@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/mission-context/review-state.js

@@ -0,0 +1,249 @@
+/*
+ * core/mission-context/review-state.ts — the REVIEW source (CONTRACT §9.1,
+ * decided in Slice 2; campaign 2026-07-18-mission-artifacts).
+ *
+ * ── THE DECISION (Sven, 2026-07-18) ────────────────────────────────────────
+ * Ship Review from the sources that already have a CLEAN CONTRACT — the
+ * per-iterate `external_*review_state.json` markers written by
+ * `shared/scripts/checks/mark-review-state.py` — and represent the INTERNAL
+ * self / code / doubt passes explicitly as unavailable. The alternative
+ * (scraping the raw session JSONL for reviewer subagent output) has no stable
+ * contract; guessing one would fabricate review history, which is the single
+ * worst thing this artifact could do. The monorepo follow-up that gives the
+ * internal passes a real machine-readable record is filed as `trg-74ec44b8`.
+ *
+ * ── WHY "unavailable" AND NOT "not run" ────────────────────────────────────
+ * They are DIFFERENT facts and the §6 state model exists to keep them apart:
+ *
+ *   not_run      a marker EXISTS and says the pass was skipped (opt-out,
+ *                below threshold, missing keys). We know it did not run.
+ *   unavailable  we have no readable record either way. The pass may well
+ *                have run — we cannot see it.
+ *
+ * Rendering an unreadable pass as "clean" (or as a silent absence) would turn a
+ * data-integrity gap into a false assurance. That is the exact lie the state
+ * model was introduced to kill, and it is worth the extra enum value.
+ *
+ * MEASURED ON THIS REPO 2026-07-18: 55 marker files, ONE uniform shape
+ * (`status`, `timestamp`, `provider`, `findings_count`, `self_review_fallback_ran`,
+ * `reason`, `review_mode`). Note what it does NOT contain: a per-finding array.
+ * So `findings[]` is always empty here and `findingsCount` is the real number —
+ * the UI must show the count and say the details are not recorded, never
+ * render an empty list as "no findings".
+ */
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { readBoundedFile } from "./fs-read.js";
+import { REVIEW_TYPES, readReviewRecord, reviewRecordPath } from "./review-record.js";
+import { pathGuard } from "../path-guard.js";
+import { isSafeRunId } from "./pointer.js";
+/** Marker basenames, mapped to the review type each one records. */
+const MARKERS = [
+    { file: "external_review_state.json", type: "plan" },
+    { file: "external_code_review_state.json", type: "external_code" },
+];
+/** A marker is a few hundred bytes; 256 KB bounds a corrupt one generously. */
+const MAX_MARKER_BYTES = 256 * 1024;
+/**
+ * Contract order — `self` first; it is the one review that always runs.
+ *
+ * IMPORTED rather than restated: `ReviewType` now admits any string, so the
+ * `ReviewType[]` annotation this list used to carry would no longer catch a
+ * typo, and a second literal could drift from the record path's without
+ * anything failing.
+ */
+const REVIEW_TYPE_ORDER = REVIEW_TYPES;
+const RECORD_INTEGRITY_NOTE = "This run's review record exists but could not be read. That is a data " +
+    "problem, not a clean result.";
+/** Prose disposition can be long (a real one runs to a paragraph) — bound it. */
+const MAX_DISPOSITION_CHARS = 2000;
+/**
+ * The internal passes have no machine-readable record TODAY. Naming the
+ * follow-up in the note keeps the gap traceable instead of mysterious.
