@event4u/agent-config 14.6.0 → 14.8.0

package/src/scripts/hooks/stdin_failure_policy.ts

@@ -0,0 +1,96 @@
+/**
+ * The stdin-read-failure policy, extracted from `dispatch_hook.ts`.
+ *
+ * These functions are pure with respect to dispatch_hook's own state: they take
+ * what they need as parameters and return a verdict. They do call two imported
+ * helpers (`readFd0ToEnd`, `isBlockCapable`), which move with them as imports. The module-level flag they feed, `_stdin_read_failed`, stays in
+ * dispatch_hook.ts, written at exactly one call site and read at three. That
+ * asymmetry is what makes moving the functions safe and the state untouched.
+ *
+ * Extracted because dispatch_hook.ts sits at the 1500-line source ceiling.
+ */
+import type { JsonObject } from './dispatch_hook.js';
+import { readFd0ToEnd } from './hook_stdin.js';
+import { isBlockCapable } from './host_semantics.js';
+
+/**
+ * The seam where a FAILED read becomes an empty string — isolated so the three
+ * failure classes the policy names can be driven with real errno values.
+ *
+ * Returns the failure message, or `null` when the read succeeded. The read
+ * itself is injectable for exactly one reason: `EAGAIN` exhaustion, `EIO` and
+ * `EBADF` cannot be staged against a live fd 0 portably, and a policy whose
+ * trigger is untestable is a policy nobody can show works. What the injection
+ * does NOT buy is proof that the production path reaches here — that is the
+ * wiring, pinned separately by driving `main()`.
+ */
+export function stdinReadFailure(read: () => string = readFd0ToEnd): {
+  text: string;
+  failure: string | null;
+} {
+  try {
+    // Reads to EOF and retries on EAGAIN rather than treating it as empty
+    // input; shared with the concern-side reader so both paths cannot drift.
+    return { text: read(), failure: null };
+  } catch (exc) {
+    return { text: "", failure: exc instanceof Error ? exc.message : String(exc) };
+  }
+}
+
+/**
+ * Is this concern one whose verdict a failed read silently converted into an
+ * allow?
+ *
+ * Both halves are required and neither is redundant. `fail_closed: true` is the
+ * manifest's declaration that this concern's own crash must not become a pass;
+ * `severity: blocking` is the declaration that it can refuse at all. An
+ * advisory concern that happens to be `fail_closed` has no verdict to lose, and
+ * a blocking concern that is not `fail_closed` has already declared the opposite
+ * intent.
+ */
+export function _is_fail_closed_blocking(concern: JsonObject): boolean {
+  const severity = String(concern["severity"] ?? "").trim().toLowerCase();
+  return concern["fail_closed"] === true && severity === "blocking";
+}
+
+/**
+ * `b-stdin-read-failure-policy`, option (c) — deny a failed read ONLY where a
+ * deny is honoured AND something was actually silenced.
+ *
+ * Decided by council 2026-08-20, 2/2 quorum, both seats on option (c):
+ * "on a read failure, deny only when the slot is block-capable and at least one
+ * selected concern is both blocking and `fail_closed: true`".
+ *
+ * The two rejected options are worth keeping visible, because each is the
+ * obvious move. Denying on EVERY slot (option (a)) refuses nothing on
+ * `post_tool_use` — the tool already ran — and on `stop` it breaks a turn end
+ * to protect a guard that was never there; it buys availability risk for no
+ * enforcement. Keeping the allow (option (b), the status quo) leaves a
+ * documented allow-on-failure on a security path: F-1 measured a
+ * `git commit --no-verify` DENIED at small payload size and ALLOWED at 300 KB,
+ * and the loud stderr line that now ships makes that visible without making it
+ * stop.
+ *
+ * The cost is stated rather than hidden: a transient I/O error on
+ * `pre_tool_use` now refuses a tool call the user must retry. The retry budget
+ * already survived ~10 s of `EAGAIN` before this point, so the class of error
+ * that reaches here is not "the writer was slow".
+ *
+ * Returns `null` when the dispatch proceeds normally.
+ */
+export function denyOnStdinFailure(
+  platform: string,
+  event: string,
+  concerns: readonly JsonObject[],
+  failure: string,
+): { reason: string } | null {
+  if (!isBlockCapable(platform, event)) return null;
+  const silenced = concerns.filter(_is_fail_closed_blocking).map((c) => String(c["name"]));
+  if (silenced.length === 0) return null;
+  return {
+    reason:
+      `agent-config: refusing this action — the hook payload could not be read ` +
+      `(${failure}), so ${silenced.join(", ")} evaluated nothing. ` +
+      `A fail-closed guard on a block-capable slot must not pass by default. Retry.`,
+  };
+}

