@ngockhoale/ukit 3.4.43 → 3.4.45

package/CHANGELOG.md

@@ -9,6 +9,25 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.45 - 2026-10-17
+
+**P1 correctness repair: implementation prompts, release identity, large-transcript intent, continuation ownership.**
+- Implementation prompts ("fix/apply ...", Vietnamese "van sua" defer-strip) are no longer misread as READ_ONLY; negation scope is bounded and covered by a classification matrix built from a real prompt fixture.
+- Completion Gate release identity is decided by tag + shipped-file state, not HEAD==tag alone: a docs-only HEAD ahead of the tag passes; uncommitted/untracked shipped files, or a missing tag in a tagging repo, still require `release-publication`.
+- Transcripts above 32 MiB use one shared incremental intent scan (project-local cache under `.ukit/storage/cache/handoff-intent`, never written into `template_project`), wired into the Claude guard, OMP bridge and Stop coordinator. The first inconclusive call is a visible advisory, never a silent allow; append, truncation, rotation and corrupt/forged cache never create false authorization. Bounded-scan limits are unchanged.
+- Continuation phrases ("tiếp tục", "continue", "go on", ...) inherit only the active task instance's contract; completed, blocked, read-only and cross-session tasks do not leak authority or evidence.
+- Known limits: live OMP and Windows/Linux not exercised; verified on macOS/Node 22.
+
+## 3.4.44 - 2026-10-14
+
+**Completion Gate scope and permission-choice preservation.**
+- Publish refusals in Vietnamese, including accented/uppercase `chưa`, `không` and `ĐỪNG`, no longer create publication obligations. Real publication requests still require registry evidence and release-tag consistency.
+- Conditional cron cancellation verifies the requested absence using a fresh native observation without inventing successful deletion. Existing in-flight contracts reconcile only the same conditional absence goal; mixed code tasks retain write/verification requirements.
+- Blockers are task-scoped in Stop and unfinished-work detection. Current blockers end explicitly BLOCKED, never COMPLETE; previous-task blockers cannot discharge new-task verification.
+- Preserve the established bypass startup template and explicit user permission choices. Instructions distinguish UKit workflow PLAN from host permission mode; these are preventive boundaries, not a runtime mode lock.
+- **The reported Claude Code extension spontaneous permission-mode switch remains OPEN and is not claimed fixed.** The two VS Code User startup settings configured on the owner's machine are local settings, not distributed by this npm package.
+- Includes the previously unreleased manual-only `/ukit:ci-check` tooling above; this release does not dispatch GitHub Actions.
+
 ## 3.4.43 - 2026-10-13
 
 **Completion Gate: an ordered `git tag` is discharged by the tag itself, so the live release Stop is accepted.**

package/manifests/documentation.yaml

@@ -407,6 +407,17 @@ entries:
     load_policy: never
     validation: [none]
     archive_policy: immutable
+  - id: docs-analysis-claude-permission-mode
+    path: docs/analysis/CLAUDE_PERMISSION_MODE.md
+    class: canonical
+    audience: [maintainer]
+    owner: product
+    source_of_truth: docs/analysis/CLAUDE_PERMISSION_MODE.md
+    merge_strategy: none
+    load_policy: on-demand
+    validation: [manual]
+    archive_policy: owner-decides
+    notes: bounded investigation evidence; extension transition remains OPEN
   - id: docs-analysis-subagent-cost-audit
     path: docs/analysis/SUBAGENT-COST-AUDIT.md
     class: archive

package/manifests/instructionRules.yaml

@@ -120,7 +120,10 @@ rules:
       Under orchestration.permissionMode: unattended there is no human in the
       loop — the loop is UNDERSTAND → PLAN → IMPLEMENT → VERIFY → FIX →
       REVERIFY → COMPLETE, and a turn ends only on COMPLETE evidence, a real
-      external blocker, or a deny decision.
+      external blocker, or a deny decision. Workflow phases do not authorize
+      changing the user-owned host permission mode: internal PLAN is not host
+      Plan Mode. Honor managed policy, newer user choices, and parent/subagent
+      and session boundaries.
     marker_in: [template_project/CLAUDE.md, template_project/AGENTS.md, CLAUDE.md, AGENTS.md]
     anchor: 'no human in the loop'
   - id: UNATTENDED-02

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.43",
+  "version": "3.4.45",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/core/executionContracts.js

@@ -190,14 +190,29 @@ function nativeOperationGoal(domain, actionable, text) {
 }
 
 // Task semantics are independent of source execution strategy and observed progress.
+// P1-A (forensic false block): the clause splitter below cuts at commas, so a negation only reached the
+// FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
+// the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
+// sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
+// Vietnamese negators stay clause-local. Noun uses of verbs ("write/verification advisory", "each proposed
+// fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
+const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
+function neutralizeNonOrders(text) {
+  return String(text)
+    .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
+}
+
 export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  const text = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase();
+  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase());
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
-  const sourceOrder = actionable.some((clause) => /\b(?:implement|fix|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
+  const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
-  const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.

