peaks-loop 4.0.46 → 4.0.48

package/dist/services/audit-independent/security-audit-service.d.ts

@@ -8,7 +8,7 @@
  * The service owns:
  *   - 5-state detection of the security-audit runtime
  *     (handoff-missing / template-missing / dispatch-failed / template-malformed / ready)
- *   - Loading + sha256 verification of the prd/handoff.md
+ *   - Loading + sha256 verification of the slice's prd/handoff-<rid>.md
  *   - Loading the project-level security-template.md
  *   - Producing the audit envelope (verdict + violations) to write
  *     to `.peaks/_runtime/<sid>/audit/security-<rid>.md`
@@ -36,7 +36,8 @@
  * 5-state detection result. Mirrors `detectEcc` in `services/code-review/ecc-bridge.ts`.
  *
  *   - `ready`              — handoff + template + project all present
- *   - `handoff-missing`    — `.peaks/_runtime/<sid>/prd/handoff.md` absent
+ *   - `handoff-missing`    — this slice's `.peaks/_runtime/<sid>/prd/handoff-<rid>.md`
+ *                        (or the pre-rid-scoping `prd/handoff.md`) absent
  *   - `template-missing`   — `.peaks/project-scan/security-template.md` absent
  *   - `dispatch-failed`    — parent LLM threw before returning the audit envelope
  *   - `envelope-malformed` — parent LLM returned a value that fails `isSecurityAuditEnvelope`
@@ -107,6 +108,15 @@ export declare function readSecurityTemplate(projectRoot: string): string | null
 export declare function detectSecurityAudit(input: {
     readonly projectRoot: string;
     readonly sessionId: string;
+    /**
+     * The slice whose capsule this run audits. Slice
+     * `2026-09-14-prd-capsule-rid-scoping` put the rid in the capsule's
+     * filename, so a caller that knows it must pass it or the probe resolves
+     * only the pre-rid-scoping bare name. Both callers pass it:
+     * `runSecurityAudit` always did, and `peaks security-audit detect` forwards
+     * its long-standing `--rid` flag as of the post-verification repair round.
+     */
+    readonly requestId?: string;
     readonly dispatchError?: unknown;
     readonly envelope?: unknown;
 }): SecurityAuditDetectResult;

