iterate-plugin 3.5.4 → 3.5.5

package/src/git-scope.ts

@@ -90,7 +90,10 @@ function decodeQuotedPath(content: string): string {
 
 export function parseChangedFiles(stdout: string): string[] {
   if (stdout.includes('\0')) {
-    return stdout.split('\0').map((s) => s.trim()).filter((s) => s.length > 0)
+    // NUL mode: git emits exact names with no surrounding whitespace, so any
+    // trim would CORRUPT a filename that legitimately starts/ends with spaces
+    // (git supports such names). Split and drop only the trailing empty entry.
+    return stdout.split('\0').filter((s) => s.length > 0)
   }
   return stdout
     .split('\n')
@@ -152,12 +155,19 @@ export function decideScope(changedFiles: string[]): {
 export function runGit(
   args: string[],
   cwd: string,
+  opts: { signal?: AbortSignal } = {},
 ): Promise<{ ok: boolean; stdout: string; stderr: string; exitCode: number }> {
   return new Promise((resolve) => {
     execFile(
       'git',
       args,
-      { cwd, timeout: 30_000, maxBuffer: 10 * 1024 * 1024, env: { ...process.env, PAGER: 'cat' } },
+      {
+        cwd,
+        timeout: 30_000,
+        maxBuffer: 10 * 1024 * 1024,
+        env: { ...process.env, PAGER: 'cat' },
+        signal: opts.signal,
+      },
       (error, stdout, stderr) => {
         const exitCode = error ? (typeof error.code === 'number' ? error.code : 1) : 0
         resolve({ ok: exitCode === 0, stdout: stdout ?? '', stderr: stderr ?? '', exitCode })
@@ -175,6 +185,7 @@ export function runGit(
 export async function resolveChangedFiles(
   root: string,
   targetBranch: string,
+  opts: { signal?: AbortSignal } = {},
 ): Promise<GitScopeResult> {
   // Option-injection guard: a branch name starting with '-' would be parsed by
   // git as an option (e.g. --output=...), not a ref. Reject it outright.
@@ -188,7 +199,7 @@ export async function resolveChangedFiles(
   }
   // -z: NUL-delimited names — machine-safe for any filename (spaces, quotes,
   // non-ASCII), and never confused with option-like content.
-  const { ok, stdout, stderr } = await runGit(['diff', '--name-only', '-z', targetBranch, '--'], root)
+  const { ok, stdout, stderr } = await runGit(['diff', '--name-only', '-z', targetBranch, '--'], root, opts)
   if (!ok) {
     const reason = stderr.trim() || `git diff --name-only -z ${targetBranch} failed`
     return { scope: 'full', changedFiles: [], fallbackToFull: true, error: reason }

package/src/jobs.ts

@@ -39,6 +39,20 @@ interface JobsLike {
   }): string
 }
 
+/**
+ * Read `ctx.jobs` defensively: the dsh plugin context can be a Proxy whose
+ * `jobs` getter throws (or is missing) when no job registry is present. A
+ * Proxy throw on property access must degrade to "no jobs", never crash the
+ * tool execution we are about to wrap.
+ */
+function safeJobs(ctx: unknown): JobsLike | undefined {
+  try {
+    return (ctx as { jobs?: JobsLike } | undefined)?.jobs
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * Run `fn` wrapped in a dsh background job, settling it completed/failed
  * with the execution's outcome. When the host exposes no job registry (or
@@ -57,7 +71,7 @@ export async function runWithJob<T>(
   label: string,
   fn: () => Promise<T> | T,
 ): Promise<{ result: T; jobId: string | null }> {
-  const jobs = (ctx as { jobs?: JobsLike } | undefined)?.jobs
+  const jobs = safeJobs(ctx)
   if (!jobs || typeof jobs.start !== 'function') {
     return { result: await fn(), jobId: null }
   }

package/src/live.ts

@@ -68,6 +68,47 @@ export function liveFilePath(projectRoot: string): string {
   return join(projectRoot, '.iterate', 'transcript-live.ndjson')
 }
 
