@cohortapp/agent-sdk 2.18.12 → 2.18.14

package/scripts/daemon/responder.mjs

@@ -74,9 +74,53 @@ import { generateAck } from "./assurance.mjs";
 // must be large; attach genuinely verbose content rather than dumping it). The
 // SAME constant leads the full-session prompt in prompt-builder.mjs, so a reactive
 // quick reply and a full inbox/backlog session shape outbound prose identically.
-// This path never renders the persona block, which is why the doctrine is a
-// separately-exported constant rather than part of voiceRules().
-import { MESSAGE_CRAFT } from "../../lib/identity/persona.mjs";
+// This path renders the seat persona through renderSeatPersona() rather than
+// the full voiceRules() block, which is why the doctrine is a separately-
+// exported constant rather than part of voiceRules().
+//
+// SELF_PRESENTATION travels with it, and for a sharper reason. The preamble this
+// path loads is scraped out of the SEAT's CLAUDE.md — a file `maestro upgrade`
+// deliberately never touches, so a seat scaffolded before the "How you write and
+// carry yourself" section existed gets NO instruction about self-presentation on
+// this plane at all. A model with no such instruction falls back to the
+// generic-assistant register it ships with, which is how quick replies came to
+// open with a rendering of the `identity_line` template in
+// policies/ai-disclosure.yaml inside the organisation's own channels — a line
+// owed to an external first contact and to nobody else. Shipping the rules from
+// the repo is what lets the fix reach a seat through `maestro upgrade`, once
+// this is released — nothing here changes a seat that is still on an older SDK.
+//
+// Adding the rule is only half of it. The preamble below is SEAT-LOCAL PROSE,
+// and some seats were hand-edited to carry the opener as a standing rule back
+// when the send gate demanded it. A counter-instruction does not delete a
+// contradiction, and the seat's copy arrives first, so the scrub strips the
+// stale instruction out of the scraped text before the model ever sees it. The
+// truthfulness invariant is exempt from the scrub by construction — see
+// lib/identity/disclosure-scrub.mjs.
+import { MESSAGE_CRAFT, SELF_PRESENTATION, renderSeatPersona } from "../../lib/identity/persona.mjs";
+import { scrubSeatText } from "../../lib/identity/disclosure-scrub.mjs";
+// The CLAUDE.md preamble helpers — one definition, shared with prompt-builder.
+import {
+  scrapeClaudeMdSections as _scrape,
+  stripScaffoldSentinels as _stripSentinels,
+  preambleTargets,
+} from "../../lib/identity/claude-md.mjs";
+// A seat CLAUDE.md line ordering a self-introduction reaches this prompt and the
+// repo cannot see it. The check therefore runs at RUNTIME over the composed
+// preamble — see lib/identity/disclosure-instructions.mjs.
+import { stripDisclosureInstructionsAndWarn } from "../../lib/identity/disclosure-instructions.mjs";
+// The conversation frame. A reply into a live thread used to arrive as a bare
+// transcript with no statement that the agent is IN it — see
+// lib/org/inbound/conversation-frame.mjs for the rendered prompt that proved it.
+import {
+  conversationFrame,
+  dedupeThreadAgainstHistory,
+  frameRecipientClass,
+  markOwnTurns,
+} from "../../lib/org/inbound/conversation-frame.mjs";
+// Internal vs external, by the SAME predicate the send gate uses, so the frame
+// and the gate can never disagree about who the agent is talking to.
+import { classifyRecipient } from "../../lib/comms/send-gate.mjs";
 // A human's roll-call to the whole room. The reply-shaping block (≤ 5 lines,
 // about myself only, no @mentions, no ack) lives with the vocabulary in
 // broadcast.mjs so the session path (prompt-builder) says the same thing this
@@ -561,28 +605,95 @@ function logInteraction(item, responseText, o = {}) {
 // Identity preamble (cached)
 // ---------------------------------------------------------------------------
 
