argus-decision-mcp 1.4.1 → 1.4.6

package/dist/lib/due-note.js

@@ -4,6 +4,7 @@ import { resolveToolArgusDir } from './argus-dir.js';
 import { resolveToday } from './resolve-today.js';
 import { configPath } from './layout.js';
 import { ambientDueFromState, ambientLine } from './ambient-due.js';
+import { stripUnsafeChars } from './untrusted.js';
 /**
  * Dispatch-level ambient due-note (plan v5 §5-2 · M1 §1.3, restraint rules §3.4).
  *
@@ -86,7 +87,11 @@ export function appendDueNote(toolName, args, result) {
             na.push('argus_check_in');
         // ── channel 2: the surface tail — session-once, mute-respecting, localized ──
         if (!ambientShownFor.has(dir) && !ambientMuted(dir)) {
-            const line = ambientLine(dir, due, state); // state lends the ledger's own voice
+            // This tail is appended AFTER envelope() already ran sanitizeOutput, so it
+            // must be sanitized itself — ambientLine reads ledger text (via `state`),
+            // and one future change that quotes the ledger's words would otherwise
+            // inject past the sanitizer.
+            const line = stripUnsafeChars(ambientLine(dir, due, state));
             if (line && typeof sc['surface'] === 'string') {
                 sc['surface'] = String(sc['surface']) + line;
                 data['ambient_shown'] = true;

package/dist/lib/elicit.js

@@ -9,6 +9,7 @@
  * elicitation (many don't yet), `elicit` returns null and callers fall back to
  * the text flow — no crash, no dead end.
  */
+import { stripUnsafeChars } from './untrusted.js';
 let _elicit = null;
 let _capable = null;
 /** Wire the elicitor and, optionally, a live capability probe. The probe must
@@ -33,7 +34,14 @@ export async function elicit(message, requestedSchema) {
     if (!_elicit)
         return null;
     try {
-        const res = await _elicit(message, requestedSchema);
+        // The elicitation `message` is a SEPARATE server→client request — it does NOT
+        // pass through envelope()/sanitizeOutput, so a raw predicate/premise
+        // interpolated into it (seal.ts, premises.ts) could carry ANSI escapes or a
+        // forged "AI VERDICT" line that a terminal host renders (screen-clear +
+        // spine spoof). Sanitize here, at the one seam every picker passes through,
+        // so no call site can forget. stripUnsafeChars keeps \n and \t (a message
+        // like `Record this?\n"…"` needs the newline).
+        const res = await _elicit(stripUnsafeChars(message), requestedSchema);
         return res.action === 'accept' && res.content ? res.content : null;
     }
     catch {

