oh-my-opencode 5.1.48 → 5.1.54

package/packages/shared-skills/skills/ulw-research/scripts/delivery-barrier-meaning.test.ts

@@ -0,0 +1,186 @@
+import { expect, test } from "bun:test"
+import { readFileSync, unlinkSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+
+import { sha256Of } from "./cli-support.mjs"
+import { MEANING_RECORD, writeFidelityRecord } from "./fidelity-records.mjs"
+import { delivered, expectRefused, fullyRecorded, LOCKED_BRIEF, meaningFile, type Recorded } from "./tests/delivery-barrier-session.ts"
+
+/** A delivered, fidelity-verified html edition in a session whose locked brief sets `meaning check`. */
+async function meaningSession(meaning: "on" | "off", codes: string[] | null) {
+	const session = await fullyRecorded(LOCKED_BRIEF.replace("meaning check: on", `meaning check: ${meaning}`))
+	if (codes === null) unlinkSync(session.recordPath.meaning)
+	else session.write("meaning", { defects: codes.map((code) => ({ code, severity: "major", message: code })) })
+	return session
+}
+
+for (const code of ["meaning_drift_confirmed", "meaning_unverified"]) {
+	test(`#given a meaning record with ${code} #when verified and finished #then delivery refuses`, async () => {
+		const session = await meaningSession("on", [code])
+		await expectRefused(session, { code: "fidelity_unresolved", codes: [code], path: session.recordPath.meaning })
+	})
+}
+
+test("#given the brief says meaning check on and the meaning step was skipped #when verified and finished #then delivery refuses: meaning gate not run", async () => {
+	const session = await meaningSession("on", null)
+	await expectRefused(session, { message: expect.stringContaining("meaning gate not run") })
+})
+
+test("#given a malformed ## Fidelity block that tries to turn meaning check off #when no meaning record exists #then delivery refuses: meaning gate not run", async () => {
+	const malformed = LOCKED_BRIEF.replace("meaning check: on (answered_by: default)", "meaning check: on (answered_by: default)\nmeaning check: off (answered_by: user)")
+	const session = await fullyRecorded(malformed)
+	unlinkSync(session.recordPath.meaning)
+	await expectRefused(session, { message: expect.stringContaining("meaning gate not run") })
+})
+
+test("#given the brief says meaning check off and no meaning record #when verified and finished #then delivery passes", async () => {
+	const session = await meaningSession("off", null)
+	expect((await session.outcomes()).map((result) => result.exitCode)).toEqual([0, 0])
+})
+
+test("#given a clean meaning record (warn only) under meaning check on #when verified #then delivery passes", async () => {
+	const { invoke } = await meaningSession("on", ["meaning_drift_warn"])
+	expect((await invoke(["verify"])).exitCode).toBe(0)
+})
+
+test("#given meaning check on, no fidelity evidence, and an explicit fidelity not_run #when verified #then the logged exemption covers the meaning step too", async () => {
+	const { dir, invoke } = await delivered()
+	writeFileSync(join(dir, "brief.md"), LOCKED_BRIEF)
+	await invoke(["gate", "fidelity", "not_run", "--reason", "No factual content in this edition"])
+	expect((await invoke(["verify"])).exitCode).toBe(0)
+})
+
+test("#given an edition meaning record but no fidelity record #when the fidelity gate is skipped with a reason #then delivery still refuses", async () => {
+	const { dir, path, invoke } = await delivered()
+	writeFileSync(join(dir, "brief.md"), LOCKED_BRIEF)
+	writeFidelityRecord(meaningFile(dir, "html"), "meaning", { artifact_sha256: sha256Of(readFileSync(path)), report: path, defects: [] })
+	await invoke(["gate", "fidelity", "not_run", "--reason", "This harness has no verifier"])
+	const result = await invoke(["verify"])
+	expect(result.exitCode).toBe(1)
+	expect(JSON.stringify(result.json.problems)).toContain("fidelity gate not run")
+})
+
+/** Deliver a second edition with byte-different text and its own clean fidelity record. */
+async function secondEdition(session: Recorded, format: string, text: string) {
+	const path = join(session.dir, `second.${format}`)
+	const record = join(session.dir, "second-fidelity.json")
+	writeFileSync(path, text)
+	writeFidelityRecord(record, "fidelity", { artifact_sha256: sha256Of(text), report: path, defects: [] })
+	await session.invoke(["set", format, "delivered", "--path", path, "--verified-by", record])
+	const meaning = meaningFile(session.dir, format)
+	const writeMeaning = (fields: Record<string, unknown> = {}) => writeFidelityRecord(meaning, "meaning", { artifact_sha256: sha256Of(text), report: path, defects: [], ...fields })
+	const problems = async () => (await session.invoke(["verify"])).json.problems
+	return { path, meaning, writeMeaning, problems }
+}
+
+for (const [format, text] of [["md", "Report in Markdown."], ["post", "Report in a post."]]) {
+	test(`#given html and ${format} delivered, each with its own meaning record #when verified and finished #then delivery passes`, async () => {
+		const session = await fullyRecorded()
+		const second = await secondEdition(session, format, text)
+		second.writeMeaning()
+		expect((await session.outcomes()).map((result) => result.exitCode)).toEqual([0, 0])
+	})
+
+	test(`#given html and ${format} delivered but only html has a meaning record #when verified #then only ${format} refuses: meaning gate not run`, async () => {
+		const session = await fullyRecorded()
+		const second = await secondEdition(session, format, text)
+		expect(await second.problems()).toEqual([expect.objectContaining({ code: "edition_unverified", format, path: second.meaning, message: expect.stringContaining(`meaning gate not run; run fact pairs and fact meaning-check --edition ${format}`) })])
+	})
+
+	test(`#given the ${format} meaning record is for other bytes #when verified #then only ${format} refuses: a different edition`, async () => {
+		const session = await fullyRecorded()
+		const second = await secondEdition(session, format, text)
+		second.writeMeaning({ artifact_sha256: sha256Of("an earlier draft") })
+		expect(await second.problems()).toEqual([expect.objectContaining({ code: "edition_unverified", format, path: second.meaning, message: expect.stringContaining("is for a different edition") })])
