daftari 1.21.0 → 1.23.0

package/dist/consolidate/envelope.js

@@ -0,0 +1,90 @@
+// The two-gate envelope (spec §5). PURE: callers assemble the context (I/O lives
+// in the CLI's makeAdmit, a later task). An action is admitted iff BOTH the
+// invariants gate AND the trust-budget gate pass. Gated actions surface (later
+// tasks); they do NOT spend (deduct-on-admit happens in the caller).
+// Actions A is allowed to take that do NOT delete (never-delete invariant).
+const NON_DELETING_ACTIONS = new Set([
+    "edge-observe",
+    "edge-contest",
+]);
+export function evaluateEnvelope(ctx, spent) {
+    // --- Invariants gate (first; §5.1) ---
+    //
+    // Precondition failures (malformed context, non-finite/negative numerics) are
+    // folded into the invariants gate because the correct behaviour is identical:
+    // refuse, never spend. A separate gate variant isn't worth rippling through the
+    // journal for inputs that are unreachable when metrics are computed normally.
+    // The reason string carries the specific signal for any journal reader.
+    // Precondition: callers must supply exactly 2 endpoints ([from, to]).
+    if (ctx.endpoints.length < 2) {
+        return {
+            admit: false,
+            gate: "invariants",
+            reason: `precondition: expected 2 endpoints (from, to), got ${ctx.endpoints.length}`,
+            impact: ctx.impact,
+        };
+    }
+    // Precondition: callers must supply finite, non-negative numeric values.
+    // NaN/Infinity would silently corrupt the budget comparison.
+    if (!Number.isFinite(ctx.impact) ||
+        !Number.isFinite(ctx.budget) ||
+        !Number.isFinite(spent) ||
+        ctx.impact < 0 ||
+        ctx.budget < 0 ||
+        spent < 0) {
+        return {
+            admit: false,
+            gate: "invariants",
+            reason: `precondition: non-finite or negative numeric input (impact/budget/spent)`,
+            impact: ctx.impact,
+        };
+    }
+    // never-delete (defensive assert).
+    if (!NON_DELETING_ACTIONS.has(ctx.action)) {
+        return {
+            admit: false,
+            gate: "invariants",
+            reason: `never-delete: action '${ctx.action}' is not permitted`,
+            impact: ctx.impact,
+        };
+    }
+    // Per-endpoint checks run in spec §5.1 priority order:
+    // 1. provenance-required  2. premise-freshness (decayBlocking)  3. tension-respect
+    for (const ep of ctx.endpoints) {
+        if (!ep.provenanceKnown) {
+            return {
+                admit: false,
+                gate: "invariants",
+                reason: `provenance-required: ${ep.path} has unknown/broken provenance`,
+                impact: ctx.impact,
+            };
+        }
+        if (ep.decayBlocking) {
+            return {
+                admit: false,
+                gate: "invariants",
+                reason: `premise-freshness: ${ep.path} is stale/deprecated`,
+                impact: ctx.impact,
+            };
+        }
+        if (ep.hasUnresolvedTension) {
+            return {
+                admit: false,
+                gate: "invariants",
+                reason: `tension-respect: ${ep.path} has an unresolved tension`,
+                impact: ctx.impact,
+            };
+        }
+    }
+    // --- Trust-budget gate (§5.2; strict > matches shadow.ts would_gate) ---
+    if (spent + ctx.impact > ctx.budget) {
+        return {
+            admit: false,
+            gate: "budget",
+            reason: `trust-budget exhausted: spent ${spent.toFixed(3)} + I ${ctx.impact.toFixed(3)} > B0 ${ctx.budget.toFixed(3)}`,
+            impact: ctx.impact,
+        };
+    }
+    return { admit: true, gate: null, reason: "admitted", impact: ctx.impact };
+}
+//# sourceMappingURL=envelope.js.map

