peaks-loop 4.0.48 → 4.0.49

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 4.0.49 — 2026-09-15 (闸门验的是描述产物的话而不是产物本身 + id 轴三次布防后改走结构 + 两处吞异常与一个不是证据的 mtime + 套件自己把夹具写进了收集 glob)
+
+**Highlights**:
+
+1. **Gate H 验的是"描述产物的那句话"，不是产物本身。** 三层检查都是 `text.includes()`。一棵**作为拒收而建**的树全部通过：注册表**不是合法 JSON**、模板上写着 `do NOT add a matcher`、`mode-gate.ts` 里是一句 `// TODO: … DELIBERATELY NOT a hard-floor category`。**同一份字节下 `enforceBashCommand` 返回 `{"decision":"allow"}`** —— 既满足了闸门，又解除了闸门所要证明的东西，而 `registry.json` 是 git 跟踪的。现在逐层解析并断言形状，产物不可读时**失败关闭**（缺失 / 非合法 JSON / 形状不对 / 解析成功但为空 / 不可读，五种全部拒绝）；C 层要求**从文档里解析出来的引用**，而不是一个子串匹配到的名字。修的过程中发现闸门一直在**为一种不存在的保护背书**：`collectMembers` 把 union 与数组摊平、从任一边接受成员，而 `isHardFloorCategory` 只读**数组** —— 于是一个只写在 union 里的成员让闸门报 BACKED，而 `shouldPauseAtGate` 返回 `shouldPause: false`。**闸门为一道不会暂停任何东西的"硬地板"背书，并且与它自己的报错信息相矛盾。** 残留**如实披露而非关闭**：C 层的引用通道**就是散文**，所以一份"点名了路径、实际管的是另一个成员"的文档仍会通过 —— 这次买到的是 **cited ≠ mentioned**。
+
+2. **id 轴：三次布防，最后一次比它替换掉的坏谓词更差 —— 于是改走结构。** 第一次把"一个 caller 提供的 id 进了路径"当作**一类**来 instrument。它没成立：守卫只盖**第一个** id、第二个敞着（四个命令各带一句"一道守卫盖住整族"的注释），而且**那次提交自己新引入了一处扫描器射程之外的双 id join，把项目根 README 覆盖掉了**。第二次修扫描器：12 个夹具里只抓住 **4** 个，而它替换掉的**按名字**谓词抓住 **8** 个 —— **五个是回归**。第三次把攻击从 4/12 提到 10/12，并**主动放弃**唯一能到 12/12 的改法：代价是活代码上 **7 处假阳性**，其中两处是结构性的（守卫合法地住在一个**助手函数**里，被守卫的值合法地作为**参数**传入）。判决：**按表达式文本的静态规则在这里做不健全** —— "守卫与 join 之间重新赋值"和"守卫在 join 之后"是**同一函数内部的支配性失败**，对任何按文本取键的办法都不可见；而收窄射程也不是免费的。于是换成**性质**：`src/shared/runtime-root.ts` 把守卫过的分段品牌在一个**非导出的 unique symbol** 后面、`RuntimeRoot` 用**私有 `#path`**、`join` 要求**至少一个**守卫分段（所以零参调用拿不回裸根）—— **新写一处未守卫的 join 直接编译不过（TS2345）**，而"拆掉守卫再变红"只能证明删除会被注意到。**诚实否定，明说而非糊过去**：旧站点根本不"取得一个根"，它们把 `join(projectRoot,'.peaks','_runtime',id,…)` **直接拼在行内** —— 没有访问器可供类型加固，而 TS 无法拒绝一个字符串字面量的拼写；所以性质**只在用了缝的地方**成立。另外披露：`as GuardedSegment` 在模块外可以伪造品牌，`dir()` 是刻意的旁路。**95 个未守卫槽位 / 48 个文件**，编译器就是工作清单。
+
+3. **压缩循环：两处吞异常、一行断言了从未发生的结算、一个不是证据的 mtime。** `settleOpenLifecycleRun` 的生命周期写入失败被吞掉 → run 停在 `armed` → **之后每一次探针都会再结算一次、再追加一行**，无界。两条结算路径中先只修了一条，另一条照旧追加；现在两条都**推迟**那一行并如实说明，run 记为**未结算**，而不是在仍处 `armed` 时报成功。状态线**把 history 文件的 mtime 当作"刚刚压缩过"的证据** —— 而那个文件**每次被"询问"就写一行 dispatch**，所以**新鲜度恰恰在什么都没压缩的时候达到峰值**（仓库自己的会话在该端点有 **1075 行 dispatch、0 次压缩**）；现在要求窗口内存在一行 `observed`，且配了非真空性对照证明旧谓词确实会接受同一个夹具。`getSessionDir` 增加一个**总体变体**，让"不能抛"的调用方有东西可调而不是吞掉；可观测性服务恢复它被记录过两次的 never-throws 契约。
+
+4. **套件自己把夹具写进了它收集的 glob 里。** `bdd-reporter.test.ts` 在 `tests/unit/` **里面**创建夹具、在 `afterEach` 删掉，而那是 vitest 的收集范围 —— 并发跑会在收集到它之后**四秒**导入失败，在**无关的套件**里报 `Cannot find module`。这件事**此前被记录过四次、一次都没修**（三份产物加一份已提交的记忆）。修完顺带量到一条比修复本身更大的事：**与测试同时跑的 `tsc` 不是证据** —— 中止时总数**错低**（一条孤立 `TS6053`、墙钟塌到约两秒），而**真实夹具在场时污染是隐形的**（总数恰好等于干净基线），是个**静默的错数**而不是显眼的错数；三选一里的判决是"在安静的树上取，并要求 `TS6053 = 0`"。非真空性对照：把夹具配置的 `include` 指向不匹配的 glob → 四个用例**全部失败**，证明它们确实依赖嵌套运行真的执行那个夹具。
+
+5. **一行观测被追加了 2054 次，而原因是我们自己的基准测试。** 一次"只读"性能评审的微基准对着**真实** history 文件跑了两遍（`readFileSync` 取最后一行 → `appendFileSync` 写回同一文件 → 在计时循环里重复）；因为载荷是**从文件里读回来**的，每次重放**逐字节相同、连 `ts` 都相同**。算术精确闭合：**1 条真事件 + 503 + 1550 = 2054 行**，占该文件的 **53.8%**。**没有产品缺陷** —— 两个候选机制（写入端有循环 / 存在一个 drain）**都被证伪**（orchestrator 里 0 个循环，且 `ts` 在对象字面量里构造，所以 N 次产品调用必然给出 N 个不同戳）。证据**一行未删**：删掉它让文件显得整洁，正是这条线存在的理由所要消灭的动作。
+
+**验证**：三个版本常量一致（**4.0.49**）；`pnpm build` 的 `build-integrity: OK` —— 并且**套件自己抓住了这次 bump 的遗漏**（`lockstep-three-packages` 报 `CLI_VERSION in dist/version.js is 4.0.48, but root package.json#version is 4.0.49`，即源码改了而构建陈旧；重建后绿）；`tsc -p tsconfig.json` 保持 **140** 基线、**0 在 `src/`**、**`TS6053` = 0**；`tests/unit` **253 files / 2706 passed / 3 skipped / 0 failed**（在安静的树上取，先确认 0 个 vitest 进程）。套件的 `write-gate-decision-table` 与 `final-review-service` 用例是**负载敏感**的（并行负载下超时、单独跑通过）—— **点名，不两边计数**。
+
+**明确未验证的（不当作已完成）**：**没有任何一次真实的 Claude Code `PostCompact` 事件被观察到** —— 两条结算路径的行为是用只读 store 驱动的，证明的是"命令会结算"，**从不是"事件会到达"**；`handoff-service.ts` 未被路由到新缝（把它的相对形式接进来会把 5 号修掉的那条片段往返载体重新引回来）；结构性质的 95 个剩余槽位**未迁移**，所以它目前只在 2 个文件上成立。
+
+**本轮顺带发现、尚未处理（不属本版修复）**：**结构缝自己的注释里有一句假话**（`runtime-root.ts:36-37` 声称模块外 `x as GuardedSegment` 是类型错误，**实测为假**）；行内拼写仍编译干净，而用 AST 普查做一条字面量禁令（本仓已写过两次这个模式）可以补上；`dir()` 旁路；规则 D 自己的套件在 import 时扫描整个 `tests/` 并会与并发夹具写入者竞争（本版修的正是这个类）；49 个文件上的 95 个未守卫槽位；六个原始 rid 的闸门状态仍停在 `spec-locked`。
+
 ## 4.0.48 — 2026-09-14 (一个 id 没校验就进了路径 + 自己的消费者读不出的交接胶囊 + 结尾才写、开头就读的状态)
 
