hanoman 0.1.6 → 0.1.8

package/dist/server.js

@@ -4145,22 +4145,20 @@ var init_zod = __esm({
 });
 
 // ../shared/src/enums.ts
-var zStage, zSpecSource, zDocStatus, zPriority, zProjectKind, zAgent, zSeverity, zErrorStatus, zTicketCategory, zTicketStatus, zLinkKind, VERIFY_SCOPES, zVerifyScope;
+var zStage, zSpecSource, zDocStatus, zPriority, zProjectKind, zAgent, zSeverity, zTicketCategory, zTicketStatus, VERIFY_SCOPES, zVerifyScope;
 var init_enums = __esm({
   "../shared/src/enums.ts"() {
     "use strict";
     init_zod();
     zStage = external_exports.enum(["brainstorming", "objective", "spec-ready", "planned", "executing", "done"]);
-    zSpecSource = external_exports.enum(["brief", "qa", "audit", "cross-audit", "help", "goal"]);
+    zSpecSource = external_exports.enum(["brief", "qa", "audit", "help", "goal"]);
     zDocStatus = external_exports.enum(["ok", "drift", "broken"]);
     zPriority = external_exports.enum(["tinggi", "sedang", "rendah"]);
     zProjectKind = external_exports.enum(["from-scratch", "existing"]);
     zAgent = external_exports.enum(["claude", "codex"]);
     zSeverity = external_exports.enum(["critical", "major", "minor"]);
-    zErrorStatus = external_exports.enum(["new", "escalated", "resolved"]);
     zTicketCategory = external_exports.enum(["bug", "fitur", "pertanyaan", "lainnya"]);
     zTicketStatus = external_exports.enum(["new", "accepted", "rejected"]);
-    zLinkKind = external_exports.enum(["api", "sdk", "data", "event", "lainnya"]);
     VERIFY_SCOPES = ["changed", "full"];
     zVerifyScope = external_exports.enum(VERIFY_SCOPES);
   }
@@ -4184,7 +4182,7 @@ function cmpVersion(a, b) {
   }
   return 0;
 }
-var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpec, NOTIFY_SOUNDS, E_5_6, E_LUNA, E_BASE, CODEX_MODELS, RETIRED_CODEX_MODELS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zLeadEngine, zLead, LEAD_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
+var zProject, zBriefPayload, zQaPayload, zGoalPayload, zSpecBlocker, zSpec, NOTIFY_SOUNDS, E_5_6, E_LUNA, E_BASE, CODEX_MODELS, RETIRED_CODEX_MODELS, zCodex, CODEX_DEFAULTS, zSourceCommon, zScheduler, SCHEDULER_DEFAULTS, zGoal, GOAL_DEFAULTS, zConflict, CONFLICT_DEFAULTS, zLeadEngine, zLead, LEAD_DEFAULTS, zSetting, zNotification, zDocFile, zDeviceTokenView;
 var init_entities = __esm({
   "../shared/src/entities.ts"() {
     "use strict";
@@ -4219,9 +4217,7 @@ var init_entities = __esm({
       expected: external_exports.string(),
       actual: external_exports.string(),
       env: external_exports.string(),
-      fromAudit: external_exports.string().optional(),
-      // SPEC-244 · qa dinaikkan dari audit → sinyal skip fase Audit (ADR-0059)
-      fromErrorGroup: external_exports.string().optional()
+      fromAudit: external_exports.string().optional()
     });
     zGoalPayload = external_exports.object({
       goal: external_exports.string(),
@@ -4229,6 +4225,10 @@ var init_entities = __esm({
       constraints: external_exports.string(),
       priority: zPriority
     });
+    zSpecBlocker = external_exports.object({
+      id: external_exports.string(),
+      reason: external_exports.enum(["missing", "unfinished", "unmerged"])
+    });
     zSpec = external_exports.object({
       id: external_exports.string(),
       projectId: external_exports.string(),
@@ -4247,7 +4247,13 @@ var init_entities = __esm({
       // SPEC-408 · ADR-0090 · stempel waktu backlog (ISO string di wire — kolom DateTime di DB).
       // `startedAt` null = belum pernah dikerjakan; ia tak pernah ditulis ulang saat sesi dilanjutkan.
       createdAt: external_exports.string(),
-      startedAt: external_exports.string().nullable()
+      startedAt: external_exports.string().nullable(),
+      // SPEC-447 · ADR-0093 · id backlog yang harus selesai & ter-merge lebih dulu. Server selalu
+      // menormalkannya ke array (kolom DB-nya `Json?`); `.default([])` menjaga respons lama.
+      dependsOn: external_exports.array(external_exports.string()).default([]),
+      // Turunan (bukan kolom): dihitung `liveSpecs` dari stage dependency + git. Klien tak pernah
+      // mengirimkannya — `.default([])` supaya bentuk lama tetap parse.
+      blockedBy: external_exports.array(zSpecBlocker).default([])
     });
     NOTIFY_SOUNDS = [
       "off",
@@ -4296,7 +4302,6 @@ var init_entities = __esm({
       // dikonsumsi daun #5
       sources: external_exports.object({
         backlog: external_exports.object({ ...zSourceCommon, everyMin: external_exports.number().int().min(1).default(15) }).default({}),
-        errors: external_exports.object({ ...zSourceCommon, everyMin: external_exports.number().int().min(1).default(15), minCount: external_exports.number().int().min(1).default(5) }).default({}),
         triase: external_exports.object({ ...zSourceCommon, everyMin: external_exports.number().int().min(1).default(30) }).default({})
       }).default({})
     });
@@ -4329,8 +4334,12 @@ var init_entities = __esm({
       // rem per project (AC-15/US-4)
       everyMin: external_exports.number().int().min(1).max(1440).default(5),
       // denyut proaktif (OQ-2)
-      timeoutSec: external_exports.number().int().min(10).max(900).default(120),
-      // batas waktu satu putusan (AC-4/35)
+      // SPEC-432 · batas waktu satu putusan (AC-4/35). Default 120 dtk MELAWAN prompt lead sendiri
+      // ("kumpulkan bukti dulu: SoT, ADR, plan, kode, riwayat git") dan kalah: satu keputusan `order`
+      // nyata terukur 306 dtk pada claude-opus-5 · xhigh, jadi 7/7 baris jejak operator berstatus
+      // `gagal`. 600 dtk memberi kelonggaran di atas ongkos terukur itu; yang memangkas ongkosnya
+      // sendiri adalah paragraf anggaran waktu di `leadPrompt` (306 dtk → 101 dtk).
+      timeoutSec: external_exports.number().int().min(10).max(900).default(600),
       // AC-11 / OQ-10 · berapa jawaban otomatis berturut-turut untuk SATU sesi sebelum lead berhenti.
       maxAutoAnswers: external_exports.number().int().min(1).max(20).default(3),
       // OQ-3 · syarat objektif sebelum lead boleh mengintegrasikan ke branch utama. Default MENYALA:
@@ -4372,10 +4381,11 @@ var init_entities = __esm({
     });
     zNotification = external_exports.object({
       id: external_exports.string(),
-      // SPEC-249 · +error; SPEC-253 · +ticket; SPEC-298 · +fail (sesi scheduler gagal/limit)
+      // SPEC-253 · +ticket; SPEC-298 · +fail (sesi scheduler gagal/limit)
       // SPEC-409 · +lead (ADR-0091): keputusan berbobot / ragu / tindakan terkunci ditolak. MEMBERI
       // TAHU, bukan meminta izin — tak ada pekerjaan yang menunggu notifikasi ini dibaca (AC-25).
-      type: external_exports.enum(["done", "decision", "error", "ticket", "fail", "lead"]).default("done"),
+      // SPEC-384 · −error (ADR-0092) · dicabut bersama error monitoring.
+      type: external_exports.enum(["done", "decision", "ticket", "fail", "lead"]).default("done"),
       specId: external_exports.string().nullable(),
       sessionId: external_exports.string().nullable(),
       title: external_exports.string(),
@@ -4449,7 +4459,7 @@ var init_agent = __esm({
     });
     CAPABILITIES = [
       { id: "projects:read", domain: "projects", access: "read", label: "Projects \u2014 baca", desc: "Lihat daftar & detail project, branch, binding." },
-      { id: "projects:write", domain: "projects", access: "write", label: "Projects \u2014 tulis", desc: "Buat/ubah/hapus project, rename, clone, DSN, Help Center." },
+      { id: "projects:write", domain: "projects", access: "write", label: "Projects \u2014 tulis", desc: "Buat/ubah/hapus project, rename, clone, Help Center." },
       { id: "backlog:read", domain: "backlog", access: "read", label: "Backlog \u2014 baca", desc: "Lihat spec/backlog, dokumen, review diff." },
       { id: "backlog:write", domain: "backlog", access: "write", label: "Backlog \u2014 tulis", desc: "Buat/ubah/hapus spec, integrate branch." },
       { id: "sessions:read", domain: "sessions", access: "read", label: "Sesi \u2014 baca", desc: "Lihat sesi terminal, fase, review." },
@@ -4462,8 +4472,8 @@ var init_agent = __esm({
       { id: "vps:write", domain: "vps", access: "write", label: "VPS \u2014 tulis", desc: "Kelola VPS, audit, harden, remediasi, konsol (remote exec).", risk: "exec" },
       { id: "settings:read", domain: "settings", access: "read", label: "Settings \u2014 baca", desc: "Baca setelan & config runtime." },
       { id: "settings:write", domain: "settings", access: "write", label: "Settings \u2014 tulis", desc: "Ubah setelan & config runtime." },
-      { id: "support:read", domain: "support", access: "read", label: "Errors & Tiket \u2014 baca", desc: "Lihat error monitoring & tiket Help Center." },
-      { id: "support:write", domain: "support", access: "write", label: "Errors & Tiket \u2014 tulis", desc: "Eskalasi error, ubah status, terima/tolak tiket." },
+      { id: "support:read", domain: "support", access: "read", label: "Tiket \u2014 baca", desc: "Lihat tiket Help Center." },
+      { id: "support:write", domain: "support", access: "write", label: "Tiket \u2014 tulis", desc: "Terima/tolak tiket, ubah status, promosikan ke backlog." },
       { id: "notifications:read", domain: "notifications", access: "read", label: "Notifikasi \u2014 baca", desc: "Lihat notifikasi." },
       { id: "notifications:write", domain: "notifications", access: "write", label: "Notifikasi \u2014 tulis", desc: "Tandai terbaca / bersihkan notifikasi." },
       { id: "lead:read", domain: "lead", access: "read", label: "Lead \u2014 baca", desc: "Baca jejak keputusan hanoman-lead & statusnya." },
@@ -4580,9 +4590,9 @@ var init_lead = __esm({
 
