@cruxy/cli 1.11.2 → 1.11.4

package/dist/session/log.js

@@ -5,6 +5,7 @@ import { formatBytes } from "../utils/disk.js";
 import { sessionFile } from "./paths.js";
 import { claimSession, describeHolder, releaseSession, sessionHeldBy, } from "./owner.js";
 import { pruneSessions } from "./prune.js";
+import { MAX_FAILURE_NAMES } from "../verification/types.js";
 import { SESSION_FILE_VERSION, } from "./types.js";
 /**
  * How many pruned sessions is worth telling the user about unprompted.
@@ -124,14 +125,44 @@ export class SessionLog {
             messages,
         });
     }
-    /** An older prefix of `replaced` messages was folded into `summary`. */
-    compaction(replaced, summary) {
+    /**
+     * An older prefix of `replaced` messages was folded into `summary`. `cost`
+     * (P3 context quality) is what the compaction cost — the estimates either
+     * side of it and the summarize call's reported usage; the usage halves are
+     * omitted, not zeroed, when the provider reported nothing.
+     */
+    compaction(replaced, summary, cost) {
         this.write({
             kind: "compaction",
             at: new Date().toISOString(),
             ...this.runId(),
             replaced,
             summary,
+            ...(cost
+                ? {
+                    estimatedBefore: cost.estimatedBefore,
+                    estimatedAfter: cost.estimatedAfter,
+                    ...(cost.summaryInputTokens !== undefined
+                        ? { summaryInputTokens: cost.summaryInputTokens }
+                        : {}),
+                    ...(cost.summaryOutputTokens !== undefined
+                        ? { summaryOutputTokens: cost.summaryOutputTokens }
+                        : {}),
+                }
+                : {}),
+        });
+    }
+    /**
+     * A compaction after which the user's instructions could not all be found
+     * in the synopsis (P3 context quality) — the heuristic's finding, recorded
+     * so it can be audited after the fact. Bounded by the detector, not here.
+     */
+    instructionLoss(sentences) {
+        this.write({
+            kind: "instruction-loss",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            sentences,
         });
     }
     /** `/clear` — history dropped, session kept. */
@@ -146,6 +177,30 @@ export class SessionLog {
     mode(mode) {
         this.write({ kind: "mode", at: new Date().toISOString(), mode });
     }
+    /**
+     * The user approved a plan (plan-durability): the decision kind and the
+     * steps as approved. A fact about the session, dated — see the schema for
+     * why it is recorded and why a resume never acts on it.
+     */
+    planApproved(decision, steps) {
+        this.write({
+            kind: "plan-approved",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            decision,
+            steps: steps.map((s) => ({ id: s.id, title: s.title, kind: s.kind })),
+        });
+    }
+    /** One step of the approved plan changed status (plan-durability). */
+    planStep(stepId, status) {
+        this.write({
+            kind: "plan-step",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            stepId,
+            status,
+        });
+    }
     /**
      * One turn's token usage. Copied here rather than referenced, because the
      * usage store keeps only its newest 50 runs while a session keeps its own
@@ -182,6 +237,46 @@ export class SessionLog {
             count,
         });
     }
+    /**
+     * One observation (P2 verification): a run that actually executed, or a
+     * write refused because its target moved. Written as its own event kind so
+     * the fold treats the two apart, and stamped with the turn's run id like
+     * every other per-turn event, so "what ran in the turn `cruxy rollback <id>`
+     * would undo" is one join, not a guess.
+     *
+     * The failure NAMES are bounded and the output is not copied: the `append`
+     * event already holds the tool_result the model saw. This is an index over
+     * what happened.
+     */
+    observe(obs) {
+        const at = new Date().toISOString();
+        if (obs.kind === "verification") {
+            this.write({
+                kind: "verification",
+                at,
+                ...this.runId(),
+                tool: obs.tool,
+                command: obs.command,
+                ...(obs.source !== undefined ? { source: obs.source } : {}),
+                passed: obs.passed,
+                exitCode: obs.exitCode,
+                durationMs: obs.durationMs,
+                ...(obs.total !== undefined ? { total: obs.total } : {}),
+                failureCount: obs.failureCount,
+                failureNames: obs.failureNames.slice(0, MAX_FAILURE_NAMES),
+                outputTruncated: obs.outputTruncated,
+                substrate: obs.substrate,
+            });
+            return;
+        }
+        this.write({
+            kind: "external-change",
+            at,
+            ...this.runId(),
+            path: obs.path,
+            what: obs.what,
+        });
+    }
     /**
      * Enforce retention for this project, once, as this session opens.
      *

