@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/mission-context/campaign-facts.js

@@ -0,0 +1,111 @@
+/*
+ * core/mission-context/campaign-facts.ts — WHAT a campaign session is made of,
+ * and WHICH of its units is the active one.
+ *
+ * Split from `campaign-artifacts.ts` at the 300-LOC rule when provenance was
+ * added. The seam is real rather than arbitrary: this file is the vocabulary
+ * (facts + the selection rule), that file is the presentation (descriptors).
+ * `selectActiveStep` lives here because `slice3-sources.ts` needs the SELECTION
+ * without needing any descriptor.
+ */
+/**
+ * Pick the ACTIVE sub-iterate, and record WHY.
+ *
+ * The basis travels on the wire (`selectedBy`) because "which one is running" is
+ * a claim, and a claim whose basis is invisible drifts without anyone noticing.
+ *
+ *   1. a unit explicitly `in_progress`               → that one
+ *   2. else the first unit that is not `complete`    → the one the campaign is
+ *      blocked on. `failed` and `escalated` land here on purpose: a stuck unit
+ *      IS the active one, and skipping past it would hide the problem.
+ *   3. else (everything complete) the LAST unit      → a finished campaign shows
+ *      where it ended rather than nothing at all.
+ */
+export function selectActiveStep(steps) {
+    if (steps.length === 0)
+        return null;
+    const running = steps.find((s) => s.status === "in_progress");
+    if (running)
+        return { step: running, selectedBy: "in_progress" };
+    const incomplete = steps.find((s) => s.status !== "complete");
+    if (incomplete)
+        return { step: incomplete, selectedBy: "first_incomplete" };
+    return { step: steps[steps.length - 1], selectedBy: "last_complete" };
+}
+// ---------------------------------------------------------------------------
+// The basis of a claim
+// ---------------------------------------------------------------------------
+/**
+ * The one sentence that turns a silent fallback into an honest one.
+ *
+ * `campaign-store` drops from the live `status.json` to the `campaign.md` table
+ * when the former is missing or torn, and until this iterate that fallback left
+ * no trace: "S2 is running now" read identically whether it came from the live
+ * status file or from a plan document written days earlier. The three cases are
+ * genuinely different claims and get genuinely different words.
+ *
+ * Returns "" when the facts came from the live file — the common case must not
+ * be cluttered with a disclosure that says nothing.
+ */
+export function provenanceNote(c, 
+/**
+ * The SOURCE to qualify. For a per-unit claim this is that unit's own source,
+ * which can differ from the campaign's overall one; omit it for a
+ * campaign-wide claim and the campaign's own source is used.
+ */
+source) {
+    // The type requires `provenance`, so an absent one means an untyped path
+    // reached here. Throwing would 500 the whole mission endpoint over a missing
+    // disclosure — the opposite of the degrade-honestly rule this module keeps.
+    // Treat it as an unknown basis and SAY so, rather than silently vouching.
+    if (!c.provenance) {
+        return " Where this status came from could not be established.";
+    }
+    const from = source ?? c.provenance.statusSource;
+    // WHERE THE VALUE CAME FROM IS RESOLVED FIRST, and `default` means it came
+    // from nowhere: neither source named this unit, so `pending` is THIS READER's
+    // own assumption. Attributing it to a document is a claim about a document
+    // that never mentioned it.
+    //
+    // This branch used to sit BELOW the file-level ones, so whenever `status.json`
+    // was unreadable — which is one of the two ways to reach `default` — the
+    // sentence became "…so this comes from its plan document and may be out of
+    // date." The plan document said nothing either. A reader's default, laundered
+    // into a cited source, by the disclosure written to prevent exactly that
+    // (internal code-review cascade, FIX 2).
+    //
+    // The two facts are both true when a source also failed, so they COMPOSE
+    // rather than one silencing the other.
+    if (from === "default") {
+        const because = c.provenance.statusJsonState === "unreadable"
+            ? " Its live status file could not be read, so that may say otherwise."
