@inetafrica/open-claudia 3.0.43 → 3.1.0

package/test-provider-events.js

@@ -117,8 +117,78 @@ assert.deepStrictEqual(claudeAuth, [{
   message: "Authentication failed",
   authError: true,
   usageLimit: false,
+  refusal: false,
 }]);
 
+// Refusal surfaced only through the CLI's flattened error text (no structured
+// stop_details): flagged, reason sentence + request id recovered from the text.
+const refusalText = "API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy. To learn more, see https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback. Try rephrasing the request or attempting a different approach.\n\nRequest ID: req_011CdCrJnhWPXeW3PsPFJEb5";
+const claudeRefusal = normalizeClaudeEvent({
+  type: "result",
+  is_error: true,
+  subtype: "error_during_execution",
+  result: refusalText,
+}, createClaudeParserState());
+assert.strictEqual(claudeRefusal.length, 1);
+assert.strictEqual(claudeRefusal[0].type, "error");
+assert.strictEqual(claudeRefusal[0].refusal, true);
+assert.strictEqual(claudeRefusal[0].authError, false);
+assert.strictEqual(claudeRefusal[0].usageLimit, false);
+assert.strictEqual(claudeRefusal[0].requestId, "req_011CdCrJnhWPXeW3PsPFJEb5");
+assert.match(claudeRefusal[0].refusalExplanation, /violative cyber content/);
+
+// Structured stop_details from the assistant message wins over text parsing.
+const refusalState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: {
+    content: [],
+    stop_reason: "refusal",
+    stop_details: { type: "refusal", category: "cyber", explanation: "This request was declined because it could enable cyber harm." },
+  },
+}, refusalState);
+const structuredRefusal = normalizeClaudeEvent({
+  type: "result",
+  is_error: true,
+  subtype: "error_during_execution",
+  result: "API Error: request blocked",
+}, refusalState);
+assert.strictEqual(structuredRefusal[0].refusal, true);
+assert.strictEqual(structuredRefusal[0].refusalCategory, "cyber");
+assert.match(structuredRefusal[0].refusalExplanation, /cyber harm/);
+
+// A refusal the CLI reports as a "successful" empty turn must fail with the
+// reason instead of settling as an empty "(no output)" result.
+const silentState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: { content: [], stop_reason: "refusal", stop_details: { type: "refusal", category: null, explanation: null } },
+}, silentState);
+const silent = normalizeClaudeEvent({
+  type: "result",
+  subtype: "success",
+  is_error: false,
+  session_id: "claude-refusal-session",
+  result: "",
+}, silentState);
+assert.strictEqual(silent.at(-1).type, "error");
+assert.strictEqual(silent.at(-1).refusal, true);
+
+// A refusal stop_reason with answer text already streamed must NOT hijack the
+// successful result path.
+const partialState = createClaudeParserState();
+normalizeClaudeEvent({
+  type: "assistant",
+  message: { content: [{ type: "text", text: "partial answer" }], stop_reason: "refusal" },
+}, partialState);
+assert.strictEqual(normalizeClaudeEvent({
+  type: "result",
+  subtype: "success",
+  is_error: false,
+  session_id: "claude-partial-session",
+  result: "",
+}, partialState).at(-1).type, "result");
+
 const codexState = createCodexParserState();
 assert.deepStrictEqual(normalizeCodexEvent(samples.codex.session, codexState), [
   { type: "session", sessionId: "codex-thread-1" },
@@ -151,6 +221,7 @@ assert.deepStrictEqual(codexAuth, [{
   message: "401 Unauthorized",
   authError: true,
   usageLimit: false,
+  refusal: false,
 }]);
 
 const decoderError = { type: "decoder.error", code: "MALFORMED_JSON", message: "Malformed provider JSONL record" };

