@cruxy/cli 1.11.2 → 1.11.3

package/dist/cli/session-factory.js

@@ -25,6 +25,7 @@ import { MemoryService, buildMultiRootRecallBlock, rememberTool, } from "../memo
 import { findDefinitionTool, findReferencesTool, getDiagnosticsTool, hoverTool, } from "../lsp/index.js";
 import { createWebSearchTool, createWebFetchTool } from "../web/index.js";
 import { appendRun } from "../usage/index.js";
+import { VerificationLedger } from "../verification/index.js";
 import { Semaphore, SubagentOrchestrator, makeSpawnSubagentTool, makeSpawnSubagentsTool, } from "../subagent/index.js";
 import { ApprovalQueue, JobManager, makeRunInBackgroundTool, } from "../jobs/index.js";
 /**
@@ -253,13 +254,26 @@ opts = {}) {
                 logger.warn(`${error.code}: ${error.title} — ${error.cause}`);
         }
         : undefined;
+    // The verification record (P2 verification): ONE ledger for the session,
+    // fed by the exec tools' side channels below and by the file tools through
+    // `ctx.verification`, and written through to the session log as its own
+    // event kinds. The in-memory side is what `/status` and the one-shot
+    // summary read; the log is what a resume and the transcript keep.
+    const verification = new VerificationLedger({
+        sink: opts.recorder ? (obs) => opts.recorder.observe(obs) : undefined,
+    });
     // The `run_tests` side channel (P3): the structured outcome the tool already
     // built, handed to the renderer to draw. Every field it needs is copied
     // across as-is — nothing is derived here, so an absent `total` stays absent
-    // rather than becoming a number the parsers refused to claim.
+    // rather than becoming a number the parsers refused to claim. The record
+    // takes the same object, from the same call — never re-parsed from the
+    // string the model gets.
     const execRegistry = buildDefaultRegistry({
-        onTestResult: renderer
-            ? (result, command) => renderer.testResult({
+        // `tools.fileEdit` / `tools.shell` (P4): wired here, the one place the
+        // default registry is built for a session.
+        tools: config.tools,
+        onTestResult: (result, command, run) => {
+            renderer?.testResult({
                 passed: result.passed,
                 command: command.command,
                 durationMs: result.durationMs,
@@ -270,8 +284,38 @@ opts = {}) {
                     ...(f.line !== undefined ? { line: f.line } : {}),
                 })),
                 outputTruncated: result.outputTruncated,
-            })
-            : undefined,
+            });
+            verification.record({
+                kind: "verification",
+                tool: "run_tests",
+                command: command.command,
+                source: command.source,
+                passed: result.passed,
+                exitCode: result.exitCode,
+                durationMs: result.durationMs,
+                ...(result.total !== undefined ? { total: result.total } : {}),
+                failureCount: result.failures.length,
+                failureNames: result.failures.map((f) => f.name),
+                outputTruncated: result.outputTruncated,
+                substrate: run.substrate,
+            });
+        },
+        // `run_command` records what ran and how it exited — and NOTHING about
+        // what it was for. Whether "pnpm typecheck" was a typecheck is the
+        // reader's call; classifying it here from its text is the inference the
+        // record refuses to make.
+        onCommandResult: (result) => verification.record({
+            kind: "verification",
+            tool: "run_command",
+            command: result.command,
+            passed: result.exitCode === 0,
+            exitCode: result.exitCode,
+            durationMs: result.durationMs,
+            failureCount: 0,
+            failureNames: [],
+            outputTruncated: result.outputTruncated,
+            substrate: result.substrate,
+        }),
     });
     const git = getGitInfo(cwd);
     const projectInstructions = loadProjectInstructions(cwd);
@@ -508,8 +552,9 @@ opts = {}) {
         requestApproval: gate(approval),
         checkpointsActive,
         sandbox,
+        verification,
     };
-    const planRunner = ({ messages, projectInstructions, recalledMemory: turnMemory, renderer: turnRenderer, onRequestUsage, }) => runPlanSession({
+    const planRunner = ({ messages, projectInstructions, recalledMemory: turnMemory, renderer: turnRenderer, onRequestUsage, compact, record, }) => runPlanSession({
         provider,
         config,
         ctx,
@@ -524,6 +569,8 @@ opts = {}) {
         renderer: turnRenderer,
         router,
         onRequestUsage,
+        compact,
+        record,
     });
     holder.session = new Session({
         provider,
@@ -548,6 +595,7 @@ opts = {}) {
         // not a second list that agrees with them only by luck.
         allowlist,
         recorder: opts.recorder,
+        verification,
         restore: opts.restore,
     });
     return holder.session;

