@try-works/dsh-recursive-mode 0.4.2 → 0.4.4

package/src/client/settings.tsx

@@ -1,18 +1,204 @@
 /**
- * Recursive settings page (Phase D R8, §11.8): a settings.section list entry
- * surfacing the host-owned enforcement config. The client is read-mostly; all
- * writes ride the host config path (never run files).
+ * Recursive settings page (§11.8): a settings.section list entry that REPORTS the
+ * live projection the host route serves — the enforcement-free facts the wire
+ * actually carries (run state + lock position, the folded phase chain with its
+ * T21 position, tamper/gate/pending facts, subagent role+provider records).
+ *
+ * WHAT THIS PANEL IS NOT: it is not a config editor and not a second board. The
+ * client is read-only (§11.9): it GETs the host route and reads no files. Every
+ * value is printed verbatim from the projection; a field the payload does not
+ * carry is printed as `not reported`, and the route-level fields the payload can
+ * never carry (enforcement modes, router defaults, scratch format) are listed by
+ * name at the bottom so a reader is never left guessing what is missing.
+ *
+ * `RecursiveSettings` is the pure renderer (props in, tree out). The live seat is
+ * `RecursiveSettingsLive`, which resolves the workspace scope exactly like the
+ * board seats and hands the snapshot down — the same shape board.tsx and
+ * inspector.tsx consume.
  */
-import { createElement } from 'react'
+import { createElement, type ReactElement, type ReactNode } from 'react'
+import { RECURSIVE_API_PREFIX } from '../live-route.ts'
+import {
+  currentSessionCwd,
+  currentWorkspacePath,
+  type LiveProjectionValue,
+  type SessionListStateLike,
+  type SnapshotSelectorHook,
+  type WorkspaceListStateLike,
+} from './contract.ts'
+import { PILL_LABELS } from './derive.ts'
+import { useLiveProjection } from './use-live.ts'
+import {
+  settingsView,
+  type SettingsPendingRow,
+  type SettingsPhaseRow,
+  type SettingsRow,
+  type SettingsRunView,
+  type SettingsStatus,
+  type SettingsSubagentRow,
+  type SettingsView,
+} from './settings-view.ts'
+
+/** Rendered in place of every value the projection did not carry. */
+export const ABSENT_LABEL = 'not reported'
 