package/dist/lib/ledger-append.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import fsP from 'fs/promises';
+import { randomUUID } from 'crypto';
 import { ledgerPath, ledgerDir } from './layout.js';
 import { SCHEMA_VERSION } from './spine.js';
 import { mirrorV1Events } from '../v2/mirror.js';
@@ -11,45 +12,116 @@ import { mirrorV1Events } from '../v2/mirror.js';
  * counting the calibration record. O_EXCL create is the atomic primitive;
  * a lock older than STALE_MS is treated as a crash leftover and stolen.
  */
-const LOCK_STALE_MS = 5000;
 const LOCK_WAIT_MS = 25;
-const LOCK_TRIES = 120; // ~3s worst case
+const LOCK_TRIES = 120; // ~3s worst case before failing OPEN (availability > strictness)
+// A normal critical section is milliseconds. 10 min = a zombie / reused pid, or a
+// lock synced in from a now-offline machine — the only cases old enough to steal
+// when we can't prove the holder is dead by pid.
+const LOCK_HELD_TOO_LONG_MS = 10 * 60_000;
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === 'EPERM';
+    } // EPERM = alive but not ours; ESRCH = dead
+}
+/**
+ * A held lock is stealable ONLY if its holder is provably gone: the pid is dead
+ * (same machine) or it has been held absurdly long. The old code stole any lock
+ * older than 5s by mtime, which let a LIVE holder inside a slow critical section
+ * (large ledger fsync, network FS) be robbed — two writers then both believed
+ * they held the lock and both appended, double-counting the calibration record.
+ */
+function lockStealable(lockPath) {
+    try {
+        let body = null;
+        try {
+            body = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+        }
+        catch { /* legacy/torn — fall to mtime */ }
+        if (body && typeof body === 'object') {
+            const b = body;
+            const started = typeof b.started_at === 'string' ? Date.parse(b.started_at) : NaN;
+            if (Number.isFinite(started) && Date.now() - started > LOCK_HELD_TOO_LONG_MS)
+                return true;
+            if (typeof b.pid === 'number')
+                return !pidAlive(b.pid);
+        }
+        // legacy bare-pid or malformed body: fall back to a GENEROUS mtime age.
+        return Date.now() - fs.statSync(lockPath).mtimeMs > LOCK_HELD_TOO_LONG_MS;
+    }
+    catch {
+        return true; // vanished between attempts — retry create
+    }
+}
 export async function withLedgerLock(argusDir, fn) {
     await fsP.mkdir(ledgerDir(argusDir), { recursive: true });
     const lockPath = ledgerPath(argusDir) + '.lock';
+    const nonce = randomUUID();
+    const bodyStr = JSON.stringify({ nonce, pid: process.pid, started_at: new Date().toISOString() });
+    const tmp = `${lockPath}.${nonce}.tmp`;
     let acquired = false;
     for (let i = 0; i < LOCK_TRIES && !acquired; i++) {
         try {
-            const fd = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
-            fs.writeSync(fd, String(process.pid), null, 'utf8');
-            fs.closeSync(fd);
+            // Complete the body first, then create the lock via an ATOMIC hardlink —
+            // the lock file exists only ever with a full body (no empty window a racer
+            // could misread as "crashed mid-write"), and EEXIST means someone holds it.
+            fs.writeFileSync(tmp, bodyStr, 'utf8');
+            fs.linkSync(tmp, lockPath);
             acquired = true;
         }
-        catch {
+        catch (e) {
+            const code = e.code;
+            if (code !== 'EEXIST') {
+                // linkSync unsupported on this FS (rare) — degrade to O_EXCL create.
+                try {
+                    const fd = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
+                    fs.writeSync(fd, bodyStr, null, 'utf8');
+                    fs.closeSync(fd);
+                    acquired = true;
+                }
+                catch { /* held — fall through to steal/wait */ }
+            }
+            if (!acquired) {
+                if (lockStealable(lockPath)) {
+                    // Steal ATOMICALLY via rename — exactly one racer's rename wins; the
+                    // loser throws (already moved) and retries. (unlink+recreate let two
+                    // stealers both delete then both create — the double-steal race.)
+                    try {
+                        const grave = `${lockPath}.stale-${nonce}`;
+                        fs.renameSync(lockPath, grave);
+                        fs.unlinkSync(grave);
+                    }
+                    catch { /* lost the steal to another racer — just retry create */ }
+                    continue; // retry immediately
+                }
+                await new Promise((r) => setTimeout(r, LOCK_WAIT_MS));
+            }
+        }
+        finally {
             try {
-                const st = fs.statSync(lockPath);
-                if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
-                    fs.unlinkSync(lockPath);
-                    continue;
-                } // crash leftover
+                fs.unlinkSync(tmp);
             }
-            catch {
-                continue;
-            } // lock vanished between attempts — retry immediately
-            await new Promise((r) => setTimeout(r, LOCK_WAIT_MS));
+            catch { /* linked away on success, or never created */ }
         }
     }
-    // Lock or no lock, the work proceeds (availability over strictness — a stuck
-    // lock must never brick the ledger; the steal above bounds the wait).
+    // Fail OPEN if never acquired (availability > strictness — a stuck lock must
+    // never brick the ledger; the steal logic bounds the wait to ~3s).
     try {
         return await fn();
     }
     finally {
         if (acquired) {
+            // Release only our OWN lock (nonce match) — never delete a lock a later
+            // holder created after ours was legitimately stolen (ABA guard).
             try {
-                fs.unlinkSync(lockPath);
+                const cur = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+                if (cur.nonce === nonce)
+                    fs.unlinkSync(lockPath);
             }
-            catch { /* already gone */ }
+            catch { /* gone, or not ours */ }
         }
     }
 }

