oh-my-opencode 5.0.0-beta.66 → 5.0.0-beta.68

package/packages/omo-codex/plugin/components/lsp/dist/.omo-runtime-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "version": "5.0.0-beta.66",
-  "inputDigest": "sha256:ca46738d2802527698d576c2fad87a2fd1cc5abd6e5af5b1ad71f554efe17448",
+  "version": "5.0.0-beta.68",
+  "inputDigest": "sha256:e94fa1eb1e1363a3c1c13ccfeec67863452fdbfcb2ed88d4a2b2e2cb8fe6581f",
   "outputs": [
     {
       "path": "cli.d.ts",
@@ -9,7 +9,7 @@
     },
     {
       "path": "cli.js",
-      "sha256": "54d3621c04697495054be69fd6328d7b9044034801b295868b23bd92d344a816"
+      "sha256": "b8d0f009e0031d015280244ddd2e5abb8db076ffb324c7e500d29d437a345446"
     },
     {
       "path": "codex-hook-cli.d.ts",

package/packages/omo-codex/plugin/components/lsp/dist/cli.js

@@ -1920,6 +1920,8 @@ class WorkspaceDocumentState {
     const state = this.openByUri.get(normalizeDocumentUri(snapshot.uri));
     if (!state || timeoutMs <= 0)
       return Promise.resolve();
+    if (state.publishGeneration !== snapshot.publishGeneration)
+      return Promise.resolve();
     return new Promise((resolveActivity) => {
       let settled = false;
       const finish = () => {

package/packages/omo-codex/plugin/components/lsp/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-tool-use",
 						"timeout": 60,
-						"statusMessage": "(OmO 5.0.0-beta.66) Checking LSP Diagnostics"
+						"statusMessage": "(OmO 5.0.0-beta.68) Checking LSP Diagnostics"
 					}
 				]
 			}
@@ -21,7 +21,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-compact",
 						"timeout": 5,
-						"statusMessage": "(OmO 5.0.0-beta.66) Resetting LSP Diagnostics Cache"
+						"statusMessage": "(OmO 5.0.0-beta.68) Resetting LSP Diagnostics Cache"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/lsp/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-lsp",
-	"version": "5.0.0-beta.66",
+	"version": "5.0.0-beta.68",
 	"description": "Codex plugin that exposes Language Server Protocol tools and post-edit diagnostics.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/rules/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook session-start",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.66) Loading Project Rules"
+						"statusMessage": "(OmO 5.0.0-beta.68) Loading Project Rules"
 					}
 				]
 			}
@@ -19,7 +19,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook user-prompt-submit",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.66) Loading Project Rules"
+						"statusMessage": "(OmO 5.0.0-beta.68) Loading Project Rules"
 					}
 				]
 			}
@@ -32,7 +32,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-tool-use",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.66) Matching Project Rules"
+						"statusMessage": "(OmO 5.0.0-beta.68) Matching Project Rules"
 					}
 				]
 			}
@@ -45,7 +45,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-compact",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.66) Resetting Project Rule Cache"
+						"statusMessage": "(OmO 5.0.0-beta.68) Resetting Project Rule Cache"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/rules/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-rules",
-	"version": "5.0.0-beta.66",
+	"version": "5.0.0-beta.68",
 	"description": "Codex plugin that injects project rule files into model context through lifecycle hooks.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/teammode/hooks/hooks.json

@@ -8,7 +8,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-tool-use",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.66) Checking Thread Title Hygiene"
+						"statusMessage": "(OmO 5.0.0-beta.68) Checking Thread Title Hygiene"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/teammode/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sisyphuslabs/codex-teammode",
-	"version": "5.0.0-beta.66",
+	"version": "5.0.0-beta.68",
 	"description": "Codex team-mode hook component that keeps background thread titles descriptive after create_thread.",
 	"type": "module",
 	"private": true,

