kairos-chain 3.75.0 → 3.76.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3491085c294fc09283689fa6a808362f088cd2d3287639c028959165928f4820
-  data.tar.gz: d974be22bf343153f28e3dff6146fcc931e72af34c138d5e3ada2330afcf08f8
+  metadata.gz: 83162bcb26c033c10413fe1f25ffed382031dfebc115aa7041438d807177ef8c
+  data.tar.gz: eacc1ed007ad60d8429954c1d0e0bca228048a5a0438f177df892e72aae3e599
 SHA512:
-  metadata.gz: 9072c0b407d3cd2a50490de0c93f954a4d32fb86d3342b5eb36c80940d21257e001edc1a3eba0b158c6f7f822638a7fb445a98093fa34fe73c84593e8b624771
-  data.tar.gz: 32afff4b989ba3b1a09a96d138250e6e536e68700be54f4f09887311406170439ffdb422f6ba21d49c204109758963181c2d5f199aa60f692c3c21a7c5ad609b
+  metadata.gz: e6e311e80bc090726582d7032aa87a0ac1a97ffea387b300306d609f19b0a38c4dbe2cd6a84dd36e924e66c3e9f579b56f91c1c25602cc2afdae21e8f8e2005c
+  data.tar.gz: 0ffddbff73ac05f8804b343e597495517b3872a0ceed500ef1370aab8f034a866b20585a5a03c46db179fbacfd18aff3862a70fc40c093f66389a69f2afdc4c2

data/CHANGELOG.md

@@ -4,6 +4,83 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.76.0] - 2026-08-22
+
+### Changed
+
+- **L1 `multi_llm_review_workflow` 3.10.2 → 3.11.0 — three norms and one
+  recorded open question, for three failures the operator named and one request
+  he made.** The failures: an orchestrator issuing different criteria each
+  round, the APPROVE ratio operating as the close condition, and design reviews
+  descending into code. The request: bound mutation experiments. Four rules were
+  drafted, reviewed over three rounds, applied, reviewed once more as applied
+  text — one APPROVE of four seats, eighteen blocking findings — and revised
+  subtractively. What ships is narrower than what was drafted, which is the
+  point: this entry's own § Revision Discipline records that deletions drew zero
+  new P0s in every measured case and additions became the next round's
+  battleground.
+
+  **§ Prompt Generation Rules gains a recording duty on the round's
+  instrument** — what a seat is told to look for, how much of the artifact it is
+  given, and which seats answer. It bounds nothing: narrowing criteria, cutting
+  scope and convening a different panel are each a documented remedy for
+  something. It forbids moving the instrument and then reading the resulting
+  change in finding counts as a property of the artifact. It was drafted around
+  criteria alone, which left scope and panel composition — two channels that
+  move the count just as well — outside it.
+
+  **§ Review Types gains the phase rule as an invariant with no branches**: a
+  review answers at the phase of its target and does not descend. Design and
+  Document reviews read code only to refute a factual claim and write none;
+  implementation review is where fixes are written. Two enumerated sentences
+  drafted with it are not here. "An implementation-phase finding that reopens
+  the design belongs to the backlog" collided with this entry's own "any (a) or
+  (b) REJECT or FAIL = revise and re-review" over exactly the
+  design-implementation seam it calls the most valuable layer, and pre-answered
+  the operator question § Revision Discipline rule 1 requires. "Fix plan and
+  Final/convergence reviews inherit the phase of the artifact they check" gave
+  those two nothing to inherit, no phase being assigned to a fix plan anywhere.
+  The `<structured_output_contract>` line drops "consider improving" without
+  enumerating review types, because the enumerated form left this entry's own
+  knowledge/documentation-update review unassigned.
+
+  **The mutation norm is one sentence inside the phase rule and assigns no
+  party**: a green suite is not evidence until its tests have been shown to
+  fail, and a pass whose sites the code's author chose measures the author's
+  attention, not the suite. It was drafted as a seventh item in Step -1 carrying
+  the duty "whoever chooses the sites is not whoever wrote the code", and no
+  party in this entry can discharge that — before dispatch the only actor is the
+  orchestrator, which § Roles makes the same context as the implementer, and
+  review seats run sandboxed read-only and cannot execute anything. Stated as a
+  property of evidence rather than a duty on someone, it holds wherever a
+  mutation result is read. The bound the operator asked for is not here and the
+  omission is open, not settled: the recorded decision is to accumulate three
+  runs and then judge.
+
+  **Withdrawn in the same version: a rule making each seat label its own
+  findings new or carryover.** A seat sees only its own priors, so a finding one
+  seat raises after another raised it is new to that seat and carryover to the
+  round, and a seat added or returning mid-thread has no priors at all, making
+  every finding it raises new by construction — the machine-side signal "new
+  (a)+(b) P0 = 0" is then not computable from seat labels. § Convergence Rules
+  records that who makes the label is undecided and that the orchestrator makes
+  it meanwhile, which is the biased judge the withdrawn rule was written to
+  replace. Its paired edits revert with it, which also removes "the round number
+  is never written into a prompt" — that sentence contradicted § Output
+  Directive's MUST that the prompt carry `review{N}` in the output path, and an
+  orchestrator obeying it would have had round N+1 overwrite round N.
+
+  A fifth proposed rule, an exception for self-referential reviews, was dropped
+  before the version was written, after four reviewer contexts — occupying two
+  of that round's three counted seats — shot it on three independent grounds.
+
+  Across all four review rounds the thing most often refuted was not the rules
+  but the change's account of itself. The pre-flight falsifier for the applied
+  round refuted 8 of 22 checked claims, three of them inside the version entry;
+  the correction to those three introduced a fourth false claim, which the round
+  then refuted. Every such claim is a record summarised without its denominator
+  or its condition.
+
 ## [3.75.0] - 2026-08-21
 
 ### Added

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.75.0"
+  VERSION = "3.76.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/multi_llm_review_workflow/multi_llm_review_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: multi_llm_review_workflow
 description: "Multi-LLM review methodology and execution — workflow pattern, CLI tooling, consensus analysis, Persona Assembly. Applicable to design, implementation, documentation, or any artifact."
-version: "3.10.2"
+version: "3.11.0"
 tags:
   - workflow
   - review
@@ -53,7 +53,9 @@ write a review spec and declare it frozen for the round:
 3. **Cap fixes per round (≤5)** and write one line per fix: *what this fix
    newly claims* (values pinned, ranges narrowed, failure visibility
    changed). A fix that cannot state its new claims is doing more than the
-   finding asked.
+   finding asked. A round that moves its instrument records that it moved it
+   (§ Prompt Generation Rules). That is a recording duty; unlike the cap
+   above, it bounds nothing.
 4. **Pre-flight falsifier.** Before dispatch, one agent whose only job is to
    refute every factual claim in the spec and artifact — especially numbers
    and "X does not exist" claims. In this loop it caught real errors before
@@ -563,6 +565,13 @@ Rules:
 | Document review | Accuracy, completeness, consistency | Document text | Grant applications, papers |
 | Final/convergence review | All prior findings resolved, no new issues | Resolution matrix + revised artifact | Before merge |
 
+**A review answers at the phase of its target and does not descend.** Design
+review and Document review read code only to refute a factual claim the
+artifact makes about an existing system, and write none. Implementation review
+is where fixes are written, and is also where a green suite is not evidence
+until its tests have been shown to fail — a mutation pass whose sites the
+code's author chose measures the author's attention, not the suite.
+
 ## LLM Role Differentiation
 
 Without explicit instruction, different LLMs naturally focus on different verification layers:
@@ -601,9 +610,17 @@ numerator moved. Do not treat a reached ratio as sufficient on its own either:
 check what the approving replies actually said before counting them.
 