+// The CLAUDE.md scrape and the scaffold-sentinel strip live in
+// lib/identity/claude-md.mjs. They used to be defined HERE, which is how the
+// full-session plane (prompt-builder.mjs) kept its own unfixed copy of the same
+// scrape: one plane got the fix, the other did not, and the other is the tier a
+// substantive reply escalates to. Re-exported for the tests that render this
+// plane, so there is one definition and two callers.
+export { scrapeClaudeMdSections, stripScaffoldSentinels } from "../../lib/identity/claude-md.mjs";
+
+/**
+ * The quick reply's identity + house-style preamble.
+ *
+ * IDENTITY COMES FROM config/agent.json, NOT FROM CLAUDE.md.
+ *
+ * This used to scrape `## Identity` out of the seat's CLAUDE.md and hand it to
+ * the model as-is. On every seat in the fleet that section is the scaffold
+ * template — `You are ` + "`{{agent.fullName}}`, `{{agent.title}}` at" +
+ * " `{{agent.company}}`…" — followed by "If those tokens are still unresolved,
+ * your identity has not been configured yet — run `maestro setup`". Nothing
+ * substitutes those tokens on this path: the responder is a `claude --print`
+ * call that is never shown config/agent.json. So EVERY reactive reply the fleet
+ * sent opened with an identity block that named nobody and then told the model
+ * its identity was unconfigured — which lib/identity/persona.mjs documents, in
+ * its own header, as the exact condition that makes an agent introduce and sign
+ * itself with a rendering of the policy's identity_line.
+ *
+ * `renderSeatPersona` is the renderer the FULL-SESSION path has used since that
+ * header was written. It resolves the real name, title, company, standing and
+ * reporting line from config/agent.json, and it carries `voiceRules()` —
+ * including "Do not introduce, describe or sign yourself as an assistant, a bot,
+ * an AI helper, or as 'working on behalf of' someone" AND the untouched
+ * truthfulness invariant. Using it here is what puts the two planes on one
+ * identity instead of one resolved and one template.
+ *
+ * The CLAUDE.md scrape is kept for the house-style sections the persona block
+ * does not cover, with `## Identity` DROPPED whenever the persona rendered —
+ * two identity blocks, one of them unresolved, is worse than either alone. It is
+ * RESTORED when nothing rendered, because a prompt that says "run maestro setup"
+ * is the honest rendering of a seat nobody has set up
+ * (lib/identity/claude-md.mjs#preambleTargets; pinned by
+ * responder-unconfigured-seat.test.mjs).
+ *
+ * AND THE SCRAPE IS FILTERED. It is seat-authored prose, and a seat file saying
+ * "On first message in any thread, introduce yourself as <the identity_line>."
+ * reaches this prompt verbatim, survives every upgrade,
+ * and defeats everything above — while being invisible from this repo, so no
+ * test that renders the scaffold can catch it. The check therefore runs at
+ * RUNTIME on the text about to go to the model, and warns once per line naming
+ * the file to edit (lib/identity/disclosure-instructions.mjs). It is narrow on
+ * purpose and keeps a line that FORBIDS the behaviour; the truthfulness
+ * invariant is untouched.
+ */
 function loadPreamble() {
   if (cachedPreamble) return cachedPreamble;
+  const persona = renderSeatPersona(AGENT_REPO_DIR);
+  const claudeMd = join(AGENT_REPO_DIR, "CLAUDE.md");
+  let scraped = "";
   try {
-    const raw = readFileSync(join(AGENT_REPO_DIR, "CLAUDE.md"), "utf-8");
-    // Extract just the identity and communication rules
-    const lines = raw.split("\n");
-    const sections = [];
-    let capturing = false;
-    const targets = ["## Identity", "## Company Context", "## Communication Rules"];
-    for (const line of lines) {
-      if (targets.some((h) => line.startsWith(h))) { capturing = true; sections.push(line); continue; }
-      if (capturing && /^## [A-Z]/.test(line) && !targets.some((h) => line.startsWith(h))) { capturing = false; continue; }
-      if (capturing) sections.push(line);
-    }
-    cachedPreamble = sections.join("\n").trim();
-    if (cachedPreamble.length < 100) cachedPreamble = FALLBACK_PREAMBLE;
+    const raw = readFileSync(claudeMd, "utf-8");
+    const targets = preambleTargets(Boolean(persona), ["## Company Context", "## Communication Rules"]);
+    scraped = _stripSentinels(_scrape(raw, targets));
   } catch {
-    cachedPreamble = FALLBACK_PREAMBLE;
+    scraped = "";
   }
+  // The seat file is the one input this repo cannot see. A line in it ordering a
+  // self-introduction survives every upgrade and defeats everything above, so it
+  // is dropped here, on the text about to go to the model, and warned about.
+  scraped = stripDisclosureInstructionsAndWarn(scraped, claudeMd).trim();
+  // Scrubbed as ONE string, and deliberately including the persona: the persona
+  // is rendered from config/agent.json, which is seat-local too, so a
+  // disclosure sentence stuffed into `persona`/`background`/`bio` renders into
+  // this prompt exactly as a CLAUDE.md line would. Scrubbing the composed text
+  // covers both seat inputs with one pass — and it happens BEFORE the length
+  // floor below, so a seat whose identity section is mostly a disclosure
+  // instruction falls through to the framework fallback rather than shipping a
+  // two-line stump. The truthfulness invariant is exempt by construction; see
+  // lib/identity/disclosure-scrub.mjs.
+  const composed = scrubSeatText([persona, scraped].filter(Boolean).join("\n\n").trim());
+  // The floor applies to the WHOLE preamble, not to the scrape alone: a seat
+  // with a resolved persona and an empty CLAUDE.md is configured, and must not
+  // be thrown back to the fallback that knows none of it.
+  cachedPreamble = composed.length < 100 ? FALLBACK_PREAMBLE : composed;
   return cachedPreamble;
 }
 
