sillyspec 3.31.0 → 3.32.1

package/src/watcher.js

@@ -1,1031 +1,1067 @@
-/**
- * watcher.js — change 产物签名 watcher（R7 切片一，detached 观测旁路）。
- *
- * 背景（2026-09-22-r7-protocol-surgery 切片一 / D-001）：协议对话与平台心跳共线（信道
- * 混乱）——进度信号只能靠 CLI 调用推进。本模块把观测从协议解耦：change 启动即拉起
- * detached 监听进程，从**产物签名**（文件/git/工件三类源）推断阶段并落事件流。事件恒带
- * provisional:true，平台 ingest 只展示不判定——`--done`（或 flow done）是唯一真相，
- * watcher 是 best-effort 缓存，崩溃/不 spawn 零影响主流程。
- *
- * 结构循 src/run/bg-sync.js（spawn detached + windowsHide + 单飞锁 + 日志截尾），两处
- * 语义差异：①长驻——锁加 heartbeatAt 心跳字段（30s 刷新，5min 无心跳或 pid 死判死；
- * bg-sync 只有 startedAt 时效）；②**未连接平台也 spawn**（本地 jsonl 是事件唯一真相源，
- * 平台推送是展示面增强；bg-sync 的 not-connected 短路不适用）。
- *
- * 观测机制=轮询快照 diff（3s，弃 fs.watch：Windows/网络盘跨平台不可靠+递归噪声；事件数
- * 与 CLI 调用数解耦是验收钉，轮询天然满足）。轮询面收窄：change 子树已知产物 +
- * git HEAD 头指针 + verify-quality-scan 记录——不扫全仓。
- *
- * 平台推送：POST {platform.url}/api/changes/{name}/events 单事件上行端点（平台侧
- * 2026-09-26-change-events-r18-full 契约；旧 /api/observation/events 批量端点随废弃
- * 分支消亡——2026-09-27-watcher-push-endpoint 对齐），实现模式循
- * src/agent-session-log.js 的 pushAgentLogToPlatform（凭据读取同 readPlatformPushConfig
- * 的 local.yaml platform 段/env 双通道——该函数未导出且 agent-session-log 属他任务
- * allowed_paths，此处同模式自建；5s 超时/条+best-effort+env SILLYSPEC_WATCHER_PUSH=0
- * 开关；未配置/非 2xx/网络失败静默降级本地-only）。事件经 toPlatformChangeEvents
- * 映射为平台单条契约（kind/rule/severity/provisional/detail/ts；stage 以「stage · note」
- * 前缀并入 detail 文本、provisional 恒 true、ts=ISO UTC；本地事件无 id 不带——
- * 平台去重键回退 ts+'|'+rule），逐条 POST 恒 200 语义；平台按去重键
- * 幂等吸收重推（at-least-once 上行安全）。
- *
- * 副产品：阶段墙钟拆账（产物事件时间序列聚合）落 .runtime/watcher-stage-timing-<change>.
- * json，替代 transcript 抽取。
- *
- * 生命周期：change 目录移入 archive（archived 终态事件）→ 自退；空闲 6h 无事件 → 自退；
- * SILLYSPEC_WATCHER=0 逃生阀（父侧不 spawn）。
- */
-import { spawn } from 'child_process';
-import {
-  appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync,
-  readFileSync, renameSync, statSync, unlinkSync, writeFileSync,
-} from 'fs';
-import { createHash } from 'crypto';
-import { join, resolve } from 'path';
-import { gitQuiet } from './git-helper.js';
-import { normalizePath, globMatch } from './change-list.js';
-import { resolveTestFileOwners } from './test-bindings.js';
-
-export const WATCHER_LOCK_FILENAME = 'watcher.lock';
-const WATCHER_LOG_FILENAME = 'watcher.log';
-
-const HEARTBEAT_INTERVAL_MS = 30_000;
-const LEASE_STALE_MS = 5 * 60_000;
-const POLL_INTERVAL_MS = 3_000;
-const IDLE_EXIT_MS = 6 * 60 * 60_1000;
-// 硬寿命帽：孤儿绝对上限（2026-09-22 泄漏实证兜底）——无论活跃与否 12h 必退
-const MAX_LIFETIME_MS = 12 * 60 * 60_000;
-const PUSH_TIMEOUT_MS = 5_000;
-const LOG_TRUNCATE_THRESHOLD = 1_000_000;
-const LOG_TRUNCATE_KEEP = 512 * 1024;
-
-/** 已知产物 → 阶段映射（阶段推断=产物签名；未列出的文件不发事件，防噪声）。 */
-const STAGE_FILES = {
-  'proposal.md': 'proposal',
-  'requirements.md': 'requirements',
-  'design.md': 'design',
-  'plan.md': 'plan',
-  'tasks.md': 'tasks',
-  'decisions.md': 'proposal',
-  'verify-result.md': 'verify',
-  'module-impact.md': 'verify',
-  'symbol-impact.md': 'verify',
-};
-
-/** pid 活性探测（跨平台）：signal 0 探测；EPERM = 进程存在但属他户，保守按活。 */
-function isPidAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (e) {
-    return e && e.code === 'EPERM';
-  }
-}
-
-/** 读 watcher 单飞锁（缺失/损坏 → null）。 */
-export function readWatcherLock(runtimeRoot) {
-  try {
-    const raw = readFileSync(join(runtimeRoot, WATCHER_LOCK_FILENAME), 'utf8');
-    const obj = JSON.parse(raw);
-    return obj && typeof obj === 'object' ? obj : null;
-  } catch {
-    return null;
-  }
-}
-
-function writeWatcherLock(runtimeRoot, lock) {
-  mkdirSync(runtimeRoot, { recursive: true });
-  const tmp = join(runtimeRoot, `${WATCHER_LOCK_FILENAME}.${process.pid}.tmp`);
-  writeFileSync(tmp, JSON.stringify(lock) + '\n', 'utf8');
-  renameSync(tmp, join(runtimeRoot, WATCHER_LOCK_FILENAME));
-}
-
-function removeWatcherLock(runtimeRoot) {
-  try {
-    const p = join(runtimeRoot, WATCHER_LOCK_FILENAME);
-    if (existsSync(p)) unlinkSync(p);
-  } catch { /* 清锁失败：残留锁按心跳/pid 判死后自动接管，不影响正确性 */ }
-}
-
-/**
- * 租约活性判定（心跳新鲜 + pid 活）。纯函数（pid 探测单列 isPidAlive 便于注入测试）。
- * 与 bg-sync 锁的差异：心跳字段 heartbeatAt 是长驻租约的判死主锚（30s 刷新/5min 过期），
- * startedAt 仅作审计信息——pid 复用假活由心跳过期兜底。
- */
-export function isWatcherLeaseLive(lock, now = Date.now()) {
-  if (!lock || !Number.isInteger(lock.pid) || lock.pid <= 0) return false;
-  if (typeof lock.heartbeatAt !== 'number') return false;
-  if (now - lock.heartbeatAt > LEASE_STALE_MS) return false;
-  return isPidAlive(lock.pid);
-}
-
-function sha256(text) {
-  return createHash('sha256').update(text).digest('hex');
-}
-
-function countCheckboxes(text) {
-  const checked = (text.match(/- \[x\]/g) || []).length;
-  const unchecked = (text.match(/- \[ \]/g) || []).length;
-  return { checked, total: checked + unchecked };
-}
-
-/** tasks.md/任务卡里已勾选的 task-NN id 清单（假勾选归因锚：无 id 的勾选行不入判集）。 */
-function extractCheckedTasks(text) {
-  const out = [];
-  const re = /^[-*] \[[xX]\] (task-\d+)/gm;
-  let m;
-  while ((m = re.exec(String(text || '')))) out.push(m[1]);
-  return out;
-}
-
-// ── 哨兵判据源（2026-09-23-sentinel-rules task-01）：快照 additive 四源 ──
-// 口径与 src/run/verify-quality-scan.js isNonCodePath 相同（.sillyspec/、docs/、*.md 非
-// 代码面）——本地复制不 import（该模块拖 test-ledger 重链，detached 子进程不吃）。
-function isNonCodePath(p) {
-  return p.startsWith('.sillyspec/') || p.startsWith('docs/') || p.endsWith('.md');
-}
-
-/**
- * `git log -20 --format=%h|%s --name-only` 输出解析 → [{hash, subject, files}]。
- * hash|subject 行与后续裸路径行段式聚合（空行分隔可忽略）；解析不出任何 commit → []。
- */
-export function parseGitLogWithFiles(text) {
-  const commits = [];
-  let cur = null;
-  for (const line of String(text || '').split('\n')) {
-    if (!line.trim()) continue;
-    const h = line.match(/^([0-9a-f]{7,40})\|(.*)$/);
-    if (h) {
-      cur = { hash: h[1], subject: h[2], files: [] };
-      commits.push(cur);
-      continue;
-    }
-    if (cur && !line.startsWith('commit ')) {
-      const p = line.trim().replace(/\\/g, '/');
-      if (p) cur.files.push(p);
-    }
-  }
-  return commits;
-}
-
-/**
- * 提交证据并集（hash 判重，保序追加）：worktree 分支提交与主仓 log 合并——
- * apply/merge 后同一提交从两面都可达，hash 判重防双计（newCommitsBetween 同键）。
- */
-export function mergeCommitEvidence(base, extra) {
-  const out = [...(base || [])];
-  const seen = new Set(out.map((c) => c && c.hash).filter(Boolean));
-  for (const c of extra || []) {
-    if (!c || !c.hash || seen.has(c.hash)) continue;
-    seen.add(c.hash);
-    out.push(c);
-  }
-  return out;
-}
-
-/** porcelain → 代码脏路径清单（重命名取新路径；剔非代码面；排序去重）。 */
-export function parsePorcelainCodePaths(porcelain) {
-  const seen = new Set();
-  const out = [];
-  for (const line of String(porcelain || '').split('\n')) {
-    if (!line.trim()) continue;
-    let p = (line.slice(3) || '').trim();
-    const arrow = p.indexOf(' -> ');
-    if (arrow >= 0) p = p.slice(arrow + 4);
-    p = p.replace(/^"|"$/g, '').replace(/\\/g, '/');
-    if (!p || isNonCodePath(p) || seen.has(p)) continue;
-    seen.add(p);
-    out.push(p);
-  }
-  return out.sort();
-}
-
-/** execute-runs 下全部 review.json 的 mtime 面（假勾选证据源二；有界遍历，缺失 → {}）。 */
-function collectReviewMtimes(runtimeRoot, readdirSyncImpl, statSyncImpl) {
-  const reviews = {};
-  let runs = [];
-  try { runs = readdirSyncImpl(join(runtimeRoot, 'execute-runs')); } catch { return reviews; }
-  for (const run of runs) {
-    let names = [];
-    try { names = readdirSyncImpl(join(runtimeRoot, 'execute-runs', run, 'tasks')); } catch { continue; }
-    for (const t of names) {
-      const rel = `${run}/tasks/${t}/review.json`;
-      try { reviews[rel] = Math.round(statSyncImpl(join(runtimeRoot, 'execute-runs', run, 'tasks', t, 'review.json')).mtimeMs); } catch { /* 缺失跳过 */ }
-    }
-  }
-  return reviews;
-}
-
-/**
- * 构建一次快照（纯读盘+git 面；不入事件——推断在 inferEvents 纯函数，测试主入口）。
- * @returns {{ts:number, archived:boolean, head:string|null, files:Object, scan:Object|null,
- *   commits:Array<{hash,subject,files:string[]}>|null, dirtyCode:string[]|null,
- *   scanStatus:{status:string,ranAt:*}|null, reviews:Object}}
- *   files: { <相对 changeDir 路径>: { hash, checked, total, checkedTasks } }
- *   哨兵四源（git 失败 → commits/dirtyCode null，规则 fail-open）；全部 JSON 可序列化
- *   （水位回补落盘依赖）。
- */
-export function buildSnapshot({ changeDir, cwd, runtimeRoot, changeName, readFileSyncImpl = readFileSync, statSyncImpl = statSync, readdirSyncImpl = readdirSync, gitHeadImpl, gitLogImpl, gitLogWorktreeImpl, porcelainImpl }) {
-  const snap = { ts: Date.now(), archived: false, head: null, files: {}, scan: null, commits: null, dirtyCode: null, scanStatus: null, reviews: {} };
-  if (!existsSync(changeDir)) {
-    snap.archived = true;
-  } else {
-    for (const [name, stage] of Object.entries(STAGE_FILES)) {
-      const p = join(changeDir, name);
-      if (!existsSync(p)) continue;
-      try {
-        const text = readFileSyncImpl(p, 'utf8');
-        snap.files[name] = { hash: sha256(text), stage, ...countCheckboxes(text), checkedTasks: extractCheckedTasks(text) };
-      } catch { /* 读失败按未变更处理，下轮重试 */ }
-    }
-    const tasksDir = join(changeDir, 'tasks');
-    if (existsSync(tasksDir)) {
-      for (const ent of readdirSync(tasksDir)) {
-        if (!ent.endsWith('.md')) continue;
-        const rel = `tasks/${ent}`;
-        try {
-          const text = readFileSyncImpl(join(tasksDir, ent), 'utf8');
-          snap.files[rel] = { hash: sha256(text), stage: 'tasks', ...countCheckboxes(text), checkedTasks: extractCheckedTasks(text) };
-        } catch { /* 同上 */ }
-      }
-    }
-  }
-  if (typeof gitHeadImpl === 'function') {
-    snap.head = gitHeadImpl();
-  } else {
-    const out = gitQuiet(cwd, ['rev-parse', '--short', 'HEAD']);
-    snap.head = typeof out === 'string' && out.trim() ? out.trim() : null;
-  }
-  // 哨兵源一：区间新提交（hash/subject/触及文件，单次 git log 调用同取两面）。worktree 模式下
-  // 任务提交先落 sillyspec/<change> 分支、apply 前主仓 log 不可见（2026-09-23 假勾选误报实证：
-  // change-events-channel 流 8 个 task 提交全在分支上，R1 两拍全误报），同仓分支 ref 主仓可直读
-  // ——按 hash 去重并入；分支不存在/git 失败 → null 不动（fail-open）。注入面只给 gitLogImpl 时
-  // 不追真 git（测试零真仓约定）：worktree 面要么注入 gitLogWorktreeImpl，要么走真 git 路径。
-  const injectedLog = typeof gitLogImpl === 'function';
-  const mainLog = injectedLog
-    ? gitLogImpl()
-    : gitQuiet(cwd, ['log', '-20', '--format=%h|%s', '--name-only']);
-  snap.commits = mainLog == null ? null : parseGitLogWithFiles(mainLog);
-  if (snap.commits != null && changeName && (!injectedLog || typeof gitLogWorktreeImpl === 'function')) {
-    const wtLog = typeof gitLogWorktreeImpl === 'function'
-      ? gitLogWorktreeImpl()
-      : gitQuiet(cwd, ['log', '-20', '--format=%h|%s', '--name-only', `sillyspec/${changeName}`]);
-    if (wtLog) snap.commits = mergeCommitEvidence(snap.commits, parseGitLogWithFiles(wtLog));
-  }
-  // 哨兵源二：工作树代码脏面（范围漂移/test-tamper 工作树证据）
-  if (typeof porcelainImpl === 'function') {
-    const out = porcelainImpl();
-    snap.dirtyCode = out == null ? null : parsePorcelainCodePaths(out);
-  } else {
-    const out = gitQuiet(cwd, ['status', '--porcelain']);
-    snap.dirtyCode = out == null ? null : parsePorcelainCodePaths(out);
-  }
-  const scanPath = join(runtimeRoot, `verify-quality-scan-${changeName}.json`);
-  try {
-    const st = statSyncImpl(scanPath);
-    snap.scan = { mtimeMs: Math.round(st.mtimeMs), size: st.size };
-  } catch {
-    snap.scan = null;
-  }
