tldr-experts 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,227 @@
 # Changelog
 
+## 0.26.0 — 2026-09-14
+
+### Fixed
+
+- **`tldrx replay` says what a failed stage died of, instead of `FAILED: no reason recorded` for
+  every one (#309).** MEASURED by inspection at `03d53e8`: the ONLY writer of `stage.failed` in the
+  tree — and, per `git log -S`, in its whole history — carries the failure as `payload.reason`
+  (`runNext.ts`, the fail path; the same field `stage.skipped` uses, and the same field `run auto`'s
+  own summary reads). The narrative renderer read `payload.error`, a field nothing ever set, so
+  `text()` was always empty and the fallback always fired — a stakeholder reading a replay saw
+  that a stage failed and never why, while the reason sat one field over in the same line of
+  `events.jsonl`. Same class as the `message`/`detail` drift #249's round-1 review found:
+  payloads are untyped and nothing checks a reader's field name against its writer's. The
+  renderer now reads `reason`, like its sibling one line down; the `FAILED: ` marker and the
+  fallback sentence are exported constants, and `test/replay.test.ts` feeds a hand-built
+  `stage.failed` event and pins the rendered line to the reason it carried (RED on the old read:
+  the line was never found; the fallback case is a guard). No record changes shape — nothing
+  wrote `error`, so there is no old record to tolerate.
+
+- **A wide story's measured widening no longer kills the invocation that earned it, and an executor that
+  throws after paid turns leaves their rows and their money in `run.yml` (#249).** MEASURED on a live 0.24.0
+  field run: a story with 16 declared touches changed 32 files, and the `story.touches_widened` the framework
+  measures at settle carried `paths`, `before` and `after` — three unbounded path lists, 5556 bytes against
+  the 4096-byte cap. `capPayload` knew `detail` and `outputs` by name and nothing else, so `EventLog.append`
+  threw; `measureSurface`'s "advisory, never throws" contract guarded the git read and not the emit, so the
+  throw went out through `settle` — after the story's `done` was on disk and before its `task.done` was in
+  the ledger — into `runNext`'s catch, which failed the stage with `tasks_recorded: false`: the developer's
+  and the reviewer's paid turns never reached `run.yml`, and every ceiling that derives from recorded spend
+  was short by exactly that, so the next economy refusal that should have fired would not have. Three fixes,
+  one per seam. The cap seam knows the three lists BY NAME in one declared table (`DROPPABLE_LISTS`):
+  `after` first (the largest, and derivable from the other two), then `before`, then `paths` last — each
+  dropped WHOLE and only while the payload is still over, each replaced by `<field>_omitted: N` and the same
+  reason-and-pointer sentence `outputs_omitted` carries, never a shortened list, which would read downstream
+  as the whole one; a `paths_omitted` a writer already put there (`worktree.foreign_work_aside`) is added
+  to, not overwritten. Every reader — `wideningRows`, the Build handoff, `tldrx replay` — renders
+  `(16 → 29 path(s))` from ONE derivation, `listCount`, so a row the cap could not carry reads the same
+  everywhere. `measureSurface` never throws: a refused emit records a bounded absence on the same event (the
+  counts, and a `note` naming the failure), and a log that refuses even that says so on stderr while the
+  story still settles. And the structural half, the expensive one: the Build executor carries the rows it
+  had already earned ON the error it throws (`withPartialTasks` — data on the same object, never a wrapper,
+  so what threw is still what the caller sees), and `runNext`'s catch records them through the same
+  `recordExecutorTasks` the return path uses BEFORE it fails the stage: the `error` event says
+  `tasks_recorded: true` with `rows_written`/`rows_expected` measured off the store after the write, the
+  rows keep their own `done` rather than being repainted with a throw they did not produce, and
+  `budget.spent_usd` is what was paid. Pinned by a real fake-agent build whose settle throws after both turns:
+  MEASURED on that case, the ledger before the fix recorded 0 rows / $0.00 for two paid turns, and after it
+  records 2 rows / $0.50. Which is the sentence an operator needs after this release: the cost half does not
+  just stop losing money, it stops LYING in favour of spend. With paid turns now recorded, ceilings bite
+  earlier — a run that used to reach the end because the ledger counted short may now be refused mid-way,
+  correctly but differently, so a new economy refusal after upgrading is this change working, not a
+  regression to hunt elsewhere. Pre-merge review found the double fault behind that: when recording the
+  carried rows itself threw (an `agent.result` the cap cannot rescue), rows and events were interleaved, so
+  a throw at event k stranded rows k+1… in memory and nothing the spend surfaces read said so — a plausible
+  short total, worse than a loud zero — and the `error` event was emitted BEFORE the save with a free-text