 export interface RecursiveSettingsProps {
   close: () => void
+  /** The live host-route frame, or null while the first fetch is in flight. */
+  snapshot?: LiveProjectionValue | null
+}
+
+/** The route-answer states, each said plainly instead of implied by an empty panel. */
+const STATUS_TEXT: Record<SettingsStatus, string> = {
+  'no-frame': 'The host route has not answered for this workspace yet. Every value below is unknown — not a default.',
+  'no-root': 'The host route answered, but resolved no recursive root for this workspace (no .recursive/ run layer found).',
+  connected: 'Live.',
+}
+
+const STATUS_VALUE: Record<SettingsStatus, string> = {
+  'no-frame': 'no frame yet',
+  'no-root': 'answered · no recursive root',
+  connected: 'connected',
+}
+
+/** A label/value report block (`dl` — the semantics of a definition list). */
+function rows(className: string, items: readonly SettingsRow[]): ReactElement {
+  return createElement('dl', { className },
+    items.flatMap((row) => [
+      createElement('dt', { key: row.id + '-k', className: 'rec-settings-label' }, row.label),
+      createElement('dd', {
+        key: row.id + '-v',
+        className: row.value === null ? 'rec-settings-value rec-settings-absent' : 'rec-settings-value',
+      }, row.value ?? ABSENT_LABEL),
+    ]),
+  )
+}
+
+/** The frame's own facts: what the route answered, and how much it carried. */
+function sourceRows(view: SettingsView): SettingsRow[] {
+  return [
+    { id: 'status', label: 'route status', value: STATUS_VALUE[view.status] },
+    { id: 'root', label: 'workspace root', value: view.root },
+    { id: 'revision', label: 'revision', value: view.revision === null ? null : String(view.revision) },
+    { id: 'runs', label: 'runs in the projection', value: view.status === 'no-frame' ? null : String(view.runs.length) },
+  ]
+}
+
+function phaseNode(row: SettingsPhaseRow): ReactElement {
+  const lock: ReactNode[] = []
+  if (row.lockedAt !== null) lock.push(createElement('span', { key: 'at' }, 'locked at ' + row.lockedAt))
+  if (row.lockHash !== null) lock.push(createElement('code', { key: 'hash', className: 'rec-lockhash' }, '#' + row.lockHash.slice(0, 8)))
+  return createElement('div', { key: row.phase, className: 'rec-settings-phase' },
+    createElement('span', { className: 'rec-settings-phase-id' }, row.phase),
+    createElement('span', { className: 'rec-settings-phase-name' }, row.fileName ?? 'not present in this run'),
+    createElement('span', { className: 'rec-settings-phase-status' }, row.status),
+    createElement('span', {
+      className: row.position === null ? 'rec-settings-phase-pos rec-settings-absent' : 'rec-settings-phase-pos',
+    }, row.position ?? ABSENT_LABEL),
+    lock.length > 0 && createElement('span', { className: 'rec-settings-phase-lock' }, lock),
+  )
+}
+
+function subagentNode(s: SettingsSubagentRow): ReactElement {
+  return createElement('div', { key: s.childId, className: 'rec-settings-item' },
+    createElement('span', { className: 'rec-settings-item-id' }, s.childId),
+    createElement('span', { className: 'rec-settings-item-text' },
+      'role ' + (s.role ?? ABSENT_LABEL) + ' · provider ' + (s.provider ?? ABSENT_LABEL) + ' · status ' + (s.status ?? ABSENT_LABEL)),
+  )
+}
+
+function pendingNode(p: SettingsPendingRow): ReactElement {
+  return createElement('div', { key: p.kind + '\u0000' + p.delegationId, className: 'rec-settings-item' },
+    createElement('span', { className: 'rec-settings-item-id' }, p.kind),
+    createElement('span', { className: 'rec-settings-item-text' }, p.delegationId + ' — ' + p.detail),
+  )
+}
+
+/**
+ * A collection field: null = the card carried no such key (not reported),
+ * [] = the card carried an empty one (that empty value IS the report).
+ */
+function collection<T>(items: readonly T[] | null, render: (item: T) => ReactElement, none: string): ReactElement {
+  if (items === null) {
+    return createElement('p', { className: 'rec-settings-value rec-settings-absent' }, ABSENT_LABEL + ' — the card carries no such field')
+  }
+  if (items.length === 0) return createElement('p', { className: 'rec-settings-value rec-settings-none' }, none)
+  return createElement('div', { className: 'rec-settings-items' }, items.map(render))
 }
 
