@stravica-ai/digital-operator-pa 0.1.55 → 0.1.56

package/dist/engineering-pa-cli/src/pa/work-cli.mjs

@@ -19,10 +19,14 @@
 // fall-back-to-default case. Full rationale + tests in
 // `@stravica-ai/engineering-pa-core/src/workItemId/index.mjs`.
 
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
 import { readPreferences } from '../../../engineering-pa-core/src/preferences.mjs';
 
 import { createWork, setWorkStatus, listWork } from './work.mjs';
 import { getRepoRoot } from './repo-root.mjs';
+import { listSubdirs } from './io.mjs';
 
 const USAGE = `pa work — manage operator-repo work items
 
@@ -154,6 +158,21 @@ async function doCreate(args) {
     process.stderr.write(`  accepted flags: ${known}\n`);
     return 1;
   }
+  // Project existence gate (w-2026-09-30-dave-005 estate chore). Before this gate,
+  // `pa work create --project <nonexistent>` silently minted a work item pointing at
+  // a project that did not exist; the mistake surfaced later as an orphan in listings.
+  // Refuse loudly with the nearest matches so a typo is a fast fix, not a silent
+  // corruption. Only the CLI enforces this — programmatic callers of createWork()
+  // stay permissive (test fixtures use --project 'proj-a' without a real project on
+  // disk); wider grep found no CLI caller depending on the old behaviour, so no
+  // escape hatch is exposed.
+  if (typeof flags.project === 'string') {
+    const projectErr = await validateProjectExists(flags.project);
+    if (projectErr) {
+      process.stderr.write(projectErr);
+      return 1;
+    }
+  }
   const priority = flags.priority != null && flags.priority !== true
     ? Number(flags.priority)
     : null;
@@ -226,3 +245,100 @@ async function doList(args) {
   for (const r of rows) process.stdout.write(cols.map((c) => pad(r[c], widths[c])).join('  ') + '\n');
   return 0;
 }
+
+// ── project-existence validation (w-2026-09-30-dave-005 estate chore) ──────────
+
+/**
+ * Levenshtein distance between two short strings. Used to rank nearest project ids
+ * for a typo; not exported.
+ */
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  if (!a.length) return b.length;
+  if (!b.length) return a.length;
+  const prev = new Array(b.length + 1);
+  const curr = new Array(b.length + 1);
+  for (let j = 0; j <= b.length; j += 1) prev[j] = j;
+  for (let i = 1; i <= a.length; i += 1) {
+    curr[0] = i;
+    for (let j = 1; j <= b.length; j += 1) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+    }
+    for (let j = 0; j <= b.length; j += 1) prev[j] = curr[j];
+  }
+  return prev[b.length];
+}
+
+/**
+ * List every projects/<id>/ whose project.json exists on disk. Names only, sorted
+ * lexicographically. Empty when the projects/ dir is absent (accepted by listSubdirs).
+ */
+async function listExistingProjectIds() {
+  const repoRoot = await getRepoRoot();
+  const projectsDir = join(repoRoot, 'projects');
+  const subdirs = await listSubdirs(projectsDir);
+  const ids = [];
+  for (const name of subdirs) {
+    if (existsSync(join(projectsDir, name, 'project.json'))) ids.push(name);
+  }
+  ids.sort();
+  return ids;
+}
+
+/**
+ * Nearest candidates for a missing project id: substring matches first (both
+ * directions), then the closest by Levenshtein distance (up to length/2 + 1). At
+ * most 5 suggestions; sorted deterministically.
+ */
+function nearestProjectMatches(target, candidates, max = 5) {
+  const seen = new Set();
+  const out = [];
+  const push = (id) => { if (!seen.has(id)) { seen.add(id); out.push(id); } };
+  for (const id of candidates) {
+    if (id.toLowerCase().includes(target.toLowerCase()) || target.toLowerCase().includes(id.toLowerCase())) {
+      push(id);
+    }
+    if (out.length >= max) break;
+  }
+  if (out.length < max) {
+    const threshold = Math.max(1, Math.floor(target.length / 2) + 1);
+    const scored = candidates
+      .filter((id) => !seen.has(id))
+      .map((id) => ({ id, d: levenshtein(target.toLowerCase(), id.toLowerCase()) }))
+      .filter((r) => r.d <= threshold)
+      .sort((a, b) => a.d - b.d || a.id.localeCompare(b.id));
+    for (const { id } of scored) {
+      push(id);
+      if (out.length >= max) break;
+    }
+  }
+  return out;
+}
+
+/**
+ * Returns null when the project id resolves to an existing project.json on disk, or
+ * a preformatted stderr message (with trailing newline) when it does not. Split so
+ * doCreate can print + return exit 1 without repeating the plumbing.
+ */
+async function validateProjectExists(projectId) {
+  const repoRoot = await getRepoRoot();
+  const path = join(repoRoot, 'projects', projectId, 'project.json');
+  if (existsSync(path)) return null;
+  let candidates = [];
+  try { candidates = await listExistingProjectIds(); } catch { candidates = []; }
+  const nearest = nearestProjectMatches(projectId, candidates);
+  const lines = [`[pa work create] unknown project: ${projectId}`];
+  lines.push(`  expected projects/${projectId}/project.json on disk (not found)`);
+  if (nearest.length) {
+    lines.push(`  did you mean: ${nearest.join(', ')}`);
+  } else if (candidates.length) {
+    lines.push(`  existing projects: ${candidates.slice(0, 10).join(', ')}${candidates.length > 10 ? ', ...' : ''}`);
+  } else {
+    lines.push('  no projects on disk yet — create one with `pa project create` first');
+  }
+  return lines.map((l) => `${l}\n`).join('');
+}
+
+// Exported for tests only — pure helpers, no filesystem side-effects.
+export const __testables = { levenshtein, nearestProjectMatches };