+            : c.provenance.campaignMdUnreadable
+                ? " Its plan document could not be read, so that may say otherwise."
+                : "";
+        return ` No record of this unit's progress was found, so this is an assumption rather than a reported state.${because}`;
+    }
+    if (from === "events") {
+        return " This was reconstructed from the completed-work record, because the campaign's own files are not in this copy of the project.";
+    }
+    // NAME THE RIGHT FILE. A single `degraded` boolean cannot: `campaign.md` can
+    // be the one that failed while `status.json` read perfectly, and saying "the
+    // live status file could not be read" there is a false statement — the exact
+    // category of error this whole iterate exists to remove, made by the
+    // disclosure meant to prevent it (external code review, openai #4).
+    if (c.provenance.statusJsonState === "unreadable") {
+        return " This campaign's live status file could not be read, so this comes from its plan document and may be out of date.";
+    }
+    if (c.provenance.campaignMdUnreadable) {
+        return " This campaign's plan document could not be read, so some details may be missing.";
+    }
+    if (from === "campaign_md") {
+        // "No live status file" is only true when there ISN'T one. A file that
+        // exists but does not mention THIS unit is a different fact, and claiming
+        // otherwise misdescribes a partial status file (openai #5).
+        return c.provenance.statusJsonState === "ok"
+            ? " The live status file does not record this unit, so this comes from the campaign's plan document."
+            : " This campaign has no live status file, so this comes from its plan document.";
+    }
+    return "";
+}
+//# sourceMappingURL=campaign-facts.js.map

package/server/dist/core/mission-context/campaign-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign-facts.js","sourceRoot":"","sources":["../../../src/core/mission-context/campaign-facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAmC;IAEnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;IAC9D,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAEjE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAC9D,IAAI,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAE5E,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,CAAgB;AAChB;;;;GAIG;AACH,MAA0C;IAE1C,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,wDAAwD,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;IAEjD,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,2BAA2B;IAC3B,EAAE;IACF,+EAA+E;IAC/E,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,yCAAyC;IACzC,EAAE;IACF,yEAAyE;IACzE,uCAAuC;IACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,OAAO,GACX,CAAC,CAAC,UAAU,CAAC,eAAe,KAAK,YAAY;YAC3C,CAAC,CAAC,qEAAqE;YACvE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB;gBACjC,CAAC,CAAC,kEAAkE;gBACpE,CAAC,CAAC,EAAE,CAAC;QACX,OAAO,uGAAuG,OAAO,EAAE,CAAC;IAC1H,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,+HAA+H,CAAC;IACzI,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,KAAK,YAAY,EAAE,CAAC;QAClD,OAAO,mHAAmH,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;QACtC,OAAO,mFAAmF,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,uEAAuE;QACvE,0EAA0E;QAC1E,4DAA4D;QAC5D,OAAO,CAAC,CAAC,UAAU,CAAC,eAAe,KAAK,IAAI;YAC1C,CAAC,CAAC,mGAAmG;YACrG,CAAC,CAAC,+EAA+E,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/server/dist/core/mission-context/decision-drops.d.ts

@@ -0,0 +1,46 @@
+export declare const DECISION_DROPS_REL = ".shipwright/agent_docs/decision-drops";
+/** One iterate records a handful of ADRs — same ceiling as the log reader. */
+export declare const MAX_DROP_ENTRIES = 20;
+/** Absolute path to the drops DIRECTORY — used for `sourceRev` probing. */
+export declare function decisionDropsDir(projectRoot: string): string;
+export interface DropEntry {
+    /** The drop's own filename, e.g. `iterate-…_001.json`. Never shown raw. */
+    fileName: string;
+    title: string;
+    markdown: string;
+}
+export type DropsLookup = {
+    status: "ok";
+    entries: DropEntry[];
+    /** Files that matched this run but could not be parsed or validated. */
+    malformed: number;
+    truncated: boolean;
+} | {
+    status: "unavailable";
+    reason: "denied" | "unreadable";
+};
+/**
+ * Every drop file belonging to `runId`, absolute, sorted.