package/src/scripts/hooks/subagent_ledger_hook.ts

@@ -35,8 +35,9 @@
  *     (`Explore` / `general-purpose` / `production-validator` / …), the same
  *     single host string `orchestration_record_hook` already records.
  *   - `last_assistant_message` is free model prose and is NEVER recorded, in
- *     any form — not truncated, not hashed, not summarised. Only the three-way
- *     parse VERDICT (`ok` / `fail` / `absent`) and a validator error COUNT
+ *     any form — not truncated, not hashed, not summarised. Only the four-way
+ *     parse VERDICT (`ok` / `fail` / `no_message` / `no_envelope`) and a
+ *     validator error COUNT
  *     leave this function. A record type with no field able to hold prose has
  *     no scrubber that can fail.
  *
@@ -196,7 +197,20 @@ function extractParentId(payload: JsonObject, ownId: string | null): string | nu
     return null;
 }
 
-export type EnvelopeParse = 'ok' | 'fail' | 'absent';
+export type EnvelopeParse = 'ok' | 'fail' | 'no_message' | 'no_envelope';
+
+/**
+ * The retired fifth value. Records written before 2026-08-20 carry `absent`,
+ * which collapsed `no_message` and `no_envelope` into one bucket.
+ *
+ * It is deliberately NOT in the union. Nothing reads `envelope_parse` back
+ * programmatically — the only writer is this file and the only reader is a
+ * human or a `grep` — so there is no consumer to keep compatible, and leaving
+ * the value writable would let the collapse reappear. A reader of the
+ * historical window must treat `absent` as "one of the two, unknown which":
+ * the measurement it supports starts at the split, not before it.
+ */
+export const RETIRED_ENVELOPE_PARSE = 'absent';
 
 export interface ParseVerdict {
     verdict: EnvelopeParse;
@@ -207,18 +221,33 @@ export interface ParseVerdict {
 /**
  * Classify a subagent's final message against the response-envelope contract.
  *
- * Three outcomes, and the distinction between the last two is the whole point
- * of the measurement: `absent` means no envelope was found to judge, `fail`
- * means one was found and did not satisfy `validateResponse`. Collapsing them
- * would make the Phase-1 baseline unable to separate "the worker never
- * returned a structured result" from "it returned a malformed one" — two
- * different defects with two different fixes.
+ * Four outcomes, and every boundary between them separates two defects with
+ * two different fixes:
+ *
+ *   - `no_message` — the host delivered no `last_assistant_message` at all
+ *     (null, or whitespace only). This is the return-channel loss #58109
+ *     describes, and it is the ONLY verdict a disk-envelope fallback may key
+ *     on.
+ *   - `no_envelope` — a message arrived and carried no JSON object. This is
+ *     the overwhelmingly common case: subagents answer in prose. It is not a
+ *     channel failure, and a fallback keyed on it would fire on nearly every
+ *     dispatch.
+ *   - `fail` — an object arrived and did not satisfy `validateResponse`.
+ *   - `ok` — an object arrived and validated.
+ *
+ * The first two used to be one value, `absent`. Over the first measured window
+ * that collapse read 25 of 25 `absent` — including the #58109 control arm that
+ * returned a complete report — so a rate computed off it measured the answer
+ * format rather than the channel
+ * (`agents/evidence/investigations/subagent-lifecycle-phase0-return-channel.md`
+ * § F2). Splitting them is what makes the Phase-1 baseline's return-rate
+ * column, and Phase 2's fallback condition, expressible at all.
  */
 export function classifyEnvelope(message: string | null): ParseVerdict {
-    if (message === null || !message.trim()) return { verdict: 'absent', error_count: 0 };
+    if (message === null || !message.trim()) return { verdict: 'no_message', error_count: 0 };
 