 **Count carryover and new (a)/(b) P0s separately; the machine-side signal of
-convergence is "new P0 = 0", not the APPROVE ratio.** Require each persona to
+convergence is "new P0 = 0", not the APPROVE ratio.** Require each **seat** to
 state a closure verdict on its own prior-round P0s — closed / open /
-half-closed, with grounds. This format is validated live (chain erasure
+half-closed, with grounds. **Who labels a finding new versus carryover is
+undecided.** The seat-side answer — each seat labelling against its own prior
+findings — was written into this section on 2026-08-22 and removed the same day:
+a seat sees only its own priors, so a finding one seat raises after another seat
+raised it is new to that seat and carryover to the round, and a seat added or
+returning mid-thread has no priors at all, making every finding it raises new by
+construction. Until this is answered, the orchestrator makes the call, knowing
+that it is the context whose artifact the call converges. This format is
+validated live (chain erasure
 R6–R8) and is what makes the carryover/new split computable. A round whose
 (a)+(b) findings are all carryover with closure verdicts, and whose revision
 drew zero new P0s (observed without exception when the revision was
@@ -1202,6 +1219,19 @@ Every review prompt MUST include these 7 items:
 
 All prompt content MUST be in **English** for consistent parsing across LLM tools.
 
+**A round that changes its instrument records the change.** The instrument is
+whatever bounds what the round can find: what a seat is told to look for, how
+much of the artifact it is given, and which seats answer. Some of a prompt
+varies by construction — the artifact itself, the prior findings a round asks a
+seat to verdict — and that is not the instrument. When a round moves the
+instrument, it says so on the record, in one line, naming what moved and why.
+
+This is a recording duty, not a prohibition. An orchestrator may narrow a
+seat's criteria mid-thread, cut the scope, or convene a different panel; each
+of those is a documented remedy for something. What it may not do is move the
+instrument and then read the resulting change in finding counts as a property
+of the artifact.
+
 ### Reviewer incentive rule
 
 **Never tell a reviewer — subprocess or persona — that its finding count is
@@ -1247,7 +1277,8 @@ For each finding:
 - **What can go wrong**: concrete failure scenario
 - **Why this is vulnerable**: code path or design gap
 - **Likely impact**: data loss, security breach, silent corruption, etc.
-- **Recommended fix**: specific change (not "consider improving")
+- **Recommended fix**: specific, never "consider improving" — the change where
+  this review writes changes, the claim that does not hold where it does not.
 </structured_output_contract>
 
 <grounding_rules>
@@ -1611,5 +1642,59 @@ Compression ratio: parallel agent raw → Assembly ≈ 2:1
   with zero new and one carryover (a) at 1 of 2 seats approving reports
   "GATE NOT PASSED" under the old rule and "FREEZE CANDIDATE" under this one.
 
+- Three norms, subtractively (v3.11.0, 2026-08-22): the operator named three
+  recurring failures — an orchestrator issuing different criteria each round,
+  the APPROVE ratio operating as the close condition, and design reviews
+  descending into code — and asked for mutation experiments to be bounded. Four
+  rules were written and reviewed; one was withdrawn in the same version and two
+  of the survivors are narrower than they were drafted, so what ships is three
+  norms and one recorded open question. **§ Prompt Generation Rules** gains a
+  recording duty on the round's instrument — what a seat is told to look for,
+  how much of the artifact it is given, and which seats answer. It bounds
+  nothing: narrowing criteria, cutting scope and convening a different panel are
+  each a documented remedy for something. What it forbids is moving the
+  instrument and then reading the resulting change in counts as a property of
+  the artifact. It was drafted around criteria alone, which left scope and panel
+  composition — two channels that move the count just as well — outside it.
+  **§ Review Types** gains the phase rule as an invariant with no branches: a
+  review answers at the phase of its target and does not descend. Two enumerated
+  sentences were drafted with it and are not here. "An implementation-phase
+  finding that reopens the design belongs to the backlog" collided with this
+  document's own "any (a) or (b) REJECT or FAIL = revise and re-review" over
+  exactly the design-implementation seam it calls the most valuable layer, and
+  pre-answered the operator question § Revision Discipline rule 1 requires. "Fix
+  plan and Final/convergence reviews inherit the phase of the artifact they
+  check" gave those two reviews nothing to inherit, since no phase is assigned to
+  a fix plan anywhere. The output contract at `<structured_output_contract>`
+  drops "consider improving" without enumerating review types, because the
+  enumerated form left this document's own knowledge/documentation-update review
+  unassigned. **The mutation norm** is one sentence inside the phase rule and
+  assigns no party: a green suite is not evidence until its tests have been shown
+  to fail, and a pass whose sites the code's author chose measures the author's
+  attention, not the suite. It was drafted as a seventh item in Step -1 with the
+  duty "whoever chooses the sites is not whoever wrote the code", and no party in
+  this document can discharge that — before dispatch the only actor is the
+  orchestrator, which § Roles makes the same context as the implementer, and the
+  seats are sandboxed read-only and cannot execute anything. Stated as a property
+  of evidence rather than a duty on someone, it holds wherever a mutation result
+  is read. The bound the operator asked for is not here and the omission is open,
+  not settled: the recorded decision is to accumulate three runs and then judge.
+  **Withdrawn in this version**: a rule making each seat label its own findings
+  new or carryover. A seat sees only its own priors, so a finding one seat raises
+  after another raised it is new to that seat and carryover to the round, and a
+  seat added or returning mid-thread has no priors at all. § Convergence Rules
+  now records that who makes the label is undecided and that the orchestrator
+  makes it meanwhile, which is the biased judge the withdrawn rule was written to
+  replace. A fifth proposed rule, an exception for self-referential reviews, was
+  dropped before this version was written, after four reviewer contexts —
+  occupying two of that round's three counted seats — shot it on three
+  independent grounds. Design history: three review rounds on the proposal
+  (closed by operator declaration, not convergence), then one round on the
+  applied text, which returned one APPROVE of four seats and eighteen blocking
+  findings — every rule above is narrower for it. What kept being shot across all
+  four rounds was the change's account of itself, not the rules it proposed.
+  Records: L2 `handoff_mlr_l1_norms_revision_three_rounds_and_switch_to_implementation_20260821`
+  and L2 `mlr_v3_11_0_applied_review_r1_and_subtractive_revision_20260822`
+
 **Key insight**: Design reviews and implementation reviews find
 **categorically different bugs**. Both phases are necessary.

data/templates/skillsets/kairos_hook_projector/hooks/readable_gate.rb

@@ -31,6 +31,31 @@ module KairosHookProjector
     TAIL_BYTES = 512 * 1024
     POLL_ATTEMPTS = 15
     POLL_DELAY = 0.1
+    # The recheck waits longer than the first read, because it is waiting for a
+    # whole rewrite rather than for the tail of a record already being written.
+    # Bounded well under the hook's own timeout; the turn it lengthens is one
+    # that already spent a full regeneration.
+    RECHECK_POLL_ATTEMPTS = 40
+    # Claude Code's own wording, written into the transcript as a user record
+    # when a Stop hook blocks. Not this gate's string: if it changes, no marker
+    # is found and the read falls back to the pre-2026-08-20 behaviour, which
+    # the verdict names so the drift shows up in the log instead of silently.
+    BLOCK_MARKER = 'Stop hook feedback:'
+    # Claude Code's limit on how long a Stop hook may run, declared twice
+    # outside this file: in `.claude/settings.json` and in this SkillSet's
+    # `lib/mode_hooks_compiler.rb`. Named here because this file spends two
+    # budgets in sequence and neither knows about the other. A hook killed at
+    # the limit emits nothing at all — no verdict, no banner, no log line — so
+    # the gate stops enforcing and the measurement loses rows, both silently.
+    HOOK_TIMEOUT = 10.0
+    # Held back from the pair for interpreter start-up and for the poll's own
+    # overhead, which measures 0.2-0.6s above the sleeps it accounts for.
+    HOOK_TIMEOUT_MARGIN = 1.0
+    # What is left for measurement once the recheck has spent its budget. A mode
+    # asking for more than this is honoured up to here and no further: the
+    # alternative is a mode file being able to silence the gate by arithmetic.
+    MEASURE_TIMEOUT_CEILING =
+      HOOK_TIMEOUT - HOOK_TIMEOUT_MARGIN - (RECHECK_POLL_ATTEMPTS * POLL_DELAY)
 