package/dist/config/schema.js

@@ -78,9 +78,18 @@ export const AgentConfigSchema = z
     planMode: z.boolean().default(false),
 })
     .strict();
+/**
+ * Which built-in tool families the model is handed (P4). Declared in the C.0
+ * scaffold and consumed by nothing until P4 — see `buildDefaultRegistry` for
+ * why they were wired rather than removed (`initConfig` writes them into every
+ * generated config, and the schema is `.strict()`).
+ */
 export const ToolsConfigSchema = z
     .object({
+    /** `false` withholds `write_file`, `edit_file` and `apply_patch`. Reads stay. */
     fileEdit: z.boolean().default(true),
+    /** `false` withholds `run_command` and `run_tests` — no command execution
+     * by the model at all. `create_pull_request` (git, own approval) stays. */
     shell: z.boolean().default(true),
 })
     .strict();

package/dist/mcp/bounds.js

@@ -1,4 +1,4 @@
-import { MAX_SCHEMA_DEPTH, schemaDepth } from "../tools/schema-depth.js";
+import { MAX_SCHEMA_DEPTH, MAX_SCHEMA_NODES, schemaDepth, schemaNodes, } from "../tools/schema-depth.js";
 const PERMISSIVE_SCHEMA = {
     type: "object",
     additionalProperties: true,
@@ -48,6 +48,13 @@ export function boundToolList(tools, bounds) {
             inputSchema = { ...PERMISSIVE_SCHEMA };
             notes.push(`input schema nests ${depth} levels deep, at or over the ${MAX_SCHEMA_DEPTH}-level provider limit, and was replaced with a permissive one`);
         }
+        // Same order, same reasoning: nodes are counted on the post-cap value, and
+        // the gateway's bound is inclusive (P4) — 400 passes, 401 fails the request.
+        const nodes = schemaNodes(inputSchema);
+        if (nodes > MAX_SCHEMA_NODES) {
+            inputSchema = { ...PERMISSIVE_SCHEMA };
+            notes.push(`input schema has ${nodes} nodes, over the ${MAX_SCHEMA_NODES}-node provider limit, and was replaced with a permissive one`);
+        }
         return { name: t.name, description, inputSchema, notes };
     });
     return { tools: bounded, droppedCount };

package/dist/plan/execute.js

@@ -1,7 +1,7 @@
 import { CruxyError } from "../errors/index.js";
 import { promptContinueAfterFailure } from "./approve.js";
 export async function executePlan(plan, deps) {
-    const { runStep, io, renderer } = deps;
+    const { runStep, io, renderer, record } = deps;
     try {
         for (const [index, step] of plan.steps.entries()) {
             step.status = "running";
@@ -13,14 +13,17 @@ export async function executePlan(plan, deps) {
             });
             renderer?.setPhase({ kind: "executing-step" });
             renderer?.setPlan(plan.steps);
+            record?.(step);
             try {
                 await runStep(step);
                 step.status = "done";
                 renderer?.setPlan(plan.steps);
+                record?.(step);
             }
             catch (err) {
                 step.status = "failed";
                 renderer?.setPlan(plan.steps);
+                record?.(step);
                 // Surface the failure via the U.5 shape when we have it.
                 const detail = err instanceof CruxyError
                     ? `${err.title}${err.cause ? ` — ${err.cause}` : ""}`