package/src/index/taskRouting.js

@@ -1103,8 +1103,17 @@ function hasAdvisoryOnlyAssertion({ promptText = '', commandText = '' } = {}) {
   const residue = trimmed
     .replace(/"[^"\n]*"|«[^»\n]*»/g, ' ')
       // "tạo plan" / "create a plan": the plan is the deliverable, not a mutation order.
-      .replace(/\b(?:tao|lap|create|make|write|draft)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap)\b/g, ' ')
+      .replace(/\b(?:tao|lap|viet|create|make|write|draft|produce)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:one\s+)?(?:structured\s+|forensic\s+|short\s+|brief\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap|bao\s+cao|report|danh\s+gia|assessment)\b/g, ' ')
     .replace(/\bwrite-evidence\b|\bverification-evidence\b|\bimpact-evidence\b|\broot-cause\b/g, ' ')
+    // P1-A (forensic false block): nouns and investigation questions are not orders. 'write/verification
+    // advisory', 'state change', 'each proposed fix' name things; 'whether X may create Y' asks a question to
+    // answer. A negated ENUMERATION with objects ('do not implement fixes, modify source code, ... or create
+    // commits') negates every item to its sentence end; the older verb-only chain broke at 'fixes'.
+    .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
+    .replace(new RegExp(`\\bwhether\\b[^.,;\\n]*?(?=\\s+(?:va|and)\\s+(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh)(?![A-Za-z0-9_])|[.,;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh)(?![A-Za-z0-9_])(?:[^.,;\\n\u2014]*?(?:\\s*,\\s*(?:(?:or|and|nor|hay|hoac|va)\\s+)?|\\s+(?:or|nor|hay|hoac)\\s+)(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh|restart|manipulate|resume|push|merge|publish|touch|alter|reset|rollback|revert|commit|kill|release|tag)(?![A-Za-z0-9_]))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
     .replace(new RegExp(`\\bgiu\\s+nguyen\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\bmuon\\s+giu\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\bkhong\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
@@ -1125,7 +1134,7 @@ function hasAdvisoryOnlyAssertion({ promptText = '', commandText = '' } = {}) {
     .replace(new RegExp(`\\b(?:yeu\\s+cau|doi\\s+hoi|ep\\s+phai|bat\\s+buoc|bat\\s+phai)\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:demand(?:ed|s)?|require(?:d|s)?|forcing|forced|forcibly|must|has\\s+to|have\\s+to)\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|not|never|no)\\s+(?!only\\b)${TAIL}`, 'g'), ' ')
-    .replace(new RegExp(`\\b(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?<!\\bvan\\s)(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
     .replace(/\bco\s+(?:can|nen)\s+sua\b[^.,;\n?]*/g, ' ')
     .replace(/(?:^|[.,;\n]\s*)(?:should|shall)\s+(?:i|we|you)\b[^.,;\n?]*/g, ' ')
     .replace(/\bchi\s+(?:tu\s+van|hoi|giai\s+thich|xem|la\s+cau\s+hoi|can|la)\b[^.,;\n]*/g, ' ')
@@ -1216,11 +1225,20 @@ function hasMutationOrder({ promptText = '', commandText = '' } = {}) {
   const residue = trimmed
     .replace(/"[^"\n]*"|«[^»\n]*»/g, ' ')
       // "tạo plan" / "create a plan": the plan is the deliverable, not a mutation order.
-      .replace(/\b(?:tao|lap|create|make|write|draft)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap)\b/g, ' ')
+      .replace(/\b(?:tao|lap|viet|create|make|write|draft|produce)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:one\s+)?(?:structured\s+|forensic\s+|short\s+|brief\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap|bao\s+cao|report|danh\s+gia|assessment)\b/g, ' ')
     // Descriptive state, not an order: "đã/vừa [được] + verb" ("hooks vừa được cài đặt") reports
     // something already done. Only the verb is stripped, so a later imperative still survives.
     .replace(/(?<![a-z0-9_])(?:da|vua)\s+(?:duoc\s+)?(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\s+the|cap\s+nhat|viet|chay|cai|chinh|trien\s+khai|cau\s+hinh)(?![a-z0-9_])/g, ' ')
     .replace(/\bwrite-evidence\b|\bverification-evidence\b|\bimpact-evidence\b|\broot-cause\b/g, ' ')
+    // P1-A (forensic false block): nouns and investigation questions are not orders. 'write/verification
+    // advisory', 'state change', 'each proposed fix' name things; 'whether X may create Y' asks a question to
+    // answer. A negated ENUMERATION with objects ('do not implement fixes, modify source code, ... or create
+    // commits') negates every item to its sentence end; the older verb-only chain broke at 'fixes'.
+    .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
+    .replace(new RegExp(`\\bwhether\\b[^.,;\\n]*?(?=\\s+(?:va|and)\\s+(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh)(?![A-Za-z0-9_])|[.,;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh)(?![A-Za-z0-9_])(?:[^.,;\\n\u2014]*?(?:\\s*,\\s*(?:(?:or|and|nor|hay|hoac|va)\\s+)?|\\s+(?:or|nor|hay|hoac)\\s+)(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh|restart|manipulate|resume|push|merge|publish|touch|alter|reset|rollback|revert|commit|kill|release|tag)(?![A-Za-z0-9_]))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
     .replace(new RegExp(`\\bgiu\\s+nguyen\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\bmuon\\s+giu\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\bkhong\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
@@ -1252,7 +1270,7 @@ function hasMutationOrder({ promptText = '', commandText = '' } = {}) {
     .replace(new RegExp(`\\b(?:yeu\\s+cau|doi\\s+hoi|ep\\s+phai|bat\\s+buoc|bat\\s+phai)\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:demand(?:ed|s)?|require(?:d|s)?|forcing|forced|forcibly|must|has\\s+to|have\\s+to)\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|not|never|no)\\s+(?!only\\b)${TAIL}`, 'g'), ' ')
-    .replace(new RegExp(`\\b(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?<!\\bvan\\s)(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
     .replace(/\bco\s+(?:can|nen)\s+sua\b[^.,;\n?]*/g, ' ')
     .replace(/(?:^|[.,;\n]\s*)(?:should|shall)\s+(?:i|we|you)\b[^.,;\n?]*/g, ' ')
     .replace(/\bchi\s+(?:tu\s+van|hoi|giai\s+thich|xem|la\s+cau\s+hoi|can|la)\b[^.,;\n]*/g, ' ')

package/template_project/.claude/hooks/handoff-model-guard.sh

@@ -668,7 +668,7 @@ async function scanTranscript() {
   if (readable) {
     try {
       const mod = await import(require('url').pathToFileURL(path.resolve(process.env.HOOK_DIR || '.', '../ukit/runtime/handoff-intent.mjs')).href);
-      scan = await (mod.transcriptHandoffIntentInherited || mod.transcriptHandoffIntent)(transcriptPath);
+      scan = await (mod.transcriptHandoffIntentInherited || mod.transcriptHandoffIntent)(transcriptPath, { cacheDir: path.join(projectRoot, '.ukit/storage/cache/handoff-intent') });
     } catch {
       scan = { intent: null, known: false };
     }

package/template_project/.claude/hooks/skill-router.sh

@@ -1814,14 +1814,29 @@ function nativeOperationGoal(domain, actionable, text) {
 }
 
