tldr-experts 0.33.0 → 0.34.0

package/CHANGELOG.md

@@ -1,5 +1,193 @@
 # Changelog
 
+## 0.34.0 — 2026-09-17
+
+### Fixed
+
+- **`budget show`, `run estimate` and the `budget-gate` hook now price a Build stage's
+  `reviewer_share`, `story_cap_multiplier` and `story_cap_floor_usd` the same way `tldrx next`'s
+  brake does, instead of the shipped defaults (see #333).** #214 fixed exactly one of the four
+  `stage.yml` calibrations `remainingWork` takes — `attempts` — leaving these three still
+  defaulted by the three readers while the brake resolved all four through `spec.tuning`.
+  Measured against the Build fixture (three stories priced 2.00/2.50/4.50, two done, stage
+  ceiling $60): a stage that writes `story_cap_multiplier: 1` ("take the plan's price
+  literally") was quoted $24.25 by `budget show`/`run estimate`/the hook against the $10.75 the
+  brake would actually price and dispatch — 2.3x — with the phase ceiling able to sit between
+  the two, so `budget show` said BLOCKED and the hook denied a `tldrx next` the brake itself
+  allows. `buildStageDefaults` (`core/run/workflowPreset.ts`) now resolves and returns the
+  stage's full `StageTuning`, not just `attempts` and `timeout_s`, by re-reading the same
+  `stage.yml` `facilitator/stageSpec.ts`'s `overlay` already reads — tolerant exactly as before,
+  so an unreadable stage file still falls back to the shipped defaults. `run estimate` already
+  held the full tuning via `loadStageSpec`; it was just not forwarding three of the four fields
+  to `remainingWork`.
+- **`round2` and the spec §3 exit-code table are each defined in exactly one place, with a shape
+  test refusing a second copy (see #174).** `round2` (`Math.round(n * 100) / 100`) was
+  independently restated in nine files; the spec §3 exit codes (`cli/exitCodes.ts`) were
+  independently restated, under a mix of matching and diverging names (`EXIT_REFUSED` for
+  `EXIT_GATE_REFUSED`, `EXIT_AWAITING` for `EXIT_AWAITING_HUMAN`), in fourteen more — wider than
+  the issue's own grep found, which only named `runNext.ts`/`runAuto.ts`; the broader set was
+  measured here (`grep -rlE '^const EXIT_[A-Z_]+\s*=\s*[0-9]+;' src/`) and folded into the same
+  fix rather than filed separately, since it is the identical defect the issue is about. Every
+  local copy now imports the canonical one (`core/build/caps.ts`'s exported `round2`,
+  `cli/exitCodes.ts`'s table, aliased where a file's own name differed) instead of restating it.
+  Mechanism this was hiding: a golden-guard mutation of `cli/exitCodes.ts` left
+  `test/build-golden.test.ts` byte-identical, because the Build path never read that file's
+  constants at all — it read `runNext.ts`'s and `runAuto.ts`'s own private copies. The new
+  `test/round2-exitcodes-one-derivation.test.ts` asserts, on the SHAPE (a local, unexported
+  `function round2(`/`const EXIT_*` declaration) rather than on the measured names, that no file
+  under `src/` besides the two canonical ones defines either — on the precedent of
+  `test/phase-ids-one-derivation.test.ts` (#187): deleting today's copies does not stop a third
+  one from coming back under a name this file never mentions.
+- **`merge-wave.sh --status` now says why it could not look instead of answering `idle` (see
+  #332).** AGENTS.md §2 calls this command the authoritative instrument for "is a wave alive" —
+  the reference-transaction guard and the merge lock exist precisely so nobody has to `ps` plus
+  a marker's mtime. Measured on the first autonomous run against this repo (2026-09-17): run
+  from outside a git repository, or with its `merge-lock.sh` sibling missing, it answered `idle`
+  and exit 0 — a false all-clear that could start a wave on top of one already live. It now
+  prints `unknown: <reason>` and exits **15**, its own code (`14` stays release.sh's — see
+  AGENTS.md §2 and docs/RELEASING.md), so a caller polling stdout can no longer read "could not
+  check" as "nothing is happening".
+- **`merge-wave.sh` now diffs a released, dated CHANGELOG section's content, not just its
+  heading, so a rebase-then-merge across a release can no longer land a bullet inside it
+  silently.** The exit-12 gate only ever counted unreleased headings; a branch written before
+  a release and rebased onto main after that release merged CLEANLY — no conflict, no heading
+  touched — and its bullet landed inside the now-dated, supposedly immutable section, caught
+  only by a human reading the diff or much later by `release-check.sh`'s own #200 check. The
+  wave now compares every dated section against what main had immediately before the merge and
+  refuses with its own exit **16**, naming the section and the first difference (see #336).
+- **A spawning test run whose `$TMPDIR` sits inside a git work tree can no longer commit its
+  scratch paths onto the enclosing branch (#335).** Fixtures resolve their sandbox through
+  `os.tmpdir()`/`$TMPDIR` and run real git inside it; when that path is inside a worktree,
+  git's own upward repo search walks out of the fixture and finds the WORKTREE's repo, so
+  `git add`/`git commit` there land on whatever branch is checked out — #335 measured 960
+  tracked scratch paths and dozens of foreign commits on a real branch this way, and the same
+  underlying mechanism reproduced here on `490f637` from a fresh throwaway worktree as the same
+  two test failures the issue reported (`test/gitignore-shadow.test.ts`,
+  `test/install.test.ts`). The `bun test` preload `test/preload/tmpdirGuard.ts` now refuses,