package/dist/services/audit-independent/security-audit-service.js

@@ -8,7 +8,7 @@
  * The service owns:
  *   - 5-state detection of the security-audit runtime
  *     (handoff-missing / template-missing / dispatch-failed / template-malformed / ready)
- *   - Loading + sha256 verification of the prd/handoff.md
+ *   - Loading + sha256 verification of the slice's prd/handoff-<rid>.md
  *   - Loading the project-level security-template.md
  *   - Producing the audit envelope (verdict + violations) to write
  *     to `.peaks/_runtime/<sid>/audit/security-<rid>.md`
@@ -35,6 +35,8 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, resolve, isAbsolute } from 'node:path';
 import { createHash } from 'node:crypto';
+import { REQUEST_ID_PATTERN } from '../artifacts/request-artifact-service.js';
+import { resolveHandoffPath } from '../prd/handoff-service.js';
 /**
  * Validate a raw value as a SecurityAuditEnvelope. Mirrors the
  * `isEccEnvelope` strict-shape pattern.
@@ -145,8 +147,12 @@ export function readSecurityTemplate(projectRoot) {
 export function detectSecurityAudit(input) {
     const warnings = [];
     const nextActions = [];
-    const handoffPath = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'prd', 'handoff.md');
-    const handoffPresent = existsSync(handoffPath);
+    const handoffPath = resolveHandoffPath({
+        projectRoot: input.projectRoot,
+        sessionId: input.sessionId,
+        ...(input.requestId !== undefined ? { requestId: input.requestId } : {})
+    });
+    const handoffPresent = handoffPath !== null;
     const templatePath = join(input.projectRoot, '.peaks', 'project-scan', 'security-template.md');
     const templatePresent = existsSync(templatePath);
     if (!handoffPresent) {
@@ -154,7 +160,12 @@ export function detectSecurityAudit(input) {
             state: 'handoff-missing',
             handoffPresent: false,
             templatePresent,
-            warnings: [`peaks-prd handoff not found at ${handoffPath}`],
+            warnings: [
+                `peaks-prd handoff not found under ${join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'prd')}`,
+                ...(input.requestId === undefined
+                    ? ['No --rid was supplied, so only the pre-rid-scoping `prd/handoff.md` could be probed. Pass --rid to resolve this slice\'s `prd/handoff-<rid>.md`.']
+                    : [])
+            ],
             nextActions: [
                 'Run peaks-prd handoff init to produce a sha256-locked handoff before running peaks security-audit.',
                 'Until the handoff exists, peaks-security-audit cannot start (gate fail).'
@@ -268,6 +279,12 @@ export function renderSecurityAuditArtifact(env, opts) {
  * Returns the absolute path on success.
  */
 export function writeSecurityAuditArtifact(projectRoot, sessionId, rid, body) {
+    // The rid is a filename below, and the write is tmp+rename, so an
+    // unvalidated rid can OVERWRITE an arbitrary `.md` rather than merely create
+    // one. Guarded here (not only at the CLI boundary) so no caller can skip it.
+    if (!REQUEST_ID_PATTERN.test(rid)) {
+        throw new Error(`Invalid request id: ${rid} (expected letters, digits, dots, underscores, or dashes)`);
+    }
     const targetDir = join(projectRoot, '.peaks', '_runtime', sessionId, 'audit');
     mkdirSync(targetDir, { recursive: true });
     const targetPath = join(targetDir, `security-${rid}.md`);
@@ -290,6 +307,7 @@ export function runSecurityAudit(input) {
     const detect = detectSecurityAudit({
         projectRoot: input.projectRoot,
         sessionId: input.sessionId,
+        requestId: input.rid,
         ...(input.dispatchError !== undefined ? { dispatchError: input.dispatchError } : {}),
         ...(input.envelope !== undefined ? { envelope: input.envelope } : {})
     });
@@ -298,8 +316,12 @@ export function runSecurityAudit(input) {
     }
     // detect.state === 'ready' implies input.envelope passed isSecurityAuditEnvelope.
     const env = input.envelope;
-    const handoffPath = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'prd', 'handoff.md');
-    const verified = readAndVerifyHandoff(handoffPath, input.projectRoot);
+    const handoffPath = resolveHandoffPath({
+        projectRoot: input.projectRoot,
+        sessionId: input.sessionId,
+        requestId: input.rid
+    });
+    const verified = handoffPath === null ? null : readAndVerifyHandoff(handoffPath, input.projectRoot);
     const handoffHash = verified?.frontmatter.sha256 ?? 'unknown';
     const rendered = renderSecurityAuditArtifact(env, {
         rid: input.rid,

package/dist/services/capability-guard-runner/contracts/J01.js

@@ -16,7 +16,8 @@ export async function runJ01Contract(ctx) {
         try {
             const stdout = execFileSync('node', [bin, command, input], {
                 cwd: ctx.projectRoot,
-                env: { ...process.env, PEAKS_CALLER_ID: `guard-J01-${ctx.sessionId}` }
+                env: { ...process.env, PEAKS_CALLER_ID: `guard-J01-${ctx.sessionId}` },
+                windowsHide: true
             }).toString('utf8');
             const env = JSON.parse(stdout);
             if (!env.ok) {

package/dist/services/capability-guard-runner/contracts/J02.js

@@ -6,10 +6,10 @@ const STATES = ['spec-locked', 'implemented', 'qa-handoff', 'handed-off'];
 export async function runJ02Contract(ctx, projectRoot = ctx.projectRoot) {
     const bin = join(ctx.projectRoot, 'bin', 'peaks.js');
     const tmp = mkdtempSync(join(tmpdir(), 'cbl-J02-'));
-    const ws = execFileSync('node', [bin, 'workspace', 'init', '--project', tmp, '--json'], { cwd: tmp }).toString('utf8');
+    const ws = execFileSync('node', [bin, 'workspace', 'init', '--project', tmp, '--json'], { cwd: tmp, windowsHide: true }).toString('utf8');
     const { data: { sessionId } } = JSON.parse(ws);
     const rid = '2026-08-03-j02-fixture';
-    const initOut = execFileSync('node', [bin, 'request', 'init', '--role', 'rd', '--id', rid, '--project', tmp, '--session-id', sessionId, '--apply', '--json'], { cwd: tmp }).toString('utf8');
+    const initOut = execFileSync('node', [bin, 'request', 'init', '--role', 'rd', '--id', rid, '--project', tmp, '--session-id', sessionId, '--apply', '--json'], { cwd: tmp, windowsHide: true }).toString('utf8');
     const initEnv = JSON.parse(initOut);
     // `request init` writes the file as `NNN-<id-slug>.md`. The transition CLI accepts
     // the file's basename (without .md) as the requestId. Derive it from data.path.
@@ -19,7 +19,7 @@ export async function runJ02Contract(ctx, projectRoot = ctx.projectRoot) {
     for (const s of STATES) {
         const out = execFileSync('node', [bin, 'request', 'transition', requestId, '--role', 'rd', '--state', s,
             '--project', tmp, '--session-id', sessionId, '--confirm', '--allow-incomplete',
-            '--reason', 'J02 contract fixture', '--json'], { cwd: tmp }).toString('utf8');
+            '--reason', 'J02 contract fixture', '--json'], { cwd: tmp, windowsHide: true }).toString('utf8');
         const env = JSON.parse(out);
         last = env.data.state;
     }

