@event4u/agent-config 14.0.0 → 14.2.0

package/src/scripts/dispatch_r2_reviewer.ts

@@ -426,35 +426,170 @@ export function expectedHashes(args: {
     return {
         scope_hash: sha256(args.scopeDiffText),
         roadmap_hash: args.roadmapText == null ? 'none' : sha256(args.roadmapText),
-        ac_hash: args.acText == null ? 'none' : sha256(args.acText),
+        // ONE predicate, shared with the prompt builder. An empty extraction
+        // used to hash to e3b0c44298fc…b855 — the SHA-256 of the empty string,
+        // which looks like a real hash in the manifest and re-derives
+        // identically on `--verify-current`, so the gate confirmed a criteria
+        // set that was never there. `'none'` is the value that already means
+        // "no input" for `roadmap_hash`; an absent AC block gets the same word.
+        ac_hash: hasAcceptanceCriteria(args.acText) ? sha256(args.acText as string) : 'none',
     };
 }
 
 /**
- * Extract the `## Acceptance Criteria` section — from that heading (inclusive)
- * to the next `## ` heading or EOF. No section → empty string.
+ * Does an extraction carry acceptance criteria?
+ *
+ * The single predicate behind BOTH the manifest's `ac_hash` and the reviewer
+ * prompt's roadmap line. It exists because the first version of this fix encoded
+ * the same question twice — truthiness in {@link expectedHashes}, an explicit
+ * `!== null && !== ''` at the call site — and the two agreed only for as long as
+ * `''` stayed the sole reachable falsy value. Refining one alone (this `.trim()`,
+ * for instance) would then have made the manifest record a hash while the prompt
+ * told the reviewer there were no criteria: the same two-places-disagree failure
+ * this module was being repaired for, one level up. Caught by the R2 review of
+ * that very fix.
+ *
+ * Whitespace-only counts as absent. The inline collector can emit blank lines
+ * between a criterion and its loose-list continuation, so a result that is
+ * structurally non-empty and semantically empty is reachable.
+ */
+export function hasAcceptanceCriteria(acText: string | null | undefined): boolean {
+    return typeof acText === 'string' && acText.trim() !== '';
+}
+
+/**
+ * Extract a roadmap's acceptance criteria in either form the tree uses.
+ *
+ * Two forms, because roadmap authors write both and the reviewer needs whichever
+ * one is present:
+ *
+ * 1. A `## Acceptance Criteria` section — from that heading (inclusive) to the
+ *    next `## ` heading or EOF.
+ * 2. Inline `- **AC-n:**` bullets, declared per phase with no section heading —
+ *    collected with their indented continuation lines.
+ *
+ * Neither form → empty string, and every caller must treat that as "no criteria"
+ * rather than as an extracted-and-empty block: see {@link expectedHashes} and the
+ * prompt's roadmap line.
+ *
+ * The heading form is tried first and wins outright when found. Measured
+ * 2026-08-18 over the 44 active roadmaps: 21 heading-only, 7 inline-only, 0
+ * carrying both, 16 carrying neither — so the two forms do not currently
+ * co-occur and a precedence rule is a guard against a future file rather than a
+ * choice between live populations.
+ *
+ * WHY THE INLINE FORM WAS MISSING, stated because this is the second instance of
+ * the same defect class in this one function. The first was case sensitivity
+ * (`## Acceptance criteria` extracted nothing, found by the zcs-close R2 review
+ * 2026-08-09). The second is this: an inline-only roadmap yielded `''`, nothing
+ * downstream noticed, and the reviewer was handed a 0-byte
+ * `acceptance-criteria.md` under a prompt that said the criteria had been
+ * extracted. The R2 reviewer is the independent check on AC conformance, so
+ * blinding it while the artefact reads as though it checked is the
+ * gate-that-scans-nothing-exits-green shape one layer up.
  */
 export function extractAcceptanceCriteria(roadmapText: string): string {
     const lines = roadmapText.split('\n');
     let start = -1;
     for (let i = 0; i < lines.length; i++) {
-        // Case-insensitive: the tree carries both `## Acceptance Criteria` and
+        // Case-insensitive, and NOT anchored at the end of the line.
+        //
+        // Case first: the tree carries both `## Acceptance Criteria` and
         // `## Acceptance criteria`; a case-sensitive match silently extracted
         // nothing for the latter (found by the zcs-close R2 review, 2026-08-09).
-        if (/^## acceptance criteria\s*$/i.test(lines[i] as string)) {
+        //
