peaks-loop 4.0.49 → 4.0.51

package/dist/services/capability-guard-runner/contracts/J15.js

@@ -1,40 +1,75 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'src/services/openspec/openspec-archive-service.ts',
-    'src/services/openspec/coverage-evidence-reader.ts',
-    'src/cli/commands/openspec-commands.ts'
-];
-const REQUIRED_FRAGMENTS = ['Capability Mapping', 'coverage'];
+import { parseCapabilityMapping, resolveCoverageSummaryPath } from '../../openspec/coverage-evidence-reader.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const COVERAGE_REL = ['coverage', 'coverage-summary.json'];
+const OPENSPEC_REL = ['openspec', 'coverage-summary.json'];
+function writeJson(root, parts, body) {
+    const abs = join(root, ...parts);
+    mkdirSync(join(root, ...parts.slice(0, -1)), { recursive: true });
+    writeFileSync(abs, JSON.stringify(body));
+}
+const PROPOSAL_WITH_MAPPING = [
+    '# change',
+    '',
+    '## Capability Mapping',
+    '',
+    '| capability | source | test anchor |',
+    '| --- | --- | --- |',
+    '| runner | src/services/capability-guard-runner/runner.ts | tests/unit/capability-guard-runner/runner.test.ts |',
+    '',
+    '## Next section',
+    'trailing prose'
+].join('\n');
+/**
+ * Behavioural probe of the fixed coverage-summary discovery order.
+ *
+ * The previous version listed three openspec files and passed if any of them
+ * mentioned "Capability Mapping" AND "coverage" — the string "coverage" appears
+ * in `coverage-evidence-reader.ts` from its own filename.
+ *
+ * Here the real resolver is driven against a tmp project where BOTH candidate
+ * files exist, then only the second, then neither. Only a resolver that honours
+ * the documented order can produce `coverage/` → `openspec/` → missing.
+ */
 export async function runJ15Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J15',
-            contract: 'spec-coverage',
-            status: 'fail',
-            diff: { before: 'an openspec archive/coverage service exists', after: 'no candidate found', reason: 'J15#1 broken: no openspec/coverage surface is present' },
-            artifactPath: 'src/services/openspec/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J15-'));
+    try {
+        const both = join(root, ...COVERAGE_REL);
+        const fallback = join(root, ...OPENSPEC_REL);
+        writeJson(root, COVERAGE_REL, { total: { lines: { pct: 100 } } });
+        writeJson(root, OPENSPEC_REL, { total: { lines: { pct: 0 } } });
+        const first = await resolveCoverageSummaryPath({ projectRoot: root });
+        rmSync(both, { force: true });
+        const second = await resolveCoverageSummaryPath({ projectRoot: root });
+        rmSync(fallback, { force: true });
+        const neither = await resolveCoverageSummaryPath({ projectRoot: root });
+        const proposalPath = join(root, 'proposal.md');
+        writeFileSync(proposalPath, PROPOSAL_WITH_MAPPING);
+        const withBlock = await parseCapabilityMapping(proposalPath);
+        writeFileSync(proposalPath, '# change\n\n## Other section\n');
+        const withoutBlock = await parseCapabilityMapping(proposalPath);
+        const triedPaths = !neither.ok && neither.error.code === 'missing' ? neither.error.triedPaths : [];
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(first.ok && first.value.replace(/\\/g, '/').endsWith('/coverage/coverage-summary.json'), `with both summaries present the c8 wrapper default wins (${first.ok ? first.value : first.error.code})`),
+            probe(second.ok && second.value.replace(/\\/g, '/').endsWith('/openspec/coverage-summary.json'), `with only the openspec summary present the override is used (${second.ok ? second.value : second.error.code})`),
+            probe(!neither.ok && neither.error.code === 'missing', `with neither summary present resolution fails (${neither.ok ? 'resolved' : neither.error.code})`),
+            probe(triedPaths.length === 2 &&
+                triedPaths[0].replace(/\\/g, '/').endsWith('/coverage/coverage-summary.json') &&
+                triedPaths[1].replace(/\\/g, '/').endsWith('/openspec/coverage-summary.json'), `the tried-path list reports the fixed order (${triedPaths.join(' | ') || 'none'})`),
+            probe(withBlock.present && withBlock.rows.length === 1, `a ## Capability Mapping block parses to one row (present=${String(withBlock.present)} rows=${String(withBlock.rows.length)})`),
+            probe(!withoutBlock.present && withoutBlock.rows.length === 0, 'a proposal without the block is reported as absent, not guessed')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/openspec/coverage-evidence-reader.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'coverage-summary discovery order is coverage/ then openspec/, and the Capability Mapping block is parsed not guessed', result.detail, 'J15 invariant broken: the coverage evidence discovery order or the Capability Mapping parse changed');
     }
-    // At least one file references BOTH "Capability Mapping" AND "coverage".
-    const fullCoverage = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8');
-        return REQUIRED_FRAGMENTS.every((frag) => src.includes(frag));
-    });
-    if (!fullCoverage) {
-        return {
-            journeyId: 'J15',
-            contract: 'spec-coverage',
-            status: 'fail',
-            diff: { before: 'openspec services reference both "Capability Mapping" and "coverage"', after: 'no such service', reason: 'J15#1 broken: openspec archive gate is missing the Capability Mapping + coverage cross-check' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J15',
-        contract: 'spec-coverage',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/_shared.d.ts

