@event4u/agent-config 13.0.0 → 14.1.0

package/src/scripts/hooks/interruption_ledger_hook.ts

@@ -0,0 +1,256 @@
+/**
+ * interruption_ledger — road-to-user-out-of-the-loop Phase 0 Step 1.
+ *
+ * CAPTURE ONLY. Every `stop`, classifies whether the turn that just ended put a
+ * synchronous contact to the user, and appends one line to
+ * `agents/runtime/state/interruptions.jsonl`. It never emits context, never
+ * warns, and always returns 0 — the whole point of Phase 0 is a window that no
+ * mechanism reacted to, so a ledger that could change a run would corrupt the
+ * baseline it exists to measure.
+ *
+ * WHY THIS EXISTS. The roadmap's Goal names two axes — synchronous contacts per
+ * delivered roadmap, and wall-clock to open PR — and pre-registers both as
+ * claims. Neither is derivable today: nothing in the tree records that a turn
+ * ended by asking the user something. `check_enforcement_coverage` counts
+ * carriers, `gate-metrics.jsonl` counts gate verdicts, and the conformance suite
+ * scores reply SHAPE without ever asking whether the reply stopped the run.
+ *
+ * REUSE, NOT REIMPLEMENTATION. Reply-shape detection is `turn_end_gate_hook`'s,
+ * imported rather than copied: `readTranscriptTail` for the last assistant text,
+ * `finalParagraph` for the closing paragraph, and its `HANDBACK` list for the
+ * yields-without-asking shape. That file is the measured corpus's detector and
+ * has an R2 history behind each regex; a second copy here would drift from it
+ * silently and the drift would land in the baseline, not in a test.
+ *
+ * WHAT COUNTS AS A CONTACT, and why it is three classes rather than two. A
+ * question mark is the obvious one. It is not the only one: `scope-control`
+ * requires a hand-back — "das entscheidest Du", "your call" — which ends the
+ * turn and waits for the user just as hard as a question does, with no `?`
+ * anywhere. Counting only questions would report the package's own preferred
+ * hand-back shape as zero contacts, which is precisely the metric-that-flatters-
+ * the-design failure the roadmap's Risk 6 names.
+ *
+ *   ask       — the closing paragraph ends in a question mark.
+ *   handback  — no question, but the closing paragraph yields the decision.
+ *   none      — the turn ended without putting anything to the user.
+ *
+ * `class` refines an `ask` by the shape the user has to answer in:
+ * `numbered-options` when the reply carries a numbered block (the
+ * `user-interaction` shape — one decision point, cheap to answer), or
+ * `open-question` when it does not (free text, the expensive shape). The split
+ * exists because the two are not equal contacts and the report separates them.
+ *
+ * DEDUPE is on the turn ordinal, the same identity `turn_end_gate_hook` derives
+ * and for the same reason: a host may fire `stop` more than once for one turn,
+ * and a per-turn ledger that double-counts inflates exactly the number the
+ * baseline is pre-registered on.
+ *
+ * The roadmap slug comes from this session's own claim file — the one
+ * `agent-config sessions:claim` writes — so a contact is attributable to a
+ * delivered roadmap without this hook knowing anything about roadmaps. No claim
+ * means `roadmap: null`, which is a real and common state (any session that is
+ * not a roadmap run) and never a reason to skip the line.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { derive_session_tag } from '../chat_history.js';
+import { unwrap, type JsonObject, type JsonValue } from './envelope.js';
+import { readHookStdin } from './hook_stdin.js';
+import { HANDBACK, finalParagraph, readTranscriptTail } from './turn_end_gate_hook.js';
+
+const EXIT_OK = 0;
+
+/** Same cap the turn-end gate reads its tail under. */
+const TRANSCRIPT_READ_MAX_BYTES = 2 * 1024 * 1024;
+
+export const LEDGER_RELPATH = path.join('agents', 'runtime', 'state', 'interruptions.jsonl');
+
+export type ContactKind = 'ask' | 'handback' | 'none';
+export type ContactClass = 'numbered-options' | 'open-question' | 'handback' | 'none';
+
+export interface InterruptionRecord {
+    run_id: string;
+    turn: number;
+    kind: ContactKind;
+    class: ContactClass;
+    roadmap: string | null;
+    at: string;
+}
+
+/**
+ * A numbered-options block: two or more numbered lines. One numbered line is an
+ * ordinary enumeration inside prose and is not a decision surface — requiring
+ * two is what keeps "1. read the file" from reading as an ask.
+ */
+export function hasNumberedOptions(reply: string): boolean {
+    let count = 0;
+    for (const line of reply.split('\n')) {
+        if (/^[ \t]{0,3}\d+[.)]\s+\S/.test(line)) count += 1;
+        if (count >= 2) return true;
+    }
+    return false;
+}
+
+/**
+ * Classify the reply. The question test is `turn_end_gate_hook`'s exactly — a
+ * question that ENDS the paragraph, never `includes('?')`, because a rhetorical
+ * or quoted question mid-reply is not a contact and counting it would inflate
+ * the baseline in the direction that makes the roadmap look successful later.
+ */
+export function classifyReply(reply: string): { kind: ContactKind; class: ContactClass } {
+    const tail = finalParagraph(reply);
