@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/mission-context/review-record-entry.js

@@ -0,0 +1,214 @@
+/*
+ * core/mission-context/review-record-entry.ts — ONE producer entry becomes ONE
+ * wire row, or a reason it cannot.
+ *
+ * Split out of `review-record.ts` (iterate-2026-07-31-review-record-tolerant-reader)
+ * along the seam the change itself exposed. The two modules answer two different
+ * questions and only one of them just changed:
+ *
+ *   review-record.ts   is this FILE a record for this run?  (path, size, JSON,
+ *                      version, run identity, which passes it carries)
+ *   review-record-entry.ts  is this ENTRY a row?             (this module)
+ *
+ * That the reader now accepts review types it has never heard of is a statement
+ * about the first question ONLY. An unrecognised pass is mapped by the SAME
+ * function, against the SAME vocabularies, as a pinned one — which is why
+ * `toRow` takes a plain `string` and not a member of a closed union. Tolerance
+ * lives at the key; this file stays total.
+ */
+const MAX_TEXT = 4000;
+const MAX_SHORT = 400;
+/**
+ * Producer status → wire status. A MAP rather than a set-plus-cast: the cast
+ * severed the only link between the runtime vocabulary and the `ReviewStatus`
+ * union, so a sixth producer status would have flowed through onto the wire and
+ * hit the client's exhaustive `reviewStatusWord` switch, which returns undefined
+ * and renders a review with NO status word at all. This way it is a compile
+ * error instead.
+ */
+const PRODUCER_STATUS = {
+    // "nobody has answered yet" is not a result — it is the absence of one.
+    pending: "unavailable",
+    completed: "completed",
+    not_run: "not_run",
+    not_applicable: "not_applicable",
+};
+const PARSE_STATUSES = new Set(["structured", "partial", "unstructured"]);
+/** Terminal statuses the producer guarantees carry a reason. */
+const NEEDS_DISPOSITION = new Set(["not_run", "not_applicable"]);
+/**
+ * Bound what one row can push into a 420px panel; disclosed, never silent —
+ * `truncated` is set and `findingsCount` keeps the FULL number, so the summary
+ * arithmetic stays right and the panel says it is showing fewer.
+ *
+ * Sized when the list was five rows fixed. The list is now bounded at 32, so the
+ * aggregate ceiling is 1600 rather than 250 (Stage-3 doubt, D7). Left as it is:
+ * the per-row cap is about one row's share of the panel, which did not change,
+ * and every row past the first few is scrolled to rather than seen.
+ */
+const MAX_FINDINGS_PER_ROW = 50;
+const SEVERITIES = new Set(["high", "medium", "low"]);
+const PENDING_NOTE = "This review has not answered yet — the run recorded no result for it.";
+function str(value, max = MAX_TEXT) {
+    return typeof value === "string" && value.trim().length > 0
+        ? value.trim().slice(0, max)
+        : null;
+}
+/**
+ * `file` + `line` joined once, server-side, so the client never formats a
+ * location. A file with no line is still a location worth showing.
+ */
+function location(file, line) {
+    const filePath = str(file, MAX_SHORT);
+    if (!filePath)
+        return null;
+    return typeof line === "number" && Number.isFinite(line) && line > 0
+        ? `${filePath}:${Math.trunc(line)}`
+        : filePath;
+}
+function toFinding(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const o = raw;
+    const title = str(o.finding);
+    if (!title)
+        return null;
+    const severity = typeof o.severity === "string" && SEVERITIES.has(o.severity)
+        ? o.severity
+        : null;
+    return {
+        severity,
+        title,
+        location: location(o.file, o.line),
+        suggestion: str(o.suggestion),
+    };
+}
+/**
+ * How many review entries sit under record-level keys the caller does not read
+ * (Stage-3 doubt, D2).
+ *
+ * Recognising an entry BY SHAPE is this module's knowledge, which is why the
+ * walk lives here. Not hypothetical: the producer parks its Stage-1 gate in a
+ * sibling `gates` object TODAY and no webui code has ever looked at it, so a run
+ * whose spec gate found five things — two of them blocking — summarises as if
+ * they did not exist. Shape, not the name `gates`, so the NEXT sibling is
+ * disclosed the day it appears rather than the day somebody notices.
