@redue/cli 0.1.0-alpha.2 → 0.1.0-alpha.4

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.1.0-alpha.4 — 2026-10-07
+
+- Withdraw automatic npm-launcher applicability because update notifications consume
+  unobserved remote/cache/time state. Npm scripts still run and record outcomes.
+- Preserve historical PASS/FAIL and require stop/start when upgrading an observer.
+  Do not delete receipts. See the [maintainer notice](docs/user/npm-launcher-notice.md).
+- Supported Yarn/pnpm and explicit reviewed contracts are unchanged. No agent
+  activation or npm direct-compiler recipe is included in this correction.
+
+## 0.1.0-alpha.3 — 2026-10-06
+
+Install: `npm install --global @redue/cli@alpha`.
+
+- Fix selected execution outcomes remaining hidden behind an older observer/cache
+  after a missed reload notification. A newer failure must not leave an older
+  passing receipt eligible for reuse.
+- Withhold applicability during incomplete receipt persistence, unreadable or
+  changing selection, and client connections to an older observer.
+- Preserve immutable run history. Upgrade requires an observer stop/start;
+  receipts need not be deleted. See the [maintainer notice](docs/user/receipt-selection-notice.md).
+
 ## 0.1.0-alpha.2 — 2026-10-06
 
 Install: `npm install --global @redue/cli@alpha`.

package/README.md

@@ -1,5 +1,10 @@
 # REDUE
 
+Maintainer notice: alpha.4 withdraws automatic npm-launcher applicability.
+Npm commands still execute and record historical outcomes, but remain UNVERIFIED.
+[Why this changed and how to upgrade without deleting receipts](docs/user/npm-launcher-notice.md).
+Alpha.2 users should also review the [receipt correction](docs/user/receipt-selection-notice.md).
+
 **Know what still holds. Redo what's due.**
 
 You ran the checks. Then the code changed—or a new coding agent started with no
@@ -9,6 +14,8 @@ REDUE keeps persistent verification state for your codebase so developers and
 coding agents can see which previous checks still apply to the code they have now.
 It records evidence, not proofs of correctness.
 
+For a qualified supported Yarn/pnpm check (ordinary npm scripts are recording-only):
+
 ```text
 $ redue status --sync
 ✓ typecheck  CURRENT / PASS
@@ -82,7 +89,8 @@ has been verified.
 - macOS, Linux, and Windows on supported local filesystems; Node 22+.
 - Linux also requires Python 3 for observation. No WSL or Git Bash needed on Windows.
 - npm, pinned Yarn `node-modules`, and pinned pnpm 12 isolated/hoisted layouts.
-- Automatic qualification for supported TypeScript invocations; workspace
+- Automatic qualification for the supported Yarn/pnpm TypeScript invocations; npm
+  launcher checks are recording-only in alpha.4. Workspace
   boundaries follow the files actually consumed, including built declarations.
 - Existing test/lint/build and arbitrary commands can record results while
   their applicability remains unqualified.

package/bin/redue.mjs

@@ -266,6 +266,7 @@ const checks=publicConfig.checks.map(check=>{
     coverageReasons:check.coverageReasons||Object.fromEntries(
       categories.map(category=>[category,reason])),
     qualification:check.qualification||null,script:check.script||null,
+    ...(npmAutomatic?{qualificationInterpretation:'npm-launcher-withheld@1'}:{}),
     workspace:check.workspace||null,kind:check.kind||null};
 });
 const runtime={schema:1,provider:'declared-project@1',root,state,checks};

package/docs/user/getting-started.md

@@ -57,6 +57,12 @@ prefix. Uninstalling the package does not remove local verification evidence;
 `redue remove-state` is a separate, explicit action. Alpha.1 remains available as
 historical software and is superseded for package identity, not a runtime defect.
 
+## Upgrading to alpha.4
+
+Stop every observer using the installation before upgrading, then restart each
+with the same config/state selection. See [the npm launcher notice](npm-launcher-notice.md)
+for exact commands. Do not remove state or delete receipts.
+
 ## First project
 
 From the project root:
@@ -74,7 +80,9 @@ Use a check actually printed by `init`. For a workspace:
 `redue init --workspace @example/package --check typecheck`.
 Initialization previews detected commands and qualification confidence before writing
 `redue.config.json`. An existing config is never overwritten. No checks are run and
-no dependencies installed. A missing/unsupported boundary is explained.
+no dependencies installed. A missing/unsupported boundary is explained. Npm-launcher typechecks are
+recording-only in alpha.4; a passed execution is historical PASS with UNVERIFIED
+applicability, not reusable CURRENT.
 
 “Ready to qualify” means REDUE has a supported recipe whose prerequisites will be
 validated. It is not a receipt. “Recording-only” can record PASS/FAIL without claiming

package/docs/user/npm-launcher-notice.md

@@ -0,0 +1,42 @@
+# npm launcher applicability correction — alpha.4
+
+Alpha.4 withdraws automatic applicability for npm-backed TypeScript checks using
+`typescript-noemit-v1`. Alpha.3 was demonstrated to admit an npm invocation whose
+update notification consumes unobserved remote responses, cache and time. Those
+inputs can change the outer npm result without changing the tracked project or
+caller identity. The controlled reproduction does not establish a public registry
+malfunction, affected-user count, or compiler completion in the failing npm case.