+ */
+const INTERNAL_NOTE = "The internal review passes do not yet write a machine-readable record, " +
+    "so this run's result cannot be shown. This is a known gap, not a clean result.";
+/** Byte-identical to `unreadableRow` but for its note — so it IS that call. */
+function internalRow(reviewType) {
+    return unreadableRow(reviewType, INTERNAL_NOTE);
+}
+function unreadableRow(reviewType, note) {
+    return {
+        reviewType,
+        status: "unavailable",
+        findingsCount: null,
+        findings: [],
+        provider: null,
+        completedAt: null,
+        disposition: null,
+        note,
+        parseStatus: null,
+        source: "marker",
+        truncated: false,
+    };
+}
+function asStr(v, max = 200) {
+    return typeof v === "string" && v.trim().length > 0 ? v.trim().slice(0, max) : null;
+}
+/** Directory holding a run's review markers. */
+export function reviewStateDir(projectRoot, runId) {
+    return path.join(projectRoot, ".shipwright", "planning", "iterate", runId);
+}
+/** Absolute marker paths — used for `sourceRev` probing so a late review refreshes. */
+export function reviewStatePaths(projectRoot, runId) {
+    if (!isSafeRunId(runId))
+        return [];
+    const dir = reviewStateDir(projectRoot, runId);
+    const recordPath = reviewRecordPath(projectRoot, runId);
+    return [
+        ...(recordPath ? [recordPath] : []),
+        ...MARKERS.map((m) => path.join(dir, m.file)),
+    ];
+}
+function readMarker(projectRoot, runId, marker) {
+    const rel = [".shipwright", "planning", "iterate", runId, marker.file].join("/");
+    const guard = pathGuard(projectRoot, rel);
+    if (!guard.ok) {
+        return { kind: "unreadable", row: unreadableRow(marker.type, "This review record could not be read safely.") };
+    }
+    if (!existsSync(guard.absolute))
+        return { kind: "absent" };
+    const read = readBoundedFile(guard.absolute, MAX_MARKER_BYTES);
+    if (!read) {
+        return { kind: "unreadable", row: unreadableRow(marker.type, "This review record could not be read.") };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(read.text);
+    }
+    catch {
+        return { kind: "unreadable", row: unreadableRow(marker.type, "This review record is not readable.") };
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return { kind: "unreadable", row: unreadableRow(marker.type, "This review record is not readable.") };
+    }
+    const o = parsed;
+    const raw = asStr(o.status, 64);
+    const completed = raw === "completed";
+    const count = typeof o.findings_count === "number" && Number.isFinite(o.findings_count)
+        ? Math.max(0, Math.trunc(o.findings_count))
+        : null;
+    return {
+        kind: "row",
+        row: {
+            reviewType: marker.type,
+            status: completed ? "completed" : "not_run",
+            // A count only means something for a review that actually ran.
+            findingsCount: completed ? count : null,
+            findings: [],
+            provider: asStr(o.provider, 120),
+            completedAt: asStr(o.timestamp, 64),
+            disposition: asStr(o.reason, MAX_DISPOSITION_CHARS),
+            // A completed review whose count we could NOT read needs a note of its
+            // own. Leaving it null let the row render as a bare "ran", which a
+            // reader completes as "…and found nothing" (internal code review).
+            note: completed
+                ? count == null
+                    ? "This review ran; its findings count was not recorded."
+                    : null
+                : notRunNote(raw),
+            parseStatus: null,
+            source: "marker",
+            truncated: false,
+        },
+    };
+}
+/** Turn the marker's machine status into something a non-expert can read. */
+function notRunNote(raw) {
+    if (!raw)
+        return "This review was recorded as not run.";
+    if (raw === "missing_keys")
+        return "Not run — the external reviewer was not configured.";
+    if (raw.startsWith("skipped_")) {
+        return `Not run — ${raw.slice("skipped_".length).replace(/_/g, " ")}.`;
+    }
+    return `Not run — recorded as “${raw}”.`;
+}
+/**
+ * All five review types for `runId`, in contract order.
+ *
+ * **Precedence: the per-run record wins.** Since
+ * `iterate-2026-07-22-mission-review-record` the producer writes
+ * `.shipwright/planning/iterate/<run_id>/reviews.json` with real per-finding
+ * detail for all five passes, so the markers are now the FALLBACK — kept
+ * byte-for-byte as they were, because 64 existing runs depend on that behaviour.
+ *
+ * A record that is present but INVALID does not fall through. Answering a
+ * corrupt record with the weaker source would present a data-integrity fault as
+ * a review history; it is reported as unreadable instead, which the §6 state
+ * model renders as "currently unavailable".
+ */
+export function readReviewState(projectRoot, runId) {
+    // Hoisted out of the marker path: the record read below rejects an unsafe run
+    // id too, so the marker path's own guard became unreachable AND its surviving
+    // branch would have claimed a record "exists but could not be read" for a file
+    // nobody ever probed.