+ *
+ * Exported for `sourceRev`: registering only the DIRECTORY catches a drop being
+ * created (which is the S1-class bug this must not repeat), but a directory's
+ * mtime does not move when a file's CONTENT is rewritten. Both are needed.
+ *
+ * Returns [] for an unsafe runId or an unreadable directory — the caller still
+ * registers the directory path itself, whose `absent` fingerprint is what makes
+ * later creation visible.
+ */
+export declare function dropFilePaths(projectRoot: string, runId: string): string[];
+/**
+ * The decision-drops this run recorded but which no release has numbered yet.
+ *
+ * `unavailable` means the DIRECTORY could not be read — we know nothing either
+ * way. An `ok` with zero entries means the directory WAS read and holds nothing
+ * for this run, which is a real answer. The caller renders those differently,
+ * and keeping them apart is the entire point of this iterate.
+ *
+ * A single malformed drop is COUNTED, not fatal: one half-written file must
+ * never take down the decisions of a run that also recorded good ones.
+ */
+export declare function readRunDrops(projectRoot: string, runId: string): DropsLookup;
+//# sourceMappingURL=decision-drops.d.ts.map

package/server/dist/core/mission-context/decision-drops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-drops.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/decision-drops.ts"],"names":[],"mappings":"AAoCA,eAAO,MAAM,kBAAkB,0CAA0C,CAAC;AAQ1E,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAanC,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GACnB;IACE,MAAM,EAAE,IAAI,CAAC;IACb,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,GACD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB1E;AAoFD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAuF5E"}

package/server/dist/core/mission-context/decision-drops.js

@@ -0,0 +1,269 @@
+/*
+ * core/mission-context/decision-drops.ts — the OTHER half of the DECISIONS
+ * artifact source (CONTRACT §6 row 5).
+ *
+ * `decisions.ts` reads `decision_log.md`, which is the source ADR-134 named. The
+ * measurement that module's own calibration probe made, and then deferred, is
+ * the reason this file exists:
+ *
+ *   An iterate's F3 does NOT write `decision_log.md`. It writes a decision-DROP
+ *   (`.shipwright/agent_docs/decision-drops/<run_id>_NNN.json`). The sequential
+ *   `ADR-NNN` and the log entry are assigned LATER, at release time, by
+ *   `/shipwright-changelog` → `aggregate_decisions.py` — which folds the drops
+ *   in and then DELETES them.
+ *
+ * So between F3 and the next release, a run's decision exists only as a drop and
+ * the log filter correctly-but-uselessly returns nothing. Measured on this repo
+ * 2026-07-19: 18 drops on disk, 166 run_ids in the log, **0** in both — i.e. all
+ * 18 runs' decisions were invisible.
+ *
+ * Two properties this module is built around:
+ *
+ *   1. A drop is STRUCTURED JSON carrying exactly the fields the panel renders,
+ *      so nothing has to be scraped out of Markdown prose.
+ *   2. The drops directory is written to the MAIN tree BY DESIGN (a worktree is
+ *      removed before release aggregation, which would destroy them). It is
+ *      gitignored. Neither is a bug and neither is ours to "fix" — we are a
+ *      READER of this directory and nothing here ever writes to it.