package/dist/session/recorded-runs.js

@@ -0,0 +1,56 @@
+import path from "node:path";
+import { sessionFilesByRecency } from "./list.js";
+import { readEvents, readMeta } from "./replay.js";
+/**
+ * The verification record of a session that has ENDED, read back from its log
+ * (P2 verification). `cruxy pr` runs outside any session, so there is no
+ * ledger in the process; the log is the durable side of the same record, and
+ * the runs it holds are the evidence there is for a PR opened from here.
+ *
+ * Every `verification` event is returned, in the order it was written — the
+ * fold in `replay.ts` keeps only the LAST run (what `/status` shows after a
+ * resume); a PR body lists them all. Nothing is filtered by content or age:
+ * each run carries its timestamp, and the reader judges whether a run from
+ * before the last edit still counts.
+ */
+export function recordedRuns(file) {
+    const runs = [];
+    for (const event of readEvents(file).events) {
+        if (event.kind !== "verification")
+            continue;
+        runs.push({
+            at: event.at,
+            tool: event.tool,
+            command: event.command,
+            ...(event.source !== undefined ? { source: event.source } : {}),
+            passed: event.passed,
+            exitCode: event.exitCode,
+            durationMs: event.durationMs,
+            ...(event.total !== undefined ? { total: event.total } : {}),
+            failureCount: event.failureCount,
+            failureNames: event.failureNames,
+            outputTruncated: event.outputTruncated,
+            substrate: event.substrate,
+        });
+    }
+    return runs;
+}
+/**
+ * The NEWEST session for `cwd` and the runs it recorded, or null when the
+ * project has no session whose meta names this directory (`projectKey` can
+ * collide — `a-b` and `a/b` — so meta.cwd is compared, as resume does).
+ *
+ * The newest session, not the newest session that ran something: if the last
+ * thing done here recorded no runs, the honest answer is no section, not the
+ * runs of an older session cherry-picked because it has some.
+ */
+export function latestRecordedRuns(cwd) {
+    const here = path.resolve(cwd);
+    for (const ref of sessionFilesByRecency(cwd)) {
+        const meta = readMeta(ref.file);
+        if (!meta || path.resolve(meta.cwd) !== here)
+            continue;
+        return { sessionId: meta.sessionId, runs: recordedRuns(ref.file) };
+    }
+    return null;
+}

