peaks-loop 4.0.48 → 4.0.49

package/dist/services/code/auto-compact-lifecycle.d.ts

@@ -51,6 +51,65 @@ export declare function resolveDispatchedStage(input: {
  * attempts inside the same millisecond distinct.
  */
 export declare function newCompactRunId(now: Date): string;
+/**
+ * rid `2026-09-14-compact-dispatch-backoff`: the compact run this session has
+ * already DISPATCHED and whose outcome is still unknown — the backoff token.
+ *
+ * WHY A BACKOFF IS NEEDED AT ALL. Once the ratio crosses the auto-fire
+ * threshold it STAYS crossed: nothing in peaks-loop can compact a running
+ * session, and the harness fires only at its own red line. So the dispatch
+ * obligation became unsatisfiable and fired on every probe. Measured in one
+ * real session (2026-09-13T22:43:33Z → 2026-09-14T14:15:02Z, ~15.5 h):
+ * 1035 `dispatch` rows, 444 checkpoints, and ZERO compactions — 1075 by
+ * 14:22:09.112Z. The dispatch itself is idempotent — `ide-native` only
+ * installs a PreToolUse hook, and a second install of the same hook is a
+ * documented no-op — so 1074 of those rows installed nothing (their own
+ * `dispatchMessage` says `already installed`) and carried no new information.
+ * Only noise: a signal that fires a thousand times is not a signal.
+ *
+ * WHY NO NEW STORE. The one-record-per-session lifecycle store already holds
+ * the one fact the backoff needs: is a compact attempt dispatched and not yet
+ * superseded? `armed` and `compacting` are exactly those two stages, and
+ * `completed` / `failed` mean the attempt is over and the next crossing is a
+ * legitimate new one. The state lives here rather than in
+ * `compact-history.jsonl`, which is append-only and never rewritten — so the
+ * backoff cannot be built by editing history, which is the point.
+ *
+ * STALENESS IS DELIBERATELY IGNORED, for `settleOpenLifecycleRun`'s reason: a
+ * probe arriving after `staleAfterMs` has learned nothing about whether the run
+ * is still live. Age cannot make re-dispatching honest, so the stale window
+ * must not decide it. (`settleOpenLifecycleRun` reads with the same window for
+ * the same reason; the two must not grow two policies.)
+ *
+ * `queued` / `preparing` / `verifying` are NOT open here: they are transient
+ * stages inside a dispatch or a settle, and a process that died in one of them
+ * left no compact attempt to protect — the next probe should be free to
+ * dispatch. `failed` is not open either, by the same argument: a failure is a
+ * reason to try again, not a reason to stay quiet.
+ */
+/**
+ * The answer to "is a compact attempt outstanding for this session?".
+ *
+ * `none` and `unresolvable` must not be the same value. The caller uses
+ * `none` to ADMIT a dispatch; `unresolvable` means the question could
+ * not be asked, and a caller that admits on "could not ask" has a gate
+ * that reads a string rather than the artifact it names.
+ */
+export type OpenDispatchRunRead = {
+    readonly kind: 'open';
+    readonly runId: string;
+    readonly stage: 'armed' | 'compacting';
+    readonly triggerRatio: number;
+} | {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'unresolvable';
+    readonly reason: string;
+};
+export declare function readOpenDispatchRun(input: {
+    readonly projectRoot: string;
+    readonly sessionId: string;
+}): OpenDispatchRunRead;
 /**
  * Slice 2026-08-01-compact-lifecycle (Task 5): the local transition
  * builder. Carries `runId`, `triggerRatio` and `redLine` forward from
@@ -132,6 +191,18 @@ export declare function summarizeLifecycleError(error: unknown): string;
  * `afterRatio` to append the "observed compaction point" row that makes the
  * intent-vs-observed gap readable after a real session. The return value is
  * telemetry only — callers that ignore it are unaffected.
