tldr-experts 0.9.0 → 0.9.2

package/CHANGELOG.md

@@ -1,6 +1,187 @@
 # Changelog
 
 
+## 0.9.2 — 2026-09-07
+
+### Changed
+
+- **The Build executor is no longer one 4,351-line file.** `BuildSession` was a single class
+  (`:520-3833`) over five subjects — the story pipeline, the reviewer handshake, the fix-list
+  round, the base-tree pre-flight and the worktree/branch mechanics — and the methods that
+  reached three or more of them were the ones every change had to touch. That is not an
+  aesthetic complaint: every remaining hardening fix lands inside this file, and a 4,000-line
+  diff context is exactly where the review loop is weakest, because the reviewer reads the
+  change and cannot see what the change sits next to. Eight modules now hold the machinery —
+  `build/reviewLedger.ts` (`events.jsonl` read once into the bounds a fresh process cannot
+  remember), `build/phaseCost.ts` (the handoff's cost line), `build/caps.ts` (the money
+  constants and every ceiling), `build/dodRunner.ts` (the story DoD and the #41 base
+  pre-flight), `build/worktrees.ts` (the git side of a story), `build/branchClaims.ts` (which
+  epic branch this run owns and the two refusals that protect the tree), `build/reviewBundle.ts`
+  (the reviewer's bundle on disk) and `build/reviewRound.ts` (one review round, one reviewer
+  prompt) — each taking DATA rather than the session, which is the rule the rest of
+  `src/core/build/` already kept without exception. The mutable state the orchestrator used to
+  hide in private maps is now explicit and passed in: `PreflightCache`, `EpicState` and
+  `ReviewCounters` — three counters of three different things, reset on three different events,
+  still never merged. `executors/build.ts` is down to ~2.9k lines and keeps the orchestration: the
+  entry points, the wave drivers, the story-state cluster, the log and handoff cluster, the
+  refusal helpers and `SerialQueue`. Nothing moved that a caller can see — every symbol anything
+  imports is still exported from `executors/build.ts`, so the nine importing test files,
+  `run/reopenStory.ts` and `facilitator/index.ts` did not change one line of import (the
+  re-exports nothing imported were dropped rather than carried, which is the opposite of drift).
+  The one test edit is a widening: `build-executor.test.ts`'s #134 pin that no file builds a
+  `story/${…}` name by hand now reads `worktrees.ts` and `branchClaims.ts` too, because a
+  NEGATIVE pin on one file gets weaker every time code leaves it.
+  Zero behaviour change, and it is proved rather than argued. A golden guard captured before the
+  first move — `test/build-golden.test.ts`, 18 committed artifacts across three scenarios that
+  cannot stand in for one another — freezes byte for byte the developer prompt, the reviewer
+  prompt, the `--prepare` bundle's own prompt, the ordered event stream with its payload keys
+  and values, `run.yml`'s task rows and the exit codes of a real fake-agent build, and every one
+  of the five move steps — and the surface-polish pass after them — had to keep it identical. It
+  is kept, because it is the cheapest regression net this file has ever had. The rule while the
+  wave ran, and the rule now: a golden byte change means REVERT — never "update the golden" to
+  make a diff go away.
+
+## 0.9.1 — 2026-09-06
+
+### Added
+
+- **The docs site carries the whole CLI, generated from the registry.** The site's
+  `reference/cli.md` was a curated map that named about half the flags and pointed at
+  `docs/guide/08-cli-reference.md` for the rest — a file the site never builds, because
+  `docs/` is not in its `srcDir`. So the "exhaustive version" was not on the website at all,
+  and the owner went looking for `--yolo`, the flag that drops per-tool permission prompts,
+  and found it only in the changelog. `docs-site/scripts/gen-cli.ts` now writes
+  `/reference/cli-flags` and `/es/reference/cli-flags` at build time out of
+  `src/cli/helpText.ts` — all 33 commands, every flag with its meaning, every allowed value
+  spelled out from where it is enforced, every exit code, the environment variables, and the
+  rules that hold everywhere. Generated, gitignored and never hand-edited, for the same
+  reason the changelog page is: a second copy of 180 flags drifts on its first edit. The
+  Spanish page is framed in Spanish and keeps the meanings in English, like the release notes
+  and the sample CLI strings.
+- **`test/docs-cli-coverage.test.ts` — the docs are now a gate.** Nothing asserted that a
+  declared flag was EXPLAINED anywhere a reader who is not typing `--help` would look. It now
+  asserts both surfaces: the repo guide names every flag inside its own command's section,
+  and the generated page carries every command, flag, allowed value and exit code, with
+  `--yolo` explained on each of the four commands that take it rather than left bare in a
+  usage line. It also holds the env-var table against a grep of `src/` in both directions.