package/dist/plan/service.js

@@ -3,6 +3,7 @@ import { ToolRegistry } from "../tools/index.js";
 import { runAgent } from "../agent/loop.js";
 import { promptPlanDecision } from "./approve.js";
 import { executePlan } from "./execute.js";
+import { stepInstruction } from "./step-message.js";
 import { makeSubmitPlanTool } from "./submit-plan.js";
 /**
  * Orchestrates a plan-mode turn (C.31): propose → approve/revise (capped) →
@@ -13,6 +14,32 @@ import { makeSubmitPlanTool } from "./submit-plan.js";
  *
  * A propose phase that ends with NO plan is a completed conversational turn, not
  * an error — see the `!holder.plan` branch below.
+ *
+ * WHAT SURVIVES THE PROCESS, AND WHAT DOES NOT (plan-durability).
+ *
+ * The plan object lives in `holder` below for exactly one call of this
+ * function. Three things outlive it: the transcript (every step's messages
+ * reach the log as they happen, through `args.compact`), the typed record
+ * (`args.record` — the approval as a fact, and each step transition), and the
+ * checkpoint (see `execute.ts` for what that one actually covers). After a
+ * crash, a closed terminal, or Ctrl-C — which is a real SIGINT here, because
+ * the TUI releases stdin for the duration of a turn — `--resume` restores the
+ * mode and the history and DESCRIBES the plan; it does not continue it.
+ *
+ * NOT BUILT: a resumable executor. Re-entering `executePlan` at step N on
+ * resume needs three things this turn does not have: a re-entry point that
+ * rebuilds the plan from the record rather than from a `submit_plan` call; a
+ * fresh-consent decision, because the approval was given in another process
+ * against a tree that has since changed (and `[g]`'s grants are gone with
+ * that process, rightly); and a second checkpoint latch, which would split one
+ * undo unit into two. Once the transcript is durable the model can continue
+ * from step N+1 on a one-line nudge — it can see its own plan and every "Do
+ * ONLY step" message that ran — and there is no recorded interruption where
+ * that has failed.
+ *
+ * REVISIT TRIGGER: one observed case where transcript-driven continuation
+ * fails — a resumed session that, told to carry on, redoes a finished step or
+ * cannot tell where it stopped. Until then the record is the deliverable.
  */
 /** Default cap on plan revisions before failing loud. */
 export const MAX_PLAN_REVISIONS = 3;
@@ -82,6 +109,7 @@ export async function runPlanSession(args) {
             router: args.router,
             taskClass: "plan",
             onRequestUsage: args.onRequestUsage,
+            compact: args.compact,
         }));
         if (!holder.plan) {
             // NO PLAN IS NOT A FAILURE. The propose phase's registry is read-only plus
@@ -121,14 +149,18 @@ export async function runPlanSession(args) {
             if (decision.kind === "approve-grant") {
                 args.planPolicy.enableSafeStepGrants();
             }
+            // The approval, recorded as a fact (plan-durability): which choice, and
+            // the steps it covered. Written before the first step runs, so a plan
+            // that dies in step 1 still has its approval on disk.
+            args.record?.planApproved(decision.kind, plan.steps.map((s) => ({ id: s.id, title: s.title, kind: s.kind })));
             // Execute step-by-step, driving one agent turn per step against the full
             // registry. Each step's actions still pass through the U.3 gate.
             const runStep = async (step) => {
-                messages.push({
-                    role: "user",
-                    content: `The plan is approved. Do ONLY step ${step.id}: ${step.title}. ${step.rationale} ` +
-                        "Do not start any other step. When this step is complete, stop.",
-                });
+                // The scoping instruction plus the whole plan's current statuses
+                // (plan-durability): the executor has already marked this step
+                // `running` and every earlier one `done` or `failed`, so the message
+                // says which — see `step-message.ts` for why the failed case matters.
+                messages.push({ role: "user", content: stepInstruction(plan, step) });
                 accumulate(await runAgent({
                     messages,
                     provider: args.provider,
@@ -142,12 +174,17 @@ export async function runPlanSession(args) {
                     router: args.router,
                     taskClass: "main-turn",
                     onRequestUsage: args.onRequestUsage,
+                    // The step message pushed above reaches the log at this loop's
+                    // first iteration, BEFORE the step's first model call — so a step
+                    // that dies still leaves on disk which step it was.
+                    compact: args.compact,
                 }));
             };
             await executePlan(plan, {
                 runStep,
                 io: args.io,
                 renderer: args.renderer,
+                record: (step) => args.record?.planStep(step.id, step.status),
             });
             return finish();
         }

