tldr-experts 0.34.0 → 0.36.0

package/CHANGELOG.md

@@ -1,5 +1,362 @@
 # Changelog
 
+## 0.36.0 — 2026-09-18
+
+### Added
+
+- **`tldrx facts dedupe [--dry-run]` retires the duplicate facts already on a ledger written
+  before the append-time check below existed (see #216).** A field audit measured 27 verbatim
+  duplicates in one workspace's `facts.yml` (F028-F054 == F001-F027, one import that ran
+  twice), inlined into every what/how/build prompt with no filter. The new subcommand groups
+  live facts by normalised text, keeps the earliest id per group, and marks every later member
+  `superseded_by` — chained rather than fanned onto the earliest id directly for a group of
+  three or more, since the reciprocal link `validateFactsFile` enforces is one-to-one; `headOf`
+  still resolves every chained member to the one still live. Nothing is deleted, `--dry-run`
+  writes nothing, and a ledger with no duplicates is byte-identical after.
+- **The context ledger carries the facts share as its own line, `facts_bytes` in `pending.json`
+  and `(facts N B)` in `--prepare`/`--dry-run` (see #216).** A subset of `inputs_bytes`, the same
+  shape `questions_bytes` already is of `stage_bytes` — never summed twice into `total_bytes`.
+  The field audit that opened #216 found this share reaching 57% of a bundle with nothing
+  anywhere naming it; the number used to exist only as something you could `wc -c` a rendered
+  prompt to discover by hand.
+- **The `plan` gate refuses a story whose own body names an edit of a path outside its own
+  `touches` allowlist (see #376).** Measured on a live autonomous run (#332): a story's step
+  asked for a CHANGELOG bullet under a new `## <v> — unreleased` heading while `CHANGELOG.md`
+  sat outside its `touches` — the Build developer correctly left the file untouched under the
+  write-allowlist rule, and the pre-merge reviewer had to send the branch back for AGENTS.md
+  §5's bullet, exactly the human intervention the autonomy north star measures. Same shape as
+  the #365 sequencing rule: a short, exported edit-verb set (`TOUCH_EDIT_VERBS`) and a
+  backtick-quoted path pattern (`TOUCHED_PATH_PATTERN`, never a `*` glob) in the SAME sentence
+  or bullet — a step that only reads or points at a path is unaffected. A `## <v> —
+  unreleased` heading named alongside an edit verb counts as an edit of `CHANGELOG.md` even
+  when the step never spells the filename. The issue's second half — a `touches_always:`
+  workspace-level allowlist addition — is not in scope here; it stays available as a
+  follow-up if this half proves insufficient in the field.
+- **An over-cap `acceptance`/`test_plan` item is now split mechanically, for $0.00, before the
+  `plan` check ever judges it (see #352, part of #345 family).** `requireStringList`'s own
+  refusal already said "split it into several items"; `checkPlan` now tries exactly that,
+  reusing `[src:]`'s own trailing-token span finder (`trailingTokenSpan`, `srcToken.ts`,
+  exported for this — one derivation, AGENTS.md §7) so a split never cuts through, or drops, a
+  citation: the token is set aside before any sentence boundary is looked for, and copied
+  VERBATIM onto every resulting piece, not just the last. `splitOverCapItem`
+  (`src/core/text/listSplit.ts`) does the mechanical half; `repairOverCapItems`
+  (`src/core/plan/repairOverCapItems.ts`) does the file half — locating the field surgically in
+  the story's raw front-matter lines (both the flow-list and block-list shapes a story is seen
+  in) and rewriting only that one field, never a full YAML round-trip that would reflow
+  everything else's quoting. A split is written back to disk ONLY when every piece is under the
+  cap AND re-validates through the same checks the original item failed
+  (`requireStringList` + the `[src:]` grammar when the item carried a token) — an item with no
+  sentence boundary, or whose split still fails re-validation, is left byte-identical and
+  refused exactly as before, including by the existing `plan-fix` round (#288) when applicable.
+  Because the repair runs inside the SAME check pass, a formatting-only over-cap item never
+  even reaches that bounded, paid round. `CheckOutcome` grows an additive `repairs?` field
+  (`src/core/run/checks.ts`), surfaced on the stage's own report line and on the
+  `check.passed`/`check.failed` event — the same "an auto-repair must be visible" owner
+  decision (2026-09-15) #345's Watch repair already follows.
+- **A retry of a failed single-agent stage whose declared outputs are already complete and
+  valid on disk settles at $0.00 instead of buying a fresh turn to reproduce them (see #353,
+  part of #345 family).** MEASURED first: `runStage`'s headless path called `spawnAgent`
+  unconditionally on every re-entry — `validateOutputs` was only ever reached from
+  `finishStage`, AFTER a turn was dispatched and paid for, so a stage that failed for a reason
+  unrelated to its declared outputs (a `checks:` failure since fixed by hand, a timeout after
+  the last file was flushed) bought a full fresh turn to redo work already on disk. Now, on
+  re-entry to a stage whose `status` is already `"failed"` (never a first attempt, and headless
+  mode only — never `--prepare`/`--commit`, never `--dry-run`), `trySettleFromDisk` runs
+  `validateOutputs` against what is already there and, when the stage declares any `checks:`,
+  runs them for real too (they are local — free to run, and a checks failure there means the
+  "already finished" premise is false and a real turn is still owed, exactly as today). Only
+  when BOTH clear does the stage settle: one task row (`status: "done"`, `cost_usd: 0`,
+  `model: null`, `session_id: null`) carrying the additive `settled_from: "prior-attempt
+  outputs"` (`RunFile.ts`, and `emitRunYaml.ts`'s hand-written task emitter, which needed the
+  new key taught to it the same way #375's `exit_disagreement` did), and a matching