 // ../shared/src/dto.ts
 function flowForSource(source) {
-  return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "cross-audit" ? "cross-audit" : source === "goal" ? "goal" : "feature";
+  return source === "qa" ? "qa" : source === "audit" ? "audit" : source === "goal" ? "goal" : "feature";
 }
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zCreateLink, zUpdateProject, zCreateSpec, zPatchSpec, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerState, zLeadDecisionView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, zLogin, zSignup, zChangePassword, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zStackFrame, zSymbolicatedFrame, zSourceMapUpload, zIngestPayload, zErrorGroupView, zErrorEventView, zErrorGroupDetail, zIngestKeyView, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerState, zLeadDecisionView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, zLogin, zSignup, zChangePassword, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, UPDATE_RESTART_EXIT, zUpdateApplyBody, zTicketView, zTicketAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -4632,11 +4642,6 @@ var init_dto = __esm({
     });
     zProjectId = external_exports.string().regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "slug tak sah");
     zRenameProject = external_exports.object({ newId: zProjectId });
-    zCreateLink = external_exports.object({
-      to: external_exports.string().min(1),
-      kind: zLinkKind,
-      note: external_exports.string().max(2e3).optional()
-    });
     zUpdateProject = external_exports.object({
       name: external_exports.string().min(1).optional(),
       desc: external_exports.string().optional(),
@@ -4655,7 +4660,9 @@ var init_dto = __esm({
       title: external_exports.string().min(1),
       priority: zPriority,
       payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]),
-      branchFrom: external_exports.string().min(1).optional()
+      branchFrom: external_exports.string().min(1).optional(),
+      // SPEC-447 · ADR-0093 · divalidasi server (id ada / satu project / bukan diri sendiri / non-siklus).
+      dependsOn: external_exports.array(external_exports.string()).optional()
     }).superRefine((o, ctx) => {
       const shape = "severity" in o.payload ? "qa" : "goal" in o.payload ? "goal" : "brief";
       const want = o.source === "qa" ? "qa" : o.source === "goal" ? "goal" : "brief";
@@ -4669,8 +4676,12 @@ var init_dto = __esm({
       // SPEC-186 · edit konten selagi item belum dimulai. Ditolak server bila sudah mulai.
       title: external_exports.string().min(1).optional(),
       priority: zPriority.optional(),
-      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]).optional()
+      payload: external_exports.union([zBriefPayload, zQaPayload, zGoalPayload]).optional(),
       // SPEC-407 · +goal
+      // SPEC-447 · ADR-0093 · SENGAJA di luar gerbang `editingContent` (SPEC-186): gerbang itu
+      // melindungi konten yang sudah jadi dasar kerja sesi berjalan, sedangkan dependsOn hanya
+      // menggerbangi peluncuran BERIKUTNYA. `[]` = kosongkan.
+      dependsOn: external_exports.array(external_exports.string()).optional()
     });
     zIntegrate = external_exports.object({
       op: external_exports.enum(["merge", "rebase"]),
@@ -4689,10 +4700,6 @@ var init_dto = __esm({
       session: zSessionSummary,
       activity: external_exports.string(),
       commit: external_exports.string(),
-      monitoringEnabled: external_exports.boolean().default(false),
-      // SPEC-249 · error monitoring aktif (ingest key ada)
-      ingestKeyPrefix: external_exports.string().nullable().default(null),
-      // SPEC-249 · hint prefix DSN (bukan hash/rahasia)
       helpEnabled: external_exports.boolean().default(false),
       // SPEC-253 · Help Center publik aktif
       schedulerOptIn: external_exports.boolean().default(false),
@@ -4715,8 +4722,6 @@ var init_dto = __esm({
       id: external_exports.string(),
       enabled: external_exports.boolean(),
       everyMin: external_exports.number(),
-      minCount: external_exports.number().optional(),
-      // hanya errors
       lastRunAt: external_exports.string().nullable(),
       nextRunAt: external_exports.string().nullable()
     });
@@ -4781,7 +4786,7 @@ var init_dto = __esm({
       // id sesi ber-marker keputusan terisi
       lastPulseAt: external_exports.string().nullable()
     });
-    zFlow = external_exports.enum(["feature", "qa", "scaffold", "reverse", "prd", "audit", "breakdown", "cross-audit", "goal"]);
+    zFlow = external_exports.enum(["feature", "qa", "scaffold", "reverse", "prd", "audit", "breakdown", "goal"]);
     zPrdBrief = external_exports.object({
       title: external_exports.string().min(1),
       context: external_exports.string(),
@@ -4856,8 +4861,6 @@ var init_dto = __esm({
       }),
       // SPEC-273 · sesi breakdown project-level: pecah SATU PRD (prdPath) → manifest N backlog.
       external_exports.object({ project: external_exports.string(), flow: external_exports.literal("breakdown"), prdPath: external_exports.string().min(1) }),
-      // SPEC-337 · ADR-0075 · sesi audit lintas project LEPAS (tanya-jawab): tanpa Spec, tanpa fase.
-      external_exports.object({ project: external_exports.string(), flow: external_exports.literal("cross-audit") }),
       // SPEC-222 · scaffold: sesi project-level from-scratch, menyusun SoT dari ide. Tanpa brief
       // (diseed dari Project.desc), tanpa Spec — cermin reverse.
       external_exports.object({ project: external_exports.string(), flow: external_exports.literal("scaffold") }),
@@ -4874,7 +4877,10 @@ var init_dto = __esm({
         goal: external_exports.boolean().optional(),
         goalCondition: external_exports.string().max(4e3).optional(),
         agent: zAgent.optional(),
-        verifyScope: zVerifyScope.optional()
+        verifyScope: zVerifyScope.optional(),
+        // SPEC-447 · ADR-0093 — lewati gerbang dependency. Hanya jalur manusia; UI hanya
+        // mengirimkannya sesudah operator melihat daftar pemblokirnya.
+        force: external_exports.boolean().optional()
       })
     ]);
     zDocFileContent = external_exports.object({ content: external_exports.string() });
@@ -4929,75 +4935,6 @@ var init_dto = __esm({
     zRemediate = external_exports.object({ items: external_exports.array(external_exports.string()).min(1).max(64) });
     UPDATE_RESTART_EXIT = 75;
     zUpdateApplyBody = external_exports.object({ confirm: external_exports.boolean().optional() });
-    zStackFrame = external_exports.object({
-      function: external_exports.string().max(500).optional(),
-      filename: external_exports.string().max(2e3).optional(),
-      lineno: external_exports.number().int().optional(),
-      colno: external_exports.number().int().optional(),
-      in_app: external_exports.boolean().optional()
-    });
-    zSymbolicatedFrame = zStackFrame.extend({
-      source: external_exports.string().optional(),
-      sourceLine: external_exports.number().int().optional(),
-      sourceColumn: external_exports.number().int().optional(),
-      contextLine: external_exports.string().optional(),
-      preContext: external_exports.array(external_exports.string()).optional(),
-      postContext: external_exports.array(external_exports.string()).optional(),
-      symbolicated: external_exports.boolean()
-    });
-    zSourceMapUpload = external_exports.object({
-      release: external_exports.string().min(1).max(200),
-      artifacts: external_exports.array(external_exports.object({
-        filename: external_exports.string().min(1).max(2e3),
-        map: external_exports.string().min(1),
-        debugId: external_exports.string().max(200).optional()
-      })).min(1).max(200)
-    });
-    zIngestPayload = external_exports.object({
-      type: external_exports.string().min(1).max(500),
-      message: external_exports.string().min(1),
-      stack: external_exports.string().optional(),
-      frames: external_exports.array(zStackFrame).max(200).optional(),
-      // SPEC-276 · opsional → kompatibel mundur
-      environment: external_exports.string().max(120).optional(),
-      release: external_exports.string().max(200).optional(),
-      context: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-    });
-    zErrorGroupView = external_exports.object({
-      id: external_exports.string(),
-      projectId: external_exports.string(),
-      type: external_exports.string(),
-      message: external_exports.string(),
-      environment: external_exports.string(),
-      status: zErrorStatus,
-      count: external_exports.number().int(),
-      firstSeenAt: external_exports.string(),
-      lastSeenAt: external_exports.string(),
-      specId: external_exports.string().nullable(),
-      release: external_exports.string().nullable()
-      // SPEC-276 · release terakhir grup (korelasi build)
-    });
-    zErrorEventView = external_exports.object({
-      id: external_exports.string(),
-      type: external_exports.string(),
-      message: external_exports.string(),
-      stack: external_exports.string().nullable(),
-      environment: external_exports.string(),
-      release: external_exports.string().nullable(),
-      receivedAt: external_exports.string()
-    });
-    zErrorGroupDetail = zErrorGroupView.extend({
-      sampleStack: external_exports.string().nullable(),
-      sampleFrames: external_exports.array(zSymbolicatedFrame).nullable(),
-      // SPEC-276 · frame tersimbolikasi (bila map ada)
-      events: external_exports.array(zErrorEventView)
-    });
-    zIngestKeyView = external_exports.object({
-      enabled: external_exports.boolean(),
-      prefix: external_exports.string().nullable(),
-      key: external_exports.string().optional(),
-      dsnUrl: external_exports.string().optional()
-    });
     zTicketView = external_exports.object({
       id: external_exports.string(),
       projectId: external_exports.string(),
@@ -5186,15 +5123,6 @@ var init_api = __esm({
       agentTokens: `${API}/agent-tokens`,
       agentToken: (id) => `${API}/agent-tokens/${id}`,
       agentCapabilities: `${API}/agent-tokens/capabilities`,
-      // SPEC-249 · error monitoring. ingest publik ber-DSN (bypass gate cookie, ADR-0060).
-      ingest: (slug) => `${API}/ingest/${encodeURIComponent(slug)}`,
-      errors: `${API}/errors`,
-      errorsGuide: `${API}/errors/integration-guide`,
-      error: (id) => `${API}/errors/${id}`,
-      errorEscalate: (id) => `${API}/errors/${id}/escalate`,
-      errorUnlink: (id) => `${API}/errors/${id}/unlink`,
-      // SPEC-271 · lepas tautan backlog
-      projectIngestKey: (id) => `${API}/projects/${encodeURIComponent(id)}/ingest-key`,
       // SPEC-253 · Help Center publik (bypass gate cookie; otorisasi helpEnabled + kunci opaque tiket).
       help: (slug) => `${API}/help/${encodeURIComponent(slug)}`,
       helpTickets: (slug) => `${API}/help/${encodeURIComponent(slug)}/tickets`,
@@ -5208,9 +5136,6 @@ var init_api = __esm({
       ticketUnlink: (id) => `${API}/tickets/${id}/unlink`,
       // SPEC-271 · lepas tautan backlog
       ticketReject: (id) => `${API}/tickets/${id}/reject`,
-      // SPEC-337 · ADR-0075 · relasi integrasi antar project (LOCAL-only) + log lintas project.
-      projectLinks: (id) => `${API}/projects/${encodeURIComponent(id)}/links`,
-      projectLink: (id, linkId) => `${API}/projects/${encodeURIComponent(id)}/links/${encodeURIComponent(linkId)}`,
       // SPEC-361 · ADR-0078 · unduh dokumen: query ditempelkan ke URL endpoint dokumen yang sudah ada
       // (tak ada endpoint ekspor terpisah). `base` bisa sudah membawa query, mis. ideFile(?path=…).
       download: (base, fmt) => `${base}${base.includes("?") ? "&" : "?"}download=${fmt}`
@@ -5300,7 +5225,6 @@ var init_session_kind = __esm({
       "prd",
       "scaffold",
       "breakdown",
-      "cross-audit",
       "vps",
       "shell",
       "worktree",
@@ -5869,45 +5793,7 @@ Stack: ${project.stack || "\u2014"}`,
 ${REVERSE_STANDARD}`
   ].filter(Boolean).join("\n\n");
 }
-function startCrossAuditPrompt(ctx, mode) {
-  const map = [projectLine(ctx.primary, true), ...ctx.neighbors.map((n) => projectLine(n, false))].join("\n");
-  const scopeNote = ctx.neighbors.length ? "" : 'CATATAN: project ini belum punya relasi integrasi terdaftar, jadi scope-nya hanya dirinya sendiri. Katakan itu di awal jawabanmu \u2014 operator mungkin lupa mendaftarkan relasinya di kartu "Integrasi antar project".';
-  const head = [
-    `hanoman cross-audit. Kamu mengaudit INTEGRASI ANTAR PROJECT \u2014 bukan satu project saja. Semua project di bawah ini berada dalam scope-mu.`,
-    `Project dalam scope:
-${map}`,
-    scopeNote,
-    // ADR-0002 · yang boleh ditulis HANYA worktree sesi — termasuk checkout utama project sendiri
-    // pun read-only. Menyebut repoDir di sini akan mengundang agen menyentuh working tree utama.
-    `Aturan tulis: kamu HANYA boleh menulis di ${ctx.worktree ? `worktree sesi ini (\`${ctx.worktree}\`)` : "direktori kerja sesi ini (worktree-mu)"}. SEMUA checkout project di atas \u2014 termasuk milik project utama \u2014 bersifat READ-ONLY: baca sepuasnya, JANGAN menulis, JANGAN commit di sana, JANGAN menjalankan perintah yang mengubah isinya.`,
-    crossAuditLogGuide(ctx.apiUrl),
-    CROSS_AUDIT_FOCUS
-  ].filter(Boolean);
-  if (mode === "live") {
-    return [
-      ...head,
-      "Ini sesi TANYA-JAWAB: manusia menonton terminal ini dan akan bertanya. Jawab dengan bukti (kutipan kode + baris log beserta waktunya), ringkas dan langsung. Tak ada fase, tak ada dokumen, tak ada commit \u2014 kalau temuannya layak ditindaklanjuti, sarankan membuat backlog audit lintas."
-    ].join("\n\n");
-  }
-  const spec = ctx.spec;
-  const slug = spec.title.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
-  const detail = spec.payload ? `
-Detail: ${JSON.stringify(spec.payload)}` : "";
-  return [
-    ...head,
-    phaseInstruction(PIPELINES["cross-audit"]),
-    `Fase Audit: telusuri akar masalah lintas project (log + kode kedua sisi). Fase Laporan: tulis DOKUMEN AUDIT ke Source of Truth project utama \`internal/docs/research/audit-${spec.id.toLowerCase()}-${slug}.md\` (ikuti konvensi audit yang ada), tautkan di \`internal/docs/README.md\`, memuat: keluhan/pertanyaan, peta integrasi yang diaudit, temuan dengan BUKTI dari tiap project (kutipan kode + baris timeline beserta waktunya), apakah issue terdefinisi baik, dan rekomendasi tindak lanjut \u2014 sebut project mana yang harus ditindaklanjuti. JANGAN menulis perbaikan kode.`,
-    // SPEC-340 · ADR-0076 · cross-audit berdokumen memakai kontrak rekomendasi yang sama dgn audit-only.
-    ESCALATION_CONTRACT,
-    AUTONOMY_CLAUSE,
-    skillInstruction(PIPELINES["cross-audit"]),
-    `Setelah fase terakhir: commit, lalu \`git push origin HEAD:refs/heads/${ctx.branchTo}\`. Worktree ini detached HEAD \u2014 itu memang disengaja.`,
-    `Backlog item ${spec.id} \xB7 sumber ${spec.source} \xB7 prioritas ${spec.priority}
-Judul: ${spec.title}
-Objective: ${spec.objective}${detail}`
-  ].filter(Boolean).join("\n\n");
-}
-var PIPELINES, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, phaseInstruction, PHASE_SKILLS, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, writesCode, scopeClause, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE, projectLine, crossAuditLogGuide, CROSS_AUDIT_FOCUS;
+var PIPELINES, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, phaseInstruction, PHASE_SKILLS, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, writesCode, scopeClause, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE;
 var init_prompt = __esm({
   "../runner/src/prompt.ts"() {
     "use strict";
@@ -5924,7 +5810,6 @@ var init_prompt = __esm({
       breakdown: ["Analisis", "Breakdown"],
       // SPEC-337 · ADR-0075 · audit lintas project: fase & stage-map identik audit-only, scope-nya
       // yang berbeda (project utama + tetangga ProjectLink).
-      "cross-audit": ["Audit", "Laporan"],
       // SPEC-407 · ADR-0089 · backlog goal: tak ada fase perencanaan sama sekali. `Goal` = kerjakan,
       // `Verifikasi` = buktikan. Kedua nama unik lintas PIPELINES — syarat peta REACHED di server,
       // yang berkunci nama fase saja.
@@ -6019,27 +5904,6 @@ ${lines2.join("\n")}` : "";
       "- Objective: kunci SATU MVP objective yang terukur dari hasil brainstorm, tulis ringkas di docs.",
       "- Doc index: tulis SELURUH internal/docs/** dari ide+objective+jawaban, mengikuti STANDAR DOCS di bawah \u2014 entrypoints, product, business, requirements (+EARS dari perilaku yang diinginkan), research, architecture (stack/data-model/api-contract/nfr), adr awal (Status accepted), design-system/frontend bila ada UI, operations, security, plus README index bernomor + CLAUDE.md + AGENTS.md + Stop hook. Lengkap dan spesifik terhadap ide ini, BUKAN kerangka."
     ].join("\n");
-    projectLine = (p, primary) => {
-      const path = p.repoDir ?? "(tak ada checkout lokal di mesin ini \u2014 audit project ini dari log & docs saja)";
-      const head = primary ? `- ${p.id} \xB7 ${p.name} \xB7 PROJECT UTAMA (worktree kamu)` : `- ${p.id} \xB7 ${p.name}`;
-      return [
-        head,
-        `  stack: ${p.stack || "\u2014"}`,
-        `  path: ${path}`,
-        ...p.relation ? [`  relasi: ${p.relation}`] : [],
-        ...p.note ? [`  catatan integrasi: ${p.note}`] : []
-      ].join("\n");
-    };
-    crossAuditLogGuide = (apiUrl) => [
-      `Menarik log: hanoman memberi sesi ini kunci baca ber-scope di env \`$HANOMAN_AUDIT_KEY\` (URL di \`$HANOMAN_AUDIT_URL\`, yaitu ${apiUrl}). Kunci ini HANYA membaca error project di atas, dan mati saat sesi ini berakhir. Panggil berkali-kali sesuai kebutuhan \u2014 jangan puas dengan sekali tarik:`,
-      "```bash",
-      `curl -s -H "X-Hanoman-Audit-Key: $HANOMAN_AUDIT_KEY" "$HANOMAN_AUDIT_URL/logs?since=24h"`,
-      `curl -s -H "X-Hanoman-Audit-Key: $HANOMAN_AUDIT_KEY" "$HANOMAN_AUDIT_URL/logs?since=7d&environment=production&q=timeout"`,
-      `curl -s -H "X-Hanoman-Audit-Key: $HANOMAN_AUDIT_KEY" "$HANOMAN_AUDIT_URL/logs/<groupId>"   # detail + stack`,
-      "```",
-      `Bentuk jawabannya: \`timeline\` = error SEMUA project di atas, TERCAMPUR & terurut waktu \u2014 di situlah korelasi lintas project terlihat (error di satu sisi tepat sesudah kegagalan di sisi lain). \`groups\` = agregat berulang. Filter: \`since\`/\`until\` (\`24h\`|\`7d\`|ISO), \`environment\`, \`q\`, \`projects\`, \`limit\`. Project yang tak punya data error: katakan itu terang-terangan lalu bandingkan kontraknya di level kode \u2014 JANGAN mengarang log.`
-    ].join("\n");
-    CROSS_AUDIT_FOCUS = "Fokus audit lintas: (1) kontrak API yang bergeser antara pemanggil & penyedia (path, bentuk payload, kode status, header auth); (2) versi paket/SDK yang tertinggal di satu sisi; (3) error yang BERKORELASI WAKTU di dua project; (4) environment/release yang tak sejalan antar sisi; (5) asumsi auth, format tanggal/uang, retry & timeout yang berbeda. Setiap temuan harus bersandar pada bukti dari KEDUA sisi \u2014 kutipan kode/kontrak dan/atau baris timeline, lengkap dengan waktunya.";
   }
 });
 
@@ -6144,6 +6008,17 @@ var init_git = __esm({
           { cwd: repo, encoding: "utf8" }
         );
         return r.status === 0 ? r.stdout.trim() : null;
+      },
+      // SPEC-447 · `git merge-base --is-ancestor A B` = exit 0 (ya) / 1 (tidak) / lainnya (error).
+      // `--end-of-options` menjaga ADR-0032: sha & ref datang dari DB/kolom, jangan sampai terbaca
+      // sebagai flag. Ref yang tak resolve membuat git exit 128 → dibaca sebagai "belum" (fail-closed).
+      isAncestor: (repo, sha, ref) => {
+        const r = spawnSync(
+          "git",
+          ["merge-base", "--is-ancestor", "--end-of-options", sha, ref],
+          { cwd: repo, encoding: "utf8" }
+        );
+        return r.status === 0;
       }
     };
   }
@@ -6483,12 +6358,16 @@ function planComplete(worktree, specId) {
   }
   return true;
 }
+function sessionComplete(phases, worktree, specId) {
+  if (!phasesComplete(phases)) return false;
+  return specId ? planComplete(worktree, specId) : true;
+}
 function stageForRun(phases, worktree, specId) {
   const s = stageFor(phases);
   if (s === "done" && !planComplete(worktree, specId)) return "executing";
   return s;
 }
-var phaseFilePath, decisionFilePath, REACHED;
+var phaseFilePath, decisionFilePath, REACHED, phasesComplete;
 var init_session_phases = __esm({
   "src/services/session-phases.ts"() {
     "use strict";
@@ -6508,6 +6387,7 @@ var init_session_phases = __esm({
       Goal: "executing",
       Verifikasi: "done"
     };
+    phasesComplete = (phases) => phases.length > 0 && phases.every((p) => p.state === "done" || p.state === "skipped");
   }
 });
 