package/test-provider-language.js

@@ -86,7 +86,67 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // every 30s, resuming cleanly the moment connectivity returns. Poll-health logs
 // are timestamped. Confined to channels/telegram/adapter.js; new cases in
 // test-telegram-poll-recovery.js cover the pause+resume and the gated exit.
-assert.strictEqual(pkg.version, "3.0.43", "release version must remain unchanged without explicit approval");
+// 3.0.44 approved by Sumeet 2026-07-20 ("push"): safety-refusal handling +
+// poisoned-session recovery. The API's stop_reason "refusal" scores the WHOLE
+// conversation, so a session whose context tripped the classifier refused every
+// resumed turn (the flagged material was re-sent each time) and the user only
+// saw a raw AUP error dump with no way forward but knowing to type /new.
+// Refusals are now detected structurally (stop_details category/explanation,
+// text-parse fallback on the flattened CLI error) and mapped to PROVIDER_REFUSAL
+// with a clear diagnostic (reason, request ID, /new + rephrase + model options).
+// Recovery: the refused session is QUARANTINED (bounded persisted map in user
+// state; never resumed again — natural turns, explicit /continue, and rotated
+// ids all forced fresh) and the refused prompt is auto-retried exactly ONCE in
+// a fresh session behind a ♻️ notice. A refusal on already-fresh context gets
+// no retry (the new message itself is the problem); capture runs never retry.
+// 3.0.45 approved by Sumeet 2026-07-20 ("Ok so you ready to implement?"): first
+// fix batch from the 2026-07-20 blind code review. Recall-graph decay moves to
+// decay-on-read (the nightly rewrite compounded — a 60d half-life emptied in
+// ~10 nights; one-time user_version 0→1 restamp, dream-tunable half-life);
+// keyring/tool-state/tuning writes become crash-safe (atomic temp+fsync+rename,
+// keyring .bak snapshot with read-through repair); recall failures alert after
+// 3 consecutive memoryless turns instead of degrading silently; the recall
+// pre-gate strips pleasantry prefixes so "ok deploy … now" recalls; tool-run
+// creds are preflighted BEFORE an approval token is consumed (a missing key no
+// longer burns the human's Approve); tool-graph parsing splits on | and &;
+// raw NUL bytes in discoverer.js/state.js become \u0000 escapes; README
+// corrected — discoverer is the shipped default engine, classic the opt-out.
+// 3.0.45 second wave folded in per Sumeet 2026-07-20 ("i think just wok
+// through all these features and fold them into .45?"): the memory-substrate
+// revival. Root cause: pods on node:20 have no node:sqlite, so pack FTS, the
+// recall graph and episodes silently never initialized — rahilcoder ran 16
+// days with seedsTotal=0 while repeating corrected branding mistakes, and its
+// reviewer starved 87% of runs on a stale mutation lock (container pid-1
+// reuse made a crashed incarnation's lock look alive forever). Ships:
+// Dockerfile.base FROM node:24-slim (+ CI build image node:24); a /doctor
+// memory-health section (substrate hard-fail, graph stats, 24h recall
+// pipeline, reviewer health, mutation lock, deferred reviews, corpus caps,
+// disk) with a deduped boot-time substrate alert and a post-upgrade doctor
+// gate on all three /upgrade paths; a pure-JS lexical seed floor under
+// matchPacks/matchEntities (recall degrades to keyword matching, never to
+// OFF — parity-tested with and without the sim-no-sqlite shim); the
+// mutation-queue lock gains a boot id + ownerless-lock grace so pid-1 reuse
+// can't wedge it, plus a reviewer retry+defer seatbelt; LOCKED Stance lines
+// hoist under a BINDING CONSTRAINTS header and the reviewer must carry them
+// verbatim and journal violations; compaction recall is fixed (summary
+// meta-turn skips recall; the fresh seed matches on condensed brief + open
+// task titles, not prompt boilerplate).
+// 3.1.0 approved by Sumeet 2026-07-20 ("yes that's fine but if in hard boot
+// loop it shoyuld give the user a way to get back online and diagnose or fall
+// back into a safe mode or something to have it fixed or set up or downgrade,
+// actually i think that's improtant as well to have a downgrade, i think add
+// this all in and let's bump the minor to 3.1.0"): the substrate-revival
+// fold graduates to a minor because boot semantics change. node:sqlite is now
+// REQUIRED — a missing substrate boots into SAFE MODE (adapters + diagnostic
+// slash commands only; no agent turns, crons, or memory writes) instead of
+// silently degrading; MEMORY_ALLOW_DEGRADED=1 or a one-shot /safemode
+// continue is the explicit keyword-only escape hatch. A boot crash loop (3
+// consecutive boots dying before 5min stable uptime) also lands in safe mode
+// so the operator keeps a live chat to rescue from instead of a dead pod.
+// New /downgrade rolls back to the previously-running version from boot
+// history (strict semver-validated target); /upgrade//downgrade clear the
+// crash counter as deliberate fix attempts. package.json engines >=24.
+assert.strictEqual(pkg.version, "3.1.0", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-recall.js

@@ -253,6 +253,39 @@ async function main() {
   recall.getEngine = originalGetEngine;
   assert.strictEqual(admittedProvider, "codex");
 
