@productbrain/cli 0.1.0-beta.1131 → 0.1.0-beta.11313

package/dist/lib/localBinding.js

@@ -0,0 +1,173 @@
+/**
+ * Repo-local binding resolution — turns what `.productbrain/config.local.json` declares into a
+ * credential, or refuses outright.
+ *
+ * Ordinary commands (`resolveConfig()` / `loadEnv()`) and `resolveAdminConfig()` share
+ * `resolvePinnedProfile()` so the pin validity bar cannot drift (STA-3 / TEN-3239). Admin still
+ * owns its own cascade around that helper: it never reads config.json siteUrl, CWD .env files, or
+ * preview / local-binding keys. Fail loud, fail closed, fail fast (RULE-268); default closed,
+ * explicitly opened (PRI-22).
+ */
+import { ConfigResolutionError } from './configResult.js';
+import { ErrorCode } from './errors.js';
+import { resolveNamedProfileConfig } from './profiles.js';
+import { readLocalProjectConfig, projectConfigExists } from './projectConfig.js';
+import { API_KEY_PREFIX } from './tokenConstants.js';
+/**
+ * Resolve the repo-local profile pin to a credential, or refuse outright.
+ *
+ * FAILS CLOSED on a DANGLING pin: a pin naming a profile that has since been deleted, or whose
+ * file carries no key, must NEVER fall through to the global active profile. The repo has
+ * explicitly declared its tenant; substituting a different one silently retargets every read AND
+ * write at a foreign workspace, and the gateway derives the workspace from the credential (BR-18)
+ * — so nothing downstream catches it.
+ *
+ * INS-2455 is the admin-path instance of exactly this fall-through. Admin now calls this helper
+ * too; a present-but-malformed key is a broken pin, not a credential.
+ */
+export function resolvePinnedProfile(profileName) {
+    const namedConfig = resolveNamedProfileConfig(profileName);
+    // A present-but-malformed key is a broken pin, not a credential. Accepting it here would
+    // surface as a generic "no API key, run pb login" far downstream, pointing the operator
+    // away from the pin that actually broke.
+    if (!namedConfig?.apiKey?.startsWith(API_KEY_PREFIX)) {
+        throw new ConfigResolutionError(`This repo is pinned to profile "${profileName}" (.productbrain/config.local.json), ` +
+            `but that profile has no valid API key — it may have been deleted or never fully set up. ` +
+            `Refusing to silently fall back to a different workspace. ` +
+            `Run \`pb profile use --local <profile>\` to fix the pin, or \`pb profile create ${profileName}\` to restore it.`, {
+            code: ErrorCode.AUTH_MISSING,
+            category: 'auth',
+            kind: 'profile-pin',
+            nextCommand: 'pb profile use --local <profile>',
+            guidance: 'Run `pb profile use --local <profile>` to fix the repo pin.',
+        });
+    }
+    return { apiKey: namedConfig.apiKey, siteUrl: namedConfig.siteUrl };
+}
+/**
+ * Does `config.local.json` CLAIM a direct credential binding of its own?
+ *
+ * The claim is the `preview` marker OR a credential — see `resolveLocalBinding()` below for why
+ * the marker alone is not the test. A claim is only a question, never an answer: it says the file
+ * MEANT to bind, not that it can. Use `bindsCompletely()` to decide whether a tenant is actually
+ * named.
+ */
+export function declaresLocalBinding(localConfig) {
+    if (!localConfig)
+        return false;
+    return (localConfig.preview === true || Boolean(localConfig.apiKey) || localConfig.apiKeyMalformed === true);
+}
+/**
+ * Does `config.local.json` carry a COMPLETE binding — the atomic apiKey+siteUrl pair (SF-3)?
+ *
+ * This, not the claim above, is what "the repo names a tenant" means. `resolveLocalBinding()`
+ * rejects a claimed-but-incomplete binding, but `resolveAdminConfig()` has no binding step to do
+ * that rejecting — so if `refuseWhenProjectHasNoTenant()` accepted a mere claim, a broken binding
+ * (`{ preview: true }` alone, a key with no siteUrl, a malformed key) would wave admin straight
+ * past the refusal into the global profile, which defaults to production (WP-681/INS-2455 is that
+ * exact incident). Shared by both so the bar cannot drift (STA-3), and it is the spec's own word:
+ * a *complete* preview binding is what stays unchanged.
+ */
+function bindsCompletely(localConfig) {
+    return Boolean(localConfig?.apiKey && localConfig.siteUrl);
+}
+/**
+ * Does `config.local.json` declare a COMPLETE PREVIEW binding — independent of the environment?
+ *
+ * The env-independence is the whole point (Codex P2 r4). `config.ts`'s `getPreviewBinding()` asks
+ * a different question — "is a preview binding what pb is EFFECTIVELY using right now" — so it
+ * bails whenever `PRODUCTBRAIN_API_KEY` is set. But `loadEnv()` COPIES the preview key into that
+ * very variable, so after any command has resolved config, that question answers "no" on a
+ * genuinely preview-bound worktree. Reporting surfaces need the file's own declaration, and
+ * handle the env-override case separately and earlier (reportedProfile.ts's startup snapshot).
+ *
+ * Shared rather than copied so the completeness bar cannot drift (STA-3) — it is the same
+ * `bindsCompletely` (SF-3 atomic apiKey+siteUrl) both callers already depend on.
+ */
+export function declaresCompletePreviewBinding(localConfig) {