+/** For tests: drop the cached preamble so a fresh seat dir is re-read. */
+export function _resetPreambleCache() {
+  cachedPreamble = null;
+}
+
 function buildFallbackPreamble() {
   const a = loadAgent();
   const principalName = a.principal?.fullName || "the principal";
@@ -597,11 +708,34 @@ const FALLBACK_PREAMBLE = buildFallbackPreamble();
 // Load user profile for context
 // ---------------------------------------------------------------------------
 
+/**
+ * The seat's own notes about a sender, injected into the SYSTEM prompt.
+ *
+ * Filtered like the CLAUDE.md scrape, and for the same reason: this is
+ * seat-authored prose in an instruction position, written on the seat's own
+ * disk where the repo cannot see it. A profile saying "introduce yourself as an
+ * AI assistant when writing to this person" would defeat every other half of
+ * the fix for exactly one correspondent — the hardest version of the bug to
+ * reproduce. See lib/identity/disclosure-instructions.mjs.
+ *
+ * @param {string} sender
+ * @returns {string|null}
+ */
 function loadUserProfile(sender) {
   try {
     const profileName = sender.replace(/\s+/g, "-").toLowerCase();
     const path = join(AGENT_REPO_DIR, "memory", "profiles", "users", `${profileName}.yaml`);
-    return readFileSync(path, "utf-8");
+    // Both filters, for the same reason the CLAUDE.md preamble gets both: these
+    // files are seat-local, written by the agent itself over months, and land in
+    // the system prompt under a "Sender profile:" heading — i.e. as instruction,
+    // not as quoted data. `scrubSeatText` removes a rendered identity TEMPLATE;
+    // `stripDisclosureInstructionsAndWarn` removes an INSTRUCTION to open with
+    // one and names the file on stderr. A profile that recorded "always
+    // introduces itself to this person as an AI assistant" would otherwise
+    // re-arm the behaviour for that one sender — the hardest version of this
+    // bug to reproduce — no matter what the framework rules say.
+    const raw = readFileSync(path, "utf-8");
+    return stripDisclosureInstructionsAndWarn(scrubSeatText(raw), path) || null;
   } catch {
     return null;
   }
@@ -844,23 +978,65 @@ export async function loadCurrentWork(item, deps = {}) {
  * persona needs: describe it as your own work, and never quote a session name
  * or id (they are internal — `session_status` says the same).
  */
-export function buildQuickReplyUserContent({ item = {}, classResult = {}, conversationHistory = null, currentWork = "", rollCall = false } = {}) {
+export function buildQuickReplyUserContent({
+  item = {},
+  classResult = {},
+  conversationHistory = null,
+  currentWork = "",
+  rollCall = false,
+  agentName = "",
+  recipientClass = "internal",
+} = {}) {
+  // A roll-call's thread context is the room's other answers — not evidence
+  // about this seat, and exactly what the reply must not summarise.
+  const rawThread = !rollCall && item.thread_context ? String(item.thread_context) : "";
+  // The two transcripts overlapped almost completely on a mid-thread channel
+  // reply: the same turns arrived twice, worth up to COHORT_HISTORY_LIMIT ×
+  // COHORT_HISTORY_CHARS, and read as two different records of one exchange.