+- **`tldrx facts add` — the command the drive mandate has been naming since 0.8.0 (#161).** The
+  mandate tells the driver "a fact that must outlive the turn is `tldrx facts add`, which every
+  later prompt DOES read", and no such command was dispatched. What drivers did instead was edit
+  `.tldrx/memory/facts.yml` by hand, which walks past `FactsStore.append`'s 2000-character cap,
+  past its `…` marker and its `truncated: true` flag, and past `save()`'s validation — and a
+  fact cut mid-word with no marker is a record that does not know it is incomplete. It writes
+  through the store, under the workspace lock, with `--area` and `--decided-by owner|driver`
+  both required — a driver's default is never cited as the owner's decision, so the command
+  never lets the caller skip saying which of the two it was. The underlying `source.decided_by`
+  field stays additive (rows written before it existed, or by another writer, still validate)
+  and renders in every `{{facts}}` block as `· decided by owner` / `· decided by driver`,
+  appended only when present. Without `--run` it uses the one open run and refuses to guess
+  between several, recording the absence with its reason.
+- **The provider's token split on the `run.yml` task row (#159).** `input_tokens` and `output_tokens`
+  were parsed on every provider turn and reached the event log only, so `run.yml` — the file
+  every cost report and every resumed run reads — carried a dollar figure with no token figure
+  beside it, which is a number nobody can check against a price table. Both fields are additive,
+  written only when a turn reported them and only together — a half-reported split is exactly
+  as unverifiable as an absent one, so it is dropped rather than have the parse's own zero
+  default stand in for a real count — and distinct from `tokens`, which keeps its meaning as a
+  host declaration. `version: 1` is unchanged and every older row loads.
+
+### Fixed
+
+- **Two commands the docs told you to run that do not exist.** `tldrx facts add` was
+  instructed three times, in `07-claude-code.md`, `10-unattended-mode.md` and
+  `08-cli-reference.md`, as the way to record something that must outlive a turn — measured:
+  `tldrx facts` is `unknown command 'facts'`, exit 1. A row in `.tldrx/memory/facts.yml` is
+  written by answering an open question, so all three now say `tldrx answer <Qid> "…"`. And
+  the environment-variable section told you to check that `TLDRX_CLAUDE_BIN` took with
+  `tldrx run --dry-run`; `--dry-run` is `next`'s flag, not `run`'s. The guard that found them
+  is now part of the suite: every `tldrx …` line inside a code span or a fenced block, on
+  every page of the site and the guide plus the README, is parsed and held against the
+  registry — an unknown command or a flag its command does not declare fails the build.
+- **Two flags the guide never documented**, found by that test on its first run:
+  `tldrx dashboard --serve` (the default mode, and half of the two-modes refusal that
+  `--static` is the other half of) and `tldrx run status --verbose` (the two instants behind
+  a gate row). Both were real, both were reachable, and neither appeared in the page that
+  claims to be exhaustive. The shared spawn flags — `--model`, `--effort`, `--max-usd`,
+  `--ui`, `--prepare`/`--commit`, `--yolo` — now point from `run auto`, `seed triage` and
+  `expert train` at the one place they are explained, instead of appearing as bare tokens in
+  a usage line.
+- **A turn with no provider USD figure is unmetered, not a metered `$0.00` (#159).** `interpret`
+  wrote `cost_usd: 0, metered: true` for a Claude result document that carried no
+  `total_cost_usd` — contradicting the `metered` field's own contract three lines above it, and
+  letting a stage, and then a whole run, read `$0.00` after real turns had run. `metered` is now
+  derived from the presence of the figure, so those turns reach `cost_usd: null` +
+  `metered: false` and every report that already knows how to say "LOWER BOUND, not a total"
+  says it. No new `spendBasis` word: `absent` already meant this, and the fix is to make more
+  turns reach it honestly. Codex keeps its pin — its synthesized result document carries a
+  `total_cost_usd: 0` that is a placeholder, and reading it as a measurement would be the same
+  lie under a different provider.
+- **A refusal no longer discards a cost (#159).** `tldrx next --commit` returned
+  `EXIT_AGENT_FAILED` on a `questions.md` the §2.7 parser cannot read BEFORE it recorded the
+  task — so a turn that had already been paid for left no row anywhere, and the run's own ledger
+  was short by exactly the amount nobody could see. The row lands first and the refusal exits
+  after it. Because that refusal deliberately leaves the stage `running` so the operator can fix
+  the file and re-run, the banked row is marked `banked_before_refusal`, and the re-run is
+  matched to it by session id, declared cost and outputs — against MARKED rows only, so an