+    if (localConfig?.preview !== true || !bindsCompletely(localConfig))
+        return null;
+    return { workspaceName: localConfig.workspaceName ?? null };
+}
+/**
+ * Refuse when a project has declared itself (committed config.json) but named no tenant.
+ *
+ * A dangling pin is a different refusal (`resolvePinnedProfile`). This is the no-tenant case:
+ * config.json says "I am a Product Brain project" and nothing in config.local.json — neither a
+ * pin nor a direct/preview binding — says which workspace. Falling through to the global profile
+ * is the incident. A directory with no config.json is not a project — personal capture and
+ * `pb login` stay open.
+ *
+ * Call after the pin / preview-binding steps, before any global fallback. Those earlier steps
+ * already returned or threw when a tenant was claimed; this still re-checks the binding claim
+ * because `resolveAdminConfig()` has no binding step of its own and must not mistake a
+ * preview-bound worktree for an unpinned one.
+ */
+export function refuseWhenProjectHasNoTenant() {
+    // The declaration is the FILE, not its contents — a corrupt config.json must not read as
+    // "not a project" and reopen the fall-through exactly when the committed file is damaged.
+    if (!projectConfigExists())
+        return;
+    const localConfig = readLocalProjectConfig();
+    if (localConfig?.profile)
+        return;
+    // A COMPLETE direct/preview binding names a tenant too: `npm run pb:preview` writes apiKey +
+    // siteUrl and no `profile` field. resolveConfig()/loadEnv() already returned at their own
+    // binding step, so this only reaches the admin cascade — which by design does not consume
+    // preview keys, and without this would call a legitimately preview-bound worktree untenanted.
+    // COMPLETE, not merely claimed: an incomplete binding names nothing usable, and admin has no
+    // binding step to reject it, so accepting a claim here would route admin to the global profile
+    // (Codex review round 2 — a regression this line introduced and this word closes).
+    if (bindsCompletely(localConfig))
+        return;
+    // Deliberately NOT excepted: `PB_PROFILE`. It looks like an explicit tenant, but exported from
+    // a shell rc it is exactly as ambient as the global active profile whose silent substitution is
+    // the incident — so WP-694 names only an exported PRODUCTBRAIN_API_KEY as the escape hatch, and
+    // this refusal outranks the profile system that reads PB_PROFILE (Codex review, declined).
+    throw new ConfigResolutionError(`This repo is a Product Brain project (.productbrain/config.json) but has no tenant pin ` +
+        `in .productbrain/config.local.json. Refusing to silently use a different workspace. ` +
+        `Run \`pb profile use --local <profile>\` to pin this repo, or \`pb profile list\` to see your profiles.`, {
+        code: ErrorCode.AUTH_MISSING,
+        category: 'auth',
+        kind: 'missing-pin',
+        nextCommand: 'pb profile use --local <profile>',
+        guidance: 'Run `pb profile use --local <profile>` to pin this repo to a workspace.',
+    });
+}
+/**
+ * Resolve the direct credential binding in config.local.json, or null when the file does not
+ * claim one (the profile pin then owns resolution).
+ *
+ * The claim is the `preview` marker OR a credential of its own — deliberately NOT the marker
+ * alone. A file carrying an apiKey is asserting which workspace this repo talks to whether or not
+ * `pb:preview` stamped the marker, so gating on the marker would let a hand-written or
+ * partially-scrubbed binding be skipped and a sibling profile pin silently supply a different
+ * tenant's credential instead (the failure class TEN-3237/TEN-3238 closed for the pin path).
+ *
+ * Once claimed, only the atomic apiKey+siteUrl pair (SF-3) may bind — never a preview key paired
+ * with config.json's real-dev gateway (STD-261). Anything else refuses here, ahead of the pin, so
+ * a broken binding is named rather than routed around.
+ */
+export function resolveLocalBinding(localConfig) {
+    if (!declaresLocalBinding(localConfig))
+        return null;
+    if (bindsCompletely(localConfig)) {
+        return { apiKey: localConfig.apiKey, siteUrl: localConfig.siteUrl.replace(/\/$/, '') };
+    }
+    // A malformed key is present-but-unusable, not absent — readLocalProjectConfig() withholds it
+    // from `apiKey` so it can never bind, and flags it so this refusal can name the real fault.
+    const fault = localConfig.apiKeyMalformed
+        ? `its API key is not a valid ${API_KEY_PREFIX} key`
+        : !localConfig.apiKey
+            ? 'missing API key'
+            : 'missing deployment URL';
+    throw new ConfigResolutionError(`This repo has an incomplete preview binding (.productbrain/config.local.json): ` +
+        `${fault}. Refusing to use its profile pin or another workspace instead.`, {
+        code: ErrorCode.CONFIG_INVALID,
+        category: 'config',
+        kind: 'preview-binding',
+        nextCommand: 'npm run pb:preview',
+        guidance: 'Run `npm run pb:preview` to repair the preview binding, or `npm run pb:real` to return to the repo pin.',
+    });
+}
+//# sourceMappingURL=localBinding.js.map