+  // ── compaction recall policy: the summary meta-turn skips recall entirely;
+  //    the seed turn matches on the runner-supplied recallQuery (condensed
+  //    brief + task titles), never the seed prompt's boilerplate ──
+  const summarySkip = await systemPrompt.buildOptionalRecallContext(
+    "Summarize this conversation for a fresh compacted continuation.",
+    {
+      state: mutableState,
+      runContext: { provider: "claude", purpose: "compact-summary", project: { name: "project-a", dir: root }, sessionId: null, runId: "compact-sum" },
+    },
+  );
+  assert.strictEqual(summarySkip.metadata.status, "omitted", "summary turn skips recall");
+  assert.strictEqual(summarySkip.metadata.reason, "compaction_meta_turn");
+  assert.strictEqual(summarySkip.dynamicContext, "");
+
+  let seedQueryText = null;
+  recall.getEngine = () => ({
+    name: "fixture",
+    async run(ctx) {
+      seedQueryText = ctx.userText;
+      return { packBlock: "", entityBlock: "", toolBlock: "", episodeBlock: "", packMatches: [], entityMatches: [] };
+    },
+  });
+  await systemPrompt.buildOptionalRecallContext(
+    "This is a compacted continuation of a previous Open Claudia session. Treat the following summary as the prior conversation context.",
+    {
+      state: mutableState,
+      runContext: { provider: "claude", purpose: "compact-seed", recallQuery: "coders africa branding fonts\nFinalize v3.0.45", project: { name: "project-a", dir: root }, sessionId: null, runId: "compact-seed" },
+    },
+  );
+  recall.getEngine = originalGetEngine;
+  assert.strictEqual(seedQueryText, "coders africa branding fonts\nFinalize v3.0.45",
+    "seed recall matches on recallQuery, not the seed prompt");
+
   for (const file of ["core/recall-filter.js", "core/recall/discoverer.js", "core/recall/warm-walker.js"]) {
     const source = fs.readFileSync(path.join(__dirname, file), "utf8");
     assert.ok(!source.includes("spawnSubagent"), `${file} no longer uses the compatibility sub-agent path`);

package/test-provider-runner.js

@@ -262,6 +262,56 @@ async function main() {
   assert.strictEqual(authFailure.error.code, "PROVIDER_UNAUTHENTICATED");
   assert.match(authFailure.diagnostic, /Authentication failed/i);
 
+  // A safety refusal on a resumed session must surface as PROVIDER_REFUSAL
+  // with the structured reason (category/explanation/request id) intact — the
+  // inputs the poisoned-session recovery quarantines and retries on.
+  const refusalCapture = path.join(root, "refusal-capture.json");
+  const refusalProviders = makeProviders(
+    { claude: refusalCapture, codex: captures.codex },
+    { claude: { FAKE_AGENT_SCENARIO: "refusal" } },
+  );
+  mutable.activeSessions["project-a"].claude = "claude-poisoned-session";
+  const refusalService = createRunnerService({
+    getState: () => mutable,
+    getStore: () => ({ channelId: "fixture-channel", transport: "telegram" }),
+    resolveProvider: (id) => refusalProviders[id],
+    buildTurnPrompt: simpleBundle,
+    cleanup: async () => {},
+  });
+  const refused = await refusalService.runAgentCapture("REFUSAL SENTINEL", projectA);
+  assert.strictEqual(refused.ok, false);
+  assert.strictEqual(refused.admittedSessionId, "claude-poisoned-session", "refusal run resumed the poisoned session");
+  assert.strictEqual(refused.error.code, "PROVIDER_REFUSAL");
+  assert.strictEqual(refused.error.details.refusal, true);
+  assert.strictEqual(refused.error.details.refusalCategory, "cyber");
+  assert.match(refused.error.details.refusalExplanation, /cyber harm/);
+  assert.strictEqual(refused.error.details.requestId, "req_fixture123");
+  assert.match(refused.diagnostic, /Usage Policy/);
+  assert.match(refused.diagnostic, /req_fixture123/);
+  const refusalArgv = JSON.parse(fs.readFileSync(refusalCapture, "utf8")).argv;
+  assert.ok(refusalArgv.includes("claude-poisoned-session"), "refusal run resumed via --resume");
+
+  // The quarantine guard: once the session is quarantined, the SAME turn shape
+  // is admitted fresh — no --resume, healthy success in a new session.
+  mutable.quarantinedSessions = {
+    "claude-poisoned-session": { provider: "claude", project: "project-a", reason: "refusal", at: Date.now() },
+  };
+  const recoveredProviders = makeProviders({ claude: refusalCapture, codex: captures.codex });
+  const recoveredService = createRunnerService({
+    getState: () => mutable,
+    getStore: () => ({ channelId: "fixture-channel", transport: "telegram" }),
+    resolveProvider: (id) => recoveredProviders[id],
+    buildTurnPrompt: simpleBundle,
+    cleanup: async () => {},
+  });
+  const recovered = await recoveredService.runAgentCapture("RECOVERY SENTINEL", projectA);
+  assert.strictEqual(recovered.ok, true);
+  assert.strictEqual(recovered.admittedSessionId, null, "quarantined session must not be admitted");
+  assert.strictEqual(recovered.sessionId, "claude-fresh-session");
+  const recoveredArgv = JSON.parse(fs.readFileSync(refusalCapture, "utf8")).argv;
+  assert.ok(!recoveredArgv.includes("--resume"), "quarantined resume is forced fresh");
+  assert.ok(!recoveredArgv.includes("claude-poisoned-session"));
+
   console.log("provider runner OK");
 }
 