package/dist/lib/ledger-replay.js

@@ -32,7 +32,13 @@ export function replayLedger(argusDir, today) {
     catch {
         return { today, overdue: [], ids, sealedPredicates, contracts: map, stats, watch, integrity: { dropped_lines: 0, skipped_unknown: 0 } };
     }
-    for (const line of raw.split('\n')) {
+    for (const rawLine of raw.split('\n')) {
+        // Strip a per-LINE BOM: deBom only removes one at byte 0, but a U+FEFF can
+        // ride the first line of a concatenated second file, or be prepended per
+        // append by a Windows PowerShell co-writer (>>/Out-File) sharing the ledger.
+        // JSON.parse('{…}') throws, so without this a real settle line would
+        // be dropped and its outcome vanish from calibration.
+        const line = rawLine.charCodeAt(0) === 0xfeff ? rawLine.slice(1) : rawLine;
         if (!line.trim())
             continue;
         let ev;
@@ -115,7 +121,6 @@ export function replayLedger(argusDir, today) {
                     map.set(id, cur);
                 } // B1: self-create
                 cur.status = 'settled';
-                stats.total_settled++;
                 const outcome = ev['outcome'];
                 cur.outcome = outcome;
                 // Timestamp field is two-vocab across surfaces: this binary stamps `ts`,
@@ -127,18 +132,35 @@ export function replayLedger(argusDir, today) {
                 if (typeof ev['broken_premise_id'] === 'string')
                     cur.broken_premise_id = ev['broken_premise_id'];
                 // `happened` is the plugin CLI's legacy spelling of `held` (pre plain-canon
-                // unification). Old ledgers keep their bytes — the alias lives at read time
-                // so the frequency buckets stay complete (total_settled == sum of buckets).
-                if (outcome === 'held' || outcome === 'happened')
+                // unification). Old ledgers keep their bytes — the alias lives at read time.
+                // total_settled is incremented HERE, together with the bucket, so the
+                // invariant total_settled == sum(buckets) always holds. A settle event
+                // with an UNKNOWN outcome (a corrupt or externally-synced ledger — the
+                // zod enum blocks it on the MCP write path) still marks the decision
+                // settled, but is not counted into a calibration frequency it can't be
+                // categorized into (it used to inflate total_settled, so the surface read
+                // "N settled: 0 · 0 · 0 · 0" — a settle that vanished from its own breakdown).
+                if (outcome === 'held' || outcome === 'happened') {
                     stats.held++;
-                else if (outcome === 'avoided')
+                    stats.total_settled++;
+                }
+                else if (outcome === 'avoided') {
                     stats.avoided++;
-                else if (outcome === 'partial')
+                    stats.total_settled++;
+                }
+                else if (outcome === 'partial') {
                     stats.partial++;
-                else if (outcome === 'still_pending')
-                    stats.still_pending++;
-                else if (outcome === 'missed')
+                    stats.total_settled++;
+                }
+                else if (outcome === 'missed') {
                     stats.missed++;
+                    stats.total_settled++;
+                }
+                // 'still_pending' is NOT a terminal outcome — the MCP settle tool routes
+                // it to a `defer` event, never a `settle`. A settle+still_pending is
+                // therefore external/legacy only; it is not counted (the displayed
+                // breakdown shows four buckets, so counting it would make the visible
+                // line under-sum: "1 settled: 0 · 0 · 0 · 0"). v2 rejects it likewise.
                 break;
             }
             case 'defer': {