package/dist/services/capability-guard-runner/contracts/J04.js

@@ -10,7 +10,8 @@ export async function runJ04Contract(ctx) {
     try {
         const stdout = execFileSync('node', [bin, 'audit', 'goal', '--help'], {
             cwd: ctx.projectRoot,
-            env: { ...process.env, PEAKS_CALLER_ID: `guard-J04-${ctx.sessionId}` }
+            env: { ...process.env, PEAKS_CALLER_ID: `guard-J04-${ctx.sessionId}` },
+            windowsHide: true
         }).toString('utf8');
         helpOk = stdout.length > 0 && !stdout.includes('unknown command');
     }
@@ -23,7 +24,8 @@ export async function runJ04Contract(ctx) {
         execFileSync('node', [bin, 'audit', 'goal', '--project', tmp, '--json'], {
             cwd: ctx.projectRoot,
             env: { ...process.env, PEAKS_CALLER_ID: `guard-J04-${ctx.sessionId}` },
-            stdio: ['ignore', 'pipe', 'pipe']
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true
         });
     }
     catch (e) {

package/dist/services/capability-guard-runner/contracts/J07.js

@@ -19,7 +19,8 @@ export async function runJ07Contract(ctx) {
         const out = execFileSync('node', [bin, 'test', '--help'], {
             cwd: ctx.projectRoot,
             env: { ...process.env, PEAKS_CALLER_ID: `guard-J07-${ctx.sessionId}` },
-            stdio: ['ignore', 'pipe', 'pipe']
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true
         }).toString('utf8');
         helpOk = out.length > 0 && !out.includes('unknown command');
     }

