tldr-experts 0.32.0 → 0.34.0

package/CHANGELOG.md

@@ -1,5 +1,291 @@
 # Changelog
 
+## 0.34.0 — 2026-09-17
+
+### Fixed
+
+- **`budget show`, `run estimate` and the `budget-gate` hook now price a Build stage's
+  `reviewer_share`, `story_cap_multiplier` and `story_cap_floor_usd` the same way `tldrx next`'s
+  brake does, instead of the shipped defaults (see #333).** #214 fixed exactly one of the four
+  `stage.yml` calibrations `remainingWork` takes — `attempts` — leaving these three still
+  defaulted by the three readers while the brake resolved all four through `spec.tuning`.
+  Measured against the Build fixture (three stories priced 2.00/2.50/4.50, two done, stage
+  ceiling $60): a stage that writes `story_cap_multiplier: 1` ("take the plan's price
+  literally") was quoted $24.25 by `budget show`/`run estimate`/the hook against the $10.75 the
+  brake would actually price and dispatch — 2.3x — with the phase ceiling able to sit between
+  the two, so `budget show` said BLOCKED and the hook denied a `tldrx next` the brake itself
+  allows. `buildStageDefaults` (`core/run/workflowPreset.ts`) now resolves and returns the
+  stage's full `StageTuning`, not just `attempts` and `timeout_s`, by re-reading the same
+  `stage.yml` `facilitator/stageSpec.ts`'s `overlay` already reads — tolerant exactly as before,
+  so an unreadable stage file still falls back to the shipped defaults. `run estimate` already
+  held the full tuning via `loadStageSpec`; it was just not forwarding three of the four fields
+  to `remainingWork`.
+- **`round2` and the spec §3 exit-code table are each defined in exactly one place, with a shape
+  test refusing a second copy (see #174).** `round2` (`Math.round(n * 100) / 100`) was
+  independently restated in nine files; the spec §3 exit codes (`cli/exitCodes.ts`) were
+  independently restated, under a mix of matching and diverging names (`EXIT_REFUSED` for
+  `EXIT_GATE_REFUSED`, `EXIT_AWAITING` for `EXIT_AWAITING_HUMAN`), in fourteen more — wider than
+  the issue's own grep found, which only named `runNext.ts`/`runAuto.ts`; the broader set was
+  measured here (`grep -rlE '^const EXIT_[A-Z_]+\s*=\s*[0-9]+;' src/`) and folded into the same
+  fix rather than filed separately, since it is the identical defect the issue is about. Every
+  local copy now imports the canonical one (`core/build/caps.ts`'s exported `round2`,
+  `cli/exitCodes.ts`'s table, aliased where a file's own name differed) instead of restating it.
+  Mechanism this was hiding: a golden-guard mutation of `cli/exitCodes.ts` left
+  `test/build-golden.test.ts` byte-identical, because the Build path never read that file's
+  constants at all — it read `runNext.ts`'s and `runAuto.ts`'s own private copies. The new
+  `test/round2-exitcodes-one-derivation.test.ts` asserts, on the SHAPE (a local, unexported
+  `function round2(`/`const EXIT_*` declaration) rather than on the measured names, that no file
+  under `src/` besides the two canonical ones defines either — on the precedent of
+  `test/phase-ids-one-derivation.test.ts` (#187): deleting today's copies does not stop a third
+  one from coming back under a name this file never mentions.
+- **`merge-wave.sh --status` now says why it could not look instead of answering `idle` (see
+  #332).** AGENTS.md §2 calls this command the authoritative instrument for "is a wave alive" —
+  the reference-transaction guard and the merge lock exist precisely so nobody has to `ps` plus
+  a marker's mtime. Measured on the first autonomous run against this repo (2026-09-17): run
+  from outside a git repository, or with its `merge-lock.sh` sibling missing, it answered `idle`
+  and exit 0 — a false all-clear that could start a wave on top of one already live. It now
+  prints `unknown: <reason>` and exits **15**, its own code (`14` stays release.sh's — see
+  AGENTS.md §2 and docs/RELEASING.md), so a caller polling stdout can no longer read "could not
+  check" as "nothing is happening".
+- **`merge-wave.sh` now diffs a released, dated CHANGELOG section's content, not just its
+  heading, so a rebase-then-merge across a release can no longer land a bullet inside it
+  silently.** The exit-12 gate only ever counted unreleased headings; a branch written before
+  a release and rebased onto main after that release merged CLEANLY — no conflict, no heading
+  touched — and its bullet landed inside the now-dated, supposedly immutable section, caught
+  only by a human reading the diff or much later by `release-check.sh`'s own #200 check. The
+  wave now compares every dated section against what main had immediately before the merge and
+  refuses with its own exit **16**, naming the section and the first difference (see #336).
+- **A spawning test run whose `$TMPDIR` sits inside a git work tree can no longer commit its
+  scratch paths onto the enclosing branch (#335).** Fixtures resolve their sandbox through