@@ -6595,21 +6475,7 @@ function listPanes() {
     throw e;
   }
   return out3.split("\n").filter(Boolean).flatMap((line) => {
-    const [
-      n,
-      projectId,
-      specId,
-      flow,
-      phaseFile,
-      cwd,
-      dead,
-      code,
-      decisionFile,
-      branch,
-      agent,
-      auditKey,
-      auditProjects
-    ] = line.split("	");
+    const [n, projectId, specId, flow, phaseFile, cwd, dead, code, decisionFile, branch, agent] = line.split("	");
     if (!n?.startsWith(PREFIX)) return [];
     const exited = dead === "1";
     return [{
@@ -6622,9 +6488,6 @@ function listPanes() {
       exited,
       code: Number(code) || 0,
       decisionFile: decisionFile || void 0,
-      // SPEC-337 · kunci audit + scope-nya (internal; tak pernah keluar lewat listSessions).
-      auditKey: auditKey || void 0,
-      auditProjects: auditProjects || void 0,
       // SPEC-230 · branch integrasi sesi project-level (PRD: prd/<slug>). Kosong = tak ada.
       branch: branch || void 0,
       // SPEC-196 · sesi hidup dengan marker keputusan terisi = menunggu manusia.
@@ -6640,7 +6503,6 @@ function registerSessionHooks(h) {
 function sessionKind(o, projectId, cwd) {
   if (o.specId) return "spec";
   if (o.flow === "reverse" || o.flow === "prd" || o.flow === "scaffold" || o.flow === "breakdown") return o.flow;
-  if (o.id.startsWith("xaudit-")) return "cross-audit";
   if (projectId.startsWith("vps")) return "vps";
   if (o.command) return "shell";
   if (cwd.includes("/.worktrees/")) return "worktree";
@@ -6654,13 +6516,6 @@ function captureTranscript(id) {
     return null;
   }
 }
-function auditSessionScope(key) {
-  if (!key) return null;
-  const p = listPanes().find((x) => x.auditKey === key && !x.exited);
-  if (!p) return null;
-  const scope = (p.auditProjects ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-  return scope.length ? scope : null;
-}
 function createSession(projectId, cwd, opts = {}) {
   const id = opts.id ?? idFor(opts.specId);
   const existing = getSession(id);
@@ -6776,10 +6631,6 @@ function createSession(projectId, cwd, opts = {}) {
   tmux("set-option", "-t", name(id), "@hanoman_agent", agent);
   if (opts.phaseFile) tmux("set-option", "-t", name(id), "@hanoman_phase_file", opts.phaseFile);
   if (opts.decisionFile) tmux("set-option", "-t", name(id), "@hanoman_decision_file", opts.decisionFile);
-  if (opts.audit) {
-    tmux("set-option", "-t", name(id), "@hanoman_audit_key", opts.audit.key);
-    tmux("set-option", "-t", name(id), "@hanoman_audit_projects", opts.audit.projects.join(","));
-  }
   if (opts.goal && !opts.command) void armGoalInTui(id, opts.goal, { agent }).catch(() => {
   });
   emitBirth({
@@ -6907,10 +6758,11 @@ function end(id, code) {
 function pollPhases(p, a) {
   if (!p.flow || !p.phaseFile) return;
   const phases = readPhases(p.phaseFile, p.flow);
-  const json = JSON.stringify(phases);
+  const complete = sessionComplete(phases, p.cwd, p.specId);
+  const json = phaseKey(phases, complete);
   if (json === a.lastPhases) return;
   a.lastPhases = json;
-  broadcast(a, { t: "phase", phases });
+  broadcast(a, { t: "phase", phases, complete });
 }
 function startPoll() {
   if (poll) return;
@@ -6951,10 +6803,11 @@ function attach(id, c) {
   const a = attached.get(id) ?? open(id);
   a.clients.add(c);
   if (a.scrollback) c.send(frame({ t: "data", d: a.scrollback }));
-  const phases = sessionPhases(id);
-  if (phases) {
-    a.lastPhases = JSON.stringify(phases);
-    c.send(frame({ t: "phase", phases }));
+  if (p.flow && p.phaseFile) {
+    const phases = readPhases(p.phaseFile, p.flow);
+    const complete = sessionComplete(phases, p.cwd, p.specId);
+    a.lastPhases = phaseKey(phases, complete);
+    c.send(frame({ t: "phase", phases, complete }));
   }
 }
 function writeTo(id, d) {
@@ -6991,7 +6844,7 @@ function spawnPty(...args) {
     );
   }
 }
-var socket, PREFIX, MAX_SCROLLBACK, POLL_MS, markerFilled, attached, claudeBin, shellBin, codexBin, agentBin, rootBypassEnv, frame, name, promptFilePath, goalGatePath, goalStatePath, NO_SERVER, TmuxError, sq, sessionIdForSpec, idFor, FMT, listSessions, liveDecisions, getSession, hooks, emitBirth, emitDeath, sleep, paneText, GOAL_ARMED_MARKERS, goalArmed, poll, detach;
+var socket, PREFIX, MAX_SCROLLBACK, POLL_MS, markerFilled, attached, claudeBin, shellBin, codexBin, agentBin, rootBypassEnv, frame, name, promptFilePath, goalGatePath, goalStatePath, NO_SERVER, TmuxError, sq, sessionIdForSpec, idFor, FMT, listSessions, liveDecisions, getSession, hooks, emitBirth, emitDeath, sleep, paneText, GOAL_ARMED_MARKERS, goalArmed, phaseKey, poll, detach;
 var init_pty = __esm({
   "src/services/pty.ts"() {
     "use strict";
@@ -7042,11 +6895,7 @@ var init_pty = __esm({
       "#{pane_dead_status}",
       "#{@hanoman_decision_file}",
       "#{@hanoman_branch}",
-      "#{@hanoman_agent}",
-      // SPEC-337 · ADR-0075 · kunci audit lintas project + scope-nya. Hidup di tmux (bukan DB): selamat
-      // dari restart API, mati bersama pane. TAK PERNAH ikut ke SessionInfo/API — lihat listSessions.
-      "#{@hanoman_audit_key}",
-      "#{@hanoman_audit_projects}"
+      "#{@hanoman_agent}"
     ].join("	");
     listSessions = () => listPanes().map(({ id, projectId, specId, flow, cwd, exited, code, branch, decision, agent }) => ({
       id,
@@ -7093,6 +6942,7 @@ var init_pty = __esm({
       const text = paneText(id);
       return GOAL_ARMED_MARKERS[agent].some((m) => text.includes(m));
     };
+    phaseKey = (phases, complete) => JSON.stringify({ phases, complete });
     detach = (id, c) => {
       attached.get(id)?.clients.delete(c);
     };
@@ -7127,11 +6977,9 @@ var init_outbox = __esm({
 async function renameProjectCore(tx, oldId, newId) {
   await tx.project.update({ where: { id: oldId }, data: { id: newId, updatedAt: /* @__PURE__ */ new Date() } });
   const spec = await tx.spec.count({ where: { projectId: newId } });
-  const errorGroup = await tx.errorGroup.count({ where: { projectId: newId } });
   const ticket = await tx.ticket.count({ where: { projectId: newId } });
   const notification = (await tx.notification.updateMany({ where: { projectId: oldId }, data: { projectId: newId } })).count;
   const sessionResult = (await tx.sessionResult.updateMany({ where: { projectId: oldId }, data: { projectId: newId } })).count;
-  const errorEvent = (await tx.errorEvent.updateMany({ where: { projectId: oldId }, data: { projectId: newId } })).count;
   const ticketAttachment = (await tx.ticketAttachment.updateMany({ where: { projectId: oldId }, data: { projectId: newId } })).count;
   const binding = await tx.localBinding.findUnique({ where: { projectId: oldId } });
   let localBinding = 0;
@@ -7140,7 +6988,7 @@ async function renameProjectCore(tx, oldId, newId) {
     await tx.localBinding.create({ data: { projectId: newId, repoDir: binding.repoDir, createdAt: binding.createdAt } });
     localBinding = 1;
   }
-  return { spec, errorGroup, ticket, notification, sessionResult, errorEvent, ticketAttachment, localBinding };
+  return { spec, ticket, notification, sessionResult, ticketAttachment, localBinding };
 }
 async function renameProject(oldId, newId) {
   if (!zProjectId.safeParse(newId).success) return { ok: false, code: 400, error: "id baru tak sah (slug)" };
@@ -7169,11 +7017,9 @@ var init_rename_project = __esm({
     RENAME_SEP = " ";
     ZERO_AFFECTED = {
       spec: 0,
-      errorGroup: 0,
       ticket: 0,
       notification: 0,
       sessionResult: 0,
-      errorEvent: 0,
       ticketAttachment: 0,
       localBinding: 0
     };
@@ -7184,6 +7030,7 @@ var init_rename_project = __esm({
 var sync_exports = {};
 __export(sync_exports, {
   SYNCED: () => SYNCED,
+  __FIELDS_FOR_TEST: () => __FIELDS_FOR_TEST,
   applyPush: () => applyPush,
   backfillFeed: () => backfillFeed,
   isEntity: () => isEntity,
@@ -7321,19 +7168,18 @@ async function upsertLocal(entity, id, version, data) {
 function setAcceptedHook(hook) {
   onAccepted = hook;
 }
-var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, onAccepted;
+var SYNCED, DELEGATE, FIELDS, DATE_FIELDS, onAccepted, __FIELDS_FOR_TEST;
 var init_sync = __esm({
   "src/services/sync.ts"() {
     "use strict";
     init_db();
     init_rename_project();
-    SYNCED = ["project", "spec", "vps", "sessionResult", "errorGroup", "ticket", "ticketAttachment"];
+    SYNCED = ["project", "spec", "vps", "sessionResult", "ticket", "ticketAttachment"];
     DELEGATE = {
       project: prisma.project,
       spec: prisma.spec,
       vps: prisma.vps,
       sessionResult: prisma.sessionResult,
-      errorGroup: prisma.errorGroup,
       ticket: prisma.ticket,
       ticketAttachment: prisma.ticketAttachment
     };
@@ -7341,11 +7187,11 @@ var init_sync = __esm({
       project: ["name", "desc", "kind", "stack", "gitRemote", "updatedAt"],
       // SPEC-408 · ADR-0090 · createdAt/startedAt ikut menyeberang — sejajar baseSha/headSha. Tanpa
       // ini spec asal-hub mendapat createdAt lokal palsu di tiap client (kolom NOT NULL ber-default).
-      spec: ["projectId", "title", "source", "stage", "priority", "author", "objective", "payload", "branchFrom", "baseSha", "headSha", "createdAt", "startedAt", "updatedAt"],
+      // SPEC-447 · ADR-0093 · dependsOn ikut juga: tanpa itu client tak tahu urutannya dan akan
+      // meluncurkan pekerjaan yang di hub terblokir. Bukan DATE_FIELDS — nilainya array string.
+      spec: ["projectId", "title", "source", "stage", "priority", "author", "objective", "payload", "branchFrom", "baseSha", "headSha", "dependsOn", "createdAt", "startedAt", "updatedAt"],
       vps: ["name", "host", "port", "user", "health", "audit", "hardened", "lastSeenAt", "lastAuditAt", "updatedAt"],
       sessionResult: ["projectId", "specId", "oldStage", "newStage", "commitSha", "branch", "prUrl", "status", "deviceId", "author", "createdAt", "updatedAt"],
-      // SPEC-268 · ADR-0066 · agregat grup error (ErrorEvent mentah tak disync).
-      errorGroup: ["projectId", "fingerprint", "type", "message", "sampleStack", "environment", "status", "count", "firstSeenAt", "lastSeenAt", "specId", "updatedAt"],
       // SPEC-268 · ADR-0066 · metadata tiket (lampiran biner tak disync). accessKeyHash wajib
       // (kolom required @unique tanpa default); kunci plaintext tak pernah menyeberang.
       ticket: ["projectId", "number", "category", "title", "detail", "reporterEmail", "status", "accessKeyHash", "specId", "createdAt", "updatedAt"],
@@ -7357,10 +7203,10 @@ var init_sync = __esm({
       spec: ["createdAt", "startedAt", "updatedAt"],
       vps: ["lastSeenAt", "lastAuditAt", "updatedAt"],
       sessionResult: ["createdAt", "updatedAt"],
-      errorGroup: ["firstSeenAt", "lastSeenAt", "updatedAt"],
       ticket: ["createdAt", "updatedAt"],
       ticketAttachment: ["createdAt", "updatedAt"]
     };
+    __FIELDS_FOR_TEST = FIELDS;
   }
 });
 
@@ -9526,7 +9372,7 @@ var require_extension = __commonJS({
       if (dest[name2] === void 0) dest[name2] = [elem];
       else dest[name2].push(elem);
     }
-    function parse3(header) {
+    function parse2(header) {
       const offers = /* @__PURE__ */ Object.create(null);
       let params = /* @__PURE__ */ Object.create(null);
       let mustUnescape = false;
@@ -9666,7 +9512,7 @@ var require_extension = __commonJS({
         }).join(", ");
       }).join(", ");
     }
-    module.exports = { format, parse: parse3 };
+    module.exports = { format, parse: parse2 };
   }
 });
 
@@ -9679,7 +9525,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes7, createHash: createHash7 } = __require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -9700,7 +9546,7 @@ var require_websocket = __commonJS({
     var {
       EventTarget: { addEventListener, removeEventListener }
     } = require_event_target();
-    var { format, parse: parse3 } = require_extension();
+    var { format, parse: parse2 } = require_extension();
     var { toBuffer } = require_buffer_util();
     var kAborted = Symbol("kAborted");
     var protocolVersions = [8, 13];
@@ -10217,7 +10063,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes7(16).toString("base64");
+      const key = randomBytes5(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -10347,7 +10193,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket2, socket2, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash7("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket2, socket2, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -10377,7 +10223,7 @@ var require_websocket = __commonJS({
           }
           let extensions;
           try {
-            extensions = parse3(secWebSocketExtensions);
+            extensions = parse2(secWebSocketExtensions);
           } catch (err) {
             const message = "Invalid Sec-WebSocket-Extensions header";
             abortHandshake(websocket2, socket2, message);
@@ -10669,7 +10515,7 @@ var require_subprotocol = __commonJS({
   "../node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/subprotocol.js"(exports, module) {
     "use strict";
     var { tokenChars } = require_validation();
-    function parse3(header) {
+    function parse2(header) {
       const protocols = /* @__PURE__ */ new Set();
       let start = -1;
       let end2 = -1;
@@ -10705,7 +10551,7 @@ var require_subprotocol = __commonJS({
       protocols.add(protocol);
       return protocols;
     }
-    module.exports = { parse: parse3 };
+    module.exports = { parse: parse2 };
   }
 });
 
@@ -10716,7 +10562,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash7 } = __require("crypto");
+    var { createHash: createHash5 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -11023,7 +10869,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket2, 503);
-        const digest = createHash7("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -13894,17 +13740,17 @@ var require_stream_wormhole = __commonJS({
   "../node_modules/.pnpm/stream-wormhole@1.1.0/node_modules/stream-wormhole/index.js"(exports, module) {
     "use strict";
     module.exports = (stream, throwError) => {
-      return new Promise((resolve15, reject) => {
+      return new Promise((resolve14, reject) => {
         if (typeof stream.resume !== "function") {
-          return resolve15();
+          return resolve14();
         }
         stream.unpipe && stream.unpipe();
         stream.resume();
         if (stream._readableState && stream._readableState.ended) {
-          return resolve15();
+          return resolve14();
         }
         if (!stream.readable || stream.destroyed) {
-          return resolve15();
+          return resolve14();
         }
         function cleanup() {
           stream.removeListener("end", onEnd);
@@ -13913,14 +13759,14 @@ var require_stream_wormhole = __commonJS({
         }
         function onEnd() {
           cleanup();
-          resolve15();
+          resolve14();
         }
         function onError(err) {
           cleanup();
           if (throwError) {
             reject(err);
           } else {
-            resolve15();
+            resolve14();
           }
         }
         stream.on("end", onEnd);
@@ -14136,7 +13982,7 @@ var require_secure_json_parse = __commonJS({
       }
       return obj;
     }
-    function parse3(text, reviver, options2) {
+    function parse2(text, reviver, options2) {
       const stackTraceLimit = Error.stackTraceLimit;
       Error.stackTraceLimit = 0;
       try {
@@ -14156,9 +14002,9 @@ var require_secure_json_parse = __commonJS({
         Error.stackTraceLimit = stackTraceLimit;
       }
     }
-    module.exports = parse3;
-    module.exports.default = parse3;
-    module.exports.parse = parse3;
+    module.exports = parse2;
+    module.exports.default = parse2;
+    module.exports.parse = parse2;
     module.exports.safeParse = safeParse;
     module.exports.scan = filter;
   }
@@ -14172,7 +14018,7 @@ var require_multipart2 = __commonJS({
     var os = __require("node:os");
     var fp = require_plugin();
     var { createWriteStream } = __require("node:fs");
-    var { unlink: unlink4 } = __require("node:fs/promises");
+    var { unlink: unlink3 } = __require("node:fs/promises");
     var path = __require("node:path");
     var { generateId } = require_generateId();
     var util2 = __require("node:util");
@@ -14355,16 +14201,16 @@ var require_multipart2 = __commonJS({
           }
         };
         const parts = () => {
-          return new Promise((resolve15, reject) => {
+          return new Promise((resolve14, reject) => {
             handle((val) => {
               if (val instanceof Error) {
                 if (val.message === "Unexpected end of multipart data") {
-                  resolve15(null);
+                  resolve14(null);
                 } else {
                   reject(val);
                 }
               } else {
-                resolve15(val);
+                resolve14(val);
               }
             });
           });
@@ -14567,7 +14413,7 @@ var require_multipart2 = __commonJS({
         for (let i = 0; i < this.tmpUploads.length; ++i) {
           const filepath = this.tmpUploads[i];
           try {
-            await unlink4(filepath);
+            await unlink3(filepath);
           } catch (error) {
             this.log.error(error, "Could not delete file");
           }
@@ -14654,41 +14500,6 @@ async function health_default(app2) {
 
 // src/routes/projects.ts
 init_src();
-
-// src/services/project-links.ts
-init_db();
-var linksOf = (projectId) => prisma.projectLink.findMany({
-  where: { OR: [{ fromProjectId: projectId }, { toProjectId: projectId }] },
-  orderBy: { createdAt: "asc" }
-});
-function neighborIds(projectId, links) {
-  const out3 = /* @__PURE__ */ new Set();
-  for (const l of links) {
-    const other = l.fromProjectId === projectId ? l.toProjectId : l.fromProjectId;
-    if (other !== projectId) out3.add(other);
-  }
-  return [...out3];
-}
-async function linkViews(projectId, links) {
-  const ids = neighborIds(projectId, links);
-  const rows = await prisma.project.findMany({ where: { id: { in: ids } }, select: { id: true, name: true } });
-  const names = new Map(rows.map((p) => [p.id, p.name]));
-  return links.map((l) => {
-    const direction = l.fromProjectId === projectId ? "keluar" : "masuk";
-    const otherId = direction === "keluar" ? l.toProjectId : l.fromProjectId;
-    return {
-      id: l.id,
-      fromProjectId: l.fromProjectId,
-      toProjectId: l.toProjectId,
-      kind: l.kind,
-      note: l.note,
-      direction,
-      other: { id: otherId, name: names.get(otherId) ?? otherId }
-    };
-  });
-}
-
-// src/routes/projects.ts
 init_db();
 init_rename_project();
 
@@ -14844,9 +14655,6 @@ async function toProjectView(p, sessions) {
     session,
     activity: session.status === "running" ? `running \xB7 ${session.flow ?? "sesi"}` : "idle",
     commit,
-    // SPEC-249 · error monitoring: ekspos status + hint prefix. ingestKeyHash TAK PERNAH ke client.
-    monitoringEnabled: !!p.ingestKeyHash,
-    ingestKeyPrefix: p.ingestKeyPrefix ?? null,
     // SPEC-253 · Help Center publik aktif.
     helpEnabled: p.helpEnabled,
     // SPEC-294 · opt-in scheduler otonom (lokal per-instance).
@@ -14906,25 +14714,6 @@ function paginate(items, page, limit) {
   return { items: pageSize ? items.slice(start, start + pageSize) : items, total, page: p, pageSize };
 }
 
-// src/services/ingest-key.ts
-import { randomBytes, createHash, timingSafeEqual } from "node:crypto";
-function hashKey(key) {
-  return createHash("sha256").update(key).digest("hex");
-}
-function generateIngestKey() {
-  const key = "hnm_ing_" + randomBytes(24).toString("hex");
-  return { key, hash: hashKey(key), prefix: key.slice(0, 16) };
-}
-function verifyKey(key, hash2) {
-  if (!key || !hash2) return false;
-  const a = Buffer.from(hashKey(key), "hex");
-  const b = Buffer.from(hash2, "hex");
-  return a.length === b.length && timingSafeEqual(a, b);
-}
-function dsnUrl(slug, key, base) {
-  return `${base.replace(/\/$/, "")}/api/ingest/${encodeURIComponent(slug)}?key=${key}`;
-}
-
 // src/routes/projects.ts
 init_src2();
 async function projects_default(app2) {
@@ -14991,8 +14780,6 @@ async function projects_default(app2) {
     const base = `${req.protocol}://${req.headers.host ?? "localhost"}`;
     return {
       id: newId,
-      // Plaintext key DSN tak tersimpan; kembalikan path DSN baru (tanpa key) sbg hint bila monitoring aktif.
-      dsnUrl: p?.ingestKeyHash ? `${base.replace(/\/$/, "")}/api/ingest/${encodeURIComponent(newId)}` : void 0,
       helpUrl: p?.helpEnabled ? `${base}/help/${encodeURIComponent(newId)}` : void 0,
       affected: r.affected
     };
@@ -15012,30 +14799,6 @@ async function projects_default(app2) {
     const repoDir = await resolveRepoDir(id);
     return { branches: await listRepoBranches(repoDir), remotes: await listRepoRemoteBranches(repoDir) };
   });
-  app2.get("/projects/:id/ingest-key", async (req, reply) => {
-    const { id } = req.params;
-    const p = await prisma.project.findUnique({ where: { id } });
-    if (!p) return reply.code(404).send({ error: "not found" });
-    return { enabled: !!p.ingestKeyHash, prefix: p.ingestKeyPrefix ?? null };
-  });
-  app2.post("/projects/:id/ingest-key", async (req, reply) => {
-    const { id } = req.params;
-    const p = await prisma.project.findUnique({ where: { id } });
-    if (!p) return reply.code(404).send({ error: "not found" });
-    const { key, hash: hash2, prefix } = generateIngestKey();
-    await prisma.project.update({ where: { id }, data: { ingestKeyHash: hash2, ingestKeyPrefix: prefix } });
-    await notifySynced("project", id);
-    const base = `${req.protocol}://${req.headers.host ?? "localhost"}`;
-    return reply.code(201).send({ enabled: true, prefix, key, dsnUrl: dsnUrl(id, key, base) });
-  });
-  app2.delete("/projects/:id/ingest-key", async (req, reply) => {
-    const { id } = req.params;
-    const p = await prisma.project.findUnique({ where: { id } });
-    if (!p) return reply.code(404).send({ error: "not found" });
-    await prisma.project.update({ where: { id }, data: { ingestKeyHash: null, ingestKeyPrefix: null } });
-    await notifySynced("project", id);
-    return reply.code(204).send();
-  });
   app2.get("/projects/:id/help-center", async (req, reply) => {
     const { id } = req.params;
     const p = await prisma.project.findUnique({ where: { id } });
@@ -15060,35 +14823,6 @@ async function projects_default(app2) {
     await notifySynced("project", id);
     return reply.code(204).send();
   });
-  app2.get("/projects/:id/links", async (req, reply) => {
-    const { id } = req.params;
-    if (!await prisma.project.findUnique({ where: { id } })) return reply.code(404).send({ error: "not found" });
-    return { links: await linkViews(id, await linksOf(id)) };
-  });
-  app2.post("/projects/:id/links", async (req, reply) => {
-    const { id } = req.params;
-    const parsed = zCreateLink.safeParse(req.body);
-    if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
-    const { to, kind, note } = parsed.data;
-    if (to === id) return reply.code(400).send({ error: "project tak bisa bergantung pada dirinya sendiri" });
-    if (!await prisma.project.findUnique({ where: { id } })) return reply.code(404).send({ error: "not found" });
-    if (!await prisma.project.findUnique({ where: { id: to } })) return reply.code(404).send({ error: `project "${to}" tak ada` });
-    const existing = await prisma.projectLink.findUnique({
-      where: { fromProjectId_toProjectId: { fromProjectId: id, toProjectId: to } }
-    });
-    if (existing) return reply.code(409).send({ error: `relasi ${id} \u2192 ${to} sudah ada` });
-    const created = await prisma.projectLink.create({ data: { fromProjectId: id, toProjectId: to, kind, note: note ?? "" } });
-    const [view7] = await linkViews(id, [created]);
-    return reply.code(201).send(view7);
-  });
-  app2.delete("/projects/:id/links/:linkId", async (req, reply) => {
-    const { id, linkId } = req.params;
-    const link2 = await prisma.projectLink.findUnique({ where: { id: linkId } });
-    if (!link2 || link2.fromProjectId !== id && link2.toProjectId !== id)
-      return reply.code(404).send({ error: "not found" });
-    await prisma.projectLink.delete({ where: { id: linkId } });
-    return reply.code(204).send();
-  });
 }
 