+ */
+import { readdirSync } from "node:fs";
+import path from "node:path";
+import { readBoundedFile } from "./fs-read.js";
+import { pathGuard, realPathGuard } from "../path-guard.js";
+import { isSafeRunId } from "./pointer.js";
+export const DECISION_DROPS_REL = ".shipwright/agent_docs/decision-drops";
+/** A directory is unbounded in principle; the real one holds 18 files. */
+const MAX_DROP_FILES = 200;
+/** Real drops are 1.4–2.8 KB. 512 KB is four orders of headroom. */
+const MAX_DROP_BYTES = 512 * 1024;
+/** One iterate records a handful of ADRs — same ceiling as the log reader. */
+export const MAX_DROP_ENTRIES = 20;
+/** Per-field, per-entry AND total caps on the Markdown carried in the response. */
+const MAX_FIELD_CHARS = 16 * 1024;
+const MAX_ENTRY_CHARS = 64 * 1024;
+/**
+ * Without this, 20 entries x 64 KB could emit over 1 MB in one response. The
+ * per-entry cap alone does not bound the whole (external code review, openai
+ * #1) — and the log reader next door has always had a total cap, so the two
+ * halves of the same artifact were bounded differently.
+ */
+const MAX_TOTAL_CHARS = 256 * 1024;
+/** Absolute path to the drops DIRECTORY — used for `sourceRev` probing. */
+export function decisionDropsDir(projectRoot) {
+    return path.join(projectRoot, ...DECISION_DROPS_REL.split("/"));
+}
+/**
+ * Every drop file belonging to `runId`, absolute, sorted.
+ *
+ * Exported for `sourceRev`: registering only the DIRECTORY catches a drop being
+ * created (which is the S1-class bug this must not repeat), but a directory's
+ * mtime does not move when a file's CONTENT is rewritten. Both are needed.
+ *
+ * Returns [] for an unsafe runId or an unreadable directory — the caller still
+ * registers the directory path itself, whose `absent` fingerprint is what makes
+ * later creation visible.
+ */
+export function dropFilePaths(projectRoot, runId) {
+    if (!isSafeRunId(runId))
+        return [];
+    const guard = pathGuard(projectRoot, DECISION_DROPS_REL);
+    if (!guard.ok)
+        return [];
+    let names;
+    try {
+        names = readdirSync(guard.absolute, { withFileTypes: true })
+            .filter((d) => d.isFile())
+            .map((d) => d.name);
+    }
+    catch {
+        return [];
+    }
+    return names
+        .filter((n) => matchesRun(n, runId))
+        .sort()
+        .slice(0, MAX_DROP_FILES)
+        .map((n) => path.join(guard.absolute, n));
+}
+/**
+ * `<runId>_001.json`. The prefix must be followed by `_` — a bare `startsWith`
+ * would let `iterate-x` match `iterate-x-followup_001.json`, the same
+ * prefix-vs-exact confusion the log reader's EXACT `Run-ID` match avoids.
+ */
+function matchesRun(fileName, runId) {
+    return fileName.startsWith(`${runId}_`) && fileName.toLowerCase().endsWith(".json");
+}
+/**
+ * Drop a leading UTF-8 BOM.
+ *
+ * Written as an explicit code-point check rather than a literal BOM in the
+ * source, because a literal one is invisible in every editor and diff — the
+ * next person to touch this line would not be able to see what it matches.
+ */
+function stripBom(text) {
+    // A LOOP, not a single slice: an editor round-trip can stack more than one
+    // (each save prepending its own), and stripping exactly the first would leave
+    // `JSON.parse` throwing on the second — the valid-record-reported-as-malformed
+    // outcome the single-BOM fix already existed to prevent (cascade, cheap).
+    let i = 0;
+    while (i < text.length && text.charCodeAt(i) === 0xfeff)
+        i++;
+    return i === 0 ? text : text.slice(i);
+}
+function field(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const t = raw.trim();
+    if (t.length === 0)
+        return null;
+    return t.length > MAX_FIELD_CHARS ? `${t.slice(0, MAX_FIELD_CHARS)}\n\n…` : t;
+}
+const SECTIONS = [
+    { key: "context", heading: "Context" },
+    { key: "decision", heading: "Decision" },
+    { key: "rationale", heading: "Rationale" },
+    { key: "consequences", heading: "Consequences" },
+    { key: "rejected", heading: "Rejected alternatives" },
+    { key: "architecture_impact", heading: "Architecture impact" },
+];
+/**
+ * Render one drop as the Markdown the right panel shows.
