tldr-experts 0.35.0 → 0.36.0

package/CHANGELOG.md

@@ -1,5 +1,179 @@
 # Changelog
 
+## 0.36.0 — 2026-09-18
+
+### Added
+
+- **`tldrx facts dedupe [--dry-run]` retires the duplicate facts already on a ledger written
+  before the append-time check below existed (see #216).** A field audit measured 27 verbatim
+  duplicates in one workspace's `facts.yml` (F028-F054 == F001-F027, one import that ran
+  twice), inlined into every what/how/build prompt with no filter. The new subcommand groups
+  live facts by normalised text, keeps the earliest id per group, and marks every later member
+  `superseded_by` — chained rather than fanned onto the earliest id directly for a group of
+  three or more, since the reciprocal link `validateFactsFile` enforces is one-to-one; `headOf`
+  still resolves every chained member to the one still live. Nothing is deleted, `--dry-run`
+  writes nothing, and a ledger with no duplicates is byte-identical after.
+- **The context ledger carries the facts share as its own line, `facts_bytes` in `pending.json`
+  and `(facts N B)` in `--prepare`/`--dry-run` (see #216).** A subset of `inputs_bytes`, the same
+  shape `questions_bytes` already is of `stage_bytes` — never summed twice into `total_bytes`.
+  The field audit that opened #216 found this share reaching 57% of a bundle with nothing
+  anywhere naming it; the number used to exist only as something you could `wc -c` a rendered
+  prompt to discover by hand.
+- **The `plan` gate refuses a story whose own body names an edit of a path outside its own
+  `touches` allowlist (see #376).** Measured on a live autonomous run (#332): a story's step
+  asked for a CHANGELOG bullet under a new `## <v> — unreleased` heading while `CHANGELOG.md`
+  sat outside its `touches` — the Build developer correctly left the file untouched under the
+  write-allowlist rule, and the pre-merge reviewer had to send the branch back for AGENTS.md
+  §5's bullet, exactly the human intervention the autonomy north star measures. Same shape as
+  the #365 sequencing rule: a short, exported edit-verb set (`TOUCH_EDIT_VERBS`) and a
+  backtick-quoted path pattern (`TOUCHED_PATH_PATTERN`, never a `*` glob) in the SAME sentence
+  or bullet — a step that only reads or points at a path is unaffected. A `## <v> —
+  unreleased` heading named alongside an edit verb counts as an edit of `CHANGELOG.md` even
+  when the step never spells the filename. The issue's second half — a `touches_always:`
+  workspace-level allowlist addition — is not in scope here; it stays available as a
+  follow-up if this half proves insufficient in the field.
+- **An over-cap `acceptance`/`test_plan` item is now split mechanically, for $0.00, before the
+  `plan` check ever judges it (see #352, part of #345 family).** `requireStringList`'s own
+  refusal already said "split it into several items"; `checkPlan` now tries exactly that,
+  reusing `[src:]`'s own trailing-token span finder (`trailingTokenSpan`, `srcToken.ts`,
+  exported for this — one derivation, AGENTS.md §7) so a split never cuts through, or drops, a
+  citation: the token is set aside before any sentence boundary is looked for, and copied
+  VERBATIM onto every resulting piece, not just the last. `splitOverCapItem`
+  (`src/core/text/listSplit.ts`) does the mechanical half; `repairOverCapItems`
+  (`src/core/plan/repairOverCapItems.ts`) does the file half — locating the field surgically in
+  the story's raw front-matter lines (both the flow-list and block-list shapes a story is seen
+  in) and rewriting only that one field, never a full YAML round-trip that would reflow
+  everything else's quoting. A split is written back to disk ONLY when every piece is under the
+  cap AND re-validates through the same checks the original item failed
+  (`requireStringList` + the `[src:]` grammar when the item carried a token) — an item with no
+  sentence boundary, or whose split still fails re-validation, is left byte-identical and
+  refused exactly as before, including by the existing `plan-fix` round (#288) when applicable.
+  Because the repair runs inside the SAME check pass, a formatting-only over-cap item never
+  even reaches that bounded, paid round. `CheckOutcome` grows an additive `repairs?` field
+  (`src/core/run/checks.ts`), surfaced on the stage's own report line and on the
+  `check.passed`/`check.failed` event — the same "an auto-repair must be visible" owner
+  decision (2026-09-15) #345's Watch repair already follows.
+- **A retry of a failed single-agent stage whose declared outputs are already complete and
+  valid on disk settles at $0.00 instead of buying a fresh turn to reproduce them (see #353,
+  part of #345 family).** MEASURED first: `runStage`'s headless path called `spawnAgent`
+  unconditionally on every re-entry — `validateOutputs` was only ever reached from
