wicked-crew 0.3.2 → 0.5.0

package/dist/api/api-prefix.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The single source of truth for the HTTP API's version prefix (FINDING-006).
+ *
+ * Lives in its own leaf module — not in routes.ts — on purpose. Both `routes.ts` (which mounts
+ * every path under this prefix) and `unit-output.ts` (which builds an operator-facing evidence URL
+ * that must match those paths) need this constant. Exporting it from routes.ts, as the first cut
+ * did (Copilot review on #217), created a cycle: routes.ts imports unit-output.ts, so importing
+ * API_PREFIX back from routes.ts made unit-output.ts pull in routes.ts's whole module
+ * initialization (which reads package.json) and risked an ESM temporal-dead-zone trap. A leaf
+ * constant that neither side's logic depends on breaks that cycle cleanly.
+ */
+export declare const API_PREFIX = "/api/v1";
+//# sourceMappingURL=api-prefix.d.ts.map

package/dist/api/api-prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-prefix.d.ts","sourceRoot":"","sources":["../../src/api/api-prefix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC"}

package/dist/api/api-prefix.js

@@ -0,0 +1,13 @@
+/**
+ * The single source of truth for the HTTP API's version prefix (FINDING-006).
+ *
+ * Lives in its own leaf module — not in routes.ts — on purpose. Both `routes.ts` (which mounts
+ * every path under this prefix) and `unit-output.ts` (which builds an operator-facing evidence URL
+ * that must match those paths) need this constant. Exporting it from routes.ts, as the first cut
+ * did (Copilot review on #217), created a cycle: routes.ts imports unit-output.ts, so importing
+ * API_PREFIX back from routes.ts made unit-output.ts pull in routes.ts's whole module
+ * initialization (which reads package.json) and risked an ESM temporal-dead-zone trap. A leaf
+ * constant that neither side's logic depends on breaks that cycle cleanly.
+ */
+export const API_PREFIX = '/api/v1';
+//# sourceMappingURL=api-prefix.js.map

package/dist/api/api-prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-prefix.js","sourceRoot":"","sources":["../../src/api/api-prefix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC"}

