@xhulz/nina 0.54.0 → 0.55.1

package/releases/0.55.1/surfaces/money/tree/.claude/patterns.md

@@ -0,0 +1,49 @@
+<!-- nina:slot money.1 -->
+
+---
+
+## Monetary values & percentages
+
+- **Money is an integer of the currency's minor unit**, end to end — {{MINOR_UNIT}}, never a float, never a type that can hold a fraction of one. Source of precision: `{{MONEY_MODULE}}`.
+- **Percentages are basis points** (`40% → 4000`, `100% → 10000`) so a distribution is exact without floating point.
+- **Parsing, formatting and percentage arithmetic live in one module and nowhere else.** A second place that turns a string into money is a second rounding rule, and the two will disagree on a value somebody is owed.
+- **Never** convert to a floating-point type before formatting, and never let a display format round a stored value.
+- Monetary database columns are integer. JSON responses serialize them as **strings**, not numbers, so no client parses them into a float. The service owns the conversion.
+
+<!-- nina:slot money.2 -->
+
+---
+
+## Distribution invariants (enforced by reviewer + unit tests)
+
+The distribution engine lives in `{{CORE_PKG}}`. It is pure and total over integer {{MINOR_UNIT}}:
+
+- A destination is either a percentage (basis points of the amount) or a fixed value.
+- `total = Σ destinations`, computed in {{MINOR_UNIT}}.
+- `total > amount` → **reject.** Never clamp, never distribute what is not there.
+- `total < amount` → **allow**, surface the shortfall, and leave the remainder **parked**. Silence is the defect here: an unexplained remainder is indistinguishable from a bug.
+- `total = amount` → OK.
+- A retention is just another destination — the same arithmetic applies to it, with no special case.
+
+<!-- nina:slot money.3 -->
+
+---
+
+## State machines & idempotency (enforced by reviewer)
+
+- **Every money-moving entity is a state machine.** Its states and legal transitions are declared in `.claude/architecture.md`; the code follows the declaration, not the other way round. Illegal transitions throw; they are never silently coerced.
+- **Every transition writes an audit row** (entity type, entity id, from, to, actor). No transition without a trail — the trail is what makes a money bug diagnosable after the money has moved.
+- **Outbound transfers are idempotent.** Each carries a unique key, and dedupe happens before the side effect, at the serialization point.
+- **One serialization point per balance.** Whatever computes and dispatches against a single balance never runs concurrently with itself. Two concurrent runs over one balance is how a double send happens even when every individual write is correct.
+
+<!-- nina:slot money.4 -->
+- **Money computation and dispatch go through the serialization point.** Routes, queue consumers and tools never run a distribution or a transfer synchronously in the request path.
+
+<!-- nina:slot money.5 -->
+- **The distribution engine lives in `{{CORE_PKG}}`.** Services call it as a pure function; they do not embed money logic inline.
+
+<!-- nina:slot money.6 -->
+- Idempotency on money-moving writes: the record carries an idempotency key, and the serialization point refuses the second attempt *before* the side effect.
+
+<!-- nina:slot money.7 -->
+- `{{CORE_PKG}}` is the most-tested package — pure functions over fixtures. Cover the distribution invariants exhaustively: over, under, exact, mixed percentage and fixed, and rounding.

package/releases/0.55.1/surfaces/money/tree/.claude/pipeline.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+  - **Money invariants respected** — a distribution never exceeds the amount; a shortfall is parked, not distributed; transfers idempotent; every transition audited.

package/releases/0.55.1/surfaces/money/tree/.claude/retrieval.md

@@ -0,0 +1,2 @@
+<!-- nina:slot money.1 -->
+| New distribution / transfer logic | `.claude/architecture.md` § *Money*, `.claude/patterns.md` § *Distribution invariants*, `{{CORE_PKG}}/` | architect → implementer → reviewer → qa |

