@productbrain/cli 0.1.0-beta.5988 → 0.1.0-beta.5993

package/dist/commands/handshake.js

@@ -2,7 +2,7 @@
  * pb handshake — generate context files for AI developer tools.
  * Context export wiring (read-only filesystem bridge; GLO-63, DEC-161) — not a product surface.
  */
-import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, copyFileSync, appendFileSync, unlinkSync, statSync, renameSync, rmSync, realpathSync } from 'fs';
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, copyFileSync, unlinkSync, statSync, realpathSync } from 'fs';
 import { join, dirname, resolve, basename, relative, sep, isAbsolute } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
@@ -42,157 +42,6 @@ import { getReverseMapFallbackMessage, reportReverseMapMissing } from '../surfac
 const MAX_HANDSHAKE_WAIT_MS = 10_000; // 10 seconds
 const POLL_INTERVAL_MS = 500; // 500 ms per poll
 const MAX_POLLS = MAX_HANDSHAKE_WAIT_MS / POLL_INTERVAL_MS; // 20
-// ── WP-379 S4: Dormant marker ─────────────────────────────────────────────────
-/**
- * DORMANT_MARKER — appended to previously-projected asset files when the asset's
- * gate deactivates (e.g. workspace readiness exceeds the max threshold).
- *
- * Contract:
- *   - The file is NOT deleted. It persists on disk so that history is preserved
- *     and the agent surface remains inspectable.
- *   - The marker is appended at the end of the file, idempotent — if it already
- *     exists, no second append occurs.
- *   - The marker does NOT trigger a drift TEN. Dormant files are intentionally
- *     deactivated, not accidentally forked.
- *   - The marker is never included in active file writes — only dormant writes.
- *
- * Used by: writeDormantMarker() (write) and hasDormantMarker() (idempotency check).
- * Exported for use in tests.
- *
- * Chain: WP-379 S4.
- */
-export const DORMANT_MARKER = '<!-- pb-status: dormant -->';
-/**
- * hasDormantMarker — check whether a file on disk already has the dormant marker.
- * Used for idempotency: if the marker is already present, skip the append.
- */
-function hasDormantMarker(content) {
-    return content.includes(DORMANT_MARKER);
-}
-/**
- * writeDormantMarker — append the dormant marker to a previously-projected file.
- *
- * Idempotent: if DORMANT_MARKER is already present, no-op.
- * Only operates on files that have the auto-gen MARKER — we never touch
- * manually-authored files.
- *
- * @param filePath  Absolute path to the file.
- * @returns         'written' | 'already-dormant' | 'skipped' (no auto-gen marker)
- */
-export function writeDormantMarkerToFile(filePath) {
-    if (!existsSync(filePath))
-        return 'skipped';
-    const content = readFileSync(filePath, 'utf8');
-    // Only mark files that were originally projected by pb handshake.
-    // Files without the auto-gen MARKER are manually authored — leave them alone.
-    if (!content.includes(MARKER))
-        return 'skipped';
-    if (hasDormantMarker(content))
-        return 'already-dormant';
-    // Append the marker on its own line. No trailing newline assumption —
-    // appendFileSync adds to whatever is already there.
-    appendFileSync(filePath, `\n${DORMANT_MARKER}\n`);
-    return 'written';
-}
-/**
- * renameSurfaceForDormancy — rename a projected surface file to `<path>.dormant`
- * so external scanners (which glob *.md / *.mdc) stop loading it. WP-426 E4.
- * The HTML-comment marker is invisible to scanners; the extension change removes
- * the file from their glob set. Only touches files carrying the auto-gen MARKER.
- * Runs on an INDEPENDENT existence check (not gated on marker-write result) so
- * legacy WP-379 marker-only files still rename. Idempotent.
- * Codex P1: when a .dormant already exists, only replace it if its body matches the
- * live file. A divergent .dormant (user edited it) is preserved and reported as 'drift'
- * rather than force-deleted — no silent data loss.
- * @returns 'renamed' | 'replaced' | 'already-dormant' | 'skipped' | 'drift'
- */
-export function renameSurfaceForDormancy(filePath) {
-    const dormantPath = `${filePath}.dormant`;
-    if (!existsSync(filePath))
-        return existsSync(dormantPath) ? 'already-dormant' : 'skipped';
-    if (!readFileSync(filePath, 'utf8').includes(MARKER))
-        return 'skipped';
-    const replacing = existsSync(dormantPath);
-    if (replacing) {
-        // Codex P1: the existing .dormant may carry user edits (e.g. the user reactivated to
-        // the live path but kept an edited dormant sibling). Compare normalized bodies
-        // (DORMANT_MARKER + volatile auto-gen timestamp stripped from both); if they diverge,
-        // preserve the .dormant and signal drift instead of force-replacing it.
