peaks-loop 4.0.47 → 4.0.49

package/dist/services/artifacts/artifact-prerequisites.js

@@ -2,6 +2,7 @@ import { join, dirname, basename } from 'node:path';
 import { readFile, readdir } from 'node:fs/promises';
 import { pathExists } from 'peaks-loop-shared/fs';
 import { emitObservabilityEvent } from '../observability/observability-service.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 export const VALID_REQUEST_TYPES = [
     'feature',
     'bugfix',
@@ -26,8 +27,17 @@ const BUG_ANALYSIS = {
     description: 'Bug root-cause analysis (reproduction, affected paths, fix approach, regression test plan)',
     mustContain: ['## Root cause', '## Fix approach']
 };
+// Slice `2026-09-14-audit-artifact-rid-scoping`: the rid is part of the
+// filename (`code-review-<rid>.md`). A fixed per-session path cannot hold
+// two slices' evidence at once — the second slice's write silently
+// destroyed the first slice's on 2026-09-13, and the gate stayed green
+// because it only checks that *some* file is there, not whose it is.
+// The bare path stays accepted (see `legacyRelativePath`) so sessions
+// written before this change — and any writer still emitting it — keep
+// passing.
 const CODE_REVIEW = {
-    relativePath: 'rd/code-review.md',
+    relativePath: 'rd/code-review-<rid>.md',
+    legacyRelativePath: 'rd/code-review.md',
     description: 'Code review evidence (CRITICAL/HIGH must be fixed before handoff)',
     mustContain: ['## Findings', 'CRITICAL']
 };
@@ -52,23 +62,31 @@ const PERF_BASELINE = {
 // are dispatched as pre-RD audit runs that consume the public PRD
 // handoff (`prd/handoff.md`) — see `AUDIT_REQUIRES_HANDOFF` below.
 //
-// Back-compat: the canonical location is `audit/security.md` (and
-// `audit/perf.md`); the legacy `rd/security-review.md` (and
-// `rd/perf-baseline.md`) path is also accepted via `legacyRelativePath`
-// for the 1-minor-release window. v2.13.0 hard-deletes the legacy paths.
+// Back-compat: the canonical location is `audit/security-<rid>.md`
+// (and `audit/perf-<rid>.md`); the pre-rid-scoping `audit/security.md`
+// (and `audit/perf.md`) plus the older `rd/security-review.md` (and
+// `rd/perf-baseline.md`) are accepted via `legacyRelativePaths`, in
+// that order, for the back-compat window.
 const AUDIT_SECURITY = {
-    relativePath: 'audit/security.md',
-    legacyRelativePath: 'rd/security-review.md',
-    description: 'Independent security audit output (peaks-security-audit skill, v2.12.0+). Replaces the v2.11.x rd/security-review.md slot for fanout-trigger request types. The legacy path is accepted during the 1-minor-release back-compat window via legacyRelativePath.',
+    relativePath: 'audit/security-<rid>.md',
+    // Two legacy tiers behind the rid-scoped path: the pre-rid-scoping
+    // v2.12.0 location, then the v2.11.x one. Both are live on disk.
+    legacyRelativePath: 'audit/security.md',
+    legacyRelativePaths: ['rd/security-review.md'],
+    description: 'Independent security audit output (peaks-security-audit skill, v2.12.0+). Replaces the v2.11.x rd/security-review.md slot for fanout-trigger request types. The rid is part of the filename so two slices in one session do not collide; the bare and rd/-prefixed legacy locations are accepted during the back-compat window via legacyRelativePaths.',
     // New canonical path writes a "## Verdict" header on the audit
     // envelope. The legacy rd/security-review.md writes a "## Findings"
     // header. Both pass the gate.
     mustContainAny: ['## Verdict', '## Findings']
 };
 const AUDIT_PERF = {
-    relativePath: 'audit/perf.md',
-    legacyRelativePath: 'rd/perf-baseline.md',
-    description: 'Independent perf audit output (peaks-perf-audit skill, v2.12.0+). Replaces the v2.11.x rd/perf-baseline.md slot for fanout-trigger request types. The legacy path is accepted during the 1-minor-release back-compat window via legacyRelativePath.',
+    relativePath: 'audit/perf-<rid>.md',
+    // Same two-tier history as AUDIT_SECURITY. This is the pair that
+    // produced the 2026-09-13 evidence: `audit/perf.md` was overwritten by
+    // the second slice and the first slice's audit is unrecoverable.