package/releases/0.55.1/surfaces/money/tree/CLAUDE.md

@@ -0,0 +1,11 @@
+<!-- nina:slot money.1 -->
+3. **An outbound transfer is idempotent — it is NEVER sent twice.** Every transfer carries an idempotency key, and deduplication happens at a single serialization point **before** the side effect, never after it. A retry, a re-delivered queue message, a double-click and a replayed webhook must all collapse to one transfer. This is the highest-blast-radius invariant in the system: almost everything else can be corrected afterwards, and a duplicated transfer cannot.
+
+<!-- nina:slot money.2 -->
+4. **Conservation — what comes in equals what goes out plus what is retained.** A distribution may NEVER exceed the amount it distributes → **block**. If it is **less**, **alert** and leave the remainder **parked** and visible — never silently distributed, never silently absorbed. All arithmetic is integer {{MINOR_UNIT}}; percentages are basis points. The LLM never computes a monetary value.
+
+<!-- nina:slot money.3 -->
+5. **State-machine integrity.** Every money-moving entity has an explicit set of states and legal transitions, declared in `.claude/architecture.md` § *State machines* — not inferred from whatever code happens to exist. Only declared transitions are legal; an illegal one throws and is never silently coerced. **Every transition writes an audit row** (entity, id, from → to, actor, when). Skipping a state, inventing one, or landing a transition with no audit row is a hard reject.
+
+<!-- nina:slot money.4 -->
+- **money movement**: anything that creates, moves, settles or records a balance

package/releases/0.55.1/surfaces/pii/tree/.claude/agents/dba.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy.** No sensitive value in clear text where it must not be. The categories are declared in `.claude/architecture.md` § *Privacy* — they are not decided per query, and not decided by you. **Document bytes live only in the object store, referenced by key: the column holds the key, never the bytes.** Any column the architect's spec flagged for masking must be encrypted at rest. Reject a schema that widens what is stored in the clear.

package/releases/0.55.1/surfaces/pii/tree/.claude/agents/devops.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+
+**Point it at an UNAUTHENTICATED route — a sign-in page is the right one.** Never sign in, and never
+screenshot a signed-in page. Accounts on deployed environments hold real personal data, and a
+screenshot or a console dump pulls it into agent transcripts and logs, where it persists and nobody
+ever looks for it again. That is a privacy leak with no upside here: the sign-in page proves
+everything this check is for. It renders from the same bundle, it exercises the same build-time env
+inlining (a missing variable blanks it identically), and it needs no session.

package/releases/0.55.1/surfaces/pii/tree/.claude/agents/reviewer.md

@@ -0,0 +1,8 @@
+<!-- nina:slot pii.1 -->
+- Check for privacy regressions: **no sensitive value in a log, an error message — a library's own included — a URL or a test fixture**, per the categories in `.claude/architecture.md` § *Privacy*; document bytes only in the object store, never plaintext in the database; no leaked secret.
+
+<!-- nina:slot pii.2 -->
+- **privacy** — the privacy check above, in full: no sensitive value in a log, an error message, a
+  URL or a test fixture; document bytes only in the object store; no leaked secret. Where
+  **tenant-and-privacy** is dispatched, its reviewer owns this too and there is no separate one; where
+  it is not, this is a dimension of its own. Either way it is never nobody's.

package/releases/0.55.1/surfaces/pii/tree/.claude/agents/secops.md

@@ -0,0 +1,2 @@
+<!-- nina:slot pii.1 -->
+- **Privacy (Hard Rule #8)** — the categories declared in `.claude/architecture.md` § *Privacy* must never appear in logs, in responses that do not need them, in error paths, or in the database in clear text. Check every endpoint that returns a person's record for fields it includes by accident: a `select` that quietly grew a column is the usual way this leaks. Check the error paths too — they are written last and reviewed least — and what the libraries on them print or carry in their own errors, bound values included.

package/releases/0.55.1/surfaces/pii/tree/.claude/agents/solidity-auditor.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+- **Nothing personal reaches the chain.** What is written on-chain is public, permanent, and beyond
+  deletion by anyone — including by you, and including after a subject asks. A hash of a personal
+  identifier is not a protection: it is a lookup table for whoever holds the input set. Reject a
+  personal datum stored in state, emitted in an event, or passed as calldata.

package/releases/0.55.1/surfaces/pii/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot pii.1 -->
+8. **Sensitive personal data is classified, and the classification is enforced.** What counts as sensitive here — identity documents, financial identifiers, anything a person would not expect to be readable by whoever can read a log — is declared in `.claude/architecture.md` § *Privacy*, along with the regime that governs it ({{PRIVACY_REGIME}}). Encrypted at rest. **No sensitive value in a log, an error message, a URL, an analytics event, or an agent transcript** — the places nobody thinks about are exactly the ones that persist. That includes what a library puts in its own errors and prints itself: a database client's error can carry the query and every bound value, and a framework can log a whole error past the logger it was given. A database error is mapped at the data layer to a typed error from a closed list before anything logs or returns it, and a test proves that a bound value it writes reaches no thrown error. Document bytes live only in the object store, referenced by key, never in the database in clear text.
+
+<!-- nina:slot pii.2 -->
+- **personal data**: where it is collected, stored, logged or sent

package/releases/0.55.1/surfaces/prisma/tree/.claude/agents/architect.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.55.1/surfaces/prisma/tree/.claude/agents/dba.md