package/test-recall-discoverer.js

@@ -53,6 +53,14 @@ assert.strictEqual(disc.recallTier("restart bot", 3), "seeds", "short command
 assert.strictEqual(disc.recallTier("show fup logs", 2), "seeds", "≤4 words → seeds-only tier");
 assert.strictEqual(disc.recallTier("yes we need to see the 100", 2), "full", "substantive yes-prefixed turn → full");
 assert.strictEqual(disc.recallTier("how do I deploy the mobile app", 4), "full", "substantive → full");
+// B2: a pleasantry prefix is stripped BEFORE tiering, so a short real request
+// wearing an ack is no longer swallowed by the ≤4-word pleasantry skip.
+assert.strictEqual(disc.recallTier("ok deploy kazee now", 3), "seeds", "ack-prefixed 4-word command → seeds, not skip");
+assert.strictEqual(disc.recallTier("yes deploy it", 4), "seeds", "approval + command → seeds, not skip");
+assert.strictEqual(disc.recallTier("thanks! restart euvy bot", 3), "seeds", "thanks-prefixed command → seeds, not skip");
+assert.strictEqual(disc.needsRecall("ok deploy kazee now", 0), true, "prefixed command needs recall");
+assert.strictEqual(disc.recallTier("ok thanks sounds good perfect", 5), "skip", "stacked pure pleasantries skip at any length");
+assert.strictEqual(disc.recallTier("morning check the kazee deploys", 2), "seeds", "greeting stripped → remainder tiers as a short command");
 
 // --- shared stub corpus + helpers ---
 const packs = {

package/test-recall-graph.js

@@ -7,6 +7,9 @@ const path = require("path");
 
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "recall-graph-"));
 process.env.RECALL_GRAPH_DB = path.join(tmp, "graph.db");
+// Pin the read-time decay half-life so assertions are deterministic (env pin
+// beats any tuning file the dream may have written).
+process.env.RECALL_DECAY_HALF_LIFE_DAYS = "30";
 
 const graph = require("./core/recall/graph");
 
@@ -51,18 +54,33 @@ for (const [, v] of act) assert.ok(v.activation > 0 && v.hop >= 1, "activation h
 // seeds with no edges produce nothing
 assert.strictEqual(graph.expand([{ id: "pack:orphanseed", score: 5 }]).size, 0);
 
-// --- decay (never below structural floor) ---
-graph.addEdge("pack:d", "pack:e", "parent"); // base weight 3, no last_reinforced → untouched
-graph.reinforce("pack:d", "pack:f", 10);
-// backdate the reinforced edge well past the half-life
+// --- decay-on-read (never below structural floor; reads never rewrite storage) ---
+graph.addEdge("pack:d", "pack:e", "parent"); // base weight 3, no last_reinforced → never decays
+graph.reinforce("pack:d", "pack:f", 10);     // stored 11, stamped now
 const db = graph.openDb();
-const old = new Date(Date.now() - 400 * 86400000).toISOString();
-db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=?").run(old, "pack:d", "pack:f");
-graph.decay({ halfLifeDays: 30 });
-const df = graph.allEdges().find((e) => e.src === "pack:d" && e.dst === "pack:f");
-assert.ok(df.weight < 11 && df.weight >= 1, "reinforced edge decayed toward floor");
-const de = graph.allEdges().find((e) => e.src === "pack:d" && e.dst === "pack:e");
-assert.strictEqual(de.weight, 3, "structural edge with no reinforcement untouched by decay");
+const oneHL = new Date(Date.now() - 30 * 86400000).toISOString(); // exactly one pinned half-life
+db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=?").run(oneHL, "pack:d", "pack:f");
+const dfEff = graph.neighbors("pack:d").find((n) => n.node === "pack:f").weight;
+assert.ok(dfEff > 5.3 && dfEff < 5.7, `one half-life on read ≈ 5.5 (${dfEff})`);
+const deEff = graph.neighbors("pack:d").find((n) => n.node === "pack:e").weight;
+assert.strictEqual(deEff, 3, "structural edge with no reinforcement never decays");
+// far past the half-life the effective weight clamps at the type's base
+const longAgo = new Date(Date.now() - 400 * 86400000).toISOString();
+db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=?").run(longAgo, "pack:d", "pack:f");
+const floored = graph.neighbors("pack:d").find((n) => n.node === "pack:f").weight;
+assert.strictEqual(floored, 1, "effective weight clamps at the related floor");
+// storage untouched by all those reads
+assert.strictEqual(graph.allEdges().find((e) => e.src === "pack:d" && e.dst === "pack:f").weight, 11,
+  "reads never rewrite the stored weight");
+
+// REGRESSION (P1 compounding decay): the nightly weight-rewrite path is gone.
+assert.strictEqual(graph.decay, undefined, "decay() rewrite removed — decay is read-time only");
+
+// reinforcement settles accrued decay, THEN bumps — never bumps the stale stored value
+db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=?").run(oneHL, "pack:d", "pack:f");
+graph.reinforce("pack:d", "pack:f", 1); // effective ≈ 5.5 + 1
+const settledDF = graph.allEdges().find((e) => e.src === "pack:d" && e.dst === "pack:f").weight;
+assert.ok(settledDF > 6.3 && settledDF < 6.7, `settle-then-bump ≈ 6.5, not 12 (${settledDF})`);
 