+
+Npm commands still execute exactly as configured through `redue run CHECK`.
+They still record PASS/FAIL. Previous PASS remains historical PASS; applicability
+is now UNVERIFIED, including after synchronization or a successful new npm run.
+This is a correction to the claimed boundary, not evidence that the code failed.
+Supported Yarn/pnpm and independently reviewed explicit contracts are unchanged.
+
+Until upgraded, do not rely solely on automatic npm CURRENT to skip the npm
+invocation. A different verification recipe requires explicit selection and fresh
+evidence; it cannot reinterpret an old npm receipt. Alpha.4 does not ship the
+experimental npm direct-compiler recipe or agent activation.
+
+## Upgrade without losing history
+
+First stop **every observer using this installation**, using each original config
+and any explicit state directory. Then upgrade that same installation and restart
+each observer with the same selections:
+
+```sh
+redue --config /path/to/project/redue.config.json stop
+npm install --global @redue/cli@0.1.0-alpha.4
+redue --config /path/to/project/redue.config.json start
+redue --config /path/to/project/redue.config.json status --sync
+```
+
+Repeat the stop/start commands for each project. If you originally used
+`--state-dir`, supply the identical directory on every REDUE command. If installed
+with a custom npm `--prefix`, supply the same prefix during installation. On Windows
+use `npm.cmd`/`redue.cmd` if required by existing PowerShell policy; do not change it.
+
+**Do not delete receipts or use `remove-state` as an upgrade step.** An upgraded
+client refuses an obsolete running observer interpretation and asks for stop/start.
+Restart reconciles existing state and preserves immutable historical runs. This
+correction does not silently change your project config or configured command.

package/docs/user/receipt-selection-notice.md

@@ -0,0 +1,60 @@
+# Receipt selection correction in alpha.3
+
+**Known affected release: `@redue/cli@0.1.0-alpha.2`. Fixed in
+`@redue/cli@0.1.0-alpha.3`.** No exploit or affected-user count is established.
+REDUE remains an alpha.
+
+If a wrapper persisted a newer outcome but its observer reload notification
+failed, the observer could continue selecting an older passing receipt. Cached
+and synchronized status could then present that older result as CURRENT and
+eligible for reuse. A separate reproduced write-failure window left a new
+immutable outcome recorded while replacing the selected receipt failed.
+
+Until upgraded, do not rely solely on affected CURRENT output to skip checks.
+Run verification when needed and inspect its actual outcome; a successful status
+command is not proof that the latest execution passed.
+
+## What changes
+
+The observer refreshes REDUE-owned receipt selection before publishing status.
+Clients check that a response represents the current readable selection. Missing,
+unreadable, malformed, incompatible, or replaced selection cannot authorize
+reuse. A new client connecting to an alpha.2 observer returns UNVERIFIED and
+asks for a restart, even when the old response says CURRENT.
+
+A small owned pending-update record also withholds applicability after an
+incomplete receipt write. Successful recording clears only that check's pending
+entry. It does not discard another check's incomplete outcome or automatically
+promote an orphaned journal entry. Inspect the failed run and storage error, fix
+the storage problem, then record that check again. An unreadable/malformed pending
+record requires operator inspection; do not delete receipts to obtain green status.
+
+Historical PASS/FAIL and immutable `runs-v1` files remain intact. Stable applicable
+FAIL remains a failure and is never reuse-eligible. This guard tracks owned
+receipt replacement; it does not replace input-content validation or promise an
+atomic decision against concurrent edits/writes.
+
+## Upgrade and restart
+
+From each initialized project, stop its observer before replacing the installation.
+After all observers for that installation have stopped, upgrade it once, then
+restart each observer with its existing configuration and state selection:
+
+```sh
+redue stop
+npm install --global @redue/cli@0.1.0-alpha.3
+redue --version
+redue start
+redue status --sync --json
+```
+
+Use the same npm `--prefix`, project `--config`, and `--state-dir` you already use,
+if customized. On Windows use `npm.cmd`/`redue.cmd` where required by the existing
+shell policy. Stop all observers belonging to the installation before replacing
+it, then start each with the upgraded binary. For an independently installed
+candidate, its `stop` command can stop the older observer in the same explicitly
+selected owned state. Do not run `remove-state`; receipts need not be deleted.
+
+Restart preserves historical receipts and reconciles inputs. It does not promise
+CURRENT: a newer failure, unstable execution, incomplete contract, changed input,
+or observation uncertainty remains visible under the normal rules.