package/dist/lib/localBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localBinding.js","sourceRoot":"","sources":["../../src/lib/localBinding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAA2B,MAAM,oBAAoB,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,WAAW,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC3D,yFAAyF;IACzF,wFAAwF;IACxF,yCAAyC;IACzC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,qBAAqB,CAC7B,mCAAmC,WAAW,uCAAuC;YACnF,0FAA0F;YAC1F,2DAA2D;YAC3D,mFAAmF,WAAW,mBAAmB,EACnH;YACE,IAAI,EAAE,SAAS,CAAC,YAAY;YAC5B,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,kCAAkC;YAC/C,QAAQ,EAAE,6DAA6D;SACxE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAsC;IAEtC,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,CACL,WAAW,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,eAAe,KAAK,IAAI,CACpG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CACtB,WAAsC;IAEtC,OAAO,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAAsC;IAEtC,IAAI,WAAW,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B;IAC1C,yFAAyF;IACzF,0FAA0F;IAC1F,IAAI,CAAC,mBAAmB,EAAE;QAAE,OAAO;IAEnC,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;IAC7C,IAAI,WAAW,EAAE,OAAO;QAAE,OAAO;IAEjC,6FAA6F;IAC7F,0FAA0F;IAC1F,0FAA0F;IAC1F,8FAA8F;IAC9F,6FAA6F;IAC7F,+FAA+F;IAC/F,mFAAmF;IACnF,IAAI,eAAe,CAAC,WAAW,CAAC;QAAE,OAAO;IAEzC,+FAA+F;IAC/F,gGAAgG;IAChG,gGAAgG;IAChG,2FAA2F;IAC3F,MAAM,IAAI,qBAAqB,CAC7B,yFAAyF;QACvF,sFAAsF;QACtF,yGAAyG,EAC3G;QACE,IAAI,EAAE,SAAS,CAAC,YAAY;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,yEAAyE;KACpF,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAsC;IAEtC,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,8FAA8F;IAC9F,4FAA4F;IAC5F,MAAM,KAAK,GAAG,WAAW,CAAC,eAAe;QACvC,CAAC,CAAC,8BAA8B,cAAc,MAAM;QACpD,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM;YACnB,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,wBAAwB,CAAC;IAC/B,MAAM,IAAI,qBAAqB,CAC7B,iFAAiF;QAC/E,GAAG,KAAK,iEAAiE,EAC3E;QACE,IAAI,EAAE,SAAS,CAAC,cAAc;QAC9B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,oBAAoB;QACjC,QAAQ,EAAE,yGAAyG;KACpH,CACF,CAAC;AACJ,CAAC"}

package/dist/lib/normalizeMaterializedFilename.d.ts

@@ -2,9 +2,9 @@
  * normalizeMaterializedFilename — WP-379 S5b
  *
  * Produces a lowercase, slug-friendly filename from an asset name.
- * Used by resolveProjectionCollision to compare on-disk filenames (which may
- * have been projected with a non-normalized case) against the canonical
- * lowercase form that handshake now writes.
+ * Used by findLeftoverProjections/findLeftoverCursorSkills to compare on-disk filenames (which
+ * may have been projected with a non-normalized case) against the canonical lowercase form
+ * that handshake now writes.
  *
  * Contract:
  *   - Output is lowercase.