+  `agent.result` event — named on the stage's own report line too, never silently. Any problem
+  falls straight through to the ordinary spawn path, unchanged. **Pre-merge review
+  (2026-09-18): structurally valid files are not proof of finished work when the agent that
+  wrote them reported the failure itself.** `trySettleFromDisk` now refuses to settle before
+  even looking at disk when the prior attempt's own task row names an agent-reported
+  `failure_kind` (`AGENT_REPORTED_FAILURE_KINDS`, `spawnAgent.ts`: `result_error`,
+  `malformed_result`, `empty_result`, `asked_no_diff`), `unclassified`, an absent kind on a
+  `"failed"` row, or `non_zero_exit` whose own `error` text shows a result document that parsed
+  and disagreed with itself (`… with is_error=true: …`) — only a `checks:`-only failure or the
+  wall dying on it (`timeout`, `process_killed`, `rate_limit`, or a clean `non_zero_exit` with
+  nothing parseable) settles. Named on the report line as `prior attempt reported <kind>;
+  spawning`. A knob two `run auto` retry-counting test fixtures grew to work around the
+  original, too-permissive settle is removed along with it — the failure-kind gate alone keeps
+  their canned "fails then succeeds" spawns real, which is the smaller, more honest fix.
+
+### Changed
+
+- **A turn killed by the provider's rate limit with no attested `rate_limit_event` frame can
+  now be classified `rate_limit` from its raw text (part of #341).** `describeFailure`'s
+  residual `unclassified` bucket now checks stdout/stderr against a small exported regex
+  (`RATE_LIMIT_TEXT_RE`) for the REPORTED (not measured — no raw capture of a turn that
+  actually died against the wall exists in this repo) shape of a session-limit API error
+  before giving up; it never overrides a more specific cause (timeout, a kill signal, a
+  malformed envelope, a named error or subtype disagreement). The frame-attested capture
+  #341 actually asks for still does not exist — this narrows the "no reason named" bucket,
+  it does not close the issue.
+- **`renderFacts`'s rendered list — Build's `### Facts already on record` and the `{{facts}}`
+  template value alike — sits under a byte ceiling (`DEFAULT_FACTS_MAX_BYTES`, 32 KB) for the
+  first time (see #216).** Previously unbounded: one measured section reached 123,938 B, 57% of
+  a 218 KB bundle. Over the ceiling the list is cut on a WHOLE fact, never mid-word (#161), and
+  the cut is named on the page rather than silently dropped.
+- **What and How stop receiving `.tldrx/memory/facts.yml` raw — an INDEX rides in its place
+  (owner decision "Index", 2026-09-18; see #216).** Measured on a 120-fact fixture ledger: a
+  48,150 B `## Inputs` entry became a 17,490 B index (63.7% smaller), one line per live fact —
+  `- [F<n>] <area> · <first ~120 chars>…` — with a closing pointer at the file for the full
+  text. Build and Watch declare the same input in their `stage.yml` too but read facts through
+  their own executors, never `inlineInputs`, so they are unaffected — measured, the declaration
+  there was already unused. The `## Inputs` preamble marks the summarised file with its own
+  sentence instead of the "nothing else to find" line that would otherwise contradict
+  what/how's own prose telling the agent to grep the real file.
+
+### Fixed
+
+- **The Build executor's `ExecutorTask` rows never copied `AgentOutcome.failureKind` across, so a
+  Build developer or reviewer turn that died with a classifiable cause carried no
+  `failure_kind` on its `run.yml` row (see #357, see #348).** `ExecutorTask.failureKind` and
+  its `recordExecutorTasks` mapping already existed; the four `this.tasks.push` sites in
+  `executors/build.ts` were the only thing not copying it. The spawned-developer and
+  spawned-reviewer sites (and the format-retry row beside them) now do; the two HOST-turn
+  push sites, which have no `AgentOutcome` to read a kind off, are unchanged and continue to
+  leave the key absent rather than guess one. `test/build-golden.test.ts`'s `rounds-run-tasks.txt`
+  golden is regenerated ON PURPOSE — a failed developer's row in that fixture now carries
+  `failure_kind: "non_zero_exit"`, which it did not before; this is the change this commit
+  means, not a drift.
+- **A spawned turn whose result document said `subtype: "success"` but whose process exit
+  code disagreed settled as a stage failure — costing a full `run auto` relaunch for work
+  that was already done (see #375, see #348).** Measured on a live autonomous run: a watch
+  developer wrote its declared output, `claude` exited 1 with `is_error: true`, and the
+  result document's own `subtype` said `"success"`; the facilitator classified this as
+  `unclassified` ("no reason named (the provider's own subtype said "success")") and `run
+  auto` spent one of five relaunches re-running work attempt 1 had already finished. The
+  three headless spawn sites in `runNext.ts` now settle the turn as `done` — recording the
+  disagreement as an additive `exit_disagreement` note on the row and the `agent.result`
+  event — whenever every output the stage declared is on disk and non-empty at the moment
+  the verdict is taken (`exitDisagreement.ts`'s `settleExitDisagreement`, one derivation,
+  called from all three rather than pasted three times); a turn missing even one declared
+  output stays `failed` under its ordinary `failure_kind`, exactly as before. The Build
+  executor's `spawnDeveloper` path has the same exit/subtype disagreement shape but no
+  per-story declared-outputs list to check existence against, so it is deliberately left
+  out of this change — see the follow-up draft at
+  `scratchpad/issue-draft-375-build-spawndeveloper-exit-disagreement.md`.
+- **`FactsStore.append` dedupes on normalised text, so re-running a driver's import or
+  `tldrx facts add` on the same sentence no longer mints a second row (see #216).** Both
+  writers — `captureAnswers` and `tldrx facts add` — now get the existing live fact back