     # Built from single-quoted strings so that `#{` in a pattern stays literal
     # rather than becoming interpolation, and anchored with \A because Python's
@@ -131,7 +156,18 @@ module KairosHookProjector
         # list. Text explaining the vocabulary rule has to name the shapes it
         # governs, and naming them is not using them.
         @specimen = merged['specimen_patterns'].map { |p| Regexp.new(p) }
-        @measure_timeout = merged['measure_timeout_seconds']
+        # Clamped, not rejected: a mode that asks for 6 seconds gets what fits
+        # rather than a refusal it cannot act on. 4 seconds of recheck poll plus
+        # 6 of measurement is 10.4 against a 10-second hook limit, and the hook
+        # dies with no output, so the gate would silently stop enforcing for
+        # exactly the modes whose patterns are expensive enough to need the time.
+        requested = merged['measure_timeout_seconds']
+        @measure_timeout =
+          if requested.is_a?(Numeric) && requested > MEASURE_TIMEOUT_CEILING
+            MEASURE_TIMEOUT_CEILING
+          else
+            requested
+          end
         @log_max_bytes = merged['log_max_bytes']
       end
 
@@ -275,32 +311,168 @@ module KairosHookProjector
       joined.empty? ? nil : joined
     end
 
+    # Index of the marker for THIS turn, or nil while it has not landed.
+    #
+    # The transcript records the block itself: a user record carrying Claude
+    # Code's feedback text, whose parentUuid names the assistant record that was
+    # judged. That pair is the entire state the recheck needs — which record has
+    # already had a verdict, and where the rewrite begins — so no state file and
+    # no config key are involved.
+    #
+    # The newest marker in the transcript is not necessarily this turn's, and
+    # taking it was a defect of its own. A session blocked once already carries
+    # an older marker; on the next block, before the new marker lands, the older
+    # one made the read believe a marker had arrived, so it skipped the wait and
+    # measured the message it had just blocked — returning in 0.06s with nothing
+    # in the log to say so. 128 of 170 real blocks are not a session's first.
+    # Between the previous block and this one there is always the operator's own
+    # message, so the test is which of the two is newer. Records carrying no
+    # text — tool results, images — belong to the turn being written and are
+    # stepped over.
+    def turn_marker(rows)
+      i = rows.length - 1
+      while i >= 0
+        row = rows[i]
+        if row['type'] == 'user'
+          text = text_of(row)
+          return text.start_with?(BLOCK_MARKER) ? i : nil if text.is_a?(String)
+        end
+
+        i -= 1
+      end
+      nil
+    end
+
+    # Compared only when a judged uuid is present: comparing it while nil made a
+    # record carrying no uuid look like the judged record and skipped a real
+    # rewrite.
+    def judged?(row, judged)
+      judged && row['uuid'] == judged
+    end
+
+    # The newest assistant record after `index` other than the judged one,
+    # whether or not it carries text yet. nil while none has landed.
+    #
+    # This is the first read's rule applied after the marker, and it is what the
+    # recheck uses while it still has budget. A rewrite that is mid-write shows
+    # up here as text-less and is waited for, rather than stepped over in favour
+    # of whatever text lies beneath it. Stepping over had a measured cost: a
+    # rewrite that called a tool was judged on its own two-line preamble and
+    # logged RECHECK-PASS in 0.04s, while the rewrite itself — a four-heading
+    # FAIL landing 0.6s later — was never read.
+    def newest_after(rows, index, judged)
+      i = rows.length - 1
+      while i > index
+        row = rows[i]
+        return [text_of(row), row['uuid']] if row['type'] == 'assistant' && !judged?(row, judged)
+
+        i -= 1
+      end
+      nil
+    end
+
+    # The newest text-bearing assistant record after `index`, stepping over
+    # records that carry none. Used only once the budget is spent.
+    #
+    # Over 3,248 transcripts and 170 real blocks, a completed rewrite sitting
+    # beneath a newer text-less record occurred 0 times, so this shape must not
+    # pre-empt the wait — that is what cost the preamble above. It is kept as a
+    # last resort because if the shape ever does occur, the alternative is the
+    # same skipped verdict this reaches past.
+    def deep_after(rows, index, judged)
+      i = rows.length - 1
+      while i > index
+        row = rows[i]
+        if row['type'] == 'assistant' && !judged?(row, judged)
+          text = text_of(row)
+          return [text, row['uuid']] if text
+        end
+
+        i -= 1
+      end
+      nil
+    end
+
+    # The newest assistant record, whether or not it carries text yet, or nil
+    # when the transcript holds none. The first read's rule, unchanged since
+    # before 2026-08-20, and the rule the recheck falls back to when no marker
+    # is found.
+    def newest_assistant(rows)
+      row = rows.reverse_each.find { |r| r['type'] == 'assistant' }
+      row && [text_of(row), row['uuid']]
+    end
+
     # Text of the turn's final assistant message, with the flush race handled.
     #
     # One response is written as several records (thinking, text, tool_use) at
     # different times. At Stop time the `text` record may not have landed yet,
     # so the newest assistant record is often thinking-only. Wait for the text
     # rather than judging an earlier message from the same turn.
-    def last_assistant_text(transcript_path)
-      POLL_ATTEMPTS.times do |attempt|
+    #
+    # On a recheck that wait never engaged, and that was the defect: the blocked
+    # message is still the newest record carrying text, so it satisfied the
+    # "has text" test immediately and was judged a second time. Measured over
+    # one instance's first 768 log records, 140 of 140 rechecks took the newest
+    # record without ever waiting, and 109 of 140 reported metrics identical to
+    # the verdict that had just blocked. The rewrite had passed in most of them.
+    # The invariant this restores, as long as the marker is found: a record that
+    # a verdict already named is never judged again.
+    def last_assistant_text(transcript_path, rechecked = false)
+      attempts = rechecked ? RECHECK_POLL_ATTEMPTS : POLL_ATTEMPTS
+      attempts.times do |attempt|
         rows = tail_records(transcript_path)
-        return [nil, 'unreadable'] if rows.nil?
+        return [nil, 'unreadable', nil] if rows.nil?
+
+        waited = attempt.zero? ? 'ok' : 'ok-after-wait'
+
+        if rechecked
+          # The marker is waited for on the same terms as the rewrite: both are
+          # written by the same process at nearly the same moment, so "not there
+          # yet" is as ordinary for one as for the other. Inside the budget the
+          # selection rule is the first read's — newest record, wait for its
+          # text — so the two reads agree wherever they can.
+          marker = turn_marker(rows)
+          if marker
+            found = newest_after(rows, marker, rows[marker]['parentUuid'])
+            return [found[0], waited, found[1]] if found && found[0]
+          end
+        else
+          newest = newest_assistant(rows)
+          return [nil, 'no-assistant-record', nil] if newest.nil?
+          return [newest[0], waited, newest[1]] if newest[0]
+        end
+        sleep(POLL_DELAY)
+      end
 
-        found_assistant = false
-        rows.reverse_each do |row|
-          next unless row['type'] == 'assistant'
+      return [nil, 'race-timeout', nil] unless rechecked
 
-          found_assistant = true
-          text = text_of(row)
-          return [text, attempt.zero? ? 'ok' : 'ok-after-wait'] if text
+      # The recheck's budget is spent. Either this turn's marker never appeared
+      # — Claude Code's wording is not this gate's to guarantee — or it appeared
+      # and the rewrite did not. Both are named, and every no-marker outcome
+      # carries the suffix, because a drift detector whose only visible trace is
+      # the exit that happens to find text reports nothing in the cases drift
+      # actually produces.
+      rows = tail_records(transcript_path)
+      return [nil, 'unreadable', nil] if rows.nil?
 