+    if (!isSafeRunId(runId)) {
+        return {
+            rows: REVIEW_TYPE_ORDER.map((t) => unreadableRow(t, "This run could not be identified.")),
+            hasRecord: false,
+            sawUnreadable: true,
+            caveats: [],
+        };
+    }
+    const record = readReviewRecord(projectRoot, runId);
+    if (record.kind === "valid") {
+        return {
+            rows: record.rows,
+            // A record the producer JUST materialized has all five types `pending`,
+            // which map to `unavailable`. Reporting `hasRecord: true` for it made the
+            // artifact appear mid-run saying "No review was recorded as having run" —
+            // worse than the honest "not written yet" it replaced. `hasRecord` means
+            // "a source carried an actual answer", on this path as on the marker one.
+            hasRecord: record.rows.some((r) => r.status !== "unavailable"),
+            sawUnreadable: false,
+            caveats: record.caveats,
+        };
+    }
+    if (record.kind === "invalid") {
+        return {
+            rows: REVIEW_TYPE_ORDER.map((t) => unreadableRow(t, RECORD_INTEGRITY_NOTE)),
+            hasRecord: false,
+            // An integrity fault is a DETECTED problem, not an absence: `false` here
+            // would make buildReviewArtifact hide the artifact entirely and throw the
+            // fault away.
+            sawUnreadable: true,
+            caveats: [],
+        };
+    }
+    return readMarkerState(projectRoot, runId);
+}
+/**
+ * The pre-record path, unchanged: the two `external_*review_state.json` markers,
+ * with the internal passes represented explicitly as unavailable. Reached only
+ * when no record exists — i.e. runs that predate it.
+ */
+function readMarkerState(projectRoot, runId) {
+    const rows = [];
+    let hasRecord = false;
+    let sawUnreadable = false;
+    const byType = new Map();
+    for (const marker of MARKERS) {
+        const r = readMarker(projectRoot, runId, marker);
+        if (r.kind === "row") {
+            hasRecord = true;
+            byType.set(marker.type, r.row);
+        }
+        else if (r.kind === "unreadable") {
+            sawUnreadable = true;
+            byType.set(marker.type, r.row);
+        }
+        else {
+            byType.set(marker.type, unreadableRow(marker.type, "No record of this review was found for this run."));
+        }
+    }
+    // Contract order: plan · code · doubt · external_code.
+    rows.push(internalRow("self"), byType.get("plan"), internalRow("code"), internalRow("doubt"), byType.get("external_code"));
+    return { rows, hasRecord, sawUnreadable, caveats: [] };
+}
+//# sourceMappingURL=review-state.js.map

package/server/dist/core/mission-context/review-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-state.js","sourceRoot":"","sources":["../../../src/core/mission-context/review-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,oEAAoE;AACpE,MAAM,OAAO,GAA4E;IACvF,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,MAAM,EAAE;IACpD,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,eAAe,EAAE;CACnE,CAAC;AAEF,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC,MAAM,qBAAqB,GACzB,wEAAwE;IACxE,8BAA8B,CAAC;AAEjC,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC;;;GAGG;AACH,MAAM,aAAa,GACjB,yEAAyE;IACzE,gFAAgF,CAAC;AAEnF,+EAA+E;AAC/E,SAAS,WAAW,CAAC,UAAqC;IACxD,OAAO,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,UAAsB,EAAE,IAAY;IACzD,OAAO;QACL,UAAU;QACV,MAAM,EAAE,aAAa;QACrB,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,IAAI;QACJ,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,CAAU,EAAE,GAAG,GAAG,GAAG;IAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtF,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,KAAa;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,KAAa;IACjE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO;QACL,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC;AAOD,SAAS,UAAU,CAAC,WAAmB,EAAE,KAAa,EAAE,MAAgC;IACtF,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,8CAA8C,CAAC,EAAE,CAAC;IACjH,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAE3D,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,uCAAuC,CAAC,EAAE,CAAC;IAC1G,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,qCAAqC,CAAC,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,qCAAqC,CAAC,EAAE,CAAC;IACxG,CAAC;IAED,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,KAAK,WAAW,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC;QACrF,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG,EAAE;YACH,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAC3C,+DAA+D;YAC/D,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YACvC,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC;YAChC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YACnC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,qBAAqB,CAAC;YACnD,uEAAuE;YACvE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,EAAE,SAAS;gBACb,CAAC,CAAC,KAAK,IAAI,IAAI;oBACb,CAAC,CAAC,uDAAuD;oBACzD,CAAC,CAAC,IAAI;gBACR,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YACnB,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,KAAK;SACjB;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,GAAkB;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,sCAAsC,CAAC;IACxD,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,qDAAqD,CAAC;IACzF,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,aAAa,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;IACzE,CAAC;IACD,OAAO,0BAA0B,GAAG,IAAI,CAAC;AAC3C,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,KAAa;IAChE,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,sBAAsB;IACtB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;YACzF,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC;YAC9D,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAC3E,SAAS,EAAE,KAAK;YAChB,yEAAyE;YACzE,0EAA0E;YAC1E,cAAc;YACd,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,WAAmB,EAAE,KAAa;IACzD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,aAAa,GAAG,KAAK,CAAC;IAG1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACnC,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,IAAI,EACX,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,IAAI,CACP,WAAW,CAAC,MAAM,CAAC,EACnB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAE,EACnB,WAAW,CAAC,MAAM,CAAC,EACnB,WAAW,CAAC,OAAO,CAAC,EACpB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAE,CAC7B,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACzD,CAAC"}

package/server/dist/core/mission-context/run-id-recovery.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Hard cap on how much text is scanned, independent of what the caller passes.