package/dist/consolidate/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/consolidate/envelope.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,4EAA4E;AAC5E,+EAA+E;AAC/E,qEAAqE;AAIrE,4EAA4E;AAC5E,MAAM,oBAAoB,GAAoC,IAAI,GAAG,CAAC;IACpE,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAwCH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,KAAa;IAC9D,wCAAwC;IACxC,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,wEAAwE;IAExE,sEAAsE;IACtE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,sDAAsD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;YACpF,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,6DAA6D;IAC7D,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvB,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,GAAG,CAAC,MAAM,GAAG,CAAC;QACd,KAAK,GAAG,CAAC,EACT,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,0EAA0E;YAClF,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,yBAAyB,GAAG,CAAC,MAAM,oBAAoB;YAC/D,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC;IACD,uDAAuD;IACvD,mFAAmF;IACnF,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,wBAAwB,EAAE,CAAC,IAAI,gCAAgC;gBACvE,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC;YACrB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,sBAAsB,EAAE,CAAC,IAAI,sBAAsB;gBAC3D,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,oBAAoB,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,oBAAoB,EAAE,CAAC,IAAI,4BAA4B;gBAC/D,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,IAAI,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,iCAAiC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YACtH,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC7E,CAAC"}

package/dist/consolidate/index.d.ts

@@ -0,0 +1,2 @@
+export declare function runConsolidate(argv: string[]): Promise<number>;
+//# sourceMappingURL=index.d.ts.map

package/dist/consolidate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/consolidate/index.ts"],"names":[],"mappings":"AA2HA,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsSpE"}

package/dist/consolidate/index.js

@@ -0,0 +1,531 @@
+// `daftari consolidate` — the cortex consolidation loop entrypoint.
+//
+// Stage 1 (shipped): computes the edge due-queue + birth queue at session
+// start and prints them. No LLM, no writes.
+// Stage 2 (this PR): adds Component A. With `--mode=birth|revision|both`,
+// the LLM re-derives queue items and emits edge_observe/edge_contest. Under
+// `shadow_mode: true` the writes are journaled, not applied (calibration
+// posture, spec §11.5). The auto-write tier graduates in Stage 5.
+//
+// Default mode is `scan` (Stage 1 behavior): no LLM, no writes — backward
+// compatible. Stage 2 modes are explicit opt-in so an unsuspecting cron
+// invocation doesn't start spending money.
+//
+// Spec: docs/superpowers/specs/2026-06-13-cortex-consolidation-loop.md
+// Brief: docs/superpowers/drafts/2026-06-16-cortex-stage-2-component-a-brief.md
+import { existsSync } from "node:fs";
+import { posix, resolve } from "node:path";
+import { listEdges } from "../curation/edges.js";
+import { addTension, listTensions } from "../curation/tension.js";
+import { loadDocuments } from "../curation/vault-docs.js";
+import { createAnthropicClient } from "../eval/llm.js";
+import { err, ok } from "../frontmatter/types.js";
+import { vaultSearchRelated } from "../tools/search.js";
+import { loadConfig } from "../utils/config.js";
+import { changedSince, log as gitLog, isGitRepo } from "../utils/git.js";
+import { makeAdmit } from "./admit.js";
+import { appendBirthTrace, birthOne, } from "./birth.js";
+import { birthQueue, decayBackstopDue, eventDue } from "./clocks.js";
+import { CONSOLIDATE_AGENT, CONSOLIDATE_DEFAULT_BUDGET, CONSOLIDATE_DEFAULT_MODEL, CONSOLIDATE_PANEL_SIZE, estimateCostUSD, isModelPriced, } from "./constants.js";
+import { formatDecorrelationReport, loadFixture, runDecorrelation } from "./decorrelation.js";
+import { makeContest, makeObserve } from "./edge-write.js";
+import { prioritize } from "./priority.js";
+import { appendRevisionTrace, revisionPanel, } from "./revision.js";
+import { readConsolidateState, writeConsolidateState } from "./state.js";
+const HELP = `daftari consolidate — cortex loop scheduler + Component A (shadow-only).
