peaks-loop 4.0.16 → 4.0.17

package/dist/services/standards/project-context.js

@@ -54,46 +54,83 @@ function majorOf(version) {
     const major = cleaned.split('.')[0];
     return major !== undefined && /^\d+$/.test(major) ? major : undefined;
 }
+const LIBRARY_DETECTORS = [
+    detectAntd,
+    detectMui,
+    detectElementPlus,
+    detectElementUi,
+    detectArco,
+    detectTdesign,
+    detectSemi,
+    detectNextui,
+    detectChakra,
+    detectVant,
+    detectShadcn
+];
 export function detectComponentLibrary(projectRoot, deps) {
-    if ('antd' in deps) {
-        const major = majorOf(deps['antd']);
-        const hasProSuite = '@ant-design/pro-components' in deps || Object.keys(deps).some((d) => d.startsWith('@ant-design/pro-'));
-        return hasProSuite
-            ? { name: 'antd-pro', ...(major !== undefined ? { majorVersion: major } : {}), hasProSuite: true }
-            : { name: 'antd', ...(major !== undefined ? { majorVersion: major } : {}) };
+    for (const detector of LIBRARY_DETECTORS) {
+        const result = detector(deps, projectRoot);
+        if (result !== null)
+            return result;
     }
-    if ('@mui/material' in deps)
-        return { name: 'mui', ...(majorOf(deps['@mui/material']) !== undefined ? { majorVersion: majorOf(deps['@mui/material']) } : {}) };
-    if ('element-plus' in deps)
-        return { name: 'element-plus' };
-    if ('element-ui' in deps)
-        return { name: 'element-ui' };
-    if ('@arco-design/web-react' in deps)
-        return { name: 'arco' };
-    if ('tdesign-react' in deps || 'tdesign-vue-next' in deps)
-        return { name: 'tdesign' };
-    if ('@douyinfe/semi-ui' in deps)
-        return { name: 'semi' };
-    if ('@nextui-org/react' in deps)
-        return { name: 'nextui' };
-    if ('@chakra-ui/react' in deps)
-        return { name: 'chakra' };
-    if ('vant' in deps)
-        return { name: 'vant' };
-    // shadcn / ui is a Tailwind-based component primitive set shipped as
-    // copyable source files under `components/ui/`. It has no top-level
-    // package of its own, so the signal we use is: Tailwind is present
-    // AND at least one of its peer utilities is also present.
-    if (('class-variance-authority' in deps
+    return { name: 'none' };
+}
+function detectAntd(deps, _projectRoot) {
+    if (!('antd' in deps))
+        return null;
+    const major = majorOf(deps['antd']);
+    const hasProSuite = '@ant-design/pro-components' in deps
+        || Object.keys(deps).some((d) => d.startsWith('@ant-design/pro-'));
+    return hasProSuite
+        ? { name: 'antd-pro', ...(major !== undefined ? { majorVersion: major } : {}), hasProSuite: true }
+        : { name: 'antd', ...(major !== undefined ? { majorVersion: major } : {}) };
+}
+function detectMui(deps, _projectRoot) {
+    if (!('@mui/material' in deps))
+        return null;
+    const major = majorOf(deps['@mui/material']);
+    return { name: 'mui', ...(major !== undefined ? { majorVersion: major } : {}) };
+}
+function detectElementPlus(deps, _projectRoot) {
+    return 'element-plus' in deps ? { name: 'element-plus' } : null;
+}
+function detectElementUi(deps, _projectRoot) {
+    return 'element-ui' in deps ? { name: 'element-ui' } : null;
+}
+function detectArco(deps, _projectRoot) {
+    return '@arco-design/web-react' in deps ? { name: 'arco' } : null;
+}
+function detectTdesign(deps, _projectRoot) {
+    return ('tdesign-react' in deps || 'tdesign-vue-next' in deps) ? { name: 'tdesign' } : null;
+}
+function detectSemi(deps, _projectRoot) {
+    return '@douyinfe/semi-ui' in deps ? { name: 'semi' } : null;
+}
+function detectNextui(deps, _projectRoot) {
+    return '@nextui-org/react' in deps ? { name: 'nextui' } : null;
+}
+function detectChakra(deps, _projectRoot) {
+    return '@chakra-ui/react' in deps ? { name: 'chakra' } : null;
+}
+function detectVant(deps, _projectRoot) {
+    return 'vant' in deps ? { name: 'vant' } : null;
+}
+/** shadcn / ui is a Tailwind-based component primitive set shipped as
+ *  copyable source files under `components/ui/`. It has no top-level
+ *  package of its own, so the signal we use is: at least one of its
+ *  peer utilities (cva, clsx, tailwind-merge, lucide-react) is present
+ *  AND Tailwind is present (either as a dep or via a components/ui dir). */
+function detectShadcn(deps, projectRoot) {
+    const hasPeerUtility = 'class-variance-authority' in deps
         || 'clsx' in deps
         || 'tailwind-merge' in deps
-        || 'lucide-react' in deps)
-        && ('tailwindcss' in deps
-            || existsSync(join(projectRoot, 'components', 'ui'))
-            || existsSync(join(projectRoot, 'src', 'components', 'ui')))) {
-        return { name: 'shadcn' };
-    }
-    return { name: 'none' };
+        || 'lucide-react' in deps;
+    if (!hasPeerUtility)
+        return null;
+    const hasTailwind = 'tailwindcss' in deps
+        || existsSync(join(projectRoot, 'components', 'ui'))
+        || existsSync(join(projectRoot, 'src', 'components', 'ui'));
+    return hasTailwind ? { name: 'shadcn' } : null;
 }
 function detectCssFrameworks(projectRoot, deps) {
     const frameworks = [];
@@ -166,6 +203,11 @@ function detectDataFetching(deps) {
 }
 function detectLegacySignals(projectRoot, deps) {