+    if (!tail) return { kind: 'none', class: 'none' };
+
+    if (/\?["'’)\]]*\s*$/.test(tail)) {
+        return {
+            kind: 'ask',
+            class: hasNumberedOptions(reply) ? 'numbered-options' : 'open-question',
+        };
+    }
+    if (HANDBACK.some((re) => re.test(tail))) return { kind: 'handback', class: 'handback' };
+    return { kind: 'none', class: 'none' };
+}
+
+/** The roadmap this session claimed, or null. Never throws. */
+export function readClaimedRoadmap(workspaceRoot: string, sessionId: string): string | null {
+    if (!sessionId) return null;
+    try {
+        const file = path.join(
+            workspaceRoot,
+            'agents',
+            'runtime',
+            'state',
+            `roadmap-claim-${sessionId}.json`,
+        );
+        const parsed: unknown = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (parsed === null || typeof parsed !== 'object') return null;
+        const slug = (parsed as Record<string, unknown>)['slug'];
+        return typeof slug === 'string' && slug.length > 0 ? slug : null;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * True when this run has already recorded this turn. Reads only the tail of the
+ * ledger: the duplicate a repeated `stop` produces is always the most recent
+ * line, so scanning the whole file would cost more on every turn to catch
+ * nothing extra.
+ */
+export function alreadyRecorded(ledgerPath: string, runId: string, turn: number): boolean {
+    let raw: string;
+    try {
+        raw = fs.readFileSync(ledgerPath, 'utf8');
+    } catch {
+        return false;
+    }
+    const lines = raw.split('\n').filter((l) => l.trim().length > 0);
+    for (const line of lines.slice(-20)) {
+        try {
+            const rec: unknown = JSON.parse(line);
+            if (rec === null || typeof rec !== 'object') continue;
+            const r = rec as Record<string, unknown>;
+            if (r['run_id'] === runId && r['turn'] === turn) return true;
+        } catch {
+            // A corrupt line is not a reason to skip the write.
+        }
+    }
+    return false;
+}
+
+function str(v: JsonValue | undefined): string {
+    return typeof v === 'string' ? v : '';
+}
+
+export function main(): number {
+    let envelope: JsonObject;
+    let payload: JsonObject;
+    try {
+        [envelope, payload] = unwrap(readHookStdin(), 'claude');
+    } catch {
+        return EXIT_OK;
+    }
+
+    const workspaceRoot = str(envelope['workspace_root'] as JsonValue | undefined) || process.cwd();
+    const transcriptPath = str(
+        (payload['transcript_path'] ?? payload['transcriptPath']) as JsonValue | undefined,
+    );
+    if (!transcriptPath) return EXIT_OK;
+
+    let lastAssistant = '';
+    let turnOrdinal = 0;
+    try {
+        const tail = readTranscriptTail(transcriptPath, { maxBytes: TRANSCRIPT_READ_MAX_BYTES });
+        lastAssistant = tail.lastAssistant;
+        turnOrdinal = tail.turnOrdinal;
+    } catch {
+        return EXIT_OK;
+    }
+    if (!lastAssistant) return EXIT_OK;
+
+    const sessionId =
+        str(payload['session_id'] as JsonValue | undefined) ||
+        str(envelope['session_id'] as JsonValue | undefined);
+    // `derive_session_tag`, NOT the turn-end gate's `deriveSessionKey`. Both
+    // hash the session id, and only this one produces the tag `chat_history`
+    // already writes as `s`. The wall-clock axis is a join between this ledger
+    // and those timestamps, so a 32-char key from the other derivation would
+    // have made the roadmap's second pre-registered claim underivable — while
+    // looking correct in every test that never crossed the two files.
+    const runId = sessionId ? derive_session_tag(sessionId) : 'unknown';
+
+    const ledgerPath = path.join(workspaceRoot, LEDGER_RELPATH);
+    if (alreadyRecorded(ledgerPath, runId, turnOrdinal)) return EXIT_OK;
+
+    const verdict = classifyReply(lastAssistant);
+    const record: InterruptionRecord = {
+        run_id: runId,
+        turn: turnOrdinal,
+        kind: verdict.kind,
+        class: verdict.class,
+        roadmap: readClaimedRoadmap(workspaceRoot, sessionId),
+        at: new Date().toISOString(),
+    };
+
+    try {
+        fs.mkdirSync(path.dirname(ledgerPath), { recursive: true });
+        fs.appendFileSync(ledgerPath, `${JSON.stringify(record)}\n`, 'utf8');
+    } catch {
+        // A ledger that cannot be written is a lost measurement, never a
+        // reason to affect the turn. Phase 0 is advisory by construction.
+    }
+    return EXIT_OK;
+}
+
+/**
+ * The concern runs in-process via `CONCERN_REGISTRY`, but the manifest's
+ * `script:` path is also the SPAWN FALLBACK — and without this guard that path
+ * imports the module, calls nothing, and exits 0. A silent no-op on a
+ * capture-only concern is invisible by construction: the ledger simply stays
+ * empty and the baseline reads as "no contacts". Caught by running the hook
+ * against a real envelope rather than by any unit test, which is why the probe
+ * is worth the two minutes.
+ */
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry()) {
+    process.exit(main());
+}

