oh-my-opencode 5.1.47 → 5.1.48

package/packages/shared-skills/skills/ulw-research/scripts/fidelity-policy.mjs

@@ -0,0 +1,183 @@
+// fidelity-policy.mjs - what the locked `## Fidelity` block of brief.md means to the CLI stages.
+//
+// lockedBrief is the gate the six reader-facing stages (fact fill, verify, pairs, meaning-check,
+// polish-apply, polish-diff) run before reading or writing anything: an unlocked brief returns
+// one fidelity_interview_incomplete defect (exit 1), a malformed block is a usage error (exit 2).
+// fillPolicy reads the fields fact fill consumes (a value off its table is a usage error, exit 2),
+// and policyErrors refuses a placeholder whose row the brief forbids: derived_not_allowed
+// (`derived numbers: none` against a derived, converted, or assumed row) and source_outside_floor
+// (the source floor is evaluated live against each source's meta.json at every fill and verify;
+// under any floor but `standard` a row resting on no source is refused too; a row's outside_floor
+// is only the cached result). briefHashOf binds the locked block into the fill map, and
+// briefBindingErrors refuses an edition whose map was filled under another brief (brief_changed).
+// Collection stages never call this module. node: builtins and sibling imports only.
+
+import { existsSync, readFileSync } from "node:fs"
+import { join, resolve } from "node:path"
+
+import { CliError, sha256Of } from "./cli-support.mjs"
+import { DEFECT_CODES } from "./contracts.mjs"
+import { KIND_RULES } from "./fact-ledger-kinds.mjs"
+import { FIDELITY_FIELDS, meaningCheckEnabled, requireLockedBrief } from "./fidelity-brief.mjs"
+
+export { meaningCheckEnabled }
+
+/**
+ * Ledger kinds a brief with `derived numbers: none` refuses. A policy list, not the ledger's
+ * derivation set: it also names assumed. Every name must be a KIND_RULES kind (checked at load).
+ */
+const DERIVED_KINDS = Object.freeze(["derived", "converted", "assumed"])
+for (const kind of DERIVED_KINDS) {
+	if (!Object.hasOwn(KIND_RULES, kind)) throw new Error(`fidelity-policy: ${kind} is not a KIND_RULES kind`)
+}
+
+/** Fields whose only legal values are a closed table: value (any case) -> its reading. */
+const VALUE_TABLES = Object.freeze({
+	"derived numbers": Object.freeze({ allowed: false, none: true }),
+	fallback: Object.freeze({ "block-quote": "quote", omit: "omit" }),
+})
+
+/** The reading of a table value; any other text is a usage error naming the field and the value. */
+function tableValue(field, value) {
+	const table = VALUE_TABLES[field]
+	const key = value.trim().toLowerCase()
+	if (Object.hasOwn(table, key)) return table[key]
+	throw new CliError(`${field} "${value}" is not ${Object.keys(table).join(", ")}`)
+}
+
+/** How each field value the fill stages consume is read; the single owner of those readings. */
+export const FIDELITY_VALUE_RULES = Object.freeze({
+	tables: VALUE_TABLES,
+	derivedKinds: DERIVED_KINDS,
+	derivedRefused: (kind) => DERIVED_KINDS.includes(kind),
+	derivedNone: (value) => tableValue("derived numbers", value),
+	fallback: (value) => tableValue("fallback", value),
+	translations: (value) => /with translation beside/iu.test(value),
+	meaningCheck: (value) => meaningCheckEnabled({ fields: { "meaning check": value } }),
+})
+
+/** The `source floor` forms: `pattern` reads one, `listed` forms carry a comma list. */
+export const SOURCE_FLOOR_RULES = Object.freeze([
+	Object.freeze({ kind: "standard", form: "standard", pattern: /^standard$/iu, listed: false }),
+	Object.freeze({ kind: "primary", form: "primary only", pattern: /^primary only$/iu, listed: false }),