package/dist/api/elicitation-cache.d.ts

@@ -0,0 +1,93 @@
+import type { CoreEvent, SessionView } from '../core/types.js';
+/**
+ * One pending elicitation for a run.
+ *
+ * Keyed by `runId`; there is at most one pending elicitation per run at a time
+ * (the bridge cancels any prior slot before opening a new one).
+ */
+export interface ElicitationEntry {
+    runId: string;
+    elicitationId: string;
+    message: string;
+    /** Ordered set of valid responses; `null` means free-text. */
+    options: string[] | null;
+    /** When the daemon observed the elicitation — ISO-8601. */
+    receivedAt: string;
+}
+/**
+ * Pending-elicitation display store (DES-002 §4 P-2 / §6.3).
+ *
+ * Keyed by `runId`. The generation counter (one per run) guards against zombie
+ * entries: any mutation that makes a previously-taken entry stale bumps the
+ * counter, so `restoreIfUnchanged` is a no-op after a terminal event or a new
+ * elicitation arrived in the window between `take()` and a failed POST.
+ *
+ * # Concurrency model
+ *
+ * This runs on Node's single event-loop thread — all operations are synchronous
+ * and therefore atomic at the JS level. `take()` atomically removes the entry
+ * and returns the generation snapshot; `restoreIfUnchanged` only writes back if
+ * the generation is unchanged (no intervening mutation).
+ */
+export declare class ElicitationCache {
+    private readonly entries;
+    /** Monotone generation counter per run. Starts at 0; every mutation increments. */
+    private readonly gens;
+    private bumpGen;
+    /**
+     * Store a new elicitation for a run, replacing any previous one.
+     *
+     * Caller supplies all fields except `receivedAt`, which is stamped here.
+     */
+    create(entry: Omit<ElicitationEntry, 'receivedAt'>): void;
+    /** The current pending elicitation for a run, if any. Does not mutate. */
+    get(runId: string): ElicitationEntry | undefined;
+    /**
+     * Atomically remove and return the entry for a run, together with the
+     * generation snapshot at the moment of removal.
+     *
+     * Returns `undefined` when there is no pending elicitation for the run.
+     * The generation counter is NOT incremented by `take` itself — only
+     * subsequent mutations (new elicitation, terminal event, reconcile) bump it.
+     * This is intentional: it lets `restoreIfUnchanged` detect exactly those
+     * mutations without counting the take itself as a change.
+     */
+    take(runId: string): {
+        entry: ElicitationEntry;
+        gen: number;
+    } | undefined;
+    /**
+     * Restore a previously taken entry if, and only if, the generation has not
+     * changed since `take()`.
+     *
+     * Returns `true` when the entry was actually restored (and bumps the gen).
+     * Returns `false` and is a no-op when any intervening mutation changed the gen.
+     *
+     * Intended for the POST /runs/:id/elicitation error path: if the adapter call
+     * fails, attempt to restore the prompt so the UI can retry — but only if no
+     * terminal event or superseding elicitation arrived in the meantime.
+     */
+    restoreIfUnchanged(runId: string, entry: ElicitationEntry, gen: number): boolean;
+    /**
+     * Fold one live CoreEvent into the cache.
+     *
+     * `elicitationCreated` → store the new prompt (replaces any prior one).
+     * Terminal events → delete the entry and bump the generation.
+     * All other events → no-op.
+     */
+    ingest(event: CoreEvent): void;
+    /**
+     * Drop entries whose run is in a terminal status and bump their generation.
+     *
+     * Called on every GET /runs reconcile. Unlike `GateCache.reconcile` (which
+     * only prunes entries that exist), this ALWAYS bumps the generation for
+     * terminal-status runs, even when no entry is currently present.
+     *
+     * Why: a POST may have taken the entry just before reconcile runs. If the
+     * run is already terminal, the subsequent `restoreIfUnchanged` in the POST
+     * error path must be a no-op — the generation bump here ensures that,
+     * regardless of whether the entry was present at reconcile time (F8).
+     */
+    reconcile(views: SessionView[]): void;
+}
+//# sourceMappingURL=elicitation-cache.d.ts.map

package/dist/api/elicitation-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elicitation-cache.d.ts","sourceRoot":"","sources":["../../src/api/elicitation-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;CACpB;AAQD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAElD,OAAO,CAAC,OAAO;IAIf;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,GAAG,IAAI;IAWzD,0EAA0E;IAC1E,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIhD;;;;;;;;;OASG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,gBAAgB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAQzE;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAQhF;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAiB9B;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;CAQtC"}

