agentic-qe 3.15.17 → 3.15.18

package/dist/coordination/handlers/coverage-handlers.js

@@ -8,7 +8,7 @@ import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
 import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 import { buildEstimatedCoverage, collectRustCoverage, findCargoRoot, isCoverageExecDisabled, isRustProject, } from './coverage-collection.js';
-import { describeNoData, evaluateCoverageForTarget, isUnmeasured, packageFilterForTarget, resolveExistingCoverage, scopeCoverageToTarget, reconcileRecommendations, thresholdVerdict, } from './coverage-target.js';
+import { describeNoData, describeRefusedReports, evaluateCoverageForTarget, isUnmeasured, packageFilterForTarget, resolveExistingCoverage, scopeCoverageToTarget, reconcileRecommendations, thresholdVerdict, } from './coverage-target.js';
 import { describeEvidence, describeExcludedEntries } from './coverage-evidence.js';
 import { randomUUID } from 'crypto';
 import * as path from 'path';
@@ -56,7 +56,10 @@ function instrumented(files) {
 function fromEvaluation(evaluation, ranTests, projectRoot) {
     return evaluation.status === 'measured'
         ? { collected: instrumented(evaluation.files), ranTests, projectRoot, evidence: evaluation.evidence }
-        : { collected: null, ranTests, noData: evaluation.reason, projectRoot };
+        : {
+            collected: null, ranTests, noData: evaluation.reason, projectRoot,
+            ...(evaluation.refused ? { refused: evaluation.refused } : {}),
+        };
 }
 /**
  * Collect coverage for a target, preferring real measurement over estimation
@@ -83,8 +86,13 @@ async function collectCoverage(targetPath) {
     if (existing.status === 'evaluated') {
         return fromEvaluation(existing.evaluation, false, existing.projectRoot);
     }
-    const { target } = existing;
-    let projectRoot = existing.projectRoot;
+    // #1186: a report that exists but was refused is named in the result,
+    // whatever the run or estimate below produces.
+    const result = await collectWithoutReport(existing.target, existing.projectRoot);
+    return existing.refused.length > 0 ? { ...result, refused: existing.refused } : result;
+}
+/** Steps 2-3 of the cascade: no usable report exists at the project root. */
+async function collectWithoutReport(target, projectRoot) {
     // #569 work item 1: delegate to real instrumentation where available.
     if (isRustProject(target)) {
         const rust = await collectRustCoverage(target);
@@ -171,9 +179,9 @@ async function collectCoverage(targetPath) {
     };
 }
 /** Caller-facing explanation for a result with no coverage figures. */
-function noDataWarning(reason, ranTests, targetPath, projectRoot) {
+function noDataWarning(reason, ranTests, targetPath, projectRoot, refused = []) {
     if (reason)
-        return describeNoData(reason, targetPath, projectRoot);
+        return describeNoData(reason, targetPath, projectRoot, refused);
     return ranTests
         ? 'Tests ran but no coverage output was generated. Ensure a coverage provider is configured (e.g., @vitest/coverage-v8, istanbul).'
         : 'No coverage data found and could not run tests automatically. ' + estimationGuidance(targetPath);
@@ -213,7 +221,9 @@ export function registerCoverageHandlers(ctx) {
             }
             const analyzer = ctx.getCoverageAnalyzer();
             const threshold = payload.threshold || 80;
-            const { collected, ranTests, noData, projectRoot, notes, runStatus, testRun, evidence } = await collectCoverage(targetPath);
+            const { collected, ranTests, noData, projectRoot, notes, runStatus, testRun, evidence, refused } = await collectCoverage(targetPath);
+            // #1186: a refused report is named, never reported as a missing one.
+            const refusedNote = refused?.length && noData !== 'refused-report' ? [describeRefusedReports(refused)] : [];
             // #995 review N5: say so plainly instead of "no coverage data found".
             if (noData === 'target-missing') {
                 return err(new Error(describeNoData('target-missing', targetPath, null)));
@@ -234,7 +244,10 @@ export function registerCoverageHandlers(ctx) {
                     // #995(d): "no measurement exists for this target", distinct from 0%.
                     ...(unmeasured ? { unmeasured: true } : {}),
                     algorithm: 'sublinear-O(log n)',
-                    warning: notes?.length ? notes.join(' ') : noDataWarning(noData, ranTests, targetPath, projectRoot),
+                    warning: [
+                        ...refusedNote,
+                        notes?.length ? notes.join(' ') : noDataWarning(noData, ranTests, targetPath, projectRoot, refused),
+                    ].join(' '),
                 });
             }
             const { data: coverageData, provenance } = collected;
@@ -283,7 +296,7 @@ export function registerCoverageHandlers(ctx) {
             // sources, leave the evidence insufficient: the figures stand for the
             // measured files only, and the threshold is not met on them.
             const evidenceReasons = describeEvidence(evidence, projectRoot ?? targetPath);
-            const warnings = [...provenance.notes, ...(notes ?? [])];
+            const warnings = [...refusedNote, ...provenance.notes, ...(notes ?? [])];
             if (provenance.estimated)
                 warnings.push(estimationGuidance(targetPath));
             if (evidenceReasons.length > 0) {

