@fusengine/harness 0.1.50 → 0.1.52

package/dist/cli/bin.mjs

@@ -4,7 +4,7 @@ import { t as detectHarness } from "../harness-Cb9xR8dC.mjs";
 import { t as claudeHome } from "../home-state-D0RLWP8J.mjs";
 import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DZvP_9xB.mjs";
 import { n as writeInitFile, t as initFor } from "../run-Do2JltgU.mjs";
-import { Nt as todayUtc, t as handleHook } from "../handle-DzPjaPS-.mjs";
+import { Nt as todayUtc, t as handleHook } from "../handle-QfgfNSh6.mjs";
 import { delimiter, dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{handle-DzPjaPS-.mjs → handle-QfgfNSh6.mjs}

@@ -1,4 +1,5 @@
 import { a as parseEnvInt, i as splitTarget, r as resolveMaxLines } from "./limits-CHn8AIL1.mjs";
+import { s as resolveTtlSec } from "./dotenv-Jj8aL1FL.mjs";
 import { r as projectLayout } from "./layout-C0jaaCQC.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { A as detectCreationIntent, E as isExcludedSwiftPath, F as docConsultedGate, H as detectProjectType$1, I as evaluateApex, M as POST_AUTH_GATES, N as PRE_AUTH_GATES, S as usesTailwindUtilities, T as isExcludedJsPath, V as detectModularArchitecture, W as requiredArchSkill, _ as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, h as buildClaudeMdContext, k as capVerbosity, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, r as descFromText, s as parseEntry, t as isHtmlLike, w as frameworkSolidGate, x as skillTriggerGate, y as parseField, z as detectFramework } from "./validate-DCQ8dkdL.mjs";
@@ -11,7 +12,7 @@ import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as setStateField, t as addRoot } from "./registry-CymilZiZ.mjs";
 import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, t as mcpCacheWrite, u as extractText } from "./mcp-store-BkBDmuxN.mjs";
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
-import { c as recordDoc, d as recordTrivialEdit, f as trivialCount, i as agentsFresh, l as recordRefRead, n as saveTrack, o as recordAgent, p as apexAuthorizationGate, r as verifyTrack, s as recordBrainstormRequired, t as loadTrack, u as recordTarget } from "./store-QSSTO3lY.mjs";
+import { a as writeLastNonce, c as recordAgent, d as recordRefRead, f as recordTarget, h as apexAuthorizationGate, i as verifyTrack, l as recordBrainstormRequired, m as trivialCount, n as saveTrack, o as agentsFresh, p as recordTrivialEdit, r as signTrack, s as emptyTrack, t as loadTrack, u as recordDoc } from "./store-CQ4roWrU.mjs";
 import { d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-BxC9semG.mjs";
 import { r as toHermesResponse } from "./hermes-DWXCRFZU.mjs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
@@ -328,9 +329,9 @@ function designLifecycle(payload, cacheDir, cwd, stamp, now) {
 	return false;
 }
 /** Sidecar basename under the per-project state dir. */
-const SIDECAR = "inject-dedup.json";
+const SIDECAR$1 = "inject-dedup.json";
 /** Load the `{ key -> epochMs }` map, or `{}` when missing/corrupt. */
-function loadMap(path) {
+function loadMap$1(path) {
 	try {
 		if (!existsSync(path)) return {};
 		const data = JSON.parse(readFileSync(path, "utf8"));
@@ -340,7 +341,7 @@ function loadMap(path) {
 	}
 }
 /** Keep only entries newer than `windowMs` before `now` (bounds sidecar size). */
-function prune(map, now, windowMs) {
+function prune$1(map, now, windowMs) {
 	const out = {};
 	for (const [k, t] of Object.entries(map)) if (typeof t === "number" && now - t < windowMs) out[k] = t;
 	return out;
@@ -360,8 +361,8 @@ function prune(map, now, windowMs) {
 */
 function oncePerWindow(key, windowMs, opts = {}) {
 	const now = opts.now ?? Date.now();
-	const path = join(opts.dir ?? defaultStateDir(), SIDECAR);
-	const map = prune(loadMap(path), now, windowMs);
+	const path = join(opts.dir ?? defaultStateDir(), SIDECAR$1);
+	const map = prune$1(loadMap$1(path), now, windowMs);
 	const last = map[key];
 	if (typeof last === "number" && now - last < windowMs) return false;
 	map[key] = now;
@@ -930,42 +931,122 @@ function subagentCacheContext(sessionIdRaw, home = homedir(), env = process.env,
 	return fresh.length ? contextResponse("SubagentStart", render(fresh)) : "";
 }
 //#endregion
-//#region src/runtime/lifecycle/agent-files.ts
+//#region src/tracking/receipts.ts
 /**
-* Per-agent file attribution for SubagentStop. Parses a sub-agent's OWN
-* transcript (`agent_transcript_path` — the clean JSONL the Claude Code platform
-* writes for that specific sub-agent, added in CLI v2.0.42) to recover the exact
-* set of files it wrote via Write/Edit/MultiEdit/NotebookEdit. This lets the
-* sniper reminder attribute only the files THIS agent touched, instead of every
-* file changed in the whole session (which cross-attributes other teammates'
-* work — the bug this fixes). Per LESSON.md, the SubagentStop transcript is the
-* reliable anchor; sidechain PostToolUse hooks are not (issues #43612/#34692).
+* @module receipts
+* Verification receipts: capture `tsc`/test runs at PostToolUse and query the
+* freshest PASSING one for the TaskCompleted (hard) and SubagentStop (advisory)
+* gates. A "done" over modified code files is refused unless such a receipt
+* exists — mechanising "no proof, no done".
+* @packageDocumentation
 */
-/** Tools whose `input.file_path`/`notebook_path` names a file the agent authored. */
-const WRITE_TOOLS = /* @__PURE__ */ new Set([
-	"Write",
-	"Edit",
-	"MultiEdit",
-	"NotebookEdit"
-]);
+/** `tsc` / `bunx tsc` / `npx tsc -p .` — a type-check invocation. */
+const TSC_RE = /(?:^|\s|\/)(?:bunx\s+|npx\s+|pnpm\s+|yarn\s+)?tsc\b/;
+/** `bun test`, `vitest`, `jest`, `npm test`, `npm run test`, … — a test run. */
+const TEST_RE = /\b(?:bun\s+test|vitest|jest|(?:npm|pnpm|yarn)\s+(?:run\s+)?test)\b/;
+/** Append a verification receipt to the track. Immutable. */
+function recordReceipt(track, receipt) {
+	return {
+		...track,
+		receipts: [...track.receipts ?? [], receipt]
+	};
+}
+/** Parse `N pass` / `M fail` counts from bun/vitest/jest output (undefined when absent). */
+function parseCounts(output) {
+	const pass = output.match(/(\d+)\s+pass/i);
+	const fail = output.match(/(\d+)\s+fail/i);
+	return {
+		pass: pass ? Number(pass[1]) : void 0,
+		fail: fail ? Number(fail[1]) : void 0
+	};
+}
 /**
-* Return the distinct list of file paths written by the sub-agent whose own
-* transcript is at `transcriptPath`, by scanning its Write/Edit/MultiEdit/
-* NotebookEdit `tool_use` blocks. Distinguishes "no writes" from "cannot read":
-*
-* - `null` — the path is absent, or the transcript is unreadable. The caller
-*   MUST fall back to the session-wide list (fail-open: never drop the sniper
-*   reminder just because a transcript could not be parsed — no regression vs.
-*   the pre-fix behavior).
-* - `string[]` (possibly empty) — the transcript was read; every write was
-*   collected. An empty array means this agent authored no files, so it should
-*   NOT be told to validate files other agents changed.
-*
-* @param transcriptPath - Absolute path to the sub-agent's own `.jsonl`
-*   transcript (SubagentStop payload field `agent_transcript_path`).
-* @returns Distinct written paths (order-preserving), or `null` when unreadable.
+* Classify a Bash command as a verification receipt, or `null` when it is not a
+* recognised `tsc`/test invocation. Test runs additionally carry parsed
+* pass/fail counts.
+* @param command - The Bash command line.
+* @param output - Combined stdout+stderr (bun writes its summary to stderr).
+* @param exitCode - The command's exit code.
+* @param now - Capture timestamp (epoch ms).
 */
-function filesWrittenByAgent(transcriptPath) {
+function classifyReceipt(command, output, exitCode, now) {
+	if (TEST_RE.test(command)) {
+		const { pass, fail } = parseCounts(output);
+		return {
+			kind: "test",
+			exitCode,
+			pass,
+			fail,
+			ts: now
+		};
+	}
+	if (TSC_RE.test(command)) return {
+		kind: "tsc",
+		exitCode,
+		ts: now
+	};
+	return null;
+}
+/** A receipt PROVES success: exit 0 and (for tests) zero reported failures. */
+function isPassing(r) {
+	return r.exitCode === 0 && (r.fail ?? 0) === 0;
+}
+/** The newest passing receipt within `windowMs`, or `null`. */
+function freshPassingReceipt(track, windowMs, now) {
+	const cutoff = now - windowMs;
+	const hits = (track.receipts ?? []).filter((r) => r.ts > cutoff && isPassing(r));
