@try-works/dsh-recursive-mode 0.4.3 → 0.4.5

package/src/client/styles.ts

@@ -860,6 +860,243 @@ const BOARD_CSS = `
   border-color: var(--dsw-alias-state-warn-primary);
 }
 
+/* ===== Settings section (Settings -> Recursive): the live projection report =====
+   This panel lives INSIDE the settings shell, so it consumes the shell's own
+   --dsw-alias-* theme tokens (like .rec-badge above) instead of the board's
+   scoped --board-* paper tokens: no theme toggle, and it follows the app theme. */
+.rec-settings {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  max-width: 940px;
+  padding: 2px 2px 10px;
+  color: var(--dsw-alias-label-primary);
+  font-size: 13px;
+  line-height: 1.5;
+}
+
+.rec-settings-header {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.rec-settings-title {
+  margin: 0;
+  font-size: 16px;
+  font-weight: 600;
+  letter-spacing: -0.01em;
+}
+
+.rec-settings-tag {
+  flex: none;
+  padding: 2px 8px;
+  font-size: 11px;
+  font-weight: 500;
+  letter-spacing: 0.03em;
+  text-transform: uppercase;
+  color: var(--dsw-alias-label-tertiary);
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 999px;
+}
+
+.rec-settings-close {
+  margin-left: auto;
+  padding: 5px 12px;
+  font: inherit;
+  font-size: 12px;
+  color: var(--dsw-alias-label-primary);
+  background: transparent;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  cursor: pointer;
+}
+
+.rec-settings-close:hover {
+  background: var(--dsw-alias-bg-layer-3);
+}
+
+.rec-settings-lede,
+.rec-settings-hint,
+.rec-settings-none {
+  margin: 0;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-hint,
+.rec-settings-none {
+  font-size: 12px;
+}
+
+.rec-settings-section,
+.rec-settings-notcarried,
+.rec-settings-run {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  padding: 12px 14px;
+  background: var(--dsw-alias-bg-layer-2);
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 10px;
+}
+
+.rec-settings-h3 {
+  margin: 0;
+  font-size: 12px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.rec-settings-h4 {
+  margin: 6px 0 0;
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-run-header {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.rec-settings-run-title {
+  margin: 0;
+  font-size: 14px;
+  font-weight: 600;
+  overflow-wrap: anywhere;
+}
+
+.rec-settings-run-root {
+  flex: 1;
+  min-width: 0;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 11px;
+  color: var(--dsw-alias-label-tertiary);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/* Solid state pill, same vocabulary as .rec-pill but on the SHELL tokens
+   (the board's --board-* aliases are scoped to .rec-board/.rec-inspector). */
+.rec-settings-pill {
+  flex: none;
+  padding: 3px 10px;
+  font-size: 11px;
+  font-weight: 500;
+  line-height: 1;
+  border-radius: 999px;
+  color: var(--dsw-alias-label-primary-foreground);
+  background: var(--dsw-alias-label-tertiary);
+}
+
+.rec-settings-pill[data-pill='locked']      { background: var(--dsw-alias-state-success-primary); }
+.rec-settings-pill[data-pill='in-progress'] { background: var(--dsw-alias-state-business-primary); }
+.rec-settings-pill[data-pill='paused']      { background: var(--dsw-alias-state-warn-primary); }
+.rec-settings-pill[data-pill='blocked']     { background: var(--dsw-alias-state-error-primary); }
+.rec-settings-pill[data-pill='tampered']    { background: var(--dsw-alias-state-error-primary); }
+.rec-settings-pill[data-pill='advisory']    { background: var(--dsw-alias-state-warn-secondary); }
+.rec-settings-pill[data-pill='neutral']     { background: var(--dsw-alias-label-tertiary); }
+
+dl.rec-settings-source,
+dl.rec-settings-rows {
+  display: grid;
+  grid-template-columns: minmax(160px, 300px) 1fr;
+  gap: 4px 16px;
+  margin: 0;
+}
+
+.rec-settings-label {
+  font-size: 12px;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.rec-settings-value {
+  margin: 0;
+  color: var(--dsw-alias-label-primary);
+  overflow-wrap: anywhere;
+}
+
+/* An absent value is a STATEMENT, not an empty row — always visibly marked. */
+.rec-settings-absent {
+  color: var(--dsw-alias-state-warn-label);
+  font-style: italic;
+}
+
+.rec-settings-phases {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.rec-settings-phase {
+  display: flex;
+  align-items: baseline;
+  flex-wrap: wrap;
+  gap: 10px;
+  padding: 4px 10px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 6px;
+}
+
+.rec-settings-phase-id {
+  flex: none;
+  min-width: 40px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 11px;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-phase-name {
+  flex: 1;
+  min-width: 140px;
+  overflow-wrap: anywhere;
+}
+
+.rec-settings-phase-status,
+.rec-settings-phase-pos {
+  flex: none;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-size: 11px;
+  letter-spacing: 0.02em;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-phase-lock {
+  flex: none;
+  font-size: 11px;
+  color: var(--dsw-alias-label-tertiary);
+}
+
+.rec-settings-items {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.rec-settings-item {
+  display: flex;
+  align-items: baseline;
+  gap: 10px;
+  font-size: 12px;
+}
+
+.rec-settings-item-id {
+  flex: none;
+  min-width: 96px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.rec-settings-item-text {
+  flex: 1;
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+
 @media (prefers-reduced-motion: reduce) {
   .rec-card, .rec-back, .rec-close, .rec-theme-toggle { transition: none; }
 }