     const candidates = _jsonObjectCandidates(message);
-    if (candidates.length === 0) return { verdict: 'absent', error_count: 0 };
+    if (candidates.length === 0) return { verdict: 'no_envelope', error_count: 0 };
 
     // A message may carry several object-shaped spans. The envelope is the one
     // that validates, so a `fail` is only reported once every candidate has
@@ -229,7 +258,7 @@ export function classifyEnvelope(message: string | null): ParseVerdict {
         if (result.valid) return { verdict: 'ok', error_count: 0 };
         if (best === null) best = { verdict: 'fail', error_count: result.errors.length };
     }
-    return best ?? { verdict: 'absent', error_count: 0 };
+    return best ?? { verdict: 'no_envelope', error_count: 0 };
 }
 
 /**
@@ -239,9 +268,9 @@ export function classifyEnvelope(message: string | null): ParseVerdict {
  * R2 finding 4: the previous implementation took the span from the first `{`
  * to the LAST `}`, so a valid envelope followed by any later brace in prose
  * ("… — done. See {done}.") produced unparseable text and was reported
- * `absent` — routing an extraction failure into the "never returned anything"
- * bucket that the whole three-way verdict exists to keep separate, and biasing
- * the Phase-1 return-rate falsifier downward.
+ * `no_envelope` — routing an extraction failure into the "answered in prose"
+ * bucket that the verdict split exists to keep separate, and biasing the
+ * Phase-1 return-rate falsifier downward.
  *
  * R2 finding 11: fenced blocks are now matched with an anchored, global scan
  * rather than a first-match-anywhere regex, which used to be able to match at