package/dist/session/replay.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { modeFromFlags } from "../agent/mode.js";
 import { redactMessages } from "./redact.js";
-import { KNOWN_EVENT_KINDS, SessionEventSchema, SessionMetaSchema, } from "./types.js";
+import { KNOWN_EVENT_KINDS, SessionEventSchema, SessionMetaSchema, emptyCompactionTally, } from "./types.js";
 /**
  * Replay: fold an append-only event log back into the state a session needs to
  * resume (P2).
@@ -109,6 +109,10 @@ export function foldEvents(events, counts = {}) {
     let planMode = false;
     let mode = null;
     let redactions = 0;
+    let lastVerification;
+    let externalChanges = 0;
+    let plan;
+    const compactions = emptyCompactionTally();
     const resumes = [];
     const usage = { input_tokens: 0, output_tokens: 0 };
     for (const event of events) {
@@ -123,6 +127,22 @@ export function foldEvents(events, counts = {}) {
                     ...asMessages(event.summary),
                     ...messages.slice(event.replaced),
                 ];
+                // And tallied (P3): the count is the events; the sums cover only the
+                // events that carry a cost, so a pre-P3 compaction counts as one that
+                // happened and not as one that freed nothing.
+                compactions.count++;
+                if (event.estimatedBefore !== undefined &&
+                    event.estimatedAfter !== undefined) {
+                    compactions.measured++;
+                    compactions.freedTokens += Math.max(0, event.estimatedBefore - event.estimatedAfter);
+                    compactions.summaryInputTokens += event.summaryInputTokens ?? 0;
+                    compactions.summaryOutputTokens += event.summaryOutputTokens ?? 0;
+                }
+                break;
+            case "instruction-loss":
+                // Counted, not folded: the synopsis is already in the history as the
+                // model sees it. This is the fact that it may be missing something.
+                compactions.instructionLosses++;
                 break;
             case "clear":
                 messages = [];
@@ -156,6 +176,56 @@ export function foldEvents(events, counts = {}) {
                 // could be added without touching `meta` or the message array.
                 resumes.push({ at: event.at, cwd: event.cwd });
                 break;
+            case "verification":
+                // Last-writer-wins, and never folded into the messages: a run is a
+                // fact ABOUT the turn, not a turn in it. The tool_result the model saw
+                // is already in the `append` events; this is the structured claim.
+                lastVerification = {
+                    at: event.at,
+                    tool: event.tool,
+                    command: event.command,
+                    ...(event.source !== undefined ? { source: event.source } : {}),
+                    passed: event.passed,
+                    exitCode: event.exitCode,
+                    durationMs: event.durationMs,
+                    ...(event.total !== undefined ? { total: event.total } : {}),
+                    failureCount: event.failureCount,
+                    failureNames: event.failureNames,
+                    outputTruncated: event.outputTruncated,
+                    substrate: event.substrate,
+                };
+                break;
+            case "external-change":
+                // Counted, not folded: the refusal wrote nothing, so there is nothing
+                // in the history to adjust — only a fact for the resume notice.
+                externalChanges++;
+                break;
+            case "plan-approved":
+                // A new approval replaces the last: every step starts `pending`, as
+                // the executor had it, and the `plan-step` events that follow move
+                // them. Never folded into the messages — the plan's text is already
+                // there as the model's own `submit_plan` call.
+                plan = {
+                    approvedAt: event.at,
+                    decision: event.decision,
+                    steps: event.steps.map((s) => ({
+                        id: s.id,
+                        title: s.title,
+                        kind: s.kind,
+                        status: "pending",
+                    })),
+                };
+                break;
+            case "plan-step": {
+                // A transition for a step the last approval did not name is skipped,
+                // not an error: a torn `plan-approved` line, or a newer build's
+                // vocabulary. Position matters — a step left `running` is one whose
+                // outcome the log never received.
+                const step = plan?.steps.find((s) => s.id === event.stepId);
+                if (step)
+                    step.status = event.status;
+                break;
+            }
             case "meta":
                 break;
         }
@@ -172,6 +242,10 @@ export function foldEvents(events, counts = {}) {
         unknownEvents: counts.unknownEvents ?? 0,
         resumes,
         redactions,
+        ...(lastVerification ? { lastVerification } : {}),
+        externalChanges,
+        compactions,
+        ...(plan ? { plan } : {}),
     };
 }
 /** Read and parse a session file into its events, counting unusable lines. */