@@ -0,0 +1,24 @@
+import type { CapabilityBaselineRow } from '../../capability-baseline/types.js';
+import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * The frozen baseline row this contract is bound to. Throws when the baseline
+ * is unreadable or the row is absent — a contract with no baseline behind it
+ * must not be able to report green.
+ */
+export declare function requireBaselineRow(ctx: GuardContext): CapabilityBaselineRow;
+/**
+ * Every `sourceFiles` entry of the row must still exist. The baseline names the
+ * files that carry the journey; a vanished file is drift, so this returns the
+ * missing ones rather than filtering them out.
+ */
+export declare function missingSourceFiles(ctx: GuardContext, row: CapabilityBaselineRow): ReadonlyArray<string>;
+export declare function pass(ctx: GuardContext, artifactPath: string): GuardRunResult;
+export declare function fail(ctx: GuardContext, artifactPath: string, before: string, after: string, reason: string): GuardRunResult;
+/** Result of a source-level probe; `ok` drives pass/fail, `detail` the diff. */
+export interface Probe {
+    readonly ok: boolean;
+    readonly detail: string;
+}
+export declare function combineProbes(probes: ReadonlyArray<Probe>): Probe;
+/** Convenience: build a probe whose ok-ness is a boolean and a label. */
+export declare function probe(ok: boolean, detail: string): Probe;

