wyrm-mcp 7.3.2 → 7.3.3

package/dist/failure-patterns.js

@@ -1,21 +1,171 @@
-import{sanitizeFtsQuery as I}from"./security.js";import{emitEvent as b,isLiveMemoryEnabled as A}from"./events.js";import{getActor as E,hasExplicitAttribution as j}from"./handlers/boundary.js";import{readActor as m,resolveAttribution as C}from"./attribution.js";import{normalizeContentSignature as D,containsFailedSignature as y}from"./content-signature.js";const M=new Set(["a","an","the","this","that","these","those","and","or","but","if","then","than","so","to","of","in","on","at","by","for","from","with","without","no","not","as","is","are","was","were","be","been","being","will","would","can","could","should","it","its","i","we","you","my","our","your","again","just","now","please","let","lets","do","does","did","into","over","about"]),T={run:0,project:1,global:2},U=200,k=5;function q(a){const e=r=>Object.entries(r).filter(([,o])=>o>0).map(([o,c])=>`${o} ${c}`).join(" \xB7 ")||"none",t=r=>r.map(o=>`${"who"in o?o.who:o.run_id} \xD7${o.count}`).join(" \xB7 ")||"none",n=a.blocked.this_run.run_id===null?"- This run: (no run identity \u2014 export WYRM_RUN_ID or pass run_id)":`- This run (${a.blocked.this_run.run_id}): ${a.blocked.this_run.blocked} repeat(s) blocked`;return`\u{F115D} **Failure Analytics** (${a.project_id===null?"all projects":`project #${a.project_id}`})
-
-**Recorded:** ${a.recorded.total} failure(s), ${a.recorded.unresolved} unresolved
-- By quarantine: ${e(a.recorded.by_quarantine_scope)}
-- By scope: ${e(a.recorded.by_scope)}
-- By agent: ${t(a.recorded.by_agent)}
-- By run: ${t(a.recorded.by_run)}
-
-**Confirmations:** ${a.confirmations.total} from ${a.confirmations.distinct_agents} distinct agent(s)
-
-**Repeats blocked:** ${a.blocked.total} total
-${n}
-- By agent: ${t(a.blocked.by_agent)}
-- By run: ${t(a.blocked.by_run)}
-- Top blockers: ${a.blocked.top_blocked.map(r=>`#${r.failure_id} ${r.scope}:${r.target} \xD7${r.blocks}`).join(" \xB7 ")||"none"}`}function w(a,e){if(a==="exact")return 1;if(a==="target")return .95;const t=Math.max(0,-(e??0));return Number((.05+.85*(t/(t+2))).toFixed(4))}function O(a){return a.toLowerCase().replace(/\s+/g," ").trim()}function L(a){return O(a).slice(0,200)}class g{db;constructor(e){this.db=e}static signature(e,t,n){return`${e}:${L(t)}:${L(n).slice(0,80)}`}record(e){const t=g.signature(e.scope,e.target,e.description),n=e.project_id??null,r=e.content&&D(e.content)||null,o=E(),s=this.db.transaction(()=>{const i=this.db.prepare(`
+/**
+ * Failure Patterns — Counter-pattern detection.
+ *
+ * Records edits / commands / prompts that failed so the predictive push
+ * can BLOCK the same suggestion mid-stream the next time it surfaces.
+ * Most "memory" tools only learn from success; Wyrm learns from failure too.
+ *
+ * Keyed on `(signature, scope)` so semantically-identical failures
+ * coalesce — re-recording the same failure increments `occurrences`
+ * rather than creating a new row.
+ *
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
+ * @license Proprietary — (c) 2026 Ghost Protocol (Pvt) Ltd. All rights reserved. See LICENSE.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { sanitizeFtsQuery } from './security.js';
+import { WyrmCrypto } from './crypto.js';
+import { emitEvent, isLiveMemoryEnabled } from './events.js';
+import { getActor, hasExplicitAttribution } from './handlers/boundary.js';
+import { readActor, resolveAttribution } from './attribution.js';
+import { normalizeContentSignature, containsFailedSignature } from './content-signature.js';
+/**
+ * Function-word filler dropped from the fuzzy-match probe. A reworded repeat
+ * ("run the migration that dropped the table AGAIN") carries incidental words
+ * that aren't in the terse recorded failure; left in, they break the conjunctive
+ * AND and the repeat slips through. Removing them lets the AND span only CONTENT
+ * words — precision is unchanged (content terms are still all required), recall
+ * on natural-language restatements rises. (Falls back to the full term set when
+ * filtering would empty the probe, e.g. an all-stopword description.)
+ */
+const FUZZY_STOPWORDS = new Set([
+    'a', 'an', 'the', 'this', 'that', 'these', 'those', 'and', 'or', 'but', 'if',
+    'then', 'than', 'so', 'to', 'of', 'in', 'on', 'at', 'by', 'for', 'from',
+    'with', 'without', 'no', 'not', 'as', 'is', 'are', 'was', 'were', 'be',
+    'been', 'being', 'will', 'would', 'can', 'could', 'should', 'it', 'its',
+    'i', 'we', 'you', 'my', 'our', 'your', 'again', 'just', 'now', 'please',
+    'let', 'lets', 'do', 'does', 'did', 'into', 'over', 'about',
+]);
+/** Quarantine tier ordering for monotonic promotion: widen-only, never narrow. */
+const TIER_RANK = { run: 0, project: 1, global: 2 };
+// ── Staleness oracle (migration 30) ─────────────────────────────────────────
+/** Hard cap on DISTINCT anchored files (rel_paths) per failure, enforced at
+ * WRITE time (recordAnchors). Refreshing an already-anchored path never
+ * consumes a slot — one row per (failure_id, rel_path) by construction. */
+export const ANCHOR_CAP = 8;
+/** The advisory flag a downgraded match carries (PROTOCOL.md §10.2.5). Both
+ * surfaces — the MCP failure_check handler and the wyrm-guard block tiers —
+ * emit EXACTLY this string, so consumers can key on it. */
+export const STALE_ANCHOR_FLAG = 'source changed since this failure was recorded — re-verify';
+/** targetIdentityMatches: hard bound on rows pulled from the signature-prefix
+ * range BEFORE the identity filter — a fixed work budget (the guard's ~200ms
+ * discipline), index-bounded by the range itself. Past it the lookup degrades
+ * toward fail-open (a miss), never toward a false block. */
+const IDENTITY_SCAN_CAP = 200;
+/** targetIdentityMatches: result cap AFTER the identity filter (parity with
+ * query()'s LIMIT 5). Applied post-filter so same-prefix cousins can never
+ * crowd a genuinely identical-target row out of the verdict. */
+const IDENTITY_MATCH_LIMIT = 5;
+/**
+ * Render the failures view as the wyrm_stats prose (v7 F2, T017). Exported
+ * standalone so the MCP handler AND bench/fleet-demo.mjs print the IDENTICAL
+ * surface — the demo's output IS the tool's output by construction.
+ */
+export function renderFailureStats(v) {
+    const scopeLine = (rec) => Object.entries(rec).filter(([, n]) => n > 0).map(([k, n]) => `${k} ${n}`).join(' · ') || 'none';
+    const bucketLine = (rows) => rows.map((r) => `${'who' in r ? r.who : r.run_id} ×${r.count}`).join(' · ') || 'none';
+    const thisRun = v.blocked.this_run.run_id === null
+        ? '- This run: (no run identity — export WYRM_RUN_ID or pass run_id)'
+        : `- This run (${v.blocked.this_run.run_id}): ${v.blocked.this_run.blocked} repeat(s) blocked`;
+    return (`󱅝 **Failure Analytics** (${v.project_id === null ? 'all projects' : `project #${v.project_id}`})\n\n` +
+        `**Recorded:** ${v.recorded.total} failure(s), ${v.recorded.unresolved} unresolved\n` +
+        `- By quarantine: ${scopeLine(v.recorded.by_quarantine_scope)}\n` +
+        `- By scope: ${scopeLine(v.recorded.by_scope)}\n` +
+        `- By agent: ${bucketLine(v.recorded.by_agent)}\n` +
+        `- By run: ${bucketLine(v.recorded.by_run)}\n\n` +
+        `**Confirmations:** ${v.confirmations.total} from ${v.confirmations.distinct_agents} distinct agent(s)\n\n` +
+        `**Repeats blocked:** ${v.blocked.total} total\n` +
+        `${thisRun}\n` +
+        `- By agent: ${bucketLine(v.blocked.by_agent)}\n` +
+        `- By run: ${bucketLine(v.blocked.by_run)}\n` +
+        `- Top blockers: ${v.blocked.top_blocked.map((t) => `#${t.failure_id} ${t.scope}:${t.target} ×${t.blocks}`).join(' · ') || 'none'}`);
+}
+/**
+ * Deterministic match-tier confidence (Article III: never an LLM).