package/src/scripts/hooks/ship_diff_volume_hook.ts

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+/**
+ * `ship-diff-volume` — a shipping-intent gate on diff VOLUME.
+ *
+ * Complementary to `minimal-safe-diff`, not a duplicate of it, and the
+ * distinction is the reason this exists: that concern counts unique FILES
+ * TOUCHED PER TURN, which is a within-session shape signal. This one measures
+ * total changed LINES on the branch AT A SHIP VERB — the moment the change
+ * leaves for review. A twelve-turn change of four files each time trips
+ * neither; a single-turn 3,000-line change trips only this one.
+ *
+ * THE THRESHOLD IS DERIVED FROM THIS REPOSITORY'S OWN HISTORY, never copied
+ * from the reference that suggested the gate. Replay of the 40 most recently
+ * merged PRs (agents/evidence/eval-findings/metric-loop-s04.md) put the
+ * corrected p90 at 1,695 lines.
+ *
+ * THE EXCLUSION SET IS PART OF THE DEFINITION, NOT A TUNING PARAMETER. The
+ * same replay found the naive metric double-counting: four of the five largest
+ * PRs were dominated by `*.review-input/diff.patch` — a committed copy of the
+ * very diff being measured — and the fifth by a generated index. Precision at
+ * the raw p90 was 2/5, below the pre-registered 0.50 floor; excluding the
+ * repository's own bookkeeping moved it to 5/5. Removing an input that was
+ * never shipping volume is a correction. Growing this set until a firing goes
+ * away would be tuning, and the kill criterion applies to that.
+ *
+ * WARN-LEVEL FIRST. It never blocks; escalation waits for one release of
+ * recorded firings, per the phase. Exit code is always 0 on the advisory path;
+ * 2 is the warn-in-context channel this estate's dispatcher reads.
+ */
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { readHookStdin } from './hook_stdin.js';
+import { atomic_write_json } from './state_io.js';
+
+export const STATE_FILE = path.join('agents', 'state', 'ship-diff-volume.json');
+
+/** Derived: corrected p90 over the last 40 merged PRs (spike s04). */
+export const DEFAULT_THRESHOLD = 1695;
+
+/**
+ * Paths excluded from the volume because they are not shipping volume.
+ *
+ * Each entry is a category of artefact the change did not author: a snapshot of
+ * the diff itself, a generated index, or a projection tree regenerated from
+ * source. None is a threshold in disguise.
+ */
+export const EXCLUDED = [
+    '.review-input/', // a committed copy of the diff being measured
+    'agents/roadmaps/archive/index.json', // generated index
+    'dist/', // projection of src/
+    '.augment/',
+    '.claude/',
+    '.cursor/',
+    '.clinerules/',
+] as const;
+
+/** Ship verbs — the moment a change leaves for review. */
+const SHIP_PATTERNS = [/\bgit\s+push\b/, /\bgh\s+pr\s+create\b/] as const;
+
+export function isShipCommand(cmd: string): boolean {
+    return SHIP_PATTERNS.some((re) => re.test(cmd));
+}
+
+export function isExcluded(p: string): boolean {
+    return EXCLUDED.some((e) => (e.endsWith('/') ? p.startsWith(e) || p.includes(e) : p === e));
+}
+
+/** `git diff --numstat` output → corrected volume plus what was excluded. */
+export function correctedVolume(numstat: string): { volume: number; excluded: number; files: number } {
+    let volume = 0;
+    let excluded = 0;
+    let files = 0;
+    for (const line of numstat.split('\n')) {
+        const m = line.match(/^(\d+|-)\t(\d+|-)\t(.+)$/);
+        if (m === null) continue;