package/dist/lib/normalizeMaterializedFilename.js

@@ -2,9 +2,9 @@
  * normalizeMaterializedFilename — WP-379 S5b
  *
  * Produces a lowercase, slug-friendly filename from an asset name.
- * Used by resolveProjectionCollision to compare on-disk filenames (which may
- * have been projected with a non-normalized case) against the canonical
- * lowercase form that handshake now writes.
+ * Used by findLeftoverProjections/findLeftoverCursorSkills to compare on-disk filenames (which
+ * may have been projected with a non-normalized case) against the canonical lowercase form
+ * that handshake now writes.
  *
  * Contract:
  *   - Output is lowercase.

package/dist/lib/notice-marker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notice-marker.d.ts","sourceRoot":"","sources":["../../src/lib/notice-marker.ts"],"names":[],"mappings":"AAwCA,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAU/D"}
+{"version":3,"file":"notice-marker.d.ts","sourceRoot":"","sources":["../../src/lib/notice-marker.ts"],"names":[],"mappings":"AA+KA,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAsB/D"}

package/dist/lib/notice-marker.js

@@ -1,15 +1,28 @@
 /**
  * Once-per-session (agent) / once-per-day (human) notice claim via O_EXCL.
  * First process to create the marker wins (returns true => may print). All others,
- * and any error, fail OPEN to no-print (return false). Markers self-expire by key
- * (session id rotates per session; daily key rolls per UTC day). DEC-2.
+ * and any error, fail OPEN to no-print (return false). A per-marker O_EXCL lock
+ * serializes stale-marker eviction against that claim. Markers expire by key
+ * (session id rotates per session; daily key rolls per UTC day) and by age, except
+ * that a losing claim heartbeats the current marker so a renewed session survives
+ * the sweep. DEC-2.
  */
-import { openSync, closeSync, mkdirSync, statSync, readdirSync, unlinkSync } from 'node:fs';
+import { openSync, closeSync, existsSync, linkSync, mkdirSync, statSync, readdirSync, unlinkSync, utimesSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { readSession } from './session.js';
 const CONFIG_DIR = join(homedir(), '.config', 'productbrain');
+// Non-current session residue becomes stale after one server expiry lease. The
+// same ID can be renewed, so claimNotice heartbeats the locked current marker.
+// Lease source: convex/intelligence/agentSessions.ts MAX_SESSION_DURATION_MS.
+const SESSION_STALE_MS = 8 * 60 * 60 * 1000;
 const DAILY_STALE_MS = 7 * 24 * 60 * 60 * 1000;
+// Lock actions contain only synchronous local filesystem calls. A one-minute
+// lease bounds crash residue while leaving ample headroom for a live holder.
+const LOCK_STALE_MS = 60 * 1000;
+const LOCK_PREFIX = '.notice-marker-lock-';
+const LOCK_RECLAIM_SUFFIX = '.reclaim';
+const LOCK_PIN_SUFFIX = '.target';
 function utcDateStamp() {
     const d = new Date();
     const p = (n) => String(n).padStart(2, '0');
@@ -23,28 +36,185 @@ function markerKey(channel) {
     // If no active session, fall back to a daily key so the per-day throttle still holds.
     return session?.sessionId ? `notice-session-${session.sessionId}` : `notice-agent-daily-${utcDateStamp()}`;
 }
-function cleanupOldNoticeMarkers() {
+function markerRetentionMs(name) {
+    if (name.startsWith('notice-session-'))
+        return SESSION_STALE_MS;
+    if (name.startsWith('notice-human-') || name.startsWith('notice-agent-daily-')) {
+        return DAILY_STALE_MS;
+    }
+    return null;
+}
+function markerLockPath(name) {
+    return join(CONFIG_DIR, `${LOCK_PREFIX}${name}`);
+}
+function cleanupStaleRecovery(lockPath, now) {
+    const reclaimPath = `${lockPath}${LOCK_RECLAIM_SUFFIX}`;
+    const pinPath = `${reclaimPath}${LOCK_PIN_SUFFIX}`;
+    try {
+        if (now - statSync(reclaimPath).mtimeMs <= LOCK_STALE_MS)
+            return;
+        try {
+            unlinkSync(pinPath);
+        }
+        catch { /* absent or unavailable identity pin */ }
+        unlinkSync(reclaimPath);
+        return;
+    }
+    catch { /* absent, fresh, or unavailable recovery election */ }
+    try {
+        if (now - statSync(pinPath).mtimeMs > LOCK_STALE_MS)
+            unlinkSync(pinPath);
+    }
+    catch { /* absent or unavailable orphan identity pin */ }
+}
+/**
+ * Reclaim one expired lock without a pathname-only unlink race. O_EXCL elects
+ * one reclaimer; its hard link pins the exact stale file instance to remove.
+ */
+function reclaimStaleLock(lockPath, now) {
+    const reclaimPath = `${lockPath}${LOCK_RECLAIM_SUFFIX}`;
+    const pinPath = `${reclaimPath}${LOCK_PIN_SUFFIX}`;
+    let reclaimFd;
+    let observed;
+    try {
+        observed = statSync(lockPath);
+        if (now - observed.mtimeMs <= LOCK_STALE_MS)
+            return false;
+        cleanupStaleRecovery(lockPath, now);