+  ordinary attempt a gate sent back is never mistaken for a re-read. Two things it deliberately
+  does NOT do. A result with no `session_id` is never fingerprinted at all: a null id identifies
+  nothing, so the second turn gets its own row carrying `dedupe: "none — no session id"` and the
+  reason is in `run.yml`, not only on the console — recording it twice is a smaller lie than
+  dropping a turn that ran. And the marker is single-use: the re-run that matches it stamps the
+  row `matched by the re-run committed at <at> — the marker is spent`, because a marker left
+  armed matched every later turn of the same shape for the life of the stage, and a real retry
+  after a gate reject — same session, same outputs, the same `null` cost — was silently dropped
+  as already recorded.
+- **An oversized reviewer verdict no longer takes the whole invocation's ledger with it
+  (#160).** The 4096-byte payload cap was enforced by `EventLog.append` throwing, nothing
+  wrapped the executor call, and the reviewer's verdict prose is the field that overflows — so
+  one wordy review escaped past `recordExecutorTasks` and `store.save()`, leaving the epic merge
+  on disk and every task's cost gone from `run.yml`. The cap is honoured, never raised: at the
+  emit seam the oversized `detail` becomes `detail_omitted`, carrying its own byte count and
+  pointing at a sidecar the seam wrote FIRST — `<phase>/log/overflow/<stamp>-<n>-<type>-detail.txt`,
+  one file per omission — while the verdict itself survives. It is not the review log: that file
+  does not exist yet when the event is built, it later holds only the final verdict's prose, and
+  a story that does not settle never gets one, so pointing at it was a promise about a file that
+  might never arrive. Around all of it, the executor call is now wrapped: ANY throw out of an
+  executor exits 5 with the stage failed by name and the loss said plainly — which rows this
+  invocation could not recover — where before the throw simply escaped, leaving the stage
+  `running` in a file nobody saved. It attributes that failure to nothing it did not do, either:
+  the row it marks `failed` is one THIS invocation recorded, so a retry whose executor throws
+  leaves the previous attempt's `done` turn exactly as it was rather than repainting it with an
+  error it never produced.
+- **A cached red base is no longer trusted forever (#162).** `04-build/preflight.yml` was
+  invalidated only by a base-sha comparison that no-ops when either sha is empty, and
+  `checked_at` was written and never read — so a red measured once came back from every later
+  `--prepare` in 0 seconds, over a base a live probe would show green, and the
+  `.tldrx/workspace.yml` fix that the refusal itself asks the operator to make was the one thing
+  the cache could not see. A red is now re-probed when the command hash differs, when the row is
+  older than 30 minutes, or always under `--prepare`. The hash covers the command together with
+  the workspace's whole declared command list, because the command string was already the join
+  key and hashing it alone would have changed nothing. A cached green keeps the rule it had, and
+  both new row fields are additive — an absent one invalidates nothing.
+- **`tldrx facts add --run <id>` no longer invents an absence.** `RunStore.resolve` answers
+  `{kind: "none"}` both to "no run is open" and to "there is no run by that id", and the command
+  took the one branch for both: a typo'd `--run` wrote the fact with `source.run: null` under the
+  stdout line "no run recorded: no open run to attribute it to" — a sentence that is false
+  whenever a run IS open, over provenance the operator had asked for by name and silently did not
+  get. An id nothing in `tldrx-work/` answers to is now refused before the store is opened: exit
+  3, nothing written, no event, and the id named back. The other two branches are unchanged —
+  one open run is used, several are still never guessed between.
+- **A fix list records the canonical 40-hex sha (#163).** `Resolved: yes <sha>` accepted 7-40
+  hex, so a sha that had lost a character read as a deliberate abbreviation: git resolved it,
+  the claim verified, and the audit record kept a form no later reader can tell from a prefix of
+  a different commit. The grammar is unchanged — demanding 40 would refuse the abbreviation a
+  person legitimately types — and the full object id is written back after the verification,
+  which is strictly stronger and refuses nobody.
+
+### Changed
+
+- **A command's subcommands are declared once.** They were written in the command module AND
+  needed by the docs generator, which would have made three copies of the same list. They now
+  live in `helpText.ts` beside the flags that are scoped by them, `subcommandsOf(name)` reads
+  them, and `Command.subcommands` is gone — one derivation, one implementation, per the house
+  invariant that the rest of the repo is already held to.
+
 ## 0.9.0 — 2026-09-06
 