+  named, before any test runs, when the resolved `$TMPDIR` is inside a git work tree — opt out
+  only with `TLDRX_ALLOW_TMPDIR_IN_WORKTREE=1`, once the isolation is verified some other way.
+- **A turn killed mid-flight by SIGINT/SIGTERM now banks its cost as absent, not a measured
+  `$0.00` (see #355).** `interrupt.ts`'s `recordPartialResult` wrote `cost_usd: 0` with no
+  `metered` key on both the task row and the `agent.result` payload — legal by `RunFile.ts`'s
+  validator, which only ever checked the converse (a `null` needs `metered: false`), so it
+  passed silently while `tallyOf` summed the row into the metered bucket as a real, measured
+  zero and `spendBasis` called the run's total complete. It now writes `cost_usd: null,
+  metered: false` on the row and the payload, the same idiom every other unknown-cost turn in
+  this codebase already uses, so a Ctrl-C mid-turn reads as a stated lower bound.
+- **A killed parent's abandoned Build-story turn now leaves a row in `run.yml`, not nothing (see
+  #337).** The headless half of this shipped earlier as the orphan case #337 was filed for; the
+  fix deliberately skipped every Build-executor phase, reasoning the per-story ceiling ledger
+  already covered it — true for `tldrx cost`'s per-story view, but that ledger has no `run.yml`
+  task row to show for it, so `tallyOf`/`spendBasis` (and so `budget.spent_usd`) never saw the
+  abandoned attempt at all, not even as unmetered. `demoteStaleRunning` now reads which of a
+  stuck Build stage's `agent.spawned` turns no `agent.result` ever answered
+  (`build/orphanedTurns.ts`) and records one `cost_usd: null, metered: false` row per abandoned
+  story, same as the headless case.
+- **The boundary gate now diffs the branch Build actually cut under `branch_model: integration`,
+  instead of an epic file's unused per-epic `branch:` label (see #225).** `epicTargets` read
+  `03-plan/epics/*.md`'s own `branch:` as the ref to diff — right under `per-epic`, where Build
+  cuts exactly that name, and silently wrong under `integration`, where every epic's stories
+  merge into ONE recorded branch and the epic's `branch:` is never cut at all. A run with eight
+  such epics measured `boundary=n/a (nothing could be diffed: … does not resolve …)` and
+  auto-signed a +31,465/−237-line PR across 117 files with the condition having diffed nothing.
+  The branch now comes from `run.yml`'s `build.epic_branch`, through the same `recordedEpicBranch`
+  derivation `watch` and `ship` already use (#90) — the epic file supplies repos and stories,
+  never the ref. A run that recorded an epic branch and still cannot diff it now HOLDS the gate
+  instead of reading `n/a`; `n/a` stays reserved for a run that named no branch to diff at all.
+- **The boundary gate reads a run's stories through the same validated, all-phases walk `ship`
+  and carried-findings ownership already share, instead of its own `03-plan/`-only, schema-less
+  reader (see #189).** `boundary.ts`'s `storyTouches` was a third `stories/*.md` reader: it
+  looked only under `03-plan/` (missing a story filed under `04-build/`, the phase a carried fix
+  list's own story is written under), parsed front matter with no schema (taking a story a real
+  reader would report as unreadable), and dropped an unparseable file silently. It now calls the
+  shared `scanStories`/`phaseDirsOf` leaf (extracted from `build/carriedRows.ts` into
+  `build/storyScan.ts` so `boundary.ts` — which `carriedRows.ts` already imports from — does not
+  import it back), closing a divergence `carriedRows.ts` had documented as "somebody else's
+  issue" since #171.
+- **An agent gate can no longer sign over evidence dated before the stage it is closing even
+  started (see #144).** A field evaluation of a delegated `watch` gate found its evidence note
+  timestamped 7h before its stage began, asserting facts already false by the time it signed,
+  with `refuted: 0` — the resolution half of that bug was #140; this is the remaining half
+  AGENTS.md §7 names: "a gate's evidence must not predate what it signs". `validateEvidence`
+  refuses a note whose `at:` is before the CURRENT attempt's own start — the new, additive
+  `RunStage.attempt_started_at`, which `markRunning` overwrites on every run, never the frozen
+  `started_at` it sits beside (§7: existing fields only grow, never change meaning; `started_at`
+  is set once, at the stage's first run, and stays that forever) — on both the engine's own
+  signer and `approve --as-agent`, one derivation, both doors. Two more holes pre-merge review
+  found in the same check: `at` was only confirmed non-empty, so a raw string compare read a
+  date-only `at` as earlier than a same-day, full-precision stage start; `at` is now confirmed a
+  real RFC3339 instant first, and the two timestamps are compared as instants, not strings. And
+  the full test gate caught the new check's own collateral: `tldrx learn`'s chapter 6 planted its
+  stand-in evidence note with a fixed past date, which the real wall clock had by now walked
+  past — its `at:` is stamped off `Date.now()` (with a 5-minute forward buffer, since the note is
+  written before the step that starts the stage it signs) rather than a date fixed at authoring
+  time.
+- **`tldrx reject` now archives a stage's scratch evidence note instead of leaving it for the
+  next attempt to sign over (see #199).** A reject sent a stage back to `ready` but never
+  touched `.agent/<stage>/evidence.md`, so a note that had already said `verdict: sign` over one
+  attempt's outputs was still the first (and only) thing either signer found after the stage
