@ngockhoale/ukit 3.4.66 → 3.4.68

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -1104,10 +1104,16 @@ const VERIFICATION_GOAL = /(?:^|\n)[ \t*#_-]*(?:muc tieu|goal|purpose|objective)
 const CONDITIONAL_BRANCH = /(?:^|\n|\.\s+)[ \t]*(?:\d+[.)]\s*)?(?:neu\s+(?:phat hien\s+(?:false-block|loi|bug|defect)|co\s+(?:source fix|sua doi))|if\s+(?:(?:a\s+)?(?:bug|defect|failure)\s+is\s+found|(?:you\s+)?find\s+(?:a\s+)?(?:bug|defect)))\b[^\n]*?(?=\.\s+|$|\n)/g;
 const GOAL_LABEL = /\b(?:muc tieu|goal|purpose|objective)\s*:/g;
 const DISPOSABLE_SETUP = /\b(?:tao|create)\s+(?:mot\s+)?(?:project|du an)\s+(?:thu nghiem|test|disposable|doc lap)\b(?:\s+(?:doc lap|independent))?/g;
+// Round-2b (FS-01 B5): a bare "no <verb>, <verb>, ..." enumeration names operations that are NOT
+// ordered ("no commit, release, publish"). The clause splitter cuts at commas, so without this the
+// tails ("release", "publish") would look like separate imperative clauses to the request-wide order
+// guard. Only a "no"-headed verb list is consumed; a real order never starts with "no". Built lazily
+// because ORDER_VERBS is declared below this function.
+const noVerbList = () => new RegExp(`\\bno\\s+(?:${ORDER_VERBS})\\b(?:\\s*,\\s*(?:${ORDER_VERBS})\\b)*`, 'g');
 function neutralizeNonOrders(text) {
   let source = String(text).replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
   if (VERIFICATION_GOAL.test(source)) source = source.replace(GOAL_LABEL, ' ').replace(CONDITIONAL_BRANCH, '\n').replace(DISPOSABLE_SETUP, ' ');
-  return source
+  return source.replace(noVerbList(), ' ')
     // A list item that DESCRIBES test cases ("Negative controls: yêu cầu thực sự chỉnh config/restart/deploy ...") is
     // specification of the work, not an order; it runs to the next bullet or blank line.
     .replace(/^[ \t]*(?:[-*+\u2022]|\d+[.)])[ \t]*(?:negative|positive)\s+controls?\b[^\n]*(?:\n(?![ \t]*(?:[-*+\u2022]|\d+[.)])|[ \t]*\n)[^\n]*)*/gm, ' ')
@@ -1122,8 +1128,25 @@ function neutralizeNonOrders(text) {
     .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
     .replace(/\bchinh\s+(?:xac|sach)\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b|\b(?:diem|cho|muc|phan)\s+(?:phai|can|nen)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\bwrite\s+permission\b/g, 'permission')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
-    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
+    // An output/deliverable spec ("Output: fix direction", "each: title, fix direction", "Output:
+    // fixes / fix list / acceptance to close") NAMES the artifacts the answer must contain; inside
+    // such a clause "fix" is a deliverable noun, not a mutation order, so a read-only audit with a
+    // fix-shaped deliverable list must not owe write evidence (FS-01). A determiner object inside
+    // the span ("Output: fix the bug in parser.ts") stays a real order - fail closed.
+    // Round-2 (FS-01 B1-B4): a span runs through a file-extension dot ("fix items.ts"), a bare singular
+    // "fix" is an order (never a noun), and a span keeps its order unless EVERY fix token in it is a
+    // deliverable noun and no order verb / "then" remains in the clause ("fix list, commit and push").
+    .replace(/(?:^|[\n.;])[ \t]*(?:[-*+•]|\d+[.)])?[ \t]*(?:outputs?|reports?|deliverables?|each|lists?|includes?|fields?|format|sections?|columns?)(?:\s+\w+){0,3}?\s*:(?:[^\n.;]|\.(?=\w))*/g,
+      (span) => {
+        const fixNouns = /\bfix(?:es)?(?:\s+applied\b|\s+(?:directions?|lists?|plans?|suggestions?|proposals?|items?|entries?|notes?|findings?|acceptance|recommendations?)\b)(?=\s*(?:,|$))|\bfixes\b(?=\s*(?:,|$))/g;
+        const residual = span.replace(fixNouns, ' ');
+        if (residual === span) return span;
+        if (new RegExp(`\\b(?:then|${NON_ORDER_VERBS}|${ORDER_VERBS})\\b`).test(residual)) return span;
+        return residual;
+      });
 }
 
 // Explicit scope declaration (intent ownership): when the request itself declares it is read-only
@@ -1133,13 +1156,25 @@ function neutralizeNonOrders(text) {
 // An explicit order (imperative-initial or modal request) keeps the request MIXED/IMPLEMENTATION:
 // the declaration never overrides a real instruction, and fenced/quoted/blockquoted text is never one.