+	return hits.length ? hits.reduce((a, b) => b.ts > a.ts ? b : a) : null;
+}
+/**
+* Sync variant reading the signed track file directly — for the sync gates
+* (TaskCompleted / SubagentStop). Returns the newest passing receipt, or `null`
+* on any read/verify failure (fail-closed: no proof ⇒ treated as unverified).
+*/
+function freshReceiptFromFile(file, windowMs, now) {
+	try {
+		if (!existsSync(file)) return null;
+		const track = verifyTrack(JSON.parse(readFileSync(file, "utf-8")));
+		return track ? freshPassingReceipt(track, windowMs, now) : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Capture a verification receipt from a PostToolUse Bash command into the signed
+* track (best effort — a non-verification command is a no-op).
+*/
+async function captureReceipt(file, command, output, exitCode, now) {
+	const receipt = classifyReceipt(command, output, exitCode, now);
+	if (!receipt) return;
+	await saveTrack(file, recordReceipt(await loadTrack(file), receipt));
+}
+//#endregion
+//#region src/runtime/lifecycle/agent-transcript.ts
+/**
+* Shared low-level parser for a sub-agent's OWN transcript (`agent_transcript_path`
+* — the clean JSONL the Claude Code platform writes per sub-agent, CLI v2.0.42+).
+* Per LESSON.md this is the RELIABLE anchor for evidence: sidechain PostToolUse
+* hooks are not guaranteed (issues #43612/#27655/#34692). One parser, reused by
+* file-attribution (`agent-files.ts`) and retroactive evidence harvesting
+* (`src/freshness/evidence-harvest.ts`) — no duplication.
+*/
+/** Parse a raw `timestamp` field to epoch ms; `undefined` when absent or invalid. */
+function parseTs$2(raw) {
+	if (raw === void 0) return void 0;
+	if (typeof raw === "number") return raw;
+	const ms = Date.parse(raw);
+	return Number.isFinite(ms) ? ms : void 0;
+}
+/**
+* Scan a sub-agent transcript into its ordered `tool_use` blocks (each with the
+* enclosing message timestamp). Distinguishes "no tool use" from "cannot read":
+* returns `null` when the path is absent or the transcript is unreadable (callers
+* fail-open), or a possibly-empty array when parsed. Malformed lines/blocks are
+* tolerated and skipped.
+* @param transcriptPath - Absolute path to the sub-agent's own `.jsonl` transcript.
+* @returns Ordered tool uses, or `null` when unreadable.
+*/
+function readAgentToolUses(transcriptPath) {
 	if (!transcriptPath) return null;
 	let text;
 	try {
@@ -974,7 +1055,6 @@ function filesWrittenByAgent(transcriptPath) {
 		return null;
 	}
 	const out = [];
-	const seen = /* @__PURE__ */ new Set();
 	for (const line of text.split("\n")) {
 		if (!line.trim()) continue;
 		let entry;
@@ -985,22 +1065,63 @@ function filesWrittenByAgent(transcriptPath) {
 		}
 		const content = entry.message?.content;
 		if (!Array.isArray(content)) continue;
+		const ts = parseTs$2(entry.timestamp);
 		for (const block of content) {
-			if (block?.type !== "tool_use" || !block.name || !WRITE_TOOLS.has(block.name)) continue;
-			const fp = block.input?.file_path ?? block.input?.notebook_path;
-			if (typeof fp === "string" && fp && !seen.has(fp)) {
-				seen.add(fp);
-				out.push(fp);
-			}
+			if (block?.type !== "tool_use" || !block.name) continue;
+			out.push({
+				name: block.name,
+				input: block.input,
+				ts
+			});
 		}
 	}
 	return out;
 }
+//#endregion
+//#region src/runtime/lifecycle/agent-files.ts
+/**
+* Per-agent file attribution for SubagentStop. Uses the shared transcript parser
+* ({@link readAgentToolUses}) to recover the exact set of files a sub-agent wrote
+* via Write/Edit/MultiEdit/NotebookEdit, so the sniper reminder attributes only
+* the files THIS agent touched instead of every file changed in the whole session
+* (which cross-attributes other teammates' work — the bug this fixes).
+*/
+/** Tools whose `input.file_path`/`notebook_path` names a file the agent authored. */
+const WRITE_TOOLS = /* @__PURE__ */ new Set([
+	"Write",
+	"Edit",
+	"MultiEdit",
+	"NotebookEdit"
+]);
 /**
-* Filter `sessionFiles` (from unified state `.changes.modifiedFiles`) down to the
-* ones this agent actually wrote. Matches on the exact recorded string first,
-* then tolerantly on `basename` so a relative-vs-absolute path drift between the
-* PostToolUse record and the transcript input never loses an owned file.
+* Return the distinct file paths written by the sub-agent whose own transcript is
+* at `transcriptPath` (Write/Edit/MultiEdit/NotebookEdit). `null` when unreadable
+* (caller MUST fall back to the session-wide list — no regression); a possibly-
+* empty array when parsed (empty = authored nothing, so it should NOT be told to
+* validate files other agents changed).
+* @param transcriptPath - Absolute path to the sub-agent's own `.jsonl` transcript.
+* @returns Distinct written paths (order-preserving), or `null` when unreadable.
+*/
+function filesWrittenByAgent(transcriptPath) {
+	const uses = readAgentToolUses(transcriptPath);
+	if (uses === null) return null;
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const u of uses) {
+		if (!WRITE_TOOLS.has(u.name)) continue;
+		const fp = u.input?.file_path ?? u.input?.notebook_path;
+		if (typeof fp === "string" && fp && !seen.has(fp)) {
+			seen.add(fp);
+			out.push(fp);
+		}
+	}
+	return out;
+}
+/**
+* Filter `sessionFiles` down to the ones this agent actually wrote. Matches the
+* exact recorded string first, then tolerantly on `basename` so a relative-vs-
+* absolute drift between the PostToolUse record and the transcript input never
+* loses an owned file.
 * @param sessionFiles - Session-wide modified files.
 * @param written - Paths the agent wrote (from {@link filesWrittenByAgent}).
 * @returns The subset of `sessionFiles` attributable to this agent.
@@ -1058,7 +1179,9 @@ function trackAgentMemory(data, home = homedir(), now = Date.now()) {
 					cumulativeCodeFiles: 0
 				}
 			}, home);
-			return contextResponse("SubagentStop", `SNIPER VALIDATION REQUIRED: Agent '${agentType}' modified ${owned.length} code file(s): ${owned.join(", ")}. Run sniper agent now.`);
+			const windowMs = resolveTtlSec(process.env) * 1e3 * 5;
+			const note = freshReceiptFromFile(trackFile(sessionId, defaultStateDir(process.cwd())), windowMs, now) === null ? " NO VERIFICATION RECEIPT — run tsc + tests before reporting done." : "";
+			return contextResponse("SubagentStop", `SNIPER VALIDATION REQUIRED: Agent '${agentType}' modified ${owned.length} code file(s): ${owned.join(", ")}. Run sniper agent now.${note}`);
 		}
 	}
 	return JSON.stringify({ message: `Agent ${agentType} completed (no code changes)` });
@@ -1260,8 +1383,292 @@ function postEditTypescript(filePath) {
 	if (hasBin("prettier")) {
 		if (run("prettier", ["--check", filePath]).code !== 0) issues.push(`Prettier: ${basename(filePath)} needs formatting`);
 	}
-	if (issues.length === 0) return "";
-	return contextResponse("PostToolUse", `Lint issues in ${basename(filePath)}: ${issues.join(" | ")}`);
+	if (issues.length === 0) return "";
+	return contextResponse("PostToolUse", `Lint issues in ${basename(filePath)}: ${issues.join(" | ")}`);
+}
+//#endregion
+//#region src/freshness/explore-tools.ts
+/** Native exploration tools (parity `apex_constants.EXPLORE_TOOLS`). */
+const EXPLORE_TOOLS = /* @__PURE__ */ new Set(["Glob", "Grep"]);
+/**
+* Research tools — MCP docs + web (parity `apex_constants.RESEARCH_TOOLS`).
+* The fuse-browser fast-path entries are a deliberate TS addition: CLAUDE.md
+* mandates fuse-browser FIRST for web research, and `docSourceOf` (activity.ts)
+* already credits it for doc consultation — without them here, an agent
+* following the rules would never satisfy the freshness gate (same
+* cross-consumer inconsistency class as the solidReadGate lesson).
+*/
+const RESEARCH_TOOLS = /* @__PURE__ */ new Set([
+	"mcp__context7__query-docs",
+	"mcp__context7__resolve-library-id",
+	"mcp__exa__web_search_exa",
+	"mcp__exa__get_code_context_exa",
+	"mcp__exa__deep_researcher_start",
+	"WebSearch",
+	"WebFetch",
+	"mcp__fuse-browser__browser_fetch",
+	"mcp__fuse-browser__browser_fetch_batch",
+	"mcp__fuse-browser__browser_crawl",
+	"mcp__fuse-browser__browser_serp_batch"
+]);
+/** Bash executables that count as exploration (parity `EXPLORE_BASH_CMDS`). */
+const EXPLORE_BASH_CMDS = /* @__PURE__ */ new Set([
+	"grep",
