@fusengine/harness 0.1.79 → 0.1.81

package/dist/{handle-Dthtlp7Z.mjs → handle-J5r2f_O_.mjs}

@@ -1,23 +1,24 @@
-import { a as parseEnvInt, i as splitTarget, r as resolveMaxLines } from "./limits-CHn8AIL1.mjs";
-import { s as resolveTtlSec } from "./dotenv-Jj8aL1FL.mjs";
-import { r as projectLayout } from "./layout-C0jaaCQC.mjs";
+import { a as resolveMaxLines, l as parseEnvInt, s as splitTarget } from "./limits-DG5pl-5s.mjs";
+import { s as resolveTtlSec } from "./dotenv-DoqNlALG.mjs";
+import { r as projectLayout } from "./layout-KWoE_Mqn.mjs";
 import { i as walkUpFor, n as projectRoot, r as projectRootOrNull, t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
-import { B as detectProjectType$1, H as requiredArchSkill, L as detectFramework, n as FAIL_CLOSED, t as evaluate, z as detectModularArchitecture } from "./evaluate-ClfbCDiY.mjs";
-import { a as sanitizeSessionId, c as sessionsDir, d as countFrameworkCodeLines, f as countLines, i as loadSessionState, l as PLUGINS_DIR, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, t as claudeHome } from "./home-state-BXf38Zi1.mjs";
+import { D as isVendorPath, G as isFileSizeScoped, K as resolveSolidRefFramework, W as computeEditResultLines, b as interfaceDeclLevel, et as detectFramework, g as conventionsMode, lt as requiredArchSkill, n as FAIL_CLOSED, ot as detectModularArchitecture, rt as maskCommentsAndStrings, st as detectProjectType$1, t as evaluate } from "./evaluate-B4-MhOy_.mjs";
+import { a as sanitizeSessionId, c as sessionsDir, d as countFrameworkCodeLines, f as countLines, i as loadSessionState, l as PLUGINS_DIR, n as fuseHarnessHome, o as saveSessionState, p as evaluateFileSize, r as fusengineCache, t as claudeHome } from "./home-state-oUGFB4ds.mjs";
 import { a as writeJsonFile, i as readJsonFile, r as hashText, t as atomicWrite } from "./json-io-DisYd2fb.mjs";
 import { r as isDocConsulted } from "./doc-helpers-CWZegVdR.mjs";
-import { A as capVerbosity, C as usesTailwindUtilities, D as isExcludedSwiftPath, E as isExcludedJsPath, I as docConsultedGate, L as evaluateApex, N as POST_AUTH_GATES, P as PRE_AUTH_GATES, S as skillTriggerGate, T as frameworkSolidGate, _ as harnessHomeSegment, b as parseField, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, h as buildClaudeMdContext, j as detectCreationIntent, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, r as descFromText, s as parseEntry, t as isHtmlLike, v as scanPlugin } from "./validate-DhOX5hDK.mjs";
-import { n as findMarketplacePlugins, r as readPluginMeta, t as resolveSkillPath } from "./skill-path-BO2N0XvB.mjs";
+import { D as frameworkSolidGate, F as isExcludedSwiftPath, G as evaluateApex, H as PRE_AUTH_GATES, P as isExcludedJsPath, R as capVerbosity, S as parseField, T as usesTailwindUtilities, V as POST_AUTH_GATES, W as docConsultedGate, b as scanPlugin, c as EXCLUDE_DIRS$1, d as buildApexTaskInjection, g as buildClaudeMdContext, l as PROJECT_INDICATORS, n as missingSeoElements, o as parseEnrichment, p as apexAgentSteps, r as descFromText, s as parseEntry, t as isHtmlLike, v as apexDocName, w as skillTriggerGate, y as harnessHomeSegment, z as detectCreationIntent } from "./validate-Bf-EsbDh.mjs";
+import { n as findMarketplacePlugins, r as readPluginMeta, t as resolveSkillPath } from "./skill-path-DhBGlQe3.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
-import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as setStateField, t as addRoot } from "./registry-CymilZiZ.mjs";
+import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as setStateField, t as addRoot } from "./registry-IhHk2KlT.mjs";
 import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, t as mcpCacheWrite, u as extractText } from "./mcp-store-BkBDmuxN.mjs";
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
-import { a as writeLastNonce, c as recordAgent, d as recordRefRead, f as recordTarget, h as apexAuthorizationGate, i as verifyTrack, l as recordBrainstormRequired, m as trivialCount, n as saveTrack, o as agentsFresh, p as recordTrivialEdit, r as signTrack, s as emptyTrack, t as loadTrack, u as recordDoc } from "./store-Bcn08y9m.mjs";
+import { _ as trivialCount, a as LOCK_TTL_MS, c as writeLastNonce, d as recordAgent, f as recordBrainstormRequired, g as recordTrivialEdit, h as recordTarget, i as LOCK_FAILED, l as agentsFresh, m as recordRefRead, o as signTrack, p as recordDoc, r as withTrack, s as verifyTrack, t as loadTrack, u as emptyTrack, v as apexAuthorizationGate } from "./store-yr_QFsZY.mjs";
 import { n as parseApplyPatch, t as isBypassPermissions } from "./permission-mode-BN3MNgbm.mjs";
-import { _ as writeText, d as collectFiles, f as pathExists, g as spawnCapture, h as sleep, i as denyResponse, l as systemMessage, m as readText, n as blockResponse, r as contextResponse, s as informResponse, t as attachSystemMessage, v as commandToString } from "./claude-51RSspJ1.mjs";
-import { r as toHermesResponse } from "./hermes-rTmVdhUL.mjs";
+import { _ as commandToString, d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText$1, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-D93HY8dq.mjs";
+import { i as toKimiResponse, n as kimiDenyResponse } from "./kimi-ChbcU2uI.mjs";
+import { r as toHermesResponse } from "./hermes-1PUEoY8q.mjs";
 import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
-import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, closeSync, copyFileSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { mkdir, rmdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
@@ -350,6 +351,34 @@ function designLifecycle(payload, cacheDir, cwd, stamp, now) {
 	return false;
 }
 //#endregion
+//#region src/runtime/inform.ts
+/**
+* Lifecycle context-injection renderer. Every emitter that injects text into
+* the model's context (rules, lessons, CLAUDE.md preamble, ...) goes through
+* here instead of calling the Claude builders directly:
+* - kimi: raw text on stdout — Kimi Code CLI appends stdout to the context on
+*   exit 0 (UserPromptSubmit is blockable; the Claude-shaped
+*   `additionalContext` envelope would be ignored or leak as raw JSON text).
+* - every other harness: the historical Claude-shaped envelope, byte-identical
+*   to what the call sites produced before this module existed (zero-regression
+*   default — `attachSystemMessage` concatenates notices with "\n", so a single
+*   combined notice equals the previous chained calls).
+*/
+/**
+* Render a context injection for the firing harness.
+* @param id - Harness id.
+* @param event - The firing hook event name (envelope tag for Claude shapes).
+* @param text - The context body to inject.
+* @param notice - Optional human-facing notice (systemMessage on Claude
+* shapes; appended as plain text for kimi).
+* @returns The native hook stdout.
+*/
+function renderInform(id, event, text, notice) {
+	if (id === "kimi") return notice ? `${text}\n\n${notice}` : text;
+	const base = contextResponse(event, text);
+	return notice ? attachSystemMessage(base, notice) : base;
+}
+//#endregion
 //#region src/runtime/inject-dedup-exclusive.ts
 /**
 * @module inject-dedup-exclusive
@@ -598,7 +627,7 @@ function promptSubmitContext(prompt, cwd, id = "claude-code") {
 	const ctx = buildClaudeMdContext(prompt, cwd, id);
 	if (!ctx) return "";
 	if (!oncePerWindow(claudeMdKey(prompt, ctx), 3e3)) return "";
-	return attachSystemMessage(contextResponse("UserPromptSubmit", ctx), "CLAUDE.md injected");
+	return renderInform(id, "UserPromptSubmit", ctx, `${apexDocName(id)} injected`);
 }
 /**
 * PreToolUse Task context injection: render the APEX sub-agent context as a
@@ -738,9 +767,15 @@ const PURGEABLE = {
 	doc: 48 * 3600,
 	explore: 48 * 3600
 };
-/** Read `~/.claude/CLAUDE.md`, or "" when missing/unreadable. */
-function claudeMd(home) {
-	const path = join(claudeHome(home), "CLAUDE.md");
+/**
+* Read the target's root instructions doc (`~/.claude/CLAUDE.md`,
+* `~/.codex/AGENTS.md`, `~/.kimi-code/AGENTS.md`, ...), or "" when
+* missing/unreadable.
+* @param home - Home dir.
+* @param id - Harness target id (defaults to "claude-code" — zero-regression default).
+*/
+function claudeMd(home, id = "claude-code") {
+	const path = join(home, harnessHomeSegment(id), apexDocName(id));
 	try {
 		return existsSync(path) ? readFileSync(path, "utf-8") : "";
 	} catch {
@@ -765,14 +800,15 @@ function runSessionStartCleanups(home = homedir(), now = Date.now()) {
 * @param cwd - Project root for dev-context detection.
 * @param home - Home dir (defaults to `~`).
 * @param now - Clock for TTL cleanup (defaults to `Date.now()`).
+* @param id - Harness target id (defaults to "claude-code" — zero-regression default).
 * @returns The native hook stdout (possibly empty).
 */
-function sessionStartCore(cwd, home = homedir(), now = Date.now()) {
-	const md = claudeMd(home);
+function sessionStartCore(cwd, home = homedir(), now = Date.now(), id = "claude-code") {
+	const md = claudeMd(home, id);
 	const dev = devContext(cwd);
 	runSessionStartCleanups(home, now);
 	const ctx = [md, dev].filter(Boolean).join("\n");
-	return ctx ? attachSystemMessage(contextResponse("SessionStart", ctx), "CLAUDE.md injected") : "";
+	return ctx ? attachSystemMessage(contextResponse("SessionStart", ctx), `${apexDocName(id)} injected`) : "";
 }
 //#endregion
 //#region src/runtime/lifecycle/inject-rules.ts
@@ -793,17 +829,19 @@ function readRules(rulesDir) {
 }
 /**
 * Build the rules injection for claude-rules (SessionStart, UserPromptSubmit,
-* SubagentStart): read `<pluginRoot>/rules/*.md` and emit as `additionalContext`,
-* or "" when no rules. Tags the output with the *actual* `hookEventName` — the
-* spec requires it to match the firing event (a hardcoded "SessionStart" is
-* non-conforming and may be dropped on UserPromptSubmit/SubagentStart).