package/dist/services/capability-guard-runner/contracts/_shared.js

@@ -0,0 +1,67 @@
+// src/services/capability-guard-runner/contracts/_shared.ts
+//
+// Helpers shared by the J01–J15 guard contracts.
+//
+// The point of these contracts is to answer "is this journey's behaviour still
+// right?", not "does some file still contain some word?". The helpers here
+// keep that honest and cheap:
+//   - the file list comes from the FROZEN BASELINE ROW, never from a
+//     hand-written candidate list inside the contract (so a baseline/source
+//     drift is visible instead of being papered over by a fallback path);
+//   - a missing source file is a contract failure, not a silently narrower
+//     check.
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { readBaselineFile } from '../../capability-baseline/store.js';
+/**
+ * The frozen baseline row this contract is bound to. Throws when the baseline
+ * is unreadable or the row is absent — a contract with no baseline behind it
+ * must not be able to report green.
+ */
+export function requireBaselineRow(ctx) {
+    const journeyId = ctx.contract.source.baselineRow;
+    const r = readBaselineFile(ctx.projectRoot);
+    if (!r.ok) {
+        throw new Error(`baseline unreadable at ${ctx.projectRoot} (${r.error.code}: ${r.error.message})`);
+    }
+    const row = r.file.rows.find((x) => x.journeyId === journeyId);
+    if (!row) {
+        throw new Error(`baseline row ${journeyId} is not in the frozen baseline`);
+    }
+    return row;
+}
+/**
+ * Every `sourceFiles` entry of the row must still exist. The baseline names the
+ * files that carry the journey; a vanished file is drift, so this returns the
+ * missing ones rather than filtering them out.
+ */
+export function missingSourceFiles(ctx, row) {
+    return row.sourceFiles.filter((f) => !existsSync(join(ctx.projectRoot, f)));
+}
+export function pass(ctx, artifactPath) {
+    return {
+        journeyId: ctx.contract.journeyId,
+        contract: ctx.contract.kind,
+        status: 'pass',
+        artifactPath
+    };
+}
+export function fail(ctx, artifactPath, before, after, reason) {
+    return {
+        journeyId: ctx.contract.journeyId,
+        contract: ctx.contract.kind,
+        status: 'fail',
+        diff: { before, after, reason },
+        artifactPath
+    };
+}
+export function combineProbes(probes) {
+    const bad = probes.filter((p) => !p.ok);
+    if (bad.length === 0)
+        return { ok: true, detail: probes.map((p) => p.detail).join('; ') };
+    return { ok: false, detail: bad.map((p) => p.detail).join('; ') };
+}
+/** Convenience: build a probe whose ok-ness is a boolean and a label. */
+export function probe(ok, detail) {
+    return { ok, detail };
+}

package/dist/services/capability-guard-runner/registry.d.ts

@@ -0,0 +1,5 @@
+import { type JourneyId } from '../capability-baseline/types.js';
+import type { GuardContract } from './types.js';
+export declare const GUARD_CONTRACTS: ReadonlyArray<GuardContract>;
+export declare function getGuardContract(journeyId: JourneyId): GuardContract | undefined;
+export declare function isJourneyId(value: string): value is JourneyId;

