@event4u/agent-config 14.4.0 → 14.5.0

package/dist/hooks/dispatch.js

@@ -7765,6 +7765,10 @@ function claudeAdditionalContext(event, text) {
   })}
 `;
 }
+function emissionCarriesReasons(platform, severity) {
+  if (!VERIFIED_PLATFORMS.has(platform)) return false;
+  return severity !== "allow";
+}
 function emitFor(platform, event, severity, reasons, legacyExit) {
   if (!VERIFIED_PLATFORMS.has(platform)) {
     return { exit: legacyExit, stdout: "", stderr: "" };
@@ -7790,6 +7794,13 @@ function emitFor(platform, event, severity, reasons, legacyExit) {
 
 // src/scripts/hooks/injection_budget.ts
 var TURN_START_EVENT = "user_prompt_submit";
+var RC_ALLOW = 0;
+var RC_WARN = 2;
+function _severityForRc(rc) {
+  if (rc === RC_ALLOW) return "allow";
+  if (rc === RC_WARN) return "warn";
+  return "block";
+}
 function isExempt(c) {
   if (c.failClosed) return true;
   return c.severity.trim().toLowerCase() !== "advisory";
@@ -7870,13 +7881,43 @@ function shapeEmissions(candidates, opts) {
     ceilingCause
   };
 }
-var TURN_SPEND_BASENAME = "injection-turn.json";
-function turnSpendPath(workspaceRoot2) {
-  return path3.join(workspaceRoot2, "agents", "runtime", "state", TURN_SPEND_BASENAME);
+var TURN_SPEND_DIR_REL = path3.join("agents", "runtime", "state", "injection-turn");
+var TURN_SPEND_MAX_FILES = 64;
+function turnSpendKey(session) {
+  const safe = session.replace(/[^A-Za-z0-9._-]/g, "_");
+  let h = 2166136261;
+  for (let i = 0; i < session.length; i += 1) {
+    h ^= session.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  const digest = h.toString(16).padStart(8, "0");
+  return `${safe.slice(0, 96)}.${digest}`;
+}
+function turnSpendPath(workspaceRoot2, session) {
+  return path3.join(workspaceRoot2, TURN_SPEND_DIR_REL, `${turnSpendKey(session)}.json`);
+}
+function _pruneTurnSpend(dir) {
+  try {
+    const entries = fs3.readdirSync(dir).filter((n) => n.endsWith(".json") || n.endsWith(".tmp")).map((n) => {
+      const p = path3.join(dir, n);
+      try {
+        return { p, mtime: fs3.statSync(p).mtimeMs };
+      } catch {
+        return { p, mtime: 0 };
+      }
+    }).sort((a, b) => b.mtime - a.mtime);
+    for (const stale of entries.slice(TURN_SPEND_MAX_FILES)) {
+      try {
+        fs3.unlinkSync(stale.p);
+      } catch {
+      }
+    }
+  } catch {
+  }
 }
 function readTurnSpend(workspaceRoot2, session) {
   try {
-    const raw = fs3.readFileSync(turnSpendPath(workspaceRoot2), "utf-8");
+    const raw = fs3.readFileSync(turnSpendPath(workspaceRoot2, session), "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.session !== session) return 0;
     return typeof parsed.bytes === "number" && Number.isFinite(parsed.bytes) && parsed.bytes >= 0 ? parsed.bytes : 0;
@@ -7889,9 +7930,13 @@ function recordTurnSpend(workspaceRoot2, session, bytes, opts = {}) {
   const previous = opts.reset === true ? 0 : readTurnSpend(workspaceRoot2, session);
   const entry = { session, bytes: previous + Math.max(0, bytes) };
   try {
-    const target = turnSpendPath(workspaceRoot2);
-    fs3.mkdirSync(path3.dirname(target), { recursive: true });
-    fs3.writeFileSync(target, JSON.stringify(entry) + "\n", { encoding: "utf-8" });
+    const target = turnSpendPath(workspaceRoot2, session);
+    const dir = path3.dirname(target);
+    fs3.mkdirSync(dir, { recursive: true });
+    const tmp = `${target}.${String(process.pid)}.tmp`;
+    fs3.writeFileSync(tmp, JSON.stringify(entry) + "\n", { encoding: "utf-8" });
+    fs3.renameSync(tmp, target);
+    _pruneTurnSpend(dir);
   } catch {
   }
 }
