fdeops 3.24.0 → 3.26.0

package/bin/fde.js

@@ -35,6 +35,7 @@ const { execSync, execFileSync } = require('child_process')
 const { createMemoryApi } = require('./lib/memory')
 const { createTrustApi } = require('./lib/trust')
 const vault = require('./lib/vault')
+const context = require('./lib/context')
 
 const HOME = os.homedir()
 // FDEOPS_ENGAGEMENTS_ROOT isolates init/status/dashboard (and the registry) for
@@ -833,46 +834,49 @@ function valueLedgerRowCount(body) {
 function appendValueLedgerRow(eng, cells) {
   ensureMemoryGit(eng)
   const p = path.join(eng, 'delivery.md')
-  let md = readEng(eng, 'delivery.md')
-  if (!md) md = '# Delivery log\n\n## Value ledger\n\n'
-  const date = new Date().toISOString().slice(0, 10)
-  const cols = []
-  for (let i = 0; i < 7; i++) cols.push((cells[i] || '').replace(/\|/g, '\\|').trim() || ' ')
-  const row = `| ${date} | ${cols.join(' | ')} |`
-  // Write into the same section the readers take: the last filled ## Value ledger.
-  // A row appended to the empty template heading above a filled one is a row no
-  // gate can see.
-  const lines = md.split('\n')
-  const sections = []
-  let cur = null
-  for (let i = 0; i < lines.length; i++) {
-    if (/^##\s+Value ledger\b/i.test(lines[i])) {
-      cur = { heading: i, lastTable: -1, filled: false, body: [] }
-      sections.push(cur)
-      continue
+  let row
+  withFileLock(p, () => {
+    let md = readEng(eng, 'delivery.md')
+    if (!md) md = '# Delivery log\n\n## Value ledger\n\n'
+    const date = new Date().toISOString().slice(0, 10)
+    const cols = []
+    for (let i = 0; i < 7; i++) cols.push((cells[i] || '').replace(/\|/g, '\\|').trim() || ' ')
+    row = `| ${date} | ${cols.join(' | ')} |`
+    // Write into the same section the readers take: the last filled ## Value ledger.
+    // A row appended to the empty template heading above a filled one is a row no
+    // gate can see.
+    const lines = md.split('\n')
+    const sections = []
+    let cur = null
+    for (let i = 0; i < lines.length; i++) {
+      if (/^##\s+Value ledger\b/i.test(lines[i])) {
+        cur = { heading: i, lastTable: -1, filled: false, body: [] }
+        sections.push(cur)
+        continue
+      }
+      if (!cur) continue
+      if (/^##\s+/.test(lines[i])) { cur = null; continue }
+      cur.body.push(lines[i])
+      if (lines[i].trim()) cur.filled = true
+      if (/^\|/.test(lines[i].trim())) cur.lastTable = i
+    }
+    // Same choice parseValueLedger makes: the last section carrying rows, else the
+    // last with a body. A row written anywhere else is a row no gate can see.
+    const withRows = [...sections].reverse().find(s => valueLedgerRowCount(s.body.join('\n')))
+    const target = withRows || [...sections].reverse().find(s => s.filled) || sections[sections.length - 1]
+    if (!target) {
+      md = appendUnderSection(md, 'Value ledger', `${VALUE_LEDGER_HEADER}\n${VALUE_LEDGER_RULE}\n${row}`)
+    } else if (target.lastTable !== -1) {
+      lines.splice(target.lastTable + 1, 0, row)
+      md = lines.join('\n')
+    } else {
+      // No table under the chosen heading: a lone row would be read as the header
+      // line and the value would vanish. Lay the canonical table first.
+      lines.splice(target.heading + 1, 0, '', VALUE_LEDGER_HEADER, VALUE_LEDGER_RULE, row)
+      md = lines.join('\n')
     }
-    if (!cur) continue
-    if (/^##\s+/.test(lines[i])) { cur = null; continue }
-    cur.body.push(lines[i])
-    if (lines[i].trim()) cur.filled = true
-    if (/^\|/.test(lines[i].trim())) cur.lastTable = i
-  }
-  // Same choice parseValueLedger makes: the last section carrying rows, else the
-  // last with a body. A row written anywhere else is a row no gate can see.
-  const withRows = [...sections].reverse().find(s => valueLedgerRowCount(s.body.join('\n')))
-  const target = withRows || [...sections].reverse().find(s => s.filled) || sections[sections.length - 1]
-  if (!target) {
-    md = appendUnderSection(md, 'Value ledger', `${VALUE_LEDGER_HEADER}\n${VALUE_LEDGER_RULE}\n${row}`)
-  } else if (target.lastTable !== -1) {
-    lines.splice(target.lastTable + 1, 0, row)
-    md = lines.join('\n')
-  } else {
-    // No table under the chosen heading: a lone row would be read as the header
-    // line and the value would vanish. Lay the canonical table first.
-    lines.splice(target.heading + 1, 0, '', VALUE_LEDGER_HEADER, VALUE_LEDGER_RULE, row)
-    md = lines.join('\n')
-  }
-  withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
+    atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n')
+  })
   recordLastWrite(eng, 'delivery.md', row)
   commitMemory(eng, 'log delivery', { files: ['delivery.md'] })
 }
@@ -881,34 +885,36 @@ function retireOpenRisks(eng, needle) {
   const n = String(needle || '').toLowerCase()
   if (!n) return 0
   const p = path.join(eng, 'risks.md')
-  const md = readEng(eng, 'risks.md')
-  if (!md) return 0
-  const retired = []
-  const kept = []
-  let inRetired = false
-  for (const raw of md.split('\n')) {
-    const t = raw.trim()
-    if (/^#{1,6}\s+Retired\b/i.test(t)) { inRetired = true; kept.push(raw); continue }
-    if (!inRetired) {
-      const m = t.match(/^-\s*\[\d{4}-\d{2}-\d{2}\]\s*(?:\[@[^\]]+\]\s*)?(.*)$/)
-      if (m && m[1].toLowerCase().includes(n)) {
-        retired.push(raw)
-        continue
+  return withFileLock(p, () => {
+    const md = readEng(eng, 'risks.md')
+    if (!md) return 0
+    const retired = []
+    const kept = []
+    let inRetired = false
+    for (const raw of md.split('\n')) {
+      const t = raw.trim()
+      if (/^#{1,6}\s+Retired\b/i.test(t)) { inRetired = true; kept.push(raw); continue }
+      if (!inRetired) {
+        const m = t.match(/^-\s*\[\d{4}-\d{2}-\d{2}\]\s*(?:\[@[^\]]+\]\s*)?(.*)$/)
+        if (m && m[1].toLowerCase().includes(n)) {
+          retired.push(raw)
+          continue
+        }
       }
+      kept.push(raw)
     }
-    kept.push(raw)
-  }
-  if (!retired.length) return 0
-  let out = kept.join('\n')
-  if (!/^#{1,6}\s+Retired\b/im.test(out)) out = out.replace(/\n*$/, '\n\n## Retired\n')
-  const stamp = new Date().toISOString().slice(0, 10)
-  const block = retired.map(l => {
-    const body = l.trim().replace(/^-\s*/, '')
-    return `- [${stamp}] (retired) ${body}`
-  }).join('\n')
-  out = appendUnderSection(out, 'Retired', block)
-  withFileLock(p, () => { atomicWriteFile(p, out.endsWith('\n') ? out : out + '\n') })
-  return retired.length
+    if (!retired.length) return 0
+    let out = kept.join('\n')
+    if (!/^#{1,6}\s+Retired\b/im.test(out)) out = out.replace(/\n*$/, '\n\n## Retired\n')
+    const stamp = new Date().toISOString().slice(0, 10)
+    const block = retired.map(l => {
+      const body = l.trim().replace(/^-\s*/, '')
+      return `- [${stamp}] (retired) ${body}`
+    }).join('\n')
+    out = appendUnderSection(out, 'Retired', block)
+    atomicWriteFile(p, out.endsWith('\n') ? out : out + '\n')
+    return retired.length
+  })
 }
 