+
+Usage:
+  daftari consolidate [--vault <path>] [--budget <n>] [--mode <m>]
+                      [--max-panels <n>] [--max-births <n>] [--model <id>]
+  daftari consolidate --report decorrelation --fixture <path> [--model <id>]
+
+Modes (--mode, default 'scan'):
+  scan      Stage 1: emit the edge due-queue + birth queue. No LLM, no writes.
+  birth     Stage 2: re-derive each unprocessed doc's top-K neighbors and
+            edge_observe the survivors as k=0 candidates. (Requires
+            ANTHROPIC_API_KEY.)
+  revision  Stage 2: cast an M-vote panel on each due edge, emit edge_observe
+            (survives) or edge_contest (fails) per vote.
+  both      birth then revision (the full pass).
+
+Stage 2 modes call the LLM and emit edge writes. Under shadow_mode:true those
+writes go to .daftari/shadow-actions.jsonl, not .daftari/edges.jsonl. With
+shadow_mode off, edge_observe/contest land for real — but Stage 2 ships with
+NO auto-write graduation, so even off-shadow only the auto-write tier from
+spec §4.2 lands (link / confidence-down / tension_log / contest revoke).
+
+What it does:
+  Computes three clocks (event / decay / backstop) over the derives_from edge
+  store + git history at session start, ranks the due work into four slices
+  under a compute budget, then (mode != scan) runs Component A on those
+  items. The trace files (.daftari/{birth,revision}-trace.jsonl) are the
+  decorrelation report's input (brief item 8).
+
+Reports:
+  --report decorrelation --fixture <path>
+    Run the shared foundational-ordering prompt against a ground-truth-labeled
+    fixture (brief item 8). Reports per-axis + majority accuracy, lift
+    (informational — the axes are identical under the deterministic prompt),
+    inter-axis agreement, error correlation. PASS/FAIL gates on ACCURACY: exits
+    6 if majority accuracy < CONSOLIDATE_DIRECTION_MIN_ACCURACY (the foundational
+    prompt did not recover direction well enough — fix the elicitation/fixture).
+    Requires ANTHROPIC_API_KEY. A real fixture lives at
+    tests/fixtures/decorrelation-fixture-v2.json.
+
+Exit codes:
+  0 — ran cleanly
+  2 — config error (no vault, bad flags, missing ANTHROPIC_API_KEY in LLM mode)
+  3 — runtime error (edge store / vault I/O)
+  4 — ran, but backstop-overdue work was left unserved (cron-alertable)
+  5 — ran, but one or more trace writes failed (recall-evaluation data lost)
+  6 — decorrelation report ran, accuracy below the gate (fix elicitation/fixture)
+  7 — ran, but the event-clock baseline was unreachable (gap skipped, re-baselined to HEAD)
+`;
+const MS_PER_DAY = 86_400_000;
+function flag(argv, name) {
+    const i = argv.indexOf(`--${name}`);
+    return i >= 0 && i + 1 < argv.length ? argv[i + 1] : undefined;
+}
+// Canonicalize a vault-relative path so the three joins (edge paths ↔ git-diff
+// paths ↔ loaded-doc paths) key consistently. The edge store stores caller
+// paths with only .trim() applied; an alias like `a/../a/x.md` or `./x.md`
+// could otherwise silently miss the byPremise/birth join.
+function canon(p) {
+    return posix.normalize(p).replace(/^\.\//, "");
+}
+const VALID_MODES = new Set(["scan", "birth", "revision", "both"]);
+export async function runConsolidate(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        process.stdout.write(HELP);
+        return 0;
+    }
+    // --report=decorrelation is an alternate entry point: no vault scan, no
+    // queue, no Component A — just runs the v1 axes against the fixture and
+    // emits the analysis. Branches early so the main consolidate flow stays
+    // unchanged.
