@jmtrin/opencode-kevin 0.8.0 → 1.0.0

package/dist/plugin/index.js

@@ -11,6 +11,7 @@ import { ContextInjector } from "./ContextInjector.js";
 import { ConventionMiner } from "./ConventionMiner.js";
 import { Curator } from "./Curator.js";
 import { Feedback } from "./Feedback.js";
+import { HookLiveness } from "./HookLiveness.js";
 import { InjectionLedger } from "./InjectionLedger.js";
 import { Materializer, SKILL_TOPIC } from "./Materializer.js";
 import { MemoryService, hasRepoIdColumn, } from "./MemoryService.js";
@@ -25,16 +26,24 @@ import { Store } from "./Store.js";
 import { ToolCallObserver } from "./ToolCallObserver.js";
 import { probe } from "./capabilities.js";
 import { computeConfidence } from "./confidence.js";
+import { probeHost, summarize } from "./host.js";
 import { kevinApprove } from "./kevin_approve.js";
 import { buildAudit } from "./kevin_audit.js";
+import { buildKevinBench } from "./kevin_bench.js";
 import { executeKevinConflicts } from "./kevin_conflicts.js";
+import { buildKevinContract } from "./kevin_contract.js";
+import { buildDoctor } from "./kevin_doctor.js";
 import { buildKevinFacts } from "./kevin_facts.js";
+import { handleNative } from "./kevin_native.js";
 import { kevinPropose } from "./kevin_propose.js";
 import { kevinPublish } from "./kevin_publish.js";
 import { kevinWhy } from "./kevin_why.js";
 import { Metrics } from "./metrics.js";
+import { attachNative } from "./native.js";
 import { exportMarkdown, exportOkf } from "./okf-export.js";
 import { importOkf } from "./okf-import.js";
+import { Perf } from "./perf.js";
+import { uuidv7 } from "./uuid.js";
 // v0.6.0 (K6-019) — process-global set of reference topics already
 // registered with the host this process. Keeps re-registration idempotent
 // across sessions within one process: a topic registered once is never
@@ -84,6 +93,24 @@ export const KEVIN_CONFIG_KEYS = [
     "share_requires_approval",
     "author_identity_mode",
     "shared_confidence_floor",
+    // v0.9.0 (K9-003 / plan §8.10) — the four keys seeded by migration 010
+    // section 5. Omitting these makes `kevin_config set` return
+    // { error: "unknown_key" } while `kevin_config list` still shows them.
+    // hook_liveness_enabled and the two registration/history flags must be
+    // compared with === "1" (they are TEXT, and '0' is truthy);
+    // dead_hook_report_threshold is a string read with Number.parseInt and
+    // clamped to [1, 1000], NaN defaulting to 3 (conventions, §2; D9-09).
+    "hook_liveness_enabled",
+    "native_registration_enabled",
+    "host_probe_history_enabled",
+    "dead_hook_report_threshold",
+    // v1.0.0 (K10-005 / plan §6) — the four keys seeded by migration 011
+    // section 4. Omitting these makes `kevin_config set` return
+    // { error: "unknown_key" } while `kevin_config list` still shows them.
+    "perf_enabled",
+    "perf_ring_capacity",
+    "perf_flush_on_idle",
+    "contract_report_enabled",
 ];
 // v0.7.0 (K7-003 / plan §5.6, D7-12) — the explicit VALUE domain for
 // `error_lesson_mode`. The setting is TEXT and must be compared with
@@ -93,7 +120,7 @@ export const KEVIN_CONFIG_KEYS = [
 // behaviour on the next reflection.
 export const ERROR_LESSON_MODE_VALUES = ["all", "triage_only"];
 /** Plugin release version — stamped into generated files (K8-021/027). */
-export const KEVIN_VERSION = "0.8.0";
+export const KEVIN_VERSION = "1.0.0";
 function resolveMigrationsDir() {
     const here = dirname(fileURLToPath(import.meta.url));
     return join(here, "..", "migrations");
@@ -235,7 +262,12 @@ export const KevinPlugin = async (input, options) => {
     // (plan §5.7 fallback; D2-11 project scoping wired into the live path).
     // v0.8.0 (K8-006 / plan §5.1): the repository identity resolves once at
     // init, next to the project id, and never on a hot path.
-    const identity = RepoIdentity.resolve(process.cwd());
+    // v0.9.0 (K9-004/K9-006 / plan §5.1-5.2, D9-12/D9-13): the host surface
+    // is probed once at construction — frozen, never re-probed — and feeds
+    // the identity chain as the third source, above `path` and below
+    // `declared`/`remote`.
+    const host = await probeHost(input);
+    const identity = RepoIdentity.resolve(process.cwd(), host);
     const projectId = identity.projectId;
     const repoId = identity.repoId;
     const identitySource = identity.source;
@@ -249,6 +281,36 @@ export const KevinPlugin = async (input, options) => {
     // not what the session is scoped on.
     let sessionIdentity = identity;
     const memoryService = new MemoryService(store, metrics, repoId);
+    // v0.9.0 (K9-008 / plan §5.1, D9-08) — host probe history: one
+    // host_probes row per construction when host_probe_history_enabled
+    // is explicitly '1' (TEXT comparison — truthiness would fire on
+    // '0'). Append-only and unbounded by design: off by default, one
+    // row per process start, no retention policy.