+  (`duplicate: true`) instead of a new one when the incoming text, trimmed/whitespace-
+  collapsed/case-folded, matches a LIVE fact's; a retired or superseded twin does not block a
+  fresh assertion of the same text. `facts add` prints "`<id>` is already on record" and exits
+  0 rather than writing a duplicate.
+- **`merge-wave.sh`'s #336 immutability guard no longer prints `printf: write error: Broken
+  pipe` once per dated CHANGELOG section (see #380).** Its `changelog_section()` awk helper
+  `exit`ed as soon as it saw the NEXT `## ` heading, while the `printf | changelog_section`
+  pipe feeding it the pre-merge CHANGELOG was still writing the rest of the file — so the
+  writer could get EPIPE (measured live: 45-46 lines of noise per wave, once per dated
+  section that was not the last one in the file). `exit` is now `p = 0`: the awk process
+  keeps consuming to EOF instead of closing its end of the pipe early, so the writer always
+  finishes; the guard's own verdict (`$WAS`/`$NOW`) is unchanged.
+- **`emitFactsYaml` writes `facts: []` for an empty list instead of a bare `facts:` line (see
+  #383).** Both YAML readers behind the runtime seam parse a key with nothing after it as
+  `null`, not `[]`, so a facts.yml with zero facts never round-tripped — `FactsStore.save()`
+  re-validates its own serialized output before writing and threw on exactly this file,
+  `refusing to write an invalid facts.yml: facts expected an array, got null`. Latent until
+  now (every shipped writer appends a fact before calling `save()`), but reachable from any
+  fresh `FactsStore.loadOrEmpty(...).save()` with nothing appended; non-empty output is
+  unchanged.
+- **Watch's kept-card pre-pass (#306) never got the `[src:]` mechanical repair the
+  validation loop a few lines below it already had, so a card left on disk with only a
+  punctuation slip — the marker missing its space, a token sitting mid-sentence, an ASCII
+  `->` in a `cmd` source — re-spawned a writer for text a script already knows how to fix
+  (see #351, part of #345).** `keptCard` now runs the same `repairSrcSyntax` before its
+  `parseWatcherCard` check: a repair that turns an invalid card valid is written back to
+  disk and the feature is kept, at $0.00, with the repair named on the stage's own report
+  line the same way the validation loop names its own. A card that stays invalid after
+  repair is still not kept (today's behaviour, byte-identical file); a card already valid
+  needs no repair and is never rewritten.
+
+## 0.35.0 — 2026-09-17
+
+### Fixed
+
+- **The phase-id shape guard (`test/phase-ids-one-derivation.test.ts`, #187) now catches a
+  reordered duplicate, not just an identical or drifted one (see #204).** The guard's
+  `ORDERED_LIST` pattern was built from `PHASE_IDS` by joining the five ids in the one order
+  `PHASE_IDS` itself is written in, so a fourth copy that wrote the same five ids out in a
+  DIFFERENT order — `["01-what","02-how","04-build","03-plan","05-watch"]` — matched neither
+  guard: not the shape guard (wrong order) nor the equality guard (nothing there compares an
+  unrelated inline literal to `QUESTION_PHASES`). Planting exactly that array in an unrelated
+  file left the suite green, 5 pass / 0 fail — confirmed here before the fix, reproducing the
+  issue's own finding. The pattern is now the alternation of all 5! = 120 orderings of the same
+  five exact `PHASE_IDS` (still derived from `PHASE_IDS`, never hand-typed), each id still
+  requiring its closing quote immediately after it so ordinary path-segment strings like
+  `01-what/intent.md` keep not matching. A real drift (a wrong id) still matches none of the
+  120 orderings, so the drifted case still falls to the equality guard exactly as before —
+  only the ORDER stopped being load-bearing for the shape guard.
+- **`validateWorkspace` now enforces spec §2.1's no-shell-metacharacter rule for
+  `repos[].commands` on LOAD, not only in `tldrx init`'s own emitted document (see #181).**
+  A hand-edited `.tldrx/workspace.yml` carrying a bare `& ; | > \`` in a command — e.g.
+  `commands.lint: "npm run test | tee lint.log"` — loaded with no complaint, because
+  `validateWorkspace` (`src/core/schemas/workspace.ts`) checked `mode`/`root`/`repos[].name`/
+  `.path`/`.command_probes` but never touched `repos[].commands` at all; only
+  `validateEmitted.ts`'s own `tldrx init`-time check ever ran the rule. The refusal now names
+  the command, its slot and the offending character, reusing the same `isSingleArgvCommand`
+  both enforcement points always shared, so the two can never drift on what counts as a
+  metacharacter. `null` and `""` both still mean "unavailable" (the shipped
+  `templates/workspace.yml` skeleton's own convention) and carry nothing to check.
+- **The rule above is quote-aware, so it never refuses a command the DoD gate would actually
+  run (follow-up to #181, same day).** The first cut of the load-time check scanned the whole
+  command string, so `sh -c "npm run test | tee out.txt"` — the exact workaround
+  `docs/guide/09-troubleshooting.md` documents for a command that needs a shell — failed to
+  LOAD even though `src/hooks/lib/story.ts`'s own `splitArgv` already runs it fine (a quoted
+  token is one literal argument, never a shell operator). Load-time validation stricter than
+  the executor it exists to describe would have broken every workspace that followed that
+  documented advice. The tokenizer that already told the two apart lived only in `story.ts`;
+  it is now `src/core/detect/argvSplit.ts`, and both `story.ts`'s `splitArgv`/
+  `unquotedShellSeparator` and `commands.ts`'s `isSingleArgvCommand`/`singleArgvViolation`
+  read a command through it — one derivation of "quoted vs bare" for the whole codebase, each
+  caller still applying its own banned-character set (the gate's fifteen, spec §2.1's five)
+  unchanged.
+- **`tldrx story reopen` now refuses on a run that is `done` or `cancelled` (`isFinished`),