+  const thread = dedupeThreadAgainstHistory(conversationHistory, rawThread);
+  const history = markOwnTurns(conversationHistory || "", agentName);
+  const threadMarked = markOwnTurns(thread, agentName);
+
+  // The frame is what tells the model it is CONTINUING something. Spent only
+  // when there is a conversation to frame, and paid for by the dedupe above.
+  const frame = conversationFrame({
+    item,
+    agentName,
+    recipientClass,
+    history,
+    threadContext: threadMarked,
+  });
+
   return [
+    frame || null,
+    frame ? "" : null,
     `From: ${item.sender} (${item.sender_privilege || "unknown"})`,
     `Via: ${item.service} / ${item.channel}`,
     item.subject ? `Subject: ${item.subject}` : null,
-    conversationHistory ? `\nRecent conversation history:\n${conversationHistory}` : null,
+    history ? `\nRecent conversation history:\n${history}` : null,
     currentWork
       ? `\n${currentWork}\n(If asked what you are doing, answer from the lines above — as your own work, in your own words, board item ids included where a person could look one up. Never quote session names or ids.)`
       : null,
     `\nCurrent message:\n${item.content || "(empty)"}`,
-    // A roll-call's thread context is the room's other answers — not evidence
-    // about this seat, and exactly what the reply must not summarise.
-    !rollCall && item.thread_context ? `\nThread context:\n${item.thread_context}` : null,
+    threadMarked ? `\nEarlier in this thread:\n${threadMarked}` : null,
     `\nClassification: ${classResult.summary}`,
-  ].filter(Boolean).join("\n");
+  ].filter((l) => l !== null).join("\n");
 }
 
+/**
+ * Says, in the prompt, what the assembly order already implies: everything above
+ * this point on this plane is SEAT-LOCAL (the seat's CLAUDE.md sections and the
+ * per-sender profile), and the framework rules below outrank it.
+ *
+ * lib/identity/disclosure-scrub already removes the one seat-local instruction
+ * known to have caused harm. This sentence covers the variants the scrub's shape
+ * rule does not recognise: a model that is handed two conflicting instructions
+ * and no ordering between them resolves the conflict by position, and the seat's
+ * copy is first.
+ */
+const SEAT_TEXT_PRECEDENCE =
+  "The sections above are this seat's own local notes. The rules that follow are the framework's, they apply to every member of this organisation, and where the two conflict the rules below win.";
+
 /**
  * The real, CLI-backed answer generator. `deps` are test seams only —
  * `{runCLI, currentWorkBlock, forbidsTextFor, loadConversationHistory}` — so
@@ -877,14 +1053,19 @@ export async function realGenerateResponse(item, classResult, deps = {}) {
 
   const systemPrompt = `${preamble}
 
-You are generating a direct response to this message. Be concise and actionable.
+You are writing the next turn in a conversation you are already part of. Be concise and actionable.
 If it's a question, answer it. If it's a request, confirm and describe what you'll do or have done.
 If it's informational, acknowledge appropriately.
+Open with the substance. Do not greet, do not introduce or describe yourself, and do not restate your role, your reporting line or what you are — the people you are writing to already know, and none of them asked.
 
