pan-wizard 3.32.0 → 3.34.0

package/pan-wizard-core/bin/lib/core.cjs

@@ -39,8 +39,13 @@ const { planningPath, planningRel } = require('./utils.cjs');
 // budget-profile project on Codex or OpenCode was told to spawn a model called
 // "mid" (reality check R28).
 //   - openai: Codex's subagent docs (learn.chatgpt.com/docs/agent-configuration/
-//     subagents, read 2026-09-23): "start with gpt-6-sol. Use gpt-6-luna when you
-//     want a faster, lower-cost option". gpt-6-astra is the flagship above both.
+//     subagents, re-read 2026-10-03) now start demanding agents on gpt-6.1-sol "when
+//     your signed-in account or workspace has access", and keep gpt-6-luna as the
+//     "faster, lower-cost option". The mid tier stays gpt-6-sol: GPT-6.1 Sol's launch
+//     keeps it off on Enterprise and Edu until an administrator enables it
+//     (learn.chatgpt.com/docs/models, read 2026-10-03), so pinning it would hand
+//     those users a model they cannot run. The inherit tier runs Codex's own
+//     default, which is gpt-6.1-sol where available. gpt-6-astra is the flagship.
 //   - google: the newest stable Flash and Flash-Lite on ai.google.dev's models page
 //     (read 2026-09-23). The 2.5 family these rows used is "not deprecated" but
 //     limited to users who have used it before, so a new project may not reach it.
@@ -58,12 +63,16 @@ const PROVIDER_MODELS = {
 // packages/web/src/content/docs/models.mdx and models.dev/api.json, both read
 // 2026-09-26; every id below exists there under that provider). Same tiers as
 // PROVIDER_MODELS, provider-qualified; `default` is Anthropic as it is there.
-// Reality check R41.
+// Reality check R41. The Anthropic mid tier follows the `sonnet` alias, which
+// resolves to Sonnet 5.5 on the Anthropic API from Claude Code 2.1.284;
+// models.dev lists `anthropic/claude-sonnet-5-5` (api.json, read 2026-10-03). The fast
+// tier follows the `haiku` alias, which resolves to Haiku 5.5 on the Anthropic API from
+// Claude Code 2.1.293; models.dev lists `anthropic/claude-haiku-5-5` (read 2026-10-10).
 const OPENCODE_MODELS = {
-  anthropic: { reasoning: 'inherit', mid: 'anthropic/claude-sonnet-5', fast: 'anthropic/claude-haiku-4-5' },
-  openai:    { reasoning: 'inherit', mid: 'openai/gpt-6-sol',          fast: 'openai/gpt-6-luna' },
-  google:    { reasoning: 'inherit', mid: 'google/gemini-3.8-flash',   fast: 'google/gemini-3.5-flash-lite' },
-  default:   { reasoning: 'inherit', mid: 'anthropic/claude-sonnet-5', fast: 'anthropic/claude-haiku-4-5' },
+  anthropic: { reasoning: 'inherit', mid: 'anthropic/claude-sonnet-5-5', fast: 'anthropic/claude-haiku-5-5' },
+  openai:    { reasoning: 'inherit', mid: 'openai/gpt-6-sol',            fast: 'openai/gpt-6-luna' },
+  google:    { reasoning: 'inherit', mid: 'google/gemini-3.8-flash',     fast: 'google/gemini-3.5-flash-lite' },
+  default:   { reasoning: 'inherit', mid: 'anthropic/claude-sonnet-5-5', fast: 'anthropic/claude-haiku-5-5' },
 };
 