-  // 哨兵源三：P2 测试账本结论（内容读，stat 只管「记录变了」事件；读失败 null）
-  try {
-    const raw = JSON.parse(readFileSyncImpl(scanPath, 'utf8'));
-    const t = raw && raw.testResult;
-    snap.scanStatus = t && t.status ? { status: String(t.status), ranAt: t.ranAt || null } : null;
-  } catch {
-    snap.scanStatus = null;
-  }
-  // 哨兵源四：review.json mtime 面
-  snap.reviews = collectReviewMtimes(runtimeRoot, readdirSyncImpl, statSyncImpl);
-  return snap;
-}
-
-/**
- * 快照 diff → 事件（纯函数）。每事件恒带 provisional:true（护栏#5：平台 ingest 只展示
- * 不判定）。事件面：文件首现/内容变更/checkbox 翻格/新提交/质量扫描记录/archived 终态。
- */
-export function inferEvents(prev, next) {
-  if (!prev || !next) return [];
-  const events = [];
-  const mk = (kind, stage, detail) => ({ ts: next.ts, kind, stage: stage ?? null, detail: detail ?? null, provisional: true });
-  if (!prev.archived && next.archived) {
-    events.push(mk('archived', 'archive', 'change 目录已移入 archive'));
-    return events;
-  }
-  const keys = new Set([...Object.keys(prev.files || {}), ...Object.keys(next.files || {})]);
-  for (const key of keys) {
-    const p = prev.files[key];
-    const n = next.files[key];
-    if (!p && n) {
-      events.push(mk('file', n.stage, `${key} 出现`));
-      if (n.checked > 0) events.push(mk('task-done', n.stage, `checked 0→${n.checked}`));
-    } else if (p && n && p.hash !== n.hash) {
-      events.push(mk('file-update', n.stage, `${key} 内容变更`));
-    }
-    if (p && n && n.checked > p.checked) {
-      events.push(mk('task-done', n.stage ?? 'tasks', `checked ${p.checked}→${n.checked}`));
-    }
-  }
-  if (prev.head && next.head && prev.head !== next.head) {
-    events.push(mk('commit', null, next.head));
-  }
-  if (next.scan && (!prev.scan || prev.scan.mtimeMs !== next.scan.mtimeMs || prev.scan.size !== next.scan.size)) {
-    events.push(mk('verify', 'verify', prev.scan ? '质量扫描记录更新' : '质量扫描记录出现'));
-  }
-  return events;
-}
-
-/**
- * 事件序列 → 阶段墙钟拆账（纯函数）：每 stage 首末事件时间差，按首事件时序输出。
- */
-export function aggregateStageTiming(events) {
-  const byStage = new Map();
-  for (const e of events) {
-    if (!e || typeof e.ts !== 'number' || !e.stage) continue;
-    let rec = byStage.get(e.stage);
-    if (!rec) {
-      rec = { stage: e.stage, firstTs: e.ts, lastTs: e.ts, events: 0 };
-      byStage.set(e.stage, rec);
-    }
-    rec.lastTs = Math.max(rec.lastTs, e.ts);
-    rec.firstTs = Math.min(rec.firstTs, e.ts);
-    rec.events += 1;
-  }
-  return [...byStage.values()]
-    .sort((a, b) => a.firstTs - b.firstTs)
-    .map((r) => ({ stage: r.stage, firstTs: r.firstTs, lastTs: r.lastTs, durationMs: r.lastTs - r.firstTs, events: r.events }));
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// 哨兵规则引擎（2026-09-23-sentinel-rules / L1：watcher 从只看升级为会喊）
-//
-// 四规则全部机械事实判定，输出恒 advisory：{kind:'warning', rule, severity:'warning',
-// provisional:true}，与基础事件同管线入 jsonl/推平台；**不写 progress db**（真相库只归
-// 协议调用——单写者纪律）。规则逐条独立 try/catch（单规则异常 fail-open 跳过本轮，不杀
-// 引擎不杀 watcher）；warning 不计 lastActivityAt、不触发 archived 自退（不是活动）。
-// ─────────────────────────────────────────────────────────────────────────────
-
-/** 停滞阈值（FR-05 分相位：brainstorm/plan 20min、execute 15min）。 */
-export const STALL_EARLY_MS = 20 * 60_000;
-export const STALL_EXECUTE_MS = 15 * 60_000;
-
-/** 引擎状态初值（ts=计时锚；task-04 重启回补时取 max(启动时刻, 水位 ts)）。 */
-export function createSentinelState(ts = Date.now()) {
-  return { phase: 'early', lastActivityAt: typeof ts === 'number' ? ts : Date.now(), stallOpen: false, lastDriftFiles: [], testTamper: null };
-}
-
-function mkWarning(rule, detail, ts) {
-  return { ts, kind: 'warning', stage: null, rule, severity: 'warning', detail, provisional: true };
-}
-
-/** 区间新提交差集（按 hash 判重，防 subject 改写误判；旧快照无 commits → 全部视为新）。 */
-function newCommitsBetween(prev, next) {
-  const prevHashes = new Set((prev.commits || []).map((c) => c.hash));
-  return (next.commits || []).filter((c) => c && !prevHashes.has(c.hash));
-}
-
-// ── 水位回补（2026-09-23-sentinel-rules task-04 / FR-08 / D-005@v1）──
-// 每轮把快照落 watcher-last-snapshot-<change>.json；重启读取为 prev diff 补发 backfill
-// 事件（幂等锚=水位消费即前移）；损坏/缺失 → null 全新启动（现行为零回归）；覆盖写不
-// append、内容去重不空转；archived 首拍早退路径不读不写。
-
-export function watcherSnapshotPath(runtimeRoot, changeName) {
-  return join(runtimeRoot, `watcher-last-snapshot-${changeName}.json`);
-}
-
-/** 读水位（损坏/缺失/形状不对 → null）。 */
-export function loadSnapshotWatermark(runtimeRoot, changeName) {
-  try {
-    const obj = JSON.parse(readFileSync(watcherSnapshotPath(runtimeRoot, changeName), 'utf8'));
-    return obj && typeof obj === 'object' && typeof obj.ts === 'number' && typeof obj.archived === 'boolean' ? obj : null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * 写水位（best-effort，失败不抛）。cacheObj={last} 时内容去重（与上次序列化串相同跳过写，
- * 防 3s 周期空转 IO——Grill 修正③）。
- */
-export function writeSnapshotWatermark(runtimeRoot, changeName, snap, cacheObj = null) {
-  try {
-    const json = JSON.stringify(snap);
-    if (cacheObj && cacheObj.last === json) return { written: false };
-    writeFileSync(watcherSnapshotPath(runtimeRoot, changeName), json);
-    if (cacheObj) cacheObj.last = json;
-    return { written: true };
-  } catch {
-    return { written: false };
-  }
-}
-
-/** task-NN 完整 token 匹配（task-01 不证 task-010，负向前瞻词边界）。 */
-function taskTokenRe(id) {
-  return new RegExp(`${id}(?!\\d)`);
-}
-
-// ── 事件流读取（2026-09-23 watcher-alerts quick：哨兵告警可视化出口的纯读面）──
-// 子进程侧 appendFileSync 落盘名与此处读取名同锚（runWatcherFromEnv 内联字符串的唯一对应）。
-
-export function watcherEventsPath(runtimeRoot, changeName) {
-  return join(runtimeRoot, `watcher-events-${changeName}.jsonl`);
-}
-
-/**
- * 读事件流（纯读：解析+过滤，`watcher alerts`/`watcher timeline` 命令与测试消费；不写盘不推平台）。
- * 坏行/残行/非对象行跳过并计数不抛（readKnowledgeHits 先例 R-04——并发 append 交错容忍）。
- * path 直读形态（2026-09-28-archive-timeline-bake）：传 path 时按该路径解析（同一坏行容忍
- * 语义），供 `watcher timeline` 回退读归档包内 watcher-events.jsonl 烤制副本——path 优先于
- * runtimeRoot/change 组合路径。
- * @returns {{exists:boolean, events:Array, warnings:Array, badLines:number}}
- *   文件/目录缺失 → {exists:false, 空集}；warnings=告警子集（kind 或 severity 为
- *   'warning' 即入——mkWarning 两者皆写，双字段容差防未来形态漂移）。
- */
-export function readWatcherEvents({ runtimeRoot, change, path: eventsPath }) {
-  let text;
-  try {
-    text = readFileSync(eventsPath || watcherEventsPath(runtimeRoot, change), 'utf8');
-  } catch {
-    return { exists: false, events: [], warnings: [], badLines: 0 };
-  }
-  const events = [];
-  let badLines = 0;
-  for (const line of text.split('\n')) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    let rec;
-    try {
-      rec = JSON.parse(trimmed);
-    } catch {
-      badLines += 1;
-      continue;
-    }
-    if (!rec || typeof rec !== 'object' || Array.isArray(rec)) {
-      badLines += 1;
-      continue;
-    }
-    events.push(rec);
-  }
-  const warnings = events.filter((e) => e.kind === 'warning' || e.severity === 'warning');
-  return { exists: true, events, warnings, badLines };
-}
-
-/**
- * R1 假勾选（FR-02）：checkedTasks 差集=本拍翻格集；证据=区间新提交 subject 含 task-NN
- * （token 边界）或 /tasks/task-NN/ 的 review.json mtime 变化；翻格零证据 → warning。
- */
-function ruleFakeCheck(prev, next, ts) {
-  const flipped = [];
-  const keys = new Set([...Object.keys(prev.files || {}), ...Object.keys(next.files || {})]);
-  for (const key of keys) {
-    const pIds = new Set(((prev.files[key] || {}).checkedTasks) || []);
-    for (const id of ((next.files[key] || {}).checkedTasks) || []) {
-      if (!pIds.has(id)) flipped.push(id);
-    }
-  }
-  if (flipped.length === 0) return [];
-  const newCommits = newCommitsBetween(prev, next);
-  const unevidenced = flipped.filter((id) => {
-    const re = taskTokenRe(id);
-    const byCommit = newCommits.some((c) => re.test(c.subject || ''));
-    const byReview = Object.entries(next.reviews || {}).some(([p, mtime]) => p.includes(`/tasks/${id}/`) && (prev.reviews || {})[p] !== mtime);
-    return !(byCommit || byReview);
-  });
-  if (unevidenced.length === 0) return [];
-  return [mkWarning('fake-check', `tasks 勾选 ${unevidenced.join('、')} 无对应提交（消息不含该 task id）且无 review.json 变更——假勾选嫌疑，人判`, ts)];
-}
-
-const testDirtyOf = (dirtyCode) => (Array.isArray(dirtyCode) ? dirtyCode.filter((p) => p.startsWith('test/')) : []);
-const normPath = (p) => String(p).replace(/\\/g, '/');
-
-/**
- * R2 改测试凑绿（FR-03；2026-09-24 定向化，fr-test-binding §1.1 受益注记）：
- * 账本 FAIL → 窗口内**新增**测试改动 → 账本 PASS → warning。
- * 定向升级：窗口被改测试文件经绑定面（resolveTestFileOwners——FR 条目行+ql 面，
- * active·非 superseded）解析归属；归属成立且该锚来源变更的 requirements.md 未在
- * 窗口内改动 → 定向 warning test-tamper-bound（绑定测试被改 ∩ 场景正文未改 ∩
- * FAIL→PASS，点名锚——绑定后 R2 从窗口级粗粒度升级为 FR 级定向，误报大降）；
- * 无归属或被规格变更抑制的文件保留窗口级 generic warning——**永不比旧版更安静**。
- * 恒 warning 档：测试纠错是无规格变更的合法场景，三联证据收窄误报不消除。
- * FAIL 锚按账本 statKey（mtime:size）判「新记录」——同一 FAIL 记录跨拍持续只累计
- * 证据不重锚；testDirtyAtFail 快照区分窗口前遗留脏面（Grill 修正①）。skipped 不参与。
- */
-function ruleTestTamper(prev, next, state, ts, resolveOwners = null) {
-  const status = next.scanStatus ? next.scanStatus.status : null;
-  const commitHashes = new Set((next.commits || []).map((c) => c.hash));
-  if (status === 'failed') {
-    const statKey = next.scan ? `${next.scan.mtimeMs}:${next.scan.size}` : String(ts);
-    if (!state.testTamper || state.testTamper.statKey !== statKey) {
-      state.testTamper = { statKey, failAt: ts, testDirtyAtFail: new Set(testDirtyOf(next.dirtyCode)), testChanged: false, testChangedFiles: new Set(), anchoredCommits: commitHashes };
-    } else {
-      const anchor = state.testTamper;
-      const dirtyNow = testDirtyOf(next.dirtyCode);
-      if (dirtyNow.some((p) => !anchor.testDirtyAtFail.has(p))) { anchor.testChanged = true; for (const p of dirtyNow) if (!anchor.testDirtyAtFail.has(p)) anchor.testChangedFiles.add(normPath(p)); }
-      for (const c of next.commits || []) {
-        if (anchor.anchoredCommits.has(c.hash)) continue;
-        for (const f of c.files || []) if (String(f).startsWith('test/')) { anchor.testChanged = true; anchor.testChangedFiles.add(normPath(f)); }
-      }
-    }
-    return [];
-  }
-  if (state.testTamper && status === 'passed') {
-    const anchor = state.testTamper;
-    state.testTamper = null;
-    const changed = Array.isArray(anchor.testChangedFiles) || anchor.testChangedFiles instanceof Set
-      ? [...(anchor.testChangedFiles || new Set())].map(normPath)
-      : []; // 旧态锚（仅 testChanged 布尔，无清单）→ 无法定向，走 generic
-    if (!anchor.testChanged && changed.length === 0) return [];
-    const generic = (note) => [mkWarning('test-tamper', `测试账本 FAIL→PASS 且窗口内测试文件被改——改测试凑绿嫌疑（${note}）（测试本身写错是合法场景，人判不阻断）`, ts)];
-    if (!resolveOwners || changed.length === 0) return generic('窗口级粗粒度');
-    let owners = null;
-    try { owners = resolveOwners(changed) } catch { owners = null }
-    if (!owners || owners.size === 0) return generic(`${changed.length} 个改动测试文件无绑定锚`);
-    // 窗口全文件面（脏面 ∪ 已提交文件）——来源变更 requirements.md 同窗改动则「场景正文未改」不成立，定向抑制
-    const windowFiles = new Set([
-      ...((next.dirtyCode || []).map(normPath)),
-      ...((next.commits || []).flatMap((c) => c.files || []).map(normPath)),
-    ]);
-    const warnings = [];
-    const genericFiles = new Set();
-    for (const f of changed) {
-      const owns = owners.get(normPath(f)) || owners.get(f);
-      if (!owns || owns.length === 0) { genericFiles.add(f); continue }