package/dist/lib/localize-result.js

@@ -4,7 +4,7 @@ const KO_ERRORS = {
     INVALID_LOCALE: { message: '지원하지 않는 언어입니다.', recovery: 'locale에는 "ko" 또는 "en"을 사용하세요.' },
     ALREADY_CLOSED: { message: '이미 진행 중이거나 닫힌 결정입니다.', recovery: '실제 결과를 기록하려면 argus_resolve를 사용하세요. 닫힌 결정은 다시 열지 않습니다.' },
     CAPTURE_NOT_FOUND: { message: '일치하는 내부 메모를 찾지 못했습니다.', recovery: '전제 문장을 text에 직접 전달하세요.' },
-    AMBIGUOUS_REF: { message: '여러 내부 메모와 일치해 대상을 정할 수 없습니다.', recovery: '전제 문장을 text에 직접 전달하세요.' },
+    AMBIGUOUS_REF: { message: '참조가 여러 항목과 일치합니다.', recovery: 'P1 같은 서수(번호)로 정확히 지정하세요. 번호는 argus_patterns view="decision_context"에서 볼 수 있습니다.' },
     PROVENANCE_REQUIRED: { message: '문장의 출처를 확인해야 합니다.', recovery: '사용자가 쓴 문장이면 user_stated, AI가 제기한 문장이면 ai_surfaced와 원문을 전달하세요.' },
     PREMISES_REQUIRED: { message: '추가할 전제가 없습니다.', recovery: 'text, kind, external, load_bearing, source를 포함한 전제 1~5개를 전달하세요.' },
     PREMISE_ID_COLLISION: { message: '다른 전제가 같은 식별자를 사용하고 있습니다.', recovery: '전제 문장을 조금 다르게 표현한 뒤 다시 추가하세요.' },
@@ -30,12 +30,15 @@ const KO_ERRORS = {
     // ko/en 패리티: 아래 코드들은 en에서만 상세했고 ko는 제네릭 폴백이었다 —
     // 한국어 사용자가 같은 품질의 복구 안내를 받도록 전용 문구를 둔다.
     NO_PRIOR_SEAL: { message: '이 id로 저장된 예측이 없습니다.', recovery: 'argus_predict로 반증 가능한 예측과 확인일을 먼저 저장하세요. (id가 argus_settings sync에서 온 "mcp_" 접두사라면 접두사를 뗀 id를 쓰세요.)' },
-    BAD_CHECK_BY: { message: '확인일이 오늘 이후의 날짜(YYYY-MM-DD)가 아닙니다.', recovery: 'check_by를 오늘 이후 날짜로 다시 전달하세요.' },
-    ILLEGAL_TRANSITION: { message: '지금 상태에서는 할 수 없는 작업입니다.', recovery: 'argus_patterns view="all"로 이 결정의 현재 상태를 확인한 뒤 맞는 도구를 사용하세요.' },
+    BAD_CHECK_BY: { message: '확인일이 오늘 이후의 실제 달력 날짜(YYYY-MM-DD)가 아닙니다 (예: 2026-13-01처럼 없는 달·날짜는 불가).', recovery: '오늘 이후의 올바른 날짜를 YYYY-MM-DD로 다시 전달하세요.' },
+    ILLEGAL_TRANSITION: { message: '이 결정에 지금은 할 수 없는 작업입니다 (id 오타이거나, 이미 저장·정산·종료된 상태일 수 있습니다).', recovery: 'argus_patterns view="all"로 id와 현재 상태를 확인하세요. 없는 id면 argus_capture 또는 argus_predict로 새로 시작하세요.' },
+    PREMISE_LOCKED: { message: '확인일이 지나 전제를 더는 바꿀 수 없습니다.', recovery: '먼저 argus_resolve로 실제 결과를 기록하세요. 확인일이 온 뒤에는 전제/예측을 고칠 수 없습니다.' },
+    ARGUS_DIR_INVALID: { message: 'Argus 기록 경로(argus_dir / ARGUS_DIR)가 올바르지 않습니다.', recovery: '절대 경로여야 하고 ".."을 포함할 수 없습니다. MCP 설정에서 절대 경로(예: C:\\Users\\이름\\.argus, /Users/이름/.argus)로 바꾸거나 ARGUS_DIR을 지워 기본값(~/.argus)을 쓰세요. ${...} 같은 변수는 호스트가 확장하지 못할 수 있습니다.' },
+    EMPTY_PREDICATE: { message: '확인 가능한 예측 문장이 필요합니다 (공백 제외 최소 8자).', recovery: '현실이 참/거짓으로 확인할 수 있는 문장으로 다시 적으세요. 예: "컷오버 다운타임 5분 미만".' },
     ALREADY_SETTLED: { message: '이미 실제 결과가 기록된 결정입니다.', recovery: '영수증은 argus_patterns view="receipt"로 볼 수 있습니다. 새 결정이면 새 id로 여세요.' },
     DECISION_CLOSED: { message: '접힌(닫힌) 결정이라 더 진행할 수 없습니다.', recovery: '필요하면 새 id로 다시 여세요. 닫힌 기록은 그대로 남습니다.' },
     GOALPOST_MOVED: { message: '봉인된 예측 문장은 확인일 전에 바꿀 수 없습니다.', recovery: '일정 변경은 outcome="still_pending"과 defer_to로, 예측 자체가 달라졌다면 새 결정으로 여세요.' },
-    NO_SUCH_PREMISE: { message: '해당 번호의 전제를 찾지 못했습니다.', recovery: 'argus_patterns view="decision_context"로 전제 목록과 번호를 확인하세요.' },
+    NO_SUCH_PREMISE: { message: '해당 번호의 전제를 찾지 못했습니다 (이 결정에 아직 전제가 없을 수 있습니다).', recovery: 'argus_patterns view="decision_context"로 목록과 번호를 확인하고, 전제가 없으면 argus_capture action="add_context"로 먼저 추가하세요.' },
     WHAT_HAPPENED_REQUIRED: { message: '실제로 일어난 일을 기록해야 합니다.', recovery: '사용자에게 실제 결과를 물어 what_happened에 그대로 전달하세요.' },
     DEFER_DATE_REQUIRED: { message: '다시 확인할 날짜가 필요합니다.', recovery: '사용자에게 날짜를 물어 defer_to에 YYYY-MM-DD로 전달하세요. 더는 중요하지 않다면 argus_capture action="close"를 사용하세요.' },
     NOT_CONNECTED: { message: '이 터미널은 Argus 계정과 연결돼 있지 않습니다.', recovery: '웹 설정에서 동기화 토큰을 발급하고 MCP 설정의 ARGUS_TOKEN에 넣으세요.' },
@@ -46,10 +49,30 @@ const KO_ERRORS = {
     UNKNOWN_TOOL: { message: '알 수 없는 도구입니다.', recovery: 'tools/list에 나온 정확한 도구 이름을 사용하세요.' },
 };
 export const LOCALIZED_ERROR_CODES = new Set(Object.keys(KO_ERRORS));
+// The allowed values for each enum field, so a wrong guess (stakes="medium",
+// outcome="success", …) TEACHES the model the valid set instead of a bare "not
+// allowed". Keyed by the field's LAST path segment (so premises.0.kind → kind).
+const ENUM_HINTS = {
+    stakes: 'trivial · low · moderate · high',
+    reversibility: 'one_way_door · costly_to_reverse · easily_reversible',
+    outcome: 'held · avoided · partial · still_pending · missed',
+    outcome_source: 'user_stated',
+    view: 'active · all · receipt · decision_context · timeline · reflection',
+    action: 'open · add_context · answer_question · keep_question_open · update_fact · change_prediction · close',
+    locale: 'ko · en',
