fdeops 3.10.2 → 3.11.0

package/bin/fde.js

@@ -26,6 +26,7 @@
  *   fde preserve            pre-compaction context snapshot (hook-internal; hooks use this)
  *   fde status [--all]      current engagement (default) or full portfolio (--all)
  *   fde dashboard [--all]   current engagement fieldbook (default) or all (--all)
+ *   fde vault               derived Obsidian vault of the fieldbook (disposable; --redacted)
  */
 const fs = require('fs')
 const path = require('path')
@@ -33,6 +34,7 @@ const os = require('os')
 const { execSync, execFileSync } = require('child_process')
 const { createMemoryApi } = require('./lib/memory')
 const { createTrustApi } = require('./lib/trust')
+const vault = require('./lib/vault')
 
 const HOME = os.homedir()
 // FDEOPS_ENGAGEMENTS_ROOT isolates init/status/dashboard (and the registry) for
@@ -94,13 +96,35 @@ function grepFiles(files, regex, cap) {
 
 // ---------- engagement resolution (zero-ceremony order) ----------
 
+// Registry lines are "<absolute workspace path> <slug>". A hand-edited or
+// truncated file used to parse into nonsense bindings (a line with no space
+// yielded a workspace missing its last character), so every binding a workspace
+// could match on silently disappeared behind "NO ENGAGEMENT". Skip what cannot
+// be a binding and say so once.
+let registryWarned = false
 function readRegistry() {
-  try {
-    return fs.readFileSync(REGISTRY, 'utf8').split('\n').filter(Boolean).map(l => {
-      const i = l.lastIndexOf(' ')
-      return { workspace: l.slice(0, i), slug: l.slice(i + 1) }
-    })
-  } catch (_) { return [] }
+  let raw
+  // Regular files only: a fifo here blocked `fde resume --init` on open.
+  try { if (!fs.lstatSync(REGISTRY).isFile()) return [] } catch (_) { return [] }
+  try { raw = fs.readFileSync(REGISTRY, 'utf8') } catch (_) { return [] }
+  const entries = []
+  let skipped = 0
+  for (const line of raw.split('\n')) {
+    if (!line.trim()) continue
+    const i = line.lastIndexOf(' ')
+    const workspace = i > 0 ? line.slice(0, i) : ''
+    const slug = i > 0 ? line.slice(i + 1).trim() : ''
+    if (!workspace || !slug || !path.isAbsolute(workspace)) { skipped++; continue }
+    entries.push({ workspace, slug })
+  }
+  if (skipped && !registryWarned) {
+    registryWarned = true
+    process.stderr.write(
+      `⚠ ${skipped} unreadable line(s) in ${REGISTRY} ignored - expected "<workspace path> <slug>" per line.\n` +
+      '  re-bind this workspace with: fde resume --init <name>\n'
+    )
+  }
+  return entries
 }
 
