
@@ -53,6 +89,7 @@ export default class Cp {
 				body: source,
 				state: "resolved",
 				visibility,
+				attributes: destTags ? { tags: destTags } : null,
 				loopId,
 			});
 			await store.set({

package/src/plugins/cp/cpDoc.md

@@ -1,7 +1,6 @@
-## <cp path="[source]">[destination]</cp> - Copy a file or entry
+## <cp path="[source]">[destination]</cp> - Copy an entry or file
 
-Example: <cp path="src/config.js">src/config.backup.js</cp>
-<!-- Simple file copy. Path = source, body = destination. -->
-
-Example: <cp path="known://plan_*">known://archive_</cp>
-<!-- Glob batch copy across known entries. -->
+Example: <cp path="known://server/handler_main">src/main.c</cp>
+<!-- Body is the destination path; cross-scheme copies are allowed. -->
+Example: <cp path="known://countries/france/*">known://archive/countries/france/</cp>
+<!-- Glob source + directory-shaped destination = batch copy preserving names. -->

package/src/plugins/engine/engine.sql

@@ -1,7 +1,7 @@
 -- PREP: get_promoted_entries
 SELECT
 	ke.path, ke.scheme, ke.state, ke.outcome, ke.visibility, ke.turn
-	, countTokens(ke.body) AS tokens, ke.refs
+	, ke.refs, countTokens(ke.body) AS tokens
 FROM known_entries AS ke
 JOIN schemes AS s ON s.name = COALESCE(ke.scheme, 'file')
 WHERE

package/src/plugins/env/README.md

@@ -8,7 +8,7 @@ side effects.
 ## Registration
 
 - **Tool**: `env`
-- **Scheme**: `env` — `category: "data"` (channels only; see below)
+- **Scheme**: `env` — `category: "logging"` (channels are time-indexed activity, not state)
 - **Handler**: Upserts the proposal entry at status 202 (proposed).
 
 ## Two namespaces per invocation
@@ -16,8 +16,10 @@ side effects.
 - **Log entry**: `log://turn_N/env/{slug}` — scheme=`log`, category=`logging`.
   The audit record (renders inside `<log>` as `<env>`).
 - **Data channels**: `env://turn_N/{slug}_1` (stdout), `env://turn_N/{slug}_2`
-  (stderr) — scheme=`env`, category=`data`. The captured payload
-  (renders inside `<context>` as `<env>`).
+  (stderr) — scheme=`env`, category=`logging` (time-indexed activity).
+  Render inside `<log>` adjacent to their parent `<env>` action entry;
+  visibility controls whether the body is full or compact, not which
+  block they appear in.
 
 The `env` scheme exists **only** for the data channels. See
 [scheme_category_split](#scheme_category_split).

package/src/plugins/env/env.js

@@ -1,4 +1,4 @@
-import { logPathToDataBase } from "../helpers.js";
+import { logPathToDataBase, streamSummary } from "../helpers.js";
 import docs from "./envDoc.js";
 
 const LOG_ACTION_RE = /^log:\/\/turn_\d+\/(\w+)\//;
@@ -8,10 +8,11 @@ export default class Env {
 
 	constructor(core) {
 		this.#core = core;
-		// `env` scheme holds the streamed stdout/stderr payload. See sh.js
-		// for the scheme/category split rationale. env differs from sh only
-		// in ask-mode policy (env is safe/read-only; sh has side effects).
-		core.registerScheme({ category: "data" });
+		// env vs sh: env is read-only (allowed in ask-mode); see plugin README.
+		// Streaming stdout/stderr is time-indexed activity output, not
+		// topic-indexed state — category="logging" so it renders in <log>
+		// adjacent to its action entry, not in <summary>/<visible>.
+		core.registerScheme({ category: "logging" });
 		core.on("handler", this.handler.bind(this));
 		core.on("visible", this.full.bind(this));
 		core.on("summarized", this.summary.bind(this));
@@ -27,7 +28,7 @@ export default class Env {
 		if (m?.[1] !== "env") return;
 		let command = "";
 		if (ctx.attrs?.command) command = ctx.attrs.command;
-		else if (ctx.attrs?.summary) command = ctx.attrs.summary;
+		else if (ctx.attrs?.tags) command = ctx.attrs.tags;
 		const turn = (await ctx.db.get_run_by_id.get({ id: ctx.runId })).next_turn;
 		const dataBase = logPathToDataBase(ctx.path);
 		for (const ch of [1, 2]) {
@@ -38,7 +39,7 @@ export default class Env {
 				body: "",
 				state: "streaming",
 				visibility: "summarized",
-				attributes: { command, summary: command, channel: ch },
+				attributes: { command, tags: command, channel: ch },
 			});
 		}
 		await ctx.entries.set({
@@ -57,7 +58,7 @@ export default class Env {
 			path: entry.resultPath,
 			body: "",
 			state: "proposed",
-			attributes: { ...entry.attributes, summary: entry.attributes.command },
+			attributes: { ...entry.attributes, tags: entry.attributes.command },
 			loopId,
 		});
 	}
@@ -66,7 +67,7 @@ export default class Env {
 		return `# env ${entry.attributes.command}\n${entry.body}`;
 	}
 