+    const reportName = flag(argv, "report");
+    if (reportName === "decorrelation") {
+        return runDecorrelationReportCli(argv);
+    }
+    if (reportName !== undefined) {
+        process.stderr.write(`consolidate: --report must be 'decorrelation', got ${reportName}\n`);
+        return 2;
+    }
+    try {
+        const vaultRoot = resolve(flag(argv, "vault") ?? process.cwd());
+        if (!existsSync(vaultRoot)) {
+            process.stderr.write(`consolidate: no vault at ${vaultRoot}\n`);
+            return 2;
+        }
+        const budget = Number(flag(argv, "budget") ?? CONSOLIDATE_DEFAULT_BUDGET);
+        if (!Number.isFinite(budget) || budget <= 0) {
+            process.stderr.write("consolidate: --budget must be a number > 0\n");
+            return 2;
+        }
+        const modeStr = (flag(argv, "mode") ?? "scan").toLowerCase();
+        if (!VALID_MODES.has(modeStr)) {
+            process.stderr.write(`consolidate: --mode must be one of scan|birth|revision|both, got ${modeStr}\n`);
+            return 2;
+        }
+        const mode = modeStr;
+        const maxBirths = parseOptionalInt(flag(argv, "max-births"));
+        if (maxBirths.error) {
+            process.stderr.write(`consolidate: ${maxBirths.error}\n`);
+            return 2;
+        }
+        const maxPanels = parseOptionalInt(flag(argv, "max-panels"));
+        if (maxPanels.error) {
+            process.stderr.write(`consolidate: ${maxPanels.error}\n`);
+            return 2;
+        }
+        const model = flag(argv, "model") ?? CONSOLIDATE_DEFAULT_MODEL;
+        const now = new Date();
+        const state = readConsolidateState(vaultRoot);
+        const edgesRes = await listEdges(vaultRoot, {}, now);
+        if (!edgesRes.ok) {
+            process.stderr.write(`consolidate: ${edgesRes.error.message}\n`);
+            return 3;
+        }
+        const edges = edgesRes.value.map((e) => ({
+            ...e,
+            fromPath: canon(e.fromPath),
+            toPath: canon(e.toPath),
+        }));
+        const edgeByKey = new Map();
+        for (const e of edges)
+            edgeByKey.set(`${e.fromPath}\n${e.toPath}`, e);
+        const docsRes = await loadDocuments(vaultRoot);
+        if (!docsRes.ok) {
+            process.stderr.write(`consolidate: ${docsRes.error.message}\n`);
+            return 3;
+        }
+        const docs = docsRes.value.map((d) => ({ relPath: canon(d.path), content: d.content }));
+        const docByPath = new Map();
+        for (const d of docs)
+            docByPath.set(d.relPath, d);
+        const birthProcessed = {};
+        for (const [k, v] of Object.entries(state.birthProcessed))
+            birthProcessed[canon(k)] = v;
+        const inRepo = await isGitRepo(vaultRoot);
+        let eventEdges = [];
+        let staleBaseline = false;
+        if (state.lastConsolidationCommit && inRepo) {
+            const changed = await changedSince(vaultRoot, state.lastConsolidationCommit);
+            if (changed.ok)
+                eventEdges = eventDue(changed.value.map(canon), edges);
+            else {
+                // The stored baseline commit is unreachable (rebase / force-push / GC /
+                // re-clone). The event clock can't run for the gap — it re-baselines to
+                // HEAD below (the decay+backstop clock will still re-derive those edges
+                // within the cap), but the gap is NOT event-examined, so we surface a
+                // non-zero exit (7) rather than silently exit 0 as if all was covered.
