fdeops 3.27.1 → 3.29.0

package/bin/fde.js

@@ -45,6 +45,13 @@ const HOME = os.homedir()
 const ENGAGEMENTS_ROOT = ((process.env.FDEOPS_ENGAGEMENTS_ROOT || '').trim().replace(/^~/, HOME))
   || path.join(HOME, 'fde-engagements')
 const REGISTRY = path.join(ENGAGEMENTS_ROOT, '.registry')
+const masking = require('./lib/masking').createMasking(ENGAGEMENTS_ROOT)
+function maskDisplay(text) {
+  return ['dashboard', 'vault'].includes(process.argv[2]) ? String(text) : masking.mask(text)
+}
+function maskedSections(sections, maxBytes) {
+  return context.boundedSections(sections.map(text => masking.mask(text)), maxBytes)
+}
 const DEBRIEF_MAX_BYTES = 256 * 1024
 const CODE_EXT = ['.js', '.ts', '.tsx', '.jsx', '.py', '.java', '.go', '.rb', '.cs', '.php']
 const CONF_EXT = CODE_EXT.concat(['.env', '.yaml', '.yml', '.json'])
@@ -114,7 +121,7 @@ function grepFiles(files, regex, cap) {
     try { text = fs.readFileSync(f, 'utf8') } catch (_) { continue }
     const lines = text.split('\n')
     for (let i = 0; i < lines.length && hits.length < cap; i++) {
-      if (regex.test(lines[i])) hits.push({ file: path.relative(process.cwd(), f), line: i + 1, text: lines[i].trim().slice(0, 120) })
+      if (regex.test(lines[i])) hits.push({ file: path.relative(process.cwd(), f), line: i + 1, text: maskDisplay(lines[i].trim()).slice(0, 120) })
     }
   }
   return hits
@@ -798,7 +805,7 @@ function firstLine(md, maxLen) {
   for (const raw of md.split('\n')) {
     const l = raw.trim()
     if (!l || /^#{1,6}\s/.test(l)) continue
-    const clean = l.replace(/^\*\*[^*]+:\*\*\s*/, '').replace(/\*\*/g, '').replace(/^["']|["']$/g, '').trim()
+    const clean = maskDisplay(l.replace(/^\*\*[^*]+:\*\*\s*/, '').replace(/\*\*/g, '').replace(/^["']|["']$/g, '').trim())
     if (!clean) continue
     return clean.length > maxLen ? clean.slice(0, maxLen - 1).trim() + '…' : clean
   }
@@ -811,7 +818,7 @@ function firstLine(md, maxLen) {
 function parseReality(md, maxLen) {
   const theory = (md.match(/\*\*Working theory:\*\*[^\S\r\n]*(.*)/i) || [])[1]
   const hasSchema = /\*\*(Working theory|Evidence|Differs from brief how):\*\*/i.test(md)
-  const theoryText = (theory || '').trim()
+  const theoryText = maskDisplay((theory || '').trim())
   if (theoryText) {
     const line = theoryText.length > maxLen ? theoryText.slice(0, maxLen - 1).trim() + '…' : theoryText
     return { line, missing: '' }
@@ -840,7 +847,7 @@ function valueLedgerRowCount(body) {
   return t.rows.filter(r => r.some(c => String(c || '').trim())).length
 }
 
-function appendValueLedgerRow(eng, cells) {
+function appendValueLedgerRow(eng, cells, { skipCommit = false } = {}) {
   ensureMemoryGit(eng)
   const p = path.join(eng, 'delivery.md')
   let row
@@ -887,7 +894,7 @@ function appendValueLedgerRow(eng, cells) {
     atomicWriteFile(p, md.endsWith('\n') ? md : md + '\n')
   })
   recordLastWrite(eng, 'delivery.md', row)
-  commitMemory(eng, 'log delivery', { files: ['delivery.md'] })
+  if (!skipCommit) commitMemory(eng, 'log delivery', { files: ['delivery.md'] })
 }
 
 function retireOpenRisks(eng, needle) {
@@ -983,7 +990,7 @@ const {
   countOpenRisks,
 } = createTrustApi({
   fs, path, readClean, readEng, parseMdTable, sectionBody, SIGNAL_LEDGER, memoryDirtyManual,
-  stripTemplateNoise, stripLegendLines,
+  stripTemplateNoise, stripLegendLines, extractRisks,
 })
 
 // Stakeholders: columns are matched by header wording, not position - real
@@ -1081,14 +1088,14 @@ function extractStakeholders(eng) {
   for (const [key, h] of latest) {
     if (byKey.has(key)) {
       const cur = byKey.get(key)
-      byKey.set(key, { ...cur, signal: h.signal, note: cur.note || h.text.slice(0, 80) })
+      byKey.set(key, { ...cur, signal: h.signal, note: cur.note || maskDisplay(h.text).slice(0, 80) })
     } else {
       const name = displayNameFromSignalText(h.text)
       if (!name || isSignalNameNoise(name)) continue
       byKey.set(key, {
         name,
         role: '',
-        note: h.text.slice(0, 80),
+        note: maskDisplay(h.text).slice(0, 80),
         signal: h.signal,
         source: 'signal',
       })
@@ -1099,14 +1106,14 @@ function extractStakeholders(eng) {
 