 // A bare verb with no object is the tail of a negated list ("no commit, release, publish"), not an order.
-const READ_ONLY_DECLARATION = /\bread[\s-]*only\s+(?:audit|investigation|review|analysis|inspection|task|request|session|pass|check|diagnos\w+|verification|forensics?)\b|(?:^|\n)[\s*#>_-]*read[\s-]*only\s*[.:!—-]|\b(?:audit|investigation|review|analysis)[\s-]*only\b|[(,]\s*read[\s-]*only\s*[).]|\bchi\s+(?:doc|audit|kiem tra|phan tich|dieu tra)\b|\b(?:make|with)\s+no\s+(?:source\s+|code\s+|file\s+)?(?:changes|edits|modifications)\b/;
+const READ_ONLY_DECLARATION = /\bread[\s-]*only(?:\s+\w+){0,3}?\s+(?:audit|investigation|review|analysis|inspection|inventory|task|request|session|pass|check|diagnos\w+|verification|forensics?|reports?)\b|(?:^|\n)[\s*#>_-]*read[\s-]*only\s*[.:!—-]|\b(?:audit|investigation|review|analysis|inventory)[\s-]*only\b|[(,]\s*read[\s-]*only\s*[).]|\bchi\s+(?:doc|audit|kiem tra|kiem ke|phan tich|dieu tra)\b|\bkhong\s+sua\b|\b(?:make|with)\s+no\s+(?:source\s+|code\s+|file\s+)?(?:changes|edits|modifications)\b|\b(?:do\s+not|don't|dont|never)\s+(?:\w+\s+){0,2}edits?\b/;
 const ORDER_VERBS = 'implement|fix|apply|refactor|modify|edit|write|update|add|create|build|install|deploy|redeploy|restart|push|commit|rename|remove|delete|replace|change|sua|viet|chinh|them|tao|xoa|enable|disable|set|toggle|configure|migrate|upgrade|publish|release|trien khai|khoi dong lai|(?:run|execute)\\s+(?:git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)|(?:npm|yarn)\\s+publish)|git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)';
 const IMPERATIVE_ORDER = new RegExp(`^(?:[-*+\\u2022>\\d.)\\s]*)(?:(?:please|hay|vui long|now|also|first|then)\\s+)*(?:${ORDER_VERBS})\\b\\s+\\S`);
 const MODAL_ORDER = new RegExp(`\\b(?:please|hay|vui long|need to|needs to|must|should|want(?:\\s+you)? to|toi muon|can phai|yeu cau)\\s+(?:[\\w-]+\\s+){0,2}(?:${ORDER_VERBS})\\b`);
 function hasExplicitOrder(clauses) {
   return clauses.some((clause) => IMPERATIVE_ORDER.test(clause) || MODAL_ORDER.test(clause));
 }
+// Round-2b (FS-01 B5): a clause AFTER the output span still orders a change ("Output: fix lists\ncommit
+// the changes", "Output: fix lists; commit"). Order detection must be request-wide, not span-local: any
+// non-negated clause whose command position is an ORDER verb - with or without an object, so a bare
+// trailing "commit" counts - is an explicit order. The vocabulary is the order class the read-only
+// declaration must never absorb (git/publish/release/apply/run-implementation); noun-ish scaffolding
+// ("tao timeline ...", "create a list") is NOT an order and must not defeat a read-only audit.
+// Negated lists ("no commit, release, publish", "Khong npm publish, git push, release") are blanked
+// first by neutralizeNonOrders, so their bare tails never read as orders.