+	"rg",
+	"find",
+	"ls",
+	"fd",
+	"ast-grep",
+	"tree",
+	"cat",
+	"head",
+	"tail"
+]);
+/** Legacy Python cache names still credited (parity `CACHE_READ_RE` + doc-helpers). */
+const CACHE_READ_RE = /\/context\/mcp\/(exa-search|exa-code-context|context7)-/;
+/**
+* Real TS cache stores: `<root>/.harness/cache/<fnv16>.md` (core MCP store,
+* `projectLayout().cacheDir`) and `~/.fuse-harness/cache/**` (ai-pilot doc
+* caches, `cache-base.cacheBaseDir`). Segment-matched — not resolved against
+* `homedir()` — so tilde-prefixed and absolute paths both hit; the `.md`
+* suffix keeps session-state JSON reads from counting as research.
+*/
+const TS_CACHE_READ_RE = /\.(?:fuse-)?harness[\\/]cache[\\/].*\.md$/;
+/**
+* First non-assignment shell token's basename, or "" — mirrors Python
+* `_bash_executable` (skips leading `VAR=value` env prefixes, e.g. `FOO=1 grep`).
+* @param cmd - Raw Bash `command` string.
+* @returns The executable basename, or "" when none.
+*/
+function bashExecutable(cmd) {
+	for (const token of cmd.trim().split(/\s+/)) {
+		if (!token) continue;
+		const last = token.split("/").pop() ?? token;
+		if (!last.includes("=")) return last;
+	}
+	return "";
+}
+/**
+* Classify a direct tool use into an APEX phase, or `null` when it is neither
+* exploration nor research. Mirrors Python `track-subagent-research._classify`.
+* @param tool - Harness tool name (e.g. "Glob", "Bash", "WebSearch").
+* @param input - Tool input payload.
+* @returns The credited phase + cache flag, or `null`.
+*/
+function classifyExplore(tool, input) {
+	if (RESEARCH_TOOLS.has(tool)) return {
+		phase: "research-expert",
+		cacheHit: false
+	};
+	if (EXPLORE_TOOLS.has(tool)) return {
+		phase: "explore-codebase",
+		cacheHit: false
+	};
+	if (tool === "Read") {
+		const path = String(input?.file_path ?? input?.path ?? "");
+		if (path && (CACHE_READ_RE.test(path) || TS_CACHE_READ_RE.test(path))) return {
+			phase: "research-expert",
+			cacheHit: true
+		};
+		return null;
+	}
+	if (tool === "Bash") {
+		const cmd = String(input?.command ?? "").trim();
+		if (EXPLORE_BASH_CMDS.has(bashExecutable(cmd))) return {
+			phase: "explore-codebase",
+			cacheHit: false
+		};
+	}
+	return null;
+}
+//#endregion
+//#region src/freshness/agent-evidence-record.ts
+/**
+* Session-track agent evidence — writer (parity track-subagent-research.py) +
+* reader scan (parity apex_agent_helpers._scan_agents). Sub-agent hooks fire
+* with the LEAD's `session_id`, so evidence recorded here lands in the ONE
+* session track the freshness gate scans FIRST — sidechain research and
+* Workflow-spawned agents count, unlike the lead-transcript scan.
+*/
+/** Tools the existing Task tracking already credits as agent LAUNCHES. */
+const AGENT_LAUNCH_TOOLS = /* @__PURE__ */ new Set(["Task", "Agent"]);
+/**
+* `JSON.stringify` length of the raw `tool_response` OBJECT (parity Python
+* `len(str(tool_response))`); 0 when absent or unserializable (circular).
+*/
+function responseJsonLength(toolResponse) {
+	if (toolResponse === void 0 || toolResponse === null) return 0;
+	try {
+		return (JSON.stringify(toolResponse) ?? "").length;
+	} catch {
+		return 0;
+	}
+}
+/**
+* Classify one PostToolUse call into session evidence, or null when it is
+* neither exploration nor research (parity track-subagent-research._classify,
+* reusing the shared {@link classifyExplore} tables — research/explore/Bash/
+* cache-read). ANTI-DOUBLE-COUNT: calls classified as agent launches
+* (`Task`/`Agent`) are skipped — the existing Task tracking credits those; the
+* criterion is the CALL's classification, never its provenance (lead vs sub).
+* @param tool - Harness tool name (e.g. "Glob", "Bash", "Read").
+* @param input - Raw tool input payload.
+* @param toolResponse - Raw `tool_response` OBJECT from the hook payload.
+* @returns The evidence to record, or null to skip.
+*/
+function classifyAgentEvidence(tool, input, toolResponse) {
+	if (AGENT_LAUNCH_TOOLS.has(tool)) return null;
+	const hit = classifyExplore(tool, input);
+	if (!hit) return null;
+	return {
+		name: hit.phase === "explore-codebase" ? "subagent-explore-codebase" : "subagent-research-expert",
+		quality: hit.cacheHit || responseJsonLength(toolResponse) > 50 ? "sufficient" : "insufficient"
+	};
+}
+/**
+* Persist evidence into the SESSION track via {@link recordAgent} — keyed by
+* `session_id` alone (sub-agent hooks carry the lead's `session_id`); the TTL
+* anchors on `ts`, the tool call's own timestamp. `agentId` is tagged as
+* metadata when present, NEVER used as a condition (unreliable field —
+* anthropics/claude-code#22348).
+* @param file - Session track file path.
+* @param evidence - Classified evidence from {@link classifyAgentEvidence}.
+* @param ts - Epoch-ms timestamp of the tool call (the hook event's `now`).
+* @param agentId - Optional Claude `agent_id` — metadata tag only.
+*/
+async function recordAgentEvidence(file, evidence, ts, agentId) {
+	const next = recordAgent(await loadTrack(file), evidence.name, ts, evidence.quality);
+	const last = next.agents[next.agents.length - 1];
+	if (agentId && last) {
+		const tagged = {
+			...last,
+			agentId
+		};
+		next.agents[next.agents.length - 1] = tagged;
+	}
+	await saveTrack(file, next);
+}
+/**
+* Parity `_scan_agents` (apex_agent_helpers.py): reverse-scan `track.agents`,
+* STOPPING at the first entry older than `windowMs` (entries append in time
+* order), matching each required name by SUBSTRING (`research-expert` matches
+* `subagent-research-expert`) and counting ONLY `quality === "sufficient"`.
+* @param track - The loaded session track.
+* @param names - Required agent names — ALL must match to return true.
+* @param windowMs - Freshness window (ms), anchored on each entry's `ts`.
+* @param now - Current epoch ms.
+* @returns True when every required name has fresh, sufficient evidence.
+*/
+function agentsFreshInTrack(track, names, windowMs, now) {
+	const found = /* @__PURE__ */ new Set();
+	for (let i = track.agents.length - 1; i >= 0; i--) {
+		const entry = track.agents[i];
+		if (!entry) continue;
+		if (now - entry.ts > windowMs) break;
+		if (entry.quality !== "sufficient") continue;
+		for (const req of names) if (entry.name.includes(req)) found.add(req);
+		if (found.size === names.length) return true;
+	}
+	return names.every((n) => found.has(n));
+}
+//#endregion
+//#region src/freshness/evidence-harvest.ts
+/**
+* Retroactive evidence harvest at SubagentStop. Parses a completed sub-agent's
+* OWN transcript (`agent_transcript_path`) and backfills the session track with
+* the research/explore tool_use it performed (→ `agents`) and the `.md` reference
+* files it read (→ `refsReadAt`). Per LESSON.md + issues #43612/#27655/#34692,
+* sidechain PostToolUse hooks are NOT guaranteed to fire, so live in-session
+* crediting is only opportunistic; SubagentStop is dispatched by the main session
+* (reliable), and its transcript is the durable anchor this harvest reads.
+*
+* QUALITY: harvested agent evidence is credited `sufficient`. The freshness reader
+* (`agentsFreshInTrack`) ignores `insufficient` entries, so anything less would
+* make the harvest inert. This is sound: the platform-authored transcript proves
+* the tool genuinely ran to completion in a finished sub-agent — a STRONGER
+* guarantee than the live path's response-size heuristic (an anti-gaming measure
+* for the self-recorded track, which the transcript's provenance supersedes).
+*/
+/** Dedup tolerance (ms) against evidence a live sidechain hook may already hold. */
+const DEDUP_MS = 2e3;
+/** True when an `agents` entry with `name` already sits within ±{@link DEDUP_MS} of `ts`. */
+function agentAlreadyRecorded(track, name, ts) {
+	return track.agents.some((a) => a.name === name && Math.abs(a.ts - ts) <= DEDUP_MS);
+}
+/**
+* Fold one transcript tool_use into the track (immutably): credit classified
+* research/explore evidence to `agents` (deduped, forced `sufficient`) and any
+* `.md` Read to `refsReadAt` (never restamping a MORE-recent existing read).
+* Returns the same reference when the call contributes nothing.
+*/
+function applyToolUse(track, u, fallbackNow) {
+	const ts = u.ts ?? fallbackNow;
+	let next = track;
+	const ev = classifyAgentEvidence(u.name, u.input, void 0);