@@ -7957,12 +8002,15 @@ function shapeAndRecord(ctx, messages, finalRc) {
       nudgeRank: typeof rank2 === "number" ? rank2 : null
     };
   });
-  if (!VERIFIED_PLATFORMS.has(ctx.platform)) {
-    return textOf(new Set(candidates.map((c) => c.concern)));
-  }
   const workspaceRoot2 = _workspaceRoot(ctx);
   const sessionKey = _sessionKey(ctx) ?? "";
   const cap = resolveVolumeCap(ctx);
+  if (!emissionCarriesReasons(ctx.platform, _severityForRc(finalRc))) {
+    if (cap !== null && ctx.event === TURN_START_EVENT) {
+      recordTurnSpend(workspaceRoot2, sessionKey, 0, { reset: true });
+    }
+    return textOf(new Set(candidates.map((c) => c.concern)));
+  }
   const turnStartsHere = ctx.event === TURN_START_EVENT;
   const spentBefore = cap === null || turnStartsHere ? 0 : readTurnSpend(workspaceRoot2, sessionKey);
   const shaped = shapeEmissions(candidates, { capBytes: cap, spentBytes: spentBefore });
@@ -21913,9 +21961,9 @@ function resolveAvailability(cwd, env) {
     return null;
   }
   const exists = fs41.existsSync(p);
-  const provenance = env[COUNCIL_CONFIG_ENV] ? "env-override" : "user-global";
+  const provenance2 = env[COUNCIL_CONFIG_ENV] ? "env-override" : "user-global";
   if (!exists) {
-    return { configured: false, path: p, exists: false, provenance, membersEnabled: 0, memberNames: [] };
+    return { configured: false, path: p, exists: false, provenance: provenance2, membersEnabled: 0, memberNames: [] };
   }
   try {
     const cfg = load_council_config(p);
@@ -21924,12 +21972,12 @@ function resolveAvailability(cwd, env) {
       configured: cfg.enabled && enabled4.length > 0,
       path: p,
       exists: true,
-      provenance,
+      provenance: provenance2,
       membersEnabled: enabled4.length,
       memberNames: enabled4
     };
   } catch {
-    return { configured: false, path: p, exists: true, provenance, membersEnabled: 0, memberNames: [] };
+    return { configured: false, path: p, exists: true, provenance: provenance2, membersEnabled: 0, memberNames: [] };
   }
 }
 function buildFact(a) {
@@ -23828,20 +23876,24 @@ function _read_claim_file(file) {
     return null;
   }
 }
-function read_claimed_slug(workspace_root, session_id) {
+function resolve_claim(workspace_root, session_id) {
   const own = roadmap_claim_rel(session_id);
   if (own !== ROADMAP_CLAIM_REL) {
     for (const p of claim_read_paths(workspace_root, session_id)) {
       if (path52.basename(p) === path52.basename(ROADMAP_CLAIM_REL)) continue;
       const mine = _read_claim_file(p);
-      if (mine !== null) return mine.slug;
+      if (mine !== null) return { slug: mine.slug, path: p };
     }
   }
   let legacy = null;
+  let legacy_path = "";
   for (const p of claim_read_paths(workspace_root, session_id)) {
     if (path52.basename(p) !== path52.basename(ROADMAP_CLAIM_REL)) continue;
     legacy = _read_claim_file(p);
-    if (legacy !== null) break;
+    if (legacy !== null) {
+      legacy_path = p;
+      break;
+    }
   }
   if (legacy === null) {
     return null;
@@ -23850,7 +23902,10 @@ function read_claimed_slug(workspace_root, session_id) {
   if (id !== "") {
     return null;
   }
-  return legacy.slug;
+  return { slug: legacy.slug, path: legacy_path };
+}
+function read_claimed_slug(workspace_root, session_id) {
+  return resolve_claim(workspace_root, session_id)?.slug ?? null;
 }
 function claim_is_stale(workspace_root, slug, peer_worktree) {
   if (slug === null || slug.trim() === "") {
@@ -26119,7 +26174,7 @@ import { fileURLToPath as fileURLToPath39, pathToFileURL as pathToFileURL32 } fr
 