+  `os.tmpdir()`/`$TMPDIR` and run real git inside it; when that path is inside a worktree,
+  git's own upward repo search walks out of the fixture and finds the WORKTREE's repo, so
+  `git add`/`git commit` there land on whatever branch is checked out — #335 measured 960
+  tracked scratch paths and dozens of foreign commits on a real branch this way, and the same
+  underlying mechanism reproduced here on `490f637` from a fresh throwaway worktree as the same
+  two test failures the issue reported (`test/gitignore-shadow.test.ts`,
+  `test/install.test.ts`). The `bun test` preload `test/preload/tmpdirGuard.ts` now refuses,
+  named, before any test runs, when the resolved `$TMPDIR` is inside a git work tree — opt out
+  only with `TLDRX_ALLOW_TMPDIR_IN_WORKTREE=1`, once the isolation is verified some other way.
+- **A turn killed mid-flight by SIGINT/SIGTERM now banks its cost as absent, not a measured
+  `$0.00` (see #355).** `interrupt.ts`'s `recordPartialResult` wrote `cost_usd: 0` with no
+  `metered` key on both the task row and the `agent.result` payload — legal by `RunFile.ts`'s
+  validator, which only ever checked the converse (a `null` needs `metered: false`), so it
+  passed silently while `tallyOf` summed the row into the metered bucket as a real, measured
+  zero and `spendBasis` called the run's total complete. It now writes `cost_usd: null,
+  metered: false` on the row and the payload, the same idiom every other unknown-cost turn in
+  this codebase already uses, so a Ctrl-C mid-turn reads as a stated lower bound.
+- **A killed parent's abandoned Build-story turn now leaves a row in `run.yml`, not nothing (see
+  #337).** The headless half of this shipped earlier as the orphan case #337 was filed for; the
+  fix deliberately skipped every Build-executor phase, reasoning the per-story ceiling ledger
+  already covered it — true for `tldrx cost`'s per-story view, but that ledger has no `run.yml`
+  task row to show for it, so `tallyOf`/`spendBasis` (and so `budget.spent_usd`) never saw the
+  abandoned attempt at all, not even as unmetered. `demoteStaleRunning` now reads which of a
+  stuck Build stage's `agent.spawned` turns no `agent.result` ever answered
+  (`build/orphanedTurns.ts`) and records one `cost_usd: null, metered: false` row per abandoned
+  story, same as the headless case.
+- **The boundary gate now diffs the branch Build actually cut under `branch_model: integration`,
+  instead of an epic file's unused per-epic `branch:` label (see #225).** `epicTargets` read
+  `03-plan/epics/*.md`'s own `branch:` as the ref to diff — right under `per-epic`, where Build
+  cuts exactly that name, and silently wrong under `integration`, where every epic's stories
+  merge into ONE recorded branch and the epic's `branch:` is never cut at all. A run with eight
+  such epics measured `boundary=n/a (nothing could be diffed: … does not resolve …)` and
+  auto-signed a +31,465/−237-line PR across 117 files with the condition having diffed nothing.
+  The branch now comes from `run.yml`'s `build.epic_branch`, through the same `recordedEpicBranch`
+  derivation `watch` and `ship` already use (#90) — the epic file supplies repos and stories,
+  never the ref. A run that recorded an epic branch and still cannot diff it now HOLDS the gate
+  instead of reading `n/a`; `n/a` stays reserved for a run that named no branch to diff at all.
+- **The boundary gate reads a run's stories through the same validated, all-phases walk `ship`
+  and carried-findings ownership already share, instead of its own `03-plan/`-only, schema-less
+  reader (see #189).** `boundary.ts`'s `storyTouches` was a third `stories/*.md` reader: it
+  looked only under `03-plan/` (missing a story filed under `04-build/`, the phase a carried fix
+  list's own story is written under), parsed front matter with no schema (taking a story a real
+  reader would report as unreadable), and dropped an unparseable file silently. It now calls the
+  shared `scanStories`/`phaseDirsOf` leaf (extracted from `build/carriedRows.ts` into
+  `build/storyScan.ts` so `boundary.ts` — which `carriedRows.ts` already imports from — does not
+  import it back), closing a divergence `carriedRows.ts` had documented as "somebody else's
+  issue" since #171.
+- **An agent gate can no longer sign over evidence dated before the stage it is closing even
+  started (see #144).** A field evaluation of a delegated `watch` gate found its evidence note
+  timestamped 7h before its stage began, asserting facts already false by the time it signed,
+  with `refuted: 0` — the resolution half of that bug was #140; this is the remaining half
+  AGENTS.md §7 names: "a gate's evidence must not predate what it signs". `validateEvidence`
+  refuses a note whose `at:` is before the CURRENT attempt's own start — the new, additive
+  `RunStage.attempt_started_at`, which `markRunning` overwrites on every run, never the frozen