+ *
+ * `lifecycleWritten` (repair R6) makes the returned record honest about
+ * whether the RUN actually moved. Before it, a failed write still returned
+ * the full envelope, so a store that could not be written reported a settle
+ * on every probe, forever: the run stayed `armed`, the next probe found it
+ * open again, and each one added another "observed compaction point" row —
+ * an unbounded append driven by a write that never happened. A failed write
+ * is not an absent run (the facts are real and stay true, so the caller may
+ * still record the measurement), but it is also not a settled one. This is
+ * the same field `settleOpenLifecycleRunOnCompactEvent` carries, for the
+ * same reason, so the two settle paths no longer disagree about what a write
+ * failure means.
  */
 export declare function settleOpenLifecycleRun(input: {
     readonly projectRoot: string;
@@ -140,10 +211,14 @@ export declare function settleOpenLifecycleRun(input: {
     readonly source: string;
     readonly autoFireThreshold: number;
     readonly onLifecycleStage?: ((stage: CompactLifecycleStage, record: CompactLifecycleRecord) => void) | undefined;
+    /** Failure injection for the write below — the seam `CompactLifecyclePublisher` already takes. */
+    readonly failLifecycleWrite?: boolean | undefined;
 }): {
     readonly runId: string;
     readonly triggerRatio: number;
     readonly afterRatio: number;
+    /** `false` when the `completed` write threw, so the run is STILL open. */
+    readonly lifecycleWritten: boolean;
 } | null;
 /**
  * rid `2026-09-13-compact-event-settle`: close out an open compact run because

package/dist/services/code/auto-compact-lifecycle.js

@@ -13,6 +13,7 @@
  */
 import { readCompactLifecycle, writeCompactLifecycle } from '../compact-statusline/compact-lifecycle-store.js';
 import { AUTO_COMPACT_RED_LINE_RATIO } from '../context/auto-compact-types.js';
+import { tryGetSessionDir } from '../session/getSessionDir.js';
 /**
  * PRD-002b slice 2 — extract the few cross-cutting magic numbers
  * that actually appear at runtime call sites in this orchestrator.
@@ -68,11 +69,18 @@ export function newCompactRunId(now) {
  * later. Wrapping that unbounded read here keeps the magic number out
  * of the settle path and makes the intent self-documenting.
  *
- * Returns `null` for any non-`valid` kind (missing / invalid /
- * stalled). Errors from the underlying read are swallowed — settling
- * is best-effort telemetry and must never bubble.
+ * The session id is resolved through `tryGetSessionDir` FIRST, so the
+ * guard's throw is answered before the store is entered and the failing
+ * branch is a value the caller must handle rather than a `catch` nobody
+ * reads. The residual `catch` is therefore unreachable for a bad id;
+ * anything that reaches it is a store fault, and a store fault is still
+ * not "there is no open run" — hence `unresolvable`, never `none`.
  */
 function readOpenCompactLifecycle(input) {
+    const resolved = tryGetSessionDir(input.projectRoot, input.sessionId);
+    if (!resolved.ok) {
+        return { kind: 'unresolvable', reason: resolved.reason };
+    }
     let out;
     try {
         out = readCompactLifecycle({
@@ -85,10 +93,21 @@ function readOpenCompactLifecycle(input) {
             staleAfterMs: Number.MAX_SAFE_INTEGER
         });
     }
-    catch {
-        return null;
+    catch (error) {
+        return { kind: 'unresolvable', reason: summarizeLifecycleError(error) };
     }
-    return out.kind === 'valid' ? out.record : null;
+    return out.kind === 'valid' ? { kind: 'found', record: out.record } : { kind: 'none' };
+}
+export function readOpenDispatchRun(input) {
+    const read = readOpenCompactLifecycle(input);
+    if (read.kind === 'unresolvable')
+        return read;
+    if (read.kind === 'none')
+        return { kind: 'none' };
+    const record = read.record;
+    if (record.stage !== 'armed' && record.stage !== 'compacting')
+        return { kind: 'none' };
+    return { kind: 'open', runId: record.runId, stage: record.stage, triggerRatio: record.triggerRatio };
 }
 /**
  * Slice 2026-08-01-compact-lifecycle (Task 5): the local transition
@@ -220,6 +239,18 @@ export function summarizeLifecycleError(error) {
  * `afterRatio` to append the "observed compaction point" row that makes the
  * intent-vs-observed gap readable after a real session. The return value is
  * telemetry only — callers that ignore it are unaffected.