+ *   - 'exact'  → 1.0: the coalescing signature itself matched — this IS the
+ *                recorded failure.
+ *   - 'target' → 0.95: scope+target identity (description-independent — the
+ *                wyrm-guard block tier, v7 F2 review fix). Deterministic
+ *                identity, strictly below 'exact' (the description was not
+ *                compared) and strictly above every fuzzy score.
+ *   - 'fuzzy'  → normalized FTS5 bm25. SQLite bm25() is "smaller is better"
+ *                (negative for relevant rows; can go ≥0 when a term is in most
+ *                rows). With r = max(0, -bm25):  0.05 + 0.85·r/(r+2),
+ *                rounded to 4dp — monotone in relevance, range [0.05, 0.9),
+ *                always strictly below the exact/target tiers.
+ */
+export function matchConfidence(tier, bm25Rank) {
+    if (tier === 'exact')
+        return 1;
+    if (tier === 'target')
+        return 0.95;
+    const r = Math.max(0, -(bm25Rank ?? 0));
+    return Number((0.05 + 0.85 * (r / (r + 2))).toFixed(4));
+}
+/**
+ * The FULL identity normalization: lowercase, whitespace runs collapsed,
+ * trimmed — NO length cap. This is the truth predicate for target identity
+ * (targetIdentityMatches and wyrm-guard's block tier): two targets are "the
+ * same action" only when their FULL normalized strings are equal, however
+ * long they are. Exported so the guard compares with exactly these semantics
+ * instead of re-implementing them.
+ */
+export function normalizeIdentity(s) {
+    return s.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+/**
+ * The signature normalization: normalizeIdentity capped at 200 chars. The cap
+ * is a STORAGE/RECALL bound (it keeps stored signatures and their index keys
+ * small), NOT an identity predicate: two different long targets can share
+ * their first 200 normalized chars, so anything deciding "is this the same
+ * target?" must compare normalizeIdentity (uncapped) forms. Exported (v7 F2,
+ * T016) so wyrm-guard's range probes use EXACTLY the normalization baked into
+ * every stored signature — re-implementing it there would drift.
+ */
+export function normalizeSignal(s) {
+    return normalizeIdentity(s).slice(0, 200);
+}
+export class FailurePatterns {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Build a stable signature from scope+target+description, so repeated
+     * identical failures coalesce instead of creating new rows. */
+    static signature(scope, target, description) {
+        return `${scope}:${normalizeSignal(target)}:${normalizeSignal(description).slice(0, 80)}`;
+    }
+    /** Record (or increment) a failure. Returns the (new or updated) row.
+     *
+     * v7 F2 review fix: the whole write — dedup SELECT, UPDATE-or-INSERT, the
+     * confirmation row, and any auto-promotion — runs in ONE transaction
+     * declared IMMEDIATE. This closes two confirmed races at once:
+     *   1. SELECT-then-INSERT across processes: two agents first-recording the
+     *      same signature could both miss the SELECT — the loser threw an
+     *      unclassified SQLITE_CONSTRAINT_UNIQUE (losing its confirmation, the
+     *      very second-distinct-agent signal T015 promotion needs), and
+     *      project_id-NULL rows (NULLs are distinct under SQLite UNIQUE)
+     *      DUPLICATED, splitting confirmations so neither row ever reached the
+     *      n>=2 promotion bar. BEGIN IMMEDIATE takes the write lock before the
+     *      SELECT, so the dedup read always sees committed truth.
+     *   2. Multi-statement partial commit: a BUSY between the row write and
+     *      noteConfirmation() left the row committed while the structured
+     *      WYRM_BUSY body told the caller to retry — inflating occurrences.
+     *      Atomic record() makes "retrying is safe" true for this path.
+     */
+    record(input) {
+        const signature = FailurePatterns.signature(input.scope, input.target, input.description);
+        const projectId = input.project_id ?? null;
+        const contentSig = input.content ? (normalizeContentSignature(input.content) || null) : null;
+        const ambient = getActor();
+        const persist = this.db.transaction(() => {
+            const existing = this.db.prepare(`
         SELECT * FROM failure_patterns
         WHERE signature = ? AND (project_id IS ? OR project_id = ?)
-      `).get(t,n,n);if(i)return this.db.prepare(`
+      `).get(signature, projectId, projectId);
+            if (existing) {
+                this.db.prepare(`
           UPDATE failure_patterns
           SET occurrences = occurrences + 1,
               last_seen = datetime('now'),
@@ -24,26 +174,423 @@ ${n}
               content_sig = COALESCE(?, content_sig),
               resolved = 0
           WHERE id = ?
-        `).run(e.why_failed??null,e.severity??i.severity,r,i.id),this.noteConfirmation(i.id,o),this.get(i.id);const u=e.quarantine_scope??(o.run_id!==null?"run":n===null?"global":"project"),p=this.db.prepare(`
+        `).run(input.why_failed ?? null, input.severity ?? existing.severity, contentSig, existing.id);
+                // v7 F2 (T015): a re-record by a KNOWN agent is a CONFIRMATION of the
+                // pattern — the debrief-independent "≥2 distinct agent_id confirmations
+                // → auto-promote" path lives in noteConfirmation(). Fetch the row AFTER
+                // so a promotion triggered by this very confirmation is visible to the
+                // caller.
+                this.noteConfirmation(existing.id, ambient);
+                return this.get(existing.id);
+            }
+            // v7 F2 (T009): stamp the recording actor. The dedup UPDATE path above
+            // intentionally does NOT restamp — attribution names the first recorder
+            // (and keeps the first recorder's quarantine_scope: cross-run
+            // re-occurrences coalesce but do NOT widen authority — T015's ≥2-agent
+            // confirmation promotion owns widening).
+            //
+            // v7 F2 (T014) quarantine default, documented:
+            //   run_id present        → 'run'     (born in a fleet run: instantly
+            //                                      authoritative for same-run siblings,
+            //                                      quarantined from everyone else until
+            //                                      T015 promotion)
+            //   no run, project row   → 'project' (the 6.x reach: authoritative for
+            //                                      its whole project at once)
+            //   no run, NULL project  → 'global'  (6.x check() matched NULL-project
+            //                                      rows from EVERY project; plain
+            //                                      'project' would silently narrow
+            //                                      them — same rationale as the
+            //                                      migration-20 backfill)
+            const quarantine = input.quarantine_scope
+                ?? (ambient.run_id !== null ? 'run' : projectId === null ? 'global' : 'project');
+            const info = this.db.prepare(`
         INSERT INTO failure_patterns
           (project_id, signature, scope, target, description, why_failed, severity, agent_id, run_id, quarantine_scope, content_sig)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(n,t,e.scope,e.target,e.description,e.why_failed??null,e.severity??"medium",o.agent_id,o.run_id,u,r),d=this.get(p.lastInsertRowid);return this.noteConfirmation(d.id,o),d}).immediate();return b(this.db,{projectId:s.project_id??0,kind:"failure",refTable:"failure_patterns",refId:s.id}),s}contentMatch(e,t,n){const r=this.db.prepare(`
+      `).run(projectId, signature, input.scope, input.target, input.description, input.why_failed ?? null, input.severity ?? 'medium', ambient.agent_id, ambient.run_id, quarantine, contentSig);
+            const created = this.get(info.lastInsertRowid);
+            // v7 F2 (T015): the first recorder is confirmation #1 (a single agent can
+            // never auto-promote its own run-quarantined failure — that needs a
+            // SECOND distinct agent_id).