+  `finishStage`, AFTER a turn was dispatched and paid for, so a stage that failed for a reason
+  unrelated to its declared outputs (a `checks:` failure since fixed by hand, a timeout after
+  the last file was flushed) bought a full fresh turn to redo work already on disk. Now, on
+  re-entry to a stage whose `status` is already `"failed"` (never a first attempt, and headless
+  mode only — never `--prepare`/`--commit`, never `--dry-run`), `trySettleFromDisk` runs
+  `validateOutputs` against what is already there and, when the stage declares any `checks:`,
+  runs them for real too (they are local — free to run, and a checks failure there means the
+  "already finished" premise is false and a real turn is still owed, exactly as today). Only
+  when BOTH clear does the stage settle: one task row (`status: "done"`, `cost_usd: 0`,
+  `model: null`, `session_id: null`) carrying the additive `settled_from: "prior-attempt
+  outputs"` (`RunFile.ts`, and `emitRunYaml.ts`'s hand-written task emitter, which needed the
+  new key taught to it the same way #375's `exit_disagreement` did), and a matching
+  `agent.result` event — named on the stage's own report line too, never silently. Any problem
+  falls straight through to the ordinary spawn path, unchanged. **Pre-merge review
+  (2026-09-18): structurally valid files are not proof of finished work when the agent that
+  wrote them reported the failure itself.** `trySettleFromDisk` now refuses to settle before
+  even looking at disk when the prior attempt's own task row names an agent-reported
+  `failure_kind` (`AGENT_REPORTED_FAILURE_KINDS`, `spawnAgent.ts`: `result_error`,
+  `malformed_result`, `empty_result`, `asked_no_diff`), `unclassified`, an absent kind on a
+  `"failed"` row, or `non_zero_exit` whose own `error` text shows a result document that parsed
+  and disagreed with itself (`… with is_error=true: …`) — only a `checks:`-only failure or the
+  wall dying on it (`timeout`, `process_killed`, `rate_limit`, or a clean `non_zero_exit` with
+  nothing parseable) settles. Named on the report line as `prior attempt reported <kind>;
+  spawning`. A knob two `run auto` retry-counting test fixtures grew to work around the
+  original, too-permissive settle is removed along with it — the failure-kind gate alone keeps
+  their canned "fails then succeeds" spawns real, which is the smaller, more honest fix.
+
+### Changed
+
+- **A turn killed by the provider's rate limit with no attested `rate_limit_event` frame can
+  now be classified `rate_limit` from its raw text (part of #341).** `describeFailure`'s
+  residual `unclassified` bucket now checks stdout/stderr against a small exported regex
+  (`RATE_LIMIT_TEXT_RE`) for the REPORTED (not measured — no raw capture of a turn that
+  actually died against the wall exists in this repo) shape of a session-limit API error
+  before giving up; it never overrides a more specific cause (timeout, a kill signal, a
+  malformed envelope, a named error or subtype disagreement). The frame-attested capture
+  #341 actually asks for still does not exist — this narrows the "no reason named" bucket,
+  it does not close the issue.
+- **`renderFacts`'s rendered list — Build's `### Facts already on record` and the `{{facts}}`
+  template value alike — sits under a byte ceiling (`DEFAULT_FACTS_MAX_BYTES`, 32 KB) for the
+  first time (see #216).** Previously unbounded: one measured section reached 123,938 B, 57% of
+  a 218 KB bundle. Over the ceiling the list is cut on a WHOLE fact, never mid-word (#161), and
+  the cut is named on the page rather than silently dropped.
+- **What and How stop receiving `.tldrx/memory/facts.yml` raw — an INDEX rides in its place
+  (owner decision "Index", 2026-09-18; see #216).** Measured on a 120-fact fixture ledger: a
+  48,150 B `## Inputs` entry became a 17,490 B index (63.7% smaller), one line per live fact —
+  `- [F<n>] <area> · <first ~120 chars>…` — with a closing pointer at the file for the full
+  text. Build and Watch declare the same input in their `stage.yml` too but read facts through
+  their own executors, never `inlineInputs`, so they are unaffected — measured, the declaration
+  there was already unused. The `## Inputs` preamble marks the summarised file with its own
+  sentence instead of the "nothing else to find" line that would otherwise contradict
+  what/how's own prose telling the agent to grep the real file.
+
+### Fixed
+
+- **The Build executor's `ExecutorTask` rows never copied `AgentOutcome.failureKind` across, so a
+  Build developer or reviewer turn that died with a classifiable cause carried no
+  `failure_kind` on its `run.yml` row (see #357, see #348).** `ExecutorTask.failureKind` and
+  its `recordExecutorTasks` mapping already existed; the four `this.tasks.push` sites in