 // Risks: table rows AND dated CLI/debrief bullets. Empty template cells ignored.
 function extractRisks(eng) {
-  const md = readClean(eng, 'risks.md')
+  const md = stripTemplateNoise(readClean(eng, 'risks.md'))
   const body = md.split(/^#{1,6}\s+Retired\b/im)[0] || md
   const HIGH = /critical|blocker|exposure|breach|urgent|at risk|at stake|\brace\b|rollback|no test/i
   const out = []
   const seen = new Set()
   const push = (text) => {
     const t = String(text || '').trim()
-    if (!t || seen.has(t.toLowerCase())) return
+    if (!t || /^(?:\[[xX]\]\s|(?:closed|resolved|retired)\s*:)/i.test(t) || seen.has(t.toLowerCase())) return
     seen.add(t.toLowerCase())
     out.push({ text: t, severity: HIGH.test(t) ? 'high' : 'med' })
   }
@@ -1114,13 +1121,23 @@ function extractRisks(eng) {
   if (table) {
     const riskIdx = colIndex(table.headers, /^risk$/i)
     if (riskIdx !== -1) {
-      for (const cs of table.rows) push(cs[riskIdx])
+      const statusIdx = colIndex(table.headers, /^status$/i)
+      for (const cs of table.rows) {
+        if (statusIdx !== -1 && /^(closed|resolved|retired)$/i.test((cs[statusIdx] || '').trim())) continue
+        push(cs[riskIdx])
+      }
     }
   }
   for (const raw of body.split('\n')) {
     const t = raw.trim()
     const m = t.match(/^-\s*\[\d{4}-\d{2}-\d{2}\]\s*(?:\[@[^\]]+\]\s*)?(.*)$/)
     if (m) push(m[1])
+    else {
+      // Inherited Markdown may predate the dated CLI format. Keep its open
+      // bullets visible; absence of a date does not mean absence of a risk.
+      const bullet = t.match(/^[-*+]\s+(.*)$/)
+      if (bullet && !/^\[[xX]\]\s/.test(bullet[1])) push(bullet[1].replace(/^\[ \]\s*/, ''))
+    }
   }
   return out
 }
@@ -1416,7 +1433,7 @@ function cmdResume(args) {
   const policy = readClean(eng, 'trust-profile.md')
   const success = readClean(eng, 'success.md')
   const risks = readClean(eng, 'risks.md')
-  process.stdout.write(context.boundedSections([
+  process.stdout.write(maskedSections([
     policy ? `CLIENT POLICY - trust-profile.md\n${policy}` : '',
     `${intro}\n\nENGAGEMENT: ${eng}`,
     success ? `CURRENT GOALS & ACCEPTANCE - success.md\n${success}` : '',
@@ -1541,7 +1558,8 @@ function cmdLog(args) {
     return
   }
   if (type === 'delivery' && text.includes('|')) {
-    const cells = text.split('|').map(s => s.trim())
+    let cells
+    try { cells = deliveryCells(text) } catch (error) { console.error(error.message); process.exitCode = 1; return }
     appendValueLedgerRow(eng, cells)
     const hash = memoryHead(eng)
     console.log(`logged → delivery.md (value ledger)${hash ? ` @${hash}` : ''}`)
@@ -1821,6 +1839,7 @@ function readDebriefInput(args) {
 }
 
 function previewLine(text, max = 240) {
+  text = masking.mask(text)
   const t = String(text || '').replace(/\s+/g, ' ').trim()
   if (t.length <= max) return t
   return `${t.slice(0, max)}… (${t.length} chars)`
@@ -1834,7 +1853,8 @@ function writeProposal(eng, text, { replace = false, locked = false } = {}) {
     finally { ownedDebriefLocks.delete(path.join(eng, DEBRIEF_PROPOSE)) }
   }, { soft: true })
   if (!debriefTransactionActive) return withDebriefRecords(eng, () => writeProposal(eng, text, { replace, locked: true }), [DEBRIEF_PROPOSE, DEBRIEF_PRIVATE, DEBRIEF_SEAL])
-  const { clean, blocks } = splitPrivate(text, { sealDangling: true })
+  const { clean: original, blocks } = splitPrivate(text, { sealDangling: true })
+  const clean = masking.mask(original)
   const proposePath = path.join(eng, DEBRIEF_PROPOSE)
   const privatePath = path.join(eng, DEBRIEF_PRIVATE)
   if (fs.existsSync(proposePath) && !replace) {
@@ -1876,6 +1896,9 @@ function stripApprovedStamp(text) {
 // One screen a human can confirm in two minutes. The file-by-file routing
 // still prints after this - agents edit prefixes; people read this.
 function printDebriefReview(text, eng) {
+  text = masking.restore(text)
+  const repeats = repeatedDebriefStatements(eng, text)
+  if (repeats.length) console.log(`REPLAY WARNING: ${repeats.length} source-backed statement(s) already recorded. Review newer facts and next action; applying again requires --allow-replay.\n`)
   const buckets = { decided: [], asked: [], scope: [], delivery: [], open: [], next: [], signer: [] }
   for (const raw of String(text || '').split('\n')) {
     const line = raw.trim().replace(/^[-*+]\s+/, '')
@@ -2048,11 +2071,42 @@ function boundedDebriefPreview(eng, render, { proposal = true, maxBytes = 12000
   return result
 }
 