-        const strip = (s) => normalizeHandshakeContentForComparison(s.split(DORMANT_MARKER).join('')).trimEnd();
-        if (strip(readFileSync(filePath, 'utf8')) !== strip(readFileSync(dormantPath, 'utf8'))) {
-            return 'drift';
-        }
-        rmSync(dormantPath, { force: true });
-    }
-    renameSync(filePath, dormantPath);
-    return replacing ? 'replaced' : 'renamed';
-}
-/**
- * restoreSurfaceFromDormant — clean the orphan `<path>.dormant` sibling after a
- * raised (observe→project) asset has been re-projected fresh from the DB body by
- * the normal write loop. WP-426 E4.
- * Normalizes the volatile auto-gen timestamp (via normalizeHandshakeContentForComparison)
- * before comparing, else the lowering-time timestamp would always force a false
- * 'orphan-drift'. Identical body → remove. Differs (user edited) → preserve + drift.
- * @returns 'restored' | 'orphan-drift' | 'skipped'
- */
-export function restoreSurfaceFromDormant(filePath) {
-    const dormantPath = `${filePath}.dormant`;
-    if (!existsSync(dormantPath))
-        return 'skipped';
-    // WP-426 E4: no fresh live projection this run (surface filtered / user-owned / not written) →
-    // nothing to reconcile; absence of fresh is NOT evidence of a user edit. Leave the .dormant.
-    if (!existsSync(filePath))
-        return 'skipped';
-    const fresh = readFileSync(filePath, 'utf8');
-    // Codex P2: only reconcile against a PB-managed projection. A live file WITHOUT the auto-gen
-    // MARKER is a user-owned file (shouldWriteAdapter would have skipped reprojecting it),
-    // so it was NOT raised this run — comparing the .dormant against it would wrongly delete it or
-    // re-fire "edited while dormant" drift. Leave the .dormant untouched.
-    if (!fresh.includes(MARKER))
-        return 'skipped';
-    const dormant = readFileSync(dormantPath, 'utf8').split(DORMANT_MARKER).join('');
-    const norm = (s) => normalizeHandshakeContentForComparison(s).trimEnd();
-    if (norm(dormant) === norm(fresh)) {
-        rmSync(dormantPath, { force: true });
-        return 'restored';
-    }
-    return 'orphan-drift';
-}
-/**
- * deriveDormantFilePaths — compute the set of on-disk file paths that would have
- * been projected for a given dormant asset (by name and assetKind).
- *
- * Assets are projected to one or more surfaces (cursor/claude/codex) depending
- * on shouldEmitToTarget. Since we don't re-run shouldEmitToTarget here, we
- * speculatively probe all known surface paths and let writeDormantMarkerToFile
- * decide whether each exists and has the auto-gen MARKER.
- *
- * @param asset  The dormant asset from the server.
- * @param cwd    Current working directory (project root).
- * @returns      Each candidate path paired with its owning surface, so callers can
- *               filter by the run's allowedTargets (--surfaces) and the perimeter.
- */
-function deriveDormantFilePaths(asset, cwd) {
-    // Defense-in-depth: even though `name` originates from platform-seeded DB
-    // entries (not user input), validate it against a strict charset before
-    // interpolating into a filesystem path. Reject anything that could traverse
-    // out of the expected directories. WP-379 S4 review finding.
-    if (!/^[A-Za-z0-9 ._-]+$/.test(asset.name)) {
-        return [];
-    }
-    const out = [];
-    const { name, assetKind } = asset;
-    if (assetKind === 'skill') {
-        out.push({ path: join(cwd, '.cursor', 'skills', name, 'SKILL.md'), surface: 'cursor' });
-        out.push({ path: join(cwd, '.codex', 'skills', `${name}.md`), surface: 'codex' });
-    }
-    else if (assetKind === 'rule' || assetKind === 'hook') {
-        out.push({ path: join(cwd, '.cursor', 'rules', `${name}.mdc`), surface: 'cursor' });
-        out.push({ path: join(cwd, '.claude', 'rules', `${name}.md`), surface: 'claude' });
-    }
-    return out;
-}
 /**
  * Single-shot health probe — calls `workspace.health` and inspects
  * `starterSetupSeeded`. Does NOT poll internally; polling is the caller's
@@ -614,12 +463,10 @@ export function deriveHandshakeStartupSignals(cwd, callerSignals = {}, deps = DE
     const { runGit, prDiff } = deps;
     const branchName = runGit(cwd, 'git branch --show-current');
     const commitSha = runGit(cwd, 'git rev-parse --short HEAD');
-    // Changed paths come from THREE sources, unioned + deduped:
-    //   1. Dirty worktree (`git diff --name-only HEAD`) — existing behavior.
-    //   2. Committed branch delta vs the merge-base with origin/main (Codex@665):
-    //      after the branch is committed and the worktree is clean, source #1 is
-    //      empty and the branch delta would be invisible without this.