 ### Added

package/README.md

@@ -251,7 +251,7 @@ Most run-targeting commands take the id either way, a positional `<run>` or `--r
 `cost`, `note`, `gate template`, `questions`, `budget show`, `ship`, `tickets`, and `run attend` ·
 `status` · `estimate` · `auto` · `unlock` · `cancel`. `replay` and `retro` take the positional only
 — `--run` there is an unknown flag. `approve`, `reject`, `answer`, `interview`, `plan`,
-`story reopen`, `watch` and `run gates set` take `--run <id>` only.
+`story reopen`, `facts add`, `watch` and `run gates set` take `--run <id>` only.
 
 `tldrx retro --all` goes the other way: it reads **every** run in the workspace and prints one
 table of what keeps catching you — finding class × count × how many runs × one example with its
@@ -314,6 +314,8 @@ back on the registry is 0.3.0.
 
 | Version | Date | Status | Contains |
 |---|---|---|---|
+| 0.9.2 | 2026-09-07 | `beta` | the Build executor decomposed: 4,351 lines became an orchestrator plus eight modules under src/core/build/ (review ledger and phase cost, money caps, the DoD runner with its preflight cache, worktrees and epic-branch claims, the reviewer bundle and review round) — a pure refactor proven byte-for-byte by a golden guard over prompts, ordered events, run.yml rows and exit codes across three scenarios; no behaviour changed, every remaining hardening fix now lands in a file a reviewer can hold |
+| 0.9.1 | 2026-09-06 | `beta` | records and money that do not lie: a turn without a provider USD figure is unmetered, never a metered $0.00; a refusal no longer discards the turn's cost (banked first, deduped only against marked rows); an event over the 4096-byte cap spills its text beside the run and names it instead of losing every row of the invocation; preflight rows carry `command_hash` and their own `checked_at`, so a cached red is re-probed when the command changed, after 30 minutes, or under --prepare; the fix list writes back git's canonical 40-hex sha; `tldrx facts add` exists with owner/driver attribution rendered in prompts; run.yml rows carry the provider's token split only when reported |
 | 0.9.0 | 2026-09-06 | `beta` | opt-in stack packs: four language pack bodies and thirteen framework overlays detected from manifests, interrogative by default (Defaults yield to any repo signal, Checks are questions with `verify:` hints), behind one per-project switch (`tldrx expert packs enable`) that materialises into `.tldrx/experts/<lang>-stack/` without touching trained knowledge; the Build reviewer gets `## Stack checks (the repo's own conventions win)`; every stage names the project's `.claude/skills` and the developer may invoke them; workspace.yml records overlays with evidence and skills with a tracked flag, `version: 1` unchanged |
 | 0.8.0 | 2026-09-04 | `beta` | the unattended mandate learns to keep going: a `## Do not stop` section that defines the one thing allowed to end a run early (a strict blocker, named against the work it does not block), product questions parked as **guided** ones with lettered options and a pre-declared fallback, and a budget stop that asks instead of halting — written against 26 `budget.raised` and 26 `question.answered` events on a real ten-run workspace where the owner had to re-authorise "unattended" mid-run. Plus `tldrx drive --tldr`: a reporting contract for runs nobody will audit — the `run status` block plus three bullets of delta, no operator notes, minimal gate evidence, handoffs trimmed of prose but never of the citations `claim-sources` gates on. The ask channel stays the console and the framework names no chat vendor |
 | 0.7.0 | 2026-09-03 | `beta` | Codex as a second honest automated runner: recorded JSONL contract, structured envelopes, role-based sandboxes, token/session provenance, and explicitly unmetered USD accounting; Claude remains the default and the pilot harness. Also absorbs the citation-honesty work previously staged as 0.6.2: a `file` src resolves against the branches the run RECORDED and NAMES the unmerged ref instead of passing in silence or breaking with the temp dir (#140), watcher cards name it the same way (#143), and every run close reports the questions nobody answered (#141) |

