@gajae-code/coding-agent 0.10.2 → 0.11.1

package/src/gjc-runtime/team-runtime.ts

@@ -2,7 +2,7 @@ import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getWorktreesDir } from "@gajae-code/utils/dirs";
-import { SPAWN_PROVENANCE_ENV } from "../notifications/config";
+import { SPAWN_PROVENANCE_ENV } from "../sdk/bus/config";
 import type { WorkflowHudSummary } from "../skill-state/active-state";
 import { buildTeamHudSummary as buildWorkflowTeamHudSummary } from "../skill-state/workflow-hud";
 import { WORKFLOW_STATE_VERSION } from "../skill-state/workflow-state-contract";
@@ -208,7 +208,7 @@ export type GjcTeamNotificationDeliveryState =
 	| "acknowledged";
 
 export type GjcTeamPaneAttemptResult = "sent" | "queued" | "deferred" | "failed";
-export type GjcTeamMailboxDeliveryTransportKind = "notifications_sdk" | "pane";
+export type GjcTeamMailboxDeliveryTransportKind = "sdk" | "pane";
 
 export interface GjcTeamNotification {
 	id: string;
@@ -235,7 +235,7 @@ export interface GjcTeamMailboxDeliveryInput {
 	env: NodeJS.ProcessEnv;
 }
 export type GjcTeamMailboxDeliveryResult =
-	| { transport: "notifications_sdk"; state: GjcTeamNotificationDeliveryState; reason?: string }
+	| { transport: "sdk"; state: GjcTeamNotificationDeliveryState; reason?: string }
 	| { transport: "pane"; state: GjcTeamPaneAttemptResult; reason?: string };
 export interface GjcTeamMailboxDeliveryTransport {
 	deliverMailboxMessage(input: GjcTeamMailboxDeliveryInput): Promise<GjcTeamMailboxDeliveryResult | null>;
@@ -1995,25 +1995,32 @@ function readCurrentTmuxLeaderContext(tmuxCommand: string, env: NodeJS.ProcessEn
 	}
 	return { sessionName, windowIndex, leaderPaneId, target: `${sessionName}:${windowIndex}` };
 }
-type CommandPathResolver = (command: string) => string | null;
-
 function isBunVirtualPath(candidate: string | undefined): boolean {
-	const normalized = candidate?.trim().replace(/\\/g, "/");
-	return normalized === "/$bunfs" || normalized?.startsWith("/$bunfs/") === true;
+	const normalized = candidate?.trim().replace(/\\/g, "/").toLowerCase();
+	return (
+		normalized === "/$bunfs" ||
+		normalized?.startsWith("/$bunfs/") === true ||
+		normalized === "b:/~bun" ||
+		normalized?.startsWith("b:/~bun/") === true
+	);
 }
 
-function resolveFallbackGjcWorkerCommand(
-	platform: NodeJS.Platform,
-	execPath: string,
-	which: CommandPathResolver,
-): string {
-	const pathModule = platform === "win32" ? path.win32 : path;
-	const quote = platform === "win32" ? powershellQuote : shellQuote;
-	const executable = execPath.trim();
-	if (executable && !isBunVirtualPath(executable) && pathModule.isAbsolute(executable)) return quote(executable);
-	const gjcPath = which("gjc")?.trim();
-	if (gjcPath && !isBunVirtualPath(gjcPath)) return quote(gjcPath);
-	return "gjc";
+function isAbsoluteRealPath(candidate: string | undefined, pathModule: typeof path): candidate is string {
+	const normalized = candidate?.trim();
+	return Boolean(normalized && !isBunVirtualPath(normalized) && pathModule.isAbsolute(normalized));
+}
+function isGjcExecutablePath(candidate: string | undefined, pathModule: typeof path): candidate is string {
+	return isAbsoluteRealPath(candidate, pathModule) && /^gjc(?:[._-]|$)/i.test(pathModule.basename(candidate.trim()));
+}
+
+function formatWorkerExecutable(platform: NodeJS.Platform, executable: string): string {
+	return (platform === "win32" ? powershellQuote : shellQuote)(executable);
+}
+
+function unresolvedWorkerAuthorityError(): Error {
+	return new Error(
+		"Unable to determine the GJC worker executable from this invocation. Set GJC_TEAM_WORKER_COMMAND to the exact GJC command, or launch GJC from a real executable path instead of a Bun virtual path.",
+	);
 }
 