-export function RecursiveSettings({ close }: RecursiveSettingsProps) {
+function runSection(run: SettingsRunView): ReactElement {
+  const present = run.phases.filter((p) => p.present).length
+  return createElement('section', { key: run.worktreeRoot + '\u0000' + run.runId, className: 'rec-settings-run' },
+    createElement('div', { className: 'rec-settings-run-header' },
+      createElement('h3', { className: 'rec-settings-run-title' }, run.runId),
+      createElement('span', { className: 'rec-settings-pill', 'data-pill': run.pill }, PILL_LABELS[run.pill]),
+      createElement('span', { className: 'rec-settings-run-root' }, run.worktreeRoot),
+    ),
+    rows('rec-settings-rows', run.rows),
+    createElement('h4', { className: 'rec-settings-h4' }, 'Phases (' + String(present) + ' present)'),
+    createElement('p', { className: 'rec-settings-hint' },
+      'status is the folded artifact status; position is the host\'s single derived phase position (T21).'),
+    run.phases.length === 0
+      ? createElement('p', { className: 'rec-settings-value rec-settings-none' }, 'none — the card carries no phase rows')
+      : createElement('div', { className: 'rec-settings-phases' }, run.phases.map(phaseNode)),
+    createElement('h4', { className: 'rec-settings-h4' }, 'Subagents (role and provider as the host recorded them)'),
+    collection(run.subagents, subagentNode, 'none — the card carries an empty subagent map'),
+    createElement('h4', { className: 'rec-settings-h4' }, 'Pending work (unresolved in-flight delegations)'),
+    collection(run.pendingWork, pendingNode, 'none — the card carries an empty pending set'),
+  )
+}
+
+/** The panel: a report of one live frame. Pure — snapshot in, tree out. */
+export function RecursiveSettings({ close, snapshot = null }: RecursiveSettingsProps) {
+  const view = settingsView(snapshot)
   return createElement('div', { className: 'rec-settings' },
-    createElement('h2', {}, 'Recursive'),
-    createElement('p', {}, 'Enforcement policy, scratch format, provider defaults, and preset install path are configured on the host. The client is read-only (§11.9).'),
-    createElement('button', { onClick: close }, 'Close'),
+    createElement('header', { className: 'rec-settings-header' },
+      createElement('h2', { className: 'rec-settings-title' }, 'Recursive'),
+      createElement('span', { className: 'rec-settings-tag' }, 'live projection · read-only'),
+      createElement('button', { type: 'button', className: 'rec-settings-close', onClick: close }, 'Close'),
+    ),
+    createElement('p', { className: 'rec-settings-lede' },
+      'Read verbatim from the host route (GET ' + RECURSIVE_API_PREFIX + '/state + GET ' + RECURSIVE_API_PREFIX
+      + '/events). This client writes nothing and reads no files; anything the projection does not carry is printed as "'
+      + ABSENT_LABEL + '".'),
+    rows('rec-settings-source', sourceRows(view)),
+    view.status !== 'connected' && createElement('p', { className: 'rec-settings-hint' }, STATUS_TEXT[view.status]),
+    view.status === 'connected' && view.runs.length === 0
+      && createElement('p', { className: 'rec-settings-value rec-settings-none' }, 'none — the projection carries no runs in this workspace'),
+    view.runs.map(runSection),
+    createElement('section', { className: 'rec-settings-notcarried' },
+      createElement('h3', { className: 'rec-settings-h3' }, 'Not carried by this route'),
+      createElement('p', { className: 'rec-settings-hint' },
+        'Configured on the host, but the payload carries only {root, projection, revision} — so this panel reports them as unknown rather than guessing.'),
+      rows('rec-settings-rows', view.notCarried),
+    ),
   )
 }
+
+/** The settings seat props: the root standard kit plus the shell's close affordance. */
+export interface RecursiveSettingsSeatProps {
+  close: () => void
+  useSessions?: SnapshotSelectorHook<SessionListStateLike>
+  useWorkspaces?: SnapshotSelectorHook<WorkspaceListStateLike>
+}
+
+export interface RecursiveSettingsLiveProps {
+  close: () => void
+  useSessions: SnapshotSelectorHook<SessionListStateLike>
+  useWorkspaces: SnapshotSelectorHook<WorkspaceListStateLike>
+}
+
+/**
+ * The live seat: same scope resolution as the board seats (sessionId PRIMARY,
+ * workspace path as the cwd hint, session cwd while workspaces hydrate). Hooks
+ * are called unconditionally — the seat only renders this component when both
+ * selector hooks are present (slots.ts), so the hook order is fixed.
+ */
+export function RecursiveSettingsLive({ close, useSessions, useWorkspaces }: RecursiveSettingsLiveProps) {
+  const sessions = useSessions((s) => s)
+  const workspaces: WorkspaceListStateLike = useWorkspaces((s) => s) ?? { items: [], recentWorkspaceId: undefined }
+  const wsPath = currentWorkspacePath(workspaces, sessions)
+  const cwd = wsPath !== '' ? wsPath : currentSessionCwd(sessions)
+  const snapshot = useLiveProjection({ sessionId: sessions.current, cwd })
+  return createElement(RecursiveSettings, { close, snapshot })
+}