package/dist/session/resume.js

@@ -1,3 +1,4 @@
+import { formatTokens } from "../render/state.js";
 import { selectList } from "../components/index.js";
 import { usageError } from "../errors/index.js";
 import { listSessionRefs, listSessions, matchSessionRefs, summarizeSession, } from "./list.js";
@@ -127,8 +128,95 @@ export function loadResume(session, cwd) {
         warnings.push(`this session was redacted ${state.redactions === 1 ? "once" : `${state.redactions} times`} — ` +
             `secrets are masked in the restored history, but the original text is still in ${session.file}`);
     }
+    if (state.externalChanges > 0) {
+        // A refused write is a fact about the user's TREE, not about cruxy: while
+        // they were being asked to approve a change, something else wrote to the
+        // file. It reached the model as an error at the time; on resume it is
+        // said once more, because "was my tree written to by something else"
+        // is a question people ask after the fact.
+        warnings.push(`${state.externalChanges} write${state.externalChanges === 1 ? " was" : "s were"} refused in this session ` +
+            `because the file changed on disk while awaiting approval — nothing was written by cruxy; ` +
+            `the session log names each path`);
+    }
+    if (state.compactions.count > 0) {
+        // What compaction has cost this conversation (P3 context quality), said
+        // once on resume because it is the moment a user decides whether to
+        // continue in a history that has been summarised N times. The freed and
+        // spent figures cover only the compactions that recorded them; the clause
+        // saying so is not optional when they differ.
+        warnings.push(describeCompactions(state.compactions));
+    }
+    if (state.compactions.instructionLosses > 0) {
+        // The heuristic's finding, restated where it can still be acted on: the
+        // sentences are in the session log; the remedy is to say them again.
+        const n = state.compactions.instructionLosses;
+        warnings.push(`${n} compaction${n === 1 ? "" : "s"} in this session may have dropped an instruction you gave — ` +
+            `the session log names the sentences; restate anything that still applies`);
+    }
+    if (state.lastVerification) {
+        // Not a warning in spirit, but this is the one channel a resume has, and
+        // the sentence is the same one `/status` shows: what last ran and how it
+        // exited, dated. A resumed session's "the tests passed" is a claim about
+        // the tree as it was THEN; the age is what keeps it honest.
+        const v = state.lastVerification;
+        const exit = v.exitCode === null ? "no exit code" : `exit ${v.exitCode}`;
+        warnings.push(`last verification ${relativeAge(v.at)}: ${v.tool} \`${v.command}\` → ${exit}`);
+    }
+    if (state.plan) {
+        // The last approved plan and where it got to (plan-durability). Same
+        // channel, same reasoning as the verification line: a fact the user
+        // decides on before continuing. The sentence ends by saying the approval
+        // is not carried over, because the one thing a reader of "approved" might
+        // reasonably expect is that the consent came back with the session.
+        warnings.push(describePlan(state.plan));
+    }
     return { session, state, warnings };
 }
+/**
+ * One sentence for the last approved plan (plan-durability): when it was
+ * approved and how, how many steps finished, which failed, and — the fact a
+ * resume exists to surface — whether a step was still running when the
+ * session ended. Says in so many words that the approval is not carried over:
+ * `[g]`'s grants lived in the allowlist of the process that asked, and this
+ * process has not asked.
+ */
+export function describePlan(p, now = Date.now()) {
+    const n = p.steps.length;
+    const count = (status) => p.steps.filter((s) => s.status === status).length;
+    const done = count("done");
+    const failed = count("failed");
+    const pending = count("pending");
+    const running = p.steps.find((s) => s.status === "running");
+    const how = p.decision === "approve-grant"
+        ? "with safe steps auto-allowed"
+        : "step by step";
+    const parts = [`${done}/${n} step${n === 1 ? "" : "s"} done`];
+    if (failed > 0)
+        parts.push(`${failed} failed`);
+    if (running) {
+        parts.push(`step ${running.id} (${running.title}) was still running when the session ended`);
+    }
+    if (pending > 0)
+        parts.push(`${pending} never started`);
+    return (`last plan approved ${relativeAge(p.approvedAt, now)} ${how}: ${parts.join(", ")} — ` +
+        `that approval is not carried into this session; every action asks again`);
+}
+/**
+ * One sentence for what compaction has cost a session (P3 context quality).
+ * Shared by the resume notice and nothing else; `/context` and the one-shot
+ * summary render the same tally as lines (`render/context-view.ts`).
+ */
+export function describeCompactions(c) {
+    const times = `compacted ${c.count === 1 ? "once" : `${c.count} times`} in this session`;
+    if (c.measured === 0) {
+        return `${times} — cost not recorded (written before it was measured)`;
+    }
+    const scope = c.measured < c.count
+        ? ` (${c.count - c.measured} of them recorded no cost)`
+        : "";
+    return (`${times} — freed ~${formatTokens(c.freedTokens)} tokens; ` +
+        `the summaries cost ~${formatTokens(c.summaryInputTokens)} in / ~${formatTokens(c.summaryOutputTokens)} out${scope}`);
+}
 /**
  * VALIDATE `--resume <id>` — which session does this name? — without loading it.
  *

