@xhulz/nina 0.47.0 → 0.48.0

package/releases/0.48.0/surfaces/money/tree/.claude/patterns.md

@@ -0,0 +1,49 @@
+<!-- nina:slot money.1 -->
+
+---
+
+## Monetary values & percentages
+
+- **Money is an integer of the currency's minor unit**, end to end — {{MINOR_UNIT}}, never a float, never a type that can hold a fraction of one. Source of precision: `{{MONEY_MODULE}}`.
+- **Percentages are basis points** (`40% → 4000`, `100% → 10000`) so a distribution is exact without floating point.
+- **Parsing, formatting and percentage arithmetic live in one module and nowhere else.** A second place that turns a string into money is a second rounding rule, and the two will disagree on a value somebody is owed.
+- **Never** convert to a floating-point type before formatting, and never let a display format round a stored value.
+- Monetary database columns are integer. JSON responses serialize them as **strings**, not numbers, so no client parses them into a float. The service owns the conversion.
+
+<!-- nina:slot money.2 -->
+
+---
+
+## Distribution invariants (enforced by reviewer + unit tests)
+
+The distribution engine lives in `{{CORE_PKG}}`. It is pure and total over integer {{MINOR_UNIT}}:
+
+- A destination is either a percentage (basis points of the amount) or a fixed value.
+- `total = Σ destinations`, computed in {{MINOR_UNIT}}.
+- `total > amount` → **reject.** Never clamp, never distribute what is not there.
+- `total < amount` → **allow**, surface the shortfall, and leave the remainder **parked**. Silence is the defect here: an unexplained remainder is indistinguishable from a bug.
+- `total = amount` → OK.
+- A retention is just another destination — the same arithmetic applies to it, with no special case.
+
+<!-- nina:slot money.3 -->
+
+---
+
+## State machines & idempotency (enforced by reviewer)
+
+- **Every money-moving entity is a state machine.** Its states and legal transitions are declared in `.claude/architecture.md`; the code follows the declaration, not the other way round. Illegal transitions throw; they are never silently coerced.
+- **Every transition writes an audit row** (entity type, entity id, from, to, actor). No transition without a trail — the trail is what makes a money bug diagnosable after the money has moved.
+- **Outbound transfers are idempotent.** Each carries a unique key, and dedupe happens before the side effect, at the serialization point.
+- **One serialization point per balance.** Whatever computes and dispatches against a single balance never runs concurrently with itself. Two concurrent runs over one balance is how a double send happens even when every individual write is correct.
+
+<!-- nina:slot money.4 -->
+- **Money computation and dispatch go through the serialization point.** Routes, queue consumers and tools never run a distribution or a transfer synchronously in the request path.
+
+<!-- nina:slot money.5 -->
+- **The distribution engine lives in `{{CORE_PKG}}`.** Services call it as a pure function; they do not embed money logic inline.
+
+<!-- nina:slot money.6 -->
+- Idempotency on money-moving writes: the record carries an idempotency key, and the serialization point refuses the second attempt *before* the side effect.
+
+<!-- nina:slot money.7 -->
+- `{{CORE_PKG}}` is the most-tested package — pure functions over fixtures. Cover the distribution invariants exhaustively: over, under, exact, mixed percentage and fixed, and rounding.

package/releases/0.48.0/surfaces/money/tree/.claude/pipeline.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+  - **Money invariants respected** — a distribution never exceeds the amount; a shortfall is parked, not distributed; transfers idempotent; every transition audited.

package/releases/0.48.0/surfaces/money/tree/.claude/retrieval.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+| New distribution / transfer logic | `.claude/architecture.md` § *Money*, `.claude/patterns.md` § *Distribution invariants*, `{{CORE_PKG}}/` | architect → implementer → reviewer → qa |

