@ngockhoale/ukit 3.4.35 → 3.4.36

package/CHANGELOG.md

@@ -9,6 +9,15 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.36 - 2026-10-12
+
+**Completion Gate: a finished task (incl. a release) stays finished across wakeups, compaction and repeated Stops.**
+- Harness-injected turns (`/loop` wakeup: transcript `isMeta` + `turnOrigin: scheduled`/`promptSource: system`; compaction "session is being continued") now resume the SAME task instance and keep its contract. Previously each minted a new task id, blanked the ledger and re-derived a MIXED git-integrity contract from the wakeup's wording, re-demanding write + verification + operation evidence from read-only post-release checks. A human prompt or an unmarked lookalike is still a fresh task.
+- Sealed completion: a Stop that evaluates COMPLETE from trusted receipts seals the task with the verified content fingerprint; later Stops of the same task are accepted until the content really changes. Seals are task- and session-scoped (no leakage to new tasks/sessions).
+- Verdict currency also compares a content fingerprint, so committing/pushing already-verified work no longer stales the test verdict (HEAD moved, content identical).
+- Release postcondition: a prompt ordering `npm publish` is complete only with trusted receipts (real unmasked `npm publish`, `npm view <pkg> version` printing package.json's version) and, if a release tag exists, its dereferenced commit equal to HEAD (never the annotated tag-object SHA). Unpublished/failed/fake claims keep blocking.
+- Wakeup ownership: repeated wakeups are issued by the Claude Code harness (`ScheduleWakeup`), not UKit (no scheduler in UKit). UKit neutralizes their effect and EXEC-04 now says never to schedule a wakeup after terminal completion. Real Windows runtime validation was not performed.
+
 ## 3.4.35 - 2026-10-12
 
 **Windows: `ukit update` no longer fails preflight with `npm is not runnable (spawnSync npm ENOENT)`.**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.35",
+  "version": "3.4.36",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/template_project/.claude/hooks/skill-router.sh

