loopforge 3.9.2 → 3.9.4

package/dist/prompt-assembler.js

@@ -10,10 +10,12 @@
  * alone are over it — truncation of mandatory content never happens.
  */
 import { createHash } from "node:crypto";
-import { activeSubGoalView, buildPhaseLine, hashCanonicalState, milestoneHeading, } from "./canonical-state.js";
+import { buildPhaseLine, formatActiveSubGoals, formatCriterionRows, hashCanonicalState, milestoneHeading, partitionActiveConstraints, } from "./canonical-state.js";
 import { PROMPT_ARTIFACT_SCHEMA_VERSION } from "./protocol.js";
-import { deriveItemId, STABLE_ID_RE, normalizeText } from "./token-utils.js";
+import { deriveCriterionId, deriveItemId, findingKey, STABLE_ID_RE, normalizeText, } from "./token-utils.js";
 import { getPolicy } from "./policy.js";
+import { verificationActionFor } from "./verification-actions.js";
+import { assertPromptCoverage, derivePromptCoverage, } from "./prompt-coverage.js";
 export const DEFAULT_PROMPT_BUDGETS = {
     l0: 5000,
     l1: 10000,
@@ -25,88 +27,19 @@ function section(title, body) {
 function bullets(values, prefix = "- ") {
     return values.map((value) => `${prefix}${value}`).join("\n");
 }
-/** v2.11: Derive a stable item ID from text content.
- *  Same hash strategy as computeGoalTextHash in loop-compiler.ts. */
-/** v2.11: Render a bullet list with ID prefixes for constraints/criteria.
- *  Each item gets a [prefix-XXXXXXXX] tag. Items that already look like IDs
- *  are rendered as-is. v3.8.1: IDs are always rendered — the
- *  `constraint_id_enabled` escape hatch is gone. */
-function bulletsWithIds(values, prefix) {
-    return values.map((v) => {
-        const trimmed = v.trim();
-        if (STABLE_ID_RE.test(trimmed)) {
-            return `- [\`${trimmed}\`] ${trimmed}`;
-        }
-        const id = prefix + "-" + deriveItemId(trimmed);
-        return `- [\`${id}\`] ${trimmed}`;
-    }).join("\n");
-}
-/** v3.3.1: Render an identity-HETEROGENEOUS list — the merged active
- *  constraint set holds hard/plan/criteria/discovered texts together, so no
- *  single prefix fits. Each item's authoritative ID comes from constraint
- *  metadata (criteria texts carry cr-XXXXXXXX, everything else
- *  c-XXXXXXXX), keeping the active list in the same identity namespace as
- *  the item's own section — one text never renders under two prefixes in
- *  one prompt. Falls back to a c- derivation only when metadata is missing
- *  (defensive: metadata covers every active text by construction). */
-function bulletsWithIdentities(values, metadata) {
-    const idByText = new Map(metadata.map((meta) => [meta.text, meta.id]));
-    return values.map((v) => {
-        const trimmed = v.trim();
-        if (STABLE_ID_RE.test(trimmed)) {
-            return `- [\`${trimmed}\`] ${trimmed}`;
-        }
-        const id = idByText.get(trimmed) ?? `c-${deriveItemId(trimmed)}`;
-        return `- [\`${id}\`] ${trimmed}`;
-    }).join("\n");
-}
-/** v3.2: Short imperative fix/action per verification check, appended to the
- *  L1/L2 Verification Gate lines. Deliberately shorter than the rejection-
- *  prompt wording in enforcement-gate.ts; keys are the plain check-name
- *  strings (NOT imported from verification-gate.ts — it already imports
- *  loop-compiler, which imports this module, so importing back would cycle).