package/dist/services/code/auto-compact-lifecycle.d.ts

@@ -126,6 +126,12 @@ export declare function summarizeLifecycleError(error: unknown): string;
  *     `afterRatio: 0` there would publish a fabricated number;
  *   - the ratio is still at or above the auto-fire threshold — the
  *     compact has not landed, so the run stays open.
+ *
+ * Returns the settled record, or `null` when nothing settled. Slice
+ * 2026-09-13-auto-compact-trigger-ownership: the caller needs the settled
+ * `afterRatio` to append the "observed compaction point" row that makes the
+ * intent-vs-observed gap readable after a real session. The return value is
+ * telemetry only — callers that ignore it are unaffected.
  */
 export declare function settleOpenLifecycleRun(input: {
     readonly projectRoot: string;
@@ -134,5 +140,128 @@ export declare function settleOpenLifecycleRun(input: {
     readonly source: string;
     readonly autoFireThreshold: number;
     readonly onLifecycleStage?: ((stage: CompactLifecycleStage, record: CompactLifecycleRecord) => void) | undefined;
-}): void;
+}): {
+    readonly runId: string;
+    readonly triggerRatio: number;
+    readonly afterRatio: number;
+} | null;
+/**
+ * rid `2026-09-13-compact-event-settle`: close out an open compact run because
+ * the HARNESS said one completed — `PostCompact` — rather than because a later
+ * probe noticed the ratio had fallen.
+ *
+ * WHY THIS IS A SECOND FUNCTION AND NOT A FLAG ON THE ONE ABOVE. The function
+ * above is defined by two MEASUREMENT gates: it refuses when nothing could be
+ * measured, and refuses when the number it got has not dropped far enough. Both
+ * are correct for a probe, whose ratio is an INFERENCE about whether something
+ * happened. Handed a harness event, both are wrong in the same direction —
+ * the harness has already stated that the compaction happened, so a probe that
+ * could not measure, or measured something larger, contradicts nothing. The
+ * event is the evidence; the ratio is a consequence.
+ *
+ * What survives from the probe path is the ATTRIBUTION gate, and only that:
+ * there must be an open run (`compacting` / `armed`) for this event to be
+ * about. A `PostCompact` on a session where peaks-loop never dispatched has
+ * nothing to settle — objectively, the run the event would complete does not
+ * exist. (`queued` / `preparing` are excluded for the probe path's reason: a
+ * run that died before dispatch never had a compaction to complete.)
+ *
+ * `afterRatio` is recorded ONLY when it is a genuine DROP below the ratio the
+ * dispatch was made at. Immediately after a compaction, `readContextPercent`
+ * prefers the statusline file, which may still hold the PRE-compact value; the
+ * one thing this row must not do is launder that stale reading into an
+ * `afterRatio` and publish "the context did not shrink" as a measurement. A
+ * `null` here means "no honest post-compact number was available at the moment
+ * the event fired" — and that is NOT self-healing: the record is left at
+ * `completed` with no number, `computeWindowCalibration` skips `observed` rows
+ * that carry none, and the probe path refuses a run that is no longer open. The
+ * pair is then closed by `fillEventSettledMeasurement` below — but only on the
+ * probes that reach it, which is not all of them: that call sits in the
+ * BELOW-THRESHOLD branch of `runAutoCompact` (`auto-compact-orchestrator.ts:567`
+ * guards it, `:589` calls it). A probe that instead commits to compacting does
+ * not merely defer the measurement: `advance('queued')` writes a fresh run to
+ * the same one-record-per-session store (`auto-compact-orchestrator.ts:668`), so
+ * the `completed`-without-`afterRatio` record this pair was owed is gone and the
+ * pair stays unmeasured. That loss is inherent rather than an oversight — once a
+ * second compaction has happened, no later ratio can be attributed to the first,
+ * so there is nothing honest left to fill — and it is visible as `unmeasured` in
+ * `peaks compact history` (QA residual R9). A fabricated number is not
+ * recoverable at all, which is why the stale reading is dropped rather than