package/src/enforcement.ts

@@ -211,7 +211,33 @@ export function currentPhaseArtifact(worktreeRoot: string, runId: string): strin
       best = name
     }
   }
-  return best
+  // ⚠ FIX 2 (half a) — PRESENCE IS NO LONGER EVIDENCE OF PROGRESS, AND THIS USED TO ASSUME IT WAS.
+  //
+  // The loop above returns the HIGHEST-numbered phase artifact present, on the documented assumption that "a run at
+  // phase 3 has `00`-`03` on disk". That assumption stopped being true when `recursive_init` began scaffolding ALL
+  // TWELVE artifacts, `08-memory-impact.md` included — so from turn 0 the phase-8 baseline governed every guard call.
+  // Phase 8 is the documentation phase, whose rule denies writes outside the run tree, so a run sitting at phase 3
+  // had its SOURCE EDITS denied as though it were finished and merely writing up. A live verification pass recorded
+  // five denials out of five while trying to author phase artifacts.
+  //
+  // The workflow's own notion of progress is the LOCK, so the phase in force is the LOWEST-numbered artifact that is
+  // not locked — the phase actually being worked on. Once everything is locked the run is complete, and the previous
+  // answer still stands, which keeps the old behaviour exactly where the old reasoning held. Still read from the
+  // filesystem on every call, for the same no-cache reason the directory listing is.
+  let inForce = ''
+  let inForcePhase = Number.POSITIVE_INFINITY
+  for (const name of names) {
+    if (!name.endsWith('.md')) continue
+    const phase = phaseNumberForArtifact(name)
+    if (!phase) continue
+    const value = Number(phase)
+    if (getLockStatus(join(runDir, name)) === 'LOCKED') continue
+    if (value < inForcePhase) {
+      inForcePhase = value
+      inForce = name
+    }
+  }
+  return inForce !== '' ? inForce : best
 }
 
 export function evaluateToolGuard(
@@ -335,10 +361,56 @@ function resolveTargetPath(target: string, worktreeRoot: string): string | null
   return abs
 }
 