+  or whose Build gate is signed, instead of writing a story back to `todo` that nothing will
+  ever dispatch (see #227).** `rollUp` derives a run's `done` from its STAGES being terminal,
+  not from every story reaching `done` — a `blocked` story can outlive the run it belongs to,
+  so the existing `row.status === "done"` guard never saw this case: measured on a real
+  workspace, the reopen wrote the file, appended the event, and `tldrx next` answered "is
+  done — nothing to advance" without ever naming the story it had just reopened. Pre-merge
+  review caught that the first cut of the fix only checked `=== "done"` and let a `cancelled`
+  run through the same hole — `run cancel` never touches a story file either — so the check
+  now reads `isFinished` (`RunFile.ts`), the same predicate `runNext.ts`'s own `advance()`
+  already refuses to dispatch on. The check runs before either write, for the plain verb and
+  `--for-fix`/`--as-is` alike, and refuses in the usage family (exit 1, per the owner's
+  decision, distinct from this file's other exit-2 refusals) naming the story and the door —
+  `tldrx reject --stage 04-build/build --note "…"`, or a new run — rather than leave a
+  signature standing over work it never saw (see #144). `next`'s own "is done — nothing to
+  advance" line now also names any `story.reopened` a run already carries that this fix
+  cannot retroactively undo, so a run an older binary left in this state is not silent about
+  it either.
+- **A `budget.yml` that exists but will not parse no longer resurrects `run.yml`'s frozen
+  creation ceiling as a live one (see #245).** Since #236 the dashboard headline and
+  `tldrx replay` read the run's ceiling from `budget.yml`, falling back to run.yml's mirror —
+  a value `budget raise` never moves — whenever that file could not be read. On a run raised
+  after creation and then damaged, that fallback printed #236's own symptom again: `$X spent
+  of $Y ceiling` with `Y < X`. Owner decision ("Null con razón"): a DAMAGED `budget.yml` nulls
+  the ceiling instead, with an additive `ceilingBasis`/`ceilingReason` on the loaded run and
+  dashboard model naming why, and every renderer falls back to the same `$?` it already prints
+  for an unreadable spend. A run with no `budget.yml` at all is a different, unchanged case —
+  it was never raised through a file it never had, so the mirror is kept exactly as before.
+
+### Added
+
+- **A human gate approval whose note names the commit that fixes an open `fix-now` fix-list
+  finding now closes that finding — only the finding the note is plainly about (see #344, owner
+  decision "Sí cerrarlo").** Before this, `tldrx approve --note "…"` never read the note back
+  against a run's fix lists, so a Build gate approved over a note like "S3 fix round landed and
+  re-reviewed (`71bfe1e`)" left the fixlist file itself saying `Resolved: no` — the
+  honour-system gap #269's on-disk escape hatch left standing — and `run.yml`'s own outcome kept
+  reporting the story `blocked` on a defect the gate had already verified fixed. `approve` now
+  reads its note for sha-looking tokens and holds each one to the exact evidence rule a
+  file-written `Resolved: yes` is held to (extracted to `src/core/build/resolutionVerify.ts` so
+  the Build executor's own per-story check and this gate path share one derivation, never two).
+  A finding is only ever touched when the note names its own story id (`S3`) or a candidate is
+  reachable from its own story branch; a reachable candidate closes it, `Resolved: yes <sha>`,
+  and one that does not check out is recorded `claimed-unverified`. Pre-merge review on #344
+  caught the first cut trying every candidate against every open finding in the whole run, so a
+  note naming only one story's fixing sha stamped an UNMENTIONED finding in a different repo
+  `claimed-unverified` over a claim nobody made about it — a finding the note never named, and
+  whose branch none of the note's candidates reach, is now not touched at all, not even read. A
+  candidate that matches no story anywhere is recorded once on the gate's own `gate.approved`
+  event instead of being guessed onto a finding. A note naming no commit touches no fix list at
+  all.
+- **A fact can carry a `was_id` alias to the id it was cited under before an id-change (see
+  #338).** `id` stays immutable (§7: nothing ever rewrites a fact's own `id`), so an owner
+  decision (2026-09-17) settled how a fact's id is ever allowed to change: additively, never by
+  rewriting or a bare documentation-only rule. `[src: <was_id>]` now resolves through
+  `resolveFact` to the fact that carries the alias — but only when the cited id has no live row
+  of its own, so an old citation written before a renumber still resolves once its old id is
+  fully vacated. A cited id that is ITSELF a live fact is never silently shadowed by another
+  fact's `was_id`: `resolveFact` refuses, naming both the live holder and the `was_id` carrier,
+  because `readFacts` never validates and a hand-edited or merged facts.yml can carry exactly
+  the collision `validateFactsFile` refuses at write time. `validateFactsFile` itself refuses a
+  `was_id` that collides with another live fact id or is claimed by more than one fact. The
+  field is optional and additive: a facts.yml with no `was_id` anywhere reads and resolves
+  exactly as before.
+
+### Changed
+
+- **The fix list's on-disk door is now documented as the human escape hatch it was already
+  behaving as (see #269).** `parseFixlistFile` — the read path every settle-time question and a
+  hand edit both go through — validates shape only and never charges the `[src: …]` citation
+  the reviewer-envelope write path (`parseFixFindings`) requires for `refuted` and for an
+  unblocking `docs`/`style` finding (#255). That asymmetry predates #255 and was previously
+  unwritten, so the next reader could read it as an oversight and "fix" it; the owner settled it
+  (2026-09-17) as deliberate — a person editing the artefact by hand is trusted the way the