package/dist/engineering-pa-cli/src/research/engine/finalise.mjs

@@ -134,9 +134,13 @@ export async function degradedSynthAgent(ctx, sq, reason) {
 
 // Pure coverage computation. Given the planner's sub-question ids and the synth
 // receipts, decide which SQs have a finding (any receipt with written=true), which ran
-// as a degraded write (empty finding, still counted as covered), and which are wholly
-// uncovered (no receipt at all — the failure this gate exists to catch). Used by the
-// wrapper to fail loudly instead of silently reporting status='done' on a partial run.
+// as a degraded write (empty finding, covered on disk but zero surviving claims), and
+// which are wholly uncovered (no receipt at all). `complete` is true only when every
+// planned SQ has a receipt AND every receipt carries at least one claim — a degraded
+// zero-claim finding is a coverage gap the wrapper must surface (status='partial'),
+// not silently mark done (w-2026-09-30-dave-005). The wrapper still distinguishes the
+// two failure modes: uncovered aborts finalise; degraded lets the answer.md be
+// written and returns status='partial' with the degraded[] list.
 export function coverageReport(subQuestionIds, synthReceipts) {
   const receiptsBySq = new Map();
   for (const r of synthReceipts || []) {
@@ -152,7 +156,13 @@ export function coverageReport(subQuestionIds, synthReceipts) {
     covered.push(id);
     if ((r.claimCount || 0) === 0) degraded.push(id);
   }
-  return { planned, covered, degraded, uncovered, complete: uncovered.length === 0 };
+  return {
+    planned,
+    covered,
+    degraded,
+    uncovered,
+    complete: uncovered.length === 0 && degraded.length === 0,
+  };
 }
 
 // -- Finalise (persist gate records, write sources.json + the session answer, round-trip, mark done) --

package/dist/engineering-pa-cli/src/research/workflows/research-deep.js

@@ -1,6 +1,6 @@
 // GENERATED by assemble.mjs — DO NOT EDIT. Edit wrappers/deep.mjs + engine/*.mjs and re-run `pnpm assemble`.
 // sources: wrappers/deep.mjs, engine/io.mjs, engine/plan.mjs, engine/agents.mjs, engine/finalise.mjs, engine/rank.mjs, engine/verify.mjs, engine/deepen.mjs, engine/deep.mjs
-// contentHash: sha256:cbdbff5d260df77a3b56a60d37bd75a58f0fa38968dbd0f0181c71fb6d8b3d29
+// contentHash: sha256:b7c50f3547c79b4c63bb54f14d1c0675a9af3a1c871d7866050cd22ff3d28fb5
 
 export const meta = {
   name: 'research-deep',
@@ -511,9 +511,13 @@ async function degradedSynthAgent(ctx, sq, reason) {
 
 // Pure coverage computation. Given the planner's sub-question ids and the synth
 // receipts, decide which SQs have a finding (any receipt with written=true), which ran
-// as a degraded write (empty finding, still counted as covered), and which are wholly
-// uncovered (no receipt at all — the failure this gate exists to catch). Used by the
-// wrapper to fail loudly instead of silently reporting status='done' on a partial run.
+// as a degraded write (empty finding, covered on disk but zero surviving claims), and
+// which are wholly uncovered (no receipt at all). `complete` is true only when every
+// planned SQ has a receipt AND every receipt carries at least one claim — a degraded
+// zero-claim finding is a coverage gap the wrapper must surface (status='partial'),
+// not silently mark done (w-2026-09-30-dave-005). The wrapper still distinguishes the
+// two failure modes: uncovered aborts finalise; degraded lets the answer.md be
+// written and returns status='partial' with the degraded[] list.
 function coverageReport(subQuestionIds, synthReceipts) {
   const receiptsBySq = new Map();
   for (const r of synthReceipts || []) {
@@ -529,7 +533,13 @@ function coverageReport(subQuestionIds, synthReceipts) {
     covered.push(id);
     if ((r.claimCount || 0) === 0) degraded.push(id);
   }
-  return { planned, covered, degraded, uncovered, complete: uncovered.length === 0 };
+  return {
+    planned,
+    covered,
+    degraded,
+    uncovered,
+    complete: uncovered.length === 0 && degraded.length === 0,
+  };
 }
 
 // -- Finalise (persist gate records, write sources.json + the session answer, round-trip, mark done) --

package/dist/engineering-pa-cli/src/research/workflows/research-normal.js

@@ -1,6 +1,6 @@
 // GENERATED by assemble.mjs — DO NOT EDIT. Edit wrappers/normal.mjs + engine/*.mjs and re-run `pnpm assemble`.
 // sources: wrappers/normal.mjs, engine/io.mjs, engine/plan.mjs, engine/agents.mjs, engine/finalise.mjs, engine/rank.mjs, engine/verify.mjs, engine/deepen.mjs
-// contentHash: sha256:579795fe41f91c096a6894492e6e0e0291b9ada32aff3ed81b5c31213c51335d
+// contentHash: sha256:9ea786a5296dd54d14bbc662d1d47a87f437829fc5d394c3a83dd64f65ff1236
 
 export const meta = {
   name: 'research-normal',
@@ -510,9 +510,13 @@ async function degradedSynthAgent(ctx, sq, reason) {
 
