harnex 0.9.0 → 0.10.0

data/lib/harnex/commands/run.rb

@@ -31,7 +31,7 @@ module Harnex
 
     KNOWN_FLAGS = %w[
       --id --description --detach --tmux --host --port --watch --watch-file
-      --stall-after --max-resumes --preset --context --meta --summary-out
+      --stall-after --max-resumes --preset --context --meta
       --artifact-report --validation-report --cwd --root --timeout --inbox-ttl
       --require-artifact-report --require-attribution --auto-stop --fast --legacy-pty
       --allow-live-parent --help
@@ -42,7 +42,7 @@ module Harnex
     LIVE_PARENT_GUARDED_KINDS = %w[retry fix fallback superseding].freeze
     VALUE_FLAGS = %w[
       --id --description --host --port --watch --watch-file --stall-after
-      --max-resumes --preset --context --meta --summary-out --artifact-report
+      --max-resumes --preset --context --meta --artifact-report
       --validation-report --cwd --root --timeout --inbox-ttl
     ].concat(TELEMETRY_FLAGS.keys).freeze
 
@@ -67,14 +67,13 @@ module Harnex
           --fast             (codex only) Use Codex service_tier="fast".
                              Default Codex runs force service_tier="flex".
           --meta JSON        Attach parsed JSON metadata to the started event
-          --summary-out PATH Also mirror the dispatch end record JSONL to PATH
           --artifact-report PATH
-                             Worker-written harnex.artifact_report.v1 JSON sidecar to ingest at exit
+                             Override the harness-authored observed-state receipt path
           --validation-report PATH
-                             Alias for --artifact-report; also exposed as HARNEX_VALIDATION_REPORT_PATH
+                             Compatibility alias for --artifact-report
           --require-artifact-report
-                             Fail closed unless PATH contains accepted final proof;
-                             requires --artifact-report or --validation-report
+                             Compatibility strict-proof flag; a default harness receipt
+                             path is used when no explicit path is provided
           --project-id ID    Queue telemetry project id (first-class flags override --meta)
           --queue-id ID      Queue telemetry queue id
           --entry-id ID      Queue telemetry entry id
@@ -124,8 +123,9 @@ module Harnex
           Compatibility: `--watch PATH` and `--watch=PATH` still configure file-hook mode.
           Bare `--watch` enables the babysitter.
           --auto-stop requires --context. Structured Codex turns only count as
-          accepted completion after activity, Git delta, or accepted sidecar proof.
-          --require-artifact-report makes sidecar validation part of the run verdict.
+          accepted completion after command/tool activity or a Git delta.
+          Every dispatch gets a harness-authored receipt. Workers may write only
+          optional claims to HARNEX_ARTIFACT_CLAIMS_PATH; claims never accept work.
           Explicit --stall-after/--max-resumes values override --preset defaults.
           CLIs with smart prompt detection: #{Adapters.known.join(', ')}
           Any other CLI name is launched with generic wrapping.
@@ -136,7 +136,7 @@ module Harnex
           #{program_name} pi --id pi-i-42 --tmux pi-i-42 --context "Read /tmp/task-impl-42.md" --auto-stop
           #{program_name} pi --id pi-i-42 --watch --preset impl --context "Read /tmp/task-impl-42.md"
           #{program_name} codex --cwd /tmp/public-bundle --id eval-001 --context "Read README.md and write OUTPUT.md" --auto-stop
-          #{program_name} pi --id pi-i-52 --artifact-report .harnex/reports/pi-i-52.json --context "Write proof to $HARNEX_ARTIFACT_REPORT_PATH" --auto-stop
+          #{program_name} pi --id pi-r-64 --context 'Optionally write review claims to $HARNEX_ARTIFACT_CLAIMS_PATH' --auto-stop
           #{program_name} pi --project-id harnex --queue-id queue-005 --entry-id SP-4 --phase implement --intent queue-work --require-attribution --context "Implement SP-4"
           #{program_name} claude --id cl-r-42 --tmux cl-r-42 --description "Review task 42"
 