+ *
+ * Deliberately NOT given an `ADR-NNN` heading: this decision has no number yet,
+ * and inventing one — even a plausible next-in-sequence — would be a fabricated
+ * identifier that a reader could cite. The caller carries `adrId: null` and the
+ * UI says so in words instead.
+ */
+function renderDrop(o) {
+    const title = field(o.title);
+    if (!title)
+        return null;
+    const lines = [`### ${title}`, ""];
+    const runId = field(o.run_id);
+    const date = field(o.date);
+    const section = field(o.section);
+    if (runId)
+        lines.push(`- **Run-ID:** ${runId}`);
+    if (date)
+        lines.push(`- **Date:** ${date}`);
+    if (section)
+        lines.push(`- **Section:** ${section}`);
+    if (lines.length > 2)
+        lines.push("");
+    for (const { key, heading } of SECTIONS) {
+        const v = field(o[key]);
+        if (!v)
+            continue;
+        lines.push(`**${heading}**`, "", v, "");
+    }
+    const commit = field(o.commit);
+    const specRef = field(o.spec_ref);
+    if (commit)
+        lines.push(`- **Commit:** \`${commit}\``);
+    if (specRef)
+        lines.push(`- **Record:** ${specRef}`);
+    const markdown = lines.join("\n").trimEnd();
+    return {
+        title,
+        markdown: markdown.length > MAX_ENTRY_CHARS ? `${markdown.slice(0, MAX_ENTRY_CHARS)}\n\n…` : markdown,
+    };
+}
+/**
+ * The decision-drops this run recorded but which no release has numbered yet.
+ *
+ * `unavailable` means the DIRECTORY could not be read — we know nothing either
+ * way. An `ok` with zero entries means the directory WAS read and holds nothing
+ * for this run, which is a real answer. The caller renders those differently,
+ * and keeping them apart is the entire point of this iterate.
+ *
+ * A single malformed drop is COUNTED, not fatal: one half-written file must
+ * never take down the decisions of a run that also recorded good ones.
+ */
+export function readRunDrops(projectRoot, runId) {
+    if (!isSafeRunId(runId))
+        return { status: "unavailable", reason: "denied" };
+    const guard = pathGuard(projectRoot, DECISION_DROPS_REL);
+    if (!guard.ok)
+        return { status: "unavailable", reason: "denied" };
+    let names;
+    try {
+        names = readdirSync(guard.absolute, { withFileTypes: true })
+            .filter((d) => d.isFile())
+            .map((d) => d.name);
+    }
+    catch (err) {
+        // The directory not existing is NOT a fault: no iterate has run F3 here yet.
+        // Anything else (permissions, an I/O error, a file where the dir should be)
+        // is a fault and must stay visible.
+        const code = err?.code;
+        if (code === "ENOENT")
+            return { status: "ok", entries: [], malformed: 0, truncated: false };
+        return { status: "unavailable", reason: "unreadable" };
+    }
+    const matched = names.filter((n) => matchesRun(n, runId)).sort();
+    const entries = [];
+    let malformed = 0;
+    let truncated = matched.length > MAX_DROP_FILES;
+    let totalChars = 0;
+    for (const fileName of matched.slice(0, MAX_DROP_FILES)) {
+        if (entries.length >= MAX_DROP_ENTRIES) {
+            truncated = true;
+            break;
+        }
+        const absolute = path.join(guard.absolute, fileName);
+        // The name came from readdir, but the entry can still be a symlink pointing
+        // out of the root — realPathGuard is what closes that (DO-NOT #10).
+        if (!realPathGuard(projectRoot, absolute).ok) {
+            malformed++;
+            continue;
+        }
+        const read = readBoundedFile(absolute, MAX_DROP_BYTES);
+        if (!read) {
+            malformed++;
+            continue;
+        }
+        let parsed;
+        try {
+            // Strip a UTF-8 BOM first. `JSON.parse` throws on it at character ZERO,
+            // so a BOM-prefixed drop would be reported as MALFORMED when it is a
+            // perfectly good decision — a valid record rendered as a read failure,
+            // which is this iterate's own defect family pointed at itself. Producers
+            // here are Python on Windows, and any editor round-trip can add one.
