deps: Bump typescript from 5.9.3 to 6.0.3 - #7

…on — 17 madde fix

Sprint 168 v1→v4 zinciri:
- v1 (commit fc91fcd): brainstorming output
- v2 systematic-debugging eval (Agent A): 79/100, Phase 4.5 trigger, 5 critical/high
- v3 devil's advocate eval (Agent B): 22/100 — hedef <30 KARŞILANDI ✅
- v4 (bu commit): 17 madde fix integration
- v5 Alperen final approval bekliyor

17 madde fix entegre:
1. (Agent A #1 CRITICAL) C0e cross-sprint orphan handling — Option C selective filter + startup invocation
2. (Agent A #2 CRITICAL) C0a bundle split → C0a-1/C0a-2/C0a-3/C0a-4 (4 sub-anchor)
3. (Agent A #3 CRITICAL) C0c subscriber owner: decision-engine.ts designate + function signature + BRAIN→SPAWN:BLOCKED event mandatory test
4. (Agent A #4 + B V7 HIGH) ADR-047 Manuel Subagent Dispatch Protocol Sprint 168'de (önceki 168.5 ertelenmiş)
5. (Agent A #5 + B Saldırı #2 HIGH) Smoke test complex scenario: 3+ task (collision + crash + parallel)
6. (B V5 HIGH) Sprint 168 NO_GO → Sprint 168.5 fallback explicit (recursion paradox kabul)
7. (B V7 HIGH) TDD skip enforcement gate (skip artış 0 + Alperen review)
8. (Agent A #8 MED) checkSpawnLock singular helper eklendi
9. (Agent A #9 MED) auto_archive_directives Alperen decision NOW (spec yazımı sırasında)
10. (Agent B #5 MED) Subagent git branch isolation (worktree per cluster)
11. (Agent B #7 MED) ADR-046 invariant test C0a-2 + C0a-3 integration test
12. (Agent B #6 MED) ADR-048 multi-provider parity (Docker + Subprocess + Tmux)
13. (Agent B #4 MED) ADR-048 Wave 1.5 serial gate + Alperen CHECKPOINT
14. (P4.5 MED) Cross-cluster dependency graph spec içinde explicit (Section 2)
15. (Agent B #3 MED) Baseline tolerance "0 yeni skip" GO/NO_GO row
16. (Agent B V6 LOW) Effort yeniden tahmin 22-30h → 35h gerçekçi
17. (Agent B #1 LOW) Brain "kırık" iddiası modül-fonksiyon-satır kanıtı (Section 1)

v1 → v4 büyük yapı değişiklikleri:
- Scope 5 task → 8 task (C0a split + ADR-047 yeni)
- Effort tahmin 22-30h → 35h
- ADR sayısı 1 (ADR-048) → 2 (ADR-047 + ADR-048)
- Smoke test 2-task echo → 3+ task complex (collision + crash + parallel)
- Subagent dispatch "manuel" → "hardened (worktree + file authority + lock + TDD gate)"
- Sprint 168.5 dependency açıklama (NO_GO → manuel dispatch replay)
- Section 2 cross-cluster dependency graph yeni
- Section 3.2 (dispatch mechanism + lock pattern + TDD gate + fallback) yeni
- Section 5.3 complex smoke test suite yeni
- Pre-Flight checklist 11 → 14 madde (git worktree, dispatch locks, smoke test, Alperen auto_archive decision)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

PR #16 main merge surfaced 3 test failures that all pass locally on the
same Node 24.15.0 runtime — pure CI environment divergence. Captured in
sub-project #2 backlog as item #7 (lokal-CI gap) with concrete fix
candidates (mock hygiene, process.kill semantics, vitest --retry tag).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…, evidence appends, quick fixes (owner admission 2026-08-25)

bulgular.md classification (owner approved C+B+D):
- C: six new MASTER rows — PLAN-PURE-PREVIEW-001 (dry-run must mirror real
  planning: bootstrap catalog gap + temp-agent side effects; our DIRECTIVES
  pipeline's 4th gate leans on this preview), SPAWN-RETRY-TASK-IMMUTABILITY,
  RESUME-STALE-LOCK-RECONCILIATION (paused-resume leg; terminal leg closed
  earlier today), SUBPROCESS-FINITE-BUDGET-ADMISSION,
  BUILD-CLEAN-HOLD-HONESTY (reproduce-first: live main probe exits 1, the
  lane's exit-0 was the authority-state-missing worktree leg),
  PROJECTION-VALIDATOR-ARTIFACT-CLASS. 522->528 rows, gate green.
- B: findings #2/#7/#10/#13 appended to row 3210's evidence as four
  independent reproductions of the single-monotonic-status-authority need.
- D quick fixes: resolveOutputMode now accepts the CORRECT English spellings
  (explanatory/standard) as canonical input while the historical stored
  identifiers stay byte-compatible (finding #15, real-binary smoke green);
  tsx pinned exact 4.23.12 as the repo-owned docs:generate-cli runner with
  an ADR-D-005 rationale row in the reborn docs/reference/dependencies.md
  (finding #16).
- Consumed bulgular.md removed per result-notes-first (the durable record is
  the MASTER rows). Findings #8 closed live during today's merge; #9 was the
  independent confirmation of our 671-005 reserve-ratio class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TX2TJFqo8HuCVvuvVBV2dt

