@smartmemory/compose 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartmemory/compose",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Structured AI dev pipeline: your agent writes the code, Compose makes it prove it. Gated design decisions, enforced postconditions, and independent review from goal to shipped code.",
   "author": "SmartMemory",
   "license": "MIT",
@@ -20,11 +20,11 @@
     "dev:client": "vite",
     "build": "vite build",
     "preview": "vite preview",
-    "test": "node --import ./test/suppress-expected-drift.js --test --test-timeout=300000 test/*.test.js test/comp-obs-branch/*.test.js test/integration/*.test.js test/golden/*.test.js && npm run test:ui && npm run test:tracker",
+    "test": "node --import ./test/suppress-expected-drift.js --test --test-timeout=900000 test/*.test.js test/comp-obs-branch/*.test.js test/integration/*.test.js test/golden/*.test.js && npm run test:ui && npm run test:tracker",
     "test:ui": "vitest run",
     "test:tracker": "vitest run --config vitest.tracker.config.js",
-    "test:integration": "node --test --test-timeout=300000 test/integration/*.test.js",
-    "test:wave-6": "node --test --test-timeout=300000 test/wave-6-integration.test.js test/wave-6-contract-compliance.test.js",
+    "test:integration": "node --test --test-timeout=900000 test/integration/*.test.js",
+    "test:wave-6": "node --test --test-timeout=900000 test/wave-6-integration.test.js test/wave-6-contract-compliance.test.js",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -55,6 +55,8 @@
   },
   "files": [
     ".compose-deps.json",
+    ".claude/agents/**",
+    ".claude/hooks/**",
     ".claude/skills/**",
     "bin/**",
     "server/**",
@@ -86,7 +88,7 @@
     "@radix-ui/react-toggle-group": "^1.1.11",
     "@radix-ui/react-tooltip": "^1.2.8",
     "@smartmemory/sdk-js": "^1.4.60",
-    "@smartmemory/stratum": "^0.4.5",
+    "@smartmemory/stratum": "^0.5.0",
     "@tanstack/react-virtual": "^3.13.23",
     "ajv": "^8.18.0",
     "ajv-formats": "^3.0.1",

package/server/build-stream-bridge.js

@@ -45,18 +45,26 @@ export class BuildStreamBridge {
   #debounceTimer = null;
   #crashTimer = null;
   #polling = false;
+  #safetyInterval = null;
+  #watchFn;
+  #pollIntervalMs;
 
   /**
    * @param {string} composeDir  Path to .compose directory
    * @param {Function} broadcast  broadcast(msg) function from agent-server
    * @param {object} [opts]
    * @param {number} [opts.crashTimeoutMs]  Crash detection timeout (default 5min)
+   * @param {number} [opts.pollIntervalMs]  Safety re-read cadence (default 2s)
+   * @param {Function} [opts.watchFn]  Injected for tests that need a watcher
+   *   which never delivers — the condition the safety poll exists to survive.
    */
   constructor(composeDir, broadcast, opts = {}) {
     this.#composeDir = composeDir;
     this.#filePath = join(composeDir, JSONL_FILENAME);
     this.#broadcast = broadcast;
     this.#crashTimeoutMs = opts.crashTimeoutMs ?? DEFAULT_CRASH_TIMEOUT_MS;
+    this.#pollIntervalMs = opts.pollIntervalMs ?? POLL_INTERVAL_MS;
+    this.#watchFn = opts.watchFn ?? watch;
   }
 
   /**
@@ -97,6 +105,10 @@ export class BuildStreamBridge {
       clearInterval(this.#pollInterval);
       this.#pollInterval = null;
     }
+    if (this.#safetyInterval) {
+      clearInterval(this.#safetyInterval);
+      this.#safetyInterval = null;
+    }
     if (this.#debounceTimer) {
       clearTimeout(this.#debounceTimer);
       this.#debounceTimer = null;
@@ -112,8 +124,11 @@ export class BuildStreamBridge {
   // ---------------------------------------------------------------------------
 