package/releases/0.48.0/surfaces/money/tree/CLAUDE.md

@@ -0,0 +1,11 @@
+<!-- nina:slot money.1 -->
+3. **An outbound transfer is idempotent — it is NEVER sent twice.** Every transfer carries an idempotency key, and deduplication happens at a single serialization point **before** the side effect, never after it. A retry, a re-delivered queue message, a double-click and a replayed webhook must all collapse to one transfer. This is the highest-blast-radius invariant in the system: almost everything else can be corrected afterwards, and a duplicated transfer cannot.
+
+<!-- nina:slot money.2 -->
+4. **Conservation — what comes in equals what goes out plus what is retained.** A distribution may NEVER exceed the amount it distributes → **block**. If it is **less**, **alert** and leave the remainder **parked** and visible — never silently distributed, never silently absorbed. All arithmetic is integer {{MINOR_UNIT}}; percentages are basis points. The LLM never computes a monetary value.
+
+<!-- nina:slot money.3 -->
+5. **State-machine integrity.** Every money-moving entity has an explicit set of states and legal transitions, declared in `.claude/architecture.md` § *State machines* — not inferred from whatever code happens to exist. Only declared transitions are legal; an illegal one throws and is never silently coerced. **Every transition writes an audit row** (entity, id, from → to, actor, when). Skipping a state, inventing one, or landing a transition with no audit row is a hard reject.
+
+<!-- nina:slot money.4 -->
+- **money movement**: anything that creates, moves, settles or records a balance

package/releases/0.48.0/surfaces/pii/tree/.claude/agents/dba.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy.** No sensitive value in clear text where it must not be. The categories are declared in `.claude/architecture.md` § *Privacy* — they are not decided per query, and not decided by you. **Document bytes live only in the object store, referenced by key: the column holds the key, never the bytes.** Any column the architect's spec flagged for masking must be encrypted at rest. Reject a schema that widens what is stored in the clear.

package/releases/0.48.0/surfaces/pii/tree/.claude/agents/devops.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+
+**Point it at an UNAUTHENTICATED route — a sign-in page is the right one.** Never sign in, and never
+screenshot a signed-in page. Accounts on deployed environments hold real personal data, and a
+screenshot or a console dump pulls it into agent transcripts and logs, where it persists and nobody
+ever looks for it again. That is a privacy leak with no upside here: the sign-in page proves
+everything this check is for. It renders from the same bundle, it exercises the same build-time env
+inlining (a missing variable blanks it identically), and it needs no session.

package/releases/0.48.0/surfaces/pii/tree/.claude/agents/reviewer.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+- Check for privacy regressions: **no sensitive value in a log, an error message — a library's own included — a URL or a test fixture**, per the categories in `.claude/architecture.md` § *Privacy*; document bytes only in the object store, never plaintext in the database; no leaked secret.
+
+<!-- nina:slot pii.2 -->
+- **privacy** — the privacy check above, in full: no sensitive value in a log, an error message, a
+  URL or a test fixture; document bytes only in the object store; no leaked secret. Where
+  **tenant-and-privacy** is dispatched, its reviewer owns this too and there is no separate one; where
+  it is not, this is a dimension of its own. Either way it is never nobody's.

package/releases/0.48.0/surfaces/pii/tree/.claude/agents/secops.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy (Hard Rule #8)** — the categories declared in `.claude/architecture.md` § *Privacy* must never appear in logs, in responses that do not need them, in error paths, or in the database in clear text. Check every endpoint that returns a person's record for fields it includes by accident: a `select` that quietly grew a column is the usual way this leaks. Check the error paths too — they are written last and reviewed least — and what the libraries on them print or carry in their own errors, bound values included.

package/releases/0.48.0/surfaces/pii/tree/.claude/agents/solidity-auditor.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+- **Nothing personal reaches the chain.** What is written on-chain is public, permanent, and beyond
+  deletion by anyone — including by you, and including after a subject asks. A hash of a personal
+  identifier is not a protection: it is a lookup table for whoever holds the input set. Reject a
+  personal datum stored in state, emitted in an event, or passed as calldata.