+* SubagentStart): read `<pluginRoot>/rules/*.md` and emit via {@link renderInform}
+* (Claude-shaped `additionalContext`, or raw text for kimi). Tags the output
+* with the *actual* `hookEventName` — the spec requires it to match the firing
+* event (a hardcoded "SessionStart" is non-conforming and may be dropped on
+* UserPromptSubmit/SubagentStart).
 * @param pluginRoot - `CLAUDE_PLUGIN_ROOT` of the claude-rules plugin.
 * @param event - The firing hook event name (e.g. "SessionStart").
+* @param id - Harness target id (defaults to "claude-code" — zero-regression default).
 * @returns The native hook stdout (possibly empty).
 */
-function injectRules(pluginRoot, event) {
+function injectRules(pluginRoot, event, id = "claude-code") {
 	const content = readRules(join(pluginRoot, "rules"));
-	return content ? attachSystemMessage(contextResponse(event, content), "rules 00-08 injected") : "";
+	return content ? renderInform(id, event, content, "rules 00-08 injected") : "";
 }
 //#endregion
 //#region src/runtime/lifecycle/solid-detect.ts
@@ -952,7 +990,7 @@ function checkFileSize(tool, filePath, env = process.env) {
 	if (!filePath || !pathExists(filePath)) return "";
 	let content;
 	try {
-		content = readText(filePath);
+		content = readText$1(filePath);
 	} catch {
 		return "";
 	}
@@ -974,20 +1012,32 @@ function checkFileSize(tool, filePath, env = process.env) {
 * gated behind `SOLID_PROJECT_TYPE`. Inert when `SOLID_PROJECT_TYPE` is
 * absent/"unknown"/nextjs/laravel/swift/rust (parity: the Python hook only
 * has a `go`/`python` validator).
+*
+* Detection rides the conventions module (MASKED content, column-0 anchored
+* for Go): the old naive regexes matched inside comments/strings and
+* indented locals — all killed. LEGACY-level detections keep the exact hard
+* deny (byte-parity); EXTENDED-level ones (Go `interface{` without the
+* space, Python `Protocol`) follow `FUSE_CONVENTIONS_MODE` — advisory
+* (non-blocking additionalContext) by default, deny only on `"deny"`
+* (owner Amendment 5, external audit D0.2).
 */
-/** Top-level Go interface declaration, e.g. `type Foo interface {`. */
-const GO_INTERFACE_RE = /^type.*interface \{/m;
-/** Python class whose header mentions `ABC` (naive, parity with the Python regex). */
-const PY_ABC_RE = /class.*ABC/;
 /** Go: deny a top-level interface declared outside `/interfaces/`. */
-function checkGo(filePath, content) {
+function checkGo(filePath, content, env) {
 	if (!filePath.endsWith(".go") || filePath.includes("/interfaces/")) return null;
-	return GO_INTERFACE_RE.test(content) ? "SOLID: Interfaces must be in internal/interfaces/" : null;
+	const level = interfaceDeclLevel(filePath, content);
+	if (level === null) return null;
+	const msg = "SOLID: Interfaces must be in internal/interfaces/";
+	if (level === "legacy" || conventionsMode(env) === "deny") return denyResponse("PreToolUse", msg);
+	return contextResponse("PreToolUse", msg);
 }
 /** Python: deny an ABC subclass declared outside `/interfaces/`. */
-function checkPython(filePath, content) {
+function checkPython(filePath, content, env) {
 	if (!filePath.endsWith(".py") || filePath.includes("/interfaces/")) return null;
-	return PY_ABC_RE.test(content) ? "SOLID: Abstract classes must be in src/interfaces/" : null;
+	const level = interfaceDeclLevel(filePath, content);
+	if (level === null) return null;
+	const msg = "SOLID: Abstract classes must be in src/interfaces/";
+	if (level === "legacy" || conventionsMode(env) === "deny") return denyResponse("PreToolUse", msg);
+	return contextResponse("PreToolUse", msg);
 }
 /** `SOLID_PROJECT_TYPE` values this gate validates (parity subset — see module doc). */
 const VALIDATORS = {
@@ -995,20 +1045,19 @@ const VALIDATORS = {
 	python: checkPython
 };
 /**
-* Deny a Write/Edit that violates the Go/Python interface-location SOLID rule.
+* Deny (or advise on) a Write/Edit that violates the Go/Python interface-location SOLID rule.
 * @param tool - The tool name (only "Write"/"Edit" are checked).
 * @param filePath - The written file's absolute path.
 * @param content - The written/edited content (`new_string` snippet on Edit).
 * @param env - Environment (defaults to `process.env`).
-* @returns The PreToolUse deny response, or `""` when clean/inert.
+* @returns The PreToolUse response, or `""` when clean/inert.
 */
 function validateSolidGate(tool, filePath, content, env = process.env) {
 	const ptype = env.SOLID_PROJECT_TYPE ?? "";
 	if (!ptype || ptype === "unknown") return "";
 	if (tool !== "Write" && tool !== "Edit") return "";
 	if (!filePath) return "";
-	const violation = VALIDATORS[ptype]?.(filePath, content) ?? null;
-	return violation ? denyResponse("PreToolUse", violation) : "";
+	return VALIDATORS[ptype]?.(filePath, content, env) ?? "";
 }
 //#endregion
 //#region src/runtime/lifecycle/validate-tailwind.ts
@@ -1044,7 +1093,7 @@ function isTailwindProject(filePath) {
 	const pkgPath = join(root, "package.json");
 	if (!pathExists(pkgPath)) return false;
 	try {
-		const pkg = JSON.parse(readText(pkgPath));
+		const pkg = JSON.parse(readText$1(pkgPath));
 		return Boolean(pkg.dependencies?.tailwindcss) || Boolean(pkg.devDependencies?.tailwindcss);
 	} catch {
 		return false;
@@ -1062,7 +1111,7 @@ function validateTailwind(tool, filePath) {
 	if (!pathExists(filePath) || !isTailwindProject(filePath)) return "";
 	let content;
 	try {
-		content = readText(filePath);
+		content = readText$1(filePath);
 	} catch {
 		return "";
 	}
@@ -1219,7 +1268,7 @@ function freshReceiptFromFile(file, windowMs, now) {
 async function captureReceipt(file, command, output, exitCode, now) {
 	const receipt = classifyReceipt(command, output, exitCode, now);
 	if (!receipt) return;
-	await saveTrack(file, recordReceipt(await loadTrack(file), receipt));
+	await withTrack(file, (track) => recordReceipt(track, receipt));
 }
 //#endregion
 //#region src/runtime/lifecycle/agent-transcript.ts
@@ -1251,7 +1300,7 @@ function readAgentToolUses(transcriptPath) {
 	if (!transcriptPath) return null;
 	let text;
 	try {
-		text = readText(transcriptPath);
+		text = readText$1(transcriptPath);
 	} catch {
 		return null;
 	}
@@ -1705,6 +1754,102 @@ function postEditTypescript(filePath) {
 	return contextResponse("PostToolUse", `Lint issues in ${basename(filePath)}: ${issues.join(" | ")}`);
 }
 //#endregion
+//#region src/util/semver.ts
+/**
+* Dependency-free semver ordering. `Array.prototype.sort()` compares strings
+* lexicographically — `"1.0.9" > "1.0.23"` — so versioned directories (plugin
+* caches) must be ordered with a numeric, segment-by-segment comparison.
+*/
+/**
+* Compare two dotted version strings numerically, segment by segment
+* (shorter version wins when a prefix is equal: `1.0` < `1.0.1`). A segment
+* that is not a plain integer (prerelease tag like `0-beta`) falls back to
+* lexicographic comparison of that segment — never NaN, so `sort()` stays
+* defined; identical strings compare 0.
+* @returns Negative when `a < b`, positive when `a > b`, 0 when equal.
+*/
+function compareSemver(a, b) {
+	const pa = a.split("."), pb = b.split(".");
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+		const sa = pa[i] ?? "0", sb = pb[i] ?? "0";
+		if (sa === sb) continue;
+		const na = Number(sa), nb = Number(sb);
+		if (Number.isInteger(na) && Number.isInteger(nb) && na !== nb) return na - nb;
+		return sa < sb ? -1 : 1;
+	}
+	return 0;
+}
+/** The highest version of the list, or null when empty. */
+function maxSemver(versions) {
+	return versions.length === 0 ? null : versions.reduce((a, b) => compareSemver(a, b) >= 0 ? a : b);
+}
+//#endregion
+//#region src/runtime/lifecycle/rules-root.ts
+/**
+* Dynamic rules-plugin root resolution. The historical `CLAUDE_PLUGIN_ROOT ??
+* cwd` chain only worked when the harness exported the plugin root — Kimi
+* injects `KIMI_PLUGIN_ROOT` instead, and a bare cwd fallback never held a
+* `rules/` dir. Resolution order (first hit wins):
+* 1. `CLAUDE_PLUGIN_ROOT` (claude-code/codex plugin-declared hooks);
+* 2. `KIMI_PLUGIN_ROOT` (kimi plugin-declared hooks);
+* 3. Per-harness install probe (claude marketplace, codex versioned cache,
+*    kimi managed plugins) — first `<plugin>/rules` dir whose plugin folder
+*    name contains "rules";
+* 4. `cwd` (historical fallback, unchanged behavior).