package/src/scripts/hooks/telemetry_flush_hook.ts

@@ -0,0 +1,139 @@
+#!/usr/bin/env tsx
+/**
+ * Session-end Class-A flush (road-to-org-telemetry Phase 2, step 2.1).
+ *
+ * WHAT THIS CONCERN DOES, IN ONE SENTENCE: it checks whether the outbound
+ * spool has bytes and, if so, spawns a detached sender and returns. It makes
+ * no network call of its own, in this process, ever.
+ *
+ * THAT SHAPE IS MEASURED, NOT PREFERRED. Phase 0's second spike
+ * pre-registered "added latency at or below one second at p95" for an INLINE
+ * session-end flush and measured it failing: 0.4 ms against a healthy sink,
+ * 0.3 ms against a refused connection, and **1002 ms against a blackhole** —
+ * a socket that accepts and never answers, which is the shape a wedged sink
+ * actually takes. Against the same blackhole the detached spool measured
+ * 20.5 ms p95, dominated by process spawn. The step's own text defers to that
+ * result, so this concern is the spool half of it.
+ *
+ * DEFAULT-OFF, AND `enabled` IS NOT THE SWITCH. `read_remote_settings`
+ * resolves `active` only when `enabled` is true AND the org pack supplied an
+ * endpoint, an org id and a salt — none of which has a default and none of
+ * which this public repository ships a value for. A clone therefore cannot
+ * reach the spawn path. `flush: never` (the value an org sets to keep records
+ * local) short-circuits before the spool is even stat-ed.
+ *
+ * ZERO FILE OPERATIONS WHEN INACTIVE, and the spool `stat` is the only one
+ * when active-but-idle: most sessions invoke no skill, so there is no spool
+ * to drain and the concern costs one `stat` and returns.
+ *
+ * EXIT CODE IS ALWAYS 0 and stdout is always empty. A hook `warn` (exit 2) is
+ * read as a hard BLOCK on the verified host, and a telemetry concern has
+ * nothing to say to the model — least of all at session end, where a message
+ * would arrive after the last thing the user reads.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import {
+    DEFAULT_FLUSH_TIMEOUT_MS,
+    FLUSH_SESSION_END,
+    spawn_detached_sender,
+    spool_has_work,
+    spool_path_for,
+} from '../../agent-src/templates/scripts/telemetry/transport.js';
+import { is_replay_mode } from './state_io.js';
+import { readHookStdin } from './hook_stdin.js';
+import { _resolveRoot, readSettingsFor } from './telemetry_usage_hook.js';
+
+const EXIT_ALLOW = 0;
+
+/**
+ * Where `flush_sender.mjs` lives, relative to this module.
+ *
+ * Resolved from `import.meta.url` and then existence-checked, rather than
+ * assumed: under an esbuild bundle every module shares the bundle's own URL,
+ * so this path can be wrong. A wrong path must degrade to "no flush this
+ * session" (the records stay spooled and go out next time) and never to a
+ * spawn of something that is not the sender.
+ */
+export const SENDER_REL = '../../agent-src/templates/scripts/telemetry/flush_sender.mjs';
+
+export function resolveSenderScript(): string | null {
+    try {
+        const here = path.dirname(fileURLToPath(import.meta.url));
+        const candidate = path.resolve(here, SENDER_REL);
+        return fs.statSync(candidate).isFile() ? candidate : null;
+    } catch {
+        return null;
+    }
+}
+
+export interface FlushOutcome {
+    /** `spawned` is the only outcome that starts a process. */
+    readonly result: 'inactive' | 'flush-never' | 'empty-spool' | 'no-sender' | 'replay' | 'spawned';
+}
+
+export function flushFor(consumer_root: string, sender: string | null = resolveSenderScript()): FlushOutcome {
+    try {
+        const { settings, root } = readSettingsFor(consumer_root);
+        if (!settings.active) return { result: 'inactive' };
+        if (settings.flush !== FLUSH_SESSION_END) return { result: 'flush-never' };
+        if (is_replay_mode()) return { result: 'replay' };
+
+        // Relative to the PROJECT root, matching the appender exactly — a
+        // flush that resolved the log against the session cwd would drain a
+        // spool nobody writes.
+        const logPath = path.isAbsolute(settings.log_path)
+            ? settings.log_path
+            : path.join(root, settings.log_path);
+        const spool = spool_path_for(logPath);
+        if (!spool_has_work(spool)) return { result: 'empty-spool' };
+        if (sender === null) return { result: 'no-sender' };
+
+        const ok = spawn_detached_sender({
+            sender_script: sender,
+            spool_path: spool,
+            endpoint: settings.endpoint,
+            timeout_ms: DEFAULT_FLUSH_TIMEOUT_MS,
+        });
+        return { result: ok ? 'spawned' : 'no-sender' };
+    } catch {
+        return { result: 'inactive' };
+    }
+}
+
+export function run(stdin_text: string, options: { consumer_root: string }): number {
+    flushFor(options.consumer_root);
+    return EXIT_ALLOW;
+}
+
+export function main(): number {
+    const raw = readHookStdin();
+    let envelope: unknown = {};
+    try {
+        envelope = raw.trim() ? JSON.parse(raw) : {};
+    } catch {
+        envelope = {};
+    }
+    flushFor(_resolveRoot(envelope as never));
+    return EXIT_ALLOW;
+}
+
+// Bundle-safety: never auto-run when inlined into an esbuild bundle, where
+// every module shares the bundle's `import.meta.url` (see cmd_migrate.ts).
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+function _isCliEntry(): boolean {
+    if (typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__) {
+        return false;
+    }
+    if (process.argv[1] === undefined) return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) return true;
+    try {
+        return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(process.argv[1]));
+    } catch {
+        return false;
+    }
+}
+if (_isCliEntry()) process.exit(main());

