@fusengine/harness 0.1.49 → 0.1.51

package/dist/{handle-D1hHqHvh.mjs → handle-QfgfNSh6.mjs}

@@ -1,4 +1,5 @@
 import { a as parseEnvInt, i as splitTarget, r as resolveMaxLines } from "./limits-CHn8AIL1.mjs";
+import { s as resolveTtlSec } from "./dotenv-Jj8aL1FL.mjs";
 import { r as projectLayout } from "./layout-C0jaaCQC.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { A as detectCreationIntent, E as isExcludedSwiftPath, F as docConsultedGate, H as detectProjectType$1, I as evaluateApex, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, S as usesTailwindUtilities, T as isExcludedJsPath, V as detectModularArchitecture, W as requiredArchSkill, _ as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, h as buildClaudeMdContext, k as capVerbosity, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, r as descFromText, s as parseEntry, t as isHtmlLike, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "./validate-DCQ8dkdL.mjs";
@@ -11,7 +12,7 @@ import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as setStateField, t as addRoot } from "./registry-CymilZiZ.mjs";
 import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, t as mcpCacheWrite, u as extractText } from "./mcp-store-BkBDmuxN.mjs";
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
-import { c as recordDoc, d as recordTrivialEdit, f as trivialCount, i as agentsFresh, l as recordRefRead, n as saveTrack, o as recordAgent, p as apexAuthorizationGate, r as verifyTrack, s as recordBrainstormRequired, t as loadTrack, u as recordTarget } from "./store-QSSTO3lY.mjs";
+import { a as writeLastNonce, c as recordAgent, d as recordRefRead, f as recordTarget, h as apexAuthorizationGate, i as verifyTrack, l as recordBrainstormRequired, m as trivialCount, n as saveTrack, o as agentsFresh, p as recordTrivialEdit, r as signTrack, s as emptyTrack, t as loadTrack, u as recordDoc } from "./store-CQ4roWrU.mjs";
 import { d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-BxC9semG.mjs";
 import { r as toHermesResponse } from "./hermes-DWXCRFZU.mjs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
@@ -327,18 +328,81 @@ function designLifecycle(payload, cacheDir, cwd, stamp, now) {
 	}
 	return false;
 }
+/** Sidecar basename under the per-project state dir. */
+const SIDECAR$1 = "inject-dedup.json";
+/** Load the `{ key -> epochMs }` map, or `{}` when missing/corrupt. */
+function loadMap$1(path) {
+	try {
+		if (!existsSync(path)) return {};
+		const data = JSON.parse(readFileSync(path, "utf8"));
+		return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+	} catch {
+		return {};
+	}
+}
+/** Keep only entries newer than `windowMs` before `now` (bounds sidecar size). */
+function prune$1(map, now, windowMs) {
+	const out = {};
+	for (const [k, t] of Object.entries(map)) if (typeof t === "number" && now - t < windowMs) out[k] = t;
+	return out;
+}
+/**
+* Cooldown gate. Returns `true` when `key` has NOT been recorded within the last
+* `windowMs` (the caller MAY emit — and the emission is recorded now), or `false`
+* when it was (the caller SHOULD suppress). The first call in a window wins;
+* subsequent identical keys are throttled until the window elapses.
+*
+* Fails open: if the sidecar is unwritable, the emission is allowed rather than
+* silently dropping context.
+* @param key - Stable identity of the block (e.g. a content hash, or `lesson:<id>`).
+* @param windowMs - Suppression window in ms.
+* @param opts - Optional clock + state-dir overrides (for tests).
+* @returns `true` to proceed/emit, `false` to suppress.
+*/
+function oncePerWindow(key, windowMs, opts = {}) {
+	const now = opts.now ?? Date.now();
+	const path = join(opts.dir ?? defaultStateDir(), SIDECAR$1);
+	const map = prune$1(loadMap$1(path), now, windowMs);
+	const last = map[key];
+	if (typeof last === "number" && now - last < windowMs) return false;
+	map[key] = now;
+	try {
+		atomicWrite(path, JSON.stringify(map));
+	} catch {}
+	return true;
+}
 //#endregion
 //#region src/runtime/inject-context.ts
 /**
+* Build the {@link oncePerWindow} key for the CLAUDE.md preamble gate. The
+* prompt hash keeps two distinct legitimate turns from colliding — even non-dev
+* prompts, whose block is prompt-independent (just CLAUDE.md) and would
+* otherwise hash-collide within the window — while the content hash still lets a
+* same-turn double-fire of an identical block be suppressed. Single source of
+* truth so the owner invariant test guards the real production key.
+* @param prompt - The raw user prompt.
+* @param ctx - The rendered CLAUDE.md (+ optional APEX) block.
+* @returns The namespaced dedup key.
+*/
+function claudeMdKey(prompt, ctx) {
+	return `claude-md:${hashText(prompt)}:${hashText(ctx)}`;
+}
+/**
 * UserPromptSubmit context injection: render the CLAUDE.md (+ optional APEX)
 * preamble as a Claude `additionalContext` response, or "" when nothing to emit.
+* Guarded by {@link oncePerWindow} via {@link claudeMdKey}: only a
+* near-simultaneous double-fire of the SAME turn (identical prompt AND identical
+* block, within {@link DEDUP_WINDOW_MS}) is suppressed. The invariant "CLAUDE.md
+* is emitted on EVERY message" is thus preserved.
 * @param prompt - The raw user prompt.
 * @param cwd - Project root (for project-type detection).
 * @returns The native hook stdout (possibly empty).
 */
 function promptSubmitContext(prompt, cwd) {
 	const ctx = buildClaudeMdContext(prompt, cwd);
-	return ctx ? contextResponse("UserPromptSubmit", ctx) : "";
+	if (!ctx) return "";
+	if (!oncePerWindow(claudeMdKey(prompt, ctx), 3e3)) return "";
+	return contextResponse("UserPromptSubmit", ctx);
 }
 /**
 * PreToolUse Task context injection: render the APEX sub-agent context as a
@@ -867,6 +931,207 @@ function subagentCacheContext(sessionIdRaw, home = homedir(), env = process.env,
 	return fresh.length ? contextResponse("SubagentStart", render(fresh)) : "";
 }
 //#endregion
+//#region src/tracking/receipts.ts
+/**
+* @module receipts
+* Verification receipts: capture `tsc`/test runs at PostToolUse and query the
+* freshest PASSING one for the TaskCompleted (hard) and SubagentStop (advisory)
+* gates. A "done" over modified code files is refused unless such a receipt
+* exists — mechanising "no proof, no done".
+* @packageDocumentation
+*/
+/** `tsc` / `bunx tsc` / `npx tsc -p .` — a type-check invocation. */
+const TSC_RE = /(?:^|\s|\/)(?:bunx\s+|npx\s+|pnpm\s+|yarn\s+)?tsc\b/;
+/** `bun test`, `vitest`, `jest`, `npm test`, `npm run test`, … — a test run. */
+const TEST_RE = /\b(?:bun\s+test|vitest|jest|(?:npm|pnpm|yarn)\s+(?:run\s+)?test)\b/;
+/** Append a verification receipt to the track. Immutable. */
+function recordReceipt(track, receipt) {
+	return {
+		...track,
+		receipts: [...track.receipts ?? [], receipt]
+	};
+}
+/** Parse `N pass` / `M fail` counts from bun/vitest/jest output (undefined when absent). */
+function parseCounts(output) {
+	const pass = output.match(/(\d+)\s+pass/i);
+	const fail = output.match(/(\d+)\s+fail/i);
+	return {
+		pass: pass ? Number(pass[1]) : void 0,
+		fail: fail ? Number(fail[1]) : void 0
+	};
+}
+/**
+* Classify a Bash command as a verification receipt, or `null` when it is not a
+* recognised `tsc`/test invocation. Test runs additionally carry parsed
+* pass/fail counts.
+* @param command - The Bash command line.
+* @param output - Combined stdout+stderr (bun writes its summary to stderr).
+* @param exitCode - The command's exit code.
+* @param now - Capture timestamp (epoch ms).
+*/
+function classifyReceipt(command, output, exitCode, now) {
+	if (TEST_RE.test(command)) {
+		const { pass, fail } = parseCounts(output);
+		return {
+			kind: "test",
+			exitCode,
+			pass,
+			fail,
+			ts: now
+		};
+	}
+	if (TSC_RE.test(command)) return {
+		kind: "tsc",
+		exitCode,
+		ts: now
+	};
+	return null;
+}
+/** A receipt PROVES success: exit 0 and (for tests) zero reported failures. */
+function isPassing(r) {
+	return r.exitCode === 0 && (r.fail ?? 0) === 0;
+}
+/** The newest passing receipt within `windowMs`, or `null`. */
+function freshPassingReceipt(track, windowMs, now) {
+	const cutoff = now - windowMs;
+	const hits = (track.receipts ?? []).filter((r) => r.ts > cutoff && isPassing(r));
+	return hits.length ? hits.reduce((a, b) => b.ts > a.ts ? b : a) : null;
+}
+/**
+* Sync variant reading the signed track file directly — for the sync gates
+* (TaskCompleted / SubagentStop). Returns the newest passing receipt, or `null`
+* on any read/verify failure (fail-closed: no proof ⇒ treated as unverified).
+*/
+function freshReceiptFromFile(file, windowMs, now) {
+	try {
+		if (!existsSync(file)) return null;
+		const track = verifyTrack(JSON.parse(readFileSync(file, "utf-8")));
+		return track ? freshPassingReceipt(track, windowMs, now) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Capture a verification receipt from a PostToolUse Bash command into the signed
+* track (best effort — a non-verification command is a no-op).
+*/
+async function captureReceipt(file, command, output, exitCode, now) {
+	const receipt = classifyReceipt(command, output, exitCode, now);
+	if (!receipt) return;
+	await saveTrack(file, recordReceipt(await loadTrack(file), receipt));
+}
+//#endregion
+//#region src/runtime/lifecycle/agent-transcript.ts
+/**
+* Shared low-level parser for a sub-agent's OWN transcript (`agent_transcript_path`
+* — the clean JSONL the Claude Code platform writes per sub-agent, CLI v2.0.42+).