+/**
+ * The ADMISSION test for the tamper path: the resolved absolute path when
+ * `targetPath` names a run-tree `*.md` — a tamper CANDIDATE — and `null`
+ * otherwise. Pure path arithmetic on every branch (no filesystem work), so a
+ * caller may use it as a cheap shape check before paying for `existsSync`.
+ *
+ * ⚠ THE BLIND SPOT THIS FUNCTION EXISTS TO CLOSE. The admission test used to be a
+ * substring test on the target STRING alone, looking for `/.recursive/run/`. A
+ * repo-relative path has no separator before `.recursive`, so
+ * `.recursive/run/<id>/00-requirements.md` — the spelling a model actually types,
+ * and its backslash form — was rejected before ANYTHING was examined, and
+ * tampering with a locked artifact through that spelling was invisible
+ * (measured: `detectTamper` returned a record for the absolute path and `null`
+ * for the relative one, on the same file). The identical defect, in the identical
+ * spelling, was fixed one module over in `policy-globs.ts` `lockedWriteRule`; this
+ * is that fix's shape, reused rather than reinvented.
+ *
+ * So the marker is looked for on the path the target RESOLVES to as well as on
+ * the string as written. The `||` is load-bearing and the string test is KEPT
+ * rather than replaced, because a resolved-only test would SHRINK the admitted
+ * set: an absolute target that literally carries the marker but resolves away
+ * from it (`…/.recursive/run/../…`) was caught before and must stay caught. The
+ * net effect is a strict SUPERSET of the previous behaviour, so no tamper that
+ * was visible before can become invisible.
+ *
+ * EXPORTED because `src/index.ts`'s `fs/observed` listener must apply the SAME
+ * admission test before calling `detectTamper`. That listener used to carry a
+ * hand-copied mirror of this test, and a mirror is exactly what leaves half the
+ * defect behind: widening `detectTamper` alone changes nothing, because the
+ * listener rejects the spelling first. One function cannot disagree with itself.
+ */
+export function tamperCandidatePath(targetPath: string, worktreeRoot: string): string | null {
+  const normalized = targetPath.replace(/\\/g, '/')
+  if (!normalized.endsWith('.md')) return null
+  const abs = resolveTargetPath(normalized, worktreeRoot)
+  if (!abs) return null
+  const resolved = abs.replace(/\\/g, '/')
+  if (!normalized.includes('/.recursive/run/') && !resolved.includes('/.recursive/run/')) return null
+  return abs
+}
+
 /**
  * Layer 8 - fs/observed lock-tamper detection.
  * A locked *.md whose observed version differs from the stored LockHash is
  * a tamper. Returns a tamper reason (or null when clean/not-applicable).
+ *
+ * The admission test lives in `tamperCandidatePath` (above), shared with the
+ * `fs/observed` listener in `src/index.ts` — see the note there for why sharing
+ * it is the point and not a tidiness preference. What this function reports is
+ * unchanged: the same record shape, carrying the target AS WRITTEN.
  */
 export function detectTamper(
   targetPath: string,
@@ -346,8 +418,7 @@ export function detectTamper(
   activeRunId: string,
 ): { runId: string; path: string; reason: string } | null {
   const normalized = targetPath.replace(/\\/g, '/')
-  if (!normalized.endsWith('.md') || !normalized.includes('/.recursive/run/')) return null
-  const abs = resolveTargetPath(normalized, worktreeRoot)
+  const abs = tamperCandidatePath(normalized, worktreeRoot)
   if (!abs || !existsSync(abs)) return null
   const status = getLockStatus(abs)
   if (status === 'STALE_LOCK') {

package/src/errors.ts

@@ -147,6 +147,18 @@ export const TOOL_ERRORS = {
 
   /* 5xxx — the runtime refused an operation it understands. */
 
+  RUN_START_NO_CHANNEL: {
+    code: 'RM5502',
+    klass: 'runtime',
+    problem: 'the run-start gate needs an answer, and this composition mounts no user-questions channel to ask one directly',
+    next: 'call recursive_ask with gate: run-start and no answer to surface the question, then retry with answer: ' + '"Start run"',
+  },
+  RUN_START_UNANSWERED: {
+    code: 'RM5503',
+    klass: 'runtime',
+    problem: 'the user-questions channel mounted in this composition refused the run-start question, so no person was asked',
+    next: 'use recursive_ask without an answer to surface the question, and retry it with answer: ' + '"Start run" once the user has approved the run start',
+  },
   RUNTIME_REFUSED: {
     code: 'RM5501',
     klass: 'runtime',

package/src/goals-projection.ts

@@ -15,6 +15,7 @@
  * completed goal may be replaced, per the service contract).
  */
 import type { RunState } from './lifecycle.ts'
+import { RUN_START_NOT_APPROVED } from './run-start.ts'
 