+                staleBaseline = true;
+                process.stderr.write(`consolidate: stale baseline ${state.lastConsolidationCommit} — event clock skipped, ` +
+                    `re-baselining to HEAD (gap relies on the backstop clock; exit 7)\n`);
+            }
+        }
+        const decayEdges = decayBackstopDue(edges, now);
+        const birth = birthQueue(docs, birthProcessed);
+        const ages = {};
+        for (const e of edges) {
+            ages[e.fromPath] = (now.getTime() - new Date(e.lastRederived).getTime()) / MS_PER_DAY;
+        }
+        const { queue, backstopOverdueRemaining } = prioritize({
+            edgeDue: [...eventEdges, ...decayEdges],
+            birth,
+            budget,
+            ages,
+        });
+        const edgeItems = queue.filter((q) => q.kind === "edge");
+        const birthItems = queue.filter((q) => q.kind === "birth");
+        // --- report header (mode-independent) -------------------------------------
+        let report = `consolidate @ ${vaultRoot}\n`;
+        report += `  edges: ${edges.length} | docs: ${docs.length} | budget: ${budget} | mode: ${mode}\n`;
+        report += `  edge due-queue (${edgeItems.length}):\n`;
+        for (const q of edgeItems) {
+            if (q.kind === "edge")
+                report += `    [${q.slice}/${q.reason}] ${q.fromPath} ← ${q.toPath}\n`;
+        }
+        report += `  birth queue (${birthItems.length}):\n`;
+        for (const q of birthItems) {
+            if (q.kind === "birth")
+                report += `    [birth] ${q.path}\n`;
+        }
+        report += `  backstop-overdue remaining: ${backstopOverdueRemaining}\n`;
+        // --- Stage 2: Component A dispatch ---------------------------------------
+        const stage2 = emptyStage2();
+        if (mode !== "scan") {
+            const cfg = await loadConfig(vaultRoot);
+            if (!cfg.ok) {
+                process.stderr.write(`consolidate: ${cfg.error.message}\n`);
+                return 2;
+            }
+            // ANTHROPIC_API_KEY check before constructing the client — fail-fast with
+            // a clear message rather than the SDK's terse internal throw.
+            if (!process.env.ANTHROPIC_API_KEY) {
+                process.stderr.write("consolidate: ANTHROPIC_API_KEY env var is required for --mode != scan\n");
+                return 2;
+            }
+            let llm;
+            try {
+                llm = createAnthropicClient();
+            }
+            catch (e) {
+                process.stderr.write(`consolidate: ${e instanceof Error ? e.message : String(e)}\n`);
+                return 2;
+            }
+            stage2.shadowMode = cfg.value.shadowMode;
+            const observe = makeObserve({
+                vaultRoot,
+                shadowMode: cfg.value.shadowMode,
+            });
+            const contest = makeContest({
+                vaultRoot,
+                shadowMode: cfg.value.shadowMode,
+            });
+            // The real envelope-owned admit (Stage 3 Task 7): assembles the
+            // EnvelopeCtx from in-process data, owns the §3.7 per-session spend
+            // scalar (deduct-on-admit), and journals every decision. Construction
+            // does I/O (loadDocuments / staged actions / tensions) and can fail.
+            //
+            // FAIL CLOSED: if construction fails the envelope cannot evaluate the
+            // gate, so Component A MUST NOT run — letting birth/revision write
+            // ungated would be exactly the auto-write-on-incomplete-info the envelope
+            // exists to prevent. We surface the error and abort with a runtime exit.
+            // Reuse the docs index.ts already loaded above (docsRes.value) — makeAdmit
+            // derives its reverse maps / per-endpoint metadata / docCount from this
+            // same LoadedDoc[], so no second vault walk happens.
+            const admitRes = await makeAdmit({
+                vaultRoot,
+                principal: CONSOLIDATE_AGENT,
+                docs: docsRes.value,
+            });
+            if (!admitRes.ok) {
+                process.stderr.write(`consolidate: envelope init failed: ${admitRes.error.message} — Component A skipped (fail-closed)\n`);
+                return 3;
+            }
+            const admit = admitRes.value.admit;
+            if (mode === "birth" || mode === "both") {
+                const cap = maxBirths.value ?? Number.POSITIVE_INFINITY;
+                const birthOnly = birthItems
+                    .filter((q) => q.kind === "birth")
+                    .slice(0, Math.min(birthItems.length, cap));
+                await runBirthLoop(birthOnly, docByPath, admit, observe, llm, vaultRoot, model, stage2, birthProcessed);
+            }
+            if (mode === "revision" || mode === "both") {
+                const cap = maxPanels.value ?? Number.POSITIVE_INFINITY;
+                const edgeOnly = edgeItems
+                    .filter((q) => q.kind === "edge")
+                    .slice(0, Math.min(edgeItems.length, cap));
+                await runRevisionLoop(edgeOnly, edgeByKey, docByPath, admit, observe, contest, llm, vaultRoot, model, stage2);
+            }
+            // Surface journal-write failures the admit closure counted across the loops.