-function routeDebriefInput(eng, input, { dry, force, sealed = [] }) {
+function deliveryCells(text) {
+  const cells = text.split('|').map(s => s.trim())
+  if (cells.length !== 7) throw new Error('delivery needs exactly 7 fields: Slice | Bucket | Promised | Measured | Accepted by | Evidence | Rollback. Use pending for unknowns; omit pipes for a narrative note.')
+  return cells
+}
+
+// Exact sourced statement replay only; a shared source may contain new facts.
+// Do not silently deduplicate: the engineer decides whether a repeated event is intended.
+function repeatedDebriefStatements(eng, input) {
+  const repeats = []
+  const records = new Map()
+  const normalize = value => value.replace(/\s*\|\s*/g, '|').replace(/\s+/g, ' ').trim()
+  for (const raw of splitPrivate(input, { sealDangling: true }).clean.split('\n')) {
+    const match = raw.trim().replace(/^[-*+]\s+/, '').match(/^(decision|risk|delivery|contact):\s*(.+)$/i)
+    if (!match || !/\[source:[^\]]+\]/i.test(match[2])) continue
+    const body = match[2].trim()
+    const file = LOG_FILES[match[1].toLowerCase()]
+    if (!records.has(file)) {
+      const statements = String(readClean(eng, file) || '').split('\n').map(line => {
+        if (/^\s*\|/.test(line)) return normalize(line.trim().replace(/^\|\s*\d{4}-\d{2}-\d{2}\s*\|/, '').replace(/\|\s*$/, ''))
+        return normalize(line.replace(/^\s*[-*+]\s+/, '').replace(/^(?:\[(?:\d{4}-\d{2}-\d{2}|@[^\]]+|signal:[^\]]+)\]\s*)+/, ''))
+      })
+      records.set(file, new Set(statements))
+    }
+    if (records.get(file).has(normalize(body))) repeats.push(body)
+  }
+  return repeats
+}
+
+function routeDebriefInput(eng, input, { dry, force, sealed = [], allowReplay = false }) {
+  input = masking.restore(input)
+  masking.mask(splitPrivate(input, { sealDangling: true }).clean)
   if (!dry && !debriefTransactionActive) {
     ensureMemoryGit(eng)
     return withDebriefRecords(eng, () => {
-      const result = routeDebriefInput(eng, input, { dry, force, sealed })
+      const result = routeDebriefInput(eng, input, { dry, force, sealed, allowReplay })
       // Consuming the review is part of the write. If cleanup fails, restoring
       // both the records and proposal makes the next explicit apply safe.
       for (const file of [DEBRIEF_PROPOSE, DEBRIEF_PRIVATE, DEBRIEF_SEAL]) {
@@ -2063,12 +2117,14 @@ function routeDebriefInput(eng, input, { dry, force, sealed = [] }) {
       return result
     })
   }
+  const repeats = repeatedDebriefStatements(eng, input)
+  if (repeats.length && !dry && !allowReplay) throw new Error('source-backed statement already recorded; review the existing record and newer next action. Explicitly confirm a repeat with --allow-replay, or remove the repeated statement from the proposal.')
   const d = new Date()
   const date = d.toISOString().slice(0, 10)
   const counts = { decision: 0, risk: 0, delivery: 0, contact: 0, next: 0, signer: 0 }
   const ctxLines = []
   let nextAction = ''
-  ensureMemoryGit(eng)
+  if (!dry) ensureMemoryGit(eng)
   // Sealed blocks are pulled out before routing, so a <private> block's interior
   // lines are never previewed and never routed into decisions/risks/stakeholders
   // unsealed. They land verbatim in context.md instead: the preview a human
@@ -2092,7 +2148,7 @@ function routeDebriefInput(eng, input, { dry, force, sealed = [] }) {
         const who = body.replace(/\s+signs?(?:\s+off)?\b.*$/i, '').trim() || body.trim()
         if (dry) {
           console.log(`→ success.md  **Stakeholder who signs off:** ${previewLine(who)}`)
-          console.log(`→ stakeholders.md  ${previewLine(datedEntry(eng, date, `${who} signs off`))}`)
+          console.log(`→ stakeholders.md  ${previewLine(`- [${date}] ${who} signs off`)}`)
         } else {
           setSigner(eng, who)
           appendLogEntry(eng, 'contact', datedEntry(eng, date, `${who} signs off`), { skipCommit: true })
@@ -2106,9 +2162,16 @@ function routeDebriefInput(eng, input, { dry, force, sealed = [] }) {
         counts.next++
         continue
       }
+      if (type === 'delivery' && body.includes('|')) {
+        const cells = deliveryCells(body)
+        if (dry) console.log(`→ delivery.md ## Value ledger  ${previewLine(body)}`)
+        else appendValueLedgerRow(eng, cells, { skipCommit: true })
+        counts.delivery++
+        continue
+      }
       const sigInline = (body.match(/\[signal:(red|amber|green)\]/i) || [])[1]
       if (sigInline) body = body.replace(/\[signal:(red|amber|green)\]/i, '').trim()
-      const entry = datedEntry(eng, date, body, type === 'contact' && sigInline ? sigInline.toLowerCase() : '')
+      const entry = dry ? `- [${date}]${type === 'contact' && sigInline ? ` [signal:${sigInline.toLowerCase()}]` : ''} ${body}` : datedEntry(eng, date, body, type === 'contact' && sigInline ? sigInline.toLowerCase() : '')
       if (dry) console.log(`→ ${LOG_FILES[type]}  ${previewLine(entry)}`)
       else appendLogEntry(eng, type, entry, { skipCommit: true })
       counts[type]++
@@ -2147,6 +2210,25 @@ function cmdDebrief(args) {
 