- *  Full coverage of every CHECK_* constant is enforced by a test that
- *  iterates the verification-gate module's CHECK_ exports (no hardcoded
- *  list — a new constant can never silently lack an action entry). */
-const VERIFICATION_ACTIONS = {
-    success_with_remaining_criteria: "Complete the remaining criteria before claiming success, or set success=false and report what remains.",
-    success_without_verified_evidence: "Back the success claim with machine-verifiable evidence: run tests or a required verification command and report the actual output. If you genuinely performed no work, provide execution_report and declare no_change_reason.",
-    outcome_success_contradiction: "Reconcile the declared outcome with the success flag and resubmit an honest evaluation.",
-    blocked_without_blocker: "State the concrete blocker, or drop the blocked outcome.",
-    retroactive_claim_bad_round: "Correct the referenced round number, or withdraw the retroactive claim.",
-    retroactive_claim_unverified: "Provide evidence for the retroactive claim, or withdraw it.",
-    duplicate_constraint_discovery: "Update the existing constraint entry instead of duplicating it.",
-    recurring_violation: "Explain why this violation keeps recurring and try a different approach — do not repeat the failed strategy.",
-    retract_fresh_constraint: "Justify the retraction explicitly, or restore the constraint.",
-    evidence_integrity: "Correct the mismatch between your claims and the recorded evidence.",
-    required_command_failed: "Re-run the required verification command and report its actual output before claiming success.",
-    command_evidence_mismatch: "Report the true command output and reconcile the mismatch.",
-    backtrack_workspace_not_restored: "Restore the skipped-round files and the expected git HEAD, then resubmit.",
-    criteria_claims_unverified: "Provide evidence for each claimed success criterion.",
-    // v3.3 — Round Contract checks (and the three v3.3 checks that predated
-    // this table entry and fell back to the generic action).
-    verification_entrypoint_modified: "Re-run the verification command on the changed entrypoint, or revert the entrypoint change and re-run.",
-    test_files_modified: "Re-run the verification command after the test-file changes and report the fresh output.",
-    round_scope_drift: "Revert the out-of-scope file changes, or close the active contract and declare the extended scope in a new proposal. Scope drift is a machine fact and is not waivable by explanation.",
-    // v3.8 — item model: claimed-but-unverified debt
-    contract_items_unverified: "Run the bound command(s) for each claimed item so they are observed passing, or report the item as remaining (or declare outcome=\"blocked\").",
-    contract_premature: "The ACTIVE contract is still open — restate it unchanged to continue it; a different contract is ignored until every item is verified or the round reports blocked.",
-    // v3.7.1 — opt-in gate layer: cited gates need an approved human decision
-    user_gate_unresolved: "The round cites a high-risk action without an approved human decision. Run loopforge_gate_check, present the approval question, call loopforge_gate_resolve after the human decides, and resubmit with the approved gate id in evaluation.gate_ids.",
-};
-/** Fallback for unmapped check names (forward-compat with future checks). */
-const VERIFICATION_ACTION_FALLBACK = "Re-examine the flagged claim and correct your evaluation before resubmitting.";
-/** v3.2: The actionable instruction for a verification check. Exported for
- *  the coverage test (which imports the CHECK_* constants). */
-export function verificationActionFor(check) {
-    return VERIFICATION_ACTIONS[check] ?? VERIFICATION_ACTION_FALLBACK;
-}
+/** 3.9.3: The action table lives in a neutral module so the evaluation-field
+ *  guidance can quote the same wording without depending on a renderer.
+ *  Re-exported here for the existing CHECK_* coverage test. */
+export { verificationActionFor } from "./verification-actions.js";
 function verificationText(state, level) {
     const lines = state.verificationFlags.map((flag) => {
         const icon = flag.severity === "error"
             ? "🚫"
             : flag.severity === "warn" ? "⚠️" : "ℹ️";
-        const base = `- ${icon} [${flag.check}] ${flag.detail}`;
+        const ref = flag.ref ? ` [ref: \`${flag.ref}\`]` : "";
+        // v3.9.4: the finding names the affected field AND the concrete subject;
+        // the repair surface is a fact, not a next-action instruction.
+        const base = `- ${icon} [${flag.check}] \`${flag.field}\` — ${flag.detail}${ref}`;
         // v3.2: error/warn flags get an actionable continuation line in L1/L2 —
         // the verdict is translated into what to DO. L0 keeps the compact retry
         // prompt byte-identical; info flags stay informational.