@@ -169,7 +169,6 @@ module Harnex
         meta: nil,
         telemetry: {},
         require_attribution: false,
-        summary_out: nil,
         artifact_report: nil,
         require_artifact_report: false,
         cwd: nil,
@@ -204,7 +203,6 @@ module Harnex
 
       repo_root = resolve_run_root(cli_name, child_args)
       validate_repo_phase_policy!(repo_root)
-      @options[:summary_out] = resolve_summary_out(repo_root)
       @options[:artifact_report] = resolve_artifact_report(repo_root)
       @options[:id] ||= Harnex.generate_id(repo_root)
       validate_unique_id!(repo_root)
@@ -273,7 +271,6 @@ module Harnex
       end
       tmux_cmd << "--require-attribution" if @options[:require_attribution]
       tmux_cmd << "--allow-live-parent" if @options[:allow_live_parent]
-      tmux_cmd += ["--summary-out", @options[:summary_out]] if @options[:summary_out]
       tmux_cmd += ["--artifact-report", @options[:artifact_report]] if @options[:artifact_report]
       tmux_cmd << "--require-artifact-report" if @options[:require_artifact_report]
       tmux_cmd += ["--cwd", @options[:cwd]] if @options[:cwd]
@@ -308,7 +305,9 @@ module Harnex
         port: registry["port"],
         mode: "tmux",
         window: window_name,
-        output_log_path: Harnex.output_log_path(repo_root, @options[:id])
+        output_log_path: Harnex.output_log_path(repo_root, @options[:id]),
+        artifact_report_path: registry["artifact_report_path"],
+        artifact_claims_path: registry["artifact_claims_path"]
       }
       payload[:description] = @options[:description] if @options[:description]
       puts JSON.generate(payload)
@@ -347,7 +346,9 @@ module Harnex
         port: registry["port"],
         mode: "headless",
         log: log_path,
-        output_log_path: Harnex.output_log_path(repo_root, @options[:id])
+        output_log_path: Harnex.output_log_path(repo_root, @options[:id]),
+        artifact_report_path: registry["artifact_report_path"],
+        artifact_claims_path: registry["artifact_claims_path"]
       }
       payload[:description] = @options[:description] if @options[:description]
       puts JSON.generate(payload) if emit_payload
@@ -435,7 +436,6 @@ module Harnex
         watch: watch,
         description: @options[:description],
         meta: @options[:meta],
-        summary_out: @options[:summary_out],
         artifact_report_path: @options[:artifact_report],
         require_artifact_report: @options[:require_artifact_report],
         inbox_ttl: @options[:inbox_ttl],
@@ -624,11 +624,6 @@ module Harnex
         when telemetry_equals_regex
           flag = "--#{Regexp.last_match(1)}"
           @options[:telemetry][TELEMETRY_FLAGS.fetch(flag)] = required_option_value(flag, Regexp.last_match(2))
-        when "--summary-out"
-          index += 1
-          @options[:summary_out] = required_option_value(arg, argv[index])
-        when /\A--summary-out=(.+)\z/
-          @options[:summary_out] = required_option_value("--summary-out", Regexp.last_match(1))
         when "--artifact-report", "--validation-report"
           index += 1
           @options[:artifact_report] = required_option_value(arg, argv[index])
@@ -720,7 +715,7 @@ module Harnex
           nil
         when *VALUE_FLAGS
           index += 1
-        when /\A--(?:id|description|host|port|watch|watch-file|stall-after|max-resumes|context|meta|summary-out|artifact-report|validation-report|cwd|root|timeout|inbox-ttl)=/
+        when /\A--(?:id|description|host|port|watch|watch-file|stall-after|max-resumes|context|meta|artifact-report|validation-report|cwd|root|timeout|inbox-ttl)=/
           nil
         when telemetry_equals_regex
           nil
@@ -740,7 +735,7 @@ module Harnex
         arg == "-h" ||
         arg.start_with?(
           "--id=", "--description=", "--tmux=", "--host=", "--port=", "--watch=", "--watch-file=",
-          "--stall-after=", "--max-resumes=", "--preset=", "--context=", "--meta=", "--summary-out=",
+          "--stall-after=", "--max-resumes=", "--preset=", "--context=", "--meta=",
           "--artifact-report=", "--validation-report=", "--cwd=", "--root=", "--timeout=", "--inbox-ttl=",
           *TELEMETRY_EQUALS_PREFIXES
         )
@@ -771,12 +766,11 @@ module Harnex
       raise OptionParser::InvalidOption, "harnex run: --auto-stop requires --context"
     end
 
