@ngockhoale/ukit 3.4.49 → 3.4.51

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -456,10 +456,118 @@ export async function writeResumeIntent(projectRoot, payload = {}, { now = Date.
   return intent;
 }
 
+// ─── Gate-continuation provenance ───────────────────────────────────────────
+// When the Stop gate blocks, the harness re-injects the block reason as the next
+// prompt (omp emits it as an agent-attributed `session-stop-continuation`). That
+// text is the gate's OWN voice, not a user order. Reproducible defect shape when
+// such a prompt is routed as a new task: a fresh taskInstanceId is minted, a
+// contract is re-derived from the gate's own wording, and the gate text is
+// stamped as the explicit user prompt — evidence recorded under the original
+// task then fails ownership and the gate can loop on its own feedback.
+//
+// Provenance is NOT content-based: the shape check below only recognizes our own
+// envelope. Trust comes from (a) the host declaring POSITIVE system provenance
+// (ukit_prompt_origin=system — a marker may then be consumed on an exact
+// session+task+reason-hash match within TTL) or (b) native adapter provenance
+// (ukit_harness=omp + origin=system), which resumes with or without a marker.
+// A marker is a CORRELATION binding, never proof of the speaker: without positive
+// provenance the prompt is conservatively treated as the user's own, so a real
+// user paste of the gate text stays a genuine fresh request even with a live
+// marker, and a user-declared origin never consumes a marker at all.
+export const GATE_CONTINUATION_TTL_MS = 30 * 60 * 1000;
+const GATE_CONTINUATION_PREFIX = /^UKit completion gate:/;
+// The exact diagnostics tail evaluateCompletion appends to every gate reason.
+const GATE_CONTINUATION_DIAGNOSTICS = /\s\[task=\S+ contract=\S+ accepted-count=\d+ rejected=[^\]\s]*\]\s*$/;
+const GATE_CONTINUATION_MAX_CHARS = 2000;
+
+export function isCompletionGateContinuationText(text) {
+  const value = String(text ?? '').trim();
+  if (!value || value.length > GATE_CONTINUATION_MAX_CHARS) return false;
+  return GATE_CONTINUATION_PREFIX.test(value) && GATE_CONTINUATION_DIAGNOSTICS.test(value);
+}
+
+export function completionContinuationTaskId(text) {
+  if (!isCompletionGateContinuationText(text)) return null;
+  return String(text).trim().match(/\[task=([^\]\s]+) contract=/)?.[1] || null;
+}
+
+// Binds a marker to the EXACT reason text the gate emitted (hash only — the
+// marker record never carries prompt text). Prevents a different gate-shaped
+// message about the same task from being mistaken for our own continuation.
+export function completionContinuationReasonHash(text) {
+  return crypto.createHash('sha256').update(String(text ?? '').trim(), 'utf8').digest('hex');
+}
+
+function completionContinuationPath(projectRoot) {
+  return path.join(projectRoot, '.ukit', 'storage', 'cache', 'completion-continuation.json');
+}
+
+// Bounded ring (newest first): session, task id, contract kind and reason hash
+// only — never prompt text. Fail-closed: no task id or no reason text, no
+// marker. Advisory: a failed write degrades to today's behavior (the envelope
+// is then just an unbound user turn), never breaks the gate. Read-modify-write
+// runs under the ledger lock so concurrent recorders/takers serialize —
+// unlocked, two takes could both "win" and parallel records could clobber the
+// ring down to a single entry. A lock failure is conservative on both sides:
+// record nothing, resume nothing.
+export async function recordPendingCompletionContinuation(projectRoot, { sessionId, taskInstanceId, contract, reason }, { now = Date.now() } = {}) {
+  if (!taskInstanceId || !String(reason ?? '').trim()) return null;
+  const file = completionContinuationPath(projectRoot);
+  try {
+    const outcome = await withLedgerLock(file, {}, async () => {
+      const store = await readJson(file, {}) || {};
+      const entries = Array.isArray(store.entries) ? store.entries : [];
+      const next = [
+        { sessionId: sessionId == null ? null : String(sessionId), taskInstanceId: String(taskInstanceId), contract: contract == null ? null : String(contract), reasonHash: completionContinuationReasonHash(reason), ts: now },
+        ...entries.filter((entry) => entry?.taskInstanceId !== taskInstanceId),
+      ].slice(0, 4);
+      await writeJsonAtomic(file, { entries: next });
+      return next[0];
+    });
+    return outcome?.ok === true ? outcome.value ?? null : null;
+  } catch {
+    return null;
+  }
+}
+
+// Exact-bound take: the envelope's own task id AND the consuming session AND
+// the reason hash must all match a fresh marker, otherwise nothing is returned
+// and nothing is consumed (an unbound or re-worded quote of the gate text stays
+// a genuine user turn). A call without the reason hash never consumes. The
+// matched entry is removed under the same lock that read it, so of N concurrent
+// takers exactly one wins.