 **Highlights**:

package/README-en.md

@@ -140,7 +140,7 @@ Every lane opens with **one slash command**.
 
 | | |
 | --- | --- |
-| **Latest** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.48 (2026-09-14) |
+| **Latest** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.49 (2026-09-15) |
 | **Domains** | Code (`peaks-code`) · Content (`peaks-content`) · Project health (`peaks-doctor`) · Issue sweep (`peaks-issue-fix-orchestrator`) · Custom SOP (`peaks-sop`) · Cross-domain primitives (`peaks-solo` dispatcher · `peaks-resume` · `peaks-status` · `peaks-test` · `peaks-slice-decompose`) |
 | **Sediment pool** | `~/.peaks/` local pool · twice-clean runs auto-promote to a bee · broken runs come back for you to redefine · the bee grows with your taste |
 | **Test suite** | 285+ cases · 4 packages (peaks-loop / peaks-loop-mut / peaks-loop-shared-channel / peaks-loop-shared) · **0 timeouts** · 14 BDD caller-binding edge cases |

package/README.md

@@ -140,7 +140,7 @@ npm i -g peaks-loop
 
 | | |
 | --- | --- |
-| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.48(2026-09-14) |
+| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.49(2026-09-15) |
 | **覆盖域** | 代码(`peaks-code`) · 内容(`peaks-content`) · 项目健康(`peaks-doctor`) · 批量修 issue(`peaks-issue-fix-orchestrator`) · 自定义 SOP(`peaks-sop`) · 通用原语(`peaks-solo` 分诊 / `peaks-resume` 续 / `peaks-status` 看 / `peaks-test` 测 / `peaks-slice-decompose` 切片) |
 | **沉淀池** | `~/.peaks/` 本地池 · 跑两次自动晋升成 bee · 跑翻车让你重定义 · bee 跟着你的口味长 |
 | **测试套件** | 1096 cases · 4 packages (peaks-loop 1015 / runtime 39 / mut 22 / shared-channel 20) · **CI 首次全绿**(ubuntu + windows) · 14 BDD caller-binding coverage |