 export function resolveGjcWorkerCommand(
@@ -2022,24 +2029,36 @@ export function resolveGjcWorkerCommand(
 	platform: NodeJS.Platform = process.platform,
 	argv: string[] = process.argv,
 	execPath = process.execPath,
-	which: CommandPathResolver = Bun.which,
 ): string {
 	const explicit = env.GJC_TEAM_WORKER_COMMAND?.trim();
-	if (explicit) return explicit;
-	const entrypoint = argv[1];
-	if (isBunVirtualPath(entrypoint)) return resolveFallbackGjcWorkerCommand(platform, execPath, which);
-	if (!entrypoint) return "gjc";
-	const pathModule = platform === "win32" ? path.win32 : path;
-	const resolvedEntrypoint = pathModule.isAbsolute(entrypoint) ? entrypoint : pathModule.resolve(cwd, entrypoint);
-	if (platform === "win32") {
-		if (entrypoint.endsWith(".ts") || entrypoint.endsWith(".js") || entrypoint.endsWith(".mjs"))
-			return `${powershellQuote(execPath)} ${powershellQuote(resolvedEntrypoint)}`;
-		if (pathModule.basename(entrypoint).startsWith("gjc")) return powershellQuote(resolvedEntrypoint);
-		return "gjc";
+	if (explicit) {
+		if (isBunVirtualPath(explicit)) throw unresolvedWorkerAuthorityError();
+		return explicit;
+	}
+
+	const pathModule = platform === "win32" ? path.win32 : path.posix;
+	const runtime = argv[0]?.trim();
+	const entrypoint = argv[1]?.trim();
+	const sourceEntrypoint = entrypoint && !isBunVirtualPath(entrypoint) && /\.(?:[cm]?[jt]s)$/i.test(entrypoint);
+
+	if (sourceEntrypoint) {
+		const sourceRuntime = isAbsoluteRealPath(runtime, pathModule)
+			? runtime
+			: isAbsoluteRealPath(execPath, pathModule)
+				? execPath.trim()
+				: undefined;
+		if (!sourceRuntime) throw unresolvedWorkerAuthorityError();
+		const absoluteEntrypoint = pathModule.isAbsolute(entrypoint) ? entrypoint : pathModule.resolve(cwd, entrypoint);
+		if (!isAbsoluteRealPath(absoluteEntrypoint, pathModule)) throw unresolvedWorkerAuthorityError();
+		return `${formatWorkerExecutable(platform, sourceRuntime)} ${formatWorkerExecutable(platform, absoluteEntrypoint)}`;
 	}
-	if (entrypoint.endsWith(".ts")) return `${shellQuote(execPath)} ${shellQuote(resolvedEntrypoint)}`;
-	if (path.basename(entrypoint).startsWith("gjc")) return shellQuote(path.resolve(cwd, entrypoint));
-	return "gjc";
+
+	const executable =
+		(isGjcExecutablePath(entrypoint, pathModule) ? entrypoint : undefined) ??
+		(isGjcExecutablePath(execPath, pathModule) ? execPath.trim() : undefined) ??
+		(isGjcExecutablePath(runtime, pathModule) ? runtime : undefined);
+	if (!executable) throw unresolvedWorkerAuthorityError();
+	return formatWorkerExecutable(platform, executable);
 }
 /** @internal Exported for unit tests. */
 export function buildWorkerCommand(
@@ -4010,7 +4029,7 @@ async function attemptConfiguredMailboxTransport(
 			env,
 		});
 		if (!result) return null;
-		if (result.transport === "notifications_sdk" && result.state === "failed") return null;
+		if (result.transport === "sdk" && result.state === "failed") return null;
 		return writeNotificationRecord(dir, {
 			...notification,
 			delivery_state: result.state,