 // Pure coverage computation. Given the planner's sub-question ids and the synth
 // receipts, decide which SQs have a finding (any receipt with written=true), which ran
-// as a degraded write (empty finding, still counted as covered), and which are wholly
-// uncovered (no receipt at all — the failure this gate exists to catch). Used by the
-// wrapper to fail loudly instead of silently reporting status='done' on a partial run.
+// as a degraded write (empty finding, covered on disk but zero surviving claims), and
+// which are wholly uncovered (no receipt at all). `complete` is true only when every
+// planned SQ has a receipt AND every receipt carries at least one claim — a degraded
+// zero-claim finding is a coverage gap the wrapper must surface (status='partial'),
+// not silently mark done (w-2026-09-30-dave-005). The wrapper still distinguishes the
+// two failure modes: uncovered aborts finalise; degraded lets the answer.md be
+// written and returns status='partial' with the degraded[] list.
 function coverageReport(subQuestionIds, synthReceipts) {
   const receiptsBySq = new Map();
   for (const r of synthReceipts || []) {
@@ -528,7 +532,13 @@ function coverageReport(subQuestionIds, synthReceipts) {
     covered.push(id);
     if ((r.claimCount || 0) === 0) degraded.push(id);
   }
-  return { planned, covered, degraded, uncovered, complete: uncovered.length === 0 };
+  return {
+    planned,
+    covered,
+    degraded,
+    uncovered,
+    complete: uncovered.length === 0 && degraded.length === 0,
+  };
 }
 
 // -- Finalise (persist gate records, write sources.json + the session answer, round-trip, mark done) --
@@ -823,7 +833,14 @@ async function runDeepenRound(ctx, state, { lenses = VERIFY_LENSES, quorum = 2,
 // the parent session's 200/200 WebSearch budget — the tools shipped in agents.mjs are
 // the same tool surface the parent uses, so caps have to leave headroom).
 const NORMAL_SEARCH_TOOL_CAP = 12; // matches agents.searchAgent default
-const NORMAL_CLAIM_BUDGET = 25;    // matches rankAndCap call below
+const NORMAL_CLAIM_BUDGET = 25;    // matches rankAndCapPerSq call below
+// Per-sub-question retention floor for normal mode (w-2026-09-30-dave-005). Sessions
+// 01M3S5PXQTCZR70MGDQRZWN6ZM (4 SQs, sq-3/sq-4 zero-claim, budgetDropped 56, 5.47M
+// tokens) and 01M3S55WDKSYSC7Z7S8VRRJ9PC (6 SQs, sq-3/sq-4 zero-claim, budgetDropped
+// 75, 10.97M tokens) both had later sub-questions silently starved by the earlier
+// global rankAndCap cap while coverage.complete still reported true. Floor is the
+// same "top-1 per SQ" guarantee deep already uses (DEEP_RETAIN_FLOOR_PER_SQ).
+const NORMAL_RETAIN_FLOOR_PER_SQ = 1;
 function normalWebSearchCeiling(subQuestionCount, centralClaimCount) {
   const searchers = subQuestionCount * NORMAL_SEARCH_TOOL_CAP;
   const verifiers = centralClaimCount * VERIFY_LENSES.length * VERIFY_TOOL_CALL_CAP_DEFAULT;
@@ -847,10 +864,19 @@ phase('Search');
 const sqResults = await runSearchExtract(ctx, subQuestions);
 
 // -- Rank + budget cap (deterministic code — §4.1) --
+// Per-SQ floor applied BEFORE global trimming (w-2026-09-30-dave-005): reserve at
+// least NORMAL_RETAIN_FLOOR_PER_SQ retained claim(s) per sub-question that had any
+// claim extracted, then fill the remainder by global rank. A pure global cap starves
+// later sub-questions silently (they end with zero retained claims, hence a degraded
+// finding) while the wrapper still marks done.
 const urlBySourceId = new Map();
 const allClaims = flattenClaims(sqResults, urlBySourceId);
-const { retained, extractedCount, budgetDropped } = rankAndCap(allClaims, NORMAL_CLAIM_BUDGET); // CLAIM_BUDGET 25 (harness-skill cap)
-log(`extracted ${extractedCount} claims; retained ${retained.length} (budgetDropped ${budgetDropped})`);
+const { retained, extractedCount, budgetDropped } = rankAndCapPerSq(
+  allClaims,
+  NORMAL_CLAIM_BUDGET, // 25 (harness-skill cap)
+  { floorPerSq: NORMAL_RETAIN_FLOOR_PER_SQ },
+);
+log(`extracted ${extractedCount} claims; retained ${retained.length} (budgetDropped ${budgetDropped}, floorPerSq ${NORMAL_RETAIN_FLOOR_PER_SQ})`);
 
 // -- Verify (3-vote adversarial on central claims only — §4 normal row) --
 phase('Verify');
@@ -877,10 +903,16 @@ phase('Synthesize');
 const synthReceipts = await runSynth(ctx, subQuestions, retained, verdictByClaimId);
 
 // -- Coverage gate --
-// Fail loudly when a planned sub-question has no findings receipt. Before this gate
-// normal returned status='done' on 4-SQ plans that only synthesised 2 of them.
+// Two failure modes, handled separately (w-2026-09-30-dave-005):
+//   1. UNCOVERED — a planned SQ has no findings receipt at all. Abort finalise; no
+//      answer.md written; status='partial'. This is the original gate.
+//   2. DEGRADED — every SQ has a receipt but one or more carry zero surviving claims
+//      (the per-SQ floor kicks in for the extractor pool, but verify/dedupe may still
+//      leave an SQ empty). Let finalise run so answer.md is written, then override the
+//      returned status to 'partial' and surface the degraded[] list. Do NOT mark done
+//      — a partial run is not a done run.
 const coverage = coverageReport(subQuestions.map((s) => s.id), synthReceipts);
-if (!coverage.complete) {
+if (coverage.uncovered.length) {
   log(`ABORT: coverage gap — ${coverage.uncovered.length} of ${coverage.planned} sub-question(s) have no findings receipt: [${coverage.uncovered.join(', ')}]. Not marking done.`);
   return {
     sessionId: ctx.sessionId,
@@ -891,7 +923,7 @@ if (!coverage.complete) {
   };
 }
 if (coverage.degraded.length) {
-  log(`coverage: ${coverage.covered.length}/${coverage.planned} covered, ${coverage.degraded.length} degraded (zero-claim finding): [${coverage.degraded.join(', ')}]`);
+  log(`coverage: ${coverage.covered.length}/${coverage.planned} covered, ${coverage.degraded.length} degraded (zero-claim finding): [${coverage.degraded.join(', ')}] — run will return status='partial'`);
 } else {
   log(`coverage: ${coverage.covered.length}/${coverage.planned} covered, all with substantive findings`);
 }
@@ -905,6 +937,12 @@ const unsourcedRatio = totalClaimCount ? totalUnsourced / totalClaimCount : 0;
 const sourcesJson = buildSourcesJson(sqResults);
 const gateRecords = buildGateRecords(sqResults);
 