+  `recording_error` the cap did not trim, so a long one could throw the seam and lose the rows with no
+  trace. Now every row goes into the store before any event is appended (the in-memory row write cannot
+  throw; the append is the only line that can), the store is saved before the `error` event is emitted and
+  that emit is wrapped, `recording_error` sits in the cap's prose table beside `detail`, and no new
+  vocabulary reaches `budget show`, the dashboard or status: `run.yml` is whole, so they read a
+  measurement. Pre-merge review round 2 found the events side was NOT labelled — `tldrx cost --stories`
+  reads only `agent.result` events, so a story the fault left un-evented came back with no measured cost
+  and zero unmetered turns, a silent null at odds with the `budget.spent_usd` run.yml records. Now the
+  story ledger walks the log in order: a spawn opens a slot for its story, a result closes one (or, arriving
+  late from an orphaned agent after its slot was already counted lost, retires that lost slot — a result is
+  proof the turn was metered whenever it lands, never both the dollars and a lost turn), and an
+  invocation-terminal event on that stage (`stage.done`/`failed`/`skipped`, the executor or record-tasks
+  `error`, or a later `stage.started` that superseded it) turns every slot still open into a LOST turn,
+  which enters the SAME unmetered/lower-bound door: the story reads as a LOWER BOUND with the turn count,
+  not a confident zero (the dollars are in run.yml; a task row carries no story key, so they are named
+  absent per story, never invented). A spawn with nothing terminal after it is a turn IN FLIGHT — every
+  healthy mid-run read of `tldrx cost` and of the handoff — and is counted as nothing, review round 3's
+  finding: `spawned − accounted` alone had flagged every live build as a lower bound. Events carry no
+  attempt id, so the log's own order is the attempt scope. `tldrx replay`
+  renders the error line from `detail` (it read `message`, a field the event never carried) and reports
+  `rows_written` of `rows_expected` — reports, never sums.
+
+## 0.25.0 — 2026-09-14
+
+### Fixed
+
+- **A Watch card refused for an unsourced `## Where` item comes back to its writer, marked, instead
+  of being rewritten blind (#301).** MEASURED on two unattended field runs the same night: the
+  `05-watch` writer named a PostgreSQL table under `## Where` with no `[src: …]` at all — twice per
+  run, on both workspaces, once on two cards in one run — while the migration defining that table
+  was cited two lines above under `## Signal`. Three things let it through. The rule said "every
+  item is sourced" and listed five source kinds, and nowhere said which kind a table, queue or
+  dashboard takes (`stage.md`, the feature brief and the template each showed a file or a fact,
+  never a place). The refusal, `no [src: …] token — every item on a card is sourced`, restated the
+  rule and named no cure. And the retry re-ran `tldrx next` from scratch: `featurePrompt` took no
+  previous-card parameter, the refusal was written to the operator's terminal and never into the
+  next prompt, and attempt 2 on run A moved the failure from L21+L22 to L19 — an independent
+  re-generation, not a repair. A person hand-edited the card and recorded the stage twice. Now:
+  ONE sentence, `NON_FILE_SOURCE_CURE`, says what a place cites (the migration, model or config
+  that defines it, or the fact that names it), and the writer's brief teaches it with one worked
+  example while the validator's refusal repeats it verbatim — one derivation, so a retry armed with
+  the refusal is armed with the cure. And the retry's prompt carries `## Previous attempt` (the
+  same heading, H3 and 32 KB cap as the one-agent path, now constants in `prompt.ts`): the card on
+  disk re-read by the parser that refused it, each refused line as `L<n> <section>: <message>`
+  with the line quoted as written, and the card inlined under "edit, do not restart". Re-validated
+  at prompt time rather than replayed from `run.yml`, so a card a person has since fixed shows no
+  stale marks; a first attempt has no card and no section, so its prompt is unchanged. The model
+  pin stays `haiku`: nothing measured says the model cannot follow the rule — it was never told
+  the rule for this case, and the retry was never shown its own card. Pinned by the fake-agent
+  harness: the first attempt's refusal names line, rule and cure; the headless retry's and the
+  `--prepare` bundle's prompts carry the marked card; a first attempt carries no section.
+
+- **The freeze between a release and a merge wave runs both ways now (#304).** #299 made one
+  direction mechanical — the wave waits on `.RELEASE-IN-PROGRESS` — and left the other as prose:
+  MEASURED by reading `scripts/release.sh` at `a341b4f`, it sourced `merge-lock.sh` only to name
+  its own marker, and nothing between its first line and `git commit` read `merge-wave.lock`. A
+  release started mid-wave edited CHANGELOG, README and package.json in a tree another process
+  was gating, and the only thing that stopped the commit was the ref hook — which aborts the
+  COMMIT and leaves the three edits dirty in the shared checkout, with nothing to roll them back.