package/src/client/slots.ts

@@ -21,7 +21,7 @@ import type { ClientContext, SessionListStateLike, SnapshotSelectorHook, Workspa
 import { isRecursivePreset, currentWorkspacePath } from './contract.ts'
 import { Board } from './board.tsx'
 import { Inspector } from './inspector.tsx'
-import { RecursiveSettings } from './settings.tsx'
+import { RecursiveSettings, RecursiveSettingsLive, type RecursiveSettingsSeatProps } from './settings.tsx'
 import { useLiveProjection } from './use-live.ts'
 import { boardState, useBoardState } from './open-state.ts'
 import { injectBoardStyles } from './styles.ts'
@@ -139,12 +139,25 @@ export function registerSlots(ctx: ClientContext): () => void {
   })))
 
   // Settings section (root scope, always present; no gate — configuration is always available).
+  // The seat receives the shell's `close` PLUS the root standard kit (useSessions/useWorkspaces,
+  // scoped-slots standardProps), so the panel can subscribe to the SAME live route the board
+  // reads and report the projection. Without the kit the panel still renders — with every value
+  // reported as absent (never guessed), which is the honest degradation.
   disposers.push(ctx.slots.inject('settings.section', () => ctx.slots.register({
     name: 'settings.section',
     id: 'recursive',
     order: 90,
     label: 'Recursive',
-  }, (props: { close: () => void }) => createElement(RecursiveSettings, { close: props.close }))))
+  }, (props: RecursiveSettingsSeatProps) => {
+    if (props.useSessions === undefined || props.useWorkspaces === undefined) {
+      return createElement(RecursiveSettings, { close: props.close })
+    }
+    return createElement(RecursiveSettingsLive, {
+      close: props.close,
+      useSessions: props.useSessions,
+      useWorkspaces: props.useWorkspaces,
+    })
+  })))
 
   return () => { for (const d of disposers) d() }
 }

package/src/client/styles.ts

@@ -860,6 +860,243 @@ const BOARD_CSS = `
   border-color: var(--dsw-alias-state-warn-primary);
 }
 
