peaks-loop 4.0.48 → 4.0.49

package/dist/services/compact-statusline/compact-statusline-service.js

@@ -9,8 +9,8 @@
 //
 // Decision priority (explicit, no implicit fall-through):
 //   1. lifecycle missing  → fall back to legacy (pending → queued,
-//      recent history → completed WITHOUT an invented after-ratio,
-//      else none)
+//      a recent `observed` history row → completed WITHOUT an invented
+//      after-ratio, else none)
 //   2. lifecycle invalid  → 'invalid' (NEVER fall back to legacy
 //      — a corrupted lifecycle is not a green progress bar)
 //   3. lifecycle valid    → map stage to filledCells via the
@@ -37,9 +37,10 @@
 // ratios. After-ratio is only rendered when the lifecycle record
 // carries a real one; otherwise the bar shows a stable "no
 // measurement" hint.
-import { existsSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { getSessionDir } from '../session/getSessionDir.js';
 import { AUTO_COMPACT_RED_LINE_RATIO } from '../context/auto-compact-types.js';
+import { readCompactHistory } from '../compact-history/compact-history-service.js';
 import { readCompactLifecycle, } from './compact-lifecycle-store.js';
 /**
  * Concrete first-version stale timeout. Adjustable after real timing
@@ -58,7 +59,12 @@ const DEFAULT_STALE_AFTER_MS = 120_000;
  * to not flap on subsequent reads. Adjustable after real timing feedback.
  */
 export const COMPLETED_EXPIRY_MS = 10_000;
-/** Legacy mtime window for the "just compacted" indicator. */
+/**
+ * How recently the last history row must itself have been written for the
+ * legacy path to report it as "just compacted". Measured against the row's own
+ * `ts` — the fact — rather than the file's mtime, which is only a proxy for it
+ * and is also moved by rows that record no compaction (repair R9).
+ */
 const LEGACY_JUST_COMPACTED_WINDOW_MS = 30_000;
 // PRD-002b slice 2 — extract cell-table magic numbers (4/6/8) into named
 // consts so the no-magic-numbers lint rule stops flagging the typed
@@ -142,6 +148,7 @@ export function decideCompactStatusline(input) {
     // lifecycle.kind === 'missing' → fall back to legacy files.
     return decideLegacyFallback({
         projectRoot: input.projectRoot,
+        sessionId: input.sessionId,
         sessionDir,
         now: input.now,
     });
@@ -212,26 +219,53 @@ function decideLegacyFallback(input) {
             // fall through to history check
         }
     }
-    // Priority 2 within legacy: a recent history event within 30s.
-    if (existsSync(historyPath)) {
-        try {
-            const mtimeMs = statSync(historyPath).mtimeMs;
-            if (now - mtimeMs <= LEGACY_JUST_COMPACTED_WINDOW_MS) {
-                // CRITICAL: no invented after-ratio. The history event may
-                // carry a beforeRatio, but never a measured after-ratio;
-                // this is the legacy path and we honour the "no measurement"
-                // default.
-                return {
-                    kind: 'completed',
-                    filledCells: 8,
-                    detail: historyPath,
-                };
-            }
-        }
-        catch {
-            // fall through to idle
+    // Priority 2 within legacy: a history row TESTIFIES that a compaction was
+    // witnessed, recently enough to still be the one being reported.
+    //
+    // Repair R9 (AC4). This used to read the file's mtime — freshness taken as
+    // evidence that "a compact just landed". Freshness is evidence of neither:
+    // the same file takes a `dispatch` row every time peaks-loop ASKS for a
+    // compact, and an ask is an intent, not an outcome. One real session
+    // (2026-09-13, ~15.5 h) holds 1075 dispatch rows and ZERO compactions
+    // (`auto-compact-orchestrator.ts`), so a fresh file was the NORMAL state of a
+    // session in which nothing had compacted at all — and each of those asks
+    // painted this 8-cell "completed" bar.
+    //
+    // So the row's own testimony is read instead, through the same reader the CLI
+    // uses. Only `kind: 'observed'` means a compaction was witnessed (a row with
+    // no `kind` is a dispatch — every pre-`kind` row is one), and the row's `ts`
+    // is the moment compared, not the filesystem's.