-    //   3. PR-ref dereference (F4) — appended later, once refs are collected.
+    // Changed paths come from THREE sources, unioned + deduped: (1) dirty worktree (`git diff
+    // --name-only HEAD`); (2) committed branch delta vs the merge-base with origin/main
+    // (Codex@665) — once the worktree is clean, source #1 is empty and the branch delta would
+    // be invisible without this; (3) PR-ref dereference (F4), appended later once refs collect.
     const dirtyChangedPaths = runGit(cwd, 'git diff --name-only HEAD')?.split(/\r?\n/).filter(Boolean) ?? [];
     const mergeBase = runGit(cwd, 'git merge-base HEAD origin/main');
     const branchChangedPaths = mergeBase
@@ -690,13 +537,10 @@ export function deriveHandshakeStartupSignals(cwd, callerSignals = {}, deps = DE
         Boolean(sanitized.explicitScope);
     if (hasMeaningfulEvidence)
         return sanitized;
-    // Codex@704: even with no task/path/ref/scope evidence, still emit a minimal
-    // envelope carrying the attribution fields (resolverVersion, commitSha,
-    // branchName). Returning {} here would drop the whole startup block at the
-    // caller, losing attribution AND the loud domain-unresolved signal exactly in
-    // the low-evidence case the resolver is meant to make queryable
-    // (spec "Loud Unresolved State"; AC #4). The envelope has no evidence fields,
-    // so the resolver sees no domain and emits domain-unresolved.
+    // Codex@704: even with no task/path/ref/scope evidence, still emit a minimal envelope
+    // carrying attribution (resolverVersion, commitSha, branchName) — returning {} would drop
+    // the whole startup block, losing attribution AND the loud domain-unresolved signal in the
+    // low-evidence case the resolver is meant to make queryable (spec "Loud Unresolved State", AC #4).
     return sanitizeStartupResolutionSignals({
         sourceSurface: sanitized.sourceSurface ?? 'cli',
         resolverVersion: sanitized.resolverVersion ?? STARTUP_RESOLUTION_RESOLVER_VERSION,
@@ -722,12 +566,9 @@ function shouldWriteAdapter(filePath, force) {
         return true;
     const content = readFileSync(filePath, 'utf8');
     // A file WITHOUT the auto-gen MARKER is user-owned / committed-static — the hand-maintained
-    // constitution (CLAUDE.md / AGENTS.md) and the committed Copilot instructions
-    // (.github/copilot-instructions.md + .github/instructions/*.instructions.md) all live here.
-    // PB NEVER overwrites these — not even under --force. (--force only re-forces PB-managed files
-    // and bypasses the tampered-defer downstream; it must never clobber committed static content.
-    // Returning false here is what stops `pb handshake --force` from clobbering them; force is
-    // therefore not consulted for the user-owned class by design.)
+    // constitution (CLAUDE.md / AGENTS.md) and the committed Copilot instructions all live here.
+    // PB NEVER overwrites these, not even under --force (force only re-forces PB-managed files and
+    // bypasses the tampered-defer downstream) — force is therefore not consulted here by design.
     void force;
     return content.includes(MARKER);
 }
@@ -836,14 +677,11 @@ function setupAuthoringPath(cwd, asset) {
     // WP-426 E3: recorded authoring source path wins so reprojection lands where the
     // user authored — no duplicate (TEN-1920). Stored relative to .productbrain/.
     if (asset.authoringPath && asset.authoringPath.trim()) {
-        // Codex P1/P2: authoringPath comes from the DB and is untrusted at projection
-        // time. It is probed via existsSync/readFileSync (and later writeFileSync) in the
-        // writeback loop BEFORE any assertSetupWritePath guard runs. Containment alone is
-        // not enough — a bad DB row could still point at a directory (e.g. "skills") or an
-        // internal PB file (".authoring-sync.json", "manifest.yaml"), which the loop would
-        // mis-handle as markdown (throw on a directory read, or overwrite PB state).
-        // Constrain to a kind-appropriate markdown file (<dir>/**/*.md); otherwise fall
-        // back to the safe name-derived path.
+        // Codex P1/P2: authoringPath is untrusted DB data, probed via existsSync/readFileSync
+        // (and later writeFileSync) BEFORE any assertSetupWritePath guard runs. Containment
+        // alone isn't enough — a bad row could point at a directory or an internal PB file
+        // ("skills", ".authoring-sync.json", "manifest.yaml"); constrain to a kind-appropriate
+        // markdown file (<dir>/**/*.md), else fall back to the safe name-derived path.
         const pbDir = join(cwd, '.productbrain');
         const candidate = resolve(pbDir, asset.authoringPath);
         const within = relative(pbDir, candidate);
@@ -886,16 +724,9 @@ function loadAuthoringSyncState(productbrainDir) {
         if (parsed.version !== 1 || !parsed.assets || typeof parsed.assets !== 'object') {
             return { version: 1, assets: {} };
         }
-        // Codex P2: the dormant registries are consumed via .includes() in the dormant loop
-        // BEFORE its per-file try/catch, so a malformed .authoring-sync.json (a field set to
-        // an object/number instead of an array) would throw a TypeError and abort the whole
-        // handshake. Coerce to a string[] (mirrors the assets validation above) to fail open.