-	summary() {
-		return "";
+	summary(entry) {
+		return streamSummary("env", entry);
 	}
 }

package/src/plugins/env/envDoc.md

@@ -1,13 +1,12 @@
 ## <env>[command]</env> - Run an exploratory shell command
 
-Example: <env>npm --version</env>
-<!-- Version check. Safe, no side effects. -->
-
-Example: <env>git log --oneline -5</env>
-<!-- Git history. Shows env for read-only investigation. -->
-
-* YOU MUST NOT use <env></env> to read or list files — use <get path="*"/> instead
-<!-- Prevents cat/ls through shell. Forces file access through get. -->
-
-* YOU MUST NOT use <env></env> for commands with side effects
-<!-- Separates exploration from action. env = observe only. -->
+Example:
+	<env><<EOF
+	npm --version
+	node --version
+	git log --oneline -3
+	EOF</env>
+<!-- Heredoc body is opaque — embed multi-line scripts and special characters without escaping. Output co-locates at env://turn_N/<slug>. -->
+
+YOU MUST NOT use <env></env> to read or list files — use <get path="*"/> instead
+YOU MUST NOT use <env></env> for commands with side effects

package/src/plugins/error/error.js

@@ -1,9 +1,10 @@
+import { SOFT_FAILURE_OUTCOMES } from "../../agent/errors.js";
+import { SUMMARY_MAX_CHARS } from "../helpers.js";
+
 const MAX_STRIKES = Number(process.env.RUMMY_MAX_STRIKES);
 const MIN_CYCLES = Number(process.env.RUMMY_MIN_CYCLES);
 const MAX_CYCLE_PERIOD = Number(process.env.RUMMY_MAX_CYCLE_PERIOD);
 
-const CONTRACT_REMINDER = "Missing update";
-
 function fingerprint(entry) {
 	const parts = Object.keys(entry.attributes)
 		.toSorted()
@@ -40,18 +41,27 @@ export default class ErrorPlugin {
 		this.#core = core;
 		core.registerScheme({ category: "logging" });
 		core.on("visible", (entry) => `# error\n${entry.body}`);
-		core.on("summarized", (entry) => entry.body);
+		core.on("summarized", (entry) => entry.body.slice(0, SUMMARY_MAX_CHARS));
 
 		core.hooks.error.log.on(this.#onErrorLog.bind(this));
 		core.hooks.loop.started.on(this.#onLoopStarted.bind(this));
 		core.hooks.loop.completed.on(this.#onLoopCompleted.bind(this));
 		core.hooks.turn.started.on(this.#onTurnStarted.bind(this));
 
-		core.hooks.error.verdict = this.#verdict.bind(this);
+		// Subscribe to the turn.verdict filter chain. Multi-plugin
+		// surface — strike streak, cycle detection, stagnation
+		// pressure all flow through here. Future voters (e.g. budget
+		// overflow termination, runaway-on-context-grow) participate
+		// via the same chain.
+		core.filter("turn.verdict", this.#verdict.bind(this));
 	}
 
 	#onLoopStarted({ loopId }) {
-		this.#loopState.set(loopId, { streak: 0, history: [], turnErrors: 0 });
+		this.#loopState.set(loopId, {
+			streak: 0,
+			history: [],
+			turnErrors: 0,
+		});
 	}
 
 	#onLoopCompleted({ loopId }) {
@@ -71,45 +81,75 @@ export default class ErrorPlugin {
 		message,
 		status,
 		attributes,
+		soft,
 	}) {
 		const statusValue = status ?? 400;
 		const path = await store.logPath(runId, turn, "error", message);
+		// Soft errors record but don't strike: the issue was already
+		// recovered (e.g. parser auto-corrected a closing-tag mismatch)
+		// and the entry exists only so the model can see what happened.
+		// state="resolved" keeps recordedFailed clean; skipping
+		// turnErrors++ keeps the strike machinery from firing. Per SPEC
+		// #entries, outcome is reserved for state ∈ {failed, cancelled}
+		// — soft entries land with outcome=null. Status carrier for
+		// rendering is attributes.status, consulted before outcome by
+		// log.js's renderLogTag.
 		await store.set({
 			runId,
 			turn,
 			path,
 			body: message,
-			state: "failed",
-			outcome: `status:${statusValue}`,
+			state: soft ? "resolved" : "failed",
+			outcome: soft ? null : `status:${statusValue}`,
 			loopId,
 			attributes: { ...attributes, status: statusValue },
 		});
+		if (soft) return;
 		const state = this.#loopState.get(loopId);
 		if (state) state.turnErrors++;
 	}
 