+    //
+    // Repair R11. The testimony is looked for in EVERY row inside the window, not
+    // only in the last one. Reading the last row alone made the indicator depend
+    // on the ASK: a `dispatch` row lands on every probe, so an `observed` row
+    // stopped counting the moment peaks-loop asked again — `[observed, dispatch]`
+    // one second apart answered `none` for a compaction that had just been
+    // witnessed — i.e. it deleted the very indicator the mtime read had shown,
+    // the one the replacement was meant to keep honest. A `dispatch` row alone
+    // still testifies
+    // to nothing (the direction R9 closed): what is required is an `observed` row
+    // inside the window, wherever in the file it sits.
+    try {
+        // The reader answers `file-missing` / `empty` itself; the `catch` is for the
+        // read itself, which it does not guard.
+        const read = readCompactHistory({ projectRoot: input.projectRoot, sessionId: input.sessionId });
+        const witnessed = read.kind === 'ok' &&
+            read.events.some((row) => row.kind === 'observed' && now - Date.parse(row.ts) <= LEGACY_JUST_COMPACTED_WINDOW_MS);
+        if (witnessed) {
+            // CRITICAL: no invented after-ratio. The row may carry a measured
+            // afterRatio, but this is the legacy path and we honour the
+            // "no measurement" default.
+            return {
+                kind: 'completed',
+                filledCells: 8,
+                detail: historyPath,
+            };
         }
     }
+    catch {
+        // fall through to idle
+    }
     return { kind: 'none', filledCells: 0 };
 }
 /**

package/dist/services/context/auto-compact-types.d.ts

@@ -128,13 +128,31 @@ export type AutoCompactResult = {
     readonly nextActions: readonly string[];
 } | {
     readonly ok: true;
-    readonly code: 'AUTO_COMPACT_SKIP' | 'AUTO_COMPACT_WAIT';
+    readonly code: 'AUTO_COMPACT_SKIP' | 'AUTO_COMPACT_WAIT' | 'AUTO_COMPACT_ALREADY_ARMED' | 'AUTO_COMPACT_UNRESOLVED_SESSION';
     readonly message: string;
     readonly data: {
         readonly sessionId: string;
         readonly ratio: number;
         readonly source: string;
-        readonly decision: 'below-threshold' | 'in-flight-batch';
+        /**
+         * `unresolved-session` (repair R6): the session id named no session
+         * directory, so the compact backoff's question — "is an attempt already
+         * outstanding?" — could not be asked. It is NOT `already-armed` (no run
+         * was found; the record could not be read at all) and NOT an admit: the
+         * dispatch is left undone because an unanswerable question is not a
+         * "no", and admitting on one is how a gate ends up reading a string
+         * instead of the artifact the string names.
+         */
+        readonly decision: 'below-threshold' | 'in-flight-batch' | 'already-armed' | 'unresolved-session';
+        /**
+         * rid `2026-09-14-compact-dispatch-backoff`, `already-armed` only: the
+         * ratio the open run was dispatched at, and its id. `ratio` above is the
+         * LIVE reading — the pair is what keeps "it is still high" legible after
+         * the backoff drops the per-probe rows: the ask is at `armedAtRatio`, and
+         * the context is now at `ratio`, above it and not yet compacted.
+         */
+        readonly armedAtRatio?: number;
+        readonly armedRunId?: string;
         /**
          * Slice 2026-09-13-auto-compact-trigger-ownership: what syncing the
          * harness auto-compact window did on this probe. `null` = the active

package/dist/services/feedback/feedback-promotion-service.d.ts

@@ -8,23 +8,27 @@
  * primitive behind the `peaks feedback promote` and
  * `peaks feedback check-unpromoted` CLI commands.
  *
- * Promotion tracking convention: a feedback memory is considered
- * "promoted" when one of the following is true:
+ * Promotion tracking convention — two parts, and BOTH are required:
  *
- *   (a) The memory file contains an HTML comment near the top of the
- *       body: `<!-- peaks-feedback-promoted: layer=<A|B|C> -->`.
- *       Written by `peaks feedback promote` so a single read of the
- *       memory file is enough to determine promotion state.
+ *   (a) A MARKER, either an HTML comment near the top of the body
+ *       (`<!-- peaks-feedback-promoted: layer=<A|B|C> -->`) or a sibling
+ *       `.peaks/memory/<name>.promotion.json` sidecar with
+ *       `{ layer: "A" | "B" | "C", ... }`. Written by `peaks feedback
+ *       promote` so a single read of the memory file is enough to see the
+ *       claimed layer.
  *
- *   (b) A sibling `.peaks/memory/<name>.promotion.json` exists with
- *       `{ layer: "A" | "B" | "C", ... }`. Written as a sidecar for
- *       tooling that prefers machine-readable state over embedded
- *       comments (e.g. `verify-pipeline` Gate H).