+	})
+
+	test(`#given the ${format} meaning record carries a confirmed drift #when verified #then only that record blocks`, async () => {
+		const session = await fullyRecorded()
+		const second = await secondEdition(session, format, text)
+		second.writeMeaning({ defects: [{ code: "meaning_drift_confirmed", severity: "major", message: "drift" }] })
+		expect(await second.problems()).toEqual([expect.objectContaining({ code: "fidelity_unresolved", format, codes: ["meaning_drift_confirmed"], path: second.meaning })])
+	})
+
+	test(`#given one legacy session meaning record checked on html and ${format} delivered #when verified #then ${format} refuses: a different edition`, async () => {
+		const session = await fullyRecorded()
+		unlinkSync(session.recordPath.meaning)
+		writeFidelityRecord(join(session.dir, MEANING_RECORD), "meaning", { artifact_sha256: sha256Of(readFileSync(session.path)), report: session.path, defects: [] })
+		const second = await secondEdition(session, format, text)
+		expect(await second.problems()).toEqual([expect.objectContaining({ code: "edition_unverified", format, path: join(session.dir, MEANING_RECORD), message: expect.stringContaining("is for a different edition") })])
+	})
+}
+
+test("#given a single edition and only the legacy session meaning record for its bytes #when verified and finished #then delivery passes", async () => {
+	const session = await fullyRecorded()
+	unlinkSync(session.recordPath.meaning)
+	writeFidelityRecord(join(session.dir, MEANING_RECORD), "meaning", { artifact_sha256: sha256Of(readFileSync(session.path)), report: session.path, defects: [] })
+	expect((await session.outcomes()).map((result) => result.exitCode)).toEqual([0, 0])
+})
+
+test("#given a pdf rendered from the html source #when only the html edition has a meaning record #then the pdf shares it and delivery passes", async () => {
+	const session = await fullyRecorded()
+	const pdf = join(session.dir, "report.pdf")
+	writeFileSync(pdf, "%PDF-1.7 rendered")
+	await session.invoke(["set", "pdf", "delivered", "--path", pdf, "--rendered-from", session.path, "--verified-by", session.record])
+	expect((await session.outcomes()).map((result) => result.exitCode)).toEqual([0, 0])
+})
+
+test("#given html and a byte-identical md copy at another path #when only the html edition has a meaning record #then the md binds to it by bytes and delivery passes", async () => {
+	const session = await fullyRecorded()
+	const second = await secondEdition(session, "md", readFileSync(session.path, "utf8"))
+	expect(await second.problems()).toEqual([])
+	expect((await session.outcomes()).map((result) => result.exitCode)).toEqual([0, 0])
+})
+
+// Reader runs on the same bytes are ordered by their records' written_at, never by file name.
+const EARLIER = new Date("2026-01-01T10:00:00.000Z")
+const LATER = new Date("2026-01-01T11:00:00.000Z")
+const DRIFT = [{ code: "meaning_drift_confirmed", severity: "major", message: "drift" }]
+
+/** Write a meaning record for the delivered html bytes at an explicit time. */
+const meaningAt = (session: Recorded, path: string, at: Date, defects: Record<string, unknown>[] = []) =>
+	writeFidelityRecord(path, "meaning", { artifact_sha256: sha256Of(readFileSync(session.path)), report: session.path, defects }, at)
+
+/** Deliver a pdf rendered from the html source; it has no meaning record of its own. */
+const deliverPdf = async (session: Recorded) => {
+	const pdf = join(session.dir, "report.pdf")
+	writeFileSync(pdf, "%PDF-1.7 rendered")
+	await session.invoke(["set", "pdf", "delivered", "--path", pdf, "--rendered-from", session.path, "--verified-by", session.record])
+}
+
+test("#given a clean own record written after a legacy record confirming drift on the same bytes #when verified and finished #then the newer clean run passes", async () => {
+	const session = await fullyRecorded()
+	meaningAt(session, join(session.dir, MEANING_RECORD), EARLIER, DRIFT)
+	meaningAt(session, session.recordPath.meaning, LATER)
+	expect((await session.outcomes()).map((result) => result.exitCode)).toEqual([0, 0])
+})
+
+test("#given a legacy record confirming drift written after a clean own record on the same bytes #when verified and finished #then the newer drift refuses", async () => {
+	const session = await fullyRecorded()
+	meaningAt(session, session.recordPath.meaning, EARLIER)
+	meaningAt(session, join(session.dir, MEANING_RECORD), LATER, DRIFT)
+	await expectRefused(session, { code: "fidelity_unresolved", codes: ["meaning_drift_confirmed"], path: join(session.dir, MEANING_RECORD) })
+})
+
+test("#given a clean own record and a legacy drift record written at the same time on the same bytes #when verified and finished #then the more severe verdict refuses", async () => {
+	const session = await fullyRecorded()
+	meaningAt(session, session.recordPath.meaning, LATER)
+	meaningAt(session, join(session.dir, MEANING_RECORD), LATER, DRIFT)
+	await expectRefused(session, { code: "fidelity_unresolved", codes: ["meaning_drift_confirmed"], path: join(session.dir, MEANING_RECORD) })
+})
+
+test("#given two edition records for the same bytes, the alphabetically-first clean and older #when a pdf of those bytes is verified and finished #then the newer drift refuses", async () => {
+	const session = await fullyRecorded()
+	await deliverPdf(session)
+	meaningAt(session, meaningFile(session.dir, "html"), EARLIER)
+	meaningAt(session, meaningFile(session.dir, "post"), LATER, DRIFT)
+	await expectRefused(session, { code: "fidelity_unresolved", codes: ["meaning_drift_confirmed"], path: meaningFile(session.dir, "post") })
+})
+
+test("#given two edition records for the same bytes, the alphabetically-first confirming drift and older #when verified and finished #then the newer clean run passes", async () => {
+	const session = await fullyRecorded()
+	await deliverPdf(session)
+	meaningAt(session, meaningFile(session.dir, "html"), EARLIER, DRIFT)
+	meaningAt(session, meaningFile(session.dir, "post"), LATER)
+	expect((await session.outcomes()).map((result) => result.exitCode)).toEqual([0, 0])
+})