+        const add = m[1] === '-' ? 0 : Number(m[1]);
+        const del = m[2] === '-' ? 0 : Number(m[2]);
+        const p = m[3]!;
+        if (isExcluded(p)) {
+            excluded += add + del;
+            continue;
+        }
+        volume += add + del;
+        files += 1;
+    }
+    return { volume, excluded, files };
+}
+
+function extractCommand(envelope: Record<string, unknown>): string {
+    const ti = envelope['tool_input'];
+    if (ti !== null && typeof ti === 'object') {
+        const c = (ti as Record<string, unknown>)['command'];
+        if (typeof c === 'string') return c;
+    }
+    const c = envelope['command'];
+    return typeof c === 'string' ? c : '';
+}
+
+export function main(argv?: string[]): number {
+    const args = argv ?? process.argv.slice(2);
+    const idx = args.indexOf('--command');
+    let cmd = idx >= 0 && args[idx + 1] !== undefined ? args[idx + 1]! : '';
+    if (!cmd) {
+        const raw = readHookStdin();
+        let envelope: Record<string, unknown> = {};
+        if (raw.trim()) {
+            try {
+                envelope = JSON.parse(raw) as Record<string, unknown>;
+            } catch {
+                envelope = {};
+            }
+        }
+        cmd = extractCommand(envelope);
+    }
+    if (!isShipCommand(cmd)) return 0;
+
+    let numstat: string;
+    let base: string;
+    try {
+        base = execFileSync('git', ['merge-base', 'HEAD', 'origin/main'], { encoding: 'utf-8' }).trim();
+        numstat = execFileSync('git', ['diff', '--numstat', `${base}...HEAD`], {
+            encoding: 'utf-8',
+            maxBuffer: 64 * 1024 * 1024,
+        });
+    } catch {
+        // No merge base, no origin, a detached probe — nothing to say. An
+        // advisory concern that guesses on missing input is worse than silent.
+        return 0;
+    }
+
+    const { volume, excluded, files } = correctedVolume(numstat);
+    const over = volume >= DEFAULT_THRESHOLD;
+
+    try {
+        fs.mkdirSync(path.dirname(STATE_FILE), { recursive: true });
+        atomic_write_json(STATE_FILE, {
+            schema_version: 1,
+            base,
+            corrected_volume: volume,
+            excluded_volume: excluded,
+            files_counted: files,
+            threshold: DEFAULT_THRESHOLD,
+            warning: over,
+            checked_at: new Date().toISOString(),
+        });
+    } catch {
+        // State is observability, never the gate. A read-only tree must not
+        // turn an advisory warning into a failed ship.
+    }
+
+    if (!over) return 0;
+
+    process.stderr.write(
+        `ship-diff-volume: ${String(volume)} changed lines against ${DEFAULT_THRESHOLD} ` +
+            `(${String(files)} file(s); ${String(excluded)} line(s) excluded as bookkeeping).\n` +
+            `Every PR above this line in the last 40 named two or more concerns in its own title. ` +
+            `Splitting is a suggestion, not a requirement — this warns and never blocks.\n`,
+    );
+    return 2; // warn-in-context; advisory severity means the dispatcher does not block
+}
+
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) return false;
+    if (import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) return true;
+    try {
+        return (
+            fs.realpathSync(fileURLToPath(import.meta.url)) ===
+            fs.realpathSync(path.resolve(process.argv[1]))
+        );
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry()) {
+    process.exit(main());
+}