+/**
+ * Module-level in-process queue serializing live-feed writes. The trim path
+ * (read → rewrite → append) is a read-modify-write: two concurrent tool
+ * results could interleave and one's rewrite would silently drop the other's
+ * freshly-appended line. Chaining every append onto one tail makes the whole
+ * read+rewrite+append atomic within the process (the only realistic mode for
+ * the plugin); cross-process racing remains a theoretical hazard, but the
+ * cap-trim makes a lost line a cosmetic issue, not a correctness one.
+ */
+let liveWriteQueue: Promise<void> = Promise.resolve()
+
+function enqueueLiveWrite(task: () => Promise<void>): Promise<void> {
+  const next = liveWriteQueue.then(task, task)
+  liveWriteQueue = next.catch(() => {})
+  return next
+}
+
+/** Append one activity record to the project's live feed (byte-capped). */
+export function appendLive(projectRoot: string, entry: LiveActivityEntry): Promise<void> {
+  return enqueueLiveWrite(async () => {
+    const file = liveFilePath(projectRoot)
+    const line = JSON.stringify(entry) + '\n'
+    await mkdir(join(projectRoot, '.iterate'), { recursive: true })
+    // Amortized O(1): only read+rewrite when the file has grown past the cap.
+    try {
+      const st = await stat(file).catch(() => null)
+      if (st && st.size > LIVE_MAX_BYTES) {
+        const raw = await readFile(file, 'utf-8')
+        const lines = raw.split('\n').filter(Boolean)
+        const tail = lines.slice(-LIVE_MAX_ENTRIES)
+        // Atomic rewrite (unique temp + rename) so a crash mid-trim never
+        // truncates the live feed; the temp file is prunable by iterate_prune.
+        await writeTextAtomicAsync(file, tail.join('\n') + '\n')
+      }
+      await appendFile(file, line, 'utf-8')
+    } catch {
+      // Fire-and-forget: never let live capture break a tool call.
+    }
+  })
+}
+
 /** Resolve the project root a tool execution belongs to, if any. */
 function projectRootOf(exec: ToolExecution): string | null {
   const cwd = exec.agent?.session?.header?.cwd
@@ -130,28 +171,6 @@ export function classifyTool(
   return { ts: new Date().toISOString(), type, tool: name, target }
 }
 
-/** Append one activity record to the project's live feed (byte-capped). */
-export async function appendLive(projectRoot: string, entry: LiveActivityEntry): Promise<void> {
-  const file = liveFilePath(projectRoot)
-  const line = JSON.stringify(entry) + '\n'
-  await mkdir(join(projectRoot, '.iterate'), { recursive: true })
-  // Amortized O(1): only read+rewrite when the file has grown past the cap.
-  try {
-    const st = await stat(file).catch(() => null)
-    if (st && st.size > LIVE_MAX_BYTES) {
-      const raw = await readFile(file, 'utf-8')
-      const lines = raw.split('\n').filter(Boolean)
-      const tail = lines.slice(-LIVE_MAX_ENTRIES)
-      // Atomic rewrite (unique temp + rename) so a crash mid-trim never
-      // truncates the live feed; the temp file is prunable by iterate_prune.
-      await writeTextAtomicAsync(file, tail.join('\n') + '\n')
-    }
-    await appendFile(file, line, 'utf-8')
-  } catch {
-    // Fire-and-forget: never let live capture break a tool call.
-  }
-}
-
 /** Read the live feed (newest first), capped at the last LIVE_MAX_ENTRIES. */
 export async function readLive(projectRoot: string): Promise<LiveActivityEntry[]> {
   const file = liveFilePath(projectRoot)