@@ -3683,13 +3683,24 @@ function applyTaskSemantics(contract, semantic) {
       // A tool event or a bare "continue" carries no order of its own: mutationOrder recomputed
       // from a file path / the word "continue" says nothing about what the user ordered, so the
       // original prompt's stamp stays authoritative.
-      if ((!extractPrompt(payload) || continuationPrompt) && typeof previous.routingContext.mutationOrder === 'boolean') {
+      if ((!extractPrompt(payload) || continuationPrompt || systemOriginTurn) && typeof previous.routingContext.mutationOrder === 'boolean') {
         persisted.routingContext.mutationOrder = previous.routingContext.mutationOrder;
       }
     }
     if (continuingTask && !persisted.suspendedContract && previous.suspendedContract) {
       persisted.suspendedContract = previous.suspendedContract;
     }
+    if (systemOriginTurn && previous.routeSummary?.executionContract?.taskKind) {
+      // A harness wakeup / compaction continuation resumes the SAME task: its contract is the
+      // original request's, never one re-derived from the injected prompt's wording.
+      persisted.routeSummary ||= {};
+      persisted.routeSummary.executionContract = previous.routeSummary.executionContract;
+      for (const key of ['expectedSourceFiles', 'completionState', 'continuationState', 'executionMode']) {
+        if (previous.routeSummary[key] !== undefined) persisted.routeSummary[key] = previous.routeSummary[key];
+        else delete persisted.routeSummary[key];
+      }
+      if (previous.requestKey) persisted.requestKey = previous.requestKey;
+    }
     const semantic = continuingTask && previous.routeSummary?.executionContract?.taskKind
       ? previous.routeSummary.executionContract
       : classifyTaskSemantics({ promptText: extractPrompt(payload) || persisted.routingContext?.lastExplicitUserPromptText, targetFile: persisted.routingContext?.targetFile });
@@ -3782,7 +3793,43 @@ function applyTaskSemantics(contract, semantic) {
       requestKey: parkedContract.requestKey, routingContext: parkedContract.routingContext || previous.routingContext };
     delete previous.suspendedContract;
   }
-  const continuingTask = Boolean(previous.taskInstanceId && (payload.tool_name || continuationPrompt));
+  // A turn the SYSTEM injected (a harness /loop wakeup, or the post-compaction "session is being
+  // continued" summary) is not a new user task: it resumes the previous one. Minting a fresh task id
+  // here dropped the task's evidence and re-derived a contract from the wakeup's own wording
+  // (a prompt that lists "git push / npm publish" became a new MIXED git-integrity operation that a
+  // verification-only turn can never satisfy). Only transcript metadata set by the harness or the
+  // fixed compaction preamble counts - never the prompt's claims about itself.
+  const systemOriginTurn = (() => {
+    const promptTrim = extractPrompt(payload).trim();
+    if (!promptTrim) return false;
+    if (/^This session is being continued from a previous conversation/i.test(promptTrim)) return true;
+    const tp = payload.transcript_path ?? payload.transcriptPath;
+    if (!tp || typeof tp !== 'string') return false;
+    try {
+      const fd = fs.openSync(tp, 'r');
+      try {
+        const size = fs.fstatSync(fd).size;
+        const len = Math.min(size, 128 * 1024);
+        const buf = Buffer.alloc(len);
+        fs.readSync(fd, buf, 0, len, size - len);
+        const lines = buf.toString('utf8').split('\n');
+        for (let i = lines.length - 1; i >= 0; i -= 1) {
+          const line = lines[i];
+          if (!line || !line.includes('"type":"user"')) continue;