package/dist/session/types.js

@@ -154,6 +154,43 @@ export const CompactionEventSchema = z
     replaced: z.number().int().nonnegative(),
     /** What replaced them (the synthetic pair). */
     summary: z.array(MessageSchema),
+    /**
+     * What the compaction COST (P3 context quality) — the four facts in hand
+     * at the write site and, until P3, thrown away there. All optional: a log
+     * written before P3 carries none, and absence means "not measured", never
+     * zero. Freed tokens is `estimatedBefore - estimatedAfter` and is NOT
+     * stored — one derivation, in the fold, rather than a fifth field that
+     * could disagree with the other two.
+     *
+     * The estimates are `estimateTokens` over the history — the same chars/4
+     * heuristic the trigger uses — WITHOUT the fixed reserve, which is a
+     * setting and would cancel out of the difference anyway.
+     */
+    estimatedBefore: z.number().int().nonnegative().optional(),
+    estimatedAfter: z.number().int().nonnegative().optional(),
+    /**
+     * The summarize call's own usage, as the provider reported it. Absent
+     * when the provider reported nothing — the same honesty rule as the usage
+     * record: unknown is not zero.
+     */
+    summaryInputTokens: z.number().int().nonnegative().optional(),
+    summaryOutputTokens: z.number().int().nonnegative().optional(),
+})
+    .passthrough();
+/**
+ * A compaction after which the user's instructions could not all be found in
+ * the synopsis (P3 context quality). Written by the heuristic in
+ * `agent/instruction-loss.ts`, which can be wrong both ways and says so; the
+ * event is what makes a suspected loss auditable after the fact instead of a
+ * warning that scrolled away. `sentences` are the user's own words, bounded
+ * and truncated — enough to recognise what may need restating.
+ */
+export const InstructionLossEventSchema = z
+    .object({
+    kind: z.literal("instruction-loss"),
+    at: z.string(),
+    runId: z.string().optional(),
+    sentences: z.array(z.string()),
 })
     .passthrough();
 /** `/clear`: history dropped, session kept. Replay resets to an empty array. */
@@ -283,6 +320,111 @@ export const ResumedEventSchema = z
     cliVersion: z.string().optional(),
 })
     .passthrough();
+/**
+ * One run that ACTUALLY EXECUTED (P2 verification): `run_tests`, or a
+ * `run_command` the model chose. An index over what happened, keyed to the
+ * turn it happened in — NOT a copy of the run's output. The `append` event
+ * already holds the tool_result the model saw, as the string built for the
+ * model; this is the structured claim beside it, written from the same
+ * object the tool built rather than re-parsed from that string (the same
+ * reasoning as the `run_tests` renderer side channel, P3).
+ *
+ * `passed` is the exit code and nothing else. `tool` and `source` are plain
+ * strings so a newer build's tool or provenance parses here instead of
+ * poisoning the line. A refused attempt, a denied approval or a spawn failure
+ * ran nothing, so no event is written for it — writing one would be a
+ * fabrication.
+ *
+ * Evidence, not enforcement: nothing reads this to decide whether a turn may
+ * end. See `verification/types.ts` for why that decision stands.
+ */
+export const VerificationEventSchema = z
+    .object({
+    kind: z.literal("verification"),
+    at: z.string(),
+    runId: z.string().optional(),
+    tool: z.string(),
+    command: z.string(),
+    source: z.string().optional(),
+    passed: z.boolean(),
+    exitCode: z.number().int().nullable(),
+    durationMs: z.number().nonnegative(),
+    total: z.number().int().nonnegative().optional(),
+    failureCount: z.number().int().nonnegative().default(0),
+    failureNames: z.array(z.string()).default([]),
+    outputTruncated: z.boolean().default(false),
+    substrate: z.string(),
+})
+    .passthrough();
+/**
+ * A write refused because its target moved during the approval wait (P1).
+ *
+ * The refusal itself is an error string handed to the model; before this
+ * event the user learned of it only by opening a rollback preview later.
+ * Something else wrote to a file in their tree while they were being asked to