 // src/install/rtkDetection.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync11, statSync as statSync15, readFileSync as readFileSync27, writeFileSync as writeFileSync13, mkdirSync as mkdirSync15 } from "node:fs";
+import { existsSync as existsSync11, statSync as statSync16, readFileSync as readFileSync27, writeFileSync as writeFileSync13, mkdirSync as mkdirSync15 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { delimiter as delimiter2, join as join26, dirname as dirname16 } from "node:path";
 var TOKEN_KILLER_GAIN_SIGNATURE = /RTK Token Savings/;
@@ -26190,7 +26245,7 @@ function detectRtkCached(options = {}) {
   if (binPath === null) return { present: false };
   let stat = null;
   try {
-    const st = statSync15(binPath);
+    const st = statSync16(binPath);
     stat = { mtimeMs: st.mtimeMs, size: st.size };
   } catch {
     stat = null;
@@ -32092,6 +32147,14 @@ function readState4(file) {
     return null;
   }
 }
+function provenance(workspaceRoot2, claimPath) {
+  return {
+    workspace_root: workspaceRoot2,
+    git_dir: git_dir(workspaceRoot2) ?? "",
+    git_common_dir: git_common_dir(workspaceRoot2) ?? "",
+    claim_path: claimPath
+  };
+}
 function appendEvent2(workspaceRoot2, record) {
   try {
     const file = path85.join(workspaceRoot2, EVENTS_RELPATH);
@@ -32125,8 +32188,10 @@ function main55() {
   }
   const workspaceRoot2 = str10(envelope["workspace_root"]) || process.cwd();
   const sessionId2 = str10(payload["session_id"]) || str10(envelope["session_id"]);
-  const slug = read_claimed_slug(workspaceRoot2, sessionId2 || null);
-  if (slug === null) return EXIT_ALLOW27;
+  const claim = resolve_claim(workspaceRoot2, sessionId2 || null);
+  if (claim === null) return EXIT_ALLOW27;
+  const slug = claim.slug;
+  const roots = provenance(workspaceRoot2, claim.path);
   const roadmapPath2 = path85.join(workspaceRoot2, "agents", "roadmaps", `${slug}.md`);
   let roadmapText;
   try {
@@ -32159,7 +32224,8 @@ function main55() {
       run_id: runId,
       roadmap: slug,
       turn: turnOrdinal,
-      at: (/* @__PURE__ */ new Date()).toISOString()
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      ...roots
     });
     return EXIT_ALLOW27;
   }
@@ -32186,7 +32252,8 @@ function main55() {
       iterations: state.iterations,
       open: scan.open,
       blocked: scan.blocked,
-      at: (/* @__PURE__ */ new Date()).toISOString()
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      ...roots
     });
     if (action === "complete") {
       try {
@@ -32225,7 +32292,8 @@ function main55() {
     iteration: state.iterations,
     open: scan.open,
     blocked: scan.blocked,
-    at: (/* @__PURE__ */ new Date()).toISOString()
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    ...roots
   });
   process.stderr.write(_continuationText(slug, scan, state.iterations));
   return EXIT_BLOCK5;

package/dist/mcp/registry-manifest.json

@@ -9,7 +9,7 @@
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "14.4.0"
+    "version": "14.5.0"
   },
   "registries": [
     {

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "14.4.0"
+      "version": "14.5.0"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "14.4.0"
+  "version": "14.5.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.4.0",
+    "version": "14.5.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/config/estate-count-budget.json