+        // The end-anchor was the same defect wearing a different mask, and it was
+        // LIVE: `\s*$` rejected a heading carrying a qualifier, so
+        // `## Acceptance criteria (per phase, on promotion to ready)` and
+        // `## Acceptance criteria (anti-dump — the review-s own rule)` extracted
+        // nothing. Two roadmaps, measured 2026-08-18 — and they had been counted
+        // as "declares no criteria" by the very census that motivated this fix,
+        // which is how a matcher tuned to its own measurement hides its misses.
+        if (/^##\s+acceptance criteria\b/i.test(lines[i] as string)) {
             start = i;
             break;
         }
     }
-    if (start === -1) return '';
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i++) {
-        if (/^## /.test(lines[i] as string)) {
-            end = i;
-            break;
+    if (start !== -1) {
+        let end = lines.length;
+        for (let i = start + 1; i < lines.length; i++) {
+            if (/^## /.test(lines[i] as string)) {
+                end = i;
+                break;
+            }
+        }
+        return lines.slice(start, end).join('\n');
+    }
+    return extractInlineAcceptanceCriteria(lines);
+}
+
+/**
+ * An inline criterion bullet, at any indent and with either bullet marker.
+ *
+ * Indent-tolerant so a nested criterion is emitted as its own row rather than
+ * folded into its parent as a continuation line — folding made the extraction
+ * shape, and therefore `ac_hash`, a function of indentation depth. Neither the
+ * `*` marker nor a nested criterion occurs in the tree today (measured
+ * 2026-08-18 across all 44 active roadmaps: zero of each), so this is a guard
+ * against a future file, not a fix for a live population.
+ */
+const AC_BULLET_RE = /^\s*[-*]\s+\*\*AC-/;
+
+/**
+ * Collect inline `- **AC-n:**` bullets and their continuation lines.
+ *
+ * A continuation line is indented and non-blank. Bullets are emitted in file
+ * order and separated by nothing but their own newline: each one is
+ * self-labelling (`AC-0`, `AC-1`, …), so a synthetic section heading would be
+ * text this function invented rather than text the roadmap declared.
+ *
+ * Two stopping rules, and the second is the subtle one:
+ *
+ * - another criterion bullet ends the current one, at any indent — see
+ *   {@link AC_BULLET_RE};
+ * - a blank line ends it ONLY when the next non-blank line is not an indented
+ *   continuation. Markdown loose lists separate a bullet from its second
+ *   paragraph with exactly that blank line, so breaking on the blank
+ *   unconditionally truncated the criterion and emitted a PARTIAL extraction —
+ *   which then hashed to a real value and read as complete. That is the
+ *   looks-like-success shape this whole function exists to remove, relocated
+ *   from "empty but claimed" to "half but claimed"; caught by the R2 review of
+ *   the first version. No roadmap uses a loose continuation today (measured
+ *   2026-08-18: zero across all 44), so this is latent-defect removal.
+ */
+function extractInlineAcceptanceCriteria(lines: readonly string[]): string {
+    const out: string[] = [];
+    for (let i = 0; i < lines.length; i++) {
+        if (!AC_BULLET_RE.test(lines[i] as string)) continue;
+        out.push(lines[i] as string);
+        let j = i + 1;
+        while (j < lines.length) {
+            const line = lines[j] as string;
+            // A sibling or nested criterion owns itself; hand it back to the
+            // outer loop rather than absorbing it.
+            if (AC_BULLET_RE.test(line)) break;
+            if (/^\s+\S/.test(line)) {
+                out.push(line);
+                j++;
+                continue;
+            }
+            if (line.trim() !== '') break;
+            // Blank: look past the run of blanks for an indented continuation.
+            let k = j;
+            while (k < lines.length && (lines[k] as string).trim() === '') k++;
+            const resumes =
+                k < lines.length &&
+                /^\s+\S/.test(lines[k] as string) &&
+                !AC_BULLET_RE.test(lines[k] as string);
+            if (!resumes) break;
+            for (let b = j; b < k; b++) out.push(lines[b] as string);
+            j = k;
         }
+        // Resume the outer scan AT the line that stopped the walk, so a
+        // criterion bullet that ended this one is still matched.
+        i = j - 1;
     }
-    return lines.slice(start, end).join('\n');
+    return out.join('\n');
 }
 