+* Per LESSON.md this is the RELIABLE anchor for evidence: sidechain PostToolUse
+* hooks are not guaranteed (issues #43612/#27655/#34692). One parser, reused by
+* file-attribution (`agent-files.ts`) and retroactive evidence harvesting
+* (`src/freshness/evidence-harvest.ts`) — no duplication.
+*/
+/** Parse a raw `timestamp` field to epoch ms; `undefined` when absent or invalid. */
+function parseTs$2(raw) {
+	if (raw === void 0) return void 0;
+	if (typeof raw === "number") return raw;
+	const ms = Date.parse(raw);
+	return Number.isFinite(ms) ? ms : void 0;
+}
+/**
+* Scan a sub-agent transcript into its ordered `tool_use` blocks (each with the
+* enclosing message timestamp). Distinguishes "no tool use" from "cannot read":
+* returns `null` when the path is absent or the transcript is unreadable (callers
+* fail-open), or a possibly-empty array when parsed. Malformed lines/blocks are
+* tolerated and skipped.
+* @param transcriptPath - Absolute path to the sub-agent's own `.jsonl` transcript.
+* @returns Ordered tool uses, or `null` when unreadable.
+*/
+function readAgentToolUses(transcriptPath) {
+	if (!transcriptPath) return null;
+	let text;
+	try {
+		text = readText(transcriptPath);
+	} catch {
+		return null;
+	}
+	const out = [];
+	for (const line of text.split("\n")) {
+		if (!line.trim()) continue;
+		let entry;
+		try {
+			entry = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		const content = entry.message?.content;
+		if (!Array.isArray(content)) continue;
+		const ts = parseTs$2(entry.timestamp);
+		for (const block of content) {
+			if (block?.type !== "tool_use" || !block.name) continue;
+			out.push({
+				name: block.name,
+				input: block.input,
+				ts
+			});
+		}
+	}
+	return out;
+}
+//#endregion
+//#region src/runtime/lifecycle/agent-files.ts
+/**
+* Per-agent file attribution for SubagentStop. Uses the shared transcript parser
+* ({@link readAgentToolUses}) to recover the exact set of files a sub-agent wrote
+* via Write/Edit/MultiEdit/NotebookEdit, so the sniper reminder attributes only
+* the files THIS agent touched instead of every file changed in the whole session
+* (which cross-attributes other teammates' work — the bug this fixes).
+*/
+/** Tools whose `input.file_path`/`notebook_path` names a file the agent authored. */
+const WRITE_TOOLS = /* @__PURE__ */ new Set([
+	"Write",
+	"Edit",
+	"MultiEdit",
+	"NotebookEdit"
+]);
+/**
+* Return the distinct file paths written by the sub-agent whose own transcript is
+* at `transcriptPath` (Write/Edit/MultiEdit/NotebookEdit). `null` when unreadable
+* (caller MUST fall back to the session-wide list — no regression); a possibly-
+* empty array when parsed (empty = authored nothing, so it should NOT be told to
+* validate files other agents changed).
+* @param transcriptPath - Absolute path to the sub-agent's own `.jsonl` transcript.
+* @returns Distinct written paths (order-preserving), or `null` when unreadable.
+*/
+function filesWrittenByAgent(transcriptPath) {
+	const uses = readAgentToolUses(transcriptPath);
+	if (uses === null) return null;
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const u of uses) {
+		if (!WRITE_TOOLS.has(u.name)) continue;
+		const fp = u.input?.file_path ?? u.input?.notebook_path;
+		if (typeof fp === "string" && fp && !seen.has(fp)) {
+			seen.add(fp);
+			out.push(fp);
+		}
+	}
+	return out;
+}
+/**
+* Filter `sessionFiles` down to the ones this agent actually wrote. Matches the
+* exact recorded string first, then tolerantly on `basename` so a relative-vs-
+* absolute drift between the PostToolUse record and the transcript input never
+* loses an owned file.
+* @param sessionFiles - Session-wide modified files.
+* @param written - Paths the agent wrote (from {@link filesWrittenByAgent}).
+* @returns The subset of `sessionFiles` attributable to this agent.
+*/
+function attributeFiles(sessionFiles, written) {
+	const exact = new Set(written);
+	const bases = new Set(written.map((f) => basename(f)));
+	return sessionFiles.filter((f) => exact.has(f) || bases.has(basename(f)));
+}
+//#endregion
 //#region src/runtime/lifecycle/agent-memory.ts
 /** `~/.claude/memory/agents` — agent completion history dir. */
 function memoryDir(home) {
@@ -903,17 +1168,21 @@ function trackAgentMemory(data, home = homedir(), now = Date.now()) {
 	if (SKIP_AGENTS.test(agentType)) return JSON.stringify({ message: `Agent ${agentType} completed` });
 	const state = loadSessionState(sessionId, home);
 	const changes = state.changes;
-	const count = changes?.cumulativeCodeFiles ?? 0;
-	if (count > 0) {
-		const files = (changes?.modifiedFiles ?? []).join(", ");
-		saveSessionState(sessionId, {
-			...state,
-			changes: {
-				...changes,
-				cumulativeCodeFiles: 0
-			}
-		}, home);
-		return contextResponse("SubagentStop", `SNIPER VALIDATION REQUIRED: Agent '${agentType}' modified ${count} code file(s): ${files}. Run sniper agent now.`);
+	if ((changes?.cumulativeCodeFiles ?? 0) > 0) {
+		const written = filesWrittenByAgent(typeof data.agent_transcript_path === "string" ? data.agent_transcript_path : void 0);
+		const owned = written === null ? changes?.modifiedFiles ?? [] : attributeFiles(changes?.modifiedFiles ?? [], written);
+		if (owned.length > 0) {
+			saveSessionState(sessionId, {
+				...state,
+				changes: {
+					...changes,
+					cumulativeCodeFiles: 0
+				}
+			}, home);
+			const windowMs = resolveTtlSec(process.env) * 1e3 * 5;
+			const note = freshReceiptFromFile(trackFile(sessionId, defaultStateDir(process.cwd())), windowMs, now) === null ? " NO VERIFICATION RECEIPT — run tsc + tests before reporting done." : "";
+			return contextResponse("SubagentStop", `SNIPER VALIDATION REQUIRED: Agent '${agentType}' modified ${owned.length} code file(s): ${owned.join(", ")}. Run sniper agent now.${note}`);
+		}
 	}
 	return JSON.stringify({ message: `Agent ${agentType} completed (no code changes)` });
 }
@@ -1118,6 +1387,290 @@ function postEditTypescript(filePath) {
 	return contextResponse("PostToolUse", `Lint issues in ${basename(filePath)}: ${issues.join(" | ")}`);
 }
 //#endregion
+//#region src/freshness/explore-tools.ts
+/** Native exploration tools (parity `apex_constants.EXPLORE_TOOLS`). */
+const EXPLORE_TOOLS = /* @__PURE__ */ new Set(["Glob", "Grep"]);
+/**
+* Research tools — MCP docs + web (parity `apex_constants.RESEARCH_TOOLS`).
+* The fuse-browser fast-path entries are a deliberate TS addition: CLAUDE.md
+* mandates fuse-browser FIRST for web research, and `docSourceOf` (activity.ts)
+* already credits it for doc consultation — without them here, an agent
+* following the rules would never satisfy the freshness gate (same
+* cross-consumer inconsistency class as the solidReadGate lesson).
+*/
+const RESEARCH_TOOLS = /* @__PURE__ */ new Set([
+	"mcp__context7__query-docs",
+	"mcp__context7__resolve-library-id",
+	"mcp__exa__web_search_exa",
+	"mcp__exa__get_code_context_exa",
+	"mcp__exa__deep_researcher_start",
+	"WebSearch",
+	"WebFetch",
+	"mcp__fuse-browser__browser_fetch",
+	"mcp__fuse-browser__browser_fetch_batch",
+	"mcp__fuse-browser__browser_crawl",
+	"mcp__fuse-browser__browser_serp_batch"
+]);
+/** Bash executables that count as exploration (parity `EXPLORE_BASH_CMDS`). */
+const EXPLORE_BASH_CMDS = /* @__PURE__ */ new Set([
+	"grep",
+	"rg",
+	"find",
+	"ls",
+	"fd",
+	"ast-grep",
+	"tree",
+	"cat",
+	"head",
+	"tail"
+]);
+/** Legacy Python cache names still credited (parity `CACHE_READ_RE` + doc-helpers). */
+const CACHE_READ_RE = /\/context\/mcp\/(exa-search|exa-code-context|context7)-/;
+/**
+* Real TS cache stores: `<root>/.harness/cache/<fnv16>.md` (core MCP store,
+* `projectLayout().cacheDir`) and `~/.fuse-harness/cache/**` (ai-pilot doc
+* caches, `cache-base.cacheBaseDir`). Segment-matched — not resolved against
+* `homedir()` — so tilde-prefixed and absolute paths both hit; the `.md`
+* suffix keeps session-state JSON reads from counting as research.
+*/
+const TS_CACHE_READ_RE = /\.(?:fuse-)?harness[\\/]cache[\\/].*\.md$/;
+/**
+* First non-assignment shell token's basename, or "" — mirrors Python
+* `_bash_executable` (skips leading `VAR=value` env prefixes, e.g. `FOO=1 grep`).
+* @param cmd - Raw Bash `command` string.
+* @returns The executable basename, or "" when none.
+*/
+function bashExecutable(cmd) {
+	for (const token of cmd.trim().split(/\s+/)) {
+		if (!token) continue;
+		const last = token.split("/").pop() ?? token;
+		if (!last.includes("=")) return last;
+	}
+	return "";
+}
+/**
+* Classify a direct tool use into an APEX phase, or `null` when it is neither
+* exploration nor research. Mirrors Python `track-subagent-research._classify`.