+            // A failed journal write loses a calibration row but does not change any gate
+            // verdict (mirrors traceWriteFailures — counted, not thrown).
+            stage2.journalWriteFailures = admitRes.value.journalFailures();
+            report += `  Component A (${mode}):\n`;
+            report += `    births_processed: ${stage2.birthsProcessed}\n`;
+            report += `    panels_cast: ${stage2.panelsCast} | votes_cast: ${stage2.votesCast}\n`;
+            report += `    observed: ${stage2.observedTotal} | contested: ${stage2.contestedTotal} | gated: ${stage2.gated}\n`;
+            report += `    llm_calls: ${stage2.llmCalls} | tokens: ${stage2.inputTokens}/${stage2.outputTokens} in/out\n`;
+            report += `    est_cost_usd: ${estimateCostUSD(model, stage2.inputTokens, stage2.outputTokens).toFixed(4)} (${model})${isModelPriced(model) ? "" : " [pricing_fallback: haiku — model unpriced]"}\n`;
+            if (stage2.traceWriteFailures > 0) {
+                report += `    trace_write_failures: ${stage2.traceWriteFailures} — recall@K evaluator input lost (exit 5)\n`;
+            }
+            if (stage2.journalWriteFailures > 0) {
+                report += `    journal_write_failures: ${stage2.journalWriteFailures} — calibration rows lost\n`;
+            }
+            // The envelope journals every decision (admit/gate) to shadow-actions.jsonl
+            // regardless of shadow mode (makeAdmit owns this). In shadow mode the edge
+            // STORE write is additionally suppressed (makeObserve); off-shadow, admitted
+            // edges also land in edges.jsonl.
+            if (stage2.shadowMode) {
+                report += `    shadow_mode: true — envelope decisions journaled to shadow-actions.jsonl, edge store untouched\n`;
+            }
+            else {
+                report += `    shadow_mode: false — envelope decisions journaled to shadow-actions.jsonl; admitted edges also written to the store\n`;
+            }
+        }
+        process.stdout.write(report);
+        // --- persist state -------------------------------------------------------
+        // Always persist birthProcessed (Stage 2 progress is independent of git).
+        // Only advance the event-clock baseline (lastConsolidationCommit) when we
+        // have a HEAD; in a non-git dir we keep the prior value (likely null) so
+        // the event clock stays in the nil-path on every run.
+        let newCommit = state.lastConsolidationCommit;
+        if (inRepo) {
+            const head = await gitLog(vaultRoot, { limit: 1 });
+            if (head.ok && head.value[0])
+                newCommit = head.value[0].hash;
+        }
+        const wrote = writeConsolidateState(vaultRoot, {
+            ...state,
+            lastConsolidationCommit: newCommit,
+            birthProcessed,
+        });
+        if (!wrote.ok)
+            process.stderr.write(`consolidate: ${wrote.error.message}\n`);
+        // --- exit code hierarchy --------------------------------------------------
+        // 5 (trace lost) > 4 (backstop unserved) > 7 (event-clock baseline lost) > 0.
+        // Trace loss silently corrupts the calibration data flow (most serious);
+        // backstop-overdue and a lost baseline are cron-alertable warnings the next
+        // session / a human can resolve.
+        //
+        // journalWriteFailures is deliberately NOT in this hierarchy: a lost
+        // calibration (shadow-actions) row never changes a gate verdict and is
+        // already surfaced in the report above. It is reported-only by design, not
+        // forgotten — the exit code is reserved for the data flows a human/cron must
+        // act on.