 /**
@@ -382,6 +391,32 @@ function safeReadFile(filePath) {
   }
 }
 
+// ─── Line endings ───────────────────────────────────────────────────────────
+// A Windows working tree (core.autocrlf=true) holds planning files with CRLF
+// endings, and a parser written for '\n' finds nothing in them without saying so:
+// on 2026-10-04 every Windows field project measured was CRLF throughout, and the
+// memory optimizer, the must-haves parser and `frontmatter set` had all been
+// silently no-op (or worse) there. Parse on LF; write back in the file's own ending.
+
+/** LF text: CRLF → LF and a leading BOM dropped. */
+function toLf(text) {
+  return String(text == null ? '' : text).replace(/^/, '').replace(/\r\n/g, '\n');
+}
+
+/** The ending a text mostly uses: '\r\n' when its CRLF lines outnumber its bare LF ones. */
+function dominantEol(text) {
+  const s = String(text == null ? '' : text);
+  const crlf = (s.match(/\r\n/g) || []).length;
+  const lf = (s.match(/\n/g) || []).length - crlf;
+  return crlf > lf ? '\r\n' : '\n';
+}
+
+/** LF text given back in the ending `eol` names. */
+function withEol(text, eol) {
+  const s = String(text == null ? '' : text);
+  return eol === '\r\n' ? s.replace(/\r?\n/g, '\r\n') : s;
+}
+
 /**
  * Load project config from .planning/config.json, merging with defaults.
  * Handles nested config sections (planning.*, workflow.*, git.*) and flat keys.
@@ -455,10 +490,10 @@ function loadConfig(cwd) {
       // Cost dashboard config: `cost.rates` per-model overrides (surfaced so the
       // documented override actually reaches cost.cjs — it was dropped before).
       cost: parsed.cost || {},
-      // Prompt-cache config: `cache.extra_files` lets a project add its own
-      // stable documents to the cached context block. Needed because the
-      // built-in list is the phase-model spine, so a focus-model project had
-      // an empty block and therefore no prompt caching at all.
+      // Cache config: `cache.extra_files` lets a project add its own stable
+      // documents to the block `cache prime` and the size checks measure. Needed
+      // because the built-in list is the phase-model spine, so a focus-model
+      // project had an empty block and nothing measured.
       cache: parsed.cache || {},
       // ADR-0031: project build/verification commands. null = not configured
       // (focus-auto --clean-seal then asks or skips rather than guessing).
@@ -552,6 +587,18 @@ function escapeRegex(value) {
   return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/**
+ * Make free text safe for one markdown table cell: escape backslashes and pipes,
+ * and fold every run of line breaks into one space. A raw `|` splits the row into
+ * an extra column, and state.md's tables are appended to for the life of a
+ * project, so one bad row breaks every later read of the table (market-ideas M21).
+ * @param {*} value - Cell text; null and undefined become ''
+ * @returns {string}
+ */
+function escapeTableCell(value) {
+  return String(value ?? '').replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/[\r\n]+/g, ' ');
+}
+
 /**
  * Normalize a phase identifier to zero-padded format.
  * Examples: "1" → "01", "3A" → "03A", "12.1" → "12.1"
@@ -615,7 +662,7 @@ function searchPhaseInDir(baseDir, relBase, normalized) {
   try {
     const entries = fs.readdirSync(baseDir, { withFileTypes: true });
     const dirs = entries.filter(e => e.isDirectory()).map(e => e.name).sort((a, b) => comparePhaseNum(a, b));
-    const match = dirs.find(d => d.startsWith(normalized));
+    const match = dirs.find(d => d === normalized || d.startsWith(normalized + '-'));
     if (!match) return null;
 
     const dirMatch = match.match(PHASE_DIR_RE);
@@ -766,7 +813,11 @@ function getRoadmapPhaseInternal(cwd, phaseNum) {
     const restOfContent = content.slice(headerIndex);
     const nextHeaderMatch = restOfContent.match(/\n#{2,4}\s+Phase\s+\d/i);
     const sectionEnd = nextHeaderMatch ? headerIndex + nextHeaderMatch.index : content.length;
-    const section = content.slice(headerIndex, sectionEnd).trim();
+    let section = content.slice(headerIndex, sectionEnd).trim();
+    // A phase moved out by `roadmap compact` leaves a stub; the full section
+    // (and any model_tier override with it) is in roadmap-history.md.
+    const compacted = require('./roadmap-compact.cjs').compactedPhaseSection(cwd, unpadded, section);
+    if (compacted && compacted.section) section = compacted.section;
 
     const goalMatch = section.match(/(?:\*\*Goal:\*\*|\*\*Goal\*\*:)\s*([^\n]+)/i);
     const goal = goalMatch ? goalMatch[1].trim() : null;
@@ -777,6 +828,7 @@ function getRoadmapPhaseInternal(cwd, phaseNum) {
       phase_name: phaseName,
       goal,
       section,
+      ...(compacted ? { compacted: true } : {}),
     };
   } catch {
     return null;
@@ -1343,12 +1395,12 @@ function scanPendingTodos(cwd, area) {
  *
  * Reads files from .planning/ that are stable across agent calls within a phase
  * (project.md, requirements.md, roadmap.md, state.md, standards.md). Each block
- * is tagged `cache: true` so the host runtime (or installer) can translate to
- * the appropriate per-runtime caching syntax (Anthropic cache_control, etc.).
+ * is tagged `cache: true`. Nothing translates that tag into a cache marker: the
+ * host caches each agent's prompt prefix by itself, so this list is what PAN
+ * measures (context-budget, hygiene's cache-context check), not what it primes.
  *
  * Files that don't exist are skipped silently. The order matches the file list
- * in constants.cjs to keep prompt prefixes byte-stable across calls (which is
- * what cache key matching requires).
+ * in constants.cjs, so the `sha` of an unchanged set stays the same.
  *
  * @param {string} cwd - Project root
  * @returns {{blocks: Array<{path: string, content: string, cache: true}>, total_bytes: number, sha: string}}
@@ -1361,14 +1413,12 @@ function buildCachedContext(cwd) {
   const hasher = crypto.createHash('sha256');
 