+  re-ran with different outputs — and could sign again over an attempt it never read. The note
+  is renamed to `evidence.rejected-<at>.md` in the same scratch directory (moved, not deleted:
+  it is still the record of a real check somebody made), so the re-run meets the ordinary "no
+  evidence note at …" state instead. `reject` also advances the stage's `attempt_started_at`
+  anchor to its own moment (see #144's entry above) — closing a gap pre-merge review found:
+  without it, `approve --evidence <path>` pointed straight at the just-archived note still
+  signed, since nothing yet had moved the anchor past it. Archiving is collision-safe too
+  (`-2`, `-3`, … suffixes): two rejections landing in the same clock second used to let the
+  second silently overwrite the first's archive.
+- **`reject --stage` (i.e. a revoke) no longer strands a later stage `running` with no verb that
+  owns it, and `run unlock`'s stranded-run note no longer promises a demotion `next` does not
+  make (see #228).** A revoke marked every later stage `stale: true` but left `status: running`
+  untouched; `next` only demotes a `running` stage behind a DEAD-PID lock, and a revoke leaves no
+  lock behind at all, so the cursor could walk back into that stranded stage mid-flight once the
+  revoked stage was re-approved. A later `running` stage with nothing holding it (no `--prepare`
+  bundle waiting) now goes back to `ready` alongside going stale, named on the outcome and on the
+  additive `gate.revoked` event; one holding a bundle is a sub-agent turn already paid for, so
+  the revoke refuses instead and names it. `run unlock` had the same false promise for a
+  lockless `running` stage ("`tldrx next` demotes it") — it now performs that demotion itself
+  when nothing is holding the run, rather than describing a move nothing makes. A revoke also
+  advances `attempt_started_at` (see #144, #199) on the stage it revokes and on every stage it
+  demotes, for the same reason `reject` does.
+- **A mutating generator command in a story's dod block can no longer be run by the base-tree
+  pre-flight as a routine measurement (see #362).** Measured live, tldrx 0.31.1: a `.NET`
+  story's dod block declared `dotnet ef migrations add …` beside ordinary build/test commands,
+  and the base-tree probe ran it against the UNTOUCHED base tree — a DELTA-gate measurement is
+  not supposed to mutate the tree it is measuring, and it would have written a migration triple
+  into pristine `main` as a side effect of asking a question. `isGeneratorCommand`
+  (`schemas/commandAllowlist.ts`) detects a generator BY NAME — the command text, not a
+  workspace-declared slot key, since a team names its migration-add slot whatever it likes — and
+  two doors read that one derivation: `validateStoryDod` now refuses a generator command at Plan
+  time, so a plan is never written this way, and `dodRunner.ts`'s `measureBaseCommand` refuses
+  to run one against either base tree it measures, as defense in depth for a story file that
+  reached Build some other way. Neither door touches a story's own fresh worktree, where a
+  generator legitimately runs once, by the developer.
+- **`tldrx next` now self-closes a parked `auto` gate the moment every condition it was held on
+  clears, `--wait-gates` or not (see #342).** Before this, the only door that ever re-measured an
+  already-`awaiting_gate` stage was `run auto --wait-gates`'s own poll (`waitForGate` →
+  `selfCloseAutoGate`); without that flag, `run auto` answering its own blocking questions (or a
+  person answering them by hand) left the gate `awaiting_gate` forever, and the next `next` call
+  reported it as terminal-for-this-call with a generic `gate pending: tldrx approve` — never
+  noticing the questions it was parked on had since been answered. `next` now re-runs the same
+  seven conditions (`reevaluateAutoGate`) on every `awaiting_gate` stage whose policy is `auto`
+  before giving up, and signs it through the same `approve` door a freshly-closed gate uses —
+  `human` and `agent` gates are untouched, and a verdict that still fails falls through to the
+  ordinary human-gate report exactly as before.
+- **The default Build budget gate now parks at a story boundary instead of stopping the stage
+  incomplete with no boundary the operator chose (see #354).** `runNext.ts`'s `budgetRefusal`
+  meters the phase ceiling exactly once, at stage entry — the Build executor itself never
+  re-checked the envelope between two dispatches of one headless run, so a phase that could
+  afford its entry estimate but ran short partway through kept dispatching until the money was
+  gone, and the only way the gate fired again was an all-or-nothing refusal on a RETRY of a
+  failed stage. Modeled directly on #298's rate-limit park: before starting a new story's
+  developer, the executor now checks whether the stage's remainder still covers that story's
+  floor and, if not, lets whatever is already running finish and settle, then stops — recording
+  one `budget.parked` event (mirroring `agent.rate_limited`'s shape) and naming the shortfall as
+  the reason in both the operator line and the handoff's `## Unknowns`. `run auto --wait-gates`
+  resumes the parked stage itself once an operator's `tldrx budget raise --stage` (or
+  `--rebalance-finished`) actually raises the STAGE's own `budget_usd` — checked fresh on every
+  poll against the phase's real remainder, never a clock — and `run status` names the park
+  instead of reading as a decision waiting on a person.
+
 ## 0.33.0 — 2026-09-17
 