+ */
+export function unreadPassCount(record, knownKeys) {
+    let count = 0;
+    for (const [key, value] of Object.entries(record)) {
+        if (knownKeys.has(key))
+            continue;
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            continue;
+        for (const entry of Object.values(value)) {
+            if (entry && typeof entry === "object" && "review_type" in entry)
+                count += 1;
+        }
+    }
+    return count;
+}
+/**
+ * A pass this build has never heard of whose ENTRY does not validate.
+ *
+ * Tolerance is per-key; without this, FAILURE would be per-record — one unknown
+ * word in one unrecognised pass would replace five perfectly-parsed rows with an
+ * integrity fault. The priors differ by object: for a PINNED pass an unknown
+ * field value really is more likely corruption, but for a pass this build does
+ * not know, it is more likely the same evolution the key tolerance exists for,
+ * and the costs are asymmetric — calling evolution corruption destroys five
+ * healthy rows, calling corruption evolution costs one row already unknown
+ * (Stage-3 doubt, D5).
+ *
+ * The row is PRESENT and explicitly unreadable, never dropped, and
+ * `buildReviewArtifact` already folds an `unavailable` row into "their result is
+ * unknown". A malformed KEY is still a record-level fault: the key is the row's
+ * identity, and there is no honest row to degrade to without one.
+ */
+export function unreadableStranger(reviewType) {
+    return {
+        reviewType,
+        status: "unavailable",
+        findingsCount: null,
+        findings: [],
+        provider: null,
+        completedAt: null,
+        disposition: null,
+        note: "This run recorded this review pass in a form this version cannot read, so its result is not shown here.",
+        parseStatus: null,
+        source: "record",
+        truncated: false,
+    };
+}
+/**
+ * Map one producer entry. A `pending` type becomes `unavailable` with a count of
+ * `null`: nobody has answered, and rendering that as a completed review with
+ * zero findings is the exact "0 reads as clean" failure this artifact exists to
+ * prevent.
+ *
+ * Returns the row, or a STRING naming the first thing wrong with the entry —
+ * which the caller reports as an integrity fault for the whole record. That is
+ * deliberate for an unrecognised pass too: not knowing what a pass is called is
+ * evolution, but a pass whose own fields contradict each other is corruption,
+ * and answering corruption with a partial record would be the quiet lie.
+ */
+export function toRow(reviewType, entry) {
+    if (entry.review_type !== reviewType) {
+        return `reviews.${reviewType}.review_type is ${String(entry.review_type)}`;
+    }
+    const status = typeof entry.status === "string" ? entry.status : "";
+    const wireStatus = PRODUCER_STATUS[status];
+    if (!wireStatus) {
+        return `reviews.${reviewType}.status ${String(entry.status)} is not a known status`;
+    }
+    const rawFindings = entry.findings;
+    if (!Array.isArray(rawFindings))
+        return `reviews.${reviewType}.findings is not a list`;
+    if (entry.findings_count !== rawFindings.length) {
+        return `reviews.${reviewType}.findings_count disagrees with its own list`;
+    }
+    const findings = [];
+    for (const raw of rawFindings) {
+        const finding = toFinding(raw);
+        if (!finding)
+            return `reviews.${reviewType} has a finding with no text`;
+        findings.push(finding);
+    }
+    // An UNKNOWN parse_status is a schema fault, not something to normalize to
+    // null: silently dropping it would turn "we do not know how well this parsed"
+    // into "it parsed fine".
+    const parseStatusRaw = entry.parse_status;
+    if (parseStatusRaw !== null && parseStatusRaw !== undefined
+        && !(typeof parseStatusRaw === "string" && PARSE_STATUSES.has(parseStatusRaw))) {
+        return `reviews.${reviewType}.parse_status ${String(parseStatusRaw)} is not a known value`;
+    }
+    const parseStatus = (typeof parseStatusRaw === "string" ? parseStatusRaw : null);
+    const disposition = str(entry.disposition, 2000);
+    if (NEEDS_DISPOSITION.has(status) && !disposition) {
+        return `reviews.${reviewType} is ${status} but records no reason`;
+    }
+    // The producer guarantees an unstructured parse itemized NOTHING. A record
+    // claiming otherwise is internally inconsistent, and rendering it would show a
+    // finding list under a caveat saying the findings could not be listed.