+	Object.freeze({ kind: "pointed", form: "pointed only: <list>", pattern: /^pointed only:\s*(.+)$/iu, listed: true }),
+	Object.freeze({ kind: "classes", form: "classes: <list>", pattern: /^classes:\s*(.+)$/iu, listed: true }),
+])
+const lineOf = (text, at) => text.slice(0, at).split("\n").length
+const listOf = (text) => text.split(",").map((entry) => entry.trim()).filter(Boolean)
+
+/** brief.md from --brief, else the session's; a usage error when neither is known. */
+export function briefPathOf(flags) {
+	if (flags.brief !== undefined && flags.brief !== true) return resolve(flags.brief)
+	const dir = flags["session-dir"] ?? process.env.SESSION_DIR
+	if (!dir || dir === true) throw new CliError("--brief is required without --session-dir (or SESSION_DIR)")
+	return join(resolve(dir), "brief.md")
+}
+
+/**
+ * @returns {{ parsed: object, refusal: null } | { parsed: null, refusal: { json: object, summary: string, exitCode: 1 } }}
+ */
+export function lockedBrief(command, flags) {
+	const path = briefPathOf(flags)
+	const lock = requireLockedBrief(path)
+	if (lock.exitCode === 2) throw new CliError(`${path}: ${lock.errors.join("; ")}`)
+	if (lock.locked) return { parsed: lock.parsed, refusal: null }
+	const json = { command, status: "fail", exitCode: 1, defects: lock.defects }
+	return { parsed: null, refusal: { json, summary: `${command}: ${lock.defects[0].message}`, exitCode: 1 } }
+}
+
+/**
+ * The source floor as a rule, or null for `standard`; a usage error for any other text.
+ * @returns {null | { kind: "primary" } | { kind: "pointed" | "classes", list: string[] }}
+ */
+export function parseSourceFloor(value) {
+	const text = value.trim()
+	for (const rule of SOURCE_FLOOR_RULES) {
+		const match = rule.pattern.exec(text)
+		if (!match) continue
+		if (rule.kind === "standard") return null
+		return rule.listed ? { kind: rule.kind, list: listOf(match[1]) } : { kind: rule.kind }
+	}
+	throw new CliError(`source floor "${value}" is not ${SOURCE_FLOOR_RULES.map((rule) => rule.form).join(", ")}`)
+}
+
+function hostOf(url) {
+	return typeof url === "string" && URL.canParse(url) ? new URL(url).hostname.toLowerCase() : null
+}
+
+/** Whether one source (id and meta.json) satisfies a parsed floor rule. */
+export function sourceInsideFloor(rule, sourceId, meta) {
+	if (rule.kind === "primary") return meta.provenance === "primary"
+	if (rule.kind === "pointed") return rule.list.includes(sourceId) || rule.list.includes(meta.url)
+	const host = hostOf(meta.url)
+	return host !== null && rule.list.some((entry) => host === entry.toLowerCase() || host.endsWith(`.${entry.toLowerCase()}`))
+}
+
+/** The fields fact fill consumes: the fallback form and whether a translation binds to its quote. */
+export function fillPolicy(parsed) {
+	const field = (name) => parsed.fields[name]
+	return {
+		fallback: FIDELITY_VALUE_RULES.fallback(field("fallback")),
+		translations: FIDELITY_VALUE_RULES.translations(field("languages")),
+		derivedNone: FIDELITY_VALUE_RULES.derivedNone(field("derived numbers")),
+		floor: parseSourceFloor(field("source floor")),
+	}
+}
+
+/** Source ids behind a row: its own, or for a derived row its operands' sources; null marks a leaf with no source. */
+function sourcesOf(row, rows, seen = new Set()) {
+	if (seen.has(row.fact_id)) return []
+	seen.add(row.fact_id)
+	if (row.source_id) return [row.source_id]
+	const inputs = [...(row.operands ?? []), ...(row.derived_from ?? [])]
+	if (inputs.length === 0) return [null]
+	return inputs.flatMap((id) => (rows.has(id) ? sourcesOf(rows.get(id), rows, seen) : [null]))
