@jmtrin/opencode-kevin 0.9.0 → 1.1.0

package/dist/migrations/011_v10_proven.sql

@@ -0,0 +1,69 @@
+-- =============================================================
+-- Kevin v1.0.0 "Proven" — migration 011
+-- Adds: perf sampling, benchmark results.
+-- No ALTER TABLE (second release running); no column is retyped.
+-- =============================================================
+
+-- 1. Per-scope latency aggregates, flushed at session.idle.
+--    Machine-scoped: no project_id, for the same reason hook_liveness
+--    has none (v0.9.0 D9-08) — latency is a property of the install.
+CREATE TABLE IF NOT EXISTS perf_samples (
+    id             INTEGER PRIMARY KEY AUTOINCREMENT,
+    scope          TEXT    NOT NULL,
+    sample_count   INTEGER NOT NULL,
+    p50_ms         REAL    NOT NULL,
+    p95_ms         REAL    NOT NULL,
+    max_ms         REAL    NOT NULL,
+    budget_p95_ms  REAL    NOT NULL,
+    within_budget  INTEGER NOT NULL DEFAULT 1,
+    recorded_at    TEXT    NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_perf_samples_scope
+    ON perf_samples(scope, recorded_at DESC);
+CREATE INDEX IF NOT EXISTS idx_perf_samples_breach
+    ON perf_samples(within_budget) WHERE within_budget = 0;
+
+-- 2. Benchmark results. Append-only. One row per arm per run.
+--    arm CHECK is closed by the plan; widening requires a table rebuild (intentional friction).
+--    scope CHECK is intentionally absent: the scope union may gain members in a 1.x minor.
+CREATE TABLE IF NOT EXISTS bench_runs (
+    id               INTEGER PRIMARY KEY AUTOINCREMENT,
+    corpus_digest    TEXT    NOT NULL,
+    contract_digest  TEXT    NOT NULL,
+    package_version  TEXT    NOT NULL,
+    runtime          TEXT    NOT NULL,
+    arm              TEXT    NOT NULL,
+    k                INTEGER NOT NULL,
+    precision_at_k   REAL    NOT NULL,
+    recall_at_k      REAL    NOT NULL,
+    mrr              REAL    NOT NULL,
+    ran_at           TEXT    NOT NULL DEFAULT (datetime('now')),
+    CHECK (arm IN ('none', 'recent-k', 'random-k', 'kevin'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_bench_runs_corpus
+    ON bench_runs(corpus_digest, ran_at DESC);
+CREATE INDEX IF NOT EXISTS idx_bench_runs_arm
+    ON bench_runs(arm, ran_at DESC);
+
+-- 3. Metric seeds (45 -> 51).
+INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('perf_samples_recorded', 0);
+INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('perf_budget_breaches', 0);
+INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('dispose_fires_total', 0);
+INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('dispose_misses_total', 0);
+INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('contract_digest_changes', 0);
+INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('bench_runs_total', 0);
+
+-- 4. Setting seeds (27 -> 31). All TEXT; '0'/'1' are strings.
+INSERT OR IGNORE INTO kevin_settings (key, value) VALUES ('perf_enabled', '1');
+INSERT OR IGNORE INTO kevin_settings (key, value) VALUES ('perf_ring_capacity', '512');
+INSERT OR IGNORE INTO kevin_settings (key, value) VALUES ('perf_flush_on_idle', '1');
+INSERT OR IGNORE INTO kevin_settings (key, value) VALUES ('contract_report_enabled', '1');
+
+-- 5. `dispose` becomes the seventh instrumented hook (v0.9.0 migration 010
+--    seeded six rows; this is a data seed, not a schema change).
+INSERT OR IGNORE INTO hook_liveness (hook) VALUES ('dispose');
+
+-- 6. Schema version.
+INSERT OR IGNORE INTO schema_version (version) VALUES ('011');