   _startWatching() {
+    // The safety poll is armed FIRST and unconditionally, because the watcher
+    // cannot be trusted to be listening (see _startSafetyPoll).
+    this._startSafetyPoll();
     try {
-      this.#watcher = watch(this.#composeDir, (eventType, filename) => {
+      this.#watcher = this.#watchFn(this.#composeDir, (eventType, filename) => {
         if (filename === JSONL_FILENAME || filename === null) {
           this._debouncedRead();
         }
@@ -129,6 +144,33 @@ export class BuildStreamBridge {
     }
   }
 
+  /**
+   * Re-read on a timer for as long as we are tailing, regardless of the watcher.
+   *
+   * `fs.watch` is an OPTIMISATION here, never the guarantee. It is not armed
+   * when the call returns: on macOS libuv registers the FSEvents stream
+   * asynchronously, so writes landing between `watch()` returning and the stream
+   * actually listening are delivered to nobody. `start()` arms the watcher and
+   * then reads synchronously, which is exactly that window — and under load the
+   * window stretches to cover a whole build's first events.
+   *
+   * Measured before this existed (600 runs of the scenario, 6 concurrent
+   * processes, full suite as load): 14/450 runs saw the watcher deliver NOTHING
+   * after start, so the bridge broadcast the pre-existing lines and then went
+   * permanently deaf — no periodic re-check existed to recover it. The same 450
+   * runs with a settle delay before the writes: 0 failures. That was a live
+   * cockpit stream that silently never starts, not a test-timing problem.
+   *
+   * A missed event is therefore recoverable rather than terminal. `_readNewLines`
+   * exits on a single `statSync` when the file has not grown, so the standing
+   * cost is one stat per interval.
+   */
+  _startSafetyPoll() {
+    if (this.#safetyInterval) return;
+    this.#safetyInterval = setInterval(() => this._readNewLines(), this.#pollIntervalMs);
+    this.#safetyInterval.unref();
+  }
+
   _pollForDirectory() {
     if (this.#polling) return;
     this.#polling = true;

package/server/cc-session-watcher.js

@@ -68,6 +68,8 @@ export class CCSessionWatcher {
     // COMP-OBS-DRIFT: optional deps for post-lineage drift broadcast
     emitDriftAxes = null,
     projectRoot = null,
+    // Backstop-poll cadence. Injectable so a test need not wait 2s for it.
+    pollIntervalMs = 2000,
   }) {
     if (!projectsRoot) throw new Error('projectsRoot required');
     if (!sessionsFile) throw new Error('sessionsFile required');
@@ -87,6 +89,7 @@ export class CCSessionWatcher {
     // COMP-OBS-DRIFT: optional drift emitter
     this._emitDriftAxes = emitDriftAxes;
     this._projectRoot = projectRoot;
+    this.pollIntervalMs = pollIntervalMs;
 
     // featureCode → (cc_session_id → BranchOutcome[])
     this._accum = new Map();
@@ -272,6 +275,29 @@ export class CCSessionWatcher {
     if (scanned) await this._flush([scanned.featureCode]);
   }
 