   // The built-in list is the PHASE-model spine. A focus-model project has none
-  // of those files, so its cached block came out empty and it silently received
-  // no prompt caching at all. `cache.extra_files` lets such a project name its
-  // own stable documents rather than PAN inventing a convention it doesn't
-  // otherwise define.
+  // of those files, so its measured block came out empty and the size checks had
+  // nothing to read. `cache.extra_files` lets such a project name its own stable
+  // documents rather than PAN inventing a convention it doesn't otherwise define.
   //
   // Entries are planning-root-relative, must stay inside it, and are appended
-  // after the built-ins so the prefix stays byte-stable for projects that set
-  // nothing — changing the prefix would invalidate every existing cache key.
+  // after the built-ins, so the `sha` of a project that sets nothing does not change.
   const extra = [];
   try {
     const configured = loadConfig(cwd)?.cache?.extra_files;
@@ -1449,11 +1499,15 @@ module.exports = {
   error,
   verbose,
   safeReadFile,
+  toLf,
+  dominantEol,
+  withEol,
   loadConfig,
   isGitIgnored,
   isGitRepo,
   execGit,
   escapeRegex,
+  escapeTableCell,
   normalizePhaseName,
   comparePhaseNum,
   searchPhaseInDir,

package/pan-wizard-core/bin/lib/cost-rebuild.cjs

@@ -39,7 +39,7 @@ const os = require('os');
 const path = require('path');
 const { output, error, loadConfig } = require('./core.cjs');
 const { planningPath } = require('./utils.cjs');
-const { readRecords, computeCost, effectiveRates, isSuspectRecord, isEmptyRecord, METRICS_DIR, TOKENS_FILE } = require('./cost.cjs');
+const { readRecords, computeCost, effectiveRates, isSuspectRecord, isEmptyRecord, LONG_PROMPT_THRESHOLD, METRICS_DIR, TOKENS_FILE } = require('./cost.cjs');
 
 const SCHEMA_V = 4; // matches hooks/pan-cost-logger.js SCHEMA_V
 const MAIN_THREAD_AGENT = '(main thread)';
@@ -144,6 +144,17 @@ function sumTranscriptUsage(file) {
       totals.cache_write_1h_tokens = (totals.cache_write_1h_tokens || 0) + num(cc, 'ephemeral_1h_input_tokens');
       totals.cache_write_5m_tokens = (totals.cache_write_5m_tokens || 0) + num(cc, 'ephemeral_5m_input_tokens');
     }
+    // A request whose prompt is over LONG_PROMPT_THRESHOLD bills at a model's long
+    // rate where it has one (Haiku 5.5); the same rule as the cost-logger hook.
+    const prompt = num(u, 'input_tokens') + num(u, 'cache_read_input_tokens') + num(u, 'cache_creation_input_tokens');
+    if (prompt > LONG_PROMPT_THRESHOLD) {
+      const lp = totals.long_prompt || (totals.long_prompt = { above: LONG_PROMPT_THRESHOLD, input_tokens: 0, output_tokens: 0, cache_read_tokens: 0, cache_write_tokens: 0, cache_write_1h_tokens: 0 });
+      lp.input_tokens += num(u, 'input_tokens');
+      lp.output_tokens += num(u, 'output_tokens');
+      lp.cache_read_tokens += num(u, 'cache_read_input_tokens');
+      lp.cache_write_tokens += num(u, 'cache_creation_input_tokens');
+      if (cc && typeof cc === 'object') lp.cache_write_1h_tokens += num(cc, 'ephemeral_1h_input_tokens');
+    }
   }
   totals.turns = byMessage.size;
   let best = null;
@@ -304,6 +315,7 @@ function makeRow(fields) {
     ...(typeof fields.usage.cache_write_1h_tokens === 'number'
       ? { cache_write_1h_tokens: fields.usage.cache_write_1h_tokens, cache_write_5m_tokens: fields.usage.cache_write_5m_tokens || 0 }
       : {}),
+    ...(fields.usage.long_prompt ? { long_prompt: fields.usage.long_prompt } : {}),
     cost_usd: null,
     duration_ms: fields.usage.first_ts && fields.usage.last_ts ? Date.parse(fields.usage.last_ts) - Date.parse(fields.usage.first_ts) : null,
     phase: null,