package/src/gjc-runtime/tmux-owner-isolation-cli.ts

@@ -53,27 +53,63 @@ function isKnownNoServerDiagnostic(stderr: string): boolean {
 	);
 }
 
-async function tmuxServerProof(socketKey: string, tmuxControlArgv?: string[]): Promise<TmuxServerProof> {
-	void socketKey;
-	if (!tmuxControlArgv?.length) return { state: "unverifiable" };
-	const controlArgv = tmuxControlArgv;
+interface TmuxListSessionsResult {
+	exitCode: number | null;
+	stdout: string;
+	stderr: string;
+}
+
+interface TmuxServerProofOptions {
+	platform?: NodeJS.Platform;
+	runListSessions?: (argv: string[]) => TmuxListSessionsResult;
+}
+
+function runTmuxListSessions(controlArgv: string[]): TmuxListSessionsResult {
 	const subprocess = Bun.spawnSync([...controlArgv, "list-sessions", "-F", "#{pid}\t#{session_name}"], {
 		stdout: "pipe",
 		stderr: "pipe",
 	});
-	const stderr = Buffer.from(subprocess.stderr).toString();
+	return {
+		exitCode: subprocess.exitCode,
+		stdout: Buffer.from(subprocess.stdout).toString(),
+		stderr: Buffer.from(subprocess.stderr).toString(),
+	};
+}
+
+function parseTmuxSessionRows(stdout: string): { pid: number; sessionNames: string[] } | null {
+	const lines = stdout.split("\n");
+	if (lines[lines.length - 1] === "") lines.pop();
+	let pid: number | undefined;
+	const sessionNames: string[] = [];
+	for (const rawLine of lines) {
+		const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+		const columns = line.split("\t");
+		if (columns.length !== 2 || !/^[1-9]\d*$/.test(columns[0]) || !columns[1].trim()) return null;
+		const rowPid = Number(columns[0]);
+		if (!Number.isSafeInteger(rowPid) || (pid !== undefined && pid !== rowPid)) return null;
+		pid = rowPid;
+		sessionNames.push(columns[1]);
+	}
+	return pid === undefined ? null : { pid, sessionNames };
+}
+
+/** Probes a tmux server using an injectable list-sessions runner for platform-bounded callers. */
+export async function tmuxServerProof(
+	socketKey: string,
+	tmuxControlArgv?: string[],
+	options: TmuxServerProofOptions = {},
+): Promise<TmuxServerProof> {
+	void socketKey;
+	if (!tmuxControlArgv?.length) return { state: "unverifiable" };
+	const platform = options.platform ?? process.platform;
+	const subprocess = options.runListSessions?.(tmuxControlArgv) ?? runTmuxListSessions(tmuxControlArgv);
 	if (subprocess.exitCode !== 0)
-		return isKnownNoServerDiagnostic(stderr) ? { state: "absent" } : { state: "unverifiable" };
-	const lines = Buffer.from(subprocess.stdout)
-		.toString()
-		.split("\n")
-		.map(line => line.trim())
-		.filter(Boolean);
-	const [pidText] = lines[0]?.split("\t") ?? [];
-	const pid = Number(pidText);
-	const sessionNames = lines.map(line => line.split("\t")[1]).filter((name): name is string => Boolean(name));
-	if (!Number.isSafeInteger(pid) || pid <= 0) return { state: "unverifiable" };
-	if (process.platform !== "linux") {
+		return isKnownNoServerDiagnostic(subprocess.stderr) ? { state: "absent" } : { state: "unverifiable" };
+	if (!subprocess.stdout.trim()) return { state: "absent" };
+	const rows = parseTmuxSessionRows(subprocess.stdout);
+	if (!rows) return { state: "unverifiable" };
+	const { pid, sessionNames } = rows;
+	if (platform !== "linux") {
 		return {
 			state: "safe",
 			pid,
@@ -82,7 +118,7 @@ async function tmuxServerProof(socketKey: string, tmuxControlArgv?: string[]): P
 			sessionNames,
 		};
 	}
-	const cgroup = classifyCgroup({ platform: process.platform, cgroupText: await readCgroup(String(pid)) });
+	const cgroup = classifyCgroup({ platform, cgroupText: await readCgroup(String(pid)) });
 	const startTime = await readProcessStartTime(pid);
 	if (!startTime) return { state: "unverifiable", pid, cgroup, sessionNames };
 	return {