+        reclaimFd = openSync(reclaimPath, 'wx');
+        closeSync(reclaimFd);
+    }
+    catch {
+        return false;
+    }
+    try {
+        linkSync(lockPath, pinPath);
+        const pinned = statSync(pinPath);
+        if (observed.dev !== pinned.dev || observed.ino !== pinned.ino)
+            return false;
+        const current = statSync(lockPath);
+        if (current.dev !== pinned.dev || current.ino !== pinned.ino)
+            return false;
+        unlinkSync(lockPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            unlinkSync(pinPath);
+        }
+        catch { /* bounded by the next stale sweep */ }
+        try {
+            unlinkSync(reclaimPath);
+        }
+        catch { /* bounded by the next stale sweep */ }
+    }
+}
+function acquireMarkerLock(name) {
+    const lockPath = markerLockPath(name);
     try {
-        for (const name of readdirSync(CONFIG_DIR)) {
-            if (!name.startsWith('notice-human-') &&
-                !name.startsWith('notice-agent-daily-') &&
-                !name.startsWith('notice-session-'))
+        return openSync(lockPath, 'wx');
+    }
+    catch {
+        if (!reclaimStaleLock(lockPath, Date.now()))
+            return null;
+        try {
+            return openSync(lockPath, 'wx');
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function withMarkerLock(name, action) {
+    const lockPath = markerLockPath(name);
+    const lockFd = acquireMarkerLock(name);
+    if (lockFd === null)
+        return null;
+    try {
+        closeSync(lockFd);
+        return action();
+    }
+    finally {
+        try {
+            unlinkSync(lockPath);
+        }
+        catch { /* best-effort lock release */ }
+    }
+}
+function cleanupAbandonedMarkerLocks(names, now) {
+    for (const name of names) {
+        if (!name.startsWith(LOCK_PREFIX))
+            continue;
+        if (name.endsWith(LOCK_RECLAIM_SUFFIX)) {
+            cleanupStaleRecovery(join(CONFIG_DIR, name.slice(0, -LOCK_RECLAIM_SUFFIX.length)), now);
+            continue;
+        }
+        if (name.endsWith(`${LOCK_RECLAIM_SUFFIX}${LOCK_PIN_SUFFIX}`))
+            continue;
+        const path = join(CONFIG_DIR, name);
+        try {
+            if (now - statSync(path).mtimeMs <= LOCK_STALE_MS)
                 continue;
-            const p = join(CONFIG_DIR, name);
-            if (Date.now() - statSync(p).mtimeMs > DAILY_STALE_MS)
-                unlinkSync(p);
+            reclaimStaleLock(path, now);
+        }
+        catch {
+            // Lock recovery is best-effort and isolated per file, like marker GC.
         }
     }
-    catch { /* best-effort */ }
+}
+function cleanupOldNoticeMarkers(currentName) {
+    let names;
+    try {
+        names = readdirSync(CONFIG_DIR);
+    }
+    catch {
+        return;
+    }
+    const now = Date.now();
+    cleanupAbandonedMarkerLocks(names, now);
+    for (const name of names) {
+        if (name === currentName)
+            continue;
+        const staleAfterMs = markerRetentionMs(name);
+        if (staleAfterMs === null)
+            continue;
+        withMarkerLock(name, () => {
+            try {
+                const p = join(CONFIG_DIR, name);
+                if (now - statSync(p).mtimeMs > staleAfterMs)
+                    unlinkSync(p);
+            }
+            catch {
+                // A marker can disappear or become unavailable while the sweep runs.
+                // Keep cleanup best-effort without skipping the remaining files.
+            }
+        });
+    }
 }
 /** Returns true exactly once per (channel, session/day). Never throws. */
 export function claimNotice(channel) {
-    const path = join(CONFIG_DIR, markerKey(channel));
+    const name = markerKey(channel);
+    const path = join(CONFIG_DIR, name);
     try {
         mkdirSync(CONFIG_DIR, { recursive: true });
-        closeSync(openSync(path, 'wx')); // 'wx' = O_EXCL: throws EEXIST if present
-        cleanupOldNoticeMarkers();
-        return true;
+        return withMarkerLock(name, () => {
+            cleanupOldNoticeMarkers(name);
+            if (existsSync(path)) {
+                // A live server session can be renewed under the same ID. Refreshing the
+                // marker on each suppressed notice keeps that active session out of GC.
+                try {
+                    const now = new Date();
+                    utimesSync(path, now, now);
+                }
+                catch { /* the existing claim still wins */ }
+                return false;
+            }
+            closeSync(openSync(path, 'wx')); // 'wx' = O_EXCL: throws EEXIST if present
+            return true;
+        }) ?? false;
     }
     catch {
         return false; // already claimed, or fs error => fail open to no-print

