@gcunharodrigues/wrxn 0.15.0 → 0.17.0

package/lib/install.cjs

@@ -99,6 +99,9 @@ function init(opts) {
   // the memory-synth writes one outcome line per synth run to `.wrxn/continuity/.synth.log` (synth-handoff-fix-01)
   // — install runtime state (never shipped in the payload), so keep it out of version control.
   ensureGitignoreLine(target, '.wrxn/continuity/.synth.log');
+  // memory-synth-spawn claims each session with a persistent `.wrxn/continuity/.spawned-<id>` marker (#45) —
+  // install runtime state (never shipped), so keep the family out of version control like the synth log.
+  ensureGitignoreLine(target, '.wrxn/continuity/.spawned-*');
   // the memory-synth gemini fallback reads GEMINI_API_KEY from `.env` — ignore it so the secret is
   // never committed (the synth's doc-comment calls it the install's gitignored `.env`).
   ensureGitignoreLine(target, '.env');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gcunharodrigues/wrxn",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "WRXN Kernel — installable AI operating system. Two profiles (project | workspace), pull-based updates, managed/seeded/state file classes.",
   "bin": {
     "wrxn": "bin/wrxn.cjs"

package/payload/.claude/hooks/memory-synth-spawn.cjs

@@ -25,6 +25,19 @@ const { spawn } = require('child_process');
 
 const SENTINEL = 'WRXN_MEMORY_SYNTH'; // recursion guard (mirrors memory-synth.cjs's SENTINEL).
 
+// safeId — canonicalize a session id used as a FILESYSTEM PATH component (#45): lowercase, collapse every
+// non-alnum run to '-', trim, cap length. A raw session id concatenated into a path is a traversal surface;
+// this keeps the once-per-session marker INSIDE .wrxn/continuity. REPLICATED byte-identically from
+// session-start.cjs (and code-intel-push / the reward shell) — each install-only hook is self-contained
+// (node stdlib only, no shared import).
+function safeId(sid) {
+  return String(sid || 'session')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 48) || 'session';
+}
+
 function findInstallRoot(startDir) {
   let dir = startDir || process.env.CLAUDE_PROJECT_DIR || process.cwd();
   for (let i = 0; i < 12; i++) {
@@ -52,6 +65,19 @@ function run({ payload, root, env = process.env, spawn: spawnFn = spawn }) {
     const dir = path.join(root, '.wrxn', 'continuity');
     fs.mkdirSync(dir, { recursive: true });
 
+    // Once-per-session claim (#45): the harness fires SessionEnd more than once per session, so an
+    // unguarded hook launches N synths that race on one shared `.pending`. CLAIM the session ATOMICALLY
+    // with an exclusive create (`wx` throws EEXIST if the marker exists) BEFORE staging markers / spawning:
+    // the FIRST fire creates the marker and proceeds; every later fire for the same session throws → the
+    // outer catch returns {} (spawns nothing, writes no markers). Race-safe across the separate hook
+    // processes (no TOCTOU). The marker is a PERSISTENT per-session file — it must OUTLIVE the synth, so it
+    // is NOT `.pending`/`.pending-handoff` (which the synth clears on exit). A missing/empty session_id
+    // cannot be deduped → preserve today's spawn-every-time behavior for that path.
+    const sid = payload && payload.session_id;
+    if (sid) {
+      fs.closeSync(fs.openSync(path.join(dir, `.spawned-${safeId(sid)}`), 'wx'));
+    }
+
     // Stash the payload as .pending (the synth reads it for transcript_path) and raise the handoff gate.
     fs.writeFileSync(path.join(dir, '.pending'), JSON.stringify(payload || {}));
     fs.writeFileSync(path.join(dir, '.pending-handoff'), String(Date.now()));

package/payload/.claude/hooks/session-start.cjs

@@ -201,6 +201,126 @@ function holdForHandoff({ root, capMs = HOLD_CAP_MS, now = Date.now, sleep } = {
   }
 }
 
