0xray 4.0.15 → 4.0.17

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.15",
+  "version": "4.0.17",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.opencode/init.sh

@@ -35,8 +35,15 @@ XRAY_VERSION=$(node -e "console.log(require('$FRAMEWORK_ROOT/package.json').vers
 # Dedup guard — prevent duplicate runs during startup
 # Uses a TTL lockfile (10s window) since OpenCode may trigger config hook
 # from multiple plugin copies in quick succession
-# Key by PROJECT_ROOT (md5) so all invocations in the same project share one lock
-LOCK_KEY=$(echo -n "$PROJECT_ROOT" | md5 | cut -c1-16)
+# Key by PROJECT_ROOT so all invocations in the same project share one lock.
+# md5 is macOS; Linux has md5sum. Do not fail the boot on a leftover Mac tool.
+if command -v md5 >/dev/null 2>&1; then
+    LOCK_KEY=$(echo -n "$PROJECT_ROOT" | md5 | cut -c1-16)
+elif command -v md5sum >/dev/null 2>&1; then
+    LOCK_KEY=$(echo -n "$PROJECT_ROOT" | md5sum | awk '{print $1}' | cut -c1-16)
+else
+    LOCK_KEY=$(echo -n "$PROJECT_ROOT" | cksum | awk '{print $1}')
+fi
 LOCK_FILE="/tmp/xray-init-${LOCK_KEY}.lock"
 LOCK_TTL=10
 if [ -f "$LOCK_FILE" ]; then
@@ -123,8 +130,11 @@ else
     PLUGIN_STATUS="❌"
 fi
 
-# Framework config check
-if [ ! -f "$PROJECT_ROOT/.opencode/enforcer-config.json" ]; then
+# Framework config check — consumer wear is .xray/codex.json, not leftover enforcer-config.json
+if [ ! -f "$PROJECT_ROOT/.opencode/enforcer-config.json" ] \
+    && [ ! -f "$PROJECT_ROOT/.xray/codex.json" ] \
+    && [ ! -f "$PROJECT_ROOT/node_modules/0xray/.xray/codex.json" ] \
+    && [ ! -f "$PROJECT_ROOT/.mcp.json" ]; then
     echo -e "${PURPLE}//   ❌ Framework configuration not found                     //${NC}"
     exit 1
 fi

package/.opencode/skills/orchestrator/SKILL.md

@@ -67,12 +67,13 @@ The seven rules are the engine. The cadence is the time signature. Disk SSOT: `g
 - **Peer test:** another instance with only worn 0xRay continues the ticket. No command stream.
 - **Wear first:** Read `.xray/state/STATION.md`. Same cloud. Same critic (resume only). Dummy Reads Station.
 - **Dummy tests `SKILLS.md`:** a suited dummy proves the worn catalog. Same-sess bodies keep context and hold a Station card.
-- **Ship track:** always branch + worktree/aside + PR. Docs as you go. Builds. Rollback = close the PR.
-- **Publish:** spawn the OTP browser, watch success, poll `npm view` until the new version is live. Do not move on early. Railway same law.
-- **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes.
+- **Ship track:** always branch + worktree/aside + PR. Docs as you go. Builds. Rollback = close the PR. **Subject review. Fix n ship.** After critic PASS, review dest/domain, close leftovers, then mill-gate D. PASS is not ship. **Groover is not Repertoire.**
+- **Publish:** stay logged in (do not `npm logout`). Every time run `npm publish --access public` in the live TTY. Paste the clickable `auth/cli` URL. No Enter, no VM browser, no subagent, no 6-digit code in chat. Poll `npm view` until live. Then prove **fresh** and **upgrade** registry installs. `npx 0xray validate` is the wear check (not leftover init.sh). `npm view` is not an install.
+- **Peer boot:** four-line dispatch. They Read Station + this cadence and install without a command novel. Not a twin critic.
+- **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes. **Clean ticks every cycle** — unsubscribe then resubscribe so the prompt matches metal. Name-dedupe does not rewrite. A stale prompt (waiting URL after live, Hold after strip) is dirty: rewrite, do not act. **If the card and WAVEBOARD are idle, unsubscribe and do not resubscribe.**
 - **Board clock:** PR events + resume the same critic. Not two idle pacers. Merge after PASS+CI (gate A). Publish only after mill-gate D + `foundry gate`.
 - **Dispatch:** ticket + PR URLs + “Wear, then review.” The critic Reads `SEATS.md` Reviewer. Do not paste a command novel. When a law is spoken twice, encode it this wake.
-- **Close:** loop until Station is done. Compact: Station survives the cut. Repertoire keeps names.
+- **Close:** loop until Station is done. Compact: Station survives the cut. Overlay dest names are OP-PROC — reload `repertoire-working.json` `opProcNames`, not Station.
 - **Board:** critic Strict comments; forge implements; lead stays main thread.
 - **Codex 69:** rewire this skill and existing ops. Do not add a new `SKILL.md` to hold the cadence.
 - **Ship matrix:** `LEAD-CADENCE.md` Decision matrix — A PR+CI · B pack · C `release:docs-check` · D `foundry release --i-mean-it`. Green CI is not ship. Spend / credentials stay Ask-first.