 // Engagement age from the .fde/ directory's own birth time - hidden (not
@@ -1282,6 +1288,9 @@ function cmdScan() {
 }
 
 function cmdResume(args) {
+  let maxBytes
+  try { ({ args, maxBytes } = context.budgetArgs(args)) } catch (e) { console.error(e.message); process.exit(2) }
+
   const initIdx = args.indexOf('--init')
   if (initIdx !== -1) {
     const name = args[initIdx + 1]
@@ -1306,30 +1315,23 @@ function cmdResume(args) {
     }
 
     try {
+      const installPaths = require('./lib/install-paths')
+      installPaths.checkTree(tpl, fdeDir)
       if (!existed) {
-        // Atomic create: build under a staging dir, then rename into place.
-        // Disk-full / permission mid-copy must not leave a half-built engagement.
-        fs.mkdirSync(ENGAGEMENTS_ROOT, { recursive: true })
-        const stagingRoot = path.join(ENGAGEMENTS_ROOT, `.init-${slug}-${process.pid}`)
-        const stagingEng = path.join(stagingRoot, slug)
-        const stagingFde = path.join(stagingEng, '.fde')
-        rmTreeQuiet(stagingRoot)
+        // Stage only the fieldbook. A pre-existing client folder can contain
+        // contracts or source files that initialization must never remove.
+        installPaths.mkdir(engRoot)
+        const stagingRoot = fs.mkdtempSync(path.join(ENGAGEMENTS_ROOT, `.init-${slug}-`))
+        const stagingFde = path.join(stagingRoot, '.fde')
         try {
-          fs.mkdirSync(stagingFde, { recursive: true })
+          fs.mkdirSync(stagingFde)
           fillTemplates(stagingFde)
-          // If a partial engRoot exists from an older failed run, remove it first.
-          if (fs.existsSync(engRoot)) rmTreeQuiet(engRoot)
-          fs.renameSync(stagingEng, engRoot)
-          rmTreeQuiet(stagingRoot)
-        } catch (e) {
+          fs.renameSync(stagingFde, fdeDir)
+        } finally {
           rmTreeQuiet(stagingRoot)
-          if (fs.existsSync(engRoot) && !fs.existsSync(path.join(engRoot, '.fde', 'context.md'))) {
-            rmTreeQuiet(engRoot)
-          }
-          failFs(e, 'create engagement', engRoot)
         }
       } else {
-        // Re-init / rebind: only fill missing template files in place.
+        // Re-init only fills missing templates; existing records are preserved.
         fillTemplates(fdeDir)
       }
     } catch (e) {
@@ -1394,17 +1396,24 @@ function cmdResume(args) {
     console.log(`NO ENGAGEMENT for this workspace.\nexisting: ${list}\nAsk the human the client name (one question), then run: fde resume --init <client-name>\nDo not tell them to type that command.`)
     process.exit(2)
   }
-  // Monday-morning: triage + proactive hygiene (silent when clean), the record
-  // (sponsor / promise / decisions), then the session log.
-  printTriageBlock(eng)
-  const digest = recordDigest(eng)
-  if (digest.length) console.log('\n' + digest.join('\n'))
-  console.log(`\nENGAGEMENT: ${eng}\n`)
-  // readClean, not fs.readFileSync: this output is what an agent loads as
-  // context, so it goes through the same <private> redaction as the dashboard.
+  const intro = [resumeTriage(eng), ...hygieneTriageLines(eng), ...recordDigest(eng)].join('\n')
   const ctx = readClean(eng, 'context.md')
-  if (!ctx) { console.log('(context.md empty - new engagement)') }
-  else { console.log(args.includes('--full') ? ctx : resumeView(ctx)) }
+  if (args.includes('--full')) {
+    console.log(`${intro}\n\nENGAGEMENT: ${eng}\n\n${ctx || '(no context.md yet)'}`)
+    return
+  }
+  // Bound the complete command output, not only context.md's line count.
+  // Separate allocations keep a long history from crowding out current goals.
+  const policy = readClean(eng, 'trust-profile.md')
+  const success = readClean(eng, 'success.md')
+  const risks = readClean(eng, 'risks.md')
+  process.stdout.write(context.boundedSections([
+    `${intro}\n\nENGAGEMENT: ${eng}`,
+    policy ? `CLIENT POLICY - trust-profile.md\n${policy}` : '',
+    success ? `CURRENT GOALS & ACCEPTANCE - success.md\n${success}` : '',
+    risks ? `RECORDED RISKS - risks.md\n${risks}` : '',
+    `WORKING CONTEXT - context.md\n${ctx ? resumeView(ctx) : '(no context.md yet)'}`,
+  ], maxBytes))
 }
 