+* @param tool - Harness tool name (e.g. "Glob", "Bash", "WebSearch").
+* @param input - Tool input payload.
+* @returns The credited phase + cache flag, or `null`.
+*/
+function classifyExplore(tool, input) {
+	if (RESEARCH_TOOLS.has(tool)) return {
+		phase: "research-expert",
+		cacheHit: false
+	};
+	if (EXPLORE_TOOLS.has(tool)) return {
+		phase: "explore-codebase",
+		cacheHit: false
+	};
+	if (tool === "Read") {
+		const path = String(input?.file_path ?? input?.path ?? "");
+		if (path && (CACHE_READ_RE.test(path) || TS_CACHE_READ_RE.test(path))) return {
+			phase: "research-expert",
+			cacheHit: true
+		};
+		return null;
+	}
+	if (tool === "Bash") {
+		const cmd = String(input?.command ?? "").trim();
+		if (EXPLORE_BASH_CMDS.has(bashExecutable(cmd))) return {
+			phase: "explore-codebase",
+			cacheHit: false
+		};
+	}
+	return null;
+}
+//#endregion
+//#region src/freshness/agent-evidence-record.ts
+/**
+* Session-track agent evidence — writer (parity track-subagent-research.py) +
+* reader scan (parity apex_agent_helpers._scan_agents). Sub-agent hooks fire
+* with the LEAD's `session_id`, so evidence recorded here lands in the ONE
+* session track the freshness gate scans FIRST — sidechain research and
+* Workflow-spawned agents count, unlike the lead-transcript scan.
+*/
+/** Tools the existing Task tracking already credits as agent LAUNCHES. */
+const AGENT_LAUNCH_TOOLS = /* @__PURE__ */ new Set(["Task", "Agent"]);
+/**
+* `JSON.stringify` length of the raw `tool_response` OBJECT (parity Python
+* `len(str(tool_response))`); 0 when absent or unserializable (circular).
+*/
+function responseJsonLength(toolResponse) {
+	if (toolResponse === void 0 || toolResponse === null) return 0;
+	try {
+		return (JSON.stringify(toolResponse) ?? "").length;
+	} catch {
+		return 0;
+	}
+}
+/**
+* Classify one PostToolUse call into session evidence, or null when it is
+* neither exploration nor research (parity track-subagent-research._classify,
+* reusing the shared {@link classifyExplore} tables — research/explore/Bash/
+* cache-read). ANTI-DOUBLE-COUNT: calls classified as agent launches
+* (`Task`/`Agent`) are skipped — the existing Task tracking credits those; the
+* criterion is the CALL's classification, never its provenance (lead vs sub).
+* @param tool - Harness tool name (e.g. "Glob", "Bash", "Read").
+* @param input - Raw tool input payload.
+* @param toolResponse - Raw `tool_response` OBJECT from the hook payload.
+* @returns The evidence to record, or null to skip.
+*/
+function classifyAgentEvidence(tool, input, toolResponse) {
+	if (AGENT_LAUNCH_TOOLS.has(tool)) return null;
+	const hit = classifyExplore(tool, input);
+	if (!hit) return null;
+	return {
+		name: hit.phase === "explore-codebase" ? "subagent-explore-codebase" : "subagent-research-expert",
+		quality: hit.cacheHit || responseJsonLength(toolResponse) > 50 ? "sufficient" : "insufficient"
+	};
+}
+/**
+* Persist evidence into the SESSION track via {@link recordAgent} — keyed by
+* `session_id` alone (sub-agent hooks carry the lead's `session_id`); the TTL
+* anchors on `ts`, the tool call's own timestamp. `agentId` is tagged as
+* metadata when present, NEVER used as a condition (unreliable field —
+* anthropics/claude-code#22348).
+* @param file - Session track file path.
+* @param evidence - Classified evidence from {@link classifyAgentEvidence}.
+* @param ts - Epoch-ms timestamp of the tool call (the hook event's `now`).
+* @param agentId - Optional Claude `agent_id` — metadata tag only.
+*/
+async function recordAgentEvidence(file, evidence, ts, agentId) {
+	const next = recordAgent(await loadTrack(file), evidence.name, ts, evidence.quality);
+	const last = next.agents[next.agents.length - 1];
+	if (agentId && last) {
+		const tagged = {
+			...last,
+			agentId
+		};
+		next.agents[next.agents.length - 1] = tagged;
+	}
+	await saveTrack(file, next);
+}
+/**
+* Parity `_scan_agents` (apex_agent_helpers.py): reverse-scan `track.agents`,
+* STOPPING at the first entry older than `windowMs` (entries append in time
+* order), matching each required name by SUBSTRING (`research-expert` matches
+* `subagent-research-expert`) and counting ONLY `quality === "sufficient"`.
+* @param track - The loaded session track.
+* @param names - Required agent names — ALL must match to return true.
+* @param windowMs - Freshness window (ms), anchored on each entry's `ts`.
+* @param now - Current epoch ms.
+* @returns True when every required name has fresh, sufficient evidence.
+*/
+function agentsFreshInTrack(track, names, windowMs, now) {
+	const found = /* @__PURE__ */ new Set();
+	for (let i = track.agents.length - 1; i >= 0; i--) {
+		const entry = track.agents[i];
+		if (!entry) continue;
+		if (now - entry.ts > windowMs) break;
+		if (entry.quality !== "sufficient") continue;
+		for (const req of names) if (entry.name.includes(req)) found.add(req);
+		if (found.size === names.length) return true;
+	}
+	return names.every((n) => found.has(n));
+}
+//#endregion
+//#region src/freshness/evidence-harvest.ts
+/**
+* Retroactive evidence harvest at SubagentStop. Parses a completed sub-agent's
+* OWN transcript (`agent_transcript_path`) and backfills the session track with
+* the research/explore tool_use it performed (→ `agents`) and the `.md` reference
+* files it read (→ `refsReadAt`). Per LESSON.md + issues #43612/#27655/#34692,
+* sidechain PostToolUse hooks are NOT guaranteed to fire, so live in-session
+* crediting is only opportunistic; SubagentStop is dispatched by the main session
+* (reliable), and its transcript is the durable anchor this harvest reads.
+*
+* QUALITY: harvested agent evidence is credited `sufficient`. The freshness reader
+* (`agentsFreshInTrack`) ignores `insufficient` entries, so anything less would
+* make the harvest inert. This is sound: the platform-authored transcript proves
+* the tool genuinely ran to completion in a finished sub-agent — a STRONGER
+* guarantee than the live path's response-size heuristic (an anti-gaming measure
+* for the self-recorded track, which the transcript's provenance supersedes).
+*/
+/** Dedup tolerance (ms) against evidence a live sidechain hook may already hold. */
+const DEDUP_MS = 2e3;
+/** True when an `agents` entry with `name` already sits within ±{@link DEDUP_MS} of `ts`. */
+function agentAlreadyRecorded(track, name, ts) {
+	return track.agents.some((a) => a.name === name && Math.abs(a.ts - ts) <= DEDUP_MS);
+}
+/**
+* Fold one transcript tool_use into the track (immutably): credit classified
+* research/explore evidence to `agents` (deduped, forced `sufficient`) and any
+* `.md` Read to `refsReadAt` (never restamping a MORE-recent existing read).
+* Returns the same reference when the call contributes nothing.
+*/
+function applyToolUse(track, u, fallbackNow) {
+	const ts = u.ts ?? fallbackNow;
+	let next = track;
+	const ev = classifyAgentEvidence(u.name, u.input, void 0);
+	if (ev && !agentAlreadyRecorded(next, ev.name, ts)) next = recordAgent(next, ev.name, ts, "sufficient");
+	if (u.name === "Read") {
+		const path = String(u.input?.file_path ?? u.input?.path ?? "");
+		const prev = next.refsReadAt?.[path];
+		if (path.endsWith(".md") && (prev === void 0 || prev < ts)) next = recordRefRead(next, path, ts);
+	}
+	return next;
+}
+/**
+* Backfill `track` from the sub-agent transcript at `transcriptPath`. PURE: the
+* caller owns load/save. Fail-open — an absent or unreadable transcript returns
+* `track` UNCHANGED (same reference), never throwing.
+* @param transcriptPath - Sub-agent's own `.jsonl` (SubagentStop `agent_transcript_path`).
+* @param track - The current session track.
+* @param now - Fallback epoch-ms for tool_uses the platform left unstamped.
+* @returns The backfilled track, or `track` itself when nothing was harvested.
+*/
+function harvestAgentEvidence(transcriptPath, track, now) {
+	const uses = readAgentToolUses(transcriptPath);
+	if (uses === null) return track;
+	return uses.reduce((acc, u) => applyToolUse(acc, u, now), track);
+}
+//#endregion
+//#region src/freshness/evidence-harvest-io.ts
+/**
+* SubagentStop wiring for {@link harvestAgentEvidence}. The core SubagentStop
+* dispatch (`runtime/lifecycle/dispatch.ts`) is SYNCHRONOUS and runs in a
+* short-lived hook process, so this does SYNC track I/O (load → harvest → save)
+* rather than the async `loadTrack`/`saveTrack`: a floating async write could be
+* dropped before the process exits. Mirrors the sync read precedent in
+* `policy/design/skill-evidence.ts` and the exact save body of `tracking/store.ts`
+* (`signTrack` → atomic write → `writeLastNonce`) — kept sync on purpose here.
+*/
+/** Load the current track synchronously; `emptyTrack()` when absent/corrupt (fail-closed read). */
+function loadTrackSync(file) {
+	try {
+		return verifyTrack(JSON.parse(readFileSync(file, "utf8"))) ?? emptyTrack();
+	} catch {
+		return emptyTrack();
+	}
+}
+/**
+* Harvest the finishing sub-agent's transcript into its session track. Runs for
+* EVERY agent type (unlike the sniper reminder, which skips research/explore) —
+* those are exactly the agents whose research/explore evidence we want to credit.
+* Fully fail-open: a missing `agent_transcript_path`, an unreadable transcript, or
+* a write error leaves the track untouched and never throws out of the hook.