package/packages/shared-skills/skills/ulw-research/scripts/delivery-barrier.test.ts

@@ -1,28 +1,12 @@
 import { describe, expect, onTestFinished, test } from "bun:test"
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs"
+import { mkdtempSync, readFileSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs"
 import { tmpdir } from "node:os"
-import { join } from "node:path"
+import { dirname, join } from "node:path"
 
 import { sha256Of } from "./cli-support.mjs"
 import { DEFECT_CODES } from "./contracts.mjs"
-import { FIDELITY_RECORDS, MEANING_RECORD, RECORD_ENVELOPE, writeFidelityRecord } from "./fidelity-records.mjs"
-import { blocksDelivery } from "./gates-fidelity.mjs"
-import { run } from "./report-tools.mjs"
-
-async function delivered(format = "html", codes: string[] | null = null) {
-	const root = mkdtempSync(join(tmpdir(), "delivery-barrier-"))
-	onTestFinished(() => rmSync(root, { recursive: true, force: true }))
-	const dir = join(root, "20260101-120000")
-	mkdirSync(dir)
-	const path = join(dir, `report.${format}`)
-	const record = join(dir, "fidelity-defects.json")
-	writeFileSync(path, "<p>Report</p>")
-	if (codes !== null) writeFidelityRecord(record, "fidelity", { artifact_sha256: sha256Of(readFileSync(path)), report: path, defects: codes.map((code) => ({ code, severity: "minor", message: code })) })
-	const invoke = (args: string[]) => run(["outcome", ...args, "--session-dir", dir])
-	await invoke(["init", "--promised", format])
-	expect((await invoke(["set", format, "delivered", "--path", path, ...(codes === null ? [] : ["--verified-by", record])])).exitCode).toBe(0)
-	return { dir, path, record, invoke }
-}
+import { fidelityProblems, FIDELITY_RECORDS, RECORD_ENVELOPE, writeFidelityRecord } from "./fidelity-records.mjs"
+import { BLOCKER, delivered, expectRefused, fullyRecorded } from "./tests/delivery-barrier-session.ts"
 
 // Enumerate the source registry, not a second list of today's fidelity codes.
 for (const [code, entry] of Object.entries(DEFECT_CODES)) {
@@ -113,32 +97,6 @@ test("#given an explicit skip and an existing blocker #when verified #then the s
 	expect((await invoke(["verify"])).exitCode).toBe(1)
 })
 
-const LOCKED_BRIEF = readFileSync(join(import.meta.dir, "tests", "fixtures", "fidelity-brief-locked.md"), "utf8")
-const BLOCKER = Object.keys(DEFECT_CODES).find((code) => blocksDelivery({ code })) as string
-
-/**
- * A delivered html edition whose locked brief requires every table record, each present, fresh for
- * the delivered bytes, and clean. recordPath is where the session keeps each row's record; a table
- * row with no entry here fails the coverage test below, so a new row brings its own cases.
- */
-async function fullyRecorded(brief = LOCKED_BRIEF) {
-	const session = await delivered("html", [])
-	writeFileSync(join(session.dir, "brief.md"), brief)
-	const recordPath: Record<string, string> = { fidelity: session.record, meaning: join(session.dir, MEANING_RECORD) }
-	const write = (kind: string, fields: Record<string, unknown> = {}) =>
-		writeFidelityRecord(recordPath[kind], kind, { artifact_sha256: sha256Of(readFileSync(session.path)), report: session.path, defects: [], ...fields })
-	write("meaning")
-	const outcomes = async () => Promise.all(["verify", "finish"].map((command) => session.invoke([command])))
-	return { ...session, recordPath, write, outcomes }
-}
-
-async function expectRefused(session: Awaited<ReturnType<typeof fullyRecorded>>, problem: Record<string, unknown>) {
-	for (const result of await session.outcomes()) {
-		expect(result.exitCode).toBe(1)
-		expect(result.json.problems).toContainEqual(expect.objectContaining(problem))
-	}
-}
-
 test("#given the record table #when every row is read #then each row has every rule column and an arranged session path", async () => {
 	const { recordPath } = await fullyRecorded()
 	expect(Object.keys(recordPath).sort()).toEqual(FIDELITY_RECORDS.map((entry) => entry.kind).sort())
@@ -148,7 +106,7 @@ test("#given the record table #when every row is read #then each row has every r
 	}
 })
 