 // Token discipline: context.md grows every session (the session-stop hook
@@ -1412,18 +1421,18 @@ function cmdResume(args) {
 // each day for less marginal signal. This returns a bounded view - the curated
 // head (state / next action) plus the most recent activity - and hides the
 // middle of the log behind `fde resume --full`. Pure code, zero model tokens.
-// The session-start hook mirrors this same bound in bash; keep them in sync.
+// The session-start hook consumes this same view through fde resume.
 function resumeView(md) {
   const lines = md.split('\n')
   // A file ending in "\n" yields a trailing "" here; drop it so the line count
-  // matches the bash hook's `wc -l` and the two bounded views stay byte-aligned.
+  // counts content lines rather than the terminal newline.
   if (lines.length > 0 && lines[lines.length - 1] === '') lines.pop()
   if (lines.length <= 160) return md
   // Anchor on the "## Session end" heading, NOT the "<!-- fdeops auto-capture -->"
   // comment: this text is read via readClean (stripPrivate strips HTML comments),
   // so the comment is gone by the time we get here. The heading is written on the
   // very next line by cmdCapture and the session-stop hook and survives redaction.
-  // The bash bounded_context() anchors on the same heading - keep them identical.
+  // Bound after sanitation so removed comments cannot shift the anchor.
   let headEnd = lines.findIndex(l => /^##\s+Session end\b/.test(l.trim()))
   if (headEnd === -1) headEnd = 120
   headEnd = Math.min(headEnd, 120)
@@ -1440,25 +1449,35 @@ function cmdLogUndo() {
   if (!eng) { console.error('no engagement - run: fde resume --init <name>'); process.exit(2) }
   const metaPath = path.join(eng, LAST_WRITE)
   let meta
-  try { meta = JSON.parse(fs.readFileSync(metaPath, 'utf8')) } catch (_) {
-    console.error('nothing to undo - no prior fde log/debrief write recorded')
-    process.exit(1)
-  }
-  if (!meta.file || !meta.entry) { console.error('corrupt .last-write - cannot undo'); process.exit(1) }
-  const target = path.join(eng, meta.file)
-  const before = readEng(eng, meta.file)
-  const after = removeExactEntryLine(before, meta.entry)
-  if (after == null) {
-    console.error(`cannot undo - entry no longer in ${meta.file} (edited by hand?). Remove it manually.`)
+  try {
+    withFileLock(metaPath, () => {
+      try { meta = JSON.parse(fs.readFileSync(metaPath, 'utf8')) } catch (_) {
+        throw new Error('nothing to undo - no prior fde log/debrief write recorded')
+      }
+      if (!Object.values(LOG_FILES).includes(meta.file) || !meta.entry) {
+        throw new Error('corrupt .last-write - cannot undo')
+      }
+      const target = path.join(eng, meta.file)
+      withFileLock(target, () => {
+        const after = removeExactEntryLine(readEng(eng, meta.file), meta.entry)
+        if (after == null) {
+          throw new Error(`cannot undo - entry no longer in ${meta.file} (edited by hand?). Remove it manually.`)
+        }
+        atomicWriteFile(target, after.endsWith('\n') ? after : after + '\n', { soft: true })
+      }, { soft: true })
+      if (/\[signal:(red|amber|green)\]/i.test(meta.entry)) {
+        const ledgerPath = path.join(eng, SIGNAL_LEDGER)
+        withFileLock(ledgerPath, () => {
+          const led = removeExactEntryLine(readEng(eng, SIGNAL_LEDGER), meta.entry)
+          if (led != null) atomicWriteFile(ledgerPath, led.endsWith('\n') ? led : led + '\n', { soft: true })
+        }, { soft: true })
+      }
+      try { fs.unlinkSync(metaPath) } catch (_) {}
+    })
+  } catch (e) {
+    console.error(e.message)
     process.exit(1)
   }
-  withFileLock(target, () => { atomicWriteFile(target, after.endsWith('\n') ? after : after + '\n') })
-  if (/\[signal:(red|amber|green)\]/i.test(meta.entry)) {
-    const ledgerPath = path.join(eng, SIGNAL_LEDGER)
-    const led = removeExactEntryLine(readEng(eng, SIGNAL_LEDGER), meta.entry)
-    if (led != null) withFileLock(ledgerPath, () => { atomicWriteFile(ledgerPath, led.endsWith('\n') ? led : led + '\n') })
-  }
-  try { fs.unlinkSync(metaPath) } catch (_) {}
   const undoFiles = [meta.file]
   if (/\[signal:(red|amber|green)\]/i.test(meta.entry)) undoFiles.push(SIGNAL_LEDGER)
   const hash = commitMemory(eng, `undo ${meta.file}`, { files: undoFiles })
@@ -1536,18 +1555,20 @@ function cmdLog(args) {
 function setContextPhase(eng, phase) {
   ensureMemoryGit(eng)
   const p = path.join(eng, 'context.md')
-  let md = readEng(eng, 'context.md')
-  if (!md) md = '# Engagement context\n\n'
-  if (/\*\*Phase:\*\*/i.test(md)) {