package/dist/services/capability-guard-runner/registry.js

@@ -0,0 +1,140 @@
+// src/services/capability-guard-runner/registry.ts
+//
+// The single production entry point for the 15 P0 guard contracts.
+//
+// Why a registry: before this, `baseline run-guard` hard-coded `J01`, and the
+// only caller of `runAllGuards` was its own unit test (which passed synthetic
+// contracts against `projectRoot: '/'`). There was no production path that ran
+// all fifteen journeys — so "15 pass / 0 fail" was an assertion nobody made.
+//
+// Each contract declares the baseline row AND the verbatim invariant text it
+// enforces; `assertBaselineRef` resolves that against
+// openspec/baselines/current/capability-baseline.json before the contract runs.
+import { P0_JOURNEY_IDS } from '../capability-baseline/types.js';
+import { runJ01Contract } from './contracts/J01.js';
+import { runJ02Contract } from './contracts/J02.js';
+import { runJ03Contract } from './contracts/J03.js';
+import { runJ04Contract } from './contracts/J04.js';
+import { runJ05Contract } from './contracts/J05.js';
+import { runJ06Contract } from './contracts/J06.js';
+import { runJ07Contract } from './contracts/J07.js';
+import { runJ08Contract } from './contracts/J08.js';
+import { runJ09Contract } from './contracts/J09.js';
+import { runJ10Contract } from './contracts/J10.js';
+import { runJ11Contract } from './contracts/J11.js';
+import { runJ12Contract } from './contracts/J12.js';
+import { runJ13Contract } from './contracts/J13.js';
+import { runJ14Contract } from './contracts/J14.js';
+import { runJ15Contract } from './contracts/J15.js';
+/** The integration test that pins each journey's contract. */
+const ARTIFACTS = {
+    J01: 'tests/integration/capability-guard/J01-envelope-arg-shapes.test.ts',
+    J02: 'tests/integration/capability-guard/J02-workflow-trace.test.ts',
+    J03: 'tests/integration/capability-guard/J03-problem-resolution-flow.test.ts',
+    J04: 'tests/integration/capability-guard/J04-audit-goal-binding.test.ts',
+    J05: 'tests/integration/capability-guard/J05-final-review-shape.test.ts',
+    J06: 'tests/integration/capability-guard/J06-resume-deepest-gate.test.ts',
+    J07: 'tests/integration/capability-guard/J07-test-runner-fidelity.test.ts',
+    J08: 'tests/integration/capability-guard/J08-asset-roundtrip.test.ts',
+    J09: 'tests/integration/capability-guard/J09-sop-register.test.ts',
+    J10: 'tests/integration/capability-guard/J10-ide-install-assertion.test.ts',
+    J11: 'tests/integration/capability-guard/J11-doctor-cli-snapshot.test.ts',
+    J12: 'tests/integration/capability-guard/J12-lease-lifecycle.test.ts',
+    J13: 'tests/integration/capability-guard/J13-content-pipeline-trace.test.ts',
+    J14: 'tests/integration/capability-guard/J14-issue-orchestrator-trace.test.ts',
+    J15: 'tests/integration/capability-guard/J15-spec-coverage.test.ts'
+};
+/** One row per P0 journey. `invariant` must be verbatim baseline text. */
+const SPECS = {
+    J01: {
+        kind: 'envelope-arg-shapes',
+        invariant: 'The CLI verb is never shown to the user as a required input',
+        execute: runJ01Contract
+    },
+    J02: {
+        kind: 'workflow-trace',
+        invariant: 'Every hard gate (audit / RD / QA / final-review) is enforced; a failure transitions state back to the prior role',
+        execute: runJ02Contract
+    },
+    J03: {
+        kind: 'workflow-trace',
+        invariant: 'No silent-catch or fake-green pattern is reintroduced in src/services/**',
+        execute: runJ03Contract
+    },
+    J04: {
+        kind: 'hook-assertion',
+        invariant: 'The audit covers exactly six dimensions: correctness, completeness, scope, risks, alternatives, constraints',
+        execute: runJ04Contract
+    },
+    J05: {
+        kind: 'workflow-trace',
+        invariant: 'Every final review contains exactly four dimensions: functional-completeness, problem-resolution, no-new-bugs, existing-functionality-intact',
+        execute: runJ05Contract
+    },
+    J06: {
+        kind: 'workflow-trace',
+        invariant: 'The resume option always identifies the deepest completed gate (audit / RD / QA / final-review)',
+        execute: runJ06Contract
+    },
+    J07: {
+        kind: 'cli-output-golden',
+        invariant: "Per-test fingerprint cache never returns 'passed' for an unverified file (fileMtime + fileSha256 gate)",
+        execute: runJ07Contract
+    },
+    J08: {
+        kind: 'asset-roundtrip',
+        invariant: 'Crystallization requires all gates (audit / RD / QA / final-review) to be in a passing state',
+        execute: runJ08Contract
+    },
+    J09: {
+        kind: 'sop-register',
+        invariant: 'An SOP id must match SOP_ID_PATTERN (lowercase kebab, no dots/slashes) to prevent path traversal',
+        execute: runJ09Contract
+    },
+    J10: {
+        kind: 'hook-assertion',
+        invariant: 'planHookInstall() runs before applyHookInstall() so the diff is reviewable',
+        execute: runJ10Contract
+    },
+    J11: {
+        kind: 'cli-output-golden',
+        invariant: 'Doctor checks live under src/services/doctor/doctor-service/checks/ as a code-driven fixed-registry tree',
+        execute: runJ11Contract
+    },
+    J12: {
+        kind: 'concurrency-lease',
+        invariant: 'Auto-release on terminal heartbeat is best-effort but idempotent: duplicate release is a no-op',
+        execute: runJ12Contract
+    },
+    J13: {
+        kind: 'workflow-trace',
+        invariant: 'The skill does NOT import peaks-code internals; it reuses the Loop Engineering primitives',
+        execute: runJ13Contract
+    },
+    J14: {
+        kind: 'workflow-trace',
+        invariant: 'Every fix carries an AI-modified declaration in the commit body (RL-3)',
+        execute: runJ14Contract
+    },
+    J15: {
+        kind: 'spec-coverage',
+        invariant: 'Coverage-summary discovery order is fixed: <projectRoot>/coverage/coverage-summary.json then /openspec/coverage-summary.json',
+        execute: runJ15Contract
+    }
+};
+export const GUARD_CONTRACTS = P0_JOURNEY_IDS.map((journeyId) => {
+    const spec = SPECS[journeyId];
+    return {
+        journeyId,
+        kind: spec.kind,
+        source: { baselineRow: journeyId, invariant: spec.invariant },
+        execute: spec.execute,
+        evidence: { kind: spec.kind, artifact: ARTIFACTS[journeyId] }
+    };
+});
+export function getGuardContract(journeyId) {
+    return GUARD_CONTRACTS.find((c) => c.journeyId === journeyId);
+}
+export function isJourneyId(value) {
+    return P0_JOURNEY_IDS.includes(value);
+}