+}
+
+/** sha256 of the locked `## Fidelity` block normalized: the seven fields in FIDELITY_FIELDS order, `field: value` per line. */
+export const briefHashOf = (parsed) => sha256Of(FIDELITY_FIELDS.map((field) => `${field}: ${parsed.fields[field]}`).join("\n"))
+
+/** brief_changed when a fill map was not written under the current brief (or predates the binding). */
+export function briefBindingErrors(map, mapPath, parsed) {
+	if (map.brief_sha256 === briefHashOf(parsed)) return []
+	const why = typeof map.brief_sha256 === "string" ? "was filled under a different ## Fidelity block" : "records no brief_sha256"
+	return [{ code: "brief_changed", token: null, line: null, message: `${mapPath} ${why}; re-run fact fill under the current brief`, severity: DEFECT_CODES.brief_changed.severity, integrity: DEFECT_CODES.brief_changed.integrity, hint: DEFECT_CODES.brief_changed.hint }]
+}
+
+function metaOf(sessionDir, sourceId, cache) {
+	if (!cache.has(sourceId)) {
+		const file = join(sessionDir, "sources", sourceId, "meta.json")
+		cache.set(sourceId, existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { url: null, provenance: "unknown" })
+	}
+	return cache.get(sourceId)
+}
+
+const defect = (code, pointer, text, message) => ({ code, token: pointer.token, line: lineOf(text, pointer.start), message, severity: DEFECT_CODES[code].severity, hint: DEFECT_CODES[code].hint })
+
+/**
+ * Refusals for the placeholders of one fill source (or the data-fact elements of one edition at
+ * verify). Sets each referenced row's outside_floor to this evaluation and reports whether any
+ * cached value changed.
+ * @param {{ token: string, start: number, parsed: { id?: string } }[]} found findPlaceholders output
+ * @returns {{ errors: object[], cacheChanged: boolean }}
+ */
+export function policyErrors(text, found, ledger, sessionDir, policy) {
+	const rows = new Map(ledger.rows.map((row) => [row.fact_id, row]))
+	const metas = new Map()
+	const errors = []
+	let cacheChanged = false
+	for (const pointer of found) {
+		const row = rows.get(pointer.parsed?.id)
+		if (row === undefined || row.status !== "active") continue
+		if (policy.derivedNone && FIDELITY_VALUE_RULES.derivedRefused(row.kind)) {
+			errors.push(defect("derived_not_allowed", pointer, text, `${row.fact_id} is ${row.kind}; the brief records derived numbers: none`))
+		}
+		const sources = sourcesOf(row, rows)
+		const outside = policy.floor === null ? [] : [...new Set(sources.filter((id) => id === null || !sourceInsideFloor(policy.floor, id, metaOf(sessionDir, id, metas))))]
+		if (row.outside_floor !== outside.length > 0) cacheChanged = true
+		row.outside_floor = outside.length > 0
+		const named = outside.map((id) => id ?? "no source").join(", ")
+		if (outside.length > 0) errors.push(defect("source_outside_floor", pointer, text, `${row.fact_id} rests on ${named}, outside the source floor`))
+	}
+	return { errors, cacheChanged }
+}

package/packages/shared-skills/skills/ulw-research/scripts/report-tools.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, onTestFinished, test } from "bun:test"
 import { createHash } from "node:crypto"
-import { copyFileSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { copyFileSync, existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
 import { tmpdir } from "node:os"
 import { delimiter, join } from "node:path"
 
@@ -517,7 +517,7 @@ function polishSession() {
 }
 
 function polishApply(dir: string, edits: string) {
-	const args = ["fact", "polish-apply", join(dir, "report.html"), "--edits", edits, "--ledger", join(dir, "fact-ledger.json"), "--out", join(dir, "report.polished.html")]