+ * approve a change to it, and that is recorded here as a fact about the
+ * session — separate from `verification` so the fold never mistakes one for
+ * the other. No content is recorded: the path and what moved are the whole
+ * fact.
+ */
+export const ExternalChangeEventSchema = z
+    .object({
+    kind: z.literal("external-change"),
+    at: z.string(),
+    runId: z.string().optional(),
+    path: z.string(),
+    what: z.string(),
+})
+    .passthrough();
+/**
+ * The user approved a plan (plan-durability).
+ *
+ * Recorded as a FACT — the decision kind and the steps as approved, dated —
+ * because it is stronger than the mode toggle, which was already journaled,
+ * and it used to evaporate with the process: the plan lived in a local holder
+ * inside one `runPlanSession` call and nowhere else. The plan's text was
+ * already on disk as the model's own `submit_plan` tool_use; this is the
+ * typed record beside it, the one a reader can fold without parsing a tool
+ * call.
+ *
+ * IT IS NEVER RE-ARMED ON RESUME. `decision: "approve-grant"` says the user
+ * chose `[g]`, which wrote grants into the session allowlist — RAM, in the
+ * process that asked. A resumed session reading this event and restoring
+ * those grants would pre-authorize writes the user consented to in a
+ * different process, against a tree that has since changed. The fold hands
+ * back a description; nothing on the consent side reads it.
+ *
+ * `decision` and `kind` are plain strings so a log written by a newer build
+ * parses here rather than poisoning the line.
+ */
+export const PlanApprovedEventSchema = z
+    .object({
+    kind: z.literal("plan-approved"),
+    at: z.string(),
+    runId: z.string().optional(),
+    /** `approve` or `approve-grant`, as the user chose. */
+    decision: z.string(),
+    steps: z.array(z
+        .object({ id: z.string(), title: z.string(), kind: z.string() })
+        .passthrough()),
+})
+    .passthrough();
+/**
+ * One step of the last approved plan changed status (plan-durability):
+ * `running` when its turn began, `done` or `failed` when it ended. A step
+ * whose last event is `running` is the signature of an interrupted plan —
+ * the process died before the step could report either outcome — and that
+ * is exactly the fact the resume notice needs.
+ */
+export const PlanStepEventSchema = z
+    .object({
+    kind: z.literal("plan-step"),
+    at: z.string(),
+    runId: z.string().optional(),
+    stepId: z.string(),
+    status: z.string(),
+})
+    .passthrough();
 /** Every event, discriminated on `kind`. */
 export const SessionEventSchema = z.discriminatedUnion("kind", [
     SessionMetaSchema,
@@ -294,6 +436,11 @@ export const SessionEventSchema = z.discriminatedUnion("kind", [
     UsageEventSchema,
     RedactEventSchema,
     ResumedEventSchema,
+    VerificationEventSchema,
+    ExternalChangeEventSchema,
+    InstructionLossEventSchema,
+    PlanApprovedEventSchema,
+    PlanStepEventSchema,
 ]);
 /**
  * Every `kind` this build understands, derived from the union itself so the two
@@ -304,3 +451,14 @@ export const SessionEventSchema = z.discriminatedUnion("kind", [
  * they used to be counted as one.
  */
 export const KNOWN_EVENT_KINDS = new Set(SessionEventSchema.options.map((option) => option.shape.kind.value));
+/** A tally with nothing in it — a fresh session, or a log with no compaction. */
+export function emptyCompactionTally() {
+    return {
+        count: 0,
+        measured: 0,
+        freedTokens: 0,
+        summaryInputTokens: 0,
+        summaryOutputTokens: 0,
+        instructionLosses: 0,
+    };
+}

package/dist/testing/run-tests-tool.js

@@ -147,7 +147,9 @@ export function makeRunTestsTool(deps = {}) {
             // The structured result goes to the renderer here, from the same object
             // the payload below is built from — never from re-reading that payload.
             try {
-                deps.onResult?.(result, resolved);
+                deps.onResult?.(result, resolved, {
+                    substrate: ctx.sandbox ? "sandbox" : "host",
+                });
             }
             catch {
                 // A renderer problem is not a test-run problem.