@@ -0,0 +1,42 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-cli` | **before ANY `prisma` CLI command** — `validate`, `format`, `migrate dev`, `migrate diff`, `migrate deploy`. Flags differ between versions, and one of them (`migrate diff --shadow-database-url` against a live database) destroys the database it points at |
+| `prisma-client-api` | auditing a new or changed query — filters, operators, `$transaction` semantics. Through a driver adapter, cite the adapter's installed source for what a transaction does: the skill describes the default engine, and an adapter can roll back less |
+
+<!-- nina:slot prisma.2 -->
+Neither skill covers a **caching or edge layer sitting on top of the client** — cache strategy,
+edge-client behaviour and the rule about never caching a read that authorizes a write belong to that
+layer's own integration doc, declared like any other integration. A skill does not replace it.
+
+<!-- nina:slot prisma.3 -->
+- **With Prisma, both offline.** Run `pnpm --filter {{DB_PKG_NAME}} exec prisma validate`; it must pass. Then run `prisma migrate diff` in its **offline, file-only form** and read the generated SQL, not just the Prisma delta. Its flags changed in Prisma 7, so read the installed major (`prisma --version`) before writing the command:
+
+   ```
+   # Prisma 6. Compare the PREVIOUS schema against the working one — pure file-to-file, no database.
+   git show HEAD:{{DB_PKG}}/prisma/schema.prisma > /tmp/schema-head.prisma
+   pnpm --filter {{DB_PKG_NAME}} exec prisma migrate diff \
+     --from-schema-datamodel /tmp/schema-head.prisma \
+     --to-schema-datamodel prisma/schema.prisma \
+     --script
+   ```
+
+   From Prisma 7 the two flags are `--from-schema` and `--to-schema`, and the schema engine starts from the
+   datasource in `prisma.config.ts` even for this diff: with none there, it prints nothing and exits 0. For
+   SQLite a placeholder the diff never opens is enough, a `file:` URL under a gitignored directory; for any
+   other provider, find out what the diff opens before you give it one. Never a real database's URL. A first schema has nothing at `HEAD`: diff it `--from-empty`. Compare the output against the
+   hand-written `migration.sql` to confirm the declarative parts match.
+
+   ⚠️ **Do NOT reach for `--from-migrations`.** It looks like the natural choice and it is a trap:
+   Prisma refuses it without a shadow database (`--shadow-database-url`, or from Prisma 7 a
+   `shadowDatabaseUrl` in `prisma.config.ts`), which pushes you toward supplying a database URL — the exact move that destroys databases (below). The file-to-file form above answers the
+   same question with no database involved.
+
+   ⛔ **NEVER point `--shadow-database-url`, `--from-url`, `--to-url`, `--from-schema-datasource` — or, from Prisma 7, a `shadowDatabaseUrl` or the config datasource behind `--from-config-datasource` — at a real database, most of all not the one `{{SECRETS_LOCAL}}` names.** Prisma **executes** the entire migration history against whatever database those flags name, which **DESTROYS ALL DATA** in it. A shadow database must be a disposable, empty database and nothing else. It does not announce itself: the command completes with a reassuring "empty migration" result and no error, having already destroyed everything in the database it was pointed at. If the offline form above cannot answer your question, **STOP and report that to the orchestrator** instead of reaching for a database URL.
+
+<!-- nina:slot prisma.4 -->
+- **Where reads are cached through Prisma Accelerate,** every `findUnique` / `findMany` on a hot read path names its `cacheStrategy` (`ttl` / `swr`), and one that feeds a correctness-critical write names none.
+
+<!-- nina:slot prisma.5 -->
+- **On an edge runtime,** new Prisma code paths use the edge client of the installed major: `@prisma/client/edge` up to Prisma 6; from 7, the client the `prisma-client` generator writes with the platform's `runtime` set, imported from where it is generated — `@prisma/client/edge` fails there with `MODULE_NOT_FOUND`.
+
+<!-- nina:slot prisma.6 -->
+- Run a Prisma command that writes to a real database — `prisma migrate dev`, `migrate deploy`, `migrate reset`, `migrate resolve`, `db push`, `db execute`, `$executeRaw*` — or **any `prisma migrate diff` variant carrying a database URL**, which silently wipes the database it points at.