package/dist/coordination/handlers/coverage-target.d.ts

@@ -19,6 +19,7 @@
  * and the CLI `coverage` command can share it.
  */
 import type { CoverageData, FileCoverage } from '../../domains/coverage-analysis/interfaces';
+import { type RefusedCoverageReport } from './handler-utils';
 import { type CoverageEvidence } from './coverage-evidence';
 /**
  * Walk up from a target to the nearest directory that holds a project marker.
@@ -52,6 +53,14 @@ export declare function isCoverageReportFile(filePath: string): boolean;
  * can't be parsed, or lists no files.
  */
 export declare function loadCoverageReportFile(filePath: string): Promise<CoverageData | null>;
+/**
+ * `loadCoverageReportFile`, plus why the report was refused unread when it
+ * was (#1186), so a refused report is not described as an unparseable one.
+ */
+export declare function readCoverageReportFile(filePath: string): Promise<{
+    data: CoverageData | null;
+    refused?: RefusedCoverageReport;
+}>;
 /**
  * Keep only the report entries that lie under `target`.
  *
@@ -67,6 +76,8 @@ export type NoDataReason =
 'target-missing'
 /** A coverage report was given but cannot be parsed (malformed, raw V8, empty). */
  | 'unreadable-report'
+/** A coverage report exists but was refused unread (#1186): see `refused`. */
+ | 'refused-report'
 /** The report lists only test files. */
  | 'test-only-report'
 /** The report has no entries under the target — it did not measure it. */
@@ -80,6 +91,7 @@ export type CoverageEvaluation = {
 } | {
     status: 'no-data';
     reason: NoDataReason;
+    refused?: RefusedCoverageReport[];
 };
 /**
  * Decide what a report says about `target`. Shared by the MCP handler and the
@@ -104,10 +116,13 @@ export declare function evaluateCoverageForTarget(report: CoverageData, projectR
 export type ExistingCoverage = {
     status: 'target-missing';
     target: string;
-} | {
+}
+/** `refused`: reports that exist but were not read (#1186); empty when none exists. */
+ | {
     status: 'no-report';
     target: string;
     projectRoot: string;
+    refused: RefusedCoverageReport[];
 } | {
     status: 'evaluated';
     target: string;
@@ -159,6 +174,11 @@ export declare function reconcileRecommendations(recommendations: string[], verd
 }): string[];
 /** Is this verdict "no measurement exists" (as opposed to an error or test-only report)? */
 export declare function isUnmeasured(reason: NoDataReason): boolean;
+/**
+ * Why existing coverage reports were not used (#1186). A refused report is
+ * named with its reason, never described as a missing one. Shared by MCP and CLI.
+ */
+export declare function describeRefusedReports(refused: readonly RefusedCoverageReport[]): string;
 /** Caller-facing explanation of a no-data verdict. Shared by MCP and CLI. */
-export declare function describeNoData(reason: NoDataReason, target: string, projectRoot: string | null): string;
+export declare function describeNoData(reason: NoDataReason, target: string, projectRoot: string | null, refused?: readonly RefusedCoverageReport[]): string;
 //# sourceMappingURL=coverage-target.d.ts.map