package/dist/hooks/answer-capture.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   FactsStore
-} from "./chunk-ecfqpeyj.js";
+} from "./chunk-f6484ykg.js";
 import {
   parseHookInput,
   readStdin
@@ -9,9 +9,9 @@ import {
 import {
   EventLog,
   PHASE_ID_RE
-} from "./chunk-b9rjx4qc.js";
+} from "./chunk-fv66tdsm.js";
 import"./chunk-5w5eg00k.js";
-import"./chunk-6405vkzk.js";
+import"./chunk-8awygmqw.js";
 import {
   MAX_FACT_CHARS,
   detectAnswered,
@@ -19,7 +19,7 @@ import {
   recordAnswer,
   replaceBlock,
   serializeQuestions
-} from "./chunk-37fwvg3x.js";
+} from "./chunk-vyvjbbmb.js";
 import"./chunk-39zh2e44.js";
 import {
   PROJECT_WORK_DIR,

package/dist/hooks/budget-gate.js

@@ -29,15 +29,15 @@ import {
   validateRunBudget,
   wouldExceed,
   wouldExceedHostTokens
-} from "./chunk-c4p5x1b4.js";
+} from "./chunk-hg43zexg.js";
 import {
   EventLog
-} from "./chunk-b9rjx4qc.js";
+} from "./chunk-fv66tdsm.js";
 import"./chunk-rrkdfk7s.js";
 import"./chunk-5w5eg00k.js";
 import {
   noteDeprecations
-} from "./chunk-37fwvg3x.js";
+} from "./chunk-vyvjbbmb.js";
 import"./chunk-39zh2e44.js";
 import {
   PROJECT_WORK_DIR,

package/dist/hooks/{chunk-6ytv36jd.js → chunk-4w03q2kj.js}

@@ -7,7 +7,7 @@ import {
   nowRfc3339,
   openRunViews,
   validateRunBudget
-} from "./chunk-c4p5x1b4.js";
+} from "./chunk-hg43zexg.js";
 import {
   EventLog,
   asRunFile,
@@ -19,7 +19,7 @@ import {
   isTerminal,
   stageAt,
   validateRunFile
-} from "./chunk-b9rjx4qc.js";
+} from "./chunk-fv66tdsm.js";
 import {
   backupPathFor,
   isAlive,
@@ -28,12 +28,12 @@ import {
   workspaceRootOfRunDir,
   writeAtomic,
   yamlScalar
-} from "./chunk-6405vkzk.js";
+} from "./chunk-8awygmqw.js";
 import {
   noteDeprecations,
   openBlocks,
   parseQuestions
-} from "./chunk-37fwvg3x.js";
+} from "./chunk-vyvjbbmb.js";
 import {
   listRunDirs,
   parseYaml,
@@ -80,11 +80,15 @@ function task(t, indent) {
   const cost = t.cost_usd === null ? "null" : money(t.cost_usd);
   const metered = t.metered === false ? ", metered: false" : "";
   const tokens = t.tokens === undefined ? "" : `, tokens: ${String(t.tokens)}`;
+  const inTokens = t.input_tokens === undefined ? "" : `, input_tokens: ${String(t.input_tokens)}`;
+  const outTokens = t.output_tokens === undefined ? "" : `, output_tokens: ${String(t.output_tokens)}`;
   return [
-    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens},`,
+    `${indent} - {id: ${yamlScalar(t.id)}, status: ${yamlScalar(t.status)}, expert: ${yamlScalar(t.expert)}, ` + `model: ${yamlScalar(t.model)}, cost_usd: ${cost}${metered}${tokens}${inTokens}${outTokens},`,
     `${inner}error: ${yamlScalar(t.error)}, session_id: ${yamlScalar(t.session_id)},`,
     `${inner}started_at: ${yamlScalar(t.started_at)}, ended_at: ${yamlScalar(t.ended_at)},`,
     ...t.stopped_by === undefined || t.stopped_by === null ? [] : [`${inner}stopped_by: ${yamlScalar(t.stopped_by)},`],
+    ...t.banked_before_refusal === undefined ? [] : [`${inner}banked_before_refusal: true,`],
+    ...t.dedupe === undefined ? [] : [`${inner}dedupe: ${yamlScalar(t.dedupe)},`],
     `${inner}outputs: ${inlineList(t.outputs)}}`
   ].join(`
 `);