 function resolveEngagement(opts = {}) {
@@ -109,11 +133,72 @@ function resolveEngagement(opts = {}) {
   // read-only convenience; writing on a folder-name guess contaminates clients.
   const forWrite = !!opts.forWrite
   const accept = (p) => acceptEngagementPath(p, { forWrite })
-  // 1) explicit env (back-compat: accept old FDEOS_ENGAGEMENT too)
-  const env = (process.env.FDEOPS_ENGAGEMENT || process.env.FDEOS_ENGAGEMENT || '').replace(/^~/, HOME).trim()
+  // 1) explicit env (back-compat: accept old FDEOS_ENGAGEMENT too). An override
+  // that cannot be honored is never silently ignored: falling through to the
+  // registry would route this client's note into whichever engagement the
+  // workspace happens to be bound to. A bare slug is accepted too - it is what
+  // an FDE types - but only when it resolves under the engagements root.
+  const envRaw = process.env.FDEOPS_ENGAGEMENT || process.env.FDEOS_ENGAGEMENT || ''
+  const env = envRaw.replace(/^~/, HOME).trim()
+  // A value that is all whitespace is a variable someone meant to set - usually
+  // an empty expansion. Treating it as unset filed the note under whichever
+  // engagement the workspace was bound to, silently.
+  if (!env && envRaw) {
+    process.stderr.write(
+      'FDEOPS_ENGAGEMENT is set to whitespace - that names no engagement.\n' +
+      '  set it to an engagement, or unset it to use this workspace\'s binding.\n'
+    )
+    return null
+  }
   if (env) {
-    const ok = accept(env)
-    if (ok) return ok
+    // A relative value resolves against whatever directory the agent happened
+    // to start in - `FDEOPS_ENGAGEMENT=..` accepted the parent folder and put
+    // memory there. Absolute path, ~ path, or bare slug; nothing in between.
+    const looksLikePath = env.includes(path.sep) || env.includes('/') || env.startsWith('.')
+    if (looksLikePath && !path.isAbsolute(env)) {
+      process.stderr.write(
+        `FDEOPS_ENGAGEMENT must be an absolute path or a bare engagement slug - got "${env}".\n` +
+        `  e.g. ${path.join(ENGAGEMENTS_ROOT, '<client>', '.fde')}  or just <client>\n`
+      )
+      return null
+    }
+    if (looksLikePath) {
+      // Pointing at the engagement folder instead of its .fde used to create a
+      // second, git-less memory beside the real one - same client, split record.
+      const nested = accept(path.join(env, '.fde'))
+      if (nested) return nested
+      const ok = accept(env)
+      if (ok) return ok
+    } else {
+      // slugify() falls back to the literal "engagement" for a value with no
+      // slug characters at all ("???"), which used to resolve onto a real
+      // engagement nobody named. A name that slugifies to nothing names nothing.
+      if (!/[a-z0-9]/i.test(env)) {
+        process.stderr.write(
+          `FDEOPS_ENGAGEMENT is set to "${env}", which is not an engagement name.\n` +
+          '  refusing to guess - fix or unset the variable.\n' +
+          '  list what exists: fde status --all\n'
+        )
+        return null
+      }
+      const slugDir = path.join(ENGAGEMENTS_ROOT, slugify(env), '.fde')
+      const asSlug = accept(slugDir)
+      if (asSlug) return asSlug
+      process.stderr.write(
+        `FDEOPS_ENGAGEMENT is set to "${env}" but no engagement memory is there.\n` +
+        `  looked at: ${slugDir}\n` +
+        '  refusing to fall back to another engagement - fix or unset the variable.\n' +
+        '  list what exists: fde status --all\n'
+      )
+      return null
+    }
+    process.stderr.write(
+      `FDEOPS_ENGAGEMENT is set to "${env}" but no engagement memory is there.\n` +
+      `  looked at: ${env}\n` +
+      '  refusing to fall back to another engagement - fix or unset the variable.\n' +
+      '  list what exists: fde status --all\n'
+    )
+    return null
   }
   // 2) workspace registry binding (written by resume --init). Match the cwd OR
   // any ancestor of it - FDEs run commands from src/, packages/api/, etc., not
@@ -195,8 +280,12 @@ function templatesDir() {
 
 // ---------- shared engagement signals (one source of truth) ----------
 
+// Regular files only: a fifo left in a memory slot used to block the whole CLI
+// on open (doctor/resume/triage hung forever), and a directory threw EISDIR.
 function readEng(eng, f) {
-  try { return fs.readFileSync(path.join(eng, f), 'utf8') } catch (_) { return '' }
+  const abs = path.join(eng, f)
+  try { if (!fs.lstatSync(abs).isFile()) return '' } catch (_) { return '' }
+  try { return fs.readFileSync(abs, 'utf8') } catch (_) { return '' }
 }
 
 // Redact private notes and template hints from every model-facing read.
@@ -375,13 +464,17 @@ function failFs(err, action, target) {
   process.exit(1)
 }
 