package/dist/coordination/handlers/coverage-target.js

@@ -19,10 +19,10 @@
  * and the CLI `coverage` command can share it.
  */
 import * as fs from 'fs';
-import { readConfinedText, readConfinedTextSync } from '../../shared/io/confined-read.js';
+import { ConfinedReadError, readConfinedText, readConfinedTextSync } from '../../shared/io/confined-read.js';
 import * as os from 'os';
 import * as path from 'path';
-import { loadCoverageReport, parseCoberturaXml, parseCoverageJson, parseCoverageSummaryJson, parseLcovInfo, } from './handler-utils.js';
+import { findCoverageReport, parseCoberturaXml, parseCoverageJson, parseCoverageSummaryJson, parseLcovInfo, } from './handler-utils.js';
 import { isTestPath } from './coverage-collection.js';
 import { assessCoverageEvidence } from './coverage-evidence.js';
 import { findProjectRoot } from '../../kernel/project-root.js';
@@ -327,15 +327,28 @@ export function isCoverageReportFile(filePath) {
  * can't be parsed, or lists no files.
  */
 export async function loadCoverageReportFile(filePath) {
+    return (await readCoverageReportFile(filePath)).data;
+}
+/**
+ * `loadCoverageReportFile`, plus why the report was refused unread when it
+ * was (#1186), so a refused report is not described as an unparseable one.
+ */
+export async function readCoverageReportFile(filePath) {
     let content;
     try {
         // #1161: read from the validated descriptor, not the name checked earlier;
         // a report linked out of the project, or to a device, is not read.
         content = await readConfinedText(filePath, { outsideRoot: 'allow' });
     }
-    catch {
-        return null;
+    catch (error) {
+        if (error instanceof ConfinedReadError && error.reason !== 'not-found') {
+            return { data: null, refused: { path: filePath, reason: error.reason } };
+        }
+        return { data: null };
     }
+    return { data: parseCoverageReportContent(filePath, content) };
+}
+function parseCoverageReportContent(filePath, content) {
     if (content.trim().length === 0)
         return null;
     try {
@@ -469,17 +482,19 @@ export async function resolveExistingCoverage(targetPath) {
         const reportDir = path.dirname(target);
         const projectRoot = findCoverageProjectRoot(reportDir)
             ?? (path.basename(reportDir) === 'coverage' ? path.dirname(reportDir) : reportDir);
-        const report = await loadCoverageReportFile(target);
+        const { data: report, refused } = await readCoverageReportFile(target);
         // The report itself is the target: judged whole, but still checked for staleness.
         const evaluation = report
             ? evaluateCoverageForTarget(report, projectRoot, projectRoot, { reportPath: target, checkCompleteness: false })
-            : { status: 'no-data', reason: 'unreadable-report' };
+            : refused
+                ? { status: 'no-data', reason: 'refused-report', refused: [refused] }
+                : { status: 'no-data', reason: 'unreadable-report' };
         return { status: 'evaluated', target, projectRoot, source: 'report-file', evaluation };
     }
     const projectRoot = findCoverageProjectRoot(target) ?? (stat.isDirectory() ? target : path.dirname(target));
-    const existing = await loadCoverageReport(projectRoot);
+    const { report: existing, refused } = await findCoverageReport(projectRoot);
     if (!existing)
-        return { status: 'no-report', target, projectRoot };
+        return { status: 'no-report', target, projectRoot, refused };
     return {
         status: 'evaluated', target, projectRoot, source: 'project-report',
         evaluation: evaluateCoverageForTarget(existing.data, projectRoot, target, { reportPath: existing.path }),
@@ -526,11 +541,32 @@ export function reconcileRecommendations(recommendations, verdict, threshold, co
 export function isUnmeasured(reason) {
     return reason === 'target-not-covered' || reason === 'no-tests-ran';
 }
+const REFUSAL_EXPLANATIONS = {
+    'outside-project-root': 'it resolves outside the project (a symlink pointing out of it)',
+    'not-a-file': 'it is not a regular file (a FIFO, device or directory)',
+    'too-large': 'it is over the read size limit',
+    'changed-during-read': 'it was replaced or removed while it was being read',
+    'hardlinked': 'it has more than one hardlink',
+    'unreadable': 'it could not be opened (permissions)',
+};
+/**
+ * Why existing coverage reports were not used (#1186). A refused report is
+ * named with its reason, never described as a missing one. Shared by MCP and CLI.
+ */
+export function describeRefusedReports(refused) {
+    const items = refused.map(r => `${r.path} (${r.reason}: ${Object.hasOwn(REFUSAL_EXPLANATIONS, r.reason) ? REFUSAL_EXPLANATIONS[r.reason] : r.reason})`);
+    return `Coverage report refused and not read: ${items.join('; ')}. ` +
+        'Write the report as a regular file inside the project, or pass a report file inside the project as the target.';
+}
 /** Caller-facing explanation of a no-data verdict. Shared by MCP and CLI. */
-export function describeNoData(reason, target, projectRoot) {
+export function describeNoData(reason, target, projectRoot, refused = []) {
     switch (reason) {
         case 'target-missing':
             return `Target does not exist: ${target}`;
+        case 'refused-report':
+            return refused.length > 0
+                ? describeRefusedReports(refused)
+                : `Coverage report refused and not read: ${target}.`;
         case 'unreadable-report':
             return `Unreadable coverage report: ${target}. It could not be parsed or lists no files. ` +
                 'Supported: lcov.info, istanbul coverage-final.json / coverage-summary.json, Cobertura XML. ' +