+// Subagent token cost — surfaced in runStats + the returned summary so an operator can
+// see what a normal-mode session actually spent, without opening the harness manifest
+// (w-2026-09-30-dave-005). Same shape deep uses.
+const outputTokensSpent = (typeof budget !== 'undefined' && budget && budget.spent) ? budget.spent() : 0;
+const budgetTotal = (typeof budget !== 'undefined' && budget && budget.total != null) ? budget.total : null;
+
 const runStats = {
   extracted: extractedCount, central: centralClaims.length,
   confirmed: confirmedN, refuted: refutedN, unverifiedInfra: infraN,
@@ -913,6 +951,8 @@ const runStats = {
   gatedDropped: gateRecords.length,
   coverage,
   webSearchCeiling: ceilingUpperBound,
+  outputTokensSpent,
+  budgetTotal,
 };
 
 if (unsourcedRatio > UNSOURCED_ABORT_RATIO) {
@@ -924,12 +964,18 @@ if (unsourcedRatio > UNSOURCED_ABORT_RATIO) {
 phase('Finalise');
 const finalise = await runFinalise(ctx, { gateRecords, sourcesJson, runStats });
 
-const status = finalise.markedDone ? 'done' : 'in-progress';
-log(`finalise: sources=${finalise.wroteSources} answer=${finalise.wroteAnswer} roundTrip=${finalise.roundTripOk} markedDone=${finalise.markedDone} gatesAppended=${finalise.gatesAppended ?? 0}/${gateRecords.length}`);
+// A degraded run reports 'partial' regardless of the finaliser's markedDone flag —
+// the answer.md is written and the session may be marked done in the store, but the
+// returned summary tells the caller a sub-question was not answered
+// (w-2026-09-30-dave-005). coverage.complete is already false in that case.
+const baseStatus = finalise.markedDone ? 'done' : 'in-progress';
+const status = coverage.degraded.length ? 'partial' : baseStatus;
+log(`finalise: sources=${finalise.wroteSources} answer=${finalise.wroteAnswer} roundTrip=${finalise.roundTripOk} markedDone=${finalise.markedDone} gatesAppended=${finalise.gatesAppended ?? 0}/${gateRecords.length} status=${status}`);
 
 return {
   sessionId: ctx.sessionId,
   status,
+  ...(coverage.degraded.length ? { reason: `${coverage.degraded.length} sub-question(s) with zero surviving claims`, degraded: coverage.degraded } : {}),
   question: ctx.baseQuestion,
   outputMode: ctx.baseOutputMode,
   subQuestions: subQuestions.map((s) => ({ id: s.id, text: s.text, kind: s.kind })),

package/dist/engineering-pa-cli/src/research/wrappers/normal.mjs

@@ -4,7 +4,7 @@
 import { deriveContext } from '../engine/io.mjs';
 import { runPlan } from '../engine/plan.mjs';
 import { runSearchExtract } from '../engine/agents.mjs';
-import { flattenClaims, rankAndCap } from '../engine/rank.mjs';
+import { flattenClaims, rankAndCapPerSq } from '../engine/rank.mjs';
 import { runVerify, VERIFY_LENSES, VERIFY_TOOL_CALL_CAP_DEFAULT } from '../engine/verify.mjs';
 import { runDeepenRound } from '../engine/deepen.mjs';
 import { UNSOURCED_ABORT_RATIO, buildSourcesJson, buildGateRecords, runSynth, runFinalise, coverageReport } from '../engine/finalise.mjs';
@@ -16,7 +16,14 @@ import { UNSOURCED_ABORT_RATIO, buildSourcesJson, buildGateRecords, runSynth, ru
 // the parent session's 200/200 WebSearch budget — the tools shipped in agents.mjs are
 // the same tool surface the parent uses, so caps have to leave headroom).
 const NORMAL_SEARCH_TOOL_CAP = 12; // matches agents.searchAgent default
-const NORMAL_CLAIM_BUDGET = 25;    // matches rankAndCap call below
+const NORMAL_CLAIM_BUDGET = 25;    // matches rankAndCapPerSq call below
+// Per-sub-question retention floor for normal mode (w-2026-09-30-dave-005). Sessions
+// 01M3S5PXQTCZR70MGDQRZWN6ZM (4 SQs, sq-3/sq-4 zero-claim, budgetDropped 56, 5.47M
+// tokens) and 01M3S55WDKSYSC7Z7S8VRRJ9PC (6 SQs, sq-3/sq-4 zero-claim, budgetDropped
+// 75, 10.97M tokens) both had later sub-questions silently starved by the earlier
+// global rankAndCap cap while coverage.complete still reported true. Floor is the
+// same "top-1 per SQ" guarantee deep already uses (DEEP_RETAIN_FLOOR_PER_SQ).
+const NORMAL_RETAIN_FLOOR_PER_SQ = 1;
 function normalWebSearchCeiling(subQuestionCount, centralClaimCount) {
   const searchers = subQuestionCount * NORMAL_SEARCH_TOOL_CAP;
   const verifiers = centralClaimCount * VERIFY_LENSES.length * VERIFY_TOOL_CALL_CAP_DEFAULT;
@@ -54,10 +61,19 @@ phase('Search');
 const sqResults = await runSearchExtract(ctx, subQuestions);
 