-// The table is the barrier's spec: every row gets the same five cases.
+// The table is the barrier's spec: every row gets the same six cases.
 for (const entry of FIDELITY_RECORDS) {
 	describe(`record row ${entry.kind}`, () => {
 		test("#given the record is missing while required #when verified and finished #then delivery refuses", async () => {
@@ -157,6 +115,13 @@ for (const entry of FIDELITY_RECORDS) {
 			await expectRefused(session, { code: "edition_unverified", path: session.recordPath[entry.kind] })
 		})
 
+		test("#given the record is missing and the row names none #when verified and finished #then delivery refuses: the step was not run", async () => {
+			const session = await fullyRecorded()
+			unlinkSync(session.recordPath[entry.kind])
+			await session.invoke(["set", "html", "delivered", "--path", session.path])
+			await expectRefused(session, { code: "edition_unverified", message: expect.stringContaining(`${entry.step} not run`) })
+		})
+
 		test("#given the record is for other bytes #when verified and finished #then delivery refuses: a different edition", async () => {
 			const session = await fullyRecorded()
 			session.write(entry.kind, { artifact_sha256: sha256Of("an earlier draft") })
@@ -191,6 +156,12 @@ for (const entry of FIDELITY_RECORDS) {
 	})
 }
 
+test("#given a row whose --verified-by record is gone #when verified and finished #then delivery refuses: the record is missing", async () => {
+	const session = await fullyRecorded()
+	unlinkSync(session.record)
+	await expectRefused(session, { code: "edition_unverified", format: "html", path: session.record, message: `html: fidelity record ${session.record} is missing` })
+})
+
 test("#given a record kind outside the table or a malformed envelope #when written #then the writer refuses", () => {
 	const dir = mkdtempSync(join(tmpdir(), "delivery-barrier-writer-"))
 	onTestFinished(() => rmSync(dir, { recursive: true, force: true }))
@@ -200,46 +171,28 @@ test("#given a record kind outside the table or a malformed envelope #when writt
 	expect(() => writeFidelityRecord(join(dir, "c.json"), "meaning", { ...fields, gatesRun: [] })).toThrow("unknown field")
 })
 
-/** A delivered, fidelity-verified html edition in a session whose locked brief sets `meaning check`. */
-async function meaningSession(meaning: "on" | "off", codes: string[] | null) {
-	const session = await fullyRecorded(LOCKED_BRIEF.replace("meaning check: on", `meaning check: ${meaning}`))
-	if (codes === null) unlinkSync(session.recordPath.meaning)
-	else session.write("meaning", { defects: codes.map((code) => ({ code, severity: "major", message: code })) })
-	return session
-}
+test("#given an unattached session fidelity blocker and a clean attached record #when verified and finished #then the session blocker refuses", async () => {
+	const session = await fullyRecorded()
+	const other = join(session.dir, "other.json")
+	writeFidelityRecord(other, "fidelity", { artifact_sha256: sha256Of(readFileSync(session.path)), report: session.path, defects: [] })
+	await session.invoke(["set", "html", "delivered", "--path", session.path, "--verified-by", other])
+	session.write("fidelity", { defects: [{ code: BLOCKER }] })
+	await expectRefused(session, { code: "fidelity_unresolved", codes: [BLOCKER], path: session.record })
+})
 
-for (const code of ["meaning_drift_confirmed", "meaning_unverified"]) {
-	test(`#given a meaning record with ${code} #when verified and finished #then delivery refuses`, async () => {
-		const session = await meaningSession("on", [code])
-		await expectRefused(session, { code: "fidelity_unresolved", codes: [code], path: join(session.dir, MEANING_RECORD) })
+for (const [name, alias] of [
+	["a dot segment", (dir: string) => `${dir}/./fidelity-defects.json`],
+	["a directory link", (dir: string) => {
+		const link = join(dirname(dir), "alias")
+		symlinkSync(dir, link, "junction")
+		return join(link, "fidelity-defects.json")
+	}],
+] as const) {
+	test(`#given two target paths reaching one blocking record through ${name} #when the barrier runs #then it reports the blocker once`, async () => {
+		const session = await fullyRecorded()
+		session.write("fidelity", { defects: [{ code: BLOCKER }] })
+		const manifest = JSON.parse(readFileSync(join(session.dir, "outcome.json"), "utf8"))
+		manifest.deliverables.push({ ...manifest.deliverables[0], format: "md", verifiedBy: alias(session.dir) })
+		expect(fidelityProblems(session.dir, manifest).filter((problem) => problem.code === "fidelity_unresolved")).toHaveLength(1)
 	})
 }
-
-test("#given the brief says meaning check on and the meaning step was skipped #when verified and finished #then delivery refuses: meaning gate not run", async () => {
-	const session = await meaningSession("on", null)
-	await expectRefused(session, { message: expect.stringContaining("meaning gate not run") })
-})
-
-test("#given a malformed ## Fidelity block that tries to turn meaning check off #when no meaning record exists #then delivery refuses: meaning gate not run", async () => {
-	const malformed = LOCKED_BRIEF.replace("meaning check: on (answered_by: default)", "meaning check: on (answered_by: default)\nmeaning check: off (answered_by: user)")
-	const session = await fullyRecorded(malformed)
-	unlinkSync(session.recordPath.meaning)
-	await expectRefused(session, { message: expect.stringContaining("meaning gate not run") })
-})
-
-test("#given the brief says meaning check off and no meaning record #when verified and finished #then delivery passes", async () => {
-	const session = await meaningSession("off", null)
-	expect((await session.outcomes()).map((result) => result.exitCode)).toEqual([0, 0])
-})
-
-test("#given a clean meaning record (warn only) under meaning check on #when verified #then delivery passes", async () => {
-	const { invoke } = await meaningSession("on", ["meaning_drift_warn"])
-	expect((await invoke(["verify"])).exitCode).toBe(0)
-})
-
-test("#given meaning check on, no fidelity evidence, and an explicit fidelity not_run #when verified #then the logged exemption covers the meaning step too", async () => {
-	const { dir, invoke } = await delivered()
-	writeFileSync(join(dir, "brief.md"), LOCKED_BRIEF)
-	await invoke(["gate", "fidelity", "not_run", "--reason", "No factual content in this edition"])
-	expect((await invoke(["verify"])).exitCode).toBe(0)
-})