+  `release.sh` now WAITS on a running wave's lock before it writes its marker and before its
+  first edit — same `MW_LOCK_*` knobs, same dead-owner rule (a dead wave's lock is broken open
+  and said so on stderr) — and gives up with **exit 14**, having edited nothing. The precedence
+  is fixed rather than symmetric (peer review of this change): a wave holding the lock finishes,
+  never preempted; once the marker is up the release is ahead, a wave that took the lock in the
+  gap hands it back as it already did, and the release waits for the lock to clear WITHOUT
+  handing back its marker — two sides yielding on the same poll cadence would ping-pong for the
+  whole budget and end in 13 and 14; pinned with the gap interleaving built deterministically (a
+  stand-in `mv` plants the lock the instant the marker lands). Which makes the wave's dead-owner
+  check the only thing that ever clears a marker a SIGKILL or a cut session orphaned (the traps
+  cover INT/TERM), so it now says so on stderr, naming the marker and the pid, and that sentence
+  is pinned. And a kept marker means two things — queued and untouched, or editing and tagging —
+  so it carries `phase: waiting|releasing` (rewritten atomically), which `--status` and the wave's
+  refusal print — and while a wave holds the lock, `--status` names the queued release on a
+  second line rather than answering "a wave, nothing else": a record never says more than the
+  truth (§7). The code: 14 rather than 1 because there is nothing to undo, and
+  not the wave's own 6 because the two scripts' codes are read in the same logs, so the next
+  number after the wave's 13 keeps a bare "exit 14" unambiguous. Pinned in both directions with
+  the real scripts: a real wave against a real running release exits 13, a real release against a
+  live wave lock exits 14 with the tree untouched, and a queued release edits nothing until the
+  lock is gone. The wave's exit-12 heading gate now also requires the unreleased version to be
+  above `package.json`'s — the CHANGELOG used to be checked only against its own top dated
+  heading, so a dated section never written, or a heading edited by hand, passed on two lies from
+  one file; `package.json` is what shipped (§9's drift guard already pins README's top row to it).
+  Same exit 12: one condition, measured twice, and the refusal names both figures. Two Minors the
+  #299 review named are pinned rather than fixed, because reading was right: `--status` on an
+  old-format lock (owner and token only) with a live pid prints `?` for what it never recorded,
+  and `ver_gt` orders `1.0.0 > 0.99.0` and `0.10.0 > 0.9.0` numerically — the function is
+  lifted from the script's own text for the test, so the pin is on the real implementation.
+
+- **`tldrx next --prepare` and `--commit` ask the same dependency frontier the headless loop asks (#300).**
+  MEASURED at `31ed3d7` on the mixed shape #280 opened: a headless pass met S2 behind S1 at `review` and
+  — correctly — left S2 `todo`; the host's `--commit --review` blocked S1; the next `--prepare` said
+  `prepared S2 · … ($3.20 ceiling, attempt 1 of 1)` and `--commit` then merged S2 into an epic branch
+  S1 had put nothing on. `runAll` has asked `blockingDependency` per story since #260/#263, but the
+  three in-session doors took `nextPending()` / `inProgress()` as offered, and `pendingStories` skips
+  only `done` and a terminal `blocked` — so the `blocked` row #280 stopped writing was, incidentally,
+  the only thing keeping `--prepare` off that dependent. A pure in-session run had the hole all along
+  (S1 blocked by a verdict, S2 `todo`); the mixed run is what made it fire without a person's hand.
+  Now `--prepare` walks the pending stories through the ONE frontier and does per story what the loop
+  does — a terminal hold records the dependent `blocked` with the recorded sentence, so the reason
+  reaches the gate and `staleDependencyHold` releases it when the dependency lands; a pending hold
+  leaves the row `todo` (never `blocked`, which would re-create #280 on the other door) and, with
+  nothing else to offer, refuses with exit 1 saying there is nothing to prepare YET and what releases
+  it. `--prepare --review` refuses over a hold and records nothing. `--commit` on a story whose
+  dependency is no longer `done` refuses with exit 1 in both cases and writes nothing — the bundle,
+  the branch and the worktree stay, the story stays `in_progress`, and the sentence names all three
+  — because that story has a developer's attempt on its branch and the loop's row would say it had
+  none. Exit 1 is the sequencing family (`refusedOnSequence`): the cycle is fine and the fix is the
+  other command; a `2` would send the stage back to `ready` and throw away the bundle a held
+  `--commit` is sitting on. And the closing hint of a `--commit` with more to do asks the same frontier,
+  recording nothing: it used to read raw `nextPending()` and say `S2 is next — run tldrx next --prepare`
+  the instant S1 was blocked, naming the one bundle the next `--prepare` refuses to write; it now names
+  what `--prepare` would actually offer, or says nothing is next and why. One correction to the issue's