package/pan-wizard-core/bin/lib/cost.cjs

@@ -55,6 +55,12 @@ const TOKENS_FILE = 'tokens.jsonl';
  * write at `cache_write` (market-ideas queue M13). OpenAI and Google report no
  * lifetime split, so their rows carry none.
  */
+// The prompt size above which a long-prompt rate applies (Haiku 5.5's tier). The
+// cost-logger hook and `cost rebuild` record the tokens of every request over it as a
+// row's `long_prompt`, with this figure as its `above`; hooks/pan-cost-logger.js keeps
+// its own copy (hooks require nothing from lib), and a test pins the two equal.
+const LONG_PROMPT_THRESHOLD = 100000;
+
 const DEFAULT_RATES = {
   // Anthropic — platform.claude.com/docs/en/about-claude/pricing, every row read
   // 2026-09-23. Opus 4.6+/Opus 5 are $5/$25 (the old $15/$75 Opus pricing ended with
@@ -91,10 +97,24 @@ const DEFAULT_RATES = {
   // 2026-08-31 was made permanent and the scheduled rise to $3/$15 cancelled.
   // Lesson: never write down a pre-announced price — this row carried the future
   // rate for a month and over-billed by half.
+  // Sonnet 5.5 (claude-sonnet-5-5): $2/$10, 5-minute writes $2.50, 1-hour $4, and
+  // hits at 0.05x input, $0.10 (pricing page, read 2026-10-10; Claude Code 2.1.296
+  // corrected its own figure from $0.20 the same week). Claude Code 2.1.284 points the
+  // `sonnet` alias at it on the Anthropic API (model-config, read 2026-10-03). Its own
+  // row is what keeps it off Sonnet 5's $0.20 hits through the family prefix.
+  'claude-sonnet-5-5':  { input: 2.0,  output: 10.0, cache_read: 0.10, cache_write: 2.50, cache_write_1h: 4.0 },
   'claude-sonnet-5':    { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50, cache_write_1h: 4.0 },
   'claude-sonnet-4-6':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75, cache_write_1h: 6.0 },
   // Sonnet 4.5 (dated id claude-sonnet-4-5-20250929): $3/$15/$0.30/$3.75 (R7).
   'claude-sonnet-4-5':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75, cache_write_1h: 6.0 },
+  // Haiku 5.5 (claude-haiku-5-5): $0.10/$0.50, 5-minute writes $0.125, 1-hour $0.20,
+  // hits $0.01 — and every rate 5x for a request whose prompt is over 100,000 tokens,
+  // counting cache reads and writes (pricing page "Long context pricing", read
+  // 2026-10-10). Claude Code 2.1.293 makes it the `haiku` alias on the Anthropic API,
+  // which is PAN's fast tier there. `long` prices the part of a row that came from
+  // such requests (`long_prompt`, see computeCost).
+  'claude-haiku-5-5':   { input: 0.10, output: 0.50, cache_read: 0.01, cache_write: 0.125, cache_write_1h: 0.20,
+    long: { above: LONG_PROMPT_THRESHOLD, input: 0.50, output: 2.50, cache_read: 0.05, cache_write: 0.625, cache_write_1h: 1.0 } },
   // Haiku 4.5: API id claude-haiku-4-5-20251001, alias claude-haiku-4-5.
   'claude-haiku-4-5':   { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25, cache_write_1h: 2.0 },
 
@@ -105,10 +125,14 @@ const DEFAULT_RATES = {
   // as plain input. Until 2026-09-22 this block said "no separate write charge" for
   // every row, which had stopped being true — Terra and Luna writes were a fifth
   // low (R27). Longest-prefix match lets each tier key win over a shorter one.
-  // GPT-6: Astra is the flagship; Sol and Luna were released 2026-09-22. Codex's
-  // config docs use gpt-6-sol as the default model and gpt-6-luna for lower-cost
-  // subagents (learn.chatgpt.com/docs/config-file/config-basic, /agent-configuration/subagents).
+  // GPT-6: Astra is the flagship; Sol and Luna were released 2026-09-22. GPT-6.1 Sol
+  // is Codex's default model from 0.159.1 (2026-09-29): `model = "gpt-6.1-sol"` in
+  // config-basic, and the subagent docs' starting model for demanding agents, with
+  // gpt-6-luna for lower-cost ones (learn.chatgpt.com/docs/config-file/config-basic,
+  // /agent-configuration/subagents, both read 2026-10-03). Its row was read from the
+  // pricing page on 2026-10-03: GPT-6 Sol's prices, except cached input at 0.05×.
   'gpt-6-astra':        { input: 10.0, output: 50.0, cache_read: 1.0,  cache_write: 12.5 },
+  'gpt-6.1-sol':        { input: 2.0,  output: 10.0, cache_read: 0.1,  cache_write: 2.5 },
   'gpt-6-sol':          { input: 2.0,  output: 10.0, cache_read: 0.2,  cache_write: 2.5 },
   'gpt-6-luna':         { input: 0.10, output: 0.50, cache_read: 0.01, cache_write: 0.125 },
   // GPT-5.6. The bare `gpt-5.6` id is an alias that "routes requests to GPT-5.6 Sol"
@@ -232,6 +256,7 @@ const scaleRate = (rate, m) => ({
   cache_read: round6(rate.cache_read * m),
   cache_write: round6(rate.cache_write * m),
   ...(typeof rate.cache_write_1h === 'number' ? { cache_write_1h: round6(rate.cache_write_1h * m) } : {}),
+  ...(rate.long && typeof rate.long === 'object' ? { long: { above: rate.long.above, ...scaleRate(rate.long, m) } } : {}),
 });
 