+  `started_at` it sits beside (§7: existing fields only grow, never change meaning; `started_at`
+  is set once, at the stage's first run, and stays that forever) — on both the engine's own
+  signer and `approve --as-agent`, one derivation, both doors. Two more holes pre-merge review
+  found in the same check: `at` was only confirmed non-empty, so a raw string compare read a
+  date-only `at` as earlier than a same-day, full-precision stage start; `at` is now confirmed a
+  real RFC3339 instant first, and the two timestamps are compared as instants, not strings. And
+  the full test gate caught the new check's own collateral: `tldrx learn`'s chapter 6 planted its
+  stand-in evidence note with a fixed past date, which the real wall clock had by now walked
+  past — its `at:` is stamped off `Date.now()` (with a 5-minute forward buffer, since the note is
+  written before the step that starts the stage it signs) rather than a date fixed at authoring
+  time.
+- **`tldrx reject` now archives a stage's scratch evidence note instead of leaving it for the
+  next attempt to sign over (see #199).** A reject sent a stage back to `ready` but never
+  touched `.agent/<stage>/evidence.md`, so a note that had already said `verdict: sign` over one
+  attempt's outputs was still the first (and only) thing either signer found after the stage
+  re-ran with different outputs — and could sign again over an attempt it never read. The note
+  is renamed to `evidence.rejected-<at>.md` in the same scratch directory (moved, not deleted:
+  it is still the record of a real check somebody made), so the re-run meets the ordinary "no
+  evidence note at …" state instead. `reject` also advances the stage's `attempt_started_at`
+  anchor to its own moment (see #144's entry above) — closing a gap pre-merge review found:
+  without it, `approve --evidence <path>` pointed straight at the just-archived note still
+  signed, since nothing yet had moved the anchor past it. Archiving is collision-safe too
+  (`-2`, `-3`, … suffixes): two rejections landing in the same clock second used to let the
+  second silently overwrite the first's archive.
+- **`reject --stage` (i.e. a revoke) no longer strands a later stage `running` with no verb that
+  owns it, and `run unlock`'s stranded-run note no longer promises a demotion `next` does not
+  make (see #228).** A revoke marked every later stage `stale: true` but left `status: running`
+  untouched; `next` only demotes a `running` stage behind a DEAD-PID lock, and a revoke leaves no
+  lock behind at all, so the cursor could walk back into that stranded stage mid-flight once the
+  revoked stage was re-approved. A later `running` stage with nothing holding it (no `--prepare`
+  bundle waiting) now goes back to `ready` alongside going stale, named on the outcome and on the
+  additive `gate.revoked` event; one holding a bundle is a sub-agent turn already paid for, so
+  the revoke refuses instead and names it. `run unlock` had the same false promise for a
+  lockless `running` stage ("`tldrx next` demotes it") — it now performs that demotion itself
+  when nothing is holding the run, rather than describing a move nothing makes. A revoke also
+  advances `attempt_started_at` (see #144, #199) on the stage it revokes and on every stage it
+  demotes, for the same reason `reject` does.
+- **A mutating generator command in a story's dod block can no longer be run by the base-tree
+  pre-flight as a routine measurement (see #362).** Measured live, tldrx 0.31.1: a `.NET`
+  story's dod block declared `dotnet ef migrations add …` beside ordinary build/test commands,
+  and the base-tree probe ran it against the UNTOUCHED base tree — a DELTA-gate measurement is
+  not supposed to mutate the tree it is measuring, and it would have written a migration triple
+  into pristine `main` as a side effect of asking a question. `isGeneratorCommand`
+  (`schemas/commandAllowlist.ts`) detects a generator BY NAME — the command text, not a
+  workspace-declared slot key, since a team names its migration-add slot whatever it likes — and
+  two doors read that one derivation: `validateStoryDod` now refuses a generator command at Plan
+  time, so a plan is never written this way, and `dodRunner.ts`'s `measureBaseCommand` refuses
+  to run one against either base tree it measures, as defense in depth for a story file that
+  reached Build some other way. Neither door touches a story's own fresh worktree, where a
+  generator legitimately runs once, by the developer.
+- **`tldrx next` now self-closes a parked `auto` gate the moment every condition it was held on
+  clears, `--wait-gates` or not (see #342).** Before this, the only door that ever re-measured an
+  already-`awaiting_gate` stage was `run auto --wait-gates`'s own poll (`waitForGate` →
+  `selfCloseAutoGate`); without that flag, `run auto` answering its own blocking questions (or a
+  person answering them by hand) left the gate `awaiting_gate` forever, and the next `next` call
