test: derive paid touchfiles from each eval's static closure (E)

touchfiles.test.ts now checks, per key, that the paid file's static
test/helpers and test/fixtures closure (plus fixture paths it names in string
literals) is covered, and names the file, path, chain and key to fix when it is
not. Free *.test.ts files are no longer touchfiles, so editing a free replay
test stops selecting paid evals: 950 entries removed, 653 real closure paths
added. The hand-copied inventories go: periodic-fixture-selection,
fake-impeccable-touchfiles and 45 per-file selection examples. Selection for
the sample edits (plan-eng-review template, claude-pty-runner,
plan-count-fixture, gstack-config) loses no case under either profile.
CONTRIBUTING documents the rule and its lower bound.

test/fixtures/autoplan-clipped-suffix-aq.json

@@ -1,93 +0,0 @@
-{
-  "cwd": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-autoplan-chain-LukJXD",
-  "config": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-hermetic-3587976-PXLrEr/with-skills/.claude",
-  "stateRoot": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-hermetic-3587976-PXLrEr/skill-home-cMZrbW/.gstack",
-  "hook": {
-    "version": 1,
-    "cwd": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-autoplan-chain-LukJXD",
-    "config": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-hermetic-3587976-PXLrEr/with-skills/.claude",
-    "stateRoot": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-hermetic-3587976-PXLrEr/skill-home-cMZrbW/.gstack",
-    "seenIds": [
-      "toolu_019ngUUTCGyDufyLQaN9Tvgm"
-    ],
-    "pending": {
-      "source": "pre_tool_use",
-      "sessionId": "037c9f5e-7035-45e2-935d-0b950c435930",
-      "toolUseId": "toolu_019ngUUTCGyDufyLQaN9Tvgm",
-      "tool": "Edit",
-      "file": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-hermetic-3587976-PXLrEr/skill-home-cMZrbW/.gstack/projects/gstack-autoplan-chain-LukJXD/ceo-plans/2026-09-10-user-dashboard.md",
-      "timestamp": "2026-09-10T14:35:35.363Z",
-      "transcriptPath": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-hermetic-3587976-PXLrEr/with-skills/.claude/projects/-tmp-gstack-paid-shard-MPtf0T-tmp-gstack-autoplan-chain-LukJXD/037c9f5e-7035-45e2-935d-0b950c435930.jsonl",
-      "editDigest": {
-        "version": 1,
-        "beforeSHA256": "6771404ca60011824af336f0a7011e3aba465b8728c011eef935a4b847e72bdd",
-        "requestSHA256": "7ea64ad22d29d9c779b6e945119ea238e2f40862a368ca518100626a1e7978de",
-        "oldLineHashes": [
-          "95b34a72ab3b36711dc4f7cffc93cfe9e4ac45adaff3cbe06170576bb2b7787d"
-        ],
-        "newLineHashes": [
-          "b69061a320491c4d23ea3b0e11040b1edfdf54c90d67287236c5b49695b74a6d",
-          "f01cbe18eb0051492cb3e8740542a491038881c5f23dac05003dfa84a4a59087",
-          "2a23528279bef0c9dcde730b41c9cb25768c8d6de1d40195181e48efa8e6a295",
-          "8110f2d8d27cb7e397562be0be38bc995e33cdf5d570d3d18aae23fe83db5116",
-          "4fef7666a0b82562e292a3d53f26f0721c09a74ceb0a30a970351f213468b07e",
-          "2bbfa283b38391e7d66c205292efb1e8565120fa337a098863f4758576fe1239",
-          "be4ed8d0778c7ba2036e19657ac496f2b24ee5d3ceb4d1240c3f7993567f4f89",
-          "861a718d78d38dd744ab59540c3139c5283d0e67a3deed5b41138f9581084d34",
-          "418ec10dc288464be75940c80f56faa734f5380ed8c2a957dcc52ed75f60f942",
-          "a59e48fe92bfcea3ec1cad39996f1a01039861faaa75daa251be8d64b102abdc",
-          "c701beb15c91ba566b32cd004f4ba46eb8f317061549c0f699041c151065a387",
-          "44aa4bd0d2a4cc4cbce51a9ea6bc485d5fb2cfbebfc01a1fe275d8e165f51c92",
-          "e8fd6eaf078d6ccc6028e6213e12acfa82511902136e4aec48e1398990582884",
-          "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-          "cfc849f68e95805d8b84b46121a94a5ee70daf8fe374e20224d88a4290553089",
-          "1e619e0fe087d96a85514e4f9f741b2aae28e3c65a73f3833b6c1869e282ed5b",
-          "0ef460f920e57467c135c9b9605f343e189fc4397565d14b12d0fc9ff5f31e4f",
-          "d9134cd12c765f0e72b00438c6f70fa3af52d4a4602dfb27c8ae4fe29a7ee4cc",