package/src/scripts/hooks/turn_end_gate_hook.ts

@@ -47,9 +47,11 @@
  *      non-sidechain user entries — is distinct for every real turn whatever
  *      the user typed, and stable across harness injections.
  *
- *      Still true and still worth stating: per-session files are bounded per
- *      session but not pruned, so a long-lived workspace accumulates one small
- *      file per session. No TTL ships here.
+ *      No longer true, and corrected here rather than left as a stale admission:
+ *      the files ARE pruned. `road-to-stop-gate-honesty` step 1.2 added a
+ *      90-day retention (`pruneAgedRefusalState`), run at `session_start` by the
+ *      session-register concern. The record also COUNTS now instead of
+ *      overwriting itself — see `markRefusedTurn`.
  *
  * The failure this ordering prevents is not a loop but a wedge: a turn that
  * can never end. Layer 2 also covers the host that does not send
@@ -111,7 +113,6 @@
  * not an advisory, so there is no advisory path here to put on the wrong code.
  * Probed, not assumed.
  */
-import * as crypto from 'node:crypto';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -130,6 +131,14 @@ import { unwrap, type JsonObject, type JsonValue } from './envelope.js';
 import { readHookStdin } from './hook_stdin.js';
 import { atomic_write_json, is_replay_mode } from './state_io.js';
 import { openRecordStats } from './subagent_ledger_hook.js';
+import {
+    deriveSessionKey,
+    foldRefusal,
+    parseRecord,
+    readInstallBoundary,
+    sessionRefusalFile,
+    type RefusalRecord,
+} from '../_lib/turn_end_refusals.js';
 