+// ── baton-staleness guard (#51) ─────────────────────────────────────────────────
+// The handoff baton is surfaced as the resume point with no health check, so a baton frozen by a failed
+// SessionEnd synth (no-engine / error) is shown as current — silently (real incident 2026-06-22→23: the
+// baton froze ~20h while .synth.log logged no-engine from later sessions). This guard reads the synth log +
+// the baton mtime and, when the latest synth attempt failed and it is NOT a same-session double-spawn (the
+// session that wrote the baton failing again right after — #45), surfaces a visible warning. The DECISION is
+// pure (no IO, no clock — the holdDecision idiom); the hook does the IO and formats the age where it holds
+// the clock. NO polling/sleeping — one file read + one stat.
+
+const SYNTH_LOG_REL = ['.wrxn', 'continuity', '.synth.log'];
+
+// sec-F2 (#52): cap the .synth.log read at its TAIL. The staleness decision needs only the NEWEST rows (+ the
+// latest `wrote`), which live at the END of this append-only log — so reading the last SYNTH_LOG_TAIL_BYTES
+// bounds memory against a pathologically large log without losing the signal. A partial first line (a row
+// sliced mid-way by the byte window) is dropped so parseSynthLog only ever sees complete rows. FAIL-OPEN +
+// total: a sub-cap log is read whole (unchanged); any stat/open/read fault → "" (no rows → no warning, no throw).
+const SYNTH_LOG_TAIL_BYTES = 64 * 1024;
+
+function readSynthLogTail(p) {
+  let fd;
+  try {
+    const size = fs.statSync(p).size;
+    if (size <= SYNTH_LOG_TAIL_BYTES) return readFileOr(p, '');
+    fd = fs.openSync(p, 'r');
+    const buf = Buffer.allocUnsafe(SYNTH_LOG_TAIL_BYTES);
+    const read = fs.readSync(fd, buf, 0, SYNTH_LOG_TAIL_BYTES, size - SYNTH_LOG_TAIL_BYTES);
+    const text = buf.toString('utf8', 0, read);
+    const nl = text.indexOf('\n');
+    return nl === -1 ? text : text.slice(nl + 1); // drop the partial first line sliced by the byte window
+  } catch {
+    return ''; // fail-open: any stat/open/read fault → no rows → no warning
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* fd already gone — never throw out of the cleanup */ }
+    }
+  }
+}
+
+// A synth row is a FAILURE iff its outcome is `no-engine` or an `error…` string (`wrote`/`trivial` = healthy).
+function isFailure(outcome) {
+  const o = String(outcome || '');
+  return o === 'no-engine' || /^error/.test(o);
+}
+
+// Parse the tab-separated synth log into chronological rows { timestampMs, sessionId, outcome }, dropping
+// any line we cannot resolve (malformed / unparseable timestamp) — "newest-resolvable last". The sessionId
+// (field 1, `-` when absent) is what discriminates a double-spawn from genuine rot. PURE + total, never throws.
+function parseSynthLog(text) {
+  const rows = [];
+  for (const line of String(text || '').split('\n')) {
+    if (!line.trim()) continue;
+    const f = line.split('\t');
+    if (f.length < 6) continue; // not a full outcome row → skip (fail-open)
+    const ts = Date.parse(f[0]);
+    if (!Number.isFinite(ts)) continue; // unresolvable timestamp → drop
+    rows.push({ timestampMs: ts, sessionId: f[1], outcome: f.slice(5).join('\t').trim() });
+  }
+  return rows;
+}
+
+// Human age for the warning line (computed where the clock is, so batonStaleness stays clock-free). PURE.
+function formatAge(ms) {
+  const m = Math.max(0, Math.round(Number(ms) / 60000));
+  if (m < 60) return `${m}m`;
+  const h = Math.floor(m / 60);
+  if (h < 24) return `${h}h`;
+  const d = Math.floor(h / 24);
+  const rem = h % 24;
+  return rem ? `${d}d ${rem}h` : `${d}d`;
+}
+
+// Sanitize the echoed synth outcome before it is interpolated into the orientation block (sec-F1). An
+// `error: …` row carries a FREE-FORM message, so a crafted/corrupt log row could smuggle control chars or a
+// forged `</wrxn-orientation>` close tag into additionalContext. Strip control chars (incl CR/LF/tab), drop
+// angle brackets so no tag can be forged, and cap the length. PURE + total. (Mirrors memory-synth's
+// sanitizeLogField idiom — each install-only hook is self-contained, node stdlib only.)
+function sanitizeOutcome(s) {
+  return String(s == null ? '' : s)