+export async function takePendingCompletionContinuation(projectRoot, { sessionId, taskInstanceId, reasonHash }, { now = Date.now(), consume = true } = {}) {
+  if (!taskInstanceId || !reasonHash) return null;
+  const file = completionContinuationPath(projectRoot);
+  try {
+    const outcome = await withLedgerLock(file, {}, async () => {
+      const store = await readJson(file, {}) || {};
+      const entries = Array.isArray(store.entries) ? store.entries : [];
+      const index = entries.findIndex((entry) => entry?.taskInstanceId === String(taskInstanceId)
+        && (entry.sessionId ?? null) === (sessionId == null ? null : String(sessionId))
+        && typeof entry.reasonHash === 'string' && entry.reasonHash === String(reasonHash)
+        && Number.isFinite(entry.ts) && now - entry.ts <= GATE_CONTINUATION_TTL_MS);
+      if (index < 0) return null;
+      if (consume) {
+        const next = entries.filter((_, i) => i !== index);
+        await writeJsonAtomic(file, { entries: next });
+      }
+      return entries[index];
+    });
+    return outcome?.ok === true ? outcome.value ?? null : null;
+  } catch {
+    return null;
+  }
+}
+
 function explicitError(payload = {}) {
   return [
     payload.isError,
     payload.is_error,
+    payload.interrupted,
+    payload.tool_output?.interrupted,
+    payload.tool_result?.interrupted,
+    payload.tool_response?.interrupted,
     payload.tool_output?.isError,
     payload.tool_output?.is_error,
     payload.tool_result?.isError,
@@ -530,8 +638,8 @@ function extractExitCode(payload = {}) {
   return null;
 }
 
-// The trailing boundary accepts shell terminators (`;`, `&`, `|`, `)`) so
-// `yarn release:verify; echo "exit=$?"` — the real-exit-code idiom — still mints a receipt.
+// Recognize runner presence separately from exit proof. A trailing echo of `$?`
+// can report a status in text but cannot make the wrapper's exit authoritative.
 // Blank out quoted literals so `echo '(jest passed)'` / `git commit -m "run yarn test"` do not
 // look like a runner invocation. A `bash|sh|zsh -c '<script>'` wrapper really executes its
 // quoted script, so that script is tested on its own (bounded recursion).
@@ -584,71 +692,94 @@ function isVerificationCommand(command, depth = 0) {
   ].some((pattern) => pattern.test(text));
 }
 
-// Split a shell command into pipelines of stages (quote/escape aware). `&&`, `||`, `;` and
-// newlines separate pipelines; a lone `|` (or `|&`) separates stages. Redirections such as
-// `2>&1` / `&>` are not separators.
-function shellPipelineStages(command) {
-  const text = String(command || '');
-  const pipelines = [];
-  let stages = [];
+// Bounded shell exit-proof recognition, not a shell interpreter. Keep separators so a
+// later echo/OR/background job cannot turn a child runner failure into verification PASS.