package/src/meta-review.ts

@@ -184,7 +184,7 @@ export function metaReviewReport(report: ReviewReport): MetaReviewResult {
       `byDimension sums to ${dimSum}, but totalFindings is ${total}.`,
     )
   }
-  const invalidDim = findings.find((f) => !dimensions.includes(f?.dimension))
+  const invalidDim = findings.find((f) => !!f && !dimensions.includes(f?.dimension))
   if (invalidDim) {
     add(
       'DIMENSION_UNKNOWN',
@@ -364,7 +364,7 @@ export function buildFinalReviewReport(
           // surfaced it (best-effort; report rounds carry it).
           for (const r of report.rounds ?? []) {
             const matched = (r.findings ?? []).some(
-              (fnd) => fnd.file === violation.file && fnd.line === violation.line,
+              (fnd) => !!fnd && fnd?.file === violation.file && fnd?.line === violation.line,
             )
             if (matched) {
               roundHint = ` (round ${r.round})`

package/src/review-scope.ts

@@ -72,8 +72,12 @@ function normalizePath(path: string): string {
   for (const part of cleaned.split(SEP)) {
     if (part === '' || part === '.') continue
     if (part === '..') {
-      if (parts.length > 0) parts.pop()
-      else parts.push(part) // no root segment to pop — keep the leading '..'
+      // Mirrors Python `os.path.normpath`: a leading `..` is preserved and a
+      // second `..` is NEVER collapsed into a bare `/` away — otherwise a
+      // traversal like `../../evil` folds into the single segment `evil` and
+      // the escape becomes undetectable downstream.
+      if (parts.length > 0 && parts[parts.length - 1] !== '..') parts.pop()
+      else parts.push(part)
       continue
     }
     parts.push(part)

package/src/review.ts

@@ -39,17 +39,18 @@ export const SEVERITY_RANK: Record<ReviewFinding['severity'], number> = {
 export function sortFindings(findings: ReviewFinding[]): ReviewFinding[] {
   return [...findings].sort((a, b) => {
     // Guard against an out-of-spec severity string (e.g. from a model that
-    // bypassed the schema): treat it as the least severe so NaN never enters
-    // the comparator and ordering stays deterministic.
-    const rankA = SEVERITY_RANK[a.severity] ?? SEVERITY_RANK.low
-    const rankB = SEVERITY_RANK[b.severity] ?? SEVERITY_RANK.low
+    // bypassed the schema) AND against a null list element (model-authored
+    // JSON): treat both as the least severe so NaN never enters the
+    // comparator and ordering stays deterministic.
+    const rankA = SEVERITY_RANK[a?.severity] ?? SEVERITY_RANK.low
+    const rankB = SEVERITY_RANK[b?.severity] ?? SEVERITY_RANK.low
     const bySeverity = rankA - rankB
     if (bySeverity !== 0) return bySeverity
     // Defensive coercion: `file`/`line` can be wrong-typed when schema
     // validation is disabled — String()/Number() keep the comparator total.
-    const byFile = String(a.file ?? '').localeCompare(String(b.file ?? ''))
+    const byFile = String(a?.file ?? '').localeCompare(String(b?.file ?? ''))
     if (byFile !== 0) return byFile
-    return (Number(a.line) || 0) - (Number(b.line) || 0)
+    return (Number(a?.line) || 0) - (Number(b?.line) || 0)
   })
 }
 