package/dist/plan/step-message.js

@@ -0,0 +1,49 @@
+/**
+ * The per-step instruction the executor sends the model (plan-durability).
+ *
+ * The first paragraph is the C.31 scoping instruction, unchanged: do this one
+ * step, nothing else, then stop. What follows it is new — the whole plan with
+ * each step's CURRENT status — and it exists because of what the model could
+ * not see without it.
+ *
+ * The model already has the plan: its own `submit_plan` call sits in the
+ * history with every step as the tool input. What it never had was status. A
+ * step that failed and that the user chose to continue past (`[c]` at the
+ * failure prompt) was followed by exactly the same message a successful step
+ * was — "Do ONLY step N+1" — so the model walked into step N+1 believing step N
+ * had landed, and built on work that was not there. The block below makes a
+ * failed step read as failed, in the message that asks for the next one.
+ *
+ * This is a prompt change, not a tool: no schema, no new tool, and no change to
+ * the tool set between phases (the prefix-cache argument in cli#150). It is
+ * appended to EVERY step message, a one-step plan included, so the shape the
+ * model learns is the same shape every time rather than one that appears from
+ * step 2 on. Plain words rather than the renderer's glyphs, because the reader
+ * here is the model and the status has to survive as text.
+ */
+export function stepInstruction(plan, step) {
+    const head = `The plan is approved. Do ONLY step ${step.id}: ${step.title}. ${step.rationale} ` +
+        "Do not start any other step. When this step is complete, stop.";
+    const n = plan.steps.length;
+    const lines = plan.steps.map((s) => `  ${s.id}. ${statusLabel(s, step)} — ${s.title}`);
+    return `${head}\n\nPlan status (${n} step${n === 1 ? "" : "s"}):\n${lines.join("\n")}`;
+}
+/**
+ * One step's status as the model should read it. `failed` is the label that
+ * matters: it names the user's decision, so the model knows the step was not
+ * skipped by accident and is not going to be retried by the executor.
+ */
+function statusLabel(s, current) {
+    if (s.id === current.id)
+        return "this step";
+    switch (s.status) {
+        case "done":
+            return "done";
+        case "failed":
+            return "FAILED — the user chose to continue past it; do not assume its work exists";
+        case "running":
+            return "running";
+        case "pending":
+            return "pending";
+    }
+}

package/dist/render/context-view.js

@@ -49,7 +49,9 @@ function share(tokens, of) {
  * a table into a misaligned mess; the default is unbounded for callers that
  * reflow themselves (the TUI's main column).
  */
-export function contextReportLines(report, t, width = Infinity) {
+export function contextReportLines(report, t, width = Infinity, 
+/** What compaction has cost so far (P3); omitted → the section is left out. */
+tally) {
     const { reading, compaction } = report;
     const lines = [t.heading("context")];
     // The headline, worded exactly as the panel words it — same estimate, same
@@ -88,6 +90,13 @@ export function contextReportLines(report, t, width = Infinity) {
             lines.push(`${head}${c.excerpt === "" ? "" : t.muted(` — ${c.excerpt}`)}`);
         }
     }
+    // ── what compaction has cost so far (P3) ──────────────────────────────────
+    if (tally) {
+        lines.push("");
+        lines.push(t.strong("compaction so far"));
+        const so = compactionTallyLines(tally, t, "  ");
+        lines.push(...(so.length > 0 ? so : [t.muted("  none yet this session")]));
+    }
     // ── what compaction would do ──────────────────────────────────────────────
     lines.push("");
     lines.push(t.strong("if you compact now"));
@@ -113,3 +122,37 @@ export function contextReportLines(report, t, width = Infinity) {
         ? lines.map((l) => fit(l, width, t.glyph.ellipsis))
         : lines;
 }
+/**
+ * What compaction has cost a session (P3 context quality), as lines — the
+ * one renderer behind `/context`'s "compaction so far" and the one-shot
+ * summary, so both describe the tally the same way. Empty when nothing has
+ * compacted: the one-shot prints nothing, `/context` says "none yet".
+ *
+ * The sums cover only the compactions that recorded a cost; when that is
+ * fewer than the count (a log written before P3), the line says so rather
+ * than presenting a partial sum as the whole. A suspected instruction loss is
+ * a WARNING line: it is the one figure here a user should act on.
+ */
+export function compactionTallyLines(tally, t, indent = "") {
+    if (tally.count === 0)
+        return [];
+    const lines = [];
+    const key = t.strong("compaction");
+    const times = `${tally.count} time${tally.count === 1 ? "" : "s"}`;
+    if (tally.measured === 0) {
+        lines.push(`${indent}${key} ${times} ${t.muted("(cost not recorded — written before it was measured)")}`);
+    }
+    else {
+        const scope = tally.measured < tally.count
+            ? t.muted(` (${tally.count - tally.measured} recorded no cost)`)
+            : "";
+        lines.push(`${indent}${key} ${times}${t.sep}freed ${approx(tally.freedTokens)}${t.sep}` +
+            t.muted(`summaries cost ${approx(tally.summaryInputTokens)} in / ${approx(tally.summaryOutputTokens)} out`) +
+            scope);
+    }
+    if (tally.instructionLosses > 0) {
+        const n = tally.instructionLosses;
+        lines.push(`${indent}${t.warning(`${n} compaction${n === 1 ? "" : "s"} may have dropped an instruction you gave — restate any that still apply`)}`);
+    }
+    return lines;
+}