+	const args = ["fact", "polish-apply", join(dir, "report.html"), "--edits", edits, "--ledger", join(dir, "fact-ledger.json"), "--out", join(dir, "report.polished.html"), "--session-dir", dir]
 	const proc = nodeJson(args)
 	return { ...proc, json: proc.json as unknown as PolishJson }
 }
@@ -547,7 +547,7 @@ describe("polish wiring under node", () => {
 		expect(applied.json.defects[0]?.reason).toContain("markup changed")
 		expect(readFileSync(join(dir, "report.polished.html"), "utf8")).toBe(html)
 		writeFileSync(join(dir, "attribute.html"), html.replace("<h2>Findings</h2>", '<h2 id="findings">Findings</h2>'))
-		const diffed = nodeJson(["fact", "polish-diff", "--before", join(dir, "report.html"), "--after", join(dir, "attribute.html"), "--ledger", join(dir, "fact-ledger.json")])
+		const diffed = nodeJson(["fact", "polish-diff", "--before", join(dir, "report.html"), "--after", join(dir, "attribute.html"), "--ledger", join(dir, "fact-ledger.json"), "--session-dir", dir])
 		expect(diffed.code).toBe(1)
 		expect(codesOf(diffed.json)).toContain("polish_diff_fail")
 		expect(JSON.stringify(diffed.json)).toContain("markup changed")
@@ -570,7 +570,7 @@ describe("polish wiring under node", () => {
 		const { dir } = polishSession()
 		const html = readFileSync(join(dir, "report.html"), "utf8")
 		writeFileSync(join(dir, "hand.html"), html.replace("320 m", "321 m"))
-		const diffed = nodeJson(["fact", "polish-diff", "--before", join(dir, "report.html"), "--after", join(dir, "hand.html"), "--ledger", join(dir, "fact-ledger.json")])
+		const diffed = nodeJson(["fact", "polish-diff", "--before", join(dir, "report.html"), "--after", join(dir, "hand.html"), "--ledger", join(dir, "fact-ledger.json"), "--session-dir", dir])
 		expect(diffed.code).toBe(1)
 		expect(codesOf(diffed.json)).toContain("polish_diff_fail")
 	})
@@ -755,3 +755,244 @@ describe("fidelity delivery barrier", () => {
 		expect(matched).toEqual({ exitCode: 0, codes: [] })
 	})
 })
+
+/** Rewrite one `## Fidelity` field line of the session's brief.md. */
+function setField(dir: string, field: string, value: string, answeredBy = "user") {
+	const path = join(dir, "brief.md")
+	const line = new RegExp(`^${field}: .*$`, "mu")
+	writeFileSync(path, readFileSync(path, "utf8").replace(line, `${field}: ${value} (answered_by: ${answeredBy})`))
+}
+
+function fillTemplate(dir: string, body: string, extra: string[] = []) {
+	const source = ['<!doctype html><html lang="en"><head><meta charset="utf-8"><title>T</title></head><body><h1>T</h1>', "<h2>Findings</h2>", body, "</body></html>"].join("\n")
+	writeFileSync(join(dir, "t.src.html"), source)
+	return nodeJson(["fact", "fill", join(dir, "t.src.html"), "--out", join(dir, "t.html"), "--session-dir", dir, ...extra])
+}
+
+/** Snapshot a one-line text source under `id` with the given provenance (omitted: unknown) and register its span row. */
+function textSource(dir: string, id: string, provenance?: string) {
+	writeFileSync(join(dir, `${id}.txt`), "Commentary: the span length is 320 m according to this review.\n")
+	const prov = provenance === undefined ? [] : ["--provenance", provenance]
+	const snap = nodeJson(["source", "snapshot", "--id", id, "--text", join(dir, `${id}.txt`), "--kind", "document", ...prov, "--session-dir", dir])
+	const add = nodeJson(["fact", "add", "--source", id, "--find", "span length", "--label", `span_${id.toLowerCase()}`, "--json", "--session-dir", dir])
+	return { snap, row: add.json.data?.row }
+}
+