package/releases/0.48.0/surfaces/pii/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+8. **Sensitive personal data is classified, and the classification is enforced.** What counts as sensitive here — identity documents, financial identifiers, anything a person would not expect to be readable by whoever can read a log — is declared in `.claude/architecture.md` § *Privacy*, along with the regime that governs it ({{PRIVACY_REGIME}}). Encrypted at rest. **No sensitive value in a log, an error message, a URL, an analytics event, or an agent transcript** — the places nobody thinks about are exactly the ones that persist. That includes what a library puts in its own errors and prints itself: a database client's error can carry the query and every bound value, and a framework can log a whole error past the logger it was given. A database error is mapped at the data layer to a typed error from a closed list before anything logs or returns it, and a test proves that a bound value it writes reaches no thrown error. Document bytes live only in the object store, referenced by key, never in the database in clear text.
+
+<!-- nina:slot pii.2 -->
+- **personal data**: where it is collected, stored, logged or sent

package/releases/0.48.0/surfaces/prisma/tree/.claude/agents/architect.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.48.0/surfaces/prisma/tree/.claude/agents/dba.md

@@ -0,0 +1,42 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-cli` | **before ANY `prisma` CLI command** — `validate`, `format`, `migrate dev`, `migrate diff`, `migrate deploy`. Flags differ between versions, and one of them (`migrate diff --shadow-database-url` against a live database) destroys the database it points at |
+| `prisma-client-api` | auditing a new or changed query — filters, operators, `$transaction` semantics. Through a driver adapter, cite the adapter's installed source for what a transaction does: the skill describes the default engine, and an adapter can roll back less |
+
+<!-- nina:slot prisma.2 -->
+Neither skill covers a **caching or edge layer sitting on top of the client** — cache strategy,
+edge-client behaviour and the rule about never caching a read that authorizes a write belong to that
+layer's own integration doc, declared like any other integration. A skill does not replace it.
+
+<!-- nina:slot prisma.3 -->
+- **With Prisma, both offline.** Run `pnpm --filter {{DB_PKG_NAME}} exec prisma validate`; it must pass. Then run `prisma migrate diff` in its **offline, file-only form** and read the generated SQL, not just the Prisma delta. Its flags changed in Prisma 7, so read the installed major (`prisma --version`) before writing the command:
+
+   ```
+   # Prisma 6. Compare the PREVIOUS schema against the working one — pure file-to-file, no database.
+   git show HEAD:{{DB_PKG}}/prisma/schema.prisma > /tmp/schema-head.prisma
+   pnpm --filter {{DB_PKG_NAME}} exec prisma migrate diff \
+     --from-schema-datamodel /tmp/schema-head.prisma \
+     --to-schema-datamodel prisma/schema.prisma \
+     --script
+   ```
+
+   From Prisma 7 the two flags are `--from-schema` and `--to-schema`, and the schema engine starts from the
+   datasource in `prisma.config.ts` even for this diff: with none there, it prints nothing and exits 0. For
+   SQLite a placeholder the diff never opens is enough, a `file:` URL under a gitignored directory; for any
+   other provider, find out what the diff opens before you give it one. Never a real database's URL. A first schema has nothing at `HEAD`: diff it `--from-empty`. Compare the output against the
+   hand-written `migration.sql` to confirm the declarative parts match.
+
+   ⚠️ **Do NOT reach for `--from-migrations`.** It looks like the natural choice and it is a trap:
+   Prisma refuses it without a shadow database (`--shadow-database-url`, or from Prisma 7 a
+   `shadowDatabaseUrl` in `prisma.config.ts`), which pushes you toward supplying a database URL — the exact move that destroys databases (below). The file-to-file form above answers the
+   same question with no database involved.
+
+   ⛔ **NEVER point `--shadow-database-url`, `--from-url`, `--to-url`, `--from-schema-datasource` — or, from Prisma 7, a `shadowDatabaseUrl` or the config datasource behind `--from-config-datasource` — at a real database, most of all not the one `{{SECRETS_LOCAL}}` names.** Prisma **executes** the entire migration history against whatever database those flags name, which **DESTROYS ALL DATA** in it. A shadow database must be a disposable, empty database and nothing else. It does not announce itself: the command completes with a reassuring "empty migration" result and no error, having already destroyed everything in the database it was pointed at. If the offline form above cannot answer your question, **STOP and report that to the orchestrator** instead of reaching for a database URL.
+
+<!-- nina:slot prisma.4 -->
+- **Where reads are cached through Prisma Accelerate,** every `findUnique` / `findMany` on a hot read path names its `cacheStrategy` (`ttl` / `swr`), and one that feeds a correctness-critical write names none.
+
+<!-- nina:slot prisma.5 -->
+- **On an edge runtime,** new Prisma code paths use the edge client of the installed major: `@prisma/client/edge` up to Prisma 6; from 7, the client the `prisma-client` generator writes with the platform's `runtime` set, imported from where it is generated — `@prisma/client/edge` fails there with `MODULE_NOT_FOUND`.
+
+<!-- nina:slot prisma.6 -->
+- Run a Prisma command that writes to a real database — `prisma migrate dev`, `migrate deploy`, `migrate reset`, `migrate resolve`, `db push`, `db execute`, `$executeRaw*` — or **any `prisma migrate diff` variant carrying a database URL**, which silently wipes the database it points at.