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.15",
+  "version": "4.0.17",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/dist/CHANGELOG.md

@@ -17,14 +17,70 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - **Dispatch encode** — lead cards ticket + PR URLs + “Wear, then review.” Critic OP-PROC lives on `SEATS.md` Reviewer. When a law is spoken twice, write it to disk this wake. No new skill.
 - **Ship decision matrix** — lead-owned. A PR+CI · B pack (`assert-packed-dist-cli` + consumer smoke) · C `npm run release:docs-check` · D `npx @0xray/foundry release --i-mean-it`. Green CI is not ship. Spend / credentials stay Ask-first. Host Auto Review may still card npm/Railway; that is not the OS decision.
 - **Metamorphosis** — an LLM becomes OP-PROC through in-context worn seats (same critic, same dummy, four-line dispatch). Spawning more bots is the old skin.
+- **Publish OTP latch** — stay logged in (do not `npm logout`). Every time run `npm publish --access public` in the live TTY (no `--auth-type=web`, no `--otp=` from chat, no `tee`). Paste the clickable `auth/cli` URL. Do not ask for a 6-digit authenticator code in chat. Do not press Enter. Do not hand publish to a browser subagent. Poll `npm view` until the version is live. Then prove **fresh** and **upgrade** registry installs. `npm view` is not an install.
+- **`npx 0xray validate` cleansed** — no longer shells leftover `.opencode/init.sh` (macOS `md5` + `enforcer-config.json`). Wear check: `REQUIRED_PACK_PATHS`, Cursor hooks, mill+inspect, repertoire. `init.sh` still boots OpenCode but accepts Linux `md5sum` and consumer `.xray/codex.json`.
+- **Swamp reflection (new arch)** — `docs/reflections/swamp-new-arch-reflection-2026-09-20.md`. Card, organ, hook. Lying metal. Live tarball lag.
+- **Clean ticks every cycle** — `/loop` prompt is rewritten at the end of every live tick. `subscribe_timer` name-dedupe does not update the prompt. Unsubscribe then resubscribe. A tick that contradicts metal is dirty: rewrite, do not act. Not on Station.
+- **Idle `/loop` stop** — if Station `Working` and the WAVEBOARD (open ship PR, live OTP, unfinished close) are idle, unsubscribe and do not resubscribe. A parked mill is not an active wave.
+- **Subject review. Fix n ship.** After board PASS, review the worn dest / domain (not only CI), close leftovers, then mill-gate D. PASS is not ship. On `LEAD-CADENCE.md` Ship track + `SEATS.md` Reviewer. Not on Station.
+- **OP-PROC reload after compact** — overlay dest names *are* OP-PROC. Heat writes them to `.xray/state/repertoire-working.json` `opProcNames`. Station stays a ticket (count + four working matches). Not a new skill.
+- **Groover is not Repertoire.** Groover was a broken experiment of the organ. Do not grow dest from Groover field as if that is the KB. On `LEAD-CADENCE.md` Heads from tails. Not on Station.
 
 ### 🔄 Changes
+- **Durable Hold npm** — heat + `cursorBootNeedsRefresh` + `npx 0xray validate` drop/fail `Hold npm` on Station. Identity stays. Mill-gate holds the ship latch. Not a new skill.
 - **Hangar catalog** — mill hangar docs use Clearing `GET /v1/catalog` as the directory (listed hangars: Groover DID + pin, plus solar + live shop), not a hardcoded extract/witness/pin route table. Groover MCP `list_hangars` reads that catalog. 0xray stays 4.0.15.
 - **foundry-plant/0** — fasten is a protocol any mill implements, not a 0xray-owned catalog of plant kinds. Builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (alias `"blip"`) fastens whatever that mill package declares. Organs (looker, vibe, mixer) live in the mill; adding one is a mill publish, not an xray catalog PR. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. 0xray stays 4.0.15.
 - **Blip/sound mills moved to `@0xray/blip`** — 4.44s drawers (render, kapow, vibe, wow-pass listen/cel, sound bed/mixer, looker) live in the blip product mill. `@0xray/foundry@0.1.11` shims `foundry blip|sound` including `blip look`. Railway plant consumes the product mill, not a hand-vendored copy. 0xray stays 4.0.15.
 