+  reported it as terminal-for-this-call with a generic `gate pending: tldrx approve` — never
+  noticing the questions it was parked on had since been answered. `next` now re-runs the same
+  seven conditions (`reevaluateAutoGate`) on every `awaiting_gate` stage whose policy is `auto`
+  before giving up, and signs it through the same `approve` door a freshly-closed gate uses —
+  `human` and `agent` gates are untouched, and a verdict that still fails falls through to the
+  ordinary human-gate report exactly as before.
+- **The default Build budget gate now parks at a story boundary instead of stopping the stage
+  incomplete with no boundary the operator chose (see #354).** `runNext.ts`'s `budgetRefusal`
+  meters the phase ceiling exactly once, at stage entry — the Build executor itself never
+  re-checked the envelope between two dispatches of one headless run, so a phase that could
+  afford its entry estimate but ran short partway through kept dispatching until the money was
+  gone, and the only way the gate fired again was an all-or-nothing refusal on a RETRY of a
+  failed stage. Modeled directly on #298's rate-limit park: before starting a new story's
+  developer, the executor now checks whether the stage's remainder still covers that story's
+  floor and, if not, lets whatever is already running finish and settle, then stops — recording
+  one `budget.parked` event (mirroring `agent.rate_limited`'s shape) and naming the shortfall as
+  the reason in both the operator line and the handoff's `## Unknowns`. `run auto --wait-gates`
+  resumes the parked stage itself once an operator's `tldrx budget raise --stage` (or
+  `--rebalance-finished`) actually raises the STAGE's own `budget_usd` — checked fresh on every
+  poll against the phase's real remainder, never a clock — and `run status` names the park
+  instead of reading as a decision waiting on a person.
+
+## 0.33.0 — 2026-09-17
+
+### Added
+
+- **A workspace can opt its base pre-flight probe into a story-shaped worktree, so an
+  environmental red that only appears there is caught before the first story (#371).** #363
+  shipped `tree:` provenance on every base-pre-flight row and declined, by measured decision, to
+  move the probe itself into a worktree by default — doing so on every run would pay for the
+  declared command a second time and reopen the `node_modules`-less outage the checkout-only
+  design exists to avoid. `probe_in_worktree: true`, workspace-wide and additive, is the opt-in
+  for a workspace that has actually seen the gap #363 named: a command green in the checkout and
+  red only in a story's own worktree shape (a `.git` FILE vs. a `.git` directory is the measured
+  case). On, every declared base command is ALSO measured, once per repo, in a fresh detached
+  worktree of the base sha — kept beside the checkout row, never instead of it, under the same
+  `tree:` field (`checkout` vs. `worktree`) rather than a third tree constant. Off (the default,
+  and every workspace before this key existed) leaves the base pre-flight measuring the checkout
+  only, exactly as before. Pre-merge review measurement: a session that calls the base pre-flight
+  more than once (a `prepare()` followed by the real call) paid for a `git worktree add`/`remove`
+  on EVERY call, even when every declared command already had a fresh `tree: worktree` reading and
+  nothing was spawned there — fixed by checking every command's cache hit before touching git at
+  all, so a worktree is opened only when at least one command still needs a fresh measurement.
+
+### Fixed
+
+- **The plan sequencing rule (#365) could false-positive two unrelated stories that happened to
+  share a generic single-transition camelCase token (#370).** `fieldsIn`
+  (`src/core/plan/planShape.ts`) captured ANY bare camelCase/PascalCase token with one inner
+  capital as a field candidate, so a story enforcing an invariant near a word like `toString` or
+  `getId` collided with an unrelated story populating a same-named `toString` or `getId`
+  elsewhere, refusing an honest plan for sharing nothing but an incidental identifier. A bare
+  camelCase/PascalCase token with at least two internal capital transitions
+  (`DeliveryAddressText`) still always counts; a one-transition token (`toString`, `getId`) now
+  counts only when the SAME normalized field is ALSO spelled `snake_case` or backtick-quoted
+  somewhere else in the plan — dropping one-transition tokens outright, the first cut at this
+  fix, reopened #365 for a genuine two-word field spelled bare PascalCase on one side and
+  `snake_case` on the other (`order_total` enforced in one story, bare `OrderTotal` populated in
+  another still refuses; `toString` shared by two unrelated stories, with no `snake_case` or
+  backtick sibling anywhere in the plan, still does not). `snake_case` and backtick-quoted
+  identifiers are unaffected either way, and the originating #365 case still refuses.