+    basis: 'judgment · luck · mixed · unsure',
+    kind: 'premise · open_question',
+    predicate_owner: 'user · ai_surfaced',
+    source: 'user_stated · ai_surfaced (update_fact에서는 url · user_stated · host_reported)',
+    dismiss_reason: 'became_irrelevant · decided_elsewhere · superseded · user_declined',
+};
+const DATE_FIELDS = new Set(['check_by', 'defer_to', 'today_override', 'snooze_until']);
 /** Translate one Zod issue into a Korean, actionable reason. Keeps the English
  *  argument NAME (models and users see arg names in English), but says in Korean
- *  WHY it failed — the piece the generic message threw away. */
-function koReason(issue) {
+ *  WHY it failed — the piece the generic message threw away. Field-aware so an id
+ *  regex failure isn't told to "use YYYY-MM-DD" and an enum lists its values. */
+function koReason(issue, field) {
+    const key = field.split('.').pop() || field;
     const unit = issue.origin === 'string' ? '자' : issue.origin === 'array' ? '개' : '';
     switch (issue.code) {
         case 'too_small':
@@ -67,14 +90,24 @@ function koReason(issue) {
         case 'invalid_type':
             return issue.expected === undefined ? '형식이 올바르지 않습니다' : `필수이거나 형식이 올바르지 않습니다 (${issue.expected} 필요)`;
         case 'invalid_value':
-        case 'invalid_enum_value':
-            return '허용되지 않는 값입니다';
+        case 'invalid_enum_value': {
+            const hint = ENUM_HINTS[key];
+            return hint ? `허용되지 않는 값입니다 (가능: ${hint})` : '허용되지 않는 값입니다';
+        }
         case 'unrecognized_keys':
             return '알 수 없는 항목입니다';
         case 'invalid_format':
         case 'invalid_string':
-            return '형식이 올바르지 않습니다 (예: 날짜는 YYYY-MM-DD)';
+            if (key === 'id')
+                return '영문·숫자와 . _ - 만 쓸 수 있습니다 (한글·공백·특수문자 불가 — 예: "career-move")';
+            if (DATE_FIELDS.has(key))
+                return 'YYYY-MM-DD 형식의 날짜여야 합니다';
+            return '형식이 올바르지 않습니다';
         default:
+            // Same text as the invalid_format id case so the two issues the id regex +
+            // superRefine both raise dedup to a single line.
+            if (key === 'id')
+                return '영문·숫자와 . _ - 만 쓸 수 있습니다 (한글·공백·특수문자 불가 — 예: "career-move")';
             return '값을 확인해 주세요';
     }
 }
@@ -82,7 +115,18 @@ function koReason(issue) {
 function localizeInvalidInput(fields) {
     if (!fields.length)
         return KO_ERRORS.INVALID_INPUT;
-    const parts = fields.slice(0, 4).map((f) => `${f.field === '(root)' ? '요청' : f.field}: ${koReason(f)}`);
+    const seen = new Set();
+    const parts = [];
+    for (const f of fields) {
+        const name = f.field === '(root)' ? '요청' : f.field;
+        const part = `${name}: ${koReason(f, f.field)}`;
+        if (seen.has(part))
+            continue; // dedup "id: …, id: …" (regex + superRefine both fire)
+        seen.add(part);
+        parts.push(part);
+        if (parts.length >= 4)
+            break;
+    }
     return {
         message: `입력값이 올바르지 않습니다 — ${parts.join(', ')}.`,
         recovery: '위에 표시된 인자를 고친 뒤 같은 도구를 다시 호출하세요. 사용자가 정해야 할 값은 추측하지 마세요.',
@@ -112,12 +156,18 @@ export function localizeToolResult(args, result) {
     if (!sc || sc['ok'] !== false)
         return result;
     const code = String(sc['error_code'] ?? 'INTERNAL_ERROR');
+    // Some handlers already return a hand-written Korean message (e.g.
+    // NOT_FALSIFIABLE: "이건 기분이지 확인 가능한 예측이 아닙니다"). If this code
+    // isn't in KO_ERRORS, the generic fallback used to DESTROY that Korean copy.
+    // Preserve any message that already contains Hangul instead of overwriting it.
+    const existingMsg = typeof sc['message'] === 'string' ? sc['message'] : '';
+    const existingRec = typeof sc['recovery'] === 'string' ? sc['recovery'] : '';
+    const genericFallback = /[가-힣]/.test(existingMsg)
+        ? { message: existingMsg, ...(existingRec ? { recovery: existingRec } : {}) }
+        : { message: '요청을 처리하지 못했습니다.', recovery: '입력값과 현재 결정 상태를 확인한 뒤 다시 시도하세요.' };
     let copy = code === 'INVALID_INPUT' && Array.isArray(sc['invalid_fields'])
         ? localizeInvalidInput(sc['invalid_fields'])
-        : KO_ERRORS[code] ?? {
-            message: '요청을 처리하지 못했습니다.',
-            recovery: '입력값과 현재 결정 상태를 확인한 뒤 다시 시도하세요.',
-        };
+        : KO_ERRORS[code] ?? genericFallback;
     // en에만 있던 날짜 상세를 ko에서도 보존 — "언제가 확인일인데?"에 답이 되도록.
     if (code === 'PREMATURE_SETTLE') {
         const m = String(sc['message'] ?? '').match(/check-by (\d{4}-\d{2}-\d{2}), today (\d{4}-\d{2}-\d{2})/);