package/releases/0.55.1/surfaces/prisma/tree/.claude/agents/devops.md

@@ -0,0 +1,11 @@
+<!-- nina:slot prisma.1 -->
+- **`prisma-cli`** — before `migrate deploy` or any other Prisma CLI command against a real database.
+
+<!-- nina:slot prisma.2 -->
+- **Prisma migrations go out with `prisma migrate deploy`**, and nothing else changes a shared database's schema.
+
+<!-- nina:slot prisma.3 -->
+- Run `prisma migrate diff --shadow-database-url <url>` against any live database. It **executes** the migration history against that database, destroying everything in it, and reports success. Use a disposable shadow database or don't run it.
+
+<!-- nina:slot prisma.4 -->
+- Run `prisma migrate reset` against a shared database, ever.

package/releases/0.55.1/surfaces/prisma/tree/.claude/agents/implementer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.55.1/surfaces/prisma/tree/.claude/agents/integration-tester.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-cli` | a Prisma CLI command |

package/releases/0.55.1/surfaces/prisma/tree/.claude/agents/reviewer.md

@@ -0,0 +1,2 @@
+<!-- nina:slot prisma.1 -->
+| `prisma-client-api` | a new or changed Prisma query |

package/releases/0.55.1/surfaces/prisma/tree/.claude/patterns.md

@@ -0,0 +1,15 @@
+<!-- nina:slot prisma.1 -->
+- **Database table/column names** (Prisma `@map` / `@@map`): `snake_case` in SQL, `camelCase` in TS.
+
+<!-- nina:slot prisma.2 -->
+- Where Prisma reads are cached through Accelerate, `cacheStrategy` lives in `{{DB_PKG}}`: services do not add, strip, or override cache policies.
+
+<!-- nina:slot prisma.3 -->
+
+### Prisma
+
+- Schema lives in `{{DB_PKG}}/prisma/schema.prisma`. Nowhere else.
+- **Never write raw SQL** unless justified in a code comment with perf data.
+- N+1 is solved with `include` / `select`, chosen deliberately.
+- Where reads are cached through Accelerate, every `findUnique` / `findMany` on a hot path defines its `cacheStrategy`, and no direct connection string is embedded in code.
+- Tests run a real Prisma client against a real database; the client is never mocked.

package/releases/0.55.1/surfaces/prisma/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot prisma.1 -->
+| Run any `prisma` CLI command (the database gate, devops, and the integration gate where there is one) | `prisma-cli` | flags differ between versions; `migrate diff --shadow-database-url` against a live DB wiped dev/staging once |
+
+<!-- nina:slot prisma.2 -->
+| Write or audit a Prisma query (architect, implementer, the database gate, reviewer) | `prisma-client-api` | filters, operators, `$transaction` semantics. a caching or edge layer on top of the client is **NOT covered** — its cache strategy belongs to that layer's own integration doc |

package/src/commands/stats.mjs

@@ -459,7 +459,7 @@ const CYCLE_ENDS = { qa: 'PASS', devops: 'DEPLOYED', secops: 'SECURE' };
  * was captured under (`core`) carries it: over every round, "0 of 16 loop-backs named their issues" read
  * reports written before the rule existed as breaking it. Releases are never rewritten, so neither is this.
  */
-const RULE_SINCE = { issues: '0.22.0', stepFiles: '0.28.8' };
+const RULE_SINCE = { issues: '0.22.0', stepFiles: '0.28.8', stepLines: '0.55.0' };
 
 /**
  * Whether a round ran under a release that carries a rule. One captured before rounds recorded their pin
@@ -558,8 +558,8 @@ export function cyclesOf(records) {
  *
  * @param {object[]} records - The runs in the window.
  */
-function proportionReport(records, stepLimit = () => null) {
-  const d = proportionData(records, stepLimit);
+function proportionReport(records, stepLimit = () => null, lineLimit = () => null) {
+  const d = proportionData(records, stepLimit, lineLimit);
   if (!d) return;
   console.log(
     heading(
@@ -584,6 +584,14 @@ function proportionReport(records, stepLimit = () => null) {
       ),
     );
   }
+  if (d.overLines) {
+    console.log(
+      note(
+        `${d.overLines.count} implementer round(s) wrote more lines than one step may (${d.overLines.limit}); the largest wrote ${d.overLines.largest}. The architect forecasts a step's lines and splits it past them.`,
+        'warn',
+      ),
+    );
+  }
 }
 