package/dist/api/elicitation-cache.js

@@ -0,0 +1,128 @@
+/** Session statuses that mean the run will never elicit again. */
+const TERMINAL_STATUSES = new Set(['completed', 'cancelled', 'failed']);
+/** CoreEvent types that signal a run is terminal (matching TERMINAL_STATUSES). */
+const TERMINAL_EVENTS = new Set(['sessionCompleted', 'runCancelled', 'sessionFailed']);
+/**
+ * Pending-elicitation display store (DES-002 §4 P-2 / §6.3).
+ *
+ * Keyed by `runId`. The generation counter (one per run) guards against zombie
+ * entries: any mutation that makes a previously-taken entry stale bumps the
+ * counter, so `restoreIfUnchanged` is a no-op after a terminal event or a new
+ * elicitation arrived in the window between `take()` and a failed POST.
+ *
+ * # Concurrency model
+ *
+ * This runs on Node's single event-loop thread — all operations are synchronous
+ * and therefore atomic at the JS level. `take()` atomically removes the entry
+ * and returns the generation snapshot; `restoreIfUnchanged` only writes back if
+ * the generation is unchanged (no intervening mutation).
+ */
+export class ElicitationCache {
+    entries = new Map();
+    /** Monotone generation counter per run. Starts at 0; every mutation increments. */
+    gens = new Map();
+    bumpGen(runId) {
+        this.gens.set(runId, (this.gens.get(runId) ?? 0) + 1);
+    }
+    /**
+     * Store a new elicitation for a run, replacing any previous one.
+     *
+     * Caller supplies all fields except `receivedAt`, which is stamped here.
+     */
+    create(entry) {
+        this.entries.set(entry.runId, {
+            runId: entry.runId,
+            elicitationId: entry.elicitationId,
+            message: entry.message,
+            options: entry.options ?? null,
+            receivedAt: new Date().toISOString(),
+        });
+        this.bumpGen(entry.runId);
+    }
+    /** The current pending elicitation for a run, if any. Does not mutate. */
+    get(runId) {
+        return this.entries.get(runId);
+    }
+    /**
+     * Atomically remove and return the entry for a run, together with the
+     * generation snapshot at the moment of removal.
+     *
+     * Returns `undefined` when there is no pending elicitation for the run.
+     * The generation counter is NOT incremented by `take` itself — only
+     * subsequent mutations (new elicitation, terminal event, reconcile) bump it.
+     * This is intentional: it lets `restoreIfUnchanged` detect exactly those
+     * mutations without counting the take itself as a change.
+     */
+    take(runId) {
+        const entry = this.entries.get(runId);
+        if (!entry)
+            return undefined;
+        const gen = this.gens.get(runId) ?? 0;
+        this.entries.delete(runId);
+        return { entry, gen };
+    }
+    /**
+     * Restore a previously taken entry if, and only if, the generation has not
+     * changed since `take()`.
+     *
+     * Returns `true` when the entry was actually restored (and bumps the gen).
+     * Returns `false` and is a no-op when any intervening mutation changed the gen.
+     *
+     * Intended for the POST /runs/:id/elicitation error path: if the adapter call
+     * fails, attempt to restore the prompt so the UI can retry — but only if no
+     * terminal event or superseding elicitation arrived in the meantime.
+     */
+    restoreIfUnchanged(runId, entry, gen) {
+        const current = this.gens.get(runId) ?? 0;
+        if (current !== gen)
+            return false;
+        this.entries.set(runId, entry);
+        this.bumpGen(runId);
+        return true;
+    }
+    /**
+     * Fold one live CoreEvent into the cache.
+     *
+     * `elicitationCreated` → store the new prompt (replaces any prior one).
+     * Terminal events → delete the entry and bump the generation.
+     * All other events → no-op.
+     */
+    ingest(event) {
+        const runId = event.session;
+        if (typeof runId !== 'string')
+            return;
+        if (event.type === 'elicitationCreated') {
+            this.create({
+                runId,
+                elicitationId: String(event.elicitationId ?? ''),
+                message: String(event.message ?? ''),
+                options: Array.isArray(event.options) ? event.options : null,
+            });
+        }
+        else if (TERMINAL_EVENTS.has(event.type)) {
+            this.entries.delete(runId);
+            this.bumpGen(runId);
+        }
+    }
+    /**
+     * Drop entries whose run is in a terminal status and bump their generation.
+     *
+     * Called on every GET /runs reconcile. Unlike `GateCache.reconcile` (which
+     * only prunes entries that exist), this ALWAYS bumps the generation for
+     * terminal-status runs, even when no entry is currently present.
+     *
+     * Why: a POST may have taken the entry just before reconcile runs. If the
+     * run is already terminal, the subsequent `restoreIfUnchanged` in the POST
+     * error path must be a no-op — the generation bump here ensures that,
+     * regardless of whether the entry was present at reconcile time (F8).
+     */
+    reconcile(views) {
+        for (const view of views) {
+            if (TERMINAL_STATUSES.has(view.session.status)) {
+                this.entries.delete(view.session.id);
+                this.bumpGen(view.session.id);
+            }
+        }
+    }
+}
+//# sourceMappingURL=elicitation-cache.js.map

package/dist/api/elicitation-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elicitation-cache.js","sourceRoot":"","sources":["../../src/api/elicitation-cache.ts"],"names":[],"mappings":"AAkBA,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExE,kFAAkF;AAClF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAEvF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gBAAgB;IACV,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC/D,mFAAmF;IAClE,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,OAAO,CAAC,KAAa;QAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAA2C;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;YAC9B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,IAAI,CAAC,KAAa;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,KAAa,EAAE,KAAuB,EAAE,GAAW;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAgB;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO;QAEtC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC;gBACV,KAAK;gBACL,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;gBAChD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;aAC7D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,KAAoB;QAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/api/evidence.d.ts