-        const toStringArray = (v) => Array.isArray(v) ? v.filter((x) => typeof x === 'string') : [];
         return {
             version: 1,
             assets: parsed.assets,
-            dormantRenamed: toStringArray(parsed.dormantRenamed),
-            dormantReactivated: toStringArray(parsed.dormantReactivated),
         };
     }
     catch {
@@ -967,27 +798,23 @@ function deduplicateEntries(entries) {
 /**
  * resolveProjectionCollision — WP-379 S5b
  *
- * Marker-scoped orphan unlink: enumerates target dirs (.cursor/rules/,
- * .claude/rules/, .claude/skills/, .codex/skills/); for each file that has
- * the auto-gen MARKER whose lowercase-normalized filename does NOT match any
- * current active-asset materializedFilename, the file is unlinked.
- *
- * User-owned files (no MARKER) are never touched, regardless of name.
- *
- * Linux case-collision disambiguation:
- *   1. Exact match (lowercase name == any canonical name): survives.
- *   2. Case-variant with MARKER (marker file, no exact canonical match): unlinked.
- *   3. Ambiguous (zero exact, multiple case-variants with MARKER):
- *      newest mtime wins; all others are unlinked; a collision TEN is
- *      appended to the session capture queue (not fired inline).
+ * Marker-scoped orphan unlink over .cursor/rules/, .claude/rules/, .claude/skills/,
+ * .codex/skills/: any marker-bearing file whose lowercase-normalized name matches no
+ * current active-asset materializedFilename is unlinked. User-owned files (no MARKER)
+ * are never touched, regardless of name.
  *
- * Returns a list of unlink results so the caller can log/report them.
+ * Case-collision disambiguation: (1) exact match (lowercase name == canonical) survives;
+ * (2) case-variant with MARKER, no exact match, unlinked; (3) ambiguous (zero exact,
+ * multiple case-variant) — newest mtime wins, others unlinked, a collision TEN queued
+ * (not fired inline); (4) a live file plus a leftover `.dormant` sibling is reconciled by
+ * CONTENT, not mtime (PR #911 review, Codex P1) — a matching sibling is unlinked, a
+ * diverged one is preserved and reported as drift.
  *
  * @param cwd         Project root (absolute path).
- * @param assetNames  The current set of canonical asset names from the server
- *                    (e.g. ["Setup-ProductBrain", "chain-rules"]).
+ * @param assetNames  Canonical asset names from the server (e.g. ["Setup-ProductBrain"]).
  * @param log         Progress log function.
  * @param logErr      Error log function.
+ * @returns           Unlink results, for the caller to log/report.
  */
 export function resolveProjectionCollision(cwd, assetNames, log, logErr) {
     // Target directories by extension suffix.
@@ -1018,7 +845,7 @@ export function resolveProjectionCollision(cwd, assetNames, log, logErr) {
         // normalizedStem → [ { filename, fullPath } ]
         const groups = new Map();
         for (const filename of files) {
-            if (!filename.endsWith(ext))
+            if (!filename.endsWith(ext) && !filename.endsWith(`${ext}.dormant`))
                 continue;
             const fullPath = join(dir, filename);
             // Only operate on files that have the auto-gen MARKER.
@@ -1031,7 +858,10 @@ export function resolveProjectionCollision(cwd, assetNames, log, logErr) {
             }
             if (!content.includes(MARKER))
                 continue; // user-owned — never touch
-            const stem = basename(filename, ext);
+            // A leftover renamed-dormant sibling (from a prior binary version — this one no
+            // longer creates them) groups under its live file's stem so the rules below can
+            // reconcile or unlink it like any other stray file.
+            const stem = basename(filename.endsWith('.dormant') ? filename.slice(0, -'.dormant'.length) : filename, ext);
             const normalizedStem = normalizeMaterializedFilename(stem);
             const group = groups.get(normalizedStem) ?? [];
             group.push({ filename, fullPath });
@@ -1062,6 +892,46 @@ export function resolveProjectionCollision(cwd, assetNames, log, logErr) {
                 results.push({ action: 'kept', filePath: members[0].fullPath, reason: 'canonical-exact' });
                 continue;
             }
+            // A live file plus leftover .dormant sibling(s) (from an older binary) is reconciled
+            // by CONTENT, never mtime — the generic ambiguous arm below could otherwise delete the
+            // live file or a user-edited dormant copy (PR #911 review, Codex P1).