+  `executors/build.ts` were the only thing not copying it. The spawned-developer and
+  spawned-reviewer sites (and the format-retry row beside them) now do; the two HOST-turn
+  push sites, which have no `AgentOutcome` to read a kind off, are unchanged and continue to
+  leave the key absent rather than guess one. `test/build-golden.test.ts`'s `rounds-run-tasks.txt`
+  golden is regenerated ON PURPOSE — a failed developer's row in that fixture now carries
+  `failure_kind: "non_zero_exit"`, which it did not before; this is the change this commit
+  means, not a drift.
+- **A spawned turn whose result document said `subtype: "success"` but whose process exit
+  code disagreed settled as a stage failure — costing a full `run auto` relaunch for work
+  that was already done (see #375, see #348).** Measured on a live autonomous run: a watch
+  developer wrote its declared output, `claude` exited 1 with `is_error: true`, and the
+  result document's own `subtype` said `"success"`; the facilitator classified this as
+  `unclassified` ("no reason named (the provider's own subtype said "success")") and `run
+  auto` spent one of five relaunches re-running work attempt 1 had already finished. The
+  three headless spawn sites in `runNext.ts` now settle the turn as `done` — recording the
+  disagreement as an additive `exit_disagreement` note on the row and the `agent.result`
+  event — whenever every output the stage declared is on disk and non-empty at the moment
+  the verdict is taken (`exitDisagreement.ts`'s `settleExitDisagreement`, one derivation,
+  called from all three rather than pasted three times); a turn missing even one declared
+  output stays `failed` under its ordinary `failure_kind`, exactly as before. The Build
+  executor's `spawnDeveloper` path has the same exit/subtype disagreement shape but no
+  per-story declared-outputs list to check existence against, so it is deliberately left
+  out of this change — see the follow-up draft at
+  `scratchpad/issue-draft-375-build-spawndeveloper-exit-disagreement.md`.
+- **`FactsStore.append` dedupes on normalised text, so re-running a driver's import or
+  `tldrx facts add` on the same sentence no longer mints a second row (see #216).** Both
+  writers — `captureAnswers` and `tldrx facts add` — now get the existing live fact back
+  (`duplicate: true`) instead of a new one when the incoming text, trimmed/whitespace-
+  collapsed/case-folded, matches a LIVE fact's; a retired or superseded twin does not block a
+  fresh assertion of the same text. `facts add` prints "`<id>` is already on record" and exits
+  0 rather than writing a duplicate.
+- **`merge-wave.sh`'s #336 immutability guard no longer prints `printf: write error: Broken
+  pipe` once per dated CHANGELOG section (see #380).** Its `changelog_section()` awk helper
+  `exit`ed as soon as it saw the NEXT `## ` heading, while the `printf | changelog_section`
+  pipe feeding it the pre-merge CHANGELOG was still writing the rest of the file — so the
+  writer could get EPIPE (measured live: 45-46 lines of noise per wave, once per dated
+  section that was not the last one in the file). `exit` is now `p = 0`: the awk process
+  keeps consuming to EOF instead of closing its end of the pipe early, so the writer always
+  finishes; the guard's own verdict (`$WAS`/`$NOW`) is unchanged.
+- **`emitFactsYaml` writes `facts: []` for an empty list instead of a bare `facts:` line (see
+  #383).** Both YAML readers behind the runtime seam parse a key with nothing after it as
+  `null`, not `[]`, so a facts.yml with zero facts never round-tripped — `FactsStore.save()`
+  re-validates its own serialized output before writing and threw on exactly this file,
+  `refusing to write an invalid facts.yml: facts expected an array, got null`. Latent until
+  now (every shipped writer appends a fact before calling `save()`), but reachable from any
+  fresh `FactsStore.loadOrEmpty(...).save()` with nothing appended; non-empty output is
+  unchanged.
+- **Watch's kept-card pre-pass (#306) never got the `[src:]` mechanical repair the
+  validation loop a few lines below it already had, so a card left on disk with only a
+  punctuation slip — the marker missing its space, a token sitting mid-sentence, an ASCII
+  `->` in a `cmd` source — re-spawned a writer for text a script already knows how to fix
+  (see #351, part of #345).** `keptCard` now runs the same `repairSrcSyntax` before its
+  `parseWatcherCard` check: a repair that turns an invalid card valid is written back to
+  disk and the feature is kept, at $0.00, with the repair named on the stage's own report
+  line the same way the validation loop names its own. A card that stays invalid after
+  repair is still not kept (today's behaviour, byte-identical file); a card already valid
+  needs no repair and is never rewritten.
+
 ## 0.35.0 — 2026-09-17
 