+	if (ev && !agentAlreadyRecorded(next, ev.name, ts)) next = recordAgent(next, ev.name, ts, "sufficient");
+	if (u.name === "Read") {
+		const path = String(u.input?.file_path ?? u.input?.path ?? "");
+		const prev = next.refsReadAt?.[path];
+		if (path.endsWith(".md") && (prev === void 0 || prev < ts)) next = recordRefRead(next, path, ts);
+	}
+	return next;
+}
+/**
+* Backfill `track` from the sub-agent transcript at `transcriptPath`. PURE: the
+* caller owns load/save. Fail-open — an absent or unreadable transcript returns
+* `track` UNCHANGED (same reference), never throwing.
+* @param transcriptPath - Sub-agent's own `.jsonl` (SubagentStop `agent_transcript_path`).
+* @param track - The current session track.
+* @param now - Fallback epoch-ms for tool_uses the platform left unstamped.
+* @returns The backfilled track, or `track` itself when nothing was harvested.
+*/
+function harvestAgentEvidence(transcriptPath, track, now) {
+	const uses = readAgentToolUses(transcriptPath);
+	if (uses === null) return track;
+	return uses.reduce((acc, u) => applyToolUse(acc, u, now), track);
+}
+//#endregion
+//#region src/freshness/evidence-harvest-io.ts
+/**
+* SubagentStop wiring for {@link harvestAgentEvidence}. The core SubagentStop
+* dispatch (`runtime/lifecycle/dispatch.ts`) is SYNCHRONOUS and runs in a
+* short-lived hook process, so this does SYNC track I/O (load → harvest → save)
+* rather than the async `loadTrack`/`saveTrack`: a floating async write could be
+* dropped before the process exits. Mirrors the sync read precedent in
+* `policy/design/skill-evidence.ts` and the exact save body of `tracking/store.ts`
+* (`signTrack` → atomic write → `writeLastNonce`) — kept sync on purpose here.
+*/
+/** Load the current track synchronously; `emptyTrack()` when absent/corrupt (fail-closed read). */
+function loadTrackSync(file) {
+	try {
+		return verifyTrack(JSON.parse(readFileSync(file, "utf8"))) ?? emptyTrack();
+	} catch {
+		return emptyTrack();
+	}
+}
+/**
+* Harvest the finishing sub-agent's transcript into its session track. Runs for
+* EVERY agent type (unlike the sniper reminder, which skips research/explore) —
+* those are exactly the agents whose research/explore evidence we want to credit.
+* Fully fail-open: a missing `agent_transcript_path`, an unreadable transcript, or
+* a write error leaves the track untouched and never throws out of the hook.
+* @param payload - The raw SubagentStop hook payload.
+* @param cwd - Project root (selects the per-project state dir).
+* @param now - Fallback epoch-ms for unstamped transcript tool_uses.
+* @param baseDir - Override the track base dir (tests); defaults to the project state dir.
+*/
+function harvestSubagentTrack(payload, cwd, now, baseDir = defaultStateDir(cwd)) {
+	const transcriptPath = typeof payload.agent_transcript_path === "string" ? payload.agent_transcript_path : void 0;
+	if (!transcriptPath) return;
+	const file = trackFile(typeof payload.session_id === "string" ? payload.session_id : "unknown", baseDir);
+	const track = loadTrackSync(file);
+	const next = harvestAgentEvidence(transcriptPath, track, now);
+	if (next === track) return;
+	try {
+		const envelope = signTrack(next);
+		atomicWrite(file, JSON.stringify(envelope, null, 2));
+		writeLastNonce(envelope.nonce);
+	} catch {}
 }
 //#endregion
 //#region src/runtime/lifecycle/task-completed.ts
@@ -1286,6 +1693,30 @@ const CODE_EXTENSIONS$2 = /* @__PURE__ */ new Set([
 	".svelte",
 	".astro"
 ]);
+/** Freshness multiple on `FUSE_ENFORCE_TTL_SEC` for receipts (no new env var); a tsc+test run precedes the "done" by more than one edit window. */
+const RECEIPT_TTL_MULTIPLIER = 5;
+/** The modified files that are code (by extension) — the receipt gate's trigger set. */
+function codeFiles(files) {
+	return files.filter((fp) => CODE_EXTENSIONS$2.has(extname(fp)));
+}
+/**
+* Refuse completion when code files changed but no fresh, passing verification
+* receipt (`tsc`/test, exit 0, zero failures, within TTL×{@link RECEIPT_TTL_MULTIPLIER})
+* exists in the signed track. TaskCompleted does NOT honor `decision:"block"`
+* (verified against the official hooks docs — `TeammateIdle/TaskCreated/
+* TaskCompleted` are excluded from that list); the documented stdout refusal is
+* `{"continue":false,"stopReason":…}`, which halts the teammate with the reason
+* shown to the user. Returns that JSON, or `null` when the session is clear.
+*/
+function receiptGate(sid, files, now, stateDir) {
+	if (codeFiles(files).length === 0) return null;
+	const windowMs = resolveTtlSec(process.env) * 1e3 * RECEIPT_TTL_MULTIPLIER;
+	if (freshReceiptFromFile(trackFile(sid, stateDir), windowMs, now)) return null;
+	return JSON.stringify({
+		continue: false,
+		stopReason: "VERIFICATION RECEIPT REQUIRED: code files changed but no fresh passing tsc/test receipt exists. Run `bun test` + `tsc --noEmit` (exit 0, 0 failures) and re-complete."
+	});
+}
 /**
 * Re-count physical lines of every modified code file and collect SOLID
 * violations (`<basename>: <n> lines (max <max>)`) for those exceeding `max`.
@@ -1305,21 +1736,24 @@ function collectViolations(files, max) {
 	return violations;
 }
 /**
-* Handle TaskCompleted: re-measure the session's modified code files and emit a
-* `SOLID VIOLATION` additionalContext listing any file over the line ceiling.
-* Ports `task-completed/validate-task-solid.py`.
-* @param payload - The TaskCompleted hook payload (`task_id`, `task_subject`, `session_id`).
+* Handle TaskCompleted (ports `task-completed/validate-task-solid.py`, plus the
+* receipt gate). SOLID violations surface first as `SOLID VIOLATION`
+* additionalContext; once the files comply, {@link receiptGate} refuses a "done"
+* that has no fresh passing tsc/test receipt.
+* @param payload - The TaskCompleted payload (`task_id`, `task_subject`, `session_id`).
 * @param home - Home dir (defaults to `~`).
-* @returns The native hook stdout, or `""` when there are no violations.
+* @param now - Clock (defaults to `Date.now()`).
+* @param stateDir - Track base dir (defaults to the cwd-derived state dir; matches `handleHook`).
+* @returns The native hook stdout, or `""` when the session is clean.
 */
-function validateTaskSolid(payload, home = homedir()) {
+function validateTaskSolid(payload, home = homedir(), now = Date.now(), stateDir = defaultStateDir(process.cwd())) {
 	const sid = sanitizeSessionId(payload.session_id ?? "unknown");
 	if (!sid) return "";
 	const files = loadSessionState(sid, home).changes?.modifiedFiles ?? [];
 	if (files.length === 0) return "";
 	const max = resolveMaxLines();
 	const violations = collectViolations(files, max);
-	if (violations.length === 0) return "";
+	if (violations.length === 0) return receiptGate(sid, files, now, stateDir) ?? "";
 	const taskId = String(payload.task_id ?? "");
 	return contextResponse("TaskCompleted", `SOLID VIOLATION in task '${String(payload.task_subject ?? "")}' (${taskId}): ${violations.length} file(s) exceed ${max} lines: ` + violations.slice(0, 5).join("; "));
 }
@@ -3180,7 +3614,10 @@ function dispatchLifecycle(input) {
 			if (input.scope === "lessons") return dispatchLessons("SubagentStart", input.payload, input.cwd, input.now);
 			return subagentCacheContext(input.payload.session_id);
 		case "Stop": return input.scope === "lessons" ? dispatchLessons("Stop", input.payload, input.cwd, input.now) : null;
-		case "SubagentStop": return input.scope === "aipilot" ? "" : trackAgentMemory(input.payload, void 0, input.now);
+		case "SubagentStop":
+			if (input.scope === "aipilot") return "";
+			harvestSubagentTrack(input.payload, input.cwd, input.now);
+			return trackAgentMemory(input.payload, void 0, input.now);
 		case "TeammateIdle": return validateTeammateOutput(input.payload);
 		case "PostToolUseFailure":
 			logToolFailure(input.payload, void 0, input.now);
@@ -4412,101 +4849,6 @@ function geminiMcpGate(tool, filePath, content, ev) {
 	};
 }
 //#endregion
-//#region src/freshness/explore-tools.ts
-/** Native exploration tools (parity `apex_constants.EXPLORE_TOOLS`). */
-const EXPLORE_TOOLS = /* @__PURE__ */ new Set(["Glob", "Grep"]);
-/**
-* Research tools — MCP docs + web (parity `apex_constants.RESEARCH_TOOLS`).
-* The fuse-browser fast-path entries are a deliberate TS addition: CLAUDE.md
-* mandates fuse-browser FIRST for web research, and `docSourceOf` (activity.ts)