package/dist/services/capability-guard-runner/runner.d.ts

@@ -1,5 +1,22 @@
+import type { CapabilityBaselineRow } from '../capability-baseline/types.js';
 import type { GuardContract, GuardContext, GuardRunResult } from './types.js';
+/**
+ * Resolve the contract's declared baseline row out of the frozen baseline and
+ * assert the declared invariant is verbatim text in that row.
+ *
+ * Before this, the check was `if (!source.baselineRow || !source.invariant)`,
+ * i.e. it only asserted the two fields were truthy. Nothing ever read the
+ * baseline, so a contract could name a journey / invariant that does not exist
+ * in the frozen file and still run to a green result.
+ */
+export declare function assertBaselineRef(contract: GuardContract, projectRoot: string): CapabilityBaselineRow;
 export declare function runGuard(contract: GuardContract, ctx: GuardContext): Promise<GuardRunResult>;
+/**
+ * Run every contract and aggregate. A contract that throws (bad baseline
+ * reference, unreadable source file, a probe that blows up) is recorded as a
+ * `fail` result rather than aborting the whole run — the gate has to be able
+ * to say "this journey is broken", not just crash.
+ */
 export declare function runAllGuards(contracts: ReadonlyArray<GuardContract>, ctx: GuardContext): Promise<{
     readonly pass: number;
     readonly fail: number;
@@ -7,3 +24,12 @@ export declare function runAllGuards(contracts: ReadonlyArray<GuardContract>, ct
     readonly total: number;
     readonly results: ReadonlyArray<GuardRunResult>;
 }>;
+/**
+ * Exit-code contract for a guard summary. `skipped` must not be
+ * indistinguishable from `pass`: a run that quietly skipped work is a
+ * different outcome from a run that verified work, so it gets its own code.
+ */
+export declare function exitCodeForGuardSummary(summary: {
+    readonly fail: number;
+    readonly skipped: number;
+}): 0 | 1 | 2;