-          "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-          "95b34a72ab3b36711dc4f7cffc93cfe9e4ac45adaff3cbe06170576bb2b7787d"
-        ]
-      }
-    },
-    "sessionId": "037c9f5e-7035-45e2-935d-0b950c435930"
-  },
-  "before": "---\nstatus: ACTIVE\n---\n# CEO Plan: User Dashboard Page\nGenerated by /plan-ceo-review (via /autoplan) on 2026-09-10\nBranch: main | Mode: SELECTIVE EXPANSION\nRepo: gstack-autoplan-chain-LukJXD (local, no remote)\n\n## Problem and goal\n\nMembers of the existing single-role workspace visit three separate pages after login to resume work, check alerts, and inspect recent changes. One team walkthrough measured a median of 75 seconds to find the next item. The dashboard at `/dashboard` is meant to cut the median login-to-first-completed-task time from ~75 s to 45 s (a 40 % reduction), with completed-task rate and permission-error rate as guardrails.\n\n**Primary ship metric:** median login-to-first-completed-task time, treatment vs control. **Ship threshold:** ≥ 40 % reduction (equivalent to 75 → 45 s) sustained over the ≥ 2-week measurement window with no guardrail regression. **Diagnostic split (not a ship gate):** login→first-action-start (the leg the dashboard moves) and action-start→completion (unchanged by this plan), both derivable from the existing login / action start / action completion events, so the read-out attributes the delta correctly. The production baseline for all three is computed from existing events before the cohort opens; the 75 s walkthrough figure is not load-bearing.\n\n**Experiment design.** Assignment is a deterministic hash of member id, fixed for the experiment's duration. Default split 10 % treatment / 90 % control. Minimum sample: ≥ 300 logins per arm within the window; if the workspace's active-member count makes that unreachable at 10 % (record the count at approval), switch to a 50/50 split, and if still unreachable, fall back to a before/after comparison over the same window and say so in the read-out. `/dashboard` is flag-gated (below), so control members cannot reach it and contaminate the read-out.\n\n## Vision\n\n### 10x Check\nThe dashboard becomes the member's assistant rather than a summary page: a ranked \"next item\" (\"You have 2 items due today\"), alerts grouped by source, small tasks completed inline, live updates as teammates act, and a home that other features publish panels into. Concrete shape: ranking service over the action registry, a panel registry, a push channel. Human ~4-6 weeks / CC ~2-3 days. Out of this plan's blast radius; the personalisation plan owns it. This plan lays the seam (per-panel envelopes + a shared panel shell) without building the platform.\n\n### Platonic Ideal\nSkipped (SELECTIVE EXPANSION).\n\n## Baseline held (plan scope)\n- `/dashboard` page with Quick actions, Notifications, Recent activity panels; Tailwind, mobile-first (sm/md/lg).\n- Loading skeleton, empty, error, success per panel; hover and focus-visible on every control.\n- \"Mark all as read\" confirmation modal on the existing dialog primitive.\n- Toast feedback for actions.\n- `GET /api/dashboard` aggregate over existing PostgreSQL tables; no schema change.\n- Out of scope by the user: dark mode, personalisation.\n\n## Implementation approach chosen\nApproach A: aggregate endpoint composed server-side from the existing list methods and action registry, returning per-panel result envelopes so one failing panel never sinks the page. Alternatives: B client-side composition of three existing endpoints (7/10, close second, surfaced as taste decision T1); C smart post-login redirect + shell badge (4/10 against the stated goal, rejected).\n\n**If the Final Gate selects B instead of A:** the \"Endpoint\", \"Response shape\", and \"Retry\" paragraphs below are replaced by three per-panel fetch hooks wrapping the existing list endpoints and a small eligibility endpoint over the registry; each hook produces the same `Envelope<T>` client-side, so panel states, empty CTAs, mark-all-read, latest-wins, redirect precedence, caching headers, toast, accessibility, analytics, and rollout are unchanged. Composer tests become hook tests. **If the gate selects dashboard-local for T3:** the toast code moves under `src/components/dashboard/` with the same API and the same live-region rule; nothing else changes.