package/releases/0.48.0/surfaces/prisma/tree/.claude/agents/devops.md

@@ -0,0 +1,11 @@
+<!-- nina:slot prisma.1 -->
+- **`prisma-cli`** — before `migrate deploy` or any other Prisma CLI command against a real database.
+
+<!-- nina:slot prisma.2 -->
+- **Prisma migrations go out with `prisma migrate deploy`**, and nothing else changes a shared database's schema.
+
+<!-- nina:slot prisma.3 -->
+- Run `prisma migrate diff --shadow-database-url <url>` against any live database. It **executes** the migration history against that database, destroying everything in it, and reports success. Use a disposable shadow database or don't run it.
+
+<!-- nina:slot prisma.4 -->
+- Run `prisma migrate reset` against a shared database, ever.

package/releases/0.48.0/surfaces/prisma/tree/.claude/agents/implementer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.48.0/surfaces/prisma/tree/.claude/agents/integration-tester.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-cli` | a Prisma CLI command |

package/releases/0.48.0/surfaces/prisma/tree/.claude/agents/reviewer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.48.0/surfaces/prisma/tree/.claude/patterns.md

@@ -0,0 +1,15 @@
+<!-- nina:slot prisma.1 -->
+- **Database table/column names** (Prisma `@map` / `@@map`): `snake_case` in SQL, `camelCase` in TS.
+
+<!-- nina:slot prisma.2 -->
+- Where Prisma reads are cached through Accelerate, `cacheStrategy` lives in `{{DB_PKG}}`: services do not add, strip, or override cache policies.
+
+<!-- nina:slot prisma.3 -->
+
+### Prisma
+
+- Schema lives in `{{DB_PKG}}/prisma/schema.prisma`. Nowhere else.
+- **Never write raw SQL** unless justified in a code comment with perf data.
+- N+1 is solved with `include` / `select`, chosen deliberately.
+- Where reads are cached through Accelerate, every `findUnique` / `findMany` on a hot path defines its `cacheStrategy`, and no direct connection string is embedded in code.
+- Tests run a real Prisma client against a real database; the client is never mocked.

package/releases/0.48.0/surfaces/prisma/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot prisma.1 -->
+| Run any `prisma` CLI command (the database gate, devops, and the integration gate where there is one) | `prisma-cli` | flags differ between versions; `migrate diff --shadow-database-url` against a live DB wiped dev/staging once |
+
+<!-- nina:slot prisma.2 -->
+| Write or audit a Prisma query (architect, implementer, the database gate, reviewer) | `prisma-client-api` | filters, operators, `$transaction` semantics. a caching or edge layer on top of the client is **NOT covered** — its cache strategy belongs to that layer's own integration doc |

package/src/commands/check.mjs

@@ -297,6 +297,16 @@ export async function check(argv, ctx) {
       notes.push(`${label} names boundary "${entry.boundary}", which does not exist yet`);
     }
   }
+  // The other direction: a doc no integration declares is retired, waits for its boundary, or lost its
+  // declaration, and nothing told a reader which. Said as a note, and as a deferral once the profile says why.
+  const declaredSlugs = new Set(integrations.map((entry) => entry?.slug));
+  const docs = await readdir(join(target, '.claude', 'integrations')).catch(() => []);
+  for (const doc of docs.filter((name) => name.endsWith('.md') && !declaredSlugs.has(name.slice(0, -'.md'.length))).sort()) {
+    const key = `.claude/integrations/${doc}`;
+    const why = deferredWhy(profile, key);
+    if (why) deferredUsed.add(key);
+    notes.push(why ? `deferred: ${key} — ${why}` : `${key} documents no declared integration — declare it, or say under "deferred" why not: retired, or waiting for its boundary`);
+  }
 