+- **`task.done`'s `as_is_note` had no size bound, unlike its two siblings on the same event
+  (#368).** `permission_refused` and `budget_death` were clamped by #359 after a ~110-line
+  refused heredoc alone pushed `task.done` past the §2.9 4096-byte payload cap and failed the
+  whole build STAGE, not just the story. `as_is_note` — the operator-typed `--note` on `tldrx
+  story reopen <id> --as-is` — was never given the same treatment, even though nothing stops a
+  long, scripted or pasted note from reaching the exact same shape. It is now passed through the
+  same `clampAgentText` call, the same `TASK_DONE_FIELD_MAX_BYTES` constant and the same
+  `[clamped: N bytes exceeds the M byte cap]` marker convention #359 already set, so an
+  oversized as-is note can no longer fail the build stage.
+- **The Build-entry probe's throwaway worktree ran a repo's `install:` but not its
+  `tool_restore:`, so a command whose resolution depended on the restore having run could be
+  refused there even though the checkout door — which does run `tool_restore:` since #363 —
+  would have been fine (part of #371).** `entryProbe.ts`'s per-repo declaration now also reads
+  `tool_restore:` (`toolRestoreCommandFor`, the same slot `prepBaseTree` already runs at the
+  checkout door) and runs it in the fresh worktree before that worktree's `install:` and before
+  any Definition-of-Done command's binary is resolved there, refusing Build by name on a
+  nonzero exit — the same shape the checkout door already uses, never a second copy of the
+  restore logic.
+
+### Changed
+
+- **`settleAskedNoDiff` and `settleRedDod` now share one requeue-settle helper instead of each
+  hand-building the same shape (#369).** Both settled a "requeue this attempt, attempts remain"
+  turn by constructing an identical eight-field n-a-review object and `keepWorktree: true` by
+  hand — copied verbatim in two places, the AGENTS.md §12 duplication the file's own
+  decomposition precedent exists to avoid. `settleRequeue` now holds that shape once, taking the
+  fields that actually vary (`dod`, `reason`, `askedNoDiff`) as data; both call sites are
+  unchanged in behavior — `test/build-golden.test.ts` stays byte-identical.
+- **AGENTS.md §11 now names the negated-closing-verb trap and widens its own verification
+  grep to catch it.** Measured 2026-09-16: commit `d8f90f9`'s sentence `reported not fixed:
+  #359` auto-closed #359 anyway — GitHub's closing-keyword parser matches `fixed` (any
+  inflection) followed by an optional colon/punctuation and `#N`, and does not parse the
+  negation three tokens earlier; #359 needed a reopen before its real fix (`24f1324`) closed
+  it a second time, legitimately. §11's own documented verification command,
+  `grep -iE '(clos|fix|resolv)[a-z]* #'`, had the identical blind spot — it does not allow a
+  colon between the verb and the number, so it read `fixed: #359` as a non-match (measured
+  exit 1) and would have let this exact sentence through. The grep is widened to
+  `(clos|fix|resolv)[a-z]*[[:punct:]]* #` (measured exit 0 on the same sentence); the real
+  discipline stays "never write a closing-shaped phrase near a `#N` that should not close" —
+  the grep is a tripwire, not the fix (closes #372).
+- **`ci.yml` now keeps `test/merge-wave.test.ts`'s tmp sandbox as a build artifact when the
+  job fails.** This is an INSTRUMENT change, not a fix for the still-undiagnosed #237 flake
+  (interrupted-merge case expects a SIGTERM exit of 143, sometimes sees 0 after ~92s): every
+  #237 data point so far recorded the same second wall on top of the first — "no merge.log is
+  available from the CI sandbox" — because the sandbox that file plants was discarded with
+  the runner. The `bun test` step's `TMPDIR` now points at `${{ runner.temp }}/mw` instead of
+  the OS default, and a new `if: failure()` step uploads a scoped subset of it on failure
+  (`actions/upload-artifact@v4`, `retention-days: 14`). Review caught a second wall in the
+  first cut (closes #372's own class of bug, an instrument that cannot observe the thing):
+  `afterEach` `rmSync`s every sandbox unconditionally, pass or fail, INSIDE the bun process,
+  before that upload step ever runs — so the artifact would have been empty on the exact run
+  it exists for. `test/merge-wave.test.ts` now mkdtemps its sandboxes under the recognisable
+  `mw-sandbox-` prefix and skips its own cleanup when `MERGE_WAVE_KEEP_SANDBOX` is set (the
+  decision lives in one small, unit-tested function, `keepSandbox`/`cleanupSandbox` in
+  `test/fixtures/mergeWaveSandbox.ts` — local runs stay hermetic and self-cleaning per §8
+  unless that var is set); ci.yml sets it on the `bun test` step and scopes the upload's
+  `path:` to exactly that prefix, so the next red leaves a `merge.log` and lock state an
+  agent can actually read (see #237, closes #373).
+
 ## 0.32.0 — 2026-09-16
 