@@ -120,43 +53,132 @@ function verificationText(state, level) {
     }
     return lines.join("\n");
 }
-function activeNonHardConstraints(state) {
-    const hard = new Set(state.hardConstraints);
-    return state.activeConstraints.filter((value) => !hard.has(value));
+/** v3.9.4: the ONE identity of a text in the prompt's normative namespaces.
+ *  A criterion keeps its cr-* even when it also appears in an active list;
+ *  metadata supplies the id for everything else. */
+function identityForText(state, text) {
+    // Criteria identity wins even if a stale/hand-built metadata row disagrees.
+    const status = state.criterionStatuses.find((criterion) => normalizeText(criterion.text) === normalizeText(text));
+    if (status)
+        return status.id;
+    if (state.successCriteria.some((criterion) => normalizeText(criterion) === normalizeText(text))) {
+        return deriveCriterionId(text);
+    }
+    const meta = state.constraintMetadata.find((entry) => entry.text === text);
+    if (meta)
+        return meta.id;
+    return `c-${deriveItemId(text)}`;
 }
-// ═══════════════════════════════════════════════════════════════════════════
-// v3.2: L1 diff-collapse helpers
-// ═══════════════════════════════════════════════════════════════════════════
-/** v3.2: Stable ID of a constraint text as rendered by bulletsWithIds —
- *  metadata's own id when present, else the derived hash. */
-function constraintIdOf(text, metadata) {
-    const meta = metadata.find((m) => m.text === text);
-    return meta?.id ?? `c-${deriveItemId(text)}`;
+/** v3.9.4: active constraint rows with their real ids and the machine fact
+ *  that this round violated them. Shared by the hard and other partitions. */
+function constraintLines(state, texts) {
+    return texts.map((text) => {
+        const violated = state.constraintMetadata.find((meta) => meta.text === text)
+            ?.last_violated_at_round === state.round;
+        return `- [\`${identityForText(state, text)}\`] ${text}` +
+            (violated ? " (violated this round)" : "");
+    }).join("\n");
+}
+/** v3.9.4: every active normative object the current prompt MUST render. */
+function activeNormativeIds(state, recoveryBrief) {
+    const out = [];
+    const partition = partitionActiveConstraints(state);
+    for (const text of partition.hard) {
+        out.push({ id: identityForText(state, text), kind: "constraint" });
+    }
+    for (const text of partition.other) {
+        out.push({ id: identityForText(state, text), kind: "constraint" });
+    }
+    for (const text of partition.criteria) {
+        out.push({ id: identityForText(state, text), kind: "criterion" });
+    }
+    if (state.roundContract) {
+        out.push({ id: state.roundContract.id, kind: "contract" });
+        for (const item of state.roundContract.items) {
+            out.push({ id: item.id, kind: "contract_item" });
+        }
+    }
+    for (const subGoal of state.subGoals) {
+        if (subGoal.status !== "done" && subGoal.status !== "canceled") {
+            out.push({ id: subGoal.id, kind: "subgoal" });
+        }
+    }
+    for (const flag of state.verificationFlags) {
+        out.push({ id: findingKey(flag), kind: "finding" });
+    }
+    if (recoveryBrief && recoveryBrief.length > 0) {
+        out.push({ id: "recovery", kind: "recovery" });
+    }
+    return out;
 }
-function commonMandatorySections(state,
-/** v2.11: L0 skips ID rendering to stay within tight budget. */
-level) {
+/** v3.9.4: the normative sections shared by L0/L1/L2. Levels change ONLY the
+ *  density of narrative sections; they never change which active normative
+ *  ids are rendered. Every section here is mandatory (protected). */
+function commonMandatorySections(state, level, recoveryBrief) {
+    const partition = partitionActiveConstraints(state);
     const sections = [
         {
             id: "objective",
             text: section("Objective", state.objective),
             mandatory: true,
+            coverageIds: [],
         },
         {
             id: "current_task",
             text: section("Current Task", state.currentTask),
             mandatory: true,
+            // Declare what this text actually carries. `createCanonicalLoopState`
+            // builds currentTask with `formatRoundContract`, so this is the
+            // structured source, not a text guess; an inconsistent hand-built state
+            // therefore fails closed instead of claiming an id it did not render.