package/dist/lib/numeric-drift.js

@@ -169,7 +169,7 @@ export function evaluateMateriality(prev, next, rule, ctx) {
     if (axis === 'ratio') {
         return {
             status: 'uncertain',
-            reason: '값이 비율/%% — %p(delta)로 볼지 complement 축으로 볼지 정해주세요',
+            reason: '값이 비율(%)입니다 — %p(퍼센트포인트)로 볼지 여집합(100−값) 축으로 볼지 정해주세요',
             low_confidence: true,
         };
     }
@@ -213,7 +213,7 @@ function evaluateDeclaredRule(pv, nv, rule, ctx) {
     // then it's uncertain, never a manufactured alert. (threshold/band/step/map
     // are axis-agnostic — a crossed line is a crossed line.)
     if (mod?.unit_axis === 'ratio' && (rule.type === 'relative' || rule.type === 'delta')) {
-        return { status: 'uncertain', reason: '값이 비율/%% — %p(delta)로 볼지 complement 축으로 볼지 정해주세요', low_confidence: true };
+        return { status: 'uncertain', reason: '값이 비율(%)입니다 — %p(퍼센트포인트)로 볼지 여집합(100−값) 축으로 볼지 정해주세요', low_confidence: true };
     }
     // sign-flip modifier (§2.3 / §6.5): dead-band AND, never "always material".
     // A declared sign_flip is decided here (not by the raw delta/relative magnitude).

package/dist/lib/receipt.js

@@ -64,6 +64,15 @@ fallback) {
             null;
     const merged = {
         ...base,
+        // The ledger is the source of truth for the sealed prediction and its date.
+        // A change_prediction (amend) updates the CONTRACT but not the seal-time
+        // receipt file on disk, so `base.predicate`/`check_by` can be STALE — the
+        // receipt then contradicts every list view (dogfood: receipt printed the
+        // pre-amend "8월" predicate while the record showed the amended "9월" one).
+        // Prefer the current contract values the settle handler resolved from the
+        // fold, so the keepsake can never disagree with the ledger.
+        ...(fallback?.predicate ? { predicate: fallback.predicate } : {}),
+        ...(fallback?.check_by ? { check_by: fallback.check_by } : {}),
         settled_at: patch.settled_at,
         what_happened: patch.what_happened,
         outcome: patch.outcome,
@@ -79,7 +88,14 @@ fallback) {
 }
 export function readReceipt(argusDir, id) {
     try {
-        return JSON.parse(deBom(fs.readFileSync(receiptPath(argusDir, id), 'utf8')));
+        const parsed = JSON.parse(deBom(fs.readFileSync(receiptPath(argusDir, id), 'utf8')));
+        // A hand-edited / corrupt receipt could be a primitive, null, or an array;
+        // renderReceipt does r.predicate.split(...) unguarded and writeSettleReceipt
+        // spreads `base`, so a non-object would crash the render / drop every field.
+        // Reject anything but a plain object — a corrupt keepsake degrades, not dies.
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return parsed;
     }
     catch {
         return null;