+function verificationShellUnits(command) {
+  const units = [];
   let buffer = '';
   let quote = null;
   let escaped = false;
-  const closeStage = () => {
-    if (buffer.trim()) stages.push(buffer.trim());
-    buffer = '';
-  };
-  const closePipeline = () => {
-    closeStage();
-    if (stages.length) pipelines.push(stages);
-    stages = [];
-  };
-  for (let i = 0; i < text.length; i += 1) {
-    const char = text[i];
+  const close = (separator) => { units.push({ text: buffer.trim(), separator }); buffer = ''; };
+  for (let i = 0; i < command.length; i += 1) {
+    const char = command[i];
     if (escaped) { escaped = false; buffer += char; continue; }
-    if (char === '\\') { escaped = true; buffer += char; continue; }
+    if (char === '\\' && quote !== "'") { escaped = true; buffer += char; continue; }
     if (quote) { if (char === quote) quote = null; buffer += char; continue; }
     if (char === "'" || char === '"') { quote = char; buffer += char; continue; }
-    if (char === '|') {
-      if (text[i + 1] === '|') { closePipeline(); i += 1; continue; }
-      closeStage();
-      if (text[i + 1] === '&') i += 1;
+    if (char === '#' && (!buffer || /\s$/.test(buffer))) {
+      while (i < command.length && command[i] !== '\n') i += 1;
+      if (i < command.length) close(';');
       continue;
     }
-    if (char === '&') {
-      if (text[i + 1] === '&') { closePipeline(); i += 1; continue; }
-      buffer += char; // `2>&1`, `&>file`, trailing background `&`
+    if (char === '&' && (/[<>]$/.test(buffer) || command[i + 1] === '>')) { buffer += char; continue; }
+    if (char === '|' || char === '&') {
+      const next = command[i + 1];
+      const separator = next === char ? char + next : char === '|' && next === '&' ? '|&' : char;
+      close(separator);
+      if (separator.length === 2) i += 1;
       continue;
     }
-    if (char === ';' || char === '\n') { closePipeline(); continue; }
+    if (char === ';' || char === '\n' || char === '\r') { close(';'); continue; }
     buffer += char;
   }
-  closePipeline();
-  return pipelines;
+  if (quote || escaped) return null;
+  if (buffer.trim()) close('');
+  return units.filter((unit) => unit.text || unit.separator !== ';');
 }
 
-// A shell pipeline exits with its LAST stage's status, so `npx vitest run | tail` is exit 0
-// even when vitest failed. A verification command in a non-final stage therefore has an
-// unproven exit status — unless the command enables `pipefail` or reads `PIPESTATUS`.
-// Returns the masked verification stage (string) or null.
-function maskedVerificationStage(command) {
-  const text = String(command || '');
-  if (/\bpipefail\b|\bPIPESTATUS\b|\bpipestatus\b/.test(text)) return null;
-  for (const stages of shellPipelineStages(text)) {
-    for (const stage of stages.slice(0, -1)) {
-      if (isVerificationCommand(stage)) return stage;
+function maskedVerificationStage(command, depth = 0) {
+  const text = String(command || '').trim();
+  const units = verificationShellUnits(text);
+  if (!units?.length || depth > 2) return text;
+  let pipefail = false;
+  let sawRunner = false;
+  for (let i = 0; i < units.length; i += 1) {
+    const unit = units[i];
+    const plain = maskQuotedLiterals(unit.text);
+    // Unsupported flow may skip a runner or discard an earlier iteration's failure.
+    // Parens, braces and `if` are not interpreted here. A sequential consumer must not
+    // turn the status of an earlier runner into PASS, even when it prints that status.
+    if (sawRunner && units[i - 1]?.separator === ';' && !/^[)}]+$/.test(plain)) return unit.text;
+    // Command position only: `vitest -t case` is an argument, not a loop.
+    if (/^(?:for|while|until|case|function|done)\b/.test(plain)) return unit.text;
+    // A later `exit 0`/`true`/`:` replaces the runner's status; a leading `!` inverts it.
+    if (sawRunner && /^(?:exit\s+0|true|:)$/.test(plain)) return unit.text;
+    if (/^!\s/.test(plain) && isVerificationCommand(unit.text)) return unit.text;
+    if (unit.separator === '||' || unit.separator === '&') return unit.text;
+    const enable = /^set\s+-(?:[a-z]*o)\s+pipefail$/.test(plain);
+    const disable = /^set\s+\+(?:[a-z]*o)\s+pipefail$/.test(plain);
+    if (enable || disable) pipefail = enable;
+    let runner = isVerificationCommand(unit.text);
+    // Only an entire simple shell wrapper can inherit the inner script's proof.
+    const wrapper = unit.text.match(/^(?:bash|sh|zsh|dash|ksh)\s+(?:-o\s+\w+\s+|-[a-z]+\s+)*(-[a-z]*c)\s+(?:'([^']*)'|"((?:[^"\\]|\\.)*)")$/);
+    if (runner && wrapper) {
+      if (maskedVerificationStage(wrapper[2] ?? wrapper[3] ?? '', depth + 1)) return unit.text;
+    } else if (runner && /(?:^|\s)(?:bash|sh|zsh|dash|ksh)\s/.test(plain)) return unit.text;
+    if (runner) sawRunner = true;
+    if (unit.separator === '|' || unit.separator === '|&') {
+      if (runner && !pipefail) {
+        // A single runner's immediate Bash PIPESTATUS read can propagate its status.