 // Task semantics are independent of source execution strategy and observed progress.
+// P1-A (forensic false block): the clause splitter below cuts at commas, so a negation only reached the
+// FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
+// the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
+// sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
+// Vietnamese negators stay clause-local. Noun uses of verbs ("write/verification advisory", "each proposed
+// fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
+const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
+function neutralizeNonOrders(text) {
+  return String(text)
+    .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
+}
+
 function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  const text = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase();
+  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase());
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
-  const sourceOrder = actionable.some((clause) => /\b(?:implement|fix|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
+  const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
-  const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
@@ -2207,8 +2222,17 @@ function applyTaskSemantics(contract, semantic) {
     const residue = trimmed
       .replace(/"[^"\n]*"|«[^»\n]*»/g, ' ')
       // "tạo plan" / "create a plan": the plan is the deliverable, not a mutation order.
-      .replace(/\b(?:tao|lap|create|make|write|draft)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap)\b/g, ' ')
+      .replace(/\b(?:tao|lap|viet|create|make|write|draft|produce)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:one\s+)?(?:structured\s+|forensic\s+|short\s+|brief\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap|bao\s+cao|report|danh\s+gia|assessment)\b/g, ' ')
       .replace(/\bwrite-evidence\b|\bverification-evidence\b|\bimpact-evidence\b|\broot-cause\b/g, ' ')
+      // P1-A (forensic false block): nouns and investigation questions are not orders. 'write/verification
+      // advisory', 'state change', 'each proposed fix' name things; 'whether X may create Y' asks a question to
+      // answer. A negated ENUMERATION with objects ('do not implement fixes, modify source code, ... or create
+      // commits') negates every item to its sentence end; the older verb-only chain broke at 'fixes'.
+      .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+      .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+      .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
+      .replace(new RegExp(`\\bwhether\\b[^.,;\\n]*?(?=\\s+(?:va|and)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])|[.,;\\n]|$)`, 'g'), ' ')
+      .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh)(?![A-Za-z0-9_])(?:[^.,;\\n\u2014]*?(?:\\s*,\\s*(?:(?:or|and|nor|hay|hoac|va)\\s+)?|\\s+(?:or|nor|hay|hoac)\\s+)(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh|restart|manipulate|resume|push|merge|publish|touch|alter|reset|rollback|revert|commit|kill|release|tag)(?![A-Za-z0-9_]))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
       // A negated LIST ("do not implement, fix, or refactor"; "khong implement, sua, refactor hay chinh") negates every
     // verb in the list: the TAIL strip below stops at the first comma, which would leave the later verbs as orders.
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])(?:\\s*(?:,|,?\\s+(?:or|and|nor|hay|hoac|va))\\s*(?:(?:${MUT_VERBS})(?![A-Za-z0-9_])|(?:${MUT_VERBS})\\s))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
@@ -2231,7 +2255,7 @@ function applyTaskSemantics(contract, semantic) {
       .replace(new RegExp(`\\b(?:de|cho)\\s+${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\b(?:yeu\\s+cau|doi\\s+hoi|ep\\s+phai|bat\\s+buoc|bat\\s+phai)\\b${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\b(?:demand(?:ed|s)?|require(?:d|s)?|forcing|forced|forcibly|must|has\\s+to|have\\s+to)\\b${TAIL}`, 'g'), ' ')
-      .replace(new RegExp(`\\b(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
+      .replace(new RegExp(`\\b(?<!\\bvan\\s)(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
       .replace(/\bco\s+(?:can|nen)\s+sua\b[^.,;\n?]*/g, ' ')
       .replace(/(?:^|[.,;\n]\s*)(?:should|shall)\s+(?:i|we|you)\b[^.,;\n?]*/g, ' ')
       .replace(/\bchi\s+(?:tu\s+van|hoi|giai\s+thich|xem|la\s+cau\s+hoi|can|la)\b[^.,;\n]*/g, ' ')
@@ -2269,11 +2293,20 @@ function applyTaskSemantics(contract, semantic) {
     const residue = trimmed
       .replace(/"[^"\n]*"|«[^»\n]*»/g, ' ')
       // "tạo plan" / "create a plan": the plan is the deliverable, not a mutation order.
-      .replace(/\b(?:tao|lap|create|make|write|draft)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap)\b/g, ' ')
+      .replace(/\b(?:tao|lap|viet|create|make|write|draft|produce)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:one\s+)?(?:structured\s+|forensic\s+|short\s+|brief\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap|bao\s+cao|report|danh\s+gia|assessment)\b/g, ' ')
       // Descriptive state, not an order: "đã/vừa [được] + verb" ("hooks vừa được cài đặt") reports
       // something already done. Only the verb is stripped, so a later imperative still survives.
       .replace(/(?<![a-z0-9_])(?:da|vua)\s+(?:duoc\s+)?(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\s+the|cap\s+nhat|viet|chay|cai|chinh|trien\s+khai|cau\s+hinh)(?![a-z0-9_])/g, ' ')
       .replace(/\bwrite-evidence\b|\bverification-evidence\b|\bimpact-evidence\b|\broot-cause\b/g, ' ')
+      // P1-A (forensic false block): nouns and investigation questions are not orders. 'write/verification
+      // advisory', 'state change', 'each proposed fix' name things; 'whether X may create Y' asks a question to
+      // answer. A negated ENUMERATION with objects ('do not implement fixes, modify source code, ... or create
+      // commits') negates every item to its sentence end; the older verb-only chain broke at 'fixes'.
+      .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+      .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+      .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
+      .replace(new RegExp(`\\bwhether\\b[^.,;\\n]*?(?=\\s+(?:va|and)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])|[.,;\\n]|$)`, 'g'), ' ')
+      .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh)(?![A-Za-z0-9_])(?:[^.,;\\n\u2014]*?(?:\\s*,\\s*(?:(?:or|and|nor|hay|hoac|va)\\s+)?|\\s+(?:or|nor|hay|hoac)\\s+)(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh|restart|manipulate|resume|push|merge|publish|touch|alter|reset|rollback|revert|commit|kill|release|tag)(?![A-Za-z0-9_]))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
       // A negated LIST ("do not implement, fix, or refactor"; "khong implement, sua, refactor hay chinh") negates every
     // verb in the list: the TAIL strip below stops at the first comma, which would leave the later verbs as orders.
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])(?:\\s*(?:,|,?\\s+(?:or|and|nor|hay|hoac|va))\\s*(?:(?:${MUT_VERBS})(?![A-Za-z0-9_])|(?:${MUT_VERBS})\\s))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
@@ -2307,7 +2340,7 @@ function applyTaskSemantics(contract, semantic) {
       .replace(new RegExp(`\\b(?:de|cho)\\s+${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\b(?:yeu\\s+cau|doi\\s+hoi|ep\\s+phai|bat\\s+buoc|bat\\s+phai)\\b${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\b(?:demand(?:ed|s)?|require(?:d|s)?|forcing|forced|forcibly|must|has\\s+to|have\\s+to)\\b${TAIL}`, 'g'), ' ')
-      .replace(new RegExp(`\\b(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
+      .replace(new RegExp(`\\b(?<!\\bvan\\s)(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
       .replace(/\bco\s+(?:can|nen)\s+sua\b[^.,;\n?]*/g, ' ')
       .replace(/(?:^|[.,;\n]\s*)(?:should|shall)\s+(?:i|we|you)\b[^.,;\n?]*/g, ' ')
       .replace(/\bchi\s+(?:tu\s+van|hoi|giai\s+thich|xem|la\s+cau\s+hoi|can|la)\b[^.,;\n]*/g, ' ')
@@ -3783,7 +3816,7 @@ function applyTaskSemantics(contract, semantic) {
   let previous = sessionId
     ? [storedPrevious, sidecarPrevious].find((state) => String(state?.sessionId || '').trim() === sessionId) || {}
     : storedPrevious;
-  const continuationPrompt = /^(?:continue|resume|keep going|proceed|tiep tuc)(?:\s+(?:the task|this task|previous task))?[.!]?$/i.test(
+  const continuationPrompt = /^(?:continue|resume|keep going|go on|proceed|tiep tuc|lam tiep)(?:\s+(?:with\s+)?(?:the\s+|this\s+)?(?:previous\s+|last\s+|current\s+|same\s+)?(?:implementation\s+)?(?:task|work))?(?:\s+(?:thoi|di|đi|nhe|nao|nua|a|ha|please|pls|now|then))*\s*[.!]?$/i.test(
     extractPrompt(payload).normalize('NFD').replace(/[̀-ͯ]/g, '').trim());
   // Restore a contract parked by an informational turn: only for the SAME session, and only
   // on an explicit continuation or a mutating tool event (never a fresh prompt, which routes on its own,

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -1086,14 +1086,29 @@ function nativeOperationGoal(domain, actionable, text) {
 }
 
 // Task semantics are independent of source execution strategy and observed progress.
+// P1-A (forensic false block): the clause splitter below cuts at commas, so a negation only reached the
+// FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
+// the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
+// sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
+// Vietnamese negators stay clause-local. Noun uses of verbs ("write/verification advisory", "each proposed
+// fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
+const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
+function neutralizeNonOrders(text) {
+  return String(text)
+    .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
+}
+
 export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  const text = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase();
+  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase());
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
-  const sourceOrder = actionable.some((clause) => /\b(?:implement|fix|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
+  const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
-  const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
@@ -1121,13 +1136,16 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
     && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
   const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
-  const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
+  const taskKind = operation ? (sourceOrder || codeChangeVerb ? 'MIXED' : 'OPERATIONAL')
     : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
   return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
     ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
     ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
-      completionSemantics: /\b(?:ensure|dam bao)\b/.test(text) ? 'ensure-state' : 'execute-and-verify' } } : {}) };
+      completionSemantics: /\b(?:ensure|dam bao)\b/.test(text)
+        || actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy)\b/.test(clause)
+          && /\b(?:if\s+(?:it\s+)?(?:still\s+)?exists|if\s+present|neu\s+(?:van\s+|con\s+)?ton tai)\b/.test(clause))
+        ? 'ensure-state' : 'execute-and-verify' } } : {}) };
 }
 