 // --- structural sync from a stubbed corpus ---
 const packsStub = {
@@ -88,7 +106,44 @@ const pruned = graph.pruneOrphans(packsStub, entStub);
 assert.ok(pruned >= 1, "orphan edge pruned");
 assert.ok(!graph.allEdges().some((e) => e.src === "pack:ghost"), "ghost edge gone");
 
+// --- REGRESSION (P1): repeated nightly tend() must leave stored weights
+// bit-identical — the old decay() rewrite shrank them again every night
+// (compounding: full age reapplied to an already-decayed weight). ---
+graph.reinforce("pack:kazee-mobile", "pack:kazee", 9); // stored 10, stamped now
+db.prepare("UPDATE edges SET last_reinforced=? WHERE src=? AND dst=? AND type='related'")
+  .run(oneHL, "pack:kazee-mobile", "pack:kazee");
+const kmStored = () => graph.allEdges()
+  .find((e) => e.src === "pack:kazee-mobile" && e.dst === "pack:kazee" && e.type === "related").weight;
+const before3 = kmStored();
+for (let i = 0; i < 3; i++) graph.tend(packsStub, entStub);
+assert.strictEqual(kmStored(), before3, "three nightly tends never rewrite a reinforced weight");
+const kmEff = graph.neighbors("pack:kazee-mobile")
+  .find((n) => n.node === "pack:kazee" && n.type === "related").weight;
+assert.ok(kmEff > 4.7 && kmEff < 5.3, `effective after 3 tends is still one half-life ≈ 5 (${kmEff})`);
+
 // parseLinks
 assert.deepStrictEqual(graph.parseLinks("see [[Foo-Bar]] and [[baz]]"), ["foo-bar", "baz"]);
 
+// --- v1 migration: a legacy DB (pre decay-on-read) gets its clock restarted on
+// first open — stored weights are treated as current, nothing else changes. ---
+graph._resetForTest();
+process.env.RECALL_GRAPH_DB = path.join(tmp, "legacy.db");
+{
+  const { DatabaseSync } = require("node:sqlite");
+  const raw = new DatabaseSync(process.env.RECALL_GRAPH_DB);
+  raw.exec(`CREATE TABLE edges (src TEXT NOT NULL, dst TEXT NOT NULL, type TEXT NOT NULL,
+    weight REAL NOT NULL DEFAULT 1, last_reinforced TEXT, created TEXT, PRIMARY KEY (src, dst, type))`);
+  raw.prepare("INSERT INTO edges (src, dst, type, weight, last_reinforced, created) VALUES (?,?,?,?,?,?)")
+    .run("pack:l1", "pack:l2", "related", 4, new Date(Date.now() - 200 * 86400000).toISOString(), new Date().toISOString());
+  raw.close();
+}
+delete require.cache[require.resolve("./core/recall/graph")];
+const graph2 = require("./core/recall/graph");
+const legacy = graph2.allEdges().find((e) => e.src === "pack:l1");
+assert.ok(Date.parse(legacy.last_reinforced) > Date.now() - 60000, "migration restamps legacy reinforced rows");
+assert.strictEqual(legacy.weight, 4, "migration leaves the stored weight untouched");
+const legacyEff = graph2.neighbors("pack:l1").find((n) => n.node === "pack:l2").weight;
+assert.ok(legacyEff > 3.9, `restamped legacy row reads at ~full stored weight (${legacyEff})`);
+graph2._resetForTest();
+
 console.log("recall graph OK");

package/test-tool-graph.js

@@ -53,25 +53,35 @@ graph.addFollow("ensure-src", "ensure-dst"); // weight 1, last_reinforced=null
 const ensured = graph.followers("ensure-src");
 assert.strictEqual(ensured[0].weight, 1, "ensure edge weighs 1");
 
-// ── decay: backdate a reinforced edge far into the past, then it prunes (no floor) ──
+// ── read-time decay + prune: backdate a reinforced edge far into the past —
+// reads hide it immediately, prune() physically deletes it (no floor) ──
 const db = graph.openDb();
 const longAgo = new Date(Date.now() - 365 * 86400000).toISOString();
 db.prepare("UPDATE tool_edges SET last_reinforced=? WHERE src=? AND dst=?").run(longAgo, "auth", "list");
-let res = graph.decay({ halfLifeDays: 1, pruneBelow: 0.15 });
+assert.ok(!graph.followers("auth").some((r) => r.name === "list"), "faded edge invisible to reads before any prune");
+let res = graph.prune({ halfLifeDays: 1, pruneBelow: 0.15 });
 assert.ok(res.pruned >= 1, "a year-old edge under the floor is pruned");
-assert.ok(!graph.followers("auth").some((r) => r.name === "list"), "pruned edge is gone");
+assert.ok(!graph.allEdges().some((e) => e.src === "auth" && e.dst === "list"), "pruned edge physically gone");
 