 /**
@@ -378,12 +403,35 @@ function computeCost(rec, configRates) {
   // bills at the one-hour rate; the rest — and every write on a row or rate without
   // the split — at `cache_write`.
   const write1h = Math.min(cacheWrite, Math.max(0, Number(rec.cache_write_1h_tokens) || 0));
-  const rate1h = typeof rate.cache_write_1h === 'number' ? rate.cache_write_1h : rate.cache_write;
-  const usd = (input * rate.input + output * rate.output + cacheRead * rate.cache_read
-    + (cacheWrite - write1h) * rate.cache_write + write1h * rate1h) / 1_000_000;
+  const tokens = { input, output, cacheRead, cacheWrite, write1h };
+  // A long-prompt tier (Haiku 5.5): the row's `long_prompt` holds the tokens of the
+  // requests whose prompt was over the threshold, and those bill at the long rates.
+  // Measured at the same threshold only — a row split at another figure cannot be
+  // re-cut here, so it prices at the base rates as before.
+  const lp = rec.long_prompt;
+  let usd = 0;
+  if (rate.long && lp && typeof lp === 'object' && Number(lp.above) === Number(rate.long.above)) {
+    const part = {
+      input: Math.min(input, Number(lp.input_tokens) || 0),
+      output: Math.min(output, Number(lp.output_tokens) || 0),
+      cacheRead: Math.min(cacheRead, Number(lp.cache_read_tokens) || 0),
+      cacheWrite: Math.min(cacheWrite, Number(lp.cache_write_tokens) || 0),
+    };
+    part.write1h = Math.min(part.cacheWrite, write1h, Number(lp.cache_write_1h_tokens) || 0);
+    usd += priceTokens(part, rate.long);
+    for (const k of Object.keys(part)) tokens[k] -= part[k];
+  }
+  usd += priceTokens(tokens, rate);
   return Math.round(usd * 10000) / 10000;
 }
 
+/** USD for disjoint token counts at one rate row (1-hour writes at their own rate). */
+function priceTokens(t, rate) {
+  const rate1h = typeof rate.cache_write_1h === 'number' ? rate.cache_write_1h : rate.cache_write;
+  return (t.input * rate.input + t.output * rate.output + t.cacheRead * rate.cache_read
+    + (t.cacheWrite - t.write1h) * rate.cache_write + t.write1h * rate1h) / 1_000_000;
+}
+
 /**
  * Append a cost record. Non-blocking — errors are swallowed so instrumentation
  * never breaks the caller.
@@ -522,7 +570,11 @@ function aggregate(cwd, opts) {
   const records = readRecords(cwd);
   const malformedSkipped = _lastReadMalformed; // captured before any later read
   const since = opts?.since ? new Date(opts.since).getTime() : null;
-  const until = opts?.until ? new Date(opts.until).getTime() : null;
+  // A bare date is that day's first instant, so as an upper bound it left out the
+  // whole day the docs call inclusive: read it as the day's last millisecond.
+  const until = opts?.until
+    ? new Date(/^\d{4}-\d{2}-\d{2}$/.test(String(opts.until)) ? `${opts.until}T23:59:59.999Z` : opts.until).getTime()
+    : null;
   const config = loadConfig(cwd);
   const configRates = effectiveRates(config);
 
@@ -689,10 +741,12 @@ function renderChart(agg) {
 function cmdCostReport(cwd, opts, raw) {
   const format = opts?.format || 'json';
   const agg = aggregate(cwd, opts);
+  // `--format table|chart` asks for text, so it prints text with or without
+  // `--raw`; without `--raw` it used to print the JSON report unchanged.
   if (format === 'table') {
-    output(agg, raw, renderTable(agg));
+    output(agg, true, renderTable(agg));
   } else if (format === 'chart') {
-    output(agg, raw, renderChart(agg));
+    output(agg, true, renderChart(agg));
   } else {
     output(agg, raw);
   }
@@ -712,6 +766,86 @@ function cmdCostClear(cwd, raw) {
   }
 }
 