+const CLAUSE_ORDER_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:commit|push(?!\s+back\b)|publish|release(?!\s+(?:notes?|process|works?|plan|candidate|checklist)\b)|apply|(?:run|execute)\s+(?:the\s+)?(?:implementation|build|migration|deploy(?:ment)?|publish|release|script|command))\b/;
+function ordersChangeAcrossClauses(clauses) {
+  return clauses.some((clause) => CLAUSE_ORDER_LEAD.test(clause));
+}
 function declaredReadOnly(promptText, releasePolicy) {
   if (releasePolicy) return false;
   const plain = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
@@ -1148,9 +1183,10 @@ function declaredReadOnly(promptText, releasePolicy) {
   const text = neutralizeNonOrders(plain);
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
     .map((clause) => clause.split(/\bwithout\b/)[0])
-    .filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause));
-  return /\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|investigation|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text)
-    && !hasExplicitOrder(clauses);
+    .filter((clause) => !/\b(?:do not|don't|never|khong)\b|^[\s*+•>\d.)-]*(?:(?:vui long|xin|hay|please)\s+)*dung\b/.test(clause));
+  return /\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|investigation|inventory|forensic|root cause|kiem tra|kiem ke|phan tich|dieu tra|doc log|tim hieu)\b/.test(text)
+    && !hasExplicitOrder(clauses)
+    && !ordersChangeAcrossClauses(clauses);
 }
 
 // Verification-only request. Root cause of a false `write-evidence` block on a "verify / re-run /
@@ -1158,12 +1194,12 @@ function declaredReadOnly(promptText, releasePolicy) {
 // "template/install", "source change") as mutation orders. Order is structural: a request whose
 // command-position verbs are verification verbs, with no explicit order (hasExplicitOrder) and no
 // change-leading clause, orders no change - it owes verification evidence, not a write.
-const VERIFY_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:verify|re-?run|confirm|xac nhan|validate|double-?check)\b/;
+const VERIFY_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:(?:keep|continue|tiep tuc)\s+)?(?:verify|re-?run|confirm|xac nhan|validate|double-?check|wait(?:ing)?|monitor|watch|cho(?=\s+(?:dung\s+)?(?:job|verifier|build|test|suite|gate|ci|run|task|ket qua|xong|output)\b))\b/;
 const CHANGE_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:make|rebuild|redo|rewrite|restore|revert|correct|clean|patch|resolve|ensure|run(?!(?=[^.]*\b(?:tests?|suite|gate|checks?|lint|typecheck|pilot|smoke|e2e|verif\w*|vitest|jest|audit)\b)))\b/;
 export function isVerificationOnlyRequest(promptText) {
   const plain = String(promptText ?? '').normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
     .replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
-  const clauses = neutralizeNonOrders(plain).split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
+  const clauses = neutralizeNonOrders(plain).split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b|\broi\b)\s*/)
     .map((clause) => clause.split(/\bwithout\b/)[0]);
   return clauses.some((clause) => VERIFY_LEAD.test(clause)) && !hasExplicitOrder(clauses)
     && !clauses.some((clause) => CHANGE_LEAD.test(clause));
@@ -1194,7 +1230,8 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
     ? { kind: 'conditional-release', preflight } : null;
   const text = neutralizeBannedLists(neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()));
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
-  const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
+  // Folded đúng (correctly) is also "dung"; only command-position đừng negates an order.
+  const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong)\b|^[\s*+•>\d.)-]*(?:(?:vui long|xin|hay|please)\s+)*dung\b/.test(clause)
     && !/^[\s*+•>\d.)-]*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
   if (declaredReadOnly(promptText, releasePolicy)) return { taskKind: 'READ_ONLY' };
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
@@ -1294,8 +1331,11 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   const statusReport = (configReportQuestion || (!mutationWord
       && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text)))
     && !operation && !config;
+  // Round-2b (FS-01 B5): order detection is request-wide. A later clause that commands an order verb
+  // ("Output: fix lists\ncommit the changes", "...; publish") keeps the mutation even when the output
+  // span itself was neutralised to deliverable nouns; a true noun-only audit output stays read-only.
   const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text.replace(/\bread[\s-]*only\b/g, ' ')) || statusReport)
-    && !sourceOrder && !codeChangeVerb && !operation && !config;
+    && !sourceOrder && !codeChangeVerb && !operation && !config && !ordersChangeAcrossClauses(actionable);
   const taskKind = operation ? (sourceOrder || codeChangeVerb ? 'MIXED' : 'OPERATIONAL')
     : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;

package/template_project/.claude/ukit/index/route-task.mjs

@@ -1134,30 +1134,183 @@ const HOOK_STATE_SOURCES = ['skill-router', 'skill-router-provisional'];
 // Mirror of execution-ledger.mjs isCompletionGateContinuationText (kept local so the CLI stays
 // import-free). Shape only: trust is decided by the caller's bound pending marker, never by this match.
 const GATE_CONTINUATION_PREFIX = /^UKit completion gate:/;
-const GATE_CONTINUATION_DIAGNOSTICS = /\s\[task=\S+ contract=\S+ accepted-count=\d+ rejected=[^\]\s]*\]\s*$/;
+// Mirrors execution-ledger.mjs: observed=/unmet=/cover= are optional so gate text
+// emitted by an older runtime (bare accepted-count/rejected tail) still binds.