 ### Added

package/README.md

@@ -335,6 +335,7 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.34.0 | 2026-09-17 | `beta` | Four waves of the audited backlog, every branch reviewed before main: run auto no longer stops itself (parked auto gates self-close, Build parks at a story boundary on budget), gates cannot sign stale or backdated evidence, interrupted turns bank their cost as absent instead of a measured zero, the boundary condition diffs the branch the run recorded, mutating generators are refused from dod blocks, merge-wave refuses edits to released CHANGELOG sections and answers `unknown` instead of `idle`, and the test harness refuses a TMPDIR inside a work tree — 14 issues, the first of them shipped end-to-end by a tldrx run against this repo |
 | 0.33.0 | 2026-09-17 | `beta` | Six follow-ups from the 0.32.0 cycle, each measured on the second unattended run (run #42) or on the review that shipped it. The plan sequencing rule counts a bare camelCase field only when it is unambiguous or the plan spells it elsewhere as snake_case or in backticks, so unrelated stories sharing a word like `toString` no longer refuse each other (#370); `task.done` clamps an oversized `as_is_note` the way it clamps `permission_refused` (#368); the asked-no-diff and red-DoD requeues settle through one helper that takes data (#369); a workspace can opt its base pre-flight probe into a story-shaped worktree with `probe_in_worktree: true`, and the Build-entry probe runs `tool_restore:` first (#371, the remainder of #363); AGENTS §11 names the negated closing verb that still auto-closes and widens the pre-wave grep (#372); and CI keeps merge-wave's sandboxes on failure so the next #237 red carries its `merge.log` (#373). Minor release: a new workspace field and a new plan refusal shape. |
 | 0.32.0 | 2026-09-16 | `beta` | Seven framework defects measured on the second unattended run (run #42), where every one of nine operator stalls was the framework's, not the code's. A refused compound shell line is a rework note for the developer instead of a human stop (#360); a dependency hold is re-evaluated the moment the dependency lands (#361) and a rescued story is written back to `todo` the instant the release is decided (#366); an event payload over the size cap is clamped to a bounded head instead of failing the whole build stage (#359); a headless developer is told it is unattended, that `## Inputs` is where to start and not an allowlist, and a turn that asks instead of deciding is a named `asked_no_diff` failure (#364); the rate-limit park waits for 90% of the window, not the provider's first warning at half of it (#367); the plan refuses a story that enforces an invariant on a field before the story that populates it, matching the field across spellings (#365); and the preflight restores workspace tools before its first probe and names the tree it ran in (#363, in part). Minor release: a new plan refusal, a changed park threshold and a new failure kind. |
 | 0.31.1 | 2026-09-16 | `beta` | One fix, measured on the first unattended run under 0.31.0: a seed placed at the documented `.tldrx/seeds/` location was invisible to the seed-solution detector, because the filter that drops the `what` stage's own framework inputs dropped every `.tldrx/` path, so `how` ran at full price for exactly the seeds #346 was written to skip (#358). |