+  proposed sequence, measured: S1 at `review`
+  followed by `--prepare` does NOT hand S2 out — S1 is pending too and earlier in wave order, so that
+  `--prepare` offers S1's review; the dependent is offered the moment S1 leaves `review` for a status
+  `pendingStories` skips. Minor by behaviour: a `--prepare` and a `--commit` that used to hand out and
+  settle now record `blocked` or refuse.
+- **A `budget raise --stage` typed during a live `run auto` loop no longer evaporates on the loop's
+  next save (#305).** MEASURED in the field on 0.21.0: the command printed `04-build/build budget_usd
+  $12.60 → $62.60`, exited 0, and two hours later `run.yml` read `budget_usd: 12.60` again with the
+  gate note holding the stage on `budget=$35.78 of $12.60` — the developers had been capped on the
+  figure the operator had raised. Not a `budget` bug: a LOST UPDATE on `run.yml`. `RunStore.save()`
+  re-read `budget.yml`'s ceilings from disk before writing (the 2026-08-29 fix) and wrote `run.yml`
+  WHOLE from the copy the store loaded — and `run auto` holds one store for the whole of a stage, the
+  Build fan-out included. Pinned RED through the real writers on today's `main`: the raise reverted
+  (`Expected: 54 / Received: 4`), a `reject --and-continue` beside a held store reverted (`rejected` →
+  `pending`), a `run cancel` beside one lost its `cancelled:` block. `save()` now re-reads `run.yml`
+  under the workspace lock and carries over it ONLY the fields this store changed since it last read
+  or wrote the file; every derived figure is rolled up from the merged document. That is ownership by
+  change, not the blind reload-and-merge the issue warned against: every value on disk was written by
+  the store that changed it, and a store never writes back a value it merely loaded — so the loop,
+  which never touches a stage's `budget_usd`, cannot revert a raise, and the raise, which never touches
+  task rows, cannot revert the ledger. Who changes what is now written down in spec §2.2 — the loop
+  owns the execution record, a person's commands own `budget_usd`, `cancelled`, gate decisions and the
+  policies — and the one field two writers can both change, a stage's `status` under `run cancel
+  --force` while a loop still runs it, has a DECLARED winner (peer review): `cancelled` is terminal
+  and wins. A cancel that landed under a held store keeps its statuses and the cursor on the file —
+  the held store's task rows still land, those turns happened and cost money — the save answers
+  `cancelledUnder: true` and says so on stderr, and the PROCESS obeys the file, not only the file:
+  the Build executor asks `RunStore.cancelledOnDisk` before every spawn (each story attempt, each
+  parallel lane, the reviewer) and `tldrx next` stops after the save that merged the cancel, with
+  the same exit 0 its "is cancelled — nothing to advance" path uses, rather than parking a
+  cancelled stage on a gate. Pinned through the real dispatch with the fake agent: a forced cancel
+  fired from S1's own DoD command leaves exactly one `agent.spawned` on the log — S1's developer —
+  S1 parked at `review` with an `n-a` verdict naming the cancel, S2 never started, `run.yml`
+  `cancelled` with the stage `cancelled`. MEASURED before the rule: the same collision spawned five
+  times over an already-cancelled run (S1's reviewer, S2's developer and reviewer, S1's developer
+  again), and the file ended `cancelled` with the stage `awaiting_gate` — #305's shape one level
+  down. A verdict read across two owners (the loop's spend against an
+  operator's ceiling) already records the figures it read beside itself — `budget.blocked` carries
+  `remaining_usd` and `ceiling_usd`, the auto-gate note carries `budget=$x of $y` — and that is now
+  the stated rule, because the file can legitimately hold a pair no single writer saw together. For
+  the record: `reject` had no live exposure by construction (it refuses anything but
+  `awaiting_gate`/`failed`, by which point the loop's store for that stage is gone) and `run cancel`
+  already refused under a live `.lock` unless forced; both are pinned at store level anyway, because
+  the next writer will not be one of these three.
+  Two edges from the pre-merge review, because a fallback that guesses silently is the same lie in a
+  smaller font: a `run.yml` on disk that exists but cannot be merged with (does not parse, does not
+  validate) has the in-memory copy written whole — the only honest move — but that is exactly the
+  case an external write may just have been destroyed, so `save()` says so on stderr, naming the
+  reason and the `.bak` beside the file where the replaced version is (the convention the repair path
+  already uses; no new event kind, none exists for repairs and §7 does not invent one); an absent file
+  is merged with nothing and stays silent, there was nothing to lose. And a `run.yml` that records
+  ANOTHER run is not damage but a violated premise: the save REFUSES, naming both ids and the path,
+  and writes nothing — unreachable by path construction today, pinned so it stays unreachable by
+  accident.
+
 ## 0.24.0 — 2026-09-14
 