package/dist/cli/commands/compact-command.js

@@ -527,9 +527,7 @@ export function registerCompactCommands(program, io) {
                         ? result.historyWritten
                             ? `Settled run ${result.runId}; appended a kind:'observed' row with pathway 'post-compact-hook'.`
                             : `Settled run ${result.runId}, but the kind:'observed' row could NOT be appended — check that .peaks/_runtime/<sid>/ is writable.`
-                        : `The harness reported a compaction for run ${result.runId}, but the lifecycle record could NOT be written — that run is still open, so a later probe will settle it from its own measurement.${result.historyWritten
-                            ? " A kind:'observed' row was still appended for this event."
-                            : " The kind:'observed' row could not be appended either."}`
+                        : `The harness reported a compaction for run ${result.runId}, but the lifecycle record could NOT be written — that run is still open, so a later probe will settle it from its own measurement and append the row then. Nothing was recorded for this event: a row here would assert a settlement the store never made.`
                     : result.reason === 'different-session'
                         ? `The hook payload names a different harness session, so this project's open compact run was left alone.`
                         : 'No compact run was open, so nothing was settled and no history row was appended.'

package/dist/cli/commands/feedback-commands.d.ts

@@ -5,13 +5,17 @@
  *   - `peaks feedback check-unpromoted --project <path> [--strict]`
  *
  * Companion to `sops/feedback-promotion-sop.md`. The promote command
- * generates a stub for the chosen enforcement layer (A: peaks-sop
- * gate, B: peaks-hooks PreToolUse, C: mode-gate hardFloorCategory)
- * and writes the promotion marker + sidecar + RD envelope. The
- * check-unpromoted command scans `.peaks/memory/*.md` for feedback
- * memories without a promotion marker and emits a structured list.
- * `--strict` flips exit code to non-zero when any unpromoted feedback
- * is found — used by `peaks workflow verify-pipeline` Gate H.
+ * writes the promotion marker + sidecar + RD envelope, and — for the
+ * layers whose artifact it can produce (A: a registered SOP manifest)
+ * — the enforcement artifact itself. Layers B and C live in shared
+ * files it does not own, so there it records the requirement and
+ * reports `effective: false` instead of claiming success.
+ *
+ * The check-unpromoted command scans `.peaks/memory/*.md` for feedback
+ * memories whose promotion is missing OR not backed by its layer's
+ * artifact, and emits a structured list. `--strict` flips exit code to
+ * non-zero when any is found — used by `peaks workflow verify-pipeline`
+ * Gate H.
  */
 import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';