package/src/scripts/hooks/telemetry_self_repair.ts

@@ -0,0 +1,128 @@
+/**
+ * The Class-A self-repair shadow (road-to-org-telemetry Phase 5, step 5.1).
+ *
+ * One function, called from `self_repair_hook.ts` immediately after a defect
+ * is queued. It emits a structural record saying that a defect of a named
+ * class occurred — never what happened.
+ *
+ * WHY THIS IS NOT A CONCERN OF ITS OWN. The event it reacts to is not a host
+ * event; it is "the self-repair store just accepted a record". Binding a
+ * second concern to the same two slots would re-run the detectors to find out
+ * whether the first one wrote anything, so the emission belongs at the seam
+ * where the answer is already in hand.
+ *
+ * WHAT IT CANNOT LEAK, BY CONSTRUCTION. `ClassADefectRecord` has no field able
+ * to hold free-form text. `DefectFinding.evidence` (a quoted span of the
+ * offending text) and `suggested_surface` (a free sentence) are the Class-B
+ * payload and are not passed to the builder at all — not sanitized, not
+ * truncated, not optional. There is no scrubber here because there is nothing
+ * for a scrubber to fail on.
+ *
+ * DEFAULT-OFF on the same terms as every other telemetry writer: `active`
+ * needs `enabled` AND an endpoint AND an org id AND a salt, none of which this
+ * public repository ships a value for. Inactive means zero file operations.
+ *
+ * NEVER THROWS. The caller wraps it, and the store write has already
+ * succeeded by the time it runs; a telemetry failure must not cost the user
+ * their turn or their queued defect.
+ */
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+import {
+    append_class_a_record,
+    build_class_a_defect_record,
+} from '../../agent-src/templates/scripts/telemetry/remote.js';
+import {
+    FLUSH_SESSION_END,
+    spool_path_for,
+} from '../../agent-src/templates/scripts/telemetry/transport.js';
+import { DEFECT_CLASSES, type DefectRecord } from '../_lib/self_repair.js';
+import { is_replay_mode } from './state_io.js';
+import {
+    extractDisciplineProfile,
+    extractPackageVersion,
+    readSettingsFor,
+} from './telemetry_usage_hook.js';
+
+type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
+type JsonObject = { [k: string]: JsonValue };
+
+function str(v: JsonValue | undefined): string {
+    return typeof v === 'string' ? v : '';
+}
+
+/** Host id off the dispatcher envelope, or `null` when it carried none. */
+export function hostOf(env: JsonObject): string | null {
+    const v = str(env['platform']) || str(env['host']);
+    return v === '' ? null : v;
+}
+
+/** The host session id, hashed downstream and never recorded raw. */
+export function sessionIdOf(env: JsonObject): string {
+    return str(env['session_id']) || str(env['sessionId']);
+}
+
+export type ShadowOutcome =
+    | 'inactive'
+    | 'replay'
+    | 'unknown-class'
+    | 'written'
+    | 'failed';
+
+/**
+ * Emit the shadow for one queued defect. Returns what it did, for tests —
+ * the caller ignores it.
+ */
+export function emitDefectShadow(
+    root: string,
+    rec: DefectRecord,
+    env: JsonObject,
+): ShadowOutcome {
+    try {
+        const { settings, text, root: projectRoot } = readSettingsFor(root);
+        if (!settings.active) return 'inactive';
+        if (is_replay_mode()) return 'replay';
+
+        // The vocabulary is pinned in `self_repair.ts` and mirrored into the
+        // upstream issue form by test. A class outside it means a detector was
+        // added without the rest of its registration; recording it would put
+        // an unpinned value into an org's record set, so it is dropped and the
+        // local queue keeps the defect regardless.
+        if (!(DEFECT_CLASSES as readonly string[]).includes(rec.defect_class)) {
+            return 'unknown-class';
+        }
+
+        const record = build_class_a_defect_record({
+            defect_class: rec.defect_class,
+            defect_source: rec.source,
+            occurrences: rec.occurrences,
+            host: hostOf(env),
+            org_id: settings.org_id,
+            salt: settings.salt,
+            hostname: os.hostname(),
+            username: os.userInfo().username,
+            session_id: sessionIdOf(env),
+            package_version: extractPackageVersion(process.env),
+            discipline_profile: extractDisciplineProfile(text),
+        });
+
+        const logPath = path.isAbsolute(settings.log_path)
+            ? settings.log_path
+            : path.join(projectRoot, settings.log_path);
+        const spool = settings.flush === FLUSH_SESSION_END ? spool_path_for(logPath) : null;
+        append_class_a_record(
+            logPath,
+            record,
+            {
+                max_age_days: settings.retention_max_age_days,
+                max_bytes: settings.retention_max_bytes,
+            },
+            new Date(),
+            spool,
+        );
+        return 'written';
+    } catch {
+        return 'failed';
+    }
+}