package/packages/shared-skills/skills/ulw-research/scripts/entities.mjs

@@ -1,14 +1,23 @@
 // entities.mjs - HTML character reference decoding for html-lite.mjs.
 //
-// Supports a fixed set of named entities plus decimal and hex numeric references. Unknown or
-// malformed references stay verbatim. Single indexOf scan; plain Node ESM, no dependencies.
+// Supports a fixed set of named entities (NAMED_ENTITIES) plus decimal and hex numeric references.
+// Unknown or malformed references stay verbatim. Single indexOf scan; plain Node ESM, no dependencies.
 
+// Beyond the common set, every named reference whose character a number reader treats specially is
+// listed (signs, dashes, the space separators that group digits, and Markdown punctuation), so the
+// conversion probe reads `−5` and `1 234` as a converter does.
 const NAMED_ENTITIES = {
 	amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: "\u00a0", mdash: "\u2014", ndash: "\u2013",
 	hellip: "\u2026", copy: "\u00a9", reg: "\u00ae", times: "\u00d7", middot: "\u00b7",
+	minus: "\u2212", hyphen: "\u2010", dash: "\u2010", NonBreakingSpace: "\u00a0", thinsp: "\u2009",
+	ThinSpace: "\u2009", numsp: "\u2007", puncsp: "\u2008", hairsp: "\u200a", VeryThinSpace: "\u200a",
+	ensp: "\u2002", emsp: "\u2003", emsp13: "\u2004", emsp14: "\u2005", MediumSpace: "\u205f",
+	comma: ",", period: ".", plus: "+", lowbar: "_", UnderBar: "_", ast: "*", midast: "*", grave: "`",
+	DiacriticalGrave: "`", lpar: "(", rpar: ")", lsqb: "[", lbrack: "[", rsqb: "]", rbrack: "]",
 }
 
-function decodeOne(body) {
+/** One reference body (between `&` and `;`), or null when unsupported. */
+export function decodeOne(body) {
 	if (Object.hasOwn(NAMED_ENTITIES, body)) return NAMED_ENTITIES[body]
 	if (body[0] !== "#") return null
 	const hex = body[1] === "x" || body[1] === "X"
@@ -26,7 +35,7 @@ export function decodeEntities(text) {
 	let at = source.indexOf("&")
 	while (at !== -1) {
 		const semi = source.indexOf(";", at + 1)
-		const decoded = semi !== -1 && semi - at <= 12 ? decodeOne(source.slice(at + 1, semi)) : null
+		const decoded = semi !== -1 && semi - at <= 32 ? decodeOne(source.slice(at + 1, semi)) : null
 		if (decoded !== null) {
 			out += source.slice(last, at) + decoded
 			last = semi + 1

package/packages/shared-skills/skills/ulw-research/scripts/fact-commands-fill.mjs

@@ -13,10 +13,13 @@ import { dirname, extname, resolve } from "node:path"
 
 import { CliError, sha256Of, writeJsonAtomic } from "./cli-support.mjs"
 import { DEFECT_CODES } from "./contracts.mjs"
+import { markdownAsHtml } from "./fact-commands-verify.mjs"
 import { FILL_FORMATS, fill } from "./fact-fill.mjs"
 import { readLedger, writeLedger } from "./fact-ledger.mjs"
 import { briefHashOf, fillPolicy, lockedBrief, policyErrors } from "./fidelity-policy.mjs"
 import { readState, writeState } from "./fidelity-state.mjs"
+import { withBoundUnits } from "./fidelity-value-unit.mjs"
+import { parseMarkdown } from "./md-lite.mjs"
 import { findPlaceholders } from "./placeholder.mjs"
 import { sessionDirOf } from "./source-commands.mjs"
 
@@ -28,6 +31,13 @@ export const FILL_INPUT_FORMAT_RULES = Object.freeze({
 export const FILL_INPUT_FORMATS = Object.freeze([...FILL_FORMATS, ...Object.keys(FILL_INPUT_FORMAT_RULES.aliases)])
 const fillFormatOf = (format) => FILL_INPUT_FORMAT_RULES.aliases[format] ?? format
 