 ### Added

package/README.md

@@ -335,6 +335,8 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.26.0 | 2026-09-14 | `beta` | Two field defects from the same class — a reader of an event payload trusting a field its writer never set — plus the ceiling that killed the turn that earned it. A wide story's measured `touches_widened` no longer throws after the turn has settled: the cap knows the three lists by name and drops them whole by count, every reader derives before/after through one function, and an executor that throws after paid turns leaves their rows and money in `run.yml` and saves before it emits. The cost surfaces then agree with each other: a turn whose result was lost to that fault reads as UNMETERED, LOWER BOUND on `tldrx cost` and in the Build handoff through the door other unmeasured turns already use, a turn still in flight reads as nothing, and a late result retires the lost mark instead of counting twice. Replay reads the reason a failed stage recorded instead of printing "no reason recorded" for every one. |
+| 0.25.0 | 2026-09-14 | `beta` | The other half of the two-session protocol and four holes measured on live runs. `scripts/release.sh` now waits on a running wave's lock before touching the tree and never hands back the marker it wrote — release has precedence, the wave yields, exit 14 when it gives up; the heading gate also refuses an unreleased version at or below `package.json`; the marker carries its phase and `--status` reports a release queued behind a wave (#304). In-session `tldrx next --prepare` and `--commit` ask the same dependency frontier the headless loop asks: a terminal hold records the dependent `blocked`, a pending hold refuses without writing, a held `--commit` keeps the work it sits on and says where it is (#300). A Watch card refused for an unsourced `## Where` item comes back to its writer marked, the refusal names the cure, and the brief shows one non-file example, so a retry edits the card instead of regenerating it blind (#301). And `run.yml` no longer loses an external write to a live loop: a save carries only the fields the store changed over a fresh read, ownership is declared, `cancelled` is terminal and wins in the file and in the process, a file that cannot be merged is kept beside as `.bak` and said so, and a file recording another run is refused (#305). Minor release: a new exit code on a public script, a stricter merge gate, and `--prepare`/`--commit` refuse where they used to proceed. |
 | 0.24.0 | 2026-09-14 | `beta` | Five fixes from one unattended night, all measured on live runs. The two-session protocol is mechanical where it was chat: the merge wave refuses a merged tree with two unreleased CHANGELOG headings or one at or below the last release (exit 12), `release.sh` holds a `.RELEASE-IN-PROGRESS` marker the wave waits on (exit 13 when it gives up), `merge-wave.sh --status` reads holder, branch and phase in one line, and the `maintain` skill gains a worker-mode section (#299). A per-story cap says what it was derived from — plan price × stage scale — and names the lever that moves it, and a plan whose prices exceed the stage budget is told so instead of being scaled in silence (#281). A story whose dependency is still at `review` waits in `todo` instead of being written `blocked`, and a dependency block left by an earlier version is released once the dependency is `done` (#280). `--until-done` compares the refusal across attempts, not the advice line printed under it, so a failure that made progress keeps its relaunches (#297). And the Build handoff no longer fails its own `claim-sources` check over a refused command that spans lines: one physical line per element, the break shown as `⏎` and explained once in the document (#283). Minor release: the wave and `--until-done` behave differently in situations that exist today. |
 | 0.23.0 | 2026-09-14 | `beta` | `tldrx story reopen --as-is` now settles a story whose work is already merged into the epic but whose review never completed (`n-a` or `error` on its last recorded merge): a new, named review-only case that merges nothing and only routes the story to its reviewer, read from an additive ledger field; the existing refusal ("no commit the epic has not got") is untouched and now names the standing verdict when one exists (`changes`, `approve`, `fixlist` still refuse). A fix list whose findings are all deferred settles the story `done` instead of spawning a developer with nothing to fix, measured on a live run that paid for four such developers (#295). And a turn that died on a provider limit no longer records `success` borrowed from the provider's own subtype: the failure record says what the host saw (#296, first half — DETECTING the provider limit as its own non-execution kind is #298 and is NOT in this release). Minor release: `story reopen --as-is` behaves differently in a situation that exists today. |
 | 0.22.0 | 2026-09-14 | `beta` | A developer may now READ its own tree — `git status`, `log`, `diff` and `show` join the one constant the grant, the developer prompt and the refusal classifier all read; measured on a live unattended run where a developer was refused `git -C <worktree> log` twice and the story died, ~$5 for a command that changes nothing. `-C <path>` (and `--git-dir`, `--work-tree`) stays ungranted as a decision with its own refusal kind, `elsewhere`, because it points git at trees the story does not own. And every refusal cure now says WHY it is a cure: three consecutive developers on one story re-appended `; echo "EXIT:$?"` to a DoD command because the cure said what to drop and never that the facilitator re-runs the Definition of Done itself and records each exit code (#287, #294). Minor release: the developer's git allowance grew and a new refusal kind was added. |