+* @param payload - The raw SubagentStop hook payload.
+* @param cwd - Project root (selects the per-project state dir).
+* @param now - Fallback epoch-ms for unstamped transcript tool_uses.
+* @param baseDir - Override the track base dir (tests); defaults to the project state dir.
+*/
+function harvestSubagentTrack(payload, cwd, now, baseDir = defaultStateDir(cwd)) {
+	const transcriptPath = typeof payload.agent_transcript_path === "string" ? payload.agent_transcript_path : void 0;
+	if (!transcriptPath) return;
+	const file = trackFile(typeof payload.session_id === "string" ? payload.session_id : "unknown", baseDir);
+	const track = loadTrackSync(file);
+	const next = harvestAgentEvidence(transcriptPath, track, now);
+	if (next === track) return;
+	try {
+		const envelope = signTrack(next);
+		atomicWrite(file, JSON.stringify(envelope, null, 2));
+		writeLastNonce(envelope.nonce);
+	} catch {}
+}
+//#endregion
 //#region src/runtime/lifecycle/task-completed.ts
 /** Code-file extensions audited on task completion (mirrors validate-task-solid.py). */
 const CODE_EXTENSIONS$2 = /* @__PURE__ */ new Set([
@@ -1140,6 +1693,30 @@ const CODE_EXTENSIONS$2 = /* @__PURE__ */ new Set([
 	".svelte",
 	".astro"
 ]);
+/** Freshness multiple on `FUSE_ENFORCE_TTL_SEC` for receipts (no new env var); a tsc+test run precedes the "done" by more than one edit window. */
+const RECEIPT_TTL_MULTIPLIER = 5;
+/** The modified files that are code (by extension) — the receipt gate's trigger set. */
+function codeFiles(files) {
+	return files.filter((fp) => CODE_EXTENSIONS$2.has(extname(fp)));
+}
+/**
+* Refuse completion when code files changed but no fresh, passing verification
+* receipt (`tsc`/test, exit 0, zero failures, within TTL×{@link RECEIPT_TTL_MULTIPLIER})
+* exists in the signed track. TaskCompleted does NOT honor `decision:"block"`
+* (verified against the official hooks docs — `TeammateIdle/TaskCreated/
+* TaskCompleted` are excluded from that list); the documented stdout refusal is
+* `{"continue":false,"stopReason":…}`, which halts the teammate with the reason
+* shown to the user. Returns that JSON, or `null` when the session is clear.
+*/
+function receiptGate(sid, files, now, stateDir) {
+	if (codeFiles(files).length === 0) return null;
+	const windowMs = resolveTtlSec(process.env) * 1e3 * RECEIPT_TTL_MULTIPLIER;
+	if (freshReceiptFromFile(trackFile(sid, stateDir), windowMs, now)) return null;
+	return JSON.stringify({
+		continue: false,
+		stopReason: "VERIFICATION RECEIPT REQUIRED: code files changed but no fresh passing tsc/test receipt exists. Run `bun test` + `tsc --noEmit` (exit 0, 0 failures) and re-complete."
+	});
+}
 /**
 * Re-count physical lines of every modified code file and collect SOLID
 * violations (`<basename>: <n> lines (max <max>)`) for those exceeding `max`.
@@ -1159,21 +1736,24 @@ function collectViolations(files, max) {
 	return violations;
 }
 /**
-* Handle TaskCompleted: re-measure the session's modified code files and emit a
-* `SOLID VIOLATION` additionalContext listing any file over the line ceiling.
-* Ports `task-completed/validate-task-solid.py`.
-* @param payload - The TaskCompleted hook payload (`task_id`, `task_subject`, `session_id`).
+* Handle TaskCompleted (ports `task-completed/validate-task-solid.py`, plus the
+* receipt gate). SOLID violations surface first as `SOLID VIOLATION`
+* additionalContext; once the files comply, {@link receiptGate} refuses a "done"
+* that has no fresh passing tsc/test receipt.
+* @param payload - The TaskCompleted payload (`task_id`, `task_subject`, `session_id`).
 * @param home - Home dir (defaults to `~`).
-* @returns The native hook stdout, or `""` when there are no violations.
+* @param now - Clock (defaults to `Date.now()`).
+* @param stateDir - Track base dir (defaults to the cwd-derived state dir; matches `handleHook`).
+* @returns The native hook stdout, or `""` when the session is clean.
 */
-function validateTaskSolid(payload, home = homedir()) {
+function validateTaskSolid(payload, home = homedir(), now = Date.now(), stateDir = defaultStateDir(process.cwd())) {
 	const sid = sanitizeSessionId(payload.session_id ?? "unknown");
 	if (!sid) return "";
 	const files = loadSessionState(sid, home).changes?.modifiedFiles ?? [];
 	if (files.length === 0) return "";
 	const max = resolveMaxLines();
 	const violations = collectViolations(files, max);
-	if (violations.length === 0) return "";
+	if (violations.length === 0) return receiptGate(sid, files, now, stateDir) ?? "";
 	const taskId = String(payload.task_id ?? "");
 	return contextResponse("TaskCompleted", `SOLID VIOLATION in task '${String(payload.task_subject ?? "")}' (${taskId}): ${violations.length} file(s) exceed ${max} lines: ` + violations.slice(0, 5).join("; "));
 }
@@ -1555,6 +2135,109 @@ function cartoSessionStart(cwd, now = Date.now()) {
 	return ctx ? contextResponse("SessionStart", ctx) : "";
 }
 //#endregion
+//#region src/runtime/lifecycle/aipilot/curate-lessons.ts
+/**
+* Mechanical, LLM-free curation of `MEMORY/LESSON.md` bullets (anti-obesity):
+* strict-dedup near-identical bullets (keep newest, `[TRIGGERS …]` preserved),
+* flag over-cap + stale (>90d, cited path gone) in a report. Only dedup writes.
+*/
+const CAP = 50;
+const STALE_DAYS = 90;
+const SIM_THRESHOLD = .8;
+const MIN_TOKENS = 4;
+const TRIG = /^\[TRIGGERS\s+.+\]$/;
+/** Epoch ms for a `[YYYY-MM-DD HH:MM]` stamp; `NaN` if absent or out of range. */
+function parseTs$1(line) {
+	const m = line.match(/\[(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{2}):(\d{2}))?/);
+	if (!m) return NaN;
+	const mo = +(m[2] ?? 0), d = +(m[3] ?? 0);
+	if (mo < 1 || mo > 12 || d < 1 || d > 31) return NaN;
+	return Date.UTC(+(m[1] ?? 0), mo - 1, d, +(m[4] ?? 0), +(m[5] ?? 0));
+}
+/** Content words (>=4 chars), timestamp & TRIGGERS marker stripped. */
+function tokenize(text) {
+	return new Set(text.toLowerCase().replace(/\[triggers[^\]]*\]/g, " ").replace(/\[\d{4}-\d{2}-\d{2}[^\]]*\]/g, " ").replace(/[^a-z0-9àâäéèêëîïôöùûüç/._-]+/gi, " ").split(/\s+/).filter((t) => t.length >= 4));
+}
+/** Jaccard overlap of two token sets (0 when both empty). */
+function jaccard(a, b) {
+	if (a.size === 0 && b.size === 0) return 0;
+	const inter = [...a].filter((t) => b.has(t)).length;
+	return inter / (a.size + b.size - inter);
+}
+/** Repo-relative cited paths (slash + extension) referenced in a block. */
+function citedPaths(text) {
+	const out = /* @__PURE__ */ new Set();
+	for (const m of text.matchAll(/`([^`]+)`/g)) if (m[1]) out.add(m[1]);
+	for (const m of text.matchAll(/[\w./@-]+\.\w{1,5}/g)) if (m[0]) out.add(m[0]);
+	return [...out].filter((p) => p.includes("/") && /\.\w{1,5}$/.test(p));
+}
+/** Split into a verbatim preamble and one Block per `- ` bullet. */
+function parse(content) {
+	const lines = content.split("\n");
+	const blocks = [];
+	let i = 0;
+	while (i < lines.length && !/^-\s/.test(lines[i] ?? "")) i++;
+	const preamble = lines.slice(0, i).join("\n");
+	for (; i < lines.length; i++) {
+		const l = lines[i] ?? "", last = blocks[blocks.length - 1];
+		if (/^-\s/.test(l)) blocks.push({
+			raw: [l],
+			ts: parseTs$1(l),
+			tokens: tokenize(l)
+		});
+		else if (l.trim() && last) last.raw.push(l);
+	}
+	return {
+		preamble,
+		blocks
+	};
+}
+/** Report lines for bullets older than STALE_DAYS whose only cited path is gone. */
+function staleReport(blocks, now, root) {
+	const cutoff = now - STALE_DAYS * 864e5;
+	return blocks.flatMap((b) => {
+		if (!(b.ts <= cutoff)) return [];
+		const paths = citedPaths(b.raw.join(" "));
+		if (paths.length === 0 || paths.some((p) => existsSync(join(root, p)))) return [];
+		return [`[STALE?] ${(b.raw[0] ?? "").slice(0, 90)} — chemin(s) disparu(s): ${paths.join(", ")}`];
+	});
+}
+/**
+* Strict-dedup LESSON.md bullets (keep newest, its `[TRIGGERS …]` line preserved —
+* or carried over from the dropped twin if the kept one lacks it) and report
+* cap/stale. `content` unchanged unless a dedup occurred. Returns content + report.