package/dist/tools/create-pull-request.js

@@ -25,7 +25,8 @@ const parameters = z.object({
     body: z
         .string()
         .optional()
-        .describe("PR body in markdown (what changed · why · verification). Omit to auto-generate."),
+        .describe("PR body in markdown (what changed · why). Omit to auto-generate. " +
+        "Do not write a Verification section: it is added from the record of what actually ran this session, and one you write is replaced by it."),
     base: z
         .string()
         .optional()
@@ -58,6 +59,12 @@ export const createPullRequestTool = {
                     ...i,
                     scopes: guidance.scopes,
                     skillBody: guidance.skillBody,
+                    // The PR body's Verification section is the record's (P2): the
+                    // runs this session actually executed, with their exit codes —
+                    // or no such section at all. The model's own body keeps its
+                    // prose; a Verification section it wrote is replaced by this.
+                    // Never a manufactured "ran typecheck + lint + test".
+                    verification: { runs: ctx.verification?.sessionRuns() ?? [] },
                 }),
             });
             const outcome = await service.openPullRequest({

package/dist/tools/file/apply-patch.js

@@ -172,8 +172,12 @@ export const applyPatchTool = {
         const drifted = [];
         for (const p of planned) {
             const moved = await changedSince(p.abs, p.approved, p.rel);
-            if (moved)
-                drifted.push(moved);
+            if (moved) {
+                drifted.push(moved.message);
+                // One record per path that moved (P2 verification): the user learns
+                // which files something else wrote to, not just that the patch failed.
+                ctx.verification?.record({ kind: "external-change", ...moved });
+            }
         }
         if (drifted.length > 0)
             return { ok: false, error: drifted.join("\n") };

package/dist/tools/file/edit-file.js

@@ -76,8 +76,12 @@ export const editFileTool = {
         // changed the file during the wait makes `updated` a splice of stale
         // content — refuse rather than overwrite what is there now (P1).
         const moved = await changedSince(abs, approvedState, input.path);
-        if (moved)
-            return { ok: false, error: moved };
+        if (moved) {
+            // Told to the model as the error, and recorded for the user (P2
+            // verification) — see write-file.ts.
+            ctx.verification?.record({ kind: "external-change", ...moved });
+            return { ok: false, error: moved.message };
+        }
         try {
             await fs.writeFile(abs, updated, "utf8");
             return { ok: true, output: `edited ${input.path}` };

package/dist/tools/file/snapshot.js

@@ -28,8 +28,9 @@ export async function snapshotFile(abs) {
 /**
  * Re-read `abs` and compare it with the state the approval was granted
  * against. Returns `null` when the file is exactly as it was, otherwise the
- * refusal to hand back as the tool's error — one sentence on what moved, and
- * the same next step every time: read it again and retry.
+ * refusal — its `message` is the tool's error (one sentence on what moved,
+ * and the same next step every time: read it again and retry), and its
+ * `path`/`what` are what the tool records so the user learns of it too.
  *
  * Call this AFTER approval and IMMEDIATELY before the write, with nothing
  * awaited in between — the point is to make the gap as small as the platform
@@ -58,6 +59,10 @@ export async function changedSince(abs, approved, rel) {
 }
 /** The one refusal shape: what moved, that nothing was written, what to do. */
 function refusal(rel, what) {
-    return (`${ErrorCode.FileChangedSinceRead}: ${rel} ${what}, so the approval no longer ` +
-        `covers this write; nothing was written — read the file again and retry`);
+    return {
+        path: rel,
+        what,
+        message: `${ErrorCode.FileChangedSinceRead}: ${rel} ${what}, so the approval no longer ` +
+            `covers this write; nothing was written — read the file again and retry`,
+    };
 }