ArcadeAI
diff --git a/‎.claude/settings.json‎
Lines changed: 17 additions & 0 deletions b/‎.claude/settings.json‎
Lines changed: 17 additions & 0 deletions
diff --git a/‎.gitignore‎
Lines changed: 1 addition & 0 deletions b/‎.gitignore‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎.project/tickets/1B46CT-retro-legacy-retirement/ticket.md‎
Lines changed: 108 additions & 0 deletions b/‎.project/tickets/1B46CT-retro-legacy-retirement/ticket.md‎
Lines changed: 108 additions & 0 deletions
diff --git a/‎.project/tickets/1FGE1C-robust-tracker-dedup/ticket.md‎
Lines changed: 79 additions & 0 deletions b/‎.project/tickets/1FGE1C-robust-tracker-dedup/ticket.md‎
Lines changed: 79 additions & 0 deletions
diff --git a/‎.project/tickets/1M20EW-retro-fixed-vs-present-friction/ticket.md‎
Lines changed: 54 additions & 0 deletions b/‎.project/tickets/1M20EW-retro-fixed-vs-present-friction/ticket.md‎
Lines changed: 54 additions & 0 deletions
@@ -118,6 +118,14 @@
             "command": "bun \"$CLAUDE_PROJECT_DIR\"/.safeword/hooks/prompt-questions.ts"
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bun \"$CLAUDE_PROJECT_DIR\"/.safeword/hooks/prompt-retro-nudge.ts"
+          }
+        ]
       }
     ],
     "Stop": [
@@ -144,6 +152,15 @@
             "command": "bun \"$CLAUDE_PROJECT_DIR\"/.safeword/hooks/stop-self-report.ts"
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bun \"$CLAUDE_PROJECT_DIR\"/.safeword/hooks/stop-retro.ts",
+            "async": true
+          }
+        ]
       }
     ],
     "PreToolUse": [
 
@@ -9,6 +9,7 @@ examples/
 # Safeword - Local cache and transient state
 .safeword/.update-cache.json
 .safeword/self-reports/
+.safeword/retro-drafts/
 .safeword-project/quality-state*.json
 .safeword-project/cursor-run-identity.json
 .safeword-project/codex-run-identity.json
 
@@ -0,0 +1,108 @@
+---
+id: 1B46CT
+slug: retro-legacy-retirement
+type: task
+phase: todo
+status: todo
+parent: RV9JT4-retro-transcript-mining
+scope: |
+  Retire the retro code/paths that ZFGWS1 (delta re-arm + signature dedupe) and
+  the Codex/Cursor invisibility tickets (#551/#552) make dead. Grounded in a usage
+  sweep + an independent quality-review (2026-06-30). Grouped by WHEN deletion is
+  safe.
+
+  VERIFICATION (quality-review C1 — load-bearing): do NOT verify with knip. Both
+  `knip.json` and `packages/cli/knip.json` IGNORE `templates/**` and `.safeword/**`
+  (knip.json:2, packages/cli/knip.json:2), so knip reports zero orphans for these
+  functions whether or not callers exist — the check is unfalsifiable. Verify with
+  a REPO-WIDE GREP (`grep -rn "<symbol>" packages/cli/src packages/cli/templates
+  .safeword tests`) returning zero hits, plus a green build + test run.
+
+  EVERY deletion PR must, in the SAME PR (quality-review C2): edit the
+  `templates/**` source, sync the `.safeword/**` byte-mirror, update `schema.ts`
+  managed-file pairs if an entry is removed, AND drop the method from all test
+  fakes — or the `IssueTracker` type check / live `.safeword` hooks break.
+
+  TIER 1 — delete WITH ZFGWS1:
+  - `searchByTitle` title-dedupe path: transport impl (github-rest.ts:70), the
+    `IssueTracker` port entry (triage.ts:39), the call (triage.ts:82), AND the
+    test fakes (triage.test.ts:50, github-rest.test.ts:67, tests/commands/
+    retro.test.ts:19). Replaced by signature matching. Verified safe: no dynamic
+    imports, no string refs, no guide calls it (the self-report + retro guides
+    dedupe via `gh`/`--findings`, not this method).
+  - The fire-once `hasNudged` gate INSIDE `decideRetroRun` (retro-trigger.ts:318)
+    — replaced by the re-arm offset state. (File-based sentinel, not an in-memory
+    boolean — C3 wording fix.) The `hasNudged`/`markNudged` helpers themselves
+    STAY until Tier 2 (still used by `decideRetroNudge`).