 ### Fixed

package/README.md

@@ -335,6 +335,7 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.36.0 | 2026-09-18 | `beta` | Wave six, the P1 cost and autonomy backlog, every branch reviewed before main: facts.yml stops riding whole into every prompt (a one-line index for what/how, a named byte ceiling for Build, dedupe at append and `tldrx facts dedupe`, the facts share visible in the context ledger); a headless turn whose exit code disagrees with its own `subtype: success` settles as done with the disagreement recorded instead of buying a relaunch; Build rows carry `failure_kind`; a rate-limit death is classified from its raw text; three more savings before a paid turn — kept Watch cards get the `[src:]` repair, over-cap acceptance items are split mechanically, and a retry whose prior attempt died by the wall with complete outputs settles at $0, never when the agent itself reported the failure; the plan gate refuses a step that edits a path outside its `touches`; an empty facts ledger round-trips; merge-wave stops spraying Broken pipe — 10 issues |
 | 0.35.0 | 2026-09-17 | `beta` | Wave five of the audited backlog, every branch reviewed before main: a human gate approval whose note names the fixing commit closes that fix-list finding (reachable from the story's own branch, or `claimed-unverified` — never a silent close), a fact keeps a `was_id` alias across an id change, `validateWorkspace` enforces the quote-aware single-argv rule the DoD gate already applied, `tldrx story reopen` refuses a finished or Build-approved run and names the way back, a damaged `budget.yml` reads as absent-with-reason instead of resurrecting a frozen ceiling, the fix list's on-disk door is documented as the human escape hatch, and the public surface stops naming private workspaces — fixtures are synthetic, citations carry neutral labels, and a blanket guard refuses the next one — 9 issues |
 | 0.34.0 | 2026-09-17 | `beta` | Four waves of the audited backlog, every branch reviewed before main: run auto no longer stops itself (parked auto gates self-close, Build parks at a story boundary on budget), gates cannot sign stale or backdated evidence, interrupted turns bank their cost as absent instead of a measured zero, the boundary condition diffs the branch the run recorded, mutating generators are refused from dod blocks, merge-wave refuses edits to released CHANGELOG sections and answers `unknown` instead of `idle`, and the test harness refuses a TMPDIR inside a work tree — 14 issues, the first of them shipped end-to-end by a tldrx run against this repo |
 | 0.33.0 | 2026-09-17 | `beta` | Six follow-ups from the 0.32.0 cycle, each measured on the second unattended run (run #42) or on the review that shipped it. The plan sequencing rule counts a bare camelCase field only when it is unambiguous or the plan spells it elsewhere as snake_case or in backticks, so unrelated stories sharing a word like `toString` no longer refuse each other (#370); `task.done` clamps an oversized `as_is_note` the way it clamps `permission_refused` (#368); the asked-no-diff and red-DoD requeues settle through one helper that takes data (#369); a workspace can opt its base pre-flight probe into a story-shaped worktree with `probe_in_worktree: true`, and the Build-entry probe runs `tool_restore:` first (#371, the remainder of #363); AGENTS §11 names the negated closing verb that still auto-closes and widens the pre-wave grep (#372); and CI keeps merge-wave's sandboxes on failure so the next #237 red carries its `merge.log` (#373). Minor release: a new workspace field and a new plan refusal shape. |