package/dist/hooks/{chunk-6405vkzk.js → chunk-8awygmqw.js}

@@ -143,6 +143,7 @@ function inlineList(values) {
 }
 function emitFact(fact, indent = "  ") {
   const inner = `${indent}  `;
+  const decidedBy = fact.source.decided_by === undefined ? "" : `, decided_by: ${yamlScalar(fact.source.decided_by)}`;
   const lines = [
     `${indent}- id: ${yamlScalar(fact.id)}`,
     `${inner}fact: ${yamlScalar(fact.fact)}`,
@@ -150,7 +151,7 @@ function emitFact(fact, indent = "  ") {
     `${inner}repos: ${inlineList(fact.repos)}`,
     `${inner}kind: ${yamlScalar(fact.kind)}`,
     `${inner}confidence: ${yamlScalar(fact.confidence)}`,
-    `${inner}source: {who: ${yamlScalar(fact.source.who)}, when: ${yamlScalar(fact.source.when)}, ` + `run: ${yamlScalar(fact.source.run)}, q: ${yamlScalar(fact.source.q)}}`,
+    `${inner}source: {who: ${yamlScalar(fact.source.who)}, when: ${yamlScalar(fact.source.when)}, ` + `run: ${yamlScalar(fact.source.run)}, q: ${yamlScalar(fact.source.q)}${decidedBy}}`,
     `${inner}supersedes: ${yamlScalar(fact.supersedes)}`,
     `${inner}superseded_by: ${yamlScalar(fact.superseded_by)}`
   ];

package/dist/hooks/{chunk-ecfqpeyj.js → chunk-f6484ykg.js}

@@ -3,7 +3,7 @@ import {
   withWorkspaceLock,
   workspaceRootOfFactsPath,
   writeAtomic
-} from "./chunk-6405vkzk.js";
+} from "./chunk-8awygmqw.js";
 import {
   FACT_CONFIDENCES,
   FACT_KINDS,
@@ -14,7 +14,7 @@ import {
   isLive,
   isRetired,
   noteDeprecations
-} from "./chunk-37fwvg3x.js";
+} from "./chunk-vyvjbbmb.js";
 import {
   asDocument,
   isRecord,
@@ -86,6 +86,13 @@ function validateFactsFile(input) {
       if (typeof q === "string" && !Q_RE.test(q)) {
         issues.push({ path: `${path}.source.q`, message: `expected ${readableSource(Q_RE)} or null` });
       }
+      const decidedBy = row.source.decided_by;
+      if (decidedBy !== undefined && decidedBy !== "owner" && decidedBy !== "driver") {
+        issues.push({
+          path: `${path}.source.decided_by`,
+          message: "expected owner, driver or absent"
+        });
+      }
     } else if (row.source !== undefined) {
       issues.push({ path: `${path}.source`, message: "expected a mapping" });
     }