@@ -18,7 +18,7 @@
   "baseline": {
     "active_roadmaps": 33,
     "later_roadmaps": 50,
-    "open_blockers": 70
+    "open_blockers": 71
   },
   "baseline_history": [
     {
@@ -104,6 +104,13 @@
       "later_roadmaps": 50,
       "open_blockers": 70,
       "why": "WALKED DOWN by 1 blocker: worktree-claim-root-split resolved in the change that found it. The blocker recorded a measured defect \u2014 the roadmap claim and the stop-slot concern resolved different roots, so run-continuation was inert in every worktree session \u2014 and the claim now lives in the git common dir beside the session register. Active and later are unchanged and net zero by construction: road-to-long-horizon-execution archived and road-to-run-continuation-observation was created in the same change to carry its last deferred criterion, per the preservation test the same change added to roadmap-progress-sync. Walked here rather than banked because the gate reported the slack itself, and a baseline above the measurement is headroom a later change spends with nothing objecting."
+    },
+    {
+      "at": "2026-08-19",
+      "active_roadmaps": 33,
+      "later_roadmaps": 50,
+      "open_blockers": 71,
+      "why": "RAISED by 1 blocker, and the raise is the alternative to a silent drop rather than room made for new growth. road-to-run-continuation-observation step 0.1 carries the parent criterion \"a process-full contract run finishes a 3-phase roadmap with zero synchronous contacts, re-engaging across turns, and opens the PR\". Its sibling step 0.0 closed on a real engagement observed 2026-08-19, and 0.1 did NOT: this roadmap has one phase, so the three-phase half cannot be read off that run however the rest of it went, and closing it there would be the attribution error the step's own text warns against. The choice was therefore between recording the gap as three-phase-contract-run, where the dashboard and this ratchet both see it, and leaving it as prose in a step nobody counts \u2014 which is the invisible-gate failure road-to-solution-minimalism recorded when its own halt lived in prose and the generated dashboard published zero blockers for a roadmap stopped for four days. Active and later are unchanged, which is the check that this is not a park wearing a tightening's clothes. The entry is class 3 rather than 0 on purpose and that bounds what the raise buys: an agent does the work, but choosing which roadmap gets worked next is the operator's, so no command produces a qualifying run and this number walks back down on the first three-phase autonomous roadmap anyone finishes from a worktree \u2014 as a side effect, with no dedicated effort."
     }
   ],
   "target": {

package/src/scripts/bench_hook_injection.ts

@@ -17,10 +17,27 @@
  *     the fix is a registered decision, not a silent default bump
  *   - per-slot SUM over all bound concerns > the slot cap → RED
  *
+ * NOT FULLY DETERMINISTIC — this paragraph replaces a claim that said it was.
+ * The fixture path was described as "deterministic, CI-reproducible". For most
+ * concerns it is; they read only the committed envelope. But `end-review-nudge`
+ * decides whether to fire from the LIVE working-tree diff plus a once-per-session
+ * latch, so one commit reads 1,140 B with uncommitted changes present and 922 B
+ * without them. Two values, observed three times in one session as the tree went
+ * dirty, clean and dirty again — the earlier wording here said "three different
+ * values", which counted the readings and not the values, and an R2 review was
+ * right to call that an unbacked number inside the paragraph that exists to
+ * replace an unbacked claim.
+ * Two consequences. A single run is a reading of THIS checkout right now, so its
+ * number must never be pinned as acceptance evidence (a roadmap note tried, and
+ * had to be corrected). And the BREACH verdict is unaffected regardless, because
+ * a state-dependent concern can only push the sum UP: a green run is still a
+ * green run. Documented rather than fixed, because making this hermetic means
+ * changing what the concern reads — a change to the concern, not to its bench.
+ *
  * HONEST SCOPE, stated up front: concerns are conditional-silence by design —
  * a generic fixture triggers few of them, so most measure 0 bytes here. The
  * gate therefore enforces the cap on whatever DOES fire under the committed
- * fixtures (deterministic, CI-reproducible), while the census mode
+ * fixtures, while the census mode
  * (`--record`) measures REAL sessions: it appends counts-only lines
  * ({ts, slot, concern, bytes}) to agents/runtime/state/injection-census.jsonl
  * — the repeat-injection-census blocker's instrument. Claiming the fixture

package/src/scripts/hooks/host_semantics.ts

@@ -97,6 +97,34 @@ export function claudeAdditionalContext(event: string, text: string): string {
     })}\n`;
 }
 