package/dist/services/capability-guard-runner/runner.js

@@ -1,16 +1,61 @@
-function assertBaselineRef(contract) {
-    if (!contract.source.baselineRow || !contract.source.invariant) {
-        throw new Error('GUARD_CONTRACT_MISSING_BASELINE_REF: contract must reference a baseline row and invariant');
+// src/services/capability-guard-runner/runner.ts
+import { readBaselineFile } from '../capability-baseline/store.js';
+/**
+ * Resolve the contract's declared baseline row out of the frozen baseline and
+ * assert the declared invariant is verbatim text in that row.
+ *
+ * Before this, the check was `if (!source.baselineRow || !source.invariant)`,
+ * i.e. it only asserted the two fields were truthy. Nothing ever read the
+ * baseline, so a contract could name a journey / invariant that does not exist
+ * in the frozen file and still run to a green result.
+ */
+export function assertBaselineRef(contract, projectRoot) {
+    const r = readBaselineFile(projectRoot);
+    if (!r.ok) {
+        throw new Error(`GUARD_CONTRACT_MISSING_BASELINE_REF: ${contract.journeyId} cannot read the frozen baseline at ${projectRoot} (${r.error.code}: ${r.error.message})`);
     }
+    const row = r.file.rows.find((x) => x.journeyId === contract.source.baselineRow);
+    if (!row) {
+        throw new Error(`GUARD_CONTRACT_MISSING_BASELINE_REF: ${contract.journeyId} references baseline row ${contract.source.baselineRow}, which is not in the frozen baseline`);
+    }
+    const declared = contract.source.invariant;
+    if (typeof declared !== 'string' || declared.trim().length === 0) {
+        throw new Error(`GUARD_CONTRACT_MISSING_BASELINE_REF: ${contract.journeyId} declares an empty invariant`);
+    }
+    if (!row.invariants.includes(declared)) {
+        throw new Error(`GUARD_CONTRACT_MISSING_BASELINE_REF: ${contract.journeyId} declares invariant "${declared}", which is not a verbatim invariant of baseline row ${row.journeyId}`);
+    }
+    return row;
 }
 export async function runGuard(contract, ctx) {
-    assertBaselineRef(contract);
-    return contract.execute(ctx);
+    assertBaselineRef(contract, ctx.projectRoot);
+    return contract.execute({ ...ctx, contract });
 }
+/**
+ * Run every contract and aggregate. A contract that throws (bad baseline
+ * reference, unreadable source file, a probe that blows up) is recorded as a
+ * `fail` result rather than aborting the whole run — the gate has to be able
+ * to say "this journey is broken", not just crash.
+ */
 export async function runAllGuards(contracts, ctx) {
     const results = [];
     for (const c of contracts) {
-        results.push(await runGuard(c, ctx));
+        try {
+            results.push(await runGuard(c, ctx));
+        }
+        catch (e) {
+            results.push({
+                journeyId: c.journeyId,
+                contract: c.kind,
+                status: 'fail',
+                diff: {
+                    before: 'contract runs against the frozen baseline',
+                    after: e.message,
+                    reason: `${c.journeyId} contract could not run`
+                },
+                artifactPath: c.evidence.artifact
+            });
+        }
     }
     return {
         pass: results.filter((r) => r.status === 'pass').length,
@@ -20,3 +65,15 @@ export async function runAllGuards(contracts, ctx) {
         results
     };
 }
+/**
+ * Exit-code contract for a guard summary. `skipped` must not be
+ * indistinguishable from `pass`: a run that quietly skipped work is a
+ * different outcome from a run that verified work, so it gets its own code.
+ */
+export function exitCodeForGuardSummary(summary) {
+    if (summary.fail > 0)
+        return 1;
+    if (summary.skipped > 0)
+        return 2;
+    return 0;
+}

package/dist/services/code/auto-compact-modes.d.ts

@@ -2,8 +2,8 @@
  * Slice 2026-07-28 — auto-compact mode table for 24h long-run awareness.
  *
  * The default `'standard'` mode preserves the v2.13.0 zero-pause contract
- * thresholds (preCompact=0.85, redLine=0.95). The `'partial'` mode fires
- * earlier for 24h long-run scenarios where the user has explicitly
+ * thresholds (autoFire=0.80, preCompact=0.85, redLine=0.95). The `'partial'`
+ * mode fires earlier for 24h long-run scenarios where the user has explicitly
  * opted into higher compaction cadence via `peaks session 24h-mode`.
  *
  * Slice 2026-07-29-context-evaluation-accuracy Part 22: a new
@@ -26,5 +26,16 @@ export declare const AUTO_COMPACT_THRESHOLDS: Readonly<Record<AutoCompactMode, {
 }>>;
 export declare function thresholdFor(mode: AutoCompactMode, kind: 'autoFire' | 'preCompact' | 'redLine'): number;
 export declare function isValidMode(value: string): value is AutoCompactMode;
+/**
+ * Human-readable form of a mode's threshold row.
+ *
+ * Derived from `AUTO_COMPACT_THRESHOLDS` rather than hand-written. Diagnosis
+ * 2026-09-15 (C1) found this string advertising `0.85/0.95` for `standard`
+ * while the table had auto-fired at `0.80` since slice
+ * 2026-07-29-context-evaluation-accuracy added the `autoFire` tier — the
+ * description named only the two thresholds that were left over from the
+ * v2.13.0 contract, and skipped the one that actually fires. Reading the
+ * numbers out of the table makes that drift unrepresentable.
+ */
 export declare function describeMode(mode: AutoCompactMode): string;
 export declare function isPartialModeEligible(contextPercent: number): boolean;