+  - Collateral (already in ZFGWS1 scope; note here so it's not forgotten):
+    `model:'haiku'` at retro.ts:113 + retro-extract.ts:155 → sonnet; and
+    `buildDigest`'s head-cap (retro-extract.ts:210-233) does NOT delete but
+    CHANGES meaning (cap now applies to a pre-sliced window, not the head).
+
+  TIER 2 — delete WITH #551/#552 (Codex/Cursor invisibility):
+  - The in-conversation nudge path: `decideRetroNudge` + `buildRetroNudge` +
+    `hasNudged`/`markNudged`/`sentinelPath`/`sentinelName` (retro-trigger.ts). For
+    Claude these are ALREADY dead (stop-retro.ts uses `decideRetroRun`); they
+    survive only via `codex/stop.ts` + `cursor/stop.ts`. Confirmed consumers
+    (incl. tests: retro-trigger.test.ts, codex/cursor/stop-retro integration
+    tests). Same-PR rule applies: templates + `.safeword` mirror + schema.ts +
+    integration tests together.
+
+  TIER 3 — consolidation design call (NOT a blind delete):
+  - Deterministic self-report spool (`stop-self-report.ts` + `lib/self-report.ts`)
+    vs qualitative invisible retro: different CAPTURE (allowlisted spool signals vs
+    LLM extraction), CADENCE (every Stop w/ signals vs once+re-arm), and EGRESS
+    (agent files w/ title-dedupe vs code files w/ signature-dedupe). Their FILING
+    paths overlap. Folding the spool into retro's invisible+egress pipeline is a
+    sound design QUESTION — BUT `stop-self-report.ts` is the ONLY remaining
+    in-conversation `additionalContext` surface after 7D8PJP; folding MUST
+    explicitly re-home that signal or it's lost. Own ticket; keep separate until
+    decided.
+
+  TICKETS: 1FGE1C (robust-tracker-dedup) — signature dedupe absorbed by ZFGWS1 →
+  close/annotate once ZFGWS1 covers its done_when.
+out_of_scope: |
+  - The deletions before ZFGWS1 / #551 / #552 land — this is the PLAN + the
+    post-merge grep-driven execution, not premature removal.
+  - #563 (cost gate) and 7ZCKS6 (eval) — still live, not retired.
+done_when: |
+  - Tier 1 removed in ZFGWS1's PR; `grep -rn "searchByTitle" packages/cli .safeword`
+    returns zero hits; build + tests green (NOT a knip check — knip ignores
+    templates/.safeword).
+  - Tier 2 removed when #551/#552 land; grep for the nudge+sentinel symbols returns
+    zero; `.safeword` mirror + schema.ts + integration tests updated in the same PR.
+  - Tier 3 has a recorded decision (fold w/ re-homed in-conversation surface, or
+    keep separate) in its own ticket.
+  - 1FGE1C closed/annotated as absorbed by ZFGWS1.
+created: 2026-06-30T17:20:00.000Z
+last_modified: 2026-06-30T17:20:00.000Z
+---
+
+# Retire legacy retro paths after ZFGWS1 + Codex/Cursor invisibility
+
+**Goal:** Track + drive the dead-code retirement the recall rework (ZFGWS1) and
+Codex/Cursor invisibility (#551/#552) enable, verified by grep + build/test (knip
+is blind to `templates/**` and `.safeword/**`).
+
+**Parent:** RV9JT4. **Depends on:** ZFGWS1 (Tier 1), #551/#552 (Tier 2).
+
+## Usage sweep + quality-review (2026-06-30, grounded)
+
+- `searchByTitle`: callers = triage.ts:82 (+ :39 port, github-rest.ts:70 impl) +
+  3 test fakes. No dynamic imports / string refs / guide calls. → Tier 1.
+- nudge path (`decideRetroNudge`/`buildRetroNudge`/`hasNudged`/`markNudged`/
+  `sentinelPath`): codex/stop.ts + cursor/stop.ts + tests only. → Tier 2.
+- knip IGNORES `templates/**` + `.safeword/**` (knip.json:2, packages/cli/
+  knip.json:2) → verify with grep, not knip.
+
+## Work Log
+
+- 2026-06-30T17:20Z Captured the three-tier retirement plan from a usage sweep.