+        let end = i;
+        while (units[end]?.separator === '|' || units[end]?.separator === '|&') end += 1;
+        const proof = units[end + 1];
+        const expected = `exit ${'${'}PIPESTATUS[${i - (units.slice(0, i).findLastIndex((u) => u.separator !== '|' && u.separator !== '|&') + 1)}]}`;
+        if (units[end]?.separator !== ';' || proof?.text !== expected || proof.separator
+          || units.slice(i + 1, end + 1).some((u) => isVerificationCommand(u.text))) return unit.text;
+        return null;
+      }
+      continue;
     }
   }
-  return null;
+  return sawRunner ? null : text;
 }
 
 // Announce through the in-proc hook emitter only (never fd 1 from library callers).
 function noteUnprovenExitStatus(stage) {
   if (!ledgerMessageEmitter) return;
   const message =
-    `UKit execution-ledger: \`${stage}\` ran in a pipeline, so the exit status belongs to the last pipe stage `
-    + '(e.g. tail/grep), not the test runner — it is NOT counted as passing verification. '
-    + 'Re-run with `set -o pipefail; <cmd> | tail` (or without the pipe) to prove the result.';
+    `UKit execution-ledger: runner exit status is unproven for \`${stage}\` — `
+    + 'the shell wrapper may mask or skip the runner; it is NOT counted as passing verification. '
+    + 'Re-run the bare verification command in the same workspace, without loops, backgrounding or status-swallowing consumers.';
   try {
     ledgerMessageEmitter(`${JSON.stringify({ systemMessage: message })}\n`);
   } catch { /* an emitter failure never loses the ledger event */ }
@@ -4415,6 +4546,17 @@ async function runEvaluateStop() {
   if (result.continue) {
     if (result.finalNotice) await markNotified(projectRoot, payload, ledger);
     else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null, evidencePromptKey(state));
+    // Provenance: the harness will re-inject this reason as a prompt. Bind it to this
+    // session+task+exact-reason (hash) so the router can recognise our own continuation
+    // (advisory — a failed write only leaves it unbound).
+    try {
+      await recordPendingCompletionContinuation(projectRoot, {
+        sessionId: explicitSessionId(payload),
+        taskInstanceId: state?.taskInstanceId || null,
+        contract: state?.routeSummary?.executionContract?.taskKind || null,
+        reason: result.reason,
+      });
+    } catch { /* advisory */ }
     process.stdout.write(`${JSON.stringify({ decision: 'block', reason: result.reason })}\n`);
     return;
   }

package/template_project/.claude/ukit/runtime/omp-task-dispatch-guard.mjs

@@ -0,0 +1,262 @@
+// omp-task-dispatch-guard.mjs — block-only preflight for OMP `task` dispatches.
+//
+// Field evidence: an ordinary OMP agent dispatched with a `sourceSession` (or `model`)
+// field is rejected by OMP's embedded validator (18.12.5) even when the value is empty
+// (`''` / `[]` / `null`), and batch-root `sourceSession`/`model` are rejected outright.
+// The model's natural retry after that rejection re-sends the exact same invalid
+// payload, so one bad field can loop a dispatch indefinitely.
+//
+// What this guard does (host PreToolUse return supports BLOCK only — it cannot rewrite
+// the native input, so correction is always the caller's job):
+//
+// - `preflightOmpTaskDispatch()` is the only function a bridge needs to call, before
+//   the native validator sees the payload. Valid dispatches are returned as-is with
+//   `action: 'allow'` and NEVER touch disk. An invalid dispatch is never rewritten:
+//   the guard returns `action: 'block'` carrying `violations`, the exact
+//   `removeFields` paths and a `guidance` string, so the model can correct the
+//   payload itself; a corrected dispatch is a valid, different shape and is allowed
+//   without consuming any budget.