-      const live = owns.filter((o) => o.source_change && ![...windowFiles].some((w) => w.includes(`/${o.source_change}/requirements.md`)))
-      if (live.length === 0) { genericFiles.add(f); continue }
-      warnings.push(mkWarning('test-tamper-bound', `${[...new Set(live.map((o) => o.anchor))].join('、')} 绑定测试被改（${f}）∩ 场景正文未改 ∩ 账本 FAIL→PASS——定向改测试凑绿嫌疑（测试纠错仍合法，人判不阻断）`, ts))
-    }
-    if (genericFiles.size > 0) {
-      warnings.push(mkWarning('test-tamper', `测试账本 FAIL→PASS 且窗口内测试文件被改（${[...genericFiles].join('、')}——无绑定锚或场景正文同窗变更，定向不成立，窗口级嫌疑保留）（测试本身写错是合法场景，人判不阻断）`, ts))
-    }
-    return warnings;
-  }
-  return [];
-}
-
-/** 任务卡 frontmatter allowed_paths 列表项解析（反引号/尾注剥离走 normalizePath）。 */
-function parseCardAllowedPaths(text) {
-  const lines = String(text || '').split(/\r?\n/);
-  let fmEnd = -1;
-  let inFm = false;
-  for (let i = 0; i < lines.length; i++) {
-    if (lines[i].trim() === '---') {
-      if (!inFm) inFm = true;
-      else { fmEnd = i; break; }
-    }
-  }
-  if (fmEnd < 0) return [];
-  const out = [];
-  let inList = false;
-  for (let j = 0; j <= fmEnd; j++) {
-    if (/^allowed_paths:\s*$/.test(lines[j])) { inList = true; continue; }
-    if (!inList) continue;
-    const m = lines[j].match(/^\s+-\s+(.+?)\s*$/);
-    if (m) out.push(normalizePath(m[1]));
-    else if (/^\S/.test(lines[j])) inList = false;
-  }
-  return out.filter(Boolean);
-}
-
-/** design.md「文件变更清单」章节条目（表格路径列+列表行；NEW: 前缀剥离后 normalizePath）。 */
-export function parseDesignListText(text) {
-  const src = String(text || '');
-  const m = /##\s*文件变更清单/.exec(src);
-  if (!m) return [];
-  const rest = src.slice(m.index);
-  const endRe = /\n##\s/;
-  const endM = endRe.exec(rest.slice(1));
-  const section = endM ? rest.slice(0, endM.index + 1) : rest;
-  const raw = [];
-  for (const line of section.split(/\r?\n/)) {
-    const t = line.trim();
-    if (t.startsWith('|')) {
-      if (/^[-:\s|]+$/.test(t)) continue;
-      const cells = t.split('|').map((c) => c.trim()).filter(Boolean);
-      const pathCell = cells.find((c) => c.startsWith('NEW:')) || cells.find((c) => (/[/]/.test(c) && /\.[A-Za-z0-9]+/.test(c)));
-      if (pathCell) raw.push(pathCell);
-    } else if (t.startsWith('- ')) {
-      raw.push(t.slice(2));
-    }
-  }
-  return raw
-    .map((s) => normalizePath(String(s).replace(/^NEW:/, '')))
-    .filter((s) => s && s !== '.' && (s.includes('/') || /\.[A-Za-z0-9]+$/.test(s)));
-}
-
-/**
- * 声明面 = 任务卡 allowed_paths ∪ design.md 文件清单（FR-04 / D-004@v1）。两源皆空 →
- * null（规则跳过，fail-open——无面可判不无事生非）。盘面读取注入化（测试零真 fs）。
- */
-function loadDeclaredScope(changeDir, readImpl, readdirImpl) {
-  if (!changeDir) return null;
-  const scope = new Set();
-  try {
-    const tasksDir = join(changeDir, 'tasks');
-    for (const ent of readdirImpl(tasksDir)) {
-      if (!/^task-.*\.md$/.test(ent)) continue;
-      for (const p of parseCardAllowedPaths(readImpl(join(tasksDir, ent), 'utf8'))) scope.add(p);
-    }
-  } catch { /* tasks/ 不存在或读失败 → 该源贡献为空 */ }
-  try {
-    for (const p of parseDesignListText(readImpl(join(changeDir, 'design.md'), 'utf8'))) scope.add(p);
-  } catch { /* design.md 缺失 → 该源贡献为空 */ }
-  return scope.size > 0 ? [...scope] : null;
-}
-
-/**
- * R3 范围漂移（FR-04）：dirtyCode 中声明面外文件（精确相等或 globMatch 容差，复用
- * change-list 匹配器）；只对新漂移文件告警（lastDriftFiles 单调去重，活动恢复不改集）。
- * 基线豁免（2026-09-23 R8 对撞实证 MP 假归因）：观测起点已在脏面的文件 = 并行会话先在途
- * 工作（quick 边界记录 / baseline checkpoint 同款语义），不归因本变更——首拍基线之外的
- * 新出现声明面外文件才算漂移。
- */
-function ruleScopeDrift(next, state, declaredScope, ts) {
-  if (!declaredScope || !Array.isArray(next.dirtyCode) || next.dirtyCode.length === 0) return [];
-  const baseline = Array.isArray(state.baselineDirty) ? state.baselineDirty : [];
-  const unmatched = next.dirtyCode.filter((p) =>
-    !baseline.includes(p) && !declaredScope.some((pat) => pat === p || globMatch(p, pat)));
-  const fresh = unmatched.filter((p) => !state.lastDriftFiles.includes(p));
-  state.lastDriftFiles = unmatched;
-  if (fresh.length === 0) return [];
-  return [mkWarning('scope-drift', `声明面之外的代码文件被改：${fresh.join('、')}——范围漂移嫌疑（并行会话改动/越界，人判）`, ts)];
-}
-
-/**
- * R4 停滞（FR-05 / D-003@v1）：相位 early→execute 单向锁存（task-done 事件，或 tasks.md
- * 在场后出现新提交）；阈值 20min/15min；episode 去重（告警一次，活动恢复才允许下一发）。
- */
-function ruleStall(prev, next, baseEvents, state, ts) {
-  const hasTasksMd = Object.prototype.hasOwnProperty.call(next.files || {}, 'tasks.md');
-  if (baseEvents.some((e) => e && e.kind === 'task-done') || (hasTasksMd && newCommitsBetween(prev, next).length > 0)) {
-    state.phase = 'execute';
-  }
-  if (baseEvents.length > 0) {
-    state.lastActivityAt = ts;
-    state.stallOpen = false;
-  }
-  const threshold = state.phase === 'execute' ? STALL_EXECUTE_MS : STALL_EARLY_MS;
-  if (state.stallOpen || ts - state.lastActivityAt <= threshold) return [];
-  state.stallOpen = true;
-  const idleMin = Math.round((ts - state.lastActivityAt) / 60000);
-  const phaseLabel = state.phase === 'execute' ? 'execute 期' : 'brainstorm/plan 期';
-  return [mkWarning('stall', `${phaseLabel}已 ${idleMin} 分钟无${state.phase === 'execute' ? '提交无' : ''}事件——停滞嫌疑（区分在想/死了，人判）`, ts)];
-}
-
-/**
- * 哨兵规则引擎主入口（纯函数；prev 缺新字段按空集/null 容错 fail-open）。
- * @returns {{warnings:Array, state:Object}} warnings 恒 provisional:true；archived 拍不判。
- */
-export function applySentinelRules({ prev, next, baseEvents = [], state = null, now = Date.now(), changeDir = null, readImpl = readFileSync, readdirImpl = readdirSync, env = process.env, bindResolveImpl = null } = {}) {
-  const st = state || createSentinelState(next && next.ts);
-  const warnings = [];
-  if (!prev || !next || next.archived) return { warnings, state: st };
-  // 哨兵总阀（2026-09-23 用户降噪诉求）：SILLYSPEC_SENTINEL=0 → 规则面零告警，watcher
-  // 照常记录中性事件（观测不中断）——比 SILLYSPEC_WATCHER=0 整体不拉起细一档；排障/
-  // 嫌吵时环境级一关即静。
-  if (env.SILLYSPEC_SENTINEL === '0') return { warnings, state: st };
-  // R3 基线脏面首拍（见 ruleScopeDrift 注释）：首判轮以 prev 脏面为基线——水位重启场景
-  // 首判轮 prev 即水位快照，语义自洽（重启前已脏 = 先在途）。
-  if (!Array.isArray(st.baselineDirty)) {
-    st.baselineDirty = prev && Array.isArray(prev.dirtyCode) ? [...prev.dirtyCode] : [];
-  }
-  // 逐规则独立 fail-open：单规则抛异常只丢本轮该规则，其余照跑（引擎绝不杀 watcher）
-  try { warnings.push(...ruleFakeCheck(prev, next, now)); } catch { /* R1 本轮跳过 */ }
-  try { warnings.push(...ruleTestTamper(prev, next, st, now, bindResolveImpl)); } catch { /* R2 本轮跳过 */ }
-  let declaredScope = null;
-  try { declaredScope = loadDeclaredScope(changeDir, readImpl, readdirImpl); } catch { declaredScope = null; }
-  try { warnings.push(...ruleScopeDrift(next, st, declaredScope, now)); } catch { /* R3 本轮跳过 */ }
-  try { warnings.push(...ruleStall(prev, next, baseEvents, st, now)); } catch { /* R4 本轮跳过 */ }
-  return { warnings, state: st };
-}
-
-/** watcher 平台推送凭据（模式同 agent-session-log readPlatformPushConfig：env > local.yaml platform 段）。 */
-function readWatcherPushConfig(specBase, env = process.env) {
-  if (env.SILLYHUB_PLATFORM_URL && env.SILLYHUB_PLATFORM_TOKEN) {
-    return { url: env.SILLYHUB_PLATFORM_URL, token: env.SILLYHUB_PLATFORM_TOKEN };
-  }
-  try {
-    const yamlPath = join(specBase, 'local.yaml');
-    if (!existsSync(yamlPath)) return null;
-    const lines = readFileSync(yamlPath, 'utf8').split(/\r?\n/);
-    let inPlatform = false;
-    const cfg = {};
-    for (const line of lines) {
-      if (!line.trim() || line.trim().startsWith('#')) continue;
-      if (!/^\s/.test(line)) inPlatform = line.startsWith('platform:');
-      else if (inPlatform) {
-        const m = line.match(/^\s+(url|token)\s*:\s*(.*)$/);
-        if (m) {
-          let v = m[2].trim();
-          if (v.length >= 2 && ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))) v = v.slice(1, -1);
-          if (v) cfg[m[1]] = v;
-        }
-      }
-    }
-    return cfg.url && cfg.token ? cfg : null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * watcher 事件 → 平台 ChangeEventPushRequest 单条契约映射（纯函数，导出供测试）。
- * 2026-09-27-watcher-push-endpoint：旧 ObservationEventIn 批量契约随废弃分支
- * （observation 模块不在平台 HEAD 线）消亡——对齐现端点 POST /api/changes/{name}/events
- * 的单事件形态（kind/rule/severity/provisional/detail/ts/id）。id 铸稳定内容键
- * ``ts|kind|stage|note``（>512 取 sha256，评审 P1：同拍多事件共享回退键 ts+rule 会被
- * 平台去重静默吞掉除首条外全部——file 出现与 task-done 常同拍；内容键使同拍不同
- * 事件各得其所、重推同键幂等吸收）。stage 无独立列——以「stage · note」前缀并入
- * detail 文本（timeline 任务面推断与人类可读双用）。
- */
-export function toPlatformChangeEvents(events) {
-  const out = [];
-  for (const rec of events || []) {
-    if (!rec || typeof rec !== 'object') continue;
-    const numTs = typeof rec.ts === 'number' ? rec.ts : Number(rec.ts);
-    const iso = Number.isFinite(numTs)
-      ? new Date(numTs).toISOString()
-      : typeof rec.ts === 'string' && !Number.isNaN(Date.parse(rec.ts))
-        ? new Date(rec.ts).toISOString()
-        : new Date().toISOString();
-    const stageText = rec.stage ? String(rec.stage) : '';
-    const noteText = rec.detail != null ? String(rec.detail) : '';
-    const detail = noteText
-      ? (stageText ? `${stageText} · ${noteText}` : noteText)
-      : (stageText || null);
-    const idSrc = `${iso}|${String(rec.kind || 'unknown')}|${stageText}|${noteText}`;
-    out.push({
-      id: idSrc.length > 512 ? createHash('sha256').update(idSrc).digest('hex') : idSrc,
-      kind: String(rec.kind || 'unknown').slice(0, 64),
-      rule: rec.rule ? String(rec.rule).slice(0, 128) : 'watcher',
-      severity: rec.severity ? String(rec.severity).slice(0, 16) : 'info',
-      provisional: true,
-      detail,
-      ts: iso,
-    });
-  }
-  return out;
-}
-
-/**
- * 事件推平台（best-effort，唯一非本地副作用）：单事件上行端点
- * POST /api/changes/{name}/events（2026-09-26-change-events-r18-full 契约，
- * 逐条 POST、恒 200 语义），每条 5s 熔断，任何失败只 warn——本地 jsonl 已是
- * 事件唯一真相源，平台是展示面。失败即弃剩余（与旧语义一致，无重推水位）；
- * 平台侧去重键幂等（无 id 回退 ts+'|'+rule），后续若加重推也安全
- * （at-least-once 上行）。
- */
-export async function pushEventsToPlatform({ specBase, changeName, events, env = process.env, fetchImpl = fetch }) {
-  if (env.SILLYSPEC_WATCHER_PUSH === '0' || !events || events.length === 0) return { pushed: null };
-  const cfg = readWatcherPushConfig(specBase, env);
-  if (!cfg) return { pushed: null, reason: 'no-config' };
-  const base = cfg.url.replace(/\/+$/, '');
-  const url = `${base}/api/changes/${encodeURIComponent(changeName)}/events`;
-  let pushed = 0;
-  for (const ev of toPlatformChangeEvents(events)) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), PUSH_TIMEOUT_MS);
-    try {
-      const res = await fetchImpl(url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${cfg.token}` },
-        body: JSON.stringify(ev),
-        signal: controller.signal,
-      });
-      if (!res.ok) {
-        console.warn(`[watcher] 事件推送 → HTTP ${res.status}（本地 jsonl 已兜底）`);
-        return { pushed: pushed > 0, reason: `http-${res.status}` };
-      }
-      pushed += 1;
-    } catch (err) {
-      const msg = err && err.name === 'AbortError' ? '超时' : (err && err.message ? err.message : err);
-      console.warn(`[watcher] 事件推送失败: ${msg}（本地 jsonl 已兜底）`);
-      return { pushed: pushed > 0, reason: 'network' };
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  return { pushed: true, count: pushed };
-}
-
-/** 子进程起步截尾日志（>1MB 保后 512KB，整行边界起）。失败只影响日志体积。 */
-function truncateLogIfNeeded(runtimeRoot) {
-  try {
-    const p = join(runtimeRoot, WATCHER_LOG_FILENAME);
-    if (statSync(p).size <= LOG_TRUNCATE_THRESHOLD) return;