+ *
+ * `lifecycleWritten` (repair R6) makes the returned record honest about
+ * whether the RUN actually moved. Before it, a failed write still returned
+ * the full envelope, so a store that could not be written reported a settle
+ * on every probe, forever: the run stayed `armed`, the next probe found it
+ * open again, and each one added another "observed compaction point" row —
+ * an unbounded append driven by a write that never happened. A failed write
+ * is not an absent run (the facts are real and stay true, so the caller may
+ * still record the measurement), but it is also not a settled one. This is
+ * the same field `settleOpenLifecycleRunOnCompactEvent` carries, for the
+ * same reason, so the two settle paths no longer disagree about what a write
+ * failure means.
  */
 export function settleOpenLifecycleRun(input) {
     // A `conservative-fallback` probe means no signal was available at
@@ -229,12 +260,17 @@ export function settleOpenLifecycleRun(input) {
         return null;
     if (input.measuredRatio >= input.autoFireThreshold)
         return null;
-    const prior = readOpenCompactLifecycle({
+    const openRead = readOpenCompactLifecycle({
         projectRoot: input.projectRoot,
         sessionId: input.sessionId
     });
-    if (prior === null)
+    // Both `none` and `unresolvable` mean "nothing to settle" HERE, and the
+    // collapse is legitimate on this path rather than a fail-open: settling
+    // ADMITS nothing. No record can exist under an id that names no session
+    // directory, so there is nothing this probe could have been about.
+    if (openRead.kind !== 'found')
         return null;
+    const prior = openRead.record;
     // Only a run that was actually dispatched can be completed by a
     // post-compact measurement. Both `compacting` (the in-band trigger is
     // satisfied) and `armed` (a trigger was registered and could fire at
@@ -253,6 +289,8 @@ export function settleOpenLifecycleRun(input) {
             ...(withAfterRatio ? { afterRatio: input.measuredRatio } : {})
         };
         try {
+            if (input.failLifecycleWrite)
+                throw new Error('lifecycle store unavailable');
             writeCompactLifecycle({
                 projectRoot: input.projectRoot,
                 sessionId: input.sessionId,
@@ -260,7 +298,10 @@ export function settleOpenLifecycleRun(input) {
             });
         }
         catch {
-            return;
+            // Best-effort telemetry, as everywhere in this file — but the failure is
+            // REPORTED to the caller as `lifecycleWritten: false` rather than folded
+            // into a record that reads as settled.
+            return false;
         }
         try {
             input.onLifecycleStage?.(stage, record);
@@ -268,12 +309,14 @@ export function settleOpenLifecycleRun(input) {
         catch {
             // Observer failures are not ours to propagate.
         }
+        return true;
     };
     // `verifying` = we hold a measurement and are checking it.
     emit('verifying', false);
-    // `completed` = the measurement confirms the drop; publish it.
-    emit('completed', true);
-    return { runId: prior.runId, triggerRatio: prior.triggerRatio, afterRatio: input.measuredRatio };
+    // `completed` = the measurement confirms the drop; publish it. This write
+    // is the one that closes the run, so it is the one that is reported.
+    const lifecycleWritten = emit('completed', true);
+    return { runId: prior.runId, triggerRatio: prior.triggerRatio, afterRatio: input.measuredRatio, lifecycleWritten };
 }
 /**
  * rid `2026-09-13-compact-event-settle`: close out an open compact run because
@@ -332,12 +375,16 @@ export function settleOpenLifecycleRun(input) {
  * two apart ends up telling the user a falsehood (see `compact-event-settle.ts`).