 export function applyTaskSemantics(contract, semantic) {

package/template_project/.claude/ukit/index/route-task.mjs

@@ -1167,7 +1167,7 @@ async function main() {
   }
 
   const continuingTask = Boolean(previousState.taskInstanceId && lastPrompt
-    && /^(?:continue|resume|keep going|proceed|tiep tuc)(?:\s+(?:the task|this task|previous task))?[.!]?$/i.test(
+    && /^(?:continue|resume|keep going|go on|proceed|tiep tuc|lam tiep)(?:\s+(?:with\s+)?(?:the\s+|this\s+)?(?:previous\s+|last\s+|current\s+|same\s+)?(?:implementation\s+)?(?:task|work))?(?:\s+(?:thoi|di|đi|nhe|nao|nua|a|ha|please|pls|now|then))*\s*[.!]?$/i.test(
       promptText.normalize('NFD').replace(/[̀-ͯ]/g, '').trim()));
   const taskInstanceId = readFlagValue(args, '--task-instance-id')
     || (((['skill-router', 'skill-router-provisional'].includes(previousState.source)
@@ -4431,8 +4431,17 @@ function hasAdvisoryOnlyAssertion({ promptText = '', commandText = '' } = {}) {
   const residue = trimmed
     .replace(/"[^"\n]*"|«[^»\n]*»/g, ' ')
       // "tạo plan" / "create a plan": the plan is the deliverable, not a mutation order.
-      .replace(/\b(?:tao|lap|create|make|write|draft)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap)\b/g, ' ')
+      .replace(/\b(?:tao|lap|viet|create|make|write|draft|produce)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:one\s+)?(?:structured\s+|forensic\s+|short\s+|brief\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap|bao\s+cao|report|danh\s+gia|assessment)\b/g, ' ')
     .replace(/\bwrite-evidence\b|\bverification-evidence\b|\bimpact-evidence\b|\broot-cause\b/g, ' ')
+    // P1-A (forensic false block): nouns and investigation questions are not orders. 'write/verification
+    // advisory', 'state change', 'each proposed fix' name things; 'whether X may create Y' asks a question to
+    // answer. A negated ENUMERATION with objects ('do not implement fixes, modify source code, ... or create
+    // commits') negates every item to its sentence end; the older verb-only chain broke at 'fixes'.
+    .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
+    .replace(new RegExp(`\\bwhether\\b[^.,;\\n]*?(?=\\s+(?:va|and)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])|[.,;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh)(?![A-Za-z0-9_])(?:[^.,;\\n\u2014]*?(?:\\s*,\\s*(?:(?:or|and|nor|hay|hoac|va)\\s+)?|\\s+(?:or|nor|hay|hoac)\\s+)(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh|restart|manipulate|resume|push|merge|publish|touch|alter|reset|rollback|revert|commit|kill|release|tag)(?![A-Za-z0-9_]))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
     // A negated LIST ("do not implement, fix, or refactor"; "khong implement, sua, refactor hay chinh") negates every
     // verb in the list: the TAIL strip below stops at the first comma, which would leave the later verbs as orders.
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])(?:\\s*(?:,|,?\\s+(?:or|and|nor|hay|hoac|va))\\s*(?:(?:${MUT_VERBS})(?![A-Za-z0-9_])|(?:${MUT_VERBS})\\s))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
@@ -4455,7 +4464,7 @@ function hasAdvisoryOnlyAssertion({ promptText = '', commandText = '' } = {}) {
     .replace(new RegExp(`\\b(?:de|cho)\\s+${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:yeu\\s+cau|doi\\s+hoi|ep\\s+phai|bat\\s+buoc|bat\\s+phai)\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:demand(?:ed|s)?|require(?:d|s)?|forcing|forced|forcibly|must|has\\s+to|have\\s+to)\\b${TAIL}`, 'g'), ' ')
-    .replace(new RegExp(`\\b(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?<!\\bvan\\s)(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
     .replace(/\bco\s+(?:can|nen)\s+sua\b[^.,;\n?]*/g, ' ')
     .replace(/(?:^|[.,;\n]\s*)(?:should|shall)\s+(?:i|we|you)\b[^.,;\n?]*/g, ' ')
     .replace(/\bchi\s+(?:tu\s+van|hoi|giai\s+thich|xem|la\s+cau\s+hoi|can|la)\b[^.,;\n]*/g, ' ')
@@ -4547,11 +4556,20 @@ function hasMutationOrder({ promptText = '', commandText = '' } = {}) {
   const residue = trimmed
     .replace(/"[^"\n]*"|«[^»\n]*»/g, ' ')
       // "tạo plan" / "create a plan": the plan is the deliverable, not a mutation order.
-      .replace(/\b(?:tao|lap|create|make|write|draft)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap)\b/g, ' ')
+      .replace(/\b(?:tao|lap|viet|create|make|write|draft|produce)\s+(?:cho\s+toi\s+)?(?:a\s+|an\s+|the\s+|1\s+|mot\s+)?(?:one\s+)?(?:structured\s+|forensic\s+|short\s+|brief\s+)?(?:plan|ke\s+hoach|phuong\s+an|lo\s+trinh|roadmap|bao\s+cao|report|danh\s+gia|assessment)\b/g, ' ')
     // Descriptive state, not an order: "đã/vừa [được] + verb" ("hooks vừa được cài đặt") reports
     // something already done. Only the verb is stripped, so a later imperative still survives.
     .replace(/(?<![a-z0-9_])(?:da|vua)\s+(?:duoc\s+)?(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\s+the|cap\s+nhat|viet|chay|cai|chinh|trien\s+khai|cau\s+hinh)(?![a-z0-9_])/g, ' ')
     .replace(/\bwrite-evidence\b|\bverification-evidence\b|\bimpact-evidence\b|\broot-cause\b/g, ' ')
+    // P1-A (forensic false block): nouns and investigation questions are not orders. 'write/verification
+    // advisory', 'state change', 'each proposed fix' name things; 'whether X may create Y' asks a question to
+    // answer. A negated ENUMERATION with objects ('do not implement fixes, modify source code, ... or create
+    // commits') negates every item to its sentence end; the older verb-only chain broke at 'fixes'.
+    .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
+    .replace(new RegExp(`\\bwhether\\b[^.,;\\n]*?(?=\\s+(?:va|and)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])|[.,;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh)(?![A-Za-z0-9_])(?:[^.,;\\n\u2014]*?(?:\\s*,\\s*(?:(?:or|and|nor|hay|hoac|va)\\s+)?|\\s+(?:or|nor|hay|hoac)\\s+)(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh|restart|manipulate|resume|push|merge|publish|touch|alter|reset|rollback|revert|commit|kill|release|tag)(?![A-Za-z0-9_]))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
     // A negated LIST ("do not implement, fix, or refactor"; "khong implement, sua, refactor hay chinh") negates every
     // verb in the list: the TAIL strip below stops at the first comma, which would leave the later verbs as orders.
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])(?:\\s*(?:,|,?\\s+(?:or|and|nor|hay|hoac|va))\\s*(?:(?:${MUT_VERBS})(?![A-Za-z0-9_])|(?:${MUT_VERBS})\\s))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
@@ -4585,7 +4603,7 @@ function hasMutationOrder({ promptText = '', commandText = '' } = {}) {
     .replace(new RegExp(`\\b(?:de|cho)\\s+${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:yeu\\s+cau|doi\\s+hoi|ep\\s+phai|bat\\s+buoc|bat\\s+phai)\\b${TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:demand(?:ed|s)?|require(?:d|s)?|forcing|forced|forcibly|must|has\\s+to|have\\s+to)\\b${TAIL}`, 'g'), ' ')
-    .replace(new RegExp(`\\b(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?<!\\bvan\\s)(?:can|nen|phai|duoc)\\s+(?:duoc\\s+)?(?:sua|cau\\s+hinh|thay\\s+doi|cap\\s+nhat|edit|fix|config)\\b${TAIL}`, 'g'), ' ')
     .replace(/\bco\s+(?:can|nen)\s+sua\b[^.,;\n?]*/g, ' ')
     .replace(/(?:^|[.,;\n]\s*)(?:should|shall)\s+(?:i|we|you)\b[^.,;\n?]*/g, ' ')
     .replace(/\bchi\s+(?:tu\s+van|hoi|giai\s+thich|xem|la\s+cau\s+hoi|can|la)\b[^.,;\n]*/g, ' ')

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -8,7 +8,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { withAsyncLock, LOCK_MAX_SLICE_MS } from './async-lock.mjs';
 import { cronOperationReceipt, bashOperationReceipt, releaseOperationReceipt } from './cron-operation-adapter.mjs';
-import { operationCompletionPolicy, foldOperationEvidence, compactOperation } from './operation-evidence.mjs';
+import { operationCompletionPolicy, foldOperationEvidence, compactOperation, conditionalAbsenceGoal } from './operation-evidence.mjs';
 