 ---
 
+## [4.0.17] - 2026-09-22
+
+### 🔄 Changes
+
+### ✨ Features
+- feat: write session-*.json from Cursor heat when HEAD moves (363186a02)
+- feat: persist overlay OP-PROC on repertoire-working after compact heat (8c55793e8)
+
+### 📚 Documentation
+- docs: ASCII gather/store/retrieve trees for Station memory (d8f2f3b89)
+- docs: Station is always the pickup memory after compact (bec431c61)
+- docs: Groover is not Repertoire — do not grow dest from Groover field (203147d19)
+- docs: Subject review. Fix n ship. — dest review then leftover then D (ad4ffa7f6)
+- docs: stop /loop when the card and WAVEBOARD are idle (60f0fd53f)
+- docs: clean ticks every cycle — rewrite /loop prompt, do not act on stale metal (e71a19559)
+
+### 🧪 Tests
+- test: match Compact cut wording on Station-as-memory (7f9a4f091)
+
+### 🔎 Other Changes
+- Merge main — include weekday-mirror #97 in 4.0.17 tarball (86fdec7ce)
+- Merge pull request #97 from 0xRayAI/cursor/weekday-mirror-dist-voice-9b4d (d0853aad1)
+- docs(grok-bot): weekday mirror for Dist reply voice and CoS wake hygiene (f91233b59)
+- Merge branch 'cursor/clean-ticks-fbe0' — clean ticks every cycle (12dd06362)
+- Merge branch 'cursor/leftover-validate-d-fbe0' — release 4.0.16 live, leftover validate gone (8fa037212)
+
+---
+
+## [4.0.16] - 2026-09-20
+
+### 🔄 Changes
+
+### 🐛 Bug Fixes
+- fix: type validate pack paths — no untyped mjs import in src/cli (ff936b276)
+- fix: cleanse npx 0xray validate — wear check, not leftover init.sh (741cca410)
+
+### 📚 Documentation
+- docs: new-arch reflection after wading part of the swamp (12d1fff69)
+- docs: persist peer-boot seat bc-49e17122 after four-line wear (5c8be98bb)
+- docs: encode registry install as live-verify after npm view (bd32bd1c4)
+- docs: encode npm CLI OTP latch — lead publishes, no subagent (d600d12a2)
+
+### 🔎 Other Changes
+- Merge branch 'cursor/npm-cli-otp-fbe0' — OTP latch, two-path live-verify, cleanse leftover validate (568797952)
+
+---
+
 ## [4.0.15] - 2026-09-17
 
 ### ✨ Features

package/dist/cli/commands/validate.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Consumer wear check — not leftover OpenCode init.sh.
+ *
+ * `npx 0xray validate` used to shell `.opencode/init.sh` (macOS `md5`,
+ * `.opencode/enforcer-config.json`). That is factory boot theater, not wear.
+ */
+/** Same paths as `REQUIRED_PACK_PATHS` in assert-packed-dist-cli.mjs — typed here so src/cli does not import untyped .mjs. */
+export declare const VALIDATE_PACK_PATHS: readonly string[];
+export declare const CONSUMER_WEAR_PATHS: readonly ["AGENTS.md", ".mcp.json", ".xray/codex.json", ".xray/features.json", ".cursor/hooks.json"];
+export declare const MILL_PLANT_SKILLS: readonly ["mill", "inspect"];
+export type ValidateCheck = {
+    id: string;
+    ok: boolean;
+    detail: string;
+};
+export type ValidateReport = {
+    ok: boolean;
+    consumer: boolean;
+    packageRoot: string;
+    checks: ValidateCheck[];
+};
+export declare function resolveInstalledPackageRoot(cwd: string): string | null;
+export declare function isConsumerInstall(cwd: string, packageRoot: string): boolean;
+export declare function collectValidateReport(cwd: string): ValidateReport;
+export declare function validateCommand(cwd?: string): Promise<ValidateReport>;
+export default validateCommand;