package/dist/hooks/answer-capture.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   conflictOf
-} from "./chunk-tjx8g39f.js";
+} from "./chunk-d0jhr5wh.js";
 import {
   FactsStore,
   formatJaccard
@@ -13,7 +13,7 @@ import {
 import {
   EventLog,
   PHASE_ID_RE
-} from "./chunk-6z5rmj0b.js";
+} from "./chunk-41k19q8t.js";
 import {
   PHASE_IDS
 } from "./chunk-m1s8a6s0.js";

package/dist/hooks/budget-gate.js

@@ -22,10 +22,10 @@ import {
   validateRunBudget,
   wouldExceed,
   wouldExceedHostTokens
-} from "./chunk-2jb272zj.js";
+} from "./chunk-bbrhs055.js";
 import {
   EventLog
-} from "./chunk-6z5rmj0b.js";
+} from "./chunk-41k19q8t.js";
 import {
   cursorStage,
   hostTokensIn,

package/dist/hooks/{chunk-2jb272zj.js → chunk-bbrhs055.js}

@@ -706,6 +706,9 @@ function stackExpertNames(root, repos) {
   return names;
 }
 
+// src/core/facilitator/prompt.ts
+var MAX_PREVIOUS_ATTEMPT_BYTES = 32 * 1024;
+
 // src/core/text/srcGrammarContract.ts
 var KINDS = {
   file: { shape: "`[repo:]path:line[-line]`", example: "api:src/Selector.ts:241" },

package/dist/hooks/{chunk-tjx8g39f.js → chunk-d0jhr5wh.js}

@@ -5,7 +5,7 @@ import {
   evidencePath,
   gateEvidencePath,
   parseEvidence
-} from "./chunk-6z5rmj0b.js";
+} from "./chunk-41k19q8t.js";
 import {
   openBlocks,
   parseQuestions

package/dist/hooks/{chunk-4frmcwp3.js → chunk-pwzy19er.js}

@@ -8,7 +8,7 @@ import {
   spentBasis,
   tallyOf,
   validateRunBudget
-} from "./chunk-2jb272zj.js";
+} from "./chunk-bbrhs055.js";
 import {
   EventLog,
   OUTCOME_NOT_RECORDED,
@@ -21,7 +21,7 @@ import {
   isTerminal,
   stageAt,
   validateRunFile
-} from "./chunk-6z5rmj0b.js";
+} from "./chunk-41k19q8t.js";
 import {
   cursorStage,
   isAttendedByHostView,
@@ -56,6 +56,7 @@ import { join as join4 } from "node:path";
 