+/** Value-mode entries carry the unit fill saw bound to them (unit_bound), read off the edition verify will check. */
+function boundUnits(out, entries, ledger, format) {
+	if (!entries.some((entry) => entry.mode === "value")) return entries
+	const html = fillFormatOf(format) === "html" ? out : parseMarkdown(out).problems.length === 0 ? markdownAsHtml(out, entries, ledger).html : null
+	return html === null ? entries : withBoundUnits(html, entries, new Map(ledger.rows.map((row) => [row.fact_id, row])))
+}
+
 function readText(path) {
 	try {
 		return readFileSync(path, "utf8")
@@ -80,7 +90,7 @@ export function runFactFill(args) {
 	const artifact = sha256Of(out)
 	const map = `${resolve(flags.out)}.fill-map.json`
 	const brief = briefHashOf(parsed)
-	writeJsonAtomic(map, { schemaVersion: 1, format, artifact: resolve(flags.out), artifact_sha256: artifact, brief_sha256: brief, entries })
+	writeJsonAtomic(map, { schemaVersion: 1, format, artifact: resolve(flags.out), artifact_sha256: artifact, brief_sha256: brief, entries: boundUnits(out, entries, ledger, format) })
 	const data = { out: resolve(flags.out), map, artifact_sha256: artifact, brief_sha256: brief, occurrences: entries.length, warnings }
 	return { json: { command: "fact fill", status: "pass", exitCode: 0, defects: [], data }, summary: `fact fill: wrote ${flags.out} (${entries.length} pointer(s))`, exitCode: 0 }
 }

package/packages/shared-skills/skills/ulw-research/scripts/fact-commands-meaning.mjs

@@ -1,9 +1,10 @@
 // fact-commands-meaning.mjs - `fact pairs` and `fact meaning-check`, the script half of the
 // separate-session meaning verifier. fact pairs writes the (source, report sentence) pairs a
-// reader lane gets and nothing else (with --changed-since, only the pairs whose sentence polish
-// rewrote); it honours the brief's `meaning check` field and writes
+// reader lane gets and nothing else (with --changed-since, only the pairs whose sentence changed
+// since the pre-polish fill map's artifact, or all when those bytes are gone); it honours the brief's `meaning check` field and writes
 // `{ skipped: true }` when it is off. fact meaning-check ingests the readers' verdict files
-// (meaning-check.mjs), writes fidelity-meaning-defects.json (a fidelity record bound to the pairs'
+// (meaning-check.mjs), writes the meaning record of one edition (fidelity-meaning-defects.<format>.json
+// with --edition, else the legacy fidelity-meaning-defects.json; a fidelity record bound to the pairs'
 // artifact_sha256 and report, through writeFidelityRecord), and records the run in
 // fidelity-calibration.jsonl: a header with the promotion criterion on first write, then per run
 // one run line plus one line per flagged pair. The run id hashes the inputs only, so a rerun or a
@@ -15,13 +16,13 @@ import { existsSync, readFileSync } from "node:fs"
 import { dirname, join, resolve } from "node:path"
 
 import { CliError, parseArgs, readJsonFile, sha256Of, writeJsonAtomic, writeTextAtomic } from "./cli-support.mjs"
-import { countDefects } from "./contracts.mjs"
+import { countDefects, DELIVERABLE_FORMATS } from "./contracts.mjs"
 import { ledgerFrom, markdownAsHtml, readEdition, sessionOf } from "./fact-commands-verify.mjs"
 import { pairsChangedSince } from "./fact-commands-polish.mjs"
 import { extractPairs, PAIR_KINDS } from "./fact-pairs.mjs"
 import { FIDELITY_INCOMPLETE } from "./fidelity-brief.mjs"
 import { briefPathOf, lockedBrief, meaningCheckEnabled } from "./fidelity-policy.mjs"
-import { MEANING_RECORD, writeFidelityRecord } from "./fidelity-records.mjs"
+import { MEANING_RECORD, meaningRecordName, writeFidelityRecord } from "./fidelity-records.mjs"
 import { blocksDelivery } from "./gates-fidelity.mjs"
 import { ingestVerdicts, unverifiedDefects, VERDICT_SCHEMA } from "./meaning-check.mjs"
 
@@ -57,10 +58,12 @@ function runPairs(args) {
 	const ledger = ledgerFrom(flags, session)
 	const html = edition.format === "md" ? markdownAsHtml(edition.text, edition.entries, ledger).html : edition.text
 	const all = extractPairs(html, ledger, claims)
-	const pairs = flags["changed-since"] === undefined ? all : pairsChangedSince(all, flags["changed-since"], ledger, claims)
+	const since = flags["changed-since"] === undefined ? null : pairsChangedSince(all, flags["changed-since"], ledger, claims)
+	const pairs = since?.pairs ?? all
 	const counts = { total: pairs.length, force_strong: pairs.filter((pair) => pair.force_strong).length }
 	for (const kind of PAIR_KINDS) counts[kind] = pairs.filter((pair) => pair.kind === kind).length
-	const record = { schemaVersion: 1, skipped: false, report: resolve(report), format: edition.format, artifact_sha256: sha256Of(edition.text), pairs_sha256: sha256Of(JSON.stringify(pairs)), counts, verdict_schema: VERDICT_SCHEMA, pairs }
+	const changed = since === null ? {} : { changed_since: { fill_map: since.fill_map, narrowed: since.narrowed } }
+	const record = { schemaVersion: 1, skipped: false, report: resolve(report), format: edition.format, artifact_sha256: sha256Of(edition.text), pairs_sha256: sha256Of(JSON.stringify(pairs)), counts, ...changed, verdict_schema: VERDICT_SCHEMA, pairs }
 	writeJsonAtomic(out, record)
 	const summary = `fact pairs: ${counts.total} pair(s), ${counts.force_strong} routed to the strong reader`
 	return { json: { command: "fact pairs", status: "pass", exitCode: 0, data: { out, ...record, pairs: undefined } }, summary, exitCode: 0 }
@@ -124,8 +127,9 @@ function skippedRefusal(flags, parsed) {
 