+    if (memoryService.getSetting("host_probe_history_enabled", "0") === "1") {
+        store
+            .prepare(`INSERT INTO host_probes
+				 (id, plugin_version, flavour, has_shell, v2_skill, v2_reference, notes)
+				 VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(uuidv7(), host.pluginVersion, host.flavour, host.hasShell ? 1 : 0, host.v2.skill ? 1 : 0, host.v2.reference ? 1 : 0, host.notes.join("\n"));
+    }
+    // v0.9.0 (K9-009 / plan §5.3, D9-07/D9-08) — hook liveness. Wraps every
+    // hook with a success-path recorder; counters persist on the
+    // metrics.flush() cadence. Explicit === "1" TEXT comparison
+    // (kevin_settings.value is TEXT).
+    const liveness = new HookLiveness(store, {
+        enabled: memoryService.getSetting("hook_liveness_enabled", "1") === "1",
+        thresholdText: memoryService.getSetting("dead_hook_report_threshold", "3"),
+        pluginVersion: host.pluginVersion,
+    });
+    // v1.0.0 (K10-012 / plan §5.2) — the performance instrument. Measures
+    // how long each hook holds the host into per-scope ring buffers that
+    // only reach the store at session.idle (D10-11: no perf_samples write
+    // anywhere else). perf_enabled uses the explicit === "1" TEXT
+    // comparison; the capacity string goes through the parse guard/clamp.
+    const perf = new Perf({
+        enabled: memoryService.getSetting("perf_enabled", "1") === "1",
+        capacity: memoryService.getSetting("perf_ring_capacity", "") ?? "",
+    });
     // v0.7.0 (K7-009 / plan §5.1, D7-13) — the repository truth scanner reads
     // the JSON project files. Runs once at init, gated by repo_truth_enabled.
     const projectRoot = opts.projectRoot ?? process.cwd();
@@ -334,6 +396,24 @@ export const KevinPlugin = async (input, options) => {
     mkdirSync(join(materializerRoot, "refs"), { recursive: true });
     const capabilities = probe(input);
     const materializer = new Materializer(store, { root: materializerRoot });
+    // v0.9.0 (K9-016 / plan §5.4, D9-10) — native registration replaces
+    // file emission. When attachNative returns a registration for a
+    // surface, the corresponding *_emission_enabled path is skipped for
+    // that surface only. The guard lives in Materializer.
+    try {
+        const nativeReg = await attachNative(host, {
+            materializer,
+            settings: memoryService,
+            store,
+        });
+        if (nativeReg) {
+            materializer.markNativeRegistered("skill", nativeReg.registered.skill);
+            materializer.markNativeRegistered("reference", nativeReg.registered.reference);
+        }
+    }
+    catch {
+        // attachNative never throws (D9-12) — guard against unexpected rejection.
+    }
     // v0.6.0 (K6-018 / plan §8.14, D6-13) — skill emission at session
     // start, behind the capability probe AND `skill_emission_enabled`
     // (default '0'). Both no-op paths are silent: "unavailable" (v1 host)
@@ -390,6 +470,9 @@ export const KevinPlugin = async (input, options) => {
         }
     }
     let currentSessionId = null;
+    // v1.0.0 (K10-013 / D10-08) — set on the first tool completion of a
+    // session; consumed at idle to arm the deferred-dispose marker.
+    let sessionRecordedWork = false;
     // BUG-011 — process-global last derived query. Cleared on
     // `session.idle`; the per-session map below is the preferred source.
     let lastUserQuery = null;
@@ -445,7 +528,11 @@ export const KevinPlugin = async (input, options) => {
             projectId,
         }));
     }
-    return {
+    // v0.9.0 (K9-009 / plan §5.3) — the hooks object is wrapped here at the
+    // point of return: transparent (identical keys/arity/returns/errors),
+    // recording fires on the success path only. With hook_liveness_enabled
+    // '0' the wrapper returns this same object untouched.
+    return liveness.wrap({
         tool: {
             kevin_save: tool({
                 description: "Guarda una memoria en el conocimiento persistente de Kevin (error, pattern, decision o context).",
@@ -783,8 +870,8 @@ export const KevinPlugin = async (input, options) => {
                             // monotone across releases; K6-024 extends this
                             // block with the remaining v0.6 fields. v0.8.0
                             // (K8-025) — 18 v0.7 + kevin_project +
-                            // kevin_share + kevin_sync = 21.
-                            tool_count: 21,
+                            // kevin_native = 23.
+                            tool_count: 23,
                             v07,
                             memories_reflector: memoriesReflector,
                             memories_agent: memoriesAgent,
@@ -819,6 +906,10 @@ export const KevinPlugin = async (input, options) => {
                             v06,
                             // v0.8.0 (K8-025) — omitted on pre-009 DBs.