 /**
@@ -593,8 +601,9 @@ function proportionReport(records, stepLimit = () => null) {
  *
  * @param {object[]} records - The rounds in the window.
  * @param {(project: string) => number|null} [stepLimit] - The most files one implementer run may write, by project.
+ * @param {(project: string) => number|null} [lineLimit] - The most lines, by project.
  */
-export function proportionData(records, stepLimit = () => null) {
+export function proportionData(records, stepLimit = () => null, lineLimit = () => null) {
   const measured = records.filter((r) => WRITERS.has(r.role) && typeof r.files_touched === 'number');
   if (measured.length === 0) return null;
   const cycles = cyclesOf(records);
@@ -629,6 +638,14 @@ export function proportionData(records, stepLimit = () => null) {
     return limit !== null && r.files_touched > limit;
   });
   const largest = over.length ? over.reduce((a, b) => (b.files_touched > a.files_touched ? b : a)) : null;
+  // And its lines: a step forecast at about 640 lines came to 2,546 in three files, under the file limit, and every
+  // gate read each of its rounds.
+  const longer = records.filter((r) => {
+    if (r.role !== 'implementer' || typeof r.lines_written !== 'number' || !ranUnder(r, 'stepLines')) return false;
+    const limit = lineLimit(r.project);
+    return limit !== null && r.lines_written > limit;
+  });
+  const longest = longer.length ? longer.reduce((a, b) => (b.lines_written > a.lines_written ? b : a)) : null;
   return {
     rows: rows.map(({ label, cycles: n, designed }) => ({ label, cycles: n, designed })),
     built,
@@ -637,18 +654,20 @@ export function proportionData(records, stepLimit = () => null) {
     over: largest
       ? { count: over.length, limit: stepLimit(largest.project), largest: largest.files_touched, readM: typeof largest.tokens?.read === 'number' ? Math.round(largest.tokens.read / 1e6) : null }
       : null,
+    overLines: longest ? { count: longer.length, limit: lineLimit(longest.project), largest: longest.lines_written } : null,
   };
 }
 
 /**
  * The most files one implementer run may write in each measured project, as its pinned release states it
  * (`{{STEP_FILES}}`, which the project may declare to change), or null where the release has no such
- * limit or the project cannot be found.
+ * limit or the project cannot be found. With `STEP_LINES`, the most lines.
  *
  * @param {{root: string}} ctx - CLI context, for the releases.
+ * @param {'STEP_FILES'|'STEP_LINES'} [key] - Which limit.
  * @returns {(project: string) => number|null}
  */
-function stepLimitOf(ctx) {
+function stepLimitOf(ctx, key = 'STEP_FILES') {
   const known = new Map();
   return (project) => {
     if (!known.has(project)) {
@@ -657,7 +676,7 @@ function stepLimitOf(ctx) {
         const found = decodeProjectDir(project);
         const profile = found ? JSON.parse(readFileSync(join(found, HARNESS, 'profile.json'), 'utf8')) : null;
         const layers = profile ? layerRootFor(ctx.root, profile.core) : null;
-        const value = profile?.vocabulary?.STEP_FILES ?? (layers?.dir ? defaultVocabulary(layers.dir).STEP_FILES : undefined);
+        const value = profile?.vocabulary?.[key] ?? (layers?.dir ? defaultVocabulary(layers.dir)[key] : undefined);
         const n = Number(value);
         limit = value !== undefined && value !== null && value !== '' && Number.isFinite(n) && n > 0 ? n : null;
       } catch {
@@ -735,7 +754,7 @@ export function statsData(records, ctx) {
     stages: stageData(records),
     cost: costData(ran),
     context: contextData(ran),
-    proportion: proportionData(ran, stepLimitOf(ctx)),
+    proportion: proportionData(ran, stepLimitOf(ctx), stepLimitOf(ctx, 'STEP_LINES')),
   };
 }
 