+*/
+/** Immediate child dir names of `dir`, or [] when unreadable. */
+function children$1(dir) {
+	try {
+		return readdirSync(dir);
+	} catch {
+		return [];
+	}
+}
+/** First existing `<base>/<child>/rules` where `child` names a rules plugin. */
+function probe(base, childFilter) {
+	for (const child of children$1(base).sort()) {
+		if (!childFilter(child)) continue;
+		if (existsSync(join(base, child, "rules"))) return join(base, child);
+	}
+	return null;
+}
+/** Claude: `~/.claude/plugins/marketplaces/<marketplace>/plugins/<rules-plugin>/`. */
+function probeClaude(home) {
+	const markets = join(home, ".claude", "plugins", "marketplaces");
+	for (const m of children$1(markets).sort()) {
+		const hit = probe(join(markets, m, "plugins"), (n) => n.includes("rules"));
+		if (hit) return hit;
+	}
+	return null;
+}
+/** Codex: `~/.codex/plugins/cache/<marketplace>/<rules-plugin>/<version>/` (highest semver). */
+function probeCodex(home) {
+	const cache = join(home, ".codex", "plugins", "cache");
+	for (const m of children$1(cache).sort()) for (const p of children$1(join(cache, m)).sort()) {
+		if (!p.includes("rules")) continue;
+		const latest = maxSemver(children$1(join(cache, m, p)).filter((v) => existsSync(join(cache, m, p, v, "rules"))));
+		if (latest) return join(cache, m, p, latest);
+	}
+	return null;
+}
+/** Kimi: `<KIMI_CODE_HOME>/plugins/managed/<rules-plugin>/` (managed install copy). */
+function probeKimi(env, home) {
+	return probe(join(env.KIMI_CODE_HOME ?? join(home, ".kimi-code"), "plugins", "managed"), (n) => n.includes("rules"));
+}
+/**
+* Resolve the directory whose `rules/` subtree holds the `*.md` rule files.
+* @param id - Harness id (selects the install-layout probe).
+* @param cwd - Historical fallback root.
+* @param env - Environment (defaults to `process.env`).
+* @returns The plugin root to read `rules/` from.
+*/
+function resolveRulesRoot(id, cwd, env = process.env) {
+	if (env.CLAUDE_PLUGIN_ROOT) return env.CLAUDE_PLUGIN_ROOT;
+	if (env.KIMI_PLUGIN_ROOT) return env.KIMI_PLUGIN_ROOT;
+	const home = env.HOME ?? homedir();
+	return (id === "codex" ? probeCodex(home) : id === "kimi" ? probeKimi(env, home) : id === "claude-code" ? probeClaude(home) : null) ?? cwd;
+}
+//#endregion
 //#region src/freshness/explore-tools.ts
 /** Native exploration tools (parity `apex_constants.EXPLORE_TOOLS`). */
 const EXPLORE_TOOLS = /* @__PURE__ */ new Set(["Glob", "Grep"]);
@@ -1724,6 +1869,7 @@ const RESEARCH_TOOLS = /* @__PURE__ */ new Set([
 	"mcp__exa__deep_researcher_start",
 	"WebSearch",
 	"WebFetch",
+	"FetchURL",
 	"mcp__fuse-browser__browser_fetch",
 	"mcp__fuse-browser__browser_fetch_batch",
 	"mcp__fuse-browser__browser_crawl",
@@ -1800,6 +1946,29 @@ function classifyExplore(tool, input) {
 	return null;
 }
 //#endregion
+//#region src/runtime/is-agent-tool.ts
+/**
+* Sub-agent dispatch tool detection — the single source of truth for "this
+* tool call spawns a sub-agent". Claude Code and Codex dispatch via `Task`;
+* Kimi Code CLI dispatches via `Agent` (and `AgentSwarm` for parallel fan-out).
+* Centralized so the APEX task-context injection, the activity tracking and
+* the PostToolUse evidence credit stop drifting on inline `"Task" | "Agent"`
+* unions: every consumer imports from HERE, never re-declares the list.
+*/
+/** Canonical set of sub-agent dispatch tool names (the ONLY definition). */
+const AGENT_TOOLS = /* @__PURE__ */ new Set([
+	"Task",
+	"Agent",
+	"AgentSwarm"
+]);
+/**
+* True when the tool is a sub-agent dispatch primitive on any harness.
+* @param tool - The normalized tool name from the hook payload.
+*/
+function isAgentTool(tool) {
+	return AGENT_TOOLS.has(tool);
+}
+//#endregion
 //#region src/freshness/agent-evidence-record.ts
 /**
 * Session-track agent evidence — writer (parity track-subagent-research.py) +
@@ -1808,8 +1977,6 @@ function classifyExplore(tool, input) {
 * session track the freshness gate scans FIRST — sidechain research and
 * Workflow-spawned agents count, unlike the lead-transcript scan.
 */
-/** Tools the existing Task tracking already credits as agent LAUNCHES. */
-const AGENT_LAUNCH_TOOLS = /* @__PURE__ */ new Set(["Task", "Agent"]);
 /**
 * `JSON.stringify` length of the raw `tool_response` OBJECT (parity Python
 * `len(str(tool_response))`); 0 when absent or unserializable (circular).
@@ -1835,7 +2002,7 @@ function responseJsonLength(toolResponse) {
 * @returns The evidence to record, or null to skip.
 */
 function classifyAgentEvidence(tool, input, toolResponse) {
-	if (AGENT_LAUNCH_TOOLS.has(tool)) return null;
+	if (isAgentTool(tool)) return null;
 	const hit = classifyExplore(tool, input);
 	if (!hit) return null;
 	return {
@@ -1855,16 +2022,18 @@ function classifyAgentEvidence(tool, input, toolResponse) {
 * @param agentId - Optional Claude `agent_id` — metadata tag only.
 */
 async function recordAgentEvidence(file, evidence, ts, agentId) {
-	const next = recordAgent(await loadTrack(file), evidence.name, ts, evidence.quality);
-	const last = next.agents[next.agents.length - 1];
-	if (agentId && last) {
-		const tagged = {
-			...last,
-			agentId
-		};
-		next.agents[next.agents.length - 1] = tagged;
-	}
-	await saveTrack(file, next);
+	await withTrack(file, (track) => {
+		const next = recordAgent(track, evidence.name, ts, evidence.quality);
+		const last = next.agents[next.agents.length - 1];
+		if (agentId && last) {
+			const tagged = {
+				...last,
+				agentId
+			};
+			next.agents[next.agents.length - 1] = tagged;
+		}
+		return next;
+	});
 }
 /**
 * Parity `_scan_agents` (apex_agent_helpers.py): reverse-scan `track.agents`,
@@ -1946,6 +2115,62 @@ function harvestAgentEvidence(transcriptPath, track, now) {
 	return uses.reduce((acc, u) => applyToolUse(acc, u, now), track);
 }
 //#endregion
+//#region src/tracking/track-lock-sync.ts
+/**
+* Synchronous twin of {@link withTrackLock} for lifecycle paths that CANNOT
+* float async work (the SubagentStop dispatch runs synchronously in a
+* short-lived hook process — an async write could be dropped before exit,
+* see `evidence-harvest-io.ts`). Same semantics: `wx` lockfile, bounded total
+* retry, named skipped write on contention, stale reclamation. The wait uses
+* `Atomics.wait` (allowed on the main thread in both Node and Bun).
+*/
+/** Block the thread for `ms` (bounded by the caller's total budget). */
+function sleepSync(ms) {
+	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/** True when the lockfile is older than the TTL (orphaned by a dead process). */
+function isStale(lock) {
+	try {
+		return Date.now() - statSync(lock).mtimeMs > LOCK_TTL_MS;
+	} catch {
+		return false;
+	}
+}
+/**
+* Run `fn` under the track lock of `dir`, synchronously.
+* @param dir - The track state directory (lockfile lives inside).
+* @param fn - The protected read-modify-write.
+* @returns `fn`'s result, or {@link LOCK_FAILED} when the lock stayed busy.
+*/
+function withTrackLockSync(dir, fn) {
+	mkdirSync(dir, { recursive: true });
+	const lock = join(dir, "track.lock");
+	const deadline = Date.now() + 400;
+	for (;;) try {
+		closeSync(openSync(lock, "wx"));
+		break;
+	} catch {
+		if (isStale(lock)) {
+			try {
+				unlinkSync(lock);
+			} catch {}
+			continue;
+		}
+		if (Date.now() >= deadline) {
+			process.stderr.write(`harness: track lock busy, write skipped (${lock})\n`);
+			return LOCK_FAILED;
+		}
+		sleepSync(8);
+	}
+	try {
+		return fn();
+	} finally {
+		try {
+			unlinkSync(lock);
+		} catch {}
+	}
+}
+//#endregion
 //#region src/freshness/evidence-harvest-io.ts
 /**
 * SubagentStop wiring for {@link harvestAgentEvidence}. The core SubagentStop
@@ -1979,14 +2204,16 @@ function harvestSubagentTrack(payload, cwd, now, baseDir = defaultStateDir(cwd))
 	const transcriptPath = typeof payload.agent_transcript_path === "string" ? payload.agent_transcript_path : void 0;
 	if (!transcriptPath) return;
 	const file = trackFile(typeof payload.session_id === "string" ? payload.session_id : "unknown", baseDir);
-	const track = loadTrackSync(file);
-	const next = harvestAgentEvidence(transcriptPath, track, now);
-	if (next === track) return;
-	try {
-		const envelope = signTrack(next);
-		atomicWrite(file, JSON.stringify(envelope, null, 2));
-		writeLastNonce(envelope.nonce);
-	} catch {}
+	if (withTrackLockSync(dirname(file), () => {
+		const track = loadTrackSync(file);
+		const next = harvestAgentEvidence(transcriptPath, track, now);
+		if (next === track) return;
+		try {
+			const envelope = signTrack(next);
+			atomicWrite(file, JSON.stringify(envelope, null, 2));
+			writeLastNonce(envelope.nonce);
+		} catch {}
+	}) === LOCK_FAILED) return;
 }
 //#endregion
 //#region src/cli/doctor.ts
@@ -2540,8 +2767,8 @@ function formatSummary(s) {
 * The proprietary rule "NEVER propose the same fix twice" is prose a model under
 * pressure ignores. This makes it machine-enforced: when a call whose
 * `(tool + normalized input)` hash was ALREADY denied in-window is retried, the
-* harness keeps the deny but rewrites the message — `[REPEAT]` title, STOP
-* prefix, forced `research-expert` action. State + wiring live in the sidecar
+* harness keeps the deny but rewrites the message — `[REPEAT]` title, a
+* mid-sentence STOP warning, forced `research-expert` action. State + wiring live in the sidecar
 * store ({@link module:deny-loop-store}); this file is IO-free and pure.