+- 2026-06-30T17:27Z /quality-review (independent subprocess) → REQUEST CHANGES,
+  folded in: (C1) knip is blind to templates/.safeword → verify by grep + build/
+  test, not knip [the done_when fix]; (C2) every deletion PR must update templates
+  + `.safeword` mirror + schema.ts + test fakes together; (C3) "boolean sentinel"
+  → "fire-once `hasNudged` gate" (file-based). Added collateral (`model:'haiku'`
+  ×2, buildDigest head-cap semantic change) and the Tier-3 nuance (folding must
+  re-home stop-self-report's in-conversation surface). Tier 1/2 consumer lists
+  confirmed correct + safe.
@@ -0,0 +1,79 @@
+---
+id: 1FGE1C
+slug: robust-tracker-dedup
+parent: RV9JT4-retro-transcript-mining
+type: task
+phase: intake
+status: todo
+created: 2026-06-28T01:00:02.710Z
+last_modified: 2026-06-28T01:00:02.710Z
+scope: |
+  Replace retro's fragile fuzzy-title dedup with a robust scheme on the upstream
+  GitHub adapter + triage:
+    1. Stamp every retro-filed issue with a `retro` label and a hidden body
+       marker `<!-- retro-sig: retro:<hash> -->`. The marker is appended in
+       `buildDraft` AFTER sanitize (assembleBody takes a Finding with no
+       signature; buildDraft has the signature) so the sanitizer never touches it.
+    2. Dedup by the strongly-consistent issues-LIST API + exact marker match —
+       NOT the eventually-consistent search API. List `state=all` (see closed
+       policy below), paginated with a page cap, and scan returned bodies for the
+       marker (the list endpoint returns `body`, so no per-issue GET).
+    3. In-run signature map (`Map<signature, IssueReference>`), checked BEFORE the
+       list lookup and populated on BOTH create and list-hit, so two findings
+       sharing a signature in one run can't double-create or double-bump within
+       the consistent-list window. This also covers the first-ever run (before the
+       label propagates).
+    4. Ensure the `retro` label exists before the first list (idempotent create,
+       ignore 422-already-exists).
+    5. Closed-issue policy: match CLOSED retro issues too. On a closed match, do
+       NOT create a duplicate and do NOT auto-reopen; post a brief "recurred after
+       close" comment so a regression is visible without resurrecting the issue.
+    6. Retire `searchByTitle` — remove the title-search dedup path entirely (no
+       dual path that could reintroduce the dup bug).
+  The IssueTracker port gains `ensureLabel` + `listByLabel` (state-parameterized);
+  the tested core (egress/pipeline/ledger) is unchanged.
+out_of_scope: |
+  - Semantic dedup vs HUMAN-filed tickets (no shared key) — that's a separate
+    LLM-triage concern; this ticket is exact retro-vs-retro dedup only.
+  - Multi-provider (Linear) adapters — routing stays upstream GitHub (RV9JT4).
+  - The cross-session near-simultaneous race (two installs filing the same novel
+    signature within the list→create window) — inherent limit; periodic merge is
+    the backstop, not in scope.
+  - Maintainer REMOVES the `retro` label from an issue → it drops out of the list
+    and a recurrence may re-file. Accepted limitation (same class as the cross-
+    session race); not defended here.
+  - Auto-reopening maintainer-closed issues — deliberately not done (a comment is
+    the signal; reopening is too aggressive).
+done_when: |
+  - A retro-filed issue carries the `retro` label and an exact, anchored
+    `<!-- retro-sig: retro:<12-hex> -->` body marker; a test asserts the marker
+    round-trips through body assembly + sanitize and is matchable by the scan.
+  - The `retro` label is ensured to exist before the first list (idempotent).
+  - Dedup uses the issues-list API + exact marker match; a known OPEN signature
+    never creates a second issue even when GitHub search hasn't indexed it yet.
+  - A known CLOSED signature creates no new issue and does not reopen; it leaves a
+    "recurred after close" comment.
+  - Two findings with the same signature in one run create exactly one issue
+    (in-run map), and re-running on the same transcript does not double-file.
+  - Title drift on a known signature does not fork a new issue.
+  - List pagination is bounded by a page cap; behavior at the cap is logged
+    (truncation = possible miss, backstopped by periodic merge).
+  - Scenarios green; /verify passes.
+---
+
+# Robust dedup: signature marker + label-scoped list lookup (not fuzzy title search)
+
+**Goal:** Make retro's "never a duplicate issue" guarantee actually hold, by
+deduping on a stable embedded signature via the strongly-consistent issues-list
+API instead of fuzzy, eventually-consistent title search.