+/* ===== Settings section (Settings -> Recursive): the live projection report =====
+   This panel lives INSIDE the settings shell, so it consumes the shell's own
+   --dsw-alias-* theme tokens (like .rec-badge above) instead of the board's
+   scoped --board-* paper tokens: no theme toggle, and it follows the app theme. */
+.rec-settings {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  max-width: 940px;
+  padding: 2px 2px 10px;
+  color: var(--dsw-alias-label-primary);
+  font-size: 13px;
+  line-height: 1.5;
+}
+
+.rec-settings-header {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.rec-settings-title {
+  margin: 0;
+  font-size: 16px;
+  font-weight: 600;
+  letter-spacing: -0.01em;
+}
+
+.rec-settings-tag {
+  flex: none;
+  padding: 2px 8px;
+  font-size: 11px;
+  font-weight: 500;
+  letter-spacing: 0.03em;
+  text-transform: uppercase;
+  color: var(--dsw-alias-label-tertiary);
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 999px;
+}
+
+.rec-settings-close {
+  margin-left: auto;
+  padding: 5px 12px;
+  font: inherit;
+  font-size: 12px;
+  color: var(--dsw-alias-label-primary);
+  background: transparent;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  cursor: pointer;
+}
+
+.rec-settings-close:hover {
+  background: var(--dsw-alias-bg-layer-3);
+}
+
+.rec-settings-lede,
+.rec-settings-hint,
+.rec-settings-none {
+  margin: 0;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-hint,
+.rec-settings-none {
+  font-size: 12px;
+}
+
+.rec-settings-section,
+.rec-settings-notcarried,
+.rec-settings-run {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  padding: 12px 14px;
+  background: var(--dsw-alias-bg-layer-2);
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 10px;
+}
+
+.rec-settings-h3 {
+  margin: 0;
+  font-size: 12px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.rec-settings-h4 {
+  margin: 6px 0 0;
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-run-header {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.rec-settings-run-title {
+  margin: 0;
+  font-size: 14px;
+  font-weight: 600;
+  overflow-wrap: anywhere;
+}
+
+.rec-settings-run-root {
+  flex: 1;
+  min-width: 0;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 11px;
+  color: var(--dsw-alias-label-tertiary);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/* Solid state pill, same vocabulary as .rec-pill but on the SHELL tokens
+   (the board's --board-* aliases are scoped to .rec-board/.rec-inspector). */
+.rec-settings-pill {
+  flex: none;
+  padding: 3px 10px;
+  font-size: 11px;
+  font-weight: 500;
+  line-height: 1;
+  border-radius: 999px;
+  color: var(--dsw-alias-label-primary-foreground);
+  background: var(--dsw-alias-label-tertiary);
+}
+
+.rec-settings-pill[data-pill='locked']      { background: var(--dsw-alias-state-success-primary); }
+.rec-settings-pill[data-pill='in-progress'] { background: var(--dsw-alias-state-business-primary); }
+.rec-settings-pill[data-pill='paused']      { background: var(--dsw-alias-state-warn-primary); }
+.rec-settings-pill[data-pill='blocked']     { background: var(--dsw-alias-state-error-primary); }
+.rec-settings-pill[data-pill='tampered']    { background: var(--dsw-alias-state-error-primary); }
+.rec-settings-pill[data-pill='advisory']    { background: var(--dsw-alias-state-warn-secondary); }
+.rec-settings-pill[data-pill='neutral']     { background: var(--dsw-alias-label-tertiary); }
+
+dl.rec-settings-source,
+dl.rec-settings-rows {
+  display: grid;
+  grid-template-columns: minmax(160px, 300px) 1fr;
+  gap: 4px 16px;
+  margin: 0;
+}
+
+.rec-settings-label {
+  font-size: 12px;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.rec-settings-value {
+  margin: 0;
+  color: var(--dsw-alias-label-primary);
+  overflow-wrap: anywhere;
+}
+
+/* An absent value is a STATEMENT, not an empty row — always visibly marked. */
+.rec-settings-absent {
+  color: var(--dsw-alias-state-warn-label);
+  font-style: italic;
+}
+
+.rec-settings-phases {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.rec-settings-phase {
+  display: flex;
+  align-items: baseline;
+  flex-wrap: wrap;
+  gap: 10px;
+  padding: 4px 10px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 6px;
+}
+
+.rec-settings-phase-id {
+  flex: none;
+  min-width: 40px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 11px;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-phase-name {
+  flex: 1;
+  min-width: 140px;
+  overflow-wrap: anywhere;
+}
+
+.rec-settings-phase-status,
+.rec-settings-phase-pos {
+  flex: none;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 11px;
+  letter-spacing: 0.02em;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-phase-lock {
+  flex: none;
+  font-size: 11px;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.rec-settings-items {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.rec-settings-item {
+  display: flex;
+  align-items: baseline;
+  gap: 10px;
+  font-size: 12px;
+}
+
+.rec-settings-item-id {
+  flex: none;
+  min-width: 96px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-item-text {
+  flex: 1;
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+
 @media (prefers-reduced-motion: reduce) {
   .rec-card, .rec-back, .rec-close, .rec-theme-toggle { transition: none; }
 }