+*/
+function curateLessons(content, now, root = process.cwd()) {
+	const { preamble, blocks } = parse(content);
+	const kept = [];
+	const fused = [];
+	for (const b of blocks) {
+		const hit = b.tokens.size >= MIN_TOKENS ? kept.find((k) => k.tokens.size >= MIN_TOKENS && jaccard(k.tokens, b.tokens) >= SIM_THRESHOLD) : void 0;
+		if (!hit) {
+			kept.push(b);
+			continue;
+		}
+		const [win, drop] = b.ts > hit.ts || Number.isNaN(hit.ts) ? [b, hit] : [hit, b];
+		if (win !== hit) kept[kept.indexOf(hit)] = win;
+		if (!win.raw.some((l) => TRIG.test(l.trim()))) {
+			const t = drop.raw.find((l) => TRIG.test(l.trim()));
+			if (t) win.raw.push(t);
+		}
+		fused.push(`fusion: gardé ${(win.raw[0] ?? "").slice(0, 60)} · retiré ${(drop.raw[0] ?? "").slice(0, 60)}`);
+	}
+	const old = [...kept].sort((a, b) => a.ts - b.ts).slice(0, Math.max(0, kept.length - CAP));
+	const cap = old.length ? [`${kept.length} bullets (> ${CAP}) — plus anciens candidats à l'archivage:`, ...old.map((b) => `  ${(b.raw[0] ?? "").slice(0, 80)}`)] : [];
+	const report = [
+		...fused,
+		...cap,
+		...staleReport(blocks, now, root)
+	].join("\n");
+	return {
+		content: fused.length ? `${preamble}\n${kept.map((b) => b.raw.join("\n")).join("\n\n")}\n` : content,
+		report
+	};
+}
+//#endregion
 //#region src/runtime/lifecycle/lessons/state.ts
 /**
 * Per-project lessons paths. The `fuse-lessons` plugin stores its lessons under
@@ -1579,9 +2262,10 @@ function lessonsStateFileFor(root) {
 * across every project with unsaved code edits; PostToolUse marks the write to
 * arm/silence the per-project throttle. Non-fatal by design.
 */
-/** Inject `<root>/MEMORY/LESSON.md` as additionalContext for `event`. */
-function injectMemory(cwd, event) {
-	const file = lessonsFileFor(projectRoot(cwd));
+/** Inject `MEMORY/LESSON.md` for `event`, after mechanical curation (a strict dedup rewrites the file in place; any report surfaces to the user via systemMessage). */
+function injectMemory(cwd, event, now) {
+	const root = projectRoot(cwd);
+	const file = lessonsFileFor(root);
 	if (!existsSync(file)) return "";
 	let content = "";
 	try {
@@ -1590,7 +2274,13 @@ function injectMemory(cwd, event) {
 		return "";
 	}
 	if (!content) return "";
-	return contextResponse(event, `Project lessons — never reproduce these:\n${content}\nYou may append OR refine/merge/dedupe bullets in MEMORY/LESSON.md — keep it terse.`);
+	const { content: curated, report } = curateLessons(content, now, root);
+	if (curated !== content) try {
+		atomicWrite(file, curated);
+		content = curated;
+	} catch {}
+	const ctx = `Project lessons — never reproduce these:\n${content}\nYou may append OR refine/merge/dedupe bullets in MEMORY/LESSON.md — keep it terse.`;
+	return report ? attachSystemMessage(contextResponse(event, ctx), `LESSON.md curation:\n${report}`) : contextResponse(event, ctx);
 }
 /** Select roots with unsaved code edits past the throttle, bumping their state. */
 function collectPending(now, window) {
@@ -1638,7 +2328,7 @@ function markWrite(payload, now) {
 function dispatchLessons(event, payload, cwd, now) {
 	switch (event) {
 		case "SessionStart":
-		case "SubagentStart": return injectMemory(cwd, event);
+		case "SubagentStart": return injectMemory(cwd, event, now);
 		case "Stop": return remindWrite(now);
 		case "PostToolUse":
 			markWrite(payload, now);
@@ -2924,7 +3614,10 @@ function dispatchLifecycle(input) {
 			if (input.scope === "lessons") return dispatchLessons("SubagentStart", input.payload, input.cwd, input.now);
 			return subagentCacheContext(input.payload.session_id);
 		case "Stop": return input.scope === "lessons" ? dispatchLessons("Stop", input.payload, input.cwd, input.now) : null;
-		case "SubagentStop": return input.scope === "aipilot" ? "" : trackAgentMemory(input.payload, void 0, input.now);
+		case "SubagentStop":
+			if (input.scope === "aipilot") return "";
+			harvestSubagentTrack(input.payload, input.cwd, input.now);
+			return trackAgentMemory(input.payload, void 0, input.now);
 		case "TeammateIdle": return validateTeammateOutput(input.payload);
 		case "PostToolUseFailure":
 			logToolFailure(input.payload, void 0, input.now);
@@ -4131,124 +4824,29 @@ function geminiMcpConsulted(authorizations, sessionId) {
 	return Object.values(authorizations).some((a) => a.doc_sessions?.includes(sessionId) && (a.sources ?? (a.source ? [a.source] : [])).some((s) => GEMINI_MCP_SOURCE_RE.test(s)));
 }
 /**
-* Gate a UI write when `FUSE_ENFORCE_GEMINI_MCP` is on: block hand-written
-* Tailwind (>= 3 classes) in a `.tsx/.jsx/.vue/.svelte` file unless a Gemini
-* Design MCP call was made this session. Returns `null` when disabled (default),
-* out of scope, or already satisfied.
-* @param tool - the tool name.
-* @param filePath - the file being written.
-* @param content - the written content (new_string on Edit).
-* @param ev - session evidence (authorizations + sessionId).
-*/
-function geminiMcpGate(tool, filePath, content, ev) {
-	if (!geminiMcpEnforced()) return null;
-	if (tool !== "Write" && tool !== "Edit") return null;
-	if (!filePath || !UI_EXT_RE.test(filePath) || GEMINI_EXEMPT_RE.test(filePath)) return null;
-	if (!content) return null;
-	if (tool === "Edit" && (content.match(/\n/g)?.length ?? 0) < MIN_LINES_EDIT) return null;
-	if (countTailwindClasses(content) < MIN_TW) return null;
-	if (geminiMcpConsulted(ev.authorizations, ev.sessionId)) return null;
-	return {
-		kind: "block",
-		title: "Gemini Design MCP",
-		reason: "BLOCKED: UI code with Tailwind detected but Gemini Design MCP not used. Use mcp__gemini-design__create_frontend, modify_frontend, or snippet_frontend BEFORE writing UI code manually.",
-		actions: ["Call mcp__gemini-design__create_frontend / modify_frontend / snippet_frontend, then retry"]
-	};
-}
-//#endregion
-//#region src/freshness/explore-tools.ts
-/** Native exploration tools (parity `apex_constants.EXPLORE_TOOLS`). */
-const EXPLORE_TOOLS = /* @__PURE__ */ new Set(["Glob", "Grep"]);
-/**
-* Research tools — MCP docs + web (parity `apex_constants.RESEARCH_TOOLS`).
-* The fuse-browser fast-path entries are a deliberate TS addition: CLAUDE.md
-* mandates fuse-browser FIRST for web research, and `docSourceOf` (activity.ts)
-* already credits it for doc consultation — without them here, an agent
-* following the rules would never satisfy the freshness gate (same
-* cross-consumer inconsistency class as the solidReadGate lesson).
-*/
-const RESEARCH_TOOLS = /* @__PURE__ */ new Set([
-	"mcp__context7__query-docs",
-	"mcp__context7__resolve-library-id",
-	"mcp__exa__web_search_exa",
-	"mcp__exa__get_code_context_exa",
-	"mcp__exa__deep_researcher_start",
-	"WebSearch",
-	"WebFetch",
-	"mcp__fuse-browser__browser_fetch",
-	"mcp__fuse-browser__browser_fetch_batch",
-	"mcp__fuse-browser__browser_crawl",
-	"mcp__fuse-browser__browser_serp_batch"
-]);
-/** Bash executables that count as exploration (parity `EXPLORE_BASH_CMDS`). */
-const EXPLORE_BASH_CMDS = /* @__PURE__ */ new Set([
-	"grep",
-	"rg",
-	"find",
-	"ls",
-	"fd",
-	"ast-grep",
-	"tree",
-	"cat",
-	"head",
-	"tail"
-]);
-/** Legacy Python cache names still credited (parity `CACHE_READ_RE` + doc-helpers). */
-const CACHE_READ_RE = /\/context\/mcp\/(exa-search|exa-code-context|context7)-/;
-/**
-* Real TS cache stores: `<root>/.harness/cache/<fnv16>.md` (core MCP store,
-* `projectLayout().cacheDir`) and `~/.fuse-harness/cache/**` (ai-pilot doc
-* caches, `cache-base.cacheBaseDir`). Segment-matched — not resolved against
-* `homedir()` — so tilde-prefixed and absolute paths both hit; the `.md`
-* suffix keeps session-state JSON reads from counting as research.
-*/
-const TS_CACHE_READ_RE = /\.(?:fuse-)?harness[\\/]cache[\\/].*\.md$/;
-/**
-* First non-assignment shell token's basename, or "" — mirrors Python
-* `_bash_executable` (skips leading `VAR=value` env prefixes, e.g. `FOO=1 grep`).
-* @param cmd - Raw Bash `command` string.
-* @returns The executable basename, or "" when none.
-*/
-function bashExecutable(cmd) {
-	for (const token of cmd.trim().split(/\s+/)) {
-		if (!token) continue;
-		const last = token.split("/").pop() ?? token;
-		if (!last.includes("=")) return last;
-	}
-	return "";
-}
-/**
-* Classify a direct tool use into an APEX phase, or `null` when it is neither
-* exploration nor research. Mirrors Python `track-subagent-research._classify`.
-* @param tool - Harness tool name (e.g. "Glob", "Bash", "WebSearch").
-* @param input - Tool input payload.
-* @returns The credited phase + cache flag, or `null`.
+* Gate a UI write when `FUSE_ENFORCE_GEMINI_MCP` is on: block hand-written
+* Tailwind (>= 3 classes) in a `.tsx/.jsx/.vue/.svelte` file unless a Gemini
+* Design MCP call was made this session. Returns `null` when disabled (default),
+* out of scope, or already satisfied.
+* @param tool - the tool name.
+* @param filePath - the file being written.
+* @param content - the written content (new_string on Edit).
+* @param ev - session evidence (authorizations + sessionId).