+            this.noteConfirmation(created.id, ambient);
+            return created;
+        });
+        const row = persist.immediate();
+        // Reference-only + private (isShared omitted): failure detail never
+        // replicates. Emitted AFTER commit (the sweepRunQuarantine pattern) so
+        // followers re-reading on the event always see the committed row.
+        emitEvent(this.db, { projectId: row.project_id ?? 0, kind: 'failure', refTable: 'failure_patterns', refId: row.id });
+        return row;
+    }
+    /**
+     * v7 Failure Firewall v2 — content tier. Find an UNRESOLVED failure for this
+     * scope (+ project reach) whose recorded code signature is re-introduced by
+     * `editContent`. Precision-gated (containsFailedSignature): a too-short stored
+     * signature never matches. Returns the matching pattern (for the block +
+     * remedy) or null. Read-only, deterministic, no network.
+     */
+    contentMatch(editContent, scope, projectId) {
+        const rows = this.db.prepare(`
       SELECT * FROM failure_patterns
       WHERE content_sig IS NOT NULL AND scope = ? AND resolved = 0
         AND (project_id IS ? OR project_id = ?)
       ORDER BY occurrences DESC, last_seen DESC
-    `).all(t,n,n);for(const o of r)if(o.content_sig&&y(e,o.content_sig))return o;return null}get(e){return this.db.prepare("SELECT * FROM failure_patterns WHERE id = ?").get(e)??null}noteConfirmation(e,t){if(t.agent_id===null)return;this.db.prepare(`
+    `).all(scope, projectId, projectId);
+        for (const row of rows) {
+            if (row.content_sig && containsFailedSignature(editContent, row.content_sig))
+                return row;
+        }
+        return null;
+    }
+    get(id) {
+        const row = this.db.prepare('SELECT * FROM failure_patterns WHERE id = ?').get(id);
+        return row ?? null;
+    }
+    // ── Staleness oracle (migration 30, PROTOCOL.md §10.2.5) ──────────────────
+    /** The anchor fingerprint: sha256 over the NORMALIZED content form
+     * (normalizeContentSignature — the content-tier normal form), so
+     * whitespace/reformat/comment churn can never false-flag staleness. */
+    static anchorSha(content) {
+        return WyrmCrypto.hash(normalizeContentSignature(content));
+    }
+    /**
+     * Anchor a recorded failure to the source files it is about (the undeclared
+     * `files` param of wyrm_failure_record). For each file UNDER the project
+     * root: stat + read + hash the normalized content, store the
+     * PROJECT-RELATIVE path (anchors replicate across machines whose checkouts
+     * live at different roots) with the stat fast-path fields. Paths escaping
+     * the project root (traversal, absolute paths outside it) are REJECTED;
+     * unreadable files are skipped.
+     *
+     * UPSERT per (failure_id, rel_path): record() COALESCES repeat failures
+     * onto ONE id, so a coalesced re-record that names the same files must
+     * REFRESH each path's anchor in place (delete-then-insert — no reliance on
+     * the unique index, so a DB that ran an earlier shape of migration 30 still
+     * behaves). Appending instead would leave the old-sha row beside the fresh
+     * one, and anchorFreshness — 'stale' on ANY drifted row — would keep a
+     * failure just re-confirmed against CURRENT source permanently advisory.
+     * ANCHOR_CAP counts DISTINCT rel_paths: refreshing an existing anchor never
+     * consumes a slot and lands even at the cap. Best-effort by contract:
+     * returns how many anchors were written (refreshes included) and NEVER
+     * throws — a pre-migration-30 DB or any fs error must not fail the record.
+     *
+     * SECURITY (allowNewPaths): only the call that FRESHLY created this failure
+     * may introduce NEW anchor paths. record() coalesces a repeat signature onto
+     * an existing id, so a coalesced re-record (allowNewPaths=false) may only
+     * REFRESH paths already anchored — it can never attach a NEW (decoy) anchor
+     * to a firm block it does not own and then drift the decoy to collapse that
+     * block to advisory. Refreshes are always allowed (a re-confirmed failure
+     * must regain its hard block); the gate is on introducing new paths only.
+     */
+    recordAnchors(failureId, projectRoot, files, allowNewPaths = true) {
+        try {
+            const root = resolve(projectRoot);
+            // Existing DISTINCT rel_paths: the cap denominator AND the refresh set.
+            const anchored = new Set(this.db.prepare('SELECT DISTINCT rel_path FROM failure_anchors WHERE failure_id = ?').all(failureId).map((r) => r.rel_path));
+            let remaining = ANCHOR_CAP - anchored.size;
+            const del = this.db.prepare('DELETE FROM failure_anchors WHERE failure_id = ? AND rel_path = ?');
+            const insert = this.db.prepare(`
+        INSERT INTO failure_anchors (failure_id, rel_path, sha, size, mtime_ns)
+        VALUES (?, ?, ?, ?, ?)
+      `);
+            const seen = new Set();
+            let stored = 0;
+            for (const file of files) {
+                if (typeof file !== 'string' || file.length === 0)
+                    continue;
+                const abs = isAbsolute(file) ? resolve(file) : resolve(root, file);
+                // No traversal: the resolved path must be strictly INSIDE the root
+                // (the root itself is a directory, never an anchor).
+                if (!abs.startsWith(root + sep))
+                    continue;
+                if (seen.has(abs))
+                    continue;
+                seen.add(abs);
+                const rel = relative(root, abs);
+                const refresh = anchored.has(rel);
+                // The cap gates NEW paths only — a refresh always lands (a failure
+                // re-confirmed against current source must regain its hard block).
+                // A NEW path also requires allowNewPaths (a coalesced re-record cannot
+                // inject a decoy anchor onto a block it does not own — see the doc).
+                if (!refresh && (!allowNewPaths || remaining <= 0))
+                    continue;
+                try {
+                    // stat BEFORE read: if the file mutates between the two, the stored
+                    // stat is conservatively older — the fast path misses once and the
+                    // hash path settles it (never a false "fresh").
+                    const st = statSync(abs, { bigint: true });
+                    if (!st.isFile())
+                        continue;
+                    const sha = FailurePatterns.anchorSha(readFileSync(abs, 'utf-8'));
+                    del.run(failureId, rel); // refresh: the old-sha row must NOT survive
+                    insert.run(failureId, rel, sha, st.size, st.mtimeNs);
+                    stored++;
+                    if (!refresh)
+                        remaining--;
+                }
+                catch {
+                    // unreadable/vanished file — skip it, anchor the rest
+                }
+            }
+            return stored;
+        }
+        catch {
+            return 0; // pre-migration-30 DB / readonly handle — anchors are best-effort
+        }
+    }
+    /** Stored anchors for one failure. safeIntegers: mtime_ns (INT64 ns) exceeds
+     * JS safe-number range — a number round-trip would break the stat fast path.
+     * Never throws: a pre-migration-30 DB reads as "no anchors" (fail-open). */
+    getAnchors(failureId) {
+        try {
+            const stmt = this.db.prepare('SELECT rel_path, sha, size, mtime_ns, recorded_at FROM failure_anchors WHERE failure_id = ?');
+            stmt.safeIntegers(true);
+            return stmt.all(failureId);
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * THE ORACLE CORE: has this failure's anchored source POSITIVELY drifted?
+     *
+     * Fast path first (the guard's latency budget): stat each anchor — equal
+     * size AND mtime_ns ⇒ fresh with ZERO hashing. Only on stat drift is the
+     * file read and its NORMALIZED content re-hashed (anchorSha), so a
+     * whitespace-only reformat stats different but hashes identical ⇒ fresh.
+     *
+     * FAIL-OPEN (PROTOCOL.md §10.2 verdict contract): a missing/unreadable
+     * anchor file (fleet-replicated rows from machines whose checkout this box
+     * doesn't have), a rel_path that would escape the root, a pre-migration DB,
+     * or ANY fs error contributes NO staleness claim — only a readable file
+     * whose normalized hash differs returns 'stale'. Never throws. Read-only
+     * (the wyrm-guard handle is readonly).