+ * The caller already reads a bounded tail; this is the belt to that braces.
+ */
+export declare const MAX_SCAN_CHARS: number;
+/**
+ * The LAST qualifying `Run-ID` in `transcript`, or null.
+ *
+ * LAST, not first: a long session legitimately contains several iterates (a
+ * fix-forward after a merge, a campaign's sub-iterates), and the most recent one
+ * is the run this session is about. Verified against every session in this
+ * project that still has a live pointer: 18 agreements, 0 disagreements.
+ *
+ * Pure — no I/O, no corroboration. `recoverRunIdFromTranscript` is the entry
+ * point that adds evidence.
+ */
+export declare function findRunIdFooter(transcript: string): string | null;
+/**
+ * Does THIS project's own record set know `runId`?
+ *
+ * `unavailable` (the log could not be read) is deliberately not evidence: an
+ * unreadable source must never be upgraded into a confirmation.
+ */
+export declare function hasRunRecord(projectRoot: string, runId: string): boolean;
+export declare function _recoveryScanCount(): number;
+/** Test-only: drop the negative-scan memo between cases. */
+export declare function _clearRecoveryMemo(): void;
+/**
+ * The recovered run id for this session, or null.
+ *
+ * Called ONLY from rule 5 of the ordered scenario table (scenario.ts), i.e. only
+ * once rules 1-4 — custom-actions, pointer, association, pipeline, campaign —
+ * have all missed. Every caller that reaches it therefore RESOLVES on the
+ * answer, and the route persists that answer, so the scan is paid once per task
+ * rather than once per poll.
+ *
+ * It was not always so: until iterate-2026-07-21-mission-recovery-memo-perf the
+ * resolver computed this BEFORE the table, so a campaign- or pipeline-resolved
+ * session that happened to quote a corroborated footer scanned on every poll
+ * forever — nothing consumed the answer, so nothing ever persisted it, and the
+ * memo below only covers a NEGATIVE result (internal code review of PR #309).
+ */
+export declare function recoverRunIdFromTranscript(projectRoot: string, transcript: string, sessionUuid?: string): string | null;
+//# sourceMappingURL=run-id-recovery.d.ts.map

package/server/dist/core/mission-context/run-id-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-id-recovery.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/run-id-recovery.ts"],"names":[],"mappings":"AAyCA;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAc,CAAC;AAoB1C;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIxE;AAkCD,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,GAAG,IAAI,CAqBf"}

package/server/dist/core/mission-context/run-id-recovery.js

@@ -0,0 +1,175 @@
+/*
+ * core/mission-context/run-id-recovery.ts — the THIRD identification source:
+ * the `Run-ID:` footer the run itself wrote into its own commit message.
+ *
+ * WHY IT EXISTS (measured 2026-07-21 on the operator's real store). The pointer
+ * is deleted at Finalize and the durable association is only ever written while
+ * somebody has the Mission tab OPEN during the live window — so 1 of 416 real
+ * tasks carried an association and 19 of 150 sessions in this project could be
+ * identified at all. The identity was never actually lost: every finalized run
+ * signs its own commit with `Run-ID: <run_id>` (the F6 footer), and that text is
+ * in the session's own transcript.