 Keep responses focused — 1-4 sentences for simple items, up to a short paragraph for more nuanced ones.
 Match the sender's tone and urgency level.
 ${profile ? `\nSender profile:\n${profile}` : ""}
 ${rollCall ? `\n${collectiveInstructions({ intent: itemCollectiveIntent(item, isRollCallItem), respondents: item.respondents })}\n` : ""}
+${SEAT_TEXT_PRECEDENCE}
+
+${SELF_PRESENTATION}
+
 ${MESSAGE_CRAFT}`;
 
   // A roll-call is answered from what this seat KNOWS about itself — its main
@@ -897,7 +1078,26 @@ ${MESSAGE_CRAFT}`;
   const conversationHistory = rollCall ? null : await (deps.loadConversationHistory || loadConversationHistory)(item);
   const currentWork = await loadCurrentWork(item, deps);
 
-  const userContent = buildQuickReplyUserContent({ item, classResult, conversationHistory, currentWork, rollCall });
+  // The seat's own name, so its prior turns in the transcript can be marked as
+  // ITS OWN. Without it the model reads lines it authored as a third party's,
+  // which is a conversation it has not joined — and a model joining a
+  // conversation cold introduces itself.
+  const agentName = (() => {
+    const a = loadAgent();
+    const n = (a.fullName || "").trim();
+    if (n && !/^unconfigured\b/i.test(n)) return n;
+    const f = (a.firstName || "").trim();
+    return f && !/^unconfigured\b/i.test(f) ? f : "";
+  })();
+  // Origin first, then the send gate's own predicate — see
+  // conversation-frame.mjs#frameRecipientClass for why a bare
+  // `classifyRecipient(service, channel_id || channel)` put colleagues in the
+  // agent's own #risk-compliance channel on the "external" branch, silently.
+  const recipientClass = frameRecipientClass(item, classifyRecipient);
+
+  const userContent = buildQuickReplyUserContent({
+    item, classResult, conversationHistory, currentWork, rollCall, agentName, recipientClass,
+  });
 
   // (b2) Session-router decision. Compute the routing key from a daemon→router
   // adapter view of the item. If the item can't be keyed (unknown service,

package/scripts/emergency-stop.sh

@@ -1,13 +1,42 @@
 #!/bin/bash
 # Emergency Stop — Immediately halts all Maestro agent operations.
-# Usage: ./scripts/emergency-stop.sh
+# Usage: ./scripts/emergency-stop.sh [--dry-run] [--help]
 #
 # This script is the kill switch for all autonomous operations:
 #   1. Drops .emergency-stop flag (every workflow / cadence consumer / enqueue
 #      script honours this on the next tick).
 #   2. Unloads every installed `ai.maestro.<agent>-*` (and legacy
 #      `ai.adaptic.<agent>-*`) launchd job.
-#   3. Kills running Claude Code subagent processes.
+#   3. Kills running Claude Code subagent processes (EXCEPT this process and
+#      its ancestors — see step 3).
+#
+# --dry-run
+#   Report the kill set instead of signalling it. The flag and the launchd
+#   unload still happen; only the signals are withheld — and BOTH the closing
+#   banner and the log line say "DRY RUN — NO PROCESSES SIGNALLED", so a dry
+#   run can never be mistaken for a halt. It exists so the self-sparing in
+#   step 3 is testable without a suite that kills the operator's own session
+#   to prove that it does not.
+#
+#   WHY A FLAG AND NOT AN ENV VAR. This used to be read from the ambient
+#   environment as MAESTRO_EMERGENCY_STOP_DRY_RUN, while step 4 printed
+#   "EMERGENCY STOP COMPLETE — All operations halted" unconditionally. A stray
+#   `export`, a line in .env, or an EnvironmentVariables entry in a plist
+#   would therefore turn the kill switch into a no-op — every claude process
+#   surviving — while the banner and the log both asserted the halt had
+#   succeeded. That is the same fault class this file was being repaired for:
+#   something that looks like it is handling the case and is not. On a
+#   break-glass control the escape hatch must be typed at the call site, once,
+#   deliberately. The env var is NOT consulted; setting it does nothing.
+#
+# SCOPE OF THE KILL (step 3), stated rather than hidden: every process of THIS
+# user whose command line matches `claude`, minus this process and its
+# ancestors. That is machine-wide, not agent-scoped — an unrelated Claude
+# session of yours in another directory WILL be terminated (21 processes
+# matched on the host where this was measured). Nothing here can narrow it
+# honestly, because a Claude Code session's argv does not carry the agent dir;
+# so the set is printed before it is signalled, and --dry-run shows it without
+# signalling anything.
 #
 # Plist resolution: the agent's first-name slug is read from config/agent.json
 # (SOT) so unload targets the correct labels; falls back to the directory
@@ -21,6 +50,25 @@ LOG_FILE="$AGENT_DIR/logs/emergency-stop.log"
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 mkdir -p "$(dirname "$LOG_FILE")" 2>/dev/null || true
 