package/dist/migrations/012_v11_drift.sql

@@ -0,0 +1,24 @@
+-- millisecond companions for the two tables whose ORDERING decides outcomes.
+ALTER TABLE tool_calls       ADD COLUMN ts_ms           INTEGER;
+ALTER TABLE kevin_injections ADD COLUMN injected_at_ms  INTEGER;
+
+-- conservative backfill: seconds -> ms (x1000). Rows keep their original
+-- second-granularity value in the old column; nothing is rewritten there.
+UPDATE tool_calls SET ts_ms =
+  CAST(strftime('%s', ts) AS INTEGER) * 1000
+WHERE ts_ms IS NULL AND ts IS NOT NULL;
+
+UPDATE kevin_injections SET injected_at_ms =
+  CAST(strftime('%s', injected_at) AS INTEGER) * 1000
+WHERE injected_at_ms IS NULL AND injected_at IS NOT NULL;
+
+CREATE INDEX idx_tool_calls_ts_ms        ON tool_calls(ts_ms);
+CREATE INDEX idx_injections_injected_ms  ON kevin_injections(injected_at_ms);
+
+-- metric seeds (C-05 additions carry since=1.1.0 in contract)
+INSERT INTO kevin_metrics (key, value, updated_at) VALUES
+  ('bench_regression_failures',    0, datetime('now')),
+  ('forget_requests_total',        0, datetime('now')),
+  ('forget_tombstones_published',  0, datetime('now'));
+
+INSERT INTO schema_version (version) VALUES ('012');

package/dist/plugin/Archiver.js

@@ -1,3 +1,4 @@
+import { hasArchivedColumn } from "./columns.js";
 /**
  * v0.5.0 Archiver (K5-012 / plan §5.4, D5-05).
  *
@@ -71,23 +72,7 @@ export class Archiver {
         }
     }
     hasArchivedColumn() {
-        return hasArchivedColumnCached(this.store);
-    }
-}
-// v0.6.0 (K6-001a) — positive-only caching: a successful probe is cached,
-// a failed probe is NOT. A Store migrated in place heals on the next call.
-const archivedColumnCache = new WeakMap();
-function hasArchivedColumnCached(store) {
-    const cached = archivedColumnCache.get(store);
-    if (cached === true)
-        return true;
-    try {
-        store.prepare("SELECT archived_at FROM memories LIMIT 1").get();
-        archivedColumnCache.set(store, true);
-        return true;
-    }
-    catch {
-        return false;
+        return hasArchivedColumn(this.store);
     }
 }
 /** 'YYYY-MM-DD HH:MM:SS' UTC — the format SQLite `datetime('now')` uses,
@@ -96,4 +81,3 @@ function formatSqliteUtc(d) {
     const pad = (n) => String(n).padStart(2, "0");
     return `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())} ${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())}`;
 }
-//# sourceMappingURL=Archiver.js.map

package/dist/plugin/ArtifactWriter.d.ts

@@ -35,18 +35,33 @@ export interface WritePlan {
     readonly hashAfter: string;
 }
 /**
- * Rule 9 (K6-009 / plan §5.1, D6-02) — three layers applied to the body
- * before splicing:
- *   (a) the escaping discipline of `plugin/memory-format.ts`;
- *   (b) strip any line containing `kevin:begin` or `kevin:end`, in any
- *       casing, anywhere in the line;
- *   (c) strip HTML comment terminators (`-->`).
- * Without this, a memory containing a literal `<!-- kevin:end -->` line would
- * close the marker comment early and let subsequent content escape the
- * curated region on the next regeneration — a marker-injection variant of the
- * v0.1.5 prompt-injection defect (plan §3.5).
+ * Rule 9, layer (a) — superseded in v1.0.0 by `escapeForMarkerBlock`
+ * in `plugin/escape.ts` (K10-027), which carries the same idempotent
+ * entity discipline.
+ */
+/**
+ * v1.0.0 (K10-027 / plan §5.7) — the boundary functions now live in
+ * `plugin/escape.ts`; this composer applies them in fence-then-marker
+ * order. Layer (b) — strip any line containing `kevin:begin` or
+ * `kevin:end`, in any casing — is a filter rather than an escape and
+ * stays here. Without layer (b), a memory containing a literal
+ * `<!-- kevin:end -->` line would close the marker comment early and
+ * let subsequent content escape the curated region on the next
+ * regeneration — a marker-injection variant of the v0.1.5
+ * prompt-injection defect (plan §3.5). The trailing `-->` strip is kept
+ * as defence in depth although `escapeForMarkerBlock` already escapes
+ * every `>` that could form one.
  */
 export declare function sanitizeArtifactBody(body: string): string;
+/**
+ * v1.0.0 (K10-027 / plan §5.7, rule 2) — whole-file writes escape by
+ * container. Only `.okf` files are line-oriented JSON: each line gets
+ * `escapeForOkfLine`, which is the identity on a well-formed OKF line
+ * (canonical JSON never contains raw control characters) and therefore
+ * preserves the re-render `noop`. Kevin-owned markdown paths keep their
+ * bytes — fences there are legitimate content.
+ */
+export declare function escapeForContainer(path: string, content: string): string;
 /**
  * v0.6.0 (K6-005 / plan §5.1) — the single write path to disk (D6-01).
  *