package/src/scripts/hooks/telemetry_usage_hook.ts

@@ -51,6 +51,10 @@ import {
     build_class_a_record,
     profile_from_legacy_tier,
 } from '../../agent-src/templates/scripts/telemetry/remote.js';
+import {
+    FLUSH_SESSION_END,
+    spool_path_for,
+} from '../../agent-src/templates/scripts/telemetry/transport.js';
 import { is_replay_mode } from './state_io.js';
 import { readHookStdin } from './hook_stdin.js';
 
@@ -271,14 +275,28 @@ function processEnvelope(envelope: JsonValue, consumer_root: string): number {
         const logPath = path.isAbsolute(settings.log_path)
             ? settings.log_path
             : path.join(root, settings.log_path);
+        // The outbound spool (Phase 2, step 2.1) is written HERE, by the same
+        // call that logs the record, and only when the install declared a
+        // flush. Under `flush: never` there is no transport at all, so a spool
+        // would be a file that grows and is never drained. The path is derived
+        // rather than configured so an install cannot point the spool
+        // somewhere the appender does not write — a failure whose symptom
+        // (records logged locally, nothing ever sent) is invisible.
+        const spool = settings.flush === FLUSH_SESSION_END ? spool_path_for(logPath) : null;
         // The growth budget travels from the settings the install actually
         // declared, not from the appender's own defaults — a retention key
         // the write path never reads would be a setting that decorates
         // rather than decides.
-        append_class_a_record(logPath, record, {
-            max_age_days: settings.retention_max_age_days,
-            max_bytes: settings.retention_max_bytes,
-        });
+        append_class_a_record(
+            logPath,
+            record,
+            {
+                max_age_days: settings.retention_max_age_days,
+                max_bytes: settings.retention_max_bytes,
+            },
+            new Date(),
+            spool,
+        );
     } catch {
         // Malformed payload, unreadable disk, a rejected id — never block
         // the tool call, and never write a degraded record.