+// ─── Host usage limits (Claude Code subscriptions) ───────────────────────────
+//
+// Claude Code's status-line payload carries `rate_limits.five_hour` and
+// `rate_limits.seven_day` (`used_percentage`, `resets_at` in epoch seconds;
+// code.claude.com/docs/en/statusline, read 2026-10-10). On a subscription those
+// windows, not dollars, are what a long campaign runs out of. PAN's status line
+// writes them, account-wide, to claude-limits.json in the per-user pan-hooks
+// directory; campaigns read them here. Headless `claude -p` runs no status line, so
+// there the file goes stale and nothing stops on it.
+
+const HOST_LIMITS_FILE = 'claude-limits.json';
+const HOST_LIMITS_FRESH_SECONDS = 15 * 60;
+const DEFAULT_WEEKLY_LIMIT_STOP_PCT = 90;
+
+/** The per-user pan-hooks directory when it is safe to read (ours, not a symlink, owner-only), else null. */
+function hooksDirIfSafe(tmpDir) {
+  const uid = typeof process.getuid === 'function' ? process.getuid() : (process.env.USERNAME || 'win');
+  const dir = path.join(tmpDir || require('os').tmpdir(), `pan-hooks-${uid}`);
+  try {
+    const st = fs.lstatSync(dir);
+    if (st.isSymbolicLink() || !st.isDirectory()) return null;
+    if (typeof process.getuid === 'function' && (st.uid !== process.getuid() || (st.mode & 0o077) !== 0)) return null;
+    return dir;
+  } catch { return null; }
+}
+
+/**
+ * The host's usage-limit windows as the status line last saw them, or null when no
+ * status line has written them. A window whose `resets_at` has passed reads as reset
+ * (used 0); the whole reading is `stale` past HOST_LIMITS_FRESH_SECONDS.
+ * @param {{tmpDir?: string, now?: number}} [opts] - now in epoch seconds
+ */
+function readHostLimits(opts = {}) {
+  const dir = hooksDirIfSafe(opts.tmpDir);
+  if (!dir) return null;
+  let raw;
+  try { raw = JSON.parse(fs.readFileSync(path.join(dir, HOST_LIMITS_FILE), 'utf8')); } catch { return null; }
+  if (!raw || typeof raw !== 'object') return null;
+  const now = Number.isFinite(opts.now) ? opts.now : Math.floor(Date.now() / 1000);
+  const win = (w) => {
+    if (!w || typeof w !== 'object' || !Number.isFinite(Number(w.used_percentage))) return null;
+    const resetsAt = Number.isFinite(Number(w.resets_at)) ? Number(w.resets_at) : null;
+    const reset = resetsAt !== null && resetsAt <= now;
+    return { used_pct: reset ? 0 : Math.max(0, Math.min(100, Number(w.used_percentage))), resets_at: resetsAt, reset_since_read: reset };
+  };
+  const age = Number.isFinite(Number(raw.timestamp)) ? now - Number(raw.timestamp) : null;
+  return {
+    five_hour: win(raw.five_hour),
+    seven_day: win(raw.seven_day),
+    age_seconds: age,
+    stale: age === null || age > HOST_LIMITS_FRESH_SECONDS,
+  };
+}
+
+/**
+ * Whether a campaign should stop on the 7-day window: a fresh reading at or past
+ * `cost.weekly_limit_stop_pct` (default 90; 0 or false turns it off).
+ */
+function weeklyLimitStop(cwd, limits = readHostLimits()) {
+  let pct = DEFAULT_WEEKLY_LIMIT_STOP_PCT;
+  try {
+    const v = loadConfig(cwd)?.cost?.weekly_limit_stop_pct;
+    if (v === false || v === 0) pct = 0;
+    else if (Number.isFinite(Number(v)) && Number(v) > 0 && Number(v) <= 100) pct = Number(v);
+  } catch { /* defaults */ }
+  const used = limits && !limits.stale && limits.seven_day ? limits.seven_day.used_pct : null;
+  return { stop: pct > 0 && used !== null && used >= pct, threshold_pct: pct, seven_day_used_pct: used };
+}
+
+function cmdCostLimits(cwd, raw) {
+  const limits = readHostLimits();
+  const stop = weeklyLimitStop(cwd, limits);
+  output({
+    available: !!limits,
+    ...(limits || { five_hour: null, seven_day: null, age_seconds: null, stale: true }),
+    weekly_limit_stop_pct: stop.threshold_pct,
+    weekly_limit_reached: stop.stop,
+  }, raw, stop.stop ? 'weekly_limit_reached' : (limits ? 'ok' : 'no_reading'));
+}
+
 // ─── Rate-table staleness ───────────────────────────────────────────────────
 
 // Date DEFAULT_RATES was last verified against published provider pricing — ALL
@@ -728,7 +862,7 @@ function cmdCostClear(cwd, raw) {
 // a default-model change inside the window — that is the job of the
 // documented-default-ids fixture test (tests/fixtures/documented-default-models.json,
 // R31), which fails the suite the day a documented default id has no exact row.
-const RATES_VERIFIED_AT = '2026-09-23';
+const RATES_VERIFIED_AT = '2026-10-10';
 const RATES_STALE_AFTER_DAYS = 60;
 const RATE_TIERS = ['reasoning', 'mid', 'fast'];
 
@@ -774,6 +908,11 @@ module.exports = {
   renderTable,
   renderChart,
   resolveRate,
+  LONG_PROMPT_THRESHOLD,
+  readHostLimits,
+  weeklyLimitStop,
+  cmdCostLimits,
+  HOST_LIMITS_FILE,
   ratesFromModelPricing,
   managedSettingsDir,
   loadManagedModelPricing,

package/pan-wizard-core/bin/lib/distill.cjs

@@ -21,8 +21,10 @@ const SCANNABLE_EXTS = ['.js', '.cjs', '.mjs', '.ts', '.tsx', '.jsx', '.py'];
 