-          break
-        end
-        return [nil, 'no-assistant-record'] unless found_assistant
+      marker = turn_marker(rows)
+      if marker
+        # Last resort, and named apart so the log can say how often the ordinary
+        # rule was not enough.
+        found = deep_after(rows, marker, rows[marker]['parentUuid'])
+        return [found[0], 'ok-after-wait-deep', found[1]] if found
 
-        sleep(POLL_DELAY)
+        return [nil, 'awaiting-rewrite', nil]
       end
-      [nil, 'race-timeout']
+
+      # No marker for this turn, so nothing is judged. Falling back to the first
+      # read's rule here looked conservative and was the opposite: the newest
+      # record it reaches is the message this turn has just blocked, so the
+      # fallback re-judged it — the very behaviour this method exists to end,
+      # reachable on any block after a session's first. A recheck never blocks,
+      # so refusing to judge costs the operator nothing except the line, and it
+      # keeps both the invariant and the measurement intact.
+      newest_assistant(rows) ? [nil, 'nomarker', nil] : [nil, 'no-assistant-record-nomarker', nil]
     end
 
     # --- measurement ---------------------------------------------------------
@@ -460,15 +632,20 @@ module KairosHookProjector
     # have — an empty-string or directory log_path left the gate blocking and
     # passing exactly as normal while nothing was ever recorded, so the
     # operator's onboarding week produced no data and no complaint.
-    def note(cfg, verdict, metrics = nil)
+    def note(cfg, verdict, metrics = nil, record_id = nil)
       # nil alone means "no log declared". false, 0 and "" are declarations the
       # gate cannot honour, and each has to reach the rescue below to be named.
       return if cfg.log_path.nil?
 
       stamp = Time.now.strftime('%Y-%m-%dT%H:%M:%S')
       detail = ''
+      # Which record the verdict is about. Without it the log cannot answer the
+      # one question the fix above turns on — whether two verdicts in a row were
+      # about the same message — and it is also how a first read that grabbed a
+      # stale record becomes diagnosable rather than merely suspected.
+      detail += "\trec=#{record_id[0, 8]}" if record_id.is_a?(String) && !record_id.empty?
       if metrics
-        detail = format(
+        detail += format(
           "\tlines=%d\theadings=%d\ttables=%d\tdiagrams=%d\tunglossed=%s",
           metrics['lines'], metrics['headings'], metrics['tables'], metrics['diagrams'],
           metrics['unglossed'].empty? ? '-' : metrics['unglossed'].join(',')
@@ -643,9 +820,31 @@ module KairosHookProjector
       # reported, so its outcome is visible; it is simply never blocked again.
       rechecked = payload['stop_hook_active'] ? true : false
 
-      text, why = last_assistant_text(payload.fetch('transcript_path', ''))
+      text, why, record_id = last_assistant_text(payload.fetch('transcript_path', ''), rechecked)
       if text.nil? || text.strip.empty?
-        note(cfg, "SKIP-#{why}")
+        lost = note(cfg, "SKIP-#{why}")
+        # Every recheck that produces no verdict says so on screen. Naming only
+        # the two expected reasons left the others silent, and the ones it left
+        # out are live: a transcript momentarily unreadable, and a rewrite whose
+        # text is whitespace after the fallback found it. Both spent the budget
+        # and told the operator nothing. A first read keeps its old silence —
+        # there the turn goes out regardless and the log is the right place.
+        budget = format('%.1f', RECHECK_POLL_ATTEMPTS * POLL_DELAY)
+        tail = lost ? "; #{log_note(lost)}" : ''
+        reason =
+          case why
+          when 'awaiting-rewrite'
+            "the rewrite had not been recorded within #{budget}s"
+          when 'nomarker', 'no-assistant-record-nomarker'
+            "no block marker appeared within #{budget}s, so the rewrite could not be told " \
+            "apart from the message that was blocked. Claude Code's feedback wording may " \
+            'have changed'
+          when 'unreadable'
+            'the transcript could not be read'
+          else
+            "nothing measurable was found (#{why})"
+          end
+        emit('systemMessage' => "#{cfg.banner_prefix} (recheck): NOT RUN — #{reason}#{tail}") if rechecked
         return 0
       end
 
@@ -663,7 +862,7 @@ module KairosHookProjector
       end
 
       verdict = failures.empty? ? 'PASS' : 'FAIL'
-      lost = note(cfg, "#{rechecked ? 'RECHECK-' : ''}#{verdict}-#{why}", metrics)
+      lost = note(cfg, "#{rechecked ? 'RECHECK-' : ''}#{verdict}-#{why}", metrics, record_id)
 
       out = { 'systemMessage' => banner(cfg, verdict, metrics, failures, rechecked, lost) }
       if !failures.empty? && !rechecked && cfg.blocking

data/templates/skillsets/kairos_hook_projector/test/mutation_check_readable_gate.rb