 * @packageDocumentation
 */
@@ -2606,7 +2833,7 @@ function denyLoopCheck(hash, priorDenies, opts) {
 * @returns A block prompt with `[REPEAT]` title, STOP-prefixed reason, forced research action.
 */
 function enrichRepeatDeny(prompt, count) {
-	const stop = `Identical attempt #${count} already denied for the same reason. STOP: do not retry this same call. `;
+	const stop = `Identical attempt #${count} already denied for the same reason. Do not retry this same call UNCHANGED — if you have since completed the required reads/actions, retry now; otherwise STOP and pick a DIFFERENT approach. `;
 	const action = "Launch fuse-ai-pilot:research-expert to find a DIFFERENT approach";
 	return {
 		...prompt,
@@ -3984,7 +4211,7 @@ function persistCuration(file, root, curated, archive, original) {
 * was this exact block silently reaching ~44k tokens. Any curation report
 * surfaces via systemMessage.
 */
-function injectMemory(cwd, event, now) {
+function injectMemory(cwd, event, now, id) {
 	const root = projectRoot(cwd);
 	const file = lessonsFileFor(root);
 	if (!existsSync(file)) return "";
@@ -3997,8 +4224,7 @@ function injectMemory(cwd, event, now) {
 	if (!content) return "";
 	const { content: curated, archive, report } = curateLessons(content, now, root);
 	if (curated !== content) content = persistCuration(file, root, curated, archive, content);
-	const withNotice = attachSystemMessage(contextResponse(event, `Project lessons — never reproduce these:\n${capFragment("lessons", compressInjection(content))}\nYou may append OR refine/merge/dedupe bullets in MEMORY/LESSON.md — keep it terse.`), "lessons injected");
-	return report ? attachSystemMessage(withNotice, `LESSON.md curation:\n${report}`) : withNotice;
+	return renderInform(id, event, `Project lessons — never reproduce these:\n${capFragment("lessons", compressInjection(content))}\nYou may append OR refine/merge/dedupe bullets in MEMORY/LESSON.md — keep it terse.`, report ? `lessons injected\nLESSON.md curation:\n${report}` : "lessons injected");
 }
 /**
 * Route a fuse-lessons event to its handler. Returns the native stdout for
@@ -4008,13 +4234,14 @@ function injectMemory(cwd, event, now) {
 * @param payload - The raw hook payload.
 * @param cwd - Project root for memory injection.
 * @param now - Clock.
+* @param id - Harness target id (defaults to "claude-code" — zero-regression default).
 * @returns The native stdout (possibly empty).
 */
-function dispatchLessons(event, payload, cwd, now) {
+function dispatchLessons(event, payload, cwd, now, id = "claude-code") {
 	switch (event) {
 		case "SessionStart":
 		case "SubagentStart":
-		case "UserPromptSubmit": return injectMemory(cwd, event, now);
+		case "UserPromptSubmit": return injectMemory(cwd, event, now, id);
 		case "Stop": return remindWrite(payload, now);
 		case "PostToolUse":
 			markWrite(payload, now);
@@ -4091,13 +4318,11 @@ async function injectApexSubagentContext(cwd, home = homedir(), id = "claude-cod
 	const apexDir = join(projectRoot, seg, "apex");
 	if (!existsSync(apexDir)) return "";
 	const agentsPath = join(apexDir, "AGENTS.md");
-	const agents = existsSync(agentsPath) ? readText(agentsPath).slice(0, 4e3) : "";
+	const agents = existsSync(agentsPath) ? readText$1(agentsPath).slice(0, 4e3) : "";
 	const taskData = await readJsonFile(join(apexDir, "task.json"));
 	const completed = taskData ? completedTasks(taskData.tasks) : "none";
 	const pending = taskData ? pendingTasks(taskData.tasks) : "none";
-	const isCodex = id === "codex";
-	const beforeStart = isCodex ? "Use update_plan → mark the active step in_progress before starting" : "Use TaskUpdate(taskId, status: in_progress) before starting";
-	const whenDone = isCodex ? "update_plan → mark the step completed when done" : "TaskUpdate(taskId, status: completed) triggers auto-commit";
+	const { beforeStart, whenDone } = apexAgentSteps(id);
 	return contextResponse("SubagentStart", capFragment("apex-subagent", `## APEX Sub-Agent Instructions
 
 You are a sub-agent in APEX workflow. Follow these rules:
@@ -4148,7 +4373,7 @@ function cacheAge(ts, now = Date.now()) {
 /** Full SHA-256 hex checksum of a file's text; "" when unreadable. */
 async function fileChecksum(path) {
 	try {
-		return createHash("sha256").update(readText(path)).digest("hex");
+		return createHash("sha256").update(readText$1(path)).digest("hex");
 	} catch {
 		return "";
 	}
@@ -4218,7 +4443,7 @@ async function cacheAnalyticsSave(home = homedir(), now = Date.now()) {
 	const dir = join(cacheBaseDir(home), "analytics");
 	const sessionsFile = join(dir, "sessions.jsonl");
 	if (!pathExists(sessionsFile)) return;
-	const raw = readText(sessionsFile);
+	const raw = readText$1(sessionsFile);
 	if (!raw.trim()) return;
 	const entries = parseEntries(raw);
 	if (entries.length === 0) return;
@@ -4300,7 +4525,7 @@ async function injectExploreCache(cwd, home = homedir(), now = Date.now()) {
 	const cfgHash = await configHash(projPath);
 	let context = "";
 	const meta = await readJsonFile(metaFile);
-	const snapshot = pathExists(snapFile) ? readText(snapFile) : "";
+	const snapshot = pathExists(snapFile) ? readText$1(snapFile) : "";
 	if (meta?.timestamp && snapshot) {
 		const age = cacheAge(meta.timestamp, now);
 		if (age < TTL_SECONDS$1 && meta.config_hash === cfgHash) {
@@ -4337,7 +4562,7 @@ async function buildDocsContext(entries, docsDir, now) {
 		seen.add(entry.hash);
 		const docPath = join(docsDir, `${entry.hash}.md`);
 		if (!pathExists(docPath)) continue;
-		const content = readText(docPath);
+		const content = readText$1(docPath);
 		if (!content) continue;
 		ctx += `\n${content}\n`;
 		count++;
@@ -4630,7 +4855,7 @@ function projectRootFromPaths(filePaths) {
 }
 /** Extract absolute file paths from tool_use entries in a JSONL transcript, optionally restricted to `toolNames` (default: any tool). */
 async function transcriptFilePaths(transcriptPath, toolNames) {
-	const text = readText(transcriptPath);
+	const text = readText$1(transcriptPath);
 	const paths = /* @__PURE__ */ new Set();
 	for (const line of text.split("\n").filter(Boolean)) try {
 		const content = JSON.parse(line)?.message?.content;
@@ -4646,7 +4871,7 @@ async function transcriptFilePaths(transcriptPath, toolNames) {
 }
 /** Extract deduplicated Edit tool_use entries (keyed by basename) from a transcript. */
 async function transcriptEdits(transcriptPath) {
-	const text = readText(transcriptPath);
+	const text = readText$1(transcriptPath);
 	const edits = [];
 	for (const line of text.split("\n").filter(Boolean)) try {
 		const content = JSON.parse(line)?.message?.content;
@@ -4663,7 +4888,7 @@ async function transcriptEdits(transcriptPath) {
 }
 /** Extract the last assistant text report (first 500 lines) from a transcript. */
 async function transcriptReport(transcriptPath) {
-	const text = readText(transcriptPath);
+	const text = readText$1(transcriptPath);
 	let lastReport = "";
 	for (const line of text.split("\n").filter(Boolean)) try {
 		const entry = JSON.parse(line);
@@ -4691,7 +4916,7 @@ const RETRY_DELAYS = [
 ];
 /** Extract the longest assistant synthesis + queried library ids from a transcript. */
 async function extractSynthesis(path) {
-	const lines = readText(path).split("\n").filter(Boolean);
+	const lines = readText$1(path).split("\n").filter(Boolean);
 	const libraries = [];
 	let synthesis = "";
 	for (const line of lines) try {
@@ -4899,7 +5124,7 @@ async function cacheSniperLessons(transcript, cwd, home = homedir()) {
 */
 /** Extract linter-related command/output text from a JSONL transcript. */
 async function extractLinterOutput(path) {
-	const text = readText(path);
+	const text = readText$1(path);
 	const outputs = [];
 	for (const line of text.split("\n").filter(Boolean)) try {
 		const content = JSON.parse(line)?.message?.content;
@@ -5151,8 +5376,8 @@ async function docCacheGate(payload, cwd, now = Date.now(), home = homedir()) {
 * Ports `check-solid-compliance.py`.