package/docs/user/supported-projects.md

@@ -15,14 +15,13 @@ At the repository root, `init` looks for existing typecheck, test, lint, and
 build scripts. It prefers familiar script names, then unique recognizable
 `tsc`, Vitest/Jest, ESLint, or Vite commands under other names. Multiple
 matches are reported as ambiguous rather than guessed. It never creates a new
-project script. It recognizes canonical
-`tsc --noEmit` on local npm installations as a candidate for automatic
-qualification. Before CURRENT is possible, a read-only probe checks the
-TypeScript configuration and effective file list, local compiler, installed
-contents, npm/Node identity, and relevant caller context. Unsupported plugins,
-preloads, config graphs, or outside-root inputs leave the check UNVERIFIED with
-an explanation. A discovered script can still be run and recorded in that
-state. Root and package-level npm/Yarn workspace scripts are discovered from
+project script. Canonical `tsc --noEmit` npm scripts are discovered and recorded, but their
+automatic applicability is withdrawn in alpha.4: npm's update notification uses
+remote/cache/time inputs outside the observed contract. Even a successful run
+remains UNVERIFIED/PASS. Historical receipts are retained. See the
+[maintainer notice](npm-launcher-notice.md). A separately selected verification
+obligation would require an explicit configuration and fresh evidence; alpha.4
+does not provide the unreleased npm direct-compiler recipe. Root and package-level npm/Yarn workspace scripts are discovered from
 `package.json` workspace declarations. Pinned Yarn 4 `node-modules`/classic
 workspaces with a standalone `tsc -p .` script, local TypeScript, a conventional
 `src` include, and Node module resolution can qualify automatically. For one

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.4",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"

package/src/cached-state.mjs

@@ -2,22 +2,37 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import {processAlive} from './process-liveness.mjs';
+import {readReceipts,readReceiptSnapshot,receiptRevision} from './state-store.mjs';
 const unknown=(reason,checks)=>({schema:1,state:'unverified',current:0,stale:0,failed:0,observed_failed:0,
   unverified:checks.length,
   checks:checks.map(c=>({name:c.name,result:null,freshness:'UNVERIFIED',reason,
     invocation:null,changed_inputs:[],reuse_eligible:false})),
   observation:{healthy:false,reason}});
 export function unavailableCached(state,reason,checks=[]) {
-  try {const value=JSON.parse(fs.readFileSync(path.join(state,'status.json')));
-    const checks=(value.checks||[]).map(row=>({...row,freshness:'UNVERIFIED',
-      reason,reuse_eligible:false,declared_inputs_match:null}));
-    return {...value,state:'unverified',current:0,stale:0,failed:0,
-      unverified:Math.max(1,checks.length),checks,
-      observation:{...value.observation,healthy:false,reason}};
-  }catch{return unknown(reason,checks);}
+  let value;try{value=JSON.parse(fs.readFileSync(path.join(state,'status.json')));}
+  catch{value=unknown(reason,checks);}
+  if(!value||!Array.isArray(value.checks))value=unknown(reason,checks);
+  let receipts=null,revision=null;
+  try{const snapshot=readReceiptSnapshot(state);receipts=snapshot.value.checks;revision=snapshot.revision;}
+  catch(error){reason+=`; latest receipt unavailable; prior outcome only: ${error.message}`;
+    try{receipts=readReceipts(state).checks;}catch{/* retain cached historical rows */}}
+  const rows=(value.checks||[]).map(row=>{
+    const latest=receipts?.[row.name];
+    return {...row,...(receipts?{result:latest?.result||null,invocation:latest?.invocation||null,
+      target_provenance:latest?.target||null,coverage_at_run:latest?.coverage||null}:{}),
+      freshness:'UNVERIFIED',reason,reuse_eligible:false,declared_inputs_match:null};
+  });
+  return {...value,receipt_revision:revision,state:'unverified',current:0,stale:0,failed:0,
+    observed_failed:rows.filter(row=>row.result==='FAIL').length,
+    unverified:Math.max(1,rows.length),checks:rows,
+    observation:{...value.observation,healthy:false,reason}};
 }
 export function readCachedStatus(state,checks=[]) {
   try{const value=JSON.parse(fs.readFileSync(path.join(state,'status.json')));
+    if(typeof value.receipt_revision!=='string')
+      return unavailableCached(state,'receipt selection is unconfirmed; synchronize status or restart an older observer',checks);
+    if(value.receipt_revision!==receiptRevision(state))
+      return unavailableCached(state,'receipt selection changed; synchronize status to evaluate the latest outcome',checks);
     if(Date.now()>=value.updated_at&&Date.now()<=value.expires_at&&
       value.expires_at-value.updated_at<=3000){
       if(processAlive(value.pid))return value;

package/src/cli.mjs

@@ -15,7 +15,7 @@ import {createHash,randomUUID} from 'node:crypto';
 import {assertOwnedStatePlacement} from './owned-state.mjs';
 import {permittedRoots} from './installed-inputs.mjs';
 import {acquireRunLock,inspectRunLock,recoverRunLock} from './run-lock.mjs';
-import {atomicJson,commitReceipt} from './state-store.mjs';
+import {atomicJson,commitReceipt,receiptRevision} from './state-store.mjs';
 import {timing} from './decision-profile.mjs';
 import {readCachedStatus,unavailableCached} from './cached-state.mjs';
 import {renderRun} from './presentation.mjs';
@@ -284,7 +284,7 @@ async function execute() {
     const persistenceStarted=performance.now();
     commitReceipt(state,name,receipt);
     timing('cli.receipt_persistence',persistenceStarted);
-    try{await call({action:'reload'});}catch{/* next read remains conservative */}
+    try{await call({action:'reload'});}catch{/* receipt revisions invalidate older status even when reload IPC is unavailable */}
     const summary={check:name,result,target:target.status,
       invocation:invocation.status,...(invocation.errorCode?{error_code:invocation.errorCode}:{}),
       stable,coverage_qualified:receipt.coverage.qualified};
@@ -376,7 +376,18 @@ async function main(){
   if(action==='sync'||action==='detail'){
     const started=performance.now();
     let value;try{value=await decisionCall({action:'sync',contextHashes:contextHashes()},
-      Number(process.env.VSTATE_SYNC_TIMEOUT_MS||decisionDeadlineMs));}
+      Number(process.env.VSTATE_SYNC_TIMEOUT_MS||decisionDeadlineMs));
+      // A client upgrade can encounter an older running observer. Its successful
+      // control response does not establish that it evaluated the latest receipt.