+  /**
+   * Dispatch one file change, never concurrently with another.
+   *
+   * `_flush` is idempotent SEQUENTIALLY — the lineage POST is a replace-by-key
+   * (`updateLifecycleExt`), and a fork already in `emitted_event_ids` is not
+   * re-broadcast. It is NOT idempotent CONCURRENTLY: `emitted.add(eventId)` runs
+   * only after `await postBranchLineage`, so two overlapping flushes both see
+   * the same fork as new and both broadcast its DecisionEvent.
+   *
+   * With the watcher as the sole dispatcher that overlap was rare. Arming the
+   * safety poll beside it (see `start`) would have made it ordinary, so
+   * dispatch is serialised here rather than left to chance — which also closes
+   * the same pre-existing overlap between `fullScan()` and a watcher event.
+   */
+  _dispatch(jsonlPath) {
+    this._chain = (this._chain ?? Promise.resolve())
+      .then(() => this._onFileChange(jsonlPath))
+      .catch(err => {
+        console.warn(`[cc-watcher] change handler failed: ${err.message}`);
+      });
+    return this._chain;
+  }
+
   start() {
     // C5: the fs.watch fallback leaves `_watcher` null, so guarding on it alone
     // let every resume() start ANOTHER poll interval — one leaked per switch.
@@ -279,6 +305,20 @@ export class CCSessionWatcher {
     if (!fs.existsSync(this.projectsRoot)) {
       fs.mkdirSync(this.projectsRoot, { recursive: true });
     }
+    // The poll is armed ALONGSIDE the watcher, not only when fs.watch throws.
+    //
+    // A watcher that stops delivering does not throw and does not emit 'error';
+    // it simply goes quiet, and every subsequent session write is lost with no
+    // symptom. Polling used to be reachable only from the synchronous throw
+    // below, so the one failure mode that actually needs recovery — a live
+    // watcher that has silently stopped — had none, and missed CC sessions meant
+    // branch DecisionEvents that never fire and never self-heal.
+    //
+    // (Unlike the build-stream bridge, the fs.watch ARMING window is not the
+    // hazard here: CC sessions are written minutes after start, not in the
+    // microseconds between `watch()` returning and the stream listening. The
+    // justification is dead-watcher recovery.)
+    this._startPolling();
     try {
       this._watcher = fs.watch(this.projectsRoot, { recursive: true }, (_evt, filename) => {
         if (!filename || !filename.endsWith('.jsonl')) return;
@@ -287,9 +327,16 @@ export class CCSessionWatcher {
         const now = Date.now();
         if (now - last < DEFAULT_DEBOUNCE_MS) return;
         this._debounce.set(full, now);
-        this._onFileChange(full).catch(err => {
-          console.warn(`[cc-watcher] change handler failed: ${err.message}`);
-        });
+        this._dispatch(full);
+      });
+      // A watcher can die AFTER construction. Without this the failure is
+      // completely silent; the poll below is already running, so recovery is
+      // just dropping the dead handle.
+      this._watcher.on?.('error', (err) => {
+        console.warn(`[cc-watcher] watcher died, polling continues: ${err?.message}`);
+        try { this._watcher?.close(); } catch { /* already gone */ }
+        this._watcher = null;
+        this._startPolling();
       });
     } catch (err) {
       console.warn(`[cc-watcher] fs.watch unavailable, falling back to polling: ${err.message}`);
@@ -297,7 +344,7 @@ export class CCSessionWatcher {
     }
   }
 
-  _startPolling(intervalMs = 2000) {
+  _startPolling(intervalMs = this.pollIntervalMs ?? 2000) {
     if (this._pollTimer) return;
     this._pollTimer = setInterval(async () => {
       const files = listJsonlFiles(this.projectsRoot);
@@ -308,10 +355,12 @@ export class CCSessionWatcher {
         const last = this._debounce.get(key) || 0;
         if (stat.mtimeMs > last) {
           this._debounce.set(key, stat.mtimeMs);
-          await this._onFileChange(f);
+          await this._dispatch(f);
         }
       }
     }, intervalMs);
+    // Never hold the process open on this alone — it is a backstop, not work.
+    this._pollTimer.unref?.();
   }
 
   stop() {

package/server/compose-mcp-tools.js

@@ -68,24 +68,46 @@ function _guardOn(capsOverride) {
   try { return loadProjectConfig()?.capabilities?.guard === true; } catch { return false; }
 }
 
-/** True iff a valid, non-agent-mintable override token accompanies the call. */
-function _overrideOk(args) {
-  const expected = process.env.STRATUM_GUARD_OVERRIDE_TOKEN;
-  return !!expected && args?.override_token === expected;
-}
+/**
+ * COMP-MCP-ENFORCE Slice 3, amended 2026-09-07: the override token is GONE.
+ *
+ * These gates used to admit a caller who supplied `override_token` matching this
+ * server process's `STRATUM_GUARD_OVERRIDE_TOKEN`. The audit in
+ * docs/decisions/2026-09-07-override-token-audit.md removed it, on evidence
+ * rather than on threat-modelling taste:
+ *
+ *   - the hatch had no user and could not have one — the variable was unset in
+ *     every environment we ship, and `override_token` appeared in no MCP tool
+ *     schema, so no agent could discover it and no operator workflow used it;
+ *   - both capabilities it nominally unlocked already have first-class doors:
+ *     KILLED through the guarded lifecycle route (`kill_feature`), COMPLETE
+ *     through the completion gate (which `lib/feature-writer.js` enforces
+ *     unconditionally anyway);
+ *   - what remained was `force`, i.e. skipping the roadmap transition table and
+ *     the prose-loss and duplicate-match refusals — the thing these gates exist
+ *     to stop, kept reachable by a secret harder to use than editing the file;
+ *   - and it was never the real protection. Anything that can call these tools
+ *     can write the files directly. The tamper-EVIDENT ledger and the pre-push
+ *     canon guard are what hold; this gate only ever stopped a well-meaning
+ *     agent from casually passing force:true, and a plain refusal does that
+ *     better than a secret nobody can hold.
+ *
+ * If a break-glass path is ever genuinely needed, the answer is stratum's signed
+ * one-shot authorization (`stratum/ts/src/guard/authorization.ts`), not a shared
+ * secret — and the trigger for building it is a real incident where someone hit
+ * one of these refusals with nowhere to go.
+ */
 
