pan-wizard 3.33.0 → 3.35.0

package/pan-wizard-core/bin/lib/cost.cjs

@@ -55,6 +55,12 @@ const TOKENS_FILE = 'tokens.jsonl';
  * write at `cache_write` (market-ideas queue M13). OpenAI and Google report no
  * lifetime split, so their rows carry none.
  */
+// The prompt size above which a long-prompt rate applies (Haiku 5.5's tier). The
+// cost-logger hook and `cost rebuild` record the tokens of every request over it as a
+// row's `long_prompt`, with this figure as its `above`; hooks/pan-cost-logger.js keeps
+// its own copy (hooks require nothing from lib), and a test pins the two equal.
+const LONG_PROMPT_THRESHOLD = 100000;
+
 const DEFAULT_RATES = {
   // Anthropic — platform.claude.com/docs/en/about-claude/pricing, every row read
   // 2026-09-23. Opus 4.6+/Opus 5 are $5/$25 (the old $15/$75 Opus pricing ended with
@@ -91,16 +97,24 @@ const DEFAULT_RATES = {
   // 2026-08-31 was made permanent and the scheduled rise to $3/$15 cancelled.
   // Lesson: never write down a pre-announced price — this row carried the future
   // rate for a month and over-billed by half.
-  // Sonnet 5.5 (claude-sonnet-5-5): the same prices as Sonnet 5 — $2/$10, 5-minute
-  // writes $2.50, 1-hour $4, hits $0.20 (pricing page, read 2026-10-03). Claude Code
-  // 2.1.284 points the `sonnet` alias at it on the Anthropic API (model-config, read
-  // 2026-10-03). The family prefix already priced it at Sonnet 5's identical row; its
-  // own row means a later price change to either model cannot misprice the other.
-  'claude-sonnet-5-5':  { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50, cache_write_1h: 4.0 },
+  // Sonnet 5.5 (claude-sonnet-5-5): $2/$10, 5-minute writes $2.50, 1-hour $4, and
+  // hits at 0.05x input, $0.10 (pricing page, read 2026-10-10; Claude Code 2.1.296
+  // corrected its own figure from $0.20 the same week). Claude Code 2.1.284 points the
+  // `sonnet` alias at it on the Anthropic API (model-config, read 2026-10-03). Its own
+  // row is what keeps it off Sonnet 5's $0.20 hits through the family prefix.
+  'claude-sonnet-5-5':  { input: 2.0,  output: 10.0, cache_read: 0.10, cache_write: 2.50, cache_write_1h: 4.0 },
   'claude-sonnet-5':    { input: 2.0,  output: 10.0, cache_read: 0.20, cache_write: 2.50, cache_write_1h: 4.0 },
   'claude-sonnet-4-6':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75, cache_write_1h: 6.0 },
   // Sonnet 4.5 (dated id claude-sonnet-4-5-20250929): $3/$15/$0.30/$3.75 (R7).
   'claude-sonnet-4-5':  { input: 3.0,  output: 15.0, cache_read: 0.3,  cache_write: 3.75, cache_write_1h: 6.0 },
+  // Haiku 5.5 (claude-haiku-5-5): $0.10/$0.50, 5-minute writes $0.125, 1-hour $0.20,
+  // hits $0.01 — and every rate 5x for a request whose prompt is over 100,000 tokens,
+  // counting cache reads and writes (pricing page "Long context pricing", read
+  // 2026-10-10). Claude Code 2.1.293 makes it the `haiku` alias on the Anthropic API,
+  // which is PAN's fast tier there. `long` prices the part of a row that came from
+  // such requests (`long_prompt`, see computeCost).
+  'claude-haiku-5-5':   { input: 0.10, output: 0.50, cache_read: 0.01, cache_write: 0.125, cache_write_1h: 0.20,
+    long: { above: LONG_PROMPT_THRESHOLD, input: 0.50, output: 2.50, cache_read: 0.05, cache_write: 0.625, cache_write_1h: 1.0 } },
   // Haiku 4.5: API id claude-haiku-4-5-20251001, alias claude-haiku-4-5.
   'claude-haiku-4-5':   { input: 1.0,  output: 5.0,  cache_read: 0.1,  cache_write: 1.25, cache_write_1h: 2.0 },
 
@@ -242,6 +256,7 @@ const scaleRate = (rate, m) => ({
   cache_read: round6(rate.cache_read * m),
   cache_write: round6(rate.cache_write * m),
   ...(typeof rate.cache_write_1h === 'number' ? { cache_write_1h: round6(rate.cache_write_1h * m) } : {}),
+  ...(rate.long && typeof rate.long === 'object' ? { long: { above: rate.long.above, ...scaleRate(rate.long, m) } } : {}),
 });
 