+    # Retained for compatibility with callers that still pass the strict flag.
+    # Session now allocates a harness-owned default receipt path, so an explicit
+    # --artifact-report path is no longer required.
     def validate_required_artifact_report!
-      return unless @options[:require_artifact_report]
-      return unless @options[:artifact_report].to_s.strip.empty?
-
-      raise OptionParser::InvalidOption,
-            "harnex run: --require-artifact-report requires --artifact-report PATH"
+      true
     end
 
     def apply_telemetry_options!
@@ -867,15 +861,6 @@ module Harnex
       raise OptionParser::InvalidOption, "--meta must be valid JSON: #{e.message}"
     end
 
-    # Explicit-only mirror: the tracked dispatch stream is the canonical
-    # destination; --summary-out just duplicates the end record elsewhere.
-    def resolve_summary_out(repo_root)
-      configured = @options[:summary_out]
-      return nil if configured.nil?
-
-      File.expand_path(configured, repo_root)
-    end
-
     def resolve_artifact_report(repo_root)
       configured = @options[:artifact_report]
       return nil if configured.nil?

data/lib/harnex/commands/status.rb

@@ -127,7 +127,6 @@ module Harnex
         "work_state" => "running",
         "exit" => nil,
         "exit_code" => nil,
-        "summary_out" => nil,
         "ended_at" => nil,
         "source" => "dispatch_start",
         "degraded" => true,
@@ -150,7 +149,6 @@ module Harnex
         "work_state" => work_state,
         "exit" => nil,
         "exit_code" => nil,
-        "summary_out" => nil,
         "ended_at" => nil,
         "source" => degraded ? "registry" : "live",
         "degraded" => degraded

data/lib/harnex/commands/wait.rb

@@ -624,7 +624,6 @@ module Harnex
         artifact_report_status: status["artifact_report_status"],
         exit: status["exit"],
         exit_code: status["exit_code"],
-        summary_out: status["summary_out"],
         ended_at: status["ended_at"],
         source: status["source"]
       }

data/lib/harnex/config.rb

@@ -4,7 +4,7 @@ module Harnex
   module Config
     CONFIG_RELATIVE_PATH = File.join(".harnex", "config.json").freeze
     PHASE_POLICIES = %w[warn reject].freeze
-    RETENTION_DIRS = %w[events output].freeze
+    RETENTION_DIRS = %w[events output receipts].freeze
     RETENTION_FIELDS = %w[max_age_days max_bytes].freeze
     RETENTION_ENV = {
       "events" => {
@@ -14,6 +14,10 @@ module Harnex
       "output" => {
         "max_age_days" => "HARNEX_OUTPUT_MAX_AGE_DAYS",
         "max_bytes" => "HARNEX_OUTPUT_MAX_BYTES"
+      },
+      "receipts" => {
+        "max_age_days" => "HARNEX_RECEIPTS_MAX_AGE_DAYS",
+        "max_bytes" => "HARNEX_RECEIPTS_MAX_BYTES"
       }
     }.freeze
     DEFAULT_RETENTION_LIMITS = RETENTION_DIRS.to_h do |dir|
@@ -127,7 +131,7 @@ module Harnex
       retention.each do |dir, value|
         unless RETENTION_DIRS.include?(dir)
           raise ConfigError,
-            "#{path}: $.retention.#{dir} is not supported (expected events or output)"
+            "#{path}: $.retention.#{dir} is not supported (expected events, output, or receipts)"
         end
         unless value.is_a?(Hash)
           raise ConfigError, "#{path}: $.retention.#{dir} must be an object"