     const signals = [];
+    collectPackageLegacySignals(deps, signals);
+    collectSourceFileLegacySignals(projectRoot, signals);
+    return signals;
+}
+function collectPackageLegacySignals(deps, signals) {
     if ('moment' in deps)
         signals.push('`moment` in deps — prefer `dayjs` or `date-fns` for new code');
     if (Object.keys(deps).some((d) => d.startsWith('enzyme')))
@@ -180,59 +222,53 @@ function detectLegacySignals(projectRoot, deps) {
         signals.push('Backbone — legacy; do not add new Backbone code');
     if (deps['vue']?.startsWith('2') === true)
         signals.push('Vue 2 — preserve Options API for existing components');
-    // Lightweight heuristic for class components and inline styles in src/
+}
+function collectSourceFileLegacySignals(projectRoot, signals) {
     const srcRoot = join(projectRoot, 'src');
-    if (existsSync(srcRoot)) {
-        const sample = sampleSourceFiles(srcRoot, 80);
-        let classComponentHits = 0;
-        let inlineStyleHits = 0;
-        for (const filePath of sample) {
-            try {
-                const content = readFileSync(filePath, 'utf8');
-                if (/extends\s+(?:React\.)?Component\b/.test(content))
-                    classComponentHits += 1;
-                const matches = content.match(/style=\{\{/g);
-                if (matches !== null)
-                    inlineStyleHits += matches.length;
-            }
-            catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-                // ignore unreadable files
-            }
+    if (!existsSync(srcRoot))
+        return;
+    const sample = sampleSourceFiles(srcRoot, 80);
+    const { classComponentHits, inlineStyleHits } = scanSampleForLegacyMarkers(sample);
+    if (classComponentHits >= 1)
+        signals.push(`React class components detected (${classComponentHits}+ files) — keep class style for existing modules, use function components + hooks for new code`);
+    if (inlineStyleHits >= 50)
+        signals.push(`Inline styles dominant (${inlineStyleHits}+ occurrences) — match existing styling for new code in same modules`);
+}
+function scanSampleForLegacyMarkers(sample) {
+    let classComponentHits = 0;
+    let inlineStyleHits = 0;
+    for (const filePath of sample) {
+        try {
+            const content = readFileSync(filePath, 'utf8');
+            if (/extends\s+(?:React\.)?Component\b/.test(content))
+                classComponentHits += 1;
+            const matches = content.match(/style=\{\{/g);
+            if (matches !== null)
+                inlineStyleHits += matches.length;
+        }
+        catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+            // ignore unreadable files
         }
-        if (classComponentHits >= 1)
-            signals.push(`React class components detected (${classComponentHits}+ files) — keep class style for existing modules, use function components + hooks for new code`);
-        if (inlineStyleHits >= 50)
-            signals.push(`Inline styles dominant (${inlineStyleHits}+ occurrences) — match existing styling for new code in same modules`);
     }
-    return signals;
+    return { classComponentHits, inlineStyleHits };
 }
 function sampleSourceFiles(root, limit) {
     const out = [];
     const queue = [root];
     while (queue.length > 0 && out.length < limit) {
         const dir = queue.shift();
-        let entries;
-        try {
-            entries = readdirSync(dir);
-        }
-        catch {
-            continue;
-        }
+        const entries = readDirOrEmpty(dir);
         for (const entry of entries) {
-            if (entry.startsWith('.') || entry === 'node_modules' || entry === 'dist' || entry === 'build')
+            if (isIgnoredEntry(entry))
                 continue;
             const full = join(dir, entry);
-            let s;
-            try {
-                s = statSync(full);
-            }
-            catch {
+            const s = statOrNull(full);
+            if (s === null || s === undefined)
                 continue;
-            }
             if (s.isDirectory()) {
                 queue.push(full);
             }
-            else if (/\.(tsx|jsx)$/.test(entry)) {
+            else if (isJsxFile(entry)) {
                 out.push(full);
                 if (out.length >= limit)
                     break;
@@ -241,6 +277,32 @@ function sampleSourceFiles(root, limit) {
     }
     return out;
 }
+function readDirOrEmpty(dir) {
+    try {
+        return readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+}
+function statOrNull(path) {
+    try {
+        return statSync(path);
+    }
+    catch {
+        return null;
+    }
+}
+function isIgnoredEntry(entry) {
+    if (entry.startsWith('.'))
+        return true;
+    if (entry === 'node_modules' || entry === 'dist' || entry === 'build')
+        return true;
+    return false;
+}
+function isJsxFile(entry) {
+    return /\.(tsx|jsx)$/.test(entry);
+}
 function notableDepsList(deps) {
     const interesting = ['monaco-editor', '@monaco-editor/react', 'react-querybuilder', '@dnd-kit/core', 'react-dnd', 'echarts', 'recharts', '@ant-design/charts', 'antd-style', 'lodash', 'lodash-es', 'rxjs', 'socket.io-client'];
     return interesting.filter((d) => d in deps);