 /**
@@ -388,12 +403,35 @@ function computeCost(rec, configRates) {
   // bills at the one-hour rate; the rest — and every write on a row or rate without
   // the split — at `cache_write`.
   const write1h = Math.min(cacheWrite, Math.max(0, Number(rec.cache_write_1h_tokens) || 0));
-  const rate1h = typeof rate.cache_write_1h === 'number' ? rate.cache_write_1h : rate.cache_write;
-  const usd = (input * rate.input + output * rate.output + cacheRead * rate.cache_read
-    + (cacheWrite - write1h) * rate.cache_write + write1h * rate1h) / 1_000_000;
+  const tokens = { input, output, cacheRead, cacheWrite, write1h };
+  // A long-prompt tier (Haiku 5.5): the row's `long_prompt` holds the tokens of the
+  // requests whose prompt was over the threshold, and those bill at the long rates.
+  // Measured at the same threshold only — a row split at another figure cannot be
+  // re-cut here, so it prices at the base rates as before.
+  const lp = rec.long_prompt;
+  let usd = 0;
+  if (rate.long && lp && typeof lp === 'object' && Number(lp.above) === Number(rate.long.above)) {
+    const part = {
+      input: Math.min(input, Number(lp.input_tokens) || 0),
+      output: Math.min(output, Number(lp.output_tokens) || 0),
+      cacheRead: Math.min(cacheRead, Number(lp.cache_read_tokens) || 0),
+      cacheWrite: Math.min(cacheWrite, Number(lp.cache_write_tokens) || 0),
+    };
+    part.write1h = Math.min(part.cacheWrite, write1h, Number(lp.cache_write_1h_tokens) || 0);
+    usd += priceTokens(part, rate.long);
+    for (const k of Object.keys(part)) tokens[k] -= part[k];
+  }
+  usd += priceTokens(tokens, rate);
   return Math.round(usd * 10000) / 10000;
 }
 
+/** USD for disjoint token counts at one rate row (1-hour writes at their own rate). */
+function priceTokens(t, rate) {
+  const rate1h = typeof rate.cache_write_1h === 'number' ? rate.cache_write_1h : rate.cache_write;
+  return (t.input * rate.input + t.output * rate.output + t.cacheRead * rate.cache_read
+    + (t.cacheWrite - t.write1h) * rate.cache_write + t.write1h * rate1h) / 1_000_000;
+}
+
 /**
  * Append a cost record. Non-blocking — errors are swallowed so instrumentation
  * never breaks the caller.
@@ -532,7 +570,11 @@ function aggregate(cwd, opts) {
   const records = readRecords(cwd);
   const malformedSkipped = _lastReadMalformed; // captured before any later read
   const since = opts?.since ? new Date(opts.since).getTime() : null;
-  const until = opts?.until ? new Date(opts.until).getTime() : null;
+  // A bare date is that day's first instant, so as an upper bound it left out the
+  // whole day the docs call inclusive: read it as the day's last millisecond.
+  const until = opts?.until
+    ? new Date(/^\d{4}-\d{2}-\d{2}$/.test(String(opts.until)) ? `${opts.until}T23:59:59.999Z` : opts.until).getTime()
+    : null;
   const config = loadConfig(cwd);
   const configRates = effectiveRates(config);
 
@@ -699,10 +741,12 @@ function renderChart(agg) {
 function cmdCostReport(cwd, opts, raw) {
   const format = opts?.format || 'json';
   const agg = aggregate(cwd, opts);
+  // `--format table|chart` asks for text, so it prints text with or without
+  // `--raw`; without `--raw` it used to print the JSON report unchanged.
   if (format === 'table') {
-    output(agg, raw, renderTable(agg));
+    output(agg, true, renderTable(agg));
   } else if (format === 'chart') {
-    output(agg, raw, renderChart(agg));
+    output(agg, true, renderChart(agg));
   } else {
     output(agg, raw);
   }
@@ -722,6 +766,86 @@ function cmdCostClear(cwd, raw) {
   }
 }
 