+# Argument parsing runs BEFORE anything is halted: a typo must refuse loudly,
+# not drop the flag and then exit.
+DRY_RUN=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --dry-run) DRY_RUN=1 ;;
+        -h | --help)
+            sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+            exit 0
+            ;;
+        *)
+            echo "emergency-stop: unknown argument: $1" >&2
+            echo "Usage: emergency-stop.sh [--dry-run]" >&2
+            exit 2
+            ;;
+    esac
+    shift
+done
+
 # Resolve agent first-name slug from SOT (config/agent.json) so the unload
 # loop targets the right launchd labels. Falls back to the basename of the
 # agent directory (stripping -ai suffix).
@@ -39,7 +87,11 @@ LAUNCH_AGENTS_DIR="$HOME/Library/LaunchAgents"
 # (deployed agents whose plists predate the rename). The loops guard with [ -f ].
 PLIST_GLOB="$LAUNCH_AGENTS_DIR/ai.maestro.${AGENT_FIRST}-*.plist $LAUNCH_AGENTS_DIR/ai.adaptic.${AGENT_FIRST}-*.plist"
 
-echo "[$TIMESTAMP] EMERGENCY STOP INITIATED (agent=$AGENT_FIRST)" | tee -a "$LOG_FILE"
+if [ "$DRY_RUN" -eq 1 ]; then
+    echo "[$TIMESTAMP] EMERGENCY STOP DRY RUN INITIATED (agent=$AGENT_FIRST) — no process will be signalled" | tee -a "$LOG_FILE"
+else
+    echo "[$TIMESTAMP] EMERGENCY STOP INITIATED (agent=$AGENT_FIRST)" | tee -a "$LOG_FILE"
+fi
 
 # 1. Drop the stop flag FIRST so any in-flight work sees it on next tick.
 echo "$TIMESTAMP" > "$AGENT_DIR/.emergency-stop"
@@ -57,23 +109,72 @@ for plist in $PLIST_GLOB; do
 done
 echo "[$TIMESTAMP] Unloaded $unloaded launchd job(s)" >> "$LOG_FILE"
 