 /**
@@ -576,11 +711,29 @@ function reviewerPrompt(args: {
     headSha: string;
     scopeHash: string;
     roadmapGiven: boolean;
+    acGiven: boolean;
     changedFiles: readonly string[];
 }): string {
-    const roadmapLine = args.roadmapGiven
-        ? '- roadmap under review: `roadmap.md` (Acceptance Criteria extracted to `acceptance-criteria.md`)'
-        : '- roadmap under review: none (`acceptance-criteria.md` is empty)';
+    // Three states, not two. Branching on `roadmapGiven` alone told the reviewer
+    // "Acceptance Criteria extracted" whenever a roadmap was supplied — including
+    // when the extraction returned nothing and the file beside it was 0 bytes. A
+    // reviewer told the criteria are in a file it finds empty has no way to tell
+    // an extraction failure from a roadmap that genuinely declares none, so it
+    // cannot report the gap.
+    //
+    // The empty branch reports the EXTRACTION, never the roadmap. Its first
+    // version said "it declares NO acceptance criteria" — a claim the extractor
+    // cannot establish, since an unrecognised shape produces the identical empty
+    // result. That turned a silent failure into an affirmative false statement
+    // handed to the one independent check on AC conformance, which is strictly
+    // worse: silence invites a look, a false assertion forecloses it. Caught by
+    // the R2 review of the first version, and it was not hypothetical — the
+    // trailing-text heading it names was live in two roadmaps.
+    const roadmapLine = !args.roadmapGiven
+        ? '- roadmap under review: none (`acceptance-criteria.md` is empty)'
+        : args.acGiven
+          ? '- roadmap under review: `roadmap.md` (Acceptance Criteria extracted to `acceptance-criteria.md`)'
+          : '- roadmap under review: `roadmap.md` — NO acceptance criteria could be EXTRACTED from it, in either recognised form (an `## Acceptance criteria` heading, or inline `- **AC-n:**` bullets), so `acceptance-criteria.md` is empty. Two different things produce that result and the dispatcher cannot tell them apart: the roadmap declares none, or it declares them in a shape the extractor does not recognise. Open `roadmap.md`, decide which, and report a finding if the criteria are there.';
     return [
         `# R2 completion review — ${args.slug}`,
         '',
@@ -1037,6 +1190,7 @@ function runDispatch(args: Args): number {
         headSha,
         scopeHash: hashes.scope_hash,
         roadmapGiven: roadmapText !== null,
+        acGiven: hasAcceptanceCriteria(acText),
         changedFiles,
     });
     const manifest = deriveManifest({

package/src/scripts/git_authorization_hook.ts

@@ -43,8 +43,102 @@ import { readHookStdin } from "./hooks/hook_stdin.js";
 
 const EXIT_ALLOW = 0;
 
+/**
+ * Legacy single-file ledger path — one file for the whole project root.
+ *
+ * Kept for direct invocations and for reading a ledger written by an older
+ * build, NOT as the write target when a session id is known. See
+ * `ledgerFileFor` for why one shared file was the defect.
+ */
 export const STATE_FILE = path.join("agents", "state", "git-authorization.json");
 