+    if (parseStatus === "unstructured" && findings.length > 0) {
+        return `reviews.${reviewType} is unstructured yet carries itemized findings`;
+    }
+    if (findings.length > MAX_FINDINGS_PER_ROW) {
+        findings.length = MAX_FINDINGS_PER_ROW;
+    }
+    const pending = status === "pending";
+    return {
+        reviewType,
+        status: wireStatus,
+        findingsCount: pending ? null : Number(entry.findings_count),
+        findings,
+        truncated: Number(entry.findings_count) > findings.length,
+        provider: str(entry.provider, 120),
+        completedAt: str(entry.completed_at, 64),
+        disposition,
+        note: pending ? PENDING_NOTE : null,
+        parseStatus,
+        source: "record",
+    };
+}
+//# sourceMappingURL=review-record-entry.js.map

package/server/dist/core/mission-context/review-record-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-record-entry.js","sourceRoot":"","sources":["../../../src/core/mission-context/review-record-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,eAAe,GAA6C;IAChE,wEAAwE;IACxE,OAAO,EAAE,aAAa;IACtB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACjC,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAE1E,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEtD,MAAM,YAAY,GAChB,uEAAuE,CAAC;AAE1E,SAAS,GAAG,CAAC,KAAc,EAAE,GAAG,GAAG,QAAQ;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,IAAa,EAAE,IAAa;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;QAClE,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;QACnC,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,CAAC,CAAC,CAAC,CAAC,QAAQ;QACZ,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,QAAQ;QACR,KAAK;QACL,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA+B,EAC/B,SAA8B;IAE9B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QAC1E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YACpE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,IAAI,KAAK;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO;QACL,UAAU;QACV,MAAM,EAAE,aAAa;QACrB,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,yGAAyG;QAC/G,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,KAAK,CAAC,UAAkB,EAAE,KAA8B;IACtE,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,WAAW,UAAU,mBAAmB,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,WAAW,UAAU,WAAW,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAAC;IACtF,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,UAAU,yBAAyB,CAAC;IACvF,IAAI,KAAK,CAAC,cAAc,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QAChD,OAAO,WAAW,UAAU,6CAA6C,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,UAAU,6BAA6B,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,yBAAyB;IACzB,MAAM,cAAc,GAAG,KAAK,CAAC,YAAY,CAAC;IAC1C,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS;WACpD,CAAC,CAAC,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,WAAW,UAAU,iBAAiB,MAAM,CAAC,cAAc,CAAC,uBAAuB,CAAC;IAC7F,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAEvE,CAAC;IAET,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAClD,OAAO,WAAW,UAAU,OAAO,MAAM,wBAAwB,CAAC;IACpE,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,uEAAuE;IACvE,IAAI,WAAW,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,WAAW,UAAU,gDAAgD,CAAC;IAC/E,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC3C,QAAQ,CAAC,MAAM,GAAG,oBAAoB,CAAC;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC;IACrC,OAAO;QACL,UAAU;QACV,MAAM,EAAE,UAAU;QAClB,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QAC5D,QAAQ;QACR,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAC,MAAM;QACzD,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;QAClC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;QACxC,WAAW;QACX,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QACnC,WAAW;QACX,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC"}

package/server/dist/core/mission-context/review-record.d.ts

@@ -0,0 +1,35 @@
+import type { ReviewRow } from "./types-slice2.js";
+/**
+ * Contract order — `self` first: it is the one review that always runs.
+ *
+ * `as const` rather than `ReviewType[]`: `ReviewType` now admits any string, so
+ * the annotation that used to catch a typo here would no longer catch anything.
+ *
+ * EXPORTED because `review-state.ts` needs the same order for its marker
+ * fallback. Two independently-written literals would now drift silently — with
+ * the annotation gone, nothing would fail if the record path and the marker path
+ * disagreed about which five passes exist.
+ */
+export declare const REVIEW_TYPES: readonly ["self", "plan", "code", "doubt", "external_code"];
+export type ReviewRecordResult = {
+    kind: "valid";
+    rows: ReviewRow[];
+    caveats: string[];
+} | {
+    kind: "absent";
+} | {
+    kind: "invalid";
+    reason: string;
+};
+/** Absolute path of the record — also probed for `sourceRev` so a late write refreshes. */
+export declare function reviewRecordPath(projectRoot: string, runId: string): string | null;
+/**
+ * Read + validate the run's review record.