-// the ensure edge (last_reinforced=null) was skipped by decay, not pruned
-assert.ok(graph.followers("ensure-src").some((r) => r.name === "ensure-dst"), "un-reinforced edge survives decay");
+// the ensure edge (last_reinforced=null) neither fades on read nor prunes
+assert.ok(graph.followers("ensure-src").some((r) => r.name === "ensure-dst"), "un-reinforced edge survives prune");
 
-// ── decay that reduces but keeps an edge above the floor ──
+// ── read-time decay that reduces but keeps an edge; storage never rewritten ──
 graph.addFollow("warm-a", "warm-b", { bump: 10 });
-const recent = new Date(Date.now() - 30 * 86400000).toISOString();
-db.prepare("UPDATE tool_edges SET last_reinforced=? WHERE src=? AND dst=?").run(recent, "warm-a", "warm-b");
-graph.decay({ halfLifeDays: 30, pruneBelow: 0.15 }); // one half-life → ~5
+const oneHL = new Date(Date.now() - 45 * 86400000).toISOString(); // one default half-life
+db.prepare("UPDATE tool_edges SET last_reinforced=? WHERE src=? AND dst=?").run(oneHL, "warm-a", "warm-b");
 const warm = graph.followers("warm-a")[0];
 assert.ok(warm && warm.name === "warm-b", "warm edge survives a single half-life");
-assert.ok(warm.weight < 10 && warm.weight > 0.15, `warm edge decayed but kept (${warm.weight})`);
+assert.ok(warm.weight > 4.7 && warm.weight < 5.3, `read-time weight ≈ half of stored (${warm.weight})`);
+assert.strictEqual(graph.allEdges().find((e) => e.src === "warm-a").weight, 10, "reads never rewrite the stored weight");
+
+// ── settle-then-bump: reinforcing a decayed edge bumps its EFFECTIVE weight ──
+graph.addFollow("warm-a", "warm-b", { bump: 1 }); // ≈ 5 + 1
+const settled = graph.allEdges().find((e) => e.src === "warm-a" && e.dst === "warm-b").weight;
+assert.ok(settled > 5.7 && settled < 6.3, `settle-then-bump ≈ 6, not 11 (${settled})`);
+
+// REGRESSION (P1 compounding decay): the nightly weight-rewrite path is gone.
+assert.strictEqual(graph.decay, undefined, "decay() rewrite removed — prune() only deletes");
 
 // ── removeEdge ──
 assert.strictEqual(graph.removeEdge("warm-a", "warm-b"), true, "removeEdge succeeds");
@@ -84,10 +94,11 @@ const removed = graph.pruneOrphans(fakeLib);
 assert.ok(removed >= 1, "edge pointing at an unregistered tool ('dead') is pruned");
 assert.ok(!graph.followers("live").length, "live→dead removed because dead is not a live tool");
 
-// ── tend() is the nightly entry: decays + prunes orphans + returns stats ──
+// ── tend() is the nightly entry: prunes faded + orphaned edges, returns stats ──
 const t = graph.tend(fakeLib);
 assert.ok(typeof t.edges === "number" && typeof t.nodes === "number", "tend returns stats");
-assert.ok(typeof t.pruned === "number" && typeof t.decayed === "number", "tend returns decay/prune counts");
+assert.ok(typeof t.pruned === "number", "tend returns prune count");
+assert.strictEqual(t.decayed, undefined, "tend has no decay pass (decay is read-time)");
 
 // ── stats / allEdges sanity ──
 const s = graph.stats();
@@ -111,6 +122,16 @@ assert.strictEqual(runs[0].name, "spaces", "first run is spaces");
 assert.strictEqual(runs[0].shape, "spaces docs --task-id <id> <path>", "first run shaped");
 assert.strictEqual(runs[1].name, "other", "second run is other (args did not bleed across &&)");
 assert.strictEqual(graph.parseToolRuns("ls -la").length, 0, "non-tool command yields no runs");
+// B17: every shell composition operator splits — the single pipe was missed,
+// so piped compositions taught no follows-edge.
+const piped = graph.parseToolRuns("open-claudia tool run kticket list | open-claudia tool run report weekly");
+assert.deepStrictEqual(piped.map((r) => r.name), ["kticket", "report"], "single-pipe composition parses both runs");
+assert.strictEqual(piped[0].shape, "kticket list", "piped first run's args don't bleed into the second");
+const bg = graph.parseToolRuns("open-claudia tool run a1 go & open-claudia tool run b2 go");
+assert.deepStrictEqual(bg.map((r) => r.name), ["a1", "b2"], "background & splits too");
+const quotedPipe = graph.parseToolRuns('open-claudia tool run kchat send "a | b" && open-claudia tool run other list');
+assert.deepStrictEqual(quotedPipe.map((r) => r.name), ["kchat", "other"], "a pipe inside a quoted argument does not split");
+assert.strictEqual(quotedPipe[0].shape, "kchat send <text>", "quoted argument still masks to <text>");
 