                             v08,
+                            // v0.9.0 (K9-008 / plan §5.1) — one-line host
+                            // summary: version, flavour, shell, v2 flags;
+                            // no paths, no ids (charset-safe for log lines).
+                            host_summary: summarize(host),
                         }),
                     };
                 },
@@ -846,7 +937,7 @@ export const KevinPlugin = async (input, options) => {
                                     path: res.path,
                                     id: res.id,
                                     created_at: res.createdAt,
-                                    generator: "opencode-kevin/0.8.0",
+                                    generator: "opencode-kevin/0.9.0",
                                 }
                                 : {
                                     action: "init",
@@ -968,6 +1059,91 @@ export const KevinPlugin = async (input, options) => {
                     };
                 },
             }),
+            // v0.9.0 (K9-018 / plan §5.5, D9-09) — kevin_doctor: pure
+            // reads, no writes, no probe re-run, no model call. The host
+            // block comes from the frozen init-time probe, hooks from the
+            // persisted hook_liveness table, native from the last
+            // registration per surface, verdict from reduceVerdict.
+            kevin_doctor: tool({
+                description: "Doctor de Kevin (v0.9.0): salud del host, hooks, dependencias y registros nativos. Solo lectura, sin LLM ni writes, invocable en cualquier momento. Devuelve host (version, flavour, shell, v2), hooks ordenados dead primero, dependencies (zod_copies), native (enabled, registered/verified por surface), verdict (healthy|degraded|unknown) y reason. Output pensado para pegar en un issue: sin filesystem paths ni session ids.",
+                args: {},
+                async execute() {
+                    const report = buildDoctor(store, host, memoryService);
+                    return {
+                        title: "Doctor de Kevin",
+                        output: JSON.stringify(report),
+                    };
+                },
+            }),
+            // v0.9.0 (K9-019 / plan §5.5, D9-12) — kevin_native: inspect
+            // and toggle native_registration_enabled. enable/disable write
+            // kevin_settings only and never re-attach — the probe is
+            // frozen for the process lifetime, so a restart is the
+            // requirement for the change to take effect. `enable` on a
+            // host without the v2 subpath succeeds and reports the
+            // registration as inert: the setting is a statement of intent.
+            kevin_native: tool({
+                description: "Registros nativos v2 (v0.9.0): show reporta el setting native_registration_enabled, si el host resuelto expone el subpath v2 (effective) y las ultimas filas de native_registrations por surface; enable/disable escriben el setting ('1'/'0' TEXT) y NO re-adjuntan — el probe es frozen para la vida del proceso, un restart del host es el requisito para que el cambio tenga efecto; enable en un host sin subpath v2 exito con registration inert.",
+                args: {
+                    action: tool.schema
+                        .enum(["show", "enable", "disable"])
+                        .default("show"),
+                },
+                async execute(args) {
+                    const report = handleNative(args.action, {
+                        host,
+                        store,
+                        settings: memoryService,
+                    });
+                    return {
+                        title: "Kevin native",
+                        output: JSON.stringify(report),
+                    };
+                },
+            }),
+            // v1.0.0 (K10-018 / plan §5.6) — kevin_contract: the frozen
+            // surface, inspectable at runtime rather than only at test
+            // time. Read-only; summary by default, one clause's full value
+            // with clause+format:'full'. Unknown clause ids are a
+            // structured error, never a throw.
+            kevin_contract: tool({
+                description: "Contrato publico de Kevin (v1.0.0): version, digest y por clausula id/titulo/estabilidad/since/deprecacion. clause:'C-0N' con format:'full' retorna el valor completo de esa clausula (marcadores, tool names, settings keys, metric keys, entry points, schema, invariantes). Solo lectura, sin LLM ni red.",
+                args: {
+                    clause: tool.schema
+                        .string()
+                        .optional()
+                        .describe("Id de clausula (ej. 'C-01'). Sin clause: resumen."),
+                    format: tool.schema
+                        .enum(["summary", "full"])
+                        .optional()
+                        .describe("summary (default): una linea por clausula. full: valores completos (requiere clause para una clausula; solo devuelve resumen enriquecido si se omite)."),
+                },
+                async execute(args) {
+                    const result = buildKevinContract({ packageVersion: KEVIN_VERSION }, args);
+                    return {
+                        title: "Contrato de Kevin",
+                        output: JSON.stringify(result),
+                    };
+                },
+            }),
+            // v1.0.0 (K10-019 / plan §5.6) — kevin_bench: reports what
+            // `npm run bench` recorded in bench_runs. It NEVER runs the
+            // benchmark from inside a live session.