package/dist/coordination/handlers/handler-utils.d.ts

@@ -4,6 +4,7 @@
  * These were originally module-level helpers in task-executor.ts and are
  * now co-located with the handlers that use them.
  */
+import { type ConfinedReadReason } from '../../shared/io/confined-read.js';
 import type { CoverageData } from '../../domains/coverage-analysis';
 /**
  * Istanbul/nyc coverage-final.json file data structure
@@ -79,6 +80,24 @@ export declare function loadCoverageReport(targetPath: string): Promise<{
     data: CoverageData;
     path: string;
 } | null>;
+/** A coverage report that exists but was refused unread (#1186). */
+export interface RefusedCoverageReport {
+    path: string;
+    reason: ConfinedReadReason;
+}
+/**
+ * `loadCoverageReport` plus the reports that were refused unread (#1186): a
+ * report linked out of the project, a FIFO or device, or one over the size
+ * limit is not a missing report, and the caller must be able to say why it
+ * was not used.
+ */
+export declare function findCoverageReport(targetPath: string): Promise<{
+    report: {
+        data: CoverageData;
+        path: string;
+    } | null;
+    refused: RefusedCoverageReport[];
+}>;
 /**
  * Per-line hit counts of one istanbul file entry, computed the way istanbul's
  * own `FileCoverage#getLineCoverage` (and therefore coverage-summary.json

package/dist/coordination/handlers/handler-utils.js

@@ -5,7 +5,7 @@
  * now co-located with the handlers that use them.
  */
 import * as fs from 'fs/promises';
-import { readConfinedText } from '../../shared/io/confined-read.js';
+import { ConfinedReadError, readConfinedText } from '../../shared/io/confined-read.js';
 import * as path from 'path';
 import { isAqeManagedDir } from '../../shared/aqe-managed-dirs.js';
 import { safeJsonParse } from '../../shared/safe-json.js';
@@ -20,6 +20,16 @@ export async function loadCoverageData(targetPath) {
 }
 /** `loadCoverageData` plus the path of the report it read (#1154: staleness needs it). */
 export async function loadCoverageReport(targetPath) {
+    return (await findCoverageReport(targetPath)).report;
+}
+/**
+ * `loadCoverageReport` plus the reports that were refused unread (#1186): a
+ * report linked out of the project, a FIFO or device, or one over the size
+ * limit is not a missing report, and the caller must be able to say why it
+ * was not used.
+ */
+export async function findCoverageReport(targetPath) {
+    const refused = [];
     // Try various coverage file locations (JS, Python, Java, etc.)
     const coverageLocations = [
         // JavaScript/TypeScript (Istanbul/nyc/vitest)
@@ -40,23 +50,27 @@ export async function loadCoverageReport(targetPath) {
             // #1161: a report linked out of the project, or to a device, is not read.
             const content = await readConfinedText(coveragePath, { outsideRoot: 'allow' });
             if (coveragePath.endsWith('coverage-summary.json')) {
-                return { data: parseCoverageSummaryJson(content), path: coveragePath };
+                return { report: { data: parseCoverageSummaryJson(content), path: coveragePath }, refused };
             }
             else if (coveragePath.endsWith('.json')) {
-                return { data: parseCoverageJson(content), path: coveragePath };
+                return { report: { data: parseCoverageJson(content), path: coveragePath }, refused };
             }
             else if (coveragePath.endsWith('.info')) {
-                return { data: parseLcovInfo(content), path: coveragePath };
+                return { report: { data: parseLcovInfo(content), path: coveragePath }, refused };
             }
             else if (coveragePath.endsWith('.xml')) {
-                return { data: parseCoberturaXml(content), path: coveragePath };
+                return { report: { data: parseCoberturaXml(content), path: coveragePath }, refused };
             }
         }
-        catch {
-            // File not found, try next
+        catch (error) {
+            // Not found (or unparseable): try the next location. A refused report
+            // is recorded so it is not reported as a missing one.
+            if (error instanceof ConfinedReadError && error.reason !== 'not-found') {
+                refused.push({ path: coveragePath, reason: error.reason });
+            }
         }
     }
-    return null;
+    return { report: null, refused };
 }
 /**
  * Per-line hit counts of one istanbul file entry, computed the way istanbul's