+ *
+ * The transcript is UNTRUSTED DATA even though it is read server-side (§5.1) —
+ * same posture as the transcript-derived PR number in merge-check.ts, which is
+ * bounded-int validated before use. So the value found here is admitted only
+ * after THREE independent checks, each derived from a REAL false positive found
+ * while probing 65 transcripts:
+ *
+ *   1. CANONICAL SHAPE. `Run-ID: iterate-<YYYY-MM-DD>-<slug>`, then the strict
+ *      `isSafeRunId` grammar on top. A permissive id class matched the template
+ *      mention `Run-ID: iterate-` and the non-iterate `Run-ID: security-…`; both
+ *      pass `isSafeRunId` happily and would resolve to an iterate that does not
+ *      exist.
+ *   2. LINE-TERMINATED. The id must END its line (or its JSON string). This is
+ *      what a commit footer looks like. It rejects the measured prose case
+ *      `→ decision_log.md (ADR via Run-ID: iterate-2026-06-14-repair-claude-json)`
+ *      in a session that is not an iterate at all — a quotation is not a claim.
+ *   3. CORROBORATED. The project's OWN records must know the run: a
+ *      `work_completed` row in `shipwright_events.jsonl`, or an
+ *      `iterates/<run_id>.json`. Measured, this rejects the 2 cross-repo run ids
+ *      quoted inside webui sessions while keeping 29 of 31 recoveries. An
+ *      UNREADABLE event log is explicitly NOT evidence — "we could not check"
+ *      must never become "yes".
+ *
+ * A transcript with no qualifying marker yields null and the session stays
+ * `plain`. There is no partial answer and no guess.
+ */
+import { findWorkCompleted, readIterateDoc } from "./iterate-record.js";
+import { isSafeRunId } from "./pointer.js";
+/**
+ * Hard cap on how much text is scanned, independent of what the caller passes.
+ * The caller already reads a bounded tail; this is the belt to that braces.
+ */
+export const MAX_SCAN_CHARS = 1024 * 1024;
+/**
+ * The F6 footer marker.
+ *
+ * The transcript is raw JSONL, so a message newline appears as the two
+ * characters `\` + `n` inside a JSON string and a string end appears as `"`
+ * (often preceded by an escaping backslash). The lookahead therefore accepts
+ * exactly those terminators — `\n`, `\r`, `\"`, a real CR/LF, a bare quote, or
+ * end-of-input — which is what makes an inline prose mention (followed by `)`,
+ * `,`, a word…) fail to match.
+ *
+ * The escape set is ENUMERATED rather than "any backslash" (external code
+ * review, openai MEDIUM): a prose sentence ending `…-real-run\)` is a backslash
+ * too, and accepting it would re-open the very quotation case the
+ * line-termination rule exists to reject.
+ */
+const RUN_ID_FOOTER = /Run-ID:[ \t]*(iterate-\d{4}-\d{2}-\d{2}-[A-Za-z0-9][A-Za-z0-9._-]{0,90})[ \t]*(?=\\[nr"]|"|\r|\n|$)/g;
+/**
+ * The LAST qualifying `Run-ID` in `transcript`, or null.
+ *
+ * LAST, not first: a long session legitimately contains several iterates (a
+ * fix-forward after a merge, a campaign's sub-iterates), and the most recent one
+ * is the run this session is about. Verified against every session in this
+ * project that still has a live pointer: 18 agreements, 0 disagreements.
+ *
+ * Pure — no I/O, no corroboration. `recoverRunIdFromTranscript` is the entry
+ * point that adds evidence.
+ */
+export function findRunIdFooter(transcript) {
+    if (typeof transcript !== "string" || transcript.length === 0)
+        return null;
+    const text = transcript.length > MAX_SCAN_CHARS ? transcript.slice(-MAX_SCAN_CHARS) : transcript;
+    let last = null;
+    RUN_ID_FOOTER.lastIndex = 0;
+    let m;
+    while ((m = RUN_ID_FOOTER.exec(text)) !== null) {
+        // Defense in depth: the same grammar every other run_id must satisfy before
+        // it may take part in a path join (kills `..`, separators, non-ASCII).