+            coverageIds: state.roundContract
+                ? [
+                    state.roundContract.id,
+                    ...state.roundContract.items.map((item) => item.id),
+                ].filter((id) => state.currentTask.includes(id))
+                : [],
         },
     ];
-    if (state.hardConstraints.length > 0) {
-        // v2.11: L0 uses plain bullets (tight budget); L1/L2 show constraint IDs
-        const body = level === "l0"
-            ? bullets(state.hardConstraints)
-            : bulletsWithIds(state.hardConstraints, "c");
+    const criteria = formatCriterionRows(state.criterionStatuses, state.successCriteria);
+    if (criteria.lines.length > 0) {
+        sections.push({
+            id: "criteria",
+            text: section("Success Criteria", criteria.lines.join("\n")),
+            mandatory: true,
+            coverageIds: criteria.ids,
+        });
+    }
+    if (partition.hard.length > 0) {
         sections.push({
             id: "hard_constraints",
-            text: section("Active Hard Constraints", body),
+            text: section("Active Hard Constraints", constraintLines(state, partition.hard)),
+            mandatory: true,
+            coverageIds: partition.hard.map((text) => identityForText(state, text)),
+        });
+    }
+    if (partition.other.length > 0) {
+        sections.push({
+            id: "active_constraints",
+            text: section("Active Constraints", constraintLines(state, partition.other)),
             mandatory: true,
+            coverageIds: partition.other.map((text) => identityForText(state, text)),
+        });
+    }
+    if (state.subGoals.length > 0) {
+        const subGoals = formatActiveSubGoals(state.subGoals, state.round);
+        sections.push({
+            id: "sub_goals",
+            text: section("Active Sub-Goals", subGoals.lines.join("\n")),
+            mandatory: true,
+            coverageIds: subGoals.ids,
+        });
+    }
+    if (recoveryBrief && recoveryBrief.length > 0) {
+        sections.push({
+            id: "recovery",
+            text: section("Recovery Brief", recoveryBrief.join("\n")),
+            mandatory: true,
+            coverageIds: ["recovery"],
         });
     }
     if (state.verificationFlags.length > 0) {
@@ -164,21 +186,25 @@ level) {
             id: "verification",
             text: section("Verification Gate", verificationText(state, level)),
             mandatory: true,
+            coverageIds: state.verificationFlags.map((flag) => findingKey(flag)),
         });
     }
     return sections;
 }
-function l0Sections(state) {
+function l0Sections(state, recoveryBrief) {
     const retryRequirements = [
         ...state.blockers,
         ...state.verificationFlags.map((flag) => flag.detail),
     ];
-    const sections = commonMandatorySections(state, "l0");
+    const sections = commonMandatorySections(state, "l0", recoveryBrief);
     if (retryRequirements.length > 0) {
         sections.push({
             id: "retry_requirements",
             text: section("Retry Requirements", bullets(retryRequirements)),
             mandatory: true,
+            // The same finding keys as the Verification Gate: either repair surface
+            // proves the finding was delivered, and both derive from the one list.
+            coverageIds: state.verificationFlags.map((flag) => findingKey(flag)),
         });
     }
     if (state.changesSinceLastRound.length > 0) {
@@ -186,6 +212,7 @@ function l0Sections(state) {
             id: "changes",
             text: section("New Evidence / Changes", bullets(state.changesSinceLastRound)),
             mandatory: false,
+            coverageIds: [],
         });
     }
     return sections;
@@ -219,43 +246,14 @@ function activeWarnings(flags, currentRound) {
         return `- ${icon} ${subject} — ${flag.count}×, latest R${Math.max(...flag.rounds)}`;
     }).join("\n");
 }
-function l1Sections(state) {
-    const sections = commonMandatorySections(state, "l1");
-    const active = activeNonHardConstraints(state);
+function l1Sections(state, recoveryBrief) {
+    const sections = commonMandatorySections(state, "l1", recoveryBrief);
     if (state.changesSinceLastRound.length > 0) {
         sections.push({
             id: "changes",
             text: section("Changes Since Last Round", bullets(state.changesSinceLastRound)),
             mandatory: false,
-        });
-    }
-    // v3.8.1: Active Constraints render IN FULL. v3.2 folded unchanged items
-    // into "… N unchanged constraints (see state file)" pointer lines, which
-    // made the prompt's content depend on what the PREVIOUS prompt happened to
-    // show rather than on committed facts — and those pointer lines fed the
-    // prompt hash. The fold needed the previous round's persisted presentation
-    // snapshot, which is deleted.