+            const liveMembers = members.filter((m) => !m.filename.endsWith('.dormant'));
+            const dormantMembers = members.filter((m) => m.filename.endsWith('.dormant'));
+            if (liveMembers.length === 1 && dormantMembers.length > 0 && dormantMembers.length === members.length - 1) {
+                const live = liveMembers[0];
+                results.push({ action: 'kept', filePath: live.fullPath, reason: 'canonical-exact' });
+                let liveNorm = '';
+                try {
+                    liveNorm = normalizeHandshakeContentForComparison(readFileSync(live.fullPath, 'utf8')).trimEnd();
+                }
+                catch { /* never matches below */ }
+                for (const dormant of dormantMembers) {
+                    let dormantNorm = null;
+                    // The retired marker is appended, not substituted — strip it before comparing.
+                    try {
+                        const raw = readFileSync(dormant.fullPath, 'utf8').split('<!-- pb-status: dormant -->').join('');
+                        dormantNorm = normalizeHandshakeContentForComparison(raw).trimEnd();
+                    }
+                    catch { /* preserve as drift below */ }
+                    if (dormantNorm !== null && dormantNorm === liveNorm) {
+                        try {
+                            unlinkSync(dormant.fullPath);
+                            log(`Dormant sibling unlinked (matches live): ${dormant.fullPath}`);
+                            results.push({ action: 'unlinked', filePath: dormant.fullPath, reason: 'dormant-sibling-matches-live' });
+                        }
+                        catch (err) {
+                            logErr(`Warning: could not unlink dormant sibling ${dormant.fullPath} — ${err instanceof Error ? err.message : String(err)}`);
+                            results.push({ action: 'kept', filePath: dormant.fullPath, reason: 'unlink-failed' });
+                        }
+                    }
+                    else {
+                        collisionTens.push(`Leftover dormant copy ${dormant.fullPath} diverges from the live projection; left both in place. Resolve manually.`);
+                        logErr(`Warning: ${dormant.fullPath} diverges from the live file; not replacing (possible manual edit).`);
+                        results.push({ action: 'kept', filePath: dormant.fullPath, reason: 'dormant-sibling-diverged' });
+                    }
+                }
+                continue;
+            }
             // Multiple files with the same normalized stem → case-collision.
             // Rule: exact match (filename stem === normalized stem, i.e. already lowercase) wins.
             const exactMatches = members.filter(({ filename }) => {
@@ -1255,8 +1125,6 @@ export async function runHandshake(options = {}) {
     let dbRules = [];
     let usedDbSource = false;
     let dbAssetRows = [];
-    // WP-379 S4: dormant assets (gate-failed) — their on-disk files get the dormant marker.
-    let dormantDbAssetRows = [];
     // WP-428 S2 (Finding #5): tracks entryIds whose body fetch from storage failed.
     // Hoisted here (same scope as dbAssetRows) so both the skills/rules projection loop
     // AND the authoring-file projection loop can skip failed assets.
@@ -1339,8 +1207,9 @@ export async function runHandshake(options = {}) {
         }
     }
     try {
-        // WP-379 S4: listAssetsForUser now returns { activeAssets, dormantAssets }.
-        // Wire format changed from DbAsset[] to { activeAssets: DbAsset[], dormantAssets: DbAsset[] }.
+        // WP-379 S4: listAssetsForUser returns { activeAssets, dormantAssets }. Only
+        // activeAssets is projected (DEC-1690: a dormant/gate-failed asset is simply not
+        // projected — nothing further to reconcile on disk for it).
         // Fall back to empty arrays if the server returns the old flat-array shape (graceful degradation).
         const rawResponse = await kernelCall('setup.listAssetsForUser', {}).catch(() => null);
         let dbAssets = [];
@@ -1348,11 +1217,9 @@ export async function runHandshake(options = {}) {
             if (Array.isArray(rawResponse)) {
                 // Pre-S4 server — treat entire response as active assets with no dormant list.
                 dbAssets = rawResponse;
-                dormantDbAssetRows = [];
             }
             else {
                 dbAssets = rawResponse.activeAssets ?? [];
-                dormantDbAssetRows = rawResponse.dormantAssets ?? [];
             }
         }
         if (dbAssets.length > 0) {
@@ -1431,9 +1298,6 @@ export async function runHandshake(options = {}) {
             }
             usedDbSource = true;
             log(`Setup assets: ${dbSkills.length} skills, ${dbRules.length} rules/hooks from DB (WP-345 DB-first path)`);
-            if (dormantDbAssetRows.length > 0) {
-                log(`Setup assets: ${dormantDbAssetRows.length} dormant (gate-filtered) asset(s) will be marked on disk`);
-            }
         }
     }
     catch {
@@ -1964,10 +1828,9 @@ export async function runHandshake(options = {}) {
         collisionTensToFire.push(...collisionTens);
     }
     // ── WP-436 S3: Vocab projector — fetch workspace vocab context once per handshake ──
-    // Source-side (.productbrain/skills/*.md + rules/*.md) stays tokenized.