 /** Native goal phase (mirrors @deepseek-ai/dsh-goal GoalPhase). */
 export type GoalPhase = 'active' | 'paused' | 'blocked' | 'complete'
@@ -97,8 +98,31 @@ function mutatePhase(service: GoalServiceLike, agent: AgentHandle, ref: GoalRefL
  * Sync a run's durable goal to the requested phase. Safe: never touches a goal
  * whose objective is not this run's marker, and never re-creates over a
  * non-complete foreign goal.
+ *
+ * ⚠ `approved` IS THE PHASE-0 GATE, and it defaults to the SAFE direction. A goal is not a label:
+ * `create` returns an ARMED view and the harness starts driving autonomous goal rounds for the
+ * session, so creating one is starting the run. The owner's rule is that phase 0 requires explicit
+ * approval, which means the projection must be unable to arm anything on its own — hence a default of
+ * `false` and an explicit refusal in EVERY branch that would call `create`, including the two
+ * replace-a-completed-goal branches (an unapproved run cannot have reached `complete`, but "cannot
+ * happen" is what the single unguarded branch relied on too).
+ *
+ * ⚠ AND IT IS REACHED ON ORDINARY WORK, so the unapproved path is QUIET AND IDEMPOTENT: no goal is
+ * created, nothing is written, no error is thrown, and the run's artifacts are untouched. The caller
+ * reads {@link RUN_START_NOT_APPROVED} to tell "this run has not been started yet" apart from a real
+ * failure, so a normal phase step never surfaces a warning.
+ *
+ * `approved` is passed IN rather than read here because this module is pure: it takes the goal service
+ * seam and nothing else, and the plugin's own filesystem reads live in the runtime (see
+ * `RecursiveRuntime.readRunStartApproval`).
  */
-export function syncRunGoal(service: GoalServiceLike | undefined | null, agent: AgentHandle, runId: string, runState: RunState): SyncResult {
+export function syncRunGoal(
+  service: GoalServiceLike | undefined | null,
+  agent: AgentHandle,
+  runId: string,
+  runState: RunState,
+  approved = false,
+): SyncResult {
   if (!service) return { ok: false, reason: 'no goals service' }
   const target = RUN_TO_GOAL_PHASE[runState]
   const current = service.get(agent)
@@ -110,6 +134,7 @@ export function syncRunGoal(service: GoalServiceLike | undefined | null, agent:
     if (phase === target) return { ok: true, phase: target, ref }
     // A completed goal is final: the contract allows it to be REPLACED, not resumed.
     if (phase === 'complete') {
+      if (!approved) return { ok: false, reason: RUN_START_NOT_APPROVED }
       const created = service.create(agent, { objective: goalObjective(runId, runState) })
       return { ok: true, phase: target, ref: refOf(created), created: true }
     }
@@ -121,29 +146,45 @@ export function syncRunGoal(service: GoalServiceLike | undefined | null, agent:
   //    cleared or resumed instead. Never clobber a foreign goal.
   if (current) {
     if (current.phase === 'complete') {
+      if (!approved) return { ok: false, reason: RUN_START_NOT_APPROVED }
       const created = service.create(agent, { objective: goalObjective(runId, runState) })
       return { ok: true, phase: target, ref: refOf(created), created: true }
     }
     return { ok: false, reason: 'a non-matching active goal exists (foreign goal not touched)' }
   }
 
-  // 3. No current goal -> create and arm.
+  // 3. No current goal. This is where the defect lived: scaffolding a run armed it. A run with no
+  //    phase-0 approval stays goal-less — the spec exists, the run does not.
+  if (!approved) return { ok: false, reason: RUN_START_NOT_APPROVED }
   const created = service.create(agent, { objective: goalObjective(runId, runState) })
   return { ok: true, phase: target, ref: refOf(created), created: true }
 }
 