@@ -939,7 +958,7 @@ export async function stats(argv, ctx) {
   costReport(records.filter((r) => r.status !== 'denied'));
   contextReport(records.filter((r) => r.status !== 'denied'));
   modelReport(records.filter((r) => r.status !== 'denied'));
-  proportionReport(records.filter((r) => r.status !== 'denied'), stepLimitOf(ctx));
+  proportionReport(records.filter((r) => r.status !== 'denied'), stepLimitOf(ctx), stepLimitOf(ctx, 'STEP_LINES'));
 
   // What the pipeline learned, against what it had to learn from. A loop-back is the raw
   // material and a pill is the product, so the two numbers belong on the same screen: the

package/src/dashboard.html

@@ -358,7 +358,8 @@ const RENDER = {
         table(['stage', 'rounds', 'n', 'turns', 'calls/turn', 'starts at', 'peak', 'prompt'], d.context.rows.map((r, i, all) => [i > 0 && all[i - 1].role === r.role ? '' : el('span', { class: 'role' }, r.role), el('span', { class: 'faint' }, r.label), String(r.n), String(r.turns), r.callsPerTurn.toFixed(2), kTokens(r.start), kTokens(r.peak), r.prompt === null ? '—' : r.prompt.toLocaleString('en-US')]), [2, 3, 4, 5, 6, 7])] : null,
       d.proportion ? [el('h3', {}, 'proportion · the size of a change against its chain'),
         table(['largest write', 'cycles', 'with a planner or architect', ''], d.proportion.rows.map((r) => [r.label, String(r.cycles), r.cycles ? `${r.designed} (${pct(r.designed, r.cycles)})` : '—', bar([[r.cycles ? r.designed / r.cycles : 0, 'var(--pink)']])]), [1, 2]),
-        d.proportion.over ? el('p', { class: 'note warn' }, `${d.proportion.over.count} implementer round(s) wrote more files than one step may (${d.proportion.over.limit}); the largest wrote ${d.proportion.over.largest}.`) : null] : null,
+        d.proportion.over ? el('p', { class: 'note warn' }, `${d.proportion.over.count} implementer round(s) wrote more files than one step may (${d.proportion.over.limit}); the largest wrote ${d.proportion.over.largest}.`) : null,
+        d.proportion.overLines ? el('p', { class: 'note warn' }, `${d.proportion.overLines.count} implementer round(s) wrote more lines than one step may (${d.proportion.overLines.limit}); the largest wrote ${d.proportion.overLines.largest}.`) : null] : null,
     );
   },
 };

package/src/office.html

@@ -59,7 +59,7 @@
  * drawn here, in pixels, on a small canvas scaled up; nothing is fetched from anywhere else. The view starts close
  * enough to read and follows the work around the floor; dragging, the wheel and the buttons take it over.
  */
-const ROOM = /*NINA_ROOM*/null || { project: 'demo', stages: ['planner', 'architect', 'implementer', 'reviewer', 'qa', 'dba', 'integration-tester', 'devops', 'secops'], many: ['architect', 'implementer', 'reviewer'], owner: 'you', replay: false };
+const ROOM = /*NINA_ROOM*/null || { project: 'demo', stages: ['planner', 'architect', 'design-reviewer', 'implementer', 'reviewer', 'qa', 'dba', 'integration-tester', 'devops', 'secops'], many: ['architect', 'implementer', 'reviewer'], owner: 'you', replay: false };
 
 // ─── palette and sprites ──────────────────────────────────────────────────────────────────────
 const C = {
@@ -163,7 +163,7 @@ const GARDEN = 52;
 
 /** The rooms, by phase, in the order the work moves through them. A stage not named here works in build. */
 const PHASES = [
-  { key: 'design', name: 'design', side: 'left', roles: ['planner', 'architect'] },
+  { key: 'design', name: 'design', side: 'left', roles: ['planner', 'architect', 'design-reviewer'] },
   { key: 'build', name: 'build', side: 'left', roles: ['implementer', 'solidity-dev'] },
   { key: 'review', name: 'review & gates', side: 'right', roles: ['reviewer', 'dba', 'integration-tester', 'solidity-auditor'] },
   { key: 'lab', name: 'test lab', side: 'right', roles: ['qa'] },
@@ -373,7 +373,9 @@ background.height = LH;
       for (let i = 0; i < 4; i += 1) box(g, room.x + 58 + i * 30, room.y + FACE + 8, 10, 9, C.seatRed);
     }
     plant(g, far, room.laneY - 18, true);
-    if (room.key === 'design') shelf(g, room.x + room.w - 30, room.y + FACE + 2);
+    // The shelf stands in a room's far corner, where only a fourth desk reaches: in design, the design-reviewer's desk
+    // was the fourth and stood under it. Release seats devops and secops, a fourth only if both ran as several agents.
+    if (room.key === 'release') shelf(g, room.x + room.w - 30, room.y + FACE + 2);
     if (room.key === 'lab') {
       box(g, room.x + room.w - 24, room.y + FACE + 2, 16, 30, C.rack);
       for (let i = 0; i < 6; i += 1) rect(g, room.x + room.w - 21, room.y + FACE + 5 + i * 4, 2, 1, i % 3 ? C.ledG : C.ledR);