package/dist/cli/commands/validate.js

@@ -0,0 +1,164 @@
+/**
+ * Consumer wear check — not leftover OpenCode init.sh.
+ *
+ * `npx 0xray validate` used to shell `.opencode/init.sh` (macOS `md5`,
+ * `.opencode/enforcer-config.json`). That is factory boot theater, not wear.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { frameworkLogger } from "../../core/framework-logger.js";
+/** Same paths as `REQUIRED_PACK_PATHS` in assert-packed-dist-cli.mjs — typed here so src/cli does not import untyped .mjs. */
+export const VALIDATE_PACK_PATHS = [
+    "dist/cli/index.js",
+    "dist/mcps/orchestrator.server.js",
+    "dist/integrations/grok/hooks/session-start.js",
+    "dist/integrations/cursor/hooks/hooks.json",
+    "dist/integrations/cursor/hooks/pre-tool-use.js",
+    "dist/integrations/cursor/hooks/pre-compact.js",
+    "dist/integrations/cursor/hooks/after-file-edit.js",
+    "dist/integrations/cursor/hooks/cursor-hook-utils.js",
+    "dist/integrations/cursor/hooks/cursor-usage-receipt.js",
+];
+export const CONSUMER_WEAR_PATHS = [
+    "AGENTS.md",
+    ".mcp.json",
+    ".xray/codex.json",
+    ".xray/features.json",
+    ".cursor/hooks.json",
+];
+export const MILL_PLANT_SKILLS = ["mill", "inspect"];
+export function resolveInstalledPackageRoot(cwd) {
+    const nested = join(cwd, "node_modules", "0xray");
+    if (existsSync(join(nested, "package.json"))) {
+        return nested;
+    }
+    const pkgPath = join(cwd, "package.json");
+    if (!existsSync(pkgPath)) {
+        return null;
+    }
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        if (pkg.name === "0xray") {
+            return cwd;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+export function isConsumerInstall(cwd, packageRoot) {
+    return packageRoot !== cwd;
+}
+function checkPath(root, rel) {
+    return existsSync(join(root, rel));
+}
+function stationDurableHoldsNpm(cwd) {
+    const dest = join(cwd, ".xray", "state", "STATION.md");
+    if (!existsSync(dest))
+        return false;
+    try {
+        return /\bhold\s+npm\b/i.test(readFileSync(dest, "utf8"));
+    }
+    catch {
+        return false;
+    }
+}
+export function collectValidateReport(cwd) {
+    const packageRoot = resolveInstalledPackageRoot(cwd);
+    const checks = [];
+    if (!packageRoot) {
+        return {
+            ok: false,
+            consumer: false,
+            packageRoot: cwd,
+            checks: [
+                {
+                    id: "package",
+                    ok: false,
+                    detail: "0xray package not found in cwd or node_modules/0xray",
+                },
+            ],
+        };
+    }
+    const consumer = isConsumerInstall(cwd, packageRoot);
+    checks.push({
+        id: "package",
+        ok: true,
+        detail: consumer ? `consumer node_modules/0xray at ${packageRoot}` : `exo dogfood at ${packageRoot}`,
+    });
+    const missingPack = VALIDATE_PACK_PATHS.filter((p) => !checkPath(packageRoot, p));
+    checks.push({
+        id: "pack-paths",
+        ok: missingPack.length === 0,
+        detail: missingPack.length === 0
+            ? `REQUIRED_PACK_PATHS ${VALIDATE_PACK_PATHS.length}/${VALIDATE_PACK_PATHS.length}`
+            : `missing ${missingPack.join(", ")}`,
+    });
+    if (consumer) {
+        const missingWear = CONSUMER_WEAR_PATHS.filter((p) => !checkPath(cwd, p));
+        checks.push({
+            id: "consumer-wear",
+            ok: missingWear.length === 0,
+            detail: missingWear.length === 0
+                ? "AGENTS.md · .mcp.json · .xray · .cursor/hooks.json"
+                : `missing ${missingWear.join(", ")}`,
+        });
+        const millRoot = join(cwd, ".opencode", "skills");
+        const missingMill = MILL_PLANT_SKILLS.filter((name) => !existsSync(join(millRoot, name, "SKILL.md")));
+        checks.push({
+            id: "mill-plant",
+            ok: missingMill.length === 0,
+            detail: missingMill.length === 0
+                ? "mill + inspect fastened"
+                : `missing plant ${missingMill.join(", ")}`,
+        });
+        const repertoire = existsSync(join(cwd, "node_modules", "@0xray", "repertoire", "package.json")) ||
+            existsSync(join(packageRoot, "vendor", "@0xray", "repertoire", "package.json"));
+        checks.push({
+            id: "repertoire",
+            ok: repertoire,
+            detail: repertoire ? "repertoire organ on disk" : "missing @0xray/repertoire",
+        });
+    }
+    const stationPath = join(cwd, ".xray", "state", "STATION.md");
+    if (existsSync(stationPath)) {
+        const staleHold = stationDurableHoldsNpm(cwd);
+        checks.push({
+            id: "durable-hold",
+            ok: !staleHold,
+            detail: staleHold
+                ? "STATION Durable still says Hold npm — heat should have stripped it"
+                : "Durable has no Hold npm",
+        });
+    }
+    return {
+        ok: checks.every((c) => c.ok),
+        consumer,
+        packageRoot,
+        checks,
+    };
+}
+export async function validateCommand(cwd = process.cwd()) {
+    frameworkLogger.log("cli", "validate-start", "info", { cwd });
+    const report = collectValidateReport(cwd);
+    for (const check of report.checks) {
+        const mark = check.ok ? "✅" : "❌";
+        console.log(`${mark} ${check.id}: ${check.detail}`);
+    }
+    if (report.ok) {
+        console.log("");
+        console.log("🎉 Wear checks passed. This is not leftover init.sh.");
+        frameworkLogger.log("cli", "validate-success", "info", { consumer: report.consumer });
+    }
+    else {
+        console.log("");
+        console.log("❌ Validation failed. Pack/wear miss — not a Mac init.sh leftover.");
+        frameworkLogger.log("cli", "validate-fail", "error", {
+            consumer: report.consumer,
+            failed: report.checks.filter((c) => !c.ok).map((c) => c.id),
+        });
+    }
+    return report;
+}
+export default validateCommand;