+    legacyRelativePath: 'audit/perf.md',
+    legacyRelativePaths: ['rd/perf-baseline.md'],
+    description: 'Independent perf audit output (peaks-perf-audit skill, v2.12.0+). Replaces the v2.11.x rd/perf-baseline.md slot for fanout-trigger request types. The rid is part of the filename so two slices in one session do not collide; the bare and rd/-prefixed legacy locations are accepted during the back-compat window via legacyRelativePaths.',
     // New schema writes "## Baseline" header; the legacy schema writes
     // "## Results". Both pass the gate, as does the explicit
     // no-perf-surface stub (slices whose surface is purely logic /
@@ -93,6 +111,16 @@ const AUDIT_PERF = {
 // failure. The hard-fail behavior for `passed: false` is preserved
 // (the body still has to carry `"passed": true` when present).
 // v2.14.0 will remove `backCompat` and re-elevate missing → throw.
+//
+// Slice `2026-09-14-audit-artifact-rid-scoping` deliberately does NOT
+// rid-scope this path, unlike the four audit/review artifacts above. The
+// repo's own producer/reader constant is `mutReportPath()` in
+// `packages/peaks-loop-mut/src/services/mut/report-loader.ts`, which names
+// `mut/mut-report.json`, and `peaks mut run`'s `--out` is supplied by the
+// caller. A `<rid>`-templated requirement here would be a name no producer
+// in the repo can write — a gate that exists only in prose, sitting behind
+// `backCompat: true` so it gates nothing at all. If mut ever gains a
+// rid-scoped producer, the constant and this path move together.
 const MUT_REPORT = {
     relativePath: 'mut/mut-report.json',
     description: 'peaks-mut mutation + weak-assertion report (Plan 2, v2.12.0+). v2.13.1: required at rd:qa-handoff for feature / bugfix / refactor slices. v2.13.2: back-compat window — missing file downgrades to a warning (1-minor-release); passed:false still throws. The body must carry `"passed": true` when present; failed runs are blocked at this gate. CONFIG / DOCS / CHORE slices retain the legacy "no acceptance surface" exemption.',
@@ -105,10 +133,11 @@ const MUT_REPORT = {
     backCompat: true
 };
 // v2.12.0 Group B Tier 5 — gate that the peaks-prd handoff (the
-// immutable handoff capsule at `prd/handoff.md`) exists before any
+// immutable, per-slice handoff capsule at `prd/handoff-<rid>.md`
+// since slice `2026-09-14-prd-capsule-rid-scoping`) exists before any
 // audit skill is allowed to consume it. The peaks-security-audit
-// and peaks-perf-audit CLI commands read frontmatter from
-// `prd/handoff.md` (AC-2.4 / AC-3.4); if the handoff is missing the
+// and peaks-perf-audit CLI commands read frontmatter from the
+// capsule (AC-2.4 / AC-3.4); if the handoff is missing the
 // audit skill aborts — and so should the prereq gate when those
 // audits are required at rd:qa-handoff.
 //
@@ -117,8 +146,21 @@ const MUT_REPORT = {
 // the old form (no PRD handoff chain — config slices may run before
 // PRD handoff exists for small CONFIG-only commits).
 const AUDIT_REQUIRES_HANDOFF = {
-    relativePath: 'prd/handoff.md',
-    description: 'PRD handoff capsule (v2.12.0+) — peaks-security-audit / peaks-perf-audit both read frontmatter from this file. Must exist before audit prereqs are evaluated at rd:qa-handoff.',
+    relativePath: 'prd/handoff-<rid>.md',
+    // Slice `2026-09-14-prd-capsule-rid-scoping`: the rid is part of the
+    // filename, like the four audit/review artifacts above. A single slot per
+    // SESSION cannot hold two slices' capsules — `peaks prd handoff init`
+    // overwrote it on every call, and this gate stayed green because it pinned
+    // only `schemaVersion: 2` + `sha256:`, never WHOSE rid the file named.
+    // Measured on `2026-09-13-session-21878f`: a four-slice job passed this
+    // prerequisite on a capsule written for a different line of work.
+    // The bare path stays accepted (see `legacyRelativePath`) so the three
+    // sessions on disk that hold only `prd/handoff.md` keep passing. That tier
+    // is rid-blind by design — the scoping binds for capsules written from now
+    // on, and every producer (`handoff-service.initHandoff`,
+    // `handoff-auto-regen`, `evidence generate`) writes the rid-scoped name.
+    legacyRelativePath: 'prd/handoff.md',
+    description: 'PRD handoff capsule (v2.12.0+) — peaks-security-audit / peaks-perf-audit both read frontmatter from this file. Must exist before audit prereqs are evaluated at rd:qa-handoff. The rid is part of the filename so two slices in one session do not collide; the bare pre-rid-scoping location is accepted as the legacy tier.',
     // Empty `mustContain` is fine — file existence is the contract.