-    md = md.replace(/\*\*Phase:\*\*\s*.*/i, `**Phase:** ${phase}`)
-  } else {
-    md = md.replace(/\n*$/, `\n\n**Phase:** ${phase}\n`)
-  }
-  const today = new Date().toISOString().slice(0, 10)
-  if (/\*\*Last updated:\*\*/i.test(md)) {
-    md = md.replace(/\*\*Last updated:\*\*\s*.*/i, `**Last updated:** ${today}`)
-  }
-  withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
+  withFileLock(p, () => {
+    let md = readEng(eng, 'context.md')
+    if (!md) md = '# Engagement context\n\n'
+    if (/\*\*Phase:\*\*/i.test(md)) {
+      md = md.replace(/\*\*Phase:\*\*\s*.*/i, `**Phase:** ${phase}`)
+    } else {
+      md = md.replace(/\n*$/, `\n\n**Phase:** ${phase}\n`)
+    }
+    const today = new Date().toISOString().slice(0, 10)
+    if (/\*\*Last updated:\*\*/i.test(md)) {
+      md = md.replace(/\*\*Last updated:\*\*\s*.*/i, `**Last updated:** ${today}`)
+    }
+    atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n')
+  })
   const hash = commitMemory(eng, `phase ${phase}`, { files: ['context.md'] })
   // Proactive warn at the moment it matters - don't wait for Monday hygiene.
   if (phase === 'ship' || phase === 'close') {
@@ -1674,57 +1695,61 @@ function signerFromLine(text) {
 function setSigner(eng, who) {
   ensureMemoryGit(eng)
   const p = path.join(eng, 'success.md')
-  let md = readEng(eng, 'success.md')
-  if (!md) md = '# Success definition\n\n'
-  const norm = (s) => String(s).replace(/\s+/g, ' ').trim().toLowerCase()
-  // [^\S\n], not \s: \s crosses newlines, so an empty field captured the next
-  // line - and setSigner then read a filled field and filed the name as "also
-  // named" under whatever heading followed.
-  const line = /^\*\*Stakeholder who signs off:\*\*[^\S\n]*(.*)$/m
-  const m = md.match(line)
-  if (m && !m[1].trim()) {
-    md = md.replace(line, `**Stakeholder who signs off:** ${who}`)
-  } else if (m) {
-    // Whole-name compare against the primary and every "also named" line under
-    // it: "Sam" must not vanish inside "Samantha", and re-applying must not
-    // stack duplicates.
-    const start = md.indexOf(m[0]) + m[0].length
-    const alsoNamed = []
-    for (const l of md.slice(start).split('\n').slice(1)) {
-      const a = l.match(/^- also named:\s*(.+)$/)
-      if (!a) break
-      alsoNamed.push(a[1])
-    }
-    const known = [m[1], ...alsoNamed].map(norm)
-    if (known.includes(norm(who))) return false
-    // A second, different name is a fact worth keeping next to the first, not
-    // a silent overwrite - who signs is exactly the thing people argue about.
-    const block = [m[0], ...alsoNamed.map(a => `- also named: ${a}`)].join('\n')
-    md = md.replace(block, `${block}\n- also named: ${who}`)
-  } else {
-    md = md.replace(/\n*$/, `\n\n**Stakeholder who signs off:** ${who}\n`)
-  }
-  withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
-  return true
+  return withFileLock(p, () => {
+    let md = readEng(eng, 'success.md')
+    if (!md) md = '# Success definition\n\n'
+    const norm = (s) => String(s).replace(/\s+/g, ' ').trim().toLowerCase()
+    // [^\S\n], not \s: \s crosses newlines, so an empty field captured the next
+    // line - and setSigner then read a filled field and filed the name as "also
+    // named" under whatever heading followed.
+    const line = /^\*\*Stakeholder who signs off:\*\*[^\S\n]*(.*)$/m
+    const m = md.match(line)
+    if (m && !m[1].trim()) {
+      md = md.replace(line, `**Stakeholder who signs off:** ${who}`)
+    } else if (m) {
+      // Whole-name compare against the primary and every "also named" line under
+      // it: "Sam" must not vanish inside "Samantha", and re-applying must not
+      // stack duplicates.
+      const start = md.indexOf(m[0]) + m[0].length
+      const alsoNamed = []
+      for (const l of md.slice(start).split('\n').slice(1)) {
+        const a = l.match(/^- also named:\s*(.+)$/)
+        if (!a) break
+        alsoNamed.push(a[1])
+      }
+      const known = [m[1], ...alsoNamed].map(norm)
+      if (known.includes(norm(who))) return false
+      // A second, different name is a fact worth keeping next to the first, not
+      // a silent overwrite - who signs is exactly the thing people argue about.
+      const block = [m[0], ...alsoNamed.map(a => `- also named: ${a}`)].join('\n')
+      md = md.replace(block, `${block}\n- also named: ${who}`)
+    } else {
+      md = md.replace(/\n*$/, `\n\n**Stakeholder who signs off:** ${who}\n`)
+    }
+    atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n')
+    return true
+  })
 }
 