-    const buf = readFileSync(p);
-    const keep = buf.subarray(Math.max(0, buf.length - LOG_TRUNCATE_KEEP));
-    const nl = keep.indexOf(10);
-    writeFileSync(p, nl >= 0 ? keep.subarray(nl + 1) : keep);
-  } catch { /* 截断失败：继续 append */ }
-}
-
-/** 子进程 bootstrap：node -e 动态 import 本模块（file URL 精确定位，不依赖 CLI 安装形态）。 */
-function buildChildBootstrap() {
-  const selfUrl = new URL('./watcher.js', import.meta.url).href;
-  return `import(${JSON.stringify(selfUrl)}).then(m=>m.runWatcherFromEnv()).catch(e=>{console.error('[watcher] 监听进程异常退出:',(e&&e.message)||e)});`;
-}
-
-/**
- * 父侧入口（run/command.js 在 effectiveChange 解析后无条件调用，锁合并）。
- * 未连接平台也 spawn（本地 jsonl 是主目标）；SILLYSPEC_WATCHER=0 逃生阀。
- * spawn 失败抛异常由调用方 catch 降级（绝不因观测旁路阻断主流程）。
- * @returns {Promise<{status:'spawned'|'coalesced'|'disabled', logPath?:string}>}
- */
-export async function spawnWatcher(cwd, changeName, opts = {}) {
-  const env = opts.env || process.env;
-  // 逃生阀/测试护栏：SILLYSPEC_WATCHER=0 显式关；NODE_TEST_CONTEXT（node:test 运行器注入）
-  // 下不拉起——防全量套件每条 run 用例孵化真 detached watcher 污染测试环境。
-  if (env.SILLYSPEC_WATCHER === '0' || env.NODE_TEST_CONTEXT) return { status: 'disabled' };
-  const { resolveRuntimeRoot } = await import('./run/shared.js');
-  const specBase = opts.specBase || join(cwd, '.sillyspec');
-  const runtimeRoot = resolveRuntimeRoot(opts, specBase);
-
-  const lock = readWatcherLock(runtimeRoot);
-  if (isWatcherLeaseLive(lock)) return { status: 'coalesced', logPath: join(runtimeRoot, WATCHER_LOG_FILENAME) };
-
-  const logPath = join(runtimeRoot, WATCHER_LOG_FILENAME);
-  let stdio = ['ignore', 'ignore', 'ignore'];
-  let logFd = null;
-  try {
-    mkdirSync(runtimeRoot, { recursive: true });
-    logFd = openSync(logPath, 'a');
-    stdio = ['ignore', logFd, logFd];
-  } catch {
-    logFd = null;
-  }
-
-  const childEnv = {
-    ...env,
-    SILLYSPEC_WATCHER_CHANGE: String(changeName),
-    SILLYSPEC_WATCHER_CWD: String(cwd),
-  };
-  if (opts.specBase) childEnv.SILLYSPEC_WATCHER_SPEC_BASE = String(opts.specBase);
-  if (opts.runtimeRoot) childEnv.SILLYSPEC_WATCHER_RUNTIME_ROOT = String(opts.runtimeRoot);
-
-  try {
-    const child = (opts.spawnImpl || spawn)(process.execPath, ['-e', buildChildBootstrap()], {
-      cwd,
-      detached: true,
-      stdio,
-      windowsHide: true,
-      env: childEnv,
-    });
-    child.unref?.();
-  } finally {
-    if (logFd !== null) {
-      try { closeSync(logFd); } catch { /* 父侧 fd 副本关闭；子进程持有继承副本 */ }
-    }
-  }
-  return { status: 'spawned', logPath };
-}
-
-/**
- * 子侧入口（bootstrap 经 env 传参调起）。循环：心跳租约（30s 刷新，锁被他人接管即让位）
- * → 每 3s 快照 diff → 事件落 jsonl + best-effort 推平台 + 墙钟拆账重写。
- * 终态自退：archived 事件 / 空闲 6h / 锁失守。退出前清本进程锁。
- */
-export async function runWatcherFromEnv(env = process.env, opts = {}) {
-  const changeName = env.SILLYSPEC_WATCHER_CHANGE;
-  const cwd = env.SILLYSPEC_WATCHER_CWD;
-  if (!changeName || !cwd) return;
-
-  const specBase = env.SILLYSPEC_WATCHER_SPEC_BASE || join(cwd, '.sillyspec');
-  const { resolveRuntimeRoot } = await import('./run/shared.js');
-  const runtimeRoot = env.SILLYSPEC_WATCHER_RUNTIME_ROOT
-    ? env.SILLYSPEC_WATCHER_RUNTIME_ROOT
-    : resolveRuntimeRoot({}, specBase);
-  const changeDir = join(specBase, 'changes', changeName);
-
-  truncateLogIfNeeded(runtimeRoot);
-  const startedAt = Date.now();
-  writeWatcherLock(runtimeRoot, { pid: process.pid, change: changeName, startedAt, heartbeatAt: startedAt });
-  console.log(`[watcher] 监听开始 ${new Date().toISOString()}: ${changeName}`);
-
-  const eventsPath = join(runtimeRoot, `watcher-events-${changeName}.jsonl`);
-  const timingPath = join(runtimeRoot, `watcher-stage-timing-${changeName}.json`);
-  let allEvents = [];
-
-  const refreshHeartbeat = () => {
-    const cur = readWatcherLock(runtimeRoot);
-    if (!cur || cur.pid !== process.pid) {
-      console.warn('[watcher] 锁已不属于本进程（被并行 spawn 接管），让位退出');
-      process.exitCode = 0;
-      return false;
-    }
-    writeWatcherLock(runtimeRoot, { ...cur, heartbeatAt: Date.now() });
-    return true;
-  };
-  const heartbeatTimer = setInterval(() => { refreshHeartbeat(); }, HEARTBEAT_INTERVAL_MS);
-  heartbeatTimer.unref?.();
-
-  // 水位回补（task-04）：重启时以水位快照为 prev——首拍 diff 即停机期间变更的补发事件
-  //（置 backfill:true，事件时间=观测时间）；水位缺失/损坏 → 全新启动（现行为）。
-  const watermark = loadSnapshotWatermark(runtimeRoot, changeName);
-  const useWatermark = Boolean(watermark) && !watermark.archived;
-  let backfillPending = useWatermark;
-  let prev = useWatermark ? watermark : buildSnapshot({ changeDir, cwd, runtimeRoot, changeName });
-  // ── 孤儿自愈三闸（2026-09-22 全套件实证漏 41 个孤儿 watcher——每 3s 轮询 git 的孤儿进程）──
-  // ①出生即死：首拍已 archived（change 目录不存在/已归档）没有可观测对象，立即退出；
-  // ②仓库蒸发：head 曾非空后连续 20 拍为 null（cwd/git 仓被删——测试临时目录清理）→ 退出；
-  // ③硬寿命帽：无论活跃与否，超过 MAX_LIFETIME_MS 绝对退出（孤儿绝对上限兜底）。
-  if (prev.archived) {
-    console.log('[watcher] 首拍即 archived（无可观测对象），不启动监听');
-    clearInterval(heartbeatTimer);
-    removeWatcherLock(runtimeRoot);
-    return;
-  }
-  if (useWatermark) console.log(`[watcher] 水位回补：自 ${new Date(watermark.ts).toISOString()} 的快照续观测`);
-  let headNullStreak = 0;
-  let everHadHead = prev.head != null;
-  const hardDeadline = startedAt + MAX_LIFETIME_MS;
-  let lastActivityAt = Date.now();
-  // 哨兵引擎状态（计时锚=启动时刻；水位回补取 max(启动时刻, 水位 ts)——水位落后即 change
-  // 早已停滞，首拍就应告警而非再等满阈值，Grill 修正②）
-  let sentinelState = createSentinelState(Math.max(Date.now(), useWatermark ? watermark.ts : 0));
-  const watermarkCache = { last: null };
-  // eslint-disable-next-line no-constant-condition
-  while (true) {
-    await new Promise((r) => setTimeout(r, opts.pollIntervalMs ?? POLL_INTERVAL_MS));
-    if (!refreshHeartbeat()) break;
-    if (Date.now() > hardDeadline) {
-      console.log('[watcher] 硬寿命帽自退（绝对上限兜底，防永续孤儿）');
-      break;
-    }
-
-    let snap;
-    try {
-      snap = buildSnapshot({ changeDir, cwd, runtimeRoot, changeName });
-    } catch (e) {
-      console.warn(`[watcher] 快照构建异常（本轮跳过）: ${(e && e.message) || e}`);
-      continue;
-    }
-    // 仓库蒸发闸：git 头从有到无且持续（临时仓被删）——无对象可观测，退
-    if (everHadHead) {
-      headNullStreak = snap.head == null ? headNullStreak + 1 : 0;
-      if (headNullStreak >= 20) {
-        console.log('[watcher] git 仓蒸发（头指针连续空拍），判定无可观测对象，自退');
-        break;
-      }
-    }
-    const events = inferEvents(prev, snap);
-    // 回补标记：水位续观测的首拍 diff 事件即停机期间变更的补发（消费即复位，幂等）
-    if (backfillPending) {
-      for (const e of events) e.backfill = true;
-      backfillPending = false;
-    }
-    // ── 哨兵规则引擎（2026-09-23-sentinel-rules task-02）：warning 与基础事件同管线 ──
-    // best-effort 双层包裹（引擎内逐规则 fail-open + 此处兜底）——引擎异常绝不杀 watcher。
-    // warning 不计 lastActivityAt（不是活动）、不触发 archived 自退（终态只认基础事件）。
-    let warnings = [];
-    try {
-      // R2 定向解析器（fr-test-binding §1.1）：changeDir 推 specBase，绑定面（FR 条目+ql 机器面）
-      // 解析被改测试文件归属锚——解析异常/无绑定回落窗口级 generic（ruleTestTamper 内兜底）
-      const r = applySentinelRules({ prev, next: snap, baseEvents: events, state: sentinelState, now: Date.now(), changeDir, bindResolveImpl: changeDir ? (files) => resolveTestFileOwners({ specBase: resolve(changeDir, '..', '..'), files }) : null });
-      sentinelState = r.state;
-      warnings = r.warnings;
-    } catch (e) {
-      console.warn(`[watcher] 哨兵规则引擎异常（best-effort 跳过本轮）: ${(e && e.message) || e}`);
-    }
-    // ── 预览进度账本（2026-09-23-watcher-preview-progress task-02）：阶段级投影 best-effort ──
-    // fail-open（writePreviewStages 全程吞异常）：预览写失败不影响事件流主循环（D-005）。
-    try {
-      const { projectPreviewStages, writePreviewStages, projectPreviewSteps, writePreviewSteps } = await import('./preview-progress.js')
-      const rows = projectPreviewStages({ snapshot: snap, prevSnapshot: prev })
-      if (rows.length > 0) writePreviewStages({ specDir: specBase, changeName, rows })
-      const stepRows = projectPreviewSteps({ snapshot: snap, prevSnapshot: prev })
-      if (stepRows.length > 0) writePreviewSteps({ specDir: specBase, changeName, rows: stepRows })
-    } catch { /* 预览投影 best-effort，绝不杀 watcher */ }
-
-    const batch = events.concat(warnings);
-    prev = snap;
-    // 水位每轮前移（内容去重；archived 早退路径已在上方 return 不达此处）
-    writeSnapshotWatermark(runtimeRoot, changeName, snap, watermarkCache);
-    if (batch.length === 0) {
-      if (Date.now() - lastActivityAt > IDLE_EXIT_MS) {
-        console.log('[watcher] 空闲超时自退（6h 无事件）');
-        break;
-      }
-      continue;
-    }
-    if (events.length > 0) lastActivityAt = Date.now();
-    allEvents = allEvents.concat(batch);
-    try {
-      for (const e of batch) appendFileSync(eventsPath, JSON.stringify(e) + '\n', 'utf8');
-      writeFileSync(timingPath, JSON.stringify({ change: changeName, updatedAt: new Date().toISOString(), stages: aggregateStageTiming(allEvents) }, null, 2) + '\n', 'utf8');
-    } catch (e) {
-      console.warn(`[watcher] 事件落盘异常（best-effort 继续）: ${(e && e.message) || e}`);
-    }
-    await pushEventsToPlatform({ specBase, changeName, events: batch, env });
-    if (events.some((e) => e.kind === 'archived')) {
-      console.log(`[watcher] archived 终态，监听结束: ${changeName}`);
-      break;
-    }
-  }
-  clearInterval(heartbeatTimer);
-  const cur = readWatcherLock(runtimeRoot);
-  if (cur && cur.pid === process.pid) removeWatcherLock(runtimeRoot);
-  console.log(`[watcher] 监听结束 ${new Date().toISOString()}: ${changeName}`);
-}
-
-export { isPidAlive };
-export default { spawnWatcher, runWatcherFromEnv, readWatcherLock, isWatcherLeaseLive, isPidAlive, buildSnapshot, inferEvents, aggregateStageTiming, applySentinelRules, createSentinelState, parseGitLogWithFiles, parsePorcelainCodePaths, parseDesignListText, watcherSnapshotPath, loadSnapshotWatermark, writeSnapshotWatermark, watcherEventsPath, readWatcherEvents, toPlatformChangeEvents, pushEventsToPlatform };
+/**
+ * watcher.js — change 产物签名 watcher（R7 切片一，detached 观测旁路）。
+ *
+ * 背景（2026-09-22-r7-protocol-surgery 切片一 / D-001）：协议对话与平台心跳共线（信道
+ * 混乱）——进度信号只能靠 CLI 调用推进。本模块把观测从协议解耦：change 启动即拉起
+ * detached 监听进程，从**产物签名**（文件/git/工件三类源）推断阶段并落事件流。事件恒带
+ * provisional:true，平台 ingest 只展示不判定——`--done`（或 flow done）是唯一真相，
+ * watcher 是 best-effort 缓存，崩溃/不 spawn 零影响主流程。
+ *
+ * 结构循 src/run/bg-sync.js（spawn detached + windowsHide + 单飞锁 + 日志截尾），两处
+ * 语义差异：①长驻——锁加 heartbeatAt 心跳字段（30s 刷新，5min 无心跳或 pid 死判死；
+ * bg-sync 只有 startedAt 时效）；②**未连接平台也 spawn**（本地 jsonl 是事件唯一真相源，
+ * 平台推送是展示面增强；bg-sync 的 not-connected 短路不适用）。
+ *
+ * 观测机制=轮询快照 diff（3s，弃 fs.watch：Windows/网络盘跨平台不可靠+递归噪声；事件数
+ * 与 CLI 调用数解耦是验收钉，轮询天然满足）。轮询面收窄：change 子树已知产物 +
+ * git HEAD 头指针 + verify-quality-scan 记录——不扫全仓。
+ *
+ * 平台推送：POST {platform.url}/api/changes/{name}/events 单事件上行端点（平台侧
+ * 2026-09-26-change-events-r18-full 契约；旧 /api/observation/events 批量端点随废弃
+ * 分支消亡——2026-09-27-watcher-push-endpoint 对齐），实现模式循
+ * src/agent-session-log.js 的 pushAgentLogToPlatform（凭据读取同 readPlatformPushConfig
+ * 的 local.yaml platform 段/env 双通道——该函数未导出且 agent-session-log 属他任务
+ * allowed_paths，此处同模式自建；5s 超时/条+best-effort+env SILLYSPEC_WATCHER_PUSH=0
+ * 开关；未配置/非 2xx/网络失败静默降级本地-only）。事件经 toPlatformChangeEvents
+ * 映射为平台单条契约（kind/rule/severity/provisional/detail/ts；stage 以「stage · note」
+ * 前缀并入 detail 文本、provisional 恒 true、ts=ISO UTC；本地事件无 id 不带——
+ * 平台去重键回退 ts+'|'+rule），逐条 POST 恒 200 语义；平台按去重键
+ * 幂等吸收重推（at-least-once 上行安全）。
+ *
+ * 副产品：阶段墙钟拆账（产物事件时间序列聚合）落 .runtime/watcher-stage-timing-<change>.