 // ── recordPackTool: insert, then bump accumulates; packTools surfaces strongest ──
 graph.recordPackTool("san-marco-agreements", "spaces", { command: "spaces docs --task-id <id> <path>", bump: 1 });
@@ -132,13 +153,15 @@ assert.ok(graph.toolPacks("spaces").some((u) => u.pack === "san-marco-agreements
 assert.strictEqual(graph.stats().packToolEdges, graph.allPackToolEdges().length, "stats packToolEdges matches allPackToolEdges");
 assert.ok(graph.stats().packToolEdges >= 2, "at least two pack↔tool edges present");
 
-// ── decay: a year-old pack↔tool edge under the floor is pruned ──
+// ── prune: a year-old pack↔tool edge fades on read and is physically deleted ──
 const ptDb = graph.openDb();
 ptDb.prepare("UPDATE pack_tool_edges SET last_reinforced=? WHERE pack=? AND tool=?")
   .run(new Date(Date.now() - 365 * 86400000).toISOString(), "san-marco-agreements", "spaces");
-const decayRes = graph.decay({ halfLifeDays: 1, pruneBelow: 0.15 });
-assert.ok(decayRes.pruned >= 1, "stale pack↔tool edge pruned by decay");
-assert.strictEqual(graph.packTools("san-marco-agreements").length, 0, "pruned pack↔tool edges gone");
+assert.strictEqual(graph.packTools("san-marco-agreements").length, 0, "faded pack↔tool edges invisible to reads");
+const pruneRes = graph.prune({ halfLifeDays: 1, pruneBelow: 0.15 });
+assert.ok(pruneRes.pruned >= 1, "stale pack↔tool edge pruned");
+assert.strictEqual(graph.allPackToolEdges().filter((e) => e.pack === "san-marco-agreements").length, 0,
+  "pruned pack↔tool rows physically gone");
 
 // ── pruneOrphans: drops edges for a removed tool and (with packsLib) a removed pack ──
 graph.recordPackTool("live-pack", "live-tool", { command: "live-tool go", bump: 1 });
@@ -152,5 +175,33 @@ assert.ok(graph.packTools("live-pack").some((u) => u.tool === "live-tool"), "liv
 assert.ok(!graph.packTools("live-pack").some((u) => u.tool === "ghost-tool"), "missing-tool edge gone");
 assert.strictEqual(graph.packTools("ghost-pack").length, 0, "missing-pack edge gone");
 
+// ── v1 migration: legacy DBs (pre decay-on-read) get their clocks restarted on
+// first open — stored weights are treated as current in both tables ──
 graph._resetForTest();
+process.env.TOOL_GRAPH_DB = path.join(tmp, "legacy.db");
+{
+  const { DatabaseSync } = require("node:sqlite");
+  const raw = new DatabaseSync(process.env.TOOL_GRAPH_DB);
+  const old = new Date(Date.now() - 200 * 86400000).toISOString();
+  raw.exec(`CREATE TABLE tool_edges (src TEXT NOT NULL, dst TEXT NOT NULL,
+    weight REAL NOT NULL DEFAULT 1, last_reinforced TEXT, created TEXT, PRIMARY KEY (src, dst))`);
+  raw.exec(`CREATE TABLE pack_tool_edges (pack TEXT NOT NULL, tool TEXT NOT NULL,
+    command TEXT NOT NULL DEFAULT '', intent TEXT NOT NULL DEFAULT '',
+    weight REAL NOT NULL DEFAULT 1, last_reinforced TEXT, created TEXT, PRIMARY KEY (pack, tool, command))`);
+  raw.prepare("INSERT INTO tool_edges (src, dst, weight, last_reinforced, created) VALUES (?,?,?,?,?)")
+    .run("l-a", "l-b", 3, old, old);
+  raw.prepare("INSERT INTO pack_tool_edges (pack, tool, command, weight, last_reinforced, created) VALUES (?,?,?,?,?,?)")
+    .run("l-pack", "l-tool", "l-tool go", 2, old, old);
+  raw.close();
+}
+delete require.cache[require.resolve("./core/tool-graph")];
+const graph2 = require("./core/tool-graph");
+const lEdge = graph2.allEdges().find((e) => e.src === "l-a");
+const lPt = graph2.allPackToolEdges().find((e) => e.pack === "l-pack");
+assert.ok(Date.parse(lEdge.last_reinforced) > Date.now() - 60000, "migration restamps legacy tool edges");
+assert.ok(Date.parse(lPt.last_reinforced) > Date.now() - 60000, "migration restamps legacy pack↔tool edges");
+assert.strictEqual(lEdge.weight, 3, "stored weight untouched by migration");
+assert.strictEqual(graph2.followers("l-a")[0].weight, 3, "restamped edge reads at full stored weight");
+graph2._resetForTest();
+
 console.log("tool-graph OK");

package/test-tool-manifest.js

@@ -106,5 +106,37 @@ const approvals = require("./core/approvals");
   approvals.decide(rec3.id, "denied", "c1");
   assert.strictEqual(await approvals.waitForDecision(rec3.id, { timeoutMs: 5000, pollMs: 50 }), "denied");
 