\n\n## Verified preconditions (confirm before implementation; each has a fallback)\n- **Bulk-read API accepts a snapshot time.** The plan's contracts section states it \"marks only notifications at or before the supplied snapshot time\". Confirm the parameter name and type. If it turns out not to exist, mark-all-read cannot be made safe against later arrivals and the modal flow is **blocked** until the API gains the parameter (this becomes the same API work E8 needs; raise at the gate, do not ship a clock-unsafe version).\n- **Bulk-read API returns the affected count.** Confirm; otherwise the success toast reads \"Marked all as read\" without a number.\n- **Feature-flag system supports stable per-member assignment** (hash of member id). Confirm; otherwise implement the hash in the redirect module and store only the flag's on/off and percentage in the flag sLine truncated
-  "viewport": "     +t.                                                                                                                \n 139 +- **Snapshot consistency.** Notifications rows, `unreadTotal`, and `now()` come from a single statement (CTE) so t\n     +hey share one READ COMMITTED snapshot. Query budget via `SET LOCAL statement_timeout = '2s'` inside that statement\n     +'s transaction (or the driver's per-query timeout option); the \"timed-out query releases its connection\" test asse\n     +rts on pool metrics, not on the promise alone.                                                                    \n 140 +- **Route gating in a client-rendered app.** The page route performs a client-side redirect to the current landing\n     + after the flag lookup (no server 302 unless the app already server-renders routes); `GET /api/dashboard` returnin\n     +g 404 for flag-off members is the authoritative gate.                                                             \n 141 +- **Forcing panel states in tests.** Playwright uses `page.route()` interception on `/api/dashboard` and the bulk-\n     +read route to inject 503 / per-panel `ok:false` / empty payloads; no test-only headers in production builds.      \n 142 +- **Identifiers.** The create action is `actionId = 'create_item'` (from the registry's stable ids); `fetchedAt` i\n     +s ISO 8601 UTC with milliseconds; the 44 px target rule applies to every interactive control inside the panels (ac\n     +tions, Retry, See all, Mark all as read).                                                                         \n 143 +                                                                                                                  \n 144 +## Reviewer Concerns (unresolved after 3 iterations)                                                              \n 145 +- **Snapshot window (r3 #5).** A notification inserted in a transaction whose `now()` predates `fetchedAt` but whi\n     +ch commits after the dashboard read has `created_at <= fetchedAt`, is invisible to the list, and is still marked r\n     +ead. Accepted and documented: the window is the duration of an in-flight insert transaction (milliseconds), the ex\n     +isting bulk-read contract is clock-based, and changing it to id-based is the E8-adjacent API work already deferred\n     +. Record as a known limitation in the JSDoc on the mark-all-read handler.                                         \n 146 +- **Provisional approach vs open taste items (r2 #4, r3 #6).** The reviewer wants T1/T3 closed or A/E7 marked prov\n     +isional. They are provisional by design: /autoplan surfaces taste decisions at one Final Gate and the fallback par\n     +agraphs define what changes. Not a contradiction to resolve in this document.                                     \n 147 +- **Population size (r3 #14).** The single-workspace population may be too small for the default design; the fallb\n     +acks exist, and the member count is now recorded before R1 starts.                                                \n 148 +                                                                                                                  \n 149  ## Taste decisions carried to the Final Gate\n 150  - T1 aggregate endpoint (A) vs client-side composition (B) — open; the B fallback paragraph above states exactly w\n      hat changes.\n 151  - T2 confirmation modal for Mark all as read — recorded decision, surfaced for information: the independent review\n      er preferred direct action + undo, but undo (E8) needs a new mutation API and is deferred, so the modal stays unle\n      ss E8 is pulled into scope.\n╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌\n Do you want to make this edit to 2026-09-10-user-dashboard.md?\n ❯ 1. Yes\n   2. Yes, and switch to accept edits (auto-approve file edits and common file commands) for this session (shift+tab)\n   3. No\n\n Esc to cancel · Tab to amend\n",
-  "request": {
-    "old_string": "## Taste decisions carried to the Final Gate",
-    "new_string": "## Iteration-3 amendments (override earlier wording where they conflict)\n- **Guardrail bounds.** Completed-task rate in treatment must not be lower than control by more than 2 percentage points; permission-error rate must not be higher than control by more than 1 percentage point, both over the same window.\n- **Control-arm assignment recorded.** Emit `dashboard_assignment{cohort, hashVersion}` on the existing login event for every member (both arms); record the hash salt/version at approval. `dashboard_viewed` remains treatment-only.\n- **Ship-rule estimator.** Unit of analysis is the member (first login-to-first-completed-task per member per day, then per-member median). Estimator: bootstrap 95 % CI on the difference of medians; ship when the CI lower bound shows ≥ 40 % reduction. \"≥ 300 logins per arm\" becomes \"≥ 300 member-days per arm\".\n- **Record the active-member count before starting R1**, not after; choose the split then.\n- **Whole-response failures on the GET.** 503 `DashboardUnavailable` or a network/parse failure → all three panels ERROR with one shared page-level Retry; 404 (assignment flipped off mid-session) → client redirects to the current landing; 401 → login. Envelope codes remain per-panel only.\n- **Panel state model.** `{ status: LOADING | EMPTY | ERROR | SUCCESS, refreshing: boolean }`. `status` derives only from the last settled envelope; `refreshing` is set at request start when the panel already has a settled status other than LOADING, and cleared on settle. EMPTY panels refresh with their empty copy still rendered. The Mark-all-read trigger stays rendered but disabled while `refreshing`; it is rendered only when `status === SUCCESS && unreadTotal > 0`.\n- **CSRF vs membership 403.** Retry-once applies only when the existing client's typed error indicates a CSRF failure (its existing discriminator, body code or header); a membership 403 shows the access message with no retry.\n- **Preconditions heading** is to be read as \"Preconditions to verify before implementation\". The bulk-read semantic requirement is: it marks read only notifications with `created_at <= snapshot` by the DB clock and is idempotent.\n- **Snapshot consistency.** Notifications rows, `unreadTotal`, and `now()` come from a single statement (CTE) so they share one READ COMMITTED snapshot. Query budget via `SET LOCAL statement_timeout = '2s'` inside that statement's transaction (or the driver's per-query timeout option); the \"timed-out query releases its connection\" test asserts on pool metrics, not on the promise alone.\n- **Route gating in a client-rendered app.** The page route performs a client-side redirect to the current landing after the flag lookup (no server 302 unless the app already server-renders routes); `GET /api/dashboard` returning 404 for flag-off members is the authoritative gate.\n- **Forcing panel states in tests.** Playwright uses `page.route()` interception on `/api/dashboard` and the bulk-read route to inject 503 / per-panel `ok:false` / empty payloads; no test-only headers in production builds.\n- **Identifiers.