package/dist/lib/notice-marker.js.map

@@ -1 +1 @@
-{"version":3,"file":"notice-marker.js","sourceRoot":"","sources":["../../src/lib/notice-marker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAC9D,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,OAA0B;IAC3C,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,gBAAgB,YAAY,EAAE,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,sFAAsF;IACtF,OAAO,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,sBAAsB,YAAY,EAAE,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,uBAAuB;IAC9B,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBACjC,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;gBACvC,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;gBAAE,SAAS;YAClD,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,cAAc;gBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,OAA0B;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,0CAA0C;QAC3E,uBAAuB,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,wDAAwD;IACxE,CAAC;AACH,CAAC"}
+{"version":3,"file":"notice-marker.js","sourceRoot":"","sources":["../../src/lib/notice-marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9H,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAC9D,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,OAA0B;IAC3C,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,gBAAgB,YAAY,EAAE,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,sFAAsF;IACtF,OAAO,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,sBAAsB,YAAY,EAAE,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC/E,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,UAAU,EAAE,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,GAAW;IACzD,MAAM,WAAW,GAAG,GAAG,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,WAAW,GAAG,eAAe,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,IAAI,aAAa;YAAE,OAAO;QACjE,IAAI,CAAC;YAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;QAC/E,UAAU,CAAC,WAAW,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,GAAG,aAAa;YAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC,CAAC,+CAA+C,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,GAAW;IACrD,MAAM,WAAW,GAAG,GAAG,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,WAAW,GAAG,eAAe,EAAE,CAAC;IACnD,IAAI,SAAiB,CAAC;IACtB,IAAI,QAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,IAAI,aAAa;YAAE,OAAO,KAAK,CAAC;QAC1D,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpC,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAE7E,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAC3E,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;QAC5E,IAAI,CAAC;YAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAI,IAAY,EAAE,MAAe;IACtD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAe,EAAE,GAAW;IAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvC,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,mBAAmB,GAAG,eAAe,EAAE,CAAC;YAAE,SAAS;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,aAAa;gBAAE,SAAS;YAC5D,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,WAAmB;IAClD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,2BAA2B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,WAAW;YAAE,SAAS;QACnC,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,YAAY,KAAK,IAAI;YAAE,SAAS;QACpC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACjC,IAAI,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,YAAY;oBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,iEAAiE;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,OAA0B;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE;YAC/B,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,yEAAyE;gBACzE,wEAAwE;gBACxE,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,0CAA0C;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,IAAI,KAAK,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,wDAAwD;IACxE,CAAC;AACH,CAAC"}

package/dist/lib/outcomeObjectiveLines.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TASK-817 (WP-818, TEN-4575): the lines `pb outcome show` and the MCP `context action=outcome` print
+ * for a key result's own objective and its sibling key results. The kernel read
+ * (convex/outcomes/readings.ts `showOutcome`) decides the objective and the siblings; this file
+ * only words them, once, for both surfaces (RULE-128, RULE-664).
+ *
+ * Pure, no I/O, zero imports: copied into each connector by scripts/generate-mcp-embedded-copies.mjs.
+ * Field sanitization is the caller's (each connector's own `sanitizeSingleLineField`), passed in
+ * as `clean`, the same split seatSentence.ts uses.
+ */
+export interface OutcomeObjectiveSibling {
+    entryId: string;
+    name: string;
+    currentValue: number | null;
+    targetValue: number | null;
+    /** Every loaded reading is superseded and more remain: not "never read" (the spine's own flag). */
+    readingUnresolved: boolean;
+}
+export interface OutcomeObjectiveView {
+    objective: {
+        entryId: string;
+        name: string;
+        siblings: OutcomeObjectiveSibling[];
+        hiddenSiblings: number;
+        truncated: boolean;
+    } | null;
+    objectiveLookup: 'found' | 'none' | 'capped' | 'unavailable';
+}
+export declare function formatOutcomeObjectiveLines(view: OutcomeObjectiveView, clean: (value: string) => string): string[];
+//# sourceMappingURL=outcomeObjectiveLines.d.ts.map