+        if (isSafeRunId(m[1]))
+            last = m[1];
+    }
+    return last;
+}
+/**
+ * Does THIS project's own record set know `runId`?
+ *
+ * `unavailable` (the log could not be read) is deliberately not evidence: an
+ * unreadable source must never be upgraded into a confirmation.
+ */
+export function hasRunRecord(projectRoot, runId) {
+    if (!isSafeRunId(runId))
+        return false;
+    if (findWorkCompleted(projectRoot, runId).status === "found")
+        return true;
+    return readIterateDoc(projectRoot, runId) !== null;
+}
+/**
+ * NEGATIVE memo (external plan review, gemini HIGH + openai MEDIUM).
+ *
+ * A SUCCESSFUL recovery is paid once because the caller persists it. A session
+ * that genuinely has no footer — an ordinary chat — never becomes associated, so
+ * without this it would re-scan on every poll for as long as its Mission tab is
+ * open.
+ *
+ * KEYED BY CONTENT, NOT BY LENGTH (external code review, openai MEDIUM). Length
+ * alone is a trap: past 1 MB the bounded tail is ALWAYS exactly `MAX_SCAN_CHARS`
+ * while its content slides forward, so a length key would freeze every large
+ * session at "no marker" — and the footer arrives precisely by sliding into that
+ * window. The fingerprint therefore also samples the END of the tail, which is
+ * exactly what moves as the transcript grows.
+ *
+ * Deliberately NOT a persisted "no run" association: that would add a second
+ * meaning to `task.missionContext` and a second write surface, to cache a regex.
+ */
+const negativeScans = new Map();
+const NEGATIVE_CAP = 512;
+/** How much of the tail END feeds the fingerprint. */
+const FINGERPRINT_CHARS = 256;
+function tailFingerprint(text) {
+    return `${text.length}:${text.slice(-FINGERPRINT_CHARS)}`;
+}
+/**
+ * Test-only: how many real scans ran. Without it a memo test can only assert the
+ * same answer twice — which passes whether or not the memo exists.
+ */
+let scanCount = 0;
+export function _recoveryScanCount() {
+    return scanCount;
+}
+/** Test-only: drop the negative-scan memo between cases. */
+export function _clearRecoveryMemo() {
+    negativeScans.clear();
+    scanCount = 0;
+}
+/**
+ * The recovered run id for this session, or null.
+ *
+ * Called ONLY from rule 5 of the ordered scenario table (scenario.ts), i.e. only
+ * once rules 1-4 — custom-actions, pointer, association, pipeline, campaign —
+ * have all missed. Every caller that reaches it therefore RESOLVES on the
+ * answer, and the route persists that answer, so the scan is paid once per task
+ * rather than once per poll.
+ *
+ * It was not always so: until iterate-2026-07-21-mission-recovery-memo-perf the
+ * resolver computed this BEFORE the table, so a campaign- or pipeline-resolved
+ * session that happened to quote a corroborated footer scanned on every poll
+ * forever — nothing consumed the answer, so nothing ever persisted it, and the
+ * memo below only covers a NEGATIVE result (internal code review of PR #309).
+ */
+export function recoverRunIdFromTranscript(projectRoot, transcript, sessionUuid) {
+    const memoKey = sessionUuid ? `${projectRoot}::${sessionUuid}` : null;
+    const fingerprint = memoKey ? tailFingerprint(transcript) : null;
+    if (memoKey && negativeScans.get(memoKey) === fingerprint)
+        return null;
+    scanCount++;
+    const candidate = findRunIdFooter(transcript);
+    // Memoize ONLY "this text contains no marker" — a purely TEXTUAL fact, which
+    // cannot change while the text does not. A candidate that failed
+    // CORROBORATION is deliberately re-checked every poll: the project's records
+    // can gain the run later (Finalize writes the event), and caching that answer
+    // would strand the session as `plain` until the transcript happened to grow.