…val card, §4 hierarchy (design-critic closure)

Independent design-critic pass over 011/012 (deckent-design-critic, read-only)
returned one BLOCKS and several SHOULD-FIX findings; this package closes the
in-scope ones with new disk evidence.

BLOCKS — the operator's own `!<cmd>` line was confirmed by the legacy modal
whose "a = always allow" called perms.allow('deckent_bash'): the operator
thought they approved THEIR shell line, the effect was a session-wide grant for
every MODEL-proposed bash call (§4: "A longer grant is a separate governed
flow"). Now:
- app.tsx: ConfirmRequest/ConfirmHead carry `oneTime`; the queue collapses an
  'a' answer on a one-time head to 'y' and never cascades it; confirmKeyToAnswer
  ignores a/A for a one-time card; the `!` dispatch window (shellConfirmRef)
  marks its confirm one-time; the card shows tui.confirm_hint_once
  "(y = allow once · N = deny)". Nothing from a `!` line can reach the allow-list.
- a denied `!` no longer echoes the raw `[deckent-denied] deckent_bash` marker
  (the dispatcher's honest-outcome block already renders "✗ cancelled").
- status anchor says "input paused · decide the card above" while a card owns
  stdin instead of promising "ready · your turn" (textual carrier).

SHOULD-FIX (approval-card.tsx):
- quiet countdown: minute-grained above a minute ("in 9m"), second-grained only
  inside the last minute; the card re-renders ONLY when the rendered time
  carrier changes (was a 1 Hz repaint of the dynamic region).
- worded relation instead of a structural arrow in the mechanism:
  tui.approval_card.expiry_outcome "in {remaining}, then {outcome}" /
  expired_outcome "expired, {outcome} applies"; tr "süre sonu" (was "süre").
- §4 "identity, current condition and age": new age row ("requested: just now"
  / "5m ago", never per-second).
- hierarchy: the object of the decision leads — action · resource at normal
  weight, then the UNTRUNCATED redacted arguments (Ink wraps to display cells;
  the fixed 80-character ceiling was the §10.2 #5 defect class), then who /
  policy / time, then consequence and rollback; an undeclared consequence or
  rollback on a high/critical request is emphasized instead of dimmed.
- header badge + summary in one inline Text: at 40 columns the flex row dropped
  the separating space ("HIGHDEMO — …").
- wording: shortcuts.shell.action ("attached to your next message"),
  action.escalate tr "üst seviyeye taşı", timeout.request_default no longer
  circular.

Tests (RED→GREEN): shell-confirm-once.test.tsx (key mapper, queue no-cascade,
labels/catalog, app wiring scan); approval-card-facts.test.tsx updated
(granularity, order with age, worded templates, emphasis rules, untruncated
arguments through a wrapped Ink frame).

Proof (real binary, node-pty, en+tr): `!echo` card hint "(y = allow once · N =
deny)" / "(y = bir kez izin · N = reddet)"; denial marker count 0; provider
lastUser still "[shell] $ echo hi-from-shell\nhi-from-shell\n\nmerhaba".
Approval 110x40: rows action → args → requester → tenant → policy →
"requested: just now" → "expires: in 9m, then deny" → consequence → rollback;
only 3 distinct time frames in a 15 s session (was one per second); "input
paused · decide the card above" visible; arrow count 0. Approval 40x30 with
NO_COLOR=1: 0 SGR sequences, "HIGH DEMO — …" spaced, card wraps, "✖ Rejected".
tsc clean; tests/cli/repl + confirm-queue + i18n-flip + helpers: 83 files /
1299 tests green.

Reported, not fixed (pre-existing, outside this diff): run.tsx demo fixture
carries hardcoded Turkish strings under DECKENT_APPROVAL_DEMO; risk colors are
component-local hex literals (§10.2 #7); the gate denial line names the raw
tool id for model-proposed tools; header/footer provider naming mismatch.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178mmVbXrwBoHzneTqkXnYC