@@ -1,13 +1,20 @@
-import type { AgentSession, RoutingInfo, SessionView, WorkUnit } from '../core/types.js';
+import type { AgentSession, RecordedEvent, SessionView, WorkUnit } from '../core/types.js';
+export type { RecordedEvent };
 /**
  * The run evidence bundle — everything an operator needs to audit a finished run,
  * in one downloadable JSON document (`GET /runs/:id/evidence`).
  *
- * The daemon persists no event log of its own (CoreEvent frames are fanned out
- * over `/ws` and dropped), so the decision trail is RE-DERIVED from the run DTO,
- * which is where core durably records it: `routing` carries the council/routing
- * provenance and `status`/`denial_reason`/`phase_status` carry the gate outcome.
- * Nothing here is invented — every field traces to a field on the run.
+ * `events` is core's DURABLE EVENT LOG for the run, read back verbatim. It used to
+ * be re-derived here from the unit records, because the daemon persisted no log of
+ * its own — which meant an exported bundle carried a handful of pseudo-events in a
+ * vocabulary this file invented (`routingDecided`) instead of what actually
+ * happened. Re-derivation cannot recover what it never saw: council deliberation
+ * and votes, gate depth, escalations, fallbacks, and every timestamp were simply
+ * absent, and nothing in the bundle said so. (FINDING-014)
+ *
+ * Nothing was lost by dropping the derived events: `routing`, `assigned_cli`,
+ * `denial_reason`, `phase_status` and `conformance_ref` were their only inputs and
+ * they ride in `units` verbatim already.
  */
 export interface EvidenceBundle {
     /** When the bundle was assembled (ISO-8601). */
@@ -16,8 +23,17 @@ export interface EvidenceBundle {
     session: AgentSession;
     /** The run's units in `ord` order, each with its captured transcript. */
     units: EvidenceUnit[];
-    /** The derived decision trail, in unit order (routing before that unit's gate). */
-    events: EvidenceEvent[];
+    /**
+     * The run's recorded event history, oldest first — the same frames `/ws` carried
+     * live, each with a capture-time `ts` and an ordering `seq`.
+     */
+    events: RecordedEvent[];
+    /**
+     * Why `events` is empty, present ONLY when it is. An empty trail must never be
+     * indistinguishable from a run that genuinely decided nothing — the same posture
+     * `transcriptError` takes for a unit.
+     */
+    eventsUnavailable?: string;
     /**
      * Structured assumptions re-parsed from the transcripts (the external-transform
      * convention): third-party payload transformations agents relied on. Entries with
@@ -45,42 +61,36 @@ export interface EvidenceUnit extends WorkUnit {
      */
     transcriptError?: string;
 }
-/** A gate decision, re-derived from the unit's persisted outcome. */
-export interface GateDecisionEvent {
-    type: 'gateDecided';
-    unitId: string;
-    ord: number;
-    /** `true` when the unit passed its gate (`done`), `false` when it was `rejected`. */
-    allow: boolean;
-    denialReason: string | null;
-    phaseStatus: string | null;