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x1f\x7f-\x9f]/g, '')
+    .replace(/[<>]/g, '')
+    .slice(0, 120);
+}
+
+/**
+ * Pure baton-staleness decision (#51). Given the baton's last-write time and the synth-log rows
+ * (chronological, newest-resolvable last, each carrying its sessionId), return the FAILING outcome to name
+ * in the warning, or null when the baton is healthy/fresh. Warn IFF the newest row failed (`no-engine` |
+ * `error…`) AND the baton predates that newest row AND it is NOT a same-session double-spawn.
+ *
+ * Double-spawn vs genuine-rot is discriminated by SESSION ID, NOT by timestamp. The session that wrote the
+ * CURRENT baton is the session of the MOST-RECENT `wrote` row (every successful synth logs a `wrote` row in
+ * runHandoff's finally, a few ms AFTER it set the baton mtime — so that row's timestamp is ALWAYS ≥ the baton
+ * mtime, and a timestamp test can never tell the two apart). The #45 double-spawn logs `wrote` then a spurious
+ * `no-engine` ~2s later under the SAME session → suppress. A genuine freeze has later failures from DIFFERENT
+ * sessions (real incident 2026-06-22→23: baton written by 6898c0a9, then 7b69b97c / 39e5754b no-engine hours
+ * later) → warn. A missing/`-` session id on either side cannot confirm a double-spawn → default to warn (a
+ * loud false-positive beats silent rot). PURE + total: no IO, no clock, never throws.
+ * @param {{ batonMtimeMs:number, rows:Array<{timestampMs:number, sessionId?:string, outcome:string}> }} [input]
+ * @returns {string|null} the failing outcome to name, or null when healthy
+ */
+function batonStaleness({ batonMtimeMs, rows } = {}) {
+  if (!Array.isArray(rows) || rows.length === 0) return null; // no rows → nothing to judge
+  if (typeof batonMtimeMs !== 'number' || !Number.isFinite(batonMtimeMs)) return null; // no usable mtime
+  const newest = rows[rows.length - 1];
+  if (!newest || !isFailure(newest.outcome)) return null; // latest run healthy → fresh
+  if (Number.isFinite(newest.timestampMs) && newest.timestampMs <= batonMtimeMs) return null; // baton at/after newest → fresh
+  // The session that wrote the CURRENT baton = the session of the most-recent `wrote` row.
+  let wroteSession;
+  for (const r of rows) {
+    if (r && r.outcome === 'wrote') wroteSession = r.sessionId;
+  }
+  const sameSession =
+    !!wroteSession && wroteSession !== '-' &&
+    !!newest.sessionId && newest.sessionId !== '-' &&
+    wroteSession === newest.sessionId;
+  if (sameSession) return null; // same-session double-spawn → not stale
+  return newest.outcome; // genuine rot (or unconfirmable) → name the failing outcome
+}
+
 function main() {
   let consumed = '';
   try {
@@ -241,6 +361,24 @@ function main() {
   const baton = readBaton(root);
   if (baton && baton.trim()) {
     parts.push('', 'Resume — deliberate handoff baton (.wrxn/continuity/latest.md):', baton.trim());
+    // #51: warn if the latest SessionEnd synth failed and no successful write has refreshed the baton since
+    // — a frozen baton must not be surfaced as current silently. Fail-open: any read/stat/parse fault → no
+    // warning, never a throw. Pure file reads + a stat only (no polling/sleeping beyond the hold cap above).
+    try {
+      const rows = parseSynthLog(readSynthLogTail(path.join(root, ...SYNTH_LOG_REL)));
+      const batonMtimeMs = fs.statSync(path.join(root, '.wrxn', 'continuity', 'latest.md')).mtimeMs;
+      const failing = batonStaleness({ batonMtimeMs, rows });
+      if (failing) {
+        const age = formatAge(Date.now() - batonMtimeMs);
+        const outcome = sanitizeOutcome(failing); // sec-F1: never echo a raw log field into the orientation
+        parts.push(
+          '',
+          `WARNING — stale handoff baton: the latest memory-synth run failed ("${outcome}") and the baton has not been refreshed for ${age}. It may not reflect the last session — see .wrxn/continuity/.synth.log.`,
+        );
+      }
+    } catch {
+      /* fail-open: a staleness-check fault must never block orientation (#51 AC3) */
+    }
   } else {
     parts.push('', 'Resume — no prior handoff.');
   }
@@ -261,4 +399,4 @@ if (require.main === module) {
   }
 }
 