+      if(value.receipt_revision===null){
+        value=unavailableCached(state,'latest receipt selection unavailable; inspect receipt state before reuse',config.checks);
+      }else if(typeof value.receipt_revision!=='string'){
+        value=unavailableCached(state,'observer cannot confirm latest receipt selection; stop and start the observer after upgrading',config.checks);
+        process.exitCode=2;
+      }else if(value.receipt_revision!==receiptRevision(state)){
+        value=unavailableCached(state,'receipt selection changed during synchronization; retry synchronized status',config.checks);
+        process.exitCode=2;
+      }}
     catch(e){value=unavailableCached(state,e.message,config.checks);process.exitCode=2;}
     timing('cli.synchronized_status',started,{available:value.observation?.healthy?1:0});
     if(action==='sync')console.log(JSON.stringify(value));

package/src/daemon.mjs

@@ -14,7 +14,7 @@ import {sha} from './plan.mjs';
 import {InputIndex} from './index.mjs';
 import {permittedRoots} from './installed-inputs.mjs';
 import {assertOwnedStatePlacement} from './owned-state.mjs';
-import {atomicJson,readReceipts} from './state-store.mjs';
+import {atomicJson,readReceipts,readReceiptSnapshot,receiptRevision} from './state-store.mjs';
 import {history} from './observation.mjs';
 import {inputKey} from './decision-validation.mjs';
 import {timing} from './decision-profile.mjs';
@@ -33,6 +33,7 @@ fs.writeFileSync(path.join(lock,'pid'),String(process.pid),{mode:0o600});
 const generation=randomUUID(), startedAt=Date.now();
 let index, receipts={}, watcher, healthy=false, reason='initial reconciliation', stopping=false;
 let receiptStateError=null;
+let receiptStateRevision=null;
 const external=new Map();
 for(const check of config.checks)for(const boundary of permittedRoots(root,check.allowedExternalRoots||[]))
   if(!external.has(boundary))external.set(boundary,{root:boundary,watcher:null,index:null,
@@ -77,9 +78,20 @@ function event(kind,fields={}) {
     repository:root,...fields})+'\n');
 }
 function loadReceipts() {
-  try {receipts=readReceipts(state).checks;receiptStateError=null;}
-  catch(e){receipts={};receiptStateError=e.message;event('receipt_state_unavailable',
-    {classification:e.name||'Error'});}
+  try {const snapshot=readReceiptSnapshot(state);receipts=snapshot.value.checks;
+    receiptStateRevision=snapshot.revision;receiptStateError=null;}
+  catch(e){receiptStateRevision=null;
+    // A readable selector can still supply explicitly historical outcomes after
+    // restart. The failed snapshot guard remains authoritative for applicability.
+    try{receipts=readReceipts(state).checks;}catch{/* retain previous historical rows */}
+    const next=`latest receipt unavailable; prior outcome only: ${e.message}`;
+    if(receiptStateError!==next)event('receipt_state_unavailable',
+      {classification:e.name||'Error'});
+    receiptStateError=next;}
+}
+function refreshReceipts() {
+  try {if(receiptStateRevision===null||receiptRevision(state)!==receiptStateRevision)loadReceipts();}
+  catch {loadReceipts();}
 }
 function persistedPlan(bundle) {
   return {schema:1,provider:bundle.provider,root:bundle.root,discoveredAt:bundle.discoveredAt,
@@ -298,13 +310,16 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
   });
 }
 function status(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=false) {
+  // Reload notifications accelerate visibility but are not required for it: a
+  // wrapper may persist its outcome even when its control connection is denied.