-    conformanceRef: string | null;
-}
-/** Council / routing provenance, re-derived from the unit's `routing`. */
-export interface RoutingDecidedEvent {
-    type: 'routingDecided';
-    unitId: string;
-    ord: number;
-    assignedCli: string | null;
-    routing: RoutingInfo;
-}
-export type EvidenceEvent = GateDecisionEvent | RoutingDecidedEvent;
 /** Loads one unit's captured transcript (the adapter's `workOutput`). */
 export type TranscriptLoader = (coreUnitId: string) => Promise<string | null>;
 /**
- * Re-derive the decision trail from the units. A unit contributes its routing
- * provenance (when the council/router recorded one) and its gate decision (once
- * the gate has actually resolved — a `pending`/`distributed` unit has no verdict
- * yet, and an evidence bundle must not imply one).
+ * Loads a run's recorded event history (the adapter's `runEvents`).
+ *
+ * `null` means the engine has no event-log binding at all — a capability gap, not an empty run.
+ * The adapter returns it rather than `[]` so this module can say which of the two happened.
  */
-export declare function evidenceEvents(units: WorkUnit[]): EvidenceEvent[];
+export type EventLoader = (runId: string) => Promise<RecordedEvent[] | null>;
 /**
- * Assemble a run's evidence bundle. Transcripts are read per unit; a single
- * unreadable transcript degrades that unit to `transcript: null` + a
- * `transcriptError` rather than failing the whole export — a partial bundle that
- * says which part is missing beats no bundle at all.
+ * The id core keys the transcript store by. Unit ids are already `<run>:<suffix>`;
+ * fall back to the free-text `u<ord>` form for any unit that lacks the prefix.
+ *
+ * EXPORTED so `/runs/:id/units/:unitKey/output` calls THIS rather than re-deriving the
+ * key from the caller's path segment. It used to be private and the route built its own
+ * `<run>:<suffix>` string from whatever the operator typed, which meant the two surfaces
+ * could disagree about which unit a key names — and did: a key the bundle resolved
+ * answered `null` on the endpoint (FINDING-006). One derivation, from the unit record.
+ */
+export declare function coreUnitId(runId: string, unit: WorkUnit): string;
+/**
+ * Assemble a run's evidence bundle.
+ *
+ * Every read degrades in place rather than failing the export: an unreadable
+ * transcript becomes `transcript: null` + `transcriptError` on that unit, and an
+ * unreadable event history becomes `events: []` + `eventsUnavailable`. A partial
+ * bundle that says which part is missing beats no bundle at all — but it must say
+ * so, or the gap reads as a fact about the run.
  */
-export declare function buildEvidenceBundle(view: SessionView, loadTranscript: TranscriptLoader): Promise<EvidenceBundle>;
+export declare function buildEvidenceBundle(view: SessionView, loadTranscript: TranscriptLoader, loadEvents: EventLoader): Promise<EvidenceBundle>;
 /**
  * Parse external-transform markers from one transcript — mirrors wicked-core's
  * `assumptions::parse` (same grammar, same malformed→needs-review posture) so the