 // -- Rank + budget cap (deterministic code — §4.1) --
+// Per-SQ floor applied BEFORE global trimming (w-2026-09-30-dave-005): reserve at
+// least NORMAL_RETAIN_FLOOR_PER_SQ retained claim(s) per sub-question that had any
+// claim extracted, then fill the remainder by global rank. A pure global cap starves
+// later sub-questions silently (they end with zero retained claims, hence a degraded
+// finding) while the wrapper still marks done.
 const urlBySourceId = new Map();
 const allClaims = flattenClaims(sqResults, urlBySourceId);
-const { retained, extractedCount, budgetDropped } = rankAndCap(allClaims, NORMAL_CLAIM_BUDGET); // CLAIM_BUDGET 25 (harness-skill cap)
-log(`extracted ${extractedCount} claims; retained ${retained.length} (budgetDropped ${budgetDropped})`);
+const { retained, extractedCount, budgetDropped } = rankAndCapPerSq(
+  allClaims,
+  NORMAL_CLAIM_BUDGET, // 25 (harness-skill cap)
+  { floorPerSq: NORMAL_RETAIN_FLOOR_PER_SQ },
+);
+log(`extracted ${extractedCount} claims; retained ${retained.length} (budgetDropped ${budgetDropped}, floorPerSq ${NORMAL_RETAIN_FLOOR_PER_SQ})`);
 
 // -- Verify (3-vote adversarial on central claims only — §4 normal row) --
 phase('Verify');
@@ -84,10 +100,16 @@ phase('Synthesize');
 const synthReceipts = await runSynth(ctx, subQuestions, retained, verdictByClaimId);
 
 // -- Coverage gate --
-// Fail loudly when a planned sub-question has no findings receipt. Before this gate
-// normal returned status='done' on 4-SQ plans that only synthesised 2 of them.
+// Two failure modes, handled separately (w-2026-09-30-dave-005):
+//   1. UNCOVERED — a planned SQ has no findings receipt at all. Abort finalise; no
+//      answer.md written; status='partial'. This is the original gate.
+//   2. DEGRADED — every SQ has a receipt but one or more carry zero surviving claims
+//      (the per-SQ floor kicks in for the extractor pool, but verify/dedupe may still
+//      leave an SQ empty). Let finalise run so answer.md is written, then override the
+//      returned status to 'partial' and surface the degraded[] list. Do NOT mark done
+//      — a partial run is not a done run.
 const coverage = coverageReport(subQuestions.map((s) => s.id), synthReceipts);
-if (!coverage.complete) {
+if (coverage.uncovered.length) {
   log(`ABORT: coverage gap — ${coverage.uncovered.length} of ${coverage.planned} sub-question(s) have no findings receipt: [${coverage.uncovered.join(', ')}]. Not marking done.`);
   return {
     sessionId: ctx.sessionId,
@@ -98,7 +120,7 @@ if (!coverage.complete) {
   };
 }
 if (coverage.degraded.length) {
-  log(`coverage: ${coverage.covered.length}/${coverage.planned} covered, ${coverage.degraded.length} degraded (zero-claim finding): [${coverage.degraded.join(', ')}]`);
+  log(`coverage: ${coverage.covered.length}/${coverage.planned} covered, ${coverage.degraded.length} degraded (zero-claim finding): [${coverage.degraded.join(', ')}] — run will return status='partial'`);
 } else {
   log(`coverage: ${coverage.covered.length}/${coverage.planned} covered, all with substantive findings`);
 }
@@ -112,6 +134,12 @@ const unsourcedRatio = totalClaimCount ? totalUnsourced / totalClaimCount : 0;
 const sourcesJson = buildSourcesJson(sqResults);
 const gateRecords = buildGateRecords(sqResults);
 
+// Subagent token cost — surfaced in runStats + the returned summary so an operator can
+// see what a normal-mode session actually spent, without opening the harness manifest
+// (w-2026-09-30-dave-005). Same shape deep uses.
+const outputTokensSpent = (typeof budget !== 'undefined' && budget && budget.spent) ? budget.spent() : 0;
+const budgetTotal = (typeof budget !== 'undefined' && budget && budget.total != null) ? budget.total : null;
+
 const runStats = {
   extracted: extractedCount, central: centralClaims.length,
   confirmed: confirmedN, refuted: refutedN, unverifiedInfra: infraN,
@@ -120,6 +148,8 @@ const runStats = {
   gatedDropped: gateRecords.length,
   coverage,
   webSearchCeiling: ceilingUpperBound,
+  outputTokensSpent,
+  budgetTotal,
 };
 
 if (unsourcedRatio > UNSOURCED_ABORT_RATIO) {
@@ -131,12 +161,18 @@ if (unsourcedRatio > UNSOURCED_ABORT_RATIO) {
 phase('Finalise');
 const finalise = await runFinalise(ctx, { gateRecords, sourcesJson, runStats });
 