     // The peaks-prd handoff service writes frontmatter with
     // `schemaVersion: 2` and a sha256 fingerprint; we pin a
@@ -138,7 +180,8 @@ const AUDIT_REQUIRES_HANDOFF = {
 // header remains a substring match (it is the file's own gate header, not
 // a structural section anchor).
 const KARPATHY_REVIEW = {
-    relativePath: 'rd/karpathy-review.md',
+    relativePath: 'rd/karpathy-review-<rid>.md',
+    legacyRelativePath: 'rd/karpathy-review.md',
     description: 'RD-side karpathy review (peaks-rd 5-way fanout) — must contain a "## Karpathy-Gate" header AND the 4 guideline section markers (Think Before Coding / Simplicity First / Surgical Changes / Goal-Driven Execution) as actual markdown headings. Per karpathy §1 / §3.',
     mustContain: ['## Karpathy-Gate'],
     headingMustContain: [
@@ -328,11 +371,71 @@ async function resolvePrerequisiteAbsolutePath(sessionRoot, prerequisite, reques
     const match = entries.find((name) => /^\d+-/.test(name) && name.endsWith(targetSuffix));
     return match ? join(dir, match) : null;
 }
+/**
+ * The contract's BODY checks for one prerequisite, applied to `body`. Returns
+ * one human-readable message per failed check, empty when the body satisfies
+ * the contract.
+ *
+ * Exported because this contract has a SECOND enforcer: `peaks workflow
+ * verify-pipeline` probes the same table for the paths it checks
+ * (`pipeline-verify-gate-support.ts`), and a resolver that probed only
+ * `existsSync` passed files this function rejects — a guard laxer than the
+ * contract it claims to read. Both callers now share this one implementation,
+ * so the checker cannot drift from the table again.
+ */
+export function prerequisiteBodyViolations(prerequisite, body) {
+    const violations = [];
+    const lowered = body.toLowerCase();
+    if (prerequisite.mustContain && prerequisite.mustContain.length > 0) {
+        const missingMarkers = prerequisite.mustContain.filter((marker) => !lowered.includes(marker.toLowerCase()));
+        if (missingMarkers.length > 0) {
+            violations.push(`${prerequisite.description} — missing section(s): ${missingMarkers.join(', ')}`);
+        }
+    }
+    if (prerequisite.headingMustContain && prerequisite.headingMustContain.length > 0) {
+        // Slice 2.6.1.F: a line beginning with `#`, `##`, or `###` followed by
+        // the marker (case-insensitive). Fenced code blocks are NOT excluded
+        // here — a "heading" inside a code fence is rare and, when present,
+        // should still be reported as missing to keep the contract strict.
+        const headingLines = body
+            .split('\n')
+            .map((line) => line.trim())
+            .filter((line) => /^#{1,3}\s+/.test(line));
+        const loweredHeadings = headingLines.map((h) => h.toLowerCase());
+        const missingHeadings = prerequisite.headingMustContain.filter((marker) => !loweredHeadings.some((h) => h.includes(marker.toLowerCase())));
+        if (missingHeadings.length > 0) {
+            violations.push(`${prerequisite.description} — missing heading(s): ${missingHeadings.join(', ')}`);
+        }
+    }
+    if (prerequisite.mustContainAny && prerequisite.mustContainAny.length > 0) {
+        const hitAny = prerequisite.mustContainAny.some((marker) => lowered.includes(marker.toLowerCase()));
+        if (!hitAny) {
+            violations.push(`${prerequisite.description} — none of the escape-hatch markers present: ${prerequisite.mustContainAny.join(', ')}`);
+        }
+    }
+    return violations;
+}
+/** True when `prerequisite` declares any body check at all. Guards the read so
+ *  a prereq with no body contract is never opened (unchanged behaviour). */
+function hasBodyChecks(prerequisite) {
+    return (prerequisite.mustContain?.length ?? 0) > 0
+        || (prerequisite.headingMustContain?.length ?? 0) > 0
+        || (prerequisite.mustContainAny?.length ?? 0) > 0;
+}
 export async function checkPrerequisites(options) {
     const requirements = getPrerequisitesFor(options.role, options.newState, options.requestType);
     if (requirements.length === 0) {
         return { ok: true, missing: [], warnings: [] };
     }
+    // Repair R5. The session id is joined into BOTH roots below and then probed
+    // on disk. `transitionRequestArtifact` is the only caller and it passes
+    // `existing.sessionId`, which pre-R5 was the caller's raw `--session-id`: with
+    // `../../../PWNED-R34` the two joins resolved outside the project root and
+    // the prerequisite probes ran there. Guarded at the sink, not at the caller,
+    // for the same reason `requestArtifactRequestsDir` is.