package/dist/hooks/{chunk-b9rjx4qc.js → chunk-fv66tdsm.js}

@@ -698,6 +698,20 @@ function validateRunFile(input) {
           if (task.cost_usd === null && task.metered !== false) {
             issues.push({ path: `${tp}.metered`, message: "a null cost_usd must be marked `metered: false`" });
           }
+          if (task.banked_before_refusal !== undefined && task.banked_before_refusal !== true) {
+            issues.push({ path: `${tp}.banked_before_refusal`, message: "expected `true` or absent" });
+          }
+          if (task.dedupe !== undefined && typeof task.dedupe !== "string") {
+            issues.push({ path: `${tp}.dedupe`, message: "expected a string" });
+          }
+          for (const key of ["input_tokens", "output_tokens"]) {
+            const value = task[key];
+            if (value === undefined)
+              continue;
+            if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+              issues.push({ path: `${tp}.${key}`, message: "expected a number >= 0" });
+            }
+          }
           if (typeof task.cost_usd === "number")
             spentFromTasks += task.cost_usd;
           checkOrder(task.started_at, task.ended_at, tp, issues);

package/dist/hooks/{chunk-c4p5x1b4.js → chunk-hg43zexg.js}

@@ -1,7 +1,7 @@
 import {
   EVIDENCE_FILE,
   gateEvidenceRelPath
-} from "./chunk-b9rjx4qc.js";
+} from "./chunk-fv66tdsm.js";
 import {
   MAX_PLAN_STORIES,
   MAX_STORIES_PER_WAVE,

package/dist/hooks/no-reask.js

@@ -7,7 +7,7 @@ import {
 } from "./chunk-cf4az0j5.js";
 import {
   FactsStore
-} from "./chunk-ecfqpeyj.js";
+} from "./chunk-f6484ykg.js";
 import {
   allow,
   deny,
@@ -17,11 +17,11 @@ import {
   runHook
 } from "./chunk-2y3kwfrx.js";
 import"./chunk-x3zy7zrn.js";
-import"./chunk-6405vkzk.js";
+import"./chunk-8awygmqw.js";
 import {
   openBlocks,
   parseQuestions
-} from "./chunk-37fwvg3x.js";
+} from "./chunk-vyvjbbmb.js";
 import"./chunk-39zh2e44.js";
 import {
   factsPath,

package/dist/hooks/session-start.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import"./chunk-ecfqpeyj.js";
+import"./chunk-f6484ykg.js";
 import {
   allow,
   readPayload,
@@ -15,7 +15,7 @@ import {
   openQuestions,
   runSnapshot,
   whatIsWaiting
-} from "./chunk-6ytv36jd.js";
+} from "./chunk-4w03q2kj.js";
 import {
   evidencePath,
   expertsDir,
@@ -25,17 +25,17 @@ import {
   pathsIntersect,
   readExpertDomain,
   stackExpertNames
-} from "./chunk-c4p5x1b4.js";
+} from "./chunk-hg43zexg.js";
 import {
   parseEvidence
-} from "./chunk-b9rjx4qc.js";
+} from "./chunk-fv66tdsm.js";
 import"./chunk-rrkdfk7s.js";
 import"./chunk-5w5eg00k.js";
-import"./chunk-6405vkzk.js";
+import"./chunk-8awygmqw.js";
 import {
   openBlocks,
   parseQuestions
-} from "./chunk-37fwvg3x.js";
+} from "./chunk-vyvjbbmb.js";
 import {
   isRecord
 } from "./chunk-39zh2e44.js";

package/dist/hooks/statusline.js

@@ -2,13 +2,13 @@
 import {
   bar,
   runSnapshot
-} from "./chunk-6ytv36jd.js";
-import"./chunk-c4p5x1b4.js";
-import"./chunk-b9rjx4qc.js";
+} from "./chunk-4w03q2kj.js";
+import"./chunk-hg43zexg.js";
+import"./chunk-fv66tdsm.js";
 import"./chunk-rrkdfk7s.js";
 import"./chunk-5w5eg00k.js";
-import"./chunk-6405vkzk.js";
-import"./chunk-37fwvg3x.js";
+import"./chunk-8awygmqw.js";
+import"./chunk-vyvjbbmb.js";
 import"./chunk-39zh2e44.js";
 import {
   findWorkspaceRoot,