package/src/skill-prompt.ts

@@ -357,10 +357,10 @@ for (let r = startRound; r <= maxRounds; r++) {
     const byFile = {}
     atomic.forEach(f => { (byFile[f.file] = byFile[f.file] || []).push(f) })
     const fixRes = await parallel(Object.keys(byFile).map(file => () => agent(
-      'Apply the fixes for ' + file + ' using iterate_fix. For EACH finding in this list, ' +
+      'Apply the fixes for ' + JSON.stringify(file) + ' using iterate_fix. For EACH finding in this list, ' +
       'read the current file, compute the edited full content (change <= ' + atomicMaxLines + ' lines), and call ' +
-      'iterate_fix({ file: "' + file + '", content: <full new file content>, finding: <that finding>, round: ' + r + ' }). ' +
-      'Apply the findings IN ORDER. After all fixes, call iterate_diff({ file: "' + file + '" }) to verify the accumulated diff and ' +
+      'iterate_fix({ file: ' + JSON.stringify(file) + ', content: <full new file content>, finding: <that finding>, round: ' + r + ' }). ' +
+      'Apply the findings IN ORDER. After all fixes, call iterate_diff({ file: ' + JSON.stringify(file) + ' }) to verify the accumulated diff and ' +
       'read its line statistics (lines added/removed). ' +
       'Findings: ' + JSON.stringify(byFile[file]) + '. Return the array of {id, ok, error, file, linesAdded, linesRemoved} per iterate_fix call ' +
       '(id/ok required; put the file-wide line stats from iterate_diff on each record, or on the last record and 0 elsewhere).',

package/src/tools/decision-log.ts

@@ -1,4 +1,14 @@
-import { appendFileSync, readFileSync, mkdirSync, existsSync } from 'node:fs'
+import {
+  appendFileSync,
+  readFileSync,
+  mkdirSync,
+  existsSync,
+  openSync,
+  writeSync,
+  closeSync,
+  unlinkSync,
+  statSync,
+} from 'node:fs'
 import { join } from 'node:path'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { JsonValue } from '@deepseek-ai/dsh-util-values'
@@ -8,6 +18,109 @@ import type { DecisionLogEntry } from '../types.ts'
 const LOG_DIR = '.iterate'
 const LOG_FILE = 'decision-log.jsonl'
 