-module.exports = { holdDecision, holdForHandoff, HOLD_CAP_MS, stampStartHead, resolveGitHead, BASELINE_DIR_REL };
+module.exports = { holdDecision, holdForHandoff, HOLD_CAP_MS, stampStartHead, resolveGitHead, BASELINE_DIR_REL, batonStaleness, parseSynthLog, readSynthLogTail, SYNTH_LOG_TAIL_BYTES };

package/payload/.wrxn/dream.cjs

@@ -390,7 +390,11 @@ const NEGATIVE_FILTERS = [
   // a transient environment / setup failure — not a durable property of the system. (The bare adjectives
   // `transient`/`intermittent` are intentionally NOT here: they false-positive on DI-lifetime decisions
   // like "services are registered transient" — the concrete error codes below carry the failure intent.)
-  { reason: 'negative_filter_transient_failure', re: /\b(econnrefused|enoent|eaddrinuse|etimedout|connection refused|connection reset|timed out|time-?out|flak(e|y|ey)|rate[- ]?limit(ed)?|http 5\d\d|50[234]|port (already )?in use|address already in use|network (error|issue|glitch)|dns (error|failure))\b/ },
+  // SAME discipline for rate-limiting: the bare noun "rate limit" / adjective "rate-limited" is NOT matched
+  // (it false-positives on rate limiting AS A FEATURE — a token-bucket decision, a "rate-limited tier").
+  // Only the ERROR sense matches: a passive/verb "got rate-limited", a transitive "rate-limited us", or a
+  // "rate-limit(ed) error" / "rate limit exceeded" cue — the transient war-story, never the design.
+  { reason: 'negative_filter_transient_failure', re: /\b(econnrefused|enoent|eaddrinuse|etimedout|connection refused|connection reset|timed out|time-?out|flak(e|y|ey)|(?:got|get|getting|gets|was|were|been|being|keeps?|kept|repeatedly) rate[- ]?limited|rate[- ]?limited (?:us|me|them|by|again)|rate[- ]?limit(?:ed|ing)? (?:error|errors|exceeded)|http 5\d\d|50[234]|port (already )?in use|address already in use|network (error|issue|glitch)|dns (error|failure))\b/ },
   // a smoke / sanity / happy-path RESULT — proves nothing durable. Gated on a result word so a forward
   // decision ("we adopt smoke tests", "the happy path must stay fast") is NOT a false positive.
   { reason: 'negative_filter_smoke_test', re: /\bhello[- ]?world\b|\b(smoke[- ]?tests?|sanity[- ]?checks?|happy path)\s+(pass(ed|es|ing)?|ran|run|succeed(ed|s)?|works?|worked|green)\b/ },

package/payload/.wrxn/memory-synth.cjs

@@ -242,9 +242,10 @@ function readTranscriptBlob(transcriptPath) {
 const CLAUDE_TIMEOUT_MS = 120000; // headless sonnet handoff/dream — generous but bounded.
 const GEMINI_TIMEOUT_MS = 30000; // mirrors the proven aimem `curl -m 30` fallback.
 const SENTINEL = 'WRXN_MEMORY_SYNTH'; // recursion guard: set on every engine spawn (the spawn hook no-ops when it sees it).
-// 1200 (vs the aimem reference's 900): the handoff prompt self-caps at ~400 words, so the extra
-// headroom is for the denser `dream` consolidation that shares this engine (lands in slice 04).
-const GEMINI_MAX_OUTPUT_TOKENS = 1200;
+// 4096 (vs the aimem reference's 900, and the prior 1200): a thinking-default model spends part of the
+// output budget on reasoning BEFORE the answer, and a rich `dream` consolidation runs ~4.3k chars — 1200
+// truncated even a non-thinking model on a dense session. 4096 fits the observed clean dream JSON (#30).
+const GEMINI_MAX_OUTPUT_TOKENS = 4096;
 
 /** Assemble the model input: the task system prompt, then the transcript blob (mirrors the reference). */
 function assemblePrompt(prompt, blob) {
@@ -270,8 +271,16 @@ function buildClaudeSpec({ model, prompt, blob }) {
  * Build the `gemini` engine spec: a POST to `…/v1beta/models/<model>:generateContent` with the
  * `x-goog-api-key` header, the task prompt as `system_instruction` and the blob as user content
  * (mirrors the proven aimem-handoff-synth call). PURE.
+ *
+ * `thinking` controls the `generationConfig.thinkingConfig` directive (#30): when true (default) the spec
+ * carries `{ thinkingBudget: 0 }`, which DISABLES model-side thinking on thinking-default models (a verified
+ * HTTP-200 no-op on non-thinking models) so reasoning tokens never consume the output budget and the answer
+ * is never split into a dropped `thought` part. Pass `false` to OMIT the directive — the AC3 retry path for
+ * forced-thinking models (gemma-class) that reject thinkingConfig with an HTTP 400.
  */
-function buildGeminiSpec({ model, prompt, blob, apiKey }) {
+function buildGeminiSpec({ model, prompt, blob, apiKey, thinking = true }) {
+  const generationConfig = { temperature: 0.2, maxOutputTokens: GEMINI_MAX_OUTPUT_TOKENS };
+  if (thinking) generationConfig.thinkingConfig = { thinkingBudget: 0 };
   return {
     engine: 'gemini',
     method: 'POST',
@@ -280,30 +289,59 @@ function buildGeminiSpec({ model, prompt, blob, apiKey }) {
     body: {
       system_instruction: { parts: [{ text: prompt || '' }] },
       contents: [{ role: 'user', parts: [{ text: `TRANSCRIPT:\n${blob || ''}` }] }],
-      generationConfig: { temperature: 0.2, maxOutputTokens: GEMINI_MAX_OUTPUT_TOKENS },
+      generationConfig,
     },
     timeoutMs: GEMINI_TIMEOUT_MS,
   };
 }
 