 */
 const CODE_EXTENSIONS$1 = /\.(ts|tsx|js|jsx|py|php|swift|go|rs|rb|java|astro)$/;
-const COMPONENT_DIR = /(components|pages|views)\//;
-const BACKEND_DIR = /(Controllers|Models|Services)\//;
+const COMPONENT_DIR = /\/(components|pages|views)\//;
+const BACKEND_DIR = /\/(Controllers|Models|Services)\//;
 const TS_INTERFACE_RE = /^(export )?(interface|type) [A-Z]/m;
 const PHP_INTERFACE_RE = /^interface /m;
 /** Count non-empty, non-comment (`//`/`#`/`*`-prefixed) lines. Shared with {@link checkSolidFromTranscript}. */
@@ -5176,9 +5401,10 @@ function checkSolidCompliance(payload) {
 	const input = payload.tool_input ?? {};
 	const filePath = typeof input.file_path === "string" ? input.file_path : "";
 	if (!filePath || !CODE_EXTENSIONS$1.test(filePath) || !pathExists(filePath)) return "";
+	if (isVendorPath(filePath)) return "";
 	let content;
 	try {
-		content = readText(filePath);
+		content = readText$1(filePath);
 	} catch {
 		return "";
 	}
@@ -5188,15 +5414,64 @@ function checkSolidCompliance(payload) {
 	const lc = countCodeLines(content);
 	if (lc > max) violations.push(`FILE SIZE: ${lc} lines (max: ${max})`);
 	else if (lc > split) violations.push(`FILE SIZE WARNING: ${lc} lines (split at ${split})`);
-	if (COMPONENT_DIR.test(filePath)) {
-		if (TS_INTERFACE_RE.test(content)) violations.push("INTERFACE LOCATION: Move to src/interfaces/");
-	} else if (BACKEND_DIR.test(filePath)) {
-		if (PHP_INTERFACE_RE.test(content)) violations.push("INTERFACE LOCATION: Move to app/Contracts/");
+	const masked = maskCommentsAndStrings(content, filePath.endsWith(".php") ? "php" : filePath.endsWith(".py") ? "py" : "c");
+	if (COMPONENT_DIR.test(filePath) && /\.(ts|tsx|js|jsx|astro)$/.test(filePath)) {
+		if (TS_INTERFACE_RE.test(masked)) violations.push("INTERFACE LOCATION: Move to src/interfaces/");
+	} else if (BACKEND_DIR.test(filePath) && filePath.endsWith(".php")) {
+		if (PHP_INTERFACE_RE.test(masked)) violations.push("INTERFACE LOCATION: Move to app/Contracts/");
 	}
 	if (violations.length === 0) return "";
 	return contextResponse("PostToolUse", `SOLID COMPLIANCE CHECK: ${filePath.split("/").pop() ?? filePath}\n\n${violations.join("\n")}\nINSTRUCTION: Fix violations before continuing.\nRun sniper agent for full validation.`);
 }
 //#endregion
+//#region src/runtime/lifecycle/aipilot/solid-notice.ts
+/**
+* SubagentStop SOLID-notice dedup (anti-loop): `checkSolidFromTranscript` is
+* stateless, so an unchanged violation set re-emitted the same
+* `additionalContext` on EVERY SubagentStop — re-invoking the agent in an
+* observed ~15-repeat loop. The dedup fingerprint is a SHA-256 hash of the
+* sorted `file:message` set, persisted per agent key in the canonical
+* `.harness/track/solid-notice.json` sidecar (`config/layout.ts`), written
+* under the synchronous track lock (this hook runs in an ephemeral sync
+* process). Semantics: identical fingerprint within the TTL → silence;
+* changed/absent/expired fingerprint → emit once and record (the TTL derives
+* from `FUSE_ENFORCE_TTL_SEC`, no new env var). On lock contention the notice
+* is emitted anyway (visibility beats a muted violation) but not recorded.
+*/
+/** SHA-256 (truncated) of the sorted violation set — the dedup fingerprint. */
+function noticeFingerprint(violations) {
+	return createHash("sha256").update([...violations].sort().join("\n")).digest("hex").slice(0, 16);
+}
+/**
+* Decide whether the notice for `key` may be emitted, recording it when so.
+* @param noticeFile - `projectLayout(cwd).solidNoticeFile`.
+* @param key - Agent/transcript identity (e.g. `agent_transcript_path`).
+* @param hash - The current set's fingerprint ({@link noticeFingerprint}).
+* @param now - Clock (epoch ms).
+* @param ttlMs - Reminder window (derived from `FUSE_ENFORCE_TTL_SEC`).
+*/
+function shouldEmitNotice(noticeFile, key, hash, now, ttlMs) {
+	let state = {};
+	try {
+		state = JSON.parse(readFileSync(noticeFile, "utf8"));
+	} catch {}
+	const prev = state[key];
+	if (prev && prev.hash === hash && now - prev.at < ttlMs) return false;
+	const next = {
+		...state,
+		[key]: {
+			hash,
+			at: now
+		}
+	};
+	withTrackLockSync(dirname(noticeFile), () => {
+		try {
+			atomicWrite(noticeFile, JSON.stringify(next));
+		} catch {}
+	});
+	return true;
+}
+//#endregion
 //#region src/runtime/lifecycle/aipilot/solid-transcript.ts
 /**
 * SubagentStop (matcher "") for the ai-pilot scope: check SOLID file-size and
@@ -5206,19 +5481,22 @@ function checkSolidCompliance(payload) {
 */
 const CODE_EXTENSIONS = /\.(ts|tsx|js|jsx|py|go|rs|java|php|cpp|c|rb|swift|kt|dart|vue|svelte|astro)$/;
 const INTERFACE_PATTERN = /^(export )?(interface|type) [A-Z]/m;
-const INTERFACE_DIRS = [
-	"components/",
-	"pages/",
-	"views/",
-	"app/"
-];
+/** Segment-anchored dirs (a substring like `app/` matched `livetest-app/`). */
+const INTERFACE_DIRS_RE = /\/(components|pages|views|app)\//;
+/** Canonical homes — never a violation there (owner decision: types/ is
+* canonical; Contracts/ is the Laravel home taught by solid-php/laravelGate). */
+const INTERFACE_EXEMPT_RE = /\/(interfaces|types|Contracts|contracts)\//;
 /**
 * Check every Write/Edit target in a subagent transcript against the SOLID
-* line-count ceiling and interface-location convention.
+* line-count ceiling and interface-location convention. Deduped per
+* transcript (`solid-notice.ts`): an unchanged violation set is emitted once
+* per TTL window, never in a loop.
 * @param transcript - Path to the agent JSONL transcript (`agent_transcript_path`).
-* @returns The SubagentStop `additionalContext` response, or `""` when clean.
+* @param cwd - Project root (locates the `.harness/track` dedup sidecar).
+* @param now - Clock (tests inject it).
+* @returns The SubagentStop `additionalContext` response, or `""` when clean/deduped.
 */
-async function checkSolidFromTranscript(transcript) {
+async function checkSolidFromTranscript(transcript, cwd = process.cwd(), now = Date.now()) {
 	if (!transcript || !pathExists(transcript)) return "";
 	const files = await transcriptFilePaths(transcript, ["Write", "Edit"]);
 	const max = resolveMaxLines();
@@ -5228,15 +5506,19 @@ async function checkSolidFromTranscript(transcript) {
 		const name = fp.split("/").pop() ?? fp;
 		let content;
 		try {
-			content = readText(fp);
+			content = readText$1(fp);
 		} catch {
 			continue;
 		}
 		const lc = countCodeLines(content);
 		if (lc > max) violations.push(`SOLID: ${name} = ${lc} lines (max ${max})`);
-		if (INTERFACE_DIRS.some((prefix) => fp.includes(prefix)) && INTERFACE_PATTERN.test(content)) violations.push(`SOLID: ${name}: move interfaces to interfaces/`);
+		if (INTERFACE_DIRS_RE.test(fp) && !INTERFACE_EXEMPT_RE.test(fp) && INTERFACE_PATTERN.test(content)) {
+			const dest = fp.endsWith(".php") ? "app/Contracts/" : "interfaces/";
+			violations.push(`SOLID: ${name}: move interfaces to ${dest}`);
+		}
 	}
 	if (violations.length === 0) return "";
+	if (!shouldEmitNotice(projectLayout(cwd).solidNoticeFile, transcript, noticeFingerprint(violations), now, resolveTtlSec(process.env) * 1e3)) return "";
 	return contextResponse("SubagentStop", `## SOLID VIOLATIONS DETECTED (subagent output)\n${violations.join("\n")}\nRun sniper to fix these issues.`);
 }
 //#endregion
@@ -5296,7 +5578,7 @@ async function onSubagentStop(payload, cwd, home) {
 		await cacheSniperLessons(transcript, cwd, home);
 		await cacheTestResults(transcript, cwd, home);
 	}
-	return checkSolidFromTranscript(transcript);
+	return checkSolidFromTranscript(transcript, cwd);
 }
 /**
 * Dispatch an ai-pilot-scope lifecycle event. Returns the native stdout, or
@@ -5322,10 +5604,10 @@ async function aipilotPostToolUse(payload, cwd, id = "claude-code") {
 /** SessionStart handler keyed on plugin scope. */
 function sessionStart(input) {
 	if (input.scope === "solid") return solidDetectStart();
-	if (input.scope === "rules") return injectRules(process.env.CLAUDE_PLUGIN_ROOT ?? input.cwd, input.event);
+	if (input.scope === "rules") return injectRules(resolveRulesRoot(input.id ?? "claude-code", input.cwd), input.event, input.id ?? "claude-code");
 	if (input.scope === "carto") return cartoSessionStart(input.cwd, input.now);
-	if (input.scope === "lessons") return dispatchLessons("SessionStart", input.payload, input.cwd, input.now);
-	const core = sessionStartCore(input.cwd, void 0, input.now);
+	if (input.scope === "lessons") return dispatchLessons("SessionStart", input.payload, input.cwd, input.now, input.id ?? "claude-code");
+	const core = sessionStartCore(input.cwd, void 0, input.now, input.id ?? "claude-code");
 	return input.scope === "core" ? withSnapshot(core, input.cwd, import.meta.url) : core;
 }
 /**
@@ -5339,16 +5621,16 @@ function dispatchLifecycle(input) {
 	switch (input.event) {
 		case "SessionStart": return sessionStart(input);
 		case "UserPromptSubmit":
-			if (input.scope === "rules") return injectRules(process.env.CLAUDE_PLUGIN_ROOT ?? input.cwd, input.event);
-			if (input.scope === "lessons") return dispatchLessons("UserPromptSubmit", input.payload, input.cwd, input.now);
+			if (input.scope === "rules") return injectRules(resolveRulesRoot(input.id ?? "claude-code", input.cwd), input.event, input.id ?? "claude-code");
+			if (input.scope === "lessons") return dispatchLessons("UserPromptSubmit", input.payload, input.cwd, input.now, input.id ?? "claude-code");
 			return null;
 		case "SubagentStart":