-const status = finalise.markedDone ? 'done' : 'in-progress';
-log(`finalise: sources=${finalise.wroteSources} answer=${finalise.wroteAnswer} roundTrip=${finalise.roundTripOk} markedDone=${finalise.markedDone} gatesAppended=${finalise.gatesAppended ?? 0}/${gateRecords.length}`);
+// A degraded run reports 'partial' regardless of the finaliser's markedDone flag —
+// the answer.md is written and the session may be marked done in the store, but the
+// returned summary tells the caller a sub-question was not answered
+// (w-2026-09-30-dave-005). coverage.complete is already false in that case.
+const baseStatus = finalise.markedDone ? 'done' : 'in-progress';
+const status = coverage.degraded.length ? 'partial' : baseStatus;
+log(`finalise: sources=${finalise.wroteSources} answer=${finalise.wroteAnswer} roundTrip=${finalise.roundTripOk} markedDone=${finalise.markedDone} gatesAppended=${finalise.gatesAppended ?? 0}/${gateRecords.length} status=${status}`);
 
 return {
   sessionId: ctx.sessionId,
   status,
+  ...(coverage.degraded.length ? { reason: `${coverage.degraded.length} sub-question(s) with zero surviving claims`, degraded: coverage.degraded } : {}),
   question: ctx.baseQuestion,
   outputMode: ctx.baseOutputMode,
   subQuestions: subQuestions.map((s) => ({ id: s.id, text: s.text, kind: s.kind })),

package/dist/engineering-pa-core/roles/agentic-workflow-designer/definition.md

@@ -95,7 +95,7 @@ Standing rules for the lane invocation, whatever engine the estate binds:
 
 - The lane is invoked as a **tool call from the designer's own session** (a CLI such as `codex exec`), never as an agent the designer spawns. Where an estate binds the lane to an agent role, the dispatching PA runs that role as a sibling dispatch and the designer verifies the render on a second pass.
 - The engine and model are **pinned explicitly per invocation**; never rely on a CLI config default.
-- **Subscription auth only**; if the tooling asks for an API key, stop and escalate.
+- **Follow the instance's LLM credential policy** (subscription sign-in, API key, or other vendor key as the instance permits); if the tooling asks for a credential shape the instance does not permit, stop and escalate.
 - **Bounded iteration**: one build invocation plus at most one refinement.
 - **On lane failure, stop and report.** Never silently self-author the design on the orchestrating model; the parent re-routes.
 

package/dist/engineering-pa-workspace/app/assets/brand/icons/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img"><title>Stravica favicon</title><desc></desc><rect x="0" y="0" width="64" height="64" rx="14" fill="#080F19"/><g fill="#7295FF"><path d="M38 9L17 21V32L38 20Z"/><path d="M30 27L46 36V46L30 37L23 33Z"/><path d="M46 46L25 58V47L37 40Z"/></g></svg>

package/dist/engineering-pa-workspace/app/assets/brand/icons/maskable-icon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="512" height="512" role="img"><title>Stravica maskable app icon</title><desc></desc><rect x="0" y="0" width="512" height="512" rx="0" fill="#080F19"/><defs><linearGradient id="ma" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#174CFF"/><stop offset="1" stop-color="#263BFF"/></linearGradient><linearGradient id="mb" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#1674FF"/><stop offset="1" stop-color="#2854FF"/></linearGradient></defs><g transform="translate(167 126) scale(1.3888888888888888)"><path fill="url(#ma)" d="M86 4 L10 48 Q4 51 4 58 L4 81 Q4 87 10 84 L80 45 Q86 42 86 35 Z"/><path fill="url(#ma)" d="M88 108 L129 125 L47 172 Q41 176 41 170 L41 142 Q41 136 47 133 Z"/><path fill="url(#mb)" d="M41 84 L74 65 Q78 63 83 66 L124 88 Q130 91 130 98 L130 121 Q130 126 124 123 Z"/></g></svg>

package/dist/engineering-pa-workspace/app/assets/brand/icons/safari-pinned-tab.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 136 180" width="136" height="180" role="img"><title>Stravica pinned tab</title><desc></desc><g transform="translate(0 0) scale(1.0)"><path fill="#000000" d="M86 4 L10 48 Q4 51 4 58 L4 81 Q4 87 10 84 L80 45 Q86 42 86 35 Z"/><path fill="#000000" d="M88 108 L129 125 L47 172 Q41 176 41 170 L41 142 Q41 136 47 133 Z"/><path fill="#000000" d="M41 84 L74 65 Q78 63 83 66 L124 88 Q130 91 130 98 L130 121 Q130 126 124 123 Z"/></g></svg>

package/dist/engineering-pa-workspace/app/assets/brand/stravica-logo-dark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 180" width="760" height="180" role="img"><title>Stravica logo for dark backgrounds</title><desc></desc><g transform="translate(0 0) scale(1.0)"><defs><linearGradient id="la" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#174CFF"/><stop offset="1" stop-color="#263BFF"/></linearGradient><linearGradient id="lb" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#1674FF"/><stop offset="1" stop-color="#2854FF"/></linearGradient></defs><g transform="translate(0 0) scale(1.0)"><path fill="url(#la)" d="M86 4 L10 48 Q4 51 4 58 L4 81 Q4 87 10 84 L80 45 Q86 42 86 35 Z"/><path fill="url(#la)" d="M88 108 L129 125 L47 172 Q41 176 41 170 L41 142 Q41 136 47 133 Z"/><path fill="url(#lb)" d="M41 84 L74 65 Q78 63 83 66 L124 88 Q130 91 130 98 L130 121 Q130 126 124 123 Z"/></g><g fill="#F2F5FA" fill-rule="evenodd" transform="translate(178 49) scale(1.036697247706422)"><path d="M56 0H22C8 0 1 9 1 20C1 31 9 38 22 38H34C40 38 42 40 42 44C42 47 39 49 34 49H6L0 62H34C49 62 57 54 57 43C57 32 50 25 36 25H23C17 25 15 23 15 19C15 15 18 13 23 13H51Z" transform="translate(0 0)"/><path d="M0 0H56V14H35V62H21V14H0Z" transform="translate(71 0)"/><path d="M0 0H32C48 0 56 8 56 20C56 29 51 35 44 38L60 62H42L28 40H15V62H0ZM15 13V27H31C38 27 41 25 41 20C41 15 38 13 31 13Z" transform="translate(140 0)"/><path d="M0 62L28 0H41L69 62H53L34.5 20L16 62Z" transform="translate(213 0)"/><path d="M0 0H16L35 42L54 0H70L42 62H28Z" transform="translate(295 0)"/><path d="M0 0H15V62H0Z" transform="translate(378 0)"/><path d="M57 0H31C12 0 0 13 0 31C0 49 12 62 31 62H55V48H31C21 48 15 41 15 31C15 21 21 14 31 14H51Z" transform="translate(406 0)"/><path d="M0 62L28 0H41L69 62H53L34.5 20L16 62Z" transform="translate(476 0)"/></g></g></svg>