+  refreshReceipts();
   const checks=rows(contextHashes,synchronizedInstalled,synchronizedFilesystem), current=checks.filter(r=>r.freshness==='CURRENT'&&r.result==='PASS').length,
     failed=checks.filter(r=>r.freshness==='CURRENT'&&r.result==='FAIL').length,
     observedFailed=checks.filter(r=>r.result==='FAIL').length,
     stale=checks.filter(r=>r.freshness==='STALE').length,
     unverified=checks.filter(r=>r.freshness==='UNVERIFIED').length||(!checks.length?1:0);
   const stateName=failed?'failed':unverified?'unverified':stale?'stale':'current';
-  const now=Date.now();return {schema:1,state:stateName,current,failed,observed_failed:observedFailed,
+  const now=Date.now();return {schema:1,receipt_revision:receiptStateRevision,state:stateName,current,failed,observed_failed:observedFailed,
     stale,unverified,checks,
     observation:{healthy:healthy&&!planning&&!recovering&&!index?.unavailable,
       generation,observed_at:lastObservation,

package/src/node-onboarding.mjs

@@ -116,7 +116,7 @@ function classify(kind,scriptName,script,pkg,managerInfo,root) {
     managerInfo.name==='npm'&&
     exists(path.join(root,'tsconfig.json'))&&
     exists(path.join(root,'node_modules/typescript/package.json')))
-    return {level:'ready',reason:'canonical local tsc --noEmit; checked again before reuse',
+    return {level:'recording',reason:'npm launcher uses unobserved remote/cache/time inputs; execution can be recorded, but cannot be reused',
       qualification:'typescript-noemit-v1'};
   if(kind==='typecheck')return {level:'recording',reason:
     'TypeScript invocation, installation, or configuration is outside the automatic noEmit contract'};
@@ -183,7 +183,7 @@ export function discoverNodeProject(root) {
     if(!script)continue;
     let classification=observationIssue?{level:'unsupported',reason:observationIssue}:
       classify(kind,script,scripts[script],pkg,pm,root);
-    if(workspaces&&classification.level==='ready')classification={level:'recording',
+    if(workspaces&&classification.qualification==='typescript-noemit-v1')classification={level:'recording',
       reason:'workspace task and installed-input closure need explicit qualification'};
     const check={name:kind,script,kind,inputs:sourceInputs(root,kind,pm.lockfiles||[])};
     if(pm.name==='pnpm'&&kind==='typecheck'&&!workspaces&&!pm.issue&&

package/src/state-store.mjs

@@ -19,19 +19,55 @@ export function readReceipts(state){
   let value;
   try{value=JSON.parse(fs.readFileSync(path.join(state,'receipts-v1.json'),'utf8'));}
   catch(e){if(e.code==='ENOENT')return {schema:STATE_SCHEMA,checks:{}};throw e;}
-  if(value.schema!==STATE_SCHEMA||!value.checks||typeof value.checks!=='object')
+  if(!value||typeof value!=='object'||Array.isArray(value)||value.schema!==STATE_SCHEMA||
+    !value.checks||typeof value.checks!=='object'||Array.isArray(value.checks))
     throw Error(`incompatible receipt state in ${state}; inspect or remove only this vstate state directory`);
   return value;
 }
 
+// This identity detects replacement of REDUE's owned, atomically written receipt
+// selector. It is not an input-content fingerprint or permission to reuse inputs.
+export function receiptRevision(state){
+  // A failed/crashed owned writer may have persisted a new immutable outcome
+  // without replacing the selector. Never certify its older selection.
+  try {fs.lstatSync(path.join(state,'receipt-selection-pending-v1.json'));
+    throw Error('receipt selection update incomplete; inspect the failed run, then record a new execution to recover');
+  }catch(error){if(error.code!=='ENOENT')throw error;}
+  try {const stat=fs.statSync(path.join(state,'receipts-v1.json'),{bigint:true});
+    if(!stat.isFile())throw Error('receipt selector is not a file');
+    return JSON.stringify(['dev','ino','size','mtimeNs','ctimeNs'].map(key=>String(stat[key])));
+  }catch(error){if(error.code==='ENOENT')return 'absent';throw error;}
+}
+
+export function readReceiptSnapshot(state){
+  const revision=receiptRevision(state),value=readReceipts(state);
+  if(receiptRevision(state)!==revision)
+    throw Error('receipt selection changed during read; retry status');
+  return {revision,value};
+}
+
 export function commitReceipt(state,name,receipt){
   const prior=readReceipts(state),runId=receipt.invocation?.runId;
   if(!/^[0-9a-f-]{36}$/.test(runId||''))throw Error('receipt lacks a valid run ID');
   const runs=path.join(state,'runs-v1');
   fs.mkdirSync(runs,{recursive:true,mode:0o700});
+  // The caller holds the state run lock. Leave this marker on any write failure;
+  // only a later successful owned commit may clear it. No journal scan guesses
+  // which incomplete execution should become the selected evidence.
+  const pending=path.join(state,'receipt-selection-pending-v1.json');
+  let updates={schema:STATE_SCHEMA,checks:{}};
+  try {updates=JSON.parse(fs.readFileSync(pending,'utf8'));
+    if(updates?.schema!==STATE_SCHEMA||!updates.checks||typeof updates.checks!=='object'||Array.isArray(updates.checks))
+      throw Error('incompatible incomplete receipt update; inspect owned state before recording');
+  }catch(error){if(error.code!=='ENOENT')throw error;}
+  updates.checks[name]={runId};
+  atomicJson(pending,updates);
   // One immutable outcome per invocation. Never overwrite an existing run.
   fs.writeFileSync(path.join(runs,runId+'.json'),
     JSON.stringify({schema:STATE_SCHEMA,check:name,receipt}),{flag:'wx',mode:0o600});
   prior.checks[name]=receipt;
   atomicJson(path.join(state,'receipts-v1.json'),prior);
+  delete updates.checks[name];
+  if(Object.keys(updates.checks).length)atomicJson(pending,updates);
+  else fs.unlinkSync(pending);
 }

package/src/typescript-contract-probe.mjs

@@ -1,188 +1,5 @@
 #!/usr/bin/env node
-// Read-only applicability probe for the deliberately narrow npm/tsc --noEmit
-// contract. It emits one digest; failures emit only a fixed diagnostic code.