+  envelope's own reviewer is not — and `docs/spec.md` and a comment at `parseFixlistFile` now say
+  so, naming exactly what a hand edit bypasses.
+- **Two illustrative examples stop naming a private workspace, and a guard now catches the
+  next one (see #191).** An audit for private-workspace leakage across the public surface found
+  two purely illustrative hits with no measurement attached — an area-id string in
+  `src/core/dashboard/render.ts`'s dashboard-layout comment, and `docs/spec.md`'s running
+  workspace.yml / competencies / questions / handoff example (§2.1, §2.6, §2.13, §2.14) — that
+  had copied a real workspace's name instead of inventing one; both now use one neutral,
+  internally-consistent placeholder. `test/public-surface-consistency.test.ts` gained a guard
+  over `src/**`, `docs/**`, `templates/**`, `docs-site/**` and the top (unreleased) CHANGELOG
+  heading: `templates/**` and `docs-site/**` fail on any occurrence, and `src/**`/`docs/**` —
+  which still carry real measurement citations naming a real workspace, cited evidence rather
+  than decoration — fail on a NEW one, via a per-file hit-count allowlist that can only be
+  lowered, never silently raised. Those citations, and the two `test/fixtures/**` families this
+  same audit found are real workspace data rather than a synthetic name that merely coincides,
+  were #389's call (the owner decided 2026-09-17 to synthesize them, on its own branch) — see
+  the next entry for that follow-through.
+- **The two `test/fixtures/**` families a real workspace's own bytes had leaked into are now
+  genuinely invented (not just a token renamed inside the same real paths and class names —
+  a first pass at this made that mistake, caught in pre-merge review), and #191's guard is a
+  blanket ban over `test/**` instead of a per-file allowlist over `src/**`/`docs/**` (see #389).**
+  `test/fixtures/competencies/read-only-expert.yml` and its paired knowledge fixture — `git mv`'d
+  again, to a name that no longer echoes the real one — were copied verbatim from a real
+  workspace, architecture and all; the `aidlc-intent` fixture tree (`ideation/feasibility`,
+  `ideation/scope-definition`) carried a real pilot's own product name, team and stack. All three
+  are now a different invented stack with invented module, file and class names throughout — a
+  token-normalised diff against the pre-#389 bytes is ~100% changed on every data-bearing line,
+  and grepping every distinctive identifier from the old files against the new ones returns zero
+  — while keeping the same shape and size class: same evidence-row counts, same claim/answer
+  counts `test/distill.test.ts` measures, same three execution-claim citations
+  `test/knowledge-value.test.ts` measures, so every test that reads them keeps asserting the same
+  behaviour against different bytes. A real absolute home-directory path in `docs/plans/v1.md` is
+  now home-relative. The 37 `src/**` and 7 `docs/**` citations #191's allowlist exempted, and 50
+  more the same audit had missed across 24 `test/**` files (evidence-comment citations and a
+  handful of test DATA — a fake root path, a fake GitHub repo slug — fed to the code under test),
+  are each rephrased to name the evidence — a workspace id, the run, the date, the figure —
+  without the workspace's own name; two of those files (`test/plan-skill.test.ts`,
+  `test/maintain-skill.test.ts`) carried their own copy of the private-workspace pattern for an
+  unrelated skill-content guard, and now import it from the one file still allowed to hold it.
+  With nothing left needing an allowlist, `test/public-surface-consistency.test.ts` drops its
+  `SRC_CITATION_COUNTS`/`DOCS_CITATION_COUNTS` maps and now refuses ANY occurrence — in file
+  CONTENT and tracked file names — across `src/**`, `docs/**`, `templates/**`, `docs-site/**`,
+  `test/**` (itself excepted, since the pattern has to live somewhere to be checked against) and
+  the unreleased CHANGELOG heading. Released CHANGELOG sections are history and stay out of the
+  guard's reach.
+- **The private-workspace guard matched one literal spelling per name, so the same four
+  workspaces kept leaking in every OTHER shape (see #389, #191).** `git grep` measured what the
+  regex could not see: a hyphenated repo slug (`<word>-api`, `<word>-platform`,
+  `<word>-platform-abstractions`, a knowledge-file name), the bare word used as an English
+  project name with no fixed noun after it ("the `<word>` run", "The `<word>` graph", "the whole
+  `<word>` sample" — an open-ended list, so disambiguated by the article "the" up to two words
+  earlier instead), the same bare word as DATA inside a `repos: [<word>]` list literal, the
+  capitalised word as a bare product name mid-sentence, and two OTHER private workspace names
+  this guard never scanned for at all — already banned for the skill markdown by
+  `test/maintain-skill.test.ts`, but leaking in `src/core/run/ship.ts` and
+  `test/ship-policy.test.ts` as a `dev/<name>` branch in a real PR citation, now `dev/W3`. A real
+  GitHub `owner/repo` remote (`test/interview.test.ts`, `test/process-answers.test.ts`, 17
+  occurrences) is now an invented `acme/billing-api`, keeping every `parseGithubRemote` shape
+  (https, ssh, scp-style, `.git` suffix, trailing slash, the negative cases) exercising the same
+  parse. Eight sub-patterns now cover all of it, engineered so the bare lowercase word — an
+  ordinary Spanish verb ("it appears") used constantly and legitimately in `docs-site/es/**` and
+  Spanish audit prose — is never matched on its own; a new false-positive control test asserts
+  two genuine Spanish sentences survive. A commit message from the previous
+  pass on this branch had leaked one such identifier itself (rewritten, since the sha had not
+  reached `main`) and carried its own review record, which is stale the moment a sha changes and
+  was dropped rather than rewritten.
+
 ## 0.34.0 — 2026-09-17
 