+            kevin_bench: tool({
+                description: "Resultados del benchmark de retrieval (v1.0.0). status: si hay corridas, digest del corpus mas reciente y si coincide con el corpus en disco. last: los cuatro brazos (none/recent-k/random-k/kevin) con precision@5, recall@5 y MRR de la ultima corrida. NUNCA ejecuta el benchmark — corre 'npm run bench' fuera de la sesion.",
+                args: {
+                    action: tool.schema
+                        .enum(["status", "last"])
+                        .describe("status | last"),
+                },
+                async execute(args) {
+                    const result = buildKevinBench({ store }, args);
+                    return {
+                        title: "Benchmark de Kevin",
+                        output: JSON.stringify(result),
+                    };
+                },
+            }),
             kevin_retrospective: tool({
                 description: "Genera un retrospective markdown para una sesion (resume tools que fallaron y lecciones aprendidas).",
                 args: {
@@ -1408,256 +1584,400 @@ export const KevinPlugin = async (input, options) => {
             }),
         },
         "tool.execute.before": async (hookInput, output) => {
-            rememberToolCall(hookInput.callID, hookInput.tool, output.args);
-            observer.onBefore({
-                tool: hookInput.tool,
-                args: output.args,
-                sessionId: hookInput.sessionID,
-                callID: hookInput.callID,
-                projectId,
-            }, {});
+            // v1.0.0 (K10-012) — perf measures the synchronous hold time;
+            // HookLiveness wraps the outside of this handler (compose,
+            // never merge — D10-09).
+            perf.measure("tool.execute.before", () => {
+                rememberToolCall(hookInput.callID, hookInput.tool, output.args);
+                observer.onBefore({
+                    tool: hookInput.tool,
+                    args: output.args,
+                    sessionId: hookInput.sessionID,
+                    callID: hookInput.callID,
+                    projectId,
+                }, {});
+            });
         },
         "tool.execute.after": async (hookInput, output) => {
-            const meta = (output.metadata ?? {});
-            const outputText = String(output.output ?? "");
-            const stderr = String(meta.stderr ?? "");
-            const stdout = String(meta.stdout ?? outputText);
-            const exitCode = pickExitCode(meta);
-            let success;
-            if (meta.success === false) {
-                success = false;
-            }
-            else if (exitCode !== undefined) {
-                success = exitCode === 0;
-            }
-            else if (stderr.length > 0 && ERROR_LINE_RE.test(stderr)) {
-                success = false;
-            }
-            else {
-                const stream = stdout.length > 0 ? stdout : outputText;
-                success = !(stream.length > 0 && STRONG_ERROR_RE.test(stream));
-            }
-            observer.onAfter({
-                tool: hookInput.tool,
-                args: hookInput.args,
-                sessionId: hookInput.sessionID,
-                callID: hookInput.callID,
-                projectId,
-            }, { success, stdout, stderr, exitCode });
-            if (!success) {
-                const errorType = observer.inferErrorType(stderr, stdout, exitCode);
-                fireAndForget(reflector.invoke({
-                    toolName: hookInput.tool,
-                    argsSummary: observer.summarizeArgs(hookInput.args),
-                    stderr,
-                    stdout,
-                    exitCode,
-                    errorType,
+            perf.measure("tool.execute.after", () => {
+                sessionRecordedWork = true;
+                // v0.9.0 (K9-010 / plan §5.3) — checkpoint: the session reached a
+                // model turn, so the system prompt was assembled and
+                // `experimental.chat.system.transform` MUST have been offered.
+                // Deduped per session inside HookLiveness.expect.
+                if (hookInput.sessionID) {
+                    liveness.expect("experimental.chat.system.transform", hookInput.sessionID);
+                }
+                const meta = (output.metadata ?? {});
+                const outputText = String(output.output ?? "");
+                const stderr = String(meta.stderr ?? "");
+                const stdout = String(meta.stdout ?? outputText);
+                const exitCode = pickExitCode(meta);
+                let success;
+                if (meta.success === false) {
+                    success = false;
+                }
+                else if (exitCode !== undefined) {
+                    success = exitCode === 0;
+                }
+                else if (stderr.length > 0 && ERROR_LINE_RE.test(stderr)) {
+                    success = false;
+                }
+                else {
+                    const stream = stdout.length > 0 ? stdout : outputText;
+                    success = !(stream.length > 0 && STRONG_ERROR_RE.test(stream));
+                }
+                observer.onAfter({
+                    tool: hookInput.tool,
+                    args: hookInput.args,
                     sessionId: hookInput.sessionID,
                     callID: hookInput.callID,
                     projectId,
-                }));
-            }
-            else {
-                causalChain.onSuccess(hookInput.tool, hookInput.args, projectId, hookInput.sessionID);
-            }
+                }, { success, stdout, stderr, exitCode });
+                if (!success) {
+                    const errorType = observer.inferErrorType(stderr, stdout, exitCode);
+                    fireAndForget(reflector.invoke({
+                        toolName: hookInput.tool,
+                        argsSummary: observer.summarizeArgs(hookInput.args),
+                        stderr,
+                        stdout,
+                        exitCode,
+                        errorType,
+                        sessionId: hookInput.sessionID,
+                        callID: hookInput.callID,
+                        projectId,
+                    }));
+                }
+                else {
+                    causalChain.onSuccess(hookInput.tool, hookInput.args, projectId, hookInput.sessionID);
+                }
+            });
         },
         "chat.message": async (hookInput, output) => {
-            const text = output.parts
-                .map((p) => p)
-                .filter((p) => p.type === "text")
-                .map((p) => p.text ?? "")
-                .join(" ");
-            if (text.trim()) {
-                const derived = injector.deriveQuery([{ role: "user", content: text }]);
-                lastUserQuery = derived.length > 0 ? derived : null;
-                if (hookInput.sessionID && lastUserQuery) {
-                    lastUserQueryBySession.set(hookInput.sessionID, lastUserQuery);
+            perf.measure("chat.message", () => {
+                const text = output.parts
+                    .map((p) => p)
+                    .filter((p) => p.type === "text")
+                    .map((p) => p.text ?? "")
+                    .join(" ");
+                if (text.trim()) {
+                    const derived = injector.deriveQuery([
+                        { role: "user", content: text },
+                    ]);
+                    lastUserQuery = derived.length > 0 ? derived : null;
+                    if (hookInput.sessionID && lastUserQuery) {
+                        lastUserQueryBySession.set(hookInput.sessionID, lastUserQuery);
+                    }
                 }
-            }
+            });
         },
         "experimental.chat.system.transform": async (hookInput, output) => {
-            // BUG-011 — prefer the per-session query so a new session whose
-            // first transform fires before any chat.message cannot reuse the
-            // previous session's query (the global is cleared on idle).