-    if (active.length > 0) {
-        // The one thing the folded branch carried that a plain bullet list does
-        // not: the machine fact that this round broke the constraint. Kept so the
-        // annotation is not lost along with the fold.
-        const lines = active.map((text) => {
-            const violated = state.constraintMetadata.find((m) => m.text === text)
-                ?.last_violated_at_round === state.round;
-            return `- [\`${constraintIdOf(text, state.constraintMetadata)}\`] ${text}` +
-                (violated ? " (violated this round)" : "");
-        });
-        sections.push({
-            id: "active_constraints",
-            text: section("Active Constraints / Success Criteria", lines.join("\n")),
-            mandatory: false,
-        });
-    }
-    if (state.remainingCriteria.length > 0) {
-        sections.push({
-            id: "remaining",
-            text: section("Remaining", bulletsWithIds(state.remainingCriteria, "cr")),
-            mandatory: false,
+            coverageIds: [],
         });
     }
     if (state.blockers.length > 0) {
@@ -263,24 +261,7 @@ function l1Sections(state) {
             id: "blockers",
             text: section("Blockers", bullets(state.blockers)),
             mandatory: false,
-        });
-    }
-    // v2.2: Sub-Goal Dashboard (compact — L1). v3.7.1: only ACTIVE items
-    // (pending/in_progress/blocked) enter the view; done/canceled never render
-    // as rows. v3.8.1: rendered in full — the unchanged-count fold is gone.
-    const view = activeSubGoalView(state.subGoals, Number.POSITIVE_INFINITY);
-    const activeSubs = view.active;
-    if (activeSubs.length > 0) {
-        const iconOf = (sg) => sg.status === "in_progress" ? "🔄" : sg.status === "blocked" ? "🚫" : "⏳";
-        const maxShow = 5;
-        const items = activeSubs.slice(0, maxShow).map((sg) => `${iconOf(sg)} [\`${sg.id}\`] ${sg.description}`);
-        if (activeSubs.length > maxShow) {
-            items.push(`... and ${activeSubs.length - maxShow} more`);
-        }
-        sections.push({
-            id: "sub_goals",
-            text: section("Active Sub-Goals", items.join("\n")),
-            mandatory: false,
+            coverageIds: [],
         });
     }
     if (state.discoveries.length > 0) {
@@ -288,6 +269,7 @@ function l1Sections(state) {
             id: "discoveries",
             text: section("New Discoveries", bullets(state.discoveries)),
             mandatory: false,
+            coverageIds: [],
         });
     }
     // v3.2: Recent Rounds. v3.8.1: rendered in full — the keep-newest-N fold and
@@ -297,6 +279,7 @@ function l1Sections(state) {
             id: "rolling_outcomes",
             text: section("Recent Rounds", bullets(state.rollingOutcomes)),
             mandatory: false,
+            coverageIds: [],
         });
     }
     // v3.2: L1 also renders the explicit external context (previously L2-only).
@@ -306,6 +289,7 @@ function l1Sections(state) {
             id: "external_context",
             text: section("External Context", state.externalContext),
             mandatory: false,
+            coverageIds: [],
         });
     }
     // v3.8.1: one compact phase line, not the Roadmap prose.
@@ -315,6 +299,7 @@ function l1Sections(state) {
             id: "phase",
             text: section("Phase", l1Phase),
             mandatory: false,
+            coverageIds: [],
         });
     }
     // v3.8.1: Active Warnings — the recent tail of the ONE recurring-fact
@@ -329,46 +314,42 @@ function l1Sections(state) {
             id: "active_warnings",
             text: section("Active Warnings", warnings),
             mandatory: false,
+            coverageIds: [],
         });
     }
     return sections;
 }
-function l2Sections(state, fullStateMarkdown) {
-    const sections = commonMandatorySections(state, "l2");
+function l2Sections(state, fullStateMarkdown, recoveryBrief) {
+    const sections = commonMandatorySections(state, "l2", recoveryBrief);
     const fullState = fullStateMarkdown?.trim();
     if (fullState) {
         sections.push({
             id: "full_state",
             text: section("Full Rehydrated State", fullState),
             mandatory: false,
+            coverageIds: [],
         });
         return sections;
     }
-    // v2.11: Groups with an idPrefix use ID-aware rendering; others use plain bullets.