+/**
+ * Will `emitFor` actually put the reasons on a stream?
+ *
+ * The per-turn injection ceiling (`injection_budget.ts`) may only charge bytes
+ * the host receives. Two branches of `emitFor` below emit nothing REGARDLESS of
+ * the reasons, and those are the two this predicate answers for: an unverified
+ * platform (legacy pass-through) and `severity: allow`. The budget module
+ * originally covered only the first, which let an `allow` dispatch spend the turn
+ * on output nobody got — and a crashed non-`fail_closed` concern is fail-opened
+ * to exactly that verdict with its stack trace as the largest candidate.
+ *
+ * A THIRD non-emitting case exists and this predicate deliberately does not claim
+ * it: a `warn` whose joined reason comes out empty, because `_joinReasons` trims
+ * and drops blanks, so a whitespace-only advisory text emits nothing either. It
+ * is content-dependent rather than a property of `(platform, severity)`, so a
+ * predicate with this signature cannot decide it — stated here rather than left
+ * to be discovered, since an R2 review found the earlier "TWO branches" wording
+ * asserting a completeness it did not have.
+ *
+ * Kept beside `emitFor` deliberately rather than re-derived at the call site:
+ * the predicate is only correct while it mirrors the function below it, and a
+ * copy one module away is a copy that drifts.
+ */
+export function emissionCarriesReasons(platform: string, severity: Severity): boolean {
+    if (!VERIFIED_PLATFORMS.has(platform)) return false;
+    return severity !== "allow";
+}
+
 /**
  * Translate (platform, event, severity, reasons) into a native emission.
  *

package/src/scripts/hooks/injection_budget.ts

@@ -67,7 +67,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 
 import { log_dispatch_issue } from "./dispatch_issues.js";
-import { VERIFIED_PLATFORMS } from "./host_semantics.js";
+import { VERIFIED_PLATFORMS, emissionCarriesReasons, type Severity } from "./host_semantics.js";
 
 /**
  * The event that STARTS a turn, and therefore the one that resets the per-turn
@@ -81,6 +81,20 @@ export const RC_ALLOW = 0;
 export const RC_BLOCK = 1;
 export const RC_WARN = 2;
 
+/**
+ * The host-facing severity for a reduced exit code, mirroring
+ * `dispatch_hook._severity_for`. Local rather than imported: this module is
+ * imported BY the dispatcher, so reaching back would close an import cycle.
+ * Anything outside the ladder reads as `block`, the conservative direction —
+ * an unknown verdict must never be treated as "emits nothing" and silently
+ * skip the ceiling.
+ */
+function _severityForRc(rc: number): Severity {
+    if (rc === RC_ALLOW) return "allow";
+    if (rc === RC_WARN) return "warn";
+    return "block";
+}
+
 /** Why a candidate did not survive shaping. */
 export type DropReason = "nudge_interference" | "injection_budget";
 
@@ -321,10 +335,91 @@ export interface TurnSpend {
     readonly bytes: number;
 }
 
-export const TURN_SPEND_BASENAME = "injection-turn.json";
+/** The per-session directory the counters live in. */
+export const TURN_SPEND_DIR_REL = path.join("agents", "runtime", "state", "injection-turn");
+
+/** Keep the directory bounded; oldest files are pruned past this many. */
+export const TURN_SPEND_MAX_FILES = 64;
+
+/**
+ * A session id reduced to ONE safe path segment.
+ *
+ * Two jobs, and the second is why a plain `replace` is not enough: the id is
+ * host-supplied, so it must not escape the directory (`../`), and it must not
+ * blow the filesystem's name limit. Anything outside a conservative charset is
+ * replaced, and the basename carries a short digest of the ORIGINAL id so two
+ * ids that sanitise to the same characters still land on different counters.
+ *
+ * The digest is a 32-bit FNV-1a-style mix over the id's UTF-16 code units — not
+ * over its encoded bytes, and not a cryptographic hash. So the collision claim
+ * is a PROBABILITY, not an absolute: ~2^-32 per pair, and the consequence of one
+ * is exactly the shared-file defect this layout removes (the foreign read returns
+ * 0, then the write clobbers). That is the honest bound; "can never collide" was
+ * the first version of this sentence and an R2 review was right to reject it.
+ */
+export function turnSpendKey(session: string): string {
+    const safe = session.replace(/[^A-Za-z0-9._-]/g, "_");
+    let h = 0x811c9dc5;
+    for (let i = 0; i < session.length; i += 1) {
+        h ^= session.charCodeAt(i);
+        h = Math.imul(h, 0x01000193) >>> 0;
+    }
+    const digest = h.toString(16).padStart(8, "0");
+    // The digest is unconditional rather than only-when-needed: a conditional
+    // suffix means two code paths can produce the same basename for different
+    // ids, which is the collision it exists to prevent.
+    return `${safe.slice(0, 96)}.${digest}`;
+}
 