 function setNextAction(eng, text) {
   ensureMemoryGit(eng)
   const bullet = `- ${stripControlChars(String(text).replace(/^[-*]\s+/, '').trim())}`
   const p = path.join(eng, 'context.md')
-  let md = readEng(eng, 'context.md')
-  if (!md) md = '# Engagement context\n\n'
-  // Collapse duplicate ## Next action headings (skill-append trap) into one.
-  md = stripAllSections(md, 'Next action')
-  if (/^##\s+Current state\b/im.test(md)) {
-    md = md.replace(
-      /(^##\s+Current state\b[^\n]*\n)([\s\S]*?)(?=^##\s|\s*$)/im,
-      (_, h, body) => `${h}${String(body).replace(/\n*$/, '\n')}\n## Next action\n\n${bullet}\n\n`
-    )
-  } else {
-    md = md.replace(/\n*$/, `\n\n## Next action\n\n${bullet}\n`)
-  }
-  withFileLock(p, () => { atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n') })
+  withFileLock(p, () => {
+    let md = readEng(eng, 'context.md')
+    if (!md) md = '# Engagement context\n\n'
+    // Collapse duplicate ## Next action headings (skill-append trap) into one.
+    md = stripAllSections(md, 'Next action')
+    if (/^##\s+Current state\b/im.test(md)) {
+      md = md.replace(
+        /(^##\s+Current state\b[^\n]*\n)([\s\S]*?)(?=^##\s|\s*$)/im,
+        (_, h, body) => `${h}${String(body).replace(/\n*$/, '\n')}\n## Next action\n\n${bullet}\n\n`
+      )
+    } else {
+      md = md.replace(/\n*$/, `\n\n## Next action\n\n${bullet}\n`)
+    }
+    atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n')
+  })
 }
 
 function looksLikeBinaryNoise(text) {
@@ -2300,6 +2325,23 @@ function cmdReceipts(args) {
   }
 }
 