-/** Block the current run goal (used on a gate-block). Never touches a foreign goal. */
+/**
+ * Block the current run goal (used on a gate-block). Never touches a foreign goal.
+ *
+ * ⚠ A RUN THAT WAS NEVER STARTED HAS NO GOAL TO BLOCK, so this reports the unapproved state in the
+ * same words as {@link syncRunGoal} rather than "no current goal to block": the caller's question is
+ * "why is there no goal", and the answer must not depend on which entry point happened to ask.
+ */
 export function blockRunGoal(service: GoalServiceLike | undefined | null, agent: AgentHandle, runId: string, reason: { code: string; message: string }): SyncResult {
   if (!service) return { ok: false, reason: 'no goals service' }
   const current = service.get(agent)
-  if (!current) return { ok: false, reason: 'no current goal to block' }
+  if (!current) return { ok: false, reason: RUN_START_NOT_APPROVED }
   if (!isRunGoal(current, runId)) return { ok: false, reason: 'current goal is not for this run (foreign goal not touched)' }
   const ref = refOf(current)
   const ok = !!service.block(agent, ref, reason)
   return ok ? { ok: true, phase: 'blocked', ref } : { ok: false, reason: 'goal block failed' }
 }
 
-/** Bridge a run's blocked goal back to active (used on a reopen). */
-export function resumeRunGoal(service: GoalServiceLike | undefined | null, agent: AgentHandle, runId: string): SyncResult {
-  return syncRunGoal(service, agent, runId, 'active')
+/**
+ * Bridge a run's blocked goal back to active (used on a reopen).
+ *
+ * ⚠ REOPEN IS NOT A BACK DOOR TO STARTING A RUN. It routes through {@link syncRunGoal}, so a reopen of
+ * an unapproved run cannot create the goal that init deliberately withheld. An APPROVED run is
+ * unaffected: its approval outlives the reopen, because the approval is a durable line in the run's
+ * own Phase 0 artifact rather than a value held in memory (verified in `tests/run-start-approval.spec.ts`).
+ */
+export function resumeRunGoal(service: GoalServiceLike | undefined | null, agent: AgentHandle, runId: string, approved = false): SyncResult {
+  return syncRunGoal(service, agent, runId, 'active', approved)
 }

package/src/index.ts

@@ -4,6 +4,7 @@ import type { ContextFormed } from '@deepseek-ai/dsh-llm'
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { RecursiveRuntime } from './runtime.ts'
+import type { UserQuestionsLike } from './runtime.ts'
 import type { JobsRegistryLike } from './jobs-runner.ts'
 import { planGateForExit } from './plan-gate.ts'
 import { registerPhaseSkills, type SkillRegistryLike } from './skills-phase.ts'
@@ -24,7 +25,7 @@ import { createRecursiveAskTool } from './recursive_ask.tool.ts'
 import { createRecursivePreviewTool } from './recursive_preview.tool.ts'
 import type { SubagentsRuntimeLike } from './delegation.ts'
 import { registerRecursiveCommand } from './commands.ts'
-import { evaluateToolGuard, coerceAskToDecision, type ToolGuardDecision } from './enforcement.ts'
+import { evaluateToolGuard, coerceAskToDecision, tamperCandidatePath, type ToolGuardDecision } from './enforcement.ts'
 import { appendGuardDecision, appendObservedTamper, type GuardDecisionRecord } from './guard-log.ts'
 import type { GoalServiceLike } from './goals-projection.ts'
 import type { TeamRuntimeLike } from './teams-loop.ts'
@@ -237,6 +238,14 @@ export function apply(ctx: Context, config?: RecursiveModeConfig) {
     ctx.inject(['llm'], (llmCtx: Context) => {
       recursive.attachLlmInventory((llmCtx.get('llm') as LlmInventoryLike | undefined) ?? null)
     })
+    // ⚠ PHASE 0 — THE HUMAN-QUESTION CHANNEL, resolved the same late-attaching way for the same reason:
+    // a composition may mount `userQuestions` after this plugin applies, and the run-start gate asks the
+    // person DIRECTLY through it before it arms a goal — which is what keeps a relayed `Start run` from
+    // being an approval while a person can actually be asked (see run-start.ts).
+    recursive.attachUserQuestions((ctx.get('userQuestions') as UserQuestionsLike | undefined) ?? null)
+    ctx.inject(['userQuestions'], (questionsCtx: Context) => {
+      recursive.attachUserQuestions((questionsCtx.get('userQuestions') as UserQuestionsLike | undefined) ?? null)
+    })
 