-	async #verdict({ store, runId, loopId, turn, recorded, summaryText }) {
+	async #verdict(
+		_currentVerdict,
+		{ store, runId, loopId, recorded, summaryText, turn: _turn },
+	) {
+		// _currentVerdict is the upstream filter's result. Today this is
+		// the only voter so it's always { continue: true }. When other
+		// plugins join the chain, they can short-circuit by setting
+		// continue=false; this implementation could honor that via an
+		// early return. Left noop for now to preserve current semantics.
 		const state = this.#loopState.get(loopId);
 
 		let cycleReason = null;
-		if (recorded && recorded.length > 0) {
-			const fp = recorded.map(fingerprint).toSorted().join("|");
-			state.history.push(fp);
-			const cycle = detectCycle(state.history);
-			if (cycle.detected) {
-				cycleReason = "Loop detected";
-				await this.#core.hooks.error.log.emit({
-					store,
-					runId,
-					turn,
-					loopId,
-					message: cycleReason,
-					status: 429,
-				});
-			}
+		// Empty turns share a blank fingerprint; intentional.
+		const fp = recorded.map(fingerprint).toSorted().join("|");
+		state.history.push(fp);
+		const cycle = detectCycle(state.history);
+		if (cycle.detected) {
+			cycleReason = "Loop detected";
+			// Silent strike: increment turn-errors without a model-facing entry.
+			state.turnErrors++;
 		}
 
-		const struck = state.turnErrors > 0;
+		// Some failure outcomes are findings the model should adapt to,
+		// not contract violations. `not_found` (model tried to act on an
+		// entry that doesn't exist) and `conflict` (SEARCH text didn't
+		// match current body) are recoverable: the model reads the new
+		// state and tries again. Striking on these punishes legitimate
+		// state-discovery and accumulates 499s on otherwise productive
+		// runs. Hard outcomes (validation, permission, exit:N) still strike.
+		let recordedFailed = false;
+		for (const e of recorded) {
+			const current = await store.getState(runId, e.path);
+			if (
+				current?.state === "failed" &&
+				!SOFT_FAILURE_OUTCOMES.has(current.outcome)
+			) {
+				recordedFailed = true;
+				break;
+			}
+		}
+		const struck = state.turnErrors > 0 || recordedFailed;
 
 		if (summaryText && !struck) {
 			state.streak = 0;
@@ -121,8 +161,7 @@ export default class ErrorPlugin {
 		if (struck) {
 			state.streak++;
 			if (state.streak >= MAX_STRIKES) {
-				// On the abandoning strike, a same-turn terminal update
-				// is honored as completion rather than overridden by 499.
+				// Abandoning-strike turn: same-turn terminal update wins over 499.
 				if (summaryText) {
 					state.streak = 0;
 					const updateEntry = recorded?.findLast?.(
@@ -139,10 +178,12 @@ export default class ErrorPlugin {
 						`Abandoned after ${state.streak} consecutive strikes.`,
 				};
 			}
-			return {
-				continue: true,
-				reason: cycleReason || CONTRACT_REMINDER,
-			};
+			// No reason on continue: the model sees the actual failure
+			// entries directly in <log> next turn. Hardcoding "Missing
+			// update" mislabels strikes that fire on validation /
+			// permission / dispatch failures or cycles, when the update
+			// itself was emitted correctly.
+			return { continue: true };
 		}
 
 		state.streak = 0;

package/src/plugins/file/README.md

@@ -15,8 +15,17 @@ Static methods `setConstraint` and `dropConstraint` manage per-project
 file constraints in the database. Constraints are project-level config
 (backbone), not tool dispatch. See [file_constraints](../../../SPEC.md#file_constraints).
 
-- `active` / `readonly` — promoted into context (visibility=visible).
-- `ignore` — excluded from scans; summarizes existing entries.
+Constraint type governs **membership** and **write permission**, not
+in-context visibility. Visibility (visible / summarized / archived)
+is per-entry and model-controlled — files default to `archived` on
+ingestion; the model promotes via `<get>` / `<set visibility=...>`.
 
-Promotion/demotion from constraints goes through the standard tool
+- `add` — file is part of the project; ingested as an entry; model
+  may write. Default for `setConstraint`.
+- `readonly` — same ingestion; `<set>` is vetoed at the proposal-
+  accept gate.
+- `ignore` — excluded from scans entirely. The file remains on disk
+  for `<sh>` / `<env>` invocation but is not present as an entry.
+
+Promotion/demotion of an ingested file goes through the standard tool
 handler chain via `dispatchTool`.