package/dist/cli/index.js

@@ -99,23 +99,15 @@ program
 });
 program
     .command("validate")
-    .description("Validate xray framework installation")
+    .description("Validate consumer wear (pack paths, Cursor hooks, mill plant) — not leftover init.sh")
     .action(async () => {
     console.log("🔬 xray CLI: Validating installation...");
     try {
-        // Run the init.sh script to validate
-        const initScript = join(packageRoot, ".opencode", "init.sh");
-        const fs = await import("fs");
-        if (!fs.existsSync(initScript)) {
-            console.error("❌ Validation failed: init script not found:", initScript);
+        const { validateCommand } = await import("./commands/validate.js");
+        const report = await validateCommand(process.cwd());
+        if (!report.ok) {
             process.exit(1);
         }
-        // SECURITY: Validate script path before execution
-        validateScriptPath(initScript, "init script");
-        execSync(`bash "${initScript}"`, {
-            stdio: "inherit",
-            cwd: process.cwd(),
-        });
     }
     catch (error) {
         console.error("❌ Validation failed:", error instanceof Error ? error.message : String(error));

package/dist/integrations/cursor/hooks/cursor-hook-utils.js

@@ -4,6 +4,7 @@
  * sessionStart is unavailable on managed cloud; first preToolUse / afterFileEdit boots.
  */
 
+import { execFileSync } from 'node:child_process';
 import fs from 'fs';
 import path from 'path';
 import {
@@ -25,6 +26,7 @@ import { appendHookActivity } from '../../grok/hooks/grok-hook-activity.js';
 import {
   buildRepertoireResume,
   readGitBrief,
+  stationDurableHoldsNpm,
 } from '../../hooks/station-hook-runtime.mjs';
 
 export const CURSOR_HOST = 'cursor';
@@ -147,15 +149,118 @@ export function cursorBootNeedsRefresh(existing, root) {
   if (liveGit && liveGit.head && bootHead !== liveGit.head) return true;
   const liveResume = buildRepertoireResume(root);
   if (liveResume && existing.repertoireResume && liveResume !== existing.repertoireResume) return true;
+  if (stationDurableHoldsNpm(root)) return true;
   return false;
 }
 