 // src/routes/specs.ts
@@ -15641,25 +15375,147 @@ async function findAuditDoc(specId, sessions) {
   return doc ? { dir: dir2, path: doc.path, live } : null;
 }
 async function readAuditDoc(specId, sessions = listSessions()) {
-  const found2 = await findAuditDoc(specId, sessions);
-  if (!found2) return null;
-  const content = readDocFile(found2.dir, found2.path);
-  return content === null ? null : { path: found2.path, content };
+  const found = await findAuditDoc(specId, sessions);
+  if (!found) return null;
+  const content = readDocFile(found.dir, found.path);
+  return content === null ? null : { path: found.path, content };
 }
 async function readEscalation(specId, sessions = listSessions()) {
-  const found2 = await findAuditDoc(specId, sessions);
-  if (!found2) {
+  const found = await findAuditDoc(specId, sessions);
+  if (!found) {
     const live = sessions.some((s) => s.specId === specId && !s.exited && s.cwd);
     return { escalation: null, docPath: null, live };
   }
-  const content = readDocFile(found2.dir, found2.path);
+  const content = readDocFile(found.dir, found.path);
   return {
     escalation: content === null ? null : parseEscalation(content),
-    docPath: found2.path,
-    live: found2.live
+    docPath: found.path,
+    live: found.live
   };
 }
 
+// src/services/spec-deps.ts
+init_db();
+init_src2();
+var REASON_LABEL = {
+  missing: "tak ditemukan",
+  unfinished: "belum selesai",
+  unmerged: "belum ter-merge"
+};
+function dependsOnOf(spec) {
+  const v = spec.dependsOn;
+  if (!Array.isArray(v)) return [];
+  const out3 = [];
+  for (const x of v) if (typeof x === "string" && x !== "" && !out3.includes(x)) out3.push(x);
+  return out3;
+}
+function blockersFor(spec, deps, isMerged) {
+  const ids = dependsOnOf(spec);
+  if (ids.length === 0) return [];
+  const base = spec.branchFrom ?? "HEAD";
+  const out3 = [];
+  for (const id of ids) {
+    const d = deps.get(id);
+    if (!d) {
+      out3.push({ id, reason: "missing" });
+      continue;
+    }
+    if (d.stage !== "done") {
+      out3.push({ id, reason: "unfinished" });
+      continue;
+    }
+    if (d.headSha && !isMerged(d.headSha, base)) out3.push({ id, reason: "unmerged" });
+  }
+  return out3;
+}
+function blockedNote(bl) {
+  return `menunggu ${bl.map((b) => `${b.id} (${REASON_LABEL[b.reason]})`).join(", ")}`;
+}
+function reaches(edges, from, target2) {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...from];
+  while (stack.length) {
+    const cur = stack.pop();
+    if (cur === target2) return true;
+    if (seen.has(cur)) continue;
+    seen.add(cur);
+    for (const n of edges.get(cur) ?? []) stack.push(n);
+  }
+  return false;
+}
+var TTL_MS = 15e3;
+var mergeCache = /* @__PURE__ */ new Map();
+function mergedInto(repoDir, sha, baseRef) {
+  const key = `${repoDir} ${sha} ${baseRef}`;
+  const hit = mergeCache.get(key);
+  const now = Date.now();
+  if (hit && now - hit.at < TTL_MS) return hit.v;
+  let v = false;
+  try {
+    v = realGit.isAncestor(repoDir, sha, baseRef);
+  } catch {
+    v = false;
+  }
+  mergeCache.set(key, { at: now, v });
+  return v;
+}
+var merger = (repoDir) => (sha, base) => repoDir ? mergedInto(repoDir, sha, base) : false;
+var depRows = (ids) => prisma.spec.findMany({
+  where: { id: { in: ids } },
+  select: { id: true, stage: true, headSha: true }
+});
+async function blockersForSpec(spec, repoDir) {
+  const ids = dependsOnOf(spec);
+  if (ids.length === 0) return [];
+  const rows = await depRows(ids);
+  return blockersFor(spec, new Map(rows.map((r) => [r.id, r])), merger(repoDir));
+}
+async function decorateBlocked(specs) {
+  const ids = [...new Set(specs.flatMap(dependsOnOf))];
+  if (ids.length === 0) return specs.map((s) => ({ ...s, dependsOn: [], blockedBy: [] }));
+  const rows = await depRows(ids);
+  const deps = new Map(rows.map((r) => [r.id, r]));
+  const repos = /* @__PURE__ */ new Map();
+  const out3 = [];
+  for (const s of specs) {
+    const own = dependsOnOf(s);
+    if (own.length === 0) {
+      out3.push({ ...s, dependsOn: [], blockedBy: [] });
+      continue;
+    }
+    if (!repos.has(s.projectId)) repos.set(s.projectId, await resolveRepoDir(s.projectId));
+    out3.push({ ...s, dependsOn: own, blockedBy: blockersFor(s, deps, merger(repos.get(s.projectId))) });
+  }
+  return out3;
+}
+async function validateDependsOn(specId, projectId, raw) {
+  const ids = dependsOnOf({ dependsOn: raw });
+  if (ids.length === 0) return { ok: true, ids: [] };
+  if (specId && ids.includes(specId))
+    return { ok: false, error: "backlog tak bisa bergantung pada dirinya sendiri" };
+  const rows = await prisma.spec.findMany({
+    where: { id: { in: ids } },
+    select: { id: true, projectId: true }
+  });
+  const found = new Map(rows.map((r) => [r.id, r.projectId]));
+  const missing = ids.filter((i) => !found.has(i));
+  if (missing.length) return { ok: false, error: `backlog tak ditemukan: ${missing.join(", ")}` };
+  const foreign = ids.filter((i) => found.get(i) !== projectId);
+  if (foreign.length)
+    return { ok: false, error: `dependency harus di project yang sama: ${foreign.join(", ")}` };
+  if (specId) {
+    const all = await prisma.spec.findMany({
+      where: { projectId },
+      select: { id: true, dependsOn: true }
+    });
+    const edges = new Map(all.map((r) => [r.id, dependsOnOf(r)]));
+    edges.set(specId, ids);
+    if (reaches(edges, ids, specId))
+      return { ok: false, error: "dependency membentuk siklus" };
+  }
+  return { ok: true, ids };
+}
+
 // src/services/doc-export.ts
 import PDFDocument from "pdfkit";
 
@@ -15694,8 +15550,8 @@ var escapeReplacements = {
   "'": "&#39;"
 };
 var getEscapeReplacement = (ch) => escapeReplacements[ch];
-function escape$1(html2, encode2) {
-  if (encode2) {
+function escape$1(html2, encode) {
+  if (encode) {
     if (escapeTest.test(html2)) {
       return html2.replace(escapeReplace, getEscapeReplacement);
     }
@@ -17982,7 +17838,7 @@ function renderDocPdf(text, name2, meta) {
   });
   const chunks = [];
   doc.on("data", (c) => chunks.push(c));
-  const done = new Promise((resolve15) => doc.on("end", () => resolve15(Buffer.concat(chunks))));
+  const done = new Promise((resolve14) => doc.on("end", () => resolve14(Buffer.concat(chunks))));
   doc.font("Helvetica-Bold").fontSize(8).fillColor(BRASS).text(toWinAnsi(meta.eyebrow.toUpperCase()), { characterSpacing: 0.8 });
   doc.moveDown(0.25);
   doc.font("Helvetica-Bold").fontSize(17).fillColor(STRONG).text(toWinAnsi(name2.split("/").pop() ?? name2));
@@ -18084,14 +17940,6 @@ async function recordFailure(specId, title, projectId, reason) {
   }).catch(() => {
   });
 }
-async function recordNewErrorGroup(groupId, projectId, projectName, type, message) {
-  const short = message.length > 80 ? message.slice(0, 77) + "\u2026" : message;
-  const title = `Error baru di "${projectName}": ${type}: ${short}`;
-  await prisma.notification.create({
-    data: { type: "error", key: `error:${groupId}`, projectId, title }
-  }).catch(() => {
-  });
-}
 async function recordNewTicket(ticketId, projectId, projectName, category, title) {
   const short = title.length > 80 ? title.slice(0, 77) + "\u2026" : title;
   const t = `Keluhan baru di "${projectName}": ${category}: ${short}`;
@@ -18137,7 +17985,7 @@ async function liveSpecs(filter = {}) {
     orderBy: { id: "desc" }
   });
   const live = sessionPhasesBySpec();
-  if (live.size === 0) return specs;
+  if (live.size === 0) return decorateBlocked(specs);
   const advanced = [];
   const doneNow = [];
   const out3 = specs.map((s) => {
@@ -18155,7 +18003,7 @@ async function liveSpecs(filter = {}) {
       if (res.count > 0) await notifySynced("spec", a.id);
     }));
   await Promise.all(doneNow.map((d) => recordCompletion(d.specId, d.title, d.projectId)));
-  return out3;
+  return decorateBlocked(out3);
 }
 
 // src/routes/specs.ts
@@ -18195,6 +18043,8 @@ async function specs_default(app2) {
     const repoDir = await resolveRepoDir(b.project);
     if (b.branchFrom && await branchUnknown(repoDir, b.branchFrom))
       return reply.code(400).send({ error: `branch "${b.branchFrom}" tidak ada di repo project` });
+    const dep = await validateDependsOn(null, b.project, b.dependsOn ?? []);
+    if (!dep.ok) return reply.code(400).send({ error: dep.error });
     const isQa = b.source === "qa";
     const { priority, objective } = deriveSpecFields(b.source, b.payload, b.priority);
     const author = req.user?.email ?? "system";
@@ -18210,10 +18060,12 @@ async function specs_default(app2) {
             source: b.source,
             stage: "brainstorming",
             priority,
-            author: isQa ? `QA \xB7 ${author}` : b.source === "audit" ? `Audit \xB7 ${author}` : b.source === "cross-audit" ? `Audit lintas \xB7 ${author}` : b.source === "goal" ? `Goal \xB7 ${author}` : author,
+            author: isQa ? `QA \xB7 ${author}` : b.source === "audit" ? `Audit \xB7 ${author}` : b.source === "goal" ? `Goal \xB7 ${author}` : author,
             objective,
             payload: b.payload,
-            branchFrom: b.branchFrom ?? null
+            branchFrom: b.branchFrom ?? null,
+            dependsOn: dep.ids
+            // SPEC-447 · ADR-0093
           }
         });
       } catch (e) {
@@ -18277,7 +18129,7 @@ ${item.context}` : item.context;
     if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
     const spec = await prisma.spec.findUnique({ where: { id } });
     if (!spec) return reply.code(404).send({ error: "not found" });
-    const { branchFrom, stage, confirmDelete, title, priority: newPriority, payload } = parsed.data;
+    const { branchFrom, stage, confirmDelete, title, priority: newPriority, payload, dependsOn } = parsed.data;
     const editingContent = title !== void 0 || newPriority !== void 0 || payload !== void 0;
     if (editingContent && (spec.stage !== "brainstorming" || spec.baseSha !== null))
       return reply.code(409).send({ error: "backlog item sudah dimulai \u2014 tak bisa diedit" });
@@ -18285,6 +18137,12 @@ ${item.context}` : item.context;
       if (await branchUnknown(await resolveRepoDir(spec.projectId), branchFrom))
         return reply.code(400).send({ error: `branch "${branchFrom}" tidak ada di repo project` });
     }
+    let depIds;
+    if (dependsOn !== void 0) {
+      const d = await validateDependsOn(spec.id, spec.projectId, dependsOn);
+      if (!d.ok) return reply.code(400).send({ error: d.error });
+      depIds = d.ids;
+    }
     if (stage !== void 0) {
       if (STAGES.indexOf(stage) >= STAGES.indexOf(spec.stage))
         return reply.code(422).send({ error: "stage hanya boleh dikembalikan mundur" });
@@ -18296,6 +18154,7 @@ ${item.context}` : item.context;
     }
     const data = {};
     if (branchFrom !== void 0) data.branchFrom = branchFrom;
+    if (depIds !== void 0) data.dependsOn = depIds;
     if (stage !== void 0) data.stage = stage;
     if (editingContent) {
       const effPayload = payload ?? spec.payload;
@@ -18328,8 +18187,21 @@ ${item.context}` : item.context;
   });
   app2.delete("/specs/:id", async (req, reply) => {
     const { id } = req.params;
+    const gone = await prisma.spec.findUnique({ where: { id }, select: { projectId: true } });
     await prisma.spec.delete({ where: { id } }).catch(() => {
     });
+    if (gone) {
+      const rows = await prisma.spec.findMany({
+        where: { projectId: gone.projectId },
+        select: { id: true, dependsOn: true }
+      });
+      for (const r of rows) {
+        const ids = dependsOnOf(r);
+        if (!ids.includes(id)) continue;
+        await prisma.spec.update({ where: { id: r.id }, data: { dependsOn: ids.filter((x) => x !== id) } });
+        await notifySynced("spec", r.id);
+      }
+    }
     return reply.code(204).send();
   });
   app2.post("/specs/:id/integrate", async (req, reply) => {
@@ -19549,70 +19421,8 @@ async function fs_default(app2) {
 init_db();
 init_src();
 init_src2();
-import { existsSync as existsSync6 } from "node:fs";
-
-// src/services/cross-audit.ts
-init_db();
-
-// src/services/audit-scope.ts
-init_pty();
-import { randomBytes as randomBytes2 } from "node:crypto";
-var AUDIT_KEY_HEADER = "x-hanoman-audit-key";
-var newAuditKey = () => `hnm_xa_${randomBytes2(16).toString("hex")}`;
-var auditApiUrl = () => `http://127.0.0.1:${process.env.PORT ?? 8787}/api/audit`;
-function auditScopeFromReq(req) {
-  const raw = req.headers[AUDIT_KEY_HEADER];
-  const key = Array.isArray(raw) ? raw[0] : raw;
-  if (typeof key !== "string" || !key) return null;
-  return auditSessionScope(key);
-}
-
-// src/services/cross-audit.ts
-async function buildCrossAuditCtx(primaryId) {
-  const primary = await prisma.project.findUnique({ where: { id: primaryId } });
-  if (!primary) return null;
-  const views = await linkViews(primaryId, await linksOf(primaryId));
-  const rows = await prisma.project.findMany({ where: { id: { in: views.map((v) => v.other.id) } } });
-  const byId2 = new Map(rows.map((p) => [p.id, p]));
-  const neighbors = [];
-  for (const v of views) {
-    const p = byId2.get(v.other.id);
-    if (!p) continue;
-    const relation = v.direction === "keluar" ? `${primary.name} bergantung pada ${p.name} (${v.kind})` : `${p.name} bergantung pada ${primary.name} (${v.kind})`;
-    neighbors.push({
-      id: p.id,
-      name: p.name,
-      stack: p.stack,
-      repoDir: await resolveRepoDir(p.id),
-      // null = belum di-bind di mesin ini; prompt menandainya
-      relation,
-      note: v.note
-    });
-  }
-  return {
-    ctx: {
-      primary: {
-        id: primary.id,
-        name: primary.name,
-        stack: primary.stack,
-        repoDir: await resolveRepoDir(primary.id)
-      },
-      neighbors,
-      apiUrl: auditApiUrl()
-    },
-    scope: [primary.id, ...neighbors.map((n) => n.id)]
-  };
-}
-function crossAuditSessionOpts(scope) {
-  const key = newAuditKey();
-  return {
-    audit: { key, projects: scope },
-    env: { HANOMAN_AUDIT_KEY: key, HANOMAN_AUDIT_URL: auditApiUrl() }
-  };
-}
-
-// src/routes/terminal.ts
 init_session_phases();
+import { existsSync as existsSync6 } from "node:fs";
 