package/src/enforcement.ts

@@ -211,7 +211,33 @@ export function currentPhaseArtifact(worktreeRoot: string, runId: string): strin
       best = name
     }
   }
-  return best
+  // ⚠ FIX 2 (half a) — PRESENCE IS NO LONGER EVIDENCE OF PROGRESS, AND THIS USED TO ASSUME IT WAS.
+  //
+  // The loop above returns the HIGHEST-numbered phase artifact present, on the documented assumption that "a run at
+  // phase 3 has `00`-`03` on disk". That assumption stopped being true when `recursive_init` began scaffolding ALL
+  // TWELVE artifacts, `08-memory-impact.md` included — so from turn 0 the phase-8 baseline governed every guard call.
+  // Phase 8 is the documentation phase, whose rule denies writes outside the run tree, so a run sitting at phase 3
+  // had its SOURCE EDITS denied as though it were finished and merely writing up. A live verification pass recorded
+  // five denials out of five while trying to author phase artifacts.
+  //
+  // The workflow's own notion of progress is the LOCK, so the phase in force is the LOWEST-numbered artifact that is
+  // not locked — the phase actually being worked on. Once everything is locked the run is complete, and the previous
+  // answer still stands, which keeps the old behaviour exactly where the old reasoning held. Still read from the
+  // filesystem on every call, for the same no-cache reason the directory listing is.
+  let inForce = ''
+  let inForcePhase = Number.POSITIVE_INFINITY
+  for (const name of names) {
+    if (!name.endsWith('.md')) continue
+    const phase = phaseNumberForArtifact(name)
+    if (!phase) continue
+    const value = Number(phase)
+    if (getLockStatus(join(runDir, name)) === 'LOCKED') continue
+    if (value < inForcePhase) {
+      inForcePhase = value
+      inForce = name
+    }
+  }
+  return inForce !== '' ? inForce : best
 }
 
 export function evaluateToolGuard(
@@ -335,10 +361,56 @@ function resolveTargetPath(target: string, worktreeRoot: string): string | null
   return abs
 }
 
+/**
+ * The ADMISSION test for the tamper path: the resolved absolute path when
+ * `targetPath` names a run-tree `*.md` — a tamper CANDIDATE — and `null`
+ * otherwise. Pure path arithmetic on every branch (no filesystem work), so a
+ * caller may use it as a cheap shape check before paying for `existsSync`.
+ *
+ * ⚠ THE BLIND SPOT THIS FUNCTION EXISTS TO CLOSE. The admission test used to be a
+ * substring test on the target STRING alone, looking for `/.recursive/run/`. A
+ * repo-relative path has no separator before `.recursive`, so
+ * `.recursive/run/<id>/00-requirements.md` — the spelling a model actually types,
+ * and its backslash form — was rejected before ANYTHING was examined, and
+ * tampering with a locked artifact through that spelling was invisible
+ * (measured: `detectTamper` returned a record for the absolute path and `null`
+ * for the relative one, on the same file). The identical defect, in the identical
+ * spelling, was fixed one module over in `policy-globs.ts` `lockedWriteRule`; this
+ * is that fix's shape, reused rather than reinvented.
+ *
+ * So the marker is looked for on the path the target RESOLVES to as well as on
+ * the string as written. The `||` is load-bearing and the string test is KEPT
+ * rather than replaced, because a resolved-only test would SHRINK the admitted
+ * set: an absolute target that literally carries the marker but resolves away
+ * from it (`…/.recursive/run/../…`) was caught before and must stay caught. The
+ * net effect is a strict SUPERSET of the previous behaviour, so no tamper that
+ * was visible before can become invisible.
+ *
+ * EXPORTED because `src/index.ts`'s `fs/observed` listener must apply the SAME
+ * admission test before calling `detectTamper`. That listener used to carry a
+ * hand-copied mirror of this test, and a mirror is exactly what leaves half the
+ * defect behind: widening `detectTamper` alone changes nothing, because the
+ * listener rejects the spelling first. One function cannot disagree with itself.
+ */
+export function tamperCandidatePath(targetPath: string, worktreeRoot: string): string | null {
+  const normalized = targetPath.replace(/\\/g, '/')
+  if (!normalized.endsWith('.md')) return null
+  const abs = resolveTargetPath(normalized, worktreeRoot)
+  if (!abs) return null
+  const resolved = abs.replace(/\\/g, '/')
+  if (!normalized.includes('/.recursive/run/') && !resolved.includes('/.recursive/run/')) return null
+  return abs
+}
+
 /**
  * Layer 8 - fs/observed lock-tamper detection.
  * A locked *.md whose observed version differs from the stored LockHash is
  * a tamper. Returns a tamper reason (or null when clean/not-applicable).
+ *
+ * The admission test lives in `tamperCandidatePath` (above), shared with the
+ * `fs/observed` listener in `src/index.ts` — see the note there for why sharing
+ * it is the point and not a tidiness preference. What this function reports is
+ * unchanged: the same record shape, carrying the target AS WRITTEN.
  */
 export function detectTamper(
   targetPath: string,
@@ -346,8 +418,7 @@ export function detectTamper(
   activeRunId: string,
 ): { runId: string; path: string; reason: string } | null {
   const normalized = targetPath.replace(/\\/g, '/')
-  if (!normalized.endsWith('.md') || !normalized.includes('/.recursive/run/')) return null
-  const abs = resolveTargetPath(normalized, worktreeRoot)
+  const abs = tamperCandidatePath(normalized, worktreeRoot)
   if (!abs || !existsSync(abs)) return null
   const status = getLockStatus(abs)
   if (status === 'STALE_LOCK') {