package/dist/hooks/answer-capture.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import {
   conflictOf
-} from "./chunk-hpeazv3q.js";
+} from "./chunk-sqkp3405.js";
 import {
   FactsStore,
   formatJaccard
-} from "./chunk-0nh8p76n.js";
+} from "./chunk-fbn9q035.js";
 import {
   parseHookInput,
   readStdin
-} from "./chunk-chmh9vva.js";
+} from "./chunk-73h7hmfx.js";
 import"./chunk-ae6bkfs5.js";
 import {
   EventLog,
   PHASE_ID_RE
-} from "./chunk-4hxdn67p.js";
+} from "./chunk-6cptynke.js";
 import {
   PHASE_IDS
-} from "./chunk-gbrgvhjc.js";
-import"./chunk-jp88kw3z.js";
+} from "./chunk-mx1g05pq.js";
+import"./chunk-gqfbnr1h.js";
 import {
   ADVISORY_KEY,
   MAX_FACT_CHARS,
@@ -28,7 +28,7 @@ import {
   renderQuestionBlock,
   replaceBlock,
   serializeQuestions
-} from "./chunk-qzabvwj1.js";
+} from "./chunk-7p9vw1s2.js";
 import {
   ITERATION_ONLY_SLOT,
   PROJECT_FRAMEWORK_DIR,
@@ -38,7 +38,7 @@ import {
   isScopedTemplate,
   parseYaml,
   scopedSlotOf
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/hooks/answer-capture.ts
 import { existsSync as existsSync5 } from "fs";
@@ -466,7 +466,7 @@ function captureAnswers(questionsPath, ctx) {
       const prov = answerProvenance(block, ctx.overrides, ctx.repoNames, []);
       const text = factTextFor(block.title, block.answer);
       const clash = conflictOf({ match: block.title, area, text }, store.active);
-      const fact = store.append({
+      const { fact, duplicate } = store.append({
         fact: text,
         ...truncated ? { truncated: true } : {},
         ...clash === null ? {} : { conflicts_with: [clash.fact.id] },
@@ -489,15 +489,16 @@ function captureAnswers(questionsPath, ctx) {
         cost_usd: 0,
         payload: { q: block.id, answer: block.answer, fact: fact.id }
       });
-      log.tryAppend({
-        ts: ctx.at,
-        run: ctx.run,
-        stage: null,
-        type: "fact.added",
-        actor: ctx.actor,
-        cost_usd: 0,
-        payload: { fact: fact.id, area: fact.area, kind: fact.kind, q: block.id }
-      });
+      if (!duplicate)
+        log.tryAppend({
+          ts: ctx.at,
+          run: ctx.run,
+          stage: null,
+          type: "fact.added",
+          actor: ctx.actor,
+          cost_usd: 0,
+          payload: { fact: fact.id, area: fact.area, kind: fact.kind, q: block.id }
+        });
       captured.push({
         q: block.id,
         fact: fact.id,

package/dist/hooks/budget-gate.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import {
   budgetGateDeny
-} from "./chunk-mgjrgmvg.js";
+} from "./chunk-h543njq3.js";
 import {
   allow,
   deny,
   readPayload,
   runHook,
   toolInput
-} from "./chunk-prj7pysh.js";
-import"./chunk-chmh9vva.js";
+} from "./chunk-re1efynj.js";
+import"./chunk-73h7hmfx.js";
 import {
   REBALANCE_SOURCE,
   applyRebalance,
@@ -25,12 +25,12 @@ import {
   validateRunBudget,
   wouldExceed,
   wouldExceedHostTokens
-} from "./chunk-gzw2ehqh.js";
+} from "./chunk-kcwv344p.js";
 import {
   EventLog,
   currentActor,
   nowRfc3339
-} from "./chunk-4hxdn67p.js";
+} from "./chunk-6cptynke.js";
 import {
   cursorStage,
   hostTokensIn,
@@ -39,20 +39,20 @@ import {
   newestActiveRun,
   renderRunEconomies,
   runSpend
-} from "./chunk-jr5gmwq5.js";
+} from "./chunk-qpy8tgtc.js";
 import {
   buildStageDefaults
-} from "./chunk-gbrgvhjc.js";
+} from "./chunk-mx1g05pq.js";
 import {
   noteDeprecations
-} from "./chunk-qzabvwj1.js";
+} from "./chunk-7p9vw1s2.js";
 import {
   PROJECT_WORK_DIR,
   findWorkspaceRoot,
   locateWork,
   parseYaml,
   stageYamlPath
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/hooks/budget-gate.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "node:fs";