+          let entry; try { entry = JSON.parse(line); } catch { continue; }
+          if (entry.type !== 'user' || entry.isSidechain === true) continue;
+          const content = entry.message?.content;
+          const text = (typeof content === 'string' ? content
+            : Array.isArray(content) ? content.map((b) => (b?.type === 'tool_result' ? '\u0000' : b?.text || '')).join('\n') : '').trim();
+          if (!text || text.includes('\u0000') || /^Stop hook feedback/i.test(text)) continue;
+          return entry.isMeta === true && (entry.turnOrigin === 'scheduled' || entry.promptSource === 'system')
+            && text === promptTrim;
+        }
+      } finally { fs.closeSync(fd); }
+    } catch {}
+    return false;
+  })();
+  const continuingTask = Boolean(previous.taskInstanceId && (payload.tool_name || continuationPrompt || systemOriginTurn));
   const taskInstanceId = continuingTask
     ? previous.taskInstanceId
     : `task-${crypto.randomBytes(16).toString("hex")}`;

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -108,3 +108,44 @@ export function bashOperationReceipt(command, response, transportSuccess, goal,
     operation: { domain, role, scope, target: role === 'state' ? null : target,
       ...(role === 'state' ? { state: 'verified', complete: ok } : {}) } };
 }
+
+// Release evidence: `npm publish` and `npm view <pkg> version` as REAL Bash tool results. The command must
+// be the checked command (no pipe/`;`/`||` masking), a dry run is not a publish, and a view only counts when
+// the registry actually printed a semver. Agent prose is never evidence; the completion gate compares the
+// recorded version with package.json and live Git state before it treats a release as published.
+const NPM_PUBLISH = /^npm\s+publish(?:\s|$)/;
+const NPM_VIEW = /^npm\s+view\s+(\S+?)(?:@\S+)?\s+version(?:\s+2>&1)?\s*$/;
+const SEMVER_LINE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+export function releaseReceipt(command, response, transportSuccess) {
+  if (typeof command !== 'string') return null;
+  const masked = /;|\n|\|/.test(command.replace(/'[^']*'|"[^"]*"/g, '""'));
+  const segments = command.split('&&').map((seg) => seg.trim()).filter((seg) => seg && !/^cd\s+\S+$/.test(seg));
+  if (segments.length !== 1) return null;
+  const [seg] = segments;
+  const ok = transportSuccess === true && !masked;
+  if (NPM_PUBLISH.test(seg)) {
+    if (DRY_RUN.test(seg.replace(/'[^']*'|"[^"]*"/g, '""'))) return null;
+    return { type: 'publish', success: ok };
+  }
+  const view = seg.match(NPM_VIEW);
+  if (view) {
+    const text = responseText(response);
+    const version = SEMVER_LINE.test(text) ? text : null;
+    return { type: 'view', success: ok && version !== null, version, package: view[1] };
+  }
+  return null;
+}
+
+export function releaseOperationReceipt(command, response, transportSuccess, { sessionId, harness } = {}) {
+  const found = releaseReceipt(command, response, transportSuccess);
+  if (!found) return null;
+  const scope = typeof sessionId === 'string' && sessionId.trim() ? `session:${sessionId.trim()}` : null;
+  const ok = found.success === true && Boolean(scope);
+  const base = { kind: 'operation', success: ok, transportSuccess: transportSuccess === true, harness };
+  if (found.type === 'publish') {
+    return { ...base, operation: { domain: 'release', role: 'mutation', scope, target: 'npm-publish' } };
+  }
+  const state = ok && `published:${found.package}@${found.version}`.length <= 200
+    ? `published:${found.package}@${found.version}` : 'unproven';
+  return { ...base, operation: { domain: 'release', role: 'state', scope, target: null, state, complete: ok && state !== 'unproven' } };
+}