 */
-function classifyExplore(tool, input) {
-	if (RESEARCH_TOOLS.has(tool)) return {
-		phase: "research-expert",
-		cacheHit: false
-	};
-	if (EXPLORE_TOOLS.has(tool)) return {
-		phase: "explore-codebase",
-		cacheHit: false
+function geminiMcpGate(tool, filePath, content, ev) {
+	if (!geminiMcpEnforced()) return null;
+	if (tool !== "Write" && tool !== "Edit") return null;
+	if (!filePath || !UI_EXT_RE.test(filePath) || GEMINI_EXEMPT_RE.test(filePath)) return null;
+	if (!content) return null;
+	if (tool === "Edit" && (content.match(/\n/g)?.length ?? 0) < MIN_LINES_EDIT) return null;
+	if (countTailwindClasses(content) < MIN_TW) return null;
+	if (geminiMcpConsulted(ev.authorizations, ev.sessionId)) return null;
+	return {
+		kind: "block",
+		title: "Gemini Design MCP",
+		reason: "BLOCKED: UI code with Tailwind detected but Gemini Design MCP not used. Use mcp__gemini-design__create_frontend, modify_frontend, or snippet_frontend BEFORE writing UI code manually.",
+		actions: ["Call mcp__gemini-design__create_frontend / modify_frontend / snippet_frontend, then retry"]
 	};
-	if (tool === "Read") {
-		const path = String(input?.file_path ?? input?.path ?? "");
-		if (path && (CACHE_READ_RE.test(path) || TS_CACHE_READ_RE.test(path))) return {
-			phase: "research-expert",
-			cacheHit: true
-		};
-		return null;
-	}
-	if (tool === "Bash") {
-		const cmd = String(input?.command ?? "").trim();
-		if (EXPLORE_BASH_CMDS.has(bashExecutable(cmd))) return {
-			phase: "explore-codebase",
-			cacheHit: false
-		};
-	}
-	return null;
 }
 //#endregion
 //#region src/freshness/agent-evidence.ts
@@ -4326,96 +4924,6 @@ function agentsRanFromTranscript(transcriptPath, names, windowMs, now) {
 	return names.every((n) => found.has(n));
 }
 //#endregion
-//#region src/freshness/agent-evidence-record.ts
-/**
-* Session-track agent evidence — writer (parity track-subagent-research.py) +
-* reader scan (parity apex_agent_helpers._scan_agents). Sub-agent hooks fire
-* with the LEAD's `session_id`, so evidence recorded here lands in the ONE
-* session track the freshness gate scans FIRST — sidechain research and
-* Workflow-spawned agents count, unlike the lead-transcript scan.
-*/
-/** Tools the existing Task tracking already credits as agent LAUNCHES. */
-const AGENT_LAUNCH_TOOLS = /* @__PURE__ */ new Set(["Task", "Agent"]);
-/**
-* `JSON.stringify` length of the raw `tool_response` OBJECT (parity Python
-* `len(str(tool_response))`); 0 when absent or unserializable (circular).
-*/
-function responseJsonLength(toolResponse) {
-	if (toolResponse === void 0 || toolResponse === null) return 0;
-	try {
-		return (JSON.stringify(toolResponse) ?? "").length;
-	} catch {
-		return 0;
-	}
-}
-/**
-* Classify one PostToolUse call into session evidence, or null when it is
-* neither exploration nor research (parity track-subagent-research._classify,
-* reusing the shared {@link classifyExplore} tables — research/explore/Bash/
-* cache-read). ANTI-DOUBLE-COUNT: calls classified as agent launches
-* (`Task`/`Agent`) are skipped — the existing Task tracking credits those; the
-* criterion is the CALL's classification, never its provenance (lead vs sub).
-* @param tool - Harness tool name (e.g. "Glob", "Bash", "Read").
-* @param input - Raw tool input payload.
-* @param toolResponse - Raw `tool_response` OBJECT from the hook payload.
-* @returns The evidence to record, or null to skip.
-*/
-function classifyAgentEvidence(tool, input, toolResponse) {
-	if (AGENT_LAUNCH_TOOLS.has(tool)) return null;
-	const hit = classifyExplore(tool, input);
-	if (!hit) return null;
-	return {
-		name: hit.phase === "explore-codebase" ? "subagent-explore-codebase" : "subagent-research-expert",
-		quality: hit.cacheHit || responseJsonLength(toolResponse) > 50 ? "sufficient" : "insufficient"
-	};
-}
-/**
-* Persist evidence into the SESSION track via {@link recordAgent} — keyed by
-* `session_id` alone (sub-agent hooks carry the lead's `session_id`); the TTL
-* anchors on `ts`, the tool call's own timestamp. `agentId` is tagged as
-* metadata when present, NEVER used as a condition (unreliable field —
-* anthropics/claude-code#22348).
-* @param file - Session track file path.
-* @param evidence - Classified evidence from {@link classifyAgentEvidence}.
-* @param ts - Epoch-ms timestamp of the tool call (the hook event's `now`).
-* @param agentId - Optional Claude `agent_id` — metadata tag only.
-*/
-async function recordAgentEvidence(file, evidence, ts, agentId) {
-	const next = recordAgent(await loadTrack(file), evidence.name, ts, evidence.quality);
-	const last = next.agents[next.agents.length - 1];
-	if (agentId && last) {
-		const tagged = {
-			...last,
-			agentId
-		};
-		next.agents[next.agents.length - 1] = tagged;
-	}
-	await saveTrack(file, next);
-}
-/**
-* Parity `_scan_agents` (apex_agent_helpers.py): reverse-scan `track.agents`,
-* STOPPING at the first entry older than `windowMs` (entries append in time
-* order), matching each required name by SUBSTRING (`research-expert` matches
-* `subagent-research-expert`) and counting ONLY `quality === "sufficient"`.
-* @param track - The loaded session track.
-* @param names - Required agent names — ALL must match to return true.
-* @param windowMs - Freshness window (ms), anchored on each entry's `ts`.
-* @param now - Current epoch ms.
-* @returns True when every required name has fresh, sufficient evidence.
-*/
-function agentsFreshInTrack(track, names, windowMs, now) {
-	const found = /* @__PURE__ */ new Set();
-	for (let i = track.agents.length - 1; i >= 0; i--) {
-		const entry = track.agents[i];
-		if (!entry) continue;
-		if (now - entry.ts > windowMs) break;
-		if (entry.quality !== "sufficient") continue;
-		for (const req of names) if (entry.name.includes(req)) found.add(req);
-		if (found.size === names.length) return true;
-	}
-	return names.every((n) => found.has(n));
-}
-//#endregion
 //#region src/runtime/gate-apex.ts
 /**
 * The APEX-scoped portion of {@link gate}, in the Python enforce-apex-phases.ts
@@ -4476,24 +4984,177 @@ async function apexScopedGate(input, track, window) {
 	}
 }
 //#endregion
+//#region src/policy/deny-loop.ts
+/**
+* @module deny-loop
+* Pure anti-loop logic: hash a tool-call, decide if it repeats a prior deny, and
+* enrich the repeated block's message.
+*
+* The proprietary rule "NEVER propose the same fix twice" is prose a model under
+* pressure ignores. This makes it machine-enforced: when a call whose
+* `(tool + normalized input)` hash was ALREADY denied in-window is retried, the
+* harness keeps the deny but rewrites the message — `[REPEAT]` title, STOP
+* prefix, forced `research-expert` action. State + wiring live in the sidecar
+* store ({@link module:deny-loop-store}); this file is IO-free and pure.
+* @packageDocumentation
+*/
+/** Stable JSON: keys sorted at every depth so `{a,b}` and `{b,a}` hash identically. */
+function stableStringify(v) {
+	if (v === null || typeof v !== "object") return JSON.stringify(v) ?? "null";
+	if (Array.isArray(v)) return `[${v.map(stableStringify).join(",")}]`;
+	const o = v;
+	return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(o[k])}`).join(",")}}`;
+}
+/**
+* Stable identity hash of a tool-call = tool name + normalized (key-sorted) input,
+* so re-ordered keys never mask a repeat.
+* @param tool - Tool name (e.g. "Write", "Bash").
+* @param input - Identifying tool input (filePath/content/command...).
+* @returns 8-char hex hash.
+*/
+function denyHash(tool, input) {
+	return hashText(`${tool}\n${stableStringify(input)}`);
+}
+/**
+* Pure loop check: given the already-pruned in-window map, compute the running
+* count for `hash` and whether it repeats (count > 1). No IO — the caller persists.
+* @param hash - {@link denyHash} of the current call.
+* @param priorDenies - The `{ hash -> DenyEntry }` map, pruned to `now`/`windowMs`.
+* @param opts - Clock + window.
+* @returns `{ isRepeat, count, hash }`.
+*/
+function denyLoopCheck(hash, priorDenies, opts) {
+	const prev = priorDenies[hash];
+	const count = (prev && typeof prev.lastTs === "number" && opts.now - prev.lastTs < opts.windowMs ? prev.count : 0) + 1;
+	return {
+		isRepeat: count > 1,
+		count,
+		hash
+	};
+}
+/**
+* Enrich a REPEATED block prompt — a NEW object, never a mutation (the input may
+* be a shared const like FAIL_CLOSED). The decision stays `block`; only the
+* message changes, so every harness renders it through the same adapter.
+* @param prompt - The original block prompt.
+* @param count - The running identical-deny count (n).
+* @returns A block prompt with `[REPEAT]` title, STOP-prefixed reason, forced research action.
+*/
+function enrichRepeatDeny(prompt, count) {
+	const stop = `Tentative identique n°${count} déjà refusée pour la même raison. STOP: ne retente pas ce même appel. `;
+	const action = "Launch fuse-ai-pilot:research-expert to find a DIFFERENT approach";
+	return {
+		...prompt,
+		title: prompt.title.startsWith("[REPEAT]") ? prompt.title : `[REPEAT] ${prompt.title}`,
+		reason: stop + prompt.reason,
+		actions: [action, ...prompt.actions ?? []]
+	};
+}
+//#endregion
+//#region src/runtime/deny-loop-store.ts
+/**
+* @module deny-loop-store
+* Sidecar state + gate wiring for the mechanical anti-loop ({@link module:deny-loop}).