+    // v2.11: narrative groups. v3.9.4: criteria, active constraints and active
+    // sub-goals moved to the shared mandatory sections, so they are not repeated
+    // here; these groups carry no normative ids.
     const groups = [
-        ["success_criteria", "Success Criteria", state.successCriteria, "cr"],
-        ["active_constraints", "Active Constraints", activeNonHardConstraints(state), "c"],
-        ["changes", "Changes Since Last Round", state.changesSinceLastRound, null],
-        ["remaining", "Remaining", state.remainingCriteria, "cr"],
-        ["blockers", "Blockers", state.blockers, null],
-        ["discoveries", "Discoveries", state.discoveries, null],
-        ["rolling_outcomes", "Cross-Round Outcomes", state.rollingOutcomes, null],
-        ["failed_patterns", "Failed Patterns", state.failedPatterns, null],
+        ["changes", "Changes Since Last Round", state.changesSinceLastRound],
+        ["blockers", "Blockers", state.blockers],
+        ["discoveries", "Discoveries", state.discoveries],
+        ["rolling_outcomes", "Cross-Round Outcomes", state.rollingOutcomes],
+        ["failed_patterns", "Failed Patterns", state.failedPatterns],
     ];
-    for (const [id, title, values, idPrefix] of groups) {
+    for (const [id, title, values] of groups) {
         if (values.length === 0)
             continue;
-        // v3.3.1: the active set is identity-heterogeneous (hard/plan/criteria/
-        // discovered merged) — render through constraint metadata so criteria
-        // texts keep their cr- identity here too (same namespace as their own
-        // Success Criteria section). Every other group is homogeneous and keeps
-        // its single-prefix renderer.
-        const body = id === "active_constraints"
-            ? bulletsWithIdentities(values, state.constraintMetadata)
-            : idPrefix
-                ? bulletsWithIds(values, idPrefix)
-                : bullets(values);
-        sections.push({ id, text: section(title, body), mandatory: false });
+        sections.push({
+            id,
+            text: section(title, bullets(values)),
+            mandatory: false,
+            coverageIds: [],
+        });
     }
     // v3.8.1: Active Warnings — the recent tail of the ONE recurring-fact
     // derivation (see l1Sections). The whole-history recurring set is the state
@@ -380,6 +361,7 @@ function l2Sections(state, fullStateMarkdown) {
             id: "active_warnings",
             text: section("Active Warnings", warnings),
             mandatory: false,
+            coverageIds: [],
         });
     }
     // v3.8.1: one compact phase line, not the Roadmap prose — rendered right
@@ -391,6 +373,7 @@ function l2Sections(state, fullStateMarkdown) {
             id: "phase",
             text: section("Phase", l2Phase),
             mandatory: false,
+            coverageIds: [],
         });
     }
     if (state.milestones.length > 0) {
@@ -410,34 +393,7 @@ function l2Sections(state, fullStateMarkdown) {
             id: "milestones",
             text: section("Phase History", milestoneText),
             mandatory: false,
-        });
-    }
-    if (state.subGoals.length > 0) {
-        // v3.7.1: active-only rows ordered blocked → in_progress → pending
-        // (priority asc, recently changed first), capped by policy; done and
-        // canceled appear only in the stats line.