package/src/index.ts

@@ -24,7 +24,7 @@ import { createRecursiveAskTool } from './recursive_ask.tool.ts'
 import { createRecursivePreviewTool } from './recursive_preview.tool.ts'
 import type { SubagentsRuntimeLike } from './delegation.ts'
 import { registerRecursiveCommand } from './commands.ts'
-import { evaluateToolGuard, coerceAskToDecision, type ToolGuardDecision } from './enforcement.ts'
+import { evaluateToolGuard, coerceAskToDecision, tamperCandidatePath, type ToolGuardDecision } from './enforcement.ts'
 import { appendGuardDecision, appendObservedTamper, type GuardDecisionRecord } from './guard-log.ts'
 import type { GoalServiceLike } from './goals-projection.ts'
 import type { TeamRuntimeLike } from './teams-loop.ts'
@@ -307,9 +307,36 @@ export function apply(ctx: Context, config?: RecursiveModeConfig) {
     ctx.tools.register(createRecursiveAskTool(recursive)),
     // T26: the read-only view of what the enforcement contract will do, before it fires.
     ctx.tools.register(createRecursivePreviewTool(recursive)),
-      ...(agentTeams ? [ctx.tools.register(createRecursiveAuditTeamTool(agentTeams))] : []),
     ]
 