+// ─── Host usage limits (Claude Code subscriptions) ───────────────────────────
+//
+// Claude Code's status-line payload carries `rate_limits.five_hour` and
+// `rate_limits.seven_day` (`used_percentage`, `resets_at` in epoch seconds;
+// code.claude.com/docs/en/statusline, read 2026-10-10). On a subscription those
+// windows, not dollars, are what a long campaign runs out of. PAN's status line
+// writes them, account-wide, to claude-limits.json in the per-user pan-hooks
+// directory; campaigns read them here. Headless `claude -p` runs no status line, so
+// there the file goes stale and nothing stops on it.
+
+const HOST_LIMITS_FILE = 'claude-limits.json';
+const HOST_LIMITS_FRESH_SECONDS = 15 * 60;
+const DEFAULT_WEEKLY_LIMIT_STOP_PCT = 90;
+
+/** The per-user pan-hooks directory when it is safe to read (ours, not a symlink, owner-only), else null. */
+function hooksDirIfSafe(tmpDir) {
+  const uid = typeof process.getuid === 'function' ? process.getuid() : (process.env.USERNAME || 'win');
+  const dir = path.join(tmpDir || require('os').tmpdir(), `pan-hooks-${uid}`);
+  try {
+    const st = fs.lstatSync(dir);
+    if (st.isSymbolicLink() || !st.isDirectory()) return null;
+    if (typeof process.getuid === 'function' && (st.uid !== process.getuid() || (st.mode & 0o077) !== 0)) return null;
+    return dir;
+  } catch { return null; }
+}
+
+/**
+ * The host's usage-limit windows as the status line last saw them, or null when no
+ * status line has written them. A window whose `resets_at` has passed reads as reset
+ * (used 0); the whole reading is `stale` past HOST_LIMITS_FRESH_SECONDS.
+ * @param {{tmpDir?: string, now?: number}} [opts] - now in epoch seconds
+ */
+function readHostLimits(opts = {}) {
+  const dir = hooksDirIfSafe(opts.tmpDir);
+  if (!dir) return null;
+  let raw;
+  try { raw = JSON.parse(fs.readFileSync(path.join(dir, HOST_LIMITS_FILE), 'utf8')); } catch { return null; }
+  if (!raw || typeof raw !== 'object') return null;
+  const now = Number.isFinite(opts.now) ? opts.now : Math.floor(Date.now() / 1000);
+  const win = (w) => {
+    if (!w || typeof w !== 'object' || !Number.isFinite(Number(w.used_percentage))) return null;
+    const resetsAt = Number.isFinite(Number(w.resets_at)) ? Number(w.resets_at) : null;
+    const reset = resetsAt !== null && resetsAt <= now;
+    return { used_pct: reset ? 0 : Math.max(0, Math.min(100, Number(w.used_percentage))), resets_at: resetsAt, reset_since_read: reset };
+  };
+  const age = Number.isFinite(Number(raw.timestamp)) ? now - Number(raw.timestamp) : null;
+  return {
+    five_hour: win(raw.five_hour),
+    seven_day: win(raw.seven_day),
+    age_seconds: age,
+    stale: age === null || age > HOST_LIMITS_FRESH_SECONDS,
+  };
+}
+
+/**
+ * Whether a campaign should stop on the 7-day window: a fresh reading at or past
+ * `cost.weekly_limit_stop_pct` (default 90; 0 or false turns it off).
+ */
+function weeklyLimitStop(cwd, limits = readHostLimits()) {
+  let pct = DEFAULT_WEEKLY_LIMIT_STOP_PCT;
+  try {
+    const v = loadConfig(cwd)?.cost?.weekly_limit_stop_pct;
+    if (v === false || v === 0) pct = 0;
+    else if (Number.isFinite(Number(v)) && Number(v) > 0 && Number(v) <= 100) pct = Number(v);
+  } catch { /* defaults */ }
+  const used = limits && !limits.stale && limits.seven_day ? limits.seven_day.used_pct : null;
+  return { stop: pct > 0 && used !== null && used >= pct, threshold_pct: pct, seven_day_used_pct: used };
+}
+
+function cmdCostLimits(cwd, raw) {
+  const limits = readHostLimits();
+  const stop = weeklyLimitStop(cwd, limits);
+  output({
+    available: !!limits,
+    ...(limits || { five_hour: null, seven_day: null, age_seconds: null, stale: true }),
+    weekly_limit_stop_pct: stop.threshold_pct,
+    weekly_limit_reached: stop.stop,
+  }, raw, stop.stop ? 'weekly_limit_reached' : (limits ? 'ok' : 'no_reading'));
+}
+
 // ─── Rate-table staleness ───────────────────────────────────────────────────
 
 // Date DEFAULT_RATES was last verified against published provider pricing — ALL
@@ -738,7 +862,7 @@ function cmdCostClear(cwd, raw) {
 // a default-model change inside the window — that is the job of the
 // documented-default-ids fixture test (tests/fixtures/documented-default-models.json,
 // R31), which fails the suite the day a documented default id has no exact row.
-const RATES_VERIFIED_AT = '2026-09-23';
+const RATES_VERIFIED_AT = '2026-10-10';
 const RATES_STALE_AFTER_DAYS = 60;
 const RATE_TIERS = ['reasoning', 'mid', 'fast'];
 
@@ -784,6 +908,11 @@ module.exports = {
   renderTable,
   renderChart,
   resolveRate,
+  LONG_PROMPT_THRESHOLD,
+  readHostLimits,
+  weeklyLimitStop,
+  cmdCostLimits,
+  HOST_LIMITS_FILE,
   ratesFromModelPricing,
   managedSettingsDir,
   loadManagedModelPricing,

package/pan-wizard-core/bin/lib/distill.cjs

@@ -21,8 +21,10 @@ const SCANNABLE_EXTS = ['.js', '.cjs', '.mjs', '.ts', '.tsx', '.jsx', '.py'];
 