-        const cap = getPolicy().evolution.max_active_subgoals;
-        const view = activeSubGoalView(state.subGoals, cap);
-        const lines = [];
-        for (const sg of view.active) {
-            if (sg.status === "in_progress") {
-                lines.push(`🔄 [\`${sg.id}\`] ${sg.description} (since R${sg.status_changed_at_round})`);
-            }
-            else if (sg.status === "blocked") {
-                lines.push(`🚫 [\`${sg.id}\`] ${sg.description} (blocked since R${sg.status_changed_at_round})`);
-            }
-            else {
-                const age = state.round - sg.declared_at_round;
-                const stale = age >= 10 ? " ⚠️ stale" : "";
-                lines.push(`⏳ [\`${sg.id}\`] ${sg.description} (pending ${age} rounds)${stale}`);
-            }
-        }
-        // Stats line (full counts — rows may be capped)
-        lines.push(`─── ${view.total} total: ${view.activeTotal} active, ${view.done} done, ${view.canceled} canceled`);
-        sections.push({
-            id: "sub_goals_full",
-            text: section("Sub-Goal Dashboard", lines.join("\n")),
-            mandatory: false,
+            coverageIds: [],
         });
     }
     if (state.externalContext) {
@@ -445,33 +401,28 @@ function l2Sections(state, fullStateMarkdown) {
             id: "external_context",
             text: section("External Context", state.externalContext),
             mandatory: false,
+            coverageIds: [],
         });
     }
-    // ── v2.8: Path B gap fills (previously only in full state markdown) ──
-    // v3.8.1: the L2 Progress Dashboard and Round Stats sections are gone.
-    // The dashboard was `criterionStatuses` re-composed into a table and mixed
-    // with reported test counts; Round Stats
-    // re-listed per-round files and progress deltas, both self-reported. The
-    // criterion list and the machine git/criteria rows still render in the
-    // state file, where a human or external tool reads them — the prompt keeps
-    // only the current round’s own facts.
-    // Retired Constraints
     if (state.retiredConstraints.length > 0) {
         const lines = state.retiredConstraints.map((c) => `- ~${c}~ (retired)`);
         sections.push({
             id: "retired_constraints",
             text: section("Retired Constraints", lines.join("\n")),
             mandatory: false,
+            coverageIds: [],
         });
     }
     return sections;
 }
 function selectSections(input) {
-    if (input.level === "l0")
-        return l0Sections(input.state);
-    if (input.level === "l1")
-        return l1Sections(input.state);
-    return l2Sections(input.state, input.fullStateMarkdown);
+    if (input.level === "l0") {
+        return l0Sections(input.state, input.recoveryBrief);
+    }
+    if (input.level === "l1") {
+        return l1Sections(input.state, input.recoveryBrief);
+    }
+    return l2Sections(input.state, input.fullStateMarkdown, input.recoveryBrief);
 }
 /** v3.8.1: render order, in ONE place.
  *
@@ -486,33 +437,32 @@ function selectSections(input) {
  *  single large early section silently pushed out every later one.)
  */
 const SECTION_PRIORITY = {
-    // ── protected ───────────────────────────────────────────────────────────
+    // ── protected (every active normative id lives here) ────────────────────
     objective: 0,
     current_task: 1,
-    hard_constraints: 2,
-    verification: 3,
-    retry_requirements: 4,
+    criteria: 2,
+    hard_constraints: 3,
+    active_constraints: 4,
+    sub_goals: 5,
+    recovery: 6,
+    verification: 7,
+    retry_requirements: 8,
     // Zero-token pure reorder, but it is the ONLY place emphasized items render
     // (they are MOVED out of their source sections), so dropping it would delete
     // them rather than just deprioritize them.
-    critical_context: 5,
-    // ── optional, most to least important ───────────────────────────────────
-    success_criteria: 10,
-    active_constraints: 11,
-    remaining: 12,
-    sub_goals: 13,
-    blockers: 14,
-    changes: 15,
-    discoveries: 16,
-    rolling_outcomes: 17,
-    phase: 18,
-    active_warnings: 19,
-    external_context: 20,
-    failed_patterns: 21,
-    retired_constraints: 22,
-    milestones: 23,
-    sub_goals_full: 24,
-    full_state: 25,
+    critical_context: 9,
+    // ── optional narrative, most to least important ─────────────────────────
+    blockers: 20,
+    changes: 21,
+    discoveries: 22,
+    rolling_outcomes: 23,
+    phase: 24,
+    active_warnings: 25,
+    external_context: 26,
+    failed_patterns: 27,
+    retired_constraints: 28,
+    milestones: 29,
+    full_state: 30,
 };
 const DEFAULT_SECTION_PRIORITY = 50;
 /** v3.8.1: the smallest remaining room worth spending on a truncated
@@ -672,6 +622,16 @@ function renderConfusionAlerts(points, fullDensity) {
 }
 /** Render the "Critical Context" section — items the model emphasized.