+     */
+    anchorFreshness(failureId, projectRoot) {
+        try {
+            if (!projectRoot)
+                return 'unanchored';
+            const anchors = this.getAnchors(failureId);
+            if (anchors.length === 0)
+                return 'unanchored';
+            const root = resolve(projectRoot);
+            let checkable = 0;
+            for (const a of anchors) {
+                try {
+                    const abs = resolve(root, a.rel_path);
+                    // Defense-in-depth mirror of the write-time rule: a row whose
+                    // rel_path escapes the root is never read (or judged).
+                    if (!abs.startsWith(root + sep))
+                        continue;
+                    const st = statSync(abs, { bigint: true });
+                    if (!st.isFile())
+                        continue;
+                    if (st.size === a.size && st.mtimeNs === a.mtime_ns) {
+                        checkable++; // stat fast path: byte-identical file, no hashing
+                        continue;
+                    }
+                    if (FailurePatterns.anchorSha(readFileSync(abs, 'utf-8')) === a.sha) {
+                        checkable++; // touched/reformatted, semantically unchanged
+                        continue;
+                    }
+                    return 'stale'; // POSITIVE drift: readable file, normalized hash differs
+                }
+                catch {
+                    // missing/unreadable — no claim from this anchor (fail-open)
+                }
+            }
+            return checkable > 0 ? 'fresh' : 'unanchored';
+        }
+        catch {
+            return 'unanchored';
+        }
+    }
+    /**
+     * The SHARED downgrade rule both firewall surfaces inherit — the MCP
+     * wyrm_failure_check handler AND the wyrm-guard block tiers call exactly
+     * this, so the two cannot drift. Returns the ids of matches whose hard
+     * block must DOWNGRADE to advisory (stale_anchor), i.e. matches that are:
+     *
+     *   · NOT an exact-signature match for the current attempt — an exact
+     *     command/edit signature match KEEPS its hard block regardless of
+     *     anchors (code moving on does not unprove a command failure), and
+     *   · file/symbol-scoped — only matches ABOUT source code are unproven by
+     *     that source changing; command/edit/prompt scopes key on the ATTEMPT
+     *     itself and never downgrade, and
+     *   · positively 'stale' under anchorFreshness above.
+     *
+     * Fail-open end to end: no project root, no anchors, missing files, any
+     * error ⇒ ids stay out of the set ⇒ verdict unchanged. Never throws.
+     */
+    staleAnchorIds(matches, projectRoot) {
+        const stale = new Set();
+        if (!projectRoot)
+            return stale;
+        const judged = new Map();
+        for (const m of matches) {
+            try {
+                if (m.match === 'exact')
+                    continue;
+                if (m.scope !== 'file' && m.scope !== 'symbol')
+                    continue;
+                let verdict = judged.get(m.id);
+                if (verdict === undefined) {
+                    verdict = this.anchorFreshness(m.id, projectRoot);
+                    judged.set(m.id, verdict);
+                }
+                if (verdict === 'stale')
+                    stale.add(m.id);
+            }
+            catch {
+                // staleness is advisory — an error can only mean "no claim"
+            }
+        }
+        return stale;
+    }
+    // ── v7 F2 (T015): run-quarantine promotion (all debrief-INDEPENDENT) ──────
+    /**
+     * Confirmation ledger + the ≥2-distinct-agents auto-promotion path.
+     *
+     * Every record() of a signature by a KNOWN agent_id files one confirmation
+     * row in failure_confirmations (migration 21). PK (failure_id, agent_id)
+     * makes COUNT(*) the DISTINCT-agent count by construction: the same agent
+     * re-recording N times stays ONE confirmation, and unattributed re-records
+     * (ambient agent_id NULL) still increment occurrences but can never
+     * establish distinctness, so they never count.
+     *
+     * When a 'run'-quarantined failure reaches ≥2 distinct agents it
+     * auto-promotes to 'project' ('global' for project-NULL rows — see
+     * applyPromotion): two independent agents hitting the same wall is a real
+     * pattern, not single-agent run noise. Works with zero wyrm_run/debrief
+     * involvement (that tooling arrives in F3) and across runs — record()'s
+     * dedup matches by signature regardless of quarantine tier, so a sibling
+     * fleet independently re-hitting the failure confirms it too.
+     *
+     * Under-counts safely: two agents that BOTH fall back to the same
+     * clientInfo name (e.g. 'claude-code') collapse into one confirmation —
+     * the fallback can delay promotion, never force it.
+     */
+    noteConfirmation(failureId, ambient) {
+        if (ambient.agent_id === null)
+            return;
+        this.db.prepare(`
       INSERT OR IGNORE INTO failure_confirmations (failure_id, agent_id, run_id)
       VALUES (?, ?, ?)
-    `).run(e,t.agent_id,t.run_id);const n=this.get(e);if(!n||n.quarantine_scope!=="run")return;const{n:r}=this.db.prepare("SELECT COUNT(*) AS n FROM failure_confirmations WHERE failure_id = ?").get(e);r>=2&&this.applyPromotion(e,"project")}applyPromotion(e,t){const n=this.get(e);if(!n)return!1;const r=t==="project"&&n.project_id===null?"global":t;return T[r]<=T[n.quarantine_scope]?!1:(this.db.prepare("UPDATE failure_patterns SET quarantine_scope = ? WHERE id = ?").run(r,e),b(this.db,{projectId:n.project_id??0,kind:"failure",refTable:"failure_patterns",refId:e}),!0)}promote(e,t){if(!j(E()))return{row:this.get(e),authorized:!1,changed:!1};const n=this.applyPromotion(e,t);return{row:this.get(e),authorized:!0,changed:n}}sweepRunQuarantine(e){const t=Math.max(1,Math.floor(e?.runInactiveHours??24)),n=`-${t} hours`,r=Date.now()-t*36e5,o=A(),c=this.db.transaction(()=>{const s=this.db.prepare(`
+    `).run(failureId, ambient.agent_id, ambient.run_id);
+        const row = this.get(failureId);
+        if (!row || row.quarantine_scope !== 'run')
+            return;
+        const { n } = this.db.prepare('SELECT COUNT(*) AS n FROM failure_confirmations WHERE failure_id = ?').get(failureId);
+        if (n >= 2)
+            this.applyPromotion(failureId, 'project');
+    }
+    /**
+     * The ungated internal promotion primitive. Monotonic: run → project →
+     * global, NEVER narrows. 'project' on a project_id-NULL row normalizes to
+     * 'global' — 6.x check() matches NULL-project rows from every project, so
+     * labeling one 'project' would be false (same rationale as the migration-20
+     * backfill). Emits a reference-only failure event on an actual widening so
+     * live-memory followers re-read the row's new authority (failures stay
+     * private: is_shared=0, never replicated).
+     */
+    applyPromotion(id, tier) {
+        const row = this.get(id);
+        if (!row)
+            return false;
+        const effective = tier === 'project' && row.project_id === null ? 'global' : tier;
+        if (TIER_RANK[effective] <= TIER_RANK[row.quarantine_scope])
+            return false;
+        this.db.prepare('UPDATE failure_patterns SET quarantine_scope = ? WHERE id = ?').run(effective, id);
+        emitEvent(this.db, {
+            projectId: row.project_id ?? 0, kind: 'failure',
+            refTable: 'failure_patterns', refId: id,
+        });
+        return true;
+    }
+    /**
+     * The orchestrator promote flag behind wyrm_failure_record/_resolve
+     * `promote:'project'|'global'`.
+     *
+     * AUTHORITY MODEL (Article VII — the documented rule, enforced by
+     * boundary.hasExplicitAttribution on the AMBIENT envelope): the flag is
+     * honored ONLY when the caller carries EXPLICIT identity — a run_id (run
+     * ids never come from the clientInfo fallback) or an agent_id supplied via
+     * param/_meta/Wyrm-Actor-header/env. The bare clientInfo fallback that
+     * every anonymous MCP caller gets for free carries NO promotion authority.
+     * Denial is visible, never silent: `authorized:false` comes back and the
+     * tool handler reports the ignored flag in its response text.