 // ─── Pass 1: Deterministic static analysis ───────────────────────────────────
 
-// Calls that genuinely CANNOT throw when given any single argument, so a
-// try/catch wrapping only such a call is truly phantom (dead catch clause).
+// Calls the matcher treats as non-throwing: none of them throws on a string or a
+// number, so a try/catch wrapping only such a call is usually phantom. Number, String,
+// parseInt and parseFloat do throw on an object whose toString throws (all but String
+// on a Symbol too), which is why findPhantomTryCatch tiers it review_required.
 // Deliberately EXCLUDES throwing calls — JSON.parse (SyntaxError on bad input),
 // JSON.stringify (TypeError on circular refs / BigInt), new RegExp, fs.*Sync,
 // etc. — because their try/catch is load-bearing and must not be flagged for
@@ -431,7 +433,7 @@ function writePatternsMemory(cwd, findings, opts) {
   const lines = [
     '---',
     'name: distill-patterns',
-    'description: Cross-session memory of AI-bloat patterns detected and resolved',
+    'description: Cross-session memory of AI-bloat patterns detected (it records detections, not fixes)',
     'type: project',
     '---',
     '',
@@ -520,6 +522,7 @@ module.exports = {
   findUnreferencedExports,
   SAFETY_TIERS,
   DEFAULT_BLOAT_THRESHOLD,
+  PATTERNS_FILE,
   MAX_FUNCTION_LOC,
   MAX_PARAM_COUNT,
   MAX_NESTING_DEPTH,

package/pan-wizard-core/bin/lib/doc-lint.cjs

@@ -44,11 +44,21 @@ const DEFAULT_SCHEMA_PATH = path.join(
  *   calls it must pass its verdict as output()'s 4th argument; a bare
  *   process.exit() after an output() call is unreachable.
  */
+/**
+ * A missing path or a file where a directory is expected ends in error(), not in the
+ * stack trace walkMarkdownFiles' throw used to print (`doc-lint counts README.md`).
+ * @param {string} targetDir
+ */
+function requireDirectory(targetDir) {
+  let stat = null;
+  try { stat = fs.statSync(targetDir); } catch { /* absent */ }
+  if (!stat) error(`directory not found: ${targetDir}`);
+  if (!stat.isDirectory()) error(`not a directory: ${targetDir} — doc-lint scans a directory of markdown files`);
+}
+
 function cmdDocLint(cwd, dir, opts = {}) {
   const targetDir = path.isAbsolute(dir) ? dir : path.join(cwd, dir);
-  if (!fs.existsSync(targetDir)) {
-    error(`directory not found: ${targetDir}`);
-  }
+  requireDirectory(targetDir);
 
   const schemaPath = opts.schema
     ? (path.isAbsolute(opts.schema) ? opts.schema : path.join(cwd, opts.schema))
@@ -209,7 +219,6 @@ function isCountAllowed(relativePath) {
 // Things that LOOK like counts but are stable identities (allowed everywhere):
 const STABLE_IDENTITIES = [
   /\b5\s+(target\s+)?runtimes\b/i,                          // 5 target runtimes
-  /\b5\s+hooks\b/i,                                          // 5 hooks (named individually)
   /\bLAYER\s+\d+\b/,                                         // architecture layer labels
   /\b5\s+(parallel\s+)?(researchers?|research\s+)/i,         // 5 parallel researchers
   /\b6\s+(parallel\s+)?agents\b/i,                           // 6 parallel agents (codebase mapper)
@@ -218,9 +227,17 @@ const STABLE_IDENTITIES = [
   /\bthree\s+phases\b|\bfour\s+phases\b/i,                   // generic phase counts in narrative
 ];
 
-function isStableIdentity(matchText, surrounding) {
+function isStableIdentity(matchText, surrounding, matchIndex = 0) {
   for (const re of STABLE_IDENTITIES) {
-    if (re.test(matchText) || re.test(surrounding)) return true;
+    if (re.test(matchText)) return true;
+    // Only an identity that overlaps the count excuses it ("LAYER 6 modules"). One
+    // elsewhere on the line excused every count there: "52 commands on all 5 runtimes".
+    const all = new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
+    let s;
+    while ((s = all.exec(surrounding)) !== null) {
+      if (s.index < matchIndex + matchText.length && matchIndex < s.index + s[0].length) return true;
+      if (s[0].length === 0) all.lastIndex++;
+    }
   }
   return false;
 }
@@ -233,9 +250,7 @@ function isStableIdentity(matchText, surrounding) {
  */
 function cmdDocLintCounts(cwd, dir, opts = {}) {
   const targetDir = path.isAbsolute(dir) ? dir : path.join(cwd, dir);
-  if (!fs.existsSync(targetDir)) {
-    error(`directory not found: ${targetDir}`);
-  }
+  requireDirectory(targetDir);
 
   const exclude = opts.exclude || [];
   const files = walkMarkdownFiles(targetDir, { exclude });
@@ -260,8 +275,8 @@ function cmdDocLintCounts(cwd, dir, opts = {}) {
         re.lastIndex = 0; // reset for /g
         let m;
         while ((m = re.exec(line)) !== null) {
-          // Skip if this whole line is in a stable-identity surrounding
-          if (isStableIdentity(m[0], line)) continue;
+          // Skip a count that is part of a stable identity
+          if (isStableIdentity(m[0], line, m.index)) continue;
           violations.push({
             file: file.relativePath,
             line: i + 1,
@@ -363,6 +378,10 @@ function scanDocFlags(cwd, opts = {}) {
 }
 