+ *
+ * Validation is total on purpose: a record that passes here is one the UI may
+ * render without re-checking, and `run_id` is verified against the REQUESTED run
+ * because a stale or copied file sitting at a valid guarded path would otherwise
+ * be presented as this run's review history.
+ */
+export declare function readReviewRecord(projectRoot: string, runId: string): ReviewRecordResult;
+//# sourceMappingURL=review-record.d.ts.map

package/server/dist/core/mission-context/review-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-record.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/review-record.ts"],"names":[],"mappings":"AA4EA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,6DAA8D,CAAC;AA2CxF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAGxC,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlF;AAMD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAiIvF"}

package/server/dist/core/mission-context/review-record.js

@@ -0,0 +1,259 @@
+/*
+ * core/mission-context/review-record.ts — the per-run REVIEW RECORD reader.
+ *
+ * ── WHAT CHANGED ───────────────────────────────────────────────────────────
+ * Slice 2 shipped Review from the two `external_*review_state.json` markers and
+ * represented the internal self / code / doubt passes explicitly as unavailable,
+ * because no clean source existed (see `review-state.ts` for that decision and
+ * why guessing one would have been worse). The producer side has since closed
+ * the gap: every iterate now writes
+ *
+ *     .shipwright/planning/iterate/<run_id>/reviews.json
+ *
+ * keyed by review type, carrying INDIVIDUAL FINDINGS, immutable once a pass has
+ * answered. This module reads it. `review-state.ts` keeps the marker path
+ * untouched as the fallback for the runs that predate the record.
+ *
+ * ── absent vs. invalid, and why it is a discriminated result ───────────────
+ * Only a VERIFIED MISSING FILE may fall back to the markers. Bad JSON, a record
+ * naming another run, an unknown schema version, a count that disagrees with its
+ * own list — each is an integrity fault, and answering one by quietly reading
+ * the weaker source would present a corrupt record as a review history. So the
+ * reader returns `valid | absent | invalid` and never a bare null.
+ *
+ * ── validation mirrors the producer's own ──────────────────────────────────
+ * The two repositories never import each other (DO-NOT #7), so this re-states
+ * the producer's schema check rather than sharing it. That duplication is the
+ * price of the boundary; the protection against drift is the fixture in
+ * `test/fixtures/reviews-record-real.json`, copied verbatim from real producer
+ * output rather than written here.
+ *
+ * ── forward tolerance, and exactly where it stops ──────────────────────────
+ * (iterate-2026-07-31-review-record-tolerant-reader.) This reader used to pin
+ * `schema_version` with `!==` and reject any `reviews` key outside its own five.
+ * Because an invalid record does NOT degrade to the marker view — it renders
+ * every row as a data-integrity fault — those two lines made the pinned five
+ * unable to grow: a sixth pass would have reported every healthy record as
+ * corrupt. So the producer parked its Stage-1 spec-compliance gate in a sibling
+ * `gates` object nobody reads, and said so in its own source, naming the release
+ * condition: "Promotion into REVIEW_TYPES — one line here, one there — becomes
+ * safe as soon as the webui ships a reader that tolerates unknown review types."
+ *
+ * Both gates therefore move, and NOTHING else does:
+ *   - the version is a FLOOR (`>=`), not a pin;
+ *   - an unrecognised review key is mapped and rendered, not rejected.
+ *
+ * The version number is not what protects this reader and never was — every
+ * entry, pinned or not, still goes through the same total `toRow`. A future
+ * record that RESHAPED an entry is rejected on that entry's own fields no matter
+ * what version it claims.
+ *
+ * ── where that argument STOPS (Stage-3 doubt, D1) ─────────────────────────
+ * It covers reshapes and NOT additions — and additions are what the producer's
+ * contract actually promises. `toRow` reads the fields it names and ignores
+ * every other one, so an added field carrying the real answer (`verdict:
+ * "blocked"` beside `status: "completed"`) would be dropped and the pass drawn
+ * as a clean run. The `!==` pin caught that by refusing the record; nothing else
+ * ever did. So forward-reading is DISCLOSED, not silent: a version past
+ * `MAX_KNOWN_RECORD_SCHEMA_VERSION`, or passes recorded where this reader does
+ * not look, each add a `caveat` that `buildReviewArtifact` appends to the
+ * summary. That is the house rule of the whole feature (`truncated`,
+ * `manifestStatus`, `parseStatus`): read what you can, say what you could not.