  */
 export function settleOpenLifecycleRunOnCompactEvent(input) {
-    const prior = readOpenCompactLifecycle({
+    const openRead = readOpenCompactLifecycle({
         projectRoot: input.projectRoot,
         sessionId: input.sessionId
     });
-    if (prior === null)
+    // Same collapse as `settleOpenLifecycleRun` above, for the same reason:
+    // an unresolvable id names no session directory, so no open run exists
+    // for this event to be about, and `null` here admits nothing.
+    if (openRead.kind !== 'found')
         return null;
+    const prior = openRead.record;
     if (prior.stage !== 'compacting' && prior.stage !== 'armed')
         return null;
     const afterRatio = input.measuredRatio !== null && input.measuredRatio < prior.triggerRatio ? input.measuredRatio : null;
@@ -410,12 +457,14 @@ export function settleOpenLifecycleRunOnCompactEvent(input) {
 export function fillEventSettledMeasurement(input) {
     if (input.source === 'conservative-fallback')
         return null;
-    const prior = readOpenCompactLifecycle({
+    const openRead = readOpenCompactLifecycle({
         projectRoot: input.projectRoot,
         sessionId: input.sessionId
     });
-    if (prior === null)
+    // Same collapse as the two settle paths above — `null` here admits nothing.
+    if (openRead.kind !== 'found')
         return null;
+    const prior = openRead.record;
     // Exactly one shape is owed a number: the one the EVENT path leaves behind.
     // `settleOpenLifecycleRun` never writes it (it always carries `afterRatio`),
     // and a `failed` run never dispatched, so it has no row to pair with.

package/dist/services/code/auto-compact-orchestrator.js

@@ -36,13 +36,14 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { getSessionIdCanonical } from '../session/session-manager.js';
+import { getSessionDir } from '../session/getSessionDir.js';
 import { resolveOuterSessionId } from '../session/binding-status-service.js';
 import { resolveCanonicalProjectRoot } from '../config/config-service.js';
 import { describeHarnessWindowSync, harnessWindowSyncWarning } from '../context/harness-window-config.js';
 import { AUTO_COMPACT_PRE_COMPACT_RATIO, DEPRECATED_ENVELOPE_FIELDS } from '../context/auto-compact-types.js';
 import { describeMode, thresholdFor } from './auto-compact-modes.js';
 import { resolveAutoCompactProfile } from '../mode/mode-status-service.js';
-import { CompactLifecyclePublisher, fillEventSettledMeasurement, newCompactRunId, resolveDispatchedStage, settleOpenLifecycleRun, summarizeLifecycleError } from './auto-compact-lifecycle.js';
+import { CompactLifecyclePublisher, fillEventSettledMeasurement, newCompactRunId, readOpenDispatchRun, resolveDispatchedStage, settleOpenLifecycleRun, summarizeLifecycleError } from './auto-compact-lifecycle.js';
 const PRE_COMPACT_REASON = 'pre-compact-auto';
 /**
  * Map a context ratio to a `CompactTrigger` action. Pure; the side
@@ -195,7 +196,10 @@ export function buildConvergencePlan(input) {
  * transcript).
  */
 function appendAutoDecisionLog(input) {
-    const dir = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'txt');
+    // Repair R6: same hand-rolled join as `writePreCompactCheckpoint`. All four
+    // session-scoped paths in this file now go through the axis builder; none
+    // composes the join itself, so none can resolve outside the project root.
+    const dir = join(getSessionDir(input.projectRoot, input.sessionId), 'txt');
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true });
     const logPath = join(dir, 'auto-decisions.md');
@@ -235,7 +239,7 @@ function appendAutoDecisionLog(input) {
  * state re-injection. Not a capability peaks-loop has today.