-import {compilerFiles} from './typescript-list.mjs';
-import {contextOnly,probeResult} from './probe-result.mjs';
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import {createHash} from 'node:crypto';
-import {createRequire} from 'node:module';
-import {spawnSync} from 'node:child_process';
-import {withinPath as within,realObservedPath} from './path-identity.mjs';
-import {timing} from './decision-profile.mjs';
-
-const [rootArg,scriptName,npmArg]=process.argv.slice(2);
-const hash=value=>createHash('sha256').update(value).digest('hex');
-const fail=code=>{throw Object.assign(Error(code),{code});};
-const digestFile=file=>hash(fs.readFileSync(file));
-const require=createRequire(import.meta.url);
-function treeHash(dir){
-  const digest=createHash('sha256');let count=0;
-  const visit=(folder,rel='')=>{
-    for(const entry of fs.readdirSync(folder,{withFileTypes:true}).sort((a,b)=>
-      a.name.localeCompare(b.name))){
-      const name=rel?rel+'/'+entry.name:entry.name,full=path.join(folder,entry.name);
-      if(entry.isDirectory())visit(full,name);
-      else if(entry.isFile()){digest.update(name+'\0'+digestFile(full)+'\0');count++;}
-      else fail('npm-installation-unobservable');
-    }
-  };
-  visit(dir);return [digest.digest('hex'),count];
-}
-function npmRcKeys(file){
-  if(!fs.existsSync(file))return null;
-  const keys=[];
-  for(const line of fs.readFileSync(file,'utf8').split(/\r?\n/)){
-    const trimmed=line.trim();if(!trimmed||/^[#;]/.test(trimmed))continue;
-    const at=trimmed.indexOf('=');if(at<0)fail('npm-configuration-unsupported');
-    const key=trimmed.slice(0,at).trim();
-    if(key!=='registry'&&!/^\/\/[^\s]+\/:_authToken$/.test(key))
-      fail('npm-configuration-unsupported');
-    keys.push(key);
-  }
-  return keys.sort();
-}
-try{
-  if(!rootArg||!scriptName||!npmArg)fail('probe-arguments');
-  const root=realObservedPath(rootArg),npm=realObservedPath(npmArg);
-  const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
-  if(pkg.scripts?.[scriptName]?.trim()!=='tsc --noEmit'||
-    pkg.scripts?.['pre'+scriptName]||pkg.scripts?.['post'+scriptName])
-    fail('typecheck-script-changed');
-  if(process.env.NODE_OPTIONS||process.env.NODE_PATH||process.env.BASH_ENV||
-    process.env.ENV||Object.entries(process.env).some(([key,value])=>{
-      if(/^npm_config_prefix$/i.test(key)&&process.platform==='win32'){
-        // The Windows runner supplies a global npm prefix independently of
-        // the selected local compiler. Its value is part of caller context.
-        return !path.isAbsolute(value);
-      }
-      return /^(npm_config_|DYLD_|TSGO_)/i.test(key);
-    }))fail('execution-environment-unsupported');
-  let npmRoot;
-  if(process.platform==='win32'){
-    if(path.basename(npm).toLowerCase()!=='npm.cmd')
-      fail('npm-installation-layout-unsupported');
-    npmRoot=path.join(path.dirname(npm),'node_modules','npm');
-    const body=fs.readFileSync(npm,'utf8');
-    if(!body.includes('node_modules\\npm\\bin\\npm-cli.js')||
-      !body.includes('node_modules\\npm\\bin\\npm-prefix.js')||
-      !body.includes('"%NODE_EXE%" "%NPM_CLI_JS%" %*'))
-      fail('npm-installation-layout-unsupported');
-    const prefix=spawnSync(process.execPath,[path.join(npmRoot,'bin','npm-prefix.js')],
-      {cwd:root,env:process.env,encoding:'utf8',timeout:4000,stdio:['ignore','pipe','ignore']});
-    const selectedPrefix=prefix.stdout?.trim();
-    if(prefix.error||prefix.status!==0||!selectedPrefix||
-      !path.isAbsolute(selectedPrefix))fail('npm-installation-layout-unsupported');
-    // npm.cmd selects the prefix's CLI only when that file exists. Otherwise
-    // it runs the bundled CLI beside npm.cmd; observe the same branch here.