-            const query = lastUserQueryBySession.get(hookInput.sessionID ?? "") ?? lastUserQuery;
-            if (!query)
-                return;
-            const suggestion = injector.generateSuggestion();
-            if (suggestion)
-                output.system.push(suggestion);
-            injector.onSystemTransform({
-                sessionID: hookInput.sessionID ?? undefined,
-                messages: [{ role: "user", content: query }],
-            }, output);
+            perf.measure("chat.system.transform", () => {
+                // BUG-011 — prefer the per-session query so a new session whose
+                // first transform fires before any chat.message cannot reuse the
+                // previous session's query (the global is cleared on idle).
+                const query = lastUserQueryBySession.get(hookInput.sessionID ?? "") ??
+                    lastUserQuery;
+                if (!query)
+                    return;
+                const suggestion = injector.generateSuggestion();
+                if (suggestion)
+                    output.system.push(suggestion);
+                injector.onSystemTransform({
+                    sessionID: hookInput.sessionID ?? undefined,
+                    messages: [{ role: "user", content: query }],
+                }, output);
+            });
         },
         "experimental.session.compacting": async (hookInput, output) => {
-            // v0.4.0 (K4-018) — plan §5.6: compaction often fires with no
-            // recent chat.message (auto-compact after a long tool turn,
-            // resumed sessions). Resolve a query per session first, then
-            // the global fallback, then any messages the runtime may
-            // provide (defensive — the current SDK contract only exposes
-            // sessionID).
-            // BUG-012 — the HITL suggestion fires AT MOST ONCE per session:
-            // whichever hook (transform or compacting) runs first consumes
-            // the pending recurrence signal (generateSuggestion resets it).
-            const suggestion = injector.generateSuggestion();
-            if (suggestion)
-                output.context.push(suggestion);
-            const sid = hookInput.sessionID;
-            const sessionQuery = lastUserQueryBySession.get(sid) ?? lastUserQuery;
-            const runtimeMessages = hookInput
-                .messages;
-            const messages = sessionQuery != null
-                ? [{ role: "user", content: sessionQuery }]
-                : (runtimeMessages ?? []);
-            injector.onCompacting({
-                sessionID: sid,
-                messages,
-            }, output);
+            perf.measure("session.compacting", () => {
+                // v0.4.0 (K4-018) — plan §5.6: compaction often fires with no
+                // recent chat.message (auto-compact after a long tool turn,
+                // resumed sessions). Resolve a query per session first, then
+                // the global fallback, then any messages the runtime may
+                // provide (defensive — the current SDK contract only exposes
+                // sessionID).
+                // BUG-012 — the HITL suggestion fires AT MOST ONCE per session:
+                // whichever hook (transform or compacting) runs first consumes
+                // the pending recurrence signal (generateSuggestion resets it).
+                const suggestion = injector.generateSuggestion();
+                if (suggestion)
+                    output.context.push(suggestion);
+                const sid = hookInput.sessionID;
+                const sessionQuery = lastUserQueryBySession.get(sid) ?? lastUserQuery;
+                const runtimeMessages = hookInput
+                    .messages;
+                const messages = sessionQuery != null
+                    ? [{ role: "user", content: sessionQuery }]
+                    : (runtimeMessages ?? []);
+                injector.onCompacting({
+                    sessionID: sid,
+                    messages,
+                }, output);
+            });
         },
         event: async ({ event }) => {
             const type = event.type;
             const props = event.properties ?? {};
-            if (type === "session.created") {
-                const info = props.info;
-                if (info?.id) {
-                    currentSessionId = info.id;
-                    // BUG-011 — a fresh session must not inherit the
-                    // previous session's derived query (the global may
-                    // still hold it if no idle fired).
-                    lastUserQueryBySession.delete(info.id);
-                    // v0.4.0 (K4-017) — plan §5.1 rule 3: the per-session
-                    // seen-set resets when a session is created.