+// - `validateOmpTaskArgs()` checks exactly the confirmed ordinary restriction: batch
+//   root `sourceSession`/`model` are invalid, and a `tasks[]` item whose agent is not
+//   `seance` must not carry `sourceSession` or `model` at all — presence alone is the
+//   violation, any value included. Seance items are NOT validated here (missing
+//   `sourceSession`, custom tools, etc. remain the native validator's job); the guard
+//   never sanitizes a seance task and never switches an agent to seance. This is
+//   deliberately narrower than the full native validator, not a re-implementation.
+// - Repeat blocks are counted per (session, taskInstanceId, dispatch shape). The
+//   `taskInstanceId` is REQUIRED for a count: the bridge reads it from
+//   `readRouteState(projectRoot, { session_id })` (per-session sidecar, owner
+//   verified) and supplies it here. A missing session or task instance id means the
+//   budget cannot be scoped, so the dispatch is blocked WITHOUT recording or borrowing
+//   any count. Full session ids are hashed (no truncation), so distinct sessions that
+//   share a long prefix never collide.
+// - Once attempts reach `OMP_DISPATCH_MAX_RETRIES` identical invalid blocks for one
+//   task instance (two, by default), the guidance says STOP: the dispatch shape is
+//   provably stuck, and retrying unchanged only burns tokens. The count persists under
+//   `.ukit/storage/cache/omp-task-dispatch-guard.json` behind the shared async lock
+//   (`withAsyncLock`), so a compact or session reload does NOT reset it. Only hashed
+//   keys and counters are stored — never task prose, agent names, or raw session or
+//   task-instance ids.
+// - The fingerprint (`ompTaskDispatchFingerprint`) intentionally EXCLUDES task prose,
+//   name, read and status — a reworded prompt is the same stuck dispatch and must not
+//   reset the count — while preserving agent, the presence AND value of the offending
+//   fields, and tools/isolation/isolated, so a genuinely different branch (different
+//   agent, tools, isolation, or field value) keeps its own independent count and a new
+//   genuine task is never blocked by another task's failures.
+//
+// Failure posture: the guard is fail-CLOSED for invalid input it already understands —
+// a lock timeout or internal I/O error still BLOCKS the known-invalid dispatch
+// (reason: 'lock-unavailable' / 'internal-error') rather than letting a looping
+// payload through; the native validator would reject it anyway. Valid dispatches hit
+// no disk, so they are unaffected by any of this.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { withAsyncLock } from './async-lock.mjs';
+
+export const OMP_DISPATCH_MAX_RETRIES = 2;
+const STATE_FILE_NAME = 'omp-task-dispatch-guard.json';
+const MAX_ENTRIES = 200;
+const LOCK_BUDGET_MS = 1_000;
+const ENTRY_TTL_MS = 24 * 60 * 60_000;
+const SEANCE_AGENT = 'seance';
+// Fields the OMP validator rejects when present on an ordinary agent or the batch
+// root. Presence alone (even '' / [] / null) is the violation.
+const ORDINARY_FORBIDDEN_FIELDS = ['sourceSession', 'model'];
+
+/**
+ * Check the confirmed OMP 18.12.5 ordinary restriction on task dispatch arguments.
+ * Pure: never mutates `args`, never talks to disk, and does NOT validate seance tasks
+ * (the native validator owns all seance rules).
+ * @param {object} args - single task object, or a batch `{ tasks: [...] }`
+ * @returns {{ valid: boolean, violations: Array<{code: string, path: string, field: string}> }}
+ */
+export function validateOmpTaskArgs(args) {
+  const violations = [];
+  if (!args || typeof args !== 'object' || Array.isArray(args)) {
+    return { valid: true, violations };
+  }
+  const isBatch = Array.isArray(args.tasks);
+  // Batch-root fields are only a violation in batch shape; a single task object's own
+  // fields are validated as that task below.
+  if (isBatch) {
+    for (const field of ORDINARY_FORBIDDEN_FIELDS) {
+      if (Object.prototype.hasOwnProperty.call(args, field)) {
+        violations.push({ code: 'batch-root-field-present', path: field, field });
+      }
+    }
+  }
+  const tasks = isBatch ? args.tasks : [args];
+  tasks.forEach((task, index) => {
+    if (!task || typeof task !== 'object' || Array.isArray(task)) return;
+    // The host trims the agent name before dispatch, so the seance comparison must
+    // trim too — a padded '  seance  ' agent is a seance task, not an ordinary one.