+ *
+ * ── the pinned five are FROZEN (Stage-3 doubt, D4) ────────────────────────
+ * Tolerance is additive ONLY. `REVIEW_TYPES` may never shrink or be renamed —
+ * the assembly below requires all five and calls the record unreadable if one is
+ * absent, so renaming `external_code` blanks the whole card rather than adding a
+ * row. A superseded pass keeps its key and closes with a disposition.
+ */
+import { statSync } from "node:fs";
+import path from "node:path";
+import { readBoundedFile } from "./fs-read.js";
+import { toRow, unreadPassCount, unreadableStranger } from "./review-record-entry.js";
+import { pathGuard, realPathGuard } from "../path-guard.js";
+import { isSafeRunId } from "./pointer.js";
+/**
+ * Contract order — `self` first: it is the one review that always runs.
+ *
+ * `as const` rather than `ReviewType[]`: `ReviewType` now admits any string, so
+ * the annotation that used to catch a typo here would no longer catch anything.
+ *
+ * EXPORTED because `review-state.ts` needs the same order for its marker
+ * fallback. Two independently-written literals would now drift silently — with
+ * the annotation gone, nothing would fail if the record path and the marker path
+ * disagreed about which five passes exist.
+ */
+export const REVIEW_TYPES = ["self", "plan", "code", "doubt", "external_code"];
+/**
+ * The OLDEST version this reader can read, not the only one. Anything newer is
+ * additive by the producer's contract and is read; anything older never existed.
+ */
+const MIN_RECORD_SCHEMA_VERSION = 1;
+/**
+ * The newest version whose fields this reader actually KNOWS. Beyond it the
+ * record is still read — that is the point — but the fact is disclosed, because
+ * a field added past this line is one `toRow` drops on the floor.
+ */
+const MAX_KNOWN_RECORD_SCHEMA_VERSION = 1;
+/** Record-level keys this reader understands; anything else may hold passes. */
+const KNOWN_RECORD_KEYS = new Set(["schema_version", "run_id", "reviews"]);
+/**
+ * What an unrecognised review key may look like. Permissive on purpose — the
+ * point of this whole change is that the producer may name a pass something this
+ * reader has not heard of — but a key is still an IDENTIFIER, so `__proto__`,
+ * an empty string, a path fragment and a paragraph of prose are corruption
+ * rather than evolution, and are reported as such.
+ */
+const REVIEW_KEY = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+/**
+ * Aggregate bound on how many passes one record may carry (external plan review,
+ * finding 3: unknown keys make a previously five-row structure unbounded). Going
+ * over is an integrity fault and NOT a silent truncation: a review pass dropped
+ * on the floor is precisely the invisible-review failure this artifact exists to
+ * prevent, so the record says it cannot be trusted instead of quietly shrinking.
+ */
+const MAX_REVIEW_TYPES = 32;
+/**
+ * 2 MB. The marker bound (256 KB) was tuned for a few hundred bytes; a real
+ * 46-finding record measures 46 KB, so that ceiling was one noisy run away from
+ * turning a healthy record into a false integrity fault.
+ */
+const MAX_RECORD_BYTES = 2 * 1024 * 1024;
+/** Absolute path of the record — also probed for `sourceRev` so a late write refreshes. */
+export function reviewRecordPath(projectRoot, runId) {
+    if (!isSafeRunId(runId))
+        return null;
+    return path.join(projectRoot, ".shipwright", "planning", "iterate", runId, "reviews.json");
+}
+function invalid(reason) {
+    return { kind: "invalid", reason };
+}
+/**
+ * Read + validate the run's review record.
+ *
+ * Validation is total on purpose: a record that passes here is one the UI may
+ * render without re-checking, and `run_id` is verified against the REQUESTED run
+ * because a stale or copied file sitting at a valid guarded path would otherwise
+ * be presented as this run's review history.
+ */
+export function readReviewRecord(projectRoot, runId) {
+    if (!isSafeRunId(runId))
+        return invalid("run id is not safe to resolve");
+    const rel = [".shipwright", "planning", "iterate", runId, "reviews.json"].join("/");
+    const guard = pathGuard(projectRoot, rel);
+    if (!guard.ok)
+        return invalid("the record path could not be resolved safely");
+    // ENOENT — and ONLY ENOENT — is an absence the markers may answer.