-    // The projector resolves {{vocab:...}} tokens before writing adapter output to disk
-    // (.cursor/rules/, .claude/rules/, CLAUDE.md, AGENTS.md, .github/copilot-instructions.md).
-    // Fail-open: if vocab fetch fails, skip resolution and write raw token (no breakage).
+    // Source-side (.productbrain/skills|rules/*.md) stays tokenized; the projector resolves
+    // {{vocab:...}} tokens before writing adapter output to disk. Fail-open: if vocab fetch
+    // fails, skip resolution and write the raw token (no breakage).
     const handshakeVocabCtx = await getOrFetchVocabCtx(config.apiKey, async () => {
         try {
             const vocab = await kernelCall('chain.getVocabulary', {});
@@ -2195,13 +2058,10 @@ export async function runHandshake(options = {}) {
             }
         });
     }
-    // Ordering note: this refusal runs AFTER the projected-hash flush so that files legitimately
-    // written THIS run still record their hashes; malformed files were never written (no hash to record).
-    // TEN-2155: in non-interactive apply, a malformed PB region is a refusal, not a silent skip.
-    // Gated on applyMode (NOT writeMode): a malformed region is a user-file INTEGRITY fault, so the
-    // refusal fires on any headless `--apply` regardless of materialize authority (STD-263 invariant vi —
-    // "headless → non-zero refusal", unqualified). writeMode would suppress it under observe/off, where
-    // the malformed file still gets enumerated but the corruption signal would be silently dropped.
+    // Ordering note: runs AFTER the projected-hash flush so files legitimately written THIS run
+    // still record their hashes (malformed files were never written). TEN-2155: in non-interactive
+    // apply, a malformed PB region is a refusal, not a silent skip — gated on applyMode (not
+    // writeMode, which would suppress it under observe/off) per STD-263 invariant vi (unqualified).
     if (applyMode && malformedRegionPaths.length > 0 && (options.noPrompt || !process.stdout.isTTY)) {
         throw new CLIError(`Malformed PB region in: ${malformedRegionPaths.join(', ')}`, {
             code: ErrorCode.VALIDATION_FAILED,
@@ -2210,19 +2070,12 @@ export async function runHandshake(options = {}) {
         });
     }
     // ── WP-421 S3: tampered-bucket resolution (doneWhen #17) ────────────────────
-    // Apply mode only. Tampered files were DEFERRED in the write loop above;
-    // here we either prompt the user (interactive TTY) or refuse (headless).
-    //
-    // Headless = `--no-prompt` flag OR `process.stdout.isTTY === false`. When
-    // headless: enumerate each tampered file to stderr, write a setup_receipt
-    // row with kind='transition' (DEC-962) capturing `refusedTamperedFiles[]`,
-    // then exit non-zero. NEVER auto-resolve. (#17 + exclusions: edits to
-    // projection dirs are detected, NOT silently overwritten.)
-    //
-    // Interactive: for each tampered file, present adopt-or-revert. Adopt =
-    // create a personal-scoped setup_asset draft from the tampered content
-    // (see helper below). Revert = re-project canonical content over the
-    // tampered file (write w.content to w.path).
+    // Apply mode only. Tampered files were DEFERRED in the write loop above; here we either
+    // prompt the user (interactive TTY) or refuse headless (--no-prompt or non-TTY stdout):
+    // enumerate to stderr, write a setup_receipt row (kind='transition', DEC-962) capturing
+    // refusedTamperedFiles[], exit non-zero — NEVER auto-resolve. Interactive: adopt (create a
+    // personal-scoped setup_asset draft from the tampered content, see helper below) or revert
+    // (re-project canonical content over the tampered file, write w.content to w.path).
     const adoptedTamperedPaths = [];
     const revertedTamperedPaths = [];
     if (writeMode && tamperedBucket.length > 0) {
@@ -2388,156 +2241,11 @@ export async function runHandshake(options = {}) {
             }
         }
     }
-    // 8a. Dormant marker + .dormant rename (WP-379 S4 + WP-426 E4) — apply mode only.
-    const dormantMarkedPaths = [];
-    if (writeMode && dormantDbAssetRows.length > 0) {
-        const dormantState = loadAuthoringSyncState(pbDir);
-        let dormantStateChanged = false;
-        for (const dormantAsset of dormantDbAssetRows) {
-            for (const { path: filePath, surface } of deriveDormantFilePaths(dormantAsset, cwd)) {
-                // Codex P2: deriveDormantFilePaths emits every known surface path. Honor the run's
-                // target set (allowedTargets = the --surfaces selection, else all manifest surfaces)
-                // so a `--surfaces cursor` run never renames .claude/.codex to .dormant, and surfaces
-                // outside the manifest are skipped silently (no false "could not dormant-mark" warning).