-                    injector.onSessionCreated(info.id);
-                }
-            }
-            else if (type === "session.idle") {
+            if (type === "session.idle") {
+                // v1.0.0 (K10-012) — the idle branch measures under
+                // "session.idle" (150/600 ms budget); every other branch
+                // measures under "event" (5/25 ms). Recording idle's ~150 ms
+                // under "event" would make that budget permanently breached
+                // and therefore ignored.
                 const sid = props.sessionID;
-                if (sid) {
-                    toolCache.clear();
-                    // BUG-011 — the session is done: drop the global query
-                    // so the next session cannot reuse it.
-                    lastUserQuery = null;
-                    // v0.4.0 (K4-024) — plan §5.2: settle the session's
-                    // unmeasured injections (effective/ineffective +
-                    // recurrence_count charges) at idle. Best-effort: a
-                    // legacy DB without migration 005 has no ledger table.
-                    try {
-                        ledger.settle(sid);
-                    }
-                    catch {
-                        // best-effort: a legacy DB without the ledger
-                        // table must not break the idle path
-                    }
-                    // v0.5.0 (K5-012 / plan §5.4) — retire stale lessons at
-                    // idle; pre-006 DBs degrade to a no-op.
-                    try {
-                        archiver.run();
-                    }
-                    catch {
-                        // best-effort, same pattern as ledger.settle
-                    }
-                    fireAndForget(retrospective.generate(sid));
-                    memoryService.boostPositiveReflectors(sid);
-                    const recurred = memoryService.penalizeRecurringReflectors(sid);
-                    injector.setRecurrences(recurred, sid);
-                    patternMiner.mine(projectId);
-                    // v0.7.0 (K7-012 / plan §5.4, D7-10) — convention mining is
-                    // session.idle-only, default-off, and isolated from the rest of
-                    // the idle chain. Mined rules still enter the ordinary Curator
-                    // approval path; this step never writes to the repository.
-                    try {
-                        if (memoryService.getSetting("convention_mining_enabled", "0") === "1") {
-                            const conventions = conventionMiner.mine();
-                            conventionMiner.emit(conventions);
+                await perf.measureAsync("session.idle", async () => {
+                    if (sid) {
+                        toolCache.clear();
+                        // BUG-011 — the session is done: drop the global query
+                        // so the next session cannot reuse it.
+                        lastUserQuery = null;
+                        // v0.4.0 (K4-024) — plan §5.2: settle the session's
+                        // unmeasured injections (effective/ineffective +
+                        // recurrence_count charges) at idle. Best-effort: a
+                        // legacy DB without migration 005 has no ledger table.
+                        try {
+                            ledger.settle(sid);
+                        }
+                        catch {
+                            // best-effort: a legacy DB without the ledger
+                            // table must not break the idle path
+                        }
+                        // v0.5.0 (K5-012 / plan §5.4) — retire stale lessons at
+                        // idle; pre-006 DBs degrade to a no-op.
+                        try {
+                            archiver.run();
+                        }
+                        catch {
+                            // best-effort, same pattern as ledger.settle
+                        }
+                        fireAndForget(retrospective.generate(sid));
+                        memoryService.boostPositiveReflectors(sid);
+                        const recurred = memoryService.penalizeRecurringReflectors(sid);
+                        injector.setRecurrences(recurred, sid);
+                        patternMiner.mine(projectId);
+                        // v0.7.0 (K7-012 / plan §5.4, D7-10) — convention mining is
+                        // session.idle-only, default-off, and isolated from the rest of
+                        // the idle chain. Mined rules still enter the ordinary Curator
+                        // approval path; this step never writes to the repository.
+                        try {
+                            if (memoryService.getSetting("convention_mining_enabled", "0") ===
+                                "1") {
+                                const conventions = conventionMiner.mine();
+                                conventionMiner.emit(conventions);
+                            }
+                        }
+                        catch {
+                            // A throwing miner must not reject or truncate the idle chain.
+                        }
+                        // v0.7.0 (K7-016 / plan §5.5, D7-06) — conflict detection is
+                        // surfacing-only on idle. It may create/open conflict rows, but
+                        // no idle path can acknowledge or resolve one.
+                        try {
+                            if (memoryService.getSetting("conflict_detection_enabled", "0") ===
+                                "1") {
+                                conflictDetector.detect();
+                            }
+                        }
+                        catch {
+                            // Conflict surfacing is best-effort and must not reject idle.
+                        }
+                        fireAndForget(Promise.resolve()
+                            .then(() => causalChain.onSessionIdle(sid))
+                            // non-blocking — promote is a best-effort pass
+                            // (legacy DBs pre-005 lack the recurrence_count
+                            // column)
+                            .catch(() => { }));
+                        // v0.6.0 (K6-015 / plan §8.14) — session-idle curation
+                        // generation. Dry-run only: `propose()` calls `plan()`
+                        // and never `apply()`, so nothing here can touch disk
+                        // (D6-01). Guarded by curation_enabled (TEXT compare)
+                        // and a 1-hour throttle persisted in kevin_settings.