 function runDebrief(args, eng) {
   args = args.slice()
+  const replayIdx = args.indexOf('--allow-replay')
+  const allowReplay = replayIdx !== -1
+  if (allowReplay) args.splice(replayIdx, 1)
+  if (args.includes('--review')) {
+    if (args.length !== 1 || allowReplay) throw new Error('use debrief --review alone to inspect the pending proposal')
+    const proposal = path.join(eng, DEBRIEF_PROPOSE)
+    const refused = refuseSymlinkWrite(proposal, { soft: true })
+    if (refused) throw new Error(refused)
+    if (!fs.existsSync(proposal)) throw new Error('nothing to review - run debrief --smart <notes> first')
+    const stored = fs.readFileSync(proposal, 'utf8')
+    if (splitPrivate(stored, { sealDangling: true }).blocks.length) throw new Error('pending proposal contains raw private content: do not open it with an agent. Recreate it through debrief --smart from local notes, using --replace-proposal only after confirmation.')
+    const { clean: input } = splitPrivate(masking.restore(stored), { sealDangling: true })
+    const safe = masking.mask(input)
+    if (safe !== stored) atomicWriteFile(proposal, safe, { mode: 0o600, soft: true })
+    return boundedDebriefPreview(eng, () => {
+      printDebriefReview(input, eng)
+      routeDebriefInput(eng, input, { dry: true, force: false })
+    })
+  }
   const dryIdx = args.indexOf('--dry-run')
   const dry = dryIdx !== -1
   if (dry) args.splice(dryIdx, 1)
@@ -2178,6 +2260,7 @@ function runDebrief(args, eng) {
       console.error('nothing to apply - run: fde debrief --smart <notes.md>   then   fde debrief --apply')
       return void (process.exitCode = 1)
     }
+    input = masking.restore(input)
     sealed = readSealedProposal(eng)
     const expected = readSealCount(eng)
     if (expected === null ? (!sealed.length && input.includes(PRIVATE_MARKER)) : sealed.length < expected) {
@@ -2202,14 +2285,14 @@ function runDebrief(args, eng) {
     if (!apply) {
       console.log(`\nproposal saved → ${proposePath}`)
       console.log('confirm:  fde debrief --apply')
-      console.log('(edit the propose file first if a line mis-routed)')
+      console.log('(edit the propose file if mis-routed; debrief --review shows the pending REVIEW)')
       return
     }
     input = clean
     sealed = blocks
   }
 
-  const route = () => routeDebriefInput(eng, input, { dry, force, sealed })
+  const route = () => routeDebriefInput(eng, input, { dry, force, sealed, allowReplay })
   const { counts, ctxLines, privateBlocks } = boundedDebriefPreview(eng, route, { proposal: false, maxBytes: smart ? 4000 : 12000 })
   if (!dry) {
     const hash = commitMemory(eng, 'debrief', {
@@ -2399,7 +2482,7 @@ function cmdIngest(args) {
   const body = [
     '---',
     `source: ${source}`,
-    `title: ${title.replace(/\n/g, ' ').slice(0, 120)}`,
+    `title: ${title.replace(/\n/g, ' ')}`,
     `staged: ${new Date().toISOString()}`,
     `id: ${id}`,
     '---',
@@ -2432,15 +2515,33 @@ function cmdReceipts(args) {
     document.split('\n').forEach((line, i) => {
       if (!line.toLowerCase().includes(term.toLowerCase())) return
       const source = decisionSources.get(i + 1) || sourceReference(line)
-      const hit = `  ${file}:${i + 1}  ${line.trim().slice(0, 160)}${source ? ` [source: ${source.slice(0, 160)}]` : ' [source missing]'}${dirty.has(file) ? '  dirty file - review manual edits' : ''}`
-      ;(recordFiles.includes(file) && source ? records : claims).push(hit)
+      const hit = `  ${file}:${i + 1}  ${masking.mask(line.trim()).slice(0, 160)}${source ? ` [source: ${masking.mask(source).slice(0, 160)}]` : ' [source missing]'}${dirty.has(file) ? '  dirty file - review manual edits' : ''}`
+      ;(recordFiles.includes(file) && source ? records : claims).push({ file, hit })
     })
   }
-  const sections = ['RECEIPTS: a cited record is not proof of customer approval. File line numbers refer to the redacted view.']
-  if (records.length) sections.push('ON RECORD (dated, source-backed):\n' + records.join('\n'))
-  if (claims.length) sections.push('CLAIMS & working notes (verify source and approval before citing):\n' + claims.join('\n'))
+  // Alternate the latest and earliest matching lines per file. Otherwise a
+  // long history can spend the entire packet on approvals before a withdrawal.
+  const select = hits => {
+    const groups = new Map()
+    for (const { file, hit } of hits) {
+      if (!groups.has(file)) groups.set(file, [])
+      groups.get(file).push(hit)
+    }
+    const selected = []
+    let latest = true
+    while (selected.length < 24 && [...groups.values()].some(group => group.length)) {
+      for (const group of groups.values()) {
+        if (group.length && selected.length < 24) selected.push(latest ? group.pop() : group.shift())
+      }
+      latest = !latest
+    }
+    return `Selected ${selected.length} of ${hits.length} matching lines; omitted matches require a narrower search.\n` + selected.join('\n')
+  }
+  const sections = ['RECEIPTS: a cited record is not proof of customer approval. File line numbers refer to the redacted view. Latest and earliest matching lines are sampled; file order is not authority. Check conflicting records.']
+  if (records.length) sections.push('ON RECORD (dated, source-backed):\n' + select(records))
+  if (claims.length) sections.push('CLAIMS & working notes (verify source and approval before citing):\n' + select(claims))
   if (!records.length && !claims.length) sections.push(`no record of "${term}" - a gap in the record, not proof of absence`)
-  process.stdout.write(context.boundedSections(sections))
+  process.stdout.write(maskedSections(sections))
 }
 