+function sessionCaptureStampPath(root) {
+  return path.join(root, '.xray', 'state', 'session-capture-stamp.json');
+}
+
+function readSessionCaptureConfig(root) {
+  let cfg = {};
+  try {
+    const raw = JSON.parse(fs.readFileSync(path.join(root, '.xray', 'features.json'), 'utf8'));
+    cfg = raw.inference_session_capture || {};
+  } catch {
+    cfg = {};
+  }
+  return {
+    enabled: cfg.enabled === true,
+    minCommits: typeof cfg.min_commits === 'number' && cfg.min_commits > 0 ? cfg.min_commits : 3,
+    lookback: typeof cfg.lookback_commits === 'number' && cfg.lookback_commits > 0 ? cfg.lookback_commits : 20,
+  };
+}
+
+function readSessionCaptureStamp(root) {
+  try {
+    return JSON.parse(fs.readFileSync(sessionCaptureStampPath(root), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function gitCommitSubjects(root, args) {
+  try {
+    const out = execFileSync('git', ['log', '--format=%h||%s', '--no-merges', ...args], {
+      cwd: root,
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return String(out)
+      .split('\n')
+      .map((line) => line.trim())
+      .filter(Boolean)
+      .map((line) => {
+        const idx = line.indexOf('||');
+        return {
+          hash: idx === -1 ? line : line.slice(0, idx),
+          message: idx === -1 ? '' : line.slice(idx + 2),
+        };
+      });
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Cursor never runs the git post-commit hook. When HEAD moves, write the same
+ * session-*.json the kernel already knows how to ingest. Dedup per HEAD.
+ */
+export function maybeCaptureSessionOnHeadMove(root) {
+  const cfg = readSessionCaptureConfig(root);
+  if (!cfg.enabled) return null;
+  const git = readGitBrief(root);
+  if (!git || !git.head) return null;
+  const stamp = readSessionCaptureStamp(root);
+  if (stamp && stamp.head === git.head) return null;
+
+  const commits = stamp && stamp.head
+    ? gitCommitSubjects(root, [`${stamp.head}..HEAD`])
+    : gitCommitSubjects(root, ['-n', String(cfg.lookback)]);
+  if (commits.length < cfg.minCommits) return null;
+
+  const sessionId = `session-${new Date().toISOString().slice(0, 10)}-${git.head}`;
+  const approaches = commits.map((c) => c.message).filter(Boolean);
+  const session = {
+    sessionId,
+    timestamp: new Date().toISOString(),
+    span: {
+      from: stamp && stamp.head ? stamp.head : `HEAD~${cfg.lookback}`,
+      to: git.head,
+    },
+    problems: [],
+    approaches,
+    wrongTurns: [],
+    solutions: [],
+    patterns: [],
+    matched_primitives: [],
+    metrics: { commits: commits.length },
+  };
+
+  const outDir = path.join(root, 'docs', 'inference');
+  fs.mkdirSync(outDir, { recursive: true });
+  const filePath = path.join(outDir, `session-${sessionId.replace(/^session-/, '')}.json`);
+  fs.writeFileSync(filePath, `${JSON.stringify(session, null, 2)}\n`);
+  fs.writeFileSync(path.join(outDir, 'latest-session.json'), `${JSON.stringify(session, null, 2)}\n`);
+  fs.mkdirSync(path.dirname(sessionCaptureStampPath(root)), { recursive: true });
+  fs.writeFileSync(
+    sessionCaptureStampPath(root),
+    `${JSON.stringify({ head: git.head, sessionId, path: filePath, updatedAt: session.timestamp }, null, 2)}\n`,
+  );
+  return filePath;
+}
+
 export function ensureCursorSessionBoot(root, source = '0xray/cursor-pre-tool-use-boot', extra = {}) {
   const bootPath = sessionBootPath(root);
   if (fs.existsSync(bootPath)) {
     try {
       const existing = JSON.parse(fs.readFileSync(bootPath, 'utf8'));
-      if (!cursorBootNeedsRefresh(existing, root)) return bootPath;
+      if (!cursorBootNeedsRefresh(existing, root)) {
+        maybeCaptureSessionOnHeadMove(root);
+        return bootPath;
+      }
     } catch {
       /* rewrite corrupt or host-mismatched boot */
     }
@@ -164,7 +269,9 @@ export function ensureCursorSessionBoot(root, source = '0xray/cursor-pre-tool-us
     host: CURSOR_HOST,
     ...extra,
   });
-  return writeSessionBoot(root, payload) || bootPath;
+  const written = writeSessionBoot(root, payload) || bootPath;
+  maybeCaptureSessionOnHeadMove(root);
+  return written;
 }
 
 export function writeCursorPrecompactReceipt(root, fields) {

package/dist/integrations/hooks/station-hook-runtime.cjs

@@ -203,6 +203,25 @@ function stationSafeSignals(names) {
   return out;
 }
 
+/** Overlay + factory names on dest. OP-PROC lives here — not on Station.md. */
+function readOpProcNames(root) {
+  const dest = join(root, ".xray", "state", "repertoire", "curated_signals.json");
+  if (!existsSync(dest)) return [];
+  try {
+    const data = JSON.parse(readFileSync(dest, "utf8"));
+    if (!Array.isArray(data.signals)) return [];
+    const names = [];
+    for (const signal of data.signals) {
+      const name = String(signal && signal.name ? signal.name : "").trim();
+      if (!name || name.toLowerCase().startsWith("bedrock-")) continue;
+      names.push(name);
+    }
+    return names;
+  } catch {
+    return [];
+  }
+}
+
 function persistRepertoireWorking(root, snapshot) {
   try {
     mkdirSync(join(root, ".xray", "state"), { recursive: true });
@@ -340,6 +359,8 @@ function applyStationHeat(root, host, extra = {}, existing = {}) {
     repertoireResume,
   };
   if (matchedSignals.length) workingSnapshot.matchedSignals = matchedSignals;
+  const opProcNames = readOpProcNames(root);
+  if (opProcNames.length) workingSnapshot.opProcNames = opProcNames;
   const working = persistRepertoireWorking(root, workingSnapshot);
   if (isCompactHook(extra) && matchedSignals.length) {
     ingestCompactFeedbackSync(
@@ -383,6 +404,23 @@ function isDurableStationHeading(line) {
   return /^##\s+(durable|seed)\b/i.test(String(line || "").trim());
 }
 