 /**
- * Extract the model text from a Gemini `generateContent` response body
- * (`candidates[0].content.parts[0].text`). An error payload, unexpected shape, or unparseable body →
- * null, so the engine fails cleanly (→ fallback / null). PURE — pins the response contract with no
- * network round-trip.
+ * Extract the model text from a Gemini `generateContent` response body. Concatenates the `.text` of every
+ * content part EXCEPT parts flagged `thought: true` — a thinking-default / forced-thinking model emits its
+ * reasoning as a separate `thought` part (often parts[0]), which must be dropped, not returned, and the
+ * answer may itself span several parts (#30). An error payload, unexpected shape, no answer text, or an
+ * unparseable body → null, so the engine fails cleanly (→ fallback / null). PURE + total — pins the response
+ * contract with no network round-trip, never throws.
  */
 function parseGeminiResponse(bodyString) {
   try {
     const d = JSON.parse(bodyString);
-    const t = d && d.candidates && d.candidates[0] && d.candidates[0].content
-      && d.candidates[0].content.parts && d.candidates[0].content.parts[0]
-      && d.candidates[0].content.parts[0].text;
-    return typeof t === 'string' && t.trim() ? t : null;
+    const parts = d && d.candidates && d.candidates[0] && d.candidates[0].content
+      && d.candidates[0].content.parts;
+    if (!Array.isArray(parts)) return null;
+    const text = parts
+      .filter((p) => p && p.thought !== true && typeof p.text === 'string')
+      .map((p) => p.text)
+      .join('');
+    return text.trim() ? text : null;
   } catch {
     return null;
   }
 }
 