   const slots = await projectSlots(resolved.dir, surfaces);
   const filled = await filledSlots(target);

package/src/commands/gate.mjs

@@ -2,6 +2,7 @@
  * `nina gate` — the loop gate's own check, and a way to run it by hand.
  *
  *   nina gate --selftest   is the gate wired, has it failed, would it still hold a loop past its cap?
+ *   nina gate --status     the loops a session holds open, and what would close each
  *   nina gate --hook       handle one hook event from stdin, the way the composed script does
  *
  * The gate lets every call through when anything goes wrong, which is right for a hook and makes a
@@ -20,7 +21,7 @@ import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { readProfile, slugFor } from '../paths.mjs';
 import { GATE, hookCommand, missingWiring, shippedScripts } from '../wiring.mjs';
-import { LEDGER_TAIL, ledgerPath, loadProject, projectGateDir, readLedger, runGate } from '../gate.mjs';
+import { LEDGER_TAIL, ledgerPath, loadProject, loopState, projectGateDir, readLedger, runGate } from '../gate.mjs';
 import { projectRecords } from '../store.mjs';
 import { layerRootFor } from './compose.mjs';
 import { handsToModel } from '../detectors.mjs';
@@ -271,13 +272,63 @@ function dryRun(target) {
 }
 
 /**
- * @param {string[]} argv - `[--selftest | --hook] [--project <dir>]`.
+ * What the gate holds of one session: its loops, what would close each, and the loop-backs waiting on a fix —
+ * the same lines a compaction hands the orchestrator, at any time. The session is the one whose ledger was
+ * written last, which is the running one while it dispatches, or the one `--session` names by the start of its id.
+ *
+ * @param {string} target - The project directory.
+ * @param {string|undefined} wanted - The start of a session id, or nothing for the latest.
+ * @returns {number} Process exit code.
+ */
+function loopStatus(target, wanted) {
+  const project = loadProject(target);
+  if (!project) {
+    console.error('  .claude/graph.md is not composed, so the gate has no loops to hold — run `nina compose`\n');
+    return 2;
+  }
+  const dir = projectGateDir(target);
+  const ledgers = (existsSync(dir) ? readdirSync(dir) : [])
+    .filter((f) => f.endsWith('.jsonl') && f !== 'errors.jsonl')
+    .map((f) => ({ session: f.slice(0, -'.jsonl'.length), written: statSync(join(dir, f)).mtime }))
+    .sort((a, b) => b.written - a.written);
+  if (ledgers.length === 0 && !wanted) {
+    console.log(`  the gate has no ledger here yet: no session has dispatched a stage since it was wired (${dir})`);
+    console.log('gate: no open loop');
+    return 0;
+  }
+  const matching = wanted ? ledgers.filter((l) => l.session.startsWith(wanted)) : ledgers.slice(0, 1);
+  if (matching.length !== 1) {
+    const why = matching.length === 0 ? `no session starts with "${wanted}"` : `${matching.length} sessions start with "${wanted}" — give more of the id`;
+    console.error(`  ${why} (${dir})\n`);
+    return 2;
+  }
+  const { session, written } = matching[0];
+  const state = loopState(project, readLedger(join(dir, `${session}.jsonl`)));
+  const others = ledgers.length > 1 ? `; ${ledgers.length - 1} other session(s) kept here, --session <id> for one` : '';
+  console.log(`  session ${session}, its ledger last written ${written.toISOString().slice(0, 16).replace('T', ' ')} UTC${others}`);
+  for (const line of state.lines) console.log(`  ${line}`);
+  const counts = [
+    state.open ? `${state.open} open loop(s)` : 'no open loop',
+    state.closing ? `${state.closing} settled, dropped at the next dispatch` : '',
+    state.waiting ? `${state.waiting} loop-back(s) waiting on a fix` : '',
+  ];
+  console.log(`gate: ${counts.filter(Boolean).join(', ')}`);
+  return 0;
+}
+
+/**
+ * @param {string[]} argv - `[--selftest | --status [--session <id>] | --hook] [--project <dir>]`.
  * @param {{root: string}} ctx - CLI context; `root` is the NINA install directory.
  * @returns {Promise<number>} Process exit code.
  */
 export async function gate(argv, ctx) {
   const target = resolve(argv.includes('--project') ? argv[argv.indexOf('--project') + 1] : '.');
   if (argv.includes('--hook')) return runGate({ root: target });
+  if (argv.includes('--status')) return loopStatus(target, argv.includes('--session') ? argv[argv.indexOf('--session') + 1] : undefined);
+  if (argv.includes('--session')) {
+    console.error('  --session names the session --status reads, and means nothing without it\n');
+    return 2;
+  }
 