 ### Fixed

package/README.md

@@ -335,6 +335,8 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.34.0 | 2026-09-17 | `beta` | Four waves of the audited backlog, every branch reviewed before main: run auto no longer stops itself (parked auto gates self-close, Build parks at a story boundary on budget), gates cannot sign stale or backdated evidence, interrupted turns bank their cost as absent instead of a measured zero, the boundary condition diffs the branch the run recorded, mutating generators are refused from dod blocks, merge-wave refuses edits to released CHANGELOG sections and answers `unknown` instead of `idle`, and the test harness refuses a TMPDIR inside a work tree — 14 issues, the first of them shipped end-to-end by a tldrx run against this repo |
+| 0.33.0 | 2026-09-17 | `beta` | Six follow-ups from the 0.32.0 cycle, each measured on the second unattended run (run #42) or on the review that shipped it. The plan sequencing rule counts a bare camelCase field only when it is unambiguous or the plan spells it elsewhere as snake_case or in backticks, so unrelated stories sharing a word like `toString` no longer refuse each other (#370); `task.done` clamps an oversized `as_is_note` the way it clamps `permission_refused` (#368); the asked-no-diff and red-DoD requeues settle through one helper that takes data (#369); a workspace can opt its base pre-flight probe into a story-shaped worktree with `probe_in_worktree: true`, and the Build-entry probe runs `tool_restore:` first (#371, the remainder of #363); AGENTS §11 names the negated closing verb that still auto-closes and widens the pre-wave grep (#372); and CI keeps merge-wave's sandboxes on failure so the next #237 red carries its `merge.log` (#373). Minor release: a new workspace field and a new plan refusal shape. |
 | 0.32.0 | 2026-09-16 | `beta` | Seven framework defects measured on the second unattended run (run #42), where every one of nine operator stalls was the framework's, not the code's. A refused compound shell line is a rework note for the developer instead of a human stop (#360); a dependency hold is re-evaluated the moment the dependency lands (#361) and a rescued story is written back to `todo` the instant the release is decided (#366); an event payload over the size cap is clamped to a bounded head instead of failing the whole build stage (#359); a headless developer is told it is unattended, that `## Inputs` is where to start and not an allowlist, and a turn that asks instead of deciding is a named `asked_no_diff` failure (#364); the rate-limit park waits for 90% of the window, not the provider's first warning at half of it (#367); the plan refuses a story that enforces an invariant on a field before the story that populates it, matching the field across spellings (#365); and the preflight restores workspace tools before its first probe and names the tree it ran in (#363, in part). Minor release: a new plan refusal, a changed park threshold and a new failure kind. |
 | 0.31.1 | 2026-09-16 | `beta` | One fix, measured on the first unattended run under 0.31.0: a seed placed at the documented `.tldrx/seeds/` location was invisible to the seed-solution detector, because the filter that drops the `what` stage's own framework inputs dropped every `.tldrx/` path, so `how` ran at full price for exactly the seeds #346 was written to skip (#358). |
 | 0.31.0 | 2026-09-16 | `beta` | Ten efficiency adjustments, ranked from a measured audit of 48 runs, so an unattended run spends less and stalls less. `how` is skipped when the seed already declares its own solution, and runs on `sonnet` when it does run (#346); `risks.md` is no longer generated (#350); `watch` follows `build`'s gate policy, so an all-auto run signs itself (#349); a Watch card's `[src:]` punctuation slip is repaired locally instead of costing a turn (#345); a fix list with zero open findings settles the round, an unreadable one holds it by name (#218); `run status` warns NO-RETRY before a retry the budget refuses (#232); a failed headless turn carries a named `failure_kind`, so the loop stops buying the same retry for every death (#348); an orphaned turn is banked as unmetered instead of a confident zero (#337); a relaunch resumes its own epic branch instead of restarting it (#347); the base-tree DoD refusal names the workspace `install:` (#343) and `run auto` names `--wait-gates` (#342). |

package/dist/hooks/answer-capture.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import {
   conflictOf
-} from "./chunk-04kpbhvk.js";
+} from "./chunk-9kzevq39.js";
 import {
   FactsStore,
   formatJaccard
-} from "./chunk-f9d2efhb.js";
+} from "./chunk-bfvcebn6.js";
 import {
   parseHookInput,
   readStdin
-} from "./chunk-zyz0fbz5.js";
+} from "./chunk-jfaarcb1.js";
 import"./chunk-ae6bkfs5.js";
 import {
   EventLog,
   PHASE_ID_RE
-} from "./chunk-akemhezh.js";
+} from "./chunk-4d22xm3c.js";
 import {
   PHASE_IDS
-} from "./chunk-yyhwf3bp.js";
-import"./chunk-5kv2vtha.js";
+} from "./chunk-kcrphpwc.js";
+import"./chunk-7ypyp8xk.js";
 import {
   ADVISORY_KEY,
   MAX_FACT_CHARS,
@@ -28,7 +28,7 @@ import {
   renderQuestionBlock,
   replaceBlock,
   serializeQuestions
-} from "./chunk-x1f4dxwk.js";
+} from "./chunk-sjykymar.js";
 import {
   ITERATION_ONLY_SLOT,
   PROJECT_FRAMEWORK_DIR,
@@ -38,7 +38,7 @@ import {
   isScopedTemplate,
   parseYaml,
   scopedSlotOf
-} from "./chunk-9bd6b3xf.js";
+} from "./chunk-0a3b8w1c.js";
 