package/dist/services/verdict/envelopes.d.ts

@@ -23,8 +23,7 @@
  *     "missing → null" contract). Callers can detect "envelope missing"
  *     without throwing.
  */
-import { type SecurityAuditEnvelope } from '../audit-independent/index.js';
-import { type PerfAuditEnvelope } from '../audit-independent/index.js';
+import { type PerfAuditEnvelope, type SecurityAuditEnvelope } from '../audit-independent/index.js';
 import { type KarpathyEnvelope, type MutEnvelope, type QaEnvelope, type AggregatorInput } from './verdict-aggregator.js';
 /**
  * `kind` is the discriminator. The on-disk file format is unchanged;

package/dist/services/verdict/envelopes.js

@@ -23,8 +23,7 @@
  *     "missing → null" contract). Callers can detect "envelope missing"
  *     without throwing.
  */
-import { isSecurityAuditEnvelope } from '../audit-independent/index.js';
-import { isPerfAuditEnvelope } from '../audit-independent/index.js';
+import { isPerfAuditEnvelope, isSecurityAuditEnvelope } from '../audit-independent/index.js';
 // ─── 5 parsers (pure, never throw) ─────────────────────────────────────
 /**
  * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.

package/dist/services/verdict/verdict-aggregator.d.ts

@@ -27,8 +27,7 @@
  *     SecurityAuditEnvelope / PerfAuditEnvelope type re-exports.
  *   - hard precedence; no scoring, no weighting, no RFC voting.
  */
-import type { SecurityAuditEnvelope } from '../audit-independent/index.js';
-import type { PerfAuditEnvelope } from '../audit-independent/index.js';
+import type { PerfAuditEnvelope, SecurityAuditEnvelope } from '../audit-independent/index.js';
 import type { ThresholdViolation } from 'peaks-loop-mut';
 export interface KarpathyViolation {
     readonly guideline: 'think-before-coding' | 'simplicity-first' | 'surgical-changes' | 'goal-driven-execution';