+const ledgerRow = (dir: string, id: string) => JSON.parse(readFileSync(join(dir, "fact-ledger.json"), "utf8")).rows.find((r: { fact_id: string }) => r.fact_id === id)
+
+describe("fidelity brief lock and policy under node", () => {
+	test("#given a filled session whose brief turns pending #when each reader-facing command runs #then all six exit 1 with only fidelity_interview_incomplete and write nothing", () => {
+		// given
+		const { dir, s } = pairedSession()
+		copyFileSync(join(FIXTURES, "fidelity-brief-pending.md"), join(dir, "brief.md"))
+		for (const name of ["fidelity-defects.json", "pairs.json"]) rmSync(join(dir, name), { force: true })
+		const drift = verdicts(dir, "cheap.json", "cheap", [])
+		writeFileSync(join(dir, "edits.json"), "[]")
+		// when
+		const runs = {
+			fill: nodeJson(["fact", "fill", join(dir, "report.src.html"), "--out", join(dir, "again.html"), ...s]),
+			verify: verify(dir, "report.html"),
+			pairs: nodeJson(["fact", "pairs", join(dir, "report.html"), "--out", join(dir, "pairs.json"), ...s]),
+			meaning: nodeJson(["fact", "meaning-check", "--pairs", join(dir, "absent-pairs.json"), "--verdicts", drift, ...s]),
+			polishApply: nodeJson(["fact", "polish-apply", join(dir, "report.html"), "--edits", join(dir, "edits.json"), "--out", join(dir, "polished.html"), ...s]),
+			polishDiff: nodeJson(["fact", "polish-diff", "--before", join(dir, "report.html"), "--after", join(dir, "report.html"), "--out", join(dir, "polish.json"), ...s]),
+		}
+		// then
+		for (const [name, result] of Object.entries(runs)) {
+			expect({ name, code: result.code, codes: codesOf(result.json) }).toEqual({ name, code: 1, codes: ["fidelity_interview_incomplete"] })
+		}
+		for (const name of ["again.html", "fidelity-defects.json", "pairs.json", "polished.html", "polish.json", "fidelity-meaning-defects.json"]) expect({ name, exists: existsSync(join(dir, name)) }).toEqual({ name, exists: false })
+	})
+
+	test("#given derived numbers none #when a derived or a converted placeholder is filled #then derived_not_allowed, and allowed renders both", () => {
+		// given
+		const { dir, s, mm } = fidelitySession()
+		const expr = nodeJson(["fact", "derive", "--op", "expr", "F1 * 2", "--unit", "m", "--rationale", "two spans", "--label", "two_spans", "--json", ...s])
+		const twice = expr.json.data.row.fact_id
+		setField(dir, "derived numbers", "none")
+		// when
+		const derived = fillTemplate(dir, `<p>Two spans are {{${twice}:two_spans}} [S4].</p>`)
+		const converted = fillTemplate(dir, `<p>The span is {{${mm}:span_mm}} [S4].</p>`)
+		setField(dir, "derived numbers", "allowed")
+		const allowed = fillTemplate(dir, `<p>Two spans are {{${twice}:two_spans}} [S4]. The span is {{${mm}:span_mm}} [S4].</p>`)
+		// then
+		expect(expr.code).toBe(0)
+		expect([derived.code, codesOf(derived.json)]).toEqual([1, ["derived_not_allowed"]])
+		expect([converted.code, codesOf(converted.json)]).toEqual([1, ["derived_not_allowed"]])
+		expect(allowed.code).toBe(0)
+		expect(readFileSync(join(dir, "t.html"), "utf8")).toContain("320,000 mm")
+	})
+
+	test("#given source floor primary only #when rows from secondary, unknown, and primary sources are filled #then only the primary row renders", () => {
+		// given
+		const { dir } = fidelitySession()
+		const secondary = textSource(dir, "S7", "secondary")
+		const unknown = textSource(dir, "S8")
+		const primary = textSource(dir, "S6", "primary")
+		setField(dir, "source floor", "primary only")
+		// when
+		const fills = [secondary, unknown, primary].map(({ row }) => fillTemplate(dir, `<p>The span is {{${row.fact_id}:${row.label}}} [S4].</p>`))
+		// then