+    if (taskAgent(task) === SEANCE_AGENT) return; // native validator owns seance rules
+    const label = isBatch ? `tasks[${index}]` : 'task';
+    for (const field of ORDINARY_FORBIDDEN_FIELDS) {
+      if (Object.prototype.hasOwnProperty.call(task, field)) {
+        violations.push({ code: 'ordinary-field-present', path: `${label}.${field}`, field });
+      }
+    }
+  });
+  return { valid: violations.length === 0, violations };
+}
+
+/**
+ * Stable shape fingerprint for repeat counting: includes agent, the presence AND value
+ * of the offending fields, tools and isolation; deliberately excludes task prose,
+ * name, read and status so a reworded prompt cannot reset the count.
+ * @param {object} args
+ * @returns {string}
+ */
+export function ompTaskDispatchFingerprint(args) {
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return 'empty';
+  const shape = {};
+  for (const field of ORDINARY_FORBIDDEN_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(args, field)) shape[field] = normalizeValue(args[field]);
+  }
+  const tasks = Array.isArray(args.tasks) ? args.tasks : [args];
+  shape.tasks = tasks.map((task) => {
+    if (!task || typeof task !== 'object' || Array.isArray(task)) return { agent: String(task) };
+    const item = { agent: taskAgent(task) };
+    for (const field of ORDINARY_FORBIDDEN_FIELDS) {
+      if (Object.prototype.hasOwnProperty.call(task, field)) item[field] = normalizeValue(task[field]);
+    }
+    if (Array.isArray(task.tools)) item.tools = task.tools.map((t) => normalizeValue(t));
+    if (task.isolation !== undefined) item.isolation = normalizeValue(task.isolation);
+    if (task.isolated !== undefined) item.isolated = normalizeValue(task.isolated);
+    return item;
+  });
+  return JSON.stringify(shape);
+}
+
+// The host trims the agent name before dispatch; mirror that here so a padded agent
+// is classified and fingerprinted as its trimmed value.
+function taskAgent(task) {
+  return String(task?.agent ?? '').trim();
+}
+
+// Key-order-stable, content-exact serialization: arrays serialize their items (so
+// same-length different-value arrays never collide), objects sort their keys (so
+// insertion order never changes the fingerprint), and only whitespace-only strings
+// collapse to 'empty'. The fingerprint must isolate the ACTUAL offending field value.
+function normalizeValue(value) {
+  if (value === null) return ['null'];
+  if (Array.isArray(value)) return ['array', value.map(normalizeValue)];
+  if (typeof value === 'object') {
+    return ['object', Object.keys(value).sort().map((key) => [key, normalizeValue(value[key])])];
+  }
+  if (typeof value === 'string') return ['string', value.trim() === '' ? '' : value];
+  return [typeof value, String(value)];
+}
+
+// Full, untruncated session id — slicing (e.g. to 80 chars) would let two distinct
+// long session ids that share a prefix collide into one budget.
+function countKey(sessionId, taskInstanceId, fingerprint) {
+  return crypto.createHash('sha1').update(`${sessionId}\u0000${taskInstanceId}\u0000${fingerprint}`).digest('hex').slice(0, 16);
+}
+
+function stateFilePath(projectRoot) {
+  return path.join(projectRoot, '.ukit', 'storage', 'cache', STATE_FILE_NAME);
+}
+
+function readState(file) {
+  try {
+    const s = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return s && typeof s === 'object' && s.entries && typeof s.entries === 'object' ? s : { entries: {} };
+  } catch {
+    return { entries: {} };
+  }
+}
+
+function guidanceFor(violations, exhausted, attempts) {
+  const lines = violations.map((v) => {
+    if (v.code === 'batch-root-field-present') {
+      return `Remove field \`${v.field}\` from the batch root: the OMP task validator rejects it there. Keep the tasks[] items unchanged.`;
+    }
+    return `Remove field \`${v.field}\` from ${v.path}: an ordinary agent (agent !== 'seance') must not carry it — any value, even '' or null, is rejected. Keep the agent, tools and isolation unchanged; do not switch the agent.`;
+  });
+  if (exhausted) {
+    lines.push(`This exact invalid dispatch was already blocked ${attempts} times for this task. STOP retrying it: apply the removal above ONCE, or record this reviewer as NOT_RUN with the actual reason. Continue independent authorized work; do not invent configuration changes or bypass a denied tool.`);
+  }
+  return lines.join(' ');
+}
+
+/**
+ * Block-only preflight for one OMP task dispatch. See the module header for the full
+ * contract. Never rewrites `args`; never validates seance tasks; valid calls never
+ * touch disk.