-    const alternate=path.join(selectedPrefix,'node_modules','npm','bin','npm-cli.js');
-    if(fs.existsSync(alternate)&&
-      realObservedPath(alternate)!==realObservedPath(path.join(npmRoot,'bin','npm-cli.js')))
-      fail('npm-installation-layout-unsupported');
-  }else npmRoot=path.dirname(path.dirname(npm));
-  if(path.basename(npmRoot)!=='npm'||path.basename(path.dirname(npmRoot))!=='node_modules')
-    fail('npm-installation-layout-unsupported');
-  const home=process.platform==='win32'?os.homedir():process.env.HOME;
-  if(!home||!path.isAbsolute(home))fail('home-context-unavailable');
-  const npmConfig=[path.join(root,'.npmrc'),path.join(home,'.npmrc')]
-    .map(file=>[hash(file),npmRcKeys(file)]);
-  const contextFacts={
-    npmTree:treeHash(npmRoot),npmConfig,
-    node:hash(JSON.stringify([process.version,realObservedPath(process.execPath),
-      fs.statSync(process.execPath).size])),
-    shell:process.platform==='win32'?hash(JSON.stringify([
-      realObservedPath(process.env.ComSpec||process.env.COMSPEC||''),
-      digestFile(process.env.ComSpec||process.env.COMSPEC||''),
-      process.env.PATHEXT||'',digestFile(npm),
-      digestFile(path.join(root,'node_modules','.bin','tsc.cmd'))])):
-      digestFile('/bin/sh')};
-  const contextHash=hash(JSON.stringify(contextFacts));
-  if(contextOnly(contextHash))process.exit(0);
-  const tsRoot=path.join(root,'node_modules','typescript');
-  let tsc;
-  if(process.platform==='win32'){
-    const shim=path.join(root,'node_modules','.bin','tsc.cmd');
-    const body=fs.readFileSync(shim,'utf8').replace(/\r\n/g,'\n').trim();
-    const expected=`@ECHO off
-GOTO start
-:find_dp0
-SET dp0=%~dp0
-EXIT /b
-:start
-SETLOCAL
-CALL :find_dp0
-
-IF EXIST "%dp0%\\node.exe" (
-  SET "_prog=%dp0%\\node.exe"
-) ELSE (
-  SET "_prog=node"
-  SET PATHEXT=%PATHEXT:;.JS;=;%
-)
-
-endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\\..\\typescript\\bin\\tsc" %*`;
-    if(body!==expected)fail('typescript-executable-changed');
-    tsc=realObservedPath(path.join(tsRoot,'bin','tsc'));
-  }else{
-    tsc=realObservedPath(path.join(root,'node_modules','.bin','tsc'));
-    if(tsc!==path.join(tsRoot,'bin','tsc'))fail('typescript-executable-changed');
-  }
-  const configReads=new Set(),visited=new Set();
-  let ts;try{ts=require(tsRoot);}catch{}
-  if(typeof ts?.getParsedCommandLineOfConfigFile==='function'){
-    const host={...ts.sys,readFile(file){configReads.add(path.resolve(file));
-      return ts.sys.readFile(file);},onUnRecoverableConfigFileDiagnostic(){}};
-    const parseConfig=file=>{
-      const absolute=path.resolve(file);
-      if(!within(absolute,root))fail('typescript-config-outside-repository');
-      if(visited.has(absolute))return;visited.add(absolute);
-      if(visited.size>64)fail('typescript-config-graph-too-large');
-      const parsed=ts.getParsedCommandLineOfConfigFile(absolute,{},host);
-      if(!parsed||parsed.errors?.length)fail('typescript-config-unavailable');
-      if(parsed.options?.plugins?.length)fail('typescript-plugin-unsupported');
-      if(parsed.options?.incremental||parsed.options?.composite)
-        fail('typescript-incremental-unsupported');
-      for(const reference of parsed.projectReferences||[])
-        parseConfig(reference.path.endsWith('.json')?reference.path:
-          path.join(reference.path,'tsconfig.json'));
-    };
-    parseConfig(path.join(root,'tsconfig.json'));
-  }else{
-    // TypeScript 7's native compiler does not expose the previous config API.
-    // Its CLI reports the effective config; restrict this path to one direct
-    // config rather than guessing about extends/reference provenance.