** The create action is `actionId = 'create_item'` (from the registry's stable ids); `fetchedAt` is ISO 8601 UTC with milliseconds; the 44 px target rule applies to every interactive control inside the panels (actions, Retry, See all, Mark all as read).\n\n## Reviewer Concerns (unresolved after 3 iterations)\n- **Snapshot window (r3 #5).** A notification inserted in a transaction whose `now()` predates `fetchedAt` but which commits after the dashboard read has `created_at <= fetchedAt`, is invisible to the list, and is still marked read. Accepted and documented: the window is the duration of an in-flight insert transaction (milliseconds), the existing bulk-read contract is clock-based, and changing it to id-based is the E8-adjacent API work already deferred. Record as a known limitation in the JSDoc on the mark-all-read handler.\n- **Provisional approach vs open taste items (r2 #4, r3 #6).** The reviewer wants T1/T3 closed or A/E7 marked provisional. They are provisional by design: /autoplan surfaces taste decisions at one Final Gate and the fallback paragraphs define what changes. Not a contradiction to resolve in this document.\n- **Population size (r3 #14).** The single-workspace population may be too small for the default design; the fallbacks exist, and the member count is now recorded before R1 starts.\n\n## Taste decisions carried to the Final Gate"
-  },
-  "publicTools": [
-    {
-      "sessionId": "037c9f5e-7035-45e2-935d-0b950c435930",
-      "timestamp": "2026-09-10T14:32:00.204Z",
-      "toolUseId": "toolu_01A78r3KVhp1i9RAkz57ECSC",
-      "kind": "use",
-      "name": "Write",
-      "input": {
-        "file_path": "/tmp/gstack-paid-shard-MPtf0T/tmp/gstack-hermetic-3587976-PXLrEr/skill-home-cMZrbW/.gstack/projects/gstack-autoplan-chain-LukJXD/ceo-plans/2026-09-10-user-dashboard.md",
-        "content": "---\nstatus: ACTIVE\n---\n# CEO Plan: User Dashboard Page\nGenerated by /plan-ceo-review (via /autoplan) on 2026-09-10\nBranch: main | Mode: SELECTIVE EXPANSION\nRepo: gstack-autoplan-chain-LukJXD (local, no remote)\n\n## Problem and goal\n\nMembers of the existing single-role workspace visit three separate pages after login to resume work, check alerts, and inspect recent changes. One team walkthrough measured a median of 75 seconds to find the next item. The dashboard at `/dashboard` is meant to cut the median login-to-first-completed-task time from ~75 s to 45 s (a 40 % reduction), with completed-task rate and permission-error rate as guardrails.\n\n**Primary ship metric:** median login-to-first-completed-task time, treatment vs control. **Ship threshold:** ≥ 40 % reduction (equivalent to 75 → 45 s) sustained over the ≥ 2-week measurement window with no guardrail regression. **Diagnostic split (not a ship gate):** login→first-action-start (the leg the dashboard moves) and action-start→completion (unchanged by this plan), both derivable from the existing login / action start / action completion events, so the read-out attributes the delta correctly. The production baseline for all three is computed from existing events before the cohort opens; the 75 s walkthrough figure is not load-bearing.\n\n**Experiment design.** Assignment is a deterministic hash of member id, fixed for the experiment's duration. Default split 10 % treatment / 90 % control. Minimum sample: ≥ 300 logins per arm within the window; if the workspace's active-member count makes that unreachable at 10 % (record the count at approval), switch to a 50/50 split, and if still unreachable, fall back to a before/after comparison over the same window and say so in the read-out. `/dashboard` is flag-gated (below), so control members cannot reach it and contaminate the read-out.\n\n## Vision\n\n### 10x Check\nThe dashboard becomes the member's assistant rather than a summary page: a ranked \"next item\" (\"You have 2 items due today\"), alerts grouped by source, small tasks completed inline, live updates as teammates act, and a home that other features publish panels into. Concrete shape: ranking service over the action registry, a panel registry, a push channel. Human ~4-6 weeks / CC ~2-3 days. Out of this plan's blast radius; the personalisation plan owns it. This plan lays the seam (per-panel envelopes + a shared panel shell) without building the platform.