package/dist/hooks/answer-capture.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   conflictOf
-} from "./chunk-px7swzs1.js";
+} from "./chunk-9kzevq39.js";
 import {
   FactsStore,
   formatJaccard
@@ -14,10 +14,10 @@ import"./chunk-ae6bkfs5.js";
 import {
   EventLog,
   PHASE_ID_RE
-} from "./chunk-5wh26b5f.js";
+} from "./chunk-4d22xm3c.js";
 import {
   PHASE_IDS
-} from "./chunk-vhy24kv6.js";
+} from "./chunk-kcrphpwc.js";
 import"./chunk-7ypyp8xk.js";
 import {
   ADVISORY_KEY,

package/dist/hooks/budget-gate.js

@@ -14,11 +14,9 @@ import {
   REBALANCE_SOURCE,
   applyRebalance,
   asRunBudget,
-  currentActor,
   describeRebalance,
   economyFor,
   isHostTokens,
-  nowRfc3339,
   planRebalance,
   raiseCommand,
   raiseGrantVerdict,
@@ -27,10 +25,12 @@ import {
   validateRunBudget,
   wouldExceed,
   wouldExceedHostTokens
-} from "./chunk-s4kz5nn2.js";
+} from "./chunk-dw8gggv9.js";
 import {
-  EventLog
-} from "./chunk-5wh26b5f.js";
+  EventLog,
+  currentActor,
+  nowRfc3339
+} from "./chunk-4d22xm3c.js";
 import {
   cursorStage,
   hostTokensIn,
@@ -42,7 +42,7 @@ import {
 } from "./chunk-57s4mdhy.js";
 import {
   buildStageDefaults
-} from "./chunk-vhy24kv6.js";
+} from "./chunk-kcrphpwc.js";
 import {
   noteDeprecations
 } from "./chunk-sjykymar.js";
@@ -125,7 +125,8 @@ await runHook("budget-gate", async () => {
   const attended = isAttendedByHostView(view);
   const stage = cursorStage(view);
   const declared = stage?.budget_usd ?? stageBudgetFromLibrary(root, view.cursor.stage);
-  const attempts = buildStageDefaults(root, view.scope, view.cursor.stage).attempts;
+  const tuning = buildStageDefaults(root, view.scope, view.cursor.stage);
+  const attempts = tuning.attempts;
   const work = declared === null ? null : remainingWork({
     runDir: view.dir,
     phaseId: view.cursor.phase,
@@ -135,7 +136,10 @@ await runHook("budget-gate", async () => {
     maxUsd: null,
     economy: economyFor(budget, view.cursor.phase),
     attended,
-    attempts
+    attempts,
+    reviewerShare: tuning.reviewerShare,
+    storyCapMultiplier: tuning.storyCapMultiplier,
+    storyCapFloorUsd: tuning.storyCapFloorUsd
   });
   const estimate = estimateFor(command, work === null ? null : work.usd);
   if (estimate <= 0)

package/dist/hooks/{chunk-5wh26b5f.js → chunk-4d22xm3c.js}

@@ -2,7 +2,7 @@ import {
   GATE_POLICIES,
   validateGatesPolicy,
   validateStagePolicy
-} from "./chunk-vhy24kv6.js";
+} from "./chunk-kcrphpwc.js";
 import {
   asDocument,
   isRecord,
@@ -69,6 +69,7 @@ var EVENT_TYPES = [
   "budget.blocked",
   "budget.raised",
   "budget.granted",
+  "budget.parked",
   "fact.added",
   "fact.retired",
   "fact.superseded",
@@ -231,6 +232,19 @@ function skippedNote(skipped) {
 }
 var WARNED = new Set;
 