 // src/services/session-launch.ts
 init_db();
@@ -19621,9 +19431,11 @@ init_pty();
 init_session_phases();
 init_pty();
 var LaunchError = class extends Error {
-  constructor(message, kind) {
+  // SPEC-447 · `blockers` hanya terisi untuk kind "blocked"; route memetakannya ke body 409.
+  constructor(message, kind, blockers = []) {
     super(message);
     this.kind = kind;
+    this.blockers = blockers;
   }
 };
 function resumeState(repoDir, worktree, branchTo, headSha) {
@@ -19645,6 +19457,11 @@ async function startSpecSession(spec, opts) {
   const id = sessionIdForSpec(spec.id);
   const pane = getSession(id);
   if (pane && !pane.exited) return { id: pane.id, reused: true };
+  if (!opts.force) {
+    const blockers = await blockersForSpec(spec, repoDir);
+    if (blockers.length)
+      throw new LaunchError(`${spec.id} ${blockedNote(blockers)}`, "blocked", blockers);
+  }
   if (pane) killSession(id);
   const setting = await getSetting();
   const agent = opts.agent ?? setting.agent;
@@ -19704,17 +19521,6 @@ async function startSpecSession(spec, opts) {
     prompt = startPrompt(opts.flow, brief, branchTo, opts.autonomy, verifyScope);
   }
   const scopeEnv = { HANOMAN_BASE_SHA: baseSha, HANOMAN_VERIFY_SCOPE: verifyScope };
-  let extra = {};
-  if (opts.flow === "cross-audit") {
-    const built = await buildCrossAuditCtx(spec.projectId);
-    if (built) {
-      prompt = startCrossAuditPrompt(
-        { ...built.ctx, worktree, spec: brief, branchTo },
-        "backlog"
-      );
-      extra = crossAuditSessionOpts(built.scope);
-    }
-  }
   const s = createSession(spec.projectId, worktree, {
     specId: spec.id,
     flow: opts.flow,
@@ -19725,9 +19531,7 @@ async function startSpecSession(spec, opts) {
     phaseFile: phaseFilePath(repoDir, id),
     decisionFile: decisionFilePath(repoDir, id),
     prompt,
-    ...extra,
-    // Digabung SESUDAH `extra` supaya env audit lintas (SPEC-337) tak terhapus dan sebaliknya.
-    env: { ...scopeEnv, ...extra.env ?? {} }
+    env: scopeEnv
   });
   return resume ? { id: s.id, resumed: true } : { id: s.id };
 }
@@ -19820,12 +19624,16 @@ async function terminal_default(app2) {
           // SPEC-332 · ADR-0073
           agent: parsed.data.agent,
           // SPEC-338 · ADR-0074
-          verifyScope: parsed.data.verifyScope
+          verifyScope: parsed.data.verifyScope,
           // SPEC-376 · ADR-0080
+          force: parsed.data.force
+          // SPEC-447 · ADR-0093
         });
         return reply.code(201).send(r.resumed ? { id: r.id, resumed: true } : { id: r.id });
       } catch (e) {
         if (e instanceof LaunchError) {
+          if (e.kind === "blocked")
+            return reply.code(409).send({ error: e.message, blocked: true, blockers: e.blockers });
           return e.kind === "needs-bind" ? reply.code(400).send({ error: e.message, needsBind: true }) : reply.code(422).send({ error: e.message });
         }
         throw e;
@@ -19975,32 +19783,6 @@ async function terminal_default(app2) {
       });
       return reply.code(201).send({ id: s2.id });
     }
-    if (parsed.data.flow === "cross-audit") {
-      const id = `xaudit-${project.id.toLowerCase().replace(/[^a-z0-9_-]/g, "_")}`;
-      const live = getSession(id);
-      if (live && !live.exited) return reply.code(201).send({ id: live.id });
-      const built = await buildCrossAuditCtx(project.id);
-      if (!built) return reply.code(404).send({ error: "project not found" });
-      const { agent: agent2, model: model2, effort: effort2 } = await sessionAgentDefaults();
-      if (agent2 === "codex") ensureCodexTrust(repoDir);
-      const wt = `${repoDir}/.worktrees/${id}`;
-      let reused;
-      try {
-        reused = ensureWorktree(repoDir, wt, "HEAD");
-      } catch (e) {
-        return reply.code(422).send({ error: `gagal membuat worktree: ${e.message}` });
-      }
-      const s2 = createSession(project.id, wt, {
-        id,
-        model: model2,
-        effort: effort2,
-        agent: agent2,
-        decisionFile: decisionFilePath(repoDir, id),
-        prompt: startCrossAuditPrompt({ ...built.ctx, worktree: wt }, "live") + resumeNote(reused),
-        ...crossAuditSessionOpts(built.scope)
-      });
-      return reply.code(201).send({ id: s2.id });
-    }
     const { agent, model, effort } = await sessionAgentDefaults();
     if (agent === "codex") ensureCodexTrust(repoDir);
     const s = createSession(project.id, repoDir, { agent, model, effort });
@@ -20252,14 +20034,14 @@ function sshExec(t, remoteCmd, opts = {}) {
     SSH_ASKPASS_REQUIRE: "force",
     HANOMAN_SSH_PASSWORD: opts.password
   } : process.env;
-  return new Promise((resolve15) => {
+  return new Promise((resolve14) => {
     const p = spawn3(sshBin(), args, { stdio: ["pipe", "pipe", "pipe"], env });
     let out3 = "";
     const timer5 = setTimeout(() => p.kill("SIGKILL"), opts.timeoutMs ?? 6e4);
     const done = (r) => {
       clearTimeout(timer5);
       if (askpass) rmSync4(dirname9(askpass), { recursive: true, force: true });
-      resolve15(r);
+      resolve14(r);
     };
     p.stdout.on("data", (d) => {
       out3 += d;
@@ -20787,7 +20569,7 @@ import { readFileSync as readFileSync9 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join9 } from "node:path";
 var USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
-var TTL_MS = 3e4;
+var TTL_MS2 = 3e4;
 var lastOk = null;
 var freshUntil = 0;
 var LABELS = {
@@ -20865,7 +20647,7 @@ async function fetchUsage() {
 async function getLimits() {
   if (lastOk && Date.now() < freshUntil) return lastOk;
   const dto = await fetchUsage();
-  if (dto.status === "ok") freshUntil = Date.now() + TTL_MS;
+  if (dto.status === "ok") freshUntil = Date.now() + TTL_MS2;
   return dto;
 }
 
@@ -20873,7 +20655,7 @@ async function getLimits() {
 import { open as open2, readdir as readdir2, stat } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
 import { join as join10 } from "node:path";
-var TTL_MS2 = 3e4;
+var TTL_MS3 = 3e4;
 var STALE_AFTER_MS = 12 * 36e5;
 var TAIL_BYTES = 512 * 1024;
 var MAX_FILES = 8;
@@ -20978,7 +20760,7 @@ async function getCodexLimits(dir2) {
   const dto = await readLimits(codexSessionsDir());
   if (dto.status !== "unavailable") {
     cache2 = dto;
-    freshUntil2 = Date.now() + TTL_MS2;
+    freshUntil2 = Date.now() + TTL_MS3;
   }
   return dto;
 }
@@ -20996,7 +20778,7 @@ import { execFile as execFile8 } from "node:child_process";
 import { promisify as promisify8 } from "node:util";
 var run = promisify8(execFile8);
 var CODEX_MIN_CLIENT = "0.144.0";
-var TTL_MS3 = 5 * 6e4;
+var TTL_MS4 = 5 * 6e4;
 var cache3 = null;
 var codexBin2 = () => effectiveStr("HANOMAN_CODEX_BIN") ?? "codex";
 function parseCodexVersion(out3) {
@@ -21004,7 +20786,7 @@ function parseCodexVersion(out3) {
   return m ? `${m[1]}.${m[2]}.${m[3]}` : null;
 }
 async function getCodexVersion(now = Date.now()) {
-  if (cache3 && now - cache3.at < TTL_MS3) return cache3.version;
+  if (cache3 && now - cache3.at < TTL_MS4) return cache3.version;
   let version = null;
   try {
     const { stdout } = await run(codexBin2(), ["--version"], { timeout: 5e3 });
@@ -21269,9 +21051,9 @@ init_db();
 
 // src/services/device-token.ts
 init_db();
-import { randomBytes as randomBytes3, createHash as createHash2 } from "node:crypto";
-var newDeviceToken = () => randomBytes3(32).toString("base64url");
-var tokenHash = (token) => createHash2("sha256").update(token).digest("hex");
+import { randomBytes, createHash } from "node:crypto";
+var newDeviceToken = () => randomBytes(32).toString("base64url");
+var tokenHash = (token) => createHash("sha256").update(token).digest("hex");
 async function issueDeviceToken(userId, name2) {
   const token = newDeviceToken();
   const row = await prisma.deviceToken.create({ data: { userId, name: name2, tokenHash: tokenHash(token) } });
@@ -21828,931 +21610,6 @@ async function config_default(app2) {
   });
 }
 