 export function assertForceAuthorized(args, toolName, capsOverride) {
   if (!args?.force) return;
   if (!_guardOn(capsOverride)) return;
-  if (!_overrideOk(args)) {
-    const e = new Error(
-      `${toolName}: force is disabled under capabilities.guard — supply a valid override_token ` +
-      `(out-of-band STRATUM_GUARD_OVERRIDE_TOKEN; not agent-mintable) to deviate, or drive the ` +
-      `change through the lifecycle.`,
-    );
-    e.code = 'FORCE_REQUIRES_OVERRIDE';
-    throw e;
-  }
+  const e = new Error(
+    `${toolName}: force is disabled under capabilities.guard. There is no override token — ` +
+    `drive the change through the lifecycle (/lifecycle routes, kill_feature) or the completion ` +
+    `gate (record_completion). If neither can express it, that is a gap to fix, not to bypass.`,
+  );
+  e.code = 'FORCE_REQUIRES_OVERRIDE';
+  throw e;
 }
 
 /**
@@ -103,15 +125,13 @@ export function assertTerminalStatusAuthorized(args, toolName, capsOverride) {
   const status = args?.status;
   if (!status || !LIFECYCLE_OWNED_STATUS.has(status)) return;
   if (!_guardOn(capsOverride)) return;
-  if (!_overrideOk(args)) {
-    const e = new Error(
-      `${toolName}: status ${status} is lifecycle-owned under capabilities.guard — drive it through ` +
-      `/lifecycle (evidence-gated for complete, guarded for kill) instead of setting it directly, ` +
-      `or supply a valid override_token.`,
-    );
-    e.code = 'STATUS_OWNED_BY_LIFECYCLE';
-    throw e;
-  }
+  const e = new Error(
+    `${toolName}: status ${status} is lifecycle-owned under capabilities.guard — drive it through ` +
+    `/lifecycle (evidence-gated for complete, guarded for kill) instead of setting it directly. ` +
+    `There is no override token.`,
+  );
+  e.code = 'STATUS_OWNED_BY_LIFECYCLE';
+  throw e;
 }
 import { resolveWorkspace } from '../lib/resolve-workspace.js';
 import { discoverWorkspaces } from '../lib/discover-workspaces.js';
@@ -474,29 +494,6 @@ export async function toolAddChangelogEntry(args) {
   return addChangelogEntry(getTargetRoot(), args);
 }
 
-/**
- * COMP-CANON-OVERRIDE — mint a single-use, path-scoped canon override.
- *
- * `actor` is deliberately not forwarded from args: it is stamped by the writer
- * per Decision 3 and must never be caller-supplied.
- */
-export async function toolCanonOverrideGrant(args) {
-  const { mintGrant } = await import('../lib/canon-override.js');
-  const { loadFeaturesDir } = await import('../lib/project-paths.js');
-  const root = getTargetRoot();
-  const grant = mintGrant(root, {
-    path: args?.path,
-    reason: args?.reason,
-    operation: args?.operation,
-    featuresDir: loadFeaturesDir(root),
-  });
-  return {
-    ...grant,
-    recorded_in: '.compose/canon-overrides.jsonl',
-    note: 'Single-use and path-scoped. Audit tooling for the Claude Write/Edit path, not enforcement.',
-  };
-}
-
 export async function toolGetChangelogEntries(args) {
   const { getChangelogEntries } = await import('../lib/changelog-writer.js');
   return getChangelogEntries(getTargetRoot(), args);
@@ -1002,8 +999,10 @@ function _targetMatchesBoundFeature(tool, args) {
 