+// src/hooks/lib/actor.ts
+function currentActor() {
+  const user = process.env.USER ?? process.env.USERNAME ?? "";
+  return user.trim() === "" ? "unknown" : user.trim();
+}
+function nowRfc3339() {
+  return `${new Date().toISOString().slice(0, 19)}Z`;
+}
+var RFC3339_RE = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+function isRfc3339(value) {
+  return RFC3339_RE.test(value) && !Number.isNaN(Date.parse(value));
+}
+
 // src/core/run/questionsPolicy.ts
 var QUESTION_POLICIES = ["human", "recommended"];
 function validateQuestionsPolicy(value, stageIds, issues) {
@@ -300,6 +314,9 @@ function parseEvidence(text) {
   const role = requireEnum2(doc.role, EVIDENCE_ROLES, "role", issues);
   const by = requireText(doc.by, "by", issues);
   const at = requireText(doc.at, "at", issues);
+  if (at !== "" && !isRfc3339(at)) {
+    issues.push(front(0, `\`at\` must be a valid RFC3339 timestamp, got \`${at}\``));
+  }
   const verdict = requireEnum2(doc.verdict, EVIDENCE_VERDICTS, "verdict", issues);
   const read = requireStrings(doc.read, "read", issues);
   const citations = requireCitations(doc.citations, issues);
@@ -728,6 +745,9 @@ function validateRunFile(input) {
       if (stage.stale !== undefined && typeof stage.stale !== "boolean") {
         issues.push({ path: `${path}.stale`, message: "expected true or false" });
       }
+      if (stage.attempt_started_at !== undefined && stage.attempt_started_at !== null && typeof stage.attempt_started_at !== "string") {
+        issues.push({ path: `${path}.attempt_started_at`, message: "expected a string or null" });
+      }
       checkOrder(stage.started_at, stage.ended_at, path, issues);
       if (cursor !== null && cursor.phase === phaseId && cursor.stage === stageId)
         cursorResolves = true;
@@ -918,4 +938,4 @@ function gateEvidencePath(runDir, phaseId, stageId) {
   return join2(runDir, ...gateEvidenceRelPath(phaseId, stageId).split("/"));
 }
 
-export { EventLog, parseEvidence, PHASE_ID_RE, OUTCOME_NOT_RECORDED, isTerminal, isFinished, isAttendedByHost, flatten, stageAt, deriveRunStatus, derivePhaseStatus, validateRunFile, asRunFile, evidencePath, gateEvidencePath };
+export { EventLog, currentActor, nowRfc3339, parseEvidence, PHASE_ID_RE, OUTCOME_NOT_RECORDED, isTerminal, isFinished, isAttendedByHost, flatten, stageAt, deriveRunStatus, derivePhaseStatus, validateRunFile, asRunFile, evidencePath, gateEvidencePath };

package/dist/hooks/{chunk-4w2e56zw.js → chunk-5q89ffsn.js}

@@ -6,12 +6,11 @@ import {
   WAVES_FILE,
   asRunBudget,
   buildProgress,
-  nowRfc3339,
   spentBasis,
   storyDependsOn,
   tallyOf,
   validateRunBudget
-} from "./chunk-s4kz5nn2.js";
+} from "./chunk-dw8gggv9.js";
 import {
   EventLog,
   OUTCOME_NOT_RECORDED,
@@ -22,9 +21,10 @@ import {
   isAttendedByHost,
   isFinished,
   isTerminal,
+  nowRfc3339,
   stageAt,
   validateRunFile
-} from "./chunk-5wh26b5f.js";
+} from "./chunk-4d22xm3c.js";
 import {
   cursorStage,
   isAttendedByHostView,
@@ -163,6 +163,9 @@ function stage(s) {
   ];
   if (s.stale === true)
     lines.push("        stale: true");
+  if (s.attempt_started_at !== undefined && s.attempt_started_at !== null) {
+    lines.push(`        attempt_started_at: ${yamlScalar(s.attempt_started_at)}`);
+  }
   if (s.tasks.length === 0) {
     lines.push("        tasks: []");
   } else {
@@ -795,6 +798,7 @@ function statusWithOutcome(status, outcome) {
 // src/core/run/autoGate.ts
 var AUTO_GATE_ACTOR = "auto";
 var RATE_LIMIT_RESUME_NOTE_PREFIX = "run auto resumed this stage: its auto gate was held by an unfinished " + "story a rate-limit warning parked, and the provider's own clock has since cleared it.";
+var BUDGET_RESUME_NOTE_PREFIX = "run auto resumed this stage: its auto gate was held by an unfinished " + "story a budget shortfall parked, and the phase can now afford it.";
 var RETRYABLE_CONDITIONS = new Set(["checks", "claim-sources"]);
 var AUTO_GATE_REFUSED_PREFIX = "auto-gate refused — held by: ";
 var HELD_SEPARATOR = " · ";
@@ -1350,6 +1354,48 @@ function currentRateLimitPark(runDir, stageId) {
   return park;
 }
 