 // Portable snapshot; stdout is read-only. --out creates a new file and never
@@ -2468,12 +2569,13 @@ function cmdHandoff(args, label = 'Handoff') {
   const decisionText = d => `${d.text} (decisions.md:${d.line}, redacted view)`
   const next = stripTemplateNoise(sectionBody(readClean(eng, 'context.md'), 'Next action', { lastNonEmpty: true }))
   const gaps = collectDoctorIssues(eng, { readiness: true })
-  const report = context.boundedSections([
+  const report = maskedSections([
     `# ${label}: ${engagementSlugFromPath(eng)}\nSnapshot: ${new Date().toISOString()} · memory ${memoryHead(eng) || 'unversioned'}\nRead-only record, not proof of approval. Confirm sources with the named customer before relying on a claim. Private blocks are excluded; review remaining client information before sharing.`,
     `## Constraints - trust-profile.md\n${stripTemplateNoise(readClean(eng, 'trust-profile.md')) || '(missing)'}`,
     `## Signer and success - success.md\nSigner: ${signer || '(missing; do not infer)'}\n${success || '(missing)'}`,
     `## Next action - context.md\n${next || '(missing)'}\n\n## Open risks - risks.md\n${extractRisks(eng).map(r => '- ' + r.text).join('\n') || '(none recorded; not proof of no risk)'}`,
-    `## Accepted value - recorded assertion with source\nOnly structured value-ledger rows are summarized here; review other notes in delivery.md before presenting or handing over this record.\n${ledger.filter(r => r.state === 'accepted').map(rowText).join('\n') || '(none)'}\n\n## CLAIMS and unmeasured promises\n${ledger.filter(r => r.state !== 'accepted').map(r => rowText(r) + ' [' + r.state + ']').join('\n') || '(none)'}`,
+    label === 'Handoff' ? `## Operational handoff - handoff.md\n${stripTemplateNoise(readClean(eng, 'handoff.md')) || '(missing; record recovery steps and the operating owner before rotation)'}` : '',
+    `## Accepted value - recorded assertion with source\nOnly structured value-ledger rows are summarized here; review other notes in delivery.md before presenting or handing over this record.\n${ledger.filter(r => r.state === 'accepted').map(rowText).join('\n') || '(none)'}\n\n## CLAIMS and unmeasured promises\n${ledger.filter(r => r.state !== 'accepted').map(r => rowText(r) + ' [' + r.state + ']' + (r.acceptanceIssue ? '; ' + r.acceptanceIssue : '')).join('\n') || '(none)'}`,
     `## ON RECORD decisions - source supplied, not automatic approval\n${records.map(decisionText).join('\n') || '(none)'}\n\n## CLAIM decisions - source missing\n${claims.map(decisionText).join('\n') || '(none)'}\nSelected ${selected.length} of ${decisions.length} dated decisions. Retrieve older or conflicting decisions with fde recall.`,
     `## Gaps before relying on this packet\n${gaps.map(g => '- ' + g).join('\n') || '(no deterministic lint gaps; human review still required)'}`,
   ], parsed.maxBytes)
@@ -2499,9 +2601,9 @@ function cmdRecall(args) {
   }
   const eng = resolveEngagement()
   if (!eng) { console.error('no engagement - bind a client before recall'); process.exit(2) }
-  const files = ['context.md', 'trust-profile.md', 'success.md', 'decisions.md', 'risks.md', 'delivery.md', 'stakeholders.md', 'brief.md', 'reality.md', 'assumptions.md', 'terrain.md']
-  const result = context.recallSections(files.map(file => ({ file, text: readClean(eng, file) })), query)
-  process.stdout.write(context.boundedSections([
+  const files = ['context.md', 'trust-profile.md', 'success.md', 'decisions.md', 'risks.md', 'delivery.md', 'stakeholders.md', 'brief.md', 'reality.md', 'assumptions.md', 'terrain.md', 'handoff.md']
+  const result = context.recallSections(files.map(file => ({ file, text: readClean(eng, file) })), query, 12, masking.mask)
+  process.stdout.write(maskedSections([
     `RECALL - ${eng}\n${result.total ? `${result.sections.length} of ${result.total} matching lines; refine the query if evidence is omitted.` : 'No matching record. This is not proof that the event never happened.'}\nSources are local record assertions; verify dates, supersession and approval scope.`,
     ...result.sections,
   ], maxBytes))
@@ -2512,7 +2614,7 @@ function cmdCapture() {
   if (!eng) process.exit(0) // silent: capture must never break a session
   // Workspace git facts (cwd), not the engagement memory repo.
   const branch = sh('git branch --show-current')
-  const lastCommit = sh("git log -1 --format='%h %s'").slice(0, 100)
+  const lastCommit = sh("git log -1 --format='%h %s'")
   // porcelain lines are "XY path" - sh() trims, so parse by first whitespace
   const changed = sh('git status --porcelain').split('\n').filter(Boolean).slice(0, 8)
     .map(l => l.trim().split(/\s+/).slice(1).join(' ')).join(' ')
@@ -2729,12 +2831,20 @@ function successContractIssues(success) {
     if (active !== -1 && line.trim()) checks[active] += ` ${line.trim()}`
   }
   const observable = checks.some(check => {
+    // This is a lint check, not a semantic proof. Explicit fields let any
+    // domain describe its test without depending on a vocabulary of verbs.
+    const target = /(?:\b(?:within|under|at most|at least|exactly|zero|no missing|no duplicate|all|every|none|true|false|pass|fail|http)\b|[<>=])/i
+    const vague = /\b(?:tbd|unknown|to be defined|improve|better|satisfactory|as expected|works well)\b/i
+    if (vague.test(check)) return false
+    const explicit = check.match(/(?:^|\s)(?:-\s*)?Input:\s*(.+?)\s+(?:-\s*)?Pass when:\s*(.+)$/i)
+    if (explicit) return explicit[1].trim().length > 3 && target.test(explicit[2])
     const stimulus = /\b(?:test|drill|replay|runs?|request|sample|given|when|simulate|inject|compare|restore|verified|observed|measured)\b/i.test(check)
+      || /^\d+\s+[a-z]/i.test(check)
     const result = /\b(?:returns?|rejects?|matches?|equals?|arrives?|alerts?|restores?|passes?|fails?|contains?|produces?|shows?|remains?|receives?)\b/i.test(check)
-    const target = /(?:\b(?:within|under|at most|at least|exactly|zero|no missing|no duplicate|all|every|none|true|false|pass|fail|http)\b|[<>=])/i.test(check)
-    return stimulus && result && target && !/\b(?:tbd|to be defined|improve|better|satisfactory|as expected|works well)\b/i.test(check)
+      || /\b(?:zero|no duplicate|no missing)\s+[a-z]/i.test(check)
+    return stimulus && result && target.test(check)
   })
-  if (!observable) issues.push('success.md needs a binary acceptance check: state a test/input and an observable pass/fail result under **Done when:** or **Acceptance check:**; numbers alone are not a check')
+  if (!observable) issues.push('success.md needs a binary acceptance check: the wording was not recognized as a test/input and observable pass/fail result under **Done when:** or **Acceptance check:**. Use Input: and Pass when: for a domain-specific check; this lint does not prove readiness')
   const signerLine = ((text.match(/^\*\*Stakeholder who signs off:\*\*[^\S\n]*(.*)$/m) || [])[1] || '').replace(/\[source:[^\]]+\]/gi, '').trim()
   // A named primary signer may be followed by responsibilities or another
   // signer's role. Preserve the full record; validate only the leading name.
@@ -2849,7 +2959,7 @@ function collectDoctorIssues(eng, { readiness = false } = {}) {
   }
   const dupes = findDuplicateOpenRisks(eng)
   if (dupes.length) {
-    const sample = (dupes[0][0] || '').replace(/\s+/g, ' ').trim().slice(0, 60)
+    const sample = maskDisplay((dupes[0][0] || '').replace(/\s+/g, ' ').trim()).slice(0, 60)
     issues.push(
       `${dupes.length} duplicate open-risk cluster(s) (e.g. "${sample}${sample.length >= 60 ? '…' : ''}") - consolidate or retire echoes in risks.md`
     )
@@ -2997,7 +3107,7 @@ function hasValueBucket(eng) {
 }
 