+ *   (b) The ARTIFACT that layer implies — see `promotionArtifactChecks`.
+ *       rid 2026-09-14-gate-h-promotion: the marker alone used to count,
+ *       which made the gate self-certifying, because the only thing a marker
+ *       proves is that `peaks feedback promote` ran. Every layer-A marker in
+ *       this repo pointed at `sops/<name>.md`, a file that did not exist and
+ *       that no engine reads.
  *
- * The comment marker is the SOURCE OF TRUTH for human review; the
- * sidecar is the source of truth for the scanner. Either is enough
- * to mark a feedback memory as promoted.
+ * The comment marker is the SOURCE OF TRUTH for human review; the sidecar is
+ * the source of truth for the scanner. Neither is evidence on its own.
  */
+import { type PromotionArtifactCheck, type PromotionEvidence } from './promotion-artifact-evidence.js';
+export type { PromotionArtifactCheck, PromotionEvidence };
 export type PromotionLayer = 'A' | 'B' | 'C';
 export declare const PROMOTION_LAYERS: readonly PromotionLayer[];
 export type PromotionLayerDetail = {
@@ -34,6 +38,59 @@ export type PromotionLayerDetail = {
     description: string;
 };
 export declare const PROMOTION_LAYER_DETAILS: readonly PromotionLayerDetail[];
+/**
+ * rid 2026-09-14-gate-h-promotion — what actually backs a promotion.
+ *
+ * Before this, a promotion was honored on the marker alone (HTML comment or
+ * sidecar). Both are written by `peaks feedback promote` and neither proves
+ * that anything was enforced: every layer-A promotion in this repo pointed at
+ * `sops/<name>.md`, a file that did not exist and that no engine reads. The
+ * gate was therefore self-certifying — it read only what the command it tells
+ * you to run had written.
+ *
+ * A promotion is now honored only when its layer's enforcement surface carries
+ * the artifact. The three layers keep artifacts in three different shapes, so
+ * the check is a small table rather than one rule:
+ *
+ *   - A (peaks-sop gate): a SOP manifest at `.peaks/sops/<id>/sop.json` AND an
+ *     entry for `<id>` in `.peaks/sops/registry.json`. The registry half is not
+ *     decoration: `gate-enforce-service.enforceBashCommand` enumerates SOPs via
+ *     `readRegistry()`, so an unregistered manifest is off the enforcement path
+ *     no matter how valid it is.
+ *   - B (peaks-hooks PreToolUse): `.peaks/.claude-settings-template.json` must
+ *     register the rule inside its `hooks` block. The file always exists, so
+ *     existence proves nothing — the evidence is the registration inside it.
+ *   - C (mode-gate hardFloorCategory): `src/services/code/mode-gate.ts` must
+ *     register the rule in the hard-floor vocabulary, for the same reason. This
+ *     is the repo's existing convention: the one real layer-C promotion cites
+ *     its memory by path, from the category's doc block.
+ *
+ * R2 (2026-09-14-gate-h-promotion): each of those is now a PARSE plus a shape
+ * assertion, in `promotion-artifact-evidence.ts`. Every check used to be a
+ * `text.includes(<rule>)` over the whole file, which certified a tree that was
+ * a refusal — an invalid-JSON registry, a template saying "do NOT add a
+ * matcher", a mode-gate line saying the rule is deliberately not a category —
+ * because in each case the rule's name was still in the file's bytes. A name in
+ * a file is not a registration, and a file that cannot be parsed is a finding,
+ * not a permit.
+ */
+/**
+ * SOP id used for a feedback memory's layer-A artifact.
+ *
+ * Prefixed because `peaks-*` SOP ids are reserved for the built-in namespace
+ * (`reservedIdReason` in sop-service.ts) and several feedback memories start
+ * with `peaks-`, which would make them unregistrable under their own name.
+ */
+export declare function sopIdForFeedback(memoryName: string): string;
+/** The artifact(s) and the structural evidence each must carry for `layer` to mean anything. */
+export declare function promotionArtifactChecks(memoryName: string, layer: PromotionLayer): PromotionArtifactCheck[];
+/**
+ * Which of `checks` are not satisfied under `projectRoot`. Empty means the
+ * promotion is backed by its artifact. Never throws, and never permits: a file
+ * that is absent, unreadable, or unparseable is a finding, not a warning —
+ * "cannot read the evidence" must not read as "the evidence is good".