-			if (input.scope === "rules") return injectRules(process.env.CLAUDE_PLUGIN_ROOT ?? input.cwd, input.event);
+			if (input.scope === "rules") return injectRules(resolveRulesRoot(input.id ?? "claude-code", input.cwd), input.event, input.id ?? "claude-code");
 			if (input.scope === "aipilot") return "";
-			if (input.scope === "lessons") return dispatchLessons("SubagentStart", input.payload, input.cwd, input.now);
+			if (input.scope === "lessons") return dispatchLessons("SubagentStart", input.payload, input.cwd, input.now, input.id ?? "claude-code");
 			return subagentCacheContext(input.payload.session_id);
 		case "Stop":
-			if (input.scope === "lessons") return dispatchLessons("Stop", input.payload, input.cwd, input.now);
+			if (input.scope === "lessons") return dispatchLessons("Stop", input.payload, input.cwd, input.now, input.id ?? "claude-code");
 			return input.scope === "core" ? stopCore(input.payload, input.cwd, input.now) : null;
 		case "SubagentStop":
 			if (input.scope === "aipilot") return "";
@@ -6354,7 +6636,11 @@ function nextModular(filePath, content, cwd) {
 }
 /** Laravel FuseCore architecture: `app/` domain ban + module.json + cross-module `use` rules. */
 function fusecore(filePath, content, cwd) {
-	for (const b of PHP_BLOCKED_IN_APP) if (filePath.includes(b)) return block$1(`BLOCKED: FuseCore project. Code in '${b.replace(/^\/|\/$/g, "")}' FORBIDDEN. Move to '${b.replaceAll("/app/", "/FuseCore/{Module}/App/").replace(/^\/|\/$/g, "")}'.`);
+	for (const b of PHP_BLOCKED_IN_APP) if (filePath.includes(b)) {
+		const from = b.replace(/^\/|\/$/g, "");
+		const to = b.replaceAll("/app/", "/FuseCore/{Module}/App/").replace(/^\/|\/$/g, "");
+		return block$1(`BLOCKED: FuseCore project. Code in '${from}' FORBIDDEN. Move to '${to}'.`);
+	}
 	const mod = filePath.match(/\/FuseCore\/([A-Za-z]+)\//);
 	if (!mod) return null;
 	const name = mod[1] ?? "";
@@ -6545,7 +6831,7 @@ function appendRefRead(dir, path, ts) {
 function reconcileRefReadsFromJournal(track, dir, now) {
 	let text;
 	try {
-		text = readText(join(dir, JOURNAL));
+		text = readText$1(join(dir, JOURNAL));
 	} catch {
 		return track;
 	}
@@ -6748,10 +7034,9 @@ function geminiMcpGate(tool, filePath, content, ev) {
 //#endregion
 //#region src/freshness/agent-evidence.ts
 /**
-* Platform-authored transcript evidence for APEX agent freshness.
-* Parses the Claude Code session JSONL transcript to find genuine `Task`/`Agent`
-* tool_use entries — forging this requires writing into the transcript file
-* which the Claude Code platform controls, unlike the self-recorded track.
+* Platform-authored transcript evidence for APEX agent freshness. Parses the
+* Claude Code session JSONL transcript for genuine dispatch tool_use entries
+* — forging requires writing into the platform-controlled transcript file.
 */
 /** Parse a raw `timestamp` field to epoch ms; `undefined` when absent or invalid. */
 function parseTs(raw) {
@@ -6761,23 +7046,14 @@ function parseTs(raw) {
 	return Number.isFinite(ms) ? ms : void 0;
 }
 /**
-* Return `true` ONLY when, for EVERY name in `names`, the Claude Code
-* transcript at `transcriptPath` contains a genuine `tool_use` of the `Task`/
-* `Agent` tool whose `subagent_type` (or `name`) matches — after stripping any
-* plugin prefix — OR a direct exploration/research tool_use (Glob/Grep, an
-* explore Bash command, mcp__context7/mcp__exa, WebSearch/WebFetch) classified
-* via {@link classifyExplore} into that name, issued by ANY sub-agent or the
-* lead within this same transcript — with the entry timestamp within
-* `windowMs` of `now`.
-*
-* **Timestamp note:** when a transcript entry carries no `timestamp` field it
-* is counted as within-window (we cannot prove staleness). This is
-* intentionally lenient to stay robust across transcript-format evolution; the
-* tamper-resistance guarantee derives from the platform authoring the file —
-* not from the timestamp alone.
-*
-* @param transcriptPath - Absolute path to the session `.jsonl` transcript
-*   (hook payload field: `transcript_path`). Returns `false` when `undefined`.
+* Return `true` ONLY when, for EVERY name in `names`, the transcript at
+* `transcriptPath` shows a within-window genuine `tool_use`: a dispatch tool
+* ({@link isAgentTool}) whose `subagent_type`/`name` (plugin prefix stripped)
+* matches, OR a direct exploration/research call classified into that name by
+* {@link classifyExplore} — issued by any sub-agent or the lead (the transcript
+* carries no author field). Entries without `timestamp` count as within-window
+* (format-evolution leniency; tamper-resistance comes from platform authoring).
+* @param transcriptPath - Session `.jsonl` transcript (`transcript_path`); false when undefined.
 * @param names - Required agent `subagent_type` values — ALL must appear.
 * @param windowMs - Freshness window in milliseconds.
 * @param now - Current epoch ms (pass `Date.now()` at the call-site).
@@ -6787,7 +7063,7 @@ function agentsRanFromTranscript(transcriptPath, names, windowMs, now) {
 	if (!transcriptPath || names.length === 0) return false;
 	let text;
 	try {
-		text = readText(transcriptPath);
+		text = readText$1(transcriptPath);
 	} catch {
 		return false;
 	}
@@ -6807,7 +7083,7 @@ function agentsRanFromTranscript(transcriptPath, names, windowMs, now) {
 		if (!Array.isArray(content)) continue;
 		for (const block of content) {
 			if (block?.type !== "tool_use") continue;
-			if (block.name === "Task" || block.name === "Agent") {
+			if (block.name !== void 0 && isAgentTool(block.name)) {
 				const raw = block.input?.subagent_type ?? block.input?.name;
 				const agent = typeof raw === "string" ? raw.split(":").pop() ?? raw : void 0;
 				if (agent !== void 0 && names.includes(agent)) found.add(agent);
@@ -6841,7 +7117,7 @@ async function apexScopedGate(input, track, window) {
 	if (protectedDeny) return protectedDeny;
 	if (SKIP_DIRS.test(input.filePath ?? "")) return null;
 	if (isTrivialEdit(input.tool, input.content, input.isReplaceAll) && trivialCount(track, window, input.now) < 4) {
-		await saveTrack(input.trackFile, recordTrivialEdit(track, input.now, window, input.now));
+		await withTrack(input.trackFile, (fresh) => recordTrivialEdit(fresh, input.now, window, input.now));
 		return null;
 	}
 	const freshnessFor = (names, windowMs = window) => agentsFreshInTrack(track, names, windowMs, input.now) || (input.transcriptPath ? agentsRanFromTranscript(input.transcriptPath, names, windowMs, input.now) : agentsFresh(track, names, windowMs, input.now));
@@ -6867,7 +7143,7 @@ async function apexScopedGate(input, track, window) {
 		const authDeny = apexAuthorizationGate(ctx);
 		if (authDeny) {
 			const set_at = new Date(input.now).toISOString();
-			await saveTrack(input.trackFile, recordTarget(track, {
+			await withTrack(input.trackFile, (fresh) => recordTarget(fresh, {
 				project: input.cwd ?? "",
 				framework: input.framework,
 				set_by: "apex-authorization",
@@ -7071,13 +7347,13 @@ const MCP_TTL_MS = parseEnvInt(process.env.FUSE_MCP_TTL_SEC, MCP_TTL_DEFAULT_SEC
 const WEBFETCH_TTL_MS = parseEnvInt(process.env.FUSE_WEBFETCH_TTL_SEC, WEBFETCH_TTL_DEFAULT_SEC) * 1e3;
 /** WebFetch prompt slice folded into its cache key (parity with Python prompt[:500]). */
 const PROMPT_TRUNC = 500;
-/** True for the WebFetch tool (exact name). */
+/** True for the WebFetch tool (exact name) or Kimi Code CLI's `FetchURL` equivalent. */
 function isWebFetch(tool) {
-	return tool === "WebFetch";
+	return tool === "WebFetch" || tool === "FetchURL";
 }
-/** MCP doc tools + WebFetch whose calls are cached / verbosity-capped. */
+/** MCP doc tools + WebFetch/FetchURL whose calls are cached / verbosity-capped. */
 function isMcpTool(tool) {
-	return /context7|exa|webfetch|web_fetch/i.test(tool) || tool === "WebFetch";
+	return /context7|exa|webfetch|web_fetch/i.test(tool) || isWebFetch(tool);
 }
 /** The query/url that keys the cache. */
 function queryOf(input) {
@@ -7105,6 +7381,7 @@ function denyWith(id, content) {
 		decision: "deny",
 		reason: content
 	});
+	if (id === "kimi") return kimiDenyResponse(content);
 	return "";
 }
 function mutateWith(id, input) {
@@ -7173,8 +7450,7 @@ function mcpPostStore(tool, input, response, dir, now = Date.now()) {
 //#region src/runtime/record.ts
 /** Apply an activity to a session's track and persist it (PostToolUse path). */
 async function recordActivity(file, activity) {
-	const track = await loadTrack(file);
-	await saveTrack(file, activity.kind === "agent" ? recordAgent(track, activity.name, activity.ts, activity.quality) : activity.kind === "doc" ? recordDoc(track, activity.framework, activity.sessionId, activity.source, activity.ts) : recordRefRead(track, activity.path, activity.ts));
+	await withTrack(file, (track) => activity.kind === "agent" ? recordAgent(track, activity.name, activity.ts, activity.quality) : activity.kind === "doc" ? recordDoc(track, activity.framework, activity.sessionId, activity.source, activity.ts) : recordRefRead(track, activity.path, activity.ts));
 	if (activity.kind === "ref") appendRefRead(dirname(file), activity.path, activity.ts ?? Date.now());
 }
 //#endregion
@@ -7195,6 +7471,12 @@ async function recordActivity(file, activity) {
 * - hermes: delegated to the adapter's `toHermesResponse` — `block` ->
 *   `{decision:"block",reason}`; `ask`/`inform` degrade to non-blocking
 *   `{context}` (Hermes has no interactive "ask" state).