package/dist/api/evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/api/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEzF;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,OAAO,EAAE,YAAY,CAAC;IACtB,yEAAyE;IACzE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,mFAAmF;IACnF,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2FAA2F;AAC3F,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,yEAAyE;IACzE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAEpE,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAW9E;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,CAyBjE;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,WAAW,EACjB,cAAc,EAAE,gBAAgB,GAC/B,OAAO,CAAC,cAAc,CAAC,CAsBzB;AAKD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,EAAE,CA0D7F;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGtD"}
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/api/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE3F,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,OAAO,EAAE,YAAY,CAAC;IACtB,yEAAyE;IACzE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB;;;OAGG;IACH,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2FAA2F;AAC3F,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,yEAAyE;IACzE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;AAE7E;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAEhE;AAsBD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,WAAW,EACjB,cAAc,EAAE,gBAAgB,EAChC,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,cAAc,CAAC,CAwCzB;AAKD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,EAAE,CA0D7F;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGtD"}

package/dist/api/evidence.js

@@ -1,50 +1,42 @@
 /**
  * The id core keys the transcript store by. Unit ids are already `<run>:<suffix>`;
- * fall back to the free-text `u<ord>` form for any unit that lacks the prefix
- * (mirrors the `/runs/:id/units/:unitKey/output` route's normalisation).
+ * fall back to the free-text `u<ord>` form for any unit that lacks the prefix.
+ *
+ * EXPORTED so `/runs/:id/units/:unitKey/output` calls THIS rather than re-deriving the
+ * key from the caller's path segment. It used to be private and the route built its own
+ * `<run>:<suffix>` string from whatever the operator typed, which meant the two surfaces
+ * could disagree about which unit a key names — and did: a key the bundle resolved
+ * answered `null` on the endpoint (FINDING-006). One derivation, from the unit record.
  */
-function coreUnitId(runId, unit) {
+export function coreUnitId(runId, unit) {
     return unit.id.startsWith(`${runId}:`) ? unit.id : `${runId}:u${unit.ord}`;
 }
 /**
- * Re-derive the decision trail from the units. A unit contributes its routing
- * provenance (when the council/router recorded one) and its gate decision (once
- * the gate has actually resolved — a `pending`/`distributed` unit has no verdict
- * yet, and an evidence bundle must not imply one).
+ * Why a run's `events` came back empty. Both cases are reported, never conflated:
+ * a read that failed is an operator problem, a run with no recorded history is a
+ * statement about that run.
  */
-export function evidenceEvents(units) {
-    const events = [];
-    for (const unit of [...units].sort((a, b) => a.ord - b.ord)) {
-        if (unit.routing) {
-            events.push({
-                type: 'routingDecided',
-                unitId: unit.id,
-                ord: unit.ord,
-                assignedCli: unit.assigned_cli,
-                routing: unit.routing,
-            });
-        }
-        if (unit.status === 'done' || unit.status === 'rejected') {
-            events.push({
-                type: 'gateDecided',
-                unitId: unit.id,
-                ord: unit.ord,
-                allow: unit.status === 'done',
-                denialReason: unit.denial_reason,
-                phaseStatus: unit.phase_status,
-                conformanceRef: unit.conformance_ref,
-            });
-        }
-    }
-    return events;
-}
+const NO_EVENTS_RECORDED = 'core recorded no events for this run — it ran before the durable event log existed ' +
+    '(FINDING-014), or its log was removed. This is not a run that made no decisions.';
 /**
- * Assemble a run's evidence bundle. Transcripts are read per unit; a single
- * unreadable transcript degrades that unit to `transcript: null` + a
- * `transcriptError` rather than failing the whole export — a partial bundle that
- * says which part is missing beats no bundle at all.
+ * The third cause, and a different kind of problem from the other two: the engine BUILD in use
+ * exposes no `runEvents` binding, so no run on this daemon has a readable trail. Reporting that as
+ * "this run recorded nothing" would blame the run for a missing capability — the FINDING-050 shape,
+ * distinct causes wearing one message.
  */
-export async function buildEvidenceBundle(view, loadTranscript) {
+const NO_EVENT_LOG_BINDING = 'the running wicked-core build exposes no durable event log (runEvents), so no decision trail ' +
+    'can be read for any run on this daemon — rebuild/reinstall wicked-core-ts. This says nothing ' +
+    'about what this run decided.';
+/**
+ * Assemble a run's evidence bundle.
+ *
+ * Every read degrades in place rather than failing the export: an unreadable
+ * transcript becomes `transcript: null` + `transcriptError` on that unit, and an
+ * unreadable event history becomes `events: []` + `eventsUnavailable`. A partial
+ * bundle that says which part is missing beats no bundle at all — but it must say
+ * so, or the gap reads as a fact about the run.
+ */
+export async function buildEvidenceBundle(view, loadTranscript, loadEvents) {
     const ordered = [...view.units].sort((a, b) => a.ord - b.ord);
     const units = await Promise.all(ordered.map(async (unit) => {
         try {
@@ -58,11 +50,28 @@ export async function buildEvidenceBundle(view, loadTranscript) {
             };
         }
     }));
+    let events = [];
+    let eventsUnavailable;
+    try {
+        const loaded = await loadEvents(view.session.id);
+        if (loaded === null) {
+            eventsUnavailable = NO_EVENT_LOG_BINDING;
+        }
+        else {
+            events = loaded;
+            if (events.length === 0)
+                eventsUnavailable = NO_EVENTS_RECORDED;
+        }
+    }
+    catch (err) {
+        eventsUnavailable = `could not read the run's event history: ${err instanceof Error ? err.message : String(err)}`;
+    }
     return {
         exportedAt: new Date().toISOString(),
         session: view.session,
         units,
-        events: evidenceEvents(ordered),
+        events,
+        ...(eventsUnavailable === undefined ? {} : { eventsUnavailable }),
         assumptions: units.flatMap((u) => parseAssumptions(u.ord, u.transcript)),
     };
 }