 // ─── Pass 1: Deterministic static analysis ───────────────────────────────────
 
-// Calls that genuinely CANNOT throw when given any single argument, so a
-// try/catch wrapping only such a call is truly phantom (dead catch clause).
+// Calls the matcher treats as non-throwing: none of them throws on a string or a
+// number, so a try/catch wrapping only such a call is usually phantom. Number, String,
+// parseInt and parseFloat do throw on an object whose toString throws (all but String
+// on a Symbol too), which is why findPhantomTryCatch tiers it review_required.
 // Deliberately EXCLUDES throwing calls — JSON.parse (SyntaxError on bad input),
 // JSON.stringify (TypeError on circular refs / BigInt), new RegExp, fs.*Sync,
 // etc. — because their try/catch is load-bearing and must not be flagged for
@@ -431,7 +433,7 @@ function writePatternsMemory(cwd, findings, opts) {
   const lines = [
     '---',
     'name: distill-patterns',
-    'description: Cross-session memory of AI-bloat patterns detected and resolved',
+    'description: Cross-session memory of AI-bloat patterns detected (it records detections, not fixes)',
     'type: project',
     '---',
     '',
@@ -520,6 +522,7 @@ module.exports = {
   findUnreferencedExports,
   SAFETY_TIERS,
   DEFAULT_BLOAT_THRESHOLD,
+  PATTERNS_FILE,
   MAX_FUNCTION_LOC,
   MAX_PARAM_COUNT,
   MAX_NESTING_DEPTH,

package/pan-wizard-core/bin/lib/doc-lint.cjs

@@ -44,11 +44,21 @@ const DEFAULT_SCHEMA_PATH = path.join(
  *   calls it must pass its verdict as output()'s 4th argument; a bare
  *   process.exit() after an output() call is unreachable.
  */
+/**
+ * A missing path or a file where a directory is expected ends in error(), not in the
+ * stack trace walkMarkdownFiles' throw used to print (`doc-lint counts README.md`).
+ * @param {string} targetDir
+ */
+function requireDirectory(targetDir) {
+  let stat = null;
+  try { stat = fs.statSync(targetDir); } catch { /* absent */ }
+  if (!stat) error(`directory not found: ${targetDir}`);
+  if (!stat.isDirectory()) error(`not a directory: ${targetDir} — doc-lint scans a directory of markdown files`);
+}
+
 function cmdDocLint(cwd, dir, opts = {}) {
   const targetDir = path.isAbsolute(dir) ? dir : path.join(cwd, dir);
-  if (!fs.existsSync(targetDir)) {
-    error(`directory not found: ${targetDir}`);
-  }
+  requireDirectory(targetDir);
 
   const schemaPath = opts.schema
     ? (path.isAbsolute(opts.schema) ? opts.schema : path.join(cwd, opts.schema))
@@ -209,7 +219,6 @@ function isCountAllowed(relativePath) {
 // Things that LOOK like counts but are stable identities (allowed everywhere):
 const STABLE_IDENTITIES = [
   /\b5\s+(target\s+)?runtimes\b/i,                          // 5 target runtimes
-  /\b5\s+hooks\b/i,                                          // 5 hooks (named individually)
   /\bLAYER\s+\d+\b/,                                         // architecture layer labels
   /\b5\s+(parallel\s+)?(researchers?|research\s+)/i,         // 5 parallel researchers
   /\b6\s+(parallel\s+)?agents\b/i,                           // 6 parallel agents (codebase mapper)
@@ -218,9 +227,17 @@ const STABLE_IDENTITIES = [
   /\bthree\s+phases\b|\bfour\s+phases\b/i,                   // generic phase counts in narrative
 ];
 
-function isStableIdentity(matchText, surrounding) {
+function isStableIdentity(matchText, surrounding, matchIndex = 0) {
   for (const re of STABLE_IDENTITIES) {
-    if (re.test(matchText) || re.test(surrounding)) return true;
+    if (re.test(matchText)) return true;
+    // Only an identity that overlaps the count excuses it ("LAYER 6 modules"). One
+    // elsewhere on the line excused every count there: "52 commands on all 5 runtimes".
+    const all = new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
+    let s;
+    while ((s = all.exec(surrounding)) !== null) {
+      if (s.index < matchIndex + matchText.length && matchIndex < s.index + s[0].length) return true;
+      if (s[0].length === 0) all.lastIndex++;
+    }
   }
   return false;
 }
@@ -233,9 +250,7 @@ function isStableIdentity(matchText, surrounding) {
  */
 function cmdDocLintCounts(cwd, dir, opts = {}) {
   const targetDir = path.isAbsolute(dir) ? dir : path.join(cwd, dir);
-  if (!fs.existsSync(targetDir)) {
-    error(`directory not found: ${targetDir}`);
-  }
+  requireDirectory(targetDir);
 
   const exclude = opts.exclude || [];
   const files = walkMarkdownFiles(targetDir, { exclude });
@@ -260,8 +275,8 @@ function cmdDocLintCounts(cwd, dir, opts = {}) {
         re.lastIndex = 0; // reset for /g
         let m;
         while ((m = re.exec(line)) !== null) {
-          // Skip if this whole line is in a stable-identity surrounding
-          if (isStableIdentity(m[0], line)) continue;
+          // Skip a count that is part of a stable identity
+          if (isStableIdentity(m[0], line, m.index)) continue;
           violations.push({
             file: file.relativePath,
             line: i + 1,
@@ -363,6 +378,10 @@ function scanDocFlags(cwd, opts = {}) {
 }
 