package/packages/omo-codex/plugin/components/telemetry/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook session-start",
 						"timeout": 5,
-						"statusMessage": "(OmO 5.0.0-beta.66) Recording Session Telemetry"
+						"statusMessage": "(OmO 5.0.0-beta.68) Recording Session Telemetry"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/telemetry/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-telemetry",
-	"version": "5.0.0-beta.66",
+	"version": "5.0.0-beta.68",
 	"description": "Codex plugin component that emits omo-codex anonymous daily-active telemetry on SessionStart.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/ultrawork/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook user-prompt-submit",
 						"timeout": 5,
-						"statusMessage": "(OmO 5.0.0-beta.66) Checking Ultrawork Trigger"
+						"statusMessage": "(OmO 5.0.0-beta.68) Checking Ultrawork Trigger"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/ultrawork/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-ultrawork",
-	"version": "5.0.0-beta.66",
+	"version": "5.0.0-beta.68",
 	"description": "Codex plugin that injects the ultrawork orchestration directive and ships LazyCodex planning, review, QA, and gate agent roles.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/ulw-execute-continuation/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/components/ulw-execute-continuation/dist/cli.js\" hook stop",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.66) Checking Ulw-Execute Continuation"
+						"statusMessage": "(OmO 5.0.0-beta.68) Checking Ulw-Execute Continuation"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/ulw-execute-continuation/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-ulw-execute-continuation",
-	"version": "5.0.0-beta.66",
+	"version": "5.0.0-beta.68",
 	"description": "Codex Stop hook continuation injector for omo-codex ulw-execute plans.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/ulw-loop/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## [0.1.0] - unreleased
 
+- **Fix:** a `goals.json` written outside the commit log (the removed `omo_agent_toolkit` tool path rewrote it wholesale, never stamping `revision`) no longer loses to an older `revisions/` snapshot when it holds goals that snapshot lacks; the cache wins, is stamped with the snapshot's revision, and the next publish folds it into revision N+1 instead of colliding on an existing record. Raw `ledger.jsonl` lines appended after a published revision are attributed to that revision rather than to the pre-store past a later `ledgerResetRevision` discards. Locked reads and every commit now refuse to rewrite `goals.json` while the reconciled ledger names a `goal_added` goal the projection lacks (`ULW_LOOP_PROJECTION_TRUNCATED`, `details.missingGoalIds`) instead of silently truncating the plan (code-yeongyu/oh-my-openagent#8328).
 - Status nextActions and missing-plan recovery now follow the calling surface: omo-senpi teaches the eval SDK methods and current attempt directory without asking for a driver snapshot; LazyCodex retains its existing CLI guidance byte-for-byte.
 
 - Async `.state.lock` holders now keep their file descriptor open and refresh a 30-second lease through it. An expired lease can be reclaimed even while its process remains alive; sync hooks and older lease-less records retain dead-pid-only ownership. Windows filesystems that refuse unlinking an open lock fail closed. Interrupted kernels can recover after lease expiry without deleting a live owner's lock.

package/packages/omo-codex/plugin/components/ulw-loop/dist/cli.js

@@ -456,7 +456,28 @@ function reconcilePlan(dir) {
     }
   }
   const latest = readNewestRecord(dir);
-  return latest !== undefined && latest.revision >= (cached?.revision ?? 0) ? latest.plan : cached;
+  if (latest === undefined)
+    return cached;
+  if (cached === undefined)
+    return latest.plan;
+  if ((cached.revision ?? 0) > latest.revision)
+    return cached;
+  if (cached.revision === undefined || cached.revision === latest.revision) {
+    const published = new Set(latest.plan.goals.map((goal) => goal.id));
+    if (Array.isArray(cached.goals) && cached.goals.some((goal) => !published.has(goal.id)))
+      return { ...cached, revision: latest.revision };
+  }
+  return latest.plan;
+}
+function assertProjectionComplete(plan, ledger) {
+  const present = new Set(plan.goals.map((goal) => goal.id));
+  const missing = new Set;
+  for (const entry of ledger)
+    if (entry.kind === "goal_added" && entry.goalId !== undefined && !present.has(entry.goalId))
+      missing.add(entry.goalId);
+  if (missing.size === 0)
+    return;
+  throw new UlwLoopError(`Refusing to rewrite goals.json: the ledger records goals the plan projection lacks (${[...missing].join(", ")}). Restore those goals into the newest revisions/ record (keeping plan.revision equal to its file number) before mutating this run.`, "ULW_LOOP_PROJECTION_TRUNCATED", { details: { missingGoalIds: [...missing] } });
 }
 function planExists(repoRoot, scope) {
   const dir = ulwLoopDir(repoRoot, scope);
@@ -467,12 +488,14 @@ function planExists(repoRoot, scope) {
 function readLedgerAt(dir) {
   const entries = new Map;
   const lines = (readOptional(join3(dir, "ledger.jsonl")) ?? "").split(/\r?\n/);
+  let reached = 0;
   for (const [index, line] of lines.entries()) {
     if (line.trim().length === 0)
       continue;
     try {
       const entry = JSON.parse(line);
-      entry.revision ??= 0;
+      entry.revision = entry.revision || reached;
+      reached = Math.max(reached, entry.revision);
       entry.id ??= `legacy-${index + 1}`;
       entries.set(entry.id, entry);
     } catch (error) {
@@ -959,6 +982,7 @@ function viewContents(dir) {
   if (plan === undefined || readRecords(dir).length === 0)
     return [];
   const ledger = readLedgerAt(dir);
+  assertProjectionComplete(plan, ledger);
   const views = [
     ["goals.json", `${JSON.stringify(plan, null, 2)}
 `],