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -7,7 +7,7 @@ import fsSync from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { withAsyncLock, LOCK_MAX_SLICE_MS } from './async-lock.mjs';
-import { cronOperationReceipt, bashOperationReceipt } from './cron-operation-adapter.mjs';
+import { cronOperationReceipt, bashOperationReceipt, releaseOperationReceipt } from './cron-operation-adapter.mjs';
 import { operationCompletionPolicy, foldOperationEvidence, compactOperation } from './operation-evidence.mjs';
 
 // Hook-context self-deadline (2.4.1 orphan-leak class): armed ONLY on direct
@@ -762,6 +762,48 @@ const VERIFICATION_FINGERPRINT_EXCLUDES = [
   ':(exclude)docs/MEMORY.md',
 ];
 
+// Content fingerprint: path -> blob map of the WORKING TREE (index blobs, overridden by the real bytes of
+// modified/untracked files), bookkeeping excluded. Unlike HEAD+diff it is identical before and after
+// committing the same content, so a commit/push of already-verified work does not stale a verdict.
+// A read-only git view; null whenever it cannot be proven (no git, oversized, odd paths).
+const CONTENT_FP_MAX_HASHED = 5000;
+function fingerprintExcluded(file) {
+  const p = String(file).replace(/\\/g, '/');
+  return p.startsWith('.ukit/storage/') || p === '.claude/ukit/skill-router-state.json'
+    || ['docs/WORKLOG.md', 'docs/STATUS.md', 'docs/TASKS.md', 'docs/MEMORY.md'].includes(p);
+}
+
+function contentFingerprint(cwd) {
+  if (!cwd) return null;
+  try {
+    const opts = { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout: 4000, maxBuffer: 64 * 1024 * 1024 };
+    const list = (args) => String(execFileSync('git', args, opts)).split('\0').filter(Boolean);
+    const blobs = new Map();
+    for (const line of list(['ls-files', '-s', '-z'])) {
+      const m = line.match(/^\d+ ([0-9a-f]+) \d\t([\s\S]*)$/);
+      if (m) blobs.set(m[2], m[1]);
+    }
+    const toHash = [];
+    for (const file of [...list(['ls-files', '-m', '-z']), ...list(['ls-files', '-o', '--exclude-standard', '-z'])]) {
+      if (fingerprintExcluded(file)) continue;
+      if (/[\n\r]/.test(file)) return null;
+      let stat = null;
+      try { stat = fsSync.lstatSync(path.resolve(cwd, file)); } catch { /* deleted */ }
+      if (stat && (stat.isFile() || stat.isSymbolicLink())) toHash.push(file);
+      else blobs.delete(file);
+    }
+    if (toHash.length > CONTENT_FP_MAX_HASHED) return null;
+    if (toHash.length > 0) {
+      const hashes = String(execFileSync('git', ['hash-object', '--stdin-paths'], { ...opts, stdio: ['pipe', 'pipe', 'ignore'], input: `${toHash.join('\n')}\n` })).split('\n').filter(Boolean);
+      if (hashes.length !== toHash.length) return null;
+      toHash.forEach((file, i) => blobs.set(file, hashes[i]));
+    }
+    const hash = crypto.createHash('sha256');
+    for (const file of [...blobs.keys()].filter((f) => !fingerprintExcluded(f)).sort()) hash.update(`${file}\0${blobs.get(file)}\n`);
+    return hash.digest('hex');
+  } catch { return null; }
+}
+
 function verificationDirtyFingerprint(cwd) {
   try {
     const paths = ['.', ...VERIFICATION_FINGERPRINT_EXCLUDES];
@@ -862,6 +904,10 @@ export function verdictCurrent(verdict, { cwd = process.cwd() } = {}) {
     cwd = verdict.workspaceRoot;
   }
   const currentHead = gitOutput(['rev-parse', 'HEAD'], cwd);
+  if (verdict.contentFp && verdict.dirtyFp && contentFingerprint(cwd) === verdict.contentFp) {
+    // Same verified content (e.g. the verified work was committed/pushed since): still current.
+    return { status: 'current', current: true, headSha: currentHead };
+  }
   if (verdict.headSha && Object.hasOwn(verdict, 'dirtyFp') && (!verdict.dirtyFp || verificationDirtyFingerprint(cwd) !== verdict.dirtyFp)) {
     return { status: 'stale', current: false, headSha: currentHead, reason: 'workspace-changed' };
   }
@@ -942,7 +988,7 @@ function mintVerificationVerdict(receipt, payload, projectRoot, sessionRoot = pr
     headSha: headSha || null,
     baseSha: baseSha || null,
     patchId,
-    ...(headSha ? { dirtyFp: verificationDirtyFingerprint(cwd) } : {}),
+    ...(headSha ? { dirtyFp: verificationDirtyFingerprint(cwd), contentFp: contentFingerprint(cwd) } : {}),
     ts: supplied.ts || new Date().toISOString(),
   };
 }
@@ -2805,7 +2851,8 @@ export async function recordExecutionReceipt({
   const nativeGoal = routeState?.routeSummary?.executionContract?.operationGoal;
   const operationReceipt = cronOperationReceipt(toolName, toolInput, toolResponse, success, { sessionId: explicitSessionId(payload), harness })
     || (toolName === 'Bash' && !bashScope.foreign
-      ? bashOperationReceipt(toolInput.command, toolResponse, success, nativeGoal, { sessionId: explicitSessionId(payload), harness })
+      ? (bashOperationReceipt(toolInput.command, toolResponse, success, nativeGoal, { sessionId: explicitSessionId(payload), harness })
+        || releaseOperationReceipt(toolInput.command, toolResponse, success, { sessionId: explicitSessionId(payload), harness }))
       : null);
   if (operationReceipt) {
     Object.assign(receipt, operationReceipt);
@@ -3236,6 +3283,36 @@ function effectiveRequestLedger(state = {}, ledger = {}) {
   return sameRequest ? ledger : {};
 }
 