package/dist/render/status-view.js

@@ -1,6 +1,7 @@
 import { capacityLevel, formatCapacity, } from "../utils/disk.js";
 import { fit } from "./layout.js";
 import { formatTokens } from "./state.js";
+import { formatDuration } from "./test-view.js";
 /** `key  value`, aligned on a fixed gutter so the column is scannable. */
 function row(key, value, t) {
     return `  ${t.muted(key.padEnd(11))} ${value}`;
@@ -96,6 +97,18 @@ export function sessionStatusLines(status, t, width = Infinity) {
         lines.push(row("jobs", detail, t));
     }
     lines.push(row("tools", t.muted(`${status.tools} available to the model`), t));
+    // What last ran and how it exited, dated — the record's answer to "was
+    // this verified", which is the reader's question to settle, not this
+    // row's. "none recorded" is said out loud rather than omitted.
+    if (status.verification) {
+        const v = status.verification;
+        const exit = v.exitCode === null ? "no exit code" : `exit ${v.exitCode}`;
+        lines.push(row("verify", `${t.muted(v.tool)} ${v.command} ${t.glyph.arrow} ${v.passed ? t.muted(exit) : t.danger(exit)} ` +
+            t.muted(`(${formatDuration(v.durationMs)}) ${t.glyph.sep} ${v.age}`), t));
+    }
+    else {
+        lines.push(row("verify", t.warning("none recorded this session"), t));
+    }
     // Roots last: one line each, so a multi-root session shows which repo each
     // change lands in — the fact the startup banner states once and then loses.
     lines.push("");