 ### Fixed

package/README.md

@@ -335,6 +335,8 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.36.0 | 2026-09-18 | `beta` | Wave six, the P1 cost and autonomy backlog, every branch reviewed before main: facts.yml stops riding whole into every prompt (a one-line index for what/how, a named byte ceiling for Build, dedupe at append and `tldrx facts dedupe`, the facts share visible in the context ledger); a headless turn whose exit code disagrees with its own `subtype: success` settles as done with the disagreement recorded instead of buying a relaunch; Build rows carry `failure_kind`; a rate-limit death is classified from its raw text; three more savings before a paid turn — kept Watch cards get the `[src:]` repair, over-cap acceptance items are split mechanically, and a retry whose prior attempt died by the wall with complete outputs settles at $0, never when the agent itself reported the failure; the plan gate refuses a step that edits a path outside its `touches`; an empty facts ledger round-trips; merge-wave stops spraying Broken pipe — 10 issues |
+| 0.35.0 | 2026-09-17 | `beta` | Wave five of the audited backlog, every branch reviewed before main: a human gate approval whose note names the fixing commit closes that fix-list finding (reachable from the story's own branch, or `claimed-unverified` — never a silent close), a fact keeps a `was_id` alias across an id change, `validateWorkspace` enforces the quote-aware single-argv rule the DoD gate already applied, `tldrx story reopen` refuses a finished or Build-approved run and names the way back, a damaged `budget.yml` reads as absent-with-reason instead of resurrecting a frozen ceiling, the fix list's on-disk door is documented as the human escape hatch, and the public surface stops naming private workspaces — fixtures are synthetic, citations carry neutral labels, and a blanket guard refuses the next one — 9 issues |
 | 0.34.0 | 2026-09-17 | `beta` | Four waves of the audited backlog, every branch reviewed before main: run auto no longer stops itself (parked auto gates self-close, Build parks at a story boundary on budget), gates cannot sign stale or backdated evidence, interrupted turns bank their cost as absent instead of a measured zero, the boundary condition diffs the branch the run recorded, mutating generators are refused from dod blocks, merge-wave refuses edits to released CHANGELOG sections and answers `unknown` instead of `idle`, and the test harness refuses a TMPDIR inside a work tree — 14 issues, the first of them shipped end-to-end by a tldrx run against this repo |
 | 0.33.0 | 2026-09-17 | `beta` | Six follow-ups from the 0.32.0 cycle, each measured on the second unattended run (run #42) or on the review that shipped it. The plan sequencing rule counts a bare camelCase field only when it is unambiguous or the plan spells it elsewhere as snake_case or in backticks, so unrelated stories sharing a word like `toString` no longer refuse each other (#370); `task.done` clamps an oversized `as_is_note` the way it clamps `permission_refused` (#368); the asked-no-diff and red-DoD requeues settle through one helper that takes data (#369); a workspace can opt its base pre-flight probe into a story-shaped worktree with `probe_in_worktree: true`, and the Build-entry probe runs `tool_restore:` first (#371, the remainder of #363); AGENTS §11 names the negated closing verb that still auto-closes and widens the pre-wave grep (#372); and CI keeps merge-wave's sandboxes on failure so the next #237 red carries its `merge.log` (#373). Minor release: a new workspace field and a new plan refusal shape. |
 | 0.32.0 | 2026-09-16 | `beta` | Seven framework defects measured on the second unattended run (run #42), where every one of nine operator stalls was the framework's, not the code's. A refused compound shell line is a rework note for the developer instead of a human stop (#360); a dependency hold is re-evaluated the moment the dependency lands (#361) and a rescued story is written back to `todo` the instant the release is decided (#366); an event payload over the size cap is clamped to a bounded head instead of failing the whole build stage (#359); a headless developer is told it is unattended, that `## Inputs` is where to start and not an allowlist, and a turn that asks instead of deciding is a named `asked_no_diff` failure (#364); the rate-limit park waits for 90% of the window, not the provider's first warning at half of it (#367); the plan refuses a story that enforces an invariant on a field before the story that populates it, matching the field across spellings (#365); and the preflight restores workspace tools before its first probe and names the tree it ran in (#363, in part). Minor release: a new plan refusal, a changed park threshold and a new failure kind. |