-// Refuse writes that would follow a symlink out of the engagement tree.
-// Missing path is fine (new file). Soft mode returns the message instead of exiting
-// (session capture must never crash a hook).
+// Refuse writes that would follow a symlink out of the engagement tree, or
+// block forever on something that is not a file (a fifo in a memory slot hung
+// every append). Missing path is fine (new file). Soft mode returns the message
+// instead of exiting (session capture must never crash a hook).
 function refuseSymlinkWrite(p, opts = {}) {
   try {
-    if (fs.lstatSync(p).isSymbolicLink()) {
-      const msg = `refused: ${path.basename(p)} is a symlink - write would leave the engagement tree. Replace it with a real file.`
+    const st = fs.lstatSync(p)
+    if (st.isSymbolicLink() || !st.isFile()) {
+      const msg = st.isSymbolicLink()
+        ? `refused: ${path.basename(p)} is a symlink - write would leave the engagement tree. Replace it with a real file.`
+        : `refused: ${path.basename(p)} is not a regular file - remove it and re-run; every write is refused while it is there.`
       if (opts.soft) return msg
       console.error(msg)
       process.exit(1)
@@ -430,7 +523,7 @@ function withFileLock(targetPath, fn, opts = {}) {
 function atomicWriteFile(p, content, opts = {}) {
   const blocked = refuseSymlinkWrite(p, opts)
   if (blocked) {
-    if (opts.soft) throw Object.assign(new Error(blocked), { code: 'ESYMLINK' })
+    if (opts.soft) throw Object.assign(new Error(blocked), { code: blocked.includes('symlink') ? 'ESYMLINK' : 'EIRREGULAR' })
     return
   }
   const tmp = `${p}.${process.pid}.${Date.now()}.tmp`
@@ -450,7 +543,7 @@ function atomicWriteFile(p, content, opts = {}) {
 function lockedAppendFile(p, text, opts = {}) {
   const blocked = refuseSymlinkWrite(p, opts)
   if (blocked) {
-    if (opts.soft) throw Object.assign(new Error(blocked), { code: 'ESYMLINK' })
+    if (opts.soft) throw Object.assign(new Error(blocked), { code: blocked.includes('symlink') ? 'ESYMLINK' : 'EIRREGULAR' })
     return
   }
   try {
@@ -1083,7 +1176,23 @@ function cmdResume(args) {
     const prev = readRegistry().find(r => r.workspace === cwd)
     const kept = readRegistry().filter(r => r.workspace !== cwd).map(r => `${r.workspace} ${r.slug}`)
     kept.push(`${cwd} ${slug}`)
-    withFileLock(REGISTRY, () => { atomicWriteFile(REGISTRY, kept.join('\n') + '\n') })
+    let bindErr = null
+    // soft: an unwritable registry must not process.exit() from inside the lock -
+    // that skipped the finally and left a stale .registry.lock behind.
+    try {
+      withFileLock(REGISTRY, () => { atomicWriteFile(REGISTRY, kept.join('\n') + '\n', { soft: true }) }, { soft: true })
+    } catch (e) { bindErr = e }
+    if (bindErr || !readRegistry().some(r => r.workspace === cwd && r.slug === slug)) {
+      // Silently unbound is the worst outcome: the memory exists, every later
+      // command says NO ENGAGEMENT, and nothing said why.
+      console.log(`ENGAGEMENT READY: ${fdeDir}`)
+      process.stderr.write(
+        `could not bind this workspace - ${REGISTRY} is not writable${bindErr ? ` (${bindErr.code || bindErr.message})` : ''}.\n` +
+        `  fix the file (it must be a regular file), or work with: export FDEOPS_ENGAGEMENT=${fdeDir}\n`
+      )
+      try { fs.unlinkSync(REGISTRY + '.lock') } catch (_) {}
+      process.exit(1)
+    }
     console.log(`ENGAGEMENT READY: ${fdeDir}\nbound to workspace: ${cwd}`)
     if (prev && prev.slug !== slug) console.log(`rebound: this workspace previously wrote to "${prev.slug}" - that memory is untouched; sessions here now write to "${slug}"`)
     // NDA surface: engagement notes must not silently leave the machine via file sync
@@ -1856,7 +1965,7 @@ function cmdPreserve() {
     ensureMemoryGit(eng)
     const contextPath = path.join(eng, 'context.md')
     const blocked = refuseSymlinkWrite(contextPath, { soft: true })
-    if (blocked) throw Object.assign(new Error(blocked), { code: 'ESYMLINK' })
+    if (blocked) throw Object.assign(new Error(blocked), { code: blocked.includes('symlink') ? 'ESYMLINK' : 'EIRREGULAR' })
     withFileLock(contextPath, () => {
       const context = readEng(eng, 'context.md')
       const preservedToday = context.split('\n')
@@ -1956,15 +2065,28 @@ function findDuplicateOpenRisks(eng) {
 function collectDoctorIssues(eng) {
   const issues = []
   const s = computeSignals(eng)
-  const datedBlob = [
+  // stripTemplateNoise: a dated example inside a template comment is not work.
+  const datedBlob = stripTemplateNoise([
     readEng(eng, 'decisions.md'), readEng(eng, 'delivery.md'),
     readEng(eng, 'risks.md'), readEng(eng, 'stakeholders.md'),
-  ].join('\n')
+  ].join('\n'))
   const hasDatedWork = /\[\d{4}-\d{2}-\d{2}\]/.test(datedBlob)
   // Day-1 empty templates are not hygiene failures - nagging there trains people to ignore doctor.
   const fresh = !hasDatedWork && (s.phase === '?' || s.phase === 'unset') && !s.openRisks
 