package/src/gjc-runtime/tmux-owner-isolation.ts

@@ -1524,7 +1524,7 @@ export function isValidOwnerIntent(intent: unknown, request?: ObserveTerminalReq
 		intent.generation === request.owner_generation &&
 		intent.session_id === request.session_id &&
 		intent.server_key === request.socket_key &&
-		intent.dispatch_id === request.operator_dispatch_id &&
+		(request.operator_dispatch_id === undefined || intent.dispatch_id === request.operator_dispatch_id) &&
 		request.signal === "SIGTERM"
 	);
 }

package/src/gjc-runtime/tmux-sessions.ts

@@ -49,6 +49,7 @@ import {
 	type TmuxOwnerIsolationExecutionResult,
 	type TmuxServerProof,
 } from "./tmux-owner-isolation";
+import { buildWindowsPowerShellInnerCommand } from "./windows-powershell-command";
 
 export interface GjcTmuxSessionStatus {
 	name: string;
@@ -128,6 +129,10 @@ export interface ForceCloseOwnerDependencies {
 const FORCE_CLOSE_VERDICT_TIMEOUT_MS = 5_000;
 const FORCE_CLOSE_VERDICT_POLL_MS = 50;
 
+export interface CreateGjcTmuxSessionOptions {
+	platform?: NodeJS.Platform;
+}
+
 export type CreateOwnerIsolationTestDependencies = {
 	probe?: Partial<OwnerIsolationProbeSync>;
 	execute?: (plan: PlanResponse, deps: TmuxOwnerIsolationExecutionDependencies) => TmuxOwnerIsolationExecutionResult;
@@ -354,15 +359,19 @@ export function statusGjcTmuxSession(sessionName: string, env: NodeJS.ProcessEnv
 	throw new Error(`gjc_tmux_session_not_found:${sessionName}`);
 }
 