+                        try {
+                            if (memoryService.getSetting("curation_enabled", "1") === "1") {
+                                const CURATION_THROTTLE_MS = 3_600_000;
+                                const last = memoryService.getSetting("last_curation_at", "");
+                                if (last === "" ||
+                                    Date.now() - Date.parse(last) > CURATION_THROTTLE_MS) {
+                                    curator.propose("agents_md", writer);
+                                    store
+                                        .prepare(`INSERT INTO kevin_settings (key, value) VALUES (?, ?)
+										 ON CONFLICT(key) DO UPDATE SET value = excluded.value`)
+                                        .run("last_curation_at", new Date().toISOString());
+                                }
+                            }
+                        }
+                        catch {
+                            // best-effort, same pattern as ledger.settle — a
+                            // curation failure must not break the idle path
+                        }
+                        // v0.8.0 (K8-022 / plan §5.5) — the shared layer
+                        // re-read at idle. Gated by shared_layer_enabled ===
+                        // "1", a TEXT comparison: '0' is a truthy string, so a
+                        // truthiness check would turn the release on for every
+                        // installation that upgrades. Never wired into
+                        // tool.execute.*, chat.message, system.transform or
+                        // session.compacting — the hot-path rule is absolute;
+                        // the file-hash skip is what makes the idle cost one
+                        // read plus one hash on an unchanged repository.
+                        try {
+                            if (memoryService.getSetting("shared_layer_enabled", "0") === "1") {
+                                syncSharedLayer();
+                            }
+                        }
+                        catch {
+                            // best-effort, same pattern as ledger.settle — a
+                            // sync failure must not break the idle path
+                        }
+                        // v1.0.0 (K10-013 / D10-08) — the session recorded work:
+                        // arm the deferred dispose settlement. The ISO timestamp
+                        // lets the next session.start compare it against
+                        // hook_liveness.last_seen_at for dispose.
+                        if (sessionRecordedWork) {
+                            try {
+                                store
+                                    .prepare("INSERT INTO kevin_settings (key, value) VALUES ('last_session_recorded_work', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
+                                    .run(new Date().toISOString());
+                            }
+                            catch {
+                                // best-effort: arming must not break idle
+                            }
+                            sessionRecordedWork = false;
                         }
                     }
-                    catch {
-                        // A throwing miner must not reject or truncate the idle chain.
-                    }
-                    // v0.7.0 (K7-016 / plan §5.5, D7-06) — conflict detection is
-                    // surfacing-only on idle. It may create/open conflict rows, but
-                    // no idle path can acknowledge or resolve one.
+                });
+                metrics.flush();
+                // v1.0.0 (K10-012 / plan §5.2, D10-11) — the idle perf_samples
+                // write (the dispose hook holds the other one), gated by
+                // perf_flush_on_idle (TEXT compare; the fallback matches the
+                // migration-seeded default '1').
+                if (memoryService.getSetting("perf_flush_on_idle", "1") === "1") {
                     try {
-                        if (memoryService.getSetting("conflict_detection_enabled", "0") ===
-                            "1") {
-                            conflictDetector.detect();
-                        }
+                        perf.flush(store);
                     }
                     catch {
-                        // Conflict surfacing is best-effort and must not reject idle.
+                        // best-effort: pre-011 DBs have no perf_samples table
                     }
-                    fireAndForget(Promise.resolve()
-                        .then(() => causalChain.onSessionIdle(sid))
-                        // non-blocking — promote is a best-effort pass
-                        // (legacy DBs pre-005 lack the recurrence_count
-                        // column)
-                        .catch(() => { }));
-                    // v0.6.0 (K6-015 / plan §8.14) — session-idle curation
-                    // generation. Dry-run only: `propose()` calls `plan()`
-                    // and never `apply()`, so nothing here can touch disk
-                    // (D6-01). Guarded by curation_enabled (TEXT compare)
-                    // and a 1-hour throttle persisted in kevin_settings.
-                    try {
-                        if (memoryService.getSetting("curation_enabled", "1") === "1") {
-                            const CURATION_THROTTLE_MS = 3_600_000;
-                            const last = memoryService.getSetting("last_curation_at", "");
-                            if (last === "" ||
-                                Date.now() - Date.parse(last) > CURATION_THROTTLE_MS) {
-                                curator.propose("agents_md", writer);
+                }
+                liveness.flush();
+                return;
+            }
+            perf.measure("event", () => {
+                if (type === "session.created") {
+                    const info = props.info;
+                    if (info?.id) {
+                        currentSessionId = info.id;
+                        // BUG-011 — a fresh session must not inherit the
+                        // previous session's derived query (the global may
+                        // still hold it if no idle fired).
+                        lastUserQueryBySession.delete(info.id);
+                        // v0.4.0 (K4-017) — plan §5.1 rule 3: the per-session
+                        // seen-set resets when a session is created.
+                        injector.onSessionCreated(info.id);
+                        // v1.0.0 (K10-013 / plan §5.3, D10-08) — deferred
+                        // dispose settlement. The previous session recorded
+                        // work but the process never came back through
+                        // `dispose` (crash or hard kill): settle it HERE,
+                        // at the start of the next session, because dispose
+                        // cannot be settled within the session that observes
+                        // it. One settlement per work marker; a first-ever
+                        // run has no marker and never reports dead. The
+                        // threshold semantics stay with expect(): unknown
+                        // until expected_count crosses the threshold.