-# 3. Kill running Claude Code subagent processes. Filter to processes that
-#    have AGENT_ROOT or this agent's directory in their cwd to avoid
-#    killing unrelated claude sessions the operator may have running.
+# 3. Kill running Claude Code subagent processes.
+#
+#    THE MIRROR-IMAGE FAULT THIS FIXES: `pgrep -f claude` matches the process
+#    that is RUNNING THIS SCRIPT whenever an agent session invokes it — which
+#    is the normal way it gets invoked. The stop then killed its own caller
+#    mid-flight, so step 4 never ran and the halt was never logged complete:
+#    a script that destroys the condition it needs in order to finish, the
+#    same shape as resume-operations.sh refusing to lift its own stop flag.
+#    The comment here also claimed a cwd filter that did not exist.
+#
+#    So: build the kill set, then subtract this process and every ancestor of
+#    it. Everything else matching `claude` is still terminated — the stop is
+#    still a kill switch, it just no longer includes the hand on the switch.
+#    See SCOPE OF THE KILL in the header: "everything else" really does mean
+#    every matching process of this user on this machine, so it is printed.
 echo "Stopping Claude Code agent processes..."
-# pgrep -lf is more selective than pkill -f
-pids=$(pgrep -f "claude" 2>/dev/null | tr '\n' ' ' || true)
-if [ -n "$pids" ]; then
+
+# PIDs to spare: this shell and its whole ancestor chain (the launching
+# session, its shell, launchd). Walk up via ppid until PID 1.
+SPARE=" $$ "
+_p=$$
+while [ -n "$_p" ] && [ "$_p" -gt 1 ]; do
+    _p=$(ps -o ppid= -p "$_p" 2>/dev/null | tr -d ' ')
+    [ -n "$_p" ] || break
+    SPARE="$SPARE$_p "
+done
+
+# claude_targets — matching PIDs (this user only) minus the spare set.
+claude_targets() {
+    local out=""
+    local pid
+    for pid in $(pgrep -u "$(id -u)" -f "claude" 2>/dev/null || true); do
+        case "$SPARE" in
+            *" $pid "*) continue ;;
+        esac
+        out="$out$pid "
+    done
+    printf '%s' "$out"
+}
+
+pids=$(claude_targets)
+if [ "$DRY_RUN" -eq 1 ]; then
+    echo "[DRY-RUN] sparing:$SPARE"
+    echo "[DRY-RUN] would terminate: ${pids:-<none>}"
+    echo "[$TIMESTAMP] DRY RUN — would terminate: ${pids:-<none>}" >> "$LOG_FILE"
+elif [ -n "$pids" ]; then
+    # Name the set before signalling it — this is machine-wide for this user.
+    echo "Terminating (every matching process of this user, not just this agent): $pids"
     # Send SIGTERM first, give 3s, then SIGKILL stragglers.
     kill -TERM $pids 2>/dev/null || true
     sleep 3
-    still=$(pgrep -f "claude" 2>/dev/null | tr '\n' ' ' || true)
-    [ -n "$still" ] && kill -KILL $still 2>/dev/null || true
+    still=$(claude_targets)
+    if [ -n "$still" ]; then kill -KILL $still 2>/dev/null || true; fi
     echo "[$TIMESTAMP] Claude processes terminated ($pids)" >> "$LOG_FILE"
+else
+    echo "[$TIMESTAMP] No Claude processes to terminate (self/ancestors spared)" >> "$LOG_FILE"
 fi
 
-# 4. Log completion.
-echo "[$TIMESTAMP] EMERGENCY STOP COMPLETE — All operations halted" | tee -a "$LOG_FILE"
+# 4. Log completion. A dry run says so in BOTH places — the banner an operator
+#    reads and the log an incident review reads — because the previous version
+#    printed the halt banner either way.
+if [ "$DRY_RUN" -eq 1 ]; then
+    echo "[$TIMESTAMP] EMERGENCY STOP DRY RUN — NO PROCESSES SIGNALLED (flag set, launchd unloaded)" | tee -a "$LOG_FILE"
+else
+    echo "[$TIMESTAMP] EMERGENCY STOP COMPLETE — All operations halted" | tee -a "$LOG_FILE"
+fi
 echo ""
 echo "To resume operations:"
 echo "  ./scripts/resume-operations.sh"

package/scripts/fleet/rollout.mjs

@@ -262,13 +262,20 @@ export function gateLine(r) {
 }
 
 /**
- * A note about paths the GATES themselves dirtied. `npm test` appends to a
- * tracked runtime ledger (.claude-flow/policy/state.json), so a second run in a
- * row would refuse on a file the first run wrote. The clean-tree gate is NOT
+ * A note about paths the GATES themselves dirtied: a second run in a row would
+ * otherwise refuse on a file the FIRST run wrote. The clean-tree gate is NOT
  * weakened for this — publishing a tree you cannot describe stays a refusal —
  * the run just says which paths are the gates' own leavings so the operator
  * reverts them instead of hunting them. Pure.
  *
+ * ~~"`npm test` appends to a tracked runtime ledger
+ * (.claude-flow/policy/state.json)"~~ — struck 2026-09-25: that file is the
+ * reason this function exists, and it is no longer tracked (it is a per-machine
+ * receipt chain, so it never should have been; `.gitignore` says why). This
+ * function stays because the SHAPE recurs — the next gate that writes into the
+ * tree will do the same thing — and because naming the paths beats hunting
+ * them. When it returns null for a whole rollout, that is the expected reading.
+ *
  * @param {string[]} before dirty paths before the gates ran
  * @param {string[]} after  dirty paths after
  * @returns {string|null}