-export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcTmuxSessionStatus {
-	const tmuxCommand = resolveGjcTmuxCommand(env);
+export function createGjcTmuxSession(
+	env: NodeJS.ProcessEnv = process.env,
+	options: CreateGjcTmuxSessionOptions = {},
+): GjcTmuxSessionStatus {
+	const platform = options.platform ?? process.platform;
+	const tmuxCommand = resolveGjcTmuxCommand(env, platform);
 	const sessionName = buildGjcTmuxSessionName(env);
 	const cwd = process.cwd();
 	const sessionId = env[GJC_COORDINATOR_SESSION_ID_ENV]?.trim() || sessionName;
 	const stateFile =
 		env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]?.trim() ||
 		tmuxRuntimeSessionPath(cwd, env.GJC_SESSION_ID?.trim() || sessionId, buildGjcTmuxSessionSlug(sessionName));
-	const stateDir = path.dirname(stateFile);
+	const stateDir = (platform === "win32" ? path.win32 : path).dirname(stateFile);
 	const generation = crypto.randomUUID();
 	const childEnvironment: Record<string, string> = {
 		GJC_TMUX_LAUNCHED: "1",
@@ -373,12 +382,9 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 		[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]: stateFile,
 	};
 	const shellQuote = (value: string): string => `'${value.replace(/'/g, `'\\''`)}'`;
-	const powershellQuote = (value: string): string => `'${value.replace(/'/g, "''")}'`;
 	const command =
-		process.platform === "win32"
-			? `${Object.entries(childEnvironment)
-					.map(([name, value]) => `$env:${name} = ${powershellQuote(value)}`)
-					.join("; ")}; gjc`
+		platform === "win32"
+			? buildWindowsPowerShellInnerCommand({ command: ["gjc"], environment: childEnvironment })
 			: `exec env ${Object.entries(childEnvironment)
 					.map(([name, value]) => `${name}=${shellQuote(value)}`)
 					.join(" ")} gjc`;
@@ -388,11 +394,11 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 		"-d",
 		"-s",
 		sessionName,
-		...(process.platform === "win32" ? [] : ["-P", "-F", "#{session_id}"]),
+		...(platform === "win32" ? [] : ["-P", "-F", "#{session_id}"]),
 		command,
 	];
 	function probeTmuxServer(tmuxCommand: string, env: NodeJS.ProcessEnv): TmuxServerProof {
-		if (process.platform !== "linux") {
+		if (platform !== "linux") {
 			return {
 				state: "safe",
 				pid: 1,
@@ -421,7 +427,7 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 				.split(/\s+/)[19];
 			if (!startTime) return { state: "unverifiable" };
 			const cgroup = classifyCgroup({
-				platform: process.platform,
+				platform,
 				cgroupText: fsSync.readFileSync(`/proc/${pid}/cgroup`, "utf8"),
 			});
 			return {
@@ -484,7 +490,7 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 				}
 			}),
 	};
-	if (resolveGjcTmuxBinary({ env }).isPsmux)
+	if (resolveGjcTmuxBinary({ env, platform }).isPsmux)
 		throw new Error("gjc_tmux_owner_isolation_native_session_identity_unavailable");
 
 	const baseline = captureOwnerGenerationBaselineSync(stateDir, sessionId);
@@ -492,7 +498,7 @@ export function createGjcTmuxSession(env: NodeJS.ProcessEnv = process.env): GjcT
 		{
 			schema_version: 1,
 			op: "plan",
-			platform: process.platform,
+			platform,
 			session_id: sessionId,
 			owner_generation: generation,
 			baseline,

package/src/gjc-runtime/ultragoal-guard.ts

@@ -1,7 +1,11 @@
 import * as fs from "node:fs/promises";
 import { DEFAULT_ULTRAGOAL_OBJECTIVE } from "./goal-mode-request";
 import { resolveGjcSessionForRead, SessionResolutionError } from "./session-resolution";
-import { validateDeferredMemberReceiptFresh, validateReceiptFreshBase } from "./ultragoal-receipt-freshness";
+import {
+	validateDeferredMemberReceiptFresh,
+	validateReceiptFreshBase,
+	validateSupersededFinalAggregateReceipt,
+} from "./ultragoal-receipt-freshness";
 import {
 	getUltragoalPaths,
 	getUltragoalRunCompletionState,
@@ -156,8 +160,33 @@ function requiredGoals(plan: UltragoalPlan): UltragoalGoal[] {
 	return plan.goals.filter(goal => goal.status !== "superseded");
 }
 