 /**
  * Throw PHASE_TOOL_DENIED if the tool is not allowed for the current
- * profile×phase. No-op when the capability is off (default) or on a valid
- * override token. On unresolved CONTEXT the behavior is graduated, NOT blanket
+ * profile×phase. No-op when the capability is off (default). The override-token
+ * escape was REMOVED 2026-09-07 with the other two (see the note above
+ * `assertForceAuthorized`): same secret, same absence of any caller who could
+ * hold it. On unresolved CONTEXT the behavior is graduated, NOT blanket
  * fail-open: an unresolved PROFILE (no/unknown env) normalizes to orchestrator →
  * unrestricted; an unresolved PHASE only fails open the phase *refinement* — the
  * profile BASE policy (implementer deny / reviewer allowlist) still applies
@@ -1013,7 +1012,6 @@ function _targetMatchesBoundFeature(tool, args) {
 export function assertToolPhaseAllowed(tool, args = {}, _testCtx) {
   const guardOn = _testCtx?.phaseScopedTools ?? (loadProjectConfig()?.capabilities?.phaseScopedTools === true);
   if (!guardOn) return;
-  if (_overrideOk(args)) return;
 
   const profile = _testCtx?.profile ?? sessionContext().profile;
   const phase = _testCtx?.phase ?? resolveBoundPhase();
@@ -1024,7 +1022,7 @@ export function assertToolPhaseAllowed(tool, args = {}, _testCtx) {
     const e = new Error(
       `${tool} is not available to profile '${profile}'` +
       (phase ? ` in phase '${phase}'` : '') + `: ${verdict.reason}. ` +
-      `Supply a valid override_token to deviate.`,
+      `There is no override token; use a session bound to a profile that owns this tool.`,
     );
     e.code = 'PHASE_TOOL_DENIED';
     e.profile = profile;

package/server/compose-mcp.js

@@ -55,7 +55,6 @@ import {
   toolGetFeatureLinks,
   toolProposeFollowup,
   toolAddChangelogEntry,
-  toolCanonOverrideGrant,
   toolGetChangelogEntries,
   toolWriteJournalEntry,
   toolGetJournalEntries,
@@ -175,7 +174,6 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         case 'get_feature_artifacts':    result = await toolGetFeatureArtifacts(args); break;
         case 'get_feature_links':        result = await toolGetFeatureLinks(args); break;
         case 'add_changelog_entry':      result = await toolAddChangelogEntry(args); break;
-        case 'canon_override_grant':     result = await toolCanonOverrideGrant(args); break;
         case 'get_changelog_entries':    result = await toolGetChangelogEntries(args); break;
         case 'write_journal_entry':      result = await toolWriteJournalEntry(args); break;
         case 'get_journal_entries':      result = await toolGetJournalEntries(args); break;

package/server/design-routes.js

@@ -13,7 +13,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { parseDecisionBlocks } from '../src/components/vision/designSessionState.js';
+import { parseDecisionBlocks } from '../lib/decision-blocks.js';
 import { StratumMcpClient } from '../lib/stratum-mcp-client.js';
 import { KNOWN_VERSIONS } from '../lib/build-stream-schema.js';
 import { getTargetRoot, resolveProjectPath, trackProjectWork } from './project-root.js';

package/server/file-watcher.js

@@ -288,6 +288,20 @@ export class FileWatcherServer {
 
           onChanged(relativePath, fullPath);
         });
+        // A watcher can die AFTER construction, and fs.watch reports that as an
+        // 'error' event, not a throw — with no handler Node has historically
+        // treated it as unhandled. Either way the failure was completely silent:
+        // the pane simply stops updating.
+        //
+        // Deliberately NOT given the backstop poll that cc-session-watcher and
+        // the build-stream bridge now carry. Those lose data that never returns
+        // (branch DecisionEvents, a build's live output); this one loses a
+        // hot-reload, and the REST path already serves current content on load,
+        // so a refresh recovers it. A recursive re-stat of docs/** on a timer is
+        // real cost for a recoverable symptom. Logged, so it stops being silent.
+        watcher.on?.('error', (err) => {
+          console.error(`[file-watcher] watch on ${prefix}/ died — changes there stop live-updating until restart: ${err?.message}`);
+        });
         this.watchers.push(watcher);
       } catch (err) {
         console.error(`[file-watcher] Failed to watch ${prefix}/:`, err.message);