+        if (stage2.traceWriteFailures > 0)
+            return 5;
+        if (backstopOverdueRemaining > 0)
+            return 4;
+        return staleBaseline ? 7 : 0;
+    }
+    catch (e) {
+        process.stderr.write(`${e instanceof Error ? e.message : String(e)}\n`);
+        return 2;
+    }
+}
+// --- helpers -----------------------------------------------------------------
+function parseOptionalInt(raw) {
+    if (raw === undefined)
+        return { value: null };
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < 0 || !Number.isInteger(n)) {
+        return { value: null, error: `expected a non-negative integer, got ${JSON.stringify(raw)}` };
+    }
+    return { value: n };
+}
+function emptyStage2() {
+    return {
+        birthsProcessed: 0,
+        panelsCast: 0,
+        votesCast: 0,
+        observedTotal: 0,
+        contestedTotal: 0,
+        gated: 0,
+        llmCalls: 0,
+        inputTokens: 0,
+        outputTokens: 0,
+        traceWriteFailures: 0,
+        journalWriteFailures: 0,
+        shadowMode: false,
+    };
+}
+async function runBirthLoop(birthItems, docByPath, admit, observe, llm, vaultRoot, model, stage2, birthProcessed) {
+    const searchNeighbors = async (docPath, k) => {
+        const r = await vaultSearchRelated(vaultRoot, { path: docPath, limit: k });
+        if (!r.ok)
+            return r;
+        return ok(r.value.hits.map((h) => h.path));
+    };
+    // Neighbor content is already in process (the docs map) — no disk read.
+    const loadNeighborContent = async (path) => {
+        const d = docByPath.get(canon(path));
+        return d ? ok(d.content) : err(new Error(`neighbor not in docs map: ${path}`));
+    };
+    // Direction-pending tensions are authored under the loop principal. Dedup on
+    // the canonical title (mirrors vaultEdgeContest): a doc re-births on every
+    // edit, so without this an unresolved direction-pending pair would re-append
+    // an identical tension on each re-birth and flood the advisory log.
+    const recordTension = async (input) => {
+        const existing = await listTensions(vaultRoot);
+        if (existing.ok && existing.value.some((t) => t.title === input.title && !t.resolved)) {
+            return ok(undefined); // already open for this pair — don't stack a duplicate
+        }
+        return addTension(vaultRoot, input);
+    };
+    const recordBirthTrace = (row) => appendBirthTrace(vaultRoot, row);
+    const opts = {
+        vaultRoot,
+        agent: CONSOLIDATE_AGENT,
+        axis: "forward",
+        budgetRemaining: Number.POSITIVE_INFINITY,
+        model,
+    };
+    for (const item of birthItems) {
+        const docPath = canon(item.path);
+        const doc = docByPath.get(docPath);
+        if (!doc)
+            continue; // queue → docs is reconstructible; a missing doc is non-fatal
+        const out = await birthOne(doc, {
+            llm,
+            searchNeighbors,
+            loadNeighborContent,
+            admit,
+            observe,
+            recordTension,
+            recordBirthTrace,
+        }, opts);
+        if (!out.ok) {
+            process.stderr.write(`consolidate: birth failed for ${docPath}: ${out.error.message}\n`);
+            continue;
+        }
+        accumulateBirth(stage2, out.value);
+        // Only mark the doc processed if its trace landed. A failed trace write
+        // (exit 5) must NOT be permanent: birthProcessed is keyed on content-hash, so
+        // marking it here would stop the doc ever re-birthing and the recall@K trace
+        // row — the whole reason birth mode exists — would be lost unrecoverably.