+// A forced-thinking model (gemma-class) rejects the thinkingConfig directive with an HTTP 400 whose body
+// mentions "thinking" (e.g. "Thinking budget is not supported"). That single discriminating token gates the
+// retry-without path (#30) — narrow enough that an unrelated 400 is NOT mis-flagged (it degrades as a plain
+// failure → fallback / null). A false positive would only cost one harmless retry-without-thinkingConfig.
+const THINKING_UNSUPPORTED_RE = /thinking/i;
+
+/**
+ * Classify a Gemini HTTP response into the invoke-result the orchestration consumes (#30). PURE + total:
+ *   - a parseable answer → `{ ok:true, text }`;
+ *   - HTTP 400 whose body mentions thinking → `{ ok:false, thinkingUnsupported:true, detail }` (the signal
+ *     runEngine uses to rebuild the spec WITHOUT thinkingConfig and retry once);
+ *   - anything else → `{ ok:false, detail }` (a plain failure, exactly as before).
+ * Kept pure (statusCode + body in, result out) so invokeGemini's 400-detection is unit-tested with no network.
+ */
+function parseGeminiResult(statusCode, bodyString) {
+  const text = parseGeminiResponse(bodyString);
+  if (text) return { ok: true, text };
+  if (statusCode === 400 && THINKING_UNSUPPORTED_RE.test(String(bodyString || ''))) {
+    return { ok: false, text: '', thinkingUnsupported: true, detail: 'gemini http 400 thinking-unsupported' };
+  }
+  return { ok: false, text: '', detail: `gemini http ${statusCode}` };
+}
+
 // ── defaultInvoke: the REAL engine invoker (the production path behind the seam) ──
 // Mirrors lib/protect.cjs's defaultInvoke: the single real-call site. The suite NEVER reaches here — it
 // injects a fake. `claude` → spawnSync `claude -p`; `gemini` → an HTTPS POST. Both judge success by the
@@ -341,8 +379,9 @@ function invokeGemini(spec) {
         let data = '';
         res.on('data', (c) => { data += c; });
         res.on('end', () => {
-          const text = parseGeminiResponse(data);
-          resolve(text ? { ok: true, text } : { ok: false, text: '', detail: `gemini http ${res.statusCode}` });
+          // parseGeminiResult is status-aware: a 400 thinking-unsupported body becomes a `thinkingUnsupported`
+          // signal so runEngine retries WITHOUT thinkingConfig; any other failure stays a plain ok:false (#30).
+          resolve(parseGeminiResult(res.statusCode, data));
         });
       },
     );
@@ -390,17 +429,35 @@ function defaultSleep(ms) {
  * Run a single engine through the invoker; return `{ text, attempts }` (text null when no output). A
  * `gemini` engine with no API key fails WITHOUT calling the invoker (no key → no request, attempts 0). A
  * transient `ok:false` is retried up to ENGINE_ATTEMPTS with a fixed backoff via the injected sleep; the
- * first non-empty text wins. An invoker that throws is caught → counts as a failed attempt, then null.
+ * first text that is non-empty AND passes the optional task `validate` predicate wins. A non-empty text
+ * that FAILS `validate` (unusable output — e.g. dream prose the gate can't parse) is a failed attempt →
+ * retried, then null, so synthesizeDetailed advances to the fallback. No validator → any non-empty wins.
+ * An invoker that throws is caught → counts as a failed attempt, then null.
  * @returns {Promise<{ text: string|null, attempts: number }>}
  */
-async function runEngine(engine, { prompt, blob, apiKey, invoke, sleep = defaultSleep }) {
+async function runEngine(engine, { prompt, blob, apiKey, invoke, sleep = defaultSleep, validate }) {
   if (!engine || !engine.engine) return { text: null, attempts: 0 };
-  let spec;
+
+  // `callOnce()` is ONE engine call — the unit the transient-spawn retry loop below repeats. For gemini it
+  // also encapsulates the thinking-unsupported fallback (#30): issue the spec carrying thinkingConfig; if the
+  // model REJECTS that directive (HTTP 400 → `thinkingUnsupported`), rebuild the SAME request WITHOUT
+  // thinkingConfig and issue it once more, using that result. This lives ABOVE the invoke seam, so a fake
+  // invoke simulates both halves with no network; it composes with the transient retries (the whole callOnce
+  // is the retried unit) and preserves the gemini-no-key early-out (no key → no request, below).
+  let callOnce;
   if (engine.engine === 'claude') {
-    spec = buildClaudeSpec({ model: engine.model, prompt, blob });
+    const spec = buildClaudeSpec({ model: engine.model, prompt, blob });
+    callOnce = () => invoke(spec);
   } else if (engine.engine === 'gemini') {
     if (!apiKey) return { text: null, attempts: 0 }; // missing key fails this engine (→ fallback / null), no request, no retry.
-    spec = buildGeminiSpec({ model: engine.model, prompt, blob, apiKey });
+    callOnce = async () => {
+      const r = await invoke(buildGeminiSpec({ model: engine.model, prompt, blob, apiKey, thinking: true }));
+      if (r && r.thinkingUnsupported) {
+        // this model rejects the thinkingConfig directive (forced-thinking / gemma-class) — retry once without it.
+        return invoke(buildGeminiSpec({ model: engine.model, prompt, blob, apiKey, thinking: false }));
+      }
+      return r;
+    };
   } else {
     return { text: null, attempts: 0 }; // unknown engine name → skip.
   }
@@ -409,18 +466,38 @@ async function runEngine(engine, { prompt, blob, apiKey, invoke, sleep = default
     attempts += 1;
     let text = null;
     try {
-      const r = await invoke(spec);
+      const r = await callOnce();
       const t = r && r.ok && typeof r.text === 'string' ? r.text.trim() : '';
       text = t || null;
     } catch {
       text = null; // an invoker throw is a transient failure for this attempt (degrade, never throw).
     }
-    if (text) return { text, attempts };
+    // success = non-empty AND task-usable (validate). No validator → permissive: any non-empty text wins.
+    if (text && (!validate || validate(text))) return { text, attempts };
     if (i < ENGINE_ATTEMPTS - 1) sleep(ENGINE_BACKOFF_MS); // back off before the next attempt (not after the last). sleep is synchronous (Atomics.wait / injected no-op) — no await.
   }
   return { text: null, attempts };
 }
 