 function runMeaningCheck(args) {
 	const { flags } = args
-	const usage = "usage: fact meaning-check --pairs pairs.json --verdicts cheap.json [--verdicts strong.json] [--dispute P<n> --reason TEXT] [--run-id ID] [--calibration F] [--brief brief.md] [--out F]"
+	const usage = "usage: fact meaning-check --pairs pairs.json --verdicts cheap.json [--verdicts strong.json] [--dispute P<n> --reason TEXT] [--run-id ID] [--calibration F] [--brief brief.md] [--edition FORMAT] [--out F]"
 	if (flags.pairs === undefined || !Array.isArray(flags.verdicts)) throw new CliError(usage)
+	if (flags.edition !== undefined && !DELIVERABLE_FORMATS.includes(flags.edition)) throw new CliError(`--edition must be a deliverable format (${DELIVERABLE_FORMATS.join(", ")}), got ${flags.edition}`)
 	const session = sessionOf(flags)
 	const { parsed, refusal } = lockedBrief("fact meaning-check", flags)
 	if (refusal) return { ...refusal, json: { ...refusal.json, error: FIDELITY_INCOMPLETE } }
@@ -146,7 +150,7 @@ function runMeaningCheck(args) {
 	} catch (error) {
 		throw new CliError(`invalid verdict input: ${error.message}`)
 	}
-	const out = resolve(flags.out ?? inSession(session, MEANING_RECORD, "--out"))
+	const out = resolve(flags.out ?? inSession(session, flags.edition === undefined ? MEANING_RECORD : meaningRecordName(flags.edition), "--out"))
 	const calibration = resolve(flags.calibration ?? join(session ?? dirname(out), CALIBRATION_FILE))
 	const runId = flags["run-id"] ?? sha256Of([pairsText, ...verdictTexts].join("\0")).slice(0, 16)
 	const pairsSha = pairsDoc.pairs_sha256 ?? sha256Of(pairsText)

package/packages/shared-skills/skills/ulw-research/scripts/fact-commands-polish.mjs

@@ -6,18 +6,24 @@
 // rejected (major) or unlocated (minor) edit leaves its region unchanged and is listed with its
 // index and reason so the orchestrator can re-send it; every rejection reason is printed verbatim, one
 // line per rejected edit (index and the first 60 characters of its before), in the summary and in
-// data.rejected_reasons. It exits 0 whenever it wrote the output.
+// data.rejected_reasons. It exits 0 whenever it wrote the output; json.applied is false when
+// any edit was rejected or unlocated, independently of data.applied's accepted-edit count.
+// polish-apply never rewrites a fill map: it checks that the edition's map (fillMapOf) records the
+// input's bytes, refusing otherwise, and writes `<out>.polished.fill-map.json` beside the output
+// (artifact = the polished file, its hash, and polishedFrom = the fill map's path and sha256).
 // polish-diff is the whole-document backstop (polish-diff.mjs) between the pre-polish artifact
-// and any later copy; it exits 1 on a blocker. pairsChangedSince keeps only the pairs whose
-// sentence text (normalized) is not in the pre-polish artifact that a fill map names, so the
-// meaning readers re-check exactly what polish rewrote. No model, no network.
+// and any later copy; it exits 1 on a blocker. pairsChangedSince always reads the pre-polish fill
+// map (following a polished map's polishedFrom) and keeps only the pairs whose sentence text
+// (normalized) is not in the artifact it names, so the meaning readers re-check exactly what
+// changed; when that artifact no longer hashes to the map (polished in place, or edited) nothing
+// can be ruled out and every pair is kept. No model, no network.
 
 import { existsSync, readFileSync } from "node:fs"
 import { join, resolve } from "node:path"
 
 import { CliError, parseArgs, readJsonFile, sha256Of, writeJsonAtomic, writeTextAtomic } from "./cli-support.mjs"
 import { countDefects, DEFECT_CODES } from "./contracts.mjs"
-import { editionFormatOf, ledgerFrom, markdownAsHtml, sessionOf } from "./fact-commands-verify.mjs"
+import { editionFormatOf, fillMapOf, ledgerFrom, markdownAsHtml, sessionOf } from "./fact-commands-verify.mjs"
 import { extractPairs } from "./fact-pairs.mjs"
 import { lockedBrief } from "./fidelity-policy.mjs"
 import { applyEdits, POLISH_EDIT_FIELDS, validatePolishEdits } from "./polish-apply.mjs"
@@ -58,7 +64,7 @@ const rejectionLine = (entry, edit) => `  rejected edit ${entry.index} ("${befor
 function runPolishApply(args) {
 	const [report] = args.positionals
 	const { flags } = args
-	if (!report || flags.edits === undefined || flags.out === undefined) throw new CliError("usage: fact polish-apply <report.html> --edits polish-edits.json --out <report.polished.html> [--ledger F] [--brief brief.md] [--session-dir D]")
+	if (!report || flags.edits === undefined || flags.out === undefined) throw new CliError("usage: fact polish-apply <report.html> --edits polish-edits.json --out <report.polished.html> [--fill-map F] [--ledger F] [--brief brief.md] [--session-dir D]")
 	if (editionFormatOf(report, flags.format) === "md") throw new CliError("fact polish-apply takes the filled HTML edition; polish a Markdown edition through its HTML source")
 	const { refusal } = lockedBrief("fact polish-apply", flags)
 	if (refusal) return refusal
@@ -71,13 +77,18 @@ function runPolishApply(args) {
 		throw new CliError(`${flags.edits} must be an array of {${Object.keys(POLISH_EDIT_FIELDS).join(", ")}} objects: ${error.message}`)
 	}
 	const result = applyEdits(html, edits, ledgerFrom(flags))
+	const mapPath = fillMapOf(report, html, flags["fill-map"])
+	const map = mapPath === null ? null : readJsonFile(mapPath)
+	if (map !== null && map.artifact_sha256 !== sha256Of(html)) throw new CliError(`${mapPath} does not record the bytes of ${report} (artifact_sha256 differs); refusing to carry its brief binding to the polished edition`)
+	const polishedFrom = map?.polishedFrom ?? (map && { map: resolve(mapPath), sha256: sha256Of(readText(mapPath)) })
 	writeTextAtomic(flags.out, result.out)
+	if (map) writeJsonAtomic(`${resolve(flags.out)}.polished.fill-map.json`, { ...map, artifact: resolve(flags.out), artifact_sha256: sha256Of(result.out), polishedFrom })
 	const defects = [...result.rejected, ...result.unlocated].sort((a, b) => a.index - b.index).map(withSeverity)
 	const counts = { applied: result.applied.length, rejected: result.rejected.length, unlocated: result.unlocated.length }
 	const data = { out: resolve(flags.out), ...counts, applied_indexes: result.applied, input_sha256: sha256Of(html), edits_sha256: sha256Of(editsText), out_sha256: sha256Of(result.out) }
 	const rejected_reasons = result.rejected.map((entry) => rejectionLine(entry, edits[entry.index]))
 	const summary = [`fact polish-apply: ${counts.applied} applied, ${counts.rejected} rejected, ${counts.unlocated} unlocated of ${edits.length} edit(s)`, ...rejected_reasons].join("\n")
-	return { json: { command: "fact polish-apply", status: "pass", exitCode: 0, defects, data: { ...data, rejected_reasons } }, summary, exitCode: 0 }
+	return { json: { command: "fact polish-apply", status: "pass", exitCode: 0, applied: counts.rejected === 0 && counts.unlocated === 0, defects, data: { ...data, rejected_reasons } }, summary, exitCode: 0 }
 }
 