@@ -0,0 +1,169 @@
+#!/usr/bin/env ruby
+# Mutation check for readable_gate.
+#
+# A green suite proves nothing until something has tried to break the code and
+# the suite noticed. Each entry below rewrites one line of the hook and asserts
+# that at least one test goes red. A SURVIVED row means the behaviour it names
+# is not witnessed by any test, however many assertions surround it.
+#
+# Why this file lives in the SkillSet rather than beside a review record: the
+# first round of this check was written to a scratch directory and was gone by
+# the time anyone tried to reproduce it, so the evidence for "the falsification
+# is real" could not be re-derived. The generator is the artifact worth keeping;
+# its output is reproducible from it.
+#
+# Runs against a COPY of the whole SkillSet in a temp directory. The repository
+# copy may be a live Stop hook, and must never be left mutated even briefly.
+# The harness is this SkillSet's own suite, unmodified: `SCRIPT` in the test
+# files resolves from `__dir__`, so the copied tests drive the copied hook.
+#
+#   ruby test/mutation_check_readable_gate.rb
+#
+require 'fileutils'
+require 'tmpdir'
+require 'open3'
+require 'rbconfig'
+
+SKILLSET_ROOT = File.dirname(__dir__)
+
+MUTATIONS = [
+  # --- the recheck's target: what it measures the second time ----------------
+  ['M1  recheck ignores the marker and takes the newest record',
+   %q{          marker = turn_marker(rows)},
+   %q{          marker = nil}],
+  ['M2  the already-judged record is not excluded (inside the budget)',
+   %q{        return [text_of(row), row['uuid']] if row['type'] == 'assistant' && !judged?(row, judged)},
+   %q{        return [text_of(row), row['uuid']] if row['type'] == 'assistant'}],
+  ['M3  the recheck does not wait',
+   %q{      attempts = rechecked ? RECHECK_POLL_ATTEMPTS : POLL_ATTEMPTS},
+   %q{      attempts = rechecked ? 1 : POLL_ATTEMPTS}],
+  ['M4  the no-marker exit claims there is no assistant record at all',
+   %q{      newest_assistant(rows) ? [nil, 'nomarker', nil] : [nil, 'no-assistant-record-nomarker', nil]},
+   %q{      [nil, 'no-assistant-record-nomarker', nil]}],
+  ['M5  the -nomarker suffix is dropped',
+   %q{      newest_assistant(rows) ? [nil, 'nomarker', nil] : [nil, 'no-assistant-record-nomarker', nil]},
+   %q{      newest_assistant(rows) ? [nil, 'awaiting-rewrite', nil] : [nil, 'no-assistant-record', nil]}],
+  ['M6  the rec= column is dropped from the log',
+   %q{      detail += "\trec=#{record_id[0, 8]}" if record_id.is_a?(String) && !record_id.empty?},
+   %q{      detail += ''}],
+  ['M7  the recheck blocks as well as the first read',
+   %q{      if !failures.empty? && !rechecked && cfg.blocking},
+   %q{      if !failures.empty? && cfg.blocking}],
+
+  # --- which record is the marker, and how long it is waited for ------------
+  ['M8  an earlier turn\'s marker is accepted as this turn\'s',
+   %q{          return text.start_with?(BLOCK_MARKER) ? i : nil if text.is_a?(String)},
+   %q{          return i if text.is_a?(String) && text.start_with?(BLOCK_MARKER)}],
+  ['M9  the recheck budget is cut from 40 attempts to 15',
+   %q{    RECHECK_POLL_ATTEMPTS = 40},
+   %q{    RECHECK_POLL_ATTEMPTS = 15}],
+  ['M10 rec= logs the whole uuid instead of the first 8 characters',
+   %q{      detail += "\trec=#{record_id[0, 8]}" if record_id.is_a?(String) && !record_id.empty?},
+   %q{      detail += "\trec=#{record_id}" if record_id.is_a?(String) && !record_id.empty?}],
+  ['M11 any record type may be a marker, not only user',
+   "        if row['type'] == 'user'\n          text = text_of(row)",
+   "        if row['type']\n          text = text_of(row)"],
+  ['M12 a record that merely mentions the wording counts as a marker',
+   %q{          return text.start_with?(BLOCK_MARKER) ? i : nil if text.is_a?(String)},
+   %q{          return text.include?(BLOCK_MARKER) ? i : nil if text.is_a?(String)}],
+
+  # --- the shape settled on 2026-08-21 after two review rounds ---------------
+  ['M13 no marker means judge the newest record anyway',
+   %q{      newest_assistant(rows) ? [nil, 'nomarker', nil] : [nil, 'no-assistant-record-nomarker', nil]},
+   "      n = newest_assistant(rows)\n" \
+   "      return [nil, 'no-assistant-record-nomarker', nil] if n.nil?\n" \
+   "      n[0] ? [n[0], 'ok-after-wait-nomarker', n[1]] : [nil, 'nomarker', nil]"],
+  ['M14 the deep walk pre-empts the wait instead of outliving it',
+   %q{        return [text_of(row), row['uuid']] if row['type'] == 'assistant' && !judged?(row, judged)},
+   "        if row['type'] == 'assistant' && !judged?(row, judged)\n" \
+   "          t = text_of(row)\n" \
+   "          return [t, row['uuid']] if t\n" \
+   "        end"],
+  ['M15 the nil-judged guard reverted to a plain inequality',
+   %q{      judged && row['uuid'] == judged},
+   %q{      row['uuid'] == judged}],
+
+  # --- what round 2 found no mutation could reach ---------------------------
+  ['M16 the no-verdict banner is not emitted at all',
+   %q{        emit('systemMessage' => "#{cfg.banner_prefix} (recheck): NOT RUN — #{reason}#{tail}") if rechecked},
+   %q{        nil}],
+  ['M17 the banner quotes a fixed number instead of the budget it spent',
+   %q{        budget = format('%.1f', RECHECK_POLL_ATTEMPTS * POLL_DELAY)},
+   %q{        budget = '1.5'}],
+  ['M18 the deep walk never finds the rewrite it is the last resort for',
+   "    def deep_after(rows, index, judged)\n      i = rows.length - 1",
+   "    def deep_after(rows, index, judged)\n      return nil\n      i = rows.length - 1"],
+  ['M19 a mode may ask for more measurement time than the hook has left',
+   %q{          if requested.is_a?(Numeric) && requested > MEASURE_TIMEOUT_CEILING},
+   %q{          if false}]
+].freeze
+
+def run_suite(root)
+  files = Dir[File.join(root, 'test', 'test_*.rb')].sort
+  runs = 0
+  bad = 0
+  unparseable = []
+  files.each do |f|
+    out, err, st = Open3.capture3(RbConfig.ruby, f)
+    tail = "#{out}\n#{err}"
+    if (m = tail.match(/(\d+) runs, \d+ assertions, (\d+) failures, (\d+) errors/))
+      runs += m[1].to_i
+      bad += m[2].to_i + m[3].to_i
+    else
+      unparseable << File.basename(f)
+      bad += 1 unless st.success?
+    end
+  end
+  [runs, bad, unparseable, files.length]
+end
+
+exit_code = 0
+
+Dir.mktmpdir do |tmp|
+  root = File.join(tmp, File.basename(SKILLSET_ROOT))
+  FileUtils.cp_r(SKILLSET_ROOT, root)
+  hook = File.join(root, 'hooks', 'readable_gate.rb')
+  pristine = File.read(hook)
+
+  runs, bad, unparseable, nfiles = run_suite(root)
+  puts format('BASELINE (unmutated copy): %d test files, %d runs, %d failures+errors%s',
+              nfiles, runs, bad, unparseable.empty? ? '' : " [unparseable: #{unparseable.join(', ')}]")
+  puts
+  if bad.positive?
+    puts 'The suite is not green before mutation; every result below is meaningless.'
+    exit_code = 1
+  end
+
+  killed = 0
+  survived = 0
+  not_applied = 0
+  MUTATIONS.each do |label, from, to|
+    unless pristine.include?(from)
+      not_applied += 1
+      puts format('%-70s  ANCHOR NOT FOUND', label)
+      next
+    end
+    mutated = pristine.sub(from, to)
+    raise "mutation #{label} was a no-op" if mutated == pristine
+
+    File.write(hook, mutated)
+    r, b, u, = run_suite(root)
+    File.write(hook, pristine)
+    if b.positive?
+      killed += 1
+      verdict = 'KILLED'
+    else
+      survived += 1
+      verdict = 'SURVIVED'
+    end
+    puts format('%-70s  %-9s %3d failures/errors over %d runs%s',
+                label, verdict, b, r, u.empty? ? '' : " [unparseable: #{u.join(', ')}]")
+  end
+
+  puts
+  puts "source restored byte-identical: #{File.read(hook) == pristine}"
+  puts "killed #{killed}/#{MUTATIONS.length}, survived #{survived}, anchor-not-found #{not_applied}"
+  exit_code = 1 if survived.positive? || not_applied.positive?
+end
+
+exit exit_code

data/templates/skillsets/kairos_hook_projector/test/test_readable_gate.rb

@@ -277,11 +277,415 @@ class TestReadableGate < Minitest::Test
     assert_equal 'block', out['decision'], out.inspect
   end
 