-* already credits it for doc consultation — without them here, an agent
-* following the rules would never satisfy the freshness gate (same
-* cross-consumer inconsistency class as the solidReadGate lesson).
-*/
-const RESEARCH_TOOLS = /* @__PURE__ */ new Set([
-	"mcp__context7__query-docs",
-	"mcp__context7__resolve-library-id",
-	"mcp__exa__web_search_exa",
-	"mcp__exa__get_code_context_exa",
-	"mcp__exa__deep_researcher_start",
-	"WebSearch",
-	"WebFetch",
-	"mcp__fuse-browser__browser_fetch",
-	"mcp__fuse-browser__browser_fetch_batch",
-	"mcp__fuse-browser__browser_crawl",
-	"mcp__fuse-browser__browser_serp_batch"
-]);
-/** Bash executables that count as exploration (parity `EXPLORE_BASH_CMDS`). */
-const EXPLORE_BASH_CMDS = /* @__PURE__ */ new Set([
-	"grep",
-	"rg",
-	"find",
-	"ls",
-	"fd",
-	"ast-grep",
-	"tree",
-	"cat",
-	"head",
-	"tail"
-]);
-/** Legacy Python cache names still credited (parity `CACHE_READ_RE` + doc-helpers). */
-const CACHE_READ_RE = /\/context\/mcp\/(exa-search|exa-code-context|context7)-/;
-/**
-* Real TS cache stores: `<root>/.harness/cache/<fnv16>.md` (core MCP store,
-* `projectLayout().cacheDir`) and `~/.fuse-harness/cache/**` (ai-pilot doc
-* caches, `cache-base.cacheBaseDir`). Segment-matched — not resolved against
-* `homedir()` — so tilde-prefixed and absolute paths both hit; the `.md`
-* suffix keeps session-state JSON reads from counting as research.
-*/
-const TS_CACHE_READ_RE = /\.(?:fuse-)?harness[\\/]cache[\\/].*\.md$/;
-/**
-* First non-assignment shell token's basename, or "" — mirrors Python
-* `_bash_executable` (skips leading `VAR=value` env prefixes, e.g. `FOO=1 grep`).
-* @param cmd - Raw Bash `command` string.
-* @returns The executable basename, or "" when none.
-*/
-function bashExecutable(cmd) {
-	for (const token of cmd.trim().split(/\s+/)) {
-		if (!token) continue;
-		const last = token.split("/").pop() ?? token;
-		if (!last.includes("=")) return last;
-	}
-	return "";
-}
-/**
-* Classify a direct tool use into an APEX phase, or `null` when it is neither
-* exploration nor research. Mirrors Python `track-subagent-research._classify`.
-* @param tool - Harness tool name (e.g. "Glob", "Bash", "WebSearch").
-* @param input - Tool input payload.
-* @returns The credited phase + cache flag, or `null`.
-*/
-function classifyExplore(tool, input) {
-	if (RESEARCH_TOOLS.has(tool)) return {
-		phase: "research-expert",
-		cacheHit: false
-	};
-	if (EXPLORE_TOOLS.has(tool)) return {
-		phase: "explore-codebase",
-		cacheHit: false
-	};
-	if (tool === "Read") {
-		const path = String(input?.file_path ?? input?.path ?? "");
-		if (path && (CACHE_READ_RE.test(path) || TS_CACHE_READ_RE.test(path))) return {
-			phase: "research-expert",
-			cacheHit: true
-		};
-		return null;
-	}
-	if (tool === "Bash") {
-		const cmd = String(input?.command ?? "").trim();
-		if (EXPLORE_BASH_CMDS.has(bashExecutable(cmd))) return {
-			phase: "explore-codebase",
-			cacheHit: false
-		};
-	}
-	return null;
-}
-//#endregion
 //#region src/freshness/agent-evidence.ts
 /**
 * Platform-authored transcript evidence for APEX agent freshness.
@@ -4582,96 +4924,6 @@ function agentsRanFromTranscript(transcriptPath, names, windowMs, now) {
 	return names.every((n) => found.has(n));
 }
 //#endregion
-//#region src/freshness/agent-evidence-record.ts
-/**
-* Session-track agent evidence — writer (parity track-subagent-research.py) +
-* reader scan (parity apex_agent_helpers._scan_agents). Sub-agent hooks fire
-* with the LEAD's `session_id`, so evidence recorded here lands in the ONE
-* session track the freshness gate scans FIRST — sidechain research and
-* Workflow-spawned agents count, unlike the lead-transcript scan.
-*/
-/** Tools the existing Task tracking already credits as agent LAUNCHES. */
-const AGENT_LAUNCH_TOOLS = /* @__PURE__ */ new Set(["Task", "Agent"]);
-/**
-* `JSON.stringify` length of the raw `tool_response` OBJECT (parity Python
-* `len(str(tool_response))`); 0 when absent or unserializable (circular).
-*/
-function responseJsonLength(toolResponse) {
-	if (toolResponse === void 0 || toolResponse === null) return 0;
-	try {
-		return (JSON.stringify(toolResponse) ?? "").length;
-	} catch {
-		return 0;
-	}
-}
-/**
-* Classify one PostToolUse call into session evidence, or null when it is
-* neither exploration nor research (parity track-subagent-research._classify,
-* reusing the shared {@link classifyExplore} tables — research/explore/Bash/
-* cache-read). ANTI-DOUBLE-COUNT: calls classified as agent launches
-* (`Task`/`Agent`) are skipped — the existing Task tracking credits those; the
-* criterion is the CALL's classification, never its provenance (lead vs sub).
-* @param tool - Harness tool name (e.g. "Glob", "Bash", "Read").
-* @param input - Raw tool input payload.
-* @param toolResponse - Raw `tool_response` OBJECT from the hook payload.
-* @returns The evidence to record, or null to skip.
-*/
-function classifyAgentEvidence(tool, input, toolResponse) {
-	if (AGENT_LAUNCH_TOOLS.has(tool)) return null;
-	const hit = classifyExplore(tool, input);
-	if (!hit) return null;
-	return {
-		name: hit.phase === "explore-codebase" ? "subagent-explore-codebase" : "subagent-research-expert",
-		quality: hit.cacheHit || responseJsonLength(toolResponse) > 50 ? "sufficient" : "insufficient"
-	};
-}
-/**
-* Persist evidence into the SESSION track via {@link recordAgent} — keyed by
-* `session_id` alone (sub-agent hooks carry the lead's `session_id`); the TTL
-* anchors on `ts`, the tool call's own timestamp. `agentId` is tagged as
-* metadata when present, NEVER used as a condition (unreliable field —
-* anthropics/claude-code#22348).
-* @param file - Session track file path.
-* @param evidence - Classified evidence from {@link classifyAgentEvidence}.
-* @param ts - Epoch-ms timestamp of the tool call (the hook event's `now`).
-* @param agentId - Optional Claude `agent_id` — metadata tag only.
-*/
-async function recordAgentEvidence(file, evidence, ts, agentId) {
-	const next = recordAgent(await loadTrack(file), evidence.name, ts, evidence.quality);
-	const last = next.agents[next.agents.length - 1];
-	if (agentId && last) {
-		const tagged = {
-			...last,
-			agentId
-		};
-		next.agents[next.agents.length - 1] = tagged;
-	}
-	await saveTrack(file, next);
-}
-/**
-* Parity `_scan_agents` (apex_agent_helpers.py): reverse-scan `track.agents`,
-* STOPPING at the first entry older than `windowMs` (entries append in time
-* order), matching each required name by SUBSTRING (`research-expert` matches
-* `subagent-research-expert`) and counting ONLY `quality === "sufficient"`.
-* @param track - The loaded session track.
-* @param names - Required agent names — ALL must match to return true.
-* @param windowMs - Freshness window (ms), anchored on each entry's `ts`.
-* @param now - Current epoch ms.
-* @returns True when every required name has fresh, sufficient evidence.
-*/
-function agentsFreshInTrack(track, names, windowMs, now) {
-	const found = /* @__PURE__ */ new Set();
-	for (let i = track.agents.length - 1; i >= 0; i--) {
-		const entry = track.agents[i];
-		if (!entry) continue;
-		if (now - entry.ts > windowMs) break;
-		if (entry.quality !== "sufficient") continue;
-		for (const req of names) if (entry.name.includes(req)) found.add(req);
-		if (found.size === names.length) return true;
-	}
-	return names.every((n) => found.has(n));
-}
-//#endregion
 //#region src/runtime/gate-apex.ts
 /**
 * The APEX-scoped portion of {@link gate}, in the Python enforce-apex-phases.ts
@@ -4732,24 +4984,177 @@ async function apexScopedGate(input, track, window) {
 	}
 }
 //#endregion
+//#region src/policy/deny-loop.ts
+/**
+* @module deny-loop
+* Pure anti-loop logic: hash a tool-call, decide if it repeats a prior deny, and
+* enrich the repeated block's message.
+*
+* The proprietary rule "NEVER propose the same fix twice" is prose a model under
+* pressure ignores. This makes it machine-enforced: when a call whose
+* `(tool + normalized input)` hash was ALREADY denied in-window is retried, the
+* harness keeps the deny but rewrites the message — `[REPEAT]` title, STOP
+* prefix, forced `research-expert` action. State + wiring live in the sidecar
+* store ({@link module:deny-loop-store}); this file is IO-free and pure.