+    if (options.sessionId !== undefined && isUnsafePathInput(options.sessionId)) {
+        throw new Error(`Invalid session id: ${options.sessionId} (must be a single path segment)`);
+    }
     // Slice 006 simplifies the resolution to a 2-tier fallback. The
     // per-change-id scope (`.peaks/_runtime/<sessionId>/<role>/`) is gone — new
     // artifacts go to the session dir directly. The 2 tiers are:
@@ -369,45 +472,10 @@ export async function checkPrerequisites(options) {
             missing.push({ path: relative, description: prerequisite.description });
             continue;
         }
-        if (prerequisite.mustContain && prerequisite.mustContain.length > 0) {
+        if (hasBodyChecks(prerequisite)) {
             const body = await readFile(absolute, 'utf8');
-            const lowered = body.toLowerCase();
-            const missingMarkers = prerequisite.mustContain.filter((marker) => !lowered.includes(marker.toLowerCase()));
-            if (missingMarkers.length > 0) {
-                missing.push({
-                    path: relative,
-                    description: `${prerequisite.description} — missing section(s): ${missingMarkers.join(', ')}`
-                });
-            }
-        }
-        if (prerequisite.headingMustContain && prerequisite.headingMustContain.length > 0) {
-            const body = await readFile(absolute, 'utf8');
-            // Slice 2.6.1.F: a line beginning with `#`, `##`, or `###` followed by
-            // the marker (case-insensitive). Fenced code blocks are NOT excluded
-            // here — a "heading" inside a code fence is rare and, when present,
-            // should still be reported as missing to keep the contract strict.
-            const headingLines = body
-                .split('\n')
-                .map((line) => line.trim())
-                .filter((line) => /^#{1,3}\s+/.test(line));
-            const loweredHeadings = headingLines.map((h) => h.toLowerCase());
-            const missingHeadings = prerequisite.headingMustContain.filter((marker) => !loweredHeadings.some((h) => h.includes(marker.toLowerCase())));
-            if (missingHeadings.length > 0) {
-                missing.push({
-                    path: relative,
-                    description: `${prerequisite.description} — missing heading(s): ${missingHeadings.join(', ')}`
-                });
-            }
-        }
-        if (prerequisite.mustContainAny && prerequisite.mustContainAny.length > 0) {
-            const body = await readFile(absolute, 'utf8');
-            const lowered = body.toLowerCase();
-            const hitAny = prerequisite.mustContainAny.some((marker) => lowered.includes(marker.toLowerCase()));
-            if (!hitAny) {
-                missing.push({
-                    path: relative,
-                    description: `${prerequisite.description} — none of the escape-hatch markers present: ${prerequisite.mustContainAny.join(', ')}`
-                });
+            for (const description of prerequisiteBodyViolations(prerequisite, body)) {
+                missing.push({ path: relative, description });
             }
         }
     }
@@ -454,12 +522,13 @@ function emitPrereqTransitionEvent(opts) {
  * (e.g. `001-<rid>.md`) at every tier. Returns the matched absolute
  * path, or null when nothing matches.
  *
- * v2.12.0 Group B Tier 5: if `prerequisite.legacyRelativePath` is set
- * and neither primary session-root tier resolved, the resolver tries
- * the legacy relative path at BOTH session roots before declaring the
- * prereq missing. This is the 1-minor-release back-compat mechanism
- * for artifacts that moved location (e.g. `rd/security-review.md` →
- * `audit/security.md`).
+ * Back-compat: once neither primary session-root tier resolved, the
+ * resolver walks `prerequisite.legacyRelativePaths` in declared order
+ * and tries each at BOTH session roots before declaring the prereq
+ * missing. This covers both artifacts that moved location
+ * (`rd/security-review.md` → `audit/security.md`) and ones that later
+ * gained a rid in the filename (`audit/security.md` →
+ * `audit/security-<rid>.md`, slice `2026-09-14-audit-artifact-rid-scoping`).
  */
 async function resolvePrerequisiteAbsolutePathWithFallback(canonicalSessionRoot, legacySessionRoot, prerequisite, requestId) {
     const roots = [canonicalSessionRoot, legacySessionRoot];
@@ -471,13 +540,19 @@ async function resolvePrerequisiteAbsolutePathWithFallback(canonicalSessionRoot,
         if (found !== null)
             return found;
     }
-    // Second pass: if a legacyRelativePath is declared, try it at every
-    // root. Only the relativePath is swapped — the same numbered-prefix
+    // Second pass: the single previous location, then any further older
+    // ones, at every root — newest first, so a session that somehow holds
+    // both a pre-rid and a v2.11.x file resolves to the newer shape.
+    // Only the relativePath is swapped — the same numbered-prefix
     // tolerance applies via the shared resolver.
-    if (prerequisite.legacyRelativePath !== undefined) {
+    const legacyTiers = [
+        ...(prerequisite.legacyRelativePath !== undefined ? [prerequisite.legacyRelativePath] : []),
+        ...(prerequisite.legacyRelativePaths ?? [])
+    ];
+    for (const legacy of legacyTiers) {
         const legacyPrereq = {
             ...prerequisite,
-            relativePath: prerequisite.legacyRelativePath
+            relativePath: legacy
         };
         for (const root of roots) {
             if (root === null)

package/dist/services/artifacts/request-artifact-service.d.ts

@@ -50,6 +50,14 @@ export type CreateRequestArtifactResult = {
      */
     scopeDir: string;
 };
+/**
+ * F-1 (slice 025 security): reject rids that contain path separators, null
+ * bytes, or traversal sequences. A request id is a single path segment, so
+ * anything that builds a filename from one must test it against this first —
+ * it is exported so those call sites reuse it instead of re-declaring a copy
+ * that can drift.