package/dist/plugin/ArtifactWriter.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { closeSync, fsyncSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, } from "node:fs";
 import { unifiedDiff } from "./diff.js";
+import { escapeForFence, escapeForMarkerBlock, escapeForOkfLine, } from "./escape.js";
 import { uuidv7 } from "./uuid.js";
 // v0.6.0 (K6-005 / plan §5.1, D6-02) — the frozen marker contract. The exact
 // byte sequences are load-bearing: README, v1.0.0 plan C-01 and the round-trip
@@ -30,39 +31,55 @@ function normalizeEol(body, eol) {
     return body.replace(/\r\n/g, "\n").replace(/\n/g, eol);
 }
 /**
- * Rule 9, layer (a) — the escaping discipline of `plugin/memory-format.ts`
- * (`&`, `<`, `>`) made idempotent: an ampersand that already heads a known
- * entity (`&amp;`, `&lt;`, `&gt;`, `&#NNN;`) is left alone, so sanitizing
- * sanitized output is a fixed point. The round-trip property of the marker
- * block depends on this: a non-idempotent escape would grow `&amp;lt;` on
- * every regeneration (K6-009 / plan §5.1 rule 9).
+ * Rule 9, layer (a) — superseded in v1.0.0 by `escapeForMarkerBlock`
+ * in `plugin/escape.ts` (K10-027), which carries the same idempotent
+ * entity discipline.
  */
-function escapeIdempotent(text) {
-    return text
-        .replace(/&(?!(amp|lt|gt|#\d+);)/g, "&amp;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;");
-}
 /**
- * Rule 9 (K6-009 / plan §5.1, D6-02) — three layers applied to the body
- * before splicing:
- *   (a) the escaping discipline of `plugin/memory-format.ts`;
- *   (b) strip any line containing `kevin:begin` or `kevin:end`, in any
- *       casing, anywhere in the line;
- *   (c) strip HTML comment terminators (`-->`).
- * Without this, a memory containing a literal `<!-- kevin:end -->` line would
- * close the marker comment early and let subsequent content escape the
- * curated region on the next regeneration — a marker-injection variant of the
- * v0.1.5 prompt-injection defect (plan §3.5).
+ * v1.0.0 (K10-027 / plan §5.7) — the boundary functions now live in
+ * `plugin/escape.ts`; this composer applies them in fence-then-marker
+ * order. Layer (b) — strip any line containing `kevin:begin` or
+ * `kevin:end`, in any casing — is a filter rather than an escape and
+ * stays here. Without layer (b), a memory containing a literal
+ * `<!-- kevin:end -->` line would close the marker comment early and
+ * let subsequent content escape the curated region on the next
+ * regeneration — a marker-injection variant of the v0.1.5
+ * prompt-injection defect (plan §3.5). The trailing `-->` strip is kept
+ * as defence in depth although `escapeForMarkerBlock` already escapes
+ * every `>` that could form one.
  */
 export function sanitizeArtifactBody(body) {
-    const escaped = escapeIdempotent(body);
+    const escaped = escapeForMarkerBlock(escapeForFence(body));
     const kept = escaped
         .split("\n")
         .filter((line) => !/kevin:begin|kevin:end/i.test(line))
         .join("\n");
     return kept.replace(/-->/g, "");
 }
+/**
+ * v1.0.0 (K10-027 / plan §5.7, rule 2) — whole-file writes escape by
+ * container. Only `.okf` files are line-oriented JSON: each line gets
+ * `escapeForOkfLine`, which is the identity on a well-formed OKF line
+ * (canonical JSON never contains raw control characters) and therefore
+ * preserves the re-render `noop`. Kevin-owned markdown paths keep their
+ * bytes — fences there are legitimate content.
+ */
+export function escapeForContainer(path, content) {
+    if (!path.endsWith(".okf"))
+        return content;
+    return content
+        .split("\n")
+        .map((line) => {
+        // A CRLF file (healHeader preserves the original EOL) leaves a
+        // trailing \r on each line after the split — it is line-ending
+        // bytes, not statement content, so it must survive untouched.
+        if (line.endsWith("\r")) {
+            return `${escapeForOkfLine(line.slice(0, -1))}\r`;
+        }
+        return escapeForOkfLine(line);
+    })
+        .join("\n");
+}
 /**
  * v0.6.0 (K6-005 / plan §5.1) — the single write path to disk (D6-01).
  *
@@ -113,7 +130,9 @@ export class ArtifactWriter {
             // like any other refusal: after = before, both hashes recorded.
             const refusal = request.refusal;
             const refused = refusal !== undefined;
-            const after = refused ? before : content;
+            // K10-027 — the container boundary: OKF lines are escaped at the
+            // single write path, never by callers.
+            const after = refused ? before : escapeForContainer(path, content);
             return {
                 path,
                 before,
@@ -270,4 +289,3 @@ export class ArtifactWriter {
             .run(uuidv7(), proposalId ?? null, this.projectId, plan.path, Buffer.byteLength(plan.before, "utf8"), Buffer.byteLength(plan.after, "utf8"), plan.hashBefore, plan.hashAfter, plan.outcome, plan.reason ?? null);
     }
 }
-//# sourceMappingURL=ArtifactWriter.js.map