+*
+* STATE — a standalone sidecar (`deny-loop.json`) in the same per-project state
+* dir as the session track, NOT a field in `session-state.ts`: that file is owned
+* by another concern this batch, so a shared field would couple two owners and
+* contend on one file for two unrelated maps. This mirrors the proven
+* {@link module:inject-dedup} `oncePerWindow` sidecar (atomicWrite, prune-by-window,
+* fail-open) and keeps the anti-loop self-contained.
+*
+* WINDOW — the hash expires with the same freshness window the gate already uses
+* (`FUSE_ENFORCE_TTL_SEC` / `windowMs`): a loop is a burst, not a lifetime, so a
+* stale deny past the window resets and a later identical call is a fresh #1.
+* @packageDocumentation
+*/
+/** Sidecar basename under the per-project state dir. */
+const SIDECAR = "deny-loop.json";
+/** Load the `{ hash -> DenyEntry }` map, or `{}` when missing/corrupt. */
+function loadMap(path) {
+	try {
+		if (!existsSync(path)) return {};
+		const data = JSON.parse(readFileSync(path, "utf8"));
+		return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+	} catch {
+		return {};
+	}
+}
+/** Drop entries whose last deny is older than the window (bounds size + resets stale loops). */
+function prune(map, now, windowMs) {
+	const out = {};
+	for (const [k, e] of Object.entries(map)) if (e && typeof e.lastTs === "number" && now - e.lastTs < windowMs) out[k] = e;
+	return out;
+}
+/**
+* Record a deny for `(tool, input)`: prune, {@link denyLoopCheck}, persist the
+* bumped entry. Fails open (`isRepeat:false`) when the sidecar is unwritable — a
+* broken state dir must never manufacture a false `[REPEAT]`.
+* @param tool - Tool name.
+* @param input - Identifying tool input.
+* @param opts - Clock + state dir + window.
+* @returns `{ isRepeat, count, hash }`.
+*/
+function recordDeny(tool, input, opts) {
+	const hash = denyHash(tool, input);
+	const path = join(opts.dir, SIDECAR);
+	const map = prune(loadMap(path), opts.now, opts.windowMs);
+	const res = denyLoopCheck(hash, map, opts);
+	map[hash] = {
+		count: res.count,
+		lastTs: opts.now
+	};
+	try {
+		atomicWrite(path, JSON.stringify(map));
+	} catch {}
+	return res;
+}
+/**
+* Gate tail: record every block deny; on a repeat, return the enriched prompt.
+* Allows (`null`) and non-block prompts (`ask`/`inform`) pass through untouched —
+* a loop is a retried REFUSAL, and only `block` is a refusal. The decision is
+* NEVER changed; only a repeated block's message is rewritten.
+* @param prompt - The gate's outcome.
+* @param tool - Tool name.
+* @param input - Identifying tool input.
+* @param opts - Clock + state dir + window.
+* @returns The prompt, enriched only when it is a repeated block.
+*/
+function withDenyLoop(prompt, tool, input, opts) {
+	if (!prompt || prompt.kind !== "block") return prompt;
+	const { isRepeat, count } = recordDeny(tool, input, opts);
+	return isRepeat ? enrichRepeatDeny(prompt, count) : prompt;
+}
+//#endregion
 //#region src/runtime/gate.ts
 /** Prior agents the freshness gate requires before a code edit. */
 const REQUIRED_AGENTS = ["explore-codebase", "research-expert"];
 /**
-* Default freshness window for {@link REQUIRED_AGENTS}, in ms. Matches the
-* plugin's `FUSE_ENFORCE_TTL_SEC` default (120s). Only a fallback for direct
-* programmatic callers that omit `windowMs` (e.g. tests) — the real CLI path
-* always supplies `windowMs` from `resolveTtlSec()` (`src/config/ttl.ts`).
+* Default freshness window (ms). Matches the plugin's `FUSE_ENFORCE_TTL_SEC`
+* default (120s); only a fallback for callers that omit `windowMs` (e.g. tests) —
+* the real CLI path always supplies it from `resolveTtlSec()` (`src/config/ttl.ts`).
 */
 const DEFAULT_WINDOW_MS = 12e4;
 /** Trivial edits allowed within the window before the full APEX gates apply. */
 const TRIVIAL_BUDGET = 4;
 /**
-* Full gate: the stateless guards (file-size, git, security...) first, then a
-* trivial-edit fast path, then the stateful APEX gates fed from the session
-* track. Returns the first blocking prompt, or null to allow.
+* Full gate: {@link runGates} yields the first blocking prompt (or null); the
+* anti-loop tail ({@link withDenyLoop}) rewrites an identical retried deny's
+* message (decision unchanged). Sidecar dir = the track's dir (tests off `$HOME`).
 */
 async function gate(input) {
+	return withDenyLoop(await runGates(input), input.tool, {
+		filePath: input.filePath,
+		content: input.content,
+		command: input.command
+	}, {
+		now: input.now,
+		dir: dirname(input.trackFile),
+		windowMs: input.windowMs ?? 12e4
+	});
+}
+/** Stateless guards, then the trivial fast path, then the stateful APEX gates. */
+async function runGates(input) {
 	const precommit = preCommitGate(input.tool, input.command, input.cwd);
 	if (precommit) return precommit;
 	const protectedDeny = protectedPathGate(input.tool, input.filePath);
@@ -5159,6 +5820,206 @@ function designGate(payload, event, cacheDir, cwd) {
 	return null;
 }
 //#endregion
+//#region src/policy/lessons/trigger-index.ts
+/**
+* Compile the triggered-lesson index from `MEMORY/LESSON.md`. A lesson is a
+* bullet (`- [YYYY-MM-DD HH:MM] ...`); it opts into decision-time injection by
+* ending with a `[TRIGGERS tool:.. path:.. error:.. keyword:..]` line. Lessons
+* WITHOUT that tag are skipped here (they keep the SessionStart block behavior —
+* zero regression). Parsed once per file version (mtime-memoized).
+*/
+/** Matches a trailing `[TRIGGERS ...]` line (its body captured). */
+const TRIGGER_RE = /^\[TRIGGERS\s+(.+?)\]$/;
+/** Comma list for `key:` in a trigger body (values are space-delimited). */
+function list(body, key) {
+	const val = body.match(new RegExp(`\\b${key}:([^\\s\\]]+)`))?.[1];
+	return val ? val.split(",").filter(Boolean) : [];
+}
+/** Parse a `[TRIGGERS ...]` body into predicates (error is a single regex). */
+function parseTriggers(body) {
+	const err = body.match(/\berror:([^\s\]]+)/);
+	return {
+		tools: list(body, "tool"),
+		paths: list(body, "path"),
+		error: err?.[1],
+		keywords: list(body, "keyword")
+	};
+}
+/** Collapse to a single ≤3-line compact string (cap length). */
+function compact(text) {
+	const one = text.replace(/\s+/g, " ").trim();
+	return one.length > 280 ? `${one.slice(0, 277)}…` : one;
+}
+/**
+* Parse LESSON.md content into triggered entries. A bullet's text spans its
+* `- ` line plus any following non-blank continuation lines up to the next
+* bullet; a `[TRIGGERS ...]` continuation line arms it.
+* @param content - Raw LESSON.md text.
+* @returns Entries that declared triggers (others skipped).
+*/
+function parseLessons(content) {
+	const lines = content.split("\n");
+	const out = [];
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		if (line === void 0 || !line.startsWith("- ")) continue;
+		let text = line.slice(2);
+		let triggers = null;
+		for (let j = i + 1; j < lines.length; j++) {
+			const cont = lines[j];
+			if (cont === void 0 || cont.trim() === "" || cont.startsWith("- ")) break;
+			const body = cont.trim().match(TRIGGER_RE)?.[1];
+			if (body !== void 0) triggers = parseTriggers(body);
+			else text += ` ${cont.trim()}`;
+		}
+		if (triggers) out.push({
+			text: compact(text),
+			triggers
+		});
+	}
+	return out;
+}
+let memo = null;
+/**
+* Compile (once per file version) the triggered-lesson index from `file`.
+* Memoized by path+mtime: re-parses only when LESSON.md changes.
+* @param file - Absolute path to MEMORY/LESSON.md.
+* @returns The compiled entries (missing/unreadable file → empty).
+*/
+function lessonIndex(file) {
+	let key;
+	try {
+		key = `${file}:${statSync(file).mtimeMs}`;
+	} catch {
+		return [];
+	}
+	if (memo?.key === key) return memo.entries;
+	let entries = [];
+	try {
+		entries = parseLessons(readFileSync(file, "utf-8"));
+	} catch {
+		entries = [];
+	}
+	memo = {
+		key,
+		entries
+	};
+	return entries;
+}
+/** Glob (`*`/`**`) → RegExp, matching a path segment/tail. */
+function globToRe(glob) {
+	const esc = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").replace(//g, ".*");
+	return new RegExp(`(^|/)${esc}$`);
+}
+/** Safe case-insensitive regex test (absent source or invalid → false). */
+function safeTest(src, s) {
+	if (!src) return false;
+	try {
+		return new RegExp(src, "i").test(s);
+	} catch {
+		return false;
+	}
+}
+/** Score one entry against the call; null = no predicate matched. */
+function scoreEntry(e, tool, filePath, inputJson, prevError) {
+	const tr = e.triggers;
+	if (tr.tools.includes(tool)) return {
+		entry: e,
+		rank: 3
+	};
+	if (filePath && tr.paths.some((g) => globToRe(g).test(filePath))) return {
+		entry: e,
+		rank: 2
+	};
+	if (prevError && safeTest(tr.error, prevError)) return {
+		entry: e,
+		rank: 1
+	};
+	if (tr.keywords.some((k) => inputJson.includes(k))) return {
+		entry: e,
+		rank: 0
+	};
+	return null;
+}
+/** Stable, filesystem-safe cooldown key from a lesson's compact text (djb2). */
+function cooldownKey(text) {
+	let h = 5381;
+	for (let i = 0; i < text.length; i++) h = (h << 5) + h + text.charCodeAt(i) | 0;
+	return `lesson:${(h >>> 0).toString(36)}`;
+}
+/**
+* The single most-specific lesson for this PreToolUse call, or null. Matching
+* priority: exact tool > path glob > error regex > input-JSON keyword. Cooldown
+* suppresses a lesson already injected within the window.