+  // ── B10: missing keyring creds are preflighted BEFORE the one-shot approval
+  // token is consumed. The old order burned the human's decision on a run that
+  // could never start; the same token must survive and redeem after the key
+  // is set, with the byte-identical command.
+  const toolCli = require("./bin/tool");
+  const b10src = path.join(tmp, "vaulted.sh");
+  fs.writeFileSync(b10src, "#!/usr/bin/env bash\necho ran-vaulted\n");
+  tools.addTool(b10src, { name: "vaulted", description: "needs a cred", risk: "destructive", requires: ["vaulted_api_key"] });
+  const b10cmd = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "vaulted", "go"]);
+  const b10rec = approvals.create({ tool: "vaulted", tier: "destructive", command: b10cmd, channelId: "c1", adapter: "tg" });
+  approvals.decide(b10rec.id, "approved", "c1");
+  const errs = [];
+  const realErr = console.error;
+  console.error = (...a) => errs.push(a.join(" "));
+  try {
+    process.exitCode = 0;
+    await toolCli.run(["run", "vaulted", "go", "--approval", b10rec.id]);
+    assert.strictEqual(process.exitCode, 1, "missing creds refuse the run with exit 1, not an approval error");
+    assert.ok(errs.some((l) => /missing keyring keys vaulted_api_key/.test(l)), "failure names the missing key");
+    assert.ok(errs.some((l) => /NOT consumed/.test(l)), "agent is told the token survived");
+    assert.strictEqual(approvals.read(b10rec.id).consumedAt, undefined, "the approval token is NOT burned by the creds failure");
+
+    fs.writeFileSync(process.env.KEYRING_FILE, JSON.stringify({ vaulted_api_key: "k" }));
+    process.exitCode = 0;
+    await toolCli.run(["run", "vaulted", "go", "--approval", b10rec.id]);
+    assert.strictEqual(process.exitCode, 0, "the same token redeems once the key exists");
+    assert.ok(approvals.read(b10rec.id).consumedAt, "token consumed exactly by the real run");
+  } finally {
+    console.error = realErr;
+    process.exitCode = 0;
+  }
+
   console.log("tool manifest OK");
 })().catch((e) => { console.error(e); process.exit(1); });

package/test-tools.js

@@ -490,4 +490,35 @@ assert.ok(tools.removeTool("hello"), "removeTool returns the removed tool");
 assert.strictEqual(tools.findTool("hello"), null, "removed tool is gone");
 assert.ok(!fs.existsSync(path.join(process.env.TOOLS_DIR, "hello")), "removed tool's directory is gone");
 
+// ── keyring durability (B6/B13): atomic save + .bak fallback on corruption ──
+// A half-written keyring must not silently strip every tool of credentials:
+// save() snapshots the last-good file, load() falls back to it and says so
+// loudly on stderr (once per process) instead of returning {} in silence.
+const keyring = require("./core/keyring");
+const KR = process.env.KEYRING_FILE;
+fs.rmSync(KR, { force: true });
+fs.rmSync(KR + ".bak", { force: true });
+keyring.set("kr_a", "1");
+assert.ok(!fs.existsSync(KR + ".bak"), "first save has no previous version to snapshot");
+keyring.set("kr_b", "2");
+assert.deepStrictEqual(JSON.parse(fs.readFileSync(KR + ".bak", "utf-8")), { kr_a: "1" },
+  "second save snapshots the previous good version to .bak");
+assert.strictEqual(fs.statSync(KR).mode & 0o777, 0o600, "keyring file is 0600 from birth");
+const krErrs = [];
+const realErr = console.error;
+console.error = (...a) => krErrs.push(a.join(" "));
+try {
+  fs.writeFileSync(KR, "{truncated-by-crash"); // simulate a torn write
+  assert.deepStrictEqual(keyring.all(), { kr_a: "1" }, "corrupt primary falls back to .bak snapshot");
+  assert.strictEqual(keyring.get("kr_a"), "1", "get() reads through the fallback");
+  keyring.all();
+  assert.strictEqual(krErrs.filter((l) => /corrupt/.test(l)).length, 1, "corruption is warned exactly once per process");
+} finally {
+  console.error = realErr;
+}
+keyring.set("kr_c", "3"); // next save repairs the primary from the fallback view
+assert.deepStrictEqual(JSON.parse(fs.readFileSync(KR, "utf-8")), { kr_a: "1", kr_c: "3" },
+  "save after corruption rewrites a valid primary from the recovered data");
+assert.ok(!fs.readdirSync(tmp).some((f) => f.endsWith(".tmp")), "no stray temp files left behind by atomic writes");
+
 console.log("tools OK");