+* @packageDocumentation
+*/
+/** Stable JSON: keys sorted at every depth so `{a,b}` and `{b,a}` hash identically. */
+function stableStringify(v) {
+	if (v === null || typeof v !== "object") return JSON.stringify(v) ?? "null";
+	if (Array.isArray(v)) return `[${v.map(stableStringify).join(",")}]`;
+	const o = v;
+	return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(o[k])}`).join(",")}}`;
+}
+/**
+* Stable identity hash of a tool-call = tool name + normalized (key-sorted) input,
+* so re-ordered keys never mask a repeat.
+* @param tool - Tool name (e.g. "Write", "Bash").
+* @param input - Identifying tool input (filePath/content/command...).
+* @returns 8-char hex hash.
+*/
+function denyHash(tool, input) {
+	return hashText(`${tool}\n${stableStringify(input)}`);
+}
+/**
+* Pure loop check: given the already-pruned in-window map, compute the running
+* count for `hash` and whether it repeats (count > 1). No IO — the caller persists.
+* @param hash - {@link denyHash} of the current call.
+* @param priorDenies - The `{ hash -> DenyEntry }` map, pruned to `now`/`windowMs`.
+* @param opts - Clock + window.
+* @returns `{ isRepeat, count, hash }`.
+*/
+function denyLoopCheck(hash, priorDenies, opts) {
+	const prev = priorDenies[hash];
+	const count = (prev && typeof prev.lastTs === "number" && opts.now - prev.lastTs < opts.windowMs ? prev.count : 0) + 1;
+	return {
+		isRepeat: count > 1,
+		count,
+		hash
+	};
+}
+/**
+* Enrich a REPEATED block prompt — a NEW object, never a mutation (the input may
+* be a shared const like FAIL_CLOSED). The decision stays `block`; only the
+* message changes, so every harness renders it through the same adapter.
+* @param prompt - The original block prompt.
+* @param count - The running identical-deny count (n).
+* @returns A block prompt with `[REPEAT]` title, STOP-prefixed reason, forced research action.
+*/
+function enrichRepeatDeny(prompt, count) {
+	const stop = `Tentative identique n°${count} déjà refusée pour la même raison. STOP: ne retente pas ce même appel. `;
+	const action = "Launch fuse-ai-pilot:research-expert to find a DIFFERENT approach";
+	return {
+		...prompt,
+		title: prompt.title.startsWith("[REPEAT]") ? prompt.title : `[REPEAT] ${prompt.title}`,
+		reason: stop + prompt.reason,
+		actions: [action, ...prompt.actions ?? []]
+	};
+}
+//#endregion
+//#region src/runtime/deny-loop-store.ts
+/**
+* @module deny-loop-store
+* Sidecar state + gate wiring for the mechanical anti-loop ({@link module:deny-loop}).
+*
+* STATE — a standalone sidecar (`deny-loop.json`) in the same per-project state
+* dir as the session track, NOT a field in `session-state.ts`: that file is owned
+* by another concern this batch, so a shared field would couple two owners and
+* contend on one file for two unrelated maps. This mirrors the proven
+* {@link module:inject-dedup} `oncePerWindow` sidecar (atomicWrite, prune-by-window,
+* fail-open) and keeps the anti-loop self-contained.
+*
+* WINDOW — the hash expires with the same freshness window the gate already uses
+* (`FUSE_ENFORCE_TTL_SEC` / `windowMs`): a loop is a burst, not a lifetime, so a
+* stale deny past the window resets and a later identical call is a fresh #1.
+* @packageDocumentation
+*/
+/** Sidecar basename under the per-project state dir. */
+const SIDECAR = "deny-loop.json";
+/** Load the `{ hash -> DenyEntry }` map, or `{}` when missing/corrupt. */
+function loadMap(path) {
+	try {
+		if (!existsSync(path)) return {};
+		const data = JSON.parse(readFileSync(path, "utf8"));
+		return data && typeof data === "object" && !Array.isArray(data) ? data : {};
+	} catch {
+		return {};
+	}
+}
+/** Drop entries whose last deny is older than the window (bounds size + resets stale loops). */
+function prune(map, now, windowMs) {
+	const out = {};
+	for (const [k, e] of Object.entries(map)) if (e && typeof e.lastTs === "number" && now - e.lastTs < windowMs) out[k] = e;
+	return out;
+}
+/**
+* Record a deny for `(tool, input)`: prune, {@link denyLoopCheck}, persist the
+* bumped entry. Fails open (`isRepeat:false`) when the sidecar is unwritable — a
+* broken state dir must never manufacture a false `[REPEAT]`.
+* @param tool - Tool name.
+* @param input - Identifying tool input.
+* @param opts - Clock + state dir + window.
+* @returns `{ isRepeat, count, hash }`.
+*/
+function recordDeny(tool, input, opts) {
+	const hash = denyHash(tool, input);
+	const path = join(opts.dir, SIDECAR);
+	const map = prune(loadMap(path), opts.now, opts.windowMs);
+	const res = denyLoopCheck(hash, map, opts);
+	map[hash] = {
+		count: res.count,
+		lastTs: opts.now
+	};
+	try {
+		atomicWrite(path, JSON.stringify(map));
+	} catch {}
+	return res;
+}
+/**
+* Gate tail: record every block deny; on a repeat, return the enriched prompt.
+* Allows (`null`) and non-block prompts (`ask`/`inform`) pass through untouched —
+* a loop is a retried REFUSAL, and only `block` is a refusal. The decision is
+* NEVER changed; only a repeated block's message is rewritten.
+* @param prompt - The gate's outcome.
+* @param tool - Tool name.
+* @param input - Identifying tool input.
+* @param opts - Clock + state dir + window.
+* @returns The prompt, enriched only when it is a repeated block.
+*/
+function withDenyLoop(prompt, tool, input, opts) {
+	if (!prompt || prompt.kind !== "block") return prompt;
+	const { isRepeat, count } = recordDeny(tool, input, opts);
+	return isRepeat ? enrichRepeatDeny(prompt, count) : prompt;
+}
+//#endregion
 //#region src/runtime/gate.ts
 /** Prior agents the freshness gate requires before a code edit. */
 const REQUIRED_AGENTS = ["explore-codebase", "research-expert"];
 /**
-* Default freshness window for {@link REQUIRED_AGENTS}, in ms. Matches the
-* plugin's `FUSE_ENFORCE_TTL_SEC` default (120s). Only a fallback for direct
-* programmatic callers that omit `windowMs` (e.g. tests) — the real CLI path
-* always supplies `windowMs` from `resolveTtlSec()` (`src/config/ttl.ts`).
+* Default freshness window (ms). Matches the plugin's `FUSE_ENFORCE_TTL_SEC`
+* default (120s); only a fallback for callers that omit `windowMs` (e.g. tests) —
+* the real CLI path always supplies it from `resolveTtlSec()` (`src/config/ttl.ts`).
 */
 const DEFAULT_WINDOW_MS = 12e4;
 /** Trivial edits allowed within the window before the full APEX gates apply. */
 const TRIVIAL_BUDGET = 4;
 /**
-* Full gate: the stateless guards (file-size, git, security...) first, then a
-* trivial-edit fast path, then the stateful APEX gates fed from the session
-* track. Returns the first blocking prompt, or null to allow.
+* Full gate: {@link runGates} yields the first blocking prompt (or null); the
+* anti-loop tail ({@link withDenyLoop}) rewrites an identical retried deny's
+* message (decision unchanged). Sidecar dir = the track's dir (tests off `$HOME`).
 */
 async function gate(input) {
+	return withDenyLoop(await runGates(input), input.tool, {
+		filePath: input.filePath,
+		content: input.content,
+		command: input.command
+	}, {
+		now: input.now,
+		dir: dirname(input.trackFile),
+		windowMs: input.windowMs ?? 12e4
+	});
+}
+/** Stateless guards, then the trivial fast path, then the stateful APEX gates. */
+async function runGates(input) {
 	const precommit = preCommitGate(input.tool, input.command, input.cwd);
 	if (precommit) return precommit;
 	const protectedDeny = protectedPathGate(input.tool, input.filePath);
@@ -5868,6 +6273,12 @@ async function handlePost(ctx) {
 	for (const activity of activities) await recordActivity(file, activity);
 	const evidence = classifyAgentEvidence(event.tool, event.input, response);
 	if (evidence) await recordAgentEvidence(file, evidence, opts.now, typeof payload.agent_id === "string" ? payload.agent_id : void 0);
+	if (event.tool === "Bash" && event.command) {
+		const r = payload.tool_result ?? response;
+		const out = `${typeof r?.stdout === "string" ? r.stdout : ""}\n${typeof r?.stderr === "string" ? r.stderr : ""}`;
+		const exit = Number(r?.exit_code ?? 0);
+		await captureReceipt(file, event.command, out, Number.isFinite(exit) ? exit : 0, opts.now);
+	}
 	postTrackingSideEffects(opts.scope ?? "core", event, event.input, opts.now, payload, opts.cwd);
 	const seoDeny = opts.scope === "seo" ? seoPostToolUseResponse(payload) : null;
 	if (seoDeny) return {