package/dist/services/code/auto-compact-modes.js

@@ -2,8 +2,8 @@
  * Slice 2026-07-28 — auto-compact mode table for 24h long-run awareness.
  *
  * The default `'standard'` mode preserves the v2.13.0 zero-pause contract
- * thresholds (preCompact=0.85, redLine=0.95). The `'partial'` mode fires
- * earlier for 24h long-run scenarios where the user has explicitly
+ * thresholds (autoFire=0.80, preCompact=0.85, redLine=0.95). The `'partial'`
+ * mode fires earlier for 24h long-run scenarios where the user has explicitly
  * opted into higher compaction cadence via `peaks session 24h-mode`.
  *
  * Slice 2026-07-29-context-evaluation-accuracy Part 22: a new
@@ -28,10 +28,26 @@ export function thresholdFor(mode, kind) {
 export function isValidMode(value) {
     return value === 'standard' || value === 'partial';
 }
+function pct(ratio) {
+    return `${(ratio * 100).toFixed(0)}%`;
+}
+/**
+ * Human-readable form of a mode's threshold row.
+ *
+ * Derived from `AUTO_COMPACT_THRESHOLDS` rather than hand-written. Diagnosis
+ * 2026-09-15 (C1) found this string advertising `0.85/0.95` for `standard`
+ * while the table had auto-fired at `0.80` since slice
+ * 2026-07-29-context-evaluation-accuracy added the `autoFire` tier — the
+ * description named only the two thresholds that were left over from the
+ * v2.13.0 contract, and skipped the one that actually fires. Reading the
+ * numbers out of the table makes that drift unrepresentable.
+ */
 export function describeMode(mode) {
+    const { autoFire, preCompact, redLine } = AUTO_COMPACT_THRESHOLDS[mode];
+    const bands = `auto-fire ${pct(autoFire)} / pre-compact ${pct(preCompact)} / red-line ${pct(redLine)}`;
     return mode === 'standard'
-        ? 'standard (0.85/0.95 — v2.13.0 zero-pause contract)'
-        : 'partial (0.70/0.85 — 24h long-run mode)';
+        ? `standard (${bands} — v2.13.0 zero-pause contract)`
+        : `partial (${bands} — 24h long-run mode)`;
 }
 export function isPartialModeEligible(contextPercent) {
     return contextPercent >= AUTO_COMPACT_THRESHOLDS.partial.preCompact;

