fix(cap): fail closed when the ledger cannot be READ, in both modules

An unreadable ledger returned 0 from countTurns in BOTH the primitive and
the hook, so a run whose ledger existed but could not be read (EISDIR,
EACCES, EIO) was handed the full budget again on every call - unbounded.
research-loop-cap.mjs argues against exactly that three lines above the
code that did it, and its missing-DIRECTORY case already failed closed.
The unreadable-FILE case now agrees with it.

Only ENOENT still counts as zero turns spent: that is the legitimate
first-turn state, and the reason this cannot just throw on any read
failure.

The hook no longer carries its own countTurns. It imports the primitive's
exported readLedger(), the same way it already resolves the data root
through resolveDataRoot() - a reader and a writer with private copies of
the counting rule is how a hook ends up enforcing a different bound than
the gate it backs. In scope + cannot count now exits 2 with a message
that says counting failed, not that the budget is spent.

Fail-closed stays scoped to the loop: a test pins that an unreadable
ledger in an OUT-of-scope session still exits 0, because a PreToolUse
hook that over-blocks bricks every session on the box.

Also dropped the existsSync pre-check before the read - readFileSync's
own ENOENT carries the same information without a second syscall that
can disagree with the read that follows it.

Review finding 5e1c6230f48ead38fa77cd8f4b06bfdc2b5b7bbf (MINOR).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LuGhWAbWyRFBFeemfhxoVv

tests/hooks/agent-cap.test.mjs

@@ -17,7 +17,7 @@ import { test } from 'node:test';
 import { strict as assert } from 'node:assert';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { runHookWithEnv } from '../helpers/hook-helper.mjs';
 
@@ -153,6 +153,37 @@ test('pre-agent-cap ALLOWS when the scope marker is older than the TTL', async (
   assert.strictEqual(code, 0, 'a stale marker must auto-reset, not deny forever');
 });
 
+// -----------------------------------------------------------------------
+// Fail CLOSED once in scope — the hook's own header says a budget control
+// that cannot count must not grant. The unreadable-ledger branch returned 0
+// and therefore ALLOWED, which is the opposite. A directory standing where
+// the ledger file belongs reproduces it portably (EISDIR).
+// -----------------------------------------------------------------------
+test('pre-agent-cap DENIES when the ledger cannot be read at all (fail closed)', async () => {
+  const dir = fixture({ turns: 0 });
+  const ledgerPath = join(dir, 'trekresearch-loop-ledger.jsonl');
+  rmSync(ledgerPath, { force: true });
+  mkdirSync(ledgerPath, { recursive: true });
+  const { code, stderr } = await runHookWithEnv(CAP_HOOK, searchInput(), {
+    ...CAPPED_ENV,
+    CLAUDE_PLUGIN_DATA: dir,
+  });
+  assert.strictEqual(code, 2, 'an in-scope run whose ledger cannot be counted must not be granted');
+  assert.match(stderr, /could not be read|unreadable/i, 'stderr must say counting failed, not that the budget is spent');
+});
+
+test('pre-agent-cap ALLOWS an unreadable ledger when the session is OUT of scope', async () => {
+  const dir = fixture({ turns: 0, sessionId: 'a-different-session' });
+  const ledgerPath = join(dir, 'trekresearch-loop-ledger.jsonl');
+  rmSync(ledgerPath, { force: true });
+  mkdirSync(ledgerPath, { recursive: true });
+  const { code } = await runHookWithEnv(CAP_HOOK, searchInput(), {
+    ...CAPPED_ENV,
+    CLAUDE_PLUGIN_DATA: dir,
+  });
+  assert.strictEqual(code, 0, 'fail-closed is scoped to the loop, it must not brick unrelated sessions');
+});
+
 // -----------------------------------------------------------------------
 // Kill switch + default-off
 // -----------------------------------------------------------------------

tests/lib/research-loop-cap.test.mjs

@@ -7,7 +7,7 @@
 import { test } from 'node:test';
 import { strict as assert } from 'node:assert';
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -17,6 +17,7 @@ import {
   resolveMaxConvTurns,
   resolveLedgerPath,
   resolveDataRoot,
+  readLedger,
   MAX_CONV_TURNS,
   MAX_TOTAL_DIMENSIONS,
 } from '../../lib/util/research-loop-cap.mjs';
@@ -268,6 +269,61 @@ test('allowTurn — missing runId or dimension denies with missing_args', () =>
   });
 });
 
+// ---- fail-closed on an unreadable ledger ------------------------------------
+//
+// The module's own header states that a budget control "must never silently
+// grant unlimited turns just because the data dir is missing". The
+// missing-DIRECTORY case already failed closed; the unreadable-FILE case
+// returned 0 from countTurns and therefore re-granted the full budget on every
+// call, unbounded — a fail-open in the same module that argues against one.
+// A directory standing where the ledger file belongs reproduces it portably
+// (EISDIR), with no chmod that a root test runner would ignore.
+
+function withUnreadableLedger(fn) {
+  return withTmpDataDir((dir) => {
+    mkdirSync(join(dir, 'trekresearch-loop-ledger.jsonl'), { recursive: true });
+    return fn(dir);
+  });
+}
+
+test('readLedger — a missing ledger is 0 turns, not an error (turn 1 must be grantable)', () => {
+  withTmpDataDir((dir) => {
+    assert.equal(readLedger(join(dir, 'nope.jsonl'), 'r1').granted, 0);
+  });
+});
+
+test('readLedger — an unreadable ledger throws rather than reporting 0 turns spent', () => {
+  withUnreadableLedger((dir) => {
+    assert.throws(
+      () => readLedger(join(dir, 'trekresearch-loop-ledger.jsonl'), 'r1'),
+      /unreadable/i,
+    );
+  });
+});
+
+test('readLedger — malformed lines are skipped, well-formed ones for the run still count', () => {
+  withTmpDataDir((dir) => {
+    const p = join(dir, 'trekresearch-loop-ledger.jsonl');
+    writeFileSync(p, [
+      JSON.stringify({ runId: 'r1', dimension: 'd1' }),
+      '{ not json',
+      '',
+      JSON.stringify({ runId: 'other', dimension: 'd1' }),
+      JSON.stringify({ runId: 'r1', dimension: 'd2' }),
+    ].join('\n') + '\n');
+    assert.equal(readLedger(p, 'r1').granted, 2);
+  });
+});
+
+test('allowTurn — an unreadable ledger DENIES the turn instead of granting a fresh budget', () => {
+  withUnreadableLedger((dir) => {
+    const env = { CLAUDE_PLUGIN_DATA: dir, VOYAGE_STORM_ENABLED: '1' };
+    const r = allowTurn({ runId: 'r-unreadable', dimension: 'd1', effort: 'high' }, { env });
+    assert.equal(r.ok, false, 'a budget control that cannot count must not grant');
+    assert.match(r.reason, /ledger-read-failed/);
+  });
+});
+
 // ---- (g) shim contract --------------------------------------------------------
 
 test('CLI shim — grants and exits 0 when enabled + high effort + budget available', () => {