   if (s.memoryWarn) issues.push(s.memoryWarn)
+  // A memory file that is not a regular file (a stray directory, a socket)
+  // reads as empty and rejects every append - doctor used to call that healthy.
+  for (const f of Object.values(LOG_FILES).concat('context.md')) {
+    const abs = path.join(eng, f)
+    let st
+    try { st = fs.lstatSync(abs) } catch (_) { continue }
+    if (st.isSymbolicLink()) {
+      issues.push(`${f} is a symlink - writes are refused; replace it with a real file inside .fde/`)
+    } else if (!st.isFile()) {
+      issues.push(`${f} is not a regular file - reads come back empty and every write fails; remove it and re-run any fde write`)
+    }
+  }
   if (fresh) return issues
 
   if (s.phase === '?' || s.phase === 'unset') {
@@ -2130,6 +2252,15 @@ function stripTemplateNoise(md) {
     .replace(/\*\([^)]*\)\*/g, '')
 }
 
+// Drop "**Label:** allowed · values" guidance lines. A receipt is a dated line or a
+// table row - never a bold label - so template prose that *documents* a receipt must
+// not satisfy the gate requiring one. hasOperatingMapContent already skips these.
+function stripLegendLines(md) {
+  return String(md || '').split('\n')
+    .filter(l => !/^\s*\*\*[^*]+:\*\*/.test(l))
+    .join('\n')
+}
+
 const VALUE_BUCKET_RE = /(cost[- ]?save|risk[- ]?mitigat|revenue[- ]?uplift)/i
 
 function hasValueBucket(eng) {
@@ -2138,7 +2269,7 @@ function hasValueBucket(eng) {
   if (bucketLine && VALUE_BUCKET_RE.test(bucketLine[1].trim())) return true
   if (!/\*\*Primary value bucket:\*\*/i.test(success) && VALUE_BUCKET_RE.test(success)) return true
 
-  const ledger = stripTemplateNoise(sectionBody(readClean(eng, 'delivery.md'), 'Value ledger') || '')
+  const ledger = stripLegendLines(stripTemplateNoise(sectionBody(readClean(eng, 'delivery.md'), 'Value ledger') || ''))
   const table = parseMdTable(ledger)
   if (table) {
     const bIdx = colIndex(table.headers, /bucket/i)
@@ -2203,7 +2334,7 @@ function hasEvalReceipt(eng) {
     if (/\bLast run:\s*\d{4}-\d{2}-\d{2}/i.test(e)) return true
     if (/\|\s*G\d+\s*\|[^|\n]+\|[^|\n]+\|[^|\n]+\|[^|\n]+\|\s*pass\s*\|/i.test(e)) return true
   }
-  const del = stripTemplateNoise(readClean(eng, 'delivery.md'))
+  const del = stripLegendLines(stripTemplateNoise(readClean(eng, 'delivery.md')))
   if (/#{1,6}\s+Eval\b/i.test(del) && /\b(pass|SHIP|\d+\/\d+)\b/i.test(sectionBody(del, 'Eval') || del)) return true
   if (/\beval (pack|receipt)[:\s].*\b(pass|SHIP)\b/i.test(del)) return true
   const receipts = sectionBody(del, 'Ship receipts') || ''
@@ -2671,6 +2802,190 @@ function cmdDashboard(args) {
   }
 }
 