-    const config=path.join(root,'tsconfig.json'),raw=fs.readFileSync(config,'utf8');
-    if(/"(?:extends|references|plugins|incremental|composite)"\s*:/.test(raw))
-      fail('typescript-config-graph-unsupported');
-    const shown=spawnSync(process.execPath,[tsc,'--showConfig'],{cwd:root,
-      env:process.env,encoding:'utf8',timeout:4000,maxBuffer:16*1024*1024,
-      stdio:['ignore','pipe','pipe']});
-    if(shown.error||shown.signal||shown.status!==0)fail('typescript-config-unavailable');
-    const effective=JSON.parse(shown.stdout);
-    if(effective.compilerOptions?.plugins?.length||
-      effective.compilerOptions?.incremental||effective.compilerOptions?.composite)
-      fail('typescript-config-graph-unsupported');
-    configReads.add(config);
-  }
-  for(const file of configReads)if(!within(realObservedPath(file),root))
-    fail('typescript-config-outside-repository');
-  const listingStarted=performance.now();
-  const captured=process.argv.includes('--redue-checkpoint')?compilerFiles(tsRoot,root):null;
-  const listed=captured?{status:0,stdout:captured.files.join('\n')}:spawnSync(process.execPath,[tsc,'--noEmit','--listFilesOnly'],
-    {cwd:root,env:process.env,encoding:'utf8',timeout:process.platform==='win32'?10000:4000,
-      maxBuffer:16*1024*1024,
-      stdio:['ignore','pipe','pipe']});
-  timing('typescript_contract.list_files',listingStarted,{status:listed.status??null,
-    error:listed.error?.code||null});
-  if(listed.error||listed.signal||listed.status!==0)fail('typescript-input-list-unavailable');
-  const files=listed.stdout.trim().split(/\r?\n/).filter(Boolean)
-    .map(file=>path.resolve(file));
-  if(!files.length||files.some(file=>!within(realObservedPath(file),root)))
-    fail('typescript-input-outside-repository');
-  const facts={schema:1,root:hash(root),script:scriptName,
-    configs:[...configReads].sort().map(file=>[hash(file),digestFile(file)]),
-    files:[...new Set(files)].sort().map(file=>[hash(file),digestFile(file)]),
-    ...contextFacts};
-  probeResult(hash(JSON.stringify(facts)),contextHash,captured?.queries);
-}catch(e){console.error(`VSTATE_REASON:${e.code&&/^[a-z-]+$/.test(e.code)?e.code:
-  'typescript-contract-unavailable'}`);process.exitCode=2;}
+// Retired npm-launcher interpretation. Do not return even a context-only digest:
+// old receipts and cached compiler certificates cannot qualify this obligation.
+console.error('VSTATE_REASON:npm-launcher-unobserved-inputs');
+process.exitCode=2;

package/src/typescript-qualification.mjs

@@ -50,47 +50,7 @@ export function qualifyTypeScript(root,selected,discovered={}) {
     return {qualified:issues.length===0,issues};
   }
   if(selected.qualification!=='typescript-noemit-v1')return null;
-  const issues=[];
-  let pkg;
-  try{pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));}
-  catch{issues.push('package manifest unavailable');}
-  if(!selected.script||pkg?.scripts?.[selected.script]?.trim()!=='tsc --noEmit'||
-    pkg?.scripts?.['pre'+selected.script]||pkg?.scripts?.['post'+selected.script])
-    issues.push('typecheck script is not the supported standalone tsc --noEmit invocation');
-  if(selected.command?.length!==3||selected.command[1]!=='run'||
-    selected.command[2]!==selected.script)
-    issues.push('package-manager invocation differs from the discovered script');
-  try{const npm=fs.realpathSync(selected.command[0]);
-    const supported=process.platform==='win32'?path.basename(npm).toLowerCase()==='npm.cmd'&&
-      fs.existsSync(path.join(path.dirname(npm),'node_modules','npm','bin','npm-cli.js')):
-      path.basename(npm)==='npm-cli.js'&&
-      path.basename(path.dirname(path.dirname(npm)))==='npm';
-    if(!supported)
-      issues.push('npm executable layout is not supported');}
-  catch{issues.push('npm executable unavailable');}
-  if(!fs.existsSync(path.join(root,'tsconfig.json')))
-    issues.push('tsconfig.json is missing');
-  if(!fs.existsSync(path.join(root,'node_modules','typescript','package.json'))||
-    !fs.existsSync(path.join(root,'node_modules','.bin',
-      process.platform==='win32'?'tsc.cmd':'tsc')))
-    issues.push('local TypeScript installation is missing');
-  if(!selected.inputs?.includes('**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json,jsonc}')||
-    !selected.inputs?.includes('package.json')||
-    !selected.inputs?.includes('tsconfig.json'))
-    issues.push('TypeScript source/config file-set declaration is incomplete');
-  if(!selected.installedInputs?.includes('node_modules/**'))
-    issues.push('installed package contents and membership are not declared');
-  if(!selected.environment?.executableIdentity||
-    !['node','npm'].every(name=>selected.environment?.pathExecutables?.includes(name))||
-    !['NODE_OPTIONS','NODE_PATH','HOME','BASH_ENV','ENV'].every(name=>
-      selected.environment?.variables?.includes(name))||
-    !['npm_config_','DYLD_','TSGO_'].every(name=>
-      selected.environment?.prefixes?.includes(name)))
-    issues.push('caller toolchain or execution context declaration is incomplete');
-  if(!selected.probes?.some(argv=>path.basename(argv[1]||'')==='typescript-contract-probe.mjs'&&
-    argv[2]&&fs.existsSync(argv[2])&&
-    realObservedPath(argv[2])===root&&argv[3]===selected.script&&
-    argv[4]===selected.command[0]))
-    issues.push('TypeScript input and toolchain probe is missing');
-  return {qualified:issues.length===0,issues};
+  // Retired automatic launcher contract: npm's notifier consumes unobserved
+  // remote/cache/time state. A successful execution is still an outcome.
+  return {qualified:false,issues:['npm launcher applicability is unqualified: update notification uses unobserved remote/cache/time inputs; run the npm script when needed']};
 }