 // src/hooks/answer-capture.ts
 import { existsSync as existsSync5 } from "fs";
@@ -157,6 +157,7 @@ function loadWorkspace(root) {
   const scopedTemplates = new Set;
   const defaultBranches = new Map;
   let seedTriageThresholdTokens = null;
+  let probeInWorktree = false;
   const empty = () => ({
     root,
     repos,
@@ -168,7 +169,8 @@ function loadWorkspace(root) {
     scopedCommands,
     scopedTemplates,
     defaultBranches,
-    seedTriageThresholdTokens
+    seedTriageThresholdTokens,
+    probeInWorktree
   });
   const path = join(root, PROJECT_FRAMEWORK_DIR, "workspace.yml");
   if (!existsSync(path))
@@ -186,6 +188,8 @@ function loadWorkspace(root) {
       seedTriageThresholdTokens = tokens;
     }
   }
+  if (doc?.probe_in_worktree === true)
+    probeInWorktree = true;
   const list = doc?.repos;
   if (!Array.isArray(list))
     return empty();

package/dist/hooks/budget-gate.js

@@ -1,24 +1,22 @@
 #!/usr/bin/env node
 import {
   budgetGateDeny
-} from "./chunk-q1ge3nex.js";
+} from "./chunk-vhn2vz83.js";
 import {
   allow,
   deny,
   readPayload,
   runHook,
   toolInput
-} from "./chunk-27v2rwa9.js";
-import"./chunk-zyz0fbz5.js";
+} from "./chunk-d3jrf6yy.js";
+import"./chunk-jfaarcb1.js";
 import {
   REBALANCE_SOURCE,
   applyRebalance,
   asRunBudget,
-  currentActor,
   describeRebalance,
   economyFor,
   isHostTokens,
-  nowRfc3339,
   planRebalance,
   raiseCommand,
   raiseGrantVerdict,
@@ -27,10 +25,12 @@ import {
   validateRunBudget,
   wouldExceed,
   wouldExceedHostTokens
-} from "./chunk-5at77jx8.js";
+} from "./chunk-dw8gggv9.js";
 import {
-  EventLog
-} from "./chunk-akemhezh.js";
+  EventLog,
+  currentActor,
+  nowRfc3339
+} from "./chunk-4d22xm3c.js";
 import {
   cursorStage,
   hostTokensIn,
@@ -39,20 +39,20 @@ import {
   newestActiveRun,
   renderRunEconomies,
   runSpend
-} from "./chunk-8ds2ret8.js";
+} from "./chunk-57s4mdhy.js";
 import {
   buildStageDefaults
-} from "./chunk-yyhwf3bp.js";
+} from "./chunk-kcrphpwc.js";
 import {
   noteDeprecations
-} from "./chunk-x1f4dxwk.js";
+} from "./chunk-sjykymar.js";
 import {
   PROJECT_WORK_DIR,
   findWorkspaceRoot,
   locateWork,
   parseYaml,
   stageYamlPath
-} from "./chunk-9bd6b3xf.js";
+} from "./chunk-0a3b8w1c.js";
 
 // src/hooks/budget-gate.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "node:fs";
@@ -125,7 +125,8 @@ await runHook("budget-gate", async () => {
   const attended = isAttendedByHostView(view);
   const stage = cursorStage(view);
   const declared = stage?.budget_usd ?? stageBudgetFromLibrary(root, view.cursor.stage);
-  const attempts = buildStageDefaults(root, view.scope, view.cursor.stage).attempts;
+  const tuning = buildStageDefaults(root, view.scope, view.cursor.stage);
+  const attempts = tuning.attempts;
   const work = declared === null ? null : remainingWork({
     runDir: view.dir,
     phaseId: view.cursor.phase,
@@ -135,7 +136,10 @@ await runHook("budget-gate", async () => {
     maxUsd: null,
     economy: economyFor(budget, view.cursor.phase),
     attended,
-    attempts
+    attempts,
+    reviewerShare: tuning.reviewerShare,
+    storyCapMultiplier: tuning.storyCapMultiplier,
+    storyCapFloorUsd: tuning.storyCapFloorUsd
   });
   const estimate = estimateFor(command, work === null ? null : work.usd);
   if (estimate <= 0)