package/dist/hooks/{chunk-4hxdn67p.js → chunk-6cptynke.js}

@@ -2,7 +2,7 @@ import {
   GATE_POLICIES,
   validateGatesPolicy,
   validateStagePolicy
-} from "./chunk-gbrgvhjc.js";
+} from "./chunk-mx1g05pq.js";
 import {
   asDocument,
   isRecord,
@@ -15,7 +15,7 @@ import {
   requireString,
   requireVersion,
   result
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/events/EventLog.ts
 import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";

package/dist/hooks/{chunk-chmh9vva.js → chunk-73h7hmfx.js}

@@ -1,6 +1,6 @@
 import {
   runtime
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/hooks/passthrough.ts
 async function readStdin() {

package/dist/hooks/{chunk-qzabvwj1.js → chunk-7p9vw1s2.js}

@@ -3,7 +3,7 @@ import {
   parseSrcToken,
   srcToken,
   withoutSrcToken
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/text/questions.ts
 var REQUIRED_METADATA_KEYS = ["id", "status", "area", "asked_by", "asked_at"];

package/dist/hooks/{chunk-1vqvq0nm.js → chunk-btr3m70g.js}

@@ -10,7 +10,7 @@ import {
   storyDependsOn,
   tallyOf,
   validateRunBudget
-} from "./chunk-gzw2ehqh.js";
+} from "./chunk-kcwv344p.js";
 import {
   EventLog,
   OUTCOME_NOT_RECORDED,
@@ -24,12 +24,12 @@ import {
   nowRfc3339,
   stageAt,
   validateRunFile
-} from "./chunk-4hxdn67p.js";
+} from "./chunk-6cptynke.js";
 import {
   cursorStage,
   isAttendedByHostView,
   openRunViews
-} from "./chunk-jr5gmwq5.js";
+} from "./chunk-qpy8tgtc.js";
 import {
   backupPathFor,
   isAlive,
@@ -38,13 +38,13 @@ import {
   workspaceRootOfRunDir,
   writeAtomic,
   yamlScalar
-} from "./chunk-jp88kw3z.js";
+} from "./chunk-gqfbnr1h.js";
 import {
   isAdvisory,
   noteDeprecations,
   openBlocks,
   parseQuestions
-} from "./chunk-qzabvwj1.js";
+} from "./chunk-7p9vw1s2.js";
 import {
   FRAMEWORK_ROOT,
   MAX_ITEM_CHARS,
@@ -55,7 +55,7 @@ import {
   parseYaml,
   parseYamlRepairing,
   withoutSrcToken
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/statusline/runSnapshot.ts
 import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
@@ -140,6 +140,8 @@ function task(t, indent) {
     `${inner}started_at: ${yamlScalar(t.started_at)}, ended_at: ${yamlScalar(t.ended_at)},`,
     ...t.stopped_by === undefined || t.stopped_by === null ? [] : [`${inner}stopped_by: ${yamlScalar(t.stopped_by)},`],
     ...t.failure_kind === undefined || t.failure_kind === null ? [] : [`${inner}failure_kind: ${yamlScalar(t.failure_kind)},`],
+    ...t.exit_disagreement === undefined || t.exit_disagreement === null ? [] : [`${inner}exit_disagreement: ${yamlScalar(t.exit_disagreement)},`],
+    ...t.settled_from === undefined || t.settled_from === null ? [] : [`${inner}settled_from: ${yamlScalar(t.settled_from)},`],
     ...t.banked_before_refusal === undefined ? [] : [`${inner}banked_before_refusal: true,`],
     ...t.dedupe === undefined ? [] : [`${inner}dedupe: ${yamlScalar(t.dedupe)},`],
     ...t.duration_ms === undefined ? [] : [`${inner}duration_ms: ${String(Math.round(t.duration_ms))}, ` + `duration_basis: ${yamlScalar(t.duration_basis ?? null)},`],
@@ -665,6 +667,10 @@ var PLAN_SHAPE_RULES = [
   {
     issue: "#365",
     text: "**A story that adds an invariant over EXISTING data lands in the same story as, or in a wave after, the " + "story that makes existing rows and fixtures satisfy it.** A check constraint, a `NOT NULL`, a required " + "field or a validation rule written ahead of the story that populates what it enforces makes that earlier " + "story's own dod structurally red — every fixture the enforcing story's own tests run against still lacks " + "the value, and two stories in the SAME wave run in separate worktrees that never see each other's writes, " + "so 'later wave' is the only way one story's data can satisfy another's rule. If the invariant must land " + "first, write it NON-ENFORCING — nullable, consistency-only, no constraint — and let the later story " + "tighten it once the data exists. The `plan` check refuses a story whose acceptance or test plan names an " + "enforcement over a field a later story's acceptance or test plan names populating."
+  },
+  {
+    issue: "#376",
+    text: "**A story's own body never names an edit of a file its own `touches` forbids.** A step that tells the " + "developer to edit, add, write, create, rename, delete or otherwise change a backtick-quoted path — or to " + "add a bullet under a `## <v> — unreleased` CHANGELOG heading, which is an edit of `CHANGELOG.md` even when " + "the step never spells the filename — is a plan contradicting its own write allowlist: the developer who " + "obeys `touches` correctly leaves the file untouched, and a reviewer has to send the branch back for it. " + "The `plan` check refuses a story whose body names such an edit outside its own `touches`; a step that " + 'only reads or points at a path ("read `x` for the shape") is unaffected.'
   }
 ];
 