package/server/ideabox-routes.js

@@ -51,6 +51,7 @@ import {
   IdeaboxRenderFailed,
 } from '../lib/fluid/ideabox-ops.js'
 import { writeIdeaboxProjection } from '../lib/fluid/render-ideabox.js'
+import { IdeaboxMigrationConflict, IdeaboxUnreadable } from '../lib/fluid/ideabox-migrate.js'
 import { ideaboxView, toClientIdeaWith } from '../lib/fluid/ideabox-view.js'
 import { relForDisplay } from '../lib/project-paths.js'
 
@@ -109,6 +110,12 @@ export function attachIdeaboxRoutes(app, { getProjectRoot, broadcastMessage }) {
       if (err instanceof IdeaboxNotFound) return res.status(404).json({ error: err.message, code: err.code })
       if (err instanceof IdeaboxInvalid) return res.status(400).json({ error: err.message, code: err.code, field: err.field })
       if (err instanceof IdeaboxConflict) return res.status(409).json({ error: err.message, code: err.code })
+      // The migration gate's two refusals. Both mean "the file on disk is in a
+      // state this operation must not write over", which is a conflict, not a
+      // server fault — and the client needs the code to say so.
+      if (err instanceof IdeaboxMigrationConflict || err instanceof IdeaboxUnreadable) {
+        return res.status(409).json({ error: err.message, code: err.code })
+      }
       return res.status(500).json({ error: err.message })
     }
   }
@@ -214,6 +221,9 @@ export function attachIdeaboxRoutes(app, { getProjectRoot, broadcastMessage }) {
   app.post('/api/ideabox/render', async (_req, res) => {
     await send(res, async () => {
       const ctx = await context()
+      // The migration gate is no longer applied here: it lives inside
+      // `writeIdeaboxProjection`, which every projection write goes through.
+      // This route reached that writer without a guard once already.
       await writeIdeaboxProjection(ctx.provider, ctx.ideaboxPath)
       return { body: { ok: true } }
     })

package/server/index.js

@@ -222,7 +222,11 @@ const _distExists = () => {
   catch { return false; }
 };
 
-app.use(express.static(_distDir, { index: false }));
+// Source checkouts keep Vite/HMR on :5195. Published installs have no Vite or
+// src/ by design, so compose start serves the prebuilt desktop shell on :4001.
+app.use(express.static(_distDir, {
+  index: process.env.COMPOSE_PACKAGED_UI === '1' ? 'index.html' : false,
+}));
 
 // /m/* SPA fallback — paths matching /m or /m/...
 app.get(/^\/m(\/|$)/, (_req, res) => {

package/server/lifecycle-guard.js

@@ -70,6 +70,19 @@ export const isGuardError = (result) => !result || Boolean(result.error) || resu
 export const guardErrorType = (result) => (result && (result.error?.code ?? result.error_type)) ?? null;
 export const guardErrorMessage = (result) => (result && (result.error?.message ?? result.message)) ?? 'no guard response';
 
+/**
+ * Infrastructure failures: the guard was never reached, or never answered, so
+ * the evidence was NOT evaluated. Distinct from a refusal (the guard ran and
+ * said no) and from a policy error (the guard ran and could not apply). Routes
+ * must not render these as "refused by guard" — for two months a timed-out
+ * `guard transition` was reported to the user as a rejection of their evidence
+ * (stratum-client.js, f7865d4), and nothing at the surface could tell the two
+ * apart.
+ */
+const GUARD_INFRA_CODES = new Set(['TIMEOUT', 'SPAWN', 'GUARD_UNREACHABLE', 'PARSE_ERROR', 'UNKNOWN']);
+export const isGuardInfraError = (result) =>
+  !!result && result.applied !== true && result.refused !== true && GUARD_INFRA_CODES.has(guardErrorType(result));
+
 /**
  * Assemble the FULL guarded graph the design requires: the forward
  * `BASE_TRANSITIONS` PLUS the `ship → complete` edge and a `<any non-terminal>