+    //
+    // `existsSync` cannot make that distinction: it swallows EVERY error and
+    // returns false, so an unreadable record (EACCES, a broken symlink, a
+    // directory where a file belongs) would report "absent" and silently hand the
+    // question to the weaker source. That is the downgrade this whole reader
+    // exists to prevent, so the errno is inspected instead.
+    try {
+        const stats = statSync(guard.absolute);
+        if (!stats.isFile())
+            return invalid("the record path is not a file");
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ENOENT")
+            return { kind: "absent" };
+        return invalid(`the record could not be inspected (${code ?? "unknown error"})`);
+    }
+    // The documented pair: pathGuard is string-only, so realPathGuard is what
+    // refuses a symlink pointing out of the project (DO-NOT #10).
+    if (!realPathGuard(projectRoot, guard.absolute).ok) {
+        return invalid("the record resolves outside the project");
+    }
+    const read = readBoundedFile(guard.absolute, MAX_RECORD_BYTES);
+    if (!read)
+        return invalid("the record could not be read within its size bound");
+    let parsed;
+    try {
+        parsed = JSON.parse(read.text);
+    }
+    catch {
+        return invalid("the record is not valid JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return invalid("the record is not an object");
+    }
+    const record = parsed;
+    const version = record.schema_version;
+    // `>=`, not `===`. See the forward-tolerance note in the file header: an older
+    // version never existed, a newer one is additive, and a reshaped entry is
+    // caught by `toRow` rather than by this number.
+    if (!Number.isInteger(version) || version < MIN_RECORD_SCHEMA_VERSION) {
+        return invalid(`record schema_version ${String(version)} is not a version this reader can read`);
+    }
+    if (record.run_id !== runId) {
+        return invalid(`the record names run ${String(record.run_id)}, not ${runId}`);
+    }
+    const reviews = record.reviews;
+    if (!reviews || typeof reviews !== "object" || Array.isArray(reviews)) {
+        return invalid("the record has no reviews object");
+    }
+    const byType = reviews;
+    // `Object.keys` is own-enumerable only, so nothing inherited can become a row.
+    const keys = Object.keys(byType);
+    if (keys.length > MAX_REVIEW_TYPES) {
+        return invalid(`the record carries ${keys.length} review passes, more than any run has`);
+    }
+    const strangers = keys.filter((k) => !REVIEW_TYPES.includes(k));
+    const malformed = strangers.filter((k) => !REVIEW_KEY.test(k));
+    if (malformed.length > 0) {
+        return invalid(`the record has a review key that is not an identifier: ${malformed.join(", ")}`);
+    }
+    // The pinned five FIRST, in contract order (AC4 of the Review artifact), then
+    // the passes this reader has not heard of, in the record's own key order. A
+    // stranger is appended rather than interleaved so the order the UI has always
+    // rendered is exactly the order it still renders.
+    //
+    // The five come from REVIEW_TYPES and NOT from the record's own keys. That
+    // looks like a stylistic choice and is not: iterating `keys` is shorter and
+    // silently stops detecting a record MISSING a pinned pass — the check that
+    // keeps a dropped or renamed pass loud instead of quietly rendering four rows
+    // as if five had been considered.
+    const rows = [];
+    for (const reviewType of REVIEW_TYPES) {
+        // `hasOwnProperty` guards something the `Object.keys` filter above does not:
+        // these lookups are by literal name, so a globally polluted
+        // `Object.prototype` could otherwise hand back a shadowing value for a key
+        // this record never carried.
+        const entry = Object.prototype.hasOwnProperty.call(byType, reviewType)
+            ? byType[reviewType]
+            : undefined;
+        if (entry === undefined || entry === null) {
+            return invalid(`the record is missing the ${reviewType} review`);
+        }
+        if (typeof entry !== "object" || Array.isArray(entry)) {
+            return invalid(`reviews.${reviewType} is not an object`);
+        }
+        const row = toRow(reviewType, entry);
+        if (typeof row === "string")
+            return invalid(row);
+        rows.push(row);
+    }
+    // A stranger is own by construction (it came from `Object.keys`), so it is
+    // never actually missing — and its entry failing is bounded to its own row.