+// ---------- vault (a window onto the fieldbook, not a second copy of it) ----------
+// Obsidian skips any path starting with "." - so ~/fde-engagements as a vault shows
+// nothing, because every client's record lives inside .fde/. The answer is a derived
+// vault: generated from .fde/, rebuilt from scratch each run, gitignored, never read
+// back. That is also where redaction belongs (`--redacted` for a shared screen).
+
+// Stamped into the vault so a stale folder is identifiable. Best-effort: a
+// missing package.json must not stop an FDE generating their vault.
+function cliVersion() {
+  try {
+    return String(JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version || '')
+  } catch (_) { return '' }
+}
+
+function valueLedgerRows(eng) {
+  const ledger = stripTemplateNoise(sectionBody(readClean(eng, 'delivery.md'), 'Value ledger') || '')
+  const table = parseMdTable(ledger)
+  if (!table) return []
+  const sIdx = colIndex(table.headers, /slice/i)
+  const pIdx = colIndex(table.headers, /promis/i)
+  const aIdx = colIndex(table.headers, /accept/i)
+  const rows = []
+  for (const row of table.rows) {
+    const slice = sIdx === -1 ? '' : String(row[sIdx] || '').trim()
+    const promised = pIdx === -1 ? '' : String(row[pIdx] || '').trim()
+    if (!slice && !promised) continue
+    const acceptedRaw = aIdx === -1 ? '' : String(row[aIdx] || '').trim()
+    rows.push({
+      slice, promised,
+      acceptedBy: !acceptedRaw || PENDING_CELL_RE.test(acceptedRaw) ? '' : acceptedRaw,
+    })
+  }
+  return rows
+}
+
+function isInside(child, parent) {
+  const rel = path.relative(parent, child)
+  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel))
+}
+
+// Containment must be judged on the real path: a symlinked parent
+// (ln -s ~/fde-engagements /tmp/l; --out /tmp/l/vault) resolves textually to
+// somewhere harmless while writing inside the engagements root. The vault target
+// usually does not exist yet, so resolve the deepest ancestor that does.
+function realPathish(p) {
+  let cur = p
+  const tail = []
+  for (let i = 0; i < 64; i++) {
+    try {
+      return path.join(fs.realpathSync(cur), ...tail)
+    } catch (e) {
+      if (e.code !== 'ENOENT' && e.code !== 'ENOTDIR') return p
+      const parent = path.dirname(cur)
+      if (parent === cur) return p
+      tail.unshift(path.basename(cur))
+      cur = parent
+    }
+  }
+  return p
+}
+
+// `fde vault` deletes its output directory before rebuilding, so the only
+// acceptable targets are a fresh path or a folder this command wrote before
+// (proved by its stamp file). Never the engagements root, never $HOME.
+function resolveVaultOut(args, redacted) {
+  const outIdx = args.indexOf('--out')
+  const raw = outIdx !== -1 ? String(args[outIdx + 1] || '').trim() : ''
+  if (outIdx !== -1 && !raw) {
+    console.error('--out needs a directory path')
+    process.exit(1)
+  }
+  const out = raw
+    ? path.resolve(raw.replace(/^~(?=$|\/)/, HOME))
+    : path.join(HOME, redacted ? 'fde-vault-redacted' : 'fde-vault')
+
+  const refuse = (why) => {
+    console.error(`refused: will not build the vault at ${out} - ${why}`)
+    process.exit(1)
+  }
+  // The symlink check reads the path as given; every containment check reads it
+  // resolved, so a link cannot smuggle the target past them.
+  try {
+    if (fs.lstatSync(out).isSymbolicLink()) {
+      refuse('it is a symlink - a rebuild would delete whatever it points at')
+    }
+  } catch (e) {
+    if (e.code !== 'ENOENT') failFs(e, 'check', out)
+  }
+  const canon = realPathish(out)
+  const engRoot = realPathish(ENGAGEMENTS_ROOT)
+  const realHome = realPathish(HOME)
+  for (const p of new Set([out, canon])) {
+    if (p === path.parse(p).root) refuse('that is the filesystem root')
+    if (p === HOME || p === realHome) refuse('the vault directory is deleted and rebuilt on every run')
+    if (p.split(path.sep).includes('.fde')) refuse('that is inside a fieldbook; .fde/ is the source of truth')
+    for (const root of new Set([ENGAGEMENTS_ROOT, engRoot])) {
+      if (isInside(p, root) || isInside(root, p)) refuse('it would contain or sit inside your engagements root')
+    }
+  }
+  try {
+    const st = fs.lstatSync(out)
+    if (!st.isDirectory()) refuse('it exists and is not a directory')