+ * corrected.
+ *
+ * `verifying` is deliberately NOT emitted: its documented meaning is "we hold a
+ * measurement and are checking it", and on this path there may be no
+ * measurement at all. Emitting it would move the same untruth from the history
+ * row into the lifecycle record.
+ *
+ * Returns the settled facts, or `null` when there was nothing to settle. `null`
+ * means exactly ONE thing here — there was no OPEN run for this event to be
+ * about. A run that was open but whose record could not be written is not
+ * `null`: it returns the facts read off that run with `lifecycleWritten: false`,
+ * because a failed write is not an absent run, and a caller that cannot tell the
+ * two apart ends up telling the user a falsehood (see `compact-event-settle.ts`).
+ */
+export declare function settleOpenLifecycleRunOnCompactEvent(input: {
+    readonly projectRoot: string;
+    readonly sessionId: string;
+    readonly measuredRatio: number | null;
+    readonly onLifecycleStage?: ((stage: CompactLifecycleStage, record: CompactLifecycleRecord) => void) | undefined;
+    /** Failure injection for the write below — the seam `CompactLifecyclePublisher` already takes. */
+    readonly failLifecycleWrite?: boolean | undefined;
+}): {
+    readonly runId: string;
+    readonly triggerRatio: number;
+    readonly afterRatio: number | null;
+    /**
+     * `false` when the run could not be marked settled — `writeCompactLifecycle`
+     * threw. The three facts above were read off the OPEN run, so they stay true
+     * and a caller may still record the observation; what it must not do is report
+     * the run as settled. `settleOpenLifecycleRun` above does not suppress its
+     * returned record on a failed write either, so the two now agree that a write
+     * failure is not "nothing happened". This field exists because this function's
+     * caller, unlike the sibling's, renders a sentence about the outcome.
+     */
+    readonly lifecycleWritten: boolean;
+} | null;
+/**
+ * rid `2026-09-13-compact-event-settle` (repair R1): supply the measurement a
+ * harness-settled run was left owing.
+ *
+ * The function above deliberately refuses to launder a post-compact reading
+ * that has not dropped — and right after a compaction that refusal is the
+ * NORMAL case, because the statusline still holds the pre-compact value. The
+ * run is then closed at `completed` with no `afterRatio`, so the dispatch's
+ * calibration pair never closes and "intent vs observed" stays blank for
+ * exactly the compactions this slice exists to witness. This function is what
+ * makes the function above's promise payable.
+ *
+ * WHY NOT WIDEN `settleOpenLifecycleRun`. That one re-emits `verifying` before
+ * `completed`, which on an already-`completed` record is a backwards stage
+ * transition with no observer to serve. This is not a settlement — the run IS
+ * settled; only the number is owed. So no stage is rewritten here.
+ *
+ * WRITING `afterRatio` ONTO THE RECORD IS THE IDEMPOTENCE TOKEN: every later
+ * probe finds it present and returns `null`, so however many probes follow, one
+ * compaction yields exactly one late measurement.
+ *
+ * THE DROP GATE IS THE EVENT PATH'S OWN (`measuredRatio < triggerRatio`), not
+ * the probe path's `autoFireThreshold`. `afterRatio` has to mean "below the
+ * ratio this run was dispatched at" — the rule the event path already enforces
+ * — or a run dispatched under the threshold (a forced or banded dispatch) would
+ * let a NON-drop through the one path that can still write a `completed` record.
+ * `conservative-fallback` is refused for the probe path's reason: its `0` is
+ * the absence of a measurement, not an empty context.
+ *
+ * Returns the filled record, or `null` when no run is owed a measurement.
+ */
+export declare function fillEventSettledMeasurement(input: {
+    readonly projectRoot: string;
+    readonly sessionId: string;
+    readonly measuredRatio: number;
+    readonly source: string;
+}): {
+    readonly runId: string;
+    readonly triggerRatio: number;
+    readonly afterRatio: number;
+} | null;
 export {};