package/src/transcripts.mjs

@@ -75,6 +75,7 @@ const VERDICTS = [
 export const ROLE_TOKENS = {
   planner: ['PLAN-READY', 'BLOCKED'],
   architect: ['SPEC-READY', 'BLOCKED'],
+  'design-reviewer': ['APPROVED', 'REJECTED'],
   implementer: ['DIFF-READY', 'BLOCKED'],
   'solidity-dev': ['DIFF-READY', 'BLOCKED'],
   reviewer: ['APPROVED', 'REJECTED'],
@@ -120,6 +121,9 @@ export function classifyVerdict(result, role) {
 /** The tools that write a file, and where each names it. */
 const WRITES = { Edit: 'file_path', Write: 'file_path', MultiEdit: 'file_path', NotebookEdit: 'notebook_path' };
 
+/** How many lines a text written through an edit tool holds: none for an empty one, a last newline ending one. */
+const linesIn = (text) => (typeof text === 'string' && text.length > 0 ? text.replace(/\n$/, '').split('\n').length : 0);
+
 /** The line under a declared verdict that names what the report sends back. */
 const ISSUES = /^\s*ISSUES:(.*)$/;
 
@@ -642,7 +646,7 @@ async function attachAgentDetail(projectDir, dispatches) {
       if (
         run.agent_read_bytes === size &&
         !('resumes' in run) &&
-        [...records, ...later].every((r) => settled(r) && 'round' in r && 'lessons_read' in r && 'tokens' in r && 'files_touched' in r && 'effort' in r && 'turns' in r && 'prompt_chars' in r)
+        [...records, ...later].every((r) => settled(r) && 'round' in r && 'lessons_read' in r && 'tokens' in r && 'files_touched' in r && 'lines_written' in r && 'effort' in r && 'turns' in r && 'prompt_chars' in r)
       ) {
         continue;
       }
@@ -670,6 +674,11 @@ async function attachAgentDetail(projectDir, dispatches) {
         usage: new Map(),
         /** The files the round wrote through the edit tools. Only their number is kept. */
         written: new Set(),
+        /**
+         * The lines it wrote there, by file: a file's last whole write, and each edit's new text after it — what the
+         * run wrote, not its diff: an edit made twice counts twice, and a file a shell command changed not at all.
+         */
+        lines: new Map(),
         /** The tool calls the round made, by id: over its turns, how many calls each turn sent at once. */
         calls: new Set(),
         /** How long the prompt that opened the round was, in characters; never the prompt. */
@@ -708,7 +717,10 @@ async function attachAgentDetail(projectDir, dispatches) {
           try {
             for (const block of JSON.parse(line)?.message?.content ?? []) {
               const path = block?.type === 'tool_use' ? block.input?.[WRITES[block.name]] : null;
-              if (typeof path === 'string') round.written.add(path);
+              if (typeof path !== 'string') continue;
+              round.written.add(path);
+              const added = { Edit: () => linesIn(block.input.new_string), MultiEdit: () => (Array.isArray(block.input.edits) ? block.input.edits : []).reduce((n, e) => n + linesIn(e?.new_string), 0), NotebookEdit: () => linesIn(block.input.new_source) }[block.name];
+              round.lines.set(path, block.name === 'Write' ? linesIn(block.input.content) : (round.lines.get(path) ?? 0) + (added?.() ?? 0));
             }
           } catch {
             // A torn line loses one edit, not the run's.
@@ -795,6 +807,7 @@ async function attachAgentDetail(projectDir, dispatches) {
           record.usage_model = spent.model;
           record.effort = spent.effort;
           record.files_touched = round.written.size;
+          record.lines_written = [...round.lines.values()].reduce((a, b) => a + b, 0);
           record.skills = [...round.skills];
           record.lessons_read = round.lessonsRead.size;
           record.lessons_listed = round.lessonsListed;