 // Hook-context self-deadline (2.4.1 orphan-leak class): armed ONLY on direct
 // CLI invocation (see isDirectRun below) — never at import time. An import-time
@@ -348,6 +348,7 @@ function explicitPromptKey(routeState = {}) {
 }
 
 export function hasUnfinishedCompletion(state = {}, ledger = {}, { cwd } = {}) {
+  ledger = effectiveRequestLedger(state, ledger);
   if (state?.routeSummary?.executionContract?.taskKind) {
     const result = evaluateCompletion({ state, ledger, cwd });
     return result.complete !== true && (result.missingEvidence || []).length > 0 && !ledger.blocker;
@@ -3268,8 +3269,18 @@ function scopedContract(state, ledger) {
   const contract = state?.routeSummary?.executionContract;
   if (!contract?.operationGoal) return contract;
   const session = state?.sessionId || ledger?.sessionId;
-  return { ...contract, operationGoal: { ...contract.operationGoal,
-    scope: contract.operationGoal.scope || (session ? `session:${session}` : null) } };
+  let goal = contract.operationGoal;
+  // In-flight contracts retain their original semantics across tool reroutes. Reconcile
+  // the conditional-absence correction only for the same native goal; never change
+  // targets or discard the contract's existing code/verification obligations.
+  if (goal.domain === 'scheduled-job' && goal.desiredState === 'absent'
+    && goal.completionSemantics === 'execute-and-verify') {
+    if (conditionalAbsenceGoal(state?.routingContext?.lastExplicitUserPromptText, goal.target)) {
+      goal = { ...goal, completionSemantics: 'ensure-state' };
+    }
+  }
+  return { ...contract, operationGoal: { ...goal,
+    scope: goal.scope || (session ? `session:${session}` : null) } };
 }
 
 // Gate-time local git truth for the remote-parity proof (cwd-bound, so it lives here, not in the pure evidence module).
@@ -3304,14 +3315,16 @@ function effectiveRequestLedger(state = {}, ledger = {}) {
 // Release postcondition. A request that ORDERS `npm publish` is complete only when trusted receipts
 // (real Bash results recorded by the adapter - never agent prose) show the registry serving exactly the
 // package.json version, and the local Git state agrees: a local release tag, if present, must DEREFERENCE
-// (`^{commit}`, never the annotated tag-object SHA) to HEAD. A failed/missing publish with no registry proof
+// (`^{commit}`, never the annotated tag-object SHA) to HEAD, or to an ancestor of HEAD with no shipped change
+// since (publishedReleaseDrifted). A failed/missing publish with no registry proof
 // stays missing. A registry that already serves the version counts as published, so a finished release is
 // never re-published just to satisfy the gate.
 function promptOrdersNpmPublish(state = {}) {
-  const text = String(state?.routingContext?.lastExplicitUserPromptText || '').toLowerCase();
+  const text = String(state?.routingContext?.lastExplicitUserPromptText || '')
+    .normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
   if (!/\bnpm\s+publish\b/.test(text)) return false;
   return text.split(/[\n;.,]|\bthen\b|\band\b/).some((clause) => /\bnpm\s+publish\b/.test(clause)
-    && !/\b(?:do not|don't|never|without|not yet|dry-run|khong|dung)\b|--dry-run/.test(clause));
+    && !/\b(?:do not|don't|never|without|not yet|dry-run|khong|dung|chua)\b|--dry-run/.test(clause));
 }
 
 function releasePublicationMissing(state, ledger, cwd) {
@@ -3327,10 +3340,73 @@ function releasePublicationMissing(state, ledger, cwd) {
   if (view?.operation?.state !== wanted) return 'release-publication';
   const tagCommit = gitOutput(['rev-parse', '--verify', '--quiet', `v${pkg.version}^{commit}`], cwd);
   const head = gitOutput(['rev-parse', 'HEAD'], cwd);
-  if (tagCommit && head && tagCommit !== head) return 'release-publication';
+  // A repository that tags its releases (any v<semver> tag exists) must have tagged THIS version: without the
+  // tag there is no immutable identity to tie the published artifact to. A repository that never tags keeps
+  // the registry receipt as its only proof (the pre-P1 behaviour) instead of being blocked forever.
+  if (!tagCommit && head && repoTagsReleases(cwd)) return 'release-publication';
+  if (tagCommit && head && (tagCommit !== head || workingTreeShippedChange(pkg, tagCommit, cwd)) && publishedReleaseDrifted(pkg, tagCommit, head, cwd)) return 'release-publication';
   return null;
 }
 
+// P1-B: the published release is identified by the IMMUTABLE tag commit, not by the moving HEAD. A later
+// commit must not invalidate a verified publication, but HEAD may only be ahead of the tag when (a) the tag
+// commit is an ancestor of HEAD, (b) package.json AT THE TAG carries the published version, and (c) nothing
+// the package ships changed between tag and HEAD (docs/tests/ledger-only follow-ups are fine; unshipped
+// source is not). Every git failure is fail-closed: unknown means drifted.
+function gitSucceeds(args, cwd) {
+  try {
+    execFileSync('git', args, { cwd, stdio: ['ignore', 'ignore', 'ignore'], timeout: 5000 });
+    return true;
+  } catch { return false; }
+}
+
+function packageFilePattern(entry) {
+  const negated = entry.startsWith('!');
+  let body = (negated ? entry.slice(1) : entry).replace(/^\.?\//, '');
+  const dir = body.endsWith('/');
+  if (dir) body = body.slice(0, -1);
+  const source = body.split('**').map((part) => part.split('*')
+    .map((seg) => seg.replace(/[.+?^${}()|[\]\\]/g, '\\$&')).join('[^/]*')).join('.*');
+  return { negated, regex: new RegExp(`^${source}(?:/.*)?$`) };
+}
+
+function shippedByPackage(pkg, file) {
+  if (/^(?:package\.json|readme(?:\.[a-z]+)?|license(?:\.[a-z]+)?|licence(?:\.[a-z]+)?|changelog(?:\.[a-z]+)?)$/i.test(file)) return true;
+  if (!Array.isArray(pkg?.files)) return true; // no allow-list: npm ships everything, so any change is shipped code
+  const patterns = pkg.files.filter((entry) => typeof entry === 'string' && entry.trim()).map(packageFilePattern);
+  const included = patterns.some((p) => !p.negated && p.regex.test(file));
+  return included && !patterns.some((p) => p.negated && p.regex.test(file));
+}
+
+function publishedReleaseDrifted(pkg, tagCommit, head, cwd) {
+  if (!gitSucceeds(['merge-base', '--is-ancestor', tagCommit, head], cwd)) return true;
+  let taggedVersion = null;
+  try {
+    taggedVersion = JSON.parse(gitOutput(['show', `${tagCommit}:package.json`], cwd) || 'null')?.version ?? null;
+  } catch { return true; }
+  if (taggedVersion !== pkg.version) return true;
+  let changed = null;
+  try {
+    changed = execFileSync('git', ['diff', '--name-only', '-z', tagCommit, head], { cwd, encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] });
+  } catch { return true; }
+  if (String(changed).split('\0').filter(Boolean).some((file) => shippedByPackage(pkg, file))) return true;
+  return workingTreeShippedChange(pkg, tagCommit, cwd);
+}
+
+function repoTagsReleases(cwd) {
+  const tags = gitOutput(['tag', '--list', 'v[0-9]*'], cwd);
+  return Boolean(tags && tags.trim());
+}
+
+// Uncommitted edits (tracked or untracked) to shipped files are not the published artifact either.
+function workingTreeShippedChange(pkg, tagCommit, cwd) {
+  try {
+    const tracked = execFileSync('git', ['diff', '--name-only', '-z', tagCommit], { cwd, encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] });
+    const untracked = execFileSync('git', ['ls-files', '--others', '--exclude-standard', '-z'], { cwd, encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return `${tracked}${untracked}`.split('\0').filter(Boolean).some((file) => shippedByPackage(pkg, file));
+  } catch { return true; }
+}
+
 function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null } = {}) {
   const routeSummary = state?.routeSummary || {};
   // Explicit vibecode autonomy: the user asked UKit to run one prompt to a finished result,
@@ -3338,17 +3414,26 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   const vibecode = routeSummary.autonomyLevel === 'vibecode';
   const mode = routeSummary.executionMode || routeSummary.approachSelector?.executionMode || null;
   const evidence = requiredEvidence(state);
-  if (ledger?.blocker) {
+  // Request-scoped blocker: the stored session ledger persists until the new request's first
+  // receipt re-keys it, so the RAW `ledger.blocker` can still be the PREVIOUS task's escape.
+  // Scope the check to the effective request ledger — a stale blocker must never release the
+  // new task's gate (its verification debt stays enforced below) — while the current task's
+  // own blocker still ends the run truthfully: complete:false + outcome:'blocked', never a
+  // fabricated complete and never another continuation loop.
+  const requestLedger = effectiveRequestLedger(state, ledger);
+  if (requestLedger?.blocker) {
     // A blocker minted by the gate itself (verification loop) is the run's exit path — it
     // must be user-visible or the release is indistinguishable from a stall. A blocker
     // minted by a permission decision is already named in the model's own reply and stays
     // silent here.
-    if (ledger.blocker.visible === true) {
+    if (requestLedger.blocker.visible === true) {
       return {
         continue: false,
         notify: true,
+        complete: false,
+        outcome: 'blocked',
         missingEvidence: [],
-        reason: `UKit stopped automatic recovery: ${ledger.blocker.detail || 'a recorded blocker ended this run.'}`,
+        reason: `UKit stopped automatic recovery: ${requestLedger.blocker.detail || 'a recorded blocker ended this run.'}`,
       };
     }
     // An invisible blocker (e.g. a permission decision the model already named in its own
@@ -3357,8 +3442,10 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
     return {
       continue: false,
       notify: true,
+      complete: false,
+      outcome: 'blocked',
       missingEvidence: [],
-      reason: `UKit stopped automatic recovery: ${ledger.blocker.detail || 'a recorded blocker ended this run.'}`,
+      reason: `UKit stopped automatic recovery: ${requestLedger.blocker.detail || 'a recorded blocker ended this run.'}`,
     };
   }
   if (!state || !state.routeSummary) {
@@ -3644,7 +3731,7 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
 