package/dist/services/code/auto-compact-lifecycle.js

@@ -214,28 +214,34 @@ export function summarizeLifecycleError(error) {
  *     `afterRatio: 0` there would publish a fabricated number;
  *   - the ratio is still at or above the auto-fire threshold — the
  *     compact has not landed, so the run stays open.
+ *
+ * Returns the settled record, or `null` when nothing settled. Slice
+ * 2026-09-13-auto-compact-trigger-ownership: the caller needs the settled
+ * `afterRatio` to append the "observed compaction point" row that makes the
+ * intent-vs-observed gap readable after a real session. The return value is
+ * telemetry only — callers that ignore it are unaffected.
  */
 export function settleOpenLifecycleRun(input) {
     // A `conservative-fallback` probe means no signal was available at
     // all. Its `ratio: 0` is the absence of a measurement, so it can
     // never be evidence that the context shrank.
     if (input.source === 'conservative-fallback')
-        return;
+        return null;
     if (input.measuredRatio >= input.autoFireThreshold)
-        return;
+        return null;
     const prior = readOpenCompactLifecycle({
         projectRoot: input.projectRoot,
         sessionId: input.sessionId
     });
     if (prior === null)
-        return;
+        return null;
     // Only a run that was actually dispatched can be completed by a
     // post-compact measurement. Both `compacting` (the in-band trigger is
     // satisfied) and `armed` (a trigger was registered and could fire at
     // any time) qualify: the measured drop is proof that SOME compact
     // landed, and this is the only open run to attribute it to.
     if (prior.stage !== 'compacting' && prior.stage !== 'armed')
-        return;
+        return null;
     const emit = (stage, withAfterRatio) => {
         const record = {
             schemaVersion: 1,
@@ -267,4 +273,174 @@ export function settleOpenLifecycleRun(input) {
     emit('verifying', false);
     // `completed` = the measurement confirms the drop; publish it.
     emit('completed', true);
+    return { runId: prior.runId, triggerRatio: prior.triggerRatio, afterRatio: input.measuredRatio };
+}
+/**
+ * rid `2026-09-13-compact-event-settle`: close out an open compact run because
+ * the HARNESS said one completed — `PostCompact` — rather than because a later
+ * probe noticed the ratio had fallen.
+ *
+ * WHY THIS IS A SECOND FUNCTION AND NOT A FLAG ON THE ONE ABOVE. The function
+ * above is defined by two MEASUREMENT gates: it refuses when nothing could be
+ * measured, and refuses when the number it got has not dropped far enough. Both
+ * are correct for a probe, whose ratio is an INFERENCE about whether something
+ * happened. Handed a harness event, both are wrong in the same direction —
+ * the harness has already stated that the compaction happened, so a probe that
+ * could not measure, or measured something larger, contradicts nothing. The
+ * event is the evidence; the ratio is a consequence.
+ *
+ * What survives from the probe path is the ATTRIBUTION gate, and only that:
+ * there must be an open run (`compacting` / `armed`) for this event to be
+ * about. A `PostCompact` on a session where peaks-loop never dispatched has
+ * nothing to settle — objectively, the run the event would complete does not
+ * exist. (`queued` / `preparing` are excluded for the probe path's reason: a
+ * run that died before dispatch never had a compaction to complete.)
+ *
+ * `afterRatio` is recorded ONLY when it is a genuine DROP below the ratio the
+ * dispatch was made at. Immediately after a compaction, `readContextPercent`
+ * prefers the statusline file, which may still hold the PRE-compact value; the
+ * one thing this row must not do is launder that stale reading into an
+ * `afterRatio` and publish "the context did not shrink" as a measurement. A
+ * `null` here means "no honest post-compact number was available at the moment
+ * the event fired" — and that is NOT self-healing: the record is left at
+ * `completed` with no number, `computeWindowCalibration` skips `observed` rows
+ * that carry none, and the probe path refuses a run that is no longer open. The
+ * pair is then closed by `fillEventSettledMeasurement` below — but only on the
+ * probes that reach it, which is not all of them: that call sits in the
+ * BELOW-THRESHOLD branch of `runAutoCompact` (`auto-compact-orchestrator.ts:567`
+ * guards it, `:589` calls it). A probe that instead commits to compacting does
+ * not merely defer the measurement: `advance('queued')` writes a fresh run to
+ * the same one-record-per-session store (`auto-compact-orchestrator.ts:668`), so
+ * the `completed`-without-`afterRatio` record this pair was owed is gone and the
+ * pair stays unmeasured. That loss is inherent rather than an oversight — once a
+ * second compaction has happened, no later ratio can be attributed to the first,
+ * so there is nothing honest left to fill — and it is visible as `unmeasured` in
+ * `peaks compact history` (QA residual R9). A fabricated number is not
+ * recoverable at all, which is why the stale reading is dropped rather than
+ * corrected.
+ *
+ * `verifying` is deliberately NOT emitted: its documented meaning is "we hold a
+ * measurement and are checking it", and on this path there may be no
+ * measurement at all. Emitting it would move the same untruth from the history