package/dist/lib/outcomeObjectiveLines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomeObjectiveLines.d.ts","sourceRoot":"","sources":["../../src/lib/outcomeObjectiveLines.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mGAAmG;IACnG,iBAAiB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,uBAAuB,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACrI,eAAe,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,aAAa,CAAC;CAC7D;AAgBD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,EAAE,CAUlH"}

package/dist/lib/outcomeObjectiveLines.js

@@ -0,0 +1,29 @@
+// GENERATED by scripts/generate-mcp-embedded-copies.mjs from kernel/outcomes/objectiveLines.ts.
+// DO NOT EDIT. Run `npm run mcp:embedded-copies` to regenerate.
+// Local runtime copy for the isolated connector build.
+const LOOKUP_LINE = {
+    none: 'none: no accepted objective holds this entry',
+    capped: 'not found: the objectives or key results read were capped before reaching this one',
+    unavailable: 'could not be read just now; run show again',
+};
+const INDENT = '              ';
+function siblingLine(kr, clean) {
+    const current = kr.readingUnresolved ? 'current unresolved, not "never read"' : kr.currentValue === null ? 'no reading yet' : `current ${kr.currentValue}`;
+    const target = kr.targetValue === null ? '' : `, target ${kr.targetValue}`;
+    return `${clean(kr.entryId)} — ${clean(kr.name)} (${current}${target})`;
+}
+export function formatOutcomeObjectiveLines(view, clean) {
+    const o = view.objective;
+    if (view.objectiveLookup !== 'found' || !o)
+        return [`  objective   ${LOOKUP_LINE[view.objectiveLookup === 'found' ? 'none' : view.objectiveLookup]}`];
+    const lines = [`  objective   ${clean(o.entryId)} — ${clean(o.name)}`];
+    if (o.siblings.length === 0 && !o.truncated)
+        return [...lines, '  siblings    none: the only key result under this objective'];
+    o.siblings.forEach((kr, i) => lines.push(`${i === 0 ? '  siblings    ' : INDENT}${siblingLine(kr, clean)}`));
+    // truncated with no counted sibling hidden: the read was capped workspace-wide, so more may exist.
+    const more = o.hiddenSiblings > 0 ? `and at least ${o.hiddenSiblings} more not shown` : 'more may exist: the key results read were capped';
+    if (o.truncated)
+        lines.push(`${o.siblings.length === 0 ? '  siblings    ' : INDENT}${more}`);
+    return lines;
+}
+//# sourceMappingURL=outcomeObjectiveLines.js.map

package/dist/lib/outcomeObjectiveLines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomeObjectiveLines.js","sourceRoot":"","sources":["../../src/lib/outcomeObjectiveLines.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,gEAAgE;AAChE,uDAAuD;AA0BvD,MAAM,WAAW,GAA8E;IAC9F,IAAI,EAAE,8CAA8C;IACpD,MAAM,EAAE,oFAAoF;IAC5F,WAAW,EAAE,4CAA4C;CACzD,CAAC;AAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,SAAS,WAAW,CAAC,EAA2B,EAAE,KAAgC;IACjF,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,CAAC;IAC3J,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,MAAM,GAAG,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAA0B,EAAE,KAAgC;IACvG,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IACzB,IAAI,IAAI,CAAC,eAAe,KAAK,OAAO,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACtJ,MAAM,KAAK,GAAG,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,KAAK,EAAE,8DAA8D,CAAC,CAAC;IAC/H,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7G,mGAAmG;IACnG,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,cAAc,iBAAiB,CAAC,CAAC,CAAC,kDAAkD,CAAC;IAC3I,IAAI,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/lib/ownerLine.d.ts