 // Shared classification keeps CLI, dashboard, and vault acceptance consistent.
-const { PENDING_CELL_RE, valueState, evidenceSource } = require('./lib/value-ledger')
+const { PENDING_CELL_RE, valueState, evidenceSource, reconcileValueRows } = require('./lib/value-ledger')
 
 function parseValueLedger(eng) {
   // Last section with actual rows, not merely the last non-empty one: a template
@@ -3027,9 +3137,9 @@ function parseValueLedger(eng) {
     const evidence = cell(row, idx.evidence)
     const acceptanceStatus = idx.acceptanceStatus === -1 ? undefined : cell(row, idx.acceptanceStatus)
     const state = valueState({ measured, accepted, acceptanceStatus, evidence })
-    rows.push({ slice, promised, measured, accepted, evidence, evidenceMissing: !evidenceSource(evidence), state })
+    rows.push({ slice, promised, measured, accepted, acceptanceStatus, evidence, evidenceMissing: !evidenceSource(evidence), state })
   }
-  return { rows, columnMissing: idx.accepted === -1 }
+  return { rows: reconcileValueRows(rows, readClean(eng, 'success.md')), columnMissing: idx.accepted === -1 }
 }
 
 function claimedValueRows(eng) {
@@ -3046,8 +3156,9 @@ function formatValueLedgerLine(r) {
   }
   const head = body ? `${name}: ${body}` : name
   if (r.state === 'accepted') return `${head} · accepted by ${r.accepted}`
-  if (r.state === 'claimed') return `${head} · claimed, not yet accepted`
-  return `${head} · not yet measured`
+  const issue = r.acceptanceIssue ? `; ${r.acceptanceIssue}` : ''
+  if (r.state === 'claimed') return `${head} · claimed, not yet accepted${issue}`
+  return `${head} · not yet measured${issue}`
 }
 