+function cmdRecall(args) {
+  let maxBytes
+  try { ({ args, maxBytes } = context.budgetArgs(args)) } catch (e) { console.error(e.message); process.exit(2) }
+  const query = args.join(' ').trim()
+  if (!query || Buffer.byteLength(query) > 2048 || args.some(a => a.startsWith('--'))) {
+    console.error('usage: fde recall <topic> [--max-bytes 4096..65536]'); process.exit(2)
+  }
+  const eng = resolveEngagement()
+  if (!eng) { console.error('no engagement - bind a client before recall'); process.exit(2) }
+  const files = ['context.md', 'trust-profile.md', 'success.md', 'decisions.md', 'risks.md', 'delivery.md', 'stakeholders.md', 'brief.md', 'reality.md', 'assumptions.md', 'terrain.md']
+  const result = context.recallSections(files.map(file => ({ file, text: readClean(eng, file) })), query)
+  process.stdout.write(context.boundedSections([
+    `RECALL - ${eng}\n${result.total ? `${result.sections.length} of ${result.total} matching lines; refine the query if evidence is omitted.` : 'No matching record. This is not proof that the event never happened.'}\nSources are local record assertions; verify dates, supersession and approval scope.`,
+    ...result.sections,
+  ], maxBytes))
+}
+
 function cmdCapture() {
   const eng = resolveEngagement({ forWrite: true })
   if (!eng) process.exit(0) // silent: capture must never break a session
@@ -2759,13 +2801,8 @@ function hasValueBucket(eng) {
   return false
 }
 
-// A measured number the FDE calculated is not a benefit the customer agreed to.
-// Rows carrying a real Measured value need a named customer-side owner in
-// "Accepted by", or they close as claimed - the distinction the renewal turns on.
-// "pending review", "TBD.", "n/a (blocked)" and "..." are all the same thing an
-// FDE means by an empty cell - nagging about them teaches people to ignore doctor.
-const PENDING_CELL_RE =
-  /^(?:pending|tbd|to ?be ?(?:measured|confirmed|determined)|n\s*\/\s*a|na|none|unknown|not(?:\s+yet)?\s+measured|unmeasured|awaiting|\?+|\.{2,}|…|-+)(?:[^\w].*)?$/i
+// Shared classification keeps CLI, dashboard, and vault acceptance consistent.
+const { PENDING_CELL_RE, valueState } = require('./lib/value-ledger')
 