package/dist/coordination/protocols/code-intelligence-index.js

@@ -217,11 +217,14 @@ export class CodeIntelligenceIndexProtocol {
             if (uncommittedFiles.length > 0) {
                 changedFiles.push(...uncommittedFiles);
             }
-            // Then, get committed changes since last index
+            // Then, get committed changes since last index. #1165: a git failure or
+            // timeout fails the detection; indexing without the committed changes
+            // would record a new last-index time and skip them for good.
             const gitChanges = await this.detectGitChanges(lastIndexTime);
-            if (gitChanges.success) {
-                changedFiles.push(...gitChanges.value);
+            if (!gitChanges.success) {
+                return gitChanges;
             }
+            changedFiles.push(...gitChanges.value);
             // Deduplicate
             const uniqueFiles = [...new Set(changedFiles)];
             return ok(uniqueFiles);

package/dist/coordination/protocols/learning-consolidation-archive.d.ts

@@ -12,8 +12,9 @@
  * - The active record must still be the selected pattern (same id, and the
  *   same scores and last use) when the archive runs, or nothing is written or
  *   deleted. A pattern used or re-scored since it was selected is left active.
- * - The archive copy is read back before the active key is deleted, so a
- *   failed write never loses the pattern.
+ * - The archive copy is read back and compared in full before the active
+ *   key is deleted, so a failed write never loses the pattern; the delete is
+ *   a compare-and-delete against that copy (#1149).
  * The move is implemented in domains/learning-optimization/pattern-archive.ts.
  */
 import type { LearnedPattern } from '../../domains/learning-optimization/interfaces.js';
@@ -24,8 +25,10 @@ export interface ArchiveCounts {
     selected: number;
     /** Selected patterns moved to `:archived:` and removed from the active set. */
     archived: number;
-    /** Selected patterns whose active record was gone or changed; left alone. */
+    /** Selected patterns whose active record was gone; nothing written. */
     missing: number;
+    /** Selected patterns changed since selection or during the move; left active (#1149). */
+    changed: number;
     /** Selected patterns whose archive copy could not be verified; left active. */
     failed: number;
 }

package/dist/coordination/protocols/learning-consolidation-archive.js

@@ -12,15 +12,16 @@
  * - The active record must still be the selected pattern (same id, and the
  *   same scores and last use) when the archive runs, or nothing is written or
  *   deleted. A pattern used or re-scored since it was selected is left active.
- * - The archive copy is read back before the active key is deleted, so a
- *   failed write never loses the pattern.
+ * - The archive copy is read back and compared in full before the active
+ *   key is deleted, so a failed write never loses the pattern; the delete is
+ *   a compare-and-delete against that copy (#1149).
  * The move is implemented in domains/learning-optimization/pattern-archive.ts.
  */
 // The move itself lives with the patterns, so the merge path in
 // LearningCoordinatorService uses the same read-back rule (#1106).
 export { archiveSelectedPattern } from '../../domains/learning-optimization/pattern-archive.js';
 export function emptyArchiveCounts() {
-    return { selected: 0, archived: 0, missing: 0, failed: 0 };
+    return { selected: 0, archived: 0, missing: 0, changed: 0, failed: 0 };
 }
 /** True when the pattern was created less than `graceDays` days ago. */
 export function isWithinRetentionGrace(pattern, graceDays, now = Date.now()) {

package/dist/coordination/workflow-builtin.js

@@ -304,6 +304,7 @@ function continuousLearningWorkflow() {
                 outputMapping: {
                     transferSuccessRate: 'transfer.successRate',
                     newPatternsCreated: 'transfer.newPatterns',
+                    mergeFailures: 'transfer.mergeFailures',
                 },
             },
             {