+// ─── Cross-process log mutex ────────────────────────────────────────────────
+//
+// The prune rewrite (temp + atomic rename) can silently discard an audit line
+// from a CONCURRENT appender whose fd was opened against the pre-rename inode:
+// the appender writes to the unlinked inode, the post-rewrite re-read sees a
+// "stable" file, and the fresh entry is lost. In-process safety is guaranteed
+// by synchronous I/O, but a second plugin process appending to the same
+// project realises the race. The log is serialized with a tiny advisory lock
+// file (exclusive create, pid stamped, stale-stealable) so `append` and the
+// prune rewrite mutually exclude across processes. Best-effort: contention
+// timeouts degrade to "proceed unlocked" (the bounded retry loop in prune.ts
+// stays as defense-in-depth), never to a crash.
+
+const LOCK_FILE = '.decision-log.lock'
+const LOCK_WAIT_MS = 5000
+const LOCK_STALE_MS = 10000
+const LOCK_POLL_MS = 25
+
+/** True when a pid refers to a live process (or we lack permission to tell). */
+function processAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === 'EPERM'
+  }
+}
+
+/** Synchronous busy-wait sleep (Atomics.wait is a reliable sleep in Node). */
+function sleepSync(ms: number): void {
+  const sab = new Int32Array(new SharedArrayBuffer(4))
+  Atomics.wait(sab, 0, 0, ms)
+}
+
+/**
+ * Acquire the decision-log lock for `projectRoot`.
+ * Returns a release function (always callable; a no-op when the lock could
+ * not be taken — never wedge an append behind a vanished holder).
+ */
+export function acquireLogLock(projectRoot: string): () => void {
+  const dir = join(projectRoot, LOG_DIR)
+  if (!existsSync(dir)) {
+    try {
+      mkdirSync(dir, { recursive: true })
+    } catch {
+      return () => {}
+    }
+  }
+  const lockPath = join(dir, LOCK_FILE)
+  const start = Date.now()
+  for (;;) {
+    let fd: number | null = null
+    try {
+      fd = openSync(lockPath, 'wx')
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EEXIST') return () => {}
+      // Lock exists — steal it when the owner is gone or the lock is ancient.
+      let stale = false
+      try {
+        const st = statSync(lockPath)
+        if (Date.now() - st.mtimeMs > LOCK_STALE_MS) stale = true
+        else {
+          const pid = Number(readFileSync(lockPath, 'utf-8'))
+          if (!processAlive(pid)) stale = true
+        }
+      } catch {
+        stale = true // unreadable/vanishing lock → retry as stale
+      }
+      if (stale) {
+        try { unlinkSync(lockPath) } catch { /* another holder stole it */ }
+        continue
+      }
+      if (Date.now() - start > LOCK_WAIT_MS) return () => {}
+      sleepSync(LOCK_POLL_MS)
+      continue
+    }
+    // Owned the lock: stamp the holder pid, then release once on return.
+    try { writeSync(fd, String(process.pid)) } catch { /* pid stamp is advisory */ }
+    try { closeSync(fd) } catch { /* best-effort */ }
+    let released = false
+    return () => {
+      if (released) return
+      released = true
+      try { unlinkSync(lockPath) } catch { /* already gone */ }
+    }
+  }
+}
+
+// ─── Entry-count cache (avoid an O(n) full re-read per append) ─────────────
+
+const entryCountCache = new Map<string, { size: number; count: number }>()
+
+/** Line-count the log file from scratch (entries = non-empty JSON lines). */
+function recountEntries(filePath: string): number {
+  try {
+    const content = readFileSync(filePath, 'utf-8')
+    return content.split('\n').filter((l) => l.trim().length > 0).length
+  } catch {
+    return 1
+  }
+}
+
 /** All valid DecisionLogEntry `type` values (must stay in sync with Types). */
 const VALID_ENTRY_TYPES = new Set<DecisionLogEntry['type']>([
   'round_start',
@@ -57,23 +170,30 @@ function logPath(projectRoot: string): string {
  * miss without failing the mutation they already performed.
  */
 export function appendDecisionEntry(projectRoot: string, entry: DecisionLogEntry): { count: number; path: string; error?: string } {
-  let filePath: string
-  try {
-    filePath = logPath(projectRoot)
-    const line = JSON.stringify(entry) + '\n'
-    appendFileSync(filePath, line, 'utf-8')
-  } catch (err) {
-    return { count: 0, path: join(projectRoot, LOG_DIR, LOG_FILE), error: `failed to append decision log: ${String(err)}` }
-  }
-  // Count entries
-  let count = 0
+  // Serialize with the cross-process log lock so an append can never interleave
+  // with a prune rewrite (which renames the file under us).
+  const release = acquireLogLock(projectRoot)
   try {
-    const content = readFileSync(filePath, 'utf-8')
-    count = content.split('\n').filter((l) => l.trim().length > 0).length
-  } catch {
-    count = 1
+    const filePath = logPath(projectRoot)
+    try {
+      const line = JSON.stringify(entry) + '\n'
+      const prevSize = existsSync(filePath) ? statSync(filePath).size : 0
+      appendFileSync(filePath, line, 'utf-8')
+      // Count entries via the size/count cache: when nothing else changed the
+      // file since our last append (same byte size), count is just +1 — no full
+      // re-read. Falls back to a full re-count whenever the cache is stale.
+      const cached = entryCountCache.get(filePath)
+      const count = cached && cached.size === prevSize
+        ? cached.count + 1
+        : recountEntries(filePath)
+      entryCountCache.set(filePath, { size: existsSync(filePath) ? statSync(filePath).size : prevSize, count })
+      return { count, path: filePath }
+    } catch (err) {
+      return { count: 0, path: join(projectRoot, LOG_DIR, LOG_FILE), error: `failed to append decision log: ${String(err)}` }
+    }
+  } finally {
+    release()
   }
-  return { count, path: filePath }
 }
 
 /**

package/src/tools/fix.ts

@@ -366,6 +366,7 @@ export function registerFixTool(ctx: { tools: { register: (def: ReturnType<typeo
             linesRemoved: { type: 'integer' },
             diffSummary: { type: 'string' },
             backupPath: { type: 'string' },
+            warning: { type: 'string' },
             error: { type: 'string' },
           },
         },
@@ -456,6 +457,17 @@ export function registerFixTool(ctx: { tools: { register: (def: ReturnType<typeo
           return { ok: false, error: `finding already fixed this run (id: ${id})`, id }
         }
 