+// ── per-task engine-success validators (synth-robustness #50) ───────────────────
+// An engine attempt succeeds only when its text is non-empty AND passes the task's validator, so an engine
+// that returns non-empty-but-UNUSABLE output exhausts its retries and synthesizeDetailed advances to the
+// fallback — instead of the unusable primary "winning" while the downstream gate parses zero proposals and
+// writes nothing. A task with NO registered validator is permissive (any non-empty text wins, exactly as
+// before), so every existing caller is preserved.
+const TASK_VALIDATORS = {
+  // dream output is usable only if the gate (parseProposals) reads ≥1 proposal from it, OR it is a STRUCTURED
+  // abstain (isAbstain — the text carries an actual {abstain:true}, NOT merely the word in prose). A deliberate
+  // "nothing to record" is a valid answer, NOT a reason to churn through the fallback (#52: the old /abstain/i
+  // substring let a model that just wrote the word pass as an abstain).
+  dream: (text) => parseProposals(text).length > 0 || isAbstain(text),
+};
+
+// Resolve a task's engine-success validator; an unregistered task is permissive (any non-empty text wins).
+function validatorFor(task) {
+  return TASK_VALIDATORS[task] || (() => true);
+}
+
 /**
  * Synthesize text for `task` from `prompt` + `blob`, resolving the engine per task (primary → fallback),
  * also reporting WHICH engine produced the text and HOW MANY attempts the producing engine spent (the
@@ -431,9 +508,10 @@ async function runEngine(engine, { prompt, blob, apiKey, invoke, sleep = default
  */
 async function synthesizeDetailed({ task, prompt, blob, config, apiKey, invoke = defaultInvoke, sleep }) {
   const { primary, fallback } = resolveTask(config || DEFAULTS, task);
+  const validate = validatorFor(task); // task-aware success: dream needs parseable proposals; handoff is permissive.
   let attempts = 0;
   for (const engine of [primary, fallback]) {
-    const r = await runEngine(engine, { prompt, blob, apiKey, invoke, sleep });
+    const r = await runEngine(engine, { prompt, blob, apiKey, invoke, sleep, validate });
     attempts += r.attempts;
     if (r.text) return { text: r.text, engine: engine && engine.engine, attempts };
   }
@@ -609,6 +687,18 @@ function writeBatonAtomic(root, body) {
  * @returns {Promise<{ wrote:boolean, blob:string, reason?:string }>}
  */
 async function runHandoff({ root, invoke = defaultInvoke, sleep }) {
+  // Stash-presence gate (#45): a synth with NO `.pending` stash has no session to process — no-op cleanly
+  // and write NO synth-log row. This is the secondary defense behind the spawn hook's once-per-session
+  // guard: a 2nd synth whose sibling already consumed+cleared the stash (or a manual --from-spawn with
+  // none) must not log a spurious `trivial`/`no-engine` row that pollutes the log + the baton-staleness
+  // signal. SPECIFIC to the ABSENT-file case — a present-but-trivial stash still logs `trivial` below.
+  // existsSync is total (never throws). NB-1: a stranded `.pending-handoff` can linger here (a concurrent /
+  // no-session-id race cleared `.pending` after a sibling re-raised both) — release session-start's hold
+  // before returning, or its holdForHandoff waits the full cap. rmQuiet is best-effort/total.
+  if (!fs.existsSync(continuityPath(root, PENDING))) {
+    rmQuiet(continuityPath(root, PENDING_HANDOFF));
+    return { wrote: false, blob: '', reason: 'no-stash' };
+  }
   let wrote = false;
   let reason;
   let safeBlob = ''; // the redacted blob, returned so dream can reuse it in memory (auto-memory-04).
@@ -671,37 +761,61 @@ function dreamAdapter() {
 }
 