+    for (const reviewType of strangers) {
+        const entry = byType[reviewType];
+        const row = entry && typeof entry === "object" && !Array.isArray(entry)
+            ? toRow(reviewType, entry)
+            : `reviews.${reviewType} is not an object`;
+        rows.push(typeof row === "string" ? unreadableStranger(reviewType) : row);
+    }
+    const caveats = [];
+    if (version > MAX_KNOWN_RECORD_SCHEMA_VERSION) {
+        caveats.push("This run's review record was written by a newer Shipwright, so a pass may " +
+            "carry detail this version does not know how to show.");
+    }
+    const unread = unreadPassCount(record, KNOWN_RECORD_KEYS);
+    if (unread > 0) {
+        caveats.push(`This run also recorded ${unread} review ${unread === 1 ? "pass" : "passes"} ` +
+            "somewhere this version does not read, so they are not counted above.");
+    }
+    return { kind: "valid", rows, caveats };
+}
+//# sourceMappingURL=review-record.js.map

package/server/dist/core/mission-context/review-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-record.js","sourceRoot":"","sources":["../../../src/core/mission-context/review-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,CAAU,CAAC;AAExF;;;GAGG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAE1C,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAQzC,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,KAAa;IACjE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,KAAa;IACjE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAEzE,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAE9E,mEAAmE;IACnE,EAAE;IACF,yEAAyE;IACzE,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,sCAAsC,IAAI,IAAI,eAAe,GAAG,CAAC,CAAC;IACnF,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC,yCAAyC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,oDAAoD,CAAC,CAAC;IAEhF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC;IACtC,+EAA+E;IAC/E,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAK,OAAkB,GAAG,yBAAyB,EAAE,CAAC;QAClF,OAAO,OAAO,CACZ,yBAAyB,MAAM,CAAC,OAAO,CAAC,wCAAwC,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAElD,+EAA+E;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,sBAAsB,IAAI,CAAC,MAAM,uCAAuC,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,YAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,0DAA0D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,kDAAkD;IAClD,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,kCAAkC;IAClC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,6EAA6E;QAC7E,4DAA4D;QAC5D,2EAA2E;QAC3E,6BAA6B;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;YACpE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YACpB,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,6BAA6B,UAAU,SAAS,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC,WAAW,UAAU,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,EAAE,KAAgC,CAAC,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAgC,CAAC;YACrD,CAAC,CAAC,WAAW,UAAU,mBAAmB,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAK,OAAkB,GAAG,+BAA+B,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,4EAA4E;YAC1E,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,0BAA0B,MAAM,WAAW,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG;YAC5E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC"}

package/server/dist/core/mission-context/review-state.d.ts

@@ -0,0 +1,33 @@
+import type { ReviewRow } from "./types-slice2.js";
+/** Directory holding a run's review markers. */
+export declare function reviewStateDir(projectRoot: string, runId: string): string;
+/** Absolute marker paths — used for `sourceRev` probing so a late review refreshes. */
+export declare function reviewStatePaths(projectRoot: string, runId: string): string[];
+export interface ReviewLookup {
+    rows: ReviewRow[];
+    /** At least one marker carried a real, readable record. */
+    hasRecord: boolean;
+    /** A marker existed but could not be read — an integrity signal, not absence. */
+    sawUnreadable: boolean;
+    /**
+     * What the reader could NOT read, said out loud (Stage-3 doubt, D1/D2) —
+     * appended to the artifact summary. Empty on the marker path.
+     */
+    caveats: string[];
+}
+/**
+ * All five review types for `runId`, in contract order.
+ *
+ * **Precedence: the per-run record wins.** Since
+ * `iterate-2026-07-22-mission-review-record` the producer writes
+ * `.shipwright/planning/iterate/<run_id>/reviews.json` with real per-finding
+ * detail for all five passes, so the markers are now the FALLBACK — kept
+ * byte-for-byte as they were, because 64 existing runs depend on that behaviour.
+ *
+ * A record that is present but INVALID does not fall through. Answering a
+ * corrupt record with the weaker source would present a data-integrity fault as
+ * a review history; it is reported as unreadable instead, which the §6 state
+ * model renders as "currently unavailable".
+ */
+export declare function readReviewState(projectRoot: string, runId: string): ReviewLookup;
+//# sourceMappingURL=review-state.d.ts.map

package/server/dist/core/mission-context/review-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-state.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/review-state.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,mBAAmB,CAAC;AA6D/D,gDAAgD;AAChD,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ7E;AAyED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,2DAA2D;IAC3D,SAAS,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,aAAa,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAwChF"}