+/** Per-session ledger directory. */
+export const STATE_DIR = path.join("agents", "state", "git-authorization");
+
+/** Per-session pending-refusal directory. */
+export const PENDING_DIR = path.join("agents", "state", "git-authorization-pending");
+
+/**
+ * A session id reduced to a safe path component.
+ *
+ * The id reaches this from the host's envelope, so it is untrusted input on a
+ * path — `..` or a separator in it would place the ledger outside the state
+ * directory. Anything outside the allowed set collapses to `_`.
+ */
+export function sessionSlug(session_id: string): string {
+    return session_id.replace(/[^A-Za-z0-9._-]/gu, "_").slice(0, 80);
+}
+
+/**
+ * Where THIS session's ledger lives.
+ *
+ * MEASURED DEFECT (2026-08-18, during the 14.0.0 release): the ledger was a
+ * single file per project root, so every prompt from every concurrent session
+ * in the repo overwrote it. A second session typed an 11-character prompt
+ * between the user's `merge den pr` and the guard's read; the guard found a
+ * foreign session id, discarded the ledger as another conversation's consent,
+ * and refused. The refusal then said "no authorization in this turn's prompt",
+ * which was false and unfalsifiable from the message alone — the authorization
+ * had existed and been clobbered. Three consecutive refusals, and the user
+ * re-authorized each time.
+ *
+ * This repo runs dozens of worktrees against one root, so the race is not an
+ * edge case there; it is the normal condition. Scoping the file by session is
+ * what makes "this turn's prompt" mean this conversation's turn.
+ */
+export function ledgerFileFor(session_id: string): string {
+    if (!session_id) {
+        return STATE_FILE;
+    }
+    return path.join(STATE_DIR, `${sessionSlug(session_id)}.json`);
+}
+
+/** Where THIS session's refused-operation record lives. */
+export function pendingFileFor(session_id: string): string {
+    if (!session_id) {
+        return PENDING_FILE;
+    }
+    return path.join(PENDING_DIR, `${sessionSlug(session_id)}.json`);
+}
+
+/**
+ * One refused irreversible operation, waiting for the answer to the question
+ * the guard just told the agent to ask.
+ *
+ * WHY THIS FILE EXISTS — the measured deadlock (2026-08-18, 14.0.0 release):
+ * `user-interaction` requires a decision to be handed to the user as a
+ * NUMBERED-OPTIONS block, and the answer to one is a bare `1`. The classifier
+ * below reads the prompt in isolation, and `1` carries no operation, so the
+ * user's consent was real, visible, and unrecordable. The release deadlocked
+ * for three turns: the guard refused, the agent asked as instructed, the user
+ * answered, and the next attempt refused identically. Two mechanisms this repo
+ * mandates were structurally incompatible on exactly the irreversible subset.
+ *
+ * The fix is deliberately the narrowest thing that resolves it. Widening the
+ * prose list with bare affirmatives was rejected: `ja` would then authorize
+ * `npm publish` on any turn, which is reach, not severity. Instead the guard
+ * records WHICH op it refused, and only that one op can be confirmed, once, by
+ * the immediately following prompt. Everything the user is consenting to has
+ * already been named to them in the refusal they just read.
+ */
+export const PENDING_FILE = path.join("agents", "state", "git-authorization-pending.json");
+
+/** A refused operation carried to exactly one following prompt. */
+export interface PendingRefusal {
+    op: GitOp;
+    session_id: string;
+    refused_at: string;
+}
+
+/**
+ * The window in which a refusal is still the thing the user is answering.
+ *
+ * Short on purpose: this is "the user read the refusal and replied", not "the
+ * user said yes to something at some point today". A stale record expires into
+ * the same not-authorized state the guard starts from.
+ */
+export const PENDING_MAX_AGE_MS = 10 * 60 * 1000;
+
 type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
 type JsonObject = { [k: string]: JsonValue };
 
@@ -142,6 +236,36 @@ export function isInterrogative(prose: string): boolean {
   );
 }
 