 /** Dispatcher-internal block code. Pinned to 1 by `concern_block_exit_parity`. */
 const EXIT_BLOCK = 1;
@@ -294,8 +303,12 @@ const PROMISSORY = [
  * A legitimate hand-back is the opposite speech act: it gives the decision
  * to the user and ends the turn on purpose. `scope-control` requires
  * exactly this shape, so refusing it would put two rules in direct conflict.
+ *
+ * EXPORTED because `interruption_ledger_hook` classifies the same shape as a
+ * synchronous contact. Narrowing this list therefore changes a measurement as
+ * well as a refusal — check that hook before you touch it.
  */
-const HANDBACK = [
+export const HANDBACK = [
     /\bdas entscheidest (du|Du)\b/i,
     /\bdeine Entscheidung\b/i,
     /\bich fasse .{0,40}nicht ungefragt an\b/i,
@@ -527,9 +540,49 @@ const _EDIT_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit']);
  * detection when a project verifies by some command not listed here, and that is
  * the safe direction for a gate that can refuse a turn: a false negative costs
  * one unguarded turn, a false positive teaches the user to switch the gate off.
+ *
+ * ## Audited 2026-08-17 — `road-to-stop-gate-honesty` step 2.2
+ *
+ * 52 commands this project's own surface actually produces (its `package.json`
+ * scripts, its `Taskfile` targets, `./scripts-run`, `./agent-config`, and the
+ * PHP / Python / Go / Rust toolchains) were run through
+ * `isVerificationCommand`. The table of every one, with its verdict, is
+ * `turn_end_verify_allowlist.test.ts`; that file is the fixture step 2.2
+ * requires, and every addition below has its own row in it.
+ *
+ * The draft that opened the roadmap expected to add `phpunit` and `pest`. Claim
+ * 4 had already overtaken that — both matched before this audit, as did
+ * `composer test` and `php artisan test` — so what the audit actually found was
+ * two different gaps:
+ *
+ *   · `phpstan` — a static analyser of exactly the class already listed
+ *     (`mypy`, `pyright`, `clippy`). Added.
+ *   · `lint` followed by a WORD character — `lint_persistence`,
+ *     `lint_provenance`, and every other `lint_*` script in `src/scripts/`
+ *     missed, because `\blint\b` needs a boundary and `_` is a word character.
+ *     `lint[-_:a-z]*` is the exact mirror of the `check[-_:a-z]*` this list
+ *     already carried, which is why it is the narrow fix rather than a new idea.
+ *
+ * Four further misses were found and deliberately NOT added, because Risk 2 of
+ * that roadmap is that every addition is a way to satisfy the gate without
+ * verifying anything:
+ *
+ *   · `npm run prepack` — a lifecycle hook whose content is per-project. Here it
+ *     validates; elsewhere it copies files. Recognising it would clear an
+ *     unverified edit in any repo whose prepack is a build step.
+ *   · `task sync` / `task generate-tools` / `agent-config roadmap:progress` —
+ *     GENERATORS. They rewrite the tree; they check nothing. A generator that
+ *     cleared the gate would be the rubber stamp in its purest form.
+ *   · `agent-config gates --all` — enumerates gates, runs none.
+ *   · `vendor/bin/rector process --dry-run` — a refactoring tool. Its dry run
+ *     prints a diff; it does not assert anything holds.
+ *
+ * `psalm` is the obvious sibling of `phpstan` and is also NOT added: nothing in
+ * the audited surface runs it, and "the team actually runs" is the step's own
+ * standard. It is named here so the next audit does not re-derive the question.
  */
 const _VERIFY_RE =
-    /\b(test|tests|vitest|jest|pytest|phpunit|pest|tsc|eslint|ruff|mypy|pyright|clippy|typecheck|lint|build|ci|preflight|smoke[-_:a-z]*|check[-_:a-z]*|validate[-_:a-z]*)\b|\b(task|npm|pnpm|yarn|composer|cargo|go|make|php artisan|bun)\s+(run\s+)?\S*(test|check|lint|build|ci|typecheck)/i;
+    /\b(test|tests|vitest|jest|pytest|phpunit|pest|tsc|eslint|ruff|mypy|pyright|clippy|phpstan|typecheck|lint[-_:a-z]*|build|ci|preflight|smoke[-_:a-z]*|check[-_:a-z]*|validate[-_:a-z]*)\b|\b(task|npm|pnpm|yarn|composer|cargo|go|make|php artisan|bun)\s+(run\s+)?\S*(test|check|lint|build|ci|typecheck)/i;
 
 export function isVerificationCommand(command: string): boolean {
     return _VERIFY_RE.test(command);
@@ -579,29 +632,30 @@ export function detectUnverifiedEdit(toolCalls: readonly ToolCall[]): Finding |
 // Re-entrancy — the guard, keyed on the turn, not on the reply
 // ---------------------------------------------------------------------------
 