+    // ⚠ FIX 1 — THE THIRD SEAM NEEDED THE SAME LATE ATTACH AS THE OTHER TWO, AND DID NOT HAVE IT.
+    //
+    // The line that used to sit in the array above was `...(agentTeams ? [register(...)] : [])` — a ONE-SHOT
+    // `ctx.get('agentTeams')` taken at apply time. A live verification pass found the consequence: `team_task_create`
+    // worked in the same session whose tool catalog lacked `recursive_audit_team`, because the service was mounted
+    // AFTER this plugin applied. The plugin shipped 13 tool files and offered 12.
+    //
+    // `subagents` and `llm` already solve this with `ctx.inject` (above); this is that pattern, with one addition the
+    // others do not need: the tool may only be registered ONCE, because the one-shot path can already have taken it.
+    let auditTeamRegistered = agentTeams !== undefined && agentTeams !== null
+    if (auditTeamRegistered) disposers.push(ctx.tools.register(createRecursiveAuditTeamTool(agentTeams ?? null)))
+    ctx.inject(['agentTeams'], (teamCtx: Context) => {
+      if (auditTeamRegistered) return
+      const late = teamCtx.get('agentTeams') as TeamRuntimeLike | undefined
+      if (late === undefined || late === null) return
+      auditTeamRegistered = true
+      // ⚠ CORRECTED COMMENT. This registers through the OUTER plugin context (`ctx`), NOT through the
+      // injecting `teamCtx` — `teamCtx` is used on the line above only to READ the late service, and the
+      // sibling `subagents`/`llm` injects use their callback context the same way. The comment that used to
+      // sit here claimed the injecting scope owned the registration, which is not what this call does.
+      //
+      // WHAT IS NOT CLAIMED: that the fiber withdraws this registration. Nobody has observed that — no test
+      // covers the late `recursive_audit_team` being withdrawn — and the disposer returned here is not
+      // retained, unlike the eager registration above, which pushes its own onto `disposers`. Until a test
+      // observes the withdrawal, this comment promises nothing about it.
+      ctx.tools.register(createRecursiveAuditTeamTool(late))
+    })
+
     // /recursive command (R4): preset-scoped registration, workspace-scoped dispatch.
     const commands = ctx.get('commands') as { register: (def: unknown) => () => void } | undefined
     if (commands) {
@@ -501,16 +528,26 @@ export function apply(ctx: Context, config?: RecursiveModeConfig) {
           if (!displayPath) return
           // Cheap shape test BEFORE any filesystem work: fs/observed fires on reads
           // too, so enumerating runs for every observation would be a readdir per
-          // file touch. This is EXACTLY detectTamper's own admission test (same
-          // normalized string, same two conditions), so it can never reject a
-          // candidate detectTamper would have accepted.
-          const normalized = displayPath.replace(/\\/g, '/')
-          if (!normalized.endsWith('.md') || !normalized.includes('/.recursive/run/')) return
-          // The actor is the tool execution. This event cannot await, so the root is
-          // the actor's session cwd (the same B4 sync shortcut fsPolicyIntent takes:
-          // the session cwd is authoritative, the registry path is async-only).
+          // file touch. The actor is the tool execution. This event cannot await, so
+          // the root is the actor's session cwd (the same B4 sync shortcut
+          // fsPolicyIntent takes: the session cwd is authoritative, the registry
+          // path is async-only). Resolving the cwd first is free — plain property
+          // reads — and the admission test needs it.
           const cwd = (actor as { agent?: { session?: { header?: { cwd?: string } } } } | null)?.agent?.session?.header?.cwd ?? ''
           if (!cwd) return
+          // ⚠ AND THIS IS `detectTamper`'s OWN ADMISSION TEST, CALLED RATHER THAN COPIED.
+          //
+          // It used to be an inline hand-copy — `endsWith('.md') && includes('/.recursive/run/')`
+          // — and a hand-copy is what made the tamper guard blind to one spelling of one
+          // path: the substring test needs a separator BEFORE `.recursive`, which a
+          // repo-relative target (`displayPath` as a model would type it) does not have, so
+          // the listener rejected the candidate here and `detectTamper` was never reached.
+          // Widening only `detectTamper` would have changed nothing observable. The test now
+          // lives in one place (`tamperCandidatePath`), so the two cannot disagree; it stays
+          // pure path arithmetic, so the "no filesystem work before admission" property the
+          // shape check exists for is preserved.
+          const normalized = displayPath.replace(/\\/g, '/')
+          if (!tamperCandidatePath(normalized, cwd)) return
           const runId = resolveRunDir(cwd)?.runId ?? ''
           const tamper = recursive.detectTamper(normalized, cwd, runId)
           if (!tamper) return