package/dist/engineering-pa-workspace/app/assets/brand/stravica-logo-light.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 180" width="760" height="180" role="img"><title>Stravica logo for light backgrounds</title><desc></desc><g transform="translate(0 0) scale(1.0)"><defs><linearGradient id="la" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#174CFF"/><stop offset="1" stop-color="#263BFF"/></linearGradient><linearGradient id="lb" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#1674FF"/><stop offset="1" stop-color="#2854FF"/></linearGradient></defs><g transform="translate(0 0) scale(1.0)"><path fill="url(#la)" d="M86 4 L10 48 Q4 51 4 58 L4 81 Q4 87 10 84 L80 45 Q86 42 86 35 Z"/><path fill="url(#la)" d="M88 108 L129 125 L47 172 Q41 176 41 170 L41 142 Q41 136 47 133 Z"/><path fill="url(#lb)" d="M41 84 L74 65 Q78 63 83 66 L124 88 Q130 91 130 98 L130 121 Q130 126 124 123 Z"/></g><g fill="#080F19" fill-rule="evenodd" transform="translate(178 49) scale(1.036697247706422)"><path d="M56 0H22C8 0 1 9 1 20C1 31 9 38 22 38H34C40 38 42 40 42 44C42 47 39 49 34 49H6L0 62H34C49 62 57 54 57 43C57 32 50 25 36 25H23C17 25 15 23 15 19C15 15 18 13 23 13H51Z" transform="translate(0 0)"/><path d="M0 0H56V14H35V62H21V14H0Z" transform="translate(71 0)"/><path d="M0 0H32C48 0 56 8 56 20C56 29 51 35 44 38L60 62H42L28 40H15V62H0ZM15 13V27H31C38 27 41 25 41 20C41 15 38 13 31 13Z" transform="translate(140 0)"/><path d="M0 62L28 0H41L69 62H53L34.5 20L16 62Z" transform="translate(213 0)"/><path d="M0 0H16L35 42L54 0H70L42 62H28Z" transform="translate(295 0)"/><path d="M0 0H15V62H0Z" transform="translate(378 0)"/><path d="M57 0H31C12 0 0 13 0 31C0 49 12 62 31 62H55V48H31C21 48 15 41 15 31C15 21 21 14 31 14H51Z" transform="translate(406 0)"/><path d="M0 62L28 0H41L69 62H53L34.5 20L16 62Z" transform="translate(476 0)"/></g></g></svg>

package/dist/engineering-pa-workspace/app/assets/brand/stravica-mark.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 136 180" width="136" height="180" role="img"><title>Stravica ribbon symbol</title><desc></desc><defs><linearGradient id="ma" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#174CFF"/><stop offset="1" stop-color="#263BFF"/></linearGradient><linearGradient id="mb" x1="0" y1="0" x2="1" y2="1"><stop stop-color="#1674FF"/><stop offset="1" stop-color="#2854FF"/></linearGradient></defs><g transform="translate(0 0) scale(1.0)"><path fill="url(#ma)" d="M86 4 L10 48 Q4 51 4 58 L4 81 Q4 87 10 84 L80 45 Q86 42 86 35 Z"/><path fill="url(#ma)" d="M88 108 L129 125 L47 172 Q41 176 41 170 L41 142 Q41 136 47 133 Z"/><path fill="url(#mb)" d="M41 84 L74 65 Q78 63 83 66 L124 88 Q130 91 130 98 L130 121 Q130 126 124 123 Z"/></g></svg>

package/dist/engineering-pa-workspace/app/assets/modal.js

@@ -20,30 +20,30 @@
   'use strict';
 