package/dist/hooks/{chunk-9bd6b3xf.js → chunk-0a3b8w1c.js}

@@ -8818,6 +8818,7 @@ function loadWorkspace(root) {
   const scopedTemplates = new Set;
   const defaultBranches = new Map;
   let seedTriageThresholdTokens = null;
+  let probeInWorktree = false;
   const empty = () => ({
     root,
     repos,
@@ -8829,7 +8830,8 @@ function loadWorkspace(root) {
     scopedCommands,
     scopedTemplates,
     defaultBranches,
-    seedTriageThresholdTokens
+    seedTriageThresholdTokens,
+    probeInWorktree
   });
   const path = join3(root, PROJECT_FRAMEWORK_DIR, "workspace.yml");
   if (!existsSync3(path))
@@ -8847,6 +8849,8 @@ function loadWorkspace(root) {
       seedTriageThresholdTokens = tokens;
     }
   }
+  if (doc?.probe_in_worktree === true)
+    probeInWorktree = true;
   const list = doc?.repos;
   if (!Array.isArray(list))
     return empty();

package/dist/hooks/{chunk-akemhezh.js → chunk-4d22xm3c.js}

@@ -2,7 +2,7 @@ import {
   GATE_POLICIES,
   validateGatesPolicy,
   validateStagePolicy
-} from "./chunk-yyhwf3bp.js";
+} from "./chunk-kcrphpwc.js";
 import {
   asDocument,
   isRecord,
@@ -15,7 +15,7 @@ import {
   requireString,
   requireVersion,
   result
-} from "./chunk-9bd6b3xf.js";
+} from "./chunk-0a3b8w1c.js";
 
 // src/core/events/EventLog.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
@@ -69,6 +69,7 @@ var EVENT_TYPES = [
   "budget.blocked",
   "budget.raised",
   "budget.granted",
+  "budget.parked",
   "fact.added",
   "fact.retired",
   "fact.superseded",
@@ -231,6 +232,19 @@ function skippedNote(skipped) {
 }
 var WARNED = new Set;
 
+// src/hooks/lib/actor.ts
+function currentActor() {
+  const user = process.env.USER ?? process.env.USERNAME ?? "";
+  return user.trim() === "" ? "unknown" : user.trim();
+}
+function nowRfc3339() {
+  return `${new Date().toISOString().slice(0, 19)}Z`;
+}
+var RFC3339_RE = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+function isRfc3339(value) {
+  return RFC3339_RE.test(value) && !Number.isNaN(Date.parse(value));
+}
+
 // src/core/run/questionsPolicy.ts
 var QUESTION_POLICIES = ["human", "recommended"];
 function validateQuestionsPolicy(value, stageIds, issues) {
@@ -300,6 +314,9 @@ function parseEvidence(text) {
   const role = requireEnum2(doc.role, EVIDENCE_ROLES, "role", issues);
   const by = requireText(doc.by, "by", issues);
   const at = requireText(doc.at, "at", issues);
+  if (at !== "" && !isRfc3339(at)) {
+    issues.push(front(0, `\`at\` must be a valid RFC3339 timestamp, got \`${at}\``));
+  }
   const verdict = requireEnum2(doc.verdict, EVIDENCE_VERDICTS, "verdict", issues);
   const read = requireStrings(doc.read, "read", issues);
   const citations = requireCitations(doc.citations, issues);
@@ -728,6 +745,9 @@ function validateRunFile(input) {
       if (stage.stale !== undefined && typeof stage.stale !== "boolean") {
         issues.push({ path: `${path}.stale`, message: "expected true or false" });
       }
+      if (stage.attempt_started_at !== undefined && stage.attempt_started_at !== null && typeof stage.attempt_started_at !== "string") {
+        issues.push({ path: `${path}.attempt_started_at`, message: "expected a string or null" });
+      }
       checkOrder(stage.started_at, stage.ended_at, path, issues);
       if (cursor !== null && cursor.phase === phaseId && cursor.stage === stageId)
         cursorResolves = true;
@@ -918,4 +938,4 @@ function gateEvidencePath(runDir, phaseId, stageId) {
   return join2(runDir, ...gateEvidenceRelPath(phaseId, stageId).split("/"));
 }
 
-export { EventLog, parseEvidence, PHASE_ID_RE, OUTCOME_NOT_RECORDED, isTerminal, isFinished, isAttendedByHost, flatten, stageAt, deriveRunStatus, derivePhaseStatus, validateRunFile, asRunFile, evidencePath, gateEvidencePath };
+export { EventLog, currentActor, nowRfc3339, parseEvidence, PHASE_ID_RE, OUTCOME_NOT_RECORDED, isTerminal, isFinished, isAttendedByHost, flatten, stageAt, deriveRunStatus, derivePhaseStatus, validateRunFile, asRunFile, evidencePath, gateEvidencePath };

package/dist/hooks/{chunk-8ds2ret8.js → chunk-57s4mdhy.js}

@@ -1,7 +1,7 @@
 import {
   listRunDirs,
   parseYaml
-} from "./chunk-9bd6b3xf.js";
+} from "./chunk-0a3b8w1c.js";
 
 // src/hooks/lib/runFile.ts
 import { existsSync, readFileSync } from "node:fs";