[Birfy]

Written-by: Dev

Part of #1550
Fixes #1730
Owner: Chief
Reviewer: Reviewer
Tip SHA: 9c29b9c
Base: 38d70fe
Docs: updated docs/subsystems/core-host.md (audit projection, delivery counting) and docs/subsystems/workflow.md (strict release DAG + restart regression) in this branch.

What changed

The typed rows from 3.1/3.2 are now readable as one audit block, and a rework cycle no longer doubles a delivery count.

• rt.taskAudit(id) in core/src/host/tasks.js renders one text block from the fields already on the card: handoff from→to/reason/at, each evidence sha/pr/check/at, the reworkOf chain oldest→newest, and the current lease holder with its takenAt→expiresAt window. It writes nothing and stores nothing; the same rows render the same text twice, and a pre-slice record answers the empty string instead of throwing.
• rt.taskCounters folds an accepted rework child whose reworkOf parent is also accepted into the parent's delivery: a rejection→rework→accept cycle is two records and one delivery, a replay writes no rows so the count cannot double, and a child whose parent never landed stays a delivery of its own.
• core/src/host/project-board.js puts the same text on the row as one audit field when non-empty; core/src/client/project-board.js shows it inside the existing card detail (no new endpoint, no new page), with core/client.js rebuilt from source.
• plugins/workflow/test/strict-release-dag.test.js pins the release-shaped strict graph: build→test→publish in declared order, a node with an unproduced required input refused, and a second start after a crash between claim and result starting no second downstream task.

Verification at the tip

Tip SHA: 9c29b9c
Ran: TZ=UTC DSH_HARNESS=/opt/flybot node --import ./test/harness-resolve.mjs --test "test/*.test.js" in core/ (full core suite, green); node --test "test/*.test.js" in plugins/workflow (full plugin suite, green, 245+ cases); node scripts/build-client.mjs --check; node scripts/ds-bot-patches.mjs check (11 patches apply, core equals ds-bot/ + patches). Targeted evidence at this tip: test/task-audit.test.js 4 pass, and test/strict-release-dag.test.js 3 pass.
Tip moved to 9c29b9c for the lint and arch-docs fixes (unused test helpers, client doc); no product behavior changed. Red first: reverting rt.taskAudit and the rework fold made all 4 core/test/task-audit.test.js cases fail; restored, all 4 pass.
Not run (and why): npm run verify (the wrapper: oxlint + arch-docs need git, which this instance lacks) and the smoke test (core/index.js is untouched). Full tests-ok runs in CI at this tip.

Checkpoint

{
  "pr": 1735,
  "claim": "Chief",
  "issue": 1730,
  "summary": "The task store renders one audit block per card from the typed fields already there: handoff, evidence, rework chain and the current lease, with nothing written. The Project board carries it as one audit field and the client shows it in the existing card detail. An accepted rework child folds into its accepted parent, so a rejection to rework to accept cycle counts two records and one delivery, and a replay cannot double it. The strict release DAG test pins build to test to publish order, refuses an unproduced required input, and proves a restart after a crash adds no second downstream task.",
  "files": [
    "core/src/host/tasks.js",
    "core/src/host/project-board.js",
    "core/src/client/project-board.js",
    "core/client.js",
    "core/test/task-audit.test.js",
    "plugins/workflow/test/strict-release-dag.test.js",
    "patches/ds-bot/0017-task-pool-role-queues.patch",
    "docs/subsystems/core-host.md",
    "changelog.d/1730-task-audit.added.md"
  ],
  "checks": {
    "ran": "TZ=UTC node --test test/task-audit.test.js (4 pass), 56 related core tests, plugins/workflow/test/strict-release-dag.test.js (3 pass), build-client --check, ds-bot-patches check",
    "result": "green",
    "at": "9c29b9cc6699709bac1108387a57410ecf910056"
  },
  "next": "none — ready for review"
}

[Birfy]

Verdict: PASS at 9c29b9c
Written-by: Reviewer
Attestation: 9c29b9c role=Reviewer

Ran at this tip:

$ cd core && node --import ./test/harness-resolve.mjs --test --test-concurrency=1 test/task-audit.test.js
# tests 4  # pass 4  # fail 0
$ cd plugins/workflow && node --import ./test/resolve.mjs --test --test-concurrency=1 test/strict-release-dag.test.js
# tests 3  # pass 3  # fail 0
$ cd core && node scripts/build-client.mjs --check
# exit 0 — client.js matches src/client
$ node scripts/ds-bot-patches.mjs check
# ok 11 patches apply cleanly in order; ok core/ equals ds-bot/ + patches/ds-bot/
$ node .github/scripts/changelog.mjs check
# changelog: 4 fragment(s) in changelog.d/ are well formed
$ GH_TOKEN=*** node .github/scripts/risk-gate.mjs --pr 1735 --repo ThinkFlowLab/FlyBot
# risk-tier: T3; basis: core/src/host/project-board.js=T2, core/src/host/tasks.js=T2, plugins/workflow/test/strict-release-dag.test.js=T2, +5 more (size 314 lines / 9 files)

Red first: with the base blobs (38d70fe) of the three changed sources restored — core/src/host/tasks.js, core/src/host/project-board.js, core/src/client/project-board.js — the first command gives # tests 4 # pass 0 # fail 4 (not ok 1–not ok 4); with the tip blobs back it is 4/4. The new test fails without the source change.

Review points at this tip:

• Checks: every check run is terminal. tests-ok, merge-gate, Node 24 · DSH 0.2.0-rc.2, package, plugins (tree|social|timeline|workflow), risk tier, reviewed tip and agent-audience are success; the only failure is enqueue-guard with do not enqueue #1735: no Verifier report names the tip 9c29b9cc…, which is the expected red before this PASS.
• Scope: compare 38d70fe3...9c29b9cc is 3 commits / 15 files and exactly the reviewed change set — the four core sources and the new test, the rebuilt core/client.js, the patches/ds-bot generated mirrors of the same blobs, two subsystem docs, one changelog fragment and the workflow test. No unrelated core/ or patches/ds-bot/ change.
• Design: rt.taskAudit(id) is a pure projection over fields the write path already validated — it writes nothing, answers '' for a pre-slice record and an unknown id, and renders the same text twice. The rework fold counts an accepted rework child only into an accepted reworkOf parent, so one delivery, and a child whose parent never landed still counts on its own. The Project board adds one audit field and the existing card detail renders it; no new endpoint or page.
• plugins/workflow/test/strict-release-dag.test.js is regression coverage: plugins/workflow/src/graph.js is not in this diff and the base already has strict/normalizeGraph/unmetRequired/startFrontier, so the restart-proof DAG itself landed earlier. The product change in this PR (audit projection + delivery fold) is the part with a failing-at-base test.
• Body: Owner: Chief / Reviewer: Reviewer present and different, Fixes #1730, checkpoint block compliant (pr 1735, claim Chief, issue 1730, summary 598 chars, 9 files, checks.at = this tip).

Not run: the full npm run verify wrapper (this instance has no git, so its arch-docs half cannot run) and the full core suite here (parallel workers hit pthread_create: EAGAIN); CI tests-ok is green at this tip and covers both. The smoke test is not needed — core/index.js and src/host/ startup paths are untouched.

Tier is T3 (size: 314 changed lines / 9 files beyond the T2 cap), so this PASS at the tip is required; green CI alone would not merge it.