 /**
- * Parse the engine's dream output into a proposals array. The model is asked for STRICT JSON, but a real
- * model may wrap it in prose or ```json fences — so we extract the first balanced {...} / [...] span and
- * parse it. An `{ abstain:true }` or anything unparseable / shapeless yields [] (write nothing). PURE.
+ * Extract the first JSON value from model output. The model is asked for STRICT JSON, but a real model may
+ * wrap it in prose or ```json fences — so on a direct-parse miss we grab the first balanced {…} / […] span and
+ * parse that. Returns the parsed value, or null when nothing parses. PURE + total — never throws. This is the
+ * SINGLE tolerant parse shared by both parseProposals and isAbstain so the two can never diverge (#52).
  * @param {string} text the engine output
- * @returns {Array} the proposals (possibly empty)
+ * @returns {object|Array|null}
  */
-function parseProposals(text) {
+function firstJsonValue(text) {
   const s = String(text || '');
-  let parsed = null;
   try {
-    parsed = JSON.parse(s);
+    return JSON.parse(s);
   } catch {
     // tolerate prose/fences around the JSON: grab the first { … } or [ … ] span and try that.
     const start = s.search(/[[{]/);
-    if (start === -1) return [];
+    if (start === -1) return null;
     const open = s[start];
     const close = open === '{' ? '}' : ']';
     const end = s.lastIndexOf(close);
-    if (end <= start) return [];
+    if (end <= start) return null;
     try {
-      parsed = JSON.parse(s.slice(start, end + 1));
+      return JSON.parse(s.slice(start, end + 1));
     } catch {
-      return [];
+      return null;
     }
   }
+}
+
+/**
+ * Parse the engine's dream output into a proposals array (via firstJsonValue's tolerant extraction). An
+ * `{ abstain:true }` or anything unparseable / shapeless yields [] (write nothing). PURE.
+ * @param {string} text the engine output
+ * @returns {Array} the proposals (possibly empty)
+ */
+function parseProposals(text) {
+  const parsed = firstJsonValue(text);
   if (parsed && typeof parsed === 'object' && parsed.abstain === true) return [];
   if (Array.isArray(parsed)) return parsed;
   if (parsed && typeof parsed === 'object' && Array.isArray(parsed.proposals)) return parsed.proposals;
   return [];
 }
 
+/**
+ * A STRUCTURED dream abstain (#52): the output carries an actual `{ abstain:true }` — not merely the word
+ * "abstain" somewhere in prose. Reuses firstJsonValue's extraction (clean / fenced / prose-wrapped JSON all
+ * resolve) and returns true only when the parsed object literally has `abstain === true`. PURE + total — never
+ * throws. The dream engine-success validator uses it so a model that just writes the word does NOT pass as a
+ * deliberate "nothing to record" (the old broad /abstain/i substring did).
+ * @param {string} text the engine output
+ * @returns {boolean}
+ */
+function isAbstain(text) {
+  const parsed = firstJsonValue(text);
+  return !!(parsed && typeof parsed === 'object' && !Array.isArray(parsed) && parsed.abstain === true);
+}
+
 /** Run a dream.cjs subcommand in-process-but-separate (spawnSync node), rooted at the install. Parses its
  * JSON stdout; a non-zero exit / unparseable output → null (the caller treats it as "no result"). */
 function runDreamCli(root, args) {
@@ -728,17 +842,19 @@ function writeTemp(root, tag, content) {
  * the dream.cjs gate (check → stage accepted → commit, all `--source`-verified against the blob), and
  * returns the committed slugs. Writes nothing on a trivial blob / abstain / empty-or-rejected set. Cleans
  * up its temp files. Never throws (a fault degrades to "wrote nothing").
- * @param {{ root:string, blob:string, invoke?:Function }} opts
+ * @param {{ root:string, blob:string, invoke?:Function, sleep?:Function }} opts
  * @returns {Promise<{ written:string[], reason?:string }>}
  */
-async function runDream({ root, blob, invoke = defaultInvoke }) {
+async function runDream({ root, blob, invoke = defaultInvoke, sleep }) {
   const temps = [];
   try {
     if (!blob || blob.trim().length < TRIVIAL_BLOB_MIN) return { written: [], reason: 'trivial' };
     const config = loadConfig(root);
     const apiKey = loadEnv(root).GEMINI_API_KEY;
     const safeBlob = redactSecrets(blob); // scrub BEFORE the blob egresses to the external model.
-    const text = await synthesize({ task: 'dream', prompt: PROMPTS.dream, blob: safeBlob, config, apiKey, invoke });
+    // `sleep` is threaded to the engine retry loop (default real backoff in production; tests inject a no-op so
+    // a validate-fail dream — which exhausts ENGINE_ATTEMPTS × ENGINE_BACKOFF_MS — runs instantly, #52).
+    const text = await synthesize({ task: 'dream', prompt: PROMPTS.dream, blob: safeBlob, config, apiKey, invoke, sleep });
     const proposals = parseProposals(text);
     if (proposals.length === 0) return { written: [], reason: 'abstain' };
 
@@ -878,7 +994,9 @@ module.exports = {
   buildClaudeSpec,
   buildGeminiSpec,
   parseGeminiResponse,
+  parseGeminiResult,
   parseProposals,
+  isAbstain,
   defaultInvoke,
   synthesize,
   runHandoff,