package/dist/session/index.js

@@ -7,18 +7,21 @@
  *    cruxy's fields never make an older one discard a session;
  *  - `log.ts` — the writer: one line per event, `0600`, non-fatal on failure;
  *  - `replay.ts` — the fold back to state, tolerant of torn/unknown lines;
+ *  - `recorded-runs.ts` — an ended session's verification record, for
+ *    `cruxy pr` (P2 verification);
  *  - `list.ts` — what the picker and the TUI sidebar both read;
  *  - `prune.ts` — retention: what the tree is allowed to keep (#257);
  *  - `resume.ts` — `--resume <id>` and the bare-`--resume` picker;
  *  - `paths.ts` — the layout, including the subtrees reserved for P3+.
  */
 export { PROJECTS_DIR_NAME, RESERVED_SUBDIRS, SESSION_FILE_EXT, projectDir, projectKey, projectsDir, reservedDir, sessionFile, } from "./paths.js";
-export { SessionLog } from "./log.js";
+export { SessionLog, } from "./log.js";
 export { claimSession, describeHolder, ownerFile, readOwner, releaseSession, removeOwnerFile, sessionHeldBy, } from "./owner.js";
 export { defaultExportName, exportMarkdown, } from "./export.js";
 export { foldEvents, readEvents, readMeta, replaySession } from "./replay.js";
+export { latestRecordedRuns, recordedRuns } from "./recorded-runs.js";
 export { redactMessages } from "./redact.js";
 export { findSession, isAmbiguous, listSessionRefs, listSessions, matchSessionRefs, sessionFilesByRecency, summarizeSession, } from "./list.js";
 export { pruneSessions, } from "./prune.js";
-export { cwdMismatchWarning, describeSession, loadResume, priorDirectoriesWarning, relativeAge, resolveSessionId, resumeById, resumePicker, shortId, PICKER_LIMIT, } from "./resume.js";
-export { KNOWN_EVENT_KINDS, SESSION_FILE_VERSION, ResumedEventSchema, SessionEventSchema, SessionMetaSchema, } from "./types.js";
+export { cwdMismatchWarning, describeCompactions, describeSession, loadResume, priorDirectoriesWarning, relativeAge, resolveSessionId, resumeById, resumePicker, shortId, PICKER_LIMIT, } from "./resume.js";
+export { KNOWN_EVENT_KINDS, SESSION_FILE_VERSION, emptyCompactionTally, ExternalChangeEventSchema, InstructionLossEventSchema, ResumedEventSchema, SessionEventSchema, SessionMetaSchema, VerificationEventSchema, } from "./types.js";

package/dist/session/log.js

@@ -5,6 +5,7 @@ import { formatBytes } from "../utils/disk.js";
 import { sessionFile } from "./paths.js";
 import { claimSession, describeHolder, releaseSession, sessionHeldBy, } from "./owner.js";
 import { pruneSessions } from "./prune.js";
+import { MAX_FAILURE_NAMES } from "../verification/types.js";
 import { SESSION_FILE_VERSION, } from "./types.js";
 /**
  * How many pruned sessions is worth telling the user about unprompted.
@@ -124,14 +125,44 @@ export class SessionLog {
             messages,
         });
     }
-    /** An older prefix of `replaced` messages was folded into `summary`. */
-    compaction(replaced, summary) {
+    /**
+     * An older prefix of `replaced` messages was folded into `summary`. `cost`
+     * (P3 context quality) is what the compaction cost — the estimates either
+     * side of it and the summarize call's reported usage; the usage halves are
+     * omitted, not zeroed, when the provider reported nothing.
+     */
+    compaction(replaced, summary, cost) {
         this.write({
             kind: "compaction",
             at: new Date().toISOString(),
             ...this.runId(),
             replaced,
             summary,
+            ...(cost
+                ? {
+                    estimatedBefore: cost.estimatedBefore,
+                    estimatedAfter: cost.estimatedAfter,
+                    ...(cost.summaryInputTokens !== undefined
+                        ? { summaryInputTokens: cost.summaryInputTokens }
+                        : {}),
+                    ...(cost.summaryOutputTokens !== undefined
+                        ? { summaryOutputTokens: cost.summaryOutputTokens }
+                        : {}),
+                }
+                : {}),
+        });
+    }
+    /**
+     * A compaction after which the user's instructions could not all be found
+     * in the synopsis (P3 context quality) — the heuristic's finding, recorded
+     * so it can be audited after the fact. Bounded by the detector, not here.
+     */
+    instructionLoss(sentences) {
+        this.write({
+            kind: "instruction-loss",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            sentences,
         });
     }
     /** `/clear` — history dropped, session kept. */
@@ -146,6 +177,30 @@ export class SessionLog {
     mode(mode) {
         this.write({ kind: "mode", at: new Date().toISOString(), mode });
     }
+    /**
+     * The user approved a plan (plan-durability): the decision kind and the
+     * steps as approved. A fact about the session, dated — see the schema for
+     * why it is recorded and why a resume never acts on it.
+     */
+    planApproved(decision, steps) {
+        this.write({
+            kind: "plan-approved",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            decision,
+            steps: steps.map((s) => ({ id: s.id, title: s.title, kind: s.kind })),
+        });
+    }
+    /** One step of the approved plan changed status (plan-durability). */
+    planStep(stepId, status) {
+        this.write({
+            kind: "plan-step",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            stepId,
+            status,
+        });
+    }
     /**
      * One turn's token usage. Copied here rather than referenced, because the
      * usage store keeps only its newest 50 runs while a session keeps its own
@@ -182,6 +237,46 @@ export class SessionLog {
             count,
         });
     }
+    /**
+     * One observation (P2 verification): a run that actually executed, or a
+     * write refused because its target moved. Written as its own event kind so
+     * the fold treats the two apart, and stamped with the turn's run id like
+     * every other per-turn event, so "what ran in the turn `cruxy rollback <id>`
+     * would undo" is one join, not a guess.
+     *
+     * The failure NAMES are bounded and the output is not copied: the `append`
+     * event already holds the tool_result the model saw. This is an index over
+     * what happened.
+     */
+    observe(obs) {
+        const at = new Date().toISOString();
+        if (obs.kind === "verification") {
+            this.write({
+                kind: "verification",
+                at,
+                ...this.runId(),
+                tool: obs.tool,
+                command: obs.command,
+                ...(obs.source !== undefined ? { source: obs.source } : {}),
+                passed: obs.passed,
+                exitCode: obs.exitCode,
+                durationMs: obs.durationMs,
+                ...(obs.total !== undefined ? { total: obs.total } : {}),
+                failureCount: obs.failureCount,
+                failureNames: obs.failureNames.slice(0, MAX_FAILURE_NAMES),
+                outputTruncated: obs.outputTruncated,
+                substrate: obs.substrate,
+            });
+            return;
+        }
+        this.write({
+            kind: "external-change",
+            at,
+            ...this.runId(),
+            path: obs.path,
+            what: obs.what,
+        });
+    }
     /**
      * Enforce retention for this project, once, as this session opens.
      *