package/dist/cli/commands/feedback-commands.js

@@ -5,18 +5,22 @@
  *   - `peaks feedback check-unpromoted --project <path> [--strict]`
  *
  * Companion to `sops/feedback-promotion-sop.md`. The promote command
- * generates a stub for the chosen enforcement layer (A: peaks-sop
- * gate, B: peaks-hooks PreToolUse, C: mode-gate hardFloorCategory)
- * and writes the promotion marker + sidecar + RD envelope. The
- * check-unpromoted command scans `.peaks/memory/*.md` for feedback
- * memories without a promotion marker and emits a structured list.
- * `--strict` flips exit code to non-zero when any unpromoted feedback
- * is found — used by `peaks workflow verify-pipeline` Gate H.
+ * writes the promotion marker + sidecar + RD envelope, and — for the
+ * layers whose artifact it can produce (A: a registered SOP manifest)
+ * — the enforcement artifact itself. Layers B and C live in shared
+ * files it does not own, so there it records the requirement and
+ * reports `effective: false` instead of claiming success.
+ *
+ * The check-unpromoted command scans `.peaks/memory/*.md` for feedback
+ * memories whose promotion is missing OR not backed by its layer's
+ * artifact, and emits a structured list. `--strict` flips exit code to
+ * non-zero when any is found — used by `peaks workflow verify-pipeline`
+ * Gate H.
  */
 import { resolve as resolvePath } from 'node:path';
 import { findProjectRoot } from '../../services/config/config-safety.js';
 import { getCurrentSessionId } from '../../services/skills/skill-presence-service.js';
-import { generatePromotionStub, isPromotionLayer, listUnpromotedFeedback, parseFeedbackMemory, PROMOTION_LAYER_DETAILS, PROMOTION_LAYERS, promoteFeedback } from '../../services/feedback/feedback-promotion-service.js';
+import { generatePromotionStub, isPromotionLayer, listPromotionExempt, listUnpromotedFeedback, missingArtifacts, parseFeedbackMemory, PROMOTION_LAYER_DETAILS, PROMOTION_LAYERS, promoteFeedback, promotionArtifactChecks } from '../../services/feedback/feedback-promotion-service.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
 export function registerFeedbackCommands(program, io) {
@@ -26,15 +30,16 @@ export function registerFeedbackCommands(program, io) {
     addJsonOption(feedback
         .command('promote <memory-file>')
         .description('Promote a feedback memory to one of the 3 enforcement layers (A=peaks-sop gate, B=peaks-hooks PreToolUse, C=mode-gate hardFloorCategory). ' +
-        'Reads `.peaks/memory/<file>.md`, generates a code stub for the chosen layer, and writes ' +
-        'the promotion marker (HTML comment + sidecar .promotion.json) + an RD envelope at ' +
-        '`.peaks/_runtime/<sid>/rd/feedback-promote-<name>.json`. ' +
+        'Reads `.peaks/memory/<file>.md` and writes the promotion marker (HTML comment + sidecar .promotion.json) + an RD envelope at ' +
+        '`.peaks/_runtime/<sid>/rd/feedback-promote-<name>.json`. Layer A additionally generates and registers the SOP manifest the ' +
+        'SOP engine reads. Layers B and C live in shared files the command does not own, so it records the requirement and exits ' +
+        'non-zero (PROMOTION_NOT_EFFECTIVE) until the registration is present. ' +
         'Without --layer, the CLI lists the 3 layer options as nextActions and exits with code 0 ' +
         '(use --layer <A|B|C> to actually promote, or pass --dry-run to preview the stub).')
         .option('--layer <A|B|C>', `enforcement layer (${PROMOTION_LAYERS.join(' | ')})`)
         .option('--project <path>', 'project root (default: cwd)')
         .option('--promoted-by <id>', 'identity string for the audit envelope (default: peaks-rd fork agent)')
-        .option('--dry-run', 'preview the stub without writing the marker / sidecar / envelope')).action((memoryFile, opts) => {
+        .option('--dry-run', 'preview the stub without writing the marker / sidecar / envelope')).action(async (memoryFile, opts) => {
         try {
             const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
             const memoryPath = memoryFile.endsWith('.md')
@@ -91,7 +96,7 @@ export function registerFeedbackCommands(program, io) {
             const layer = opts.layer;
             const sessionId = getCurrentSessionId(projectRoot) ?? 'unknown-sid';
             const promotedBy = opts.promotedBy ?? 'peaks-rd fork agent';
-            const envelope = promoteFeedback({
+            const envelope = await promoteFeedback({
                 feedbackPath: memoryPath,
                 layer,
                 promotedBy,
@@ -99,11 +104,26 @@ export function registerFeedbackCommands(program, io) {
                 projectRoot,
                 dryRun: false
             });
-            printResult(io, ok('feedback.promote', envelope, [], [
+            // rid 2026-09-14-gate-h-promotion: report what was written, not what
+            // the stub wished for. A promotion whose layer artifact is absent is
+            // recorded but NOT effective, and says so with a non-zero exit.
+            const notes = [
                 `Promoted feedback "${envelope.name}" to layer ${envelope.layer} (${envelope.layerDetail}).`,
                 `Generated files: ${envelope.generatedFiles.join(', ')}`,
                 `Envelope written to .peaks/_runtime/${sessionId}/rd/feedback-promote-${envelope.name}.json`
+            ];
+            if (envelope.effective) {
+                printResult(io, ok('feedback.promote', envelope, [], notes), opts.json);
+                return;
+            }
+            const missing = missingArtifacts(promotionArtifactChecks(envelope.name, envelope.layer), projectRoot);
+            printResult(io, fail('feedback.promote', 'PROMOTION_NOT_EFFECTIVE', `Promotion recorded but not effective — layer ${envelope.layer} is not backed by its artifact: ${missing.join('; ')}`, envelope, [
+                ...notes,
+                ...(envelope.layer === 'C'
+                    ? ['Layer C lives in source code: register the hard-floor category in src/services/code/mode-gate.ts, then re-run promote to record it.']
+                    : ['Apply the snippet to the file(s) named above, then re-run promote to record it.'])
             ]), opts.json);
+            process.exitCode = 1;
         }
         catch (err) {
             printResult(io, fail('feedback.promote', 'PROMOTE_FAILED', getErrorMessage(err), { memoryFile }, ['Verify the file is a feedback memory and re-run']), opts.json);
@@ -119,23 +139,35 @@ export function registerFeedbackCommands(program, io) {
         .option('--strict', 'exit non-zero when any unpromoted feedback is found (used by verify-pipeline Gate H)')).action((opts) => {
         try {
             const unpromoted = listUnpromotedFeedback({ projectRoot: opts.project });
+            const exempt = listPromotionExempt({ projectRoot: opts.project });
             const count = unpromoted.length;
             if (count === 0) {
-                printResult(io, ok('feedback.check-unpromoted', { count: 0, unpromoted: [] }, [], [`No unpromoted feedback found in .peaks/memory/.`]), opts.json);
+                printResult(io, ok('feedback.check-unpromoted', { count: 0, unpromoted: [], exempt }, [], [
+                    `No unpromoted feedback found in .peaks/memory/.`,
+                    ...(exempt.length === 0
+                        ? []
+                        : [`${exempt.length} memor${exempt.length === 1 ? 'y' : 'ies'} declare themselves not-to-be-promoted: ${exempt.map((e) => `${e.name} (${e.code})`).join('; ')}.`])
+                ]), opts.json);
                 return;
             }
             const message = `${count} feedback memor${count === 1 ? 'y is' : 'ies are'} not yet promoted to an enforcement layer.`;
             const nextActions = [
                 `Run \`peaks feedback promote <memory-file> --layer <A|B|C>\` for each entry above.`,
                 'A = peaks-sop gate, B = peaks-hooks PreToolUse, C = mode-gate hardFloorCategory.',
+                'A marker alone does not count: the entry above names the artifact its layer still owes.',
                 'See sops/feedback-promotion-sop.md for the SOP and the layer-choice rubric.'
             ];
             if (opts.strict === true) {
-                printResult(io, fail('feedback.check-unpromoted', 'UNPROMOTED_FEEDBACK_FOUND', message, { count, unpromoted }, nextActions), opts.json);
+                printResult(io, fail('feedback.check-unpromoted', 'UNPROMOTED_FEEDBACK_FOUND', message, { count, unpromoted, exempt }, nextActions), opts.json);
                 process.exitCode = 1;
                 return;
             }
-            printResult(io, ok('feedback.check-unpromoted', { count, unpromoted }, [message], nextActions), opts.json);
+            printResult(io, ok('feedback.check-unpromoted', { count, unpromoted, exempt }, [
+                message,
+                ...(exempt.length === 0
+                    ? []
+                    : [`${exempt.length} memor${exempt.length === 1 ? 'y' : 'ies'} declare themselves not-to-be-promoted: ${exempt.map((e) => `${e.name} (${e.code})`).join('; ')}.`])
+            ], nextActions), opts.json);
         }
         catch (err) {
             printResult(io, fail('feedback.check-unpromoted', 'CHECK_FAILED', getErrorMessage(err), { project: opts.project }, ['Verify --project path and re-run']), opts.json);