+// Release postcondition. A request that ORDERS `npm publish` is complete only when trusted receipts
+// (real Bash results recorded by the adapter - never agent prose) show the registry serving exactly the
+// package.json version, and the local Git state agrees: a local release tag, if present, must DEREFERENCE
+// (`^{commit}`, never the annotated tag-object SHA) to HEAD. A failed/missing publish with no registry proof
+// stays missing. A registry that already serves the version counts as published, so a finished release is
+// never re-published just to satisfy the gate.
+function promptOrdersNpmPublish(state = {}) {
+  const text = String(state?.routingContext?.lastExplicitUserPromptText || '').toLowerCase();
+  if (!/\bnpm\s+publish\b/.test(text)) return false;
+  return text.split(/[\n;.,]|\bthen\b|\band\b/).some((clause) => /\bnpm\s+publish\b/.test(clause)
+    && !/\b(?:do not|don't|never|without|not yet|dry-run|khong|dung)\b|--dry-run/.test(clause));
+}
+
+function releasePublicationMissing(state, ledger, cwd) {
+  if (!promptOrdersNpmPublish(state)) return null;
+  let pkg = null;
+  try { pkg = JSON.parse(fsSync.readFileSync(path.join(cwd || process.cwd(), 'package.json'), 'utf8')); } catch { return null; }
+  if (!pkg?.version) return null;
+  const release = Object.values(ledger?.operationBank || {}).filter((entry) => entry && typeof entry === 'object');
+  const view = release.map((entry) => entry.state).filter((proof) => proof?.operation?.domain === 'release'
+    && proof.success === true && proof.operation.complete === true)
+    .sort((a, b) => b.sequence - a.sequence)[0];
+  const wanted = `published:${pkg.name}@${pkg.version}`;
+  if (view?.operation?.state !== wanted) return 'release-publication';
+  const tagCommit = gitOutput(['rev-parse', '--verify', '--quiet', `v${pkg.version}^{commit}`], cwd);
+  const head = gitOutput(['rev-parse', 'HEAD'], cwd);
+  if (tagCommit && head && tagCommit !== head) return 'release-publication';
+  return null;
+}
+
 function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null } = {}) {
   const routeSummary = state?.routeSummary || {};
   // Explicit vibecode autonomy: the user asked UKit to run one prompt to a finished result,
@@ -3321,6 +3398,8 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   const operationalTask = operationStatus !== null;
   const missingEvidence = evidence.filter((item) => !evidenceSatisfied(item, effectiveLedger, state, { cwd }));
   if (operationalTask && !operationStatus.complete && !missingEvidence.includes('operation-verification')) missingEvidence.push('operation-verification');
+  const releaseMissing = releasePublicationMissing(state, effectiveLedger, cwd);
+  if (releaseMissing) missingEvidence.push(releaseMissing);
   // TASK-009 (BL-011): the bug-fix floor. On a `playbookId: bug-fix` route a
   // green verdict requires verbatim repro-before (fail) + repro-after (pass)
   // receipts on the same surface plus a named root cause in the exec-ledger —
@@ -3536,7 +3615,9 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   }
 
   const finalAttempt = !vibecode && continuationCount === MAX_CONTINUATIONS - 1;
-  const instruction = operationalTask
+  const instruction = missingEvidence.includes('release-publication')
+    ? 'The release is not proven published: run `npm publish` once if the registry does not yet serve this version, then confirm with `npm view <package> version` (must equal package.json) and that the release tag dereferences to HEAD. Do not republish a version the registry already serves.'
+    : operationalTask
     ? 'Inspect native mutation receipts and verify the requested operational state; do not fabricate source edits or source-test evidence.'
     : recoveryInstruction(missingEvidence, effectiveLedger, routeSummary, { cwd });
   return {
@@ -3679,6 +3760,37 @@ async function resetGateCrashCounter(projectRoot) {
   }
 }
 
+// Sealed completion: when a Stop evaluates COMPLETE from the ledger's trusted receipts, the task instance
+// is sealed with the verified content fingerprint. A later Stop for the SAME task instance (a
+// post-release check, a continuation, a task id re-adopted via "continue" after a status turn) is accepted
+// without re-demanding write/test/operation debt - until the verified content really changes. The seal
+// is keyed by taskInstanceId, so a different task never inherits it, and it is only ever minted from a
+// complete evaluation, never from agent prose.
+const SEAL_MAX = 8;
+function sealPath(projectRoot, payload) {
+  return path.join(projectRoot, '.ukit', 'storage', 'cache', 'exec-ledger-seals', `${sessionIdentity(payload)}.json`);
+}
+
+async function readSeal(projectRoot, payload, taskInstanceId) {
+  if (!taskInstanceId) return null;
+  const seals = await readJson(sealPath(projectRoot, payload), {});
+  const seal = seals?.[taskInstanceId];
+  return seal && typeof seal === 'object' ? seal : null;
+}
+
+async function writeSeal(projectRoot, payload, state, result) {
+  const taskInstanceId = state?.taskInstanceId;
+  const contentFp = contentFingerprint(projectRoot);
+  if (!taskInstanceId || !contentFp || result.complete !== true) return;
+  if (!(requiredEvidence(state).length > 0)) return;
+  const file = sealPath(projectRoot, payload);
+  const seals = await readJson(file, {}) || {};
+  seals[taskInstanceId] = { contentFp, headSha: gitOutput(['rev-parse', 'HEAD'], projectRoot), ts: Date.now() };
+  const keep = Object.entries(seals).sort((a, b) => (b[1]?.ts || 0) - (a[1]?.ts || 0)).slice(0, SEAL_MAX);
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  await writeJsonAtomic(file, Object.fromEntries(keep));
+}
+
 async function runEvaluateStop() {
   const projectRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   let payload;
@@ -3712,7 +3824,17 @@ async function runEvaluateStop() {
   }
 