package/dist/session/recorded-runs.js

@@ -0,0 +1,56 @@
+import path from "node:path";
+import { sessionFilesByRecency } from "./list.js";
+import { readEvents, readMeta } from "./replay.js";
+/**
+ * The verification record of a session that has ENDED, read back from its log
+ * (P2 verification). `cruxy pr` runs outside any session, so there is no
+ * ledger in the process; the log is the durable side of the same record, and
+ * the runs it holds are the evidence there is for a PR opened from here.
+ *
+ * Every `verification` event is returned, in the order it was written — the
+ * fold in `replay.ts` keeps only the LAST run (what `/status` shows after a
+ * resume); a PR body lists them all. Nothing is filtered by content or age:
+ * each run carries its timestamp, and the reader judges whether a run from
+ * before the last edit still counts.
+ */
+export function recordedRuns(file) {
+    const runs = [];
+    for (const event of readEvents(file).events) {
+        if (event.kind !== "verification")
+            continue;
+        runs.push({
+            at: event.at,
+            tool: event.tool,
+            command: event.command,
+            ...(event.source !== undefined ? { source: event.source } : {}),
+            passed: event.passed,
+            exitCode: event.exitCode,
+            durationMs: event.durationMs,
+            ...(event.total !== undefined ? { total: event.total } : {}),
+            failureCount: event.failureCount,
+            failureNames: event.failureNames,
+            outputTruncated: event.outputTruncated,
+            substrate: event.substrate,
+        });
+    }
+    return runs;
+}
+/**
+ * The NEWEST session for `cwd` and the runs it recorded, or null when the
+ * project has no session whose meta names this directory (`projectKey` can
+ * collide — `a-b` and `a/b` — so meta.cwd is compared, as resume does).
+ *
+ * The newest session, not the newest session that ran something: if the last
+ * thing done here recorded no runs, the honest answer is no section, not the
+ * runs of an older session cherry-picked because it has some.
+ */
+export function latestRecordedRuns(cwd) {
+    const here = path.resolve(cwd);
+    for (const ref of sessionFilesByRecency(cwd)) {
+        const meta = readMeta(ref.file);
+        if (!meta || path.resolve(meta.cwd) !== here)
+            continue;
+        return { sessionId: meta.sessionId, runs: recordedRuns(ref.file) };
+    }
+    return null;
+}