  *  Pulled from active constraints, discoveries, and blocking issues. */
+/** v3.9.4: an emphasized item that is also an active normative constraint
+ *  reports its real id here, because it is MOVED out of its source section
+ *  and this is the only place it renders. Narrative items carry no id. */
+function normativeIdForText(state, text) {
+    const key = normalizeText(text);
+    const normative = state.activeConstraints.some((item) => normalizeText(item) === key) ||
+        state.successCriteria.some((item) => normalizeText(item) === key) ||
+        state.hardConstraints.some((item) => normalizeText(item) === key);
+    return normative ? identityForText(state, text) : null;
+}
 function renderCriticalContext(emphasized) {
     if (emphasized.length === 0)
         return "";
@@ -682,7 +642,9 @@ function renderCriticalContext(emphasized) {
         "",
     ];
     for (const item of emphasized) {
-        lines.push(`- ${item}`);
+        lines.push(item.id
+            ? `- [\`${item.id}\`] ${item.text}`
+            : `- ${item.text}`);
     }
     lines.push("");
     return lines.join("\n");
@@ -820,7 +782,13 @@ export function assemblePromptArtifact(input) {
         }
         : input.state;
     const sections = selectSections({ ...input, state: stateForSections });
-    const criticalContextText = renderCriticalContext(emphasized);
+    // The ID attached here comes from the ORIGINAL state: emphasize moved the
+    // item out of its source section, so this is the only renderer for it.
+    const emphasizedItems = emphasized.map((text) => ({
+        text,
+        id: normativeIdForText(input.state, text),
+    }));
+    const criticalContextText = renderCriticalContext(emphasizedItems);
     // v3.8.1: no presentation snapshot. The artifact records what THIS prompt
     // rendered (level, hashes, round identity, the sections it emitted) and
     // nothing about what a LATER prompt should do differently — a prompt's
@@ -836,6 +804,7 @@ export function assemblePromptArtifact(input) {
                 id: "critical_context",
                 text: criticalContextText,
                 mandatory: true,
+                coverageIds: emphasizedItems.flatMap((item) => item.id ? [item.id] : []),
             },
             ...sections,
         ];
@@ -844,6 +813,29 @@ export function assemblePromptArtifact(input) {
     const selected = renderWithinBudget(augmentedSections, fixedText, sectionBudget);
     const renderedPrompt = selected.rendered + footer;
     const promptHash = createHash("sha256").update(renderedPrompt).digest("hex");
+    // v3.9.4: coverage is derived from the ORIGINAL state and the sections that
+    // actually rendered. It is not text-scanned and not a second fact source.
+    // An incomplete projection fails closed — no prompt or artifact escapes.
+    const active = activeNormativeIds(input.state, input.recoveryBrief);
+    const declaredIds = new Set();
+    for (const section of augmentedSections) {
+        for (const id of section.coverageIds)
+            declaredIds.add(id);
+    }
+    const renderedIds = new Set();
+    for (const sectionId of selected.included) {
+        const section = augmentedSections.find((entry) => entry.id === sectionId);
+        if (!section)
+            continue;
+        for (const id of section.coverageIds)
+            renderedIds.add(id);
+    }
+    const coverage = derivePromptCoverage({
+        active,
+        rendered: renderedIds,
+        declared: declaredIds,
+    });
+    assertPromptCoverage(coverage);
     return {
         schemaVersion: PROMPT_ARTIFACT_SCHEMA_VERSION,
         roundId: `loop:${input.state.loopId}:round:${input.state.round}`,
@@ -862,6 +854,7 @@ export function assemblePromptArtifact(input) {
         budget: sectionBudget,
         renderedChars: selected.rendered.length,
         promptRequestEffects,
+        coverage,
     };
 }
 //# sourceMappingURL=prompt-assembler.js.map