+ * json，替代 transcript 抽取。
+ *
+ * 生命周期：change 目录移入 archive（archived 终态事件）→ 自退；空闲 6h 无事件 → 自退；
+ * SILLYSPEC_WATCHER=0 逃生阀（父侧不 spawn）。
+ */
+import { spawn } from 'child_process';
+import {
+  appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync,
+  readFileSync, renameSync, statSync, unlinkSync, writeFileSync,
+} from 'fs';
+import { createHash } from 'crypto';
+import { basename, dirname, join, resolve } from 'path';
+import { gitQuiet } from './git-helper.js';
+import { normalizePath, globMatch } from './change-list.js';
+import { resolveTestFileOwners } from './test-bindings.js';
+
+export const WATCHER_LOCK_FILENAME = 'watcher.lock';
+const WATCHER_LOG_FILENAME = 'watcher.log';
+
+const HEARTBEAT_INTERVAL_MS = 30_000;
+const LEASE_STALE_MS = 5 * 60_000;
+const POLL_INTERVAL_MS = 3_000;
+const IDLE_EXIT_MS = 6 * 60 * 60_1000;
+// 硬寿命帽：孤儿绝对上限（2026-09-22 泄漏实证兜底）——无论活跃与否 12h 必退
+const MAX_LIFETIME_MS = 12 * 60 * 60_000;
+const PUSH_TIMEOUT_MS = 5_000;
+const LOG_TRUNCATE_THRESHOLD = 1_000_000;
+const LOG_TRUNCATE_KEEP = 512 * 1024;
+
+/** 已知产物 → 阶段映射（阶段推断=产物签名；未列出的文件不发事件，防噪声）。 */
+const STAGE_FILES = {
+  'proposal.md': 'proposal',
+  'requirements.md': 'requirements',
+  'design.md': 'design',
+  'plan.md': 'plan',
+  'tasks.md': 'tasks',
+  'decisions.md': 'proposal',
+  'verify-result.md': 'verify',
+  'module-impact.md': 'verify',
+  'symbol-impact.md': 'verify',
+};
+
+/** pid 活性探测（跨平台）：signal 0 探测；EPERM = 进程存在但属他户，保守按活。 */
+function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e && e.code === 'EPERM';
+  }
+}
+
+/** 读 watcher 单飞锁（缺失/损坏 → null）。 */
+export function readWatcherLock(runtimeRoot) {
+  try {
+    const raw = readFileSync(join(runtimeRoot, WATCHER_LOCK_FILENAME), 'utf8');
+    const obj = JSON.parse(raw);
+    return obj && typeof obj === 'object' ? obj : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeWatcherLock(runtimeRoot, lock) {
+  mkdirSync(runtimeRoot, { recursive: true });
+  const tmp = join(runtimeRoot, `${WATCHER_LOCK_FILENAME}.${process.pid}.tmp`);
+  writeFileSync(tmp, JSON.stringify(lock) + '\n', 'utf8');
+  renameSync(tmp, join(runtimeRoot, WATCHER_LOCK_FILENAME));
+}
+
+function removeWatcherLock(runtimeRoot) {
+  try {
+    const p = join(runtimeRoot, WATCHER_LOCK_FILENAME);
+    if (existsSync(p)) unlinkSync(p);
+  } catch { /* 清锁失败：残留锁按心跳/pid 判死后自动接管，不影响正确性 */ }
+}
+
+/**
+ * 租约活性判定（心跳新鲜 + pid 活）。纯函数（pid 探测单列 isPidAlive 便于注入测试）。
+ * 与 bg-sync 锁的差异：心跳字段 heartbeatAt 是长驻租约的判死主锚（30s 刷新/5min 过期），
+ * startedAt 仅作审计信息——pid 复用假活由心跳过期兜底。
+ */
+export function isWatcherLeaseLive(lock, now = Date.now()) {
+  if (!lock || !Number.isInteger(lock.pid) || lock.pid <= 0) return false;
+  if (typeof lock.heartbeatAt !== 'number') return false;
+  if (now - lock.heartbeatAt > LEASE_STALE_MS) return false;
+  return isPidAlive(lock.pid);
+}
+
+function sha256(text) {
+  return createHash('sha256').update(text).digest('hex');
+}
+
+function countCheckboxes(text) {
+  const checked = (text.match(/- \[x\]/g) || []).length;
+  const unchecked = (text.match(/- \[ \]/g) || []).length;
+  return { checked, total: checked + unchecked };
+}
+
+/** tasks.md/任务卡里已勾选的 task-NN id 清单（假勾选归因锚：无 id 的勾选行不入判集）。 */
+function extractCheckedTasks(text) {
+  const out = [];
+  const re = /^[-*] \[[xX]\] (task-\d+)/gm;
+  let m;
+  while ((m = re.exec(String(text || '')))) out.push(m[1]);
+  return out;
+}
+
+// ── 哨兵判据源（2026-09-23-sentinel-rules task-01）：快照 additive 四源 ──
+// 口径与 src/run/verify-quality-scan.js isNonCodePath 相同（.sillyspec/、docs/、*.md 非
+// 代码面）——本地复制不 import（该模块拖 test-ledger 重链，detached 子进程不吃）。
+function isNonCodePath(p) {
+  return p.startsWith('.sillyspec/') || p.startsWith('docs/') || p.endsWith('.md');
+}
+
+/**
+ * `git log -20 --format=%h|%s --name-only` 输出解析 → [{hash, subject, files}]。
+ * hash|subject 行与后续裸路径行段式聚合（空行分隔可忽略）；解析不出任何 commit → []。
+ */
+export function parseGitLogWithFiles(text) {
+  const commits = [];
+  let cur = null;
+  for (const line of String(text || '').split('\n')) {
+    if (!line.trim()) continue;
+    const h = line.match(/^([0-9a-f]{7,40})\|(.*)$/);
+    if (h) {
+      cur = { hash: h[1], subject: h[2], files: [] };
+      commits.push(cur);
+      continue;
+    }
+    if (cur && !line.startsWith('commit ')) {
+      const p = line.trim().replace(/\\/g, '/');
+      if (p) cur.files.push(p);
+    }
+  }
+  return commits;
+}
+
+/**
+ * 提交证据并集（hash 判重，保序追加）：worktree 分支提交与主仓 log 合并——
+ * apply/merge 后同一提交从两面都可达，hash 判重防双计（newCommitsBetween 同键）。
+ */
+export function mergeCommitEvidence(base, extra) {
+  const out = [...(base || [])];
+  const seen = new Set(out.map((c) => c && c.hash).filter(Boolean));
+  for (const c of extra || []) {
+    if (!c || !c.hash || seen.has(c.hash)) continue;
+    seen.add(c.hash);
+    out.push(c);
+  }
+  return out;
+}
+
+/** porcelain → 代码脏路径清单（重命名取新路径；剔非代码面；排序去重）。 */
+export function parsePorcelainCodePaths(porcelain) {
+  const seen = new Set();
+  const out = [];
+  for (const line of String(porcelain || '').split('\n')) {
+    if (!line.trim()) continue;
+    let p = (line.slice(3) || '').trim();
+    const arrow = p.indexOf(' -> ');
+    if (arrow >= 0) p = p.slice(arrow + 4);
+    p = p.replace(/^"|"$/g, '').replace(/\\/g, '/');
+    if (!p || isNonCodePath(p) || seen.has(p)) continue;
+    seen.add(p);
+    out.push(p);
+  }
+  return out.sort();
+}
+
+/** execute-runs 下全部 review.json 的 mtime 面（有界遍历，缺失 → {}）——R1 退役后无 watcher 规则消费，保留采集维持水位序列化键稳定（2026-09-29-watcher-fakecheck-retire 评审 F1）。 */
+function collectReviewMtimes(runtimeRoot, readdirSyncImpl, statSyncImpl) {
+  const reviews = {};
+  let runs = [];
+  try { runs = readdirSyncImpl(join(runtimeRoot, 'execute-runs')); } catch { return reviews; }
+  for (const run of runs) {
+    let names = [];
+    try { names = readdirSyncImpl(join(runtimeRoot, 'execute-runs', run, 'tasks')); } catch { continue; }
+    for (const t of names) {
+      const rel = `${run}/tasks/${t}/review.json`;
+      try { reviews[rel] = Math.round(statSyncImpl(join(runtimeRoot, 'execute-runs', run, 'tasks', t, 'review.json')).mtimeMs); } catch { /* 缺失跳过 */ }
+    }
+  }
+  return reviews;
+}
+
+/**
+ * 构建一次快照（纯读盘+git 面；不入事件——推断在 inferEvents 纯函数，测试主入口）。
+ * @returns {{ts:number, archived:boolean, head:string|null, files:Object, scan:Object|null,
+ *   commits:Array<{hash,subject,files:string[]}>|null, dirtyCode:string[]|null,
+ *   scanStatus:{status:string,ranAt:*}|null, reviews:Object}}
+ *   files: { <相对 changeDir 路径>: { hash, checked, total, checkedTasks } }
+ *   哨兵四源（git 失败 → commits/dirtyCode null，规则 fail-open）；全部 JSON 可序列化
+ *   （水位回补落盘依赖）。
+ */
+export function buildSnapshot({ changeDir, cwd, runtimeRoot, changeName, readFileSyncImpl = readFileSync, statSyncImpl = statSync, readdirSyncImpl = readdirSync, gitHeadImpl, gitLogImpl, gitLogWorktreeImpl, porcelainImpl }) {
+  const snap = { ts: Date.now(), archived: false, head: null, files: {}, scan: null, commits: null, dirtyCode: null, scanStatus: null, reviews: {} };
+  if (!existsSync(changeDir)) {
+    snap.archived = true;
+  } else {
+    for (const [name, stage] of Object.entries(STAGE_FILES)) {
+      const p = join(changeDir, name);
+      if (!existsSync(p)) continue;
+      try {
+        const text = readFileSyncImpl(p, 'utf8');
+        snap.files[name] = { hash: sha256(text), stage, ...countCheckboxes(text), checkedTasks: extractCheckedTasks(text) };
+      } catch { /* 读失败按未变更处理，下轮重试 */ }
+    }
+    const tasksDir = join(changeDir, 'tasks');
+    if (existsSync(tasksDir)) {
+      for (const ent of readdirSync(tasksDir)) {
+        if (!ent.endsWith('.md')) continue;
+        const rel = `tasks/${ent}`;
+        try {
+          const text = readFileSyncImpl(join(tasksDir, ent), 'utf8');
+          snap.files[rel] = { hash: sha256(text), stage: 'tasks', ...countCheckboxes(text), checkedTasks: extractCheckedTasks(text) };
+        } catch { /* 同上 */ }
+      }
+    }
+  }
+  if (typeof gitHeadImpl === 'function') {
+    snap.head = gitHeadImpl();
+  } else {
+    const out = gitQuiet(cwd, ['rev-parse', '--short', 'HEAD']);
+    snap.head = typeof out === 'string' && out.trim() ? out.trim() : null;
+  }
+  // 哨兵源一：区间新提交（hash/subject/触及文件，单次 git log 调用同取两面）。worktree 模式下
+  // 任务提交先落 sillyspec/<change> 分支、apply 前主仓 log 不可见（2026-09-23 假勾选误报实证：
+  // change-events-channel 流 8 个 task 提交全在分支上，R1 两拍全误报），同仓分支 ref 主仓可直读
+  // ——按 hash 去重并入；分支不存在/git 失败 → null 不动（fail-open）。注入面只给 gitLogImpl 时
+  // 不追真 git（测试零真仓约定）：worktree 面要么注入 gitLogWorktreeImpl，要么走真 git 路径。
+  const injectedLog = typeof gitLogImpl === 'function';
+  const mainLog = injectedLog
+    ? gitLogImpl()
+    : gitQuiet(cwd, ['log', '-20', '--format=%h|%s', '--name-only']);
+  snap.commits = mainLog == null ? null : parseGitLogWithFiles(mainLog);
+  if (snap.commits != null && changeName && (!injectedLog || typeof gitLogWorktreeImpl === 'function')) {
+    const wtLog = typeof gitLogWorktreeImpl === 'function'
+      ? gitLogWorktreeImpl()
+      : gitQuiet(cwd, ['log', '-20', '--format=%h|%s', '--name-only', `sillyspec/${changeName}`]);
+    if (wtLog) snap.commits = mergeCommitEvidence(snap.commits, parseGitLogWithFiles(wtLog));
+  }
+  // 哨兵源二：工作树代码脏面（范围漂移/test-tamper 工作树证据）
+  if (typeof porcelainImpl === 'function') {
+    const out = porcelainImpl();
+    snap.dirtyCode = out == null ? null : parsePorcelainCodePaths(out);
+  } else {
+    const out = gitQuiet(cwd, ['status', '--porcelain']);
+    snap.dirtyCode = out == null ? null : parsePorcelainCodePaths(out);
+  }
+  const scanPath = join(runtimeRoot, `verify-quality-scan-${changeName}.json`);
+  try {
+    const st = statSyncImpl(scanPath);
+    snap.scan = { mtimeMs: Math.round(st.mtimeMs), size: st.size };
+  } catch {
+    snap.scan = null;
+  }
+  // 哨兵源三：P2 测试账本结论（内容读，stat 只管「记录变了」事件；读失败 null）
+  try {
+    const raw = JSON.parse(readFileSyncImpl(scanPath, 'utf8'));
+    const t = raw && raw.testResult;
+    snap.scanStatus = t && t.status ? { status: String(t.status), ranAt: t.ranAt || null } : null;
+  } catch {
+    snap.scanStatus = null;
+  }
+  // 哨兵源四：review.json mtime 面（R1 退役后无规则消费方；水位兼容保留采集）
+  snap.reviews = collectReviewMtimes(runtimeRoot, readdirSyncImpl, statSyncImpl);
+  // 哨兵源五（2026-09-28-watcher-signal-widen）：门实测结论——verify-runs 下本变更最新
+  // test-result.json（目录名 YYYYMMDDHHMMSS 字典序即时序）。停滞判定的核心活跃信号：
+  // 门在跑/失败/过此前对观测面完全不可见（15 分钟苦战被判停滞的实证）。
+  try {
+    const runsDir = join(runtimeRoot, 'verify-runs');
+    let latest = null;
+    for (const d of readdirSyncImpl(runsDir)) {
+      try {
+        const raw = JSON.parse(readFileSyncImpl(join(runsDir, d, 'test-result.json'), 'utf8'));
+        if (raw && raw.change === changeName) {
+          if (!latest || String(d) > latest.dir) latest = { dir: String(d), status: String(raw.status || '?'), durationMs: typeof raw.duration_ms === 'number' ? raw.duration_ms : null };
+        }
+      } catch { /* 半写/坏行跳过 */ }
+    }
+    snap.gateRun = latest;
+  } catch { snap.gateRun = null; }
+  // 哨兵源六：本地配置变更事实（local.yaml mtime——gitignored 无 git 信号；内容不上行只留痕，