+            // (Found by a boundary probe, not by review.)
+            parsed = JSON.parse(stripBom(read.text));
+        }
+        catch {
+            malformed++;
+            continue;
+        }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            malformed++;
+            continue;
+        }
+        const o = parsed;
+        // The FILENAME claims a run; the CONTENT is what we believe. A drop whose
+        // `run_id` disagrees with its name is not this run's decision.
+        //
+        // NOT counted as malformed: this file read fine and parsed fine, so
+        // "N further records could not be read" would be simply untrue of it. It is
+        // in exactly the same category as a file whose NAME does not match, which we
+        // also pass over in silence — it is another run's record, not a damaged one
+        // (cascade, cheap). The content is still never surfaced.
+        if (field(o.run_id) !== runId) {
+            continue;
+        }
+        const rendered = renderDrop(o);
+        if (!rendered) {
+            malformed++;
+            continue;
+        }
+        if (totalChars + rendered.markdown.length > MAX_TOTAL_CHARS) {
+            // Stop rather than clip mid-entry, and SAY that entries were omitted.
+            truncated = true;
+            break;
+        }
+        totalChars += rendered.markdown.length;
+        entries.push({ fileName, title: rendered.title, markdown: rendered.markdown });
+    }
+    return { status: "ok", entries, malformed, truncated };
+}
+//# sourceMappingURL=decision-drops.js.map

package/server/dist/core/mission-context/decision-drops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-drops.js","sourceRoot":"","sources":["../../../src/core/mission-context/decision-drops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AAE1E,0EAA0E;AAC1E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,oEAAoE;AACpE,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAElC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,mFAAmF;AACnF,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC;;;;;GAKG;AACH,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC;AAEnC,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAmBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,KAAa;IAC9D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACzB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACzD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SACnC,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,QAAgB,EAAE,KAAa;IACjD,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,CAAC,EAAE,CAAC;IAC7D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,KAAK,CAAC,GAAY;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,QAAQ,GAAuC;IACnD,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IACtC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE;IACxC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE;IAC1C,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE;IAChD,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE;IACrD,EAAE,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,EAAE;CAC/D,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,CAA0B;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAa,CAAC,OAAO,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAChD,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAErC,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,IAAI,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,OAAO;QACL,KAAK;QACL,QAAQ,EACN,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;KAC9F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,KAAa;IAC7D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE5E,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAElE,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACzD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,4EAA4E;QAC5E,oCAAoC;QACpC,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,CAAC;QACzD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;IAChD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACvC,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,4EAA4E;QAC5E,oEAAoE;QACpE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7C,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,yEAAyE;YACzE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,0EAA0E;QAC1E,+DAA+D;QAC/D,EAAE;QACF,oEAAoE;QACpE,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,yDAAyD;QACzD,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YAC5D,sEAAsE;YACtE,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;QACD,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC"}

package/server/dist/core/mission-context/decisions.d.ts

@@ -0,0 +1,91 @@
+import type { DecisionEntryView } from "./types-slice2.js";
+export declare const DECISION_LOG_REL = ".shipwright/agent_docs/decision_log.md";
+/** One iterate records a handful of ADRs. 20 is a generous, bounded ceiling. */
+export declare const MAX_DECISION_ENTRIES = 20;
+export interface DecisionEntry {
+    /** `ADR-070`, `ADR-045b` — as written in the heading. */
+    adrId: string;
+    /** Heading text after the id. May be empty when the heading carried none. */
+    title: string;
+    /** The ADR block's own Markdown, ready for `DocumentMarkdown`. */
+    markdown: string;
+}
+export type DecisionsLookup = {
+    status: "ok";
+    entries: DecisionEntry[];
+    truncated: boolean;
+} | {
+    status: "unavailable";
+    reason: "missing" | "too_large" | "denied";
+};
+/** Absolute path to the decision log — used for `sourceRev` probing. */
+export declare function decisionLogPath(projectRoot: string): string;
+/** The Run-ID this block declares, or null when it declares none. */
+export declare function blockRunId(block: string): string | null;
+interface RawBlock {
+    adrId: string;
+    title: string;
+    lines: string[];
+}
+/**
+ * Split the log into ADR blocks. Exported for direct unit testing — the
+ * splitting rule is the fragile part and deserves its own cases.