 function cmdDocLintFlags(cwd, opts = {}, raw) {
+  for (const d of opts.docDirs || []) {
+    const abs = path.isAbsolute(d) ? d : path.join(cwd, d);
+    if (fs.existsSync(abs)) requireDirectory(abs);
+  }
   const r = scanDocFlags(cwd, opts);
   if (raw) {
     if (r.violation_count === 0) {

package/pan-wizard-core/bin/lib/findings.cjs

@@ -16,11 +16,14 @@
  *     again (a regression);
  *   - with no disposition, a finding is `open`.
  *
- * Two rules are applied when a verdict is recorded:
- *   - AUTO-FIX: the same agent's earlier open findings on the phase that the new
- *     verdict does not report become `fixed`. That is how a gap-closure round
- *     closes its gaps. `human` and `unrequested` are exempt, because a re-run does
- *     not re-check them.
+ * Rules applied when a verdict is recorded:
+ *   - EVIDENCE CLOSES, SILENCE DOES NOT (V6): an earlier open finding closes only when
+ *     the judge answers it `resolved` with evidence (a `resolutions` entry, or the
+ *     verifier's `re_verification.gaps_closed`), or, for a `code-fact:<fact>` finding,
+ *     when that fact passes. One the new verdict neither reports nor answers stays
+ *     open and is listed as `unaddressed`. `still_present` counts as a re-report.
+ *   - IDENTITY: a reworded report of an earlier finding (same class family, same
+ *     file, same truth or a similar summary) keeps that finding's id.
  *   - IDEMPOTENCY: recording the same artifact twice is a no-op that returns the
  *     first verdict (record_sig). That is why exec-phase and verify-phase may both
  *     record one verification.md.
@@ -122,6 +125,69 @@ function samePhase(a, b) {
   return V.comparablePhase(a) === V.comparablePhase(b);
 }
 
+// ─── Finding identity across reports (V6) ───────────────────────────────────
+
+/** The file a `where` names, without a line or column suffix. */
+function fileOf(where) {
+  return where ? String(where).replace(/\\/g, '/').replace(/(:\d+){1,2}$/, '').replace(/#L?\d+.*$/, '') : '';
+}
+
+function tokens(s) {
+  return new Set(String(s || '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').split(' ').filter((w) => w.length > 2));
+}
+
+/** Token overlap (Jaccard) of two summaries at or above one half. */
+function similar(a, b) {
+  const A = tokens(a);
+  const B = tokens(b);
+  if (!A.size || !B.size) return false;
+  let both = 0;
+  for (const t of A) if (B.has(t)) both++;
+  return both / (A.size + B.size - both) >= 0.5;
+}
+
+/** The part of a summary before " — " (a verifier gap's truth), lower-cased. */
+const headOf = (s) => String(s || '').split(' — ')[0].trim().toLowerCase();
+/** A verifier gap moves between missing and partial as it is worked on: one family. */
+const familyOf = (c) => (c === 'partial' ? 'missing' : c);
+
+/** Same class family, same file, and the same truth or a similar summary. */
+function sameFinding(e, f) {
+  return familyOf(e.class) === familyOf(f.class) && fileOf(e.where) === fileOf(f.where)
+    && (headOf(e.summary) === headOf(f.summary) || similar(e.summary, f.summary));
+}
+
+/** The earlier finding a judge's resolution answers: by id, else by its truth or summary. */
+function resolutionTarget(mine, r) {
+  if (r.id) return mine.find((f) => f.id === r.id) || null;
+  const head = headOf(r.summary);
+  return mine.find((f) => headOf(f.summary) === head) || mine.find((f) => similar(f.summary, r.summary)) || null;
+}
+
+function truncateReason(s) {
+  return String(s).replace(/\s+/g, ' ').trim().slice(0, REASON_MAX);
+}
+
+/**
+ * How stable a judge's findings are across its reports on one phase (V6): between
+ * consecutive verdicts, how many ids appeared and how many disappeared. A judge whose
+ * findings churn while the code does not change is not measuring the code.
+ */
+function findingsChurn(rows, phase, agent) {
+  const seq = foldFindings(rows).verdicts.filter((v) => v.agent === agent && samePhase(v.phase, phase));
+  let added = 0;
+  let dropped = 0;
+  let union = 0;
+  for (let i = 1; i < seq.length; i++) {
+    const a = new Set(seq[i - 1].finding_ids || []);
+    const b = new Set(seq[i].finding_ids || []);
+    for (const id of b) if (!a.has(id)) added++;
+    for (const id of a) if (!b.has(id)) dropped++;
+    union += new Set([...a, ...b]).size;
+  }
+  return { reports: seq.length, transitions: Math.max(0, seq.length - 1), added, dropped, rate: union ? Math.round(((added + dropped) / union) * 1000) / 1000 : 0 };
+}
+
 /** `.planning/` must exist: the ledger fills a planning tree, it never creates one. */
 function requirePlanningTree(cwd) {
   try { return fs.statSync(planningPath(cwd)).isDirectory(); } catch { return false; }
@@ -163,11 +229,15 @@ function recordVerdict(cwd, input) {
   // `not_checked` (M23): what the judge could not run. A pass with entries here is a
   // pass over less than the whole phase, and the record says so.
   const notChecked = verdict.not_checked || [];
-  const base = { contract: V.VERDICT_CONTRACT, agent, verdict: verdict.verdict, outcome: verdict.outcome, not_checked: notChecked, source_kind: parsed.source_kind, warnings: parsed.warnings };
+  // Two-key verdict (V9): when a code fact lowered the judge's word, the record keeps
+  // both, and `verdict` is the lowered word the workflow branches on.
+  const lowered = Array.isArray(parsed.lowered_by) && parsed.lowered_by.length
+    ? { agent_verdict: verdict.agent_verdict, lowered_by: parsed.lowered_by } : {};
+  const base = { contract: V.VERDICT_CONTRACT, agent, verdict: verdict.verdict, outcome: verdict.outcome, ...lowered, not_checked: notChecked, source_kind: parsed.source_kind, warnings: parsed.warnings };
 