package/dist/plugin/CausalChain.js

@@ -1,4 +1,6 @@
 import { extractFixArgs, } from "./LessonFixer.js";
+import { hasColumn } from "./columns.js";
+import { toMs } from "./time-ms.js";
 /** K3-007 — a success only links to a failure within this many calls. */
 const MAX_LINK_DISTANCE = 10;
 export class CausalChain {
@@ -24,11 +26,15 @@ export class CausalChain {
     // distance, so an unrelated success (e.g. an `ls` run after a
     // typecheck failure) was stamped as the fix for that error.
     onSuccess(_tool, _args, _projectId, sessionId) {
-        const successRow = this.store
-            .prepare(`SELECT rowid, tool, args_summary FROM tool_calls
-				 WHERE session_id = ? AND success = 1
-				 ORDER BY rowid DESC LIMIT 1`)
-            .get(sessionId);
+        // v1.1.0 (K11-004 / plan §5.2, D11-01/D11-07) — ms-aware window: prefer _ms
+        const hasTsMs = hasColumn(this.store, "tool_calls", "ts_ms");
+        const successRow = (hasTsMs
+            ? this.store.prepare(`SELECT rowid, tool, args_summary, ts, ts_ms FROM tool_calls
+						 WHERE session_id = ? AND success = 1
+						 ORDER BY rowid DESC LIMIT 1`)
+            : this.store.prepare(`SELECT rowid, tool, args_summary, ts FROM tool_calls
+						 WHERE session_id = ? AND success = 1
+						 ORDER BY rowid DESC LIMIT 1`)).get(sessionId);
         if (!successRow)
             return;
         const linkedFps = new Set(this.store
@@ -40,20 +46,33 @@ export class CausalChain {
         // onLinkError) is the SAME identity dimension the error memory
         // uses; `fingerprint` is the legacy tool|args|success hash and
         // simply never matches a reflector error memory.
-        const failRows = this.store
-            .prepare(`SELECT rowid, COALESCE(error_fingerprint, fingerprint) AS fp
-				 FROM tool_calls
-				 WHERE session_id = ?
-				   AND success = 0
-				   AND (error_fingerprint IS NOT NULL OR fingerprint IS NOT NULL)
-				 ORDER BY rowid DESC LIMIT ?`)
-            .all(sessionId, MAX_LINK_DISTANCE);
+        const failRows = (hasTsMs
+            ? this.store.prepare(`SELECT rowid, COALESCE(error_fingerprint, fingerprint) AS fp, ts, ts_ms
+						 FROM tool_calls
+						 WHERE session_id = ?
+						   AND success = 0
+						   AND (error_fingerprint IS NOT NULL OR fingerprint IS NOT NULL)
+						 ORDER BY rowid DESC LIMIT ?`)
+            : this.store.prepare(`SELECT rowid, COALESCE(error_fingerprint, fingerprint) AS fp, ts
+						 FROM tool_calls
+						 WHERE session_id = ?
+						   AND success = 0
+						   AND (error_fingerprint IS NOT NULL OR fingerprint IS NOT NULL)
+						 ORDER BY rowid DESC LIMIT ?`)).all(sessionId, MAX_LINK_DISTANCE);
         for (const fail of failRows) {
             if (!fail.fp || linkedFps.has(fail.fp))
                 continue;
             const dist = successRow.rowid - fail.rowid;
             if (dist <= 0 || dist > MAX_LINK_DISTANCE)
                 continue;
+            // v1.1.0 — ≤24h window uses ms when available
+            const successMs = toMs(successRow.ts, successRow.ts_ms ?? null);
+            const failMs = toMs(fail.ts, fail.ts_ms ?? null);
+            if (successMs !== null && failMs !== null) {
+                const diff = successMs - failMs;
+                if (diff < 0 || diff > 86_400_000)
+                    continue;
+            }
             const mem = this.store
                 .prepare(`SELECT 1 FROM memories
 					 WHERE fingerprint = ? AND type = 'error'
@@ -176,4 +195,3 @@ export class CausalChain {
         return row?.value === "1";
     }
 }
-//# sourceMappingURL=CausalChain.js.map