+  // 「门为何突然过了」的豁免配置变更在时间线可见）
+  try {
+    const cfgStat = statSyncImpl(join(resolve(changeDir, '..', '..'), 'local.yaml'));
+    snap.localConfig = { mtimeMs: Math.round(cfgStat.mtimeMs) };
+  } catch { snap.localConfig = null; }
+  return snap;
+}
+
+/**
+ * 快照 diff → 事件（纯函数）。每事件恒带 provisional:true（护栏#5：平台 ingest 只展示
+ * 不判定）。事件面：文件首现/内容变更/checkbox 翻格/新提交/质量扫描记录/archived 终态。
+ */
+export function inferEvents(prev, next) {
+  if (!prev || !next) return [];
+  const events = [];
+  const mk = (kind, stage, detail) => ({ ts: next.ts, kind, stage: stage ?? null, detail: detail ?? null, provisional: true });
+  if (!prev.archived && next.archived) {
+    events.push(mk('archived', 'archive', 'change 目录已移入 archive'));
+    return events;
+  }
+  const keys = new Set([...Object.keys(prev.files || {}), ...Object.keys(next.files || {})]);
+  for (const key of keys) {
+    const p = prev.files[key];
+    const n = next.files[key];
+    if (!p && n) {
+      events.push(mk('file', n.stage, `${key} 出现`));
+      if (n.checked > 0) events.push(mk('task-done', n.stage, `checked 0→${n.checked}`));
+    } else if (p && n && p.hash !== n.hash) {
+      events.push(mk('file-update', n.stage, `${key} 内容变更`));
+    }
+    if (p && n && n.checked > p.checked) {
+      events.push(mk('task-done', n.stage ?? 'tasks', `checked ${p.checked}→${n.checked}`));
+    }
+  }
+  if (prev.head && next.head && prev.head !== next.head) {
+    events.push(mk('commit', null, next.head));
+  }
+  if (next.scan && (!prev.scan || prev.scan.mtimeMs !== next.scan.mtimeMs || prev.scan.size !== next.scan.size)) {
+    events.push(mk('verify', 'verify', prev.scan ? '质量扫描记录更新' : '质量扫描记录出现'));
+  }
+  // 门实测结论事件（2026-09-28-watcher-signal-widen）：新实测记录出现即事件（含结论与耗时
+  // ——停滞判定的活跃信号，ruleStall 经 baseEvents 非空自然计入 lastActivityAt）。
+  if (next.gateRun && (!prev.gateRun || prev.gateRun.dir !== next.gateRun.dir)) {
+    const dur = typeof next.gateRun.durationMs === 'number' ? `（${(next.gateRun.durationMs / 1000).toFixed(1)}s）` : '';
+    events.push(mk('gate-run', 'verify', `门实测 ${next.gateRun.status}${dur} · ${next.gateRun.dir}`));
+  }
+  // 本地配置变更事实事件（内容不上行——gitignored 文件只留 mtime 痕迹）
+  if (next.localConfig && (!prev.localConfig || prev.localConfig.mtimeMs !== next.localConfig.mtimeMs)) {
+    events.push(mk('config-change', null, prev.localConfig ? '本地配置 local.yaml 有变更（内容不上行）' : '本地配置 local.yaml 在场'));
+  }
+  return events;
+}
+
+/**
+ * 事件序列 → 阶段墙钟拆账（纯函数）：每 stage 首末事件时间差，按首事件时序输出。
+ */
+export function aggregateStageTiming(events) {
+  const byStage = new Map();
+  for (const e of events) {
+    if (!e || typeof e.ts !== 'number' || !e.stage) continue;
+    let rec = byStage.get(e.stage);
+    if (!rec) {
+      rec = { stage: e.stage, firstTs: e.ts, lastTs: e.ts, events: 0 };
+      byStage.set(e.stage, rec);
+    }
+    rec.lastTs = Math.max(rec.lastTs, e.ts);
+    rec.firstTs = Math.min(rec.firstTs, e.ts);
+    rec.events += 1;
+  }
+  return [...byStage.values()]
+    .sort((a, b) => a.firstTs - b.firstTs)
+    .map((r) => ({ stage: r.stage, firstTs: r.firstTs, lastTs: r.lastTs, durationMs: r.lastTs - r.firstTs, events: r.events }));
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// 哨兵规则引擎（2026-09-23-sentinel-rules / L1：watcher 从只看升级为会喊）
+//
+// 四规则全部机械事实判定，输出恒 advisory：{kind:'warning', rule, severity:'warning',
+// provisional:true}，与基础事件同管线入 jsonl/推平台；**不写 progress db**（真相库只归
+// 协议调用——单写者纪律）。规则逐条独立 try/catch（单规则异常 fail-open 跳过本轮，不杀
+// 引擎不杀 watcher）；warning 不计 lastActivityAt、不触发 archived 自退（不是活动）。
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** 停滞阈值（FR-05 分相位：brainstorm/plan 20min、execute 15min）。 */
+export const STALL_EARLY_MS = 20 * 60_000;
+export const STALL_EXECUTE_MS = 15 * 60_000;
+
+/** 引擎状态初值（ts=计时锚；task-04 重启回补时取 max(启动时刻, 水位 ts)）。 */
+export function createSentinelState(ts = Date.now()) {
+  return { phase: 'early', lastActivityAt: typeof ts === 'number' ? ts : Date.now(), stallOpen: false, lastDriftFiles: [], testTamper: null };
+}
+
+function mkWarning(rule, detail, ts) {
+  return { ts, kind: 'warning', stage: null, rule, severity: 'warning', detail, provisional: true };
+}
+
+/** 区间新提交差集（按 hash 判重，防 subject 改写误判；旧快照无 commits → 全部视为新）。 */
+function newCommitsBetween(prev, next) {
+  const prevHashes = new Set((prev.commits || []).map((c) => c.hash));
+  return (next.commits || []).filter((c) => c && !prevHashes.has(c.hash));
+}
+
+// ── 水位回补（2026-09-23-sentinel-rules task-04 / FR-08 / D-005@v1）──
+// 每轮把快照落 watcher-last-snapshot-<change>.json；重启读取为 prev diff 补发 backfill
+// 事件（幂等锚=水位消费即前移）；损坏/缺失 → null 全新启动（现行为零回归）；覆盖写不
+// append、内容去重不空转；archived 首拍早退路径不读不写。
+
+export function watcherSnapshotPath(runtimeRoot, changeName) {
+  return join(runtimeRoot, `watcher-last-snapshot-${changeName}.json`);
+}
+
+/** 读水位（损坏/缺失/形状不对 → null）。 */
+export function loadSnapshotWatermark(runtimeRoot, changeName) {
+  try {
+    const obj = JSON.parse(readFileSync(watcherSnapshotPath(runtimeRoot, changeName), 'utf8'));
+    return obj && typeof obj === 'object' && typeof obj.ts === 'number' && typeof obj.archived === 'boolean' ? obj : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 写水位（best-effort，失败不抛）。cacheObj={last} 时内容去重（与上次序列化串相同跳过写，
+ * 防 3s 周期空转 IO——Grill 修正③）。
+ */
+export function writeSnapshotWatermark(runtimeRoot, changeName, snap, cacheObj = null, sentinel = null) {
+  try {
+    const json = JSON.stringify(sentinel ? { ...snap, sentinel } : snap);
+    if (cacheObj && cacheObj.last === json) return { written: false };
+    writeFileSync(watcherSnapshotPath(runtimeRoot, changeName), json);
+    if (cacheObj) cacheObj.last = json;
+    return { written: true };
+  } catch {
+    return { written: false };
+  }
+}
+
+/** task-NN token 边界判据已随 R1 退役移交收口侧（sentinel-assertions.taskTokenRe 单源）。 */
+
+// ── 事件流读取（2026-09-23 watcher-alerts quick：哨兵告警可视化出口的纯读面）──
+// 子进程侧 appendFileSync 落盘名与此处读取名同锚（runWatcherFromEnv 内联字符串的唯一对应）。
+
+export function watcherEventsPath(runtimeRoot, changeName) {
+  return join(runtimeRoot, `watcher-events-${changeName}.jsonl`);
+}
+
+/**
+ * 工件内容变更重推判定（2026-10-07-allticked-gate-docs-resync，纯函数）：事件面出现
+ * tasks/design/requirements/proposal 四工件的内容变更（file 出现/file-update）→ true。
+ * 消费面：watcher 主循环触发 spec-sync 文档重推（防抖冷却）——修「平台停留 start 时点
+ * 初稿快照」（真实会话实证：agent 中途重写 tasks/design，spec-sync 只在协议调用时点推，
+ * 平台恒显初稿）。匹配口径与 inferEvents 的 detail 格式成对（`${key} 出现`/`${key} 内容变更`，
+ * key=工件文件名）。fail-open：解析不了的事件不触发重推。
+ */
+export function shouldResyncDocs(events) {
+  const DOC_KEYS = ['tasks.md', 'design.md', 'requirements.md', 'proposal.md'];
+  for (const e of events || []) {
+    if (!e || (e.kind !== 'file' && e.kind !== 'file-update')) continue;
+    const detail = String(e.detail || '');
+    if (DOC_KEYS.some((k) => detail.includes(k))) return true;
+  }
+  return false;
+}
+
+/** 工件重推防抖冷却（同 change 连续改写只触发一轮后台同步；bg-sync 自带单飞锁，双保险）。 */
+const DOCS_RESYNC_COOLDOWN_MS = 10_000;
+
+/**
+ * 读事件流（纯读：解析+过滤，`watcher alerts`/`watcher timeline` 命令与测试消费；不写盘不推平台）。
+ * 坏行/残行/非对象行跳过并计数不抛（readKnowledgeHits 先例 R-04——并发 append 交错容忍）。
+ * path 直读形态（2026-09-28-archive-timeline-bake）：传 path 时按该路径解析（同一坏行容忍
+ * 语义），供 `watcher timeline` 回退读归档包内 watcher-events.jsonl 烤制副本——path 优先于
+ * runtimeRoot/change 组合路径。
+ * @returns {{exists:boolean, events:Array, warnings:Array, badLines:number}}
+ *   文件/目录缺失 → {exists:false, 空集}；warnings=告警子集（kind 或 severity 为
+ *   'warning' 即入——mkWarning 两者皆写，双字段容差防未来形态漂移）。
+ */
+export function readWatcherEvents({ runtimeRoot, change, path: eventsPath }) {
+  let text;
+  try {
+    text = readFileSync(eventsPath || watcherEventsPath(runtimeRoot, change), 'utf8');
+  } catch {
+    return { exists: false, events: [], warnings: [], badLines: 0 };
+  }
+  const events = [];
+  let badLines = 0;
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let rec;
+    try {
+      rec = JSON.parse(trimmed);
+    } catch {
+      badLines += 1;
+      continue;
+    }
+    if (!rec || typeof rec !== 'object' || Array.isArray(rec)) {
+      badLines += 1;
+      continue;
+    }
+    events.push(rec);
+  }
+  const warnings = events.filter((e) => e.kind === 'warning' || e.severity === 'warning');
+  return { exists: true, events, warnings, badLines };
+}
+
+const testDirtyOf = (dirtyCode) => (Array.isArray(dirtyCode) ? dirtyCode.filter((p) => p.startsWith('test/')) : []);
+const normPath = (p) => String(p).replace(/\\/g, '/');
+
+/**
+ * R2 改测试凑绿（FR-03；2026-09-24 定向化，fr-test-binding §1.1 受益注记）：
+ * 账本 FAIL → 窗口内**新增**测试改动 → 账本 PASS → warning。
+ * 定向升级：窗口被改测试文件经绑定面（resolveTestFileOwners——FR 条目行+ql 面，
+ * active·非 superseded）解析归属；归属成立且该锚来源变更的 requirements.md 未在
+ * 窗口内改动 → 定向 warning test-tamper-bound（绑定测试被改 ∩ 场景正文未改 ∩
+ * FAIL→PASS，点名锚——绑定后 R2 从窗口级粗粒度升级为 FR 级定向，误报大降）；
+ * 无归属或被规格变更抑制的文件保留窗口级 generic warning——**永不比旧版更安静**。
+ * 恒 warning 档：测试纠错是无规格变更的合法场景，三联证据收窄误报不消除。
+ * FAIL 锚按账本 statKey（mtime:size）判「新记录」——同一 FAIL 记录跨拍持续只累计
+ * 证据不重锚；testDirtyAtFail 快照区分窗口前遗留脏面（Grill 修正①）。skipped 不参与。
+ */
+function ruleTestTamper(prev, next, state, ts, resolveOwners = null) {
+  const status = next.scanStatus ? next.scanStatus.status : null;
+  const commitHashes = new Set((next.commits || []).map((c) => c.hash));
+  if (status === 'failed') {
+    const statKey = next.scan ? `${next.scan.mtimeMs}:${next.scan.size}` : String(ts);
+    if (!state.testTamper || state.testTamper.statKey !== statKey) {
+      state.testTamper = { statKey, failAt: ts, testDirtyAtFail: new Set(testDirtyOf(next.dirtyCode)), testChanged: false, testChangedFiles: new Set(), anchoredCommits: commitHashes };
+    } else {
+      const anchor = state.testTamper;
+      const dirtyNow = testDirtyOf(next.dirtyCode);
+      if (dirtyNow.some((p) => !anchor.testDirtyAtFail.has(p))) { anchor.testChanged = true; for (const p of dirtyNow) if (!anchor.testDirtyAtFail.has(p)) anchor.testChangedFiles.add(normPath(p)); }
+      for (const c of next.commits || []) {
+        if (anchor.anchoredCommits.has(c.hash)) continue;
+        for (const f of c.files || []) if (String(f).startsWith('test/')) { anchor.testChanged = true; anchor.testChangedFiles.add(normPath(f)); }
+      }
+    }
+    return [];
+  }
+  if (state.testTamper && status === 'passed') {
+    const anchor = state.testTamper;
+    state.testTamper = null;
+    const changed = Array.isArray(anchor.testChangedFiles) || anchor.testChangedFiles instanceof Set
+      ? [...(anchor.testChangedFiles || new Set())].map(normPath)
+      : []; // 旧态锚（仅 testChanged 布尔，无清单）→ 无法定向，走 generic
+    if (!anchor.testChanged && changed.length === 0) return [];
+    const generic = (note) => [mkWarning('test-tamper', `测试账本 FAIL→PASS 且窗口内测试文件被改——改测试凑绿嫌疑（${note}）（测试本身写错是合法场景，人判不阻断）`, ts)];
+    if (!resolveOwners || changed.length === 0) return generic('窗口级粗粒度');
+    let owners = null;
+    try { owners = resolveOwners(changed) } catch { owners = null }
+    if (!owners || owners.size === 0) return generic(`${changed.length} 个改动测试文件无绑定锚`);
+    // 窗口全文件面（脏面 ∪ 已提交文件）——来源变更 requirements.md 同窗改动则「场景正文未改」不成立，定向抑制