+		expect([secondary.snap.json, unknown.snap.json, primary.snap.json].map((json) => (json as unknown as { data: { provenance: string } }).data.provenance)).toEqual(["secondary", "unknown", "primary"])
+		expect(fills.map((f) => [f.code, codesOf(f.json)])).toEqual([
+			[1, ["source_outside_floor"]],
+			[1, ["source_outside_floor"]],
+			[0, []],
+		])
+	})
+
+	test("#given a row registered while source floor is pending #when the floor locks to pointed only S4, then standard #then fill refuses, then renders, and outside_floor caches each result", () => {
+		// given
+		const { dir } = fidelitySession()
+		setField(dir, "source floor", "pending", "pending")
+		const { snap, row } = textSource(dir, "S9")
+		const body = `<p>The span is {{${row.fact_id}:${row.label}}} [S9].</p>`
+		// when
+		setField(dir, "source floor", "pointed only: S4")
+		const refused = fillTemplate(dir, body)
+		const cachedRefused = ledgerRow(dir, row.fact_id).outside_floor
+		setField(dir, "source floor", "standard")
+		const rendered = fillTemplate(dir, body)
+		// then
+		expect(snap.code).toBe(0)
+		expect(row.outside_floor).toBe(false)
+		expect([refused.code, codesOf(refused.json)]).toEqual([1, ["source_outside_floor"]])
+		expect(cachedRefused).toBe(true)
+		expect(rendered.code).toBe(0)
+		expect(ledgerRow(dir, row.fact_id).outside_floor).toBe(false)
+	})
+
+	test("#given a markdown translation comment after a quote #when languages is translation beside, then quotes original #then fact pairs emits a translation pair only for the first", () => {
+		// given
+		const { dir, s } = fidelitySession()
+		const md = ["# T", "", "## Findings", "", "The operator wrote {{Q1:completion}} <!-- translates: Q1 --> completion comes in 2027 at the earliest [S4].", ""].join("\n")
+		writeFileSync(join(dir, "t.src.md"), md)
+		const kinds = () => {
+			const filled = nodeJson(["fact", "fill", join(dir, "t.src.md"), "--format", "md", "--out", join(dir, "t.md"), ...s])
+			const pairs = nodeJson(["fact", "pairs", join(dir, "t.md"), "--out", join(dir, "pairs.json"), ...s])
+			return { fill: filled.code, pairs: pairs.code, kinds: JSON.parse(readFileSync(join(dir, "pairs.json"), "utf8")).pairs.map((p: Pair) => p.kind) }
+		}
+		// when
+		const beside = kinds()
+		setField(dir, "languages", "report en; sources en; quotes original")
+		const original = kinds()
+		// then
+		expect(beside).toEqual({ fill: 0, pairs: 0, kinds: ["quote", "translation"] })
+		expect(original).toEqual({ fill: 0, pairs: 0, kinds: ["quote"] })
+	})
+
+	test("#given a sentence that failed twice #when filled with --replace-failed #then block-quote replaces it and fallback omit removes it", () => {
+		// given
+		const { dir } = fidelitySession()
+		const state = { schemaVersion: 1, failures: { "findings#F1": 2 }, replaced: [] }
+		const body = "<p>The span length is {{F1:span_len}} [S4]. The operator wrote {{Q1:completion}} [S4].</p>"
+		// when
+		writeFileSync(join(dir, "fidelity-state.json"), JSON.stringify(state))
+		const quoted = fillTemplate(dir, body, ["--replace-failed"])
+		const quotedHtml = readFileSync(join(dir, "t.html"), "utf8")
+		setField(dir, "fallback", "omit")
+		writeFileSync(join(dir, "fidelity-state.json"), JSON.stringify(state))
+		const omitted = fillTemplate(dir, body, ["--replace-failed"])
+		const omittedHtml = readFileSync(join(dir, "t.html"), "utf8")
+		// then
+		expect(quoted.code).toBe(0)
+		expect(quotedHtml).toContain("<blockquote")
+		expect(omitted.code).toBe(0)
+		expect(omittedHtml).not.toContain("<blockquote")
+		expect(omittedHtml).not.toContain("The span length is")