+/**
+ * Is this prompt an ANSWER to the refusal the user was just shown?
+ *
+ * Accepts the two shapes a numbered-options block actually produces — a bare
+ * selection (`1`, `1.`, `Option 2`) and a bare affirmative (`ja`, `ok`, `mach`,
+ * `go`, `do it`) — and nothing else. The bar is that the prompt says yes and
+ * says NOTHING ELSE: a turn that also carries new instructions is a new turn,
+ * not an answer, and must name its operation like any other.
+ *
+ * That last clause is the whole safety argument, so it is enforced by length
+ * rather than by good intentions. `release und fixe auch den schess bug` reads
+ * as consent to a human and is correctly NOT an affirmative here — it opens new
+ * work, and the op it authorizes is the one it names.
+ */
+export function isAffirmative(prose: string): boolean {
+    const t = prose.trim().replace(/[.!]+$/u, "");
+    if (!t || t.length > 24) {
+        return false;
+    }
+    if (isInterrogative(t)) {
+        return false;
+    }
+    return (
+        /^(?:option\s*)?\d{1,2}[.)]?$/iu.test(t) ||
+        /^(ja|jo|jep|yes|yep|yeah|ok|okay|okey|klar|passt|gut|los|go|go ahead|mach|mach das|mach es|leg los|do it|proceed|bitte)$/iu.test(
+            t,
+        )
+    );
+}
+
 /** Executable commands a user may paste, mapped to the op they authorize. */
 const PASTED_COMMANDS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   { op: "publish", re: /\bnpm\s+publish\b/i },
@@ -242,6 +366,55 @@ export function classifyAuthorization(prompt: string): {
   return { authorized: [...authorized], evidence };
 }
 
+/**
+ * Read the refused operation, and consume it in the same breath.
+ *
+ * Consuming unconditionally is the single-use guarantee: the record survives
+ * exactly one following prompt whether or not that prompt confirmed it, so a
+ * `ja` three turns later cannot reach back to a refusal the user has long
+ * stopped thinking about.
+ */
+export function takePending(
+    consumer_root: string,
+    session_id: string,
+    now: number,
+): PendingRefusal | null {
+    const file = path.join(consumer_root, pendingFileFor(session_id));
+    let raw: string;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    } catch {
+        return null;
+    }
+    try {
+        fs.rmSync(file, { force: true });
+    } catch {
+        /* consumed in memory either way — a stale file expires by age below */
+    }
+    try {
+        const decoded = JSON.parse(raw) as unknown;
+        if (!_isObject(decoded)) {
+            return null;
+        }
+        const op = decoded["op"];
+        if (typeof op !== "string" || !(ALL_OPS as readonly string[]).includes(op)) {
+            return null;
+        }
+        const recorded = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+        // A refusal from another conversation is another conversation's question.
+        if (session_id && recorded && recorded !== session_id) {
+            return null;
+        }
+        const at = Date.parse(String(decoded["refused_at"] ?? ""));
+        if (!Number.isFinite(at) || now - at > PENDING_MAX_AGE_MS) {
+            return null;
+        }
+        return { op: op as GitOp, session_id: recorded, refused_at: String(decoded["refused_at"]) };
+    } catch {
+        return null;
+    }
+}
+
 export function run(stdin_text: string, options: { consumer_root: string }): number {
   let envelope: JsonObject = {};
   if (stdin_text.trim()) {
@@ -269,6 +442,18 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
   }
 
   const { authorized, evidence } = classifyAuthorization(prompt);
+
+  // The answer to the guard's own question. Read (and consume) on EVERY prompt,
+  // so the record cannot outlive the turn it was raised in.
+  const session = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
+  const pending = takePending(options.consumer_root, session, Date.now());
+  if (pending && !authorized.includes(pending.op) && isAffirmative(prompt)) {
+    authorized.push(pending.op);
+    evidence[pending.op] =
+      `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): ` +
+      `"${prompt.trim().slice(0, 40)}"`;
+  }
+
   const ledger: Ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
     detected_at: new Date().toISOString(),
@@ -278,7 +463,7 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
   };
 
   try {
-    atomic_write_json(path.join(options.consumer_root, STATE_FILE), ledger);
+    atomic_write_json(path.join(options.consumer_root, ledgerFileFor(session)), ledger);
   } catch {
     // Observability only — a failed write degrades the gate to "no ledger",
     // which the pre_tool_use concern treats as "not authorized" for the

package/src/scripts/hooks/block_unauthorized_git.ts

@@ -61,7 +61,13 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { readHookStdin } from "./hook_stdin.js";
-import { STATE_FILE, type GitOp } from "../git_authorization_hook.js";
+import { atomic_write_json } from "./state_io.js";
+import {
+  ledgerFileFor,
+  pendingFileFor,
+  STATE_FILE,
+  type GitOp,
+} from "../git_authorization_hook.js";
 