package/dist/services/vm/vm-lease.js

@@ -24,13 +24,24 @@ import { normalizePath } from '../../shared/path-utils.js';
 export const VM_HYPERVISORS = Object.freeze([
     'kvm', 'hyperkit', 'hyperv'
 ]);
+// PRD-002b slice 2 — extract lease-TTL primitives (same shape as
+// container-lease.ts / worktree-lease.ts). See config diff comment.
+const MINUTES_PER_HOUR = 60;
+const MS_PER_MINUTE = MINUTES_PER_HOUR * 1_000;
+const LEASE_RD_TTL_MINUTES = 30;
+const LEASE_QA_TTL_MINUTES = 15;
+const LEASE_UI_TTL_MINUTES = MINUTES_PER_HOUR;
+const LEASE_SC_TTL_MINUTES = 30;
+const LEASE_PRD_TTL_MINUTES = 15;
+const LEASE_GENERAL_TTL_MINUTES = 30;
+const LEASE_ID_RANDOM_BYTES = 8;
 export const DEFAULT_TTL_BY_ROLE = Object.freeze({
-    rd: 30 * 60 * 1_000,
-    qa: 15 * 60 * 1_000,
-    ui: 60 * 60 * 1_000,
-    sc: 30 * 60 * 1_000,
-    prd: 15 * 60 * 1_000,
-    general: 30 * 60 * 1_000
+    rd: LEASE_RD_TTL_MINUTES * MS_PER_MINUTE,
+    qa: LEASE_QA_TTL_MINUTES * MS_PER_MINUTE,
+    ui: LEASE_UI_TTL_MINUTES * MS_PER_MINUTE,
+    sc: LEASE_SC_TTL_MINUTES * MS_PER_MINUTE,
+    prd: LEASE_PRD_TTL_MINUTES * MS_PER_MINUTE,
+    general: LEASE_GENERAL_TTL_MINUTES * MS_PER_MINUTE
 });
 export const DEFAULT_TTL_MS = DEFAULT_TTL_BY_ROLE.rd;
 export const DEFAULT_VM_IMAGE = 'peaks-base:22-slim';
@@ -41,12 +52,12 @@ export function vmLeaseFilePath(sessionRuntimeDir, leaseId) {
     return joinPath(vmLeaseStoreDir(sessionRuntimeDir), `${leaseId}.json`);
 }
 export function generateVmLeaseId() {
-    return randomBytes(8).toString('hex');
+    return randomBytes(LEASE_ID_RANDOM_BYTES).toString('hex');
 }
 export function ttlForVmRole(role) {
     const normalized = role.toLowerCase();
     const candidate = DEFAULT_TTL_BY_ROLE[normalized];
-    const fallback = DEFAULT_TTL_BY_ROLE['rd'] ?? 30 * 60 * 1_000;
+    const fallback = DEFAULT_TTL_BY_ROLE['rd'] ?? LEASE_RD_TTL_MINUTES * MS_PER_MINUTE;
     return candidate ?? fallback;
 }
 export function finalizeVmLease(draft) {

package/dist/services/worktree/worktree-lease.d.ts

@@ -24,16 +24,6 @@
  * implicitly authorizes worktree operations on its path (the hook
  * integration is Part 2 of this slice).
  */
-/**
- * Per-role default TTL. Sub-agent dispatch duration varies by role:
- * - rd (long planning + impl) → 30 min
- * - qa (test design + browser validation) → 15 min
- * - ui (high-fidelity prototype iteration) → 1 h
- * - txt (handoff capsule, no worktree expected) → n/a (no worktree)
- * - general-purpose / unknown → 30 min (rd-like)
- *
- * Users MAY override with `--ttl <duration>` (e.g. `--ttl 4h`).
- */
 export declare const DEFAULT_TTL_BY_ROLE: Readonly<Record<string, number>>;
 export declare const DEFAULT_TTL_MS: number | undefined;
 export type WorktreeLeaseStatus = 'active' | 'released' | 'expired' | 'gc';