-export function turnSpendPath(workspaceRoot: string): string {
-    return path.join(workspaceRoot, "agents", "runtime", "state", TURN_SPEND_BASENAME);
+/**
+ * Path of ONE session's counter.
+ *
+ * Per session, not per workspace, and that was a defect rather than a
+ * refinement: with a single shared file, two concurrent sessions in one
+ * workspace read each other's record, saw a foreign id, resolved to "nothing
+ * spent", and then overwrote it — so the ceiling was effectively unenforced for
+ * both, every fire. The estate's existing pattern for per-session state is a
+ * directory (`agents/runtime/state/end-review-nudge/`); this follows it.
+ */
+export function turnSpendPath(workspaceRoot: string, session: string): string {
+    return path.join(workspaceRoot, TURN_SPEND_DIR_REL, `${turnSpendKey(session)}.json`);
+}
+
+/**
+ * Drop the oldest counters once the directory passes its cap.
+ *
+ * A per-session file trades one unbounded counter for unbounded FILES, so the
+ * cap is part of the same change rather than a follow-up. Best-effort and
+ * silent: failing to prune must never affect a dispatch.
+ */
+function _pruneTurnSpend(dir: string): void {
+    try {
+        // `.tmp` is included deliberately: the temp file is `<name>.json.<pid>.tmp`,
+        // which does NOT end in `.json`, so a `.json`-only filter left every temp
+        // leaked by a crash between the write and the rename to accumulate forever
+        // — unbounded growth in the directory this cap exists to bound.
+        const entries = fs
+            .readdirSync(dir)
+            .filter((n) => n.endsWith(".json") || n.endsWith(".tmp"))
+            .map((n) => {
+                const p = path.join(dir, n);
+                try {
+                    return { p, mtime: fs.statSync(p).mtimeMs };
+                } catch {
+                    return { p, mtime: 0 };
+                }
+            })
+            .sort((a, b) => b.mtime - a.mtime);
+        for (const stale of entries.slice(TURN_SPEND_MAX_FILES)) {
+            try {
+                fs.unlinkSync(stale.p);
+            } catch {
+                /* a file another process already removed is the desired state */
+            }
+        }
+    } catch {
+        /* unreadable directory — nothing to prune, nothing to report */
+    }
 }
 