package/dist/plugin/ConflictDetector.js

@@ -1,4 +1,6 @@
+import { mapRow } from "./MemoryService.js";
 import { normalize } from "./fingerprint.js";
+import { STOP_WORDS } from "./query-tokenizer.js";
 import { uuidv7 } from "./uuid.js";
 const POLARITY_RULES = [
     {
@@ -14,33 +16,6 @@ const POLARITY_RULES = [
     { positive: ["enable"], negative: [["disable"]] },
     { positive: ["prefer"], negative: [["avoid"]] },
 ];
-const STOP_WORDS = new Set([
-    "a",
-    "an",
-    "and",
-    "are",
-    "as",
-    "at",
-    "be",
-    "by",
-    "for",
-    "from",
-    "in",
-    "is",
-    "it",
-    "of",
-    "on",
-    "or",
-    "that",
-    "the",
-    "this",
-    "to",
-    "with",
-    "we",
-    "when",
-    "where",
-    "you",
-]);
 const POLARITY_WORDS = new Set([
     "use",
     "do",
@@ -157,9 +132,12 @@ export class ConflictDetector {
 				 FROM memories WHERE project_id = ? AND status = 'active'`)
             .all(this.projectId);
         return rows.flatMap((row) => {
-            const memory = row;
+            // v1.1.0 (K11-014) — route through mapRow so metadata is parsed and confidence derived
+            const memory = mapRow(row);
             const reasons = this.repoTruth?.contradictions(memory) ?? [];
-            return reasons.length > 0 ? [{ memoryId: row.id, reasons }] : [];
+            return reasons.length > 0
+                ? [{ memoryId: row.id, reasons }]
+                : [];
         });
     }
     detectDecisionPairs() {
@@ -280,4 +258,3 @@ function oppositePair(a, b) {
     }
     return null;
 }
-//# sourceMappingURL=ConflictDetector.js.map

package/dist/plugin/ContextInjector.js

@@ -531,4 +531,3 @@ Consider adding this convention to AGENTS.md:
             output.context.push(block);
     }
 }
-//# sourceMappingURL=ContextInjector.js.map

package/dist/plugin/ConventionMiner.js

@@ -240,4 +240,3 @@ function statementForSequence(a, b) {
 function statementForSequence3(a, b, c) {
     return `every ${a} is followed by ${b} and then ${c}`;
 }
-//# sourceMappingURL=ConventionMiner.js.map

package/dist/plugin/Curator.js

@@ -322,4 +322,3 @@ function normalizeBullet(line) {
         .replace(/\s+\((?:verified|feedback)[^)]*\)\s*$/i, "");
     return normalize(statement);
 }
-//# sourceMappingURL=Curator.js.map