+    const windowFiles = new Set([
+      ...((next.dirtyCode || []).map(normPath)),
+      ...((next.commits || []).flatMap((c) => c.files || []).map(normPath)),
+    ]);
+    const warnings = [];
+    const genericFiles = new Set();
+    for (const f of changed) {
+      const owns = owners.get(normPath(f)) || owners.get(f);
+      if (!owns || owns.length === 0) { genericFiles.add(f); continue }
+      const live = owns.filter((o) => o.source_change && ![...windowFiles].some((w) => w.includes(`/${o.source_change}/requirements.md`)))
+      if (live.length === 0) { genericFiles.add(f); continue }
+      warnings.push(mkWarning('test-tamper-bound', `${[...new Set(live.map((o) => o.anchor))].join('、')} 绑定测试被改（${f}）∩ 场景正文未改 ∩ 账本 FAIL→PASS——定向改测试凑绿嫌疑（测试纠错仍合法，人判不阻断）`, ts))
+    }
+    if (genericFiles.size > 0) {
+      warnings.push(mkWarning('test-tamper', `测试账本 FAIL→PASS 且窗口内测试文件被改（${[...genericFiles].join('、')}——无绑定锚或场景正文同窗变更，定向不成立，窗口级嫌疑保留）（测试本身写错是合法场景，人判不阻断）`, ts))
+    }
+    return warnings;
+  }
+  return [];
+}
+
+/** 任务卡 frontmatter allowed_paths 列表项解析（反引号/尾注剥离走 normalizePath）。 */
+function parseCardAllowedPaths(text) {
+  const lines = String(text || '').split(/\r?\n/);
+  let fmEnd = -1;
+  let inFm = false;
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i].trim() === '---') {
+      if (!inFm) inFm = true;
+      else { fmEnd = i; break; }
+    }
+  }
+  if (fmEnd < 0) return [];
+  const out = [];
+  let inList = false;
+  for (let j = 0; j <= fmEnd; j++) {
+    if (/^allowed_paths:\s*$/.test(lines[j])) { inList = true; continue; }
+    if (!inList) continue;
+    const m = lines[j].match(/^\s+-\s+(.+?)\s*$/);
+    if (m) out.push(normalizePath(m[1]));
+    else if (/^\S/.test(lines[j])) inList = false;
+  }
+  return out.filter(Boolean);
+}
+
+/** design.md「文件变更清单」章节条目（表格路径列+列表行；NEW: 前缀剥离后 normalizePath）。 */
+export function parseDesignListText(text) {
+  const src = String(text || '');
+  const m = /##\s*文件变更清单/.exec(src);
+  if (!m) return [];
+  const rest = src.slice(m.index);
+  const endRe = /\n##\s/;
+  const endM = endRe.exec(rest.slice(1));
+  const section = endM ? rest.slice(0, endM.index + 1) : rest;
+  const raw = [];
+  for (const line of section.split(/\r?\n/)) {
+    const t = line.trim();
+    if (t.startsWith('|')) {
+      if (/^[-:\s|]+$/.test(t)) continue;
+      const cells = t.split('|').map((c) => c.trim()).filter(Boolean);
+      const pathCell = cells.find((c) => c.startsWith('NEW:')) || cells.find((c) => (/[/]/.test(c) && /\.[A-Za-z0-9]+/.test(c)));
+      if (pathCell) raw.push(pathCell);
+    } else if (t.startsWith('- ')) {
+      raw.push(t.slice(2));
+    }
+  }
+  return raw
+    .map((s) => normalizePath(String(s).replace(/^NEW:/, '')))
+    .filter((s) => s && s !== '.' && (s.includes('/') || /\.[A-Za-z0-9]+$/.test(s)));
+}
+
+/**
+ * 声明面 = 任务卡 allowed_paths ∪ design.md 文件清单（FR-04 / D-004@v1）。两源皆空 →
+ * null（规则跳过，fail-open——无面可判不无事生非）。盘面读取注入化（测试零真 fs）。
+ */
+function loadDeclaredScope(changeDir, readImpl, readdirImpl) {
+  if (!changeDir) return null;
+  const scope = new Set();
+  try {
+    const tasksDir = join(changeDir, 'tasks');
+    for (const ent of readdirImpl(tasksDir)) {
+      if (!/^task-.*\.md$/.test(ent)) continue;
+      for (const p of parseCardAllowedPaths(readImpl(join(tasksDir, ent), 'utf8'))) scope.add(p);
+    }
+  } catch { /* tasks/ 不存在或读失败 → 该源贡献为空 */ }
+  try {
+    for (const p of parseDesignListText(readImpl(join(changeDir, 'design.md'), 'utf8'))) scope.add(p);
+  } catch { /* design.md 缺失 → 该源贡献为空 */ }
+  return scope.size > 0 ? [...scope] : null;
+}
+
+/**
+ * R3 范围漂移（FR-04）：dirtyCode 中声明面外文件（精确相等或 globMatch 容差，复用
+ * change-list 匹配器）；只对新漂移文件告警（lastDriftFiles 单调去重，活动恢复不改集）。
+ * 基线豁免（2026-09-23 R8 对撞实证 MP 假归因）：观测起点已在脏面的文件 = 并行会话先在途
+ * 工作（quick 边界记录 / baseline checkpoint 同款语义），不归因本变更——首拍基线之外的
+ * 新出现声明面外文件才算漂移。
+ */
+function ruleScopeDrift(next, state, declaredScope, ts) {
+  if (!declaredScope || !Array.isArray(next.dirtyCode) || next.dirtyCode.length === 0) return [];
+  const baseline = Array.isArray(state.baselineDirty) ? state.baselineDirty : [];
+  const unmatched = next.dirtyCode.filter((p) =>
+    !baseline.includes(p) && !declaredScope.some((pat) => pat === p || globMatch(p, pat)));
+  const fresh = unmatched.filter((p) => !state.lastDriftFiles.includes(p));
+  state.lastDriftFiles = unmatched;
+  if (fresh.length === 0) return [];
+  return [mkWarning('scope-drift', `声明面之外的代码文件被改：${fresh.join('、')}——范围漂移嫌疑（并行会话改动/越界，人判）`, ts)];
+}
+
+/**
+ * R4 停滞（FR-05 / D-003@v1）：相位 early→execute 单向锁存（task-done 事件，或 tasks.md
+ * 在场后出现新提交）；阈值 20min/15min；episode 去重（告警一次，活动恢复才允许下一发）。
+ */
+function ruleStall(prev, next, baseEvents, state, ts) {
+  const hasTasksMd = Object.prototype.hasOwnProperty.call(next.files || {}, 'tasks.md');
+  if (baseEvents.some((e) => e && e.kind === 'task-done') || (hasTasksMd && newCommitsBetween(prev, next).length > 0)) {
+    state.phase = 'execute';
+  }
+  if (baseEvents.length > 0) {
+    state.lastActivityAt = ts;
+    state.stallOpen = false;
+  }
+  const threshold = state.phase === 'execute' ? STALL_EXECUTE_MS : STALL_EARLY_MS;
+  if (state.stallOpen || ts - state.lastActivityAt <= threshold) return [];
+  state.stallOpen = true;
+  const idleMin = Math.round((ts - state.lastActivityAt) / 60000);
+  const phaseLabel = state.phase === 'execute' ? 'execute 期' : 'brainstorm/plan 期';
+  return [mkWarning('stall', `${phaseLabel}已 ${idleMin} 分钟无${state.phase === 'execute' ? '提交无' : ''}事件——停滞嫌疑（区分在想/死了，人判）`, ts)];
+}
+
+/**
+ * 哨兵规则引擎主入口（纯函数；prev 缺新字段按空集/null 容错 fail-open）。
+ * @returns {{warnings:Array, state:Object}} warnings 恒 provisional:true；archived 拍不判。
+ */
+export function applySentinelRules({ prev, next, baseEvents = [], state = null, now = Date.now(), changeDir = null, readImpl = readFileSync, readdirImpl = readdirSync, env = process.env, bindResolveImpl = null } = {}) {
+  const st = state || createSentinelState(next && next.ts);
+  const warnings = [];
+  if (!prev || !next || next.archived) return { warnings, state: st };
+  // 哨兵总阀（2026-09-23 用户降噪诉求）：SILLYSPEC_SENTINEL=0 → 规则面零告警，watcher
+  // 照常记录中性事件（观测不中断）——比 SILLYSPEC_WATCHER=0 整体不拉起细一档；排障/
+  // 嫌吵时环境级一关即静。
+  if (env.SILLYSPEC_SENTINEL === '0') return { warnings, state: st };
+  // R3 基线脏面首拍（见 ruleScopeDrift 注释）：首判轮以 prev 脏面为基线——水位重启场景
+  // 首判轮 prev 即水位快照，语义自洽（重启前已脏 = 先在途）。
+  if (!Array.isArray(st.baselineDirty)) {
+    st.baselineDirty = prev && Array.isArray(prev.dirtyCode) ? [...prev.dirtyCode] : [];
+  }
+  // 逐规则独立 fail-open：单规则抛异常只丢本轮该规则，其余照跑（引擎绝不杀 watcher）
+  try { warnings.push(...ruleTestTamper(prev, next, st, now, bindResolveImpl)); } catch { /* R2 本轮跳过 */ }
+  let declaredScope = null;
+  try { declaredScope = loadDeclaredScope(changeDir, readImpl, readdirImpl); } catch { declaredScope = null; }
+  try { warnings.push(...ruleScopeDrift(next, st, declaredScope, now)); } catch { /* R3 本轮跳过 */ }
+  try { warnings.push(...ruleStall(prev, next, baseEvents, st, now)); } catch { /* R4 本轮跳过 */ }
+  return { warnings, state: st };
+}
+
+/** watcher 平台推送凭据（模式同 agent-session-log readPlatformPushConfig：env > local.yaml platform 段）。 */
+function readWatcherPushConfig(specBase, env = process.env) {
+  if (env.SILLYHUB_PLATFORM_URL && env.SILLYHUB_PLATFORM_TOKEN) {
+    return { url: env.SILLYHUB_PLATFORM_URL, token: env.SILLYHUB_PLATFORM_TOKEN };
+  }
+  try {
+    const yamlPath = join(specBase, 'local.yaml');
+    if (!existsSync(yamlPath)) return null;
+    const lines = readFileSync(yamlPath, 'utf8').split(/\r?\n/);
+    let inPlatform = false;
+    const cfg = {};
+    for (const line of lines) {
+      if (!line.trim() || line.trim().startsWith('#')) continue;
+      if (!/^\s/.test(line)) inPlatform = line.startsWith('platform:');
+      else if (inPlatform) {
+        const m = line.match(/^\s+(url|token)\s*:\s*(.*)$/);
+        if (m) {
+          let v = m[2].trim();
+          if (v.length >= 2 && ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))) v = v.slice(1, -1);
+          if (v) cfg[m[1]] = v;
+        }
+      }
+    }
+    return cfg.url && cfg.token ? cfg : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * watcher 事件 → 平台 ChangeEventPushRequest 单条契约映射（纯函数，导出供测试）。
+ * 2026-09-27-watcher-push-endpoint：旧 ObservationEventIn 批量契约随废弃分支
+ * （observation 模块不在平台 HEAD 线）消亡——对齐现端点 POST /api/changes/{name}/events
+ * 的单事件形态（kind/rule/severity/provisional/detail/ts/id）。id 铸稳定内容键
+ * ``ts|kind|stage|note``（>512 取 sha256，评审 P1：同拍多事件共享回退键 ts+rule 会被
+ * 平台去重静默吞掉除首条外全部——file 出现与 task-done 常同拍；内容键使同拍不同
+ * 事件各得其所、重推同键幂等吸收）。stage 无独立列——以「stage · note」前缀并入
+ * detail 文本（timeline 任务面推断与人类可读双用）。
+ */
+export function toPlatformChangeEvents(events) {
+  const out = [];
+  for (const rec of events || []) {
+    if (!rec || typeof rec !== 'object') continue;
+    const numTs = typeof rec.ts === 'number' ? rec.ts : Number(rec.ts);
+    const iso = Number.isFinite(numTs)
+      ? new Date(numTs).toISOString()
+      : typeof rec.ts === 'string' && !Number.isNaN(Date.parse(rec.ts))
+        ? new Date(rec.ts).toISOString()
+        : new Date().toISOString();
+    const stageText = rec.stage ? String(rec.stage) : '';
+    const noteText = rec.detail != null ? String(rec.detail) : '';
+    const detail = noteText
+      ? (stageText ? `${stageText} · ${noteText}` : noteText)
+      : (stageText || null);
+    const idSrc = `${iso}|${String(rec.kind || 'unknown')}|${stageText}|${noteText}`;
+    out.push({
+      id: idSrc.length > 512 ? createHash('sha256').update(idSrc).digest('hex') : idSrc,
+      kind: String(rec.kind || 'unknown').slice(0, 64),
+      rule: rec.rule ? String(rec.rule).slice(0, 128) : 'watcher',
+      severity: rec.severity ? String(rec.severity).slice(0, 16) : 'info',
+      provisional: true,
+      detail,
+      ts: iso,
+    });
+  }
+  return out;
+}
+
+/**
+ * 事件推平台（best-effort，唯一非本地副作用）：单事件上行端点
+ * POST /api/changes/{name}/events（2026-09-26-change-events-r18-full 契约，
+ * 逐条 POST、恒 200 语义），每条 5s 熔断，任何失败只 warn——本地 jsonl 已是
+ * 事件唯一真相源，平台是展示面。失败即弃剩余（与旧语义一致，无重推水位）；
+ * 平台侧去重键幂等（无 id 回退 ts+'|'+rule），后续若加重推也安全
+ * （at-least-once 上行）。
+ */
+export async function pushEventsToPlatform({ specBase, changeName, events, env = process.env, fetchImpl = fetch }) {
+  if (env.SILLYSPEC_WATCHER_PUSH === '0' || !events || events.length === 0) return { pushed: null };
+  const cfg = readWatcherPushConfig(specBase, env);
+  if (!cfg) return { pushed: null, reason: 'no-config' };
+  const base = cfg.url.replace(/\/+$/, '');
+  const url = `${base}/api/changes/${encodeURIComponent(changeName)}/events`;
+  let pushed = 0;
+  for (const ev of toPlatformChangeEvents(events)) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), PUSH_TIMEOUT_MS);
+    try {
+      const res = await fetchImpl(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${cfg.token}` },
+        body: JSON.stringify(ev),
+        signal: controller.signal,
+      });
+      if (!res.ok) {
+        console.warn(`[watcher] 事件推送 → HTTP ${res.status}（本地 jsonl 已兜底）`);