 function parseValueLedger(eng) {
   // Last section with actual rows, not merely the last non-empty one: a template
@@ -2780,7 +2817,8 @@ function parseValueLedger(eng) {
     slice: colIndex(table.headers, /slice/i),
     promised: colIndex(table.headers, /promised/i),
     measured: colIndex(table.headers, /measured/i),
-    accepted: colIndex(table.headers, /accept/i),
+    accepted: colIndex(table.headers, /accepted by/i),
+    acceptanceStatus: colIndex(table.headers, /^acceptance status$/i),
     evidence: colIndex(table.headers, /evidence/i),
   }
   const cell = (row, i) => (i === -1 ? '' : String(row[i] || '').trim())
@@ -2791,12 +2829,9 @@ function parseValueLedger(eng) {
     const measured = cell(row, idx.measured)
     const accepted = cell(row, idx.accepted)
     if (!slice && !promised && !measured) continue
-    const measuredPending = !measured || PENDING_CELL_RE.test(measured)
-    const acceptedPending = idx.accepted === -1 || !accepted || PENDING_CELL_RE.test(accepted)
-    let state = 'unmeasured'
-    if (!measuredPending && acceptedPending) state = 'claimed'
-    else if (!measuredPending) state = 'accepted'
     const evidence = cell(row, idx.evidence)
+    const acceptanceStatus = idx.acceptanceStatus === -1 ? undefined : cell(row, idx.acceptanceStatus)
+    const state = valueState({ measured, accepted, acceptanceStatus, evidence })
     rows.push({ slice, promised, measured, accepted, evidence, evidenceMissing: !evidence || PENDING_CELL_RE.test(evidence), state })
   }
   return { rows, columnMissing: idx.accepted === -1 }
@@ -2990,19 +3025,15 @@ function cmdRedact(args) {
   }
   ensureMemoryGit(eng)
   const touched = []
-  const byFile = new Map()
-  for (const h of hits) {
-    if (!byFile.has(h.file)) byFile.set(h.file, new Set())
-    byFile.get(h.file).add(h.lineNo)
-  }
-  for (const [file, lineNos] of byFile) {
+  for (const file of new Set(hits.map(h => h.file))) {
     const abs = path.join(eng, file)
-    const before = readEng(eng, file)
-    const kept = before.split('\n').filter((_, i) => !lineNos.has(i + 1))
-    const after = kept.join('\n')
-    if (after === before) continue
-    withFileLock(abs, () => { atomicWriteFile(abs, after.endsWith('\n') || after === '' ? after : after + '\n') })
-    touched.push(file)
+    withFileLock(abs, () => {
+      const before = readEng(eng, file)
+      const after = before.split('\n').filter(line => !line.toLowerCase().includes(needle)).join('\n')
+      if (after === before) return
+      atomicWriteFile(abs, after.endsWith('\n') || after === '' ? after : after + '\n')
+      touched.push(file)
+    })
   }
   if (!touched.length) {
     console.log('nothing changed')
@@ -3153,37 +3184,45 @@ function cmdGarden(args) {
       continue
     }
     if (p.id !== 'archive-sessions') continue
-    const cutDates = new Set(p.sessionBlocks.map(b => b.date))
-    const keep = []
-    const archive = []
-    let mode = 'keep'
-    let buf = []
-    const flush = () => {
-      if (!buf.length) return
-      ;(mode === 'archive' ? archive : keep).push(...buf)
-      buf = []
-    }
-    for (const line of lines) {
-      const m = line.match(/^##\s+Session end\s+-\s+(\d{4}-\d{2}-\d{2})\b/)
-      if (m) {
-        flush()
-        mode = cutDates.has(m[1]) ? 'archive' : 'keep'
-      } else if (/^##\s+/.test(line) && mode === 'archive') {
+    let archived
+    try {
+      archived = withFileLock(path.join(eng, 'context.md'), () => {
+        const cutDates = new Set(p.sessionBlocks.map(b => b.date))
+        const keep = []
+        const archive = []
+        let mode = 'keep'
+        let buf = []
+        const flush = () => {
+          if (!buf.length) return
+          ;(mode === 'archive' ? archive : keep).push(...buf)
+          buf = []
+        }
+        for (const line of readEng(eng, 'context.md').split('\n')) {
+          const m = line.match(/^##\s+Session end\s+-\s+(\d{4}-\d{2}-\d{2})\b/)
+          if (m) {
+            flush()
+            mode = cutDates.has(m[1]) ? 'archive' : 'keep'
+          } else if (/^##\s+/.test(line) && mode === 'archive') {
+            flush()
+            mode = 'keep'
+          }
+          buf.push(line)
+        }
         flush()
-        mode = 'keep'
-      }
-      buf.push(line)
-    }
-    flush()
-    if (!archive.length) continue
-    const archPath = path.join(eng, 'context-archive.md')
-    const prev = fs.existsSync(archPath) ? fs.readFileSync(archPath, 'utf8') : '# Context archive\n\n'
-    withFileLock(archPath, () => {
-      atomicWriteFile(archPath, prev.replace(/\n*$/, '\n\n') + archive.join('\n').trim() + '\n')
-    })
-    withFileLock(path.join(eng, 'context.md'), () => {
-      atomicWriteFile(path.join(eng, 'context.md'), keep.join('\n').replace(/\n*$/, '\n'))
-    })
+        if (!archive.length) return false
+        const archPath = path.join(eng, 'context-archive.md')
+        withFileLock(archPath, () => {
+          const prev = readEng(eng, 'context-archive.md') || '# Context archive\n\n'
+          atomicWriteFile(archPath, prev.replace(/\n*$/, '\n\n') + archive.join('\n').trim() + '\n', { soft: true })
+        }, { soft: true })
+        atomicWriteFile(path.join(eng, 'context.md'), keep.join('\n').replace(/\n*$/, '\n'), { soft: true })
+        return true
+      }, { soft: true })
+    } catch (e) {
+      console.error(`tidy archive: ${e.message}`)
+      process.exit(1)
+    }
+    if (!archived) continue
     applied++
     touched.add('context.md')
     touched.add('context-archive.md')
@@ -3197,47 +3236,49 @@ function cmdGarden(args) {
 // Keep the first open-risk bullet per fingerprint; move later echoes under ## Retired.
 function applyRiskDedupe(eng, clusters) {
   const p = path.join(eng, 'risks.md')
-  let md = readEng(eng, 'risks.md')
-  if (!md) return 0
-  const echoTexts = new Set()
-  for (const group of clusters) {
-    for (let i = 1; i < group.length; i++) echoTexts.add(group[i])
-  }
-  if (!echoTexts.size) return 0
-  const retiredLines = []
-  const kept = []
-  let inRetired = false
-  let moved = 0
-  for (const raw of md.split('\n')) {
-    const t = raw.trim()
-    if (/^#{1,6}\s+Retired\b/i.test(t)) {
-      inRetired = true
-      kept.push(raw)
-      continue
-    }
-    if (!inRetired) {
-      const m = t.match(/^-\s*\[\d{4}-\d{2}-\d{2}\]\s*(?:\[@[^\]]+\]\s*)?(.*)$/)
-      if (m && echoTexts.has(m[1].trim())) {
-        retiredLines.push(raw)
-        moved++
+  return withFileLock(p, () => {
+    let md = readEng(eng, 'risks.md')
+    if (!md) return 0
+    const echoTexts = new Set()
+    for (const group of clusters) {
+      for (let i = 1; i < group.length; i++) echoTexts.add(group[i])
+    }
+    if (!echoTexts.size) return 0
+    const retiredLines = []
+    const kept = []
+    let inRetired = false
+    let moved = 0
+    for (const raw of md.split('\n')) {
+      const t = raw.trim()
+      if (/^#{1,6}\s+Retired\b/i.test(t)) {
+        inRetired = true
+        kept.push(raw)
         continue
       }
+      if (!inRetired) {
+        const m = t.match(/^-\s*\[\d{4}-\d{2}-\d{2}\]\s*(?:\[@[^\]]+\]\s*)?(.*)$/)
+        if (m && echoTexts.has(m[1].trim())) {
+          retiredLines.push(raw)
+          moved++
+          continue
+        }
+      }
+      kept.push(raw)
     }
-    kept.push(raw)
-  }
-  if (!moved) return 0
-  let out = kept.join('\n')
-  if (!/^#{1,6}\s+Retired\b/im.test(out)) {
-    out = out.replace(/\n*$/, '\n\n## Retired\n')
-  }
-  const stamp = new Date().toISOString().slice(0, 10)
-  const block = retiredLines.map(l => {
-    const body = l.trim().replace(/^-\s*/, '')
-    return `- [${stamp}] (tidy dedupe) ${body}`
-  }).join('\n')
-  out = appendUnderSection(out, 'Retired', block)
-  withFileLock(p, () => { atomicWriteFile(p, out.endsWith('\n') ? out : out + '\n') })
-  return moved
+    if (!moved) return 0
+    let out = kept.join('\n')
+    if (!/^#{1,6}\s+Retired\b/im.test(out)) {
+      out = out.replace(/\n*$/, '\n\n## Retired\n')
+    }
+    const stamp = new Date().toISOString().slice(0, 10)
+    const block = retiredLines.map(l => {
+      const body = l.trim().replace(/^-\s*/, '')
+      return `- [${stamp}] (tidy dedupe) ${body}`
+    }).join('\n')
+    out = appendUnderSection(out, 'Retired', block)
+    atomicWriteFile(p, out.endsWith('\n') ? out : out + '\n')
+    return moved
+  })
 }
 