package/dist/plugin/Feedback.js

@@ -1,3 +1,4 @@
+import { hasFeedbackTable } from "./columns.js";
 import { uuidv7 } from "./uuid.js";
 const POSITIVE_VERDICTS = ["useful"];
 const NEGATIVE_VERDICTS = [
@@ -5,25 +6,7 @@ const NEGATIVE_VERDICTS = [
     "outdated",
     "ignore",
 ];
-// v0.5.0 — pre-006 DBs lack `memory_feedback`; record() fails loudly with a
-// descriptive error instead of a bare "no such table" (the tool layer turns
-// it into a graceful message).
-// v0.6.0 (K6-001a) — positive-only caching: a successful probe is cached,
-// a failed probe is NOT. A Store migrated in place heals on the next call.
-const feedbackTableCache = new WeakMap();
-function hasFeedbackTable(store) {
-    const cached = feedbackTableCache.get(store);
-    if (cached === true)
-        return true;
-    try {
-        store.prepare("SELECT COUNT(*) FROM memory_feedback").get();
-        feedbackTableCache.set(store, true);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
+// v1.1.0 (K11-011) — table probe delegates to columns registry
 export class Feedback {
     store;
     metrics;
@@ -135,4 +118,3 @@ export class Feedback {
             .run(memoryId, memoryId, memoryId);
     }
 }
-//# sourceMappingURL=Feedback.js.map

package/dist/plugin/HookLiveness.d.ts

@@ -37,6 +37,7 @@ interface HookLivenessOptions {
 export declare class HookLiveness {
     private readonly store;
     private readonly options;
+    excessArityCount: number;
     private readonly counters;
     private readonly seenSessions;
     private readonly suppressedSessions;
@@ -68,6 +69,12 @@ export declare class HookLiveness {
     /** Persists every counter row. Called on the metrics.flush() cadence. */
     flush(): void;
     private makeWrapper;
+    /**
+     * v1.0.0 (K10-013 / plan §5.3) — records the `dispose` fire and
+     * flushes immediately, from inside the dispose delegate: this is the
+     * last write of the process, and nothing after it can persist.
+     */
+    recordDispose(): void;
     private recordSuccess;
     private recordError;
     private loadFromDb;

package/dist/plugin/HookLiveness.js

@@ -25,6 +25,8 @@ export function parseThreshold(text) {
 export class HookLiveness {
     store;
     options;
+    // v1.1.0 (K11-015) — debug counter for excess arity; never logged on hot path
+    excessArityCount = 0;
     counters;
     seenSessions;
     suppressedSessions = new Set();
@@ -212,6 +214,12 @@ export class HookLiveness {
     }
     makeWrapper(key, delegate) {
         const record = () => {
+            // v1.0.0 (K10-013) — dispose is recorded inside its own delegate
+            // (via recordDispose()) rather than here: the wrapper's post-return
+            // record would land after the store is closed and could never be
+            // persisted — the event being detected is the process ending.
+            if (key === "dispose")
+                return;
             if (HOOK_NAMES.includes(key)) {
                 this.recordSuccess(key);
             }
@@ -222,34 +230,16 @@ export class HookLiveness {
             }
             throw e;
         };
-        const n = delegate.length;
-        if (n === 0) {
-            return async () => {
-                try {
-                    const result = await delegate();
-                    record();
-                    return result;
-                }
-                catch (e) {
-                    return recordError(e);
-                }
-            };
-        }
-        if (n === 1) {
-            return async (a) => {
-                try {
-                    const result = await delegate(a);
-                    record();
-                    return result;
-                }
-                catch (e) {
-                    return recordError(e);
-                }
-            };
-        }
-        return async (a, b) => {
+        // v1.1.0 (K11-015) — arity guard: maximum supported arity is 2 (plan §5.5).
+        // Excess args are sliced and counted via excessArityCount; never logged.
+        return async (...args) => {
+            let callArgs = args;
+            if (args.length > 2) {
+                this.excessArityCount++;
+                callArgs = args.slice(0, 2);
+            }
             try {
-                const result = await delegate(a, b);
+                const result = await delegate(...callArgs);
                 record();
                 return result;
             }
@@ -258,6 +248,15 @@ export class HookLiveness {
             }
         };
     }
+    /**
+     * v1.0.0 (K10-013 / plan §5.3) — records the `dispose` fire and
+     * flushes immediately, from inside the dispose delegate: this is the
+     * last write of the process, and nothing after it can persist.
+     */
+    recordDispose() {
+        this.recordSuccess("dispose");
+        this.flush();
+    }
     recordSuccess(hook) {
         const c = this.counters.get(hook);
         if (!c)
@@ -321,4 +320,3 @@ export function reduceVerdict(reports) {
         reason: `${pending} hook(s) without checkpoint`,
     };
 }
-//# sourceMappingURL=HookLiveness.js.map