  */
 function writeMainSessionCompactIntent(input) {
-    const dir = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'txt');
+    const dir = join(getSessionDir(input.projectRoot, input.sessionId), 'txt');
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true });
     const path = join(dir, 'auto-compact-pending.json');
@@ -255,7 +259,12 @@ function writeMainSessionCompactIntent(input) {
  * checkpoint` so D7's post-compact-detect picks it up unchanged.
  */
 function writePreCompactCheckpoint(input) {
-    const dir = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'checkpoints');
+    // Repair R6: this used to hand-roll the session join, which is the one shape
+    // `getSessionDir`'s own header records as NOT covered by the guard — an
+    // unsafe id resolved outside the project root and the checkpoint was written
+    // there. The gate above now refuses an unresolvable id before this point, but
+    // `--force` outranks that gate, so this join has to hold on its own.
+    const dir = join(getSessionDir(input.projectRoot, input.sessionId), 'checkpoints');
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true });
     const prefix = input.redLine === true ? 'red-line-' : 'pre-compact-';
@@ -382,25 +391,37 @@ export async function runAutoCompact(input) {
         // still open at `compacting`. Nothing is written when there is no
         // open run, when the ratio is still high, or when the probe could
         // not measure at all.
-        const settled = settleOpenLifecycleRun({
+        const settleRead = settleOpenLifecycleRun({
             projectRoot: input.projectRoot,
             sessionId,
             measuredRatio: probe.ratio,
             source: probe.source,
             autoFireThreshold: thresholdFor(mode, 'autoFire'),
-            onLifecycleStage: input.onLifecycleStage
-        }) ??
-            // Repair R1 (`2026-09-13-compact-event-settle`): the HARNESS event may
-            // already have closed this run WITHOUT an honest post-compact number —
-            // in which case the call above finds nothing open, and without this the
-            // calibration pair stays blank for exactly the compactions the event path
-            // exists to witness. Fills the number the event owed.
-            fillEventSettledMeasurement({
-                projectRoot: input.projectRoot,
-                sessionId,
-                measuredRatio: probe.ratio,
-                source: probe.source
-            });
+            onLifecycleStage: input.onLifecycleStage,
+            failLifecycleWrite: input.testHooks?.failLifecycleWrite
+        });
+        // Repair R6 (AC3): a settle whose lifecycle write FAILED has not settled the
+        // run — the record is still resting at `armed` / `compacting`, so the next
+        // probe finds the same run open and settles it again. Appending the
+        // "observed compaction point" row anyway writes one row per probe for a
+        // compaction the lifecycle store never recorded: an unbounded append driven
+        // by a write that did not happen, and a history row whose paired lifecycle
+        // record does not exist. Nothing is lost by deferring the row — `probe.ratio`
+        // is re-measured on every probe, so the retry carries a fresh number.
+        const settled = settleRead !== null && !settleRead.lifecycleWritten
+            ? null
+            : (settleRead ??
+                // Repair R1 (`2026-09-13-compact-event-settle`): the HARNESS event may
+                // already have closed this run WITHOUT an honest post-compact number —
+                // in which case the call above finds nothing open, and without this the
+                // calibration pair stays blank for exactly the compactions the event path
+                // exists to witness. Fills the number the event owed.
+                fillEventSettledMeasurement({
+                    projectRoot: input.projectRoot,
+                    sessionId,
+                    measuredRatio: probe.ratio,
+                    source: probe.source
+                }));
         // Slice 2026-09-13-auto-compact-trigger-ownership (T4): a settle means a
         // dispatched compact demonstrably landed. Append an `observed` row
         // carrying the measured ratio, so `peaks compact history` can show
@@ -460,6 +481,85 @@ export async function runAutoCompact(input) {
     }
     const isRedLine = decision.reason === 'red-line';
     const now = input.now ?? new Date();
+    // rid `2026-09-14-compact-dispatch-backoff`: ONE dispatch per compact
+    // attempt.