-                if (!allowedTargets.has(surface))
-                    continue;
-                // FIX 4: use relative() instead of string-replace for correct cross-platform behaviour.
-                const rel = relative(cwd, filePath);
-                const alreadyReactivated = dormantState.dormantReactivated?.includes(rel) ?? false;
-                const previouslyRenamed = dormantState.dormantRenamed?.includes(rel) ?? false;
-                try {
-                    assertSetupWritePath(filePath, perimeterManifest);
-                    // WP-426 E4: BUG 1 fix — hands-off set.
-                    //
-                    // Step 1: permanently hands-off — user already reactivated this path on a
-                    //   prior run. Skip silently every time until they re-lower or raise in PB.
-                    //   (Task 7 raise-cleanup must later also prune dormantReactivated for raised
-                    //   assets — see the `dormantReactivated` comment on AuthoringSyncState.)
-                    if (alreadyReactivated) {
-                        continue; // leave file untouched; no TEN (already fired on first detection)
-                    }
-                    // Step 2: FIRST detection of manual reactivation — we previously renamed
-                    //   this to .dormant but the user renamed it back to a live file. Push the
-                    //   drift TEN exactly once, add to the permanent hands-off set, remove from
-                    //   dormantRenamed, leave file untouched.
-                    if (previouslyRenamed && existsSync(filePath) && !existsSync(`${filePath}.dormant`)) {
-                        syncDriftTensToFire.push(`Dormant asset ${dormantAsset.entryId} was manually reactivated at ${rel}; left untouched. Re-lower or raise it in PB to resync.`);
-                        logErr(`Warning: ${rel} was manually un-dormanted; leaving it in place (drift).`);
-                        dormantState.dormantReactivated = [...(dormantState.dormantReactivated ?? []), rel];
-                        dormantState.dormantRenamed = (dormantState.dormantRenamed ?? []).filter((p) => p !== rel);
-                        dormantStateChanged = true;
-                        continue;
-                    }
-                    // Step 3: normal lowering — write dormant marker + rename to .dormant.
-                    // WP-426 E4 spec: every rename TARGET must also pass the perimeter guard.
-                    // Check the post-rename .dormant path BEFORE any FS mutation, so a guard
-                    // failure can't leave a half-dormant file (marker appended but not renamed).
-                    assertSetupWritePath(`${filePath}.dormant`, perimeterManifest);
-                    const markerResult = writeDormantMarkerToFile(filePath);
-                    if (markerResult === 'written')
-                        log(`Dormant marker written: ${filePath}`);
-                    const renameResult = renameSurfaceForDormancy(filePath);
-                    if (renameResult === 'renamed' || renameResult === 'replaced') {
-                        // dormantMarkedPaths holds post-rename .dormant paths (not the original surface paths).
-                        dormantMarkedPaths.push(`${filePath}.dormant`);
-                        if (!dormantState.dormantRenamed?.includes(rel)) {
-                            dormantState.dormantRenamed = [...(dormantState.dormantRenamed ?? []), rel];
-                            dormantStateChanged = true;
-                        }
-                        log(`Dormant rename: ${filePath} → ${filePath}.dormant`);
-                    }
-                    else if (renameResult === 'drift') {
-                        // Codex P1: an edited .dormant already exists alongside the live file. Preserve
-                        // both and flag, rather than overwriting the user's edited dormant copy.
-                        syncDriftTensToFire.push(`Edited dormant copy ${rel}.dormant diverges from the live surface for ${dormantAsset.entryId}; left both in place. Resolve manually.`);
-                        logErr(`Warning: ${rel}.dormant diverges from the live file; not replacing (possible manual edit).`);
-                    }
-                }
-                catch (err) {
-                    logErr(`Warning: could not dormant-mark ${filePath} — ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-        if (dormantMarkedPaths.length > 0) {
-            log('Run `pb setup observe --purge` to remove these instead of dormant-renaming.');
-        }
-        if (dormantStateChanged) {
-            try {
-                saveAuthoringSyncState(pbDir, dormantState);
-            }
-            catch (err) {
-                logErr(`Warning: could not persist dormancy state — ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-    }
-    // 8b. Raise-cleanup (WP-426 E4): for assets active this run, drop any orphan
-    // <surface>.dormant left by a prior lowering (active surface was re-projected
-    // fresh above). User-edited dormant copies are preserved + flagged. Fail-open.