 function runPolishDiff(args) {
@@ -100,29 +111,40 @@ function runPolishDiff(args) {
 
 const pairKey = (pair) => [pair.kind, pair.sentence_key, pair.claim_id ?? "", normalizeText(pair.sentence)].join("\u0000")
 
+/** The pre-polish fill map behind --changed-since: a polished map leads to it through polishedFrom, whose sha256 it must still match. */
+function prePolishMap(mapPath) {
+	const given = readJsonFile(mapPath)
+	if (given.polishedFrom === undefined) return { path: resolve(mapPath), map: given }
+	const { map: path, sha256 } = given.polishedFrom
+	if (typeof path !== "string" || sha256Of(readText(path)) !== sha256) throw new CliError(`${path} changed after polish wrote ${mapPath}; --changed-since needs the pre-polish fill map it names`)
+	return { path, map: readJsonFile(path) }
+}
+
 /**
- * The pairs whose sentence text changed since the pre-polish artifact a fill map names: a pair is
- * kept unless the same (kind, sentence key, normalized sentence) occurs in that artifact. The map
- * must carry the artifact's `artifact_sha256` and the bytes must still match it, so the filter is
- * fail-closed on a hand-made or stale map.
+ * The pairs whose sentence text changed since the pre-polish artifact the fill map names: a pair is
+ * kept unless the same (kind, sentence key, normalized sentence) occurs in that artifact. Only bytes
+ * that still hash to the map's `artifact_sha256` narrow the set; otherwise (the report was polished
+ * in place, or edited) every pair is kept, so nothing changed escapes the meaning re-check.
  * @param {object[]} pairs extractPairs output on the polished edition
- * @param {string} mapPath the pre-polish fill map (fact fill's `<out>.fill-map.json`)
+ * @param {string} mapPath fact fill's `<out>.fill-map.json`, or polish-apply's `<out>.polished.fill-map.json`
+ * @returns {{ pairs: object[], fill_map: string, narrowed: boolean }}
  */
 export function pairsChangedSince(pairs, mapPath, ledger, claims) {
-	const map = readJsonFile(mapPath)
-	if (typeof map.artifact !== "string" || !existsSync(map.artifact)) throw new CliError(`${mapPath} names no readable pre-polish artifact`)
-	const text = readText(map.artifact)
-	if (typeof map.artifact_sha256 !== "string") throw new CliError(`${mapPath} fill map has no artifact_sha256; --changed-since needs the pre-polish hash`)
-	if (sha256Of(text) !== map.artifact_sha256) throw new CliError(`${map.artifact} changed after fill; --changed-since needs the pre-polish bytes`)
+	const { path, map } = prePolishMap(mapPath)
+	if (typeof map.artifact !== "string") throw new CliError(`${path} names no pre-polish artifact`)
+	if (typeof map.artifact_sha256 !== "string") throw new CliError(`${path} fill map has no artifact_sha256; --changed-since needs the pre-polish hash`)
+	const text = existsSync(map.artifact) ? readText(map.artifact) : null
+	if (text === null || sha256Of(text) !== map.artifact_sha256) return { pairs, fill_map: path, narrowed: false }
 	const html = map.format === "md" ? markdownAsHtml(text, map.entries, ledger).html : text
 	const before = new Map()
 	for (const pair of extractPairs(html, ledger, claims)) before.set(pairKey(pair), (before.get(pairKey(pair)) ?? 0) + 1)
-	return pairs.filter((pair) => {
+	const kept = pairs.filter((pair) => {
 		const left = before.get(pairKey(pair)) ?? 0
 		if (left === 0) return true
 		before.set(pairKey(pair), left - 1)
 		return false
 	})
+	return { pairs: kept, fill_map: path, narrowed: true }
 }
 
 /** @param {string[]} argv the arguments after `fact polish-apply` or `fact polish-diff` */