 function valueLedgerStatusLines(eng, opts = {}) {
@@ -3124,7 +3235,7 @@ function hasEvalReceipt(eng) {
 function hygieneTriageLines(eng) {
   const issues = collectDoctorIssues(eng)
   if (!issues.length) return []
-  const top = issues[0].replace(/\s+/g, ' ').trim().slice(0, 72)
+  const top = maskDisplay(issues[0].replace(/\s+/g, ' ').trim()).slice(0, 72)
   return [
     `  hygiene: ${issues.length} issue(s) - ${top}${issues[0].length > 72 ? '…' : ''}`,
     '    → say "@fde clean up the fieldbook" when ready (agent runs fde doctor; nothing auto-rewrites), or: fde doctor',
@@ -3164,14 +3275,14 @@ function recordDigest(eng) {
   const signer = ((success.match(/^\*\*Stakeholder who signs off:\*\*[^\S\n]*(.*)$/m) || [])[1] || '').trim()
   // "(none)" rather than a missing line: on session start, nobody named to sign
   // off is the fact worth seeing, not an absence to scroll past.
-  const lines = [`  signer: ${signer.slice(0, 110) || '(none)'}`]
+  const lines = [`  signer: ${masking.mask(signer).slice(0, 110) || '(none)'}`]
   const { rows } = parseValueLedger(eng)
   const promisedRow = [...rows].reverse().find(r => r.promised)
   if (promisedRow) {
-    lines.push(`  promised: ${formatValueLedgerLine(promisedRow).slice(0, 110)}`)
+    lines.push(`  promised: ${masking.mask(formatValueLedgerLine(promisedRow)).slice(0, 110)}`)
   } else {
     const target = ((success.match(/^\*\*Baseline[^\S\n]*→[^\S\n]*target:\*\*[^\S\n]*(.*)$/m) || [])[1] || '').trim()
-    if (target) lines.push(`  promised: ${target.slice(0, 110)}`)
+    if (target) lines.push(`  promised: ${masking.mask(target).slice(0, 110)}`)
   }
   const decisions = datedDecisions(readClean(eng, 'decisions.md')).slice(-2)
   for (const d of decisions) lines.push(`  decided: ${formatDecisionRecord(d.text)}; source: ${previewLine(sourceReference(d.text) || '(missing)', 100)}`)
@@ -3226,7 +3337,7 @@ function cmdRedact(args) {
   }
   console.log(`REDACT - ${hits.length} matching line(s) for ${JSON.stringify(term)}`)
   hits.slice(0, 20).forEach(h => {
-    const preview = h.line.length > 100 ? h.line.slice(0, 97) + '…' : h.line
+    const preview = h.line.length > 100 ? masking.mask(h.line).slice(0, 97) + '…' : h.line
     console.log(`  ${h.file}:${h.lineNo}  ${preview}`)
   })
   if (hits.length > 20) console.log(`  … +${hits.length - 20} more`)
@@ -3271,12 +3382,12 @@ function cmdPrep(args) {
   const people = extractStakeholders(eng).slice(0, 8)
   console.log('\nStakeholders (table + signal history)')
   if (!people.length) console.log('  (none yet - log contacts with --signal)')
-  else people.forEach(p => console.log(`  [${p.signal}] ${p.name}${p.role ? ` - ${p.role}` : ''}${p.note ? ` · ${p.note.slice(0, 60)}` : ''}`))
+  else people.forEach(p => console.log(`  [${p.signal}] ${p.name}${p.role ? ` - ${p.role}` : ''}${p.note ? ` · ${masking.mask(p.note).slice(0, 60)}` : ''}`))
 
   const risks = extractRisks(eng).slice(0, 5)
   console.log('\nOpen risks (table + dated bullets)')
   if (!risks.length) console.log('  (none logged)')
-  else risks.forEach(r => console.log(`  [${r.severity}] ${r.text.slice(0, 100)}`))
+  else risks.forEach(r => console.log(`  [${r.severity}] ${masking.mask(r.text).slice(0, 100)}`))
 
   const success = firstLine(readClean(eng, 'success.md'), 160)
   console.log('\nSuccess looks like')
@@ -3287,7 +3398,7 @@ function cmdPrep(args) {
     .slice(-5)
   console.log('\nRecent decisions')
   if (!decisions.length) console.log('  (none logged)')
-  else decisions.forEach(l => console.log(`  ${l.trim().slice(0, 120)}`))
+  else decisions.forEach(l => console.log(`  ${masking.mask(l.trim()).slice(0, 120)}`))
 