 function cmdDocLintFlags(cwd, opts = {}, raw) {
+  for (const d of opts.docDirs || []) {
+    const abs = path.isAbsolute(d) ? d : path.join(cwd, d);
+    if (fs.existsSync(abs)) requireDirectory(abs);
+  }
   const r = scanDocFlags(cwd, opts);
   if (raw) {
     if (r.violation_count === 0) {

package/pan-wizard-core/bin/lib/findings.cjs

@@ -160,7 +160,10 @@ function recordVerdict(cwd, input) {
 
   const { rows } = readLedger(cwd);
   const fold = foldFindings(rows);
-  const base = { contract: V.VERDICT_CONTRACT, agent, verdict: verdict.verdict, outcome: verdict.outcome, source_kind: parsed.source_kind, warnings: parsed.warnings };
+  // `not_checked` (M23): what the judge could not run. A pass with entries here is a
+  // pass over less than the whole phase, and the record says so.
+  const notChecked = verdict.not_checked || [];
+  const base = { contract: V.VERDICT_CONTRACT, agent, verdict: verdict.verdict, outcome: verdict.outcome, not_checked: notChecked, source_kind: parsed.source_kind, warnings: parsed.warnings };
 
   const dup = fold.verdicts.find((r) => r.record_sig === recordSig && r.agent === agent && samePhase(r.phase, phase));
   if (dup) {
@@ -204,6 +207,7 @@ function recordVerdict(cwd, input) {
     v: LEDGER_V, kind: 'verdict', ts, verdict_id: verdictId, record_sig: recordSig, phase, milestone, agent,
     verdict: verdict.verdict, outcome: verdict.outcome, attempt, source, finding_ids: ids,
     by_severity: bySeverity, by_class: byClass, warnings: parsed.warnings,
+    ...(notChecked.length ? { not_checked: notChecked } : {}),
   });
   appendRows(cwd, [...findingRows, ...newRows, ...autoFixRows]);
 
@@ -216,7 +220,7 @@ function recordVerdict(cwd, input) {
     phase,
     description: `${agent} ${verdict.verdict || verdict.outcome} on phase ${phase} (attempt ${attempt}, ${ids.length} finding${ids.length === 1 ? '' : 's'})`,
     impact: verdict.outcome === 'fail' ? (serious ? 'major' : 'minor') : 'minor',
-    context: { agent, phase, verdict: verdict.verdict, attempt, findings: ids.length, by_severity: bySeverity, by_class: byClass, verdict_id: verdictId },
+    context: { agent, phase, verdict: verdict.verdict, attempt, findings: ids.length, by_severity: bySeverity, by_class: byClass, verdict_id: verdictId, not_checked: notChecked.map((n) => n.check) },
   });
   if (previous && previous.outcome === 'fail') {
     traceEvent(cwd, {
@@ -272,6 +276,13 @@ function disposeFindings(cwd, input) {
   return { contract: V.VERDICT_CONTRACT, disposition: as, disposed, skipped };
 }
 
+/**
+ * Milestone versions compare with or without the leading `v`: the ledger stores
+ * `getMilestoneInfo`'s `v1.0`, while milestone-audit names its version `1.0` (its
+ * report is `v{version}-milestone-audit.md`), so `--milestone 1.0` found no debt.
+ */
+const sameMilestone = (a, b) => String(a || '').trim().replace(/^v/i, '') === String(b || '').trim().replace(/^v/i, '');
+
 /** Findings with their folded status, filtered. */
 function listFindings(cwd, filters = {}) {
   const { rows, malformed } = readLedger(cwd);
@@ -281,7 +292,7 @@ function listFindings(cwd, filters = {}) {
   if (filters.agent) list = list.filter((f) => f.agent === filters.agent);
   if (filters.status) list = list.filter((f) => f.status === filters.status);
   if (filters.class) list = list.filter((f) => f.class === filters.class);
-  if (filters.milestone) list = list.filter((f) => f.milestone === filters.milestone);
+  if (filters.milestone) list = list.filter((f) => sameMilestone(f.milestone, filters.milestone));
   const findings = list.map(publicFinding);
   return {
     contract: V.VERDICT_CONTRACT,
@@ -302,7 +313,7 @@ function findingsDebt(cwd, opts = {}) {
   const fold = foldFindings(rows);
   const byPhase = new Map();
   for (const f of fold.findings.values()) {
-    if (milestone && f.milestone !== milestone) continue;
+    if (milestone && !sameMilestone(f.milestone, milestone)) continue;
     if (f.status !== 'deferred' && f.status !== 'open') continue;
     const key = V.comparablePhase(f.phase);
     if (!byPhase.has(key)) byPhase.set(key, { phase: f.phase, deferred: [], open: [] });