package/dist/api/evidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/api/evidence.ts"],"names":[],"mappings":"AA6EA;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAa,EAAE,IAAc;IAC/C,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM;gBAC7B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,cAAc,EAAE,IAAI,CAAC,eAAe;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAiB,EACjB,cAAgC;IAEhC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAyB,EAAE;QAChD,IAAI,CAAC;YACH,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,GAAG,IAAI;gBACP,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAClE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK;QACL,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAC3D,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,UAAyB;IACrE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAe,EAAU,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAClB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC,CAAC,EACF,KAAK,CAAC,MAAM,CACb,CAAC;YACF,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,MAAM,UAAU,GACd,OAAO,KAAK,EAAE,IAAI,SAAS,KAAK,EAAE,IAAI,CAAC,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,gBAAgB,CAAC,CAAC;QAEpG,KAAK,CAAC,IAAI,CACR,UAAU;YACR,CAAC,CAAC;gBACE,GAAG;gBACH,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC1B,KAAK,EAAE,UAAU,KAAK,OAAO;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAM,CAAC;aAC9D;YACH,CAAC,CAAC;gBACE,GAAG;gBACH,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;gBACzD,SAAS,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9E,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,IAAI,CAAC,6CAA6C,IAAI,EAAE,CAAC;aAClE,CACN,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,IAAI,wBAAwB;YAAE,MAAM;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,OAAO,GAAG,IAAI,IAAI,KAAK,gBAAgB,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/api/evidence.ts"],"names":[],"mappings":"AA+EA;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAc;IACtD,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GACtB,qFAAqF;IACrF,kFAAkF,CAAC;AAErF;;;;;GAKG;AACH,MAAM,oBAAoB,GACxB,+FAA+F;IAC/F,+FAA+F;IAC/F,8BAA8B,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAiB,EACjB,cAAgC,EAChC,UAAuB;IAEvB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAyB,EAAE;QAChD,IAAI,CAAC;YACH,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,GAAG,IAAI;gBACP,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAClE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,MAAM,GAAoB,EAAE,CAAC;IACjC,IAAI,iBAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,iBAAiB,GAAG,oBAAoB,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,iBAAiB,GAAG,kBAAkB,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iBAAiB,GAAG,2CAClB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;IACL,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK;QACL,MAAM;QACN,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAC3D,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,UAAyB;IACrE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC1C,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAe,EAAU,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAClB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC5B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC,CAAC,EACF,KAAK,CAAC,MAAM,CACb,CAAC;YACF,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,MAAM,UAAU,GACd,OAAO,KAAK,EAAE,IAAI,SAAS,KAAK,EAAE,IAAI,CAAC,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,gBAAgB,CAAC,CAAC;QAEpG,KAAK,CAAC,IAAI,CACR,UAAU;YACR,CAAC,CAAC;gBACE,GAAG;gBACH,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC1B,KAAK,EAAE,UAAU,KAAK,OAAO;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,MAAM,CAAC;aAC9D;YACH,CAAC,CAAC;gBACE,GAAG;gBACH,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;gBACzD,SAAS,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9E,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,IAAI,CAAC,6CAA6C,IAAI,EAAE,CAAC;aAClE,CACN,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,IAAI,wBAAwB;YAAE,MAAM;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,OAAO,GAAG,IAAI,IAAI,KAAK,gBAAgB,CAAC;AAC1C,CAAC"}