data/lib/harnex/core.rb

@@ -1,5 +1,6 @@
 require "digest"
 require "fileutils"
+require "open3"
 require "optparse"
 require "securerandom"
 require "set"
@@ -19,6 +20,8 @@ module Harnex
   DEFAULT_PORT_SPAN = Integer(env_value("HARNEX_PORT_SPAN", default: "4000"))
   DEFAULT_ID = "default"
   WATCH_DEBOUNCE_SECONDS = 1.0
+  GIT_FINGERPRINT_FULL_BYTES = 4 * 1024 * 1024
+  GIT_FINGERPRINT_SAMPLE_BYTES = 64 * 1024
   STATE_DIR = File.expand_path(env_value("HARNEX_STATE_DIR", default: "~/.local/state/harnex"))
   SESSIONS_DIR = File.join(STATE_DIR, "sessions")
   WatchConfig = Struct.new(:absolute_path, :display_path, :hook_message, :debounce_seconds, keyword_init: true)
@@ -114,42 +117,204 @@ module Harnex
     text.to_s.gsub(/\e\[[0-9;]*[a-zA-Z]/, "")
   end
 
-  def git_capture_start(repo_root)
+  def git_capture_start(repo_root, exclude_paths: [])
     sha = git_output(repo_root, "rev-parse", "HEAD")
     branch = git_output(repo_root, "rev-parse", "--abbrev-ref", "HEAD")
     return {} if sha.empty? || branch.empty?
 
+    excluded_paths = normalize_git_excluded_paths(exclude_paths)
+    worktree = git_worktree_snapshot(repo_root, exclude_paths: excluded_paths)
     {
       sha: sha,
-      branch: branch
+      branch: branch,
+      worktree: worktree,
+      excluded_paths: excluded_paths
     }
   rescue StandardError
     {}
   end
 
-  def git_capture_end(repo_root, start_sha)
-    start_sha = start_sha.to_s.strip
+  # Captures committed and in-progress work relative to the state observed at
+  # session start. Passing the full git_capture_start hash avoids treating an
+  # unchanged pre-existing dirty tree as worker activity; a SHA string remains
+  # supported for older callers.
+  def git_capture_end(repo_root, start, exclude_paths: nil)
+    start_capture = start.is_a?(Hash) ? start : {}
+    start_sha = (start_capture[:sha] || start_capture["sha"] || start).to_s.strip
     return {} if start_sha.empty?
 
+    excluded_paths ||= start_capture[:excluded_paths] || start_capture["excluded_paths"] || []
+    excluded_paths = normalize_git_excluded_paths(excluded_paths)
     end_sha = git_output(repo_root, "rev-parse", "HEAD")
     range = "#{start_sha}..#{end_sha}"
-    shortstat = git_output(repo_root, "diff", "--shortstat", range)
-    changed_paths = git_output(repo_root, "diff", "--name-only", range).lines.map(&:strip).reject(&:empty?).first(200)
     commits = Integer(git_output(repo_root, "rev-list", "--count", range))
-    stats = parse_git_shortstat(shortstat)
+    committed_paths = git_null_paths(repo_root, "diff", "--name-only", "-z", range)
+      .reject { |path| excluded_paths.include?(path) }
+    committed_stats = if committed_paths.empty?
+                        { loc_added: 0, loc_removed: 0 }
+                      else
+                        parse_git_numstat(
+                          git_output(repo_root, "diff", "--numstat", range, "--", *committed_paths.first(200))
+                        )
+                      end
+
+    start_worktree = start_capture[:worktree] || start_capture["worktree"]
+    end_worktree = git_worktree_snapshot(repo_root, exclude_paths: excluded_paths)
+    worktree_paths = changed_worktree_paths(start_worktree, end_worktree)
+    tracked_worktree_paths = worktree_paths.select do |path|
+      entry = end_worktree.fetch(:entries).fetch(path, nil)
+      entry && entry.fetch(:tracked)
+    end
+    worktree_stats = if tracked_worktree_paths.empty?
+                       { loc_added: 0, loc_removed: 0 }
+                     else
+                       parse_git_numstat(
+                         git_output(repo_root, "diff", "--numstat", end_sha, "--", *tracked_worktree_paths.first(200))
+                       )
+                     end
+    untracked_stats = untracked_worktree_stats(start_worktree, end_worktree, worktree_paths)
+    all_paths = (committed_paths + worktree_paths).uniq
 