   const { profile, error } = readProfile(target);
   if (error) {

package/src/commands/init.mjs

@@ -218,14 +218,21 @@ async function interview(available, matched, impacts) {
     const scope = lines.join(' ');
 
     const order = available;
-    console.log(`\n  ${strong('Surfaces')} — ${order.length} yes-or-no questions, one per surface.`);
+    console.log(`\n  ${strong('Surfaces')} — up to ${order.length} yes-or-no questions, one per surface; a stack comes only after a yes to what it needs.`);
     console.log('  A surface is a part of the harness only some projects need: its rules, its checks, sometimes a');
     console.log('  whole role. Answer for what the project does today; one can be added later in .nina/profile.json.\n');
     const surfaces = [];
+    let asked = 0;
     for (const [n, s] of order.entries()) {
       // A stack is asked about only where its concern was answered yes: asked whether data it does not
       // own goes through Prisma, a project has nothing true to answer.
       if (missingNeeds(s, surfaces).length > 0) continue;
+      // Counted by what is asked, not by place in the list: numbered by place, a no to the database read
+      // 1/10 then 4/10, and the header promised ten questions to someone asked seven. The total is what is
+      // asked so far plus what can still be, so a no shrinks it; the last question is n/n while the order
+      // ends with a surface that needs nothing, as it does.
+      asked += 1;
+      const total = asked + order.slice(n + 1).filter((t) => missingNeeds(t, [...surfaces, ...order.slice(n)]).length === 0).length;
       const i = impacts[s];
       const reason = matched.find((d) => d.surface === s)?.why;
       // What a yes brings, in what a person would recognise: roles, rules, agents. The count of
@@ -235,7 +242,7 @@ async function interview(available, matched, impacts) {
         ...(i.rules ? [`${i.rules} hard rule${i.rules > 1 ? 's' : ''}`] : []),
         ...(i.agents.length ? [`changes to ${i.agents.length} agent${i.agents.length > 1 ? 's' : ''}`] : []),
       ];
-      console.log(`  ${faint(`${n + 1}/${order.length}`)}  ${strong(s)}`);
+      console.log(`  ${faint(`${asked}/${total}`)}  ${strong(s)}`);
       console.log(`       ${questionFor(s)}`);
       console.log(faint(`       if yes: ${brings.length ? brings.join(' · ') : `guidance in ${i.fragments} places`}`));
       if (reason) console.log(found(`       already here: ${reason}`));

package/src/gate.mjs

@@ -280,11 +280,13 @@ function append(path, entry) {
  * @param {object[]} entries - The ledger, oldest first.
  * @param {ReturnType<typeof loopEdges>} loops - The capped loop-back edges.
  * @param {Map<string, Set<string>>} [forward] - Stage → the sources that hand passing work on to it.
- * @returns {{effect: (to: string) => {rounds: object[]}, rounds: object[]}}
+ * @returns {{effect: (to: string) => {rounds: object[]}, rounds: object[], open: object[], waiting: object[]}}
  *   A round is `{source, target, token, round, max, edgeRound, ceiling, agents}`, plus `issue` (the id
  *   that decides it) and `issues` (every id with its count) when it was counted by issue.
  *   `effect` says what a dispatch to a stage would make now, without making it; `rounds` is every round
- *   the recorded dispatches made.
+ *   the recorded dispatches made; `open` each loop still counted, with whether a pass already closes it
+ *   (`closing`), the stages a dispatch to which would (`targets`) and the stages whose pass would (`onward`);
+ *   `waiting` each loop-back no fix has acted on yet.
  */
 export function replay(entries, loops, forward = new Map()) {
   // When each dispatch went out. A foreground dispatch's `dispatch` entry is written after the agent
@@ -329,15 +331,23 @@ export function replay(entries, loops, forward = new Map()) {
     for (const map of [streak, grace]) for (const key of [...map.keys()]) if (key.startsWith(`${source}|`)) map.delete(key);
   };
 