+    const entries = fs.readdirSync(out)
+    if (entries.length && !entries.includes(vault.STAMP)) {
+      refuse(`it already holds files fde vault did not write (no ${vault.STAMP}). Pick an empty path with --out`)
+    }
+  } catch (e) {
+    if (e.code !== 'ENOENT') failFs(e, 'check', out)
+  }
+  return out
+}
+
+function cmdVault(args) {
+  const redacted = args.includes('--redacted')
+  const all = !args.includes('--current')
+  const out = resolveVaultOut(args, redacted)
+
+  let engagements
+  if (all) {
+    engagements = gatherEngagements()
+  } else {
+    const eng = resolveEngagement()
+    if (!eng) {
+      console.error('no engagement bound to this workspace.\nrun: fde resume --init <name>   or   fde vault')
+      process.exit(2)
+    }
+    engagements = gatherEngagements({ only: eng })
+  }
+
+  const SECTION_FILES = ['decisions', 'risks', 'delivery', 'stakeholders', 'terrain', 'success', 'trust-profile']
+  const ALWAYS = new Set(['decisions', 'risks', 'delivery'])
+  engagements.forEach(e => {
+    const ctx = readClean(e.dir, 'context.md')
+    e.next = (sectionBody(ctx, 'Next action', { lastNonEmpty: true }).split('\n').find(l => l.trim()) || '').trim()
+    e.brief = firstLine(readClean(e.dir, 'brief.md'), 400)
+    e.reality = firstLine(readClean(e.dir, 'reality.md'), 400)
+    e.overlay = detectOverlay(e.dir)
+    e.days = daysElapsed(e.dir)
+    e.stakeholders = extractStakeholders(e.dir)
+    e.log = extractLog(e.dir)
+    e.valueRows = valueLedgerRows(e.dir)
+    e.pages = {}
+    for (const f of SECTION_FILES) {
+      if (!fs.existsSync(path.join(e.dir, `${f}.md`))) continue
+      // stripTemplateNoise: the instruction comments are for whoever writes the
+      // fieldbook, not for whoever reads it in Obsidian.
+      const body = stripTemplateNoise(readClean(e.dir, `${f}.md`))
+      if (!ALWAYS.has(f) && !render.hasRealContent(body)) continue
+      e.pages[f] = body
+    }
+  })
+
+  const files = vault.buildVaultFiles({
+    engagements,
+    today: render.formatToday(new Date()),
+    redacted,
+    engagementsRoot: ENGAGEMENTS_ROOT,
+    version: cliVersion(),
+  })
+
+  // Fresh every run: a client dropped from the portfolio, or a page that stopped
+  // having content, must not linger as a stale note.
+  rmTreeQuiet(out)
+  try {
+    fs.mkdirSync(out, { recursive: true })
+  } catch (e) {
+    failFs(e, 'create vault', out)
+  }
+  for (const f of files) {
+    const target = path.join(out, f.rel)
+    try {
+      fs.mkdirSync(path.dirname(target), { recursive: true })
+    } catch (e) {
+      failFs(e, 'create vault folder', target)
+    }
+    atomicWriteFile(target, f.content)
+  }
+
+  console.log(`vault → ${out}${redacted ? '  (redacted)' : ''}`)
+  console.log(`${engagements.length} engagement(s) · ${files.length} pages · derived, gitignored, rebuilt on every run`)
+  console.log('open it:  Obsidian → Open folder as vault → this folder, then start at Portfolio')
+  if (!redacted) console.log('sharing a screen with the sponsor?  fde vault --redacted')
+}
+
 // ---------- demo (see the value before touching a real client) ----------
 // Everything below runs the real commands against a throwaway engagement under
 // ~/fde-engagements/.demo/ - the leading dot keeps it out of every portfolio
@@ -2842,6 +3157,7 @@ function printUsage() {
   fde preserve             pre-compaction context snapshot (hook-internal; hooks use this)
   fde status [--all]       current engagement status (pass --all for full portfolio)
   fde dashboard [--all]    current engagement fieldbook (pass --all for every client)
+  fde vault                derived Obsidian vault of every engagement (--current for one, --redacted for a shared screen, --out <dir>)
   env FDEOPS_ENGAGEMENTS_ROOT  override ~/fde-engagements (init/status/dashboard/registry)
   writes require a workspace bind (or FDEOPS_ENGAGEMENT) - folder-name match is read-only
   .fde/ is git-versioned locally for tamper-evident receipts (no remote, no telemetry)
@@ -2867,6 +3183,7 @@ switch (cmd) {
   case 'preserve': cmdPreserve(); break
   case 'status': cmdStatus(args); break
   case 'dashboard': cmdDashboard(args); break
+  case 'vault': cmdVault(args); break
   case 'help':
   case '-h':
   case '--help':