+     */
+    promote(id, tier) {
+        if (!hasExplicitAttribution(getActor())) {
+            return { row: this.get(id), authorized: false, changed: false };
+        }
+        const changed = this.applyPromotion(id, tier);
+        return { row: this.get(id), authorized: true, changed };
+    }
+    /**
+     * The run-quarantine MAINTENANCE SWEEP — the third debrief-independent
+     * promotion path, wired into wyrm_maintenance (and shipped in the same
+     * commit as the quarantine, per spec FR-2). One transaction; idempotent —
+     * a second sweep over a settled DB changes zero rows.
+     *
+     * Run lifecycle enforced (works with NO runs rows at all — wyrm_run is F3):
+     *  1. EXPIRE abandoned-run noise (TTL auto-expiry): unresolved 'run'-scoped
+     *     failures whose runs row says status='abandoned' — an EXPLICIT verdict
+     *     (an orchestrator/operator junked the run, or a previous sweep TTL'd
+     *     it) — are auto-resolved with a note. Noise never reaches project
+     *     memory; history is kept (resolve, not delete).
+     *  2. PROMOTE unresolved 'run'-scoped failures from runs that are OVER or
+     *     INACTIVE past the TTL — the run ended without resolving or debriefing
+     *     them, and quarantined learning must not die with its run:
+     *       - runs.status IN ('completed','failed'): definitively over;
+     *       - runs.status='running' but BOTH runs.updated_at and the newest
+     *         run-tagged event are older than the TTL: a crashed/stalled fleet;
+     *       - no runs row at all (the common F2 shape: an orchestrator exports
+     *         WYRM_RUN_ID without registering a run) and BOTH the failure's
+     *         last_seen and the newest run-tagged event are older than the TTL.
+     *     Target tier: 'project' ('global' when project_id IS NULL).
+     *  3. MARK the TTL-stalled 'running' runs of step 2 'abandoned' — AFTER
+     *     their failures were promoted (a crash must not lose learning). Any
+     *     LATE write that re-quarantines against such a dead run is noise and
+     *     expires on the next sweep via step 1.
+     *
+     * Activity signal: run-tagged events (idx_events_run) — every attributed
+     * write emits one, so a live fleet continuously refreshes its run; reads
+     * (failure_check) never keep a run alive. THE SIGNAL ONLY EXISTS WHILE LIVE
+     * MEMORY IS ON: emitEvent is WYRM_LIVE_MEMORY-gated, so with it off a fully
+     * active fleet produces ZERO run-tagged events and "no recent events" is
+     * silence, not evidence of a dead run. The sweep therefore degrades
+     * EXPLICITLY in that mode: the inactivity/TTL paths — the stalled-'running'
+     * clause, the no-runs-row (orphan) clause, and the step-3 abandon — are
+     * SKIPPED, only the explicit-verdict paths act (status='abandoned' expiry,
+     * status IN ('completed','failed') promotion), and the result carries
+     * `degraded` naming the mode so maintenance output can say why nothing
+     * promoted. Deterministic, zero LLM calls (Article III); every value is a
+     * bound parameter (the datetime() modifier and the TTL-path gate are bound
+     * too, never spliced into SQL).
+     */
+    sweepRunQuarantine(opts) {
+        const hours = Math.max(1, Math.floor(opts?.runInactiveHours ?? 24));
+        const cut = `-${hours} hours`; // datetime('now', @cut) modifier, bound
+        const cutMs = Date.now() - hours * 3_600_000; // events.created_at is INTEGER ms
+        // @ttl gate: 1 only when the run-tagged-event heartbeat can exist at all
+        // (see the doc comment) — the inactivity clauses must not read its
+        // absence as inactivity when live memory is off.
+        const eventSignal = isLiveMemoryEnabled();
+        const sweep = this.db.transaction(() => {
+            // 1. EXPIRE abandoned-run noise.
+            const expired = this.db.prepare(`
         UPDATE failure_patterns
         SET resolved = 1,
-            resolution_note = COALESCE(resolution_note || ' \xB7 ', '')
+            resolution_note = COALESCE(resolution_note || ' · ', '')
               || 'auto-expired by run-quarantine sweep: run ' || run_id || ' was abandoned'
         WHERE resolved = 0 AND quarantine_scope = 'run' AND run_id IS NOT NULL
           AND run_id IN (SELECT run_id FROM runs WHERE status = 'abandoned')
-      `).run().changes,i=this.db.prepare(`
+      `).run().changes;
+            // 2. PROMOTE from over/inactive runs. Select-then-update (inside the
+            // same transaction, so still atomic) — the promoted ids emit
+            // reference-only events after commit.
+            const promotedIds = this.db.prepare(`
         SELECT fp.id FROM failure_patterns fp
         WHERE fp.resolved = 0 AND fp.quarantine_scope = 'run' AND fp.run_id IS NOT NULL
           AND (
@@ -69,18 +616,155 @@ ${n}
               )
             )
           )
-      `).all({cut:n,cutMs:r,ttl:o?1:0}).map(d=>d.id),u=this.db.prepare(`
+      `).all({ cut, cutMs, ttl: eventSignal ? 1 : 0 }).map((r) => r.id);
+            const widen = this.db.prepare(`
         UPDATE failure_patterns
         SET quarantine_scope = CASE WHEN project_id IS NULL THEN 'global' ELSE 'project' END
         WHERE id = ?
-      `);for(const d of i)u.run(d);const p=o?this.db.prepare(`
+      `);
+            for (const id of promotedIds)
+                widen.run(id);
+            // 3. TTL-abandon the stalled running runs (after step 2 promoted them).
+            // Event-dependent like the step-2 TTL clauses: without the heartbeat a
+            // 'running' run cannot be judged dead, so it is left alone.
+            const abandoned = !eventSignal ? 0 : this.db.prepare(`
         UPDATE runs SET status = 'abandoned', updated_at = datetime('now')
         WHERE status = 'running' AND updated_at < datetime('now', @cut)
           AND NOT EXISTS (
             SELECT 1 FROM events e
             WHERE e.run_id = runs.run_id AND e.created_at >= @cutMs
           )
-      `).run({cut:n,cutMs:r}).changes:0;return{promotedIds:i,expired:s,abandoned:p}})();for(const s of c.promotedIds){const i=this.get(s);b(this.db,{projectId:i?.project_id??0,kind:"failure",refTable:"failure_patterns",refId:s,agentId:null,runId:null})}return{promoted:c.promotedIds.length,expired:c.expired,runs_abandoned:c.abandoned,...o?{}:{degraded:"live memory off (WYRM_LIVE_MEMORY) \u2014 run-tagged events do not exist, so the run-inactivity TTL paths were skipped; only explicit run verdicts acted (completed/failed promote, abandoned expires)"}}}check(e,t,n,r,o){return this.query(e,t,n,r??null,o).map(({_match:c,_rank:s,...i})=>i)}checkVerdict(e,t,n,r,o){const s=this.query(e,t,n,r??null,o).map(i=>this.toVerdictMatch(i,i._match,i._rank));return{blocked:s.length>0,matches:s,recorded_by_agent:s[0]?.recorded_by_agent??null,run_id:s[0]?.run_id??null,confidence:s.reduce((i,u)=>Math.max(i,u.confidence),0)}}toVerdictMatch(e,t,n=null){const r=C(e);return{id:e.id,pattern:e.signature,scope:e.scope,quarantine_scope:e.quarantine_scope,target:e.target,description:e.description,why_failed:e.why_failed,severity:e.severity,occurrences:e.occurrences,last_seen:e.last_seen,recorded_by_agent:r.actor,run_id:r.run_id,match:t,confidence:w(t,n)}}targetIdentityMatches(e,t,n,r){const o=O(t),c=o.slice(0,200);if(c.length===0)return[];const s=r?.callerRunId!==void 0?r.callerRunId:E().run_id,i=`${e}:${c}:`,u=`${e}:${c};`;return this.db.prepare(`
+      `).run({ cut, cutMs }).changes;
+            return { promotedIds, expired, abandoned };
+        })();
+        // Reference-only events for the widened rows. Explicit NULL attribution
+        // (T009 emitEvent semantics): the sweep is system maintenance — it must
+        // not inherit whoever happened to call wyrm_maintenance.