package/dist/lib/render-receipt.js

@@ -4,8 +4,9 @@ export function renderReceipt(r, premises, locale = 'en') {
     const L = [];
     const sealed = r.created_at ? r.created_at.slice(0, 10) : '—';
     const settled = r.settled_at ? r.settled_at.slice(0, 10) : R.not_settled;
-    const top = '┌─ ' + R.header + ' ' + '─'.repeat(Math.max(2, 56 - R.header.length)) + '┐';
-    const bottom = '└' + '─'.repeat(Math.max(2, 52 - R.footer.length)) + '  ' + R.footer + ' ─┘';
+    const RW = 64; // target display columns — top and bottom derive from one width
+    const top = '┌─ ' + R.header + ' ' + '─'.repeat(Math.max(2, RW - 5 - dw(R.header))) + '┐';
+    const bottom = '└' + '─'.repeat(Math.max(2, RW - 6 - dw(R.footer))) + '  ' + R.footer + ' ─┘';
     L.push(top);
     L.push(`  ${R.sealed_label} ${sealed}      ${R.settled_label} ${settled}`);
     // Deferral fact (still_pending re-arms): "originally due X · deferred N×".
@@ -68,17 +69,20 @@ export function renderReceipt(r, premises, locale = 'en') {
 export function renderSeal(opts) {
     const S = SURFACES[opts.locale].seal;
     const L = [];
-    const top = '┌─ ' + S.header + ' ' + '─'.repeat(Math.max(2, 56 - S.header.length)) + '┐';
-    const bottom = '└' + '─'.repeat(Math.max(2, 54 - S.footer.length)) + '  ' + S.footer + ' ─┘';
+    const SW = 64; // target display columns — top and bottom derive from one width
+    const top = '┌─ ' + S.header + ' ' + '─'.repeat(Math.max(2, SW - 5 - dw(S.header))) + '┐';
+    const bottom = '└' + '─'.repeat(Math.max(2, SW - 6 - dw(S.footer))) + '  ' + S.footer + ' ─┘';
     L.push(top);
     L.push('');
     // the quote block — the user's own falsifiable sentence (continuation lines
     // sit inside the opening quote)
     L.push(`  "${wrap(opts.predicate, 50).split('\n    ').join('\n   ')}"`);
     L.push('');
-    const ownerLine = `  ${opts.predicate_owner === 'user' ? S.owner_user : S.owner_ai}`;
-    const ownerTag = `(predicate_owner: ${opts.predicate_owner})`;
-    L.push(ownerLine.length >= 40 ? `${ownerLine}   ${ownerTag}` : ownerLine.padEnd(40) + ownerTag);
+    // The prose already states provenance honestly ("these words are yours" /
+    // "Argus drafted these"). The raw `(predicate_owner: user)` machine tag beside
+    // it was plumbing on the keepsake certificate — the honest-provenance sentence
+    // carries the meaning; the token stays in `data`, off the rendered card.
+    L.push(`  ${opts.predicate_owner === 'user' ? S.owner_user : S.owner_ai}`);
     L.push('');
     const labelWidth = Math.max(S.sealed_label.length, S.answers_label.length) + 4;
     const days = Math.round((Date.parse(opts.check_by) - Date.parse(opts.today)) / 86400000);
@@ -112,7 +116,13 @@ recordSince) {
     const L = [];
     const headText = W.header + ' ';
     const countText = ' ' + W.counts(contracts.length, sealed.length, settled.length) + ' ';
-    L.push('┌─ ' + headText + '─'.repeat(Math.max(2, WIDTH - 5 - headText.length - countText.length)) + countText + '─┐');
+    // The header+counts row can exceed WIDTH (Korean counts are wide); when it
+    // does, the top must GROW rather than clamp its dashes to a floor while the
+    // short footer sits at WIDTH — that was the 1-column top/bottom mismatch. Both
+    // edges derive from one barWidth: WIDTH, or wider if the top needs it.
+    const topFixed = 3 + dw(headText) + dw(countText) + 2; // everything but the dashes
+    const barWidth = Math.max(WIDTH, topFixed + 2);
+    L.push('┌─ ' + headText + '─'.repeat(barWidth - topFixed) + countText + '─┐');
     const pushGroup = (rows, head, line, hint) => {
         if (rows.length === 0)
             return;
@@ -129,14 +139,29 @@ recordSince) {
     // reference the host can settle by; "past check-by" alone, no day-count.
     pushGroup(overdue, W.overdue_group(overdue.length), (c) => `"${label(c)}"   ${mmdd(c.check_by)}  ·  ${c.id}`, W.overdue_hint);
     pushGroup(waiting, W.waiting_group(waiting.length), (c) => `"${label(c)}"   ${W.answer_on(mmdd(c.check_by))}  ·  ${c.id}`);
-    pushGroup(settled, W.settled_group(settled.length, stats.held, stats.avoided, stats.partial), (c) => `"${label(c)}"   ${(c.outcome || '—')}  ${mmdd(c.settled_on || c.check_by)}  ·  ${c.id}`);
+    pushGroup(settled, W.settled_group(settled.length, stats.held, stats.avoided, stats.partial, stats.missed), (c) => `"${label(c)}"   ${c.outcome ? W.outcome_label(c.outcome) : '—'}  ${mmdd(c.settled_on || c.check_by)}  ·  ${c.id}`);
     L.push('');
     const foot = recordSince ? ' ' + W.record_since(recordSince) + ' ' : '';
-    L.push('└' + '─'.repeat(Math.max(2, WIDTH - 2 - foot.length)) + foot + '─┘');
+    L.push('└' + '─'.repeat(Math.max(2, barWidth - 3 - dw(foot))) + foot + '─┘');
     return L.join('\n');
 }
+// Display width: Hangul/CJK/fullwidth and the ⚓ anchor render as TWO terminal
+// columns while String.length counts them as one. Every box border was built
+// from `.length`, so a Korean header/footer made the top and bottom edges
+// disagree by several columns — the keepsake's frame did not close. Both edges
+// are now derived from one target WIDTH using this measure.
+const WIDE = /[ᄀ-ᇿ⺀-鿿ꥠ-꥿가-힣豈-﫿︰-﹏＀-｠￠-￦⚓]/;
+function dw(s) {
+    let w = 0;
+    for (const ch of s)
+        w += WIDE.test(ch) ? 2 : 1;
+    return w;
+}
 function wrap(s, width = 54) {
-    const words = s.split(/\s+/);
+    // Defense in depth: a corrupt receipt field could be non-string (readReceipt
+    // rejects a non-object file, but a wrong-typed field inside a valid object
+    // would still reach here) — coerce so .split never throws on the keepsake.
+    const words = String(s ?? '').split(/\s+/);
     const lines = [];
     let cur = '';
     for (const w of words) {