package/bin/install.js

@@ -355,7 +355,7 @@ function cmdInstall(opts = {}) {
 // through to the CLI (fde.js reads process.argv itself, so require() is enough).
 const FDE_SUBCOMMANDS = [
   'demo', 'scan', 'resume', 'triage', 'log', 'debrief', 'ingest', 'prep', 'doctor', 'redact',
-  'garden', 'owner', 'receipts', 'capture', 'preserve', 'status', 'dashboard', 'help',
+  'garden', 'owner', 'receipts', 'capture', 'preserve', 'status', 'dashboard', 'vault', 'help',
 ]
 
 const INSTALL_SUBCOMMANDS = ['init', 'adapters', 'install']

package/bin/lib/trust.js

@@ -15,7 +15,13 @@ function createTrustApi(deps) {
   function stakeholdersMemoryHealth(eng) {
     // Hostile handoff: binary / unparseable stakeholders must not read as healthy green.
     let buf
-    try { buf = fs.readFileSync(path.join(eng, 'stakeholders.md')) } catch (_) {
+    const abs = path.join(eng, 'stakeholders.md')
+    // Regular files only - opening a fifo here blocked status/triage/doctor
+    // forever. doctor reports the shape separately.
+    try { if (!fs.lstatSync(abs).isFile()) return { ok: true, warn: '' } } catch (_) {
+      return { ok: true, warn: '' }
+    }
+    try { buf = fs.readFileSync(abs) } catch (_) {
       return { ok: true, warn: '' }
     }
     if (buf.includes(0)) {
@@ -70,8 +76,10 @@ function createTrustApi(deps) {
       const t = raw.trim()
       if (!t || t.startsWith('<!--') || /^#{1,6}\s/.test(t)) continue
       if (/risk\s*\|\s*status|mitigation/i.test(t) || /^\|?[\s|:-]+$/.test(t)) continue
-      // Bullet risk with substance (skip empty "- " stubs).
-      if (/^[-*]/.test(t)) {
+      // Bullet risk with substance (skip empty "- " stubs). The bullet marker
+      // must be followed by space: "**Status:** open · closed" is a legend, and
+      // counting it as a risk reported one open risk on an empty register.
+      if (/^[-*]\s/.test(t)) {
         if (t.replace(/^[-*]\s+/, '').trim()) n++
         continue
       }