+* - kimi: delegated to the adapter's `toKimiResponse` — `block`/`ask` ->
+*   `hookSpecificOutput.permissionDecision:"deny"` (Kimi Code CLI's hooks
+*   contract documents only "deny"; `ask` downgrades with a prefix, mirroring
+*   the codex branch above), `inform` -> raw text on stdout (Kimi appends
+*   stdout to context on exit 0 — no `hookSpecificOutput` envelope documented
+*   for non-blocking context injection).
 *
 * User-visible pass notices (`prompt.userMessage`, Python `hook_output.allow_pass`
 * / `post_pass` parity), by harness:
@@ -7259,6 +7541,7 @@ function respond(id, prompt, event = "PreToolUse") {
 				agent_message: message
 			});
 		case "hermes": return toHermesResponse(prompt);
+		case "kimi": return toKimiResponse(prompt);
 		case "cline":
 			if (kind === "block") return JSON.stringify({
 				cancel: true,
@@ -7462,7 +7745,7 @@ function uiDesignSkillGate(tool, filePath, content, ev) {
 	if (!isUiWrite(tool, filePath, content)) return null;
 	if (!designSkillRead(ev.refsRead)) return block("BLOCKED: design skill not consulted before writing UI. Read a design SKILL.md (design-system, design-web, or design-motion), then retry.", "Read a design skill reference, then retry");
 	const missing = missingDomainSkills(content, ev.refsRead);
-	if (missing.length) return block(`BLOCKED: code uses ${missing.join(", ")} but the matching design skill(s) were not consulted. Read the SKILL.md for: ${missing.join(", ")}, then retry.`, `Read design skill(s): ${missing.join(", ")}, then retry`);
+	if (missing.length) return block(`BLOCKED: code uses ${missing.join(", ")} but the matching design skill(s) were not consulted. Read the SKILL.md FILE (with the Read tool) for: ${missing.join(", ")}, then retry.`, `Read design skill(s): ${missing.join(", ")}, then retry`);
 	if (!ev.docConsulted) return block("BLOCKED: no documentation consulted. Use BOTH mcp__context7__query-docs AND mcp__exa__web_search_exa, or a web fallback alone (WebSearch/WebFetch). Gemini is NOT required.", "Consult Context7+Exa, or web docs alone (Gemini not required), then retry");
 	return null;
 }
@@ -7732,6 +8015,201 @@ function designGate(payload, event, cacheDir, cwd) {
 	return null;
 }
 //#endregion
+//#region src/runtime/solid-file-size-gate.ts
+/**
+* PreToolUse file-size deny for the solid scope — the same SOLID ceiling the
+* core gate chain enforces (`policy/evaluate.ts`), extracted so
+* `harness hook <id> solid` blocks oversized Write/Edit WITHOUT the core-only
+* APEX freshness gates (they require explore/research agents that not every
+* harness runs). Pure and read-only (on-disk read via {@link existingLineCounts},
+* no session state), so the sibling-plugin fan-out stays idempotent.
+*/
+/**
+* Deny a Write/Edit whose resulting file would exceed the SOLID line ceiling.
+* Mirrors `policy/evaluate.ts` exactly: a computable Edit outcome passes when
+* the result is compliant OR strictly shrinks an already-oversized file; the
+* block message reports the pre-existing on-disk count for a Write.
+* @param tool - The tool name (only "Write"/"Edit" are checked).
+* @param filePath - The written file's absolute path.
+* @param content - Write: the full new content; Edit: the `new_string` snippet.
+* @param oldString - Edit only: the `old_string` being replaced.
+* @param isReplaceAll - Edit only: whether every occurrence is replaced.
+* @param agentType - Subagent type, when known (Explore/Plan are exempt).
+* @returns The blocking prompt, or null when compliant or out of scope.
+*/
+function solidFileSizeGate(tool, filePath, content, oldString, isReplaceAll = false, agentType) {
+	if (tool !== "Write" && tool !== "Edit") return null;
+	if (!filePath || !isFileSizeScoped(filePath)) return null;
+	if (agentType === "Explore" || agentType === "Plan") return null;
+	const { raw: existingLines, content: existingContent } = existingLineCounts(filePath);
+	const incoming = content !== void 0 ? countLines(content) : 0;
+	const existing = existingLines ?? 0;
+	const max = resolveMaxLines();
+	const editResult = tool === "Edit" && existingContent !== void 0 && content !== void 0 ? computeEditResultLines(existingContent, oldString, content, isReplaceAll) : null;
+	if (editResult !== null && (editResult <= max || editResult < existing)) return null;
+	const lines = tool === "Edit" ? editResult ?? Math.max(incoming, existing) : incoming || existing;
+	const displayLines = tool === "Write" ? existingLines ?? lines : lines;
+	const verdict = evaluateFileSize(lines, max, filePath, resolveSolidRefFramework(filePath), displayLines);
+	if (lines === 0 || verdict.ok) return null;
+	return {
+		kind: "block",
+		title: "SOLID file-size limit",
+		reason: verdict.message ?? "",
+		actions: [`Split into modules under ${verdict.max} lines (Single Responsibility)`, "Then re-run the write"]
+	};
+}
+//#endregion
+//#region src/runtime/core-guards-active.ts
+/**
+* Per-harness ACTIVATION probing for the core-guards plugin, behind
+* {@link coreGuardsWired}. The owner decision: the solid scope abstains from
+* its file-size deny ONLY when core-guards is installed AND active — an
+* installed-but-disabled plugin must leave the solid deny firing. Safe
+* default, per harness: anything undetectable (unreadable/missing state)
+* reads as NOT active, so the worst case is a duplicate deny — never zero.
+*/
+/** File content, or null when unreadable (undetectable → caller's safe default). */
+function readText(path) {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return null;
+	}
+}
+/** First `core-guards@…` value in a name→bool map; undefined when absent. */
+function enabledEntry(map) {
+	if (typeof map !== "object" || map === null || Array.isArray(map)) return void 0;
+	for (const [k, v] of Object.entries(map)) if (k.startsWith("core-guards@")) return v !== false;
+}
+/**
+* Claude Code: `~/.claude/settings.json` → `enabledPlugins`. core-guards is a
+* REQUIRED marketplace plugin: no entry means active whenever the marketplace
+* copy exists (`installed`); an explicit `false` means disabled. Unreadable
+* settings → false (undetectable).
+* @param home - OS home.
+* @param installed - Whether the marketplace copy of core-guards exists.
+*/
+function claudeCoreGuardsActive(home, installed) {
+	const text = readText(join(home, ".claude", "settings.json"));
+	if (text === null) return false;
+	try {
+		return enabledEntry(JSON.parse(text).enabledPlugins) ?? installed;
+	} catch {
+		return false;
+	}
+}
+/**
+* Codex: `[plugins."core-guards@<mkt>"] enabled = …` in `~/.codex/config.toml`
+* (minimal section-scoped extraction — no TOML dependency). Missing section,
+* `enabled = false`, or unreadable file → false.
+* @param home - OS home.
+*/
+function codexCoreGuardsActive(home) {
+	const text = readText(join(home, ".codex", "config.toml"));
+	if (text === null) return false;
+	return /^\[plugins\."core-guards@[^"]+"\]\s*enabled\s*=\s*(true|false)/m.exec(text)?.[1] === "true";
+}
+/**
+* Kimi: `<KIMI_CODE_HOME>/plugins/installed.json` — map form (`id →
+* {enabled?}`) or array form (`[{id, enabled?}]`); an entry counts active
+* unless `enabled === false`. File absent here today → format read
+* tolerantly; missing/unreadable → false (undetectable).
+* @param root - Kimi data root (`KIMI_CODE_HOME` ?? `~/.kimi-code`).
+*/
+function kimiCoreGuardsActive(root) {
+	const text = readText(join(root, "plugins", "installed.json"));
+	if (text === null) return false;
+	try {
+		const data = JSON.parse(text).plugins;
+		if (Array.isArray(data)) {
+			const hit = data.find((p) => typeof p === "object" && p !== null && p.id === "core-guards");
+			return hit !== void 0 && hit.enabled !== false;
+		}
+		if (typeof data !== "object" || data === null) return false;
+		for (const [k, v] of Object.entries(data)) if (k === "core-guards" || k.startsWith("core-guards@")) return typeof v === "object" && v !== null ? v.enabled !== false : v !== false;
+		return false;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/runtime/core-guards-wired.ts
+/**
+* Detect whether the core-guards plugin is installed AND ACTIVE for a harness.
+* When it is, its `core` scope already owns the PreToolUse file-size deny
+* (`policy/evaluate.ts`), so the `solid` scope MUST abstain on the same
+* tool-call — otherwise a user with BOTH plugins wired on PreToolUse
+* Write|Edit receives the identical deny twice. Activation probing is
+* per-harness (`core-guards-active.ts`, owner decision):
+* - claude-code: marketplace copy present + `settings.json` `enabledPlugins`
+*   (required core: no entry = active; explicit `false` = disabled);
+* - codex: `[plugins."core-guards@…"] enabled = true` in `~/.codex/config.toml`;
+* - kimi: `<KIMI_CODE_HOME>/plugins/installed.json` entry not disabled.
+* SAFE DEFAULT: anything undetectable (unreadable/missing state) reads as
+* NOT active — the solid scope then fires its own deny, so the worst case is
+* a duplicate deny, NEVER zero deny.