+ */
+export declare const REQUEST_ID_PATTERN: RegExp;
 export declare function createRequestArtifact(options: CreateRequestArtifactOptions): Promise<CreateRequestArtifactResult>;
 export type RequestArtifactSummary = {
     role: RequestArtifactRole;

package/dist/services/artifacts/request-artifact-service.js

@@ -11,6 +11,8 @@ import { ensureSession, getSessionIdCanonical } from '../session/session-manager
 // live at `shared/path-safety.ts` if this module ever needs them.
 import { getNextNumber, buildNumberedFilename, slugifyDescription } from '../../shared/incrementing-number.js';
 import { lintRequestArtifact } from './artifact-lint-service.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { guardRuntimeSegment, runtimeRoot } from '../../shared/runtime-root.js';
 import { checkTypeSanity } from '../scan/type-sanity-service.js';
 import { requireUserConfirmation } from '../mode/mode-enforcement.js';
 import { scanFileSize } from '../scan/file-size-scan.js';
@@ -27,7 +29,14 @@ export { VALID_REQUEST_TYPES, DEFAULT_REQUEST_TYPE, isRequestType };
 // the local namespace under `isolatedModules`).
 import { renderTemplate } from './artifact-templates.js';
 export { formatHandoffPath, formatCommitBoundaryPath, formatSkillUsageLessonsPath } from './artifact-templates.js';
-const REQUEST_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/**
+ * F-1 (slice 025 security): reject rids that contain path separators, null
+ * bytes, or traversal sequences. A request id is a single path segment, so
+ * anything that builds a filename from one must test it against this first —
+ * it is exported so those call sites reuse it instead of re-declaring a copy
+ * that can drift.
+ */
+export const REQUEST_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const VALID_ROLES = new Set(['prd', 'ui', 'rd', 'qa', 'sc']);
 function defaultClock() {
     return new Date().toISOString();
@@ -38,6 +47,30 @@ function dateSlugFromIso(iso) {
 function defaultSessionId(iso) {
     return `${dateSlugFromIso(iso)}-session`;
 }
+/**
+ * The single place a request-artifact directory is built, and therefore the
+ * single place the ids that reach it are guarded.
+ *
+ * Repair R5. This join used to be written at four sites; `createRequestArtifact`
+ * guarded its session id and the other three did not. The two ids are the whole
+ * of the invariant — `role` is a path segment too, and the closed-set check its
+ * callers perform is not visible from here.
+ *
+ * The guard belongs HERE and not at the entry points because the invariant is
+ * the resolved path, not the flag. `transitionRequestArtifact` is the measured
+ * cost: it performs no join of its own (it delegates the path to
+ * `showRequestArtifact`), so it had no guard and no join to hang one on.
+ * `--session-id ../../../PWNED-R34` resolved `.peaks/_runtime/../../../PWNED-R34`,
+ * wrote `state: blocked` to a file outside the project root, and only then threw
+ * — from `emitObservabilityEvent`'s own session-id check, i.e. after the write.
+ */
+function requestArtifactRequestsDir(projectRoot, sessionId, role) {
+    // Slice 2026-09-15 (runtime-path-unrepresentable): the two ids are branded by
+    // `guardRuntimeSegment`, which performs the same `isUnsafePathInput` check
+    // this function used to spell inline. The join itself now *requires* the
+    // brand, so a caller that reaches this dir without a guard does not compile.
+    return runtimeRoot(projectRoot).join(guardRuntimeSegment(sessionId, 'session id'), guardRuntimeSegment(role, 'role'), guardRuntimeSegment('requests', 'leaf'));
+}
 export async function createRequestArtifact(options) {
     if (!VALID_ROLES.has(options.role)) {
         throw new Error(`Invalid role: ${String(options.role)} (expected prd, ui, rd, qa, or sc)`);
@@ -60,6 +93,13 @@ export async function createRequestArtifact(options) {
     // in the artifact body's frontmatter (under `- change-id:`) for
     // human navigation; it is no longer a filesystem path key.
     const sessionId = options.sessionId ?? await ensureSession(options.projectRoot);
+    // Sid axis. The rid axis is guarded three times above (`REQUEST_ID_PATTERN`
+    // at :110, and again in the numbered-filename path); the session id was
+    // never checked, so `--session-id ../../x` wrote the artifact outside the
+    // project root under an `ok: true` envelope.