+        if (out.value.traceWritten)
+            birthProcessed[docPath] = out.value.contentHash;
+    }
+}
+function accumulateBirth(stage2, out) {
+    stage2.birthsProcessed++;
+    stage2.observedTotal += out.observations.length;
+    stage2.gated += out.gatedCount;
+    stage2.llmCalls += out.llmCalls;
+    stage2.inputTokens += out.inputTokens;
+    stage2.outputTokens += out.outputTokens;
+    if (!out.traceWritten)
+        stage2.traceWriteFailures++;
+}
+async function runRevisionLoop(edgeItems, edgeByKey, docByPath, admit, observe, contest, llm, vaultRoot, model, stage2) {
+    const loadDoc = async (path) => {
+        const d = docByPath.get(canon(path));
+        if (!d) {
+            return { ok: false, error: new Error(`doc not in load set: ${path}`) };
+        }
+        return ok({ path: d.relPath, content: d.content });
+    };
+    const recordRevisionTrace = (row) => appendRevisionTrace(vaultRoot, row);
+    const opts = {
+        vaultRoot,
+        agent: CONSOLIDATE_AGENT,
+        panelSize: CONSOLIDATE_PANEL_SIZE,
+        budgetRemaining: Number.POSITIVE_INFINITY,
+        model,
+    };
+    for (const item of edgeItems) {
+        const key = `${canon(item.fromPath)}\n${canon(item.toPath)}`;
+        const edge = edgeByKey.get(key);
+        if (!edge)
+            continue;
+        // Defensive: the clocks already exclude direction-symmetric edges from the
+        // due-list, but the revision panel votes on a FIXED from→to direction and
+        // has no symmetric guard of its own. Keep the invariant next to the consumer
+        // so a future due-path (e.g. the deferred TTL clock) can't feed a pending
+        // edge into a directional verdict.
+        if (edge.directionVerdict === "symmetric")
+            continue;
+        const out = await revisionPanel(edge, { llm, loadDoc, admit, observe, contest, recordRevisionTrace }, opts);
+        if (!out.ok) {
+            process.stderr.write(`consolidate: revision failed for ${key.replace("\n", "←")}: ${out.error.message}\n`);
+            continue;
+        }
+        accumulateRevision(stage2, out.value);
+    }
+}
+function accumulateRevision(stage2, out) {
+    stage2.panelsCast++;
+    stage2.votesCast += out.votes.length;
+    stage2.observedTotal += out.observedCount;
+    stage2.contestedTotal += out.contestedCount;
+    if (out.decision === "gated")
+        stage2.gated++;
+    stage2.llmCalls += out.llmCalls;
+    stage2.inputTokens += out.inputTokens;
+    stage2.outputTokens += out.outputTokens;
+    if (!out.traceWritten)
+        stage2.traceWriteFailures++;
+}
+// --- --report=decorrelation ---------------------------------------------------
+async function runDecorrelationReportCli(argv) {
+    const fixturePath = flag(argv, "fixture");
+    if (!fixturePath) {
+        process.stderr.write("consolidate --report decorrelation: --fixture <path> is required\n");
+        return 2;
+    }
+    if (!process.env.ANTHROPIC_API_KEY) {
+        process.stderr.write("consolidate --report decorrelation: ANTHROPIC_API_KEY env var is required\n");
+        return 2;
+    }
+    const fixtureRes = loadFixture(fixturePath);
+    if (!fixtureRes.ok) {
+        process.stderr.write(`consolidate: ${fixtureRes.error.message}\n`);
+        return 2;
+    }
+    if (fixtureRes.value.edges.length === 0) {
+        process.stderr.write("consolidate: fixture is empty\n");
+        return 2;
+    }
+    let llm;
+    try {
+        llm = createAnthropicClient();
+    }
+    catch (e) {
+        process.stderr.write(`consolidate: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 2;
+    }
+    const model = flag(argv, "model") ?? CONSOLIDATE_DEFAULT_MODEL;
+    const reportRes = await runDecorrelation(fixtureRes.value, { llm }, { model, fixtureSource: fixturePath });
+    if (!reportRes.ok) {
+        process.stderr.write(`consolidate: ${reportRes.error.message}\n`);
+        return 3;
+    }
+    process.stdout.write(formatDecorrelationReport(reportRes.value));
+    // Kill condition fires → exit 6 so CI / a calibration wrapper can branch.
+    return reportRes.value.passes ? 0 : 6;
+}
+//# sourceMappingURL=index.js.map