+const GATE_CONTINUATION_DIAGNOSTICS = /\s\[task=\S+ contract=\S+ accepted-count=\d+ rejected=[^\]\s]*(?:\sobserved=[^\]\s]*)?(?:\sunmet=[^\]\s]*)?(?:\scover=\d+\/\d+)?\]\s*$/;
 export function isCompletionGateContinuationText(text) {
   const value = String(text ?? '').trim();
   if (!value || value.length > 2000) return false;
   return GATE_CONTINUATION_PREFIX.test(value) && GATE_CONTINUATION_DIAGNOSTICS.test(value);
 }
 
+// Guidance-only supplement (hook mirror): order-free note on open work appends to the same task;
+// anything not provably order-free mints fresh. Regression: tests/hooks/guidanceSupplementBinding.test.js.
+const GUIDANCE_MAX_CHARS = 2000;
+const GUIDANCE_LOOKUP_ORDER = /\b(?:audit|inspect|review|analy[sz]e|explain|read|investigate|debug|forensic|check|status|report|show|summari[sz]e|result|results|translate|compare|kiem tra|phan tich|dieu tra|trang thai|ket qua|bao cao|tim hieu|dich|so sanh)\b/;
+// Linkage: the note must presuppose in-flight work; framing alone never binds.
+const GUIDANCE_LINKAGE = /\b(?:this|current|in-flight|ongoing|active)\s+(?:task|work|change|scope|one)\b|\bthis\s+one\b|\bthay doi thuc te\b|\bactual changes\b|\bban sua\b|\bviec dang lam\b|\bdang lam\b|\bhien tai\b|\bsau audit\b|\bafter audit\b|\b(?:thay doi|viec|task|lan|cong viec)\s+nay\b/;
+// Shared mutation vocabulary (= hook MUT_VERBS).
+const GUIDANCE_MUTATION_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\\s+the|cap\\s+nhat|viet|chay|cai|chinh|trien\\s+khai|cau\\s+hinh';
+const GUIDANCE_MUTATION_VERB = new RegExp(`\\b(?:${GUIDANCE_MUTATION_VERBS})\\b`);
+// Noun-framed "thay đổi" is a measurement, not the imperative; the frame must sit immediately before.
+const GUIDANCE_NOUN_FRAME_CHANGE = /\b(?:theo|sau|khoi luong|so luong|quy mo|volume|amount|scope|pham vi)\s+thay doi\b/g;
+// Framing (raw text): needs policy evidence (version, policy/release noun, preservation verb, negation).
+const GUIDANCE_FRAME = /(?:\d+\.\d+)|\b(?:guidance|policy|release|publish|patch|minor|major|breaking|scope|version|keep|remains?|stays?|preserve|unchanged|giu|bao toan|phien ban|phat hanh|khong|dung|chua|do not|does not|don't|cannot|must not)\b/;
+// Questions are answer-only turns.
+const GUIDANCE_QUESTION = /\?|^(?:what|which|when|who|whom|whose|how|why|where|is|are|am|do|does|did|can|could|should|would|will|shall|may|co|ai|gi|sao|nao|the nao|khi nao)\b/;
+// Order vocabularies are named once; residue predicates and the temporal head share them.
+const GUIDANCE_ANY_ORDER_VERBS = 'bump|upgrade|downgrade|publish|deploy|nang\\s+cap';
+const GUIDANCE_LEADING_ORDER_VERBS = 'bump|upgrade|downgrade|nang(?:\\s+cap)?|ha|giam|raise|publish|deploy|ship|release|phat\\s+hanh|update|cap\\s+nhat';
+const GUIDANCE_ANY_ORDER = new RegExp(`\\b(?:${GUIDANCE_ANY_ORDER_VERBS})\\b`);
+// A residue opening with a version/imperative verb is a direct order.
+const GUIDANCE_LEADING_ORDER = new RegExp(`^\\s*(?:please\\s+)?(?:${GUIDANCE_LEADING_ORDER_VERBS})\\b`);
+// Start-anchored order head of a temporal reference (full vocabulary); LOOKUP verbs stay absent.