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     // Slice 2026-06-29-change-id-root-removal: the `current-change`
     // binding file is gone. Resolution order for the change-id (file
     // body metadata) is now:
@@ -80,7 +120,7 @@ export async function createRequestArtifact(options) {
     // `mkdir(..., { recursive: true })`.
     const LOOKS_LIKE_SESSION_ID = /^\d{4}-\d{2}-\d{2}-session-/;
     if (LOOKS_LIKE_SESSION_ID.test(sessionId)) {
-        const sessionDir = join(options.projectRoot, '.peaks', '_runtime', sessionId);
+        const sessionDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'));
         if (!(await isDirectory(sessionDir))) {
             const canonicalSid = getSessionIdCanonical(options.projectRoot);
             const hint = canonicalSid !== null
@@ -90,7 +130,7 @@ export async function createRequestArtifact(options) {
         }
     }
     // Build numbered path under the session dir (canonical post-F3 home).
-    const requestsDir = join(options.projectRoot, '.peaks', '_runtime', sessionId, options.role, 'requests');
+    const requestsDir = requestArtifactRequestsDir(options.projectRoot, sessionId, options.role);
     // Check if a file with this requestId already exists (regardless of number prefix)
     if (await isDirectory(requestsDir)) {
         const existingFiles = await listMarkdownFiles(requestsDir);
@@ -118,7 +158,7 @@ export async function createRequestArtifact(options) {
         // Slice 2026-06-29-change-id-root-removal: scopeDir is the
         // session-axis dir (`.peaks/_runtime/<sid>/`). Pre-resolved here
         // so dry-run output reports the canonical scope location.
-        const scopeDir = join(options.projectRoot, '.peaks', '_runtime', sessionId);
+        const scopeDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'));
         return {
             role: options.role,
             requestId: options.requestId,
@@ -135,7 +175,7 @@ export async function createRequestArtifact(options) {
     // Create QA initiated marker so rd:qa-handoff gate can verify QA was invoked.
     // The marker lives under the SESSION dir (canonical post-F3 home).
     if (options.role === 'qa') {
-        const qaDir = join(options.projectRoot, '.peaks', '_runtime', sessionId, 'qa');
+        const qaDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'), guardRuntimeSegment('qa', 'role'));
         const initiatedPath = join(qaDir, '.initiated');
         if (!existsSync(initiatedPath)) {
             await mkdir(qaDir, { recursive: true });
@@ -149,22 +189,17 @@ export async function createRequestArtifact(options) {
         path,
         content,
         applied: true,
-        scopeDir: join(options.projectRoot, '.peaks', '_runtime', sessionId),
+        scopeDir: runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id')),
         ...(options.callerId !== undefined ? { callerId: options.callerId } : {})
     };
 }
 function extractMetadata(markdown) {
-    let state = 'unknown';
+    const state = readArtifactState(markdown) ?? 'unknown';
     let createdAt;
     let requestType = DEFAULT_REQUEST_TYPE;
     let sessionId;
     for (const rawLine of markdown.split(/\r?\n/)) {
         const line = rawLine.trim();
-        const stateMatch = /^-\s*state:\s*(.+?)\s*$/.exec(line);
-        if (stateMatch !== null && stateMatch[1] !== undefined) {
-            state = stateMatch[1];
-            continue;
-        }
         const createdMatch = /^-\s*created:\s*(.+?)\s*$/.exec(line);
         if (createdMatch !== null && createdMatch[1] !== undefined) {
             createdAt = createdMatch[1];
@@ -192,31 +227,27 @@ function extractMetadata(markdown) {
         base.sessionId = sessionId;
     return base;
 }
-async function readSummary(projectRoot, sessionId, role, fileName) {
-    const path = join(projectRoot, '.peaks', sessionId, role, 'requests', fileName);
+async function readSummary(dir, role, fileName, sessionId) {
+    const path = join(dir, fileName);
     const body = await readFile(path, 'utf8');
     const { state, createdAt, requestType, sessionId: bodySessionId } = extractMetadata(body);
     // Strip numbered prefix (e.g., "001-requestId.md" -> "requestId")
     // Only strip 3-digit zero-padded prefixes (our incrementing number format)
     const requestId = fileName.replace(/^0\d{2}-/, '').replace(/\.md$/, '');
-    // The `sessionId` parameter is the *scope* path fragment
-    // (`_runtime/<sid>`); consumers expect the bare session id. Strip
-    // the `_runtime/` prefix when recording the summary so downstream
-    // calls (observability emit, prereq check, lint gate) see just the
-    // session id. Pre-2.19.0 the field carried the scope verbatim, which
-    // caused the observability metrics file to land at
-    // `.peaks/_runtime/_runtime/<sid>/...` instead of the canonical
-    // `.peaks/_runtime/<sid>/metrics/...`. `writerSessionId` falls back
-    // to the parsed body session line (or the bare sid) — same intent.