+    if (!candidate) {
+        if (memoKey && fingerprint) {
+            if (negativeScans.size >= NEGATIVE_CAP)
+                negativeScans.clear();
+            negativeScans.set(memoKey, fingerprint);
+        }
+        return null;
+    }
+    return hasRunRecord(projectRoot, candidate) ? candidate : null;
+}
+//# sourceMappingURL=run-id-recovery.js.map

package/server/dist/core/mission-context/run-id-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-id-recovery.js","sourceRoot":"","sources":["../../../src/core/mission-context/run-id-recovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,aAAa,GACjB,sGAAsG,CAAC;AAEzG;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,IAAI,GACR,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAEtF,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,KAAa;IAC7D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAChD,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,IAAI,SAAS,GAAG,CAAC,CAAC;AAClB,MAAM,UAAU,kBAAkB;IAChC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB;IAChC,aAAa,CAAC,KAAK,EAAE,CAAC;IACtB,SAAS,GAAG,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAmB,EACnB,UAAkB,EAClB,WAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,IAAI,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAEvE,SAAS,EAAE,CAAC;IACZ,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAE9C,6EAA6E;IAC7E,iEAAiE;IACjE,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,IAAI,aAAa,CAAC,IAAI,IAAI,YAAY;gBAAE,aAAa,CAAC,KAAK,EAAE,CAAC;YAC9D,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC"}

package/server/dist/core/mission-context/scenario.d.ts

@@ -0,0 +1,121 @@
+import type { MissionContextAssociation, MissionScenario } from "./types.js";
+import type { ReadPointerResult } from "./pointer.js";
+/** The four builtin action ids. Anything else is a user-defined custom action. */
+export declare const BUILTIN_ACTION_IDS: ReadonlySet<string>;
+/**
+ * What we know about the project's SDLC run-config — THREE states, not a boolean.
+ *
+ * `RunConfigReadResult` has four (`ok` / `missing` / `v1_legacy` / `invalid`) and
+ * only ONE of them, `missing`, is evidence that the project does not run the
+ * pipeline. A config that is present but corrupt, legacy, or written to a schema
+ * this build does not know is a config we COULD NOT READ — which says nothing
+ * about whether the project is an SDLC project.
+ *
+ * Collapsing the other three into "no run-config" is how an unreadable file
+ * silently deletes the Mission tab (internal code review, BLOCKING).
+ */
+export type RunConfigPresence = 
+/** Parsed as a valid v2 config — the project demonstrably runs the pipeline. */
+"ok"
+/** No run-config file at all — the ONLY state that permits a hide. */
+ | "missing"
+/** Present but unparseable / legacy / unknown schema / unreadable. We do not know. */
+ | "unreadable";
+export interface ScenarioInputs {
+    /** Result of reading `.shipwright/iterate_active/<uuid>.json`. */
+    pointer: ReadPointerResult;
+    /**
+     * The DURABLE association persisted on the task, if any.
+     *
+     * Load-bearing after Finalize: `prune_stale_run_pointers` deletes the pointer
+     * once the worktree is gone, so from that moment the pointer can never
+     * identify the run again. Without this fallback the resolver would answer
+     * `plain` for every finished iterate — reintroducing precisely the data loss
+     * the association was added to close, and breaking AC2 (a finalized iterate
+     * must still show its commit + merge state, never "No run data yet").
+     */
+    association?: MissionContextAssociation | null;
+    /**
+     * A run id recovered from this session's OWN transcript and already
+     * corroborated by the project's records (`run-id-recovery.ts`).
+     *
+     * The last-resort identification source, for the tasks that ran before this
+     * build shipped: measured 2026-07-21, only 19 of this project's 150 sessions
+     * could be identified from a pointer or an association, because the pointer is
+     * pruned at Finalize and the association is only written while the Mission tab
+     * is open during the run.
+     *
+     * Ranked BELOW pipeline and campaign, unlike the association: an association
+     * is a SERVER-OBSERVED fact (this session really was running that iterate),
+     * whereas the footer is text the session happens to contain. Measured, a
+     * campaign session quotes its sub-iterates' footers — ranking this higher
+     * would demote a genuine campaign to `iterate`.
+     *
+     * A THUNK, not a value, and that is the whole point (internal code review of
+     * PR #309, PERF). Computing it eagerly meant a campaign- or pipeline-resolved
+     * session whose transcript quotes a CORROBORATED footer re-ran the regex and
+     * the record lookup on every poll forever: it never reached rule 5, so nothing
+     * ever persisted, and the negative memo does not cover a POSITIVE find.
+     * Deferring removes that work instead of remembering it, and makes this table
+     * the single place that decides whether the footer matters at all.