     // T7 — THE SETTINGS NAMESPACE, APPLIED ON EVERY APPLY. The settings service edits the
     // Loader entry's config and the Loader RE-APPLIES this plugin, so a toggle in the UI
@@ -307,9 +316,36 @@ export function apply(ctx: Context, config?: RecursiveModeConfig) {
     ctx.tools.register(createRecursiveAskTool(recursive)),
     // T26: the read-only view of what the enforcement contract will do, before it fires.
     ctx.tools.register(createRecursivePreviewTool(recursive)),
-      ...(agentTeams ? [ctx.tools.register(createRecursiveAuditTeamTool(agentTeams))] : []),
     ]
 
+    // ⚠ FIX 1 — THE THIRD SEAM NEEDED THE SAME LATE ATTACH AS THE OTHER TWO, AND DID NOT HAVE IT.
+    //
+    // The line that used to sit in the array above was `...(agentTeams ? [register(...)] : [])` — a ONE-SHOT
+    // `ctx.get('agentTeams')` taken at apply time. A live verification pass found the consequence: `team_task_create`
+    // worked in the same session whose tool catalog lacked `recursive_audit_team`, because the service was mounted
+    // AFTER this plugin applied. The plugin shipped 13 tool files and offered 12.
+    //
+    // `subagents` and `llm` already solve this with `ctx.inject` (above); this is that pattern, with one addition the
+    // others do not need: the tool may only be registered ONCE, because the one-shot path can already have taken it.
+    let auditTeamRegistered = agentTeams !== undefined && agentTeams !== null
+    if (auditTeamRegistered) disposers.push(ctx.tools.register(createRecursiveAuditTeamTool(agentTeams ?? null)))
+    ctx.inject(['agentTeams'], (teamCtx: Context) => {
+      if (auditTeamRegistered) return
+      const late = teamCtx.get('agentTeams') as TeamRuntimeLike | undefined
+      if (late === undefined || late === null) return
+      auditTeamRegistered = true
+      // ⚠ CORRECTED COMMENT. This registers through the OUTER plugin context (`ctx`), NOT through the
+      // injecting `teamCtx` — `teamCtx` is used on the line above only to READ the late service, and the
+      // sibling `subagents`/`llm` injects use their callback context the same way. The comment that used to
+      // sit here claimed the injecting scope owned the registration, which is not what this call does.
+      //
+      // WHAT IS NOT CLAIMED: that the fiber withdraws this registration. Nobody has observed that — no test
+      // covers the late `recursive_audit_team` being withdrawn — and the disposer returned here is not
+      // retained, unlike the eager registration above, which pushes its own onto `disposers`. Until a test
+      // observes the withdrawal, this comment promises nothing about it.
+      ctx.tools.register(createRecursiveAuditTeamTool(late))
+    })
+
     // /recursive command (R4): preset-scoped registration, workspace-scoped dispatch.
     const commands = ctx.get('commands') as { register: (def: unknown) => () => void } | undefined
     if (commands) {
@@ -501,16 +537,26 @@ export function apply(ctx: Context, config?: RecursiveModeConfig) {
           if (!displayPath) return
           // Cheap shape test BEFORE any filesystem work: fs/observed fires on reads
           // too, so enumerating runs for every observation would be a readdir per
-          // file touch. This is EXACTLY detectTamper's own admission test (same
-          // normalized string, same two conditions), so it can never reject a
-          // candidate detectTamper would have accepted.
-          const normalized = displayPath.replace(/\\/g, '/')
-          if (!normalized.endsWith('.md') || !normalized.includes('/.recursive/run/')) return
-          // The actor is the tool execution. This event cannot await, so the root is
-          // the actor's session cwd (the same B4 sync shortcut fsPolicyIntent takes:
-          // the session cwd is authoritative, the registry path is async-only).
+          // file touch. The actor is the tool execution. This event cannot await, so
+          // the root is the actor's session cwd (the same B4 sync shortcut
+          // fsPolicyIntent takes: the session cwd is authoritative, the registry
+          // path is async-only). Resolving the cwd first is free — plain property
+          // reads — and the admission test needs it.
           const cwd = (actor as { agent?: { session?: { header?: { cwd?: string } } } } | null)?.agent?.session?.header?.cwd ?? ''
           if (!cwd) return
+          // ⚠ AND THIS IS `detectTamper`'s OWN ADMISSION TEST, CALLED RATHER THAN COPIED.
+          //
+          // It used to be an inline hand-copy — `endsWith('.md') && includes('/.recursive/run/')`
+          // — and a hand-copy is what made the tamper guard blind to one spelling of one
+          // path: the substring test needs a separator BEFORE `.recursive`, which a
+          // repo-relative target (`displayPath` as a model would type it) does not have, so
+          // the listener rejected the candidate here and `detectTamper` was never reached.
+          // Widening only `detectTamper` would have changed nothing observable. The test now
+          // lives in one place (`tamperCandidatePath`), so the two cannot disagree; it stays
+          // pure path arithmetic, so the "no filesystem work before admission" property the
+          // shape check exists for is preserved.
+          const normalized = displayPath.replace(/\\/g, '/')
+          if (!tamperCandidatePath(normalized, cwd)) return
           const runId = resolveRunDir(cwd)?.runId ?? ''
           const tamper = recursive.detectTamper(normalized, cwd, runId)
           if (!tamper) return