@@ -0,0 +1,90 @@
+/**
+ * WP-753 O5b fix round 1 (item 2): the ONE judged core for "how do we say who owns this
+ * entry" — the CLI (packages/cli/src/formatters/entry.ts), MCP
+ * (packages/mcp-server/src/tools/knowledge-helpers.ts), and the browser Rail
+ * (EntryRailPreview.svelte) each held a hand-copied switch over the same states; the
+ * Svelte copy alone drifted with a silent `default:` arm that would print "Owner: unresolved"
+ * for an unhandled kind instead of failing to compile. Pure, no I/O — kernel never imports
+ * convex, so this is a structural five-kind union that convex's `EntryOwnerRead`
+ * (convex/governance/entryOwnershipRead.ts) satisfies exactly, not a copy of it.
+ *
+ * DEC-1793 (RULE-632) deleted the `default`, `overflow` and `unavailable` kinds this union used
+ * to carry: a working record with no ownership row now reads as the plain `none` kind below —
+ * no synthetic Team Lead, no overflow guess.
+ *
+ * DEC-1944 (TASK-614; WP-783): a role or a team is an organisation definition with no
+ * owner of its own; its line says where it lives instead (`placed`). DEC-2064 (TASK-860): the word
+ * is `PLACED_WORD` on every surface, CLI, MCP and the Rail alike (RULE-664). DEC-1950 (TASK-768):
+ * a role's Rail header puts that word before the pill, a team's parent pill stands alone and its
+ * hover reads the path from the organisation down (`placedRailWord`, `placedRailHover`).
+ *
+ * Surface-specific bits are NOT here, by design — the caller applies them: per-field name
+ * sanitization (CLI/MCP's `sanitizeSingleLineField`), the bold label (MCP), and
+ * whether raw ids are shown at all (browser Rail: never — Rail-Design-Thesis.md:278 forbids
+ * Convex `_id`s as Noise; CLI/MCP: yes, a terminal user pastes them into a repair command).
+ */
+export type OwnerLine = {
+    kind: 'one';
+    team: {
+        name: string;
+    };
+    role: {
+        name: string;
+    };
+} | {
+    kind: 'none';
+} | {
+    kind: 'many';
+    count: number;
+    truncated: boolean;
+} | {
+    kind: 'dangling';
+    teamId: string;
+    roleId: string;
+    team?: {
+        name: string;
+    };
+    role?: {
+        name: string;
+    };
+} | {
+    kind: 'placed';
+    of: 'role' | 'team';
+    team: {
+        name: string;
+    };
+    ancestors: string[];
+    ancestorsTruncated: boolean;
+};
+/** DEC-2064 (TASK-860; RULE-664): the one word before the team an entry lives in, on every surface.
+ *  CLI and MCP print it for a role and a team alike; the Rail prints it only before a role's team
+ *  pill, because on a team's header it would read as if the team were its own team (DEC-1950). */
+export declare const PLACED_WORD = "Team:";
+export interface FormatOwnerLineOptions {
+    /** CLI/MCP keep the raw id for repair commands (default true). The browser Rail passes
+     *  `false` — Convex ids are Noise there, never Signal. */
+    ids?: boolean;
+    /** MCP bolds the leading label (`**Owner:**`, `**Team:**`); CLI and the browser keep it plain (default false). */
+    bold?: boolean;
+}
+/** The owning role and its team as two names, for a surface that shows them apart (the browser
+ *  Rail's role pill with the team beside it, DEC-1932). `null` for every kind but `one`: those keep
+ *  their sentence from `formatOwnerLine`, which builds its `one` sentence from these same names. */
+export declare function ownerLineParts(owner: OwnerLine): {
+    role: string;
+    team: string;
+} | null;
+/** DEC-1950 (TASK-768): the word the Rail prints before the placed pill — `PLACED_WORD` for a
+ *  role's home team, `null` for a team's parent (the pill stands alone) and for every other kind. */
+export declare function placedRailWord(owner: OwnerLine): string | null;
+/** DEC-1950 (TASK-768): the Rail's hover text on the placed line and pill. A team: the path from the
+ *  organisation down to its parent, root first, led by `… › ` when the reader's walk was cut. A role:
+ *  the CLI/MCP sentence without ids. `null` for every other kind. */
+export declare function placedRailHover(owner: OwnerLine): string | null;
+/** Exhaustive over the five kinds above. The `default:` arm below is not a silent catch-all —
+ *  it assigns the narrowed remainder to a `never`-typed const, so an unhandled kind fails to
+ *  compile HERE regardless of which tsconfig's strictness flags apply at the call site
+ *  (kernel's own tsconfig is red pre-existing, unrelated to this PR, so exhaustiveness cannot
+ *  be left to ride on `noImplicitReturns` alone; WP-753 O5b fix round 3, addendum a). */
+export declare function formatOwnerLine(owner: OwnerLine, options?: FormatOwnerLineOptions): string;
+//# sourceMappingURL=ownerLine.d.ts.map

package/dist/lib/ownerLine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownerLine.d.ts","sourceRoot":"","sources":["../../src/lib/ownerLine.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,SAAS,GAClB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAE/D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAKnD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAMtG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAA;CAAE,CAAC;AAErH;;kGAEkG;AAClG,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,MAAM,WAAW,sBAAsB;IACtC;8DAC0D;IAC1D,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kHAAkH;IAClH,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;oGAEoG;AACpG,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAEtF;AAED;qGACqG;AACrG,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAE9D;AAED;;qEAEqE;AACrE,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAK/D;AAED;;;;yFAIyF;AACzF,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAyC9F"}