+        // No-op guard: content-identical "fixes" (e.g. a fixer that re-sent the
+        // file unchanged) must never burn a backup, a write, or a registry/success
+        // record. Placed after the registry check so a re-sent fix of an id that
+        // was ALREADY fixed is still reported as "already fixed this run".
+        if (added === 0 && removed === 0) {
+          return {
+            ok: false,
+            error: `no changes: the supplied content for ${file} is identical to the current content — apply a real edit`,
+          }
+        }
+
         const target = resolveProjectFile(projectRoot, file)
         if (!target.ok) return { ok: false, error: target.reason }
 
@@ -528,13 +540,16 @@ export function registerFixTool(ctx: { tools: { register: (def: ReturnType<typeo
           return { ok: false, error: `failed to write fix registry: ${String(err)} (file restored from backup)` }
         }
 
-        appendDecisionEntry(projectRoot, {
+        const logRes = appendDecisionEntry(projectRoot, {
           timestamp,
           round: args.round,
           type: 'atomic_fix',
           data: { id, file, finding: finding.summary, linesAdded: added, linesRemoved: removed },
         })
 
+        // The fix itself succeeded, but a decision-log write failure would leave
+        // the audit trail incomplete — surface it (warning, not fatal) so the
+        // model/UI knows the record was not persisted.
         return {
           ok: true,
           id,
@@ -544,6 +559,7 @@ export function registerFixTool(ctx: { tools: { register: (def: ReturnType<typeo
           linesRemoved: removed,
           diffSummary: record.diffSummary,
           backupPath,
+          ...(logRes.error ? { warning: logRes.error } : {}),
         }
         })
         return result
@@ -710,6 +726,7 @@ export function registerRollbackTool(ctx: { tools: { register: (def: ReturnType<
             ok: { type: 'boolean', required: true },
             id: { type: 'string' },
             file: { type: 'string' },
+            warning: { type: 'string' },
             error: { type: 'string' },
           },
         },
@@ -749,7 +766,7 @@ export function registerRollbackTool(ctx: { tools: { register: (def: ReturnType<
           return { ok: false, error: `failed to update fix registry: ${String(err)}` }
         }
 
-        appendDecisionEntry(projectRoot, {
+        const logRes = appendDecisionEntry(projectRoot, {
           timestamp: new Date().toISOString(),
           round: record.round,
           type: 'revert',
@@ -762,7 +779,12 @@ export function registerRollbackTool(ctx: { tools: { register: (def: ReturnType<
         // rollback flow.
         await markFixRolledBackInTranscript(projectRoot, id)
 
-        return { ok: true, id, file: record.finding.file }
+        return {
+          ok: true,
+          id,
+          file: record.finding.file,
+          ...(logRes.error ? { warning: logRes.error } : {}),
+        }
       },
     }),
   )