+    //
+    // The decision above fires whenever the ratio is at or over the auto-fire
+    // threshold, and the ratio does not come back down on its own — nothing in
+    // peaks-loop can compact a running session, and the harness fires only at
+    // its own red line. So "shouldCompact" was true on every probe, forever: one
+    // real session's `compact-history.jsonl` holds 1075 dispatch rows, 444
+    // checkpoints and ZERO compactions over 15.5 h — and the file was still
+    // growing while this slice ran. Re-dispatching bought nothing, because the
+    // `ide-native` dispatch only installs a PreToolUse hook and installing it
+    // again is a documented no-op: 1074 of those 1075 rows say `already
+    // installed` in their own `dispatchMessage`. It produced rows, not
+    // compactions.
+    //
+    // The lifecycle store already knows whether an attempt is outstanding (see
+    // `readOpenDispatchRun` — `armed`/`compacting` = dispatched, `completed`/
+    // `failed` = over), so the gate needs no new state and no threshold: it is
+    // keyed on the STAGE of the open run, never on a ratio, which is why it
+    // survives any future realignment of the 0.65/0.70/0.85/0.95 table.
+    //
+    // What is NOT suppressed: the probe still measures and still reports. The
+    // envelope carries the LIVE ratio plus the ratio the open ask was made at,
+    // so "it crossed and it is still high, unanswered" stays legible on every
+    // turn — the difference between a quiet signal and a silenced one.
+    //
+    // `force` (the `--force` test seam, "force compact at any ratio") outranks
+    // the inference: an explicit instruction must not be silently reduced to a
+    // no-op, which would make the published flag a lie.
+    // Repair R6: `readOpenDispatchRun` answers in THREE states, not two. `none`
+    // admits the dispatch; `unresolvable` means the backoff's question could not
+    // be asked — the session id names no session directory, so no lifecycle
+    // record can exist under it and the gate used to read that as "nothing is
+    // outstanding". Measured on ONE directory before this: a legal sid found the
+    // open `armed` run and suppressed the dispatch; `./<legal sid>`, which joins
+    // to the identical path, returned `null` and dispatched. A gate that reads a
+    // string instead of the artifact the string names is the defect the whole
+    // id axis exists to close, so an unanswerable question is NOT an admit: the
+    // conservative direction is to leave the dispatch undone and say why.
+    const openRun = readOpenDispatchRun({ projectRoot: input.projectRoot, sessionId });
+    if (openRun.kind === 'unresolvable' && input.force !== true) {
+        return {
+            ok: true,
+            code: 'AUTO_COMPACT_UNRESOLVED_SESSION',
+            message: `Context at ${(probe.ratio * 100).toFixed(1)}%; a compact may be warranted, but this session's ` +
+                `directory could not be resolved (${openRun.reason}), so whether a compact was already dispatched ` +
+                `for this crossing cannot be answered. Not dispatching: an unanswered question is not a 'no'. ` +
+                `The session id comes from the active binding or from the caller.`,
+            data: {
+                sessionId,
+                ratio: probe.ratio,
+                source: probe.source,
+                decision: 'unresolved-session',
+                harnessWindow
+            }
+        };
+    }
+    if (openRun.kind === 'open' && input.force !== true) {
+        return {
+            ok: true,
+            code: 'AUTO_COMPACT_ALREADY_ARMED',
+            message: `Context at ${(probe.ratio * 100).toFixed(1)}% — still above the ` +
+                `${(thresholdFor(mode, 'autoFire') * 100).toFixed(0)}% auto-fire threshold (mode=${mode}); ` +
+                `a compact was already dispatched for this crossing at ${(openRun.triggerRatio * 100).toFixed(1)}% ` +
+                `(run ${openRun.runId}, resting at '${openRun.stage}') and nothing has compacted since. ` +
+                `Not dispatching again: the trigger is already registered, so a second dispatch would install the ` +
+                `same hook and add a checkpoint and a history row without adding a capability. ` +
+                `Re-probe with \`peaks code context-now\`.`,
+            data: {
+                sessionId,
+                ratio: probe.ratio,
+                source: probe.source,
+                decision: 'already-armed',
+                armedAtRatio: openRun.triggerRatio,
+                armedRunId: openRun.runId,
+                harnessWindow
+            }
+        };
+    }
     // Slice 2026-08-01-compact-lifecycle (Task 5): the decision has now
     // committed to compacting, so the run is `queued`. One runId per
     // attempt; every later transition carries it forward.