package/packages/omo-codex/plugin/components/ulw-loop/dist/ledger.js

@@ -4,12 +4,17 @@ import { readOptional, readRecords, reconcilePlan } from "./plan-log.js";
 export function readLedgerAt(dir) {
     const entries = new Map();
     const lines = (readOptional(join(dir, "ledger.jsonl")) ?? "").split(/\r?\n/);
+    // A materialized view is sorted by revision, so a line that carries no revision (or revision 0)
+    // AFTER a published revision was appended out-of-band (the removed tool path) and belongs to the
+    // newest revision before it - not to the pre-store past a later ledgerResetRevision would discard.
+    let reached = 0;
     for (const [index, line] of lines.entries()) {
         if (line.trim().length === 0)
             continue;
         try {
             const entry = JSON.parse(line);
-            entry.revision ??= 0;
+            entry.revision = entry.revision || reached;
+            reached = Math.max(reached, entry.revision);
             entry.id ??= `legacy-${index + 1}`;
             entries.set(entry.id, entry);
         }

package/packages/omo-codex/plugin/components/ulw-loop/dist/plan-commit.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import { readLedgerAt } from "./ledger.js";
 import { ulwLoopDir, ulwLoopStateLockPath } from "./paths.js";
 import { assertStateLockOwned, migrationEntries } from "./plan-io.js";
-import { hasCode, readOptional, readRecords, reconcilePlan } from "./plan-log.js";
+import { assertProjectionComplete, hasCode, readOptional, readRecords, reconcilePlan, } from "./plan-log.js";
 import { UlwLoopError } from "./types.js";
 const hooks = new AsyncLocalStorage();
 export function withCommitHooks(value, fn) {
@@ -72,6 +72,7 @@ function viewContents(dir) {
     if (plan === undefined || readRecords(dir).length === 0)
         return [];
     const ledger = readLedgerAt(dir);
+    assertProjectionComplete(plan, ledger);
     const views = [
         ["goals.json", `${JSON.stringify(plan, null, 2)}\n`],
         ["ledger.jsonl", ledger.length === 0 ? "" : `${ledger.map((entry) => JSON.stringify(entry)).join("\n")}\n`],

package/packages/omo-codex/plugin/components/ulw-loop/dist/plan-log.d.ts

@@ -1,5 +1,5 @@
 import { type UlwLoopScope } from "./paths.js";
-import type { UlwLoopLedgerEntry, UlwLoopPlan } from "./types.js";
+import { type UlwLoopLedgerEntry, type UlwLoopPlan } from "./types.js";
 export interface PlanCommitRecord {
     readonly version: 1;
     readonly revision: number;
@@ -12,4 +12,5 @@ export declare function logNames(dir: string): string[];
 export declare function readRecords(dir: string): PlanCommitRecord[];
 export declare function readNewestRecord(dir: string): PlanCommitRecord | undefined;
 export declare function reconcilePlan(dir: string): UlwLoopPlan | undefined;
+export declare function assertProjectionComplete(plan: UlwLoopPlan, ledger: readonly UlwLoopLedgerEntry[]): void;
 export declare function planExists(repoRoot: string, scope?: UlwLoopScope): boolean;