+// src/core/run/budgetPark.ts
+function currentBudgetPark(runDir, stageId) {
+  let events;
+  try {
+    events = EventLog.forRun(runDir).readAll().events;
+  } catch {
+    return null;
+  }
+  let stageStartIndex = -1;
+  for (let index = events.length - 1;index >= 0; index -= 1) {
+    const event = events[index];
+    if (event !== undefined && event.stage === stageId && event.type === "stage.started") {
+      stageStartIndex = index;
+      break;
+    }
+  }
+  if (stageStartIndex === -1)
+    return null;
+  let park = null;
+  for (let index = events.length - 1;index >= stageStartIndex; index -= 1) {
+    const event = events[index];
+    if (event === undefined || event.type !== "budget.parked" || event.stage !== stageId)
+      continue;
+    const payload = event.payload;
+    const parked = payload.parked;
+    if (typeof parked !== "string" || parked === "")
+      continue;
+    if (typeof payload.remainder_usd !== "number" || typeof payload.floor_usd !== "number")
+      continue;
+    park = { remainderUsd: payload.remainder_usd, floorUsd: payload.floor_usd, parked };
+    break;
+  }
+  if (park === null)
+    return null;
+  const view = storiesView(runDir);
+  if (view === null || view.unfinished.length === 0)
+    return null;
+  if (view.unfinished.some((story) => story.status !== "todo"))
+    return null;
+  return park;
+}
+
 // src/core/run/waiting.ts
 var MOVABLE_KINDS = [
   "gate",
@@ -1408,6 +1454,14 @@ function waitingFor(run, runDir) {
             questions: open
           };
         }
+        const budgetPark = currentBudgetPark(runDir, entry.stage.id);
+        if (budgetPark !== null) {
+          return {
+            kind: "gate",
+            message: `gate on ${entry.phase.id}/${entry.stage.id} — parked by a budget shortfall ` + `($${budgetPark.remainderUsd.toFixed(2)} left, $${budgetPark.floorUsd.toFixed(2)} needed) ` + "— resumes automatically once the phase can afford it (`tldrx budget raise`, " + "or `run auto --rebalance-finished`)",
+            questions: open
+          };
+        }
       }
       return {
         kind: "gate",

package/dist/hooks/{chunk-px7swzs1.js → chunk-9kzevq39.js}

@@ -5,7 +5,7 @@ import {
   evidencePath,
   gateEvidencePath,
   parseEvidence
-} from "./chunk-5wh26b5f.js";
+} from "./chunk-4d22xm3c.js";
 import {
   openBlocks,
   parseQuestions

package/dist/hooks/{chunk-s4kz5nn2.js → chunk-dw8gggv9.js}

@@ -1,6 +1,6 @@
 import {
   STAGE_TUNING_DEFAULTS
-} from "./chunk-vhy24kv6.js";
+} from "./chunk-kcrphpwc.js";
 import {
   MAX_PLAN_STORIES,
   MAX_STORIES_PER_WAVE,
@@ -28,15 +28,6 @@ import {
   result
 } from "./chunk-0a3b8w1c.js";
 
-// src/hooks/lib/actor.ts
-function currentActor() {
-  const user = process.env.USER ?? process.env.USERNAME ?? "";
-  return user.trim() === "" ? "unknown" : user.trim();
-}
-function nowRfc3339() {
-  return `${new Date().toISOString().slice(0, 19)}Z`;
-}
-
 // src/core/budget/spentFigure.ts
 var SPENT_BASES = ["lower-bound", "complete"];
 function spentBasis(unmetered) {
@@ -229,6 +220,9 @@ var REVIEWER_SHARE = STAGE_TUNING_DEFAULTS.reviewerShare;
 var REVIEWER_FLOOR_USD = 2;
 var STORY_CAP_MULTIPLIER = STAGE_TUNING_DEFAULTS.storyCapMultiplier;
 var STORY_CAP_FLOOR_USD = STAGE_TUNING_DEFAULTS.storyCapFloorUsd;
+function round2(n) {
+  return Math.round(n * 100) / 100;
+}
 function shortBy(estimate, remaining) {
   return Math.max(0.01, Math.ceil((estimate - remaining) * 100) / 100);
 }
@@ -1214,9 +1208,6 @@ function reviewEventErrored(payload) {
     return false;
   return typeof payload.detail === "string" && looksLikeReviewerError(payload.detail);
 }
-function round2(n) {
-  return Math.round(n * 100) / 100;
-}
 
 // src/core/budget/wouldExceed.ts
 function totalSpent(budget) {
@@ -1451,4 +1442,4 @@ function round6(n) {
   return Math.round(n * 100) / 100;
 }
 