+  /**
+   * A source's waiting verdicts, settled: the rejections no later review of a fix cancelled, and whether a pass
+   * closes its loops — one that began after the latest fix, with no rejection running beside it.
+   */
+  const settle = (source, batch) => {
+    const passes = batch.filter((v) => !isLoopBack(v.verdict));
+    const live = batch.filter((v) => isLoopBack(v.verdict) && !passes.some((p) => p.launch > v.at && fixBetween(source, v.at, p.launch)));
+    return { live, closes: passes.some((p) => p.launch > (lastFix.get(source) ?? -1) && !live.some((v) => v.launch < p.at)) };
+  };
+
   const effect = (to, at) => {
     const rounds = [];
     const outcome = [];
     for (const [source, batch] of pending) {
       const byToken = loops.get(source);
       if (!byToken || batch.length === 0 || !targetsOf(source).has(to)) continue;
-      const passes = batch.filter((v) => !isLoopBack(v.verdict));
-      const live = batch.filter((v) => isLoopBack(v.verdict) && !passes.some((p) => p.launch > v.at && fixBetween(source, v.at, p.launch)));
-      const closes = passes.some((p) => p.launch > (lastFix.get(source) ?? -1) && !live.some((v) => v.launch < p.at));
+      const { live, closes } = settle(source, batch);
       const routed = live.filter((v) => byToken.get(v.verdict)?.has(to));
       const fresh = routed.filter((v) => {
         const last = streak.get(`${source}|${v.verdict}`);
@@ -434,13 +444,18 @@ export function replay(entries, loops, forward = new Map()) {
   });
   // What is open when the replay ends: each loop with its rounds, the rounds the owner's replies gave it and the
   // issues it counted by, and each loop-back no fix has acted on yet — what a compaction takes from the orchestrator.
+  // A loop whose source passed after the latest fix is closed by the next dispatch it could act on, and until then
+  // is still in the count; it says so, and what would close each of the others. Listed as open, three loops
+  // approved the evening before a compaction were handed back as capped, and the orchestrator went looking for why.
   const open = [...streak.entries()]
     .filter(([key]) => key.split('|').length === 2)
     .map(([key, s]) => {
       const [source, token] = key.split('|');
       const cap = Math.max(0, ...(loops.get(source)?.get(token)?.values() ?? []));
       const issues = [...streak.keys()].filter((k) => k.startsWith(`${key}|`)).map((k) => k.slice(key.length + 1));
-      return { source, token, rounds: s.n, cap, given: grace.get(key) ?? 0, issues };
+      const closing = settle(source, pending.get(source) ?? []).closes;
+      const onward = [...forward].filter(([, sources]) => sources.has(source)).map(([stage]) => stage);
+      return { source, token, rounds: s.n, cap, given: grace.get(key) ?? 0, issues, closing, targets: [...targetsOf(source)], onward };
     });
   const waiting = [...pending.entries()].flatMap(([source, batch]) => batch.filter((v) => isLoopBack(v.verdict)).map((v) => ({ source, verdict: v.verdict, issues: v.issues ?? [] })));
   return { effect: (to) => effect(to, entries.length), rounds: made, open, waiting };
@@ -671,32 +686,56 @@ function onPre(input, project, path, at) {
   return confirmation(worst);
 }
 