 // src/core/run/RunStore.ts
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
 import { basename, join as join2 } from "node:path";
 
 // src/core/frameworkVersion.ts
@@ -297,11 +298,14 @@ class RunStore {
   events;
   current;
   currentBudget;
+  loaded;
+  cancelledUnderFlag = false;
   budgetMutated = false;
   constructor(runDir, run, budget, events) {
     this.runDir = runDir;
     this.events = events;
     this.current = run;
+    this.loaded = run;
     this.currentBudget = budget;
   }
   static open(runDir) {
@@ -386,6 +390,20 @@ class RunStore {
   get runId() {
     return this.current.run;
   }
+  get cancelledUnder() {
+    return this.cancelledUnderFlag;
+  }
+  static cancelledOnDisk(runDir) {
+    const path = join2(runDir, "run.yml");
+    if (!existsSync(path))
+      return false;
+    try {
+      const doc = parseYaml(readFileSync2(path, "utf8"));
+      return validateRunFile(doc).ok && asRunFile(doc).cancelled !== undefined;
+    } catch {
+      return false;
+    }
+  }
   cursorEntry() {
     return stageAt(this.current, this.current.cursor);
   }
@@ -407,13 +425,14 @@ class RunStore {
     this.events.append(event);
   }
   save() {
-    const rolled = rollUp(this.current);
-    const runValidation = validateRunFile(rolled);
-    if (!runValidation.ok) {
-      const first = runValidation.issues[0];
-      throw new RunStoreError(`refusing to write an invalid run.yml: ${first?.path ?? ""} ${first?.message ?? ""}`);
-    }
-    withWorkspaceLock(workspaceRootOfRunDir(this.runDir), () => {
+    return withWorkspaceLock(workspaceRootOfRunDir(this.runDir), () => {
+      const base = this.runToWrite();
+      const rolled = rollUp(base.run);
+      const runValidation = validateRunFile(rolled);
+      if (!runValidation.ok) {
+        const first = runValidation.issues[0];
+        throw new RunStoreError(`refusing to write an invalid run.yml: ${first?.path ?? ""} ${first?.message ?? ""}`);
+      }
       const budget = rollUpBudget(this.ceilingsToWrite(), rolled);
       const budgetValidation = validateRunBudget(budget);
       if (!budgetValidation.ok) {
@@ -421,12 +440,56 @@ class RunStore {
         throw new RunStoreError(`refusing to write an invalid budget.yml: ${first?.path ?? ""} ${first?.message ?? ""}`);
       }
       writeAtomic(join2(this.runDir, "budget.yml"), emitBudgetYaml(budget));
-      writeAtomic(join2(this.runDir, "run.yml"), emitRunYaml(rolled));
+      const runPath = join2(this.runDir, "run.yml");
+      writeAtomic(runPath, emitRunYaml(rolled));
       this.current = rolled;
+      this.loaded = rolled;
       this.currentBudget = budget;
       this.budgetMutated = false;
+      if (base.fallback !== null) {
+        process.stderr.write(`tldrx: ${runPath} ${base.fallback}, so it could not be merged with: this process's copy of ` + `the run was written whole, and the version that was on disk is beside it as ${backupPathFor(runPath)}. ` + "A change another command wrote there since this process read the run (a budget raise, a " + `cancel, a rejection) may be in that backup and not in run.yml.
+`);
+      }
+      if (base.cancelledUnder) {
+        this.cancelledUnderFlag = true;
+        const who = rolled.cancelled;
+        process.stderr.write(`tldrx: run ${rolled.run} was cancelled` + (who === undefined ? "" : ` by ${who.by} at ${who.at} (${who.note})`) + " while this process held it: the cancel's statuses were kept, this process's task rows were " + `recorded beside them, and nothing more may be spawned for it.
+`);
+      }
+      return { cancelledUnder: base.cancelledUnder };
     });
   }
+  runToWrite() {
+    const path = join2(this.runDir, "run.yml");
+    if (!existsSync(path))
+      return { run: this.current, fallback: null, cancelledUnder: false };
+    let doc;
+    try {
+      doc = parseYaml(readFileSync2(path, "utf8"));
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      return { run: this.current, fallback: `could not be read or parsed (${detail})`, cancelledUnder: false };
+    }
+    const validation = validateRunFile(doc);
+    if (!validation.ok) {
+      const first = validation.issues[0];
+      return {
+        run: this.current,
+        fallback: `does not validate (${first?.path ?? ""} ${first?.message ?? "schema error"})`,
+        cancelledUnder: false
+      };
+    }
+    const onDisk = asRunFile(doc);
+    if (onDisk.run !== this.current.run) {
+      throw new RunStoreError(`refusing to write ${path}: it records run ${onDisk.run}, and this store holds run ` + `${this.current.run} — a save never overwrites another run's record`);
+    }
+    const cancelledUnder = onDisk.cancelled !== undefined && this.loaded.cancelled === undefined && this.current.cancelled === undefined;
+    return {
+      run: carryChanges(onDisk, this.current, this.loaded, { cancelledWins: this.cancelledUnderFlag || cancelledUnder }),
+      fallback: null,
+      cancelledUnder
+    };
+  }
   ceilingsToWrite() {
     if (this.budgetMutated)
       return this.currentBudget;
@@ -474,6 +537,41 @@ function parseStateFile(path) {
 `));
   }
 }
+function carryChanges(onDisk, mine, loaded, rules = { cancelledWins: false }) {
+  const top = carryLevel(onDisk, mine, loaded, rules.cancelledWins ? ["phases", "cursor"] : ["phases"]);
+  const phases = mine.phases.map((phase) => {
+    const theirs = onDisk.phases.find((p) => p.id === phase.id);
+    const was = loaded.phases.find((p) => p.id === phase.id);
+    if (theirs === undefined || was === undefined)
+      return phase;
+    const stages = phase.stages.map((stage2) => {
+      const theirStage = theirs.stages.find((s) => s.id === stage2.id);
+      const wasStage = was.stages.find((s) => s.id === stage2.id);
+      if (theirStage === undefined || wasStage === undefined)
+        return stage2;
+      const kept = rules.cancelledWins && theirStage.status === "cancelled" ? ["status", "started_at", "ended_at"] : [];
+      return carryLevel(theirStage, stage2, wasStage, kept);
+    });
+    return { ...carryLevel(theirs, phase, was, ["stages"]), stages };
+  });
+  return { ...top, phases };
+}
+function carryLevel(onDisk, mine, loaded, skip) {
+  const out = { ...onDisk };
+  const theirs = mine;
+  const was = loaded;
+  for (const key of new Set([...Object.keys(theirs), ...Object.keys(was)])) {
+    if (skip.includes(key))
+      continue;
+    if (isDeepStrictEqual(theirs[key], was[key]))
+      continue;
+    if (theirs[key] === undefined)
+      delete out[key];
+    else
+      out[key] = theirs[key];
+  }
+  return out;
+}
 function rollUp(run) {
   const phases = run.phases.map((phase) => {
     const stages = phase.stages.map((stage2) => ({