package/dist/services/worktree/worktree-lease.js

@@ -37,13 +37,24 @@ import { normalizePath } from '../../shared/path-utils.js';
  *
  * Users MAY override with `--ttl <duration>` (e.g. `--ttl 4h`).
  */
+// PRD-002b slice 2 — extract lease-TTL primitives (same shape as
+// container-lease.ts / vm-lease.ts). See config diff comment.
+const MINUTES_PER_HOUR = 60;
+const MS_PER_MINUTE = MINUTES_PER_HOUR * 1_000;
+const LEASE_RD_TTL_MINUTES = 30;
+const LEASE_QA_TTL_MINUTES = 15;
+const LEASE_UI_TTL_MINUTES = MINUTES_PER_HOUR;
+const LEASE_SC_TTL_MINUTES = 30;
+const LEASE_PRD_TTL_MINUTES = 15;
+const LEASE_GENERAL_TTL_MINUTES = 30;
+const LEASE_ID_RANDOM_BYTES = 8;
 export const DEFAULT_TTL_BY_ROLE = Object.freeze({
-    rd: 30 * 60 * 1_000,
-    qa: 15 * 60 * 1_000,
-    ui: 60 * 60 * 1_000,
-    sc: 30 * 60 * 1_000,
-    prd: 15 * 60 * 1_000,
-    general: 30 * 60 * 1_000
+    rd: LEASE_RD_TTL_MINUTES * MS_PER_MINUTE,
+    qa: LEASE_QA_TTL_MINUTES * MS_PER_MINUTE,
+    ui: LEASE_UI_TTL_MINUTES * MS_PER_MINUTE,
+    sc: LEASE_SC_TTL_MINUTES * MS_PER_MINUTE,
+    prd: LEASE_PRD_TTL_MINUTES * MS_PER_MINUTE,
+    general: LEASE_GENERAL_TTL_MINUTES * MS_PER_MINUTE
 });
 export const DEFAULT_TTL_MS = DEFAULT_TTL_BY_ROLE.rd;
 /**
@@ -76,7 +87,7 @@ export function worktreePath(sessionRuntimeDir, leaseId) {
  * are irrelevant because each session has its own lease directory.
  */
 export function generateLeaseId() {
-    return randomBytes(8).toString('hex');
+    return randomBytes(LEASE_ID_RANDOM_BYTES).toString('hex');
 }
 /**
  * Compute the TTL ms for a role, falling back to DEFAULT_TTL_MS for
@@ -86,7 +97,7 @@ export function generateLeaseId() {
 export function ttlForRole(role) {
     const normalized = role.toLowerCase();
     const candidate = DEFAULT_TTL_BY_ROLE[normalized];
-    const fallback = DEFAULT_TTL_BY_ROLE['rd'] ?? 30 * 60 * 1_000;
+    const fallback = DEFAULT_TTL_BY_ROLE['rd'] ?? LEASE_RD_TTL_MINUTES * MS_PER_MINUTE;
     return candidate ?? fallback;
 }
 /**

package/dist/shared/fs-utils.d.ts

@@ -1,4 +1,4 @@
-import type { Platform } from './platform.js';
+import { type Platform } from './platform.js';
 export declare function getDirectoryLinkType(targetPlatform?: Platform): 'junction' | 'dir';
 export declare function createDirectoryLinkSync(target: string, linkPath: string): void;
 export declare function readDirectoryLinkTarget(linkPath: string): string | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peaks-loop",
-  "version": "4.0.16",
+  "version": "4.0.17",
   "description": "Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration",
   "author": "SquabbyZ",
   "keywords": [
@@ -101,9 +101,9 @@
     "headroom-ai": "0.22.4",
     "yaml": "^2.9.0",
     "zod": "^3.25.76",
-    "peaks-loop-mut": "0.1.19",
-    "peaks-loop-shared-channel": "0.0.23",
-    "peaks-loop-shared": "0.0.47"
+    "peaks-loop-mut": "0.1.20",
+    "peaks-loop-shared-channel": "0.0.24",
+    "peaks-loop-shared": "0.0.48"
   },
   "devDependencies": {
     "@changesets/cli": "2.31.1",
@@ -113,9 +113,12 @@
     "@stryker-mutator/vitest-runner": "^9.6.1",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^22.10.2",
+    "@typescript-eslint/eslint-plugin": "8.66.0",
+    "@typescript-eslint/parser": "8.66.0",
     "@vitest/coverage-istanbul": "^4.1.10",
     "@vitest/coverage-v8": "^4.1.10",
     "c8": "^10.1.3",
+    "eslint": "8.57.1",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2",
     "vite": "^6.0.0",

package/skills/peaks-code/SKILL.md

@@ -44,6 +44,52 @@ This skill is the **primary surface**. The `peaks <cmd>` CLI is **auxiliary**
 
 **Peaks-Loop Code is an orchestrator, NOT an implementer. You MUST NOT write, edit, or modify any application source code directly.** Every code change goes through `peaks-code → RD → QA → verdict`. **If you catch yourself about to write code, STOP.** Hand off to RD. Before declaring workflow complete, run `peaks workflow verify-pipeline --rid <rid> --project <repo> --json`.
 