+		expect(omittedHtml).toContain("The operator wrote")
+	})
+
+	test("#given --calibration #when meaning-check flags a pair #then the calibration line goes to that path, not the session default", () => {
+		const { dir, s } = pairedSession()
+		const drift = { pair_id: "P2", verdict: "drift", drift_kind: "hedge_dropped", fragment: "no earlier than 2027", source_fragment: "we estimate" }
+		const log = join(dir, "custom-calibration.jsonl")
+		const checked = nodeJson(["fact", "meaning-check", "--pairs", join(dir, "pairs.json"), "--verdicts", verdicts(dir, "cheap.json", "cheap", [drift, { pair_id: "P1", verdict: "ok" }]), "--calibration", log, ...s])
+		const rows = readFileSync(log, "utf8").trim().split("\n").map((line) => JSON.parse(line)).filter((row) => row.header !== true && row.run !== true)
+		expect(checked.code).toBe(0)
+		expect(rows).toHaveLength(1)
+		expect(existsSync(join(dir, "fidelity-calibration.jsonl"))).toBe(false)
+	})
+})
+
+describe("fidelity brief values, sourceless rows, and the brief binding under node", () => {
+	test("#given derived numbers or fallback off its table #when fact fill runs #then a usage error names the field and value and nothing is written", () => {
+		// given
+		const { dir, s } = fidelitySession()
+		const twice = nodeJson(["fact", "derive", "--op", "expr", "F1 * 2", "--unit", "m", "--rationale", "two spans", "--label", "two_spans", "--json", ...s]).json.data.row.fact_id
+		// when
+		setField(dir, "derived numbers", "nope")
+		const derived = fillTemplate(dir, `<p>Two spans are {{${twice}:two_spans}} [S4].</p>`)
+		setField(dir, "derived numbers", "allowed")
+		setField(dir, "fallback", "drop")
+		const fallback = fillTemplate(dir, "<p>The span length is {{F1:span_len}} [S4].</p>")
+		// then
+		expect({ code: derived.code, named: derived.stderr.includes('derived numbers "nope"') }).toEqual({ code: 2, named: true })
+		expect({ code: fallback.code, named: fallback.stderr.includes('fallback "drop"') }).toEqual({ code: 2, named: true })
+		expect(existsSync(join(dir, "t.html"))).toBe(false)
+	})
+
+	test("#given an assumed row #when filled under primary only, then standard #then the sourceless row is source_outside_floor, then renders", () => {
+		// given
+		const { dir, s } = fidelitySession()
+		const assumed = nodeJson(["fact", "add", "--assumed", "12", "--unit", "%", "--rationale", "planning share chosen by the requester", "--label", "share_assumed", "--json", ...s]).json.data.row.fact_id
+		const body = `<p>The planning share is {{${assumed}:share_assumed}}.</p>`
+		// when
+		setField(dir, "source floor", "primary only")
+		const refused = fillTemplate(dir, body)
+		setField(dir, "source floor", "standard")
+		const rendered = fillTemplate(dir, body)
+		// then
+		expect([refused.code, codesOf(refused.json)]).toEqual([1, ["source_outside_floor"]])
+		expect(JSON.stringify(refused.json)).toContain("no source")
+		expect(rendered.code).toBe(0)
+	})
+
+	test("#given a derived row whose operand rests on a secondary source #when filled under primary only #then source_outside_floor names that source", () => {
+		// given
+		const { dir, s } = fidelitySession()
+		const { row } = textSource(dir, "S7", "secondary")
+		const twice = nodeJson(["fact", "derive", "--op", "expr", `${row.fact_id} * 2`, "--unit", "m", "--rationale", "two spans", "--label", "two_spans", "--json", ...s]).json.data.row.fact_id
+		setField(dir, "source floor", "primary only")
+		// when
+		const refused = fillTemplate(dir, `<p>Two spans are {{${twice}:two_spans}} [S7].</p>`)
+		// then