 const EXIT_ALLOW = 0;
 // MUST equal dispatch_hook.EXIT_BLOCK. The dispatcher's internal ladder is
@@ -497,18 +503,45 @@ function _loadLedger(
   session_id: string,
   now: number,
 ): { authorized: Set<GitOp>; present: boolean } {
+  // This session's own ledger first; the flat legacy file only as a fallback,
+  // so a ledger written by an older build still counts. Reading the flat file
+  // FIRST was the defect: any concurrent session in the repo overwrites it, and
+  // the session check below then discarded a real authorization as foreign.
+  const candidates = [ledgerFileFor(session_id)];
+  if (!candidates.includes(STATE_FILE)) {
+    candidates.push(STATE_FILE);
+  }
+  for (const rel of candidates) {
+    const found = _readLedgerFile(path.join(consumer_root, rel), session_id, now);
+    if (found !== null) {
+      return found;
+    }
+  }
+  return { authorized: new Set<GitOp>(), present: false };
+}
+
+/**
+ * Read one ledger file. `null` means "this file does not answer the question" —
+ * absent, malformed, foreign session, or expired — so the caller may try the
+ * next candidate. A parsed, in-session, fresh ledger answers definitively.
+ */
+function _readLedgerFile(
+  file: string,
+  session_id: string,
+  now: number,
+): { authorized: Set<GitOp>; present: boolean } | null {
   try {
-    const raw = fs.readFileSync(path.join(consumer_root, STATE_FILE), "utf8");
+    const raw = fs.readFileSync(file, "utf8");
     const decoded = JSON.parse(raw) as unknown;
     if (_isObject(decoded) && Array.isArray(decoded["authorized"])) {
       const ledgerSession = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
       // A ledger from a different session is another conversation's consent.
       if (session_id && ledgerSession && ledgerSession !== session_id) {
-        return { authorized: new Set<GitOp>(), present: false };
+        return null;
       }
       const at = Date.parse(String(decoded["detected_at"] ?? ""));
       if (Number.isFinite(at) && now - at > LEDGER_MAX_AGE_MS) {
-        return { authorized: new Set<GitOp>(), present: false };
+        return null;
       }
       return {
         authorized: new Set((decoded["authorized"] as string[]).filter(Boolean) as GitOp[]),
@@ -518,13 +551,21 @@ function _loadLedger(
   } catch {
     /* fall through */
   }
-  return { authorized: new Set<GitOp>(), present: false };
+  return null;
 }
 
 export interface Decision {
   exit: number;
   stdout: string;
   stderr: string;
+  /**
+   * The op this decision refused, when it refused one.
+   *
+   * `decide` stays pure; `run` turns this into the pending record that lets the
+   * user's answer to the refusal count as authorization for that one op. See
+   * `git_authorization_hook.PENDING_FILE` for why that record exists at all.
+   */
+  blockedOp?: GitOp;
 }
 
 export function decide(
@@ -547,7 +588,7 @@ export function decide(
       `This operation is irreversible and non-destructive-by-default already declares it ` +
       `never-autonomous. Command: ${shown}. ` +
       `Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
-    return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}\n` };
+    return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}\n`, blockedOp: op };
   }
 
   if (WARN_OPS.has(op)) {
@@ -582,6 +623,21 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
     extractCommand(envelope),
     _loadLedger(options.consumer_root, session_id, Date.now()),
   );
+  if (decision.blockedOp) {
+    // Record WHAT was refused, so the user's answer to the question this
+    // refusal just told the agent to ask can authorize that one operation.
+    // Best-effort: a failed write degrades to the previous behaviour, where a
+    // numbered answer is unrecordable and the refusal simply repeats.
+    try {
+      atomic_write_json(path.join(options.consumer_root, pendingFileFor(session_id)), {
+        op: decision.blockedOp,
+        session_id,
+        refused_at: new Date().toISOString(),
+      });
+    } catch {
+      /* observability only — see above */
+    }
+  }
   if (decision.stdout) {
     process.stdout.write(decision.stdout);
   }