+/**
+ * Select the goal whose final-aggregate receipt should represent the run.
+ * Prefer a receipt that still validates fresh; several goals can hold
+ * final-aggregate receipts once plan growth (e.g. `steer add_subgoal`) stales
+ * an earlier one and a later checkpoint re-mints. Fall back to the newest
+ * holder (array-last) purely for diagnostics when none validates.
+ */
+function findFinalAggregateReceiptGoal(
+	plan: UltragoalPlan,
+	ledger: readonly UltragoalLedgerEvent[],
+): UltragoalGoal | null {
+	const candidates = [...requiredGoals(plan)]
+		.reverse()
+		.filter(goal => goal.completionVerification?.receiptKind === "final-aggregate");
+	if (candidates.length === 0) return null;
+	return (
+		candidates.find(
+			goal =>
+				validateCompletionReceipt({ plan, ledger, goal, receiptKind: "final-aggregate" }).state ===
+				"active_verified_complete",
+		) ?? candidates[0]!
+	);
+}
+
 function findReceiptGoal(
 	plan: UltragoalPlan,
+	ledger: readonly UltragoalLedgerEvent[],
 	currentObjective: string,
 ): { goal: UltragoalGoal; receiptKind: UltragoalReceiptKind } | null {
 	if (
@@ -165,15 +194,46 @@ function findReceiptGoal(
 		currentObjective === DEFAULT_ULTRAGOAL_OBJECTIVE ||
 		plan.gjcObjectiveAliases?.some(alias => alias === currentObjective)
 	) {
-		const finalGoal = [...requiredGoals(plan)]
-			.reverse()
-			.find(goal => goal.completionVerification?.receiptKind === "final-aggregate");
+		const finalGoal = findFinalAggregateReceiptGoal(plan, ledger);
 		return finalGoal ? { goal: finalGoal, receiptKind: "final-aggregate" } : null;
 	}
 	const storyGoal = plan.goals.find(goal => goal.objective === currentObjective);
 	return storyGoal ? { goal: storyGoal, receiptKind: "per-goal" } : null;
 }
 
+/**
+ * A review-blocker replacement can stand in for a superseded validation-batch
+ * final only while validating the run's final aggregate receipt. Ordinary
+ * per-goal validation continues to require the original batch-close receipt.
+ */
+function hasFreshReviewedBatchFinalReplacement(input: {
+	plan: UltragoalPlan;
+	ledger: readonly UltragoalLedgerEvent[];
+	deferredGoal: UltragoalGoal;
+}): boolean {
+	const finalGoalId = input.deferredGoal.completionVerification?.validationBatch?.finalGoalId;
+	const finalGoal = finalGoalId ? input.plan.goals.find(goal => goal.id === finalGoalId) : undefined;
+	if (finalGoal?.status !== "superseded") return false;
+	const replacements = input.plan.goals.filter(
+		goal =>
+			goal.status === "complete" &&
+			goal.steering?.kind === "review_blocker" &&
+			goal.steering.blockedGoalId === finalGoal.id,
+	);
+	if (replacements.length !== 1) return false;
+	const replacement = replacements[0]!;
+	const receipt = replacement.completionVerification;
+	if (receipt?.receiptKind !== "per-goal") return false;
+	return (
+		validateCompletionReceipt({