package/dist/services/code/post-compact-detector.js

@@ -24,6 +24,7 @@
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { getSkillPresence } from '../skills/skill-presence-service.js';
+import { isExpectedFsMiss } from '../../shared/fs-utils.js';
 import { emitObservabilityEvent } from '../observability/observability-service.js';
 import { isCodeMode } from './mode-gate.js';
 export const POST_COMPACT_RESUME_REASONS = [
@@ -65,12 +66,19 @@ function safeReadCheckpoint(absPath) {
         const content = mutable;
         return { path: absPath, mtime: stat.mtime, content };
     }
-    catch (err) { // TODO(g2): legacy silent catch — now narrows to IO errors only (grace: 1 minor release, v2.14.0)
-        if (err instanceof ReferenceError)
-            throw err; // surface module-load bugs
+    catch (err) {
+        // P1 site (S6, 2026-09-15). The TODO(g2) marker this replaces said the
+        // catch "narrows to IO errors only" — it did not. It rethrew the two JS
+        // error classes it happened to name and swallowed everything else,
+        // including the ReferenceError an ESM `require()` bug produces on the one
+        // platform this file's whole defence exists for. Corrupt JSON stays loud
+        // (we cannot read a checkpoint we cannot parse); every non-fs-miss error
+        // now propagates. See `isExpectedFsMiss`.
         if (err instanceof SyntaxError)
-            throw err; // surface parse bugs
-        return null; // only swallow IO errors
+            throw err;
+        if (!isExpectedFsMiss(err))
+            throw err;
+        return null;
     }
 }
 function readLatestTodayCheckpoint(runtimeDir, now) {
@@ -227,12 +235,13 @@ function readActiveSkillName(projectRoot) {
         const presence = getSkillPresence(projectRoot);
         return presence?.skill;
     }
-    catch (err) { // TODO(g2): legacy silent catch — now narrows to IO errors only (grace: 1 minor release, v2.14.0)
-        if (err instanceof ReferenceError)
-            throw err; // surface module-load bugs
-        if (err instanceof SyntaxError)
-            throw err; // surface parse bugs
-        return undefined; // only swallow IO errors
+    catch (err) {
+        // P1 site (S6, 2026-09-15) — same correction as `safeReadCheckpoint`
+        // above: a non-fs-miss failure reading the active skill is a bug, not an
+        // absence, and no longer resolves to `undefined` (i.e. to "no skill").
+        if (!isExpectedFsMiss(err))
+            throw err;
+        return undefined;
     }
 }
 /**

package/dist/services/code/step-08-gate.js

@@ -35,6 +35,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { readJobShapeDecision, JobShapeDecisionError, JOB_SHAPE_NOT_DECIDED } from './job-shape-decision.js';
+import { isExpectedFsMiss } from '../../shared/fs-utils.js';
 export const STEP_08_GATE_FILE_NAME = 'job-shape.json';
 export const STEP_08_PROGRESS_FILE_NAME = 'progress.json';
 /**
@@ -85,12 +86,16 @@ function readProgressIfAny(projectRoot, sessionId, jid) {
         }
         return null;
     }
-    catch (err) { // narrows to IO errors only — surface ReferenceError / SyntaxError so future module-load or parse bugs fail loudly (instead of silently masking progress.json corruption)
-        if (err instanceof ReferenceError)
-            throw err; // surface module-load bugs
+    catch (err) {
+        // P1 site (S6, 2026-09-15) — same correction as `readPromptFromLastPromptFile`
+        // below: corrupt progress.json stays loud, and a failure that is not an
+        // fs miss (module-load ReferenceError, TypeError from a bad field, …)
+        // propagates instead of reading as "no progress yet".
         if (err instanceof SyntaxError)
-            throw err; // surface parse bugs (corrupt progress.json)
-        return null; // only swallow IO errors (ENOENT, EACCES, …)
+            throw err;
+        if (!isExpectedFsMiss(err))
+            throw err;
+        return null;
     }
 }
 function readPromptFromLastPromptFile(projectRoot, sessionId) {
@@ -100,7 +105,17 @@ function readPromptFromLastPromptFile(projectRoot, sessionId) {
     try {
         return readFileSync(path, 'utf8');
     }
-    catch {
+    catch (err) {
+        // P1 site (S6, 2026-09-15). This catch was bare — it bound nothing and
+        // swallowed every error class. The sibling reads in this file had been
+        // narrowed; this one had not, so the ONE path that feeds the step-08
+        // backup regex was also the one that could not tell "no prompt file" from
+        // "the module is broken". On the platform this gate exists for, that is
+        // the difference between blocking a disavowal prompt and silently
+        // allowing it. Missing/unreadable text is an empty prompt; anything else
+        // propagates.
+        if (!isExpectedFsMiss(err))
+            throw err;
         return '';
     }
 }