package/packages/omo-codex/plugin/components/ulw-loop/dist/plan-log.js

@@ -1,6 +1,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { ulwLoopDir } from "./paths.js";
+import { UlwLoopError } from "./types.js";
 export function hasCode(error, code) {
     return error instanceof Error && "code" in error && error.code === code;
 }
@@ -78,7 +79,35 @@ export function reconcilePlan(dir) {
         }
     }
     const latest = readNewestRecord(dir);
-    return latest !== undefined && latest.revision >= (cached?.revision ?? 0) ? latest.plan : cached;
+    if (latest === undefined)
+        return cached;
+    if (cached === undefined)
+        return latest.plan;
+    if ((cached.revision ?? 0) > latest.revision)
+        return cached;
+    // A goals.json written outside the commit log (the removed tool path rewrote it wholesale, never
+    // stamping `revision`) can hold goals no snapshot has. Serving the snapshot would drop them, so the
+    // cache wins and is stamped with the snapshot's revision: the next publish derives N+1 from it and
+    // folds the whole plan into a real record instead of colliding with an existing revision file.
+    // A cache that names an OLDER revision is a lagging view of a force-recreate and never wins.
+    if (cached.revision === undefined || cached.revision === latest.revision) {
+        const published = new Set(latest.plan.goals.map((goal) => goal.id));
+        if (Array.isArray(cached.goals) && cached.goals.some((goal) => !published.has(goal.id)))
+            return { ...cached, revision: latest.revision };
+    }
+    return latest.plan;
+}
+// Goals are never removed from a plan, so every `goal_added` the reconciled ledger still carries must
+// have a goal in the projection. A projection that lacks one is truncated and must not become goals.json.
+export function assertProjectionComplete(plan, ledger) {
+    const present = new Set(plan.goals.map((goal) => goal.id));
+    const missing = new Set();
+    for (const entry of ledger)
+        if (entry.kind === "goal_added" && entry.goalId !== undefined && !present.has(entry.goalId))
+            missing.add(entry.goalId);
+    if (missing.size === 0)
+        return;
+    throw new UlwLoopError(`Refusing to rewrite goals.json: the ledger records goals the plan projection lacks (${[...missing].join(", ")}). Restore those goals into the newest revisions/ record (keeping plan.revision equal to its file number) before mutating this run.`, "ULW_LOOP_PROJECTION_TRUNCATED", { details: { missingGoalIds: [...missing] } });
 }
 export function planExists(repoRoot, scope) {
     const dir = ulwLoopDir(repoRoot, scope);

package/packages/omo-codex/plugin/components/ulw-loop/hooks/hooks.json

@@ -7,7 +7,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook user-prompt-submit --with-ultrawork",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.66) Checking Ulw-Loop Steering"
+						"statusMessage": "(OmO 5.0.0-beta.68) Checking Ulw-Loop Steering"
 					}
 				]
 			}
@@ -20,7 +20,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook post-tool-use-spawn",
 						"timeout": 5,
-						"statusMessage": "(OmO 5.0.0-beta.66) Recording Spawn Admission"
+						"statusMessage": "(OmO 5.0.0-beta.68) Recording Spawn Admission"
 					}
 				]
 			}
@@ -33,7 +33,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook pre-tool-use",
 						"timeout": 5,
-						"statusMessage": "(OmO 5.0.0-beta.66) Enforcing Unlimited Ulw-Loop Budget"
+						"statusMessage": "(OmO 5.0.0-beta.68) Enforcing Unlimited Ulw-Loop Budget"
 					}
 				]
 			},
@@ -44,7 +44,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook pre-tool-use-spawn",
 						"timeout": 5,
-						"statusMessage": "(OmO 5.0.0-beta.66) Guarding Ulw-Loop Spawns"
+						"statusMessage": "(OmO 5.0.0-beta.68) Guarding Ulw-Loop Spawns"
 					}
 				]
 			}
@@ -56,7 +56,7 @@
 						"type": "command",
 						"command": "node \"${PLUGIN_ROOT}/dist/cli.js\" hook stop",
 						"timeout": 10,
-						"statusMessage": "(OmO 5.0.0-beta.66) Checking Ulw-Loop Resume"
+						"statusMessage": "(OmO 5.0.0-beta.68) Checking Ulw-Loop Resume"
 					}
 				]
 			}

package/packages/omo-codex/plugin/components/ulw-loop/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@code-yeongyu/codex-ulw-loop",
-	"version": "5.0.0-beta.66",
+	"version": "5.0.0-beta.68",
 	"description": "Codex plugin: durable repo-native multi-goal orchestration with embedded success criteria and observable evidence audit.",
 	"type": "module",
 	"packageManager": "npm@11.12.1",

package/packages/omo-codex/plugin/components/ulw-loop/src/ledger.ts

@@ -6,11 +6,16 @@ import type { UlwLoopLedgerEntry } from "./types.js";
 export function readLedgerAt(dir: string): UlwLoopLedgerEntry[] {
 	const entries = new Map<string, UlwLoopLedgerEntry>();
 	const lines = (readOptional(join(dir, "ledger.jsonl")) ?? "").split(/\r?\n/);
+	// A materialized view is sorted by revision, so a line that carries no revision (or revision 0)
+	// AFTER a published revision was appended out-of-band (the removed tool path) and belongs to the
+	// newest revision before it - not to the pre-store past a later ledgerResetRevision would discard.
+	let reached = 0;
 	for (const [index, line] of lines.entries()) {
 		if (line.trim().length === 0) continue;
 		try {
 			const entry: UlwLoopLedgerEntry = JSON.parse(line);
-			entry.revision ??= 0;
+			entry.revision = entry.revision || reached;
+			reached = Math.max(reached, entry.revision);
 			entry.id ??= `legacy-${index + 1}`;
 			entries.set(entry.id, entry);
 		} catch (error) {