package/src/memory-feedback.ts

@@ -19,7 +19,32 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 
 /** Where the machine-owned counters live — inside the memory plane, but never a shard a person writes. */
-export const FEEDBACK_FILE = 'memory/.feedback.json'
+// The path is `.recursive/memory/.feedback.json`, joined onto the REPO ROOT, which is what the
+// doc comment above has always said and what `filterRuntimeChangedFiles` expects: a counter the
+// memory plane writes must live inside the `.recursive` control plane, not in the product tree.
+// Measured before this fix: a completed fixture run ended with four residual FAILs naming
+// `memory/.feedback.json` against phases 03 and 03.5, because the file landed outside
+// `.recursive/run/<runId>/`, survived the runtime-diff filter, and entered the run's diff only
+// after those phases were authored - retro-invalidating them. The counter is machine-owned and
+// disposable per the same doc comment, so a counter left at the OLD path by an earlier version is
+// READ once (see LEGACY_FEEDBACK_FILE) rather than silently dropped.
+export const FEEDBACK_FILE = '.recursive/memory/.feedback.json'
+
+/**
+ * WHERE THE COUNTERS LIVED BEFORE the constant above carried its `.recursive/` prefix.
+ *
+ * ⚠ READ, BUT DELIBERATELY NEITHER MOVED NOR DELETED. Read, because evidence a previous run recorded is
+ * not the plugin's to discard, and without the fallback the first settle after the move would start the
+ * new file from an empty book — a counter lost silently, which is the one outcome ruled out. NOT moved,
+ * because a delete is the single action that could re-create the very defect the prefix fixes: a legacy
+ * file that is TRACKED and COMMITTED is absent from the run's diff while it is clean, so removing it
+ * mid-run puts `D memory/.feedback.json` into the diff of every diff-audited phase authored before the
+ * delete, which is the same retro-invalidation. Left alone, an untracked legacy file is in the diff from
+ * the run's first phase (and is therefore accounted for), while a committed one stays invisible.
+ * `readFeedback` prefers {@link FEEDBACK_FILE}, so the legacy counters are folded forward by the next
+ * settle and this file then only sits there; it is machine-owned and disposable, so delete it by hand.
+ */
+export const LEGACY_FEEDBACK_FILE = 'memory/.feedback.json'
 