+        return { pushed: pushed > 0, reason: `http-${res.status}` };
+      }
+      pushed += 1;
+    } catch (err) {
+      const msg = err && err.name === 'AbortError' ? '超时' : (err && err.message ? err.message : err);
+      console.warn(`[watcher] 事件推送失败: ${msg}（本地 jsonl 已兜底）`);
+      return { pushed: pushed > 0, reason: 'network' };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return { pushed: true, count: pushed };
+}
+
+/** 子进程起步截尾日志（>1MB 保后 512KB，整行边界起）。失败只影响日志体积。 */
+function truncateLogIfNeeded(runtimeRoot) {
+  try {
+    const p = join(runtimeRoot, WATCHER_LOG_FILENAME);
+    if (statSync(p).size <= LOG_TRUNCATE_THRESHOLD) return;
+    const buf = readFileSync(p);
+    const keep = buf.subarray(Math.max(0, buf.length - LOG_TRUNCATE_KEEP));
+    const nl = keep.indexOf(10);
+    writeFileSync(p, nl >= 0 ? keep.subarray(nl + 1) : keep);
+  } catch { /* 截断失败：继续 append */ }
+}
+
+/** 子进程 bootstrap：node -e 动态 import 本模块（file URL 精确定位，不依赖 CLI 安装形态）。 */
+function buildChildBootstrap() {
+  const selfUrl = new URL('./watcher.js', import.meta.url).href;
+  return `import(${JSON.stringify(selfUrl)}).then(m=>m.runWatcherFromEnv()).catch(e=>{console.error('[watcher] 监听进程异常退出:',(e&&e.message)||e)});`;
+}
+
+/**
+ * 父侧入口（run/command.js 在 effectiveChange 解析后无条件调用，锁合并）。
+ * 未连接平台也 spawn（本地 jsonl 是主目标）；SILLYSPEC_WATCHER=0 逃生阀。
+ * spawn 失败抛异常由调用方 catch 降级（绝不因观测旁路阻断主流程）。
+ * @returns {Promise<{status:'spawned'|'coalesced'|'disabled', logPath?:string}>}
+ */
+export async function spawnWatcher(cwd, changeName, opts = {}) {
+  const env = opts.env || process.env;
+  // 逃生阀/测试护栏：SILLYSPEC_WATCHER=0 显式关；NODE_TEST_CONTEXT（node:test 运行器注入）
+  // 下不拉起——防全量套件每条 run 用例孵化真 detached watcher 污染测试环境。
+  if (env.SILLYSPEC_WATCHER === '0' || env.NODE_TEST_CONTEXT) return { status: 'disabled' };
+  const { resolveRuntimeRoot } = await import('./run/shared.js');
+  const specBase = opts.specBase || join(cwd, '.sillyspec');
+  const runtimeRoot = resolveRuntimeRoot(opts, specBase);
+
+  const lock = readWatcherLock(runtimeRoot);
+  if (isWatcherLeaseLive(lock)) return { status: 'coalesced', logPath: join(runtimeRoot, WATCHER_LOG_FILENAME) };
+
+  const logPath = join(runtimeRoot, WATCHER_LOG_FILENAME);
+  let stdio = ['ignore', 'ignore', 'ignore'];
+  let logFd = null;
+  try {
+    mkdirSync(runtimeRoot, { recursive: true });
+    logFd = openSync(logPath, 'a');
+    stdio = ['ignore', logFd, logFd];
+  } catch {
+    logFd = null;
+  }
+
+  const childEnv = {
+    ...env,
+    SILLYSPEC_WATCHER_CHANGE: String(changeName),
+    SILLYSPEC_WATCHER_CWD: String(cwd),
+  };
+  if (opts.specBase) childEnv.SILLYSPEC_WATCHER_SPEC_BASE = String(opts.specBase);
+  if (opts.runtimeRoot) childEnv.SILLYSPEC_WATCHER_RUNTIME_ROOT = String(opts.runtimeRoot);
+
+  try {
+    const child = (opts.spawnImpl || spawn)(process.execPath, ['-e', buildChildBootstrap()], {
+      cwd,
+      detached: true,
+      stdio,
+      windowsHide: true,
+      env: childEnv,
+    });
+    child.unref?.();
+  } finally {
+    if (logFd !== null) {
+      try { closeSync(logFd); } catch { /* 父侧 fd 副本关闭；子进程持有继承副本 */ }
+    }
+  }
+  return { status: 'spawned', logPath };
+}
+
+/**
+ * 子侧入口（bootstrap 经 env 传参调起）。循环：心跳租约（30s 刷新，锁被他人接管即让位）
+ * → 每 3s 快照 diff → 事件落 jsonl + best-effort 推平台 + 墙钟拆账重写。
+ * 终态自退：archived 事件 / 空闲 6h / 锁失守。退出前清本进程锁。
+ */
+export async function runWatcherFromEnv(env = process.env, opts = {}) {
+  const changeName = env.SILLYSPEC_WATCHER_CHANGE;
+  const cwd = env.SILLYSPEC_WATCHER_CWD;
+  if (!changeName || !cwd) return;
+
+  const specBase = env.SILLYSPEC_WATCHER_SPEC_BASE || join(cwd, '.sillyspec');
+  const { resolveRuntimeRoot } = await import('./run/shared.js');
+  const runtimeRoot = env.SILLYSPEC_WATCHER_RUNTIME_ROOT
+    ? env.SILLYSPEC_WATCHER_RUNTIME_ROOT
+    : resolveRuntimeRoot({}, specBase);
+  const changeDir = join(specBase, 'changes', changeName);
+
+  truncateLogIfNeeded(runtimeRoot);
+  const startedAt = Date.now();
+  writeWatcherLock(runtimeRoot, { pid: process.pid, change: changeName, startedAt, heartbeatAt: startedAt });
+  console.log(`[watcher] 监听开始 ${new Date().toISOString()}: ${changeName}`);
+
+  const eventsPath = join(runtimeRoot, `watcher-events-${changeName}.jsonl`);
+  const timingPath = join(runtimeRoot, `watcher-stage-timing-${changeName}.json`);
+  let allEvents = [];
+
+  const refreshHeartbeat = () => {
+    const cur = readWatcherLock(runtimeRoot);
+    if (!cur || cur.pid !== process.pid) {
+      console.warn('[watcher] 锁已不属于本进程（被并行 spawn 接管），让位退出');
+      process.exitCode = 0;
+      return false;
+    }
+    writeWatcherLock(runtimeRoot, { ...cur, heartbeatAt: Date.now() });
+    return true;
+  };
+  const heartbeatTimer = setInterval(() => { refreshHeartbeat(); }, HEARTBEAT_INTERVAL_MS);
+  heartbeatTimer.unref?.();
+
+  // 水位回补（task-04）：重启时以水位快照为 prev——首拍 diff 即停机期间变更的补发事件
+  //（置 backfill:true，事件时间=观测时间）；水位缺失/损坏 → 全新启动（现行为）。
+  const watermark = loadSnapshotWatermark(runtimeRoot, changeName);
+  const useWatermark = Boolean(watermark) && !watermark.archived;
+  let backfillPending = useWatermark;
+  let prev = useWatermark ? watermark : buildSnapshot({ changeDir, cwd, runtimeRoot, changeName });
+  // ── 孤儿自愈三闸（2026-09-22 全套件实证漏 41 个孤儿 watcher——每 3s 轮询 git 的孤儿进程）──
+  // ①出生即死：首拍已 archived（change 目录不存在/已归档）没有可观测对象，立即退出；
+  // ②仓库蒸发：head 曾非空后连续 20 拍为 null（cwd/git 仓被删——测试临时目录清理）→ 退出；
+  // ③硬寿命帽：无论活跃与否，超过 MAX_LIFETIME_MS 绝对退出（孤儿绝对上限兜底）。
+  if (prev.archived) {
+    console.log('[watcher] 首拍即 archived（无可观测对象），不启动监听');
+    clearInterval(heartbeatTimer);
+    removeWatcherLock(runtimeRoot);
+    return;
+  }
+  if (useWatermark) console.log(`[watcher] 水位回补：自 ${new Date(watermark.ts).toISOString()} 的快照续观测`);
+  let headNullStreak = 0;
+  let everHadHead = prev.head != null;
+  const hardDeadline = startedAt + MAX_LIFETIME_MS;
+  let lastActivityAt = Date.now();
+  // 工件重推防抖锚（2026-10-07-allticked-gate-docs-resync）
+  let lastDocsResyncAt = 0;
+  // 哨兵引擎状态（计时锚=启动时刻；水位回补取 max(启动时刻, 水位 ts)——水位落后即 change
+  // 早已停滞，首拍就应告警而非再等满阈值，Grill 修正②）
+  let sentinelState = createSentinelState(Math.max(Date.now(), useWatermark ? watermark.ts : 0));
+  const watermarkCache = { last: null };
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    await new Promise((r) => setTimeout(r, opts.pollIntervalMs ?? POLL_INTERVAL_MS));
+    if (!refreshHeartbeat()) break;
+    if (Date.now() > hardDeadline) {
+      console.log('[watcher] 硬寿命帽自退（绝对上限兜底，防永续孤儿）');
+      break;
+    }
+
+    let snap;
+    try {
+      snap = buildSnapshot({ changeDir, cwd, runtimeRoot, changeName });
+    } catch (e) {
+      console.warn(`[watcher] 快照构建异常（本轮跳过）: ${(e && e.message) || e}`);
+      continue;
+    }
+    // 仓库蒸发闸：git 头从有到无且持续（临时仓被删）——无对象可观测，退
+    if (everHadHead) {
+      headNullStreak = snap.head == null ? headNullStreak + 1 : 0;
+      if (headNullStreak >= 20) {
+        console.log('[watcher] git 仓蒸发（头指针连续空拍），判定无可观测对象，自退');
+        break;
+      }
+    }
+    const events = inferEvents(prev, snap);
+    // 回补标记：水位续观测的首拍 diff 事件即停机期间变更的补发（消费即复位，幂等）
+    if (backfillPending) {
+      for (const e of events) e.backfill = true;
+      backfillPending = false;
+    }
+    // ── 哨兵规则引擎（2026-09-23-sentinel-rules task-02）：warning 与基础事件同管线 ──
+    // best-effort 双层包裹（引擎内逐规则 fail-open + 此处兜底）——引擎异常绝不杀 watcher。
+    // warning 不计 lastActivityAt（不是活动）、不触发 archived 自退（终态只认基础事件）。
+    let warnings = [];
+    try {
+      // R2 定向解析器（fr-test-binding §1.1）：changeDir 推 specBase，绑定面（FR 条目+ql 机器面）
+      // 解析被改测试文件归属锚——解析异常/无绑定回落窗口级 generic（ruleTestTamper 内兜底）
+      const r = applySentinelRules({ prev, next: snap, baseEvents: events, state: sentinelState, now: Date.now(), changeDir, bindResolveImpl: changeDir ? (files) => resolveTestFileOwners({ specBase: resolve(changeDir, '..', '..'), files }) : null });
+      sentinelState = r.state;
+      warnings = r.warnings;
+    } catch (e) {
+      console.warn(`[watcher] 哨兵规则引擎异常（best-effort 跳过本轮）: ${(e && e.message) || e}`);
+    }
+    // ── 预览进度账本（2026-09-23-watcher-preview-progress task-02）：阶段级投影 best-effort ──
+    // fail-open（writePreviewStages 全程吞异常）：预览写失败不影响事件流主循环（D-005）。
+    try {
+      const { projectPreviewStages, writePreviewStages, projectPreviewSteps, writePreviewSteps } = await import('./preview-progress.js')
+      const rows = projectPreviewStages({ snapshot: snap, prevSnapshot: prev })
+      if (rows.length > 0) writePreviewStages({ specDir: specBase, changeName, rows })
+      const stepRows = projectPreviewSteps({ snapshot: snap, prevSnapshot: prev })
+      if (stepRows.length > 0) writePreviewSteps({ specDir: specBase, changeName, rows: stepRows })
+    } catch { /* 预览投影 best-effort，绝不杀 watcher */ }
+
+    const batch = events.concat(warnings);
+    prev = snap;
+    // 水位每轮前移（内容去重；archived 早退路径已在上方 return 不达此处）
+    writeSnapshotWatermark(runtimeRoot, changeName, snap, watermarkCache);
+    if (batch.length === 0) {
+      if (Date.now() - lastActivityAt > IDLE_EXIT_MS) {
+        console.log('[watcher] 空闲超时自退（6h 无事件）');
+        break;
+      }
+      continue;
+    }
+    if (events.length > 0) lastActivityAt = Date.now();
+    allEvents = allEvents.concat(batch);
+    try {
+      for (const e of batch) appendFileSync(eventsPath, JSON.stringify(e) + '\n', 'utf8');
+      writeFileSync(timingPath, JSON.stringify({ change: changeName, updatedAt: new Date().toISOString(), stages: aggregateStageTiming(allEvents) }, null, 2) + '\n', 'utf8');
+    } catch (e) {
+      console.warn(`[watcher] 事件落盘异常（best-effort 继续）: ${(e && e.message) || e}`);
+    }
+    await pushEventsToPlatform({ specBase, changeName, events: batch, env });
+    // 工件内容变更即时重推（2026-10-07-allticked-gate-docs-resync）：tasks/design 等被改写
+    // （含 Edit 勾格/任务面重写）→ 防抖后触发 spec-sync 文档重推——平台不再停留 start 快照。
+    // best-effort：triggerSync 内部自带未连接预判/单飞锁/后台化，此处只挡异常不挡语义。
+    if (shouldResyncDocs(events) && Date.now() - lastDocsResyncAt > DOCS_RESYNC_COOLDOWN_MS) {
+      lastDocsResyncAt = Date.now();
+      try {
+        const { triggerSync } = await import('./run/shared.js');
+        await triggerSync(cwd, changeName, { specRoot: specBase });
+      } catch { /* 重推 best-effort：绝不影响事件流主循环 */ }
+    }
+    if (events.some((e) => e.kind === 'archived')) {
+      console.log(`[watcher] archived 终态，监听结束: ${changeName}`);
+      break;
+    }
+  }
+  clearInterval(heartbeatTimer);
+  const cur = readWatcherLock(runtimeRoot);
+  if (cur && cur.pid === process.pid) removeWatcherLock(runtimeRoot);
+  console.log(`[watcher] 监听结束 ${new Date().toISOString()}: ${changeName}`);
+}
+
+export { isPidAlive };
+export default { spawnWatcher, runWatcherFromEnv, readWatcherLock, isWatcherLeaseLive, isPidAlive, buildSnapshot, inferEvents, aggregateStageTiming, applySentinelRules, createSentinelState, parseGitLogWithFiles, parsePorcelainCodePaths, parseDesignListText, watcherSnapshotPath, loadSnapshotWatermark, writeSnapshotWatermark, watcherEventsPath, readWatcherEvents, toPlatformChangeEvents, pushEventsToPlatform, shouldResyncDocs };