package/dist/domains/defect-intelligence/interfaces.d.ts

@@ -30,6 +30,8 @@ export interface PredictionResult {
     factors: string[];
     /** ADR-051: LLM-enhanced analysis when enabled */
     llmAnalysis?: LLMDefectAnalysis;
+    /** #1137: the run was stored, but pruning older runs failed. */
+    retention?: 'failed';
 }
 /**
  * ADR-051: LLM-enhanced defect analysis result

package/dist/domains/defect-intelligence/prediction-history.d.ts

@@ -1,5 +1,7 @@
 import type { MemoryBackend } from '../../kernel/interfaces.js';
 export declare const MAX_PREDICTION_HISTORY = 32;
+/** Longest `target` a prediction run may name (Linux PATH_MAX) (#1137). */
+export declare const MAX_PREDICTION_TARGET_LENGTH = 4096;
 type RiskLevel = 'critical' | 'high' | 'medium' | 'low' | 'info';
 /** One file prediction as the defect-intelligence predictor recorded it. */
 export interface DomainFilePrediction {
@@ -12,16 +14,28 @@ export interface DomainFilePrediction {
     }[];
     recommendations: string[];
 }
+/**
+ * #1137: the target a run for an explicit file list covers. A list too long
+ * to store as a target is identified by its digest.
+ */
+export declare function predictionTargetForFiles(files: readonly string[]): string;
 /** A recorded prediction run, or `null` when the record is not a usable one. */
 export declare function parsePredictionRecord(raw: unknown, now: number): {
     id: string;
     timestamp: string;
     predictions: DomainFilePrediction[];
+    /** What the run covered; '' for runs recorded before #1137. */
+    target: string;
     predictionMethod?: 'static-code-indicators';
     estimated?: true;
     filesSkipped?: number;
 } | null;
-/** Keep 32 usable immutable UUID runs, preserving tied-latest ambiguity. */
+/**
+ * Bound the stored prediction runs: delete runs older than 7 days and usable
+ * runs beyond the cap. A row this version cannot parse (stamped ahead by
+ * another host's clock, or a riskLevel from a newer release) is left to its
+ * TTL rather than deleted on this version's schema (#1137).
+ */
 export declare function prunePredictionHistory(memory: Pick<MemoryBackend, 'search' | 'get' | 'delete'>, modelNamespace?: string): Promise<void>;
 export {};
 //# sourceMappingURL=prediction-history.d.ts.map