+const GUIDANCE_TEMPORAL_ORDER_HEAD = new RegExp(`^(?:sau|after)\\s+(?:${GUIDANCE_MUTATION_VERBS}|${GUIDANCE_ANY_ORDER_VERBS}|${GUIDANCE_LEADING_ORDER_VERBS})\\b`);
+// Execution tail: sau/after + optional đó/that/thì/then + an order verb. Checked before reference removal.
+const GUIDANCE_TEMPORAL_EXECUTION = new RegExp(`\\b(?:sau|after)\\s+(?:(?:do|that)[\\s,:;]+)?(?:(?:thi|then)[\\s,:;]+)?(?:please\\s+)?(?:${GUIDANCE_MUTATION_VERBS}|${GUIDANCE_ANY_ORDER_VERBS}|${GUIDANCE_LEADING_ORDER_VERBS})\\b`);
+// Short conditional version-policy supplement: consequent uses only glue words; else fails closed.
+const SHORT_POLICY_MAX_CHARS = 120;
+const SHORT_POLICY_MARKER = /\b(?:neu|if|khi|when)\b/;
+const SHORT_POLICY_CLAUSE_SPLIT = /[;\n]|\.(?!\d)/;
+// The conditional strip hides the head, so the head is checked against the full vocabulary.
+const CONDITION_HEAD_ORDER = new RegExp(`\\b(?:${GUIDANCE_MUTATION_VERBS}|publish|release|push|commit|bump|upgrade|downgrade)\\b`);
+// Noun/policy frames strip from the head only; subject+verb ("bạn sửa config") never strips.
+const CONDITION_HEAD_NOUN_FRAME = /\b(?:(?:vai|mot|may|nhung|cac|hai|ba|bon|nam|\d+)\s+ban|(?:the|an?|this))\s+(?:sua|cap\s+nhat|fix|update|change|run|add)\b|\b(?:update|cap\s+nhat)\s+nhieu\b(?=\s*(?:thi|then|[,.;:]|$))|\bthay\s+doi\s+(?:lon|nho)\b(?=\s*(?:thi|then|[,.;:]|$))/g;
+// A slash compound is neutral only inside one local nominal chain; otherwise it fails closed.
+const GUIDANCE_COMPOUND_NOUN = /\b[a-z]+\/[a-z]+\b/g;
+const GUIDANCE_COMPOUND_WORK_AREA = /\b(?:neu|if|khi|when)\b[^.!?\n]*(?:\bchanges\b|\bthay\s+doi\b)[^.!?\n]*\b(?:lon|nho|nhieu)\b\s*:\s*hoan\s+thien\s+(?:dang\s+ke\s+)?$/;
+const guidanceCompoundOrKeep = (compound, offset, text) => {
+  const separator = compound.indexOf('/');
+  if (GUIDANCE_MUTATION_VERB.test(compound.slice(0, separator)) && GUIDANCE_MUTATION_VERB.test(compound.slice(separator + 1))) return compound;
+  const construction = GUIDANCE_COMPOUND_WORK_AREA.exec(text.slice(0, offset));
+  if (!construction || /\b(?:thi|then)\b/.test(construction[0]) || !/^\s*(?:$|[,.;:)\n])/.test(text.slice(offset + compound.length))) return compound;
+  return ' ';
+};
+const CONDITION_HEAD_SPAN = /\b(?:if|neu)\s+[^.,;:\n]*?(?:\b(?:thi|then)\b|(?=[.,;:\n]|$))/g;
+const SHORT_POLICY_TERMINATOR = /\b(?:thi|then)\b|[,;]|\.(?!\d)/;
+const SHORT_POLICY_GLUE = /\b(?:go|to|len|make|bump|use|dung|switch|move|up)\b/;
+const SHORT_POLICY_VERSION_TEST = /\d+\.(?:\d+|x)/;
+const SHORT_POLICY_VERSION_ALL = /\b(?:ban\s+|version\s+)?\d+\.(?:\d+|x)(?:\.\d+)?\b/g;
+const SHORT_POLICY_CONDITION_ORDER = /\b(?:publish|deploy|release|push|commit|ship|bump|upgrade|sua|edit|fix|change|config)\b/;
+// 'update' is not bare-allowlisted; it survives only via the magnitude frame strip.
+const SHORT_POLICY_ALLOWED = new Set(['neu', 'khi', 'if', 'when', 'thi', 'then', 'can', 'need', 'needs', 'needed', 'updates', 'nhieu', 'many', 'it', 'this', 'grows', 'thay', 'doi', 'lon