+		expect([refused.code, codesOf(refused.json)]).toEqual([1, ["source_outside_floor"]])
+		expect(JSON.stringify(refused.json)).toContain("rests on S7")
+	})
+
+	test("#given an edition filled under standard from a secondary source #when the brief tightens to primary only #then fact verify refuses with and without its fill map", () => {
+		// given
+		const { dir, s } = fidelitySession()
+		const { row } = textSource(dir, "S7", "secondary")
+		const src = readFileSync(join(dir, "report.src.html"), "utf8")
+			.replace("<h2>How", `<p>A review gives the span as {{${row.fact_id}:${row.label}}} [S7].</p>\n<h2>How`)
+			.replace("</ol>", '<li id="s7">[S7] Bridge review, retrieved 2026-10-01.</li></ol>')
+		writeFileSync(join(dir, "report.src.html"), src)
+		const filled = nodeJson(["fact", "fill", join(dir, "report.src.html"), "--out", join(dir, "report.html"), ...s])
+		const map = join(dir, "report.html.fill-map.json")
+		const before = verify(dir, "report.html")
+		// when
+		setField(dir, "source floor", "primary only")
+		const bound = verify(dir, "report.html")
+		const record = JSON.parse(readFileSync(join(dir, "fidelity-defects.json"), "utf8"))
+		const kept = readFileSync(map, "utf8")
+		rmSync(map)
+		const unbound = verify(dir, "report.html")
+		setField(dir, "source floor", "standard")
+		const { brief_sha256: _dropped, ...legacy } = JSON.parse(kept)
+		writeFileSync(map, JSON.stringify(legacy))
+		const unstamped = verify(dir, "report.html")
+		// then
+		expect([filled.code, before.code, codesOf(before.json)]).toEqual([0, 0, []])
+		expect(typeof JSON.parse(kept).brief_sha256).toBe("string")
+		expect(bound.code).toBe(1)
+		expect(codesOf(bound.json)).toContain("brief_changed")
+		expect(codesOf(bound.json)).toContain("source_outside_floor")
+		expect(record.status).toBe("fail")
+		expect(unbound.code).toBe(1)
+		expect(codesOf(unbound.json)).toContain("source_outside_floor")
+		expect(codesOf(unbound.json)).not.toContain("brief_changed")
+		expect([unstamped.code, codesOf(unstamped.json)]).toEqual([1, ["brief_changed"]])
+	})
+})

package/packages/shared-skills/skills/ulw-research/scripts/source-commands.mjs

@@ -14,6 +14,7 @@ import { join, resolve } from "node:path"
 import { indexClaims } from "./claims-index.mjs"
 import { CliError, parseArgs, sha256Of, writeJsonAtomic } from "./cli-support.mjs"
 import { parseFidelityBlock } from "./fidelity-brief.mjs"
+import { parseSourceFloor } from "./fidelity-policy.mjs"
 import { writeSnapshot } from "./source-snapshot.mjs"
 
 const FETCH_TIMEOUT_MS = 30_000
@@ -44,12 +45,16 @@ export function snapshotOf(sessionDir, id) {
 	return { meta: JSON.parse(readInput(join(dir, "meta.json"))), text: readInput(join(dir, "text.txt")), html: existsSync(html) ? readInput(html) : null }
 }
 
-/** Whether the brief's source floor lists this source as pointed at (`pointed only: a, b`). */
+/**
+ * Whether the brief's source floor lists this source as pointed at (`pointed only: a, b`). An absent
+ * or pending floor points at nothing; a malformed floor is a usage error (parseSourceFloor's CliError).
+ */
 export function pointedFlag(sessionDir, url) {
 	const brief = join(sessionDir, "brief.md")
 	const floor = existsSync(brief) ? (parseFidelityBlock(readInput(brief)).fields?.["source floor"] ?? "") : ""
-	const match = /^pointed only:\s*(.+)$/i.exec(floor.trim())
-	return match ? match[1].split(",").map((entry) => entry.trim()).includes(url) : false
+	if (floor === "" || floor === "pending") return false
+	const rule = parseSourceFloor(floor)
+	return rule?.kind === "pointed" && rule.list.includes(url)
 }
 
 async function fetchSource(url) {