+ * row into the lifecycle record.
+ *
+ * Returns the settled facts, or `null` when there was nothing to settle. `null`
+ * means exactly ONE thing here — there was no OPEN run for this event to be
+ * about. A run that was open but whose record could not be written is not
+ * `null`: it returns the facts read off that run with `lifecycleWritten: false`,
+ * because a failed write is not an absent run, and a caller that cannot tell the
+ * two apart ends up telling the user a falsehood (see `compact-event-settle.ts`).
+ */
+export function settleOpenLifecycleRunOnCompactEvent(input) {
+    const prior = readOpenCompactLifecycle({
+        projectRoot: input.projectRoot,
+        sessionId: input.sessionId
+    });
+    if (prior === null)
+        return null;
+    if (prior.stage !== 'compacting' && prior.stage !== 'armed')
+        return null;
+    const afterRatio = input.measuredRatio !== null && input.measuredRatio < prior.triggerRatio ? input.measuredRatio : null;
+    const record = {
+        schemaVersion: 1,
+        runId: prior.runId,
+        stage: 'completed',
+        updatedAt: new Date().toISOString(),
+        triggerRatio: prior.triggerRatio,
+        redLine: prior.redLine,
+        ...(afterRatio !== null ? { afterRatio } : {})
+    };
+    const facts = { runId: prior.runId, triggerRatio: prior.triggerRatio, afterRatio };
+    try {
+        if (input.failLifecycleWrite)
+            throw new Error('lifecycle store unavailable');
+        writeCompactLifecycle({
+            projectRoot: input.projectRoot,
+            sessionId: input.sessionId,
+            record
+        });
+    }
+    catch {
+        // Deliberately NOT `null`. The run WAS open and the write FAILED; returning
+        // the same value as "no run is open" is the conflation the repo's own lint
+        // names at this exact line (`catch-return-null — caller cannot distinguish
+        // failure from success`), and it reached the user as "No compact run was
+        // open", which is false.
+        return { ...facts, lifecycleWritten: false };
+    }
+    try {
+        input.onLifecycleStage?.('completed', record);
+    }
+    catch {
+        // Observer failures are not ours to propagate.
+    }
+    return { ...facts, lifecycleWritten: true };
+}
+/**
+ * rid `2026-09-13-compact-event-settle` (repair R1): supply the measurement a
+ * harness-settled run was left owing.
+ *
+ * The function above deliberately refuses to launder a post-compact reading
+ * that has not dropped — and right after a compaction that refusal is the
+ * NORMAL case, because the statusline still holds the pre-compact value. The
+ * run is then closed at `completed` with no `afterRatio`, so the dispatch's
+ * calibration pair never closes and "intent vs observed" stays blank for
+ * exactly the compactions this slice exists to witness. This function is what
+ * makes the function above's promise payable.
+ *
+ * WHY NOT WIDEN `settleOpenLifecycleRun`. That one re-emits `verifying` before
+ * `completed`, which on an already-`completed` record is a backwards stage
+ * transition with no observer to serve. This is not a settlement — the run IS
+ * settled; only the number is owed. So no stage is rewritten here.
+ *
+ * WRITING `afterRatio` ONTO THE RECORD IS THE IDEMPOTENCE TOKEN: every later
+ * probe finds it present and returns `null`, so however many probes follow, one
+ * compaction yields exactly one late measurement.
+ *
+ * THE DROP GATE IS THE EVENT PATH'S OWN (`measuredRatio < triggerRatio`), not
+ * the probe path's `autoFireThreshold`. `afterRatio` has to mean "below the
+ * ratio this run was dispatched at" — the rule the event path already enforces
+ * — or a run dispatched under the threshold (a forced or banded dispatch) would
+ * let a NON-drop through the one path that can still write a `completed` record.
+ * `conservative-fallback` is refused for the probe path's reason: its `0` is
+ * the absence of a measurement, not an empty context.
+ *
+ * Returns the filled record, or `null` when no run is owed a measurement.
+ */
+export function fillEventSettledMeasurement(input) {
+    if (input.source === 'conservative-fallback')
+        return null;
+    const prior = readOpenCompactLifecycle({
+        projectRoot: input.projectRoot,
+        sessionId: input.sessionId
+    });
+    if (prior === null)
+        return null;
+    // Exactly one shape is owed a number: the one the EVENT path leaves behind.
+    // `settleOpenLifecycleRun` never writes it (it always carries `afterRatio`),
+    // and a `failed` run never dispatched, so it has no row to pair with.
+    if (prior.stage !== 'completed' || prior.afterRatio !== undefined)
+        return null;
+    if (input.measuredRatio >= prior.triggerRatio)
+        return null;
+    const record = {
+        schemaVersion: 1,
+        runId: prior.runId,
+        stage: 'completed',
+        updatedAt: new Date().toISOString(),
+        triggerRatio: prior.triggerRatio,
+        redLine: prior.redLine,
+        afterRatio: input.measuredRatio
+    };
+    try {
+        writeCompactLifecycle({
+            projectRoot: input.projectRoot,
+            sessionId: input.sessionId,
+            record
+        });
+    }
+    catch {
+        return null;
+    }
+    return { runId: prior.runId, triggerRatio: prior.triggerRatio, afterRatio: input.measuredRatio };
 }