   const phase = await resolveStopPhase(payload?.transcript_path);
-  const result = evaluateCompletion({ state, ledger, cwd: projectRoot, phase });
+  let result = evaluateCompletion({ state, ledger, cwd: projectRoot, phase });
+  if (result.continue === true && !result.finalNotice) {
+    try {
+      const seal = await readSeal(projectRoot, payload, state?.taskInstanceId);
+      if (seal?.contentFp && contentFingerprint(projectRoot) === seal.contentFp) {
+        result = { continue: false, notify: false, complete: true, missingEvidence: [], gateRelease: 'sealed-complete' };
+      }
+    } catch { /* a seal read failure keeps the strict gate */ }
+  } else if (result.complete === true && (!result.gateRelease || result.gateRelease === 'native-operation-verified')) {
+    try { await writeSeal(projectRoot, payload, state, result); } catch { /* advisory */ }
+  }
 
   // TASK-C85-019 fix C: a mutating-mode route released by a no-mutation valve
   // while evidence is missing is the anomaly signal for misrouted advisory

package/template_project/AGENTS.md

@@ -23,7 +23,7 @@
 <!-- RULE: EXEC-02 -->
 - **No "done"/"applied"/"fixed" after Read/Grep/analysis alone** — needs concrete Edit/Write evidence this turn, plus verification when risky.
 <!-- RULE: EXEC-04 -->
-- **Every stop says why — no silent idle.** User-only-action stops open with `WAITING ON YOU: <command/action>` + one-shot wakeup (~20-30 min) when available; report errors verbatim.
+- **Every stop says why — no silent idle.** User-only-action stops open with `WAITING ON YOU: <command/action>` + one-shot wakeup (~20-30 min) when available; report errors verbatim. After terminal completion (verified release/task) never schedule a wakeup or `/loop` — the gate seals completed tasks.
 
 ## Stall & Wait Reporting
 <!-- RULE: STALL-01 -->

package/template_project/CLAUDE.md

@@ -23,7 +23,7 @@
 <!-- RULE: EXEC-02 -->
 - **No "done"/"applied"/"fixed" after Read/Grep/analysis alone** — needs concrete Edit/Write evidence this turn, plus verification when risky.
 <!-- RULE: EXEC-04 -->
-- **Every stop says why — no silent idle.** User-only-action stops open with `WAITING ON YOU: <command/action>` + one-shot wakeup (~20-30 min) when available; report errors verbatim.
+- **Every stop says why — no silent idle.** User-only-action stops open with `WAITING ON YOU: <command/action>` + one-shot wakeup (~20-30 min) when available; report errors verbatim. After terminal completion (verified release/task) never schedule a wakeup or `/loop` — the gate seals completed tasks.
 
 ## Stall & Wait Reporting
 <!-- RULE: STALL-01 -->

package/template_project/instructions/core.md

@@ -20,7 +20,7 @@
 <!-- RULE: EXEC-02 -->
 - **No "done"/"applied"/"fixed" after Read/Grep/analysis alone** — needs concrete Edit/Write evidence this turn, plus verification when risky.
 <!-- RULE: EXEC-04 -->
-- **Every stop says why — no silent idle.** User-only-action stops open with `WAITING ON YOU: <command/action>` + one-shot wakeup (~20-30 min) when available; report errors verbatim.
+- **Every stop says why — no silent idle.** User-only-action stops open with `WAITING ON YOU: <command/action>` + one-shot wakeup (~20-30 min) when available; report errors verbatim. After terminal completion (verified release/task) never schedule a wakeup or `/loop` — the gate seals completed tasks.
 
 ## Stall & Wait Reporting
 <!-- RULE: STALL-01 -->