package/dist/runtime/index.d.mts

@@ -1,6 +1,6 @@
 import { t as Prompt } from "../types-DVbIl9md.mjs";
 import { t as RefMeta } from "../types-CY5qT2X1.mjs";
-import { t as AgentQuality } from "../session-state-DMpotbRz.mjs";
+import { t as AgentQuality } from "../session-state-CY4iohn_.mjs";
 
 //#region src/runtime/paths.d.ts
 /**
@@ -108,18 +108,17 @@ interface GateInput {
 /** Prior agents the freshness gate requires before a code edit. */
 declare const REQUIRED_AGENTS: ReadonlyArray<string>;
 /**
-* Default freshness window for {@link REQUIRED_AGENTS}, in ms. Matches the
-* plugin's `FUSE_ENFORCE_TTL_SEC` default (120s). Only a fallback for direct
-* programmatic callers that omit `windowMs` (e.g. tests) — the real CLI path
-* always supplies `windowMs` from `resolveTtlSec()` (`src/config/ttl.ts`).
+* Default freshness window (ms). Matches the plugin's `FUSE_ENFORCE_TTL_SEC`
+* default (120s); only a fallback for callers that omit `windowMs` (e.g. tests) —
+* the real CLI path always supplies it from `resolveTtlSec()` (`src/config/ttl.ts`).
 */
 declare const DEFAULT_WINDOW_MS = 12e4;
 /** Trivial edits allowed within the window before the full APEX gates apply. */
 declare const TRIVIAL_BUDGET = 4;
 /**
-* Full gate: the stateless guards (file-size, git, security...) first, then a
-* trivial-edit fast path, then the stateful APEX gates fed from the session
-* track. Returns the first blocking prompt, or null to allow.
+* Full gate: {@link runGates} yields the first blocking prompt (or null); the
+* anti-loop tail ({@link withDenyLoop}) rewrites an identical retried deny's
+* message (decision unchanged). Sidecar dir = the track's dir (tests off `$HOME`).
 */
 declare function gate(input: GateInput): Promise<Prompt | null>;
 //#endregion