-// src/routes/ingest.ts
-init_src();
-init_db();
-
-// src/services/error-ingest.ts
-init_db();
-
-// src/services/error-fingerprint.ts
-import { createHash as createHash3 } from "node:crypto";
-function normalizeMessage(msg) {
-  return (msg || "").replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "<uuid>").replace(/0x[0-9a-f]+/gi, "<hex>").replace(/"[^"]*"|'[^']*'/g, "<str>").replace(/\b\d+\b/g, "<n>").replace(/\s+/g, " ").trim().slice(0, 500);
-}
-function normalizeBundleName(name2) {
-  return name2.replace(/([-.])(?=[a-z0-9_]*\d)[a-z0-9_]{6,}(\.[a-z0-9]+)$/i, "$2");
-}
-function baseOf(s) {
-  const clean = s.split(/[?#]/)[0] ?? "";
-  const parts = clean.split(/[/\\]/);
-  return parts[parts.length - 1] || clean;
-}
-function topFrame(stack) {
-  if (!stack) return "";
-  for (const raw of stack.split("\n")) {
-    const line = raw.trim();
-    if (!line.startsWith("at ")) continue;
-    return line.replace(/:\d+:\d+/g, "").replace(/\(([^)]*)\)/g, (_m, inner) => `(${normalizeBundleName(baseOf(inner))})`).replace(/\b(?:[a-z][a-z0-9+.-]*:\/\/|\/)[^\s()]+/gi, (m) => normalizeBundleName(baseOf(m))).replace(/\s+/g, " ").trim();
-  }
-  return "";
-}
-function topFrameFromFrames(frames) {
-  const f = frames.find((x) => x.in_app) ?? frames[0];
-  if (!f) return "";
-  return `at ${f.function ?? "?"} (${normalizeBundleName(baseOf(f.filename ?? ""))})`;
-}
-function fingerprint(type, message, stack, frames) {
-  const top = frames && frames.length ? topFrameFromFrames(frames) : topFrame(stack);
-  const basis = `${type}
-${normalizeMessage(message)}
-${top}`;
-  return createHash3("sha256").update(basis).digest("hex").slice(0, 32);
-}
-
-// src/services/error-ingest.ts
-init_config2();
-var MSG_CAP = 2e3;
-var STACK_CAP = 16e3;
-var EVENTS_PER_GROUP = () => effectiveInt("HANOMAN_ERROR_EVENTS_PER_GROUP") ?? 50;
-var RETENTION_DAYS = () => effectiveInt("HANOMAN_ERROR_RETENTION_DAYS") ?? 30;
-var RATE_PER_MIN = () => effectiveInt("HANOMAN_INGEST_RATE_PER_MIN") ?? 120;
-var buckets = /* @__PURE__ */ new Map();
-function rateLimitOk(projectId, now = Date.now()) {
-  const cap = RATE_PER_MIN();
-  const refillPerMs = cap / 6e4;
-  const b = buckets.get(projectId) ?? { tokens: cap, ts: now };
-  b.tokens = Math.min(cap, b.tokens + (now - b.ts) * refillPerMs);
-  b.ts = now;
-  buckets.set(projectId, b);
-  if (b.tokens < 1) return false;
-  b.tokens -= 1;
-  return true;
-}
-async function ingestError(projectId, projectName, payload) {
-  const type = payload.type.slice(0, 500);
-  const message = payload.message.slice(0, MSG_CAP);
-  const stack = payload.stack ? payload.stack.slice(0, STACK_CAP) : null;
-  const environment = (payload.environment || "unknown").slice(0, 120);
-  const frames = payload.frames;
-  const fp = fingerprint(type, message, stack ?? void 0, frames);
-  const key = { projectId_fingerprint: { projectId, fingerprint: fp } };
-  let groupId;
-  let isNew = false;
-  const existing = await prisma.errorGroup.findUnique({ where: key });
-  if (existing) {
-    await prisma.errorGroup.update({
-      where: { id: existing.id },
-      data: { count: { increment: 1 }, lastSeenAt: /* @__PURE__ */ new Date(), environment, updatedAt: /* @__PURE__ */ new Date(), release: payload.release ?? void 0 }
-    });
-    groupId = existing.id;
-  } else {
-    try {
-      const g = await prisma.errorGroup.create({
-        data: {
-          projectId,
-          fingerprint: fp,
-          type,
-          message,
-          sampleStack: stack,
-          environment,
-          count: 1,
-          sampleFrames: frames ?? void 0,
-          // SPEC-276 · frame sample (disymbolikasi saat display)
-          release: payload.release ?? null
-          // SPEC-276 · korelasi build
-        }
-      });
-      groupId = g.id;
-      isNew = true;
-    } catch (e) {
-      if (e.code !== "P2002") throw e;
-      const g = await prisma.errorGroup.update({
-        where: key,
-        data: { count: { increment: 1 }, lastSeenAt: /* @__PURE__ */ new Date(), environment, updatedAt: /* @__PURE__ */ new Date() }
-      });
-      groupId = g.id;
-    }
-  }
-  if (isNew && environment === "production")
-    await recordNewErrorGroup(groupId, projectId, projectName, type, message);
-  await prisma.errorEvent.create({
-    data: {
-      groupId,
-      projectId,
-      type,
-      message,
-      stack,
-      environment,
-      frames: frames ?? void 0,
-      // SPEC-276 · frame terstruktur mentah
-      release: payload.release ?? null,
-      context: payload.context ?? void 0
-    }
-  });
-  await pruneGroup(groupId);
-  if (isNew) await notifySynced("errorGroup", groupId);
-  return { groupId, new: isNew };
-}
-async function pruneGroup(groupId) {
-  const cutoff = new Date(Date.now() - RETENTION_DAYS() * 864e5);
-  await prisma.errorEvent.deleteMany({ where: { groupId, receivedAt: { lt: cutoff } } });
-  const cap = EVENTS_PER_GROUP();
-  const keep = await prisma.errorEvent.findMany({
-    where: { groupId },
-    orderBy: { receivedAt: "desc" },
-    take: cap,
-    select: { id: true }
-  });
-  if (keep.length >= cap)
-    await prisma.errorEvent.deleteMany({ where: { groupId, id: { notIn: keep.map((k) => k.id) } } });
-}
-
-// src/services/sourcemap-store.ts
-init_db();
-import { randomUUID as randomUUID6 } from "node:crypto";
-import { mkdir as mkdir4, writeFile as writeFile4, readFile as readFile5, unlink as unlink3 } from "node:fs/promises";
-import { join as join13 } from "node:path";
-function basenameOf(ref) {
-  const clean = ref.split(/[?#]/)[0] ?? "";
-  const parts = clean.split(/[/\\]/);
-  return parts[parts.length - 1] || clean;
-}
-async function saveSourceMap(projectId, release, filename, mapText, debugId) {
-  const dir2 = uploadDir();
-  await mkdir4(dir2, { recursive: true });
-  const base = basenameOf(filename);
-  const storageKey = `${randomUUID6()}.map`;
-  const buf = Buffer.from(mapText, "utf8");
-  await writeFile4(join13(dir2, storageKey), buf);
-  const prev = await prisma.sourceMapArtifact.findUnique({
-    where: { projectId_release_filename: { projectId, release, filename: base } }
-  });
-  const row = await prisma.sourceMapArtifact.upsert({
-    where: { projectId_release_filename: { projectId, release, filename: base } },
-    update: { storageKey, size: buf.length, debugId: debugId ?? null },
-    create: { projectId, release, filename: base, storageKey, size: buf.length, debugId: debugId ?? null }
-  });
-  if (prev && prev.storageKey !== storageKey)
-    await unlink3(join13(dir2, prev.storageKey.replace(/[/\\]/g, ""))).catch(() => {
-    });
-  return { id: row.id, storageKey, size: buf.length };
-}
-async function findSourceMap(projectId, release, frameFilename) {
-  const base = basenameOf(frameFilename);
-  const row = await prisma.sourceMapArtifact.findUnique({
-    where: { projectId_release_filename: { projectId, release, filename: base } }
-  });
-  if (!row) return null;
-  try {
-    const buf = await readFile5(join13(uploadDir(), row.storageKey.replace(/[/\\]/g, "")));
-    return buf.toString("utf8");
-  } catch {
-    return null;
-  }
-}
-async function pruneReleases(projectId, keep = 10) {
-  const rows = await prisma.sourceMapArtifact.findMany({
-    where: { projectId },
-    orderBy: [{ createdAt: "desc" }, { id: "desc" }]
-  });
-  const order = [];
-  for (const r of rows) if (!order.includes(r.release)) order.push(r.release);
-  const keepSet = new Set(order.slice(0, keep));
-  const dir2 = uploadDir();
-  for (const r of rows) if (!keepSet.has(r.release)) {
-    await unlink3(join13(dir2, r.storageKey.replace(/[/\\]/g, ""))).catch(() => {
-    });
-    await prisma.sourceMapArtifact.delete({ where: { id: r.id } }).catch(() => {
-    });
-  }
-}
-
-// src/routes/ingest.ts
-var BODY_CAP = 64e3;
-var SOURCEMAP_CAP = 30 * 1024 * 1024;
-function cors(reply) {
-  reply.header("access-control-allow-origin", "*");
-  reply.header("access-control-allow-methods", "POST,OPTIONS");
-  reply.header("access-control-allow-headers", "content-type,x-hanoman-dsn");
-}
-async function ingest_default(app2) {
-  app2.options("/ingest/:slug", async (_req, reply) => {
-    cors(reply);
-    return reply.code(204).send();
-  });
-  app2.post("/ingest/:slug", async (req, reply) => {
-    cors(reply);
-    const { slug } = req.params;
-    const key = req.query.key ?? req.headers["x-hanoman-dsn"] ?? "";
-    const raw = JSON.stringify(req.body ?? {});
-    if (raw.length > BODY_CAP) return reply.code(413).send({ error: "payload too large" });
-    const project = await prisma.project.findUnique({ where: { id: slug } });
-    if (!project || !verifyKey(key, project.ingestKeyHash)) return reply.code(401).send({ error: "unauthorized" });
-    if (!rateLimitOk(project.id)) return reply.code(429).send({ error: "rate limited" });
-    const parsed = zIngestPayload.safeParse(req.body);
-    if (!parsed.success) return reply.code(400).send({ error: "invalid payload" });
-    const r = await ingestError(project.id, project.name, parsed.data);
-    return reply.code(202).send({ ok: true, groupId: r.groupId, new: r.new });
-  });
-  app2.options("/ingest/:slug/sourcemaps", async (_req, reply) => {
-    cors(reply);
-    return reply.code(204).send();
-  });
-  app2.post("/ingest/:slug/sourcemaps", { bodyLimit: SOURCEMAP_CAP }, async (req, reply) => {
-    cors(reply);
-    const { slug } = req.params;
-    const key = req.query.key ?? req.headers["x-hanoman-dsn"] ?? "";
-    const project = await prisma.project.findUnique({ where: { id: slug } });
-    if (!project || !verifyKey(key, project.ingestKeyHash)) return reply.code(401).send({ error: "unauthorized" });
-    const parsed = zSourceMapUpload.safeParse(req.body);
-    if (!parsed.success) return reply.code(400).send({ error: "invalid payload" });
-    const total = parsed.data.artifacts.reduce((n, a) => n + a.map.length, 0);
-    if (total > SOURCEMAP_CAP) return reply.code(413).send({ error: "payload too large" });
-    for (const a of parsed.data.artifacts)
-      await saveSourceMap(project.id, parsed.data.release, a.filename, a.map, a.debugId);
-    await pruneReleases(project.id);
-    return reply.code(202).send({ ok: true, stored: parsed.data.artifacts.length });
-  });
-}
-
-// src/routes/errors.ts
-init_src();
-init_db();
-import { readFile as readFile6 } from "node:fs/promises";
-import { join as join14 } from "node:path";
-
-// src/services/error-escalate.ts
-init_db();
-async function escalateErrorGroup(group2, opts) {
-  if (group2.specId) {
-    const spec2 = await prisma.spec.findUnique({ where: { id: group2.specId } });
-    return { spec: spec2, created: false };
-  }
-  const short = group2.message.length > 80 ? group2.message.slice(0, 77) + "\u2026" : group2.message;
-  const topStack = (group2.sampleStack ?? "").split("\n").slice(0, 12).join("\n");
-  const backlink = `Dari Error monitoring: grup ${group2.id} (${group2.count}\xD7, ${group2.environment}).`;
-  const payload = {
-    severity: "major",
-    steps: "Otomatis dari Error monitoring \u2014 reproduksi dari stack sampel.",
-    expected: "Tidak ada error.",
-    actual: `${group2.type}: ${group2.message}
-
-${topStack}
-
-${backlink}`,
-    env: group2.environment,
-    fromErrorGroup: group2.id
-  };
-  const repoDir = await resolveRepoDir(group2.projectId);
-  let spec = null;
-  for (let attempt = 0; attempt < 3 && !spec; attempt++) {
-    const sid = await nextSpecId(repoDir);
-    try {
-      spec = await prisma.spec.create({
-        data: {
-          id: sid,
-          projectId: group2.projectId,
-          title: `${group2.type}: ${short}`,
-          source: "qa",
-          stage: "brainstorming",
-          priority: "tinggi",
-          author: `QA \xB7 ${opts.author}`,
-          objective: `${group2.type}: ${group2.message}. ${backlink}`,
-          payload
-        }
-      });
-    } catch (e) {
-      if (e.code === "P2002" && attempt < 2) continue;
-      throw e;
-    }
-  }
-  await prisma.errorGroup.update({ where: { id: group2.id }, data: { status: "escalated", specId: spec.id } });
-  await notifySynced("spec", spec.id);
-  await notifySynced("errorGroup", group2.id);
-  return { spec, created: true };
-}
-
-// ../node_modules/.pnpm/@jridgewell+sourcemap-codec@1.5.5/node_modules/@jridgewell/sourcemap-codec/dist/sourcemap-codec.mjs
-var comma = ",".charCodeAt(0);
-var semicolon = ";".charCodeAt(0);
-var chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-var intToChar = new Uint8Array(64);
-var charToInt = new Uint8Array(128);
-for (let i = 0; i < chars.length; i++) {
-  const c = chars.charCodeAt(i);
-  intToChar[i] = c;
-  charToInt[c] = i;
-}
-function decodeInteger(reader, relative2) {
-  let value = 0;
-  let shift = 0;
-  let integer = 0;
-  do {
-    const c = reader.next();
-    integer = charToInt[c];
-    value |= (integer & 31) << shift;
-    shift += 5;
-  } while (integer & 32);
-  const shouldNegate = value & 1;
-  value >>>= 1;
-  if (shouldNegate) {
-    value = -2147483648 | -value;
-  }
-  return relative2 + value;
-}
-function hasMoreVlq(reader, max) {
-  if (reader.pos >= max) return false;
-  return reader.peek() !== comma;
-}
-var bufLength = 1024 * 16;
-var StringReader = class {
-  constructor(buffer) {
-    this.pos = 0;
-    this.buffer = buffer;
-  }
-  next() {
-    return this.buffer.charCodeAt(this.pos++);
-  }
-  peek() {
-    return this.buffer.charCodeAt(this.pos);
-  }
-  indexOf(char) {
-    const { buffer, pos } = this;
-    const idx = buffer.indexOf(char, pos);
-    return idx === -1 ? buffer.length : idx;
-  }
-};
-function decode(mappings) {
-  const { length } = mappings;
-  const reader = new StringReader(mappings);
-  const decoded = [];
-  let genColumn = 0;
-  let sourcesIndex = 0;
-  let sourceLine = 0;
-  let sourceColumn = 0;
-  let namesIndex = 0;
-  do {
-    const semi = reader.indexOf(";");
-    const line = [];
-    let sorted = true;
-    let lastCol = 0;
-    genColumn = 0;
-    while (reader.pos < semi) {
-      let seg;
-      genColumn = decodeInteger(reader, genColumn);
-      if (genColumn < lastCol) sorted = false;
-      lastCol = genColumn;
-      if (hasMoreVlq(reader, semi)) {
-        sourcesIndex = decodeInteger(reader, sourcesIndex);
-        sourceLine = decodeInteger(reader, sourceLine);
-        sourceColumn = decodeInteger(reader, sourceColumn);
-        if (hasMoreVlq(reader, semi)) {
-          namesIndex = decodeInteger(reader, namesIndex);
-          seg = [genColumn, sourcesIndex, sourceLine, sourceColumn, namesIndex];
-        } else {
-          seg = [genColumn, sourcesIndex, sourceLine, sourceColumn];
-        }
-      } else {
-        seg = [genColumn];
-      }
-      line.push(seg);
-      reader.pos++;
-    }
-    if (!sorted) sort(line);
-    decoded.push(line);
-    reader.pos = semi + 1;
-  } while (reader.pos <= length);
-  return decoded;
-}
-function sort(line) {
-  line.sort(sortComparator);
-}
-function sortComparator(a, b) {
-  return a[0] - b[0];
-}
-
-// ../node_modules/.pnpm/@jridgewell+resolve-uri@3.1.2/node_modules/@jridgewell/resolve-uri/dist/resolve-uri.mjs
-var schemeRegex = /^[\w+.-]+:\/\//;
-var urlRegex = /^([\w+.-]+:)\/\/([^@/#?]*@)?([^:/#?]*)(:\d+)?(\/[^#?]*)?(\?[^#]*)?(#.*)?/;
-var fileRegex = /^file:(?:\/\/((?![a-z]:)[^/#?]*)?)?(\/?[^#?]*)(\?[^#]*)?(#.*)?/i;
-function isAbsoluteUrl(input) {
-  return schemeRegex.test(input);
-}
-function isSchemeRelativeUrl(input) {
-  return input.startsWith("//");
-}
-function isAbsolutePath(input) {
-  return input.startsWith("/");
-}
-function isFileUrl(input) {
-  return input.startsWith("file:");
-}
-function isRelative(input) {
-  return /^[.?#]/.test(input);
-}
-function parseAbsoluteUrl(input) {
-  const match = urlRegex.exec(input);
-  return makeUrl(match[1], match[2] || "", match[3], match[4] || "", match[5] || "/", match[6] || "", match[7] || "");
-}
-function parseFileUrl(input) {
-  const match = fileRegex.exec(input);
-  const path = match[2];
-  return makeUrl("file:", "", match[1] || "", "", isAbsolutePath(path) ? path : "/" + path, match[3] || "", match[4] || "");
-}
-function makeUrl(scheme, user, host2, port2, path, query, hash2) {
-  return {
-    scheme,
-    user,
-    host: host2,
-    port: port2,
-    path,
-    query,
-    hash: hash2,
-    type: 7
-  };
-}
-function parseUrl(input) {
-  if (isSchemeRelativeUrl(input)) {
-    const url3 = parseAbsoluteUrl("http:" + input);
-    url3.scheme = "";
-    url3.type = 6;
-    return url3;
-  }
-  if (isAbsolutePath(input)) {
-    const url3 = parseAbsoluteUrl("http://foo.com" + input);
-    url3.scheme = "";
-    url3.host = "";
-    url3.type = 5;
-    return url3;
-  }
-  if (isFileUrl(input))
-    return parseFileUrl(input);
-  if (isAbsoluteUrl(input))
-    return parseAbsoluteUrl(input);
-  const url2 = parseAbsoluteUrl("http://foo.com/" + input);
-  url2.scheme = "";
-  url2.host = "";
-  url2.type = input ? input.startsWith("?") ? 3 : input.startsWith("#") ? 2 : 4 : 1;
-  return url2;
-}
-function stripPathFilename(path) {
-  if (path.endsWith("/.."))
-    return path;
-  const index = path.lastIndexOf("/");
-  return path.slice(0, index + 1);
-}
-function mergePaths(url2, base) {
-  normalizePath(base, base.type);
-  if (url2.path === "/") {
-    url2.path = base.path;
-  } else {
-    url2.path = stripPathFilename(base.path) + url2.path;
-  }
-}
-function normalizePath(url2, type) {
-  const rel = type <= 4;
-  const pieces = url2.path.split("/");
-  let pointer = 1;
-  let positive = 0;
-  let addTrailingSlash = false;
-  for (let i = 1; i < pieces.length; i++) {
-    const piece = pieces[i];
-    if (!piece) {
-      addTrailingSlash = true;
-      continue;
-    }
-    addTrailingSlash = false;
-    if (piece === ".")
-      continue;
-    if (piece === "..") {
-      if (positive) {
-        addTrailingSlash = true;
-        positive--;
-        pointer--;
-      } else if (rel) {
-        pieces[pointer++] = piece;
-      }
-      continue;
-    }
-    pieces[pointer++] = piece;
-    positive++;
-  }
-  let path = "";
-  for (let i = 1; i < pointer; i++) {
-    path += "/" + pieces[i];
-  }
-  if (!path || addTrailingSlash && !path.endsWith("/..")) {
-    path += "/";
-  }
-  url2.path = path;
-}
-function resolve14(input, base) {
-  if (!input && !base)
-    return "";
-  const url2 = parseUrl(input);
-  let inputType = url2.type;
-  if (base && inputType !== 7) {
-    const baseUrl = parseUrl(base);
-    const baseType = baseUrl.type;
-    switch (inputType) {
-      case 1:
-        url2.hash = baseUrl.hash;
-      // fall through
-      case 2:
-        url2.query = baseUrl.query;
-      // fall through
-      case 3:
-      case 4:
-        mergePaths(url2, baseUrl);
-      // fall through
-      case 5:
-        url2.user = baseUrl.user;
-        url2.host = baseUrl.host;
-        url2.port = baseUrl.port;
-      // fall through
-      case 6:
-        url2.scheme = baseUrl.scheme;
-    }
-    if (baseType > inputType)
-      inputType = baseType;
-  }
-  normalizePath(url2, inputType);
-  const queryHash = url2.query + url2.hash;
-  switch (inputType) {
-    // This is impossible, because of the empty checks at the start of the function.
-    // case UrlType.Empty:
-    case 2:
-    case 3:
-      return queryHash;
-    case 4: {
-      const path = url2.path.slice(1);
-      if (!path)
-        return queryHash || ".";
-      if (isRelative(base || input) && !isRelative(path)) {
-        return "./" + path + queryHash;
-      }
-      return path + queryHash;
-    }
-    case 5:
-      return url2.path + queryHash;
-    default:
-      return url2.scheme + "//" + url2.user + url2.host + url2.port + url2.path + queryHash;
-  }
-}
-
-// ../node_modules/.pnpm/@jridgewell+trace-mapping@0.3.31/node_modules/@jridgewell/trace-mapping/dist/trace-mapping.mjs
-function stripFilename(path) {
-  if (!path) return "";
-  const index = path.lastIndexOf("/");
-  return path.slice(0, index + 1);
-}
-function resolver(mapUrl, sourceRoot) {
-  const from = stripFilename(mapUrl);
-  const prefix = sourceRoot ? sourceRoot + "/" : "";
-  return (source) => resolve14(prefix + (source || ""), from);
-}
-var COLUMN = 0;
-var SOURCES_INDEX = 1;
-var SOURCE_LINE = 2;
-var SOURCE_COLUMN = 3;
-var NAMES_INDEX = 4;
-function maybeSort(mappings, owned) {
-  const unsortedIndex = nextUnsortedSegmentLine(mappings, 0);
-  if (unsortedIndex === mappings.length) return mappings;
-  if (!owned) mappings = mappings.slice();
-  for (let i = unsortedIndex; i < mappings.length; i = nextUnsortedSegmentLine(mappings, i + 1)) {
-    mappings[i] = sortSegments(mappings[i], owned);
-  }
-  return mappings;
-}
-function nextUnsortedSegmentLine(mappings, start) {
-  for (let i = start; i < mappings.length; i++) {
-    if (!isSorted(mappings[i])) return i;
-  }
-  return mappings.length;
-}
-function isSorted(line) {
-  for (let j = 1; j < line.length; j++) {
-    if (line[j][COLUMN] < line[j - 1][COLUMN]) {
-      return false;
-    }
-  }
-  return true;
-}
-function sortSegments(line, owned) {
-  if (!owned) line = line.slice();
-  return line.sort(sortComparator2);
-}
-function sortComparator2(a, b) {
-  return a[COLUMN] - b[COLUMN];
-}
-var found = false;
-function binarySearch(haystack, needle, low, high) {
-  while (low <= high) {
-    const mid = low + (high - low >> 1);
-    const cmp = haystack[mid][COLUMN] - needle;
-    if (cmp === 0) {
-      found = true;
-      return mid;
-    }
-    if (cmp < 0) {
-      low = mid + 1;
-    } else {
-      high = mid - 1;
-    }
-  }
-  found = false;
-  return low - 1;
-}
-function upperBound(haystack, needle, index) {
-  for (let i = index + 1; i < haystack.length; index = i++) {
-    if (haystack[i][COLUMN] !== needle) break;
-  }
-  return index;
-}
-function lowerBound(haystack, needle, index) {
-  for (let i = index - 1; i >= 0; index = i--) {
-    if (haystack[i][COLUMN] !== needle) break;
-  }
-  return index;
-}
-function memoizedState() {
-  return {
-    lastKey: -1,
-    lastNeedle: -1,
-    lastIndex: -1
-  };
-}
-function memoizedBinarySearch(haystack, needle, state, key) {
-  const { lastKey, lastNeedle, lastIndex } = state;
-  let low = 0;
-  let high = haystack.length - 1;
-  if (key === lastKey) {
-    if (needle === lastNeedle) {
-      found = lastIndex !== -1 && haystack[lastIndex][COLUMN] === needle;
-      return lastIndex;
-    }
-    if (needle >= lastNeedle) {
-      low = lastIndex === -1 ? 0 : lastIndex;
-    } else {
-      high = lastIndex;
-    }
-  }
-  state.lastKey = key;
-  state.lastNeedle = needle;
-  return state.lastIndex = binarySearch(haystack, needle, low, high);
-}
-function parse2(map) {
-  return typeof map === "string" ? JSON.parse(map) : map;
-}
-var LINE_GTR_ZERO = "`line` must be greater than 0 (lines start at line 1)";
-var COL_GTR_EQ_ZERO = "`column` must be greater than or equal to 0 (columns start at column 0)";
-var LEAST_UPPER_BOUND = -1;
-var GREATEST_LOWER_BOUND = 1;
-var TraceMap = class {
-  constructor(map, mapUrl) {
-    const isString = typeof map === "string";
-    if (!isString && map._decodedMemo) return map;
-    const parsed = parse2(map);
-    const { version, file, names, sourceRoot, sources: sources2, sourcesContent } = parsed;
-    this.version = version;
-    this.file = file;
-    this.names = names || [];
-    this.sourceRoot = sourceRoot;
-    this.sources = sources2;
-    this.sourcesContent = sourcesContent;
-    this.ignoreList = parsed.ignoreList || parsed.x_google_ignoreList || void 0;
-    const resolve15 = resolver(mapUrl, sourceRoot);
-    this.resolvedSources = sources2.map(resolve15);
-    const { mappings } = parsed;
-    if (typeof mappings === "string") {
-      this._encoded = mappings;
-      this._decoded = void 0;
-    } else if (Array.isArray(mappings)) {
-      this._encoded = void 0;
-      this._decoded = maybeSort(mappings, isString);
-    } else if (parsed.sections) {
-      throw new Error(`TraceMap passed sectioned source map, please use FlattenMap export instead`);
-    } else {
-      throw new Error(`invalid source map: ${JSON.stringify(parsed)}`);
-    }
-    this._decodedMemo = memoizedState();
-    this._bySources = void 0;
-    this._bySourceMemos = void 0;
-  }
-};
-function cast(map) {
-  return map;
-}
-function decodedMappings(map) {
-  var _a;
-  return (_a = cast(map))._decoded || (_a._decoded = decode(cast(map)._encoded));
-}
-function originalPositionFor(map, needle) {
-  let { line, column, bias } = needle;
-  line--;
-  if (line < 0) throw new Error(LINE_GTR_ZERO);
-  if (column < 0) throw new Error(COL_GTR_EQ_ZERO);
-  const decoded = decodedMappings(map);
-  if (line >= decoded.length) return OMapping(null, null, null, null);
-  const segments = decoded[line];
-  const index = traceSegmentInternal(
-    segments,
-    cast(map)._decodedMemo,
-    line,
-    column,
-    bias || GREATEST_LOWER_BOUND
-  );
-  if (index === -1) return OMapping(null, null, null, null);
-  const segment = segments[index];
-  if (segment.length === 1) return OMapping(null, null, null, null);
-  const { names, resolvedSources } = map;
-  return OMapping(
-    resolvedSources[segment[SOURCES_INDEX]],
-    segment[SOURCE_LINE] + 1,
-    segment[SOURCE_COLUMN],
-    segment.length === 5 ? names[segment[NAMES_INDEX]] : null
-  );
-}
-function sourceIndex(map, source) {
-  const { sources: sources2, resolvedSources } = map;
-  let index = sources2.indexOf(source);
-  if (index === -1) index = resolvedSources.indexOf(source);
-  return index;
-}
-function sourceContentFor(map, source) {
-  const { sourcesContent } = map;
-  if (sourcesContent == null) return null;
-  const index = sourceIndex(map, source);
-  return index === -1 ? null : sourcesContent[index];
-}
-function OMapping(source, line, column, name2) {
-  return { source, line, column, name: name2 };
-}
-function traceSegmentInternal(segments, memo, line, column, bias) {
-  let index = memoizedBinarySearch(segments, column, memo, line);
-  if (found) {
-    index = (bias === LEAST_UPPER_BOUND ? upperBound : lowerBound)(segments, column, index);
-  } else if (bias === LEAST_UPPER_BOUND) index++;
-  if (index === -1 || index === segments.length) return -1;
-  return index;
-}
-
-// src/services/symbolicate.ts
-var CONTEXT = 3;
-async function symbolicateFrames(frames, lookup) {
-  const cache4 = /* @__PURE__ */ new Map();
-  const out3 = [];
-  for (const f of frames) {
-    const base = { ...f, symbolicated: false };
-    if (!f.filename || !f.lineno) {
-      out3.push(base);
-      continue;
-    }
-    let tracer = cache4.get(f.filename);
-    if (tracer === void 0) {
-      const text = await lookup(f.filename);
-      try {
-        tracer = text ? new TraceMap(text) : null;
-      } catch {
-        tracer = null;
-      }
-      cache4.set(f.filename, tracer);
-    }
-    if (!tracer) {
-      out3.push(base);
-      continue;
-    }
-    try {
-      const pos = originalPositionFor(tracer, { line: f.lineno, column: (f.colno ?? 1) - 1 });
-      if (pos.source == null || pos.line == null) {
-        out3.push(base);
-        continue;
-      }
-      const content = sourceContentFor(tracer, pos.source);
-      let contextLine, preContext, postContext;
-      if (content != null) {
-        const lines2 = content.split("\n");
-        const idx = pos.line - 1;
-        contextLine = lines2[idx];
-        preContext = lines2.slice(Math.max(0, idx - CONTEXT), idx);
-        postContext = lines2.slice(idx + 1, idx + 1 + CONTEXT);
-      }
-      out3.push({
-        ...f,
-        function: pos.name ?? f.function,
-        source: pos.source,
-        sourceLine: pos.line,
-        sourceColumn: pos.column ?? void 0,
-        in_app: !/node_modules/.test(pos.source),
-        contextLine,
-        preContext,
-        postContext,
-        symbolicated: true
-      });
-    } catch {
-      out3.push(base);
-    }
-  }
-  return out3;
-}
-
-// src/routes/errors.ts
-var groupView = (g) => ({
-  id: g.id,
-  projectId: g.projectId,
-  type: g.type,
-  message: g.message,
-  environment: g.environment,
-  status: g.status,
-  count: g.count,
-  firstSeenAt: g.firstSeenAt,
-  lastSeenAt: g.lastSeenAt,
-  specId: g.specId,
-  release: g.release
-  // SPEC-276 · korelasi build
-});
-var eventView = (e) => ({
-  id: e.id,
-  type: e.type,
-  message: e.message,
-  stack: e.stack,
-  environment: e.environment,
-  release: e.release,
-  receivedAt: e.receivedAt
-});
-async function errors_default(app2) {
-  app2.get("/errors/integration-guide", async (_req, reply) => {
-    try {
-      const text = await readFile6(join14(repoRoot(), "sdk", "README.md"), "utf8");
-      return { text };
-    } catch {
-      return reply.code(404).send({ error: "panduan integrasi tidak ditemukan" });
-    }
-  });
-  app2.get("/errors", async (req) => {
-    const { project, environment, status, q, page, limit } = req.query;
-    const where = {};
-    if (project) where.projectId = project;
-    if (environment) where.environment = environment;
-    if (status) where.status = status;
-    let groups = await prisma.errorGroup.findMany({ where, orderBy: { lastSeenAt: "desc" } });
-    if (q) {
-      const n = q.toLowerCase();
-      groups = groups.filter((g) => `${g.type} ${g.message}`.toLowerCase().includes(n));
-    }
-    return paginate(groups.map(groupView), page, limit);
-  });
-  app2.get("/errors/:id", async (req, reply) => {
-    const { id } = req.params;
-    const g = await prisma.errorGroup.findUnique({ where: { id } });
-    if (!g) return reply.code(404).send({ error: "not found" });
-    const events = await prisma.errorEvent.findMany({
-      where: { groupId: id },
-      orderBy: { receivedAt: "desc" },
-      take: 50
-    });
-    const sampleFrames = Array.isArray(g.sampleFrames) ? await symbolicateFrames(
-      g.sampleFrames,
-      (fn) => findSourceMap(g.projectId, g.release ?? "", fn)
-    ) : null;
-    return { ...groupView(g), sampleStack: g.sampleStack, sampleFrames, events: events.map(eventView) };
-  });
-  app2.post("/errors/:id/escalate", async (req, reply) => {
-    const { id } = req.params;
-    const g = await prisma.errorGroup.findUnique({ where: { id } });
-    if (!g) return reply.code(404).send({ error: "not found" });
-    const { spec, created } = await escalateErrorGroup(g, { author: req.user?.email ?? "system" });
-    return created ? reply.code(201).send({ spec }) : reply.code(200).send({ alreadyEscalated: true, spec });
-  });
-  app2.post("/errors/:id/unlink", async (req, reply) => {
-    const { id } = req.params;
-    const g = await prisma.errorGroup.findUnique({ where: { id } });
-    if (!g) return reply.code(404).send({ error: "not found" });
-    const updated = await prisma.errorGroup.update({ where: { id }, data: { status: "new", specId: null } });
-    await notifySynced("errorGroup", id);
-    return { id: updated.id, status: updated.status, specId: updated.specId };
-  });
-  app2.patch("/errors/:id", async (req, reply) => {
-    const { id } = req.params;
-    const parsed = zErrorStatus.safeParse(req.body?.status);
-    if (!parsed.success) return reply.code(400).send({ error: "status invalid" });
-    const g = await prisma.errorGroup.findUnique({ where: { id } });
-    if (!g) return reply.code(404).send({ error: "not found" });
-    const updated = await prisma.errorGroup.update({ where: { id }, data: { status: parsed.data } });
-    await notifySynced("errorGroup", id);
-    return { id: updated.id, status: updated.status };
-  });
-  app2.delete("/errors/:id", async (req, reply) => {
-    const { id } = req.params;
-    const g = await prisma.errorGroup.findUnique({ where: { id } });
-    if (!g) return reply.code(404).send({ error: "not found" });
-    await prisma.errorGroup.delete({ where: { id } });
-    return { ok: true };
-  });
-}
-
 // src/routes/help.ts
 init_zod();
 init_src();
@@ -22760,17 +21617,17 @@ init_db();
 