+/** Stages as a sentence lists them: `qa`, `implementer or architect`, `a, b or c`. */
+const either = (stages) => (stages.length < 2 ? stages.join('') : `${stages.slice(0, -1).join(', ')} or ${stages.at(-1)}`);
+
 /**
- * What the gate hands the orchestrator after its conversation was compacted: the loops still open and the
- * loop-backs waiting on a fix, the latest dispatches, where the checkout stands, and the two documents to read
- * again. The graph and the router are read once, at a session's start, and a compaction drops them with every
- * report; the router told the orchestrator to write "round 2 of max 2" in a dispatch so "you after a
- * compaction" could see it, and after a compaction it sees only a summary.
+ * What a session's ledger says of its loops, a line each: every loop still counted, and what would close it;
+ * the loop-backs no fix has acted on yet; and the latest dispatches. It is what a compaction hands the
+ * orchestrator and what `nina gate --status` prints, so the two cannot disagree.
  *
  * @param {object} project - `loadProject`'s.
- * @param {string} path - The session's ledger.
- * @param {string} root - The project.
- * @returns {object}
+ * @param {object[]} entries - The session's ledger, oldest first.
+ * @returns {{lines: string[], open: number, closing: number, waiting: number}} The lines; the loops open, the
+ *   loops a pass already settled, whose count the next dispatch drops, and the loop-backs waiting on a fix.
  */
-function afterCompaction(project, path, root) {
-  const entries = readLedger(path);
+export function loopState(project, entries) {
   const { open, waiting } = replay(entries, project.loops, project.forward);
-  const lines = ['The conversation was compacted. What the NINA loop gate kept of this session:'];
+  const lines = [];
   for (const l of open) {
+    const count =
+      `${l.source} ${l.token} — ${l.rounds} round(s), capped at ${l.cap}${l.given ? ` and ${l.given} more from the owner's replies` : ''}` +
+      (l.issues.length ? `, issues ${l.issues.join(', ')}` : '');
+    const fix = waiting.some((w) => w.source === l.source) ? 'the fix it waits on' : 'the latest fix';
     lines.push(
-      `- open loop: ${l.source} ${l.token} — ${l.rounds} round(s), capped at ${l.cap}${l.given ? ` and ${l.given} more from the owner's replies` : ''}` +
-        (l.issues.length ? `, issues ${l.issues.join(', ')}` : ''),
+      l.closing
+        ? `- passed after its latest fix: ${count}. Those rounds are settled, and the gate drops them at the next dispatch to ${either(l.targets)}`
+        : `- open loop: ${count}. It closes when a ${l.source} launched after ${fix} passes with no rejection beside it` +
+            (l.onward.length ? `, or when ${either(l.onward)} passes, sent out after the ${l.source} last reported` : ''),
     );
   }
   for (const w of waiting) lines.push(`- waiting on a fix: ${w.source} ${w.verdict}${w.issues.length ? `, issues ${w.issues.join(', ')}` : ''}`);
   if (open.length === 0 && waiting.length === 0) lines.push('- no loop is open');
   const dispatched = entries.filter((e) => e.k === 'dispatch' && e.role).slice(-4);
   if (dispatched.length) lines.push(`- the latest dispatches: ${dispatched.map((e) => e.role).join(', ')}, the newest at ${String(dispatched.at(-1).at ?? '').slice(11, 16)} UTC`);
+  const closing = open.filter((l) => l.closing).length;
+  return { lines, open: open.length - closing, closing, waiting: waiting.length };
+}
+
+/**
+ * What the gate hands the orchestrator after its conversation was compacted: the loops still open and the
+ * loop-backs waiting on a fix, the latest dispatches, where the checkout stands, and the two documents to read
+ * again. The graph and the router are read once, at a session's start, and a compaction drops them with every
+ * report; the router told the orchestrator to write "round 2 of max 2" in a dispatch so "you after a
+ * compaction" could see it, and after a compaction it sees only a summary.
+ *
+ * @param {object} project - `loadProject`'s.
+ * @param {string} path - The session's ledger.
+ * @param {string} root - The project.
+ * @returns {object}
+ */
+function afterCompaction(project, path, root) {
+  const lines = ['The conversation was compacted. What the NINA loop gate kept of this session:', ...loopState(project, readLedger(path)).lines];
   const git = (...args) => spawnSync('git', ['-C', root, ...args], { encoding: 'utf8', timeout: 2000 }).stdout?.trim() ?? '';
   const branch = git('rev-parse', '--abbrev-ref', 'HEAD');
   const last = git('log', '-1', '--format=%h %s');