+### Hard-blocked path families (the orchestrator may NOT directly Edit/Write these)
+
+| Family | Examples |
+|---|---|
+| `src/` | `src/services/foo.ts`, `src/cli/commands/x.ts` |
+| `tests/unit/` | `tests/unit/services/foo.test.ts` |
+| `tests/integration/` | `tests/integration/x.test.ts` |
+| `config/` | `config/peaks.json`, `tsconfig.json` |
+| `bin/` | `bin/peaks.js` |
+| `scripts/` | `scripts/release.sh` |
+
+ANY direct `Edit` / `Write` / `MultiEdit` of these paths from the orchestrator context is a **hard error**. The orchestrator's role is ONLY to dispatch sub-agents; it never owns a code-change tool call against these families.
+
+### Allowed path families (orchestrator may touch freely)
+
+- `.peaks/**` (memory sediment, project metadata, audit logs)
+- `.peaks/_runtime/**` (session-bound reviewable artifacts, gitignored)
+- `skills/**/SKILL.md` and other skill manifest files (orchestrator self-documents)
+- `docs/**` (governance / spec / plan docs)
+
+These families are non-source-code; the orchestrator may `Edit`/`Write` them directly (memory sediment, SKILL.md prose updates, doc snapshots). The PreToolUse hook + the `orchestrator-can-do` probe do NOT block these.
+
+### Code-Gate (slice 2026-08-06-codegate-vendor-neutral)
+
+Two-layer enforcement — do NOT try to bypass either:
+
+1. **LLM-level guard — `peaks code orchestrator-can-do`** (Step 0.51). Before any Edit/Write/MultiEdit tool call, run:
+   ```bash
+   peaks code orchestrator-can-do --slice-spec '<your task>' --json
+   ```
+   For source-code changes (mentioning `src/`, `tests/unit/`, `tests/integration/`, `config/`, `bin/`, `scripts/`) the probe MUST return `canDoInSession: false` with `blockers: ["requires-sub-agent-dispatch"]`. The probe does NOT block non-source slices (memory sediment, docs, SKILL.md updates).
+
+2. **Tool-level guard — `pre-tool-code-gate.sh`** (PreToolUse hook). When the orchestrator reaches for `Edit`/`Write`/`MultiEdit` against a hard-blocked path family, the hook exits 2 with stderr `PEAKS_CODE_PROHIBITED_DIRECT_EDIT: <file>... use 'peaks sub-agent dispatch rd'`. The hook is vendor-neutral — it inspects only the standard `{tool, input}` JSON contract, never env vars.
+
+### If you catch yourself reaching for Edit/Write on `src/**`
+
+STOP. Run:
+
+```bash
+peaks sub-agent dispatch rd --prompt '<your task>' --request-id <rid> --project . --batch-id <uuid> --json
+```
+
+The RD sub-agent owns the actual `Edit`/`Write`/`MultiEdit` tool calls against source code. The orchestrator only emits the dispatch request.
+
+**Anti-pattern:** directly calling `Edit`/`Write`/`MultiEdit` on `src/**` from the orchestrator session because "the change is tiny" / "it's just one line" / "the dispatch overhead is too high" / "the LLM feels confident". None of these override the Code-Gate; the probe + the hook both fail-closed.
+
 ## 24h mode (orchestrator flag, NOT a new skill)
 
 24h mode is a *flag* the orchestrator flips, not a sibling skill. See `.peaks/memory/2026-07-28-peaks-code-loop-skill-proposal.md` for the RL-8 tension analysis. State machine via `peaks session 24h-mode {state,transition,attempts,reset}`; snapshot at `.peaks/_runtime/<sessionId>/24h-state.json` (read-only for peaks-code).