+  # A failing rewrite is still measured and still reported; it is simply never
+  # blocked a second time. The marker has to be present for a verdict to be
+  # issued at all — see "a recheck with no marker for this turn issues no
+  # verdict" below for why the marker-less case stopped producing one.
   def test_a_rewrite_is_measured_and_reported_but_never_blocked_again
-    out = decide("# a\n## b\n### c\n#### d\n", rechecked: true, max_headings: 3)
+    out, log = drive(blocked_then(row_for('assistant', text: "# a\n## b\n### c\n#### d\n",
+                                          uuid: 'BBB')),
+                     max_headings: 3)
     refute out.key?('decision'), out.inspect
     assert_includes out.fetch('systemMessage', ''), 'FAIL'
     assert_includes out.fetch('systemMessage', ''), 'recheck'
+    assert_includes log, 'RECHECK-FAIL', log.inspect
+  end
+
+  # --- the recheck must judge the rewrite, not what it already judged --------
+  #
+  # Until 2026-08-20 it judged what it had already judged. The blocked message
+  # is still the newest record carrying text when the recheck runs, so the
+  # existing wait — which only engages when the newest record has no text —
+  # never engaged: over one instance's first 768 log records, 140 of 140
+  # rechecks took the newest record immediately, and 109 of 140 reported
+  # metrics identical to the verdict that had just blocked. Re-measuring 145
+  # real rewrites from the transcripts showed 101 of them passing while the log
+  # recorded RECHECK-FAIL. The two sweeps are two hours apart and are not one
+  # evidence base.
+
+  def row_for(type, text: nil, uuid: nil, parent: nil, thinking: false)
+    content =
+      if thinking then [{ 'type' => 'thinking', 'thinking' => 'x' }]
+      elsif type == 'user' then text
+      else [{ 'type' => 'text', 'text' => text }]
+      end
+    row = { 'type' => type, 'message' => { 'content' => content } }
+    row['uuid'] = uuid if uuid
+    row['parentUuid'] = parent if parent
+    row
+  end
+
+  def rows_json(rows)
+    rows.map { |r| JSON.generate(r) }.join("\n") + "\n"
+  end
+
+  # Drive the real script over a hand-built transcript and hand back both the
+  # emitted object and the log. The log is what carries `rec=`, and a verdict
+  # that names no record cannot be checked for naming the right one.
+  def drive(rows, rechecked: true, **overrides)
+    Dir.mktmpdir do |tmp|
+      cfg_path = File.join(tmp, 'cfg.json')
+      tx_path = File.join(tmp, 't.jsonl')
+      log_path = File.join(tmp, 'gate.log')
+      raw = { 'mode_name' => 'test', 'section' => '§ Test', 'log_path' => log_path }
+            .merge(overrides.transform_keys(&:to_s))
+      File.write(cfg_path, JSON.generate(raw), encoding: 'UTF-8')
+      File.write(tx_path, rows_json(rows), encoding: 'UTF-8')
+      out, err, status = run_script(
+        cfg_path,
+        JSON.generate('transcript_path' => tx_path, 'stop_hook_active' => rechecked)
+      )
+      assert_equal 0, status.exitstatus, "gate exited #{status.exitstatus}: #{err[0, 300]}"
+      log = File.exist?(log_path) ? File.read(log_path, encoding: 'UTF-8') : ''
+      [out.strip.empty? ? {} : JSON.parse(out), log]
+    end
+  end
+
+  BLOCKED = "# a\n# b\n# c\n# d\n"
+  REWRITE = "# a\n"
+
+  def blocked_then(*after)
+    [row_for('assistant', text: BLOCKED, uuid: 'AAA'),
+     row_for('user', text: "Stop hook feedback:\n- HEADINGS: 4 (cap 3).", parent: 'AAA',
+                     uuid: 'MMM')] + after
+  end
+
+  def test_the_recheck_judges_the_rewrite_not_the_message_it_already_judged
+    out, log = drive(blocked_then(row_for('assistant', text: REWRITE, uuid: 'BBB')),
+                     max_headings: 3)
+    assert_includes out.fetch('systemMessage', ''), 'PASS', out.inspect
+    assert_includes out.fetch('systemMessage', ''), '1 headings',
+                    'the rewrite has one heading; the blocked message had four'
+    assert_includes log, 'rec=BBB', "the verdict must name the rewrite: #{log.inspect}"
+    refute out.key?('decision')
+  end
+
+  def test_a_recheck_whose_rewrite_has_not_landed_records_no_verdict
+    out, log = drive(blocked_then, max_headings: 3)
+    assert_includes log, 'SKIP-awaiting-rewrite', log.inspect
+    refute_includes log, 'RECHECK-FAIL',
+                    'a verdict on the already-judged record is the defect itself'
+    assert_includes out.fetch('systemMessage', ''), 'NOT RUN'
+    refute out.key?('decision')
+  end
+
+  def test_the_already_judged_record_is_skipped_even_when_it_is_the_newest
+    # Ordering that only a truncated tail or a rewritten transcript produces,
+    # and the only fixture that can fail when the uuid guard is deleted: the
+    # index check alone would let the judged record through here.
+    rows = [row_for('assistant', text: REWRITE, uuid: 'BBB'),
+            row_for('user', text: "Stop hook feedback:\n- x", parent: 'AAA', uuid: 'MMM'),
+            row_for('assistant', text: BLOCKED, uuid: 'AAA')]
+    _out, log = drive(rows, max_headings: 3)
+    assert_includes log, 'SKIP-awaiting-rewrite', log.inspect
+  end
+
+  def test_the_newest_marker_is_the_one_that_counts
+    rows = [row_for('assistant', text: BLOCKED, uuid: 'AAA'),
+            row_for('user', text: "Stop hook feedback:\n- x", parent: 'AAA', uuid: 'M1'),
+            row_for('assistant', text: "#{BLOCKED}# e\n", uuid: 'BBB'),
+            row_for('user', text: "Stop hook feedback:\n- x", parent: 'BBB', uuid: 'M2'),
+            row_for('assistant', text: REWRITE, uuid: 'CCC')]
+    out, log = drive(rows, max_headings: 3)
+    assert_includes log, 'rec=CCC', log.inspect
+    assert_includes out.fetch('systemMessage', ''), 'PASS'
+  end
+
+  def test_a_recheck_with_no_marker_for_this_turn_issues_no_verdict
+    # Claude Code's wording is not this gate's to guarantee, and when it changes
+    # the drift has to be visible. It must not be papered over by degrading to
+    # the old rule: the newest record that rule reaches is the message this turn
+    # has just blocked, so degrading meant re-judging it — reachable on any
+    # block after a session's first, and logged as an ordinary verdict. A
+    # recheck never blocks, so declining to judge costs only the line.
+    out, log = drive([row_for('assistant', text: BLOCKED, uuid: 'AAA')], max_headings: 3)
+    assert_includes log, 'SKIP-nomarker', log.inspect
+    refute_includes log, 'no-assistant-record',
+                    'there is an assistant record; only the marker is missing, and the two ' \
+                    'are separate rows in the measurement'
+    refute_includes log, 'rec=AAA', 'AAA is the message that was just blocked'
+    assert_includes out.fetch('systemMessage', ''), 'NOT RUN'
+    refute out.key?('decision')
+  end
+
+  def test_the_first_read_is_unchanged_and_names_the_record_it_judged
+    out, log = drive([row_for('assistant', text: BLOCKED, uuid: 'AAA')],
+                     rechecked: false, max_headings: 3)
+    assert_equal 'block', out['decision'], out.inspect
+    assert_includes log, 'rec=AAA', log.inspect
+    refute_includes log, 'nomarker', 'a first read has no marker to miss'
+  end
+
+  # The recheck's own flush race, driven with a real late write. The rewrite
+  # record appears only after the first read has already come back empty.
+  def test_the_recheck_waits_for_the_rewrite_to_land
+    Dir.mktmpdir do |tmp|
+      tx = File.join(tmp, 't.jsonl')
+      File.write(tx, rows_json(blocked_then), encoding: 'UTF-8')
+      writer = Thread.new do
+        sleep(G::POLL_DELAY * 3)
+        File.write(tx, rows_json([row_for('assistant', text: 'landed late', uuid: 'BBB')]),
+                   mode: 'a', encoding: 'UTF-8')
+      end
+      begin
+        text, why, record_id = G.last_assistant_text(tx, true)
+      ensure
+        writer.join
+      end
+      assert_equal 'landed late', text
+      assert_equal 'ok-after-wait', why
+      assert_equal 'BBB', record_id
+    end
+  end
+
+  # --- what round 1 of the 2026-08-21 review found the tests above missed ----
+  #
+  # Every fixture below was written against a mutation that the original seven
+  # left green. A behaviour no mutation can kill is untested however many
+  # assertions surround it.
+
+  # The marker was read once, on attempt zero, while the rewrite got forty
+  # attempts. Both are written by the same process at nearly the same moment,
+  # so a marker a fraction of a second late sent the read to the fallback and
+  # re-judged the blocked message — the defect this whole method exists to end,
+  # restored in full, with nothing but a suffix in the log to show for it.
+  def test_the_recheck_waits_for_the_marker_as_well_as_the_rewrite
+    Dir.mktmpdir do |tmp|
+      tx = File.join(tmp, 't.jsonl')
+      File.write(tx, rows_json([row_for('assistant', text: BLOCKED, uuid: 'AAA')]),
+                 encoding: 'UTF-8')
+      writer = Thread.new do
+        sleep(G::POLL_DELAY * 3)
+        File.write(
+          tx,
+          rows_json([row_for('user', text: "Stop hook feedback:\n- x", parent: 'AAA', uuid: 'MMM'),
+                     row_for('assistant', text: REWRITE, uuid: 'BBB')]),
+          mode: 'a', encoding: 'UTF-8'
+        )
+      end
+      begin
+        text, why, record_id = G.last_assistant_text(tx, true)
+      ensure
+        writer.join
+      end
+      assert_equal REWRITE, text, 'a marker 0.3s late must not send the read to the fallback'
+      assert_equal 'ok-after-wait', why
+      assert_equal 'BBB', record_id
+    end
+  end
+
+  # Operator ruling, 2026-08-21: the recheck searches backward for text rather
+  # than stopping at the newest record, accepting that it now differs from the
+  # first read. Stopping at the newest record spent the whole budget and called
+  # the rewrite absent while it sat one row down.
+  def test_a_rewrite_behind_a_later_textless_record_is_still_measured
+    rows = blocked_then(row_for('assistant', text: REWRITE, uuid: 'BBB'),
+                        row_for('assistant', uuid: 'CCC', thinking: true))
+    out, log = drive(rows, max_headings: 3)
+    assert_includes log, 'rec=BBB', log.inspect
+    refute_includes log, 'awaiting-rewrite',
+                    'the rewrite was in the tail; a trailing thinking record must not hide it'
+    assert_includes out.fetch('systemMessage', ''), 'PASS', out.inspect