package/dist/domains/defect-intelligence/prediction-history.js

@@ -1,4 +1,7 @@
+import { createHash } from 'node:crypto';
 export const MAX_PREDICTION_HISTORY = 32;
+/** Longest `target` a prediction run may name (Linux PATH_MAX) (#1137). */
+export const MAX_PREDICTION_TARGET_LENGTH = 4096;
 const MAX_PREDICTION_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 const NAMESPACE = 'defect-intelligence';
 const RISK_LEVELS = ['critical', 'high', 'medium', 'low', 'info'];
@@ -21,6 +24,16 @@ function parseFilePrediction(raw) {
         : [];
     return { file, probability, riskLevel: riskLevel, factors, recommendations };
 }
+/**
+ * #1137: the target a run for an explicit file list covers. A list too long
+ * to store as a target is identified by its digest.
+ */
+export function predictionTargetForFiles(files) {
+    const target = `files:${[...new Set(files)].sort().join(',')}`;
+    return target.length <= MAX_PREDICTION_TARGET_LENGTH
+        ? target
+        : `files-sha256:${createHash('sha256').update(target).digest('hex')}`;
+}
 /** A recorded prediction run, or `null` when the record is not a usable one. */
 export function parsePredictionRecord(raw, now) {
     if (!isRecord(raw) || typeof raw.id !== 'string' || typeof raw.timestamp !== 'string')
@@ -28,6 +41,8 @@ export function parsePredictionRecord(raw, now) {
     const t = Date.parse(raw.timestamp);
     if (!Number.isFinite(t) || t > now + 60_000 || now - t > MAX_PREDICTION_AGE_MS)
         return null;
+    if (raw.target !== undefined && (typeof raw.target !== 'string' || raw.target.length > MAX_PREDICTION_TARGET_LENGTH))
+        return null;
     if (!Array.isArray(raw.predictions) || raw.predictions.length === 0)
         return null;
     const predictions = raw.predictions.map(parseFilePrediction);
@@ -35,6 +50,7 @@ export function parsePredictionRecord(raw, now) {
         return null;
     return {
         id: raw.id, timestamp: raw.timestamp, predictions: predictions,
+        target: raw.target ?? '',
         ...(raw.predictionMethod === 'static-code-indicators' ? {
             predictionMethod: 'static-code-indicators', estimated: true,
             filesSkipped: typeof raw.filesSkipped === 'number' && Number.isSafeInteger(raw.filesSkipped) && raw.filesSkipped >= 0
@@ -42,26 +58,66 @@ export function parsePredictionRecord(raw, now) {
         } : {}),
     };
 }
-/** Keep 32 usable immutable UUID runs, preserving tied-latest ambiguity. */
+/** Milliseconds since the epoch the record claims, or `null` when it names no parseable time. */
+function recordTime(raw) {
+    if (!isRecord(raw) || typeof raw.timestamp !== 'string')
+        return null;
+    const t = Date.parse(raw.timestamp);
+    return Number.isFinite(t) ? t : null;
+}
+/**
+ * #1137: the latest run of every target stays (with any run tied with it, so
+ * the worker still sees the ambiguity), most recently predicted targets first;
+ * the newest other runs fill what is left. Never more than the cap in total.
+ */
+function selectRetained(newestFirst) {
+    const latestAt = new Map();
+    const latest = [];
+    for (const run of newestFirst) {
+        const at = latestAt.get(run.target);
+        if (at === undefined)
+            latestAt.set(run.target, run.timestamp);
+        if (at === undefined || at === run.timestamp)
+            latest.push(run);
+    }
+    const keep = new Set(latest.slice(0, MAX_PREDICTION_HISTORY).map((run) => run.key));
+    for (const run of newestFirst) {
+        if (keep.size >= MAX_PREDICTION_HISTORY)
+            break;
+        keep.add(run.key);
+    }
+    return keep;
+}
+/**
+ * Bound the stored prediction runs: delete runs older than 7 days and usable
+ * runs beyond the cap. A row this version cannot parse (stamped ahead by
+ * another host's clock, or a riskLevel from a newer release) is left to its
+ * TTL rather than deleted on this version's schema (#1137).
+ */
 export async function prunePredictionHistory(memory, modelNamespace = 'defect-intelligence:predictor') {
     const prefix = `${modelNamespace}:prediction:`;
     const keys = await memory.search(`${prefix}*`, Number.MAX_SAFE_INTEGER, { namespace: NAMESPACE });
     const now = Date.now();
     const records = [];
-    const invalid = [];
+    const expired = [];
     for (const found of keys) {
         const key = found.startsWith(`${NAMESPACE}:${prefix}`) ? found.slice(NAMESPACE.length + 1) : found;
         if (!key.startsWith(prefix))
             continue;
-        const parsed = parsePredictionRecord(await memory.get(key, { namespace: NAMESPACE }), now);
+        const raw = await memory.get(key, { namespace: NAMESPACE });
+        const t = recordTime(raw);
+        if (t !== null && now - t > MAX_PREDICTION_AGE_MS) {
+            expired.push(key);
+            continue;
+        }
+        const parsed = parsePredictionRecord(raw, now);
         if (parsed)
-            records.push({ key, timestamp: Date.parse(parsed.timestamp), id: parsed.id });
-        else
-            invalid.push(key);
+            records.push({ key, timestamp: Date.parse(parsed.timestamp), id: parsed.id, target: parsed.target });
     }
     records.sort((a, b) => b.timestamp - a.timestamp || (a.id === b.id ? (a.key === b.key ? 0 : a.key > b.key ? -1 : 1) : a.id > b.id ? -1 : 1));
+    const keep = selectRetained(records);
     // Only observed immutable keys are candidates; concurrent new runs are untouched.
-    for (const key of [...invalid, ...records.slice(MAX_PREDICTION_HISTORY).map(record => record.key)]) {
+    for (const key of [...expired, ...records.filter((record) => !keep.has(record.key)).map((record) => record.key)]) {
         await memory.delete(key, { namespace: NAMESPACE });
     }
 }

package/dist/domains/defect-intelligence/services/defect-predictor.d.ts

@@ -188,6 +188,7 @@ export declare class DefectPredictorService implements IDefectPredictorService {
     private generateTestRecommendations;
     private calculateModelConfidence;
     private calculateVariance;
+    /** Records the run; `false` when it was stored but older runs could not be pruned (#1137). */
     private storePrediction;
     private recalculateMetrics;
 }