package/dist/cli/commands/final-review-commands.js

@@ -26,6 +26,7 @@
  */
 import { existsSync, statSync } from 'node:fs';
 import { join, resolve } from 'node:path';
+import { REQUEST_ID_PATTERN } from '../../services/artifacts/request-artifact-service.js';
 import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { createAnthropicRunner, LlmBindingError, LlmRequestError, resolveAnthropicConfig, } from '../../services/llm/anthropic-runner.js';
@@ -135,6 +136,17 @@ export function registerFinalReviewCommands(program, io) {
         //    in two places: the pre-flight existence check (here) and the
         //    stub-path envelope (below). The service computes it identically
         //    at `src/services/final-review/final-review-service.ts:45-52`.
+        //
+        //    Rid axis. The rid is the CLI positional and it is the FILENAME
+        //    segment below, so it is checked here, at the join. Added 2026-09-14
+        //    (repair R1): this join was a second-slot hole — the `--session-id`
+        //    validation above passed and the rid slot escaped. Found by the
+        //    widened rule D, not by a human reading the file.
+        if (!REQUEST_ID_PATTERN.test(rid)) {
+            printResult(io, fail('final-review.prepare', 'RID_INVALID', `Invalid request id: ${rid} (expected letters, digits, dots, underscores, or dashes)`, emptyFinalReviewData(rid, options.sessionId, ''), ['Pass the rid of the slice, e.g. 2026-09-14-some-slug']), options.json);
+            process.exitCode = 1;
+            return;
+        }
         const auditGoalPath = join(projectValidation.projectRoot, '.peaks', '_runtime', sessionValidation.sessionId, 'audit-goal', `${rid}.json`);
         // 4. Pre-flight: if the audit-goal file is missing, surface a 404
         //    BEFORE the stub/provider check so the caller learns the real

package/dist/cli/commands/loop-eval-commands.js

@@ -166,14 +166,25 @@ export function registerWorkflowEvalCommands(program, io) {
                     process.exitCode = 1;
                     return;
                 }
-                // Sid axis. `--session` reaches two joins below (`dir` and, through
-                // `nextEvalCaptureIndex`, the same literal), so one guard here covers
-                // the whole `--capture-score` write path.
+                // Sid axis AND rid axis — the join below takes TWO ids, not one.
+                // Corrected 2026-09-14 (repair R1): this comment used to say one guard
+                // covers "the whole `--capture-score` write path". The security audit of
+                // `2026-09-14-cli-id-escape-instrumentation` (F1b) measured that false —
+                // the `--session` guard passed and the `rid` slot escaped:
+                // `peaks loop eval '../../../../…/EVILCYC' --capture-score --session
+                // <legal>` created `<projectRoot>/../EVILCYC/cycles/cycle-1.json` under
+                // an `ok: true` envelope. The rid is the CLI positional and has no pinned
+                // format, so the segment check is the control for that axis.
                 if (isUnsafePathInput(options.session)) {
                     printResult(io, fail('loop.eval', 'INVALID_SESSION_ID', `Invalid session id: ${options.session} (must be a single path segment)`, { provided: options.session }, ['Pass a session id that is a single path segment']), options.json);
                     process.exitCode = 1;
                     return;
                 }
+                if (isUnsafePathInput(rid)) {
+                    printResult(io, fail('loop.eval', 'INVALID_REQUEST_ID', `Invalid request id: ${rid} (must be a single path segment)`, { provided: rid }, ['Pass a request id that is a single path segment']), options.json);
+                    process.exitCode = 1;
+                    return;
+                }
                 const score = envelope.degraded ? 0.25 : (envelope.gateAction === 'pass' ? 1.0 : envelope.gateAction === 'warn' ? 0.5 : 0.0);
                 const dir = join(projectRoot, '.peaks', '_runtime', options.session, 'loop', rid, 'cycles');
                 const n = nextEvalCaptureIndex(projectRoot, options.session, rid);
@@ -484,12 +495,17 @@ export function registerWorkflowEvalCommands(program, io) {
  *  writes. The run-driver also writes to the same dir; the next
  *  index = max(prior)+1, or 1. */
 function nextEvalCaptureIndex(projectRoot, sid, rid) {
-    // Sid axis: this function is the join for the capture-score cycle dir. The
-    // action guards `options.session` before calling in, but the seam is callable
-    // on its own, so the join states its own contract.
+    // BOTH id axes: this function is the join for the capture-score cycle dir.
+    // The action guards `options.session` and `rid` before calling in, but the
+    // seam is callable on its own, so the join states its own contract. The rid
+    // half was missing until 2026-09-14 (repair R1) — the same second-slot hole
+    // the action had, in the same file, one function below it.
     if (isUnsafePathInput(sid)) {
         throw new Error(`Invalid session id: ${sid} (must be a single path segment)`);
     }
+    if (isUnsafePathInput(rid)) {
+        throw new Error(`Invalid request id: ${rid} (must be a single path segment)`);
+    }
     const dir = join(projectRoot, '.peaks', '_runtime', sid, 'loop', rid, 'cycles');
     if (!existsSync(dir))
         return 1;