 /** Where a run records what it was shown. */
 export const INJECTIONS_FILE = 'memory-injections.json'
@@ -43,10 +68,24 @@ export interface FeedbackCounter {
 
 export type FeedbackBook = Record<string, FeedbackCounter>
 
-/** Read the counters. A missing or unreadable file is an empty book, never an error. */
+/**
+ * Read the counters. A missing or unreadable file is an empty book, never an error.
+ *
+ * ⚠ THE LEGACY PATH IS A FALLBACK AND ONLY A FALLBACK: it is consulted when — and only when — there is
+ * no usable file at {@link FEEDBACK_FILE} yet, which is exactly the first run after the path moved. The
+ * two are never merged, because they are two SNAPSHOTS of one counter and adding them would count a run
+ * twice. A file that exists at the current path but does not parse stays an empty book, which is what
+ * this function has always promised: a corrupt sidecar is not an invitation to read a different file.
+ */
 export function readFeedback(root: string, readFile: (path: string) => string | null = defaultRead): FeedbackBook {
-  const text = readFile(join(root, FEEDBACK_FILE))
-  if (text === null || text.trim() === '') return {}
+  const current = readFile(join(root, FEEDBACK_FILE))
+  if (current !== null && current.trim() !== '') return parseBook(current)
+  const legacy = readFile(join(root, LEGACY_FEEDBACK_FILE))
+  return legacy === null ? {} : parseBook(legacy)
+}
+
+/** One counters file as a book: anything unreadable or unshaped is `{}`, never an error. */
+function parseBook(text: string): FeedbackBook {
   try {
     const parsed = JSON.parse(text) as unknown
     if (typeof parsed !== 'object' || parsed === null) return {}
@@ -140,7 +179,13 @@ export function settleInjections(
     book[record.source] = counter
   }
 
-  write(join(root, FEEDBACK_FILE), JSON.stringify(sortBook(book), null, 2) + '\n')
+  const feedbackPath = join(root, FEEDBACK_FILE)
+  // The counter now lives under the `.recursive` control plane, whose memory directory a fresh
+  // checkout or a scratch fixture may not have yet. Creating it here rather than assuming it
+  // exists is what a plugin owning its own control plane should do; before this, the write
+  // threw ENOENT when nothing else had already made the directory.
+  mkdirSync(dirname(feedbackPath), { recursive: true })
+  write(feedbackPath, JSON.stringify(sortBook(book), null, 2) + '\n')
   return book
 }
 

package/src/phase-rules.ts

@@ -490,7 +490,16 @@ export function resolveFrom(worktreeRoot: string, target: string): string | null
   const normalized = target.replace(/\\/g, '/').trim()
   if (!normalized) return null
   if (/^[A-Za-z]:\//.test(normalized) || normalized.startsWith('/')) return resolve(normalized)
-  return resolve(join(worktreeRoot, normalized.replace(/^\.?\/?/, '')))
+  // ⚠ FIX 2 — THIS USED TO STRIP A LEADING DOT, WHICH IS NOT THE SAME AS STRIPPING `./`.
+  //
+  // The regex was `/^\.?\/?/`: an optional dot followed by an optional slash. Its intent was plainly to normalise a
+  // `./relative` path, but on a DOTFILE path it removed the dot and kept the name — so `.recursive/run/<id>/01.md`
+  // resolved to `<root>/recursive/run/<id>/01.md`, OUTSIDE the run tree it names. Under strict enforcement the phase
+  // guard denies writes outside the run tree, and a live verification pass recorded five denials out of five while
+  // trying to author phase artifacts — the model could not write the very files the workflow is about.
+  //
+  // Only `./` is a relative-path prefix. A bare leading dot is part of the name.
+  return resolve(join(worktreeRoot, normalized.replace(/^\.\//, '')))
 }
 
 /** The tool-target path of a call (same key order enforcement.ts uses). */