package/dist/hooks/{chunk-0nh8p76n.js → chunk-fbn9q035.js}

@@ -3,7 +3,7 @@ import {
   withWorkspaceLock,
   workspaceRootOfFactsPath,
   writeAtomic
-} from "./chunk-jp88kw3z.js";
+} from "./chunk-gqfbnr1h.js";
 import {
   FACT_CONFIDENCES,
   FACT_DECIDERS,
@@ -15,7 +15,7 @@ import {
   isLive,
   isRetired,
   noteDeprecations
-} from "./chunk-qzabvwj1.js";
+} from "./chunk-7p9vw1s2.js";
 import {
   SRC_PATTERNS,
   asDocument,
@@ -28,7 +28,7 @@ import {
   requireString,
   requireVersion,
   result
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/facts/FactsStore.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -227,6 +227,11 @@ function findDuplicate(question, area, facts, threshold = DEFAULT_JACCARD_THRESH
   return best;
 }
 
+// src/core/facts/normaliseFactText.ts
+function normaliseFactText(text) {
+  return text.trim().replace(/\s+/g, " ").toLowerCase();
+}
+
 // src/core/facts/FactsStore.ts
 var NEW_FILE_HEADER = `# .tldrx/memory/facts.yml — durable, provenanced answers (spec §2.5).
 ` + "# Append-mostly: supersede or retire, never edit. A fact without a source is not a fact.";
@@ -271,6 +276,13 @@ class FactsStore {
     return formatFactId(highest + 1);
   }
   append(input) {
+    const target = normaliseFactText(input.fact);
+    const existing = this.rows.find((f) => isLive(f) && normaliseFactText(f.fact) === target);
+    if (existing !== undefined)
+      return { fact: existing, duplicate: true };
+    return { fact: this.appendRaw(input), duplicate: false };
+  }
+  appendRaw(input) {
     const cut = input.fact.length > MAX_FACT_CHARS;
     const fact = {
       id: this.nextId(),
@@ -310,7 +322,7 @@ class FactsStore {
     }
     if (isRetired(old))
       throw new Error(`${oldId} is retired; a retired fact is not superseded`);
-    const replacement = this.append({ ...input, supersedes: oldId });
+    const replacement = this.appendRaw({ ...input, supersedes: oldId });
     this.rows[index] = { ...old, superseded_by: replacement.id };
     return replacement;
   }
@@ -326,6 +338,27 @@ class FactsStore {
     this.rows[index] = retired;
     return retired;
   }
+  retireDuplicate(id, by) {
+    const index = this.rows.findIndex((f) => f.id === id);
+    if (index === -1)
+      throw new Error(`cannot supersede ${id}: no such fact`);
+    const old = this.rows[index];
+    if (old.superseded_by !== null) {
+      throw new Error(`${id} is already superseded by ${old.superseded_by}`);
+    }
+    if (isRetired(old))
+      throw new Error(`${id} is retired; a retired fact is not superseded`);
+    const byIndex = this.rows.findIndex((f) => f.id === by);
+    if (byIndex === -1)
+      throw new Error(`cannot supersede ${id} by ${by}: no such fact`);
+    const target = this.rows[byIndex];
+    if (target.supersedes !== null) {
+      throw new Error(`${by} already supersedes ${target.supersedes}; the reciprocal link is one-to-one`);
+    }
+    this.rows[index] = { ...old, superseded_by: by };
+    this.rows[byIndex] = { ...target, supersedes: id };
+    return this.rows[index];
+  }
   findDuplicate(question, area, threshold) {
     return findDuplicate(question, area, this.active, threshold);
   }