package/dist/cli/commands/slice-integrate-commands.js

@@ -10,6 +10,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { getCurrentSessionId } from '../../services/skills/skill-presence-service.js';
 import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { SLICE_ID_PATTERN } from '../../services/sc/sc-service.js';
 import { integrateSlices } from '../../services/slice/slice-integration.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, printResult } from '../cli-helpers.js';
@@ -23,6 +24,22 @@ function loadContractsForSlices(projectRoot, sessionId, sliceIds) {
         return [];
     const result = [];
     for (const sliceId of sliceIds) {
+        // Slice-id axis: the id becomes the FILENAME below, so `--slices a,../..`
+        // reads a JSON file outside the contracts dir. Guarded 2026-09-14 (repair
+        // R1, security audit F3 of `2026-09-14-cli-id-escape-instrumentation`) —
+        // the session guard above covers the other axis and this one was open.
+        // Skipped with a warning rather than thrown, matching this function's
+        // existing contract for a contract it cannot read.
+        //
+        // NOTE for the instrument: rule D in
+        // `tests/unit/runtime/no-runtime-input-guard.test.ts` does NOT see this
+        // site — its root is the local `const dir` above, not a same-file call, so
+        // it is that rule's limit (m). The guard is real; the coverage is not
+        // claimed.
+        if (!SLICE_ID_PATTERN.test(sliceId)) {
+            console.warn(`loadContractsForSlices: skipping invalid slice id ${JSON.stringify(sliceId)} (must be a single filename segment)`);
+            continue;
+        }
         const file = join(dir, `${sliceId}.json`);
         if (!existsSync(file))
             continue;

package/dist/services/artifacts/artifact-prerequisites.js

@@ -2,6 +2,7 @@ import { join, dirname, basename } from 'node:path';
 import { readFile, readdir } from 'node:fs/promises';
 import { pathExists } from 'peaks-loop-shared/fs';
 import { emitObservabilityEvent } from '../observability/observability-service.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 export const VALID_REQUEST_TYPES = [
     'feature',
     'bugfix',
@@ -426,6 +427,15 @@ export async function checkPrerequisites(options) {
     if (requirements.length === 0) {
         return { ok: true, missing: [], warnings: [] };
     }
+    // Repair R5. The session id is joined into BOTH roots below and then probed
+    // on disk. `transitionRequestArtifact` is the only caller and it passes
+    // `existing.sessionId`, which pre-R5 was the caller's raw `--session-id`: with
+    // `../../../PWNED-R34` the two joins resolved outside the project root and
+    // the prerequisite probes ran there. Guarded at the sink, not at the caller,
+    // for the same reason `requestArtifactRequestsDir` is.
+    if (options.sessionId !== undefined && isUnsafePathInput(options.sessionId)) {
+        throw new Error(`Invalid session id: ${options.sessionId} (must be a single path segment)`);
+    }
     // Slice 006 simplifies the resolution to a 2-tier fallback. The
     // per-change-id scope (`.peaks/_runtime/<sessionId>/<role>/`) is gone — new
     // artifacts go to the session dir directly. The 2 tiers are:

package/dist/services/artifacts/request-artifact-service.js

@@ -12,6 +12,7 @@ import { ensureSession, getSessionIdCanonical } from '../session/session-manager
 import { getNextNumber, buildNumberedFilename, slugifyDescription } from '../../shared/incrementing-number.js';
 import { lintRequestArtifact } from './artifact-lint-service.js';
 import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { guardRuntimeSegment, runtimeRoot } from '../../shared/runtime-root.js';
 import { checkTypeSanity } from '../scan/type-sanity-service.js';
 import { requireUserConfirmation } from '../mode/mode-enforcement.js';
 import { scanFileSize } from '../scan/file-size-scan.js';
@@ -46,6 +47,30 @@ function dateSlugFromIso(iso) {
 function defaultSessionId(iso) {
     return `${dateSlugFromIso(iso)}-session`;
 }
+/**
+ * The single place a request-artifact directory is built, and therefore the
+ * single place the ids that reach it are guarded.
+ *
+ * Repair R5. This join used to be written at four sites; `createRequestArtifact`
+ * guarded its session id and the other three did not. The two ids are the whole
+ * of the invariant — `role` is a path segment too, and the closed-set check its
+ * callers perform is not visible from here.
+ *
+ * The guard belongs HERE and not at the entry points because the invariant is
+ * the resolved path, not the flag. `transitionRequestArtifact` is the measured
+ * cost: it performs no join of its own (it delegates the path to
+ * `showRequestArtifact`), so it had no guard and no join to hang one on.
+ * `--session-id ../../../PWNED-R34` resolved `.peaks/_runtime/../../../PWNED-R34`,
+ * wrote `state: blocked` to a file outside the project root, and only then threw
+ * — from `emitObservabilityEvent`'s own session-id check, i.e. after the write.
+ */
+function requestArtifactRequestsDir(projectRoot, sessionId, role) {
+    // Slice 2026-09-15 (runtime-path-unrepresentable): the two ids are branded by
+    // `guardRuntimeSegment`, which performs the same `isUnsafePathInput` check
+    // this function used to spell inline. The join itself now *requires* the
+    // brand, so a caller that reaches this dir without a guard does not compile.
+    return runtimeRoot(projectRoot).join(guardRuntimeSegment(sessionId, 'session id'), guardRuntimeSegment(role, 'role'), guardRuntimeSegment('requests', 'leaf'));
+}
 export async function createRequestArtifact(options) {
     if (!VALID_ROLES.has(options.role)) {
         throw new Error(`Invalid role: ${String(options.role)} (expected prd, ui, rd, qa, or sc)`);
@@ -95,7 +120,7 @@ export async function createRequestArtifact(options) {
     // `mkdir(..., { recursive: true })`.
     const LOOKS_LIKE_SESSION_ID = /^\d{4}-\d{2}-\d{2}-session-/;
     if (LOOKS_LIKE_SESSION_ID.test(sessionId)) {
-        const sessionDir = join(options.projectRoot, '.peaks', '_runtime', sessionId);
+        const sessionDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'));
         if (!(await isDirectory(sessionDir))) {
             const canonicalSid = getSessionIdCanonical(options.projectRoot);
             const hint = canonicalSid !== null
@@ -105,7 +130,7 @@ export async function createRequestArtifact(options) {
         }
     }
     // Build numbered path under the session dir (canonical post-F3 home).
-    const requestsDir = join(options.projectRoot, '.peaks', '_runtime', sessionId, options.role, 'requests');
+    const requestsDir = requestArtifactRequestsDir(options.projectRoot, sessionId, options.role);
     // Check if a file with this requestId already exists (regardless of number prefix)
     if (await isDirectory(requestsDir)) {
         const existingFiles = await listMarkdownFiles(requestsDir);
@@ -133,7 +158,7 @@ export async function createRequestArtifact(options) {
         // Slice 2026-06-29-change-id-root-removal: scopeDir is the
         // session-axis dir (`.peaks/_runtime/<sid>/`). Pre-resolved here
         // so dry-run output reports the canonical scope location.
-        const scopeDir = join(options.projectRoot, '.peaks', '_runtime', sessionId);
+        const scopeDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'));
         return {
             role: options.role,
             requestId: options.requestId,
@@ -150,7 +175,7 @@ export async function createRequestArtifact(options) {
     // Create QA initiated marker so rd:qa-handoff gate can verify QA was invoked.
     // The marker lives under the SESSION dir (canonical post-F3 home).
     if (options.role === 'qa') {
-        const qaDir = join(options.projectRoot, '.peaks', '_runtime', sessionId, 'qa');
+        const qaDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'), guardRuntimeSegment('qa', 'role'));
         const initiatedPath = join(qaDir, '.initiated');
         if (!existsSync(initiatedPath)) {
             await mkdir(qaDir, { recursive: true });
@@ -164,7 +189,7 @@ export async function createRequestArtifact(options) {
         path,
         content,
         applied: true,
-        scopeDir: join(options.projectRoot, '.peaks', '_runtime', sessionId),
+        scopeDir: runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id')),
         ...(options.callerId !== undefined ? { callerId: options.callerId } : {})
     };
 }
@@ -202,31 +227,27 @@ function extractMetadata(markdown) {
         base.sessionId = sessionId;
     return base;
 }
-async function readSummary(projectRoot, sessionId, role, fileName) {
-    const path = join(projectRoot, '.peaks', sessionId, role, 'requests', fileName);
+async function readSummary(dir, role, fileName, sessionId) {
+    const path = join(dir, fileName);
     const body = await readFile(path, 'utf8');
     const { state, createdAt, requestType, sessionId: bodySessionId } = extractMetadata(body);
     // Strip numbered prefix (e.g., "001-requestId.md" -> "requestId")
     // Only strip 3-digit zero-padded prefixes (our incrementing number format)
     const requestId = fileName.replace(/^0\d{2}-/, '').replace(/\.md$/, '');
-    // The `sessionId` parameter is the *scope* path fragment
-    // (`_runtime/<sid>`); consumers expect the bare session id. Strip
-    // the `_runtime/` prefix when recording the summary so downstream
-    // calls (observability emit, prereq check, lint gate) see just the
-    // session id. Pre-2.19.0 the field carried the scope verbatim, which
-    // caused the observability metrics file to land at
-    // `.peaks/_runtime/_runtime/<sid>/...` instead of the canonical
-    // `.peaks/_runtime/<sid>/metrics/...`. `writerSessionId` falls back