   const finalAttempt = !vibecode && continuationCount === MAX_CONTINUATIONS - 1;
   const instruction = missingEvidence.includes('release-publication')
-    ? 'The release is not proven published: run `npm publish` once if the registry does not yet serve this version, then confirm with `npm view <package> version` (must equal package.json) and that the release tag dereferences to HEAD. Do not republish a version the registry already serves.'
+    ? 'The release is not proven published: run `npm publish` once if the registry does not yet serve this version, then confirm with `npm view <package> version` (must equal package.json) and that the release tag dereferences to HEAD (or to an ancestor of HEAD with no shipped change since). Never move the tag. Do not republish a version the registry already serves.'
     : operationalTask
     ? 'Inspect native mutation receipts and verify the requested operational state; do not fabricate source edits or source-test evidence.'
     : recoveryInstruction(missingEvidence, effectiveLedger, routeSummary, { cwd });

package/template_project/.claude/ukit/runtime/handoff-intent.mjs

@@ -38,6 +38,8 @@
 import fs from 'node:fs/promises';
 import fsSync from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
 
 // The `(?![\w-])` closer is the exact token boundary: a command name followed by
@@ -273,15 +275,164 @@ export function classifyHandoffLine(line) {
   }
 }
 
+const SCAN_CHUNK = 4 * 1024 * 1024;
+const INTENT_CACHE_VERSION = 1;
+const RUNTIME_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+// The shipped template tree must never grow runtime state: only an installed project gets a default cache.
+const DEFAULT_INTENT_CACHE_DIR = path.basename(RUNTIME_ROOT) === 'template_project' ? null : path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '.ukit', 'storage', 'cache', 'handoff-intent');
+const EVIDENCE_MARKERS = ['handoff-create', 'handoff-fullstack', 'handoff-implement', 'handoff-review', 'handoff-status', 'handoff-clear', 'HANDOFF RESUME'];
+
+/**
+ * Walk the byte range [lo, hi) NEWEST line first, in bounded chunks, and stop at the
+ * first line that carries a handoff intent. `hi` must be EOF or a line boundary. `lo`
+ * is a line boundary only when `loIsBoundary`; otherwise the fragment cut by `lo` is
+ * not a whole entry and is dropped. `reached` is the lowest absolute byte offset up to
+ * which every line was fully examined; `lastNL` the highest newline seen (so callers
+ * can persist a line-aligned offset and never cache a half-written trailing record).
+ * @returns {{status:'found'|'done'|'torn'|'timeout', intent?:string, evidence?:{pos:number,len:number}, reached:number, lastNL:number}}
+ */
+async function scanBack(handle, hi, lo, loIsBoundary, deadline) {
+  let pos = hi;
+  let carry = Buffer.alloc(0);
+  let lastNL = -1;
+  let reached = hi;
+  while (pos > lo) {
+    if (Date.now() > deadline) return { status: 'timeout', reached, lastNL };
+    const start = Math.max(lo, pos - SCAN_CHUNK);
+    const chunk = Buffer.allocUnsafe(pos - start);
+    const { bytesRead } = await handle.read(chunk, 0, chunk.length, start);
+    if (bytesRead !== chunk.length) return { status: 'timeout', reached, lastNL };
+    const buf = carry.length ? Buffer.concat([chunk, carry]) : chunk;
+    if (lastNL < 0) {
+      const i = buf.lastIndexOf(10);
+      if (i >= 0) lastNL = start + i;
+    }
+    let base = start;
+    let region = buf;
+    if (start > 0 && !(loIsBoundary && start === lo)) {
+      // This chunk begins mid-line: the head fragment belongs to the next lower chunk.
+      const nl = buf.indexOf(10);
+      if (nl < 0) { carry = buf; pos = start; continue; }
+      carry = buf.subarray(0, nl);
+      region = buf.subarray(nl + 1);
+      base = start + nl + 1;
+      reached = base;
+    } else {
+      carry = Buffer.alloc(0);
+      reached = start;
+    }
+    let end = region.length;
+    for (;;) {
+      const i = end > 0 ? region.lastIndexOf(10, end - 1) : -1;
+      const lineBuf = region.subarray(i + 1, end);
+      if (lineBuf.length) {
+        const line = lineBuf.toString('utf8');
+        // Cheap prefilter — skip JSON.parse for lines that cannot be evidence.
+        if (EVIDENCE_MARKERS.some((m) => line.includes(m))) {
+          // This is the NEWEST line carrying intent evidence. A host append can be
+          // cut mid-record (killed turn, torn write), leaving it unparseable. Skipping
+          // it would fall through to an OLDER — possibly OPPOSITE — intent (a torn
+          // `handoff-implement` after a create released a real fullstack run). An
+          // incomplete newest evidence-bearing record is UNDETERMINED, not "no
+          // intent": the caller stays fail-closed (MODULE02-SPEC FR-M2-002).
+          let entry;
+          try { entry = JSON.parse(line); } catch { return { status: 'torn', reached, lastNL }; }
+          const intent = classifyHandoffEntry(entry);
+          if (intent) return { status: 'found', intent, evidence: { pos: base + i + 1, len: lineBuf.length }, reached, lastNL };
+          // Complete record with no recognised intent (tool output, foreign envelope):
+          // not evidence — keep walking older lines.
+        }
+      }
+      if (i < 0) break;
+      end = i;
+    }
+    pos = start;
+  }
+  return { status: 'done', reached, lastNL };
+}
+
+const fp = (buf) => createHash('sha1').update(buf).digest('hex');
+
+async function readBytes(handle, pos, len) {
+  const buf = Buffer.allocUnsafe(len);
+  const { bytesRead } = await handle.read(buf, 0, len, pos);
+  return bytesRead === len ? buf : null;
+}
+
+/**
+ * Load the per-transcript incremental state and prove it still describes THIS file:
+ * same head bytes (rotation / session reuse), same bytes just below the cached offset
+ * (in-place rewrite), size not below the offset (truncation), and any cached intent
+ * line re-read and re-classified. Anything malformed, stale or unverifiable returns
+ * null so the caller re-scans from scratch — a bad cache can only cost time, and can
+ * never turn an inconclusive scan into a conclusive one.
+ */
+async function loadIntentCache(file, handle, size, maxBytes) {
+  try {
+    const c = JSON.parse(await fs.readFile(file, 'utf8'));
+    if (!c || c.v !== INTENT_CACHE_VERSION) return null;
+    const ints = [c.offset, c.coveredFrom, c.headLen, c.tailLen];
+    if (!ints.every((n) => Number.isSafeInteger(n) && n >= 0)) return null;
+    if (c.offset > size || size - c.offset > maxBytes || c.coveredFrom > c.offset) return null;
+    if (c.headLen > Math.min(size, 4096) || c.tailLen > c.offset) return null;
+    const head = await readBytes(handle, 0, c.headLen);
+    if (!head || fp(head) !== c.headFp) return null;
+    const tail = await readBytes(handle, c.offset - c.tailLen, c.tailLen);
+    if (!tail || fp(tail) !== c.tailFp) return null;
+    let intent = null;
+    let evidence = null;
+    if (c.intent) {
+      const ev = c.evidence;
+      if (!ev || !Number.isSafeInteger(ev.pos) || !Number.isSafeInteger(ev.len) || ev.pos < c.coveredFrom || ev.pos + ev.len >= c.offset) return null;
+      const raw = await readBytes(handle, ev.pos, ev.len);
+      if (!raw || classifyHandoffLine(raw.toString('utf8')) !== c.intent) return null;
+      intent = c.intent;
+      evidence = { pos: ev.pos, len: ev.len };
+    }
+    return { offset: c.offset, coveredFrom: c.coveredFrom, intent, evidence };
+  } catch {
+    return null;
+  }
+}
+
+async function saveIntentCache(file, handle, st) {
+  try {
+    if (!(st.coveredFrom <= st.offset)) return;
+    const headLen = Math.min(4096, st.offset);
+    const tailLen = Math.min(256, st.offset);
+    const head = await readBytes(handle, 0, headLen);
+    const tail = await readBytes(handle, st.offset - tailLen, tailLen);
+    if (!head || !tail) return;
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify({
+      v: INTENT_CACHE_VERSION, offset: st.offset, coveredFrom: st.coveredFrom,