   var CSS =
-    '.ws-modal-overlay{display:none;position:fixed;inset:0;background:rgba(0,0,0,0.65);z-index:200;align-items:center;justify-content:center;padding:1rem}' +
+    '.ws-modal-overlay{display:none;position:fixed;inset:0;background:color-mix(in srgb, var(--text) 65%, transparent);z-index:200;align-items:center;justify-content:center;padding:1rem}' +
     '.ws-modal-overlay.open{display:flex}' +
-    '.ws-modal{background:var(--bg-surface,#1f2335);border:1px solid var(--border,#3b4261);border-radius:10px;max-width:780px;width:100%;max-height:85vh;display:flex;flex-direction:column;position:relative;font-family:inherit}' +
-    '.ws-modal-header{padding:1rem 1.25rem 0.5rem;border-bottom:1px solid var(--border,#3b4261);display:flex;align-items:center;gap:0.75rem}' +
-    '.ws-modal-title{color:var(--text-bright,#e0e6ff);font-size:1rem;font-weight:600;flex:1;min-width:0;word-break:break-word}' +
-    '.ws-modal-close{background:var(--bg-highlight,#292e42);border:1px solid var(--border,#3b4261);border-radius:4px;color:var(--text-dim,#565f89);font-size:0.72rem;padding:0.25rem 0.6rem;cursor:pointer;font-family:inherit;flex-shrink:0}' +
-    '.ws-modal-close:hover{color:var(--text-bright,#e0e6ff);border-color:var(--accent,#7aa2f7)}' +
-    '.ws-modal-body{padding:1rem 1.25rem 1.25rem;overflow-y:auto;color:var(--text,#c0caf5);font-size:0.8rem;line-height:1.6}' +
-    '.ws-modal-body pre{background:var(--bg-highlight,#292e42);border:1px solid var(--border,#3b4261);border-radius:5px;padding:0.6rem;overflow-x:auto;font-size:0.72rem;white-space:pre-wrap;word-break:break-word}' +
-    '.ws-modal-body code{background:var(--bg-highlight,#292e42);border:1px solid var(--border,#3b4261);border-radius:3px;padding:0.05rem 0.3rem;font-size:0.78em;color:var(--cyan,#7dcfff)}' +
+    '.ws-modal{background:var(--bg-surface);border:1px solid var(--border);border-radius:10px;max-width:780px;width:100%;max-height:85vh;display:flex;flex-direction:column;position:relative;font-family:inherit}' +
+    '.ws-modal-header{padding:1rem 1.25rem 0.5rem;border-bottom:1px solid var(--border);display:flex;align-items:center;gap:0.75rem}' +
+    '.ws-modal-title{color:var(--text-bright);font-size:1rem;font-weight:600;flex:1;min-width:0;word-break:break-word}' +
+    '.ws-modal-close{background:var(--bg-highlight);border:1px solid var(--border);border-radius:4px;color:var(--text-dim);font-size:0.72rem;padding:0.25rem 0.6rem;cursor:pointer;font-family:inherit;flex-shrink:0}' +
+    '.ws-modal-close:hover{color:var(--text-bright);border-color:var(--accent)}' +
+    '.ws-modal-body{padding:1rem 1.25rem 1.25rem;overflow-y:auto;color:var(--text);font-size:0.8rem;line-height:1.6}' +
+    '.ws-modal-body pre{background:var(--bg-highlight);border:1px solid var(--border);border-radius:5px;padding:0.6rem;overflow-x:auto;font-size:0.72rem;white-space:pre-wrap;word-break:break-word}' +
+    '.ws-modal-body code{background:var(--bg-highlight);border:1px solid var(--border);border-radius:3px;padding:0.05rem 0.3rem;font-size:0.78em;color:var(--cyan)}' +
     '.ws-modal-body pre code{background:transparent;border:none;padding:0;color:inherit}' +
-    '.ws-modal-body h1,.ws-modal-body h2,.ws-modal-body h3,.ws-modal-body h4{color:var(--text-bright,#e0e6ff);margin:0.75rem 0 0.35rem}' +
-    '.ws-modal-body h1{font-size:1rem}.ws-modal-body h2{font-size:0.9rem;border-bottom:1px solid var(--border,#3b4261);padding-bottom:0.15rem}' +
-    '.ws-modal-body h3{font-size:0.82rem;color:var(--purple,#bb9af7)}' +
+    '.ws-modal-body h1,.ws-modal-body h2,.ws-modal-body h3,.ws-modal-body h4{color:var(--text-bright);margin:0.75rem 0 0.35rem}' +
+    '.ws-modal-body h1{font-size:1rem}.ws-modal-body h2{font-size:0.9rem;border-bottom:1px solid var(--border);padding-bottom:0.15rem}' +
+    '.ws-modal-body h3{font-size:0.82rem;color:var(--purple)}' +
     '.ws-modal-body p{margin-bottom:0.5rem}' +
     '.ws-modal-body ul,.ws-modal-body ol{padding-left:1.3rem;margin-bottom:0.5rem}' +
     '.ws-modal-body li{margin-bottom:0.1rem}' +
-    '.ws-modal-body a{color:var(--accent,#7aa2f7);text-decoration:none}' +
+    '.ws-modal-body a{color:var(--accent);text-decoration:none}' +
     '.ws-modal-body a:hover{text-decoration:underline}' +
     '.ws-modal-body .kv{display:grid;grid-template-columns:7rem 1fr;gap:0.35rem 0.75rem;font-size:0.76rem;margin-bottom:0.75rem}' +
-    '.ws-modal-body .kv .k{color:var(--text-dim,#565f89);text-transform:uppercase;letter-spacing:0.05em;font-size:0.64rem;padding-top:0.1rem}' +
-    '.ws-modal-body .kv .v{color:var(--text,#c0caf5);word-break:break-word}' +
-    '.ws-modal-body .kv .v.mono{font-family:"SF Mono","JetBrains Mono",monospace;font-size:0.72rem;color:var(--cyan,#7dcfff)}' +
-    '.ws-modal-body .section-label{color:var(--text-dim,#565f89);text-transform:uppercase;letter-spacing:0.05em;font-size:0.64rem;margin-top:0.75rem;margin-bottom:0.3rem}';
+    '.ws-modal-body .kv .k{color:var(--text-dim);text-transform:uppercase;letter-spacing:0.05em;font-size:0.64rem;padding-top:0.1rem}' +
+    '.ws-modal-body .kv .v{color:var(--text);word-break:break-word}' +
+    '.ws-modal-body .kv .v.mono{font-family:var(--font-mono);font-size:0.72rem;color:var(--cyan)}' +
+    '.ws-modal-body .section-label{color:var(--text-dim);text-transform:uppercase;letter-spacing:0.05em;font-size:0.64rem;margin-top:0.75rem;margin-bottom:0.3rem}';
 
   var initialised = false;
   var keyHandlerAttached = false;