-    if (writeMode) {
-        const raiseState = loadAuthoringSyncState(pbDir);
-        let raiseStateChanged = false;
-        const dormantIds = new Set(dormantDbAssetRows.map((a) => a.entryId));
-        const activeRows = dbAssetRows.filter((a) => !dormantIds.has(a.entryId) &&
-            (a.assetKind === 'skill' || a.assetKind === 'rule' || a.assetKind === 'hook'));
-        for (const asset of activeRows) {
-            // Codex P2: if this asset's body fetch failed, the write loop did NOT reproject its
-            // surfaces this run (same skip the authoring loop applies), so there's no fresh surface
-            // to reconcile against — skip raise-cleanup to avoid acting on stale content.
-            if (bodyFetchFailedEntryIds.has(asset.entryId))
-                continue;
-            for (const { path: filePath, surface } of deriveDormantFilePaths(asset, cwd)) {
-                // Codex P2: honor the run's target set (parity with the dormant pass) — a
-                // `--surfaces cursor` run must not touch .claude/.codex .dormant files, and surfaces
-                // outside the manifest are skipped silently (no false "raise-cleanup failed" warning).
-                if (!allowedTargets.has(surface))
-                    continue;
-                const rel = relative(cwd, filePath);
-                try {
-                    assertSetupWritePath(filePath, perimeterManifest); // WP-426 E4: perimeter before any FS mutation (parity with the dormant pass)
-                    // E4 spec parity (review): restoreSurfaceFromDormant deletes the .dormant
-                    // sibling, so guard that delete TARGET too — exactly as the lowering pass
-                    // guards both filePath and ${filePath}.dormant.
-                    assertSetupWritePath(`${filePath}.dormant`, perimeterManifest);
-                    const r = restoreSurfaceFromDormant(filePath);
-                    if (r === 'restored') {
-                        log(`Raised: removed superseded ${filePath}.dormant`);
-                    }
-                    else if (r === 'orphan-drift') {
-                        syncDriftTensToFire.push(`Dormant copy ${rel}.dormant was edited while dormant for ${asset.entryId}; preserved on raise. Resolve manually.`);
-                        logErr(`Warning: ${rel}.dormant differs from the freshly raised projection; left in place.`);
-                    }
-                    // Prune the registry only when no .dormant sibling remains for this surface:
-                    //   • 'restored' removed it, or
-                    //   • it was already gone (manual .dormant→live reactivation; 'skipped', no .dormant).
-                    // Carry-over obligation (Phase 3) + Codex P1: the manual-reactivation case must
-                    // leave the hands-off set so a future lowering can re-evaluate the surface.
-                    // Codex P2: but if a .dormant STILL exists (surface-filtered 'skipped' with no
-                    // fresh live file, or a preserved 'orphan-drift'), KEEP the registry evidence —
-                    // otherwise a later manual .dormant→live reactivation would not be recognized as
-                    // previouslyRenamed and would be silently re-dormanted on the next lowering.
-                    if (!existsSync(`${filePath}.dormant`)) {
-                        if (raiseState.dormantRenamed?.includes(rel)) {
-                            raiseState.dormantRenamed = raiseState.dormantRenamed.filter((p) => p !== rel);
-                            raiseStateChanged = true;
-                        }
-                        if (raiseState.dormantReactivated?.includes(rel)) {
-                            raiseState.dormantReactivated = raiseState.dormantReactivated.filter((p) => p !== rel);
-                            raiseStateChanged = true;
-                        }
-                    }
-                }
-                catch (err) {
-                    logErr(`Warning: raise-cleanup failed for ${filePath} — ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-        if (raiseStateChanged) {
-            try {
-                saveAuthoringSyncState(pbDir, raiseState);
-            }
-            catch { /* fail-open */ }
-        }
-    }
+    // DEC-1690: a dormant (gate-failed) asset is simply not projected — dbAssets above
+    // already comes from the server's activeAssets list, so no further action is needed
+    // here. The WP-379 S4 / WP-426 E4 on-disk marker+rename+restore machinery (and its
+    // .authoring-sync.json dormancy registries) is retired: pre-launch, every on-disk
+    // projection is regenerable, so there is nothing to reconcile.
     // 8. User-owned files left untouched are NOT drift (TEN-2150).
     // A marker-less file at an adapter path is the user's own file: handshake never
     // wrote it, so there is nothing to "sync" and no draft TEN is logged. These files
@@ -2657,5 +2365,5 @@ export async function runHandshake(options = {}) {
     return report;
 }
 // WP-426 E3/E4: exported test-only surface (not part of the public CLI API).
-export const __test = { setupAuthoringPath, renameSurfaceForDormancy, restoreSurfaceFromDormant, loadAuthoringSyncState, MARKER };
+export const __test = { setupAuthoringPath, loadAuthoringSyncState, MARKER };
 //# sourceMappingURL=handshake.js.map