package/dist/lib/resolve-today.js

@@ -49,6 +49,26 @@ export function asDate(value) {
     const m = value.match(/(\d{4})-(\d{2})-(\d{2})/);
     return m ? `${m[1]}-${m[2]}-${m[3]}` : null;
 }
+/**
+ * asDate matches the digit SHAPE but never the calendar: "2026-13-01" (month 13)
+ * and "2026-09-31" (Sept has 30 days) both pass its regex. A calendar-invalid
+ * check_by used to seal — comparisons are lexical, so a future-looking bad date
+ * slid past the "must be in the future" gate — producing a malformed .ics
+ * (DTSTART:20261301) and a wrong due date. isRealDate rejects impossible
+ * month/day so the seal gate can fail loud instead.
+ */
+export function isRealDate(value) {
+    if (typeof value !== 'string')
+        return false;
+    const m = value.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+    if (!m)
+        return false;
+    const y = Number(m[1]), mo = Number(m[2]), d = Number(m[3]);
+    if (mo < 1 || mo > 12 || d < 1 || d > 31)
+        return false;
+    const dt = new Date(Date.UTC(y, mo - 1, d));
+    return dt.getUTCFullYear() === y && dt.getUTCMonth() === mo - 1 && dt.getUTCDate() === d;
+}
 export function isFutureDate(check, today) {
     const c = asDate(check);
     return !!c && c > today;

package/dist/lib/safe-path.js

@@ -12,6 +12,12 @@ import fs from 'fs';
 // A single path segment: letters, digits, dot, underscore, hyphen.
 // Rejects separators (/ \), '..', '.', percent-encoding, NUL, etc.
 const SEGMENT = /^[A-Za-z0-9._-]+$/;
+// Windows reserved device basenames (CON, NUL, COM1…). Case-insensitive and
+// matched on the name up to the first dot, so `nul` and `nul.ics` both hit.
+// On Windows `calendar/NUL.ics` resolves to the null device → the write
+// "succeeds" but the bytes vanish (silent reminder loss); `sessions/con`
+// throws a cryptic EINVAL. Reject the whole family loudly instead.
+const WIN_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i;
 export function safeSegment(raw, kind = 'segment') {
     if (typeof raw !== 'string' || raw.length === 0 || raw.length > 128) {
         throw new PathSafetyError(`invalid_${kind}`, `${kind} must be a 1-128 char string`);
@@ -19,6 +25,16 @@ export function safeSegment(raw, kind = 'segment') {
     if (raw === '.' || raw === '..' || !SEGMENT.test(raw)) {
         throw new PathSafetyError(`invalid_${kind}`, `${kind} must match [A-Za-z0-9._-] and not be '.'/'..'`);
     }
+    // A trailing dot or space is stripped by Windows at path-resolution time, so
+    // "build." and "build" alias to ONE directory → the second decision silently
+    // overwrites the first. assertInside can't catch it (the aliasing happens in
+    // the OS at write time, invisible to a lexical check). Reject it here.
+    if (/[. ]$/.test(raw)) {
+        throw new PathSafetyError(`invalid_${kind}`, `${kind} must not end with a '.' or space`);
+    }
+    if (WIN_RESERVED.test(raw)) {
+        throw new PathSafetyError(`invalid_${kind}`, `${kind} must not be a reserved device name (CON, NUL, COM1…)`);
+    }
     // Defense in depth: reject any percent-encoded or NUL byte that slipped the regex.
     if (raw.includes('\0') || /%2e/i.test(raw) || /%2f/i.test(raw) || /%5c/i.test(raw)) {
         throw new PathSafetyError(`invalid_${kind}`, `${kind} contains an encoded separator`);