-    const bareSessionId = sessionId.replace(/^_runtime[\\/]/, '');
+    // Repair R5: this used to take the *scope* path fragment (`_runtime/<sid>`)
+    // and re-join it onto the project root, then strip the prefix back off to
+    // recover the bare session id. The round-trip was the escape's carrier — an
+    // unsafe id rode it into `path` unguarded. The directory now arrives already
+    // resolved and already guarded (`requestArtifactRequestsDir`), and the bare
+    // session id arrives as itself, so neither is re-derived here.
     const summary = {
         role,
-        sessionId: bareSessionId,
+        sessionId,
         requestId,
         path,
         state,
         requestType,
-        writerSessionId: bodySessionId ?? bareSessionId
+        writerSessionId: bodySessionId ?? sessionId
     };
     if (createdAt !== undefined) {
         summary.createdAt = createdAt;
@@ -244,26 +275,28 @@ export async function listRequestArtifacts(options) {
     // scanned. The user has forbidden the `.peaks/_runtime/<id>/` root layout —
     // the CLI guarantees no such dirs are created. See
     // `.peaks/memory/2026-06-21-peaks-request-session-id-leaks-into-change-id.md`.
+    // Repair R5: `scopes` holds bare session ids. It used to hold the joined
+    // fragment `_runtime/<sid>` so that `readSummary` could re-join it to the
+    // project root; the directory is built once, below, by the guard.
     const scopes = [];
     if (options.sessionId !== undefined) {
-        scopes.push(join('_runtime', options.sessionId));
+        scopes.push(options.sessionId);
     }
     else {
-        const runtimeRoot = join(peaksRoot, '_runtime');
-        if (await isDirectory(runtimeRoot)) {
-            for (const sid of await listDirectories(runtimeRoot)) {
-                scopes.push(join('_runtime', sid));
-            }
+        // Read-only enumeration of the root itself, so `dir()` and not `join()`.
+        const runtimeDir = runtimeRoot(options.projectRoot).dir();
+        if (await isDirectory(runtimeDir)) {
+            scopes.push(...(await listDirectories(runtimeDir)));
         }
     }
     const roles = options.role !== undefined ? [options.role] : Array.from(VALID_ROLES);
     const summaries = [];
     for (const scope of scopes) {
         for (const role of roles) {
-            const dir = join(peaksRoot, scope, role, 'requests');
+            const dir = requestArtifactRequestsDir(options.projectRoot, scope, role);
             const fileNames = await listMarkdownFiles(dir);
             for (const fileName of fileNames) {
-                summaries.push(await readSummary(options.projectRoot, scope, role, fileName));
+                summaries.push(await readSummary(dir, role, fileName, scope));
             }
         }
     }
@@ -301,24 +334,22 @@ export async function showRequestArtifact(options) {
     // `.peaks/_runtime/<sid>/<role>/requests/` legacy home is no longer
     // scanned. The user has forbidden the `.peaks/_runtime/<id>/` root layout.
     if (options.sessionId !== undefined) {
-        const dir = join(options.projectRoot, '.peaks', '_runtime', options.sessionId, options.role, 'requests');
-        const scope = join('_runtime', options.sessionId);
+        const dir = requestArtifactRequestsDir(options.projectRoot, options.sessionId, options.role);
         const found = await findFileInDir(dir);
         if (found === null) {
             return null;
         }
-        return await readRequestArtifact(options.projectRoot, scope, options.role, found);
+        return await readRequestArtifact(dir, options.role, found, options.sessionId);
     }
-    const peaksRoot = join(options.projectRoot, '.peaks');
-    const runtimeRoot = join(peaksRoot, '_runtime');
-    if (!(await isDirectory(runtimeRoot))) {
+    const runtimeDir = runtimeRoot(options.projectRoot).dir();
+    if (!(await isDirectory(runtimeDir))) {
         return null;
     }
-    for (const sid of await listDirectories(runtimeRoot)) {
-        const dir = join(runtimeRoot, sid, options.role, 'requests');
+    for (const sid of await listDirectories(runtimeDir)) {
+        const dir = requestArtifactRequestsDir(options.projectRoot, sid, options.role);
         const found = await findFileInDir(dir);
         if (found !== null) {
-            return await readRequestArtifact(options.projectRoot, join('_runtime', sid), options.role, found);
+            return await readRequestArtifact(dir, options.role, found, sid);
         }
     }
     return null;
@@ -326,8 +357,8 @@ export async function showRequestArtifact(options) {
 /** Read the summary + content for a found request file; treat a read
  * error on the content as "not found" so the caller can fall through
  * to the next candidate (the on-disk file may be partially written). */
-async function readRequestArtifact(projectRoot, scope, role, found) {
-    const summary = await readSummary(projectRoot, scope, role, found.fileName);
+async function readRequestArtifact(dir, role, found, sessionId) {
+    const summary = await readSummary(dir, role, found.fileName, sessionId);
     try {
         const content = await readFile(found.path, 'utf8');
         return { ...summary, content };
@@ -343,7 +374,7 @@ async function readRequestArtifact(projectRoot, scope, role, found) {
 // the sibling `request-artifact-state-helpers.ts` module — see
 // v2.18.3 file-split for the rationale. Function signatures and
 // behaviour are unchanged (verbatim move).