+* @param tool - The tool being called (e.g. `Write`).
+* @param toolInput - The raw `tool_input`.
+* @param opts - Index file, cooldown gate, and optional prior error.
+* @returns An `inform` prompt, or null when nothing matches / in cooldown.
+*/
+function lessonFor(tool, toolInput, opts) {
+	const entries = lessonIndex(opts.file);
+	if (entries.length === 0) return null;
+	const filePath = typeof toolInput?.file_path === "string" ? toolInput.file_path : "";
+	const inputJson = JSON.stringify(toolInput ?? {});
+	let best = null;
+	for (const e of entries) {
+		const m = scoreEntry(e, tool, filePath, inputJson, opts.prevError);
+		if (m && (!best || m.rank > best.rank)) best = m;
+	}
+	if (!best) return null;
+	if (!opts.once(cooldownKey(best.entry.text), opts.cooldownMs ?? 18e5)) return null;
+	return {
+		kind: "inform",
+		title: `Project lesson${filePath ? ` (${basename(filePath)})` : ""}`,
+		reason: best.entry.text
+	};
+}
+//#endregion
+//#region src/runtime/pre-allow.ts
+/**
+* PreToolUse ALLOW-path response assembly. Reached only after every gate
+* allowed (a deny/ask already returned upstream), so nothing here can block nor
+* override a decision. Combines the Python-parity pass notice (systemMessage)
+* with the single most-specific decision-time lesson (additionalContext).
+*/
+/**
+* Build the native outcome for a PreToolUse call that passed every gate: emit a
+* user-visible pass notice (once per allowed call) and, when its TRIGGERS match
+* this call, the one cooldown-guarded decision-time lesson. Both channels ride a
+* single response (lesson → additionalContext, notice → systemMessage).
+* @param id - Harness id for {@link respond}.
+* @param event - The normalized PreToolUse event.
+* @param payload - The raw hook payload (for `agent_id`).
+* @param mcpDir - MCP state dir backing the pass-notice throttle.
+* @param cwd - Project root (lesson file + notice scope).
+* @returns The native hook outcome (empty stdout when nothing to emit).
+*/
+function allowOutcome(id, event, payload, mcpDir, cwd) {
+	const notice = designPassNotice({
+		agentId: typeof payload.agent_id === "string" ? payload.agent_id : "",
+		tool: event.tool,
+		filePath: event.filePath ?? "",
+		content: event.content ?? "",
+		url: typeof event.input.url === "string" ? event.input.url : "",
+		phase: "pre"
+	}, mcpDir);
+	const lesson = lessonFor(event.tool, event.input, {
+		file: lessonsFileFor(projectRoot(cwd)),
+		once: oncePerWindow
+	});
+	if (lesson) return {
+		stdout: respond(id, notice?.userMessage ? {
+			...lesson,
+			userMessage: notice.userMessage
+		} : lesson),
+		exit: 0
+	};
+	return {
+		stdout: notice ? respond(id, notice) : "",
+		exit: 0
+	};
+}
+//#endregion
 //#region src/runtime/handle-pre.ts
 /**
 * Run the PreToolUse pipeline: MCP/WebFetch cache intercept, design gate, APEX
@@ -5223,18 +6084,7 @@ async function handlePre(ctx) {
 		stdout: respond(id, prompt),
 		exit: 0
 	};
-	const notice = designPassNotice({
-		agentId: typeof payload.agent_id === "string" ? payload.agent_id : "",
-		tool: event.tool,
-		filePath: event.filePath ?? "",
-		content: event.content ?? "",
-		url: typeof event.input.url === "string" ? event.input.url : "",
-		phase: "pre"
-	}, mcpDir);
-	return {
-		stdout: notice ? respond(id, notice) : "",
-		exit: 0
-	};
+	return allowOutcome(id, event, payload, mcpDir, opts.cwd);
 }
 //#endregion
 //#region src/freshness/query-framework.ts
@@ -5423,6 +6273,12 @@ async function handlePost(ctx) {
 	for (const activity of activities) await recordActivity(file, activity);
 	const evidence = classifyAgentEvidence(event.tool, event.input, response);
 	if (evidence) await recordAgentEvidence(file, evidence, opts.now, typeof payload.agent_id === "string" ? payload.agent_id : void 0);
+	if (event.tool === "Bash" && event.command) {
+		const r = payload.tool_result ?? response;
+		const out = `${typeof r?.stdout === "string" ? r.stdout : ""}\n${typeof r?.stderr === "string" ? r.stderr : ""}`;
+		const exit = Number(r?.exit_code ?? 0);
+		await captureReceipt(file, event.command, out, Number.isFinite(exit) ? exit : 0, opts.now);
+	}
 	postTrackingSideEffects(opts.scope ?? "core", event, event.input, opts.now, payload, opts.cwd);
 	const seoDeny = opts.scope === "seo" ? seoPostToolUseResponse(payload) : null;
 	if (seoDeny) return {
@@ -5564,4 +6420,4 @@ async function handleHook(id, payload, opts) {
 	});
 }
 //#endregion
-export { saveApexState as $, trackSkillRead as A, securityStateDir as At, writePluginMap as B, seoPostToolUse as C, defaultStateDir as Ct, postTrackingSideEffects as D, isoUtc as Dt, securityAdvisory as E, normalizeEvent as Et, dispatchLessons as F, mergeLines as G, isProject as H, lessonsFileFor as I, listChildren as J, countFiles as K, lessonsStateFileFor as L, dispatchLifecycle as M, todayUtc as Mt, aipilotPostToolUse as N, trackWatchResearch as O, loadSecurityState as Ot, dispatchAipilot as P, cleanupSession as Q, cartoSessionStart as R, postEditContext as S, taskContext as St, dispatchMemory as T, trackFile as Tt, writeTree as U, generateProjectMap as V, loadEnriched as W, trackSessionChanges as X, postEditTypescript as Y, validateRulesLoaded as Z, preCommitGate as _, trimLogFile as _t, recordActivity as a, validateSolidGate as at, extractSymbols as b, projectContext as bt, MCP_TTL_MS as c, detectSolidProfile as ct, isMcpTool as d, readRules as dt, logToolFailure as et, queryOf as f, runSessionStartCleanups as ft, gate as g, removeOldFiles as gt, TRIVIAL_BUDGET as h, purgeTtlTree as ht, respond as i, validateTailwind as it, trackEnrichment as j, securityStatePath as jt, trackMcpResearch as k, saveSecurityState as kt, WEBFETCH_TTL_MS as l, solidDetectStart as lt, REQUIRED_AGENTS as m, pruneEmptyDirs as mt, activityFor as n, trackAgentMemory as nt, mcpPostStore as o, checkFileSize as ot, DEFAULT_WINDOW_MS as p, sessionStartCore as pt, getFileDesc as q, handlePre as r, subagentCacheContext as rt, mcpPreIntercept as s, countLoc as st, handleHook as t, validateTeammateOutput as tt, cacheQueryOf as u, injectRules as ut, detectDuplication as v, devContext as vt, seoPostToolUseResponse as w, projectHash$1 as wt, lifecycleStdout as x, promptSubmitContext as xt, dryGate as y, gitContext as yt, generateEcosystemMap as z };
+export { saveApexState as $, trackSkillRead as A, saveSecurityState as At, writePluginMap as B, seoPostToolUse as C, taskContext as Ct, postTrackingSideEffects as D, normalizeEvent as Dt, securityAdvisory as E, trackFile as Et, dispatchLessons as F, mergeLines as G, isProject as H, lessonsFileFor as I, listChildren as J, countFiles as K, lessonsStateFileFor as L, dispatchLifecycle as M, securityStatePath as Mt, aipilotPostToolUse as N, todayUtc as Nt, trackWatchResearch as O, isoUtc as Ot, dispatchAipilot as P, cleanupSession as Q, cartoSessionStart as R, postEditContext as S, promptSubmitContext as St, dispatchMemory as T, projectHash$1 as Tt, writeTree as U, generateProjectMap as V, loadEnriched as W, trackSessionChanges as X, postEditTypescript as Y, validateRulesLoaded as Z, preCommitGate as _, trimLogFile as _t, recordActivity as a, validateSolidGate as at, extractSymbols as b, projectContext as bt, MCP_TTL_MS as c, detectSolidProfile as ct, isMcpTool as d, readRules as dt, logToolFailure as et, queryOf as f, runSessionStartCleanups as ft, gate as g, removeOldFiles as gt, TRIVIAL_BUDGET as h, purgeTtlTree as ht, respond as i, validateTailwind as it, trackEnrichment as j, securityStateDir as jt, trackMcpResearch as k, loadSecurityState as kt, WEBFETCH_TTL_MS as l, solidDetectStart as lt, REQUIRED_AGENTS as m, pruneEmptyDirs as mt, activityFor as n, trackAgentMemory as nt, mcpPostStore as o, checkFileSize as ot, DEFAULT_WINDOW_MS as p, sessionStartCore as pt, getFileDesc as q, handlePre as r, subagentCacheContext as rt, mcpPreIntercept as s, countLoc as st, handleHook as t, validateTeammateOutput as tt, cacheQueryOf as u, injectRules as ut, detectDuplication as v, devContext as vt, seoPostToolUseResponse as w, defaultStateDir as wt, lifecycleStdout as x, claudeMdKey as xt, dryGate as y, gitContext as yt, generateEcosystemMap as z };