   const dup = fold.verdicts.find((r) => r.record_sig === recordSig && r.agent === agent && samePhase(r.phase, phase));
   if (dup) {
-    return { ...base, recorded: false, duplicate: true, verdict_id: dup.verdict_id, attempt: dup.attempt, phase, findings: (dup.finding_ids || []).length, new: 0, auto_fixed: 0, reopened: 0 };
+    return { ...base, recorded: false, duplicate: true, verdict_id: dup.verdict_id, attempt: dup.attempt, phase, findings: (dup.finding_ids || []).length, new: 0, rematched: 0, resolved: 0, unaddressed: [], reopened: 0 };
   }
 
   const prior = fold.verdicts.filter((r) => r.agent === agent && samePhase(r.phase, phase));
@@ -180,21 +250,52 @@ function recordVerdict(cwd, input) {
   const ids = [];
   const newRows = [];
   const findingRows = [];
+  const mine = [...fold.findings.values()].filter((e) => e.agent === agent && samePhase(e.phase, phase));
+  let rematched = 0;
   for (const f of verdict.findings) {
-    const id = V.findingId(phase, agent, f);
+    let id = V.findingId(phase, agent, f);
+    if (!fold.findings.has(id)) {
+      // A reworded report of an earlier finding keeps that finding's id (V6), so a
+      // rewording is a re-report, not a fix plus a new finding.
+      const earlier = mine.filter((e) => !ids.includes(e.id) && sameFinding(e, f)).sort((a, b) => (a.status === 'open' ? 0 : 1) - (b.status === 'open' ? 0 : 1))[0];
+      if (earlier) { id = earlier.id; rematched++; }
+    }
     if (ids.includes(id)) continue; // the same finding twice in one report is one finding
     ids.push(id);
     if (!fold.findings.has(id)) {
       findingRows.push({ v: LEDGER_V, kind: 'finding', ts, id, verdict_id: verdictId, phase, milestone, agent, class: f.class, severity: f.severity, where: f.where, summary: f.summary });
     }
   }
-  const reopened = ids.filter((id) => fold.findings.has(id) && fold.findings.get(id).status === 'fixed').length;
-  const autoFixRows = [];
-  for (const f of fold.findings.values()) {
-    if (f.agent !== agent || !samePhase(f.phase, phase) || f.status !== 'open') continue;
-    if (ids.includes(f.id) || V.AUTO_FIX_EXEMPT.includes(f.class)) continue;
-    autoFixRows.push({ v: LEDGER_V, kind: 'disposition', ts, id: f.id, disposition: 'fixed', reason: `not reported by ${agent} at attempt ${attempt}`, auto: true, verdict_id: verdictId });
+
+  // Findings close only on evidence (V6). Silence is not evidence: an earlier open
+  // finding the new verdict neither reports nor answers stays open, and the record
+  // lists it as unaddressed. What closes one: the judge's `resolved` answer with its
+  // evidence, or, for a code-fact finding, the fact passing.
+  const resolveRows = [];
+  const closing = new Set();
+  const close = (f, reason) => {
+    if (closing.has(f.id) || ids.includes(f.id) || f.status !== 'open') return;
+    closing.add(f.id);
+    resolveRows.push({ v: LEDGER_V, kind: 'disposition', ts, id: f.id, disposition: 'fixed', reason: truncateReason(reason), auto: true, verdict_id: verdictId });
+  };
+  let contradicted = 0;
+  for (const r of verdict.resolutions || []) {
+    const target = resolutionTarget(mine, r);
+    if (!target) { parsed.warnings.push(`resolution_unmatched: ${r.id || r.summary}`); continue; }
+    if (r.status === 'resolved') {
+      if (ids.includes(target.id)) { contradicted++; continue; }
+      close(target, `resolved by ${agent} at attempt ${attempt}: ${r.evidence}`);
+    } else if (r.status === 'still_present' && !ids.includes(target.id)) {
+      ids.push(target.id); // a re-report: reopens a fixed finding, keeps an open one open
+    }
   }
+  if (contradicted) parsed.warnings.push(`resolution_contradicted: ${contradicted} finding(s) answered resolved but reported again; they stay open`);
+  for (const fact of parsed.facts_ok || []) {
+    for (const f of mine) if (f.where === `code-fact:${fact}`) close(f, `${fact} passed at attempt ${attempt}`);
+  }
+  const reopened = ids.filter((id) => fold.findings.has(id) && fold.findings.get(id).status === 'fixed').length;
+  const unaddressed = mine.filter((f) => f.status === 'open' && !ids.includes(f.id) && !closing.has(f.id)).map((f) => f.id);
+  if (unaddressed.length) parsed.warnings.push(`open_findings_unaddressed: ${unaddressed.length} earlier finding(s) neither reported nor resolved; they stay open`);
 