+ */
+export declare function splitAdrBlocks(text: string): RawBlock[];
+/**
+ * The ADRs this run recorded.
+ *
+ * `unavailable` means the log itself could not be read. An `ok` with zero
+ * entries means the log WAS read and this run recorded no ADR — a real, honest
+ * answer, and the caller renders the two cases differently.
+ */
+export declare function readRunDecisions(projectRoot: string, runId: string): DecisionsLookup;
+/**
+ * What the DECISIONS artifact is built from, after both sources are consulted.
+ *
+ * `sawUnreadable` is the field that keeps the S1/S2 failure shape out of this
+ * module: a source that EXISTED and could not be read is a fault, and the
+ * builder must be able to tell that apart from "both sources read fine and this
+ * run decided nothing". Collapsing the two is exactly how a read failure ends up
+ * rendered as an absence.
+ */
+export interface DecisionRecord {
+    entries: DecisionEntryView[];
+    truncated: boolean;
+    malformedCount: number;
+    sawUnreadable: boolean;
+    /**
+     * A loss that `malformedCount` does NOT account for: an unreadable log, an
+     * unreadable drops directory, or a scan cut short by a cap.
+     *
+     * Separate from `sawUnreadable` because the two drive different sentences. A
+     * count can be stated ("2 further records could not be read"); these cannot,
+     * and folding them into the count would let a number silently stand in for
+     * "and also, an entire source we never read".
+     */
+    logOrScanLoss: boolean;
+}
+/**
+ * The run's decisions from **drops ∪ decision_log**, merged PER ENTRY.
+ *
+ * The dedupe granularity is the load-bearing detail, and an earlier version got
+ * it wrong: it keyed on the RUN, returning early whenever the log held any entry
+ * for this run and never reading the drops at all. The record's true granularity
+ * is run + `_NNN`, and those coincide only if aggregation were all-or-nothing.
+ * It is not — `aggregate_decisions.py` snapshots the drops it will fold, writes
+ * them, then unlinks them ONE AT A TIME, so a drop written mid-aggregation is
+ * never snapshotted and simply stays on disk. A run could therefore have `_001`
+ * published and `_002` still pending, and the run-level short-circuit rendered
+ * the first while the second vanished with `sawUnreadable: false` — a decision
+ * lost silently, by the function written to stop decisions being lost silently.
+ *
+ * So: read BOTH, always. A drop whose TITLE matches a published entry has been
+ * folded and is suppressed as the duplicate it is (`format_entry` renders the
+ * drop's own `title` as the ADR heading, and a drop with no title never becomes
+ * an entry here, so the join holds for exactly the drops we would render). Every
+ * other drop is still pending and renders unnumbered. The log wins on conflict;
+ * it no longer wins on mere presence.
+ */
+export declare function readRunDecisionRecord(projectRoot: string, runId: string): DecisionRecord;
+export {};
+//# sourceMappingURL=decisions.d.ts.map

package/server/dist/core/mission-context/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/decisions.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,gBAAgB,2CAA2C,CAAC;AAKzE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAMvC,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;CAAE,CAAC;AAE1E,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE3D;AA4BD,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASvD;AAED,UAAU,QAAQ;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAsBvD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,CAqCpF;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AAOD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAuDxF"}