+        for (const id of sweep.promotedIds) {
+            const row = this.get(id);
+            emitEvent(this.db, {
+                projectId: row?.project_id ?? 0, kind: 'failure',
+                refTable: 'failure_patterns', refId: id, agentId: null, runId: null,
+            });
+        }
+        return {
+            promoted: sweep.promotedIds.length,
+            expired: sweep.expired,
+            runs_abandoned: sweep.abandoned,
+            // Key ABSENT (not null) on a fully-signalled sweep — the healthy result
+            // shape stays exactly { promoted, expired, runs_abandoned }.
+            ...(eventSignal ? {} : {
+                degraded: 'live memory off (WYRM_LIVE_MEMORY) — run-tagged events do not exist, '
+                    + 'so the run-inactivity TTL paths were skipped; only explicit run '
+                    + 'verdicts acted (completed/failed promote, abandoned expires)',
+            }),
+        };
+    }
+    /** Check whether a proposed action matches any unresolved failure.
+     * Stage 1: exact signature match (scope+target+description); stage 2 fallback:
+     * FTS fuzzy match within the same scope. Both ordered by occurrences DESC,
+     * last_seen DESC, LIMIT 5 — no multiplicative recency-times-occurrences score.
+     *
+     * v7 F2 (T014) run-scope awareness: 'run'-quarantined rows only match callers
+     * carrying the SAME run_id (ambient envelope by default) — 6.x rows are all
+     * 'project'/'global' so their behavior is byte-identical to 6.x. */
+    check(scope, target, description, projectId, opts) {
+        return this.query(scope, target, description, projectId ?? null, opts)
+            .map(({ _match: _m, _rank: _r, ...row }) => row);
+    }
+    /**
+     * v7 F2 (T014): the canonical structured verdict for wyrm_failure_check
+     * (spec FR-2). Same two-stage query and ordering as check() — the verdict is
+     * a richer VIEW of the same rows, so prose derived from it cannot drift from
+     * 6.x behavior. `confidence` = max over per-match matchConfidence() scores
+     * (deterministic bm25/match-tier arithmetic — Article III).
+     */
+    checkVerdict(scope, target, description, projectId, opts) {
+        const rows = this.query(scope, target, description, projectId ?? null, opts);
+        const matches = rows.map((r) => this.toVerdictMatch(r, r._match, r._rank));
+        return {
+            blocked: matches.length > 0,
+            matches,
+            recorded_by_agent: matches[0]?.recorded_by_agent ?? null,
+            run_id: matches[0]?.run_id ?? null,
+            confidence: matches.reduce((m, x) => Math.max(m, x.confidence), 0),
+        };
+    }
+    /**
+     * Map a stored row to the canonical verdict-match shape. Shared by
+     * checkVerdict() and wyrm-guard's target-identity tier (v7 F2 review fix)
+     * so the two surfaces cannot drift.
+     */
+    toVerdictMatch(r, match, bm25Rank = null) {
+        const att = resolveAttribution(r);
+        return {
+            id: r.id,
+            pattern: r.signature,
+            scope: r.scope,
+            quarantine_scope: r.quarantine_scope,
+            target: r.target,
+            description: r.description,
+            why_failed: r.why_failed,
+            severity: r.severity,
+            occurrences: r.occurrences,
+            last_seen: r.last_seen,
+            recorded_by_agent: att.actor,
+            run_id: att.run_id,
+            match,
+            confidence: matchConfidence(match, bm25Rank),
+        };
+    }
+    /**
+     * v7 F2 review fix (T016): the deterministic TARGET-IDENTITY lookup behind
+     * wyrm-guard's block tier.
+     *
+     * Production failures always carry a NON-EMPTY description (the
+     * wyrm_failure_record schema and the daemon endpoint both require one), so
+     * full-signature equality against the guard's empty-description probe could
+     * never match a real row — the documented "exact signature match" block rule
+     * was unreachable outside empty-description test fixtures.
+     *
+     * RECALL vs TRUTH — the two invariants this lookup keeps strictly separate:
+     *
+     *   · RECALL is the signature PREFIX range `scope:normalizeSignal(target):`
+     *     — description-independent, a bound-parameter range scan (no LIKE, no
+     *     template SQL), with the same project filter and run-tier gate as
+     *     query(). The 200-char signature cap and the ':' separator both live
+     *     here, so the range legitimately over-captures: a stored target that
+     *     extends the probe past a colon (probe 'npm run build', stored
+     *     'npm run build:dev') and any row sharing a truncated 200-char prefix
+     *     both land IN the range. Callers must pass the RAW (pre-normalize,
+     *     uncapped) target so the truth check below has the full string.
+     *
+     *   · TRUTH is full-string identity: a row is kept only when
+     *     normalizeIdentity(stored target) === normalizeIdentity(probe) — the
+     *     UNCAPPED normalization over the full stored column and the full
+     *     probe. Targets differing only past the signature cap are NOT
+     *     identical. (Pushing this check into SQL via the signature would be
+     *     unsound: the signature is ambiguous at the target/description
+     *     boundary — target 'npm run build:dev' + description 'x' is
+     *     byte-identical to target 'npm run build' + description 'dev:x'.)
+     *
+     * The result cap applies AFTER the truth check: prefix-cousins, however
+     * many and however highly ranked, can never crowd a genuinely identical
+     * row out of the verdict. The range scan itself pulls at most
+     * IDENTITY_SCAN_CAP rows (occurrences/recency-ordered) as a fixed work
+     * budget — past it the lookup degrades toward fail-open (a miss), never
+     * toward a false block. (query()'s FTS fuzzy stage keeps its own LIMIT 5
+     * and CAN be crowded — acceptable, because fuzzy results only ever feed
+     * warn context; the block verdict never depends on FTS recall.)
+     */
+    targetIdentityMatches(scope, target, projectId, opts) {
+        const fullTarget = normalizeIdentity(target);
+        const normTarget = fullTarget.slice(0, 200); // === normalizeSignal(target): the stored-signature key
+        if (normTarget.length === 0)
+            return []; // an empty prefix would match every row in scope
+        const callerRun = opts?.callerRunId !== undefined ? opts.callerRunId : getActor().run_id;
+        // Half-open prefix range under SQLite's binary collation: every signature
+        // beginning with `scope:target:` sorts in [`...:`, `...;`) (';' is ':'+1).
+        const lo = `${scope}:${normTarget}:`;
+        const hi = `${scope}:${normTarget};`;
+        const rows = this.db.prepare(`
       SELECT * FROM failure_patterns
       WHERE resolved = 0
         AND signature >= @lo AND signature < @hi
@@ -88,51 +772,188 @@ ${n}
         AND (quarantine_scope <> 'run' OR run_id = @run)
       ORDER BY occurrences DESC, last_seen DESC
       LIMIT @cap
-    `).all({lo:i,hi:u,project:n??null,run:s,cap:U}).filter(d=>O(d.target)===o).slice(0,k)}recordBlock(e,t){if(!(!e.blocked||e.matches.length===0))try{const n=E();this.db.prepare(`
+    `).all({
+            lo, hi, project: projectId ?? null, run: callerRun, cap: IDENTITY_SCAN_CAP,
+        });
+        // TRUTH check first, result cap second (see the doc comment): identity is
+        // re-verified on the FULL stored column against the FULL probe, and only
+        // then are the top IDENTITY_MATCH_LIMIT kept — capping before filtering
+        // would let higher-ranked prefix-cousins evict the identical row.
+        return rows
+            .filter((r) => normalizeIdentity(r.target) === fullTarget)
+            .slice(0, IDENTITY_MATCH_LIMIT);
+    }
+    // ── v7 F2 (T017): prevented-repeat analytics ───────────────────────────────
+    /**
+     * Count one prevented repeat: a blocked:true verdict files ONE row in the
+     * failure_blocks ledger (migration 22 — the documented storage choice lives
+     * on that migration), attributed to the CHECKING agent/run from the ambient
+     * actor envelope — the agent that was about to repeat the failure, not the
+     * recorder. failure_id is the verdict's top blocker (matches[0]).
+     *
+     * Deliberately a SEPARATE method, not a side effect inside checkVerdict():
+     * checks must stay pure reads — wyrm-guard (T016) runs checkVerdict() over a
+     * READONLY DB handle and a write inside it would crash every guard probe.