+/** Durable is identity. Hold/ship lives in mill-gate — not on the card. */
+function isHoldNpmLine(line) {
+  return /\bhold\s+npm\b/i.test(String(line || "").trim());
+}
+
+function stripHoldNpm(line) {
+  return String(line || "")
+    .replace(/\s*hold\s+npm\.?/gi, "")
+    .replace(/[ \t]+$/g, "");
+}
+
+function stationDurableHoldsNpm(root) {
+  return readExistingStationMarkdown(root)
+    .split(/\r?\n/)
+    .some((line) => isHoldNpmLine(line));
+}
+
 function isStockStationLine(line) {
   const trimmed = String(line || "").trim();
   if (!trimmed) return true;
@@ -411,12 +449,14 @@ function extractPreservedStationLines(existing) {
       if (otherHeading || isStockStationLine(line)) {
         inDurable = false;
       } else {
-        preserved.push(line);
+        const durableLine = stripHoldNpm(line);
+        if (durableLine.trim()) preserved.push(durableLine);
         continue;
       }
     }
     if (isStockStationLine(line)) continue;
-    preserved.push(line);
+    const kept = stripHoldNpm(line);
+    if (kept.trim()) preserved.push(kept);
   }
   while (preserved.length && !preserved[0].trim()) preserved.shift();
   while (preserved.length && !preserved[preserved.length - 1].trim()) preserved.pop();
@@ -500,10 +540,13 @@ module.exports = {
   isLeftoverMemoryRoutingOff,
   persistRepertoireWorking,
   readRepertoireWorking,
+  readOpProcNames,
   formatWorkingLine,
   applyStationHeat,
   extractPreservedStationLines,
   mergeStationMarkdown,
   formatStationMarkdown,
   writeStationMarkdown,
+  isHoldNpmLine,
+  stationDurableHoldsNpm,
 };

package/dist/integrations/hooks/station-hook-runtime.mjs

@@ -18,9 +18,12 @@ export const readPlanLine = impl.readPlanLine;
 export const buildRepertoireResume = impl.buildRepertoireResume;
 export const persistRepertoireWorking = impl.persistRepertoireWorking;
 export const readRepertoireWorking = impl.readRepertoireWorking;
+export const readOpProcNames = impl.readOpProcNames;
 export const formatWorkingLine = impl.formatWorkingLine;
 export const applyStationHeat = impl.applyStationHeat;
 export const extractPreservedStationLines = impl.extractPreservedStationLines;
 export const mergeStationMarkdown = impl.mergeStationMarkdown;
 export const formatStationMarkdown = impl.formatStationMarkdown;
 export const writeStationMarkdown = impl.writeStationMarkdown;
+export const isHoldNpmLine = impl.isHoldNpmLine;
+export const stationDurableHoldsNpm = impl.stationDurableHoldsNpm;

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.15",
+  "version": "4.0.17",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/dist/skills/orchestrator/SKILL.md