-import { ALLOWED_STATES_PER_ROLE, FileSizeViolationError, LintGateError, PrerequisitesNotSatisfiedError, TypeSanityViolationError, updateStatusBlock, } from './request-artifact-state-helpers.js';
+import { ALLOWED_STATES_PER_ROLE, FileSizeViolationError, LintGateError, PrerequisitesNotSatisfiedError, readArtifactState, TypeSanityViolationError, updateStatusBlock, } from './request-artifact-state-helpers.js';
 export { allowedStatesForRole, FileSizeViolationError, LintGateError, PrerequisitesNotSatisfiedError, TypeSanityViolationError, updateStatusBlock } from './request-artifact-state-helpers.js';
 export async function transitionRequestArtifact(options) {
     if (!VALID_ROLES.has(options.role)) {

package/dist/services/artifacts/request-artifact-state-helpers.d.ts

@@ -45,6 +45,63 @@ export declare class FileSizeViolationError extends Error {
         lines: number;
     }>, threshold: number);
 }
+export interface ArtifactStateLocation {
+    /** Index of the authoritative `- state:` line, or -1 when the document has none. */
+    stateLineIndex: number;
+    /** The authoritative state, or null when `stateLineIndex` is -1. */
+    state: string | null;
+}
+/**
+ * The ONE rule for "which `state:` line is this artifact's state": the LAST
+ * one. A request artifact is an append-only log — each QA round appends a
+ * section ending in its own `## Status`, and `request transition` rewrites the
+ * newest state line in place — so the last line is the current round and the
+ * earlier ones are history.
+ *
+ * Every reader (`verify-pipeline`, `request show`, the resume detector) and the
+ * writer (`updateStatusBlock`) MUST go through this. The 2026-09-14 defect was
+ * three readers disagreeing about one file: `verify-pipeline` and the resume
+ * detector took the first match, `request show` took the last, so an artifact
+ * appended to more than once read as its first round to the checker and the
+ * resume detector while reading as its last round to the viewer and the writer.
+ *
+ * Scoping the search to the last `## Status` block was evaluated as an
+ * alternative and rejected — as a SECOND locator, not as a broken rule. It is
+ * well defined on the specimen that motivated this slice (four blocks) and
+ * returns `verdict-issued`, the right answer; and a trailing appended
+ * `- state:` line does not defeat it the way it defeats this rule — on that
+ * input the two rules disagree, and the one the block rule then disagrees with
+ * is the writer. `updateStatusBlock` rewrites the last `- state:` line wherever
+ * it sits and never moves it into the newest block, so a block-scoped reader
+ * parts company with the writer as soon as those two positions differ: the
+ * writer writes the appended line while the block reader keeps reporting the
+ * block's own line. That is this slice's reader-vs-writer divergence on a new
+ * axis. Sharing the writer's locator makes the agreement structural, not
+ * accidental.
+ *
+ * Known boundary of this rule, pinned in
+ * `request-artifact-state-authority.test.ts` rather than hidden: a process that
+ * appends a bare `- state:` line takes over the field — consistent with the
+ * writer being its only sanctioned producer.
+ *
+ * Two narrowings keep that boundary to lines the writer could have produced.
+ * A line inside a fenced code region is skipped, and the line must start at
+ * column 0. Neither is defensive decoration: a document that *describes* the
+ * state machine quotes `- state: qa-block` inside a fence, and this job's own
+ * `qa/requests/*.md` artifacts do exactly that — under the unfenced rule the
+ * quoted example was an input to the transition checker, and it survived only
+ * because the quoted copies happened not to be last. Both narrowings were
+ * measured against every `*.md` under `.peaks/` (833 files) and change no
+ * artifact's answer, and the writer already satisfies both by construction
+ * (`updateStatusBlock` writes `- state: <state>` at column 0), so reader and
+ * writer stay the same locator.
+ *
+ * Fuller record: the slice-3 section of this session's `rd/tech-doc.md` and
+ * the repair-round section of `rd/repair2-meta-integrity-fixes.md`.
+ */
+export declare function locateArtifactState(lines: ReadonlyArray<string>): ArtifactStateLocation;
+/** `locateArtifactState` over a whole document. Null when there is no `- state:` line. */
+export declare function readArtifactState(markdown: string): string | null;
 export declare function updateStatusBlock(markdown: string, newState: RequestArtifactState, timestamp: string, reason?: string): {
     updated: string;
     previousState: string;