-function stateDir(workspaceRoot: string): string {
-    return path.join(workspaceRoot, 'agents', 'runtime', 'state', 'turn-end-gate');
-}
-
 /**
  * ONE file per session, not one per refused turn. R2 round 1, finding 17:
  * per-turn files accumulated without bound and without a TTL, because "re-arms
  * itself with no cleanup" described the key rotating, not the files being
  * removed.
  *
- * HALF of that is fixed and half is not, stated rather than implied (R2 round 2,
- * finding 12): the per-turn MULTIPLICITY is gone, so a session no longer leaves
- * one file per refused turn. There is still no TTL and no pruning, so a
- * long-lived workspace accumulates one small file per session that ever had a
- * turn refused. Adding expiry is new behaviour and belongs with its own test.
+ * Both halves are now closed. The per-turn MULTIPLICITY went first; the missing
+ * TTL was the other half and `road-to-stop-gate-honesty` step 1.2 shipped it as
+ * `pruneAgedRefusalState`, run at `session_start` by the session-register
+ * concern — the one slot that already prunes and therefore adds no spawn. The
+ * path and the retention constant live with the reader
+ * (`_lib/turn_end_refusals.ts`), because a pruner in one module and a writer in
+ * another must not each own their own idea of where the files are.
  */
 function sessionStateFile(workspaceRoot: string, sessionKey: string): string {
-    return path.join(stateDir(workspaceRoot), `${sessionKey}.json`);
+    return sessionRefusalFile(workspaceRoot, sessionKey);
 }
 
-export function deriveSessionKey(sessionId: string): string {
-    return crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 32);
-}
+/**
+ * Re-exported, not re-derived: the session register reads this session's own
+ * refusal record back for live per-session visibility, so the stem has two
+ * consumers and exactly one definition (`_lib/turn_end_refusals.ts`).
+ */
+export { deriveSessionKey };
 
 /**
  * A turn's identity is its ORDINAL — how many genuine user prompts the
@@ -641,19 +695,53 @@ export function alreadyRefusedTurn(
     return false;
 }
 
+/**
+ * Write the re-entrancy marker AND count the refusal.
+ *
+ * The marker half is unchanged: `refused_turn` is what `alreadyRefusedTurn`
+ * reads, and nothing about the counting can alter whether a turn is refused
+ * twice. The counting half is `road-to-stop-gate-honesty` step 1.1 — the old
+ * record overwrote itself, so a session refused nine times looked exactly like a
+ * session refused once, and D-2's "refusal frequency is invisible" was true of
+ * the state file as much as of the absent reader.
+ *
+ * EVERY finding's detector is counted, not just the first. The first still lands
+ * in `detector` for compatibility with the 36 field records written before this,
+ * but a turn that trips B and C at once is two observations, and pooling them
+ * into one is what step 1.1 forbids in the reader — doing it in the writer would
+ * put the same defect somewhere the reader cannot fix.
+ */
 function markRefusedTurn(
     workspaceRoot: string,
     sessionKey: string,
     turnOrdinal: number,
-    detector: DetectorId,
+    detectors: readonly DetectorId[],
 ): void {
     if (is_replay_mode()) return;
+    const file = sessionStateFile(workspaceRoot, sessionKey);
+    let prev: RefusalRecord | null = null;
+    try {
+        prev = parseRecord(fs.readFileSync(file, 'utf-8'));
+    } catch {
+        // Absent or unreadable prior state starts a fresh count. Never a reason
+        // to skip the marker — the marker is the wedge guard.
+    }
+    let version: string | undefined;
+    try {
+        version = readInstallBoundary().version ?? undefined;
+    } catch {
+        version = undefined;
+    }
     try {
-        atomic_write_json(sessionStateFile(workspaceRoot, sessionKey), {
-            refused_at: new Date().toISOString(),
-            refused_turn: turnOrdinal,
-            detector,
-        });
+        atomic_write_json(
+            file,
+            foldRefusal(prev, {
+                detectors,
+                turnOrdinal,
+                at: new Date().toISOString(),
+                version,
+            }) as unknown as Record<string, unknown>,
+        );
     } catch {
         // A state-write failure must never wedge the turn. Losing the marker
         // costs at most one extra refusal; failing closed here would cost the
@@ -934,7 +1022,12 @@ export function main(): number {
     }
     if (findings.length === 0) return EXIT_ALLOW;
 
-    markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, findings[0]!.detector);
+    markRefusedTurn(
+        workspaceRoot,
+        sessionKey,
+        turnOrdinal,
+        findings.map((f) => f.detector),
+    );
 
     const lines = findings.map(
         (f) => `  · ${f.detector}: ${f.reason}\n    evidence: ${JSON.stringify(f.evidence)}`,