+                        try {
+                            const marker = memoryService.getSetting("last_session_recorded_work", "");
+                            if (marker !== "") {
+                                let fired = true;
+                                try {
+                                    const row = store
+                                        .prepare("SELECT last_seen_at FROM hook_liveness WHERE hook = 'dispose'")
+                                        .get();
+                                    const last = row?.last_seen_at ?? null;
+                                    fired = last !== null && last > marker;
+                                }
+                                catch {
+                                    // pre-010 DB without hook_liveness: treat as
+                                    // no evidence of a fire, same as a crash.
+                                    fired = false;
+                                }
+                                if (!fired) {
+                                    liveness.expect("dispose", `miss:${marker}`);
+                                    store
+                                        .prepare("UPDATE kevin_metrics SET value = value + 1 WHERE key = 'dispose_misses_total'")
+                                        .run();
+                                }
                                 store
-                                    .prepare(`INSERT INTO kevin_settings (key, value) VALUES (?, ?)
-										 ON CONFLICT(key) DO UPDATE SET value = excluded.value`)
-                                    .run("last_curation_at", new Date().toISOString());
+                                    .prepare("UPDATE kevin_settings SET value = '' WHERE key = 'last_session_recorded_work'")
+                                    .run();
                             }
                         }
+                        catch {
+                            // best-effort: settlement must not break session start
+                        }
                     }
-                    catch {
-                        // best-effort, same pattern as ledger.settle — a
-                        // curation failure must not break the idle path
+                }
+                else if (type === "session.next.tool.failed") {
+                    const callID = props.callID;
+                    const sessionID = props.sessionID;
+                    const error = props.error;
+                    if (callID && sessionID && error?.message) {
+                        handleToolFailed(callID, sessionID, error.message);
                     }
-                    // v0.8.0 (K8-022 / plan §5.5) — the shared layer
-                    // re-read at idle. Gated by shared_layer_enabled ===
-                    // "1", a TEXT comparison: '0' is a truthy string, so a
-                    // truthiness check would turn the release on for every
-                    // installation that upgrades. Never wired into
-                    // tool.execute.*, chat.message, system.transform or
-                    // session.compacting — the hot-path rule is absolute;
-                    // the file-hash skip is what makes the idle cost one
-                    // read plus one hash on an unchanged repository.
+                }
+                else if (type === "session.next.tool.success") {
+                    const callID = props.callID;
+                    if (callID)
+                        toolCache.delete(callID);
+                }
+            });
+        },
+        dispose: async () => {
+            // v1.0.0 (K10-013 / plan §5.3) — the seventh instrumented hook.
+            // HookLiveness.wrap (outside) records the fire only if the
+            // delegate completes; Perf.measureAsync (inside) times it even
+            // on throw.
+            try {
+                await perf.measureAsync("dispose", async () => {
                     try {
-                        if (memoryService.getSetting("shared_layer_enabled", "0") === "1") {
-                            syncSharedLayer();
-                        }
+                        await Promise.allSettled([...pending]);
                     }
-                    catch {
-                        // best-effort, same pattern as ledger.settle — a
-                        // sync failure must not break the idle path
+                    finally {
+                        // v1.0.0 (K10-013) — record the fire and persist it now:
+                        // this is the last write of the process.
+                        liveness.recordDispose();
+                        // v1.0.0 (K10-013) — record the successful fire and
+                        // disarm any pending deferred-settlement marker: a
+                        // clean dispose is exactly what the next session's
+                        // settlement check looks for.
+                        store
+                            .prepare("UPDATE kevin_metrics SET value = value + 1 WHERE key = 'dispose_fires_total'")
+                            .run();
+                        try {
+                            store
+                                .prepare("UPDATE kevin_settings SET value = '' WHERE key = 'last_session_recorded_work'")
+                                .run();
+                        }
+                        catch {
+                            // best-effort: legacy DBs without kevin_settings
+                        }
                     }
-                }
-                metrics.flush();
+                });
             }
-            else if (type === "session.next.tool.failed") {
-                const callID = props.callID;
-                const sessionID = props.sessionID;
-                const error = props.error;
-                if (callID && sessionID && error?.message) {
-                    handleToolFailed(callID, sessionID, error.message);
+            finally {
+                // v1.0.0 review fix — persist the final period (including this
+                // dispose sample, recorded by measureAsync above) BEFORE the
+                // closes; otherwise the dispose budget could never be verified
+                // by bench:check because its samples died with the ring.
+                try {
+                    perf.flush(store);
                 }
-            }
-            else if (type === "session.next.tool.success") {
-                const callID = props.callID;
-                if (callID)
-                    toolCache.delete(callID);
+                catch {
+                    // best-effort: pre-011 DBs have no perf_samples table
+                }
+                metrics.close();
+                store.close();
             }
         },
-        dispose: async () => {
-            await Promise.allSettled([...pending]);
-            metrics.close();
-            store.close();
-        },
-    };
+    });
 };
 export default KevinPlugin;
-//# sourceMappingURL=index.js.map