-    // to the parsed body session line (or the bare sid) — same intent.
-    const bareSessionId = sessionId.replace(/^_runtime[\\/]/, '');
+    // Repair R5: this used to take the *scope* path fragment (`_runtime/<sid>`)
+    // and re-join it onto the project root, then strip the prefix back off to
+    // recover the bare session id. The round-trip was the escape's carrier — an
+    // unsafe id rode it into `path` unguarded. The directory now arrives already
+    // resolved and already guarded (`requestArtifactRequestsDir`), and the bare
+    // session id arrives as itself, so neither is re-derived here.
     const summary = {
         role,
-        sessionId: bareSessionId,
+        sessionId,
         requestId,
         path,
         state,
         requestType,
-        writerSessionId: bodySessionId ?? bareSessionId
+        writerSessionId: bodySessionId ?? sessionId
     };
     if (createdAt !== undefined) {
         summary.createdAt = createdAt;
@@ -254,26 +275,28 @@ export async function listRequestArtifacts(options) {
     // scanned. The user has forbidden the `.peaks/_runtime/<id>/` root layout —
     // the CLI guarantees no such dirs are created. See
     // `.peaks/memory/2026-06-21-peaks-request-session-id-leaks-into-change-id.md`.
+    // Repair R5: `scopes` holds bare session ids. It used to hold the joined
+    // fragment `_runtime/<sid>` so that `readSummary` could re-join it to the
+    // project root; the directory is built once, below, by the guard.
     const scopes = [];
     if (options.sessionId !== undefined) {
-        scopes.push(join('_runtime', options.sessionId));
+        scopes.push(options.sessionId);
     }
     else {
-        const runtimeRoot = join(peaksRoot, '_runtime');
-        if (await isDirectory(runtimeRoot)) {
-            for (const sid of await listDirectories(runtimeRoot)) {
-                scopes.push(join('_runtime', sid));
-            }
+        // Read-only enumeration of the root itself, so `dir()` and not `join()`.
+        const runtimeDir = runtimeRoot(options.projectRoot).dir();
+        if (await isDirectory(runtimeDir)) {
+            scopes.push(...(await listDirectories(runtimeDir)));
         }
     }
     const roles = options.role !== undefined ? [options.role] : Array.from(VALID_ROLES);
     const summaries = [];
     for (const scope of scopes) {
         for (const role of roles) {
-            const dir = join(peaksRoot, scope, role, 'requests');
+            const dir = requestArtifactRequestsDir(options.projectRoot, scope, role);
             const fileNames = await listMarkdownFiles(dir);
             for (const fileName of fileNames) {
-                summaries.push(await readSummary(options.projectRoot, scope, role, fileName));
+                summaries.push(await readSummary(dir, role, fileName, scope));
             }
         }
     }
@@ -311,24 +334,22 @@ export async function showRequestArtifact(options) {
     // `.peaks/_runtime/<sid>/<role>/requests/` legacy home is no longer
     // scanned. The user has forbidden the `.peaks/_runtime/<id>/` root layout.
     if (options.sessionId !== undefined) {
-        const dir = join(options.projectRoot, '.peaks', '_runtime', options.sessionId, options.role, 'requests');
-        const scope = join('_runtime', options.sessionId);
+        const dir = requestArtifactRequestsDir(options.projectRoot, options.sessionId, options.role);
         const found = await findFileInDir(dir);
         if (found === null) {
             return null;
         }
-        return await readRequestArtifact(options.projectRoot, scope, options.role, found);
+        return await readRequestArtifact(dir, options.role, found, options.sessionId);
     }
-    const peaksRoot = join(options.projectRoot, '.peaks');
-    const runtimeRoot = join(peaksRoot, '_runtime');
-    if (!(await isDirectory(runtimeRoot))) {
+    const runtimeDir = runtimeRoot(options.projectRoot).dir();
+    if (!(await isDirectory(runtimeDir))) {
         return null;
     }
-    for (const sid of await listDirectories(runtimeRoot)) {
-        const dir = join(runtimeRoot, sid, options.role, 'requests');
+    for (const sid of await listDirectories(runtimeDir)) {
+        const dir = requestArtifactRequestsDir(options.projectRoot, sid, options.role);
         const found = await findFileInDir(dir);
         if (found !== null) {
-            return await readRequestArtifact(options.projectRoot, join('_runtime', sid), options.role, found);
+            return await readRequestArtifact(dir, options.role, found, sid);
         }
     }
     return null;
@@ -336,8 +357,8 @@ export async function showRequestArtifact(options) {
 /** Read the summary + content for a found request file; treat a read
  * error on the content as "not found" so the caller can fall through
  * to the next candidate (the on-disk file may be partially written). */
-async function readRequestArtifact(projectRoot, scope, role, found) {
-    const summary = await readSummary(projectRoot, scope, role, found.fileName);
+async function readRequestArtifact(dir, role, found, sessionId) {
+    const summary = await readSummary(dir, role, found.fileName, sessionId);
     try {
         const content = await readFile(found.path, 'utf8');
         return { ...summary, content };

package/dist/services/audit/enforcers/active-skill-resolver.js

@@ -64,7 +64,20 @@ export function resolveActiveSkillForCaller(projectRoot, opts) {
     // single skill per resolution. When the lease dir is empty (e.g.
     // ad-hoc / pre-migration projects) we fall through to the legacy
     // walk below.
-    const sessionDir = getSessionDir(projectRoot, sessionId);
+    // `getSessionDir` refuses an unsafe session id by throwing (slice
+    // 2026-09-14-getsessiondir-guard). This function's contract is the
+    // resolution order's "graceful degradation — never throws", so an unsafe
+    // id degrades to the same `source: 'none'` shape an absent session dir
+    // produces, exactly as it did before that guard existed. Without this,
+    // the throw escapes to the nearest caller `catch` — for `hook handle`
+    // that catch is a fail-open that skips the SOP gate.
+    let sessionDir;
+    try {
+        sessionDir = getSessionDir(projectRoot, sessionId);
+    }
+    catch {
+        return { skill: null, callerId: null, sessionId: null, mode: null, source: 'none' };
+    }
     if (!existsSync(sessionDir)) {
         return { skill: null, callerId: null, sessionId, mode: null, source: 'none' };
     }