     {
       sha: end_sha,
-      loc_added: stats.fetch(:loc_added),
-      loc_removed: stats.fetch(:loc_removed),
-      files_changed: stats.fetch(:files_changed),
-      changed_paths: changed_paths,
-      commits: commits
+      loc_added: committed_stats.fetch(:loc_added) + worktree_stats.fetch(:loc_added) + untracked_stats.fetch(:loc_added),
+      loc_removed: committed_stats.fetch(:loc_removed) + worktree_stats.fetch(:loc_removed) + untracked_stats.fetch(:loc_removed),
+      files_changed: all_paths.length,
+      changed_paths: all_paths.first(200),
+      commits: commits,
+      start_dirty: start_worktree ? !start_worktree.fetch(:entries).empty? : nil,
+      end_dirty: !end_worktree.fetch(:entries).empty?,
+      worktree_changed: !worktree_paths.empty?
     }
   rescue StandardError
     {}
   end
 
+  def git_worktree_snapshot(repo_root, exclude_paths: [])
+    excluded_paths = normalize_git_excluded_paths(exclude_paths)
+    tracked_paths = (
+      git_null_paths(repo_root, "diff", "--name-only", "-z") +
+      git_null_paths(repo_root, "diff", "--cached", "--name-only", "-z")
+    ).uniq.reject { |path| excluded_paths.include?(path) }
+    untracked_paths = git_null_paths(repo_root, "ls-files", "--others", "--exclude-standard", "-z")
+      .reject { |path| excluded_paths.include?(path) }
+    entries = {}
+    tracked_paths.each do |path|
+      entries[path] = git_worktree_entry(repo_root, path, tracked: true)
+    end
+    untracked_paths.each do |path|
+      entries[path] = git_worktree_entry(repo_root, path, tracked: false)
+    end
+    { entries: entries }
+  end
+
+  def normalize_git_excluded_paths(paths)
+    Array(paths).filter_map do |path|
+      text = path.to_s.sub(%r{\A\./}, "")
+      text unless text.empty?
+    end.uniq
+  end
+
+  def git_worktree_entry(repo_root, relative_path, tracked:)
+    path = File.join(repo_root.to_s, relative_path)
+    stat = File.lstat(path)
+    if stat.symlink?
+      content = File.readlink(path)
+      return {
+        tracked: tracked,
+        fingerprint: "symlink:#{Digest::SHA256.hexdigest(content)}",
+        lines: 0,
+        binary: false
+      }
+    end
+
+    return { tracked: tracked, fingerprint: "missing", lines: 0, binary: false } unless stat.file?
+
+    if stat.size > GIT_FINGERPRINT_FULL_BYTES
+      first = File.binread(path, GIT_FINGERPRINT_SAMPLE_BYTES)
+      last = File.open(path, "rb") do |file|
+        file.seek(-[stat.size, GIT_FINGERPRINT_SAMPLE_BYTES].min, IO::SEEK_END)
+        file.read(GIT_FINGERPRINT_SAMPLE_BYTES).to_s
+      end
+      digest = Digest::SHA256.new
+      digest.update("#{stat.mode}:#{stat.size}:#{(stat.mtime.to_r * 1_000_000_000).to_i}")
+      digest.update(first)
+      digest.update(last)
+      return {
+        tracked: tracked,
+        fingerprint: "large:#{digest.hexdigest}",
+        lines: 0,
+        binary: first.include?("\0") || last.include?("\0")
+      }
+    end
+
+    digest = Digest::SHA256.new
+    lines = 0
+    binary = false
+    last_byte = nil
+    File.open(path, "rb") do |file|