   const bySeverity = countBy(verdict.findings, 'severity');
   const byClass = countBy(verdict.findings, 'class');
@@ -205,11 +306,14 @@ function recordVerdict(cwd, input) {
   }
   newRows.push({
     v: LEDGER_V, kind: 'verdict', ts, verdict_id: verdictId, record_sig: recordSig, phase, milestone, agent,
-    verdict: verdict.verdict, outcome: verdict.outcome, attempt, source, finding_ids: ids,
+    verdict: verdict.verdict, outcome: verdict.outcome, ...lowered, attempt, source, finding_ids: ids,
     by_severity: bySeverity, by_class: byClass, warnings: parsed.warnings,
     ...(notChecked.length ? { not_checked: notChecked } : {}),
+    // A plan check is bound to the plans it checked (V7): exec-phase compares this
+    // hash with the plans it is about to run.
+    ...(agent === 'pan-plan-checker' ? { plans_sha: require('./verify-plan-set.cjs').plansShaFor(cwd, phase) } : {}),
   });
-  appendRows(cwd, [...findingRows, ...newRows, ...autoFixRows]);
+  appendRows(cwd, [...findingRows, ...newRows, ...resolveRows]);
 
   const category = { pass: 'verdict_passed', fail: 'verdict_failed', needs_human: 'verdict_needs_human' }[verdict.outcome];
   const serious = (bySeverity.critical || 0) + (bySeverity.high || 0) > 0;
@@ -228,13 +332,13 @@ function recordVerdict(cwd, input) {
       category: 'verdict_retry',
       agent,
       phase,
-      description: `${agent} judged phase ${phase} again (attempt ${attempt}): ${previous.outcome} → ${verdict.outcome}, ${autoFixRows.length} earlier finding(s) no longer reported`,
+      description: `${agent} judged phase ${phase} again (attempt ${attempt}): ${previous.outcome} → ${verdict.outcome}, ${resolveRows.length} earlier finding(s) resolved, ${unaddressed.length} unaddressed`,
       impact: 'minor',
-      context: { agent, phase, attempt, previous_outcome: previous.outcome, outcome: verdict.outcome, auto_fixed: autoFixRows.length, reopened, verdict_id: verdictId },
+      context: { agent, phase, attempt, previous_outcome: previous.outcome, outcome: verdict.outcome, resolved: resolveRows.length, unaddressed: unaddressed.length, reopened, verdict_id: verdictId },
     });
   }
 
-  return { ...base, recorded: true, duplicate: false, verdict_id: verdictId, attempt, phase, findings: ids.length, new: findingRows.length, auto_fixed: autoFixRows.length, reopened, ledger: planningRel(FINDINGS_FILE) };
+  return { ...base, recorded: true, duplicate: false, verdict_id: verdictId, attempt, phase, findings: ids.length, new: findingRows.length, rematched, resolved: resolveRows.length, unaddressed, reopened, ledger: planningRel(FINDINGS_FILE) };
 }
 
 /**
@@ -276,6 +380,13 @@ function disposeFindings(cwd, input) {
   return { contract: V.VERDICT_CONTRACT, disposition: as, disposed, skipped };
 }
 