\n\n### Platonic Ideal\nSkipped (SELECTIVE EXPANSION).\n\n## Baseline held (plan scope)\n- `/dashboard` page with Quick actions, Notifications, Recent activity panels; Tailwind, mobile-first (sm/md/lg).\n- Loading skeleton, empty, error, success per panel; hover and focus-visible on every control.\n- \"Mark all as read\" confirmation modal on the existing dialog primitive.\n- Toast feedback for actions.\n- `GET /api/dashboard` aggregate over existing PostgreSQL tables; no schema change.\n- Out of scope by the user: dark mode, personalisation.\n\n## Implementation approach chosen\nApproach A: aggregate endpoint composed server-side from the existing list methods and action registry, returning per-panel result envelopes so one failing panel never sinks the page. Alternatives: B client-side composition of three existing endpoints (7/10, close second, surfaced as taste decision T1); C smart post-login redirect + shell badge (4/10 against the stated goal, rejected).\n\n**If the Final Gate selects B instead of A:** the \"Endpoint\", \"Response shape\", and \"Retry\" paragraphs below are replaced by three per-panel fetch hooks wrapping the existing list endpoints and a small eligibility endpoint over the registry; each hook produces the same `Envelope<T>` client-side, so panel states, empty CTAs, mark-all-read, latest-wins, redirect precedence, caching headers, toast, accessibility, analytics, and rollout are unchanged. Composer tests become hook tests. **If the gate selects dashboard-local for T3:** the toast code moves under `src/components/dashboard/` with the same API and the same live-region rule; nothing else changes.\n\n## Verified preconditions (confirm before implementation; each has a fallback)\n- **Bulk-read API accepts a snapshot time.** The plan's contracts section states it \"marks only notifications at or before the supplied snapshot time\". Confirm the parameter name and type. If it turns out not to exist, mark-all-read cannot be made safe against later arrivals and the modal flow is **blocked** until the API gains the parameter (this becomes the same API work E8 needs; raise at the gate, do not ship a clock-unsafe version).\n- **Bulk-read API returns the affected count.** Confirm; otherwise the success toast reads \"Marked all as read\" without a number.\n- **Feature-flag system supports stable per-member assignment** (hash of member id). Confirm; otherwise implement the hash in the redirect module and store only the flag's on/off and percentage in theLine truncated
-      },
-      "messageId": "msg_011CeuvH91RGhGXA5XHMPN7J",
-      "requestId": "req_011CeuvH6MgNDWkEkYtuWxs9"
-    },
-    {
-      "sessionId": "037c9f5e-7035-45e2-935d-0b950c435930",
-      "timestamp": "2026-09-10T14:32:00.969Z",
-      "toolUseId": "toolu_01A78r3KVhp1i9RAkz57ECSC",
-      "kind": "result",
-      "content": "The file /tmp/gstack-paid-shard-MPtf0T/tmp/gstack-hermetic-3587976-PXLrEr/skill-home-cMZrbW/.gstack/projects/gstack-autoplan-chain-LukJXD/ceo-plans/2026-09-10-user-dashboard.md has been updated successfully. (file state is current in your context — no need to Read it back)",
-      "isError": false
-    }
-  ],
-  "provenance": {
-    "status": "Exact original request reconstruction independently equals original requestSHA; no new digest existed in the paid attempt.",
-    "requestSHA256": "7ea64ad22d29d9c779b6e945119ea238e2f40862a368ca518100626a1e7978de",
-    "beforeSHA256": "6771404ca60011824af336f0a7011e3aba465b8728c011eef935a4b847e72bdd",
-    "paneSHA256": "c5662a9c0d67ba04de8720c25d51378b4662266273cb186f48f7c3109abd2ee2",
-    "sourceProof": "ap-cropped-addition-plan-v1/proof.json",
-    "reconstruction": "ap-cropped-addition-request-reconstruction-plan-v1.json",
-    "publicTools": "Exact acknowledged same-file predecessor pair from full94 public events.",
-    "actualCoverage": "operator-cancelled-incomplete; no phase credit"
-  }
-}