 /**
@@ -335,7 +430,7 @@ export function turnSpendPath(workspaceRoot: string): string {
  */
 export function readTurnSpend(workspaceRoot: string, session: string): number {
     try {
-        const raw = fs.readFileSync(turnSpendPath(workspaceRoot), "utf-8");
+        const raw = fs.readFileSync(turnSpendPath(workspaceRoot, session), "utf-8");
         const parsed = JSON.parse(raw) as Partial<TurnSpend>;
         if (parsed.session !== session) return 0;
         return typeof parsed.bytes === "number" &&
@@ -355,6 +450,16 @@ export function readTurnSpend(workspaceRoot: string, session: string): number {
  *
  * `reset` is passed on the slot that STARTS a turn (`user_prompt_submit`), so
  * the count is bounded by one turn rather than growing across a session.
+ *
+ * The write is a temp file plus a rename, which buys exactly one thing: no reader
+ * ever sees a TORN file. It does NOT serialise the read-modify-write — the read
+ * at the top of this function and the write below it are still two steps, so two
+ * interleaved dispatches of the same session can still lose an update. Claiming
+ * otherwise was an R2 finding on the first version of this docblock, and the
+ * narrower claim is the true one. The residual failure is under-counting, which
+ * is the safe direction: an accounting error must never be the reason an advisory
+ * disappears. The sibling counter in this estate (`rule-trips.json`) uses the
+ * same primitive for the same class of artefact in the same directory.
  */
 export function recordTurnSpend(
     workspaceRoot: string,
@@ -366,9 +471,13 @@ export function recordTurnSpend(
     const previous = opts.reset === true ? 0 : readTurnSpend(workspaceRoot, session);
     const entry: TurnSpend = { session, bytes: previous + Math.max(0, bytes) };
     try {
-        const target = turnSpendPath(workspaceRoot);
-        fs.mkdirSync(path.dirname(target), { recursive: true });
-        fs.writeFileSync(target, JSON.stringify(entry) + "\n", { encoding: "utf-8" });
+        const target = turnSpendPath(workspaceRoot, session);
+        const dir = path.dirname(target);
+        fs.mkdirSync(dir, { recursive: true });
+        const tmp = `${target}.${String(process.pid)}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(entry) + "\n", { encoding: "utf-8" });
+        fs.renameSync(tmp, target);
+        _pruneTurnSpend(dir);
     } catch {
         /* observability-adjacent bookkeeping never breaks the agent loop */
     }
@@ -536,17 +645,44 @@ export function shapeAndRecord(
                 nudgeRank: typeof rank === "number" ? rank : null,
             };
         });
-    // Skipped wholesale where the emission carries nothing: on an unverified
-    // platform `emitFor` returns empty stdout AND stderr, so choosing between two
-    // messages there would write advisory-suppression records into the consumer's
-    // log for output that never left the process. Nothing to shape is not the
-    // same as shaping to nothing.
-    if (!VERIFIED_PLATFORMS.has(ctx.platform)) {
-        return textOf(new Set(candidates.map((c) => c.concern)));
-    }
     const workspaceRoot = _workspaceRoot(ctx);
     const sessionKey = _sessionKey(ctx) ?? "";
     const cap = resolveVolumeCap(ctx);
+    // Where the emission carries nothing, skip the CHARGE — never the reset.
+    // Two such cases, and one reason for both: this is an INJECTION ceiling, so
+    // it may only charge bytes the host actually receives. Shaping output that
+    // never left would write advisory-suppression records for nothing and —
+    // worse — spend the turn's budget, so a LATER dispatch whose advisory WOULD
+    // have been delivered gets dropped instead.
+    //
+    //   1. an unverified platform — `emitFor` returns the legacy pass-through,
+    //      empty stdout AND stderr;
+    //   2. a reduced verdict of ALLOW — `emitFor` returns
+    //      `{exit: 0, stdout: "", stderr: ""}` for `severity: allow`, on every
+    //      platform including the verified one.
+    //
+    // Case 2 was missed when this module landed, and it is not theoretical. A
+    // non-`fail_closed` concern that CRASHES is fail-opened to `EXIT_ALLOW` by
+    // the dispatcher and its stderr then becomes the deciding message — usually
+    // the largest candidate in the set. Measured against this module before the
+    // fix: a 9,000-byte rc-0 message emitted 0 bytes and charged 9,000, so about
+    // five such dispatches exhausted a 47,104-byte turn ceiling on output nobody
+    // received. `emissionCarriesReasons` is the shared predicate, kept beside
+    // `emitFor` so it cannot drift from the function whose behaviour it reports.
+    //
+    // THE RESET STILL HAS TO RUN, and getting that wrong was an R2 finding on the
+    // first version of this fix. `_reduce([])` is `EXIT_ALLOW`, so a
+    // `user_prompt_submit` where no concern fires — the common case for
+    // conditional-silence concerns — takes this branch. Returning here without
+    // resetting left the PREVIOUS turn's total on disk, and later dispatches in
+    // the new turn then dropped advisories to pay for bytes belonging to an
+    // earlier one. Skipping a charge and skipping a boundary are different acts.
+    if (!emissionCarriesReasons(ctx.platform, _severityForRc(finalRc))) {
+        if (cap !== null && ctx.event === TURN_START_EVENT) {
+            recordTurnSpend(workspaceRoot, sessionKey, 0, { reset: true });
+        }
+        return textOf(new Set(candidates.map((c) => c.concern)));
+    }
     // On the turn-START slot the carried total is zero by definition: this is the
     // dispatch that begins the turn. Reading the stored value here budgeted the
     // new turn against the one that just ended.