package/dist/hooks/{chunk-jp88kw3z.js → chunk-gqfbnr1h.js}

@@ -1,7 +1,7 @@
 import {
   PROJECT_FRAMEWORK_DIR,
   PROJECT_WORK_DIR
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/lock/workspaceLock.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, rmSync as rmSync2, writeSync, closeSync } from "node:fs";
@@ -174,9 +174,13 @@ function emitFactsYaml(file, header) {
   if (header !== undefined && header !== "")
     out.push(header.replace(/\n$/, ""));
   out.push(`version: ${file.version}`);
-  out.push("facts:");
-  for (const fact of file.facts)
-    out.push(emitFact(fact));
+  if (file.facts.length === 0) {
+    out.push("facts: []");
+  } else {
+    out.push("facts:");
+    for (const fact of file.facts)
+      out.push(emitFact(fact));
+  }
   return `${out.join(`
 `)}
 `;

package/dist/hooks/{chunk-mgjrgmvg.js → chunk-h543njq3.js}

@@ -3,7 +3,7 @@ import {
   EMPTY_SECTION_RULE,
   noneBullet,
   srcRule
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/hooks/lib/messages.ts
 var GRAMMAR = "[src: <repo:path:line> | https://… | Q<n> | F<n> | $ <cmd> → exit <n> | graph:<node> | absent:<path>]";

package/dist/hooks/{chunk-gzw2ehqh.js → chunk-kcwv344p.js}

@@ -1,6 +1,6 @@
 import {
   STAGE_TUNING_DEFAULTS
-} from "./chunk-gbrgvhjc.js";
+} from "./chunk-mx1g05pq.js";
 import {
   MAX_PLAN_STORIES,
   MAX_STORIES_PER_WAVE,
@@ -26,7 +26,7 @@ import {
   requireVersion,
   requireVersion1,
   result
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/budget/spentFigure.ts
 var SPENT_BASES = ["lower-bound", "complete"];
@@ -680,6 +680,7 @@ function stackExpertNames(root, repos) {
 
 // src/core/facilitator/prompt.ts
 var MAX_PREVIOUS_ATTEMPT_BYTES = 32 * 1024;
+var DEFAULT_FACTS_MAX_BYTES = 32 * 1024;
 
 // src/core/text/srcGrammarContract.ts
 var KINDS = {

package/dist/hooks/{chunk-gbrgvhjc.js → chunk-mx1g05pq.js}

@@ -6,7 +6,7 @@ import {
   isRecord,
   loadWorkspace,
   parseYaml
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/core/run/workflowPreset.ts
 import { existsSync, readFileSync } from "node:fs";

package/dist/hooks/{chunk-jr5gmwq5.js → chunk-qpy8tgtc.js}

@@ -1,7 +1,7 @@
 import {
   listRunDirs,
   parseYaml
-} from "./chunk-1thvqqp8.js";
+} from "./chunk-d2g7h2qb.js";
 
 // src/hooks/lib/runFile.ts
 import { existsSync, readFileSync } from "node:fs";

package/dist/hooks/{chunk-prj7pysh.js → chunk-re1efynj.js}

@@ -1,7 +1,7 @@
 import {
   parseHookInput,
   readStdin
-} from "./chunk-chmh9vva.js";
+} from "./chunk-73h7hmfx.js";
 
 // src/hooks/lib/decide.ts
 function deny(reason) {

package/dist/hooks/{chunk-hpeazv3q.js → chunk-sqkp3405.js}

@@ -1,15 +1,15 @@
 import {
   findDuplicate
-} from "./chunk-0nh8p76n.js";
+} from "./chunk-fbn9q035.js";
 import {
   evidencePath,
   gateEvidencePath,
   parseEvidence
-} from "./chunk-4hxdn67p.js";
+} from "./chunk-6cptynke.js";
 import {
   openBlocks,
   parseQuestions
-} from "./chunk-qzabvwj1.js";
+} from "./chunk-7p9vw1s2.js";
 
 // src/core/distill/distill.ts
 var CONFLICT_THRESHOLD = 0.6;

package/dist/hooks/{chunk-2yedmja1.js → chunk-y0bk666d.js}

@@ -1,6 +1,6 @@
 import {
   toolInput
-} from "./chunk-prj7pysh.js";
+} from "./chunk-re1efynj.js";
 
 // src/hooks/lib/wouldBe.ts
 import { existsSync, readFileSync } from "node:fs";