package/dist/hooks/answer-capture.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import {
   conflictOf
-} from "./chunk-9kzevq39.js";
+} from "./chunk-sqkp3405.js";
 import {
   FactsStore,
   formatJaccard
-} from "./chunk-bfvcebn6.js";
+} from "./chunk-fbn9q035.js";
 import {
   parseHookInput,
   readStdin
-} from "./chunk-jfaarcb1.js";
+} from "./chunk-73h7hmfx.js";
 import"./chunk-ae6bkfs5.js";
 import {
   EventLog,
   PHASE_ID_RE
-} from "./chunk-4d22xm3c.js";
+} from "./chunk-6cptynke.js";
 import {
   PHASE_IDS
-} from "./chunk-kcrphpwc.js";
-import"./chunk-7ypyp8xk.js";
+} from "./chunk-mx1g05pq.js";
+import"./chunk-gqfbnr1h.js";
 import {
   ADVISORY_KEY,
   MAX_FACT_CHARS,
@@ -28,7 +28,7 @@ import {
   renderQuestionBlock,
   replaceBlock,
   serializeQuestions
-} from "./chunk-sjykymar.js";
+} from "./chunk-7p9vw1s2.js";
 import {
   ITERATION_ONLY_SLOT,
   PROJECT_FRAMEWORK_DIR,
@@ -38,7 +38,7 @@ import {
   isScopedTemplate,
   parseYaml,
   scopedSlotOf
-} from "./chunk-0a3b8w1c.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/hooks/answer-capture.ts
 import { existsSync as existsSync5 } from "fs";
@@ -466,7 +466,7 @@ function captureAnswers(questionsPath, ctx) {
       const prov = answerProvenance(block, ctx.overrides, ctx.repoNames, []);
       const text = factTextFor(block.title, block.answer);
       const clash = conflictOf({ match: block.title, area, text }, store.active);
-      const fact = store.append({
+      const { fact, duplicate } = store.append({
         fact: text,
         ...truncated ? { truncated: true } : {},
         ...clash === null ? {} : { conflicts_with: [clash.fact.id] },
@@ -489,15 +489,16 @@ function captureAnswers(questionsPath, ctx) {
         cost_usd: 0,
         payload: { q: block.id, answer: block.answer, fact: fact.id }
       });
-      log.tryAppend({
-        ts: ctx.at,
-        run: ctx.run,
-        stage: null,
-        type: "fact.added",
-        actor: ctx.actor,
-        cost_usd: 0,
-        payload: { fact: fact.id, area: fact.area, kind: fact.kind, q: block.id }
-      });
+      if (!duplicate)
+        log.tryAppend({
+          ts: ctx.at,
+          run: ctx.run,
+          stage: null,
+          type: "fact.added",
+          actor: ctx.actor,
+          cost_usd: 0,
+          payload: { fact: fact.id, area: fact.area, kind: fact.kind, q: block.id }
+        });
       captured.push({
         q: block.id,
         fact: fact.id,

package/dist/hooks/budget-gate.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import {
   budgetGateDeny
-} from "./chunk-vhn2vz83.js";
+} from "./chunk-h543njq3.js";
 import {
   allow,
   deny,
   readPayload,
   runHook,
   toolInput
-} from "./chunk-d3jrf6yy.js";
-import"./chunk-jfaarcb1.js";
+} from "./chunk-re1efynj.js";
+import"./chunk-73h7hmfx.js";
 import {
   REBALANCE_SOURCE,
   applyRebalance,
@@ -25,12 +25,12 @@ import {
   validateRunBudget,
   wouldExceed,
   wouldExceedHostTokens
-} from "./chunk-dw8gggv9.js";
+} from "./chunk-kcwv344p.js";
 import {
   EventLog,
   currentActor,
   nowRfc3339
-} from "./chunk-4d22xm3c.js";
+} from "./chunk-6cptynke.js";
 import {
   cursorStage,
   hostTokensIn,
@@ -39,20 +39,20 @@ import {
   newestActiveRun,
   renderRunEconomies,
   runSpend
-} from "./chunk-57s4mdhy.js";
+} from "./chunk-qpy8tgtc.js";
 import {
   buildStageDefaults
-} from "./chunk-kcrphpwc.js";
+} from "./chunk-mx1g05pq.js";
 import {
   noteDeprecations
-} from "./chunk-sjykymar.js";
+} from "./chunk-7p9vw1s2.js";
 import {
   PROJECT_WORK_DIR,
   findWorkspaceRoot,
   locateWork,
   parseYaml,
   stageYamlPath
-} from "./chunk-0a3b8w1c.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/hooks/budget-gate.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "node:fs";