package/packages/omo-codex/plugin/components/ulw-loop/src/plan-commit.ts

@@ -6,7 +6,14 @@ import { join } from "node:path";
 import { readLedgerAt } from "./ledger.js";
 import { type UlwLoopScope, ulwLoopDir, ulwLoopStateLockPath } from "./paths.js";
 import { assertStateLockOwned, migrationEntries } from "./plan-io.js";
-import { hasCode, type PlanCommitRecord, readOptional, readRecords, reconcilePlan } from "./plan-log.js";
+import {
+	assertProjectionComplete,
+	hasCode,
+	type PlanCommitRecord,
+	readOptional,
+	readRecords,
+	reconcilePlan,
+} from "./plan-log.js";
 import { UlwLoopError, type UlwLoopLedgerEntry, type UlwLoopPlan } from "./types.js";
 
 interface CommitHooks {
@@ -91,6 +98,7 @@ function viewContents(dir: string): [string, string][] {
 	const plan = reconcilePlan(dir);
 	if (plan === undefined || readRecords(dir).length === 0) return [];
 	const ledger = readLedgerAt(dir);
+	assertProjectionComplete(plan, ledger);
 	const views: [string, string][] = [
 		["goals.json", `${JSON.stringify(plan, null, 2)}\n`],
 		["ledger.jsonl", ledger.length === 0 ? "" : `${ledger.map((entry) => JSON.stringify(entry)).join("\n")}\n`],

package/packages/omo-codex/plugin/components/ulw-loop/src/plan-log.ts

@@ -1,7 +1,7 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { type UlwLoopScope, ulwLoopDir } from "./paths.js";
-import type { UlwLoopLedgerEntry, UlwLoopPlan } from "./types.js";
+import { UlwLoopError, type UlwLoopLedgerEntry, type UlwLoopPlan } from "./types.js";
 
 export interface PlanCommitRecord {
 	readonly version: 1;
@@ -76,7 +76,35 @@ export function reconcilePlan(dir: string): UlwLoopPlan | undefined {
 		}
 	}
 	const latest = readNewestRecord(dir);
-	return latest !== undefined && latest.revision >= (cached?.revision ?? 0) ? latest.plan : cached;
+	if (latest === undefined) return cached;
+	if (cached === undefined) return latest.plan;
+	if ((cached.revision ?? 0) > latest.revision) return cached;
+	// A goals.json written outside the commit log (the removed tool path rewrote it wholesale, never
+	// stamping `revision`) can hold goals no snapshot has. Serving the snapshot would drop them, so the
+	// cache wins and is stamped with the snapshot's revision: the next publish derives N+1 from it and
+	// folds the whole plan into a real record instead of colliding with an existing revision file.
+	// A cache that names an OLDER revision is a lagging view of a force-recreate and never wins.
+	if (cached.revision === undefined || cached.revision === latest.revision) {
+		const published = new Set(latest.plan.goals.map((goal) => goal.id));
+		if (Array.isArray(cached.goals) && cached.goals.some((goal) => !published.has(goal.id)))
+			return { ...cached, revision: latest.revision };
+	}
+	return latest.plan;
+}
+// Goals are never removed from a plan, so every `goal_added` the reconciled ledger still carries must
+// have a goal in the projection. A projection that lacks one is truncated and must not become goals.json.
+export function assertProjectionComplete(plan: UlwLoopPlan, ledger: readonly UlwLoopLedgerEntry[]): void {
+	const present = new Set(plan.goals.map((goal) => goal.id));
+	const missing = new Set<string>();
+	for (const entry of ledger)
+		if (entry.kind === "goal_added" && entry.goalId !== undefined && !present.has(entry.goalId))
+			missing.add(entry.goalId);
+	if (missing.size === 0) return;
+	throw new UlwLoopError(
+		`Refusing to rewrite goals.json: the ledger records goals the plan projection lacks (${[...missing].join(", ")}). Restore those goals into the newest revisions/ record (keeping plan.revision equal to its file number) before mutating this run.`,
+		"ULW_LOOP_PROJECTION_TRUNCATED",
+		{ details: { missingGoalIds: [...missing] } },
+	);
 }
 export function planExists(repoRoot: string, scope?: UlwLoopScope): boolean {
 	const dir = ulwLoopDir(repoRoot, scope);