 function engagementSlugFromPath(eng) {
@@ -3419,24 +3460,10 @@ function cliVersion() {
 }
 
 function valueLedgerRows(eng) {
-  const ledger = stripTemplateNoise(sectionBody(readClean(eng, 'delivery.md'), 'Value ledger', { lastNonEmpty: true }) || '')
-  const table = parseMdTable(ledger)
-  if (!table) return []
-  const sIdx = colIndex(table.headers, /slice/i)
-  const pIdx = colIndex(table.headers, /promis/i)
-  const aIdx = colIndex(table.headers, /accept/i)
-  const rows = []
-  for (const row of table.rows) {
-    const slice = sIdx === -1 ? '' : String(row[sIdx] || '').trim()
-    const promised = pIdx === -1 ? '' : String(row[pIdx] || '').trim()
-    if (!slice && !promised) continue
-    const acceptedRaw = aIdx === -1 ? '' : String(row[aIdx] || '').trim()
-    rows.push({
-      slice, promised,
-      acceptedBy: !acceptedRaw || PENDING_CELL_RE.test(acceptedRaw) ? '' : acceptedRaw,
-    })
-  }
-  return rows
+  return parseValueLedger(eng).rows.map(row => ({
+    slice: row.slice, promised: row.promised,
+    acceptedBy: row.state === 'accepted' ? row.accepted : '',
+  }))
 }
 
 function isInside(child, parent) {
@@ -3756,6 +3783,7 @@ function printUsage() {
   fde redact <term>        preview/remove lines containing a buried term (pass --apply to commit; subject never repeats the term)
   fde tidy [--apply]       propose consolidations; blesses hand-written dirty files when you apply
   fde owner [set email]    who keeps this engagement record
+  fde recall <topic>       bounded, redacted source excerpts (--max-bytes 4096..65536)
   fde receipts <term>      "what did we agree?" with dates
   fde status [--all]       value ledger, then trust (pass --all for full portfolio)
   fde dashboard [--all] [--open] [--out <path>]  bound fieldbook (pass --all for every client)
@@ -3776,6 +3804,7 @@ switch (cmd) {
   case 'demo': cmdDemo(args); break
   case 'scan': cmdScan(); break
   case 'resume': cmdResume(args); break
+  case 'recall': cmdRecall(args); break
   case 'triage': cmdTriage(); break
   case 'log': cmdLog(args); break
   case 'debrief': cmdDebrief(args); break