package/dist/hooks/{chunk-4d22xm3c.js → chunk-6cptynke.js}

@@ -2,7 +2,7 @@ import {
   GATE_POLICIES,
   validateGatesPolicy,
   validateStagePolicy
-} from "./chunk-kcrphpwc.js";
+} from "./chunk-mx1g05pq.js";
 import {
   asDocument,
   isRecord,
@@ -15,7 +15,7 @@ import {
   requireString,
   requireVersion,
   result
-} from "./chunk-0a3b8w1c.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/events/EventLog.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";

package/dist/hooks/{chunk-jfaarcb1.js → chunk-73h7hmfx.js}

@@ -1,6 +1,6 @@
 import {
   runtime
-} from "./chunk-0a3b8w1c.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/hooks/passthrough.ts
 async function readStdin() {

package/dist/hooks/{chunk-sjykymar.js → chunk-7p9vw1s2.js}

@@ -3,7 +3,7 @@ import {
   parseSrcToken,
   srcToken,
   withoutSrcToken
-} from "./chunk-0a3b8w1c.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/text/questions.ts
 var REQUIRED_METADATA_KEYS = ["id", "status", "area", "asked_by", "asked_at"];

package/dist/hooks/{chunk-5q89ffsn.js → chunk-btr3m70g.js}

@@ -10,7 +10,7 @@ import {
   storyDependsOn,
   tallyOf,
   validateRunBudget
-} from "./chunk-dw8gggv9.js";
+} from "./chunk-kcwv344p.js";
 import {
   EventLog,
   OUTCOME_NOT_RECORDED,
@@ -24,12 +24,12 @@ import {
   nowRfc3339,
   stageAt,
   validateRunFile
-} from "./chunk-4d22xm3c.js";
+} from "./chunk-6cptynke.js";
 import {
   cursorStage,
   isAttendedByHostView,
   openRunViews
-} from "./chunk-57s4mdhy.js";
+} from "./chunk-qpy8tgtc.js";
 import {
   backupPathFor,
   isAlive,
@@ -38,13 +38,13 @@ import {
   workspaceRootOfRunDir,
   writeAtomic,
   yamlScalar
-} from "./chunk-7ypyp8xk.js";
+} from "./chunk-gqfbnr1h.js";
 import {
   isAdvisory,
   noteDeprecations,
   openBlocks,
   parseQuestions
-} from "./chunk-sjykymar.js";
+} from "./chunk-7p9vw1s2.js";
 import {
   FRAMEWORK_ROOT,
   MAX_ITEM_CHARS,
@@ -55,7 +55,7 @@ import {
   parseYaml,
   parseYamlRepairing,
   withoutSrcToken
-} from "./chunk-0a3b8w1c.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/statusline/runSnapshot.ts
 import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
@@ -140,6 +140,8 @@ function task(t, indent) {
     `${inner}started_at: ${yamlScalar(t.started_at)}, ended_at: ${yamlScalar(t.ended_at)},`,
     ...t.stopped_by === undefined || t.stopped_by === null ? [] : [`${inner}stopped_by: ${yamlScalar(t.stopped_by)},`],
     ...t.failure_kind === undefined || t.failure_kind === null ? [] : [`${inner}failure_kind: ${yamlScalar(t.failure_kind)},`],
+    ...t.exit_disagreement === undefined || t.exit_disagreement === null ? [] : [`${inner}exit_disagreement: ${yamlScalar(t.exit_disagreement)},`],
+    ...t.settled_from === undefined || t.settled_from === null ? [] : [`${inner}settled_from: ${yamlScalar(t.settled_from)},`],
     ...t.banked_before_refusal === undefined ? [] : [`${inner}banked_before_refusal: true,`],
     ...t.dedupe === undefined ? [] : [`${inner}dedupe: ${yamlScalar(t.dedupe)},`],
     ...t.duration_ms === undefined ? [] : [`${inner}duration_ms: ${String(Math.round(t.duration_ms))}, ` + `duration_basis: ${yamlScalar(t.duration_basis ?? null)},`],
@@ -665,6 +667,10 @@ var PLAN_SHAPE_RULES = [
   {
     issue: "#365",
     text: "**A story that adds an invariant over EXISTING data lands in the same story as, or in a wave after, the " + "story that makes existing rows and fixtures satisfy it.** A check constraint, a `NOT NULL`, a required " + "field or a validation rule written ahead of the story that populates what it enforces makes that earlier " + "story's own dod structurally red — every fixture the enforcing story's own tests run against still lacks " + "the value, and two stories in the SAME wave run in separate worktrees that never see each other's writes, " + "so 'later wave' is the only way one story's data can satisfy another's rule. If the invariant must land " + "first, write it NON-ENFORCING — nullable, consistency-only, no constraint — and let the later story " + "tighten it once the data exists. The `plan` check refuses a story whose acceptance or test plan names an " + "enforcement over a field a later story's acceptance or test plan names populating."
+  },
+  {
+    issue: "#376",
+    text: "**A story's own body never names an edit of a file its own `touches` forbids.** A step that tells the " + "developer to edit, add, write, create, rename, delete or otherwise change a backtick-quoted path — or to " + "add a bullet under a `## <v> — unreleased` CHANGELOG heading, which is an edit of `CHANGELOG.md` even when " + "the step never spells the filename — is a plan contradicting its own write allowlist: the developer who " + "obeys `touches` correctly leaves the file untouched, and a reviewer has to send the branch back for it. " + "The `plan` check refuses a story whose body names such an edit outside its own `touches`; a step that " + 'only reads or points at a path ("read `x` for the shape") is unaffected.'
   }
 ];