+*/
+/** Immediate child dir names of `dir`, or [] when unreadable. */
+function children(dir) {
+	try {
+		return readdirSync(dir);
+	} catch {
+		return [];
+	}
+}
+/** Claude: marketplace copy `~/.claude/plugins/marketplaces/<m>/plugins/core-guards`. */
+function claudeInstalled(home) {
+	const markets = join(home, ".claude", "plugins", "marketplaces");
+	return children(markets).some((m) => existsSync(join(markets, m, "plugins", "core-guards")));
+}
+/**
+* True when core-guards is installed AND active for the harness.
+* @param id - Harness id.
+* @param env - Environment (defaults to `process.env`).
+* @param home - OS home (defaults to `env.HOME` / `os.homedir()`; injectable).
+*/
+function coreGuardsWired(id, env = process.env, home = env.HOME ?? homedir()) {
+	if (id === "claude-code") return claudeCoreGuardsActive(home, claudeInstalled(home));
+	if (id === "codex") return codexCoreGuardsActive(home);
+	if (id === "kimi") return kimiCoreGuardsActive(env.KIMI_CODE_HOME ?? join(home, ".kimi-code"));
+	return false;
+}
+//#endregion
+//#region src/runtime/solid-pre.ts
+/**
+* Solid-scope PreToolUse outcome: the file-size deny ({@link solidFileSizeGate})
+* first — rendered via {@link respond} so every harness gets its native shape
+* (Kimi finally receives a real `hookSpecificOutput` deny instead of a leaked
+* Claude envelope) — then the ported Go/Python interface-location check
+* ({@link validateSolidGate}, kept byte-identical for claude-code/codex).
+* Owns the whole solid-scope branch so `handle-pre` stays a dispatcher and the
+* branch NEVER falls through to the core APEX/SOLID gate chain: core-guards
+* owns it, so falling through would run `gate()` twice per edit when both
+* plugins wire PreToolUse Write|Edit (duplicate denies + added latency). For
+* the same reason the file-size gate itself ABSTAINS when core-guards is
+* installed ({@link coreGuardsWired}): one tool-call, one deny, whoever fires.
+*/
+/**
+* Run the solid-scope PreToolUse gates and render the native hook outcome.
+* @param id - Harness id (selects the response shape via {@link respond}).
+* @param event - The normalized hook event.
+* @param file - Session track file (the deny-notice state derives from its dir).
+* @param now - Current time in ms.
+* @param env - Environment for the core-guards wiring probe (injectable).
+* @returns The hook outcome: file-size deny, Go/Python deny, or allow.
+*/
+function solidScopeOutcome(id, event, file, now, env = process.env) {
+	const prompt = coreGuardsWired(id, env) ? null : solidFileSizeGate(event.tool, event.filePath, event.content, event.oldString, event.input.replace_all === true, event.agentType);
+	if (prompt) return {
+		stdout: withDenyNotice(id, respond(id, prompt), prompt, event.sessionId, dirname(file), now),
+		exit: 0
+	};
+	return {
+		stdout: validateSolidGate(event.tool, event.filePath ?? "", event.content ?? ""),
+		exit: 0
+	};
+}
+//#endregion
 //#region src/runtime/pre-allow.ts
 /**
 * PreToolUse ALLOW-path response assembly. Reached only after every gate
@@ -7890,11 +8368,8 @@ async function handlePre(ctx) {
 		stdout: event.files?.length ? securityAdvisoryForPatch(event.files, opts.now) : securityAdvisory(event.tool, event.filePath ?? "", opts.now),
 		exit: 0
 	};
-	if (opts.scope === "solid") return {
-		stdout: validateSolidGate(event.tool, event.filePath ?? "", event.content ?? ""),
-		exit: 0
-	};
-	if (event.tool === "Task") {
+	if (opts.scope === "solid") return solidScopeOutcome(id, event, file, opts.now);
+	if (isAgentTool(event.tool)) {
 		const taskCtx = taskContext(opts.cwd, id);
 		if (taskCtx) return {
 			stdout: taskCtx,
@@ -8116,9 +8591,8 @@ function shellReadRefPaths(command) {
 }
 //#endregion
 //#region src/runtime/activity.ts
-/** Min response length (chars) for a lead agent call to count as `sufficient`. */
+/** Quality thresholds (chars): lead agent calls vs direct explore/research (parity Python `> 50`). */
 const AGENT_QUALITY_MIN = 500;
-/** Min response length (chars) for direct exploration/research (parity Python `> 50`). */
 const EXPLORE_QUALITY_MIN = 50;
 /** Read tools across harnesses (Claude `Read`, Gemini/Cline `read_file`, …). */
 const READ_TOOLS = /* @__PURE__ */ new Set([
@@ -8163,7 +8637,7 @@ function docSourceOf(tool) {
 * Map a live tool-use to the activity to record, or null when nothing is
 * tracked. Works across harnesses — tool names are globally distinct:
 * - MCP doc calls (`context7` / `exa`, any separator) → `doc`
-* - `Task`/`Agent` + `subagent_type` (Claude/Cursor) → `agent` (bare agent name)
+* - `Task`/`Agent`/`AgentSwarm` + `subagent_type` (Claude/Cursor/Kimi) → `agent` (bare agent name)
 * - direct exploration/research (Glob/Grep, explore Bash, web, MCP cache reads)
 *   → `agent` credited to the matching REQUIRED_AGENTS phase
 * - a read tool opening a `.md` reference → `ref`
@@ -8178,7 +8652,7 @@ function activityFor(event) {
 		source: docSource,
 		ts: event.now
 	});
-	if (event.tool === "Task" || event.tool === "Agent") {
+	if (isAgentTool(event.tool)) {
 		const name = String(event.input?.subagent_type ?? event.input?.name ?? "").split(":").pop() ?? "";
 		if (name) out.push(agentActivity(name, event.now, qualityFor(event.responseLength, AGENT_QUALITY_MIN)));
 		return out;
@@ -8284,9 +8758,37 @@ function creditCodexSpawnAgent(id, tool, input, track, ts) {
 */
 async function recordCodexSpawnEvidence(file, id, tool, input, ts) {
 	if (id !== "codex" || !isCodexSpawnAgentTool(tool)) return;
-	const track = await loadTrack(file);
-	const next = creditCodexSpawnAgent(id, tool, input, track, ts);
-	if (next !== track) await saveTrack(file, next);
+	await withTrack(file, (track) => {
+		const next = creditCodexSpawnAgent(id, tool, input, track, ts);
+		return next !== track ? next : track;
+	});
+}
+//#endregion
+//#region src/runtime/receipt-capture.ts
+/**
+* Bash verification-receipt extraction for PostToolUse: a `tsc`/`bun test`
+* run is parsed (exit code + output) into a signed receipt the TaskCompleted
+* gate later demands. Structured responses ONLY: Kimi Code CLI sends
+* `tool_output` as a truncated STRING (no exit_code, no stdout/stderr
+* channels) — parsing it would forge a success receipt (`exit 0`, empty
+* output) for possibly-failed runs, so a non-object source is skipped.
+*/
+/**
+* Record a verification receipt for a Bash run when the response is structured.
+* @param file - Session track file.
+* @param tool - The tool name (only "Bash" receipts exist).
+* @param command - The executed command.
+* @param toolResult - `payload.tool_result` (preferred), when present.
+* @param response - `payload.tool_response ?? payload.tool_output` fallback.
+* @param now - Clock.
+*/
+async function captureBashReceipt(file, tool, command, toolResult, response, now) {
+	if (tool !== "Bash" || !command) return;
+	const r = toolResult ?? response;
+	if (!r || typeof r !== "object") return;
+	const out = `${typeof r.stdout === "string" ? r.stdout : ""}\n${typeof r.stderr === "string" ? r.stderr : ""}`;
+	const exit = Number(r.exit_code ?? 0);
+	await captureReceipt(file, command, out, Number.isFinite(exit) ? exit : 0, now);
 }
 //#endregion
 //#region src/tracking/codex-post-failure.ts
@@ -8429,12 +8931,7 @@ async function handlePost(ctx) {
 	const evidence = classifyAgentEvidence(event.tool, event.input, response);
 	if (evidence) await recordAgentEvidence(file, evidence, opts.now, typeof payload.agent_id === "string" ? payload.agent_id : void 0);
 	await recordCodexSpawnEvidence(file, id, event.tool, event.input, opts.now);
-	if (event.tool === "Bash" && event.command) {
-		const r = payload.tool_result ?? response;
-		const out = `${typeof r?.stdout === "string" ? r.stdout : ""}\n${typeof r?.stderr === "string" ? r.stderr : ""}`;
-		const exit = Number(r?.exit_code ?? 0);
-		await captureReceipt(file, event.command, out, Number.isFinite(exit) ? exit : 0, opts.now);
-	}
+	await captureBashReceipt(file, event.tool, event.command, payload.tool_result, response, opts.now);
 	if (id === "codex") recordCodexPostFailure(event.tool, payload.tool_result ?? response, {
 		now: opts.now,
 		dir: defaultStateDir(opts.cwd),
@@ -8511,6 +9008,10 @@ async function handlePost(ctx) {
 		stdout: attachSystemMessage(extra, userMessage),
 		exit: 0
 	};
+	if (id === "kimi") return {
+		stdout: respond(id, withUserMessage, "PostToolUse"),
+		exit: 0
+	};
 	return {
 		stdout: respond(id, withUserMessage, "PostToolUse") || extra,
 		exit: 0
@@ -8960,7 +9461,7 @@ async function handleHook(id, payload, opts) {
 	};
 	const userPrompt = typeof payload.prompt === "string" ? payload.prompt : void 0;
 	if (userPrompt !== void 0) {
-		await saveTrack(file, recordBrainstormRequired(await loadTrack(file), detectCreationIntent(userPrompt)));
+		await withTrack(file, (track) => recordBrainstormRequired(track, detectCreationIntent(userPrompt)));
 		return {
 			stdout: promptSubmitContext(userPrompt, opts.cwd, id),
 			exit: 0