 // src/services/ticket.ts
 init_db();
-import { createHash as createHash4, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
 init_src();
 function hashAccessKey(key) {
-  return createHash4("sha256").update(key).digest("hex");
+  return createHash2("sha256").update(key).digest("hex");
 }
 function generateAccessKey() {
-  const key = "hnm_tkt_" + randomBytes4(24).toString("hex");
+  const key = "hnm_tkt_" + randomBytes2(24).toString("hex");
   return { key, hash: hashAccessKey(key) };
 }
 function generateShareToken() {
-  return "hnm_shr_" + randomBytes4(24).toString("hex");
+  return "hnm_shr_" + randomBytes2(24).toString("hex");
 }
 async function createTicket(input) {
   const { key, hash: hash2 } = generateAccessKey();
@@ -22919,7 +21776,7 @@ init_db();
 
 // src/services/ticket-accept.ts
 init_db();
-import { join as join15 } from "node:path";
+import { join as join13 } from "node:path";
 async function materializeAttachments(atts) {
   const ready = /* @__PURE__ */ new Set();
   for (const a of atts) {
@@ -22934,7 +21791,7 @@ async function materializeAttachments(atts) {
 var attachmentInstruction = (t, atts, ready) => {
   if (atts.length === 0) return "Tanpa lampiran.";
   const list2 = atts.map(
-    (a) => ready.has(a.id) ? `- ${a.filename} (${a.mimeType}) \u2192 ${join15(uploadDir(), a.storageKey)}` : `- ${a.filename} (${a.mimeType}) \u2192 BELUM TERUNDUH, ambil via GET /api/tickets/${t.id}/attachments/${a.id}`
+    (a) => ready.has(a.id) ? `- ${a.filename} (${a.mimeType}) \u2192 ${join13(uploadDir(), a.storageKey)}` : `- ${a.filename} (${a.mimeType}) \u2192 BELUM TERUNDUH, ambil via GET /api/tickets/${t.id}/attachments/${a.id}`
   ).join("\n");
   return `LAMPIRAN (${atts.length}) dari pelapor \u2014 biasanya screenshot yang menunjukkan masalah. PERIKSA setiap lampiran untuk memahami konteks keluhan sebelum bekerja; jangan berasumsi dari teks saja. Berkas ada di direktori upload server (baca langsung dengan tool Read):
 ${list2}
@@ -23132,6 +21989,7 @@ async function setScheduler(next) {
 // src/services/scheduler/queue.ts
 init_db();
 var RANK = { tinggi: 0, sedang: 1, rendah: 2 };
+var UNSTARTED_SPEC_WHERE = { baseSha: null, stage: { not: "done" } };
 async function enqueue(i) {
   await prisma.schedulerQueueItem.upsert({
     where: { specId: i.specId },
@@ -23152,8 +22010,16 @@ async function markLaunched(id, sessionId2) {
 async function markFailed(id, note) {
   await prisma.schedulerQueueItem.update({ where: { id }, data: { status: "failed", note: note ?? null } });
 }
-async function markDone(id) {
-  await prisma.schedulerQueueItem.update({ where: { id }, data: { status: "done" } });
+async function markDone(id, note) {
+  await prisma.schedulerQueueItem.update({
+    where: { id },
+    data: { status: "done", ...note ? { note } : {} }
+  });
+}
+async function noteQueued(id, note) {
+  const row = await prisma.schedulerQueueItem.findUnique({ where: { id }, select: { note: true } });
+  if (row?.note === note) return;
+  await prisma.schedulerQueueItem.update({ where: { id }, data: { note } });
 }
 
 // src/services/scheduler/registry.ts
@@ -23202,7 +22068,6 @@ async function scheduler_default(app2) {
     };
     const sources2 = [
       srcView("backlog", cfg.sources.backlog),
-      srcView("errors", cfg.sources.errors, cfg.sources.errors.minCount),
       srcView("triase", cfg.sources.triase)
     ];
     const launchedSpecs = new Set(queue.filter((q) => q.status === "launched").map((q) => q.specId));
@@ -23211,114 +22076,6 @@ async function scheduler_default(app2) {
   });
 }
 
-// src/routes/audit.ts
-init_db();
-var REL = /^(\d+)([mhd])$/;
-var MS = { m: 6e4, h: 36e5, d: 864e5 };
-function parseWhen(v, fallback2, now) {
-  if (!v) return fallback2;
-  const m = REL.exec(v.trim());
-  if (m) return new Date(now.getTime() - Number(m[1]) * MS[m[2]]);
-  const d = new Date(v);
-  return isNaN(d.getTime()) ? null : d;
-}
-var groupView2 = (g) => ({
-  id: g.id,
-  projectId: g.projectId,
-  type: g.type,
-  message: g.message,
-  environment: g.environment,
-  release: g.release,
-  status: g.status,
-  count: g.count,
-  firstSeenAt: g.firstSeenAt,
-  lastSeenAt: g.lastSeenAt,
-  specId: g.specId
-});
-var timelineView = (e) => ({
-  at: e.receivedAt,
-  projectId: e.projectId,
-  groupId: e.groupId,
-  type: e.type,
-  message: e.message,
-  environment: e.environment,
-  release: e.release
-});
-async function scopeFor(req) {
-  const s = auditScopeFromReq(req);
-  if (s) return s;
-  return (await prisma.project.findMany({ select: { id: true } })).map((p) => p.id);
-}
-async function audit_default(app2) {
-  app2.get("/audit/logs", async (req, reply) => {
-    const q = req.query;
-    const now = /* @__PURE__ */ new Date();
-    const since = parseWhen(q.since, new Date(now.getTime() - MS.d), now);
-    const until = parseWhen(q.until, now, now);
-    if (!since || !until) return reply.code(400).send({ error: "since/until tak terparse \u2014 pakai 24h, 7d, atau ISO-8601" });
-    const scope = await scopeFor(req);
-    let projects = scope;
-    if (q.projects) {
-      const want = q.projects.split(",").map((s) => s.trim()).filter(Boolean);
-      const outside = want.filter((p) => !scope.includes(p));
-      if (outside.length) return reply.code(403).send({ error: `di luar scope sesi: ${outside.join(", ")}` });
-      if (want.length) projects = want;
-    }
-    const limit = Math.min(Number(q.limit) || 200, 1e3);
-    const needle = (q.q ?? "").trim().toLowerCase();
-    const envWhere = q.environment ? { environment: q.environment } : {};
-    const raw = await prisma.errorEvent.findMany({
-      where: { projectId: { in: projects }, receivedAt: { gte: since, lte: until }, ...envWhere },
-      orderBy: { receivedAt: "desc" },
-      take: needle ? 2e3 : limit
-    });
-    const events = (needle ? raw.filter((e) => `${e.type} ${e.message}`.toLowerCase().includes(needle)) : raw).slice(0, limit);
-    const rawGroups = await prisma.errorGroup.findMany({
-      where: { projectId: { in: projects }, lastSeenAt: { gte: since }, ...envWhere },
-      orderBy: { lastSeenAt: "desc" },
-      take: 200
-    });
-    const groups = needle ? rawGroups.filter((g) => `${g.type} ${g.message}`.toLowerCase().includes(needle)) : rawGroups;
-    const names = await prisma.project.findMany({ where: { id: { in: projects } }, select: { id: true, name: true } });
-    return {
-      window: { since, until },
-      scope: names,
-      groups: groups.map(groupView2),
-      timeline: events.map(timelineView)
-    };
-  });
-  app2.get("/audit/logs/:groupId", async (req, reply) => {
-    const { groupId } = req.params;
-    const scope = await scopeFor(req);
-    const g = await prisma.errorGroup.findUnique({ where: { id: groupId } });
-    if (!g || !scope.includes(g.projectId)) return reply.code(404).send({ error: "not found" });
-    const events = await prisma.errorEvent.findMany({
-      where: { groupId },
-      orderBy: { receivedAt: "desc" },
-      take: 50
-    });
-    const sampleFrames = Array.isArray(g.sampleFrames) ? await symbolicateFrames(
-      g.sampleFrames,
-      (fn) => findSourceMap(g.projectId, g.release ?? "", fn)
-    ) : null;
-    return {
-      ...groupView2(g),
-      sampleStack: g.sampleStack,
-      sampleFrames,
-      events: events.map((e) => ({
-        id: e.id,
-        at: e.receivedAt,
-        type: e.type,
-        message: e.message,
-        stack: e.stack,
-        environment: e.environment,
-        release: e.release,
-        context: e.context
-      }))
-    };
-  });
-}
-
 // src/routes/lead.ts
 init_src();
 init_db();
@@ -23392,8 +22149,12 @@ function leadPrompt(q, c) {
     for (const [i, o] of q.options.entries()) lines2.push(`${i + 1}. ${o}`);
   }
   lines2.push("");
+  lines2.push("## Batas waktu (BACA INI DULU)");
+  lines2.push(`Kamu punya **${c.timeoutSec} detik** sejak sekarang. Lewat dari itu prosesmu dihentikan paksa, keluaranmu DIBUANG, dan permintaan ini dicatat sebagai kegagalan \u2014 peminta kembali mandek menunggu manusia. Jadi keputusan tepat waktu di atas bukti secukupnya jauh lebih berguna daripada pembacaan lengkap yang tak pernah sampai.`);
+  lines2.push(`Anggarkan begini: pakai paling banyak separuh waktu untuk mengumpulkan bukti, lalu **berhenti membaca** dan tulis jawabannya dengan apa yang sudah kamu punya. Kalau buktinya jadi tipis karena itu, turunkan \`confidence\`-nya \u2014 jangan menambah waktu baca.`);
+  lines2.push("");
   lines2.push("## Cara kerja");
-  lines2.push("1. KUMPULKAN BUKTI DULU sebelum memutuskan: `internal/docs/**` (Source of Truth) dan index-nya, ADR yang relevan, plan `docs/superpowers/plans/**`, kode yang bersangkutan, dan riwayat git. Baca, jangan mengingat.");
+  lines2.push("1. KUMPULKAN BUKTI DULU sebelum memutuskan, DI DALAM anggaran waktu di atas: `internal/docs/**` (Source of Truth) dan index-nya, ADR yang relevan, plan `docs/superpowers/plans/**`, kode yang bersangkutan, dan riwayat git. Baca, jangan mengingat \u2014 tapi baca seperlunya, bukan sehabisnya.");
   lines2.push('2. Putuskan. Kalau setelah membaca kamu masih ragu, TETAP putuskan: pilih opsi yang PALING MUDAH DIBATALKAN, lalu tandai `confidence: "ragu"`. Jangan pernah menjawab "tidak tahu" atau meminta manusia memutuskan \u2014 itu persis keadaan yang kamu ada untuk menghapusnya.');
   lines2.push("3. Rujuk bukti yang BENAR-BENAR kamu baca. Rujukan berupa path berkas relatif terhadap checkout, nomor ADR (`ADR-0091`), atau sha commit. Rujukan yang tak ada di repo akan dibuang server dan membuat jawabanmu tampak tanpa dasar.");
   lines2.push("4. JANGAN membaca atau mengutip kredensial (isi `.env*`, token, kunci privat). Jejak keputusan disimpan di basis data; rahasia tak boleh mendarat di sana.");
@@ -23548,6 +22309,7 @@ function toDecisionView(r) {
 
 // src/services/lead/brain.ts
 init_config2();
+init_pty();
 import { execFile as execFile9 } from "node:child_process";
 var binFor = (agent) => agent === "codex" ? effectiveStr("HANOMAN_CODEX_BIN") ?? "codex" : effectiveStr("HANOMAN_CLAUDE_BIN") ?? "claude";
 function leadArgv(o) {
@@ -23568,14 +22330,16 @@ function leadArgv(o) {
     o.prompt
   ];
 }
+var leadEnv = (agent, base = process.env, uid = process.getuid?.()) => agent === "claude" ? { ...rootBypassEnv(uid), ...base } : { ...base };
 function think(prompt, o) {
   const bin = binFor(o.agent);
   const args = leadArgv({ agent: o.agent, model: o.model, effort: o.effort, prompt });
-  return new Promise((resolve15, reject) => {
-    execFile9(bin, args, {
+  return new Promise((resolve14, reject) => {
+    const child = execFile9(bin, args, {
       cwd: o.cwd,
       timeout: o.timeoutMs,
       maxBuffer: 16 * 1024 * 1024,
+      env: leadEnv(o.agent),
       encoding: "utf8",
       killSignal: "SIGTERM"
     }, (err, stdout, stderr) => {
@@ -23584,8 +22348,9 @@ function think(prompt, o) {
         reject(new Error(killed ? `lead ${o.agent} kehabisan waktu ${o.timeoutMs} ms` : `lead ${o.agent} gagal: ${(stderr || err.message).trim().slice(0, 500)}`));
         return;
       }
-      resolve15(stdout);
+      resolve14(stdout);
     });
+    child.stdin?.end();
   });
 }
 