@@ -665,7 +765,7 @@ export async function runAutoCompact(input) {
     };
 }
 export function appendCompactHistoryEvent(input) {
-    const dir = join(input.projectRoot, '.peaks', '_runtime', input.sessionId);
+    const dir = getSessionDir(input.projectRoot, input.sessionId);
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true });
     const path = join(dir, 'compact-history.jsonl');

package/dist/services/code/compact-event-settle.d.ts

@@ -29,18 +29,30 @@ export type CompactSettleResult = {
     /** Present only when the harness reported one. */
     readonly trigger?: CompactTrigger;
     /**
-     * False when the run settled but the `observed` row could not be
-     * appended. The settlement is the load-bearing half and is never undone
-     * for this, but the two outcomes are not the same fact.
+     * Whether the `observed` row for this event is on disk. `false` means
+     * there is none, for one of two DIFFERENT reasons, told apart by
+     * `lifecycleWritten`:
+     *
+     *   - `lifecycleWritten: true` — the append was attempted and threw.
+     *   - `lifecycleWritten: false` — the append was deliberately not made,
+     *     because the settle it would describe is one the store never
+     *     recorded (see `lifecycleWritten`).
      */
     readonly historyWritten: boolean;
     /**
      * False when the lifecycle record could not be written. The run is then
-     * still open, so a later probe will settle it from its own measurement —
-     * but the `observed` row is appended anyway, because the harness's
-     * statement is evidence independent of that write. The two failures are
-     * reported separately rather than collapsed: a caller that sees only one
-     * of them cannot say which half of the settlement landed.
+     * still open, and this path does NOT append the `observed` row: the row
+     * would assert a settled measurement for a run the store still holds at
+     * `armed` / `compacting`, and each arrival would add another one. The
+     * row is deferred rather than lost — the run stays open, so the retry
+     * that does land owns the row and measures the ratio at that moment.
+     * This is repair R6's answer on the probe path
+     * (`auto-compact-orchestrator.ts`), applied here so the two settle
+     * paths agree.
+     *
+     * The two halves are reported separately rather than collapsed: a caller
+     * that sees only one of them cannot say which half of the settlement
+     * landed.
      */
     readonly lifecycleWritten: boolean;
 } | {

package/dist/services/code/compact-event-settle.js

@@ -161,6 +161,27 @@ export function settleCompactFromHarnessEvent(input) {
     if (settled === null) {
         return { settled: false, reason: 'nothing-to-settle' };
     }
+    if (!settled.lifecycleWritten) {
+        // Repair R9 (AC2): a settle whose lifecycle write FAILED has not settled the
+        // run. The record is still resting at `armed` / `compacting`, so the next
+        // arrival — another `PostCompact`, or a probe — finds the SAME run open and
+        // settles it again. Appending the row anyway writes one per arrival for a
+        // compaction the lifecycle store never recorded, each one carrying an
+        // `afterRatio` that reads as a settled measurement; and when the store does
+        // recover, the retry appends a SECOND row for the same compaction, which
+        // `computeWindowCalibration` is free to attach to a later dispatch pair.
+        // Nothing is lost by deferring: `probe.ratio` is re-measured at the retry,
+        // and the retry is the settlement this row is about.
+        return {
+            settled: true,
+            runId: settled.runId,
+            beforeRatio: settled.triggerRatio,
+            afterRatio: settled.afterRatio,
+            historyWritten: false,
+            lifecycleWritten: false,
+            ...(input.trigger !== undefined ? { trigger: input.trigger } : {})
+        };
+    }
     const event = {
         schemaVersion: 1,
         kind: 'observed',