+
+**Why:** Title-search dedup (RV9JT4's first cut) is fragile — GitHub search
+indexing-lag, relevance ranking past the first results page, and title drift can
+all miss an existing issue and file a duplicate, breaking SM1.AC2.
+
+**Parent:** RV9JT4-retro-transcript-mining. Flagged by two independent reviews
+(S2) and deferred from RV9JT4 as a contained follow-up.
+
+## Work Log
+
+- 2026-06-28T01:00:02.710Z Started: Created ticket 1FGE1C (sub-ticket of RV9JT4)
@@ -0,0 +1,54 @@
+---
+id: 1M20EW
+slug: retro-fixed-vs-present-friction
+type: task
+phase: intake
+status: todo
+created: 2026-06-30T20:43:24.401Z
+last_modified: 2026-06-30T20:43:24.401Z
+---
+
+# Retro extractor reports fixed/discussed bugs as current friction
+
+**Goal:** Stop the invisible retro from filing issues for bugs the session
+already FIXED (or merely discussed) — only surface friction that is still live.
+
+**Why:** Discovered during the ZFGWS1 live fire (2026-06-30). Sonnet mined the
+back half of the ZFGWS1 build session and returned 6 sanitized findings — 5 of
+which described the very bugs ZFGWS1 *fixed in that session* (haiku default,
+once-per-session sentinel, title dedupe, blocking hook, missing session id),
+phrased as present-tense friction. The extractor can't distinguish "we fixed X
+this session" from "X is broken." For a self-reporting feature this is high-impact:
+**any** session that fixes safeword bugs will file false issues for the bugs it
+just resolved — exactly the sessions most likely to be substantial and trigger
+retro. (The 6th finding — the GitHub-indexing risk — was genuine and was filed +
+then closed as #581 after the indexing assumption was empirically confirmed.)
+
+## Evidence
+
+- Live-fire transcript window: `--window-start 2000000` over the ZFGWS1 session;
+  `model=sonnet rawFindings=9 encounters=6`.
+- 5/6 encounters were fixed-this-session bugs framed as current friction.
+- Egress + signature + filing + dedupe all worked correctly — the gap is purely
+  the extractor's temporal framing of findings.
+
+## Sketch (not yet designed — intake)
+
+Candidate directions to weigh in spec/figure-it-out:
+
+- Tighten the extraction system prompt to require findings be friction that is
+  STILL present at the end of the window (ignore problems the session resolved).
+- Post-filter: drop findings whose surface/title was touched by a commit in the
+  same session (the transcript shows the fix landing).
+- Accept-and-dedupe: rely on the occurrence ledger + human triage (weakest —
+  still files the false issue once).
+
+## Out of scope
+
+- ZFGWS1's shipped mechanism (delta re-arm, sonnet, async hook, signature dedupe)
+  — all validated by the live fire; this is a follow-up refinement, not a regression.
+
+## Work Log
+
+- 2026-06-30T20:43Z Created from the ZFGWS1 live fire — extractor reported 5/6
+  already-fixed bugs as current friction. Backlog (todo); needs intake/spec.
Original file line number	Diff line number	Diff line change
`@@ -118,6 +118,14 @@`
`118`	`118`	`"command": "bun \"$CLAUDE_PROJECT_DIR\"/.safeword/hooks/prompt-questions.ts"`
`119`	`119`	`}`
`120`	`120`	`]`
	`121`	`+ },`
	`122`	`+ {`
	`123`	`+ "hooks": [`
	`124`	`+ {`
	`125`	`+ "type": "command",`
	`126`	`+ "command": "bun \"$CLAUDE_PROJECT_DIR\"/.safeword/hooks/prompt-retro-nudge.ts"`
	`127`	`+ }`
	`128`	`+ ]`
`121`	`129`	`}`
`122`	`130`	`],`
`123`	`131`	`"Stop": [`
`@@ -144,6 +152,15 @@`
`144`	`152`	`"command": "bun \"$CLAUDE_PROJECT_DIR\"/.safeword/hooks/stop-self-report.ts"`
`145`	`153`	`}`
`146`	`154`	`]`
	`155`	`+ },`
	`156`	`+ {`
	`157`	`+ "hooks": [`
	`158`	`+ {`
	`159`	`+ "type": "command",`
	`160`	`+ "command": "bun \"$CLAUDE_PROJECT_DIR\"/.safeword/hooks/stop-retro.ts",`
	`161`	`+ "async": true`
	`162`	`+ }`
	`163`	`+ ]`
`147`	`164`	`}`
`148`	`165`	`],`
`149`	`166`	`"PreToolUse": [`