+      buffer = +""
+      while file.read(16 * 1024, buffer)
+        digest.update(buffer)
+        binary ||= buffer.include?("\0")
+        lines += buffer.count("\n")
+        last_byte = buffer.byteslice(-1)
+      end
+    end
+    lines += 1 if stat.size.positive? && last_byte != "\n"
+    {
+      tracked: tracked,
+      fingerprint: "file:#{stat.mode}:#{digest.hexdigest}",
+      lines: binary ? 0 : lines,
+      binary: binary
+    }
+  rescue Errno::ENOENT, Errno::EACCES, Errno::ENOTDIR
+    { tracked: tracked, fingerprint: "missing", lines: 0, binary: false }
+  end
+
+  def changed_worktree_paths(start_worktree, end_worktree)
+    end_entries = end_worktree.fetch(:entries)
+    return end_entries.keys.sort unless start_worktree.is_a?(Hash)
+
+    start_entries = start_worktree[:entries] || start_worktree["entries"] || {}
+    (start_entries.keys + end_entries.keys).uniq.select do |path|
+      start_entries[path] != end_entries[path]
+    end.sort
+  end
+
+  def untracked_worktree_stats(start_worktree, end_worktree, changed_paths)
+    start_entries = if start_worktree.is_a?(Hash)
+                      start_worktree[:entries] || start_worktree["entries"] || {}
+                    else
+                      {}
+                    end
+    end_entries = end_worktree.fetch(:entries)
+    changed_paths.each_with_object({ loc_added: 0, loc_removed: 0 }) do |path, stats|
+      before = start_entries[path]
+      after = end_entries[path]
+      next if after && after.fetch(:tracked)
+      next if before && before.fetch(:tracked)
+
+      stats[:loc_removed] += before.fetch(:lines) if before
+      stats[:loc_added] += after.fetch(:lines) if after
+    end
+  end
+
+  def git_null_paths(repo_root, *args)
+    output, _stderr, status = Open3.capture3("git", "-C", repo_root.to_s, *args)
+    raise "git #{args.join(' ')} failed" unless status.success?
+
+    output.split("\0").reject(&:empty?)
+  end
+
+  def parse_git_numstat(text)
+    text.to_s.lines.each_with_object({ loc_added: 0, loc_removed: 0 }) do |line, stats|
+      added, removed, = line.split("\t", 3)
+      stats[:loc_added] += Integer(added, exception: false).to_i
+      stats[:loc_removed] += Integer(removed, exception: false).to_i
+    end
+  end
+
   # Canonical path resolution shared by every registry/exit/events writer and
   # reader. realpath collapses symlinked prefixes so a session registered from
   # a symlinked cwd stays visible to checkers resolving the physical path.
@@ -285,6 +450,12 @@ module Harnex
     false
   rescue Errno::EPERM
     true
+  rescue ArgumentError, TypeError
+    # A non-numeric pid means a truncated, hand-edited, or foreign-written
+    # registry file. Report it dead so active_sessions prunes it, the same
+    # self-healing it already applies to unparseable JSON. Raising here would
+    # take down every command that scans sessions -- status, send, pane.
+    false
   end
 
   def read_registry(repo_root, id = DEFAULT_ID, cli: nil)
@@ -352,10 +523,25 @@ module Harnex
     nil
   end
 