package/dist/runtime/index.mjs

@@ -1,6 +1,6 @@
 import { r as projectLayout } from "../layout-C0jaaCQC.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, i as loadSessionState, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, s as sessionStatePath, t as claudeHome } from "../home-state-D0RLWP8J.mjs";
-import { $ as saveApexState, A as trackSkillRead, At as saveSecurityState, B as writePluginMap, C as seoPostToolUse, Ct as taskContext, D as postTrackingSideEffects, Dt as normalizeEvent, E as securityAdvisory, Et as trackFile, F as dispatchLessons, G as mergeLines, H as isProject, I as lessonsFileFor, J as listChildren, K as countFiles, L as lessonsStateFileFor, M as dispatchLifecycle, Mt as securityStatePath, N as aipilotPostToolUse, Nt as todayUtc, O as trackWatchResearch, Ot as isoUtc, P as dispatchAipilot, Q as cleanupSession, R as cartoSessionStart, S as postEditContext, St as promptSubmitContext, T as dispatchMemory, Tt as projectHash, U as writeTree, V as generateProjectMap, W as loadEnriched, X as trackSessionChanges, Y as postEditTypescript, Z as validateRulesLoaded, _ as preCommitGate, _t as trimLogFile, a as recordActivity, at as validateSolidGate, b as extractSymbols, bt as projectContext, c as MCP_TTL_MS, ct as detectSolidProfile, d as isMcpTool, dt as readRules, et as logToolFailure, f as queryOf, ft as runSessionStartCleanups, g as gate, gt as removeOldFiles, h as TRIVIAL_BUDGET, ht as purgeTtlTree, i as respond, it as validateTailwind, j as trackEnrichment, jt as securityStateDir, k as trackMcpResearch, kt as loadSecurityState, l as WEBFETCH_TTL_MS, lt as solidDetectStart, m as REQUIRED_AGENTS, mt as pruneEmptyDirs, n as activityFor, nt as trackAgentMemory, o as mcpPostStore, ot as checkFileSize, p as DEFAULT_WINDOW_MS, pt as sessionStartCore, q as getFileDesc, r as handlePre, rt as subagentCacheContext, s as mcpPreIntercept, st as countLoc, t as handleHook, tt as validateTeammateOutput, u as cacheQueryOf, ut as injectRules, v as detectDuplication, vt as devContext, w as seoPostToolUseResponse, wt as defaultStateDir, x as lifecycleStdout, xt as claudeMdKey, y as dryGate, yt as gitContext, z as generateEcosystemMap } from "../handle-DzPjaPS-.mjs";
+import { $ as saveApexState, A as trackSkillRead, At as saveSecurityState, B as writePluginMap, C as seoPostToolUse, Ct as taskContext, D as postTrackingSideEffects, Dt as normalizeEvent, E as securityAdvisory, Et as trackFile, F as dispatchLessons, G as mergeLines, H as isProject, I as lessonsFileFor, J as listChildren, K as countFiles, L as lessonsStateFileFor, M as dispatchLifecycle, Mt as securityStatePath, N as aipilotPostToolUse, Nt as todayUtc, O as trackWatchResearch, Ot as isoUtc, P as dispatchAipilot, Q as cleanupSession, R as cartoSessionStart, S as postEditContext, St as promptSubmitContext, T as dispatchMemory, Tt as projectHash, U as writeTree, V as generateProjectMap, W as loadEnriched, X as trackSessionChanges, Y as postEditTypescript, Z as validateRulesLoaded, _ as preCommitGate, _t as trimLogFile, a as recordActivity, at as validateSolidGate, b as extractSymbols, bt as projectContext, c as MCP_TTL_MS, ct as detectSolidProfile, d as isMcpTool, dt as readRules, et as logToolFailure, f as queryOf, ft as runSessionStartCleanups, g as gate, gt as removeOldFiles, h as TRIVIAL_BUDGET, ht as purgeTtlTree, i as respond, it as validateTailwind, j as trackEnrichment, jt as securityStateDir, k as trackMcpResearch, kt as loadSecurityState, l as WEBFETCH_TTL_MS, lt as solidDetectStart, m as REQUIRED_AGENTS, mt as pruneEmptyDirs, n as activityFor, nt as trackAgentMemory, o as mcpPostStore, ot as checkFileSize, p as DEFAULT_WINDOW_MS, pt as sessionStartCore, q as getFileDesc, r as handlePre, rt as subagentCacheContext, s as mcpPreIntercept, st as countLoc, t as handleHook, tt as validateTeammateOutput, u as cacheQueryOf, ut as injectRules, v as detectDuplication, vt as devContext, w as seoPostToolUseResponse, wt as defaultStateDir, x as lifecycleStdout, xt as claudeMdKey, y as dryGate, yt as gitContext, z as generateEcosystemMap } from "../handle-QfgfNSh6.mjs";
 //#region src/runtime/storage.ts
 /**
 * The project's single state dir (`<root>/.harness`) — neutral + harness-agnostic,

package/dist/{session-state-DMpotbRz.d.mts → session-state-CY4iohn_.d.mts}

@@ -9,6 +9,21 @@ interface SessionTarget {
   set_at: string;
 }
 //#endregion
+//#region src/tracking/receipts.d.ts
+/**
+* A verification receipt captured at PostToolUse from a Bash verification
+* command. Feeds the TaskCompleted receipt gate: a "done" over modified code
+* files is refused unless a fresh, passing receipt (`exitCode === 0`, `fail === 0`)
+* exists. `pass`/`fail` are parsed only for test runs; `tsc` carries the code alone.
+*/
+interface Receipt {
+  kind: "tsc" | "test";
+  exitCode: number;
+  pass?: number;
+  fail?: number;
+  ts: number;
+}
+//#endregion
 //#region src/tracking/session-state.d.ts
 /** Quality of a recorded agent call (the freshness gate ignores insufficient ones). */
 type AgentQuality = "sufficient" | "insufficient";
@@ -34,6 +49,8 @@ interface SessionTrack {
   }[];
   trivialEdits: number[];
   brainstormRequired?: boolean;
+  /** Verification receipts (tsc/test) at PostToolUse; absent/empty reads as unverified in the TaskCompleted gate (backward compat, fail-closed). See {@link Receipt}. */
+  receipts?: Receipt[];
 }
 /** A fresh, empty track. */
 declare function emptyTrack(): SessionTrack;

package/dist/{store-QSSTO3lY.mjs → store-CQ4roWrU.mjs}

@@ -346,4 +346,4 @@ async function saveTrack(file, track) {
 	writeLastNonce(envelope.nonce);
 }
 //#endregion
-export { emptyTrack as a, recordDoc as c, recordTrivialEdit as d, trivialCount as f, agentsFresh as i, recordRefRead as l, saveTrack as n, recordAgent as o, apexAuthorizationGate as p, verifyTrack as r, recordBrainstormRequired as s, loadTrack as t, recordTarget as u };
+export { writeLastNonce as a, recordAgent as c, recordRefRead as d, recordTarget as f, apexAuthorizationGate as h, verifyTrack as i, recordBrainstormRequired as l, trivialCount as m, saveTrack as n, agentsFresh as o, recordTrivialEdit as p, signTrack as r, emptyTrack as s, loadTrack as t, recordDoc as u };

package/dist/tracking/index.d.mts

@@ -1,4 +1,4 @@
-import { a as recordAgent, c as recordRefRead, d as trivialCount, i as emptyTrack, l as recordTarget, n as SessionTrack, o as recordBrainstormRequired, r as agentsFresh, s as recordDoc, t as AgentQuality, u as recordTrivialEdit } from "../session-state-DMpotbRz.mjs";
+import { a as recordAgent, c as recordRefRead, d as trivialCount, i as emptyTrack, l as recordTarget, n as SessionTrack, o as recordBrainstormRequired, r as agentsFresh, s as recordDoc, t as AgentQuality, u as recordTrivialEdit } from "../session-state-CY4iohn_.mjs";
 
 //#region src/tracking/store.d.ts
 /**

package/dist/tracking/index.mjs

@@ -1,2 +1,2 @@
-import { a as emptyTrack, c as recordDoc, d as recordTrivialEdit, f as trivialCount, i as agentsFresh, l as recordRefRead, n as saveTrack, o as recordAgent, s as recordBrainstormRequired, t as loadTrack, u as recordTarget } from "../store-QSSTO3lY.mjs";
+import { c as recordAgent, d as recordRefRead, f as recordTarget, l as recordBrainstormRequired, m as trivialCount, n as saveTrack, o as agentsFresh, p as recordTrivialEdit, s as emptyTrack, t as loadTrack, u as recordDoc } from "../store-CQ4roWrU.mjs";
 export { agentsFresh, emptyTrack, loadTrack, recordAgent, recordBrainstormRequired, recordDoc, recordRefRead, recordTarget, recordTrivialEdit, saveTrack, trivialCount };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusengine/harness",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
   "type": "module",
   "module": "src/index.ts",
@@ -130,6 +130,7 @@
   "sideEffects": false,
   "scripts": {
     "test": "bun test",
+    "sim": "bun test test/sim/",
     "typecheck": "tsc --noEmit",
     "docs:api": "typedoc",
     "build": "tsdown src/index.ts src/config/index.ts src/util/index.ts src/detect/index.ts src/policy/index.ts src/prompt/index.ts src/memory/index.ts src/cache/index.ts src/freshness/index.ts src/refs/index.ts src/statusline/index.ts src/cli/index.ts src/cli/bin.ts src/init/index.ts src/tracking/index.ts src/runtime/index.ts src/adapters/claude/index.ts src/adapters/codex/index.ts src/adapters/cursor/index.ts src/adapters/cline/index.ts src/adapters/gemini/index.ts src/adapters/hermes/index.ts --dts --format esm --clean --out-dir dist",