@@ -67,12 +67,13 @@ The seven rules are the engine. The cadence is the time signature. Disk SSOT: `g
 - **Peer test:** another instance with only worn 0xRay continues the ticket. No command stream.
 - **Wear first:** Read `.xray/state/STATION.md`. Same cloud. Same critic (resume only). Dummy Reads Station.
 - **Dummy tests `SKILLS.md`:** a suited dummy proves the worn catalog. Same-sess bodies keep context and hold a Station card.
-- **Ship track:** always branch + worktree/aside + PR. Docs as you go. Builds. Rollback = close the PR.
-- **Publish:** spawn the OTP browser, watch success, poll `npm view` until the new version is live. Do not move on early. Railway same law.
-- **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes.
+- **Ship track:** always branch + worktree/aside + PR. Docs as you go. Builds. Rollback = close the PR. **Subject review. Fix n ship.** After critic PASS, review dest/domain, close leftovers, then mill-gate D. PASS is not ship. **Groover is not Repertoire.**
+- **Publish:** stay logged in (do not `npm logout`). Every time run `npm publish --access public` in the live TTY. Paste the clickable `auth/cli` URL. No Enter, no VM browser, no subagent, no 6-digit code in chat. Poll `npm view` until live. Then prove **fresh** and **upgrade** registry installs. `npx 0xray validate` is the wear check (not leftover init.sh). `npm view` is not an install.
+- **Peer boot:** four-line dispatch. They Read Station + this cadence and install without a command novel. Not a twin critic.
+- **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes. **Clean ticks every cycle** — unsubscribe then resubscribe so the prompt matches metal. Name-dedupe does not rewrite. A stale prompt (waiting URL after live, Hold after strip) is dirty: rewrite, do not act. **If the card and WAVEBOARD are idle, unsubscribe and do not resubscribe.**
 - **Board clock:** PR events + resume the same critic. Not two idle pacers. Merge after PASS+CI (gate A). Publish only after mill-gate D + `foundry gate`.
 - **Dispatch:** ticket + PR URLs + “Wear, then review.” The critic Reads `SEATS.md` Reviewer. Do not paste a command novel. When a law is spoken twice, encode it this wake.
-- **Close:** loop until Station is done. Compact: Station survives the cut. Repertoire keeps names.
+- **Close:** loop until Station is done. Compact: Station survives the cut. Overlay dest names are OP-PROC — reload `repertoire-working.json` `opProcNames`, not Station.
 - **Board:** critic Strict comments; forge implements; lead stays main thread.
 - **Codex 69:** rewire this skill and existing ops. Do not add a new `SKILL.md` to hold the cadence.
 - **Ship matrix:** `LEAD-CADENCE.md` Decision matrix — A PR+CI · B pack · C `release:docs-check` · D `foundry release --i-mean-it`. Green CI is not ship. Spend / credentials stay Ask-first.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.15",
+  "version": "4.0.17",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.15",
+  "version": "4.0.17",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/src/skills/orchestrator/SKILL.md

@@ -67,12 +67,13 @@ The seven rules are the engine. The cadence is the time signature. Disk SSOT: `g
 - **Peer test:** another instance with only worn 0xRay continues the ticket. No command stream.
 - **Wear first:** Read `.xray/state/STATION.md`. Same cloud. Same critic (resume only). Dummy Reads Station.
 - **Dummy tests `SKILLS.md`:** a suited dummy proves the worn catalog. Same-sess bodies keep context and hold a Station card.
-- **Ship track:** always branch + worktree/aside + PR. Docs as you go. Builds. Rollback = close the PR.
-- **Publish:** spawn the OTP browser, watch success, poll `npm view` until the new version is live. Do not move on early. Railway same law.
-- **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes.
+- **Ship track:** always branch + worktree/aside + PR. Docs as you go. Builds. Rollback = close the PR. **Subject review. Fix n ship.** After critic PASS, review dest/domain, close leftovers, then mill-gate D. PASS is not ship. **Groover is not Repertoire.**
+- **Publish:** stay logged in (do not `npm logout`). Every time run `npm publish --access public` in the live TTY. Paste the clickable `auth/cli` URL. No Enter, no VM browser, no subagent, no 6-digit code in chat. Poll `npm view` until live. Then prove **fresh** and **upgrade** registry installs. `npx 0xray validate` is the wear check (not leftover init.sh). `npm view` is not an install.
+- **Peer boot:** four-line dispatch. They Read Station + this cadence and install without a command novel. Not a twin critic.
+- **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes. **Clean ticks every cycle** — unsubscribe then resubscribe so the prompt matches metal. Name-dedupe does not rewrite. A stale prompt (waiting URL after live, Hold after strip) is dirty: rewrite, do not act. **If the card and WAVEBOARD are idle, unsubscribe and do not resubscribe.**
 - **Board clock:** PR events + resume the same critic. Not two idle pacers. Merge after PASS+CI (gate A). Publish only after mill-gate D + `foundry gate`.
 - **Dispatch:** ticket + PR URLs + “Wear, then review.” The critic Reads `SEATS.md` Reviewer. Do not paste a command novel. When a law is spoken twice, encode it this wake.
-- **Close:** loop until Station is done. Compact: Station survives the cut. Repertoire keeps names.
+- **Close:** loop until Station is done. Compact: Station survives the cut. Overlay dest names are OP-PROC — reload `repertoire-working.json` `opProcNames`, not Station.
 - **Board:** critic Strict comments; forge implements; lead stays main thread.
 - **Codex 69:** rewire this skill and existing ops. Do not add a new `SKILL.md` to hold the cadence.
 - **Ship matrix:** `LEAD-CADENCE.md` Decision matrix — A PR+CI · B pack · C `release:docs-check` · D `foundry release --i-mean-it`. Green CI is not ship. Spend / credentials stay Ask-first.

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.15",
+  "version": "4.0.17",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",