package/dist/api/gate-cache.d.ts

@@ -11,25 +11,41 @@ export interface GateCacheEntry {
     receivedAt: string;
 }
 /**
- * Self-healing gate-prompt cache (DES-STUDIO-001 §3.3).
+ * Gate-prompt cache over a durable log (DES-STUDIO-001 §3.3).
  *
- * Core does NOT persist the gate prompt — it exists only on the transient
- * `awaitingHuman` CoreEvent (`AgentSession` has no prompt field). So the daemon
- * event-sources it here, keyed by runId (a paused run has exactly one open gate,
- * before `unit_ix`). Entries are pruned on any resumed/terminal event for the
- * run, and re-checked against `sessionsDetail()` on every list reconcile so the
- * cache can neither leak nor go stale ("re-merged on reconcile, pruned to
- * still-paused — can't leak or blank").
+ * The prompt is keyed by runId — a paused run has exactly one open gate, before `unit_ix`. Entries
+ * are pruned on any resumed/terminal event for the run, and re-checked against `sessionsDetail()`
+ * on every list reconcile, so the cache can neither leak nor go stale.
  *
- * NOTE: the full HITL lifecycle from §3.3 (advisory / hard-expiry timers,
- * append-only message log, auto-cancel-on-expiry, synthesized `gateLifecycle`
- * frames) is a deliberate follow-on. This increment caches only the prompt so a
- * late-joining browser can render the gate; `lifecycle` is always `open`.
+ * That self-healing claim was true and beside the point until FINDING-051: every path here was
+ * prune-only, so a daemon restart dropped the map and **nothing could put an entry back**. A parked
+ * run then kept holding the operator without being able to say what it was asking. The prompt was
+ * never actually lost — core records `awaitingHuman` to the event log (core#139) — it was simply
+ * never read. `rebuild` is that read, which demotes this map to what it was always meant to be: a
+ * latency optimisation, not the system of record.
+ *
+ * NOTE: the full HITL lifecycle from §3.3 (advisory / hard-expiry timers, append-only message log,
+ * auto-cancel-on-expiry, synthesized `gateLifecycle` frames) is a deliberate follow-on. This
+ * increment caches only the prompt so a late-joining browser can render the gate; `lifecycle` is
+ * always `open`.
  */
 export declare class GateCache {
     private readonly entries;
-    /** Fold one CoreEvent into the cache. */
+    /** Fold one live CoreEvent into the cache. */
     ingest(event: CoreEvent): void;
+    /**
+     * Rebuild one run's gate from its durable event history and adopt the result (FINDING-051).
+     *
+     * `events` is the run's log oldest-first. Folding all of it yields the last `awaitingHuman` not
+     * followed by a resumed/terminal event — i.e. an open gate, or nothing.
+     *
+     * Deliberately does NOT cross-check the run's live status first: that costs a `sessionsDetail()`
+     * on a read path, and the write side is already guarded — approving a run that has moved on is
+     * refused by the `status === 'awaiting_human'` check on `POST /runs/:id/gate`. So the worst a
+     * stale replay can do is show a prompt that then declines to be approved, and `reconcile` drops
+     * it on the next list. The failure mode is a confusing read, never a bad write.
+     */
+    rebuild(runId: string, events: CoreEvent[]): GateCacheEntry | undefined;
     /** The cached open gate for a run, if any. */
     get(runId: string): GateCacheEntry | undefined;
     /** Drop cache entries whose run is no longer `awaiting_human` (self-healing on reconcile). */

package/dist/api/gate-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-cache.d.ts","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/D,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,yCAAyC;IACzC,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAyB9B,8CAA8C;IAC9C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI9C,8FAA8F;IAC9F,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;CAQtC"}
+{"version":3,"file":"gate-cache.d.ts","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/D,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;CACpB;AA+CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,8CAA8C;IAC9C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAI9B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,GAAG,SAAS;IAQvE,8CAA8C;IAC9C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI9C,8FAA8F;IAC9F,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;CAQtC"}