+      headLen, headFp: fp(head), tailLen, tailFp: fp(tail),
+      intent: st.intent || null, evidence: st.intent ? st.evidence : null,
+    }), 'utf8');
+    await fs.rename(tmp, file);
+  } catch { /* best effort: the next call just re-scans */ }
+}
+
 /**
  * Read a session transcript and return its MOST RECENT handoff intent.
+ *
+ * Bounded per call: at most `maxBytes` examined within `budgetMs`. When `cacheDir` is
+ * given, progress is kept per transcript as a line-aligned offset + the newest intent
+ * line found + the lowest byte covered, so later calls scan only the appended bytes and
+ * (for a transcript larger than `maxBytes`) backfill one more window below the covered
+ * region until the whole file is proven to hold no intent. Hooks never rescan the whole
+ * transcript, yet an oversized session still becomes conclusive. Without `cacheDir` the
+ * scan is stateless (tail window only).
  * @returns {Promise<{ intent: 'fullstack'|'create'|null, known: boolean }>}
  *   `known=false` means the scan could not be completed (no path, unreadable,
- *   budget overrun); callers keep their existing blocking behaviour there.
+ *   budget overrun, torn newest evidence, region not yet covered); callers keep
+ *   their existing blocking behaviour there.
  */
 export async function transcriptHandoffIntent(transcriptPath, {
   budgetMs = INTENT_SCAN_BUDGET_MS,
   maxBytes = INTENT_SCAN_MAX_BYTES,
+  cacheDir = undefined,
 } = {}) {
   if (typeof transcriptPath !== 'string' || !transcriptPath.trim()) {
     return { intent: null, known: false };
@@ -289,58 +440,60 @@ export async function transcriptHandoffIntent(transcriptPath, {
   let handle;
   try {
     handle = await fs.open(transcriptPath, 'r');
-    const stat = await handle.stat();
-    const size = Number(stat.size) || 0;
-    const start = Math.max(0, size - maxBytes);
+    const size = Number((await handle.stat()).size) || 0;
     const deadline = Date.now() + budgetMs;
-    const chunk = Buffer.allocUnsafe(Math.min(Math.max(1, size - start), 4 * 1024 * 1024));
-    let text = '';
-    let pos = start;
-    while (pos < size) {
-      if (Date.now() > deadline) return { intent: null, known: false };
-      const toRead = Math.min(chunk.length, size - pos);
-      const { bytesRead } = await handle.read(chunk, 0, toRead, pos);
-      if (!bytesRead) break;
-      text += chunk.toString('utf8', 0, bytesRead);
-      pos += bytesRead;
-    }
-    let lines = text.split('\n');
-    // A tail window starts mid-line: the first fragment is not a whole entry.
-    if (start > 0) lines = lines.slice(1);
-    for (let i = lines.length - 1; i >= 0; i -= 1) {
-      const line = lines[i];
-      if (!line) continue;
-      // Cheap prefilter — skip JSON.parse for lines that cannot be evidence.
-      // `handoff-implement` is included: an implement invocation after a create
-      // must be seen as the NEWEST intent, not lost to the older create line.
-      if (!line.includes('handoff-create') && !line.includes('handoff-fullstack') && !line.includes('handoff-implement') && !line.includes('handoff-review') && !line.includes('handoff-status') && !line.includes('handoff-clear') && !line.includes('HANDOFF RESUME')) {
-        continue;
+    // One shared mechanism for every caller (Claude hook, omp bridge, Stop coordinator):
+    // an oversized transcript gets the incremental cache by default, rooted at this
+    // runtime's own project (<root>/.claude/ukit/runtime -> <root>/.ukit/storage/cache).
+    // `cacheDir:false|null` forces a stateless scan; small transcripts never need one.
+    if (cacheDir === undefined) cacheDir = size > maxBytes ? (process.env.UKIT_INTENT_CACHE_DIR || DEFAULT_INTENT_CACHE_DIR) : null;
+    const cacheFile = cacheDir ? path.join(cacheDir, `${fp(Buffer.from(path.resolve(transcriptPath))).slice(0, 24)}.json`) : null;
+    const cache = cacheFile ? await loadIntentCache(cacheFile, handle, size, maxBytes) : null;
+
+    let offset;
+    let covered;
+    let intent = null;
+    let evidence = null;
+    let persist = false;
+    // Step A: bytes the cache has not seen (the whole tail window on a cold start).
+    const a = await scanBack(handle, size, cache ? cache.offset : Math.max(0, size - maxBytes), Boolean(cache), deadline);
+    if (a.status === 'torn') return { intent: null, known: false };
+    if (cache) {
+      offset = a.lastNL >= 0 ? a.lastNL + 1 : cache.offset;
+      covered = cache.coveredFrom;
+      if (a.status === 'found') {
+        if (a.evidence.pos + a.evidence.len < offset) { intent = a.intent; evidence = a.evidence; persist = true; }
+        else intent = a.intent; // still being appended: answer now, cache once the line is complete
+      } else if (a.status === 'done') {
+        intent = cache.intent; evidence = cache.evidence; persist = offset !== cache.offset;
+      } else {
+        return { intent: null, known: false };
       }
-      // This is the NEWEST line carrying intent evidence. A host append can be
-      // cut mid-record (killed turn, torn write), leaving this line as unparseable
-      // JSON. Skipping it like any other non-qualifying line would fall through to
-      // an OLDER — possibly OPPOSITE — intent and misreport the session's current
-      // ownership (a torn `handoff-implement` after a create released a real
-      // fullstack run). An incomplete newest evidence-bearing record is therefore
-      // UNDETERMINED, not "no intent": return unknown so fail-closed callers keep
-      // their blocking/conservative posture (MODULE02-SPEC FR-M2-002).
-      let entry;
-      try {
-        entry = JSON.parse(line);
-      } catch {
+    } else {
+      offset = a.lastNL >= 0 ? a.lastNL + 1 : size;
+      covered = a.status === 'found' ? a.evidence.pos : a.reached;
+      if (a.status === 'found') { intent = a.intent; evidence = a.evidence; persist = a.evidence.pos + a.evidence.len < offset; }
+      else persist = a.lastNL >= 0 && covered <= offset;
+      if (a.status === 'timeout') {
+        if (persist && cacheFile) await saveIntentCache(cacheFile, handle, { offset, coveredFrom: covered, intent: null });
         return { intent: null, known: false };
       }
-      const intent = classifyHandoffEntry(entry);
-      if (intent) return { intent, known: true };
-      // Complete record that carries no recognised intent (tool output, a foreign
-      // envelope, a malformed-but-whole unrelated line): not evidence — keep
-      // walking older lines.
     }
-    // Nothing found. Only a scan of the WHOLE transcript proves "no handoff
-    // intent"; a tail window that missed it (the invoking turn usually appears
-    // once, near the start of an omp session) cannot, so it stays unknown and
-    // callers keep blocking.
-    return { intent: null, known: start === 0 };
+    // Step B: nothing newer — extend coverage one bounded window further down.
+    if (!intent && covered > 0) {
+      const room = Math.max(0, maxBytes - (size - (cache ? cache.offset : Math.max(0, size - maxBytes))));
+      if (room > 0) {
+        const b = await scanBack(handle, covered, Math.max(0, covered - room), false, deadline);
+        if (b.status === 'torn') return { intent: null, known: false };
+        if (b.status === 'found') { intent = b.intent; evidence = b.evidence; covered = b.evidence.pos; persist = true; }
+        else { covered = b.reached; persist = true; }
+      }
+    }
+    if (persist && cacheFile) await saveIntentCache(cacheFile, handle, { offset, coveredFrom: covered, intent, evidence });
+    // Only a scan of the WHOLE transcript proves "no handoff intent"; an uncovered
+    // region (the invoking turn usually appears once, near the start of an omp
+    // session) stays unknown and callers keep blocking.
+    return { intent, known: Boolean(intent) || covered === 0 };
   } catch {
     return { intent: null, known: false };
   } finally {