+     * Counting surfaces: the MCP wyrm_failure_check handler (the logSavings
+     * precedent — it already writes savings on the same path), and — v7 F2
+     * review fix — wyrm-guard's block path via a separate short-lived RW
+     * connection (best-effort, fail-open), so the harness-enforced blocks feed
+     * the FR-2 ROI number too. Remaining uncounted (documented): the agent-loop
+     * internalDispatch failure_check.
+     *
+     * NEVER throws (the emitEvent contract): the check already succeeded — a
+     * readonly handle, SQLITE_BUSY, or a pre-migration-22 DB must never turn a
+     * successful read into a failure for the sake of analytics.
+     */
+    recordBlock(verdict, projectId) {
+        if (!verdict.blocked || verdict.matches.length === 0)
+            return;
+        try {
+            const ambient = getActor();
+            // Attribute the prevented repeat to the match that ACTUALLY blocked — the
+            // first NON-downgraded match. After a staleness downgrade matches[0] can
+            // be an advisory (stale_anchor) match while a later firm match holds the
+            // block; crediting matches[0] would misattribute the wyrm_stats ledger.
+            const firm = verdict.matches.find((m) => !m.stale_anchor) ?? verdict.matches[0];
+            this.db.prepare(`
         INSERT INTO failure_blocks (failure_id, project_id, agent_id, run_id)
         VALUES (?, ?, ?, ?)
-      `).run(e.matches[0].id,t??null,n.agent_id,n.run_id)}catch{}}pruneBlocks(e){const t=Math.max(1,Math.floor(e));try{return this.db.prepare("DELETE FROM failure_blocks WHERE blocked_at < datetime('now', @cut)").run({cut:`-${t} days`}).changes}catch{return 0}}failureStats(e){const t=e?.projectId??null,n=e?.callerRunId!==void 0?e.callerRunId:E().run_id,r={project:t},o=this.db.prepare(`
+      `).run(firm.id, projectId ?? null, ambient.agent_id, ambient.run_id);
+        }
+        catch { /* best-effort analytics — log-and-drop, never break the check */ }
+    }
+    /**
+     * v7 F2 review fix: retention for the failure_blocks ledger (migration 22).
+     * The ledger is append-only and caller-amplifiable — every blocked
+     * wyrm_failure_check (a read tool, no rate limit) files one row, and nothing
+     * pruned it, so a loop probing one known-blocked signature could grow the
+     * table without bound. wyrm_maintenance calls this with the SAME retention
+     * knob as the event log (WYRM_EVENT_RETAIN_DAYS, default 90d) — mirroring
+     * pruneEvents. Bound parameter for the datetime modifier (never spliced);
+     * best-effort on a pre-migration-22 DB (returns 0).
+     */
+    pruneBlocks(olderThanDays) {
+        const days = Math.max(1, Math.floor(olderThanDays));
+        try {
+            return this.db.prepare(`DELETE FROM failure_blocks WHERE blocked_at < datetime('now', @cut)`).run({ cut: `-${days} days` }).changes;
+        }
+        catch {
+            return 0;
+        }
+    }
+    /**
+     * The `wyrm_stats view=failures` aggregation (spec FR-2 prevented-repeat
+     * analytics): per-run/per-agent recorded-failure attribution + "N repeats
+     * blocked this run". Pure indexed COUNT/GROUP BY (idx_failure_run,
+     * idx_failure_quarantine, idx_failure_blocks_run) with always-bound params —
+     * deterministic, zero LLM calls (Article III). Project filter is EXACT
+     * (rows recorded for that project_id); omitted = all rows, the fleet view.
+     */
+    failureStats(opts) {
+        const projectId = opts?.projectId ?? null;
+        const callerRun = opts?.callerRunId !== undefined ? opts.callerRunId : getActor().run_id;
+        const p = { project: projectId };
+        const totals = this.db.prepare(`
       SELECT COUNT(*) AS total, COALESCE(SUM(resolved = 0), 0) AS unresolved
       FROM failure_patterns WHERE (@project IS NULL OR project_id = @project)
-    `).get(r),c={run:0,project:0,global:0};for(const _ of this.db.prepare(`
+    `).get(p);
+        const byQuarantine = { run: 0, project: 0, global: 0 };
+        for (const r of this.db.prepare(`
       SELECT quarantine_scope AS k, COUNT(*) AS n FROM failure_patterns
       WHERE (@project IS NULL OR project_id = @project) GROUP BY quarantine_scope
-    `).all(r))c[_.k]=_.n;const s={file:0,symbol:0,command:0,prompt:0,edit:0};for(const _ of this.db.prepare(`
+    `).all(p))
+            byQuarantine[r.k] = r.n;
+        const byScope = { file: 0, symbol: 0, command: 0, prompt: 0, edit: 0 };
+        for (const r of this.db.prepare(`
       SELECT scope AS k, COUNT(*) AS n FROM failure_patterns
       WHERE (@project IS NULL OR project_id = @project) GROUP BY scope
-    `).all(r))s[_.k]=_.n;const i=_=>_.map(N=>({who:m(N.agent_id),count:N.count})),u=i(this.db.prepare(`
+    `).all(p))
+            byScope[r.k] = r.n;
+        // GROUP BY the raw column (one NULL group), display via readActor —
+        // 'legacy' is read-time presentation only, never stored (src/attribution.ts).
+        // Four FIXED query literals (no table-name interpolation — the hygiene
+        // ratchet's zero-template-SQL floor stays clean); LIMIT 10 is the
+        // deterministic bucket bound (count DESC, name ASC tiebreak).
+        const toAgentBuckets = (rows) => rows.map((r) => ({ who: readActor(r.agent_id), count: r.count }));
+        const recordedByAgent = toAgentBuckets(this.db.prepare(`
       SELECT agent_id, COUNT(*) AS count FROM failure_patterns
       WHERE (@project IS NULL OR project_id = @project)
       GROUP BY agent_id ORDER BY count DESC, agent_id ASC LIMIT 10
-    `).all(r)),p=this.db.prepare(`
+    `).all(p));
+        const recordedByRun = this.db.prepare(`
       SELECT run_id, COUNT(*) AS count FROM failure_patterns
       WHERE run_id IS NOT NULL AND (@project IS NULL OR project_id = @project)
       GROUP BY run_id ORDER BY count DESC, run_id ASC LIMIT 10
-    `).all(r),d=i(this.db.prepare(`
+    `).all(p);
+        const blockedByAgent = toAgentBuckets(this.db.prepare(`
       SELECT agent_id, COUNT(*) AS count FROM failure_blocks
       WHERE (@project IS NULL OR project_id = @project)
       GROUP BY agent_id ORDER BY count DESC, agent_id ASC LIMIT 10
-    `).all(r)),R=this.db.prepare(`
+    `).all(p));
+        const blockedByRun = this.db.prepare(`
       SELECT run_id, COUNT(*) AS count FROM failure_blocks
       WHERE run_id IS NOT NULL AND (@project IS NULL OR project_id = @project)
       GROUP BY run_id ORDER BY count DESC, run_id ASC LIMIT 10
-    `).all(r),f=this.db.prepare(`
+    `).all(p);
+        const conf = this.db.prepare(`
       SELECT COUNT(*) AS total, COUNT(DISTINCT fc.agent_id) AS distinct_agents
       FROM failure_confirmations fc
       JOIN failure_patterns fp ON fp.id = fc.failure_id
       WHERE (@project IS NULL OR fp.project_id = @project)
-    `).get(r),S=this.db.prepare(`
+    `).get(p);
+        const blockedTotal = this.db.prepare(`
       SELECT COUNT(*) AS n FROM failure_blocks WHERE (@project IS NULL OR project_id = @project)
-    `).get(r).n,h=this.db.prepare(`
+    `).get(p).n;
+        // `run_id = NULL` is never true in SQL — a runless caller reads 0, the
+        // same always-bound-param shape as the query() run gate.