+  end
+
+  # Two blocks in a row, the second with no rewrite yet. The fixture above this
+  # one cannot tell the newest marker from the oldest, because both lead to the
+  # same record; here the older marker hands back the message the *second*
+  # block just named.
+  def test_the_oldest_marker_would_hand_back_the_message_the_newest_one_named
+    rows = [row_for('assistant', text: BLOCKED, uuid: 'AAA'),
+            row_for('user', text: "Stop hook feedback:\n- x", parent: 'AAA', uuid: 'M1'),
+            row_for('assistant', text: REWRITE, uuid: 'BBB'),
+            row_for('user', text: "Stop hook feedback:\n- x", parent: 'BBB', uuid: 'M2')]
+    _out, log = drive(rows, max_headings: 3)
+    assert_includes log, 'SKIP-awaiting-rewrite', log.inspect
+    refute_includes log, 'rec=BBB', 'BBB is what the newest marker names, not a rewrite'
+  end
+
+  # This project discusses its own gate, so an assistant message opening with
+  # Claude Code's feedback wording is not hypothetical.
+  def test_only_a_user_record_can_be_a_marker
+    rows = blocked_then(row_for('assistant', text: "Stop hook feedback: 見出しなし\n", uuid: 'BBB'))
+    _out, log = drive(rows, max_headings: 3)
+    assert_includes log, 'rec=BBB', log.inspect
+    refute_includes log, 'awaiting-rewrite', log.inspect
+  end
+
+  def test_a_record_that_merely_mentions_the_wording_is_not_a_marker
+    # The operator asking about the gate is an ordinary turn in this project.
+    # If that question counted as a marker, the read would treat the answer it
+    # just blocked as lying after a marker, and measure it.
+    rows = [row_for('user', text: 'なぜ Stop hook feedback: が出るの？', uuid: 'Q'),
+            row_for('assistant', text: BLOCKED, uuid: 'AAA')]
+    _out, log = drive(rows, max_headings: 3)
+    assert_includes log, 'nomarker', log.inspect
+    refute_includes log, 'rec=AAA', 'AAA is the message that was just blocked'
+  end
+
+  # The fallback's only visible trace used to be the exit that finds text, so a
+  # change in Claude Code's wording reported nothing in the two cases it
+  # actually produces — and one of them borrowed the name of the counter that
+  # decides whether a rewrite cap is worth building.
+  def test_a_recheck_with_no_marker_says_so_on_every_exit
+    _out, textless = drive([row_for('assistant', uuid: 'AAA', thinking: true)], max_headings: 3)
+    assert_includes textless, 'nomarker', textless.inspect
+    refute_includes textless, 'awaiting-rewrite',
+                    'no marker was found, so the rewrite was never the question'
+
+    _out2, none = drive([row_for('user', text: 'hello')], max_headings: 3)
+    assert_includes none, 'SKIP-no-assistant-record-nomarker', none.inspect
+    refute_includes none, 'awaiting-rewrite', none.inspect
+  end
+
+  # Comparing the judged uuid while it is nil made a record carrying no uuid
+  # look like the judged record, and skipped a rewrite that was right there.
+  def test_a_rewrite_with_no_uuid_is_measured_rather_than_taken_for_the_judged_one
+    rows = [row_for('assistant', text: BLOCKED, uuid: 'AAA'),
+            row_for('user', text: "Stop hook feedback:\n- x", uuid: 'MMM'),
+            row_for('assistant', text: REWRITE)]
+    out, log = drive(rows, max_headings: 3)
+    assert_includes out.fetch('systemMessage', ''), 'PASS', out.inspect
+    refute_includes log, 'awaiting-rewrite', log.inspect
+  end
+
+  # The budget's length is a claim in its own right, and nothing witnessed it:
+  # cutting forty attempts back to the first read's fifteen left the whole suite
+  # green. A rewrite that lands after 1.5s and before 4s is the only thing that
+  # can tell the two budgets apart.
+  def test_the_recheck_budget_outlasts_the_first_read_s
+    Dir.mktmpdir do |tmp|
+      tx = File.join(tmp, 't.jsonl')
+      File.write(tx, rows_json(blocked_then), encoding: 'UTF-8')
+      writer = Thread.new do
+        sleep((G::POLL_ATTEMPTS * G::POLL_DELAY) + 0.4)
+        File.write(tx, rows_json([row_for('assistant', text: REWRITE, uuid: 'BBB')]),
+                   mode: 'a', encoding: 'UTF-8')
+      end
+      begin
+        text, why, record_id = G.last_assistant_text(tx, true)
+      ensure
+        writer.join
+      end
+      assert_equal REWRITE, text,
+                   "a rewrite landing after the first read's budget must still be caught"
+      assert_equal 'ok-after-wait', why
+      assert_equal 'BBB', record_id
+    end
+  end
+
+  # Every other fixture uses a three-character uuid, so nothing witnessed the
+  # truncation against the thirty-six-character uuids production writes.
+  def test_the_rec_column_carries_only_the_first_eight_characters
+    long = 'abcdefgh-1234-5678-9abc-def012345678'
+    rows = blocked_then(row_for('assistant', text: REWRITE, uuid: long))
+    _out, log = drive(rows, max_headings: 3)
+    assert_includes log, "rec=abcdefgh\t", log.inspect
+    refute_includes log, "rec=#{long}", 'the whole uuid would push the metrics off the line'
+  end
+
+  # --- what round 2 of the review found the fixtures above still missed ------
+
+  def second_block(*after)
+    # A session already blocked once: the first rewrite passed and was
+    # delivered, the operator asked something else, and that answer was blocked
+    # too. Everything up to and including CCC is on disk before CCC's own marker
+    # is written.
+    [row_for('assistant', text: BLOCKED, uuid: 'AAA'),
+     row_for('user', text: "Stop hook feedback:\n- x", parent: 'AAA', uuid: 'M1'),
+     row_for('assistant', text: REWRITE, uuid: 'BBB'),
+     row_for('user', text: '次の質問です', uuid: 'Q'),
+     row_for('assistant', text: BLOCKED, uuid: 'CCC')] + after
+  end
+
+  # The marker that counts is this turn's, not the newest in the file. Taking the
+  # newest one let the older marker stand in for a marker that had not landed,
+  # so the read skipped its wait and measured the message it had just blocked —
+  # in 0.06s, logged as an ordinary RECHECK verdict. 127 of 170 real blocks are
+  # not a session's first.
+  def test_a_marker_from_an_earlier_block_is_not_this_turn_s
+    _out, log = drive(second_block, max_headings: 3)
+    assert_includes log, 'nomarker', log.inspect
+    refute_includes log, 'rec=CCC', 'CCC is the message this turn just blocked'
+    refute_includes log, 'rec=BBB', "BBB is the previous turn's delivered rewrite"
+  end
+
+  def test_the_second_block_s_own_marker_is_used_once_it_lands
+    rows = second_block(row_for('user', text: "Stop hook feedback:\n- x", parent: 'CCC', uuid: 'M2'),
+                        row_for('assistant', text: REWRITE, uuid: 'DDD'))
+    out, log = drive(rows, max_headings: 3)
+    assert_includes log, 'rec=DDD', log.inspect
+    assert_includes out.fetch('systemMessage', ''), 'PASS'
+  end
+
+  # A rewrite that calls a tool writes a short preamble, then tool records, then
+  # its real answer. Stepping over the text-less records to find text measured
+  # the two-line preamble and logged RECHECK-PASS in 0.04s, while the real
+  # rewrite — landing 0.6s later, four headings, a FAIL — was never read. Inside
+  # the budget the newest record is now waited for instead.
+  def test_a_preamble_is_not_mistaken_for_the_rewrite_while_the_budget_remains
+    Dir.mktmpdir do |tmp|
+      tx = File.join(tmp, 't.jsonl')
+      File.write(tx, rows_json(blocked_then(row_for('assistant', text: "少し調べます\n", uuid: 'P1'),
+                                            row_for('assistant', uuid: 'T1', thinking: true))),
+                 encoding: 'UTF-8')
+      writer = Thread.new do
+        sleep(G::POLL_DELAY * 3)
+        File.write(tx, rows_json([row_for('assistant', text: BLOCKED, uuid: 'REAL')]),
+                   mode: 'a', encoding: 'UTF-8')
+      end
+      begin
+        text, why, record_id = G.last_assistant_text(tx, true)
+      ensure
+        writer.join
+      end
+      assert_equal BLOCKED, text, 'the real rewrite, not the preamble that preceded it'
+      assert_equal 'REAL', record_id
+      assert_equal 'ok-after-wait', why
+    end
+  end
+
+  # Kept as a last resort, and named apart so the log can count how often the
+  # ordinary rule was not enough. Over 3,248 transcripts this shape occurred 0
+  # times, so it must never pre-empt the wait — only outlive it.
+  def test_text_under_a_newer_textless_record_is_reached_only_after_the_budget
+    rows = blocked_then(row_for('assistant', text: REWRITE, uuid: 'BBB'),
+                        row_for('assistant', uuid: 'T1', thinking: true))
+    out, log = drive(rows, max_headings: 3)
+    assert_includes log, 'ok-after-wait-deep', log.inspect
+    assert_includes log, 'rec=BBB', log.inspect
+    assert_includes out.fetch('systemMessage', ''), 'PASS'
+  end
+
+  # Naming only the two expected reasons left the other exits silent, and both
+  # of the silent ones are live: a transcript momentarily unreadable, and a
+  # fallback that found whitespace. Each spent the whole budget and told the
+  # operator nothing.
+  def test_every_recheck_that_produces_no_verdict_says_so_on_screen
+    _out, = drive([row_for('assistant', uuid: 'AAA', thinking: true)], max_headings: 3)
+
+    whitespace, = drive([row_for('assistant', text: "   \n", uuid: 'AAA')], max_headings: 3)
+    assert_includes whitespace.fetch('systemMessage', ''), 'NOT RUN', whitespace.inspect
+
+    Dir.mktmpdir do |tmp|
+      cfg_path = File.join(tmp, 'cfg.json')
+      File.write(cfg_path, JSON.generate('mode_name' => 't', 'log_path' => File.join(tmp, 'g.log')),
+                 encoding: 'UTF-8')
+      out, _err, status = run_script(
+        cfg_path,
+        JSON.generate('transcript_path' => tmp, 'stop_hook_active' => true) # a directory
+      )
+      assert_equal 0, status.exitstatus
+      assert_includes JSON.parse(out).fetch('systemMessage', ''), 'NOT RUN',
+                      'an unreadable transcript on a recheck must not be silent'
+    end
+  end
+
+  # The banner quotes a number. Hard-coding it left the suite green while the
+  # figure the operator reads drifted away from the budget actually spent.
+  def test_the_banner_quotes_the_budget_it_actually_spent
+    out, = drive(blocked_then, max_headings: 3)
+    expected = format('%.1f', G::RECHECK_POLL_ATTEMPTS * G::POLL_DELAY)
+    assert_includes out.fetch('systemMessage', ''), "#{expected}s", out.inspect
   end
 