+ */
+export declare function missingArtifacts(checks: readonly PromotionArtifactCheck[], projectRoot: string): string[];
 export type FeedbackMemory = {
     /** File basename (without `.md`). */
     name: string;
@@ -59,6 +116,43 @@ export type UnpromotedFeedbackEntry = {
     path: string;
     reason: string;
 };
+/**
+ * rid 2026-09-14-gate-h-promotion (classify slice) — the "not to be promoted"
+ * declaration.
+ *
+ * The gate used to know only `has artifact` / `has no artifact`, so a memory that
+ * prescribes no action could never pass: promoting it registers a SOP whose only
+ * gate is "the source file still exists", which asserts nothing about behaviour.
+ * That is a permanent false positive — the old vacuity defect facing the other way.
+ *
+ * The declaration closes it, but it must not become a way to silence the gate.
+ * It differs from the refused grandfather channel (`promotedAt` older than this
+ * rule) in that a grandfather exemption is a property of a memory's AGE: every
+ * legacy memory has it, it says nothing about content, and nobody has to assert
+ * or defend it. This is a bounded claim about the memory's CONTENT:
+ *
+ *   1. The code is drawn from a closed vocabulary — free text cannot be used.
+ *   2. Each code binds to a predicate over the memory's own frontmatter, which
+ *      the gate recomputes. The declaration may only RESTATE what the memory
+ *      already says; it cannot introduce a new fact.
+ *   3. A reason string is required (the `closedAt` escape hatch beside it has none).
+ *   4. Coexisting with a promotion marker is a contradiction and fails, so the
+ *      channel cannot be used to bury a promotion whose artifact is missing.
+ *   5. Exempted memories stay REPORTED via `listPromotionExempt`, so the
+ *      unpromoted count never drops silently.
+ */
+export declare const NOT_TO_PROMOTE_CODES: readonly ["non-actionable", "closed-slice-note"];
+export type NotToPromoteCode = (typeof NOT_TO_PROMOTE_CODES)[number];
+export type NotToPromoteRead = {
+    kind: 'none';
+} | {
+    kind: 'valid';
+    code: NotToPromoteCode;
+    reason: string;
+} | {
+    kind: 'invalid';
+    reason: string;
+};
 /**
  * Parse a single `.peaks/memory/<file>.md` into a FeedbackMemory, or
  * `null` when the file is missing / unreadable / not a feedback memory.
@@ -78,6 +172,26 @@ export declare function parseFeedbackMemory(filePath: string): FeedbackMemory |
 export declare function listUnpromotedFeedback(opts: {
     projectRoot: string;
 }): UnpromotedFeedbackEntry[];
+/**
+ * Read the memory's not-to-promote declaration. `invalid` is returned rather than
+ * `none` when the fields are present but unusable, so the gate fails with a reason
+ * instead of quietly treating a malformed declaration as "no declaration".
+ */
+export declare function readNotToPromote(filePath: string): NotToPromoteRead;
+export type PromotionExemptEntry = {
+    name: string;
+    path: string;
+    code: NotToPromoteCode;
+    reason: string;
+};
+/**
+ * The feedback memories that declare themselves out of the gate. Exposed so the
+ * gate can REPORT them: an exemption nobody can see is the vacuity this whole
+ * channel is required to avoid. Never throws.
+ */
+export declare function listPromotionExempt(opts: {
+    projectRoot: string;
+}): PromotionExemptEntry[];
 /**
  * Generate the code stub for a given layer. Returns a Markdown
  * snippet the LLM / human can paste into the appropriate file. Pure
@@ -97,7 +211,16 @@ export type FeedbackPromoteEnvelope = {
     feedbackPath: string;
     layer: PromotionLayer;
     layerDetail: string;
+    /**
+     * Files this call actually wrote. rid 2026-09-14-gate-h-promotion: this used
+     * to be the stub's *targets* — paths the command never wrote yet printed as
+     * `Generated files:` — which is the defect the Gate H rework exists to remove.
+     */
     generatedFiles: string[];
+    /** The artifact(s) `layer` requires before the promotion means anything. */
+    requiredArtifacts: string[];
+    /** `false` when `requiredArtifacts` are not all present — the marker is then a claim without evidence. */
+    effective: boolean;
     snippet: string;
     promotedAt: string;
     promotedBy: string;
@@ -119,5 +242,5 @@ export declare function promoteFeedback(opts: {
     sessionId: string;
     projectRoot: string;
     dryRun?: boolean;
-}): FeedbackPromoteEnvelope;
+}): Promise<FeedbackPromoteEnvelope>;
 export declare function isPromotionLayer(value: string): value is PromotionLayer;