+     */
+    recoverTranscriptRunId?: (() => string | null) | null;
+    /** Actions catalog facts, resolved SERVER-side from the project. */
+    actions: {
+        /** True when `.shipwright-webui/actions.json` was actually used. */
+        fromUser: boolean;
+        /** Loader diagnostics — any entry means "ambiguous", so do NOT hide. */
+        hasDiagnostics: boolean;
+        /** Every resolved action id. */
+        actionIds: readonly string[];
+    } | null;
+    /** What we know about the project's SDLC run-config. See `RunConfigPresence`. */
+    runConfigStatus: RunConfigPresence;
+    /** The task's phase-task linkage (scenario 3). */
+    phaseTaskId: string | null;
+    taskRunId: string | null;
+    /** Parsed `campaign:<slug>` from the title, and whether a record exists. */
+    campaignSlug: string | null;
+    hasCampaignRecord: boolean;
+}
+/**
+ * Is this project VALIDLY in custom-actions mode?
+ *
+ * Every clause must hold — the conjunction is the point. Presence of an
+ * actions.json is explicitly NOT sufficient (§4 precedence 1).
+ *
+ * S3 — the `actionIds: readonly string[]` type is a CLAIM, not a guarantee: the
+ * values cross a JSON boundary (`.shipwright-webui/actions.json`) where nothing
+ * enforces it. MEASURED on the real loader + a real temp project (S3 probe):
+ * `{"schemaVersion":1,"actions":[{"foo":"bar"}]}` parses fine, the loader reports
+ * `fromUser: true` with ZERO diagnostics because `JSON.parse` succeeded and
+ * `checkContractVersion` only WARNS, and `facts.ts` maps `a.id` to `undefined`.
+ * That produced a one-element id list matching no builtin — and this function
+ * returned true, HIDING the Mission tab for a project whose actions file is
+ * simply the wrong shape. Malformed and truncated files were already safe (they
+ * throw, so the loader falls back to the bundled default); valid-JSON-wrong-shape
+ * was the hole between "parses" and "means anything".
+ *
+ * The asymmetry is deliberate and load-bearing: hiding a whole tab is
+ * irreversible from the user's side and gives no error and no cause, so EVERY
+ * ambiguous input must resolve to SHOWING (CONTRACT §4.1, Review-2 GPT #12).
+ */
+export declare function isValidatedCustomActions(inputs: ScenarioInputs): boolean;
+export interface ScenarioDecision {
+    scenario: MissionScenario;
+    missionTabVisible: boolean;
+    /** Set only for `iterate` — the run id the whole resolve joins on. */
+    runId: string | null;
+    /**
+     * WHICH rule produced `runId`. The resolver persists an association for the
+     * pointer and the transcript, never for the one it read back from the store —
+     * deriving that from `pointer.status` plus a separately-computed candidate is
+     * how the two could disagree (they did: the association branch reported
+     * `transcript_run_id` beside a null id).
+     */
+    runIdSource: "pointer" | "association" | "transcript" | null;
+    /** Set when a pointer existed but could not be trusted (§5.1e) → `unavailable`. */
+    pointerInvalidReason: string | null;
+}
+export declare function detectScenario(inputs: ScenarioInputs): ScenarioDecision;
+//# sourceMappingURL=scenario.d.ts.map

package/server/dist/core/mission-context/scenario.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenario.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/scenario.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAKjD,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB;AAC3B,gFAAgF;AAC9E,IAAI;AACN,sEAAsE;GACpE,SAAS;AACX,sFAAsF;GACpF,YAAY,CAAC;AAEjB,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,OAAO,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,sBAAsB,CAAC,EAAE,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACtD,oEAAoE;IACpE,OAAO,EAAE;QACP,oEAAoE;QACpE,QAAQ,EAAE,OAAO,CAAC;QAClB,wEAAwE;QACxE,cAAc,EAAE,OAAO,CAAC;QACxB,gCAAgC;QAChC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;KAC9B,GAAG,IAAI,CAAC;IACT,iFAAiF;IACjF,eAAe,EAAE,iBAAiB,CAAC;IACnC,kDAAkD;IAClD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAmBxE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,eAAe,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,EAAE,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,IAAI,CAAC;IAC7D,mFAAmF;IACnF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CA4EvE"}