-  def write_registry(path, payload)
-    tmp = "#{path}.tmp.#{Process.pid}"
+  # Atomically replace a JSON state file.
+  #
+  # The temp name must be unique per write, not just per process. Several
+  # threads in one session write the same registry path — the startup persist,
+  # the inbox delivery thread, and one thread per API client — and a shared
+  # temp name lets one thread rename the file another is still writing, which
+  # surfaces as ENOENT on the loser's rename. mkdir_p covers a state directory
+  # that was reaped (tmpfs, operator cleanup) while the process was live.
+  def atomic_write_json(path, payload)
+    FileUtils.mkdir_p(File.dirname(path))
+    tmp = "#{path}.tmp.#{Process.pid}.#{SecureRandom.hex(6)}"
     File.write(tmp, JSON.pretty_generate(payload))
     File.rename(tmp, path)
+  ensure
+    FileUtils.rm_f(tmp) if tmp
+  end
+
+  def write_registry(path, payload)
+    atomic_write_json(path, payload)
   end
 
   def allocate_port(repo_root, id, requested_port = nil, host: DEFAULT_HOST)

data/lib/harnex/dispatch_history.rb

@@ -156,8 +156,9 @@ module Harnex
         repo_root: session.repo_root,
         tier: session.__send__(:meta_hash)["tier"],
         meta: session.__send__(:meta_hash),
-        summary_out_path: session.summary_out,
-        events_log_path: session.events_log_path
+        events_log_path: session.events_log_path,
+        artifact_report_path: session.artifact_report_path,
+        artifact_claims_path: session.artifact_claims_path
       }
     end
 
@@ -182,7 +183,6 @@ module Harnex
         terminal_event: terminal_event,
         commit_sha: commit_sha(session.git_start, session.git_end),
         tier: session.__send__(:meta_hash)["tier"],
-        summary_out_path: session.summary_out,
         events_log_path: session.events_log_path,
         tmux_state: tmux_state(session.__send__(:summary_tmux_session))
       }.merge(session.__send__(:build_summary_record))

data/lib/harnex/retention.rb

@@ -7,7 +7,8 @@ module Harnex
   module Retention
     DIRS = {
       "events" => "events",
-      "output" => "output"
+      "output" => "output",
+      "receipts" => "receipts"
     }.freeze
     THROTTLE_SECONDS = 3600
     MAX_REPORTED_PATHS = 100
@@ -184,6 +185,8 @@ module Harnex
 
         protect(paths, data["events_log_path"])
         protect(paths, data["output_log_path"])
+        protect(paths, data["artifact_report_path"])
+        protect(paths, data["artifact_claims_path"])
         protect_derived_session_paths(paths, data)
       rescue JSON::ParserError, ArgumentError, TypeError, Errno::ENOENT, Errno::EACCES
         next
@@ -200,6 +203,8 @@ module Harnex
         live_start_records(path).each do |record|
           protect(paths, record["events_log_path"])
           protect(paths, record["output_log_path"])
+          protect(paths, record["artifact_report_path"])
+          protect(paths, record["artifact_claims_path"])
           protect_derived_session_paths(paths, record)
         end
       end
@@ -243,6 +248,12 @@ module Harnex
 
       protect(paths, Harnex.events_log_path(repo, id))
       protect(paths, Harnex.output_log_path(repo, id))
+      session_id = data["session_id"].to_s
+      unless session_id.empty?
+        receipt = Harnex::ArtifactReport.default_path(repo_root: repo, id: id, session_id: session_id)
+        protect(paths, receipt)
+        protect(paths, Harnex::ArtifactReport.claims_path(receipt))
+      end
     rescue StandardError
       nil
     end
@@ -301,9 +312,7 @@ module Harnex
           end
         }
       }
-      tmp = "#{METADATA_PATH}.tmp.#{Process.pid}"
-      File.write(tmp, JSON.pretty_generate(payload))
-      File.rename(tmp, METADATA_PATH)
+      Harnex.atomic_write_json(METADATA_PATH, payload)
     rescue StandardError => e
       warn("harnex: failed to persist retention metadata: #{e.message}")
     end