+ * @param {{
+ *   projectRoot: string,
+ *   sessionId?: string,
+ *   taskInstanceId?: string,
+ *   args: object,
+ *   now?: number,
+ * }} input
+ * @returns {Promise<{
+ *   action: 'allow' | 'block',
+ *   args: object,
+ *   violations?: Array<object>,
+ *   removeFields?: string[],
+ *   guidance?: string,
+ *   attempts?: number,
+ *   exhausted?: boolean,
+ *   reason?: 'unscoped' | 'lock-unavailable' | 'internal-error',
+ * }>}
+ */
+export async function preflightOmpTaskDispatch({ projectRoot, sessionId, taskInstanceId, args, now = Date.now() }) {
+  const verdict = validateOmpTaskArgs(args);
+  if (verdict.valid) {
+    return { action: 'allow', args };
+  }
+  const removeFields = verdict.violations.map((v) => v.path);
+  const blockBase = { action: 'block', args, violations: verdict.violations, removeFields };
+  try {
+    // A count requires a scoppable identity. Without it the dispatch is blocked
+    // WITHOUT recording or borrowing any count entry.
+    const scoped = projectRoot && sessionId && taskInstanceId
+      && fs.existsSync(path.join(projectRoot, '.ukit', 'storage'));
+    if (!scoped) {
+      return { ...blockBase, guidance: guidanceFor(verdict.violations, false, 0), reason: 'unscoped' };
+    }
+    const key = countKey(sessionId, taskInstanceId, ompTaskDispatchFingerprint(args));
+    const file = stateFilePath(projectRoot);
+    const outcome = await withAsyncLock(file, { deadlineMs: LOCK_BUDGET_MS }, async () => {
+      const state = readState(file);
+      for (const [k, v] of Object.entries(state.entries)) {
+        if (!v || now - (v.last || 0) > ENTRY_TTL_MS) delete state.entries[k];
+      }
+      const keys = Object.keys(state.entries);
+      if (!state.entries[key] && keys.length >= MAX_ENTRIES) {
+        for (const k of keys.sort((a, b) => (state.entries[a].last || 0) - (state.entries[b].last || 0)).slice(0, keys.length - MAX_ENTRIES + 1)) {
+          delete state.entries[k];
+        }
+      }
+      const entry = state.entries[key] || (state.entries[key] = { count: 0, first: now });
+      entry.count += 1;
+      entry.last = now;
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, `${JSON.stringify(state)}\n`);
+      fs.renameSync(tmp, file);
+      return entry.count;
+    });
+    if (!outcome.ok) {
+      // Fail closed: the payload is known-invalid, so block it even without a count.
+      return { ...blockBase, guidance: guidanceFor(verdict.violations, false, 0), reason: 'lock-unavailable' };
+    }
+    const attempts = outcome.value;
+    // STOP guidance starts once the count REACHES the bound (after two identical
+    // blocks, by default) — not on the block after them.
+    const exhausted = attempts >= OMP_DISPATCH_MAX_RETRIES;
+    return { ...blockBase, guidance: guidanceFor(verdict.violations, exhausted, attempts), attempts, exhausted };
+  } catch (error) {
+    return {
+      ...blockBase,
+      guidance: guidanceFor(verdict.violations, false, 0),
+      reason: 'internal-error',
+      note: `omp dispatch guard count unavailable: ${String(error?.message || error).slice(0, 120)}`,
+    };
+  }
+}

package/template_project/.claude/ukit/runtime/resumable-run.mjs

@@ -519,6 +519,14 @@ export async function readResumableRun(projectRoot, {
     };
   }
 
+  // The filename is a lossy sanitization of taskId (path chars normalized, length
+  // truncated to 80), so distinct task ids can share one record file. A record
+  // whose stored taskId is not the exact requested id belongs to another task and
+  // must never be borrowed — its evidence and failures are not this task's.
+  if (taskId !== undefined && parsed.taskId !== taskId) {
+    return { status: 'absent', record: null, warnings: [] };
+  }
+
   // A new explicit task boundary resets the record — the persisted state belongs
   // to a different logical task.
   if (typeof taskBoundary === 'string' && taskBoundary.length > 0