package/dist/services/code/auto-compact-orchestrator.d.ts

@@ -31,7 +31,21 @@ export interface AutoCompactInput {
      * autonomously at 0.85+ with zero human / zero LLM intervention.
      */
     readonly force?: boolean | undefined;
-    /** Skip the 95% red-line gate (test seam — never true in production). */
+    /**
+     * INERT — nothing reads this. It is threaded from the CLI's
+     * `--bypass-red-line` (a published flag, kept for backward compatibility;
+     * see the option's own note) down to `evaluateAutoCompactDecision`, where the
+     * red-line branch ignores it.
+     *
+     * Why nothing reads it any more: it used to skip a gate that refused to
+     * dispatch below 0.85. That gate was removed (slice
+     * 2026-09-13-auto-compact-trigger-ownership, T3/A1) — peaks-loop cannot
+     * compact a running session, so the refusal could not shorten the wait it
+     * was waiting for, and it deadlocked the runner at the worst moment. With the
+     * gate gone, the red line still ASKS the harness to compact (when it always
+     * did) and no longer needs a bypass. Kept as a field so the published
+     * signature does not change under callers that pass it.
+     */
     readonly bypassRedLine?: boolean | undefined;
     /** Current session id (default = resolve via session-id-service). */
     readonly sessionId?: string | undefined;
@@ -93,7 +107,7 @@ export interface AutoCompactTestHooks {
  *
  *   - ratio < preCompact → 'none' or 'soft-warn'
  *   - ratio ≥ preCompact → 'pre-compact' (async-friendly path)
- *   - ratio ≥ redLine    → 'red-line' (synchronous gate)
+ *   - ratio ≥ redLine    → 'red-line' (ask the harness; dispatch continues)
  *
  * Slice 2026-07-28 (rid-027): `mode` selects the threshold table.
  * Default `'standard'` (0.85/0.95). `'partial'` (0.70/0.85) is used
@@ -109,8 +123,13 @@ export declare function evaluateCompactTrigger(ratio: number, mode?: AutoCompact
  *   - 0.85 ≤ ratio < 0.95    → pre-compact; if in-flight batch
  *                                present, defer (D6.e); else dispatch
  *                                IDE compact asynchronously.
- *   - ratio ≥ 0.95           → red-line; ALWAYS dispatch synchronously
- *                                regardless of in-flight batch.
+ *   - ratio ≥ 0.95           → red-line; ask the harness to compact
+ *                                regardless of in-flight batch. Nothing is
+ *                                gated — dispatch is NOT blocked (slice
+ *                                2026-09-13-auto-compact-trigger-ownership:
+ *                                peaks-loop cannot compact a running session,
+ *                                so a "block" gated nothing and deadlocked the
+ *                                runner).
  */
 export declare function evaluateAutoCompactDecision(input: {
     ratio: number;
@@ -129,6 +148,7 @@ export declare function evaluateAutoCompactDecision(input: {
      */
     inflightBatch?: boolean | InFlightBatchProbe | undefined;
     force?: boolean | undefined;
+    /** Accepted and ignored — see `AutoCompactInput.bypassRedLine`. */
     bypassRedLine?: boolean | undefined;
     mode?: AutoCompactMode | undefined;
     /**
@@ -170,13 +190,14 @@ export declare function buildConvergencePlan(input: {
  *   5. If trigger.kind === 'pre-compact' AND in-flight batch → wait.
  *   6. If trigger.kind === 'pre-compact' → async dispatch (write
  *      checkpoint + IDE compact; orchestrator returns immediately).
- *   7. If trigger.kind === 'red-line' → synchronous gate: refuse
- *      sub-agent dispatch, dispatch IDE compact, mark `redLineGated`.
+ *   7. If trigger.kind === 'red-line' → dispatch the IDE compact, report
+ *      that the harness has been asked and that dispatch continues.
  *
  * The caller (CLI or skill body) handles the actual return — D7's
- * post-compact-detect will pick up the checkpoint on the next turn.
- * For red-line, the caller MUST block further tool calls until the
- * post-compact probe confirms ratio < 0.85.
+ * post-compact-detect will pick up the checkpoint on the next turn. For
+ * red-line, the caller keeps working; it re-probes and, if the ratio is
+ * still rising with no compact from the harness, reports that instead of
+ * stalling.
  */
 export declare function runAutoCompact(input: AutoCompactInput): Promise<AutoCompactResult>;
 /** Re-export for callers that need to surface the trigger shape. */
@@ -200,6 +221,29 @@ export interface CompactHistoryEvent {
     readonly ok: boolean;
     readonly checkpointPath: string;
     readonly dispatchMessage: string;
+    /**
+     * Slice 2026-09-13-auto-compact-trigger-ownership (T4): the calibration
+     * instrument. `windowTokens` is the denominator peaks-loop divided by
+     * (`probe.capacityTokens`), so `beforeRatio * windowTokens` is the exact
+     * TOKEN POINT peaks-loop asked the harness to compact at. That number is
+     * the deliverable — NOT a hand-picked threshold: this slice could not run a
+     * real Claude Code session, so the real trigger point of
+     * `CLAUDE_CODE_AUTO_COMPACT_WINDOW` (documented as a window, observed to
+     * fire near the window's end) has no measured answer yet. Recording the
+     * intent lets the first real session produce one.
+     */
+    readonly windowTokens?: number | null;
+    /** Which layer produced `windowTokens` (see `ContextWindowSource`). */
+    readonly windowSource?: string | null;
+    /**
+     * `dispatch` (default, and the only kind earlier releases wrote) or
+     * `observed` — a row appended when a later probe MEASURED the ratio after
+     * a dispatched compact, proving one landed. The pair is what yields the
+     * intent-vs-observed delta.
+     */
+    readonly kind?: 'dispatch' | 'observed';
+    /** `observed` rows only: the measured post-compact ratio. */
+    readonly afterRatio?: number;
 }
 export declare function appendCompactHistoryEvent(input: {
     readonly projectRoot: string;