package/src/scripts/hooks/turn_end_gate_hook.ts

@@ -146,17 +146,25 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import {
     classify,
+    hasStableSessionId,
     isSyntheticPrompt,
-    STATE_FILE as LANGUAGE_STATE_FILE,
+    statePathFor as languageStatePathFor,
     type Verdict,
 } from '../language_mirror_hook.js';
-// Round 7 § Phase 1 — the CI-settle producer. Imported for its STATE_FILE only,
-// so the consumer cannot read a path the producer does not write.
-import { STATE_FILE as CI_STATE_FILE } from '../before_complete_hook.js';
+// Round 7 § Phase 1 — the CI-settle producer. Imported for its path BUILDER, not
+// for a path constant: "the consumer cannot read a path the producer does not
+// write" is only true while the two agree, and importing a constant made that
+// agreement invisible when the producer's layout moved. A builder makes the move
+// a type error.
+import { statePathFor as ciStatePathFor } from '../before_complete_hook.js';
 import { isSafeTranscriptPath } from './end_review_nudge_hook.js';
 import { unwrap, type JsonObject, type JsonValue } from './envelope.js';
 import { readHookStdin } from './hook_stdin.js';
-import { atomic_write_json, is_replay_mode } from './state_io.js';
+import {
+    atomic_write_json,
+    is_replay_mode,
+    owns_session_state as ownsSessionState,
+} from './state_io.js';
 import { openRecordStats } from './subagent_ledger_hook.js';
 import {
     deriveSessionKey,
@@ -400,7 +408,17 @@ export interface LanguagePin {
  *
  * So the producer is `before_complete_hook`, which already sees tool output on
  * `post_tool_use` and already owns the `pendingCount` predicate. It writes
- * `ci_last` into `agents/state/verify-before-complete.json` and this reads it.
+ * `ci_last` into its own per-session state file under
+ * `agents/state/verify-before-complete/` and this reads it — via the producer's
+ * `statePathFor`, never a path literal, so the next move of that layout is a
+ * compile error instead of a detector that silently reads nothing. (That is not
+ * hypothetical: the sibling language pin moved exactly this way and its
+ * consumer here kept importing the abandoned constant, which turned a blocking
+ * detector off without a single failing test.)
+ *
+ * KEYED ON `session_id`, because the CI witness is a fact about ONE run.
+ * A no-id envelope reads as "no CI observed" — the producer persists nothing in
+ * that case, and the refusal direction that follows is the safe one.
  *
  * NO network call, deliberately. Asking `gh pr checks` here would put a network
  * round-trip on every turn-end; `road-to-hook-latency-repair` exists because that
@@ -412,10 +430,20 @@ export interface LanguagePin {
  * never saw. A stale NEGATIVE ("CI was not settled") only ever refuses more often.
  * Same freshness invariant, opposite failure direction.
  */
-export function readCiSettled(workspaceRoot: string): { seen: boolean; settled: boolean } {
+export function readCiSettled(
+    workspaceRoot: string,
+    session_id: string,
+): { seen: boolean; settled: boolean } {
+    if (!hasStableSessionId(session_id)) return { seen: false, settled: false };
     try {
-        const raw = fs.readFileSync(path.join(workspaceRoot, CI_STATE_FILE), 'utf-8');
+        const raw = fs.readFileSync(path.join(workspaceRoot, ciStatePathFor(session_id)), 'utf-8');
         const decoded: unknown = JSON.parse(raw);
+        // Same ownership check as the pin, and here it is the sharper of the two:
+        // a FOREIGN `ci_last: {settled: true}` vouches for a CI run this session
+        // never made, which is exactly the premature completion claim detector D
+        // exists to refuse. Refusing an unowned file returns "no CI observed",
+        // which never refuses a session for someone else's run.
+        if (!ownsSessionState(decoded, session_id)) return { seen: false, settled: false };
         if (typeof decoded === 'object' && decoded !== null && !Array.isArray(decoded)) {
             const ci = (decoded as Record<string, unknown>)['ci_last'];
             if (typeof ci === 'object' && ci !== null && !Array.isArray(ci)) {
@@ -496,11 +524,43 @@ export function detectCompletionClaim(
  *
  * (R2 finding 8: this line was left 73 lines above, where inserting `readCiSettled`
  * had stranded it — so it documented the wrong function and this one had none.)
+ *
+ * KEYED ON `session_id`, because the producer is. The import above says
+ * "imported for its STATE_FILE only, so the consumer cannot read a path the
+ * producer does not write" — and that discipline failed the moment the producer