+			plan: input.plan,
+			ledger: input.ledger,
+			goal: replacement,
+			receiptKind: "per-goal",
+		}).state === "active_verified_complete"
+	);
+}
+
 export function validateCompletionReceipt(input: {
 	plan: UltragoalPlan;
 	ledger: readonly UltragoalLedgerEvent[];
@@ -267,12 +327,48 @@ export function validateCompletionReceipt(input: {
 					goalId: input.goal.id,
 				};
 			}
-			const priorDiagnostic = validateCompletionReceipt({
-				plan: input.plan,
-				ledger: input.ledger,
-				goal: priorGoal,
-				receiptKind: "per-goal",
-			});
+			if (
+				priorGoal.completionVerification.validationBatch?.role !== "deferred-member" &&
+				priorGoal.completionVerification.receiptKind === "final-aggregate"
+			) {
+				// A prior goal may hold the run's previous final-aggregate receipt
+				// when plan growth staled it and a later checkpoint re-minted the
+				// aggregate receipt. Accept it as historical evidence for its own
+				// goal instead of demanding an impossible per-goal receipt.
+				const supersededDiagnostic = validateSupersededFinalAggregateReceipt({
+					ledger: input.ledger,
+					goal: priorGoal,
+					receipt: priorGoal.completionVerification,
+				});
+				if (supersededDiagnostic) {
+					return {
+						state: supersededDiagnostic.state,
+						message: `Ultragoal final receipt requires valid historical evidence for ${priorGoal.id}: ${supersededDiagnostic.message}`,
+						goalId: input.goal.id,
+					};
+				}
+				continue;
+			}
+			const priorDiagnostic =
+				priorGoal.completionVerification.validationBatch?.role === "deferred-member"
+					? validateDeferredMemberReceiptFresh({
+							plan: input.plan,
+							ledger: input.ledger,
+							goal: priorGoal,
+							receipt: priorGoal.completionVerification,
+							receiptKind: "per-goal",
+							requireClose: !hasFreshReviewedBatchFinalReplacement({
+								plan: input.plan,
+								ledger: input.ledger,
+								deferredGoal: priorGoal,
+							}),
+						})
+					: validateCompletionReceipt({
+							plan: input.plan,
+							ledger: input.ledger,
+							goal: priorGoal,
+							receiptKind: "per-goal",
+						});
 			if (priorDiagnostic.state !== "active_verified_complete") {
 				return {
 					state: priorDiagnostic.state,
@@ -334,7 +430,7 @@ export async function readUltragoalVerificationState(input: {
 			message: "Ultragoal has blocked or failed goals; record blockers or rerun verification.",
 		};
 	}
-	const receiptTarget = findReceiptGoal(plan, currentObjective);
+	const receiptTarget = findReceiptGoal(plan, ledger, currentObjective);
 	if (!receiptTarget) {
 		// When earlier required goals are already complete but later ones remain, name the
 		// specific blocking goals (a final-aggregate receipt cannot exist yet anyway). Only
@@ -576,9 +672,7 @@ export async function isUltragoalAskBlocked(
 		});
 	}
 