   def test_a_passing_message_never_blocks_either_way
@@ -432,14 +836,33 @@ class TestReadableGate < Minitest::Test
     original = G.method(:measure)
     G.define_singleton_method(:measure) { |*| seen = Regexp.timeout; [{}, []] }
     begin
-      G.measure_bounded("x\n", cfg('measure_timeout_seconds' => 7))
+      G.measure_bounded("x\n", cfg('measure_timeout_seconds' => 3))
     ensure
       G.define_singleton_method(:measure, original)
     end
-    assert_equal 7, seen, 'the per-match bound is installed while measuring'
+    assert_equal 3, seen, 'the per-match bound is installed while measuring'
     assert_nil Regexp.timeout, 'and restored afterwards'
   end
 
+  # The two budgets this file spends run one after the other inside one hook
+  # invocation, and neither knew about the other. A mode asking for 6 seconds of
+  # measurement put the pair at 10.4 against a 10-second limit; Claude Code kills
+  # the hook there and it emits nothing at all, so the gate stops enforcing and
+  # the log stops recording, both without a trace.
+  def test_a_mode_cannot_ask_for_more_measurement_time_than_the_hook_has_left
+    assert_operator (G::RECHECK_POLL_ATTEMPTS * G::POLL_DELAY) + G::MEASURE_TIMEOUT_CEILING,
+                    :<=, G::HOOK_TIMEOUT - G::HOOK_TIMEOUT_MARGIN,
+                    'the recheck budget and the measurement ceiling must fit the hook timeout'
+
+    over = cfg('measure_timeout_seconds' => 60)
+    assert_equal G::MEASURE_TIMEOUT_CEILING, over.measure_timeout,
+                 'an over-large request is clamped to what is left'
+    assert_empty over.problems, 'and clamping is not an error the operator must act on'
+
+    under = cfg('measure_timeout_seconds' => 2)
+    assert_equal 2, under.measure_timeout, 'a request that fits is passed through unchanged'
+  end
+
   def test_a_transcript_that_cannot_be_read_is_recorded_as_a_skip
     Dir.mktmpdir do |tmp|
       log = File.join(tmp, 'gate.log')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.75.0
+  version: 3.76.0
 platform: ruby
 authors:
 - Masaomi Hatakeyama
@@ -602,6 +602,7 @@ files:
 - templates/skillsets/kairos_hook_projector/mode_hooks/_schema.json
 - templates/skillsets/kairos_hook_projector/plugin/SKILL.md
 - templates/skillsets/kairos_hook_projector/skillset.json
+- templates/skillsets/kairos_hook_projector/test/mutation_check_readable_gate.rb
 - templates/skillsets/kairos_hook_projector/test/test_boot_time_assertion.rb
 - templates/skillsets/kairos_hook_projector/test/test_hooks_status.rb
 - templates/skillsets/kairos_hook_projector/test/test_mode_hooks_add.rb