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -66,6 +66,17 @@ export function foldOperationEvidence(bank = {}, receipt, ledger) {
     [key]: { ...prior, [op.role]: proof } };
 }
 
+export function conditionalAbsenceGoal(promptText, target) {
+  if (typeof target !== 'string' || !/^[a-f0-9]{8}(?:[a-f0-9-]{0,28})$/.test(target)) return false;
+  const text = String(promptText || '').normalize('NFD')
+    .replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase();
+  return text.split(/[\n;.,]/).some((clause) => clause.split(/\s+/).some((word) => word === target)
+    && /\b(?:cron|scheduled\s+job)\b/.test(clause)
+    && /\b(?:delete|remove|cancel|xoa|huy)\b/.test(clause)
+    && !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
+    && /\b(?:if\s+(?:it\s+)?(?:still\s+)?exists|if\s+present|neu\s+(?:van\s+|con\s+)?ton tai)\b/.test(clause));
+}
+
 export function operationEvidenceStatus(goal, ledger = {}) {
   if (!goal || typeof goal.domain !== 'string' || !goal.domain || typeof goal.desiredState !== 'string'
     || !goal.desiredState || (goal.target !== null && (typeof goal.target !== 'string' || !goal.target))
@@ -104,7 +115,10 @@ export function operationEvidenceStatus(goal, ledger = {}) {
   if (goal.domain === 'git-integrity' && validRemoteSync(op.remoteSync) && auth
     && (op.remoteSync.sha !== auth.head || op.remoteSync.ref !== `refs/heads/${auth.branch}`
       || (auth.remote && op.remoteSync.remote !== auth.remote))) return incomplete;
-  if (goal.completionSemantics === 'ensure-state' && attempts.length === 0) {
+  // Ensuring a state does not promise execution. A fresh native observation after
+  // every attempt proves the postcondition even when an already-absent delete failed.
+  if (goal.completionSemantics === 'ensure-state'
+    && attempts.every((proof) => Number.isSafeInteger(proof.sequence) && observation.sequence > proof.sequence)) {
     return { complete: true, operationProof: 'desired-state-only' };
   }
   if (!proofs.every((proof) => proof?.success && proof.toolUseId && observation.toolUseId

package/template_project/AGENTS.md

@@ -106,6 +106,7 @@ Chỉ active khi task đi qua `docs/AI_HANDOFF/` ("execute task TASK-xxx" hoặc
 ## Unattended Completion Loop
 <!-- RULE: UNATTENDED-01 -->
 - `orchestration.permissionMode: unattended` = no human in the loop — UNDERSTAND → PLAN → IMPLEMENT → VERIFY → FIX → REVERIFY → COMPLETE. A turn ends only on COMPLETE evidence, a real external blocker, or a deny.
+- UKit workflow phases are not host permissions: host permission mode remains user-owned (including Bypass, Default/Ask and Plan). PLAN is not a request to enter host Plan Mode; planning/review/handoff must not switch modes unless the user explicitly requests that transition. Respect host approval and managed policy; never restore an older mode over a newer user choice; subagent mode must not change the parent or another session.
 <!-- RULE: UNATTENDED-02 -->
 - `maxAttemptsPerFailure: 2`, `maxRecoveryStrategies: 2` distinct fix strategies before reassessing — retry the same edit, then fix the cause differently; never loop one strategy.
 <!-- RULE: UNATTENDED-03 -->

package/template_project/CLAUDE.md

@@ -106,6 +106,7 @@ Chỉ active khi task đi qua `docs/AI_HANDOFF/` ("execute task TASK-xxx" hoặc
 ## Unattended Completion Loop
 <!-- RULE: UNATTENDED-01 -->
 - `orchestration.permissionMode: unattended` = no human in the loop — UNDERSTAND → PLAN → IMPLEMENT → VERIFY → FIX → REVERIFY → COMPLETE. A turn ends only on COMPLETE evidence, a real external blocker, or a deny.
+- UKit workflow phases are not host permissions: host permission mode remains user-owned (including Bypass, Default/Ask and Plan). PLAN is not a request to enter host Plan Mode; planning/review/handoff must not switch modes unless the user explicitly requests that transition. Respect host approval and managed policy; never restore an older mode over a newer user choice; subagent mode must not change the parent or another session.
 <!-- RULE: UNATTENDED-02 -->
 - `maxAttemptsPerFailure: 2`, `maxRecoveryStrategies: 2` distinct fix strategies before reassessing — retry the same edit, then fix the cause differently; never loop one strategy.
 <!-- RULE: UNATTENDED-03 -->

package/template_project/instructions/core.md

@@ -103,6 +103,7 @@ Chỉ active khi task đi qua `docs/AI_HANDOFF/` ("execute task TASK-xxx" hoặc
 ## Unattended Completion Loop
 <!-- RULE: UNATTENDED-01 -->
 - `orchestration.permissionMode: unattended` = no human in the loop — UNDERSTAND → PLAN → IMPLEMENT → VERIFY → FIX → REVERIFY → COMPLETE. A turn ends only on COMPLETE evidence, a real external blocker, or a deny.
+- UKit workflow phases are not host permissions: host permission mode remains user-owned (including Bypass, Default/Ask and Plan). PLAN is not a request to enter host Plan Mode; planning/review/handoff must not switch modes unless the user explicitly requests that transition. Respect host approval and managed policy; never restore an older mode over a newer user choice; subagent mode must not change the parent or another session.
 <!-- RULE: UNATTENDED-02 -->
 - `maxAttemptsPerFailure: 2`, `maxRecoveryStrategies: 2` distinct fix strategies before reassessing — retry the same edit, then fix the cause differently; never loop one strategy.
 <!-- RULE: UNATTENDED-03 -->