-	const finalReceiptGoal = [...requiredGoals(plan)]
-		.reverse()
-		.find(goal => goal.completionVerification?.receiptKind === "final-aggregate");
+	const finalReceiptGoal = findFinalAggregateReceiptGoal(plan, ledger);
 	if (!finalReceiptGoal) {
 		return activeAskDiagnostic({
 			reason: "Ultragoal aggregate completion is missing a final aggregate receipt.",

package/src/gjc-runtime/ultragoal-receipt-freshness.ts

@@ -244,6 +244,93 @@ export function validateReceiptFreshBase(input: {
 	return null;
 }
 
+/**
+ * Validate a receipt whose plan-generation freshness was legitimately staled
+ * by later plan growth as a historical attestation for its own goal:
+ * internally consistent, anchored to a ledger checkpoint event that carries a
+ * byte-identical receipt, quality gate untampered, and the goal row untouched
+ * since verification. Plan-generation freshness against the CURRENT plan is
+ * intentionally not required; that is exactly what later plan growth
+ * invalidates by design. Returns null when the receipt stands as valid
+ * historical evidence.
+ */
+function validateLedgerAnchoredHistoricalReceipt(input: {
+	ledger: readonly UltragoalLedgerEvent[];
+	goal: UltragoalGoal;
+	receipt: UltragoalCompletionVerification;
+	label: string;
+}): UltragoalReceiptFreshnessDiagnostic | null {
+	if (
+		input.receipt.schemaVersion !== 1 ||
+		input.receipt.goalId !== input.goal.id ||
+		!input.receipt.planGeneration ||
+		!input.receipt.checkpointLedgerEventId ||
+		hashStructuredValue(input.receipt.basis) !== input.receipt.planGeneration
+	) {
+		return {
+			state: "active_stale_receipt",
+			message: `Ultragoal ${input.goal.id} ${input.label} is malformed.`,
+			goalId: input.goal.id,
+		};
+	}
+	const event = findLedgerReceiptEvent(input.ledger, input.receipt);
+	if (!event)
+		return {
+			state: "active_stale_receipt",
+			message: `Ultragoal ${input.goal.id} ${input.label} ledger event is missing.`,
+			goalId: input.goal.id,
+		};
+	// Bind the goals.json receipt to the FULL receipt recorded on the ledger
+	// event. Field-selective matching would accept a coordinated edit of the
+	// goals-row basis/generation paired with only the event generation.
+	const eventReceipt = event.completionVerification as UltragoalCompletionVerification | undefined;
+	if (!eventReceipt || hashStructuredValue(eventReceipt) !== hashStructuredValue(input.receipt))
+		return {
+			state: "active_stale_receipt",
+			message: `Ultragoal ${input.goal.id} ${input.label} does not match its ledger event receipt.`,
+			goalId: input.goal.id,
+		};
+	if (hashStructuredValue(event.qualityGateJson) !== input.receipt.qualityGateHash)
+		return {
+			state: "active_dirty_quality_gate",
+			message: `Ultragoal ${input.goal.id} ${input.label} quality-gate hash does not match ledger.`,
+			goalId: input.goal.id,
+		};
+	if (input.goal.updatedAt !== input.receipt.verifiedAt)
+		return {
+			state: "active_stale_receipt",
+			message: `Ultragoal ${input.goal.id} changed after its ${input.label} was verified.`,
+			goalId: input.goal.id,
+		};
+	return null;
+}
+
+/**
+ * Validate a final-aggregate receipt that was legitimately superseded — its
+ * aggregate claim staled by later plan growth (e.g. `steer add_subgoal`
+ * appending goals after a terminal run) — as historical evidence for its own
+ * goal. Returns null when the receipt stands.
+ */
+export function validateSupersededFinalAggregateReceipt(input: {
+	ledger: readonly UltragoalLedgerEvent[];
+	goal: UltragoalGoal;
+	receipt: UltragoalCompletionVerification;
+}): UltragoalReceiptFreshnessDiagnostic | null {
+	if (input.receipt.receiptKind !== "final-aggregate") {
+		return {
+			state: "active_stale_receipt",
+			message: `Ultragoal ${input.goal.id} superseded final-aggregate receipt is malformed.`,
+			goalId: input.goal.id,
+		};
+	}
+	return validateLedgerAnchoredHistoricalReceipt({
+		ledger: input.ledger,
+		goal: input.goal,
+		receipt: input.receipt,
+		label: "superseded final-aggregate receipt",
+	});
+}
+
 export function findFreshBatchCloseReceipt(input: {
 	plan: UltragoalPlan;
 	ledger: readonly UltragoalLedgerEvent[];
@@ -267,7 +354,21 @@ export function findFreshBatchCloseReceipt(input: {
 		receipt: finalReceipt,
 		receiptKind: finalReceipt.receiptKind,
 	});
-	return diagnostic ? null : finalReceipt;
+	if (!diagnostic) return finalReceipt;
+	// A batch close staled only by later plan growth (e.g. `steer add_subgoal`
+	// after the batch completed) still proves the batch was validly closed:
+	// the member receipts are freshness-checked separately, the close is
+	// anchored to its ledger event, and the final goal's row is untouched.
+	// Without this, completing a goal appended after a closed batch can never
+	// validate, because the old close can never be fresh against the grown
+	// plan and identical-evidence replays of fresh receipts are no-ops.
+	const historicalDiagnostic = validateLedgerAnchoredHistoricalReceipt({
+		ledger: input.ledger,
+		goal: finalGoal,
+		receipt: finalReceipt,
+		label: "superseded batch-close receipt",
+	});
+	return historicalDiagnostic ? null : finalReceipt;
 }
 
 export function validateDeferredMemberReceiptFresh(input: {