@@ -23627,6 +22392,10 @@ async function decide(req, deps = prodDecideDeps) {
     projectId: req.projectId,
     projectName: project?.name ?? req.projectId,
     repoDir,
+    // SPEC-432 · anggaran yang disebut prompt WAJIB berasal dari cfg yang sama yang dipakai
+    // `think()` di bawah. Dua sumber angka akan berselisih diam-diam begitu operator menggeser
+    // knob-nya, dan agen yang dianggarkan salah gagal persis seperti agen yang tak dianggarkan.
+    timeoutSec: cfg.timeoutSec,
     spec,
     liveSessions: deps.liveSessions().filter((s) => !s.exited && s.projectId === req.projectId && s.id !== req.sessionId).map((s) => ({ id: s.id, specId: s.specId, flow: s.flow, branch: s.branch })),
     priorDecisions: prior.map((d) => ({
@@ -23691,6 +22460,11 @@ function takeReply(decisionId) {
   return v;
 }
 async function fail(req, deps, reason) {
+  const prev = await prisma.leadDecision.findFirst({
+    where: { projectId: req.projectId, gate: req.gate, kind: req.kind },
+    orderBy: { createdAt: "desc" },
+    select: { status: true }
+  });
   const row = await recordDecision({
     projectId: req.projectId,
     specId: req.specId,
@@ -23706,13 +22480,15 @@ async function fail(req, deps, reason) {
     status: "gagal",
     weighty: true
   });
-  await deps.notify(
-    row.id,
-    `Lead gagal memutuskan: ${req.question.replace(/\s+/g, " ").slice(0, 90)}`,
-    req.projectId,
-    req.specId ?? null,
-    req.sessionId ?? null
-  );
+  if (prev?.status !== "gagal") {
+    await deps.notify(
+      row.id,
+      `Lead gagal memutuskan: ${req.question.replace(/\s+/g, " ").slice(0, 90)}`,
+      req.projectId,
+      req.specId ?? null,
+      req.sessionId ?? null
+    );
+  }
   return row;
 }
 
@@ -24048,7 +22824,8 @@ var prodPulseDeps = {
   enqueue,
   notify: recordLeadDecision,
   optIn: leadProjects,
-  cfg: getLead
+  cfg: getLead,
+  scheduler: getScheduler
 };
 var lastReadySig = /* @__PURE__ */ new Map();
 async function pulse(deps = prodPulseDeps) {
@@ -24079,7 +22856,10 @@ async function followUpFinished(cfg, optIn, deps) {
     const bad = (s.exitCode ?? 0) !== 0;
     const unfinished = !deps.planDone(s.cwd, s.specId);
     if (!bad && !unfinished) continue;
-    const seen = await prisma.leadDecision.findFirst({ where: { sessionId: s.id, kind: "quality", gate: "pulse" } });
+    const mark = `Sesi ${s.id} untuk backlog ${s.specId}`;
+    const seen = await prisma.leadDecision.findFirst({
+      where: { sessionId: s.id, gate: "pulse", question: { startsWith: mark } }
+    });
     if (seen) continue;
     const why = [
       bad ? `berakhir dengan kode keluar ${s.exitCode}` : null,
@@ -24091,7 +22871,7 @@ async function followUpFinished(cfg, optIn, deps) {
       sessionId: s.id,
       gate: "pulse",
       kind: "quality",
-      question: `Sesi ${s.id} untuk backlog ${s.specId} ${why}. Tindak lanjutnya apa: lanjutkan pekerjaan yang terputus, ulangi dari awal, atau hentikan?`,
+      question: `${mark} ${why}. Tindak lanjutnya apa: lanjutkan pekerjaan yang terputus, ulangi dari awal, atau hentikan?`,
       options: [
         "resume-session \u2014 lanjutkan dari keadaan worktree sekarang (ADR-0084)",
         "restart-session \u2014 ulangi dari awal",
@@ -24123,7 +22903,7 @@ async function detectCollisions(optIn, deps) {
   for (const c of findCollisions(areas)) {
     const key = [c.a.sessionId, c.b.sessionId].sort().join("|");
     const seen = await prisma.leadDecision.findFirst({
-      where: { kind: "collision", gate: "pulse", question: { contains: key } }
+      where: { gate: "pulse", question: { contains: key } }
     });
     if (seen) continue;
     const row = await deps.decide({
@@ -24147,36 +22927,57 @@ async function detectCollisions(optIn, deps) {
   return n;
 }
 async function orderReadyWork(optIn, deps) {
+  const sched = await deps.scheduler();
+  if (!sched.enabled || sched.paused) return 0;
   let total = 0;
   for (const projectId of optIn) total += await orderProject(projectId, deps);
   return total;
 }
 async function orderProject(projectId, deps) {
-  const ready = await prisma.spec.findMany({
-    where: { baseSha: null, projectId },
-    select: { id: true, projectId: true, title: true, priority: true, objective: true },
+  const project = await prisma.project.findUnique({ where: { id: projectId }, select: { schedulerOptIn: true } });
+  if (!project?.schedulerOptIn) return 0;
+  const readyRaw = await prisma.spec.findMany({
+    where: { ...UNSTARTED_SPEC_WHERE, projectId },
+    select: {
+      id: true,
+      projectId: true,
+      title: true,
+      priority: true,
+      objective: true,
+      branchFrom: true,
+      dependsOn: true
+    },
     orderBy: { id: "asc" }
   });
+  const repoDir = await resolveRepoDir(projectId);
+  const ready = [];
+  for (const r of readyRaw) if ((await blockersForSpec(r, repoDir)).length === 0) ready.push(r);
   if (ready.length < 2) return 0;
-  const sig = ready.map((r) => r.id).join(",");
+  const already = new Set((await prisma.schedulerQueueItem.findMany({
+    where: { specId: { in: ready.map((r) => r.id) } },
+    select: { specId: true }
+  })).map((q) => q.specId));
+  const pending = ready.filter((r) => !already.has(r.id));
+  if (pending.length < 2) return 0;
+  const sig = pending.map((r) => r.id).join(",");
   if (sig === lastReadySig.get(projectId)) return 0;
   lastReadySig.set(projectId, sig);
   const row = await deps.decide({
     projectId,
     gate: "pulse",
     kind: "order",
-    question: `Ada ${ready.length} backlog siap dikerjakan. Urutkan mana yang lebih dulu berdasarkan isi pekerjaannya, lalu tuliskan urutan id-nya (dipisah koma) di \`decision\`.`,
-    options: ready.map((r) => `${r.id} \xB7 [${r.priority}] ${r.title}`),
-    notes: ready.map((r) => `${r.id}: ${r.objective.slice(0, 200)}`)
+    question: `Ada ${pending.length} backlog siap dikerjakan. Urutkan mana yang lebih dulu berdasarkan isi pekerjaannya, lalu tuliskan urutan id-nya (dipisah koma) di \`decision\`.`,
+    options: pending.map((r) => `${r.id} \xB7 [${r.priority}] ${r.title}`),
+    notes: pending.map((r) => `${r.id}: ${r.objective.slice(0, 200)}`)
   }, deps.decideDeps);
   if (!row || row.status !== "berlaku") return 0;
-  const byId2 = new Map(ready.map((r) => [r.id.toLowerCase(), r]));
+  const byId2 = new Map(pending.map((r) => [r.id.toLowerCase(), r]));
   const named = [];
   for (const tok of row.answer.split(/[,\s]+/).map((t) => t.trim().toLowerCase()).filter(Boolean)) {
     const hit = byId2.get(tok);
     if (hit && !named.includes(hit)) named.push(hit);
   }
-  const ordered = [...named, ...ready.filter((r) => !named.includes(r))];
+  const ordered = [...named, ...pending.filter((r) => !named.includes(r))];
   for (const r of ordered) {
     await deps.enqueue({ specId: r.id, projectId: r.projectId, source: "lead", priority: r.priority });
   }
@@ -24186,36 +22987,46 @@ async function orderProject(projectId, deps) {
 
 // src/services/lead/engine.ts
 var TICK_MS = 5e3;
+var busyDetect = false;
+var busyPulse = false;
 var lastPulseAt = 0;
-var busy2 = false;
+var pulseEndedAt = 0;
 var timer3;
 function lastPulse() {
   return lastPulseAt;
 }
 async function tick2(now, deps = {}) {
-  if (busy2) return;
-  busy2 = true;
+  let cfg;
   try {
-    const cfg = await getLead();
-    if (!cfg.enabled) return;
-    try {
-      await scanAndAnswer(deps.detect ?? prodDetectDeps);
-    } catch (e) {
+    cfg = await getLead();
+  } catch (e) {
+    console.error("lead tick:", e);
+    return;
+  }
+  if (!cfg.enabled) return;
+  const jobs = [];
+  if (!busyDetect) {
+    busyDetect = true;
+    jobs.push(scanAndAnswer(deps.detect ?? prodDetectDeps).then(() => {
+    }).catch((e) => {
       console.error("lead detect:", e);
-    }
-    if (cfg.paused) return;
-    if (now - lastPulseAt < cfg.everyMin * 6e4) return;
+    }).finally(() => {
+      busyDetect = false;
+    }));
+  }
+  if (!cfg.paused && !busyPulse && now - Math.max(lastPulseAt, pulseEndedAt) >= cfg.everyMin * 6e4) {
+    busyPulse = true;
     lastPulseAt = now;
-    try {
-      await pulse(deps.pulse ?? prodPulseDeps);
-    } catch (e) {
+    const clock = deps.now ?? Date.now;
+    jobs.push(pulse(deps.pulse ?? prodPulseDeps).then(() => {
+    }).catch((e) => {
       console.error("lead pulse:", e);
-    }
-  } catch (e) {
-    console.error("lead tick:", e);
-  } finally {
-    busy2 = false;
+    }).finally(() => {
+      pulseEndedAt = clock();
+      busyPulse = false;
+    }));
   }
+  await Promise.all(jobs);
 }
 function startLead(deps = {}) {
   if (timer3) return;
@@ -24360,13 +23171,13 @@ init_db();
 
 // src/services/auth.ts
 init_db();
-import { randomBytes as randomBytes5, scrypt as scryptCb, timingSafeEqual as timingSafeEqual2, createHash as createHash5 } from "node:crypto";
+import { randomBytes as randomBytes3, scrypt as scryptCb, timingSafeEqual, createHash as createHash3 } from "node:crypto";
 import { promisify as promisify9 } from "node:util";
 var scrypt = promisify9(scryptCb);
 var COOKIE_NAME = "hn_session";
 var SESSION_TTL_MS = 7 * 24 * 3600 * 1e3;
 async function hashPassword(pw) {
-  const salt = randomBytes5(16);
+  const salt = randomBytes3(16);
   const key = await scrypt(pw, salt, 64);
   return `${salt.toString("hex")}:${key.toString("hex")}`;
 }
@@ -24375,10 +23186,10 @@ async function verifyPassword(pw, stored) {
   if (!saltHex || !hashHex) return false;
   const key = await scrypt(pw, Buffer.from(saltHex, "hex"), 64);
   const want = Buffer.from(hashHex, "hex");
-  return key.length === want.length && timingSafeEqual2(key, want);
+  return key.length === want.length && timingSafeEqual(key, want);
 }
-var newSessionToken = () => randomBytes5(32).toString("base64url");
-var sessionId = (token) => createHash5("sha256").update(token).digest("hex");
+var newSessionToken = () => randomBytes3(32).toString("base64url");
+var sessionId = (token) => createHash3("sha256").update(token).digest("hex");
 async function createSession2(userId) {
   const token = newSessionToken();
   await prisma.session.create({
@@ -24509,8 +23320,8 @@ init_src();
 
 // src/services/agent-token.ts
 init_db();
-import { randomBytes as randomBytes6, createHash as createHash6, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
-var hash = (token) => createHash6("sha256").update(token).digest("hex");
+import { randomBytes as randomBytes4, createHash as createHash4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var hash = (token) => createHash4("sha256").update(token).digest("hex");
 function toAgentTokenView(t) {
   return {
     id: t.id,
@@ -24525,7 +23336,7 @@ function toAgentTokenView(t) {
   };
 }
 async function issueAgentToken(input) {
-  const token = "hnm_agt_" + randomBytes6(24).toString("hex");
+  const token = "hnm_agt_" + randomBytes4(24).toString("hex");
   const row = await prisma.agentToken.create({
     data: {
       name: input.name,
@@ -24543,7 +23354,7 @@ async function verifyAgentToken(token) {
   if (!row || !row.enabled || row.revokedAt) return null;
   const a = Buffer.from(hash(token), "hex");
   const b = Buffer.from(row.tokenHash, "hex");
-  if (a.length !== b.length || !timingSafeEqual3(a, b)) return null;
+  if (a.length !== b.length || !timingSafeEqual2(a, b)) return null;
   await prisma.agentToken.update({ where: { id: row.id }, data: { lastUsedAt: /* @__PURE__ */ new Date() } }).catch(() => {
   });
   return { id: row.id, capabilities: Array.isArray(row.capabilities) ? row.capabilities : [] };
@@ -24638,7 +23449,7 @@ function capabilityForRoute(method, path) {
   if (top === "settings" || top === "config") return rw("settings");
   if (top === "specs") return rw("backlog");
   if (top === "notifications") return rw("notifications");
-  if (top === "errors" || top === "tickets") return rw("support");
+  if (top === "tickets") return rw("support");
   if (top === "vps") return rw("vps");
   if (top === "prds") return rw("docs");
   if (top === "terminal") {
@@ -24698,9 +23509,7 @@ function buildApp({ requireAuth = true } = {}) {
         const path = req.url.split("?")[0] ?? req.url;
         if (PUBLIC.has(`${req.method} ${path}`)) return;
         if (path.startsWith("/api/sync") && path !== "/api/sync/now" && !path.startsWith("/api/sync/conflicts")) return;
-        if (path.startsWith("/api/ingest")) return;
         if (path.startsWith("/api/help")) return;
-        if (path.startsWith("/api/audit/") && auditScopeFromReq(req)) return;
         if (user) return;
         const agentTok = agentTokenFromReq(req);
         if (agentTok) {
@@ -24738,12 +23547,9 @@ function buildApp({ requireAuth = true } = {}) {
     await api.register(session_results_default);
     await api.register(session_history_default);
     await api.register(config_default);
-    await api.register(ingest_default);
-    await api.register(errors_default);
     await api.register(help_default);
     await api.register(tickets_default);
     await api.register(scheduler_default);
-    await api.register(audit_default);
     await api.register(codex);
     await api.register(lead_default);
   }, { prefix: "/api" });
@@ -24798,6 +23604,7 @@ init_db();
 init_src();
 
 // src/services/scheduler/governor.ts
+var ALREADY_DONE_NOTE = "spec sudah selesai \u2014 tak diluncurkan";
 var draining = false;
 async function drain(cfg, deps) {
   if (draining) return;
@@ -24807,6 +23614,15 @@ async function drain(cfg, deps) {
     if (slots <= 0) return;
     for (const item of await queued()) {
       if (slots <= 0) break;
+      if (await deps.isDone(item.specId)) {
+        await markDone(item.id, ALREADY_DONE_NOTE);
+        continue;
+      }
+      const blocked = await deps.blockers(item.specId);
+      if (blocked.length) {
+        await noteQueued(item.id, blockedNote(blocked));
+        continue;
+      }
       const liveId = deps.isLive(item.specId);
       if (liveId) {
         await markLaunched(item.id, liveId);
@@ -24929,6 +23745,20 @@ var prodDeps = {
     const s = getSession(sessionIdForSpec(specId));
     return s && !s.exited ? s.id : null;
   },
+  // SPEC-431 · dibaca ULANG dari DB tepat sebelum launch, bukan dari baris antrean: antrean tak
+  // menyimpan stage, dan item bisa selesai selagi mengantre. Spec yang hilang bukan urusan gerbang
+  // ini — `launch` di bawah yang melempar "spec tak ada" → item ditandai failed dengan alasannya.
+  isDone: async (specId) => {
+    const s = await prisma.spec.findUnique({ where: { id: specId }, select: { stage: true } });
+    return s?.stage === "done";
+  },
+  // SPEC-447 · ADR-0093 · dibaca ULANG dari DB tepat sebelum launch, seperti `isDone`: `dependsOn`
+  // bisa ditulis operator selagi item mengantre, dan merged-ness bergerak sendiri saat ada integrate.
+  blockers: async (specId) => {
+    const spec = await prisma.spec.findUnique({ where: { id: specId } });
+    if (!spec) return [];
+    return blockersForSpec(spec, await resolveRepoDir(spec.projectId));
+  },
   launch: async (item, autonomy) => {
     const spec = await prisma.spec.findUnique({ where: { id: item.specId } });
     if (!spec) throw new Error(`spec ${item.specId} tak ada`);
@@ -24950,7 +23780,7 @@ init_db();
 var RANK2 = { tinggi: 0, sedang: 1, rendah: 2 };
 async function checkBacklog() {
   const specs = await prisma.spec.findMany({
-    where: { baseSha: null, project: { schedulerOptIn: true } }
+    where: { ...UNSTARTED_SPEC_WHERE, project: { schedulerOptIn: true } }
   });
   specs.sort((a, b) => (RANK2[a.priority] ?? 1) - (RANK2[b.priority] ?? 1) || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
   for (const s of specs) {
@@ -24961,36 +23791,6 @@ function registerBacklogSource() {
   registerSchedulerSource({ id: "backlog", check: checkBacklog });
 }
 
-// src/services/scheduler/sources/errors.ts
-init_db();
-async function checkErrors() {
-  const minCount = (await getScheduler()).sources.errors.minCount;
-  const groups = await prisma.errorGroup.findMany({
-    where: {
-      status: "new",
-      // escalated/resolved tersaring di query
-      environment: "production",
-      // literal, cermin services/error-ingest.ts
-      specId: null,
-      // grup ber-specId tersaring di query
-      count: { gte: minCount },
-      // ambang dari setelan
-      project: { schedulerOptIn: true }
-      // non-opt-in tak pernah ter-query
-    }
-  });
-  for (const g of groups) {
-    try {
-      const { spec } = await escalateErrorGroup(g, { author: "scheduler" });
-      await enqueue({ specId: spec.id, projectId: spec.projectId, source: "errors", priority: spec.priority });
-    } catch {
-    }
-  }
-}
-function registerErrorsSource() {
-  registerSchedulerSource({ id: "errors", check: checkErrors });
-}
-
 // src/services/scheduler/sources/triase.ts
 init_db();
 async function checkTriase() {
@@ -25050,7 +23850,6 @@ app.listen({ port, host }).then(() => {
   }
   startVpsMonitor();
   registerBacklogSource();
-  registerErrorsSource();
   registerTriaseSource();
   startScheduler();
   startLead();