   const next = nextActionLine(readClean(eng, 'context.md'))
   console.log('\nWalk in with')
@@ -3327,7 +3438,7 @@ function cmdGarden(args) {
   }
   const dupes = findDuplicateOpenRisks(eng)
   if (dupes.length) {
-    const sample = (dupes[0][0] || '').replace(/\s+/g, ' ').trim().slice(0, 50)
+    const sample = maskDisplay((dupes[0][0] || '').replace(/\s+/g, ' ').trim()).slice(0, 50)
     proposals.push({
       id: 'dedupe-risks',
       kind: 'apply',
@@ -3507,7 +3618,7 @@ function cmdStatus(args) {
       const eng = path.join(ENGAGEMENTS_ROOT, d, '.fde')
       if (!fs.existsSync(eng)) continue
       const s = computeSignals(eng)
-      const note = [s.memoryWarn, (s.dirtyFiles && s.dirtyFiles.length) ? `dirty:${s.dirtyFiles.length}` : '', s.reason || s.topRisk].filter(Boolean).join(' · ').slice(0, 70)
+      const note = maskDisplay([s.memoryWarn, (s.dirtyFiles && s.dirtyFiles.length) ? `dirty:${s.dirtyFiles.length}` : '', s.reason || s.topRisk].filter(Boolean).join(' · ')).slice(0, 70)
       rows.push({ name: d, phase: s.phase, trust: s.trust, signalAge: s.signalAge, stale: s.stale, updated: s.updated, reason: note, memoryWarn: s.memoryWarn, dirtyFiles: s.dirtyFiles, valueLines: valueLedgerStatusLines(eng, { compact: true }) })
     }
   } else {
@@ -3517,7 +3628,7 @@ function cmdStatus(args) {
       process.exit(2)
     }
     const s = computeSignals(eng)
-    const note = [s.memoryWarn, (s.dirtyFiles && s.dirtyFiles.length) ? `dirty:${s.dirtyFiles.length}` : '', s.reason || s.topRisk].filter(Boolean).join(' · ').slice(0, 70)
+    const note = maskDisplay([s.memoryWarn, (s.dirtyFiles && s.dirtyFiles.length) ? `dirty:${s.dirtyFiles.length}` : '', s.reason || s.topRisk].filter(Boolean).join(' · ')).slice(0, 70)
     rows.push({ name: engagementSlugFromPath(eng), phase: s.phase, trust: s.trust, signalAge: s.signalAge, stale: s.stale, updated: s.updated, reason: note, memoryWarn: s.memoryWarn, dirtyFiles: s.dirtyFiles, valueLines: valueLedgerStatusLines(eng) })
   }
   if (!rows.length) { console.log('no engagements yet'); return }
@@ -3991,6 +4102,7 @@ ${fs.existsSync(html) ? `\n  Open the fieldbook:  ${html}` : ''}
 function printUsage() {
   console.log(`fde - deterministic core of fdeops
   fde demo                 the whole loop on a fake client (fde demo --clean removes it)
+  fde privacy              show masking capability and its boundaries
   fde scan                 day-1 recon of this repo (facts, no AI)
   fde resume               load this workspace's engagement memory (bounded)
   fde resume --full        load the complete context.md (no bound)
@@ -4003,6 +4115,8 @@ function printUsage() {
   fde log --undo           remove the last CLI log/debrief entry from memory
   fde debrief [file]       meeting notes → memory (prefixed lines; --dry-run; --force)
   fde debrief --smart      heuristic propose; REVIEW first (decided/asked/open/next/signer); --apply after one confirm
+    --review              inspect the pending REVIEW after editing, without replacing it
+    --allow-replay        explicitly apply already recorded sourced statements after review
     --replace-proposal    explicitly discard a pending review when proposing different notes
   fde ingest stage …       stage raw pull into <engagement>/.inbox/ (not .fde/)
   fde ingest list          list staged inbox items
@@ -4027,12 +4141,32 @@ function printUsage() {
   ingest is a sink only - source MCPs (Granola/Gmail/…) are user-configured; never ambient sync`)
 }
 
-const [cmd, ...args] = process.argv.slice(2)
+const [cmd, ...rawArgs] = process.argv.slice(2)
+let outputBudget
+if (['resume', 'recall', 'handoff', 'defend'].includes(cmd) && !rawArgs.some(a => ['--full', '--init', '--bind', '--out'].includes(a))) {
+  try { outputBudget = context.budgetArgs(rawArgs).maxBytes } catch (_) {}
+}
+require('./lib/masking').protectOutput(masking, { maxBytes: outputBudget })
+let args
+try {
+  args = rawArgs.map(arg => masking.restore(arg))
+  for (const key of ['FDEOPS_ENGAGEMENT', 'FDEOS_ENGAGEMENT']) {
+    if (process.env[key]) process.env[key] = masking.restore(process.env[key])
+  }
+  // Resolve privacy-state failures before a user-authorized argument write.
+  args.forEach(arg => masking.mask(arg))
+}
+catch (e) { console.error(e.message); process.exit(1) }
 if (args.includes('--help') || args.includes('-h') || cmd === 'help' || cmd === '--help' || cmd === '-h') {
   printUsage()
   process.exit(0)
 }
+try {
 switch (cmd) {
+  case 'privacy':
+    if (args.length) { console.error('usage: fde privacy'); process.exitCode = 2; break }
+    console.log(`FDEOps ${require('../package.json').version} - identifier masking enabled by default.\nCLI responses, smart proposals, handoff packets and ingest MCP results use local aliases.\nPatterns: common emails, international/US phones, SSN-shaped identifiers and supported credentials.\nNames and arbitrary sensitive prose are not detected; mark them <private>.\nRaw files, pasted chat, upstream MCP content and local dashboard/vault files bypass this protection.`)
+    break
   case 'demo': cmdDemo(args); break
   case 'scan': cmdScan(); break
   case 'resume': cmdResume(args); break
@@ -4066,3 +4200,8 @@ switch (cmd) {
     // Missing or unknown command must fail - exit 0 made typos look like success in scripts/hooks.
     process.exit(1)
 }
+
+} catch (error) {
+  console.error(error && error.message ? error.message : "command failed")
+  process.exitCode = 1
+}

package/bin/lib/context.js

@@ -45,7 +45,7 @@ function boundedSections(sections, maxBytes = DEFAULT_BYTES) {
 
 // Literal, client-scoped lexical retrieval. Retain independently matching
 // records, including conflicting/older ones; recency never means truth.
-function recallSections(documents, query, maxHits = 12) {
+function recallSections(documents, query, maxHits = 12, outputText = text => text) {
   const words = [...new Set(query.toLocaleLowerCase().split(/\s+/).filter(Boolean))].slice(0, 16)
   const hits = []
   for (const { file, text } of documents) {
@@ -57,7 +57,7 @@ function recallSections(documents, query, maxHits = 12) {
       if (!score) continue
       const first = Math.max(0, i - 1)
       const last = Math.min(lines.length, i + 3)
-      const excerpt = lines.slice(first, last).map(l => Buffer.byteLength(l) <= 1024 ? l : clipUtf8(l, 900) + OMITTED).join('\n')
+      const excerpt = lines.slice(first, last).map(outputText).map(l => Buffer.byteLength(l) <= 1024 ? l : clipUtf8(l, 900) + OMITTED).join('\n')
       hits.push({ file, line: first + 1, end: last, score, text: excerpt.trim() })
     }
   }