+/**
+ * Milestone versions compare with or without the leading `v`: the ledger stores
+ * `getMilestoneInfo`'s `v1.0`, while milestone-audit names its version `1.0` (its
+ * report is `v{version}-milestone-audit.md`), so `--milestone 1.0` found no debt.
+ */
+const sameMilestone = (a, b) => String(a || '').trim().replace(/^v/i, '') === String(b || '').trim().replace(/^v/i, '');
+
 /** Findings with their folded status, filtered. */
 function listFindings(cwd, filters = {}) {
   const { rows, malformed } = readLedger(cwd);
@@ -285,13 +396,14 @@ function listFindings(cwd, filters = {}) {
   if (filters.agent) list = list.filter((f) => f.agent === filters.agent);
   if (filters.status) list = list.filter((f) => f.status === filters.status);
   if (filters.class) list = list.filter((f) => f.class === filters.class);
-  if (filters.milestone) list = list.filter((f) => f.milestone === filters.milestone);
+  if (filters.milestone) list = list.filter((f) => sameMilestone(f.milestone, filters.milestone));
   const findings = list.map(publicFinding);
   return {
     contract: V.VERDICT_CONTRACT,
     findings,
     counts: { total: findings.length, by_status: countBy(findings, 'status'), by_class: countBy(findings, 'class'), by_severity: countBy(findings, 'severity') },
     verdicts: fold.verdicts.length,
+    ...(filters.phase && filters.agent ? { churn: findingsChurn(rows, filters.phase, filters.agent) } : {}),
     malformed_rows: malformed,
   };
 }
@@ -306,7 +418,7 @@ function findingsDebt(cwd, opts = {}) {
   const fold = foldFindings(rows);
   const byPhase = new Map();
   for (const f of fold.findings.values()) {
-    if (milestone && f.milestone !== milestone) continue;
+    if (milestone && !sameMilestone(f.milestone, milestone)) continue;
     if (f.status !== 'deferred' && f.status !== 'open') continue;
     const key = V.comparablePhase(f.phase);
     if (!byPhase.has(key)) byPhase.set(key, { phase: f.phase, deferred: [], open: [] });
@@ -377,6 +489,8 @@ module.exports = {
   disposeFindings,
   listFindings,
   findingsDebt,
+  findingsChurn,
+  sameFinding,
   findingIdsIn,
   cmdFindingsRecord,
   cmdFindingsDispose,

package/pan-wizard-core/bin/lib/focus.cjs

@@ -22,6 +22,7 @@ const {
 const { extractFrontmatter, extractPriorityEffort } = require('./frontmatter.cjs');
 const { enumerateRoadmapPhases } = require('./roadmap.cjs');
 const { readErrorPatterns } = require('./commands.cjs');
+const { weeklyLimitStop } = require('./cost.cjs');
 const { planningPath, listPhaseDirs, classifyPhaseStatus, filterPlanFiles, filterSummaryFiles, planningRel } = require('./utils.cjs');
 
 // ─── Scan helpers ───────────────────────────────────────────────────────────
@@ -302,10 +303,13 @@ function allocateBudget(items, budget, mode) {
   } else if (mode === 'features') {
     const { picked: mPicked, used: mUsed } = allocatePass(items, budget, { maxPriority: 0, minPriority: 0, track: 'mandatory' });
     addToBatch(mPicked);
-    const featureBudget = Math.floor(budget * FEATURE_RATIO);
+    // The feature/stability split shares what the P0 pass left: splitting the
+    // whole budget again let a batch reach nearly twice the budget.
+    const rest = budget - mUsed;
+    const featureBudget = Math.floor(rest * FEATURE_RATIO);
     const { picked: fPicked, used: fUsed } = allocatePass(items, featureBudget, { minPriority: 3, maxPriority: 5, track: 'feature', exclude: batchIds });
     addToBatch(fPicked);
-    const { picked: sPicked, used: sUsed } = allocatePass(items, budget - featureBudget, { minPriority: 1, maxPriority: 2, track: 'stability', exclude: batchIds });
+    const { picked: sPicked, used: sUsed } = allocatePass(items, rest - featureBudget, { minPriority: 1, maxPriority: 2, track: 'stability', exclude: batchIds });
     addToBatch(sPicked);
     allocated = mUsed + fUsed + sUsed;
   } else {
@@ -920,9 +924,14 @@ function focusAutoUpdate(cwd, raw, getVal) {
   run.totals.tests_current = cycle.tests_after;
   run.status = AUTORUN_STATUSES.IN_PROGRESS;
 
-  const stopReason = determineStopReason(cycle, run);
+  // The host's 7-day usage window (Claude Code subscriptions, read from what PAN's
+  // status line last saw): past cost.weekly_limit_stop_pct the run stops resumable,
+  // so the rest of the window stays the user's. No fresh reading never stops it.
+  const weekly = weeklyLimitStop(cwd);
+  cycle.weekly_limit_used_pct = weekly.seven_day_used_pct;
+  const stopReason = determineStopReason(cycle, run) || (weekly.stop ? 'weekly_limit' : null);
   if (stopReason) {
-    run.status = stopReason === 'regression' ? AUTORUN_STATUSES.STOPPED : AUTORUN_STATUSES.COMPLETED;
+    run.status = stopReason === 'regression' || stopReason === 'weekly_limit' ? AUTORUN_STATUSES.STOPPED : AUTORUN_STATUSES.COMPLETED;
     run.stop_reason = stopReason;
   }