+        const thisRunBlocked = this.db.prepare(`
       SELECT COUNT(*) AS n FROM failure_blocks
       WHERE run_id = @run AND (@project IS NULL OR project_id = @project)
-    `).get({...r,run:n}).n,l=this.db.prepare(`
+    `).get({ ...p, run: callerRun }).n;
+        const topBlocked = this.db.prepare(`
       SELECT fb.failure_id, fp.scope, fp.target, COUNT(*) AS blocks
       FROM failure_blocks fb
       JOIN failure_patterns fp ON fp.id = fb.failure_id
       WHERE (@project IS NULL OR fb.project_id = @project)
       GROUP BY fb.failure_id ORDER BY blocks DESC, fb.failure_id ASC LIMIT 5
-    `).all(r);return{view:"failures",project_id:t,recorded:{total:o.total,unresolved:o.unresolved,by_quarantine_scope:c,by_scope:s,by_agent:u,by_run:p},confirmations:{total:f.total,distinct_agents:f.distinct_agents},blocked:{total:S,by_agent:d,by_run:R,this_run:{run_id:n??null,blocked:h},top_blocked:l}}}query(e,t,n,r,o){const c=o?.callerRunId!==void 0?o.callerRunId:E().run_id,s=o?.runScope??"any",i={project:r,run:c,tier:s==="any"?null:s},u=g.signature(e,t,n),p=this.db.prepare(`
+    `).all(p);
+        return {
+            view: 'failures',
+            project_id: projectId,
+            recorded: {
+                total: totals.total,
+                unresolved: totals.unresolved,
+                by_quarantine_scope: byQuarantine,
+                by_scope: byScope,
+                by_agent: recordedByAgent,
+                by_run: recordedByRun,
+            },
+            confirmations: { total: conf.total, distinct_agents: conf.distinct_agents },
+            blocked: {
+                total: blockedTotal,
+                by_agent: blockedByAgent,
+                by_run: blockedByRun,
+                this_run: { run_id: callerRun ?? null, blocked: thisRunBlocked },
+                top_blocked: topBlocked,
+            },
+        };
+    }
+    /** The shared two-stage match query behind check()/checkVerdict(). */
+    query(scope, target, description, projectId, opts) {
+        // 'run'-tier gate: the caller's run from the ambient envelope unless
+        // explicitly supplied. `run_id = NULL` is never true in SQL, so a caller
+        // with no run simply never sees run-quarantined rows. The optional tier
+        // filter is an always-bound nullable param (@tier IS NULL = 'any') — no
+        // SQL assembled from values (hygiene ratchet: zero template interpolation).
+        const callerRun = opts?.callerRunId !== undefined ? opts.callerRunId : getActor().run_id;
+        const runScope = opts?.runScope ?? 'any';
+        const params = {
+            project: projectId,
+            run: callerRun,
+            tier: runScope === 'any' ? null : runScope,
+        };
+        const signature = FailurePatterns.signature(scope, target, description);
+        const exact = this.db.prepare(`
       SELECT *, NULL AS _rank FROM failure_patterns
       WHERE resolved = 0 AND signature = @sig
         AND (project_id IS @project OR project_id = @project OR project_id IS NULL)
@@ -140,7 +961,35 @@ ${n}
         AND (@tier IS NULL OR quarantine_scope = @tier)
       ORDER BY occurrences DESC, last_seen DESC
       LIMIT 5
-    `).all({...i,sig:u});if(p.length>0)return p.map(l=>({...l,_match:"exact",_rank:null}));const d=I(`${t} ${n}`.slice(0,100));if(!d)return[];const R=d.split(" ").filter(l=>/[\p{L}\p{N}]/u.test(l)),f=R.filter(l=>!M.has(l.toLowerCase())),S=f.length?f:R;if(S.length===0)return[];const h=S.map(l=>`"${l.replace(/"/g,"")}"`).join(" ");try{return this.db.prepare(`
+    `).all({ ...params, sig: signature });
+        if (exact.length > 0)
+            return exact.map((r) => ({ ...r, _match: 'exact', _rank: null }));
+        // Fuzzy fallback: FTS over description + target, bm25-ranked for the
+        // deterministic confidence score (ordering stays the 6.x occurrences/
+        // recency order — confidence is reported, not used to reorder).
+        //
+        // v7 F2 (T016): each term is quoted into a phrase (implicit AND preserved —
+        // this stage wants precision, unlike buildFtsMatchQuery's OR). Chars that
+        // survive sanitizeFtsQuery but are FTS5 operators in bareword position
+        // ('-', '+', '/', …) previously made MATCH throw "syntax error" — silently
+        // swallowed into ZERO recall for any probe with a shell flag or path, the
+        // guard's main input class. Quoting is operator-safe ('"' itself is already
+        // stripped); tokens with no letter/digit would be zero-token phrases that
+        // AND-zero the whole query, so they are dropped.
+        const q = sanitizeFtsQuery(`${target} ${description}`.slice(0, 100));
+        if (!q)
+            return [];
+        const allTerms = q.split(' ').filter((t) => /[\p{L}\p{N}]/u.test(t));
+        // Drop function-word filler so a reworded repeat still AND-matches on its
+        // CONTENT words (precision-preserving — see FUZZY_STOPWORDS); fall back to the
+        // full term set if filtering would empty the probe.
+        const content = allTerms.filter((t) => !FUZZY_STOPWORDS.has(t.toLowerCase()));
+        const terms = content.length ? content : allTerms;
+        if (terms.length === 0)
+            return [];
+        const probe = terms.map((t) => `"${t.replace(/"/g, '')}"`).join(' ');
+        try {
+            const fuzzy = this.db.prepare(`
         SELECT fp.*, bm25(failure_patterns_fts) AS _rank FROM failure_patterns fp
         JOIN failure_patterns_fts fts ON fts.rowid = fp.id
         WHERE failure_patterns_fts MATCH @q
@@ -151,11 +1000,43 @@ ${n}
           AND (@tier IS NULL OR fp.quarantine_scope = @tier)
         ORDER BY fp.occurrences DESC, fp.last_seen DESC
         LIMIT 5
-      `).all({...i,q:h,scope:e}).map(_=>({..._,_match:"fuzzy"}))}catch{return[]}}list(e,t=20){return e==null?this.db.prepare(`SELECT * FROM failure_patterns WHERE resolved = 0
-         ORDER BY last_seen DESC LIMIT ?`).all(t):this.db.prepare(`SELECT * FROM failure_patterns
+      `).all({ ...params, q: probe, scope });
+            return fuzzy.map((r) => ({ ...r, _match: 'fuzzy' }));
+        }
+        catch {
+            return [];
+        }
+    }
+    /** List unresolved failures in a project, most-recent-first. */
+    list(projectId, limit = 20) {
+        if (projectId == null) {
+            return this.db.prepare(`SELECT * FROM failure_patterns WHERE resolved = 0
+         ORDER BY last_seen DESC LIMIT ?`).all(limit);
+        }
+        return this.db.prepare(`SELECT * FROM failure_patterns
        WHERE resolved = 0 AND project_id = ?
-       ORDER BY last_seen DESC LIMIT ?`).all(e,t)}resolve(e,t){return this.db.prepare(`
+       ORDER BY last_seen DESC LIMIT ?`).all(projectId, limit);
+    }
+    /** Mark a failure as resolved (the underlying issue was fixed). */
+    resolve(id, note) {
+        this.db.prepare(`
       UPDATE failure_patterns
       SET resolved = 1, resolution_note = ?
       WHERE id = ?
-    `).run(t??null,e),this.get(e)}delete(e){return this.db.prepare("DELETE FROM failure_patterns WHERE id = ?").run(e).changes>0}}export{g as FailurePatterns,w as matchConfidence,O as normalizeIdentity,L as normalizeSignal,q as renderFailureStats};
+    `).run(note ?? null, id);
+        return this.get(id);
+    }
+    /** Permanently delete a failure (use sparingly — resolve() is preferred). */
+    delete(id) {
+        // Anchors go with their failure (SQLite FKs are off by default, so the
+        // REFERENCES clause alone would orphan them). Best-effort: a
+        // pre-migration-30 DB has no table and the delete must still succeed.
+        try {
+            this.db.prepare('DELETE FROM failure_anchors WHERE failure_id = ?').run(id);
+        }
+        catch { /* pre-migration-30 DB */ }
+        const info = this.db.prepare('DELETE FROM failure_patterns WHERE id = ?').run(id);
+        return info.changes > 0;
+    }
+}
+//# sourceMappingURL=failure-patterns.js.map