package/dist/hooks/session-start.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   questionsCard
-} from "./chunk-tjx8g39f.js";
+} from "./chunk-d0jhr5wh.js";
 import"./chunk-jpp137mb.js";
 import {
   allow,
@@ -20,17 +20,17 @@ import {
   runSnapshot,
   statusWithOutcome,
   whatIsWaiting
-} from "./chunk-4frmcwp3.js";
+} from "./chunk-pwzy19er.js";
 import {
   expertsDir,
   loadExperts,
   pathsIntersect,
   readExpertDomain,
   stackExpertNames
-} from "./chunk-2jb272zj.js";
+} from "./chunk-bbrhs055.js";
 import {
   isFinished
-} from "./chunk-6z5rmj0b.js";
+} from "./chunk-41k19q8t.js";
 import"./chunk-m1s8a6s0.js";
 import {
   openRunViews

package/dist/hooks/statusline.js

@@ -2,9 +2,9 @@
 import {
   bar,
   runSnapshot
-} from "./chunk-4frmcwp3.js";
-import"./chunk-2jb272zj.js";
-import"./chunk-6z5rmj0b.js";
+} from "./chunk-pwzy19er.js";
+import"./chunk-bbrhs055.js";
+import"./chunk-41k19q8t.js";
 import"./chunk-m1s8a6s0.js";
 import"./chunk-yre2scxn.js";
 import"./chunk-bznt6jb2.js";