package/src/tools/prune.ts

@@ -30,7 +30,7 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import { resolveProjectRootForExec } from '../config-loader.ts'
 import { writeTextAtomic, writeJsonAtomic } from '../atomic-fs.ts'
-import { readDecisionEntries, appendDecisionEntry } from './decision-log.ts'
+import { readDecisionEntries, appendDecisionEntry, acquireLogLock } from './decision-log.ts'
 import { readRegistry, removeRecord, recomputeRoundCounts } from './fix.ts'
 import { readExperienceBank, writeExperienceBank } from './experience-store.ts'
 import { readDefenseEvents, writeDefenseEvents } from './defense-store.ts'
@@ -264,23 +264,32 @@ export function inspectPrune(
  */
 function rewriteDecisionLogKeepingRecent(projectRoot: string, cutoff: string): { deleted: number; error?: string } {
   const logPath = join(iterateDir(projectRoot), 'decision-log.jsonl')
-  for (let attempt = 0; attempt < MAX_LOG_REWRITE_RETRIES; attempt++) {
-    try {
-      const entries = readDecisionEntries(projectRoot)
-      const kept = entries.filter((e) => e.timestamp >= cutoff)
-      const deleted = entries.length - kept.length
-      if (deleted === 0) return { deleted: 0 }
-      writeTextAtomic(logPath, kept.map((e) => JSON.stringify(e)).join('\n') + '\n')
-      // A concurrent appender may have landed new lines after our read. If the
-      // log grew during the write window, re-read and prune again instead of
-      // accepting a lost audit trail.
-      const after = readDecisionEntries(projectRoot)
-      if (after.length <= kept.length) return { deleted }
-    } catch (err) {
-      return { deleted: 0, error: `failed to rewrite decision log: ${String(err)}` }
+  // Take the cross-process log lock for the ENTIRE loop: with the mutex held,
+  // no concurrent appender can slip a fresh line into the read-before-rewrite
+  // window, so the first attempt is nearly always the only one. (The retry
+  // loop stays as defense-in-depth for the lock-unavailable path.)
+  const release = acquireLogLock(projectRoot)
+  try {
+    for (let attempt = 0; attempt < MAX_LOG_REWRITE_RETRIES; attempt++) {
+      try {
+        const entries = readDecisionEntries(projectRoot)
+        const kept = entries.filter((e) => e.timestamp >= cutoff)
+        const deleted = entries.length - kept.length
+        if (deleted === 0) return { deleted: 0 }
+        writeTextAtomic(logPath, kept.map((e) => JSON.stringify(e)).join('\n') + '\n')
+        // A concurrent appender (cross-process, lock-unavailable path) may have
+        // landed new lines after our read. If the log grew during the write
+        // window, re-read and prune again instead of accepting a lost audit trail.
+        const after = readDecisionEntries(projectRoot)
+        if (after.length <= kept.length) return { deleted }
+      } catch (err) {
+        return { deleted: 0, error: `failed to rewrite decision log: ${String(err)}` }
+      }
     }
+    return { deleted: 0, error: `failed to rewrite decision log after ${MAX_LOG_REWRITE_RETRIES} attempts` }
+  } finally {
+    release()
   }
-  return { deleted: 0, error: `failed to rewrite decision log after ${MAX_LOG_REWRITE_RETRIES} attempts` }
 }
 
 /**
@@ -507,8 +516,10 @@ export function registerPruneTool(ctx: { tools: { register: (def: ReturnType<typ
 
         const result = executePrune(projectRoot, retainDays, report)
 
-        // Log the prune to the decision log.
-        appendDecisionEntry(projectRoot, {
+        // Log the prune to the decision log. The mutations already happened, so
+        // a failed log append is reported via `errors` — a silent audit miss
+        // (F2) must never pretend every deletion was recorded.
+        const logRes = appendDecisionEntry(projectRoot, {
           timestamp: new Date().toISOString(),
           round: 0,
           type: 'decision',
@@ -523,6 +534,7 @@ export function registerPruneTool(ctx: { tools: { register: (def: ReturnType<typ
             deletedDefenseEvents: result.deletedDefenseEvents,
           },
         })
+        if (logRes.error) result.errors.push(logRes.error)
 
         return {
           ok: true,

package/src/tools/triage.ts

@@ -208,8 +208,9 @@ function readConfigFile(configPath: string): Record<string, unknown> {
   if (!existsSync(configPath)) return {}
   const content = readFileSync(configPath, 'utf-8')
   const parsed = yaml.load(content)
-  if (!parsed || typeof parsed !== 'object') {
-    // A config that exists but is not a YAML mapping must NOT be silently
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    // A config that exists but is NOT a YAML mapping (including a YAML list,
+    // which `typeof [] === 'object'` alone would accept) must NOT be silently
     // treated as empty: writing over it would destroy user data. Callers
     // surface this as an error and refuse to write.
     throw new Error('existing iterate.config.yaml is not a valid YAML mapping')