-export { currentActor, nowRfc3339, spentBasis, tallyOf, DEFAULT_ON_HOST_TOKENS_EXCEED, DEFAULT_ON_GRANT_EXCEED, DEFAULT_ECONOMY, economyFor, isHostTokens, validateRunBudget, asRunBudget, expertsDir, loadExperts, readExpertDomain, pathsIntersect, stackExpertNames, WAVES_FILE, BUILD_PHASE2 as BUILD_PHASE, buildProgress, storyDependsOn, shortBy, remainingWork, wouldExceed, wouldExceedHostTokens, raiseGrantVerdict, REBALANCE_SOURCE, planRebalance, applyRebalance, describeRebalance, raiseCommand };
+export { spentBasis, tallyOf, DEFAULT_ON_HOST_TOKENS_EXCEED, DEFAULT_ON_GRANT_EXCEED, DEFAULT_ECONOMY, economyFor, isHostTokens, validateRunBudget, asRunBudget, expertsDir, loadExperts, readExpertDomain, pathsIntersect, stackExpertNames, WAVES_FILE, BUILD_PHASE2 as BUILD_PHASE, buildProgress, storyDependsOn, shortBy, remainingWork, wouldExceed, wouldExceedHostTokens, raiseGrantVerdict, REBALANCE_SOURCE, planRebalance, applyRebalance, describeRebalance, raiseCommand };

package/dist/hooks/{chunk-vhy24kv6.js → chunk-kcrphpwc.js}

@@ -122,13 +122,14 @@ var PHASE_IDS = ["01-what", "02-how", "03-plan", "04-build", "05-watch"];
 var PHASE_SEGMENT_RE = /^0[1-5]-[a-z]+$/;
 var DEFAULT_TIMEOUT_S = 7200;
 function buildStageDefaults(root, scope, stageId) {
-  const fallback = { attempts: STAGE_TUNING_DEFAULTS.attempts, timeoutS: DEFAULT_TIMEOUT_S };
+  const fallback = { ...STAGE_TUNING_DEFAULTS, timeoutS: DEFAULT_TIMEOUT_S };
   try {
     const preset = loadWorkflowPreset(root, scope);
     const stage = (stageId === undefined ? undefined : preset.stages.find((s) => s.id === stageId)) ?? preset.stages.find((s) => s.phase === PHASE_IDS[3]);
     if (stage === undefined)
       return fallback;
-    return { attempts: stage.attempts, timeoutS: stage.timeout_s };
+    const doc = existsSync(stage.source) ? parseYaml(readFileSync(stage.source, "utf8")) : null;
+    return { ...readStageTuning(doc), timeoutS: stage.timeout_s };
   } catch {
     return fallback;
   }

package/dist/hooks/dod-gate.js

@@ -23,7 +23,7 @@ import {
 import {
   DEFAULT_TIMEOUT_S,
   buildStageDefaults
-} from "./chunk-vhy24kv6.js";
+} from "./chunk-kcrphpwc.js";
 import {
   DodCommandRefused,
   loadWorkspace,

package/dist/hooks/session-start.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   questionsCard
-} from "./chunk-px7swzs1.js";
+} from "./chunk-9kzevq39.js";
 import"./chunk-bfvcebn6.js";
 import {
   allow,
@@ -20,7 +20,7 @@ import {
   runSnapshot,
   statusWithOutcome,
   whatIsWaiting
-} from "./chunk-4w2e56zw.js";
+} from "./chunk-5q89ffsn.js";
 import"./chunk-ae6bkfs5.js";
 import {
   expertsDir,
@@ -28,14 +28,14 @@ import {
   pathsIntersect,
   readExpertDomain,
   stackExpertNames
-} from "./chunk-s4kz5nn2.js";
+} from "./chunk-dw8gggv9.js";
 import {
   isFinished
-} from "./chunk-5wh26b5f.js";
+} from "./chunk-4d22xm3c.js";
 import {
   openRunViews
 } from "./chunk-57s4mdhy.js";
-import"./chunk-vhy24kv6.js";
+import"./chunk-kcrphpwc.js";
 import"./chunk-7ypyp8xk.js";
 import {
   openBlocks,

package/dist/hooks/statusline.js

@@ -2,12 +2,12 @@
 import {
   bar,
   runSnapshot
-} from "./chunk-4w2e56zw.js";
+} from "./chunk-5q89ffsn.js";
 import"./chunk-ae6bkfs5.js";
-import"./chunk-s4kz5nn2.js";
-import"./chunk-5wh26b5f.js";
+import"./chunk-dw8gggv9.js";
+import"./chunk-4d22xm3c.js";
 import"./chunk-57s4mdhy.js";
-import"./chunk-vhy24kv6.js";
+import"./chunk-kcrphpwc.js";
 import"./chunk-7ypyp8xk.js";
 import"./chunk-sjykymar.js";
 import {