+ * MOVED: `language_mirror_hook` split its state per session
+ * (`agents/state/language-mirror/<digest>.json`) and `_pruneLegacyState` now
+ * deletes the single file this function used to read. Importing the old symbol
+ * still compiled, so nothing broke loudly: `readLanguagePin` returned `und` for
+ * every turn, `detectLanguage` returned `null` for every turn, and detector B of
+ * a blocking gate stopped checking anything. Importing the path-BUILDER instead
+ * of a path constant is what makes the next such move a type error rather than a
+ * silent dead detector.
+ *
+ * NO LEGACY FALLBACK, deliberately. Reading `STATE_FILE` when the per-session
+ * file is absent would restore exactly the cross-session read the split closed:
+ * that file is shared by every session under one project root, so a neighbouring
+ * English session's pin would become this German session's obligation. A missing
+ * pin is the safe answer; a foreign pin is the defect.
+ *
+ * No stable id ⇒ `und`. The producer runs stateless in that case and persists
+ * nothing, so there is no pin to read — not "no obligation by accident", but the
+ * same degradation the producer documents, in the same direction (under-refuse).
  */
-export function readLanguagePin(workspaceRoot: string): Verdict {
+export function readLanguagePin(workspaceRoot: string, session_id: string): Verdict {
+    if (!hasStableSessionId(session_id)) return 'und';
     try {
-        const raw = fs.readFileSync(path.join(workspaceRoot, LANGUAGE_STATE_FILE), 'utf-8');
+        const raw = fs.readFileSync(
+            path.join(workspaceRoot, languageStatePathFor(session_id)),
+            'utf-8',
+        );
         const decoded: unknown = JSON.parse(raw);
+        // The digest path is not the whole guarantee — see `owns_session_state`.
+        // A file that reached this pathname by a copy, a restore, or a buggy
+        // writer still carries its real owner, and consuming it hands one
+        // session's pin to another. Refusing it costs a turn's obligation;
+        // accepting it is the cross-session read the split closed.
+        if (!ownsSessionState(decoded, session_id)) return 'und';
         if (typeof decoded === 'object' && decoded !== null && !Array.isArray(decoded)) {
             const lang = (decoded as Record<string, unknown>)['language'];
             if (lang === 'de' || lang === 'en') return lang;
@@ -1019,9 +1079,13 @@ export function main(): number {
     // than colliding, and this one collides. It is named here rather than
     // papered over — the degradation is toward UNDER-refusing, which is the safe
     // direction, and layer 1 still covers the host that sends the flag.
-    const sessionKey = deriveSessionKey(
-        str(envelope['session_id'] as JsonValue | undefined) || 'unknown-session',
-    );
+    // RAW id, kept beside the derived key rather than replaced by it:
+    // `readLanguagePin` addresses the producer's own per-session file, and the
+    // producer keys that on the raw `session_id`. Passing `sessionKey` here would
+    // read a path nothing writes — the same shape as the STATE_FILE break this
+    // parameter exists to close.
+    const rawSessionId = str(envelope['session_id'] as JsonValue | undefined) || '';
+    const sessionKey = deriveSessionKey(rawSessionId || 'unknown-session');
     if (alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal)) return EXIT_ALLOW;
 
     // B and C run on every turn-end; A and D run only when no dispatch is open
@@ -1042,7 +1106,7 @@ export function main(): number {
         // (Phase 3 Step 2, narrowed by R2 round 2 finding 2). B and C are not
         // excused by anything about a dispatch and run unchanged.
         dispatchOpen ? null : detectPromissory(lastAssistant),
-        detectLanguage(lastAssistant, readLanguagePin(workspaceRoot)),
+        detectLanguage(lastAssistant, readLanguagePin(workspaceRoot, rawSessionId)),
         detectUnverifiedEdit(toolCalls),
         // Round 7 § Phase 1 — detector D. It is NOT unconditional, and this
         // comment said it was while sitting one line above the `dispatchOpen`
@@ -1054,7 +1118,9 @@ export function main(): number {
         // gating is where the comment above says gating belongs — inside the
         // detector: no CI observed, or a settled read, or no completion claim
         // ⇒ no finding.
-        dispatchOpen ? null : detectCompletionClaim(lastAssistant, readCiSettled(workspaceRoot)),
+        dispatchOpen
+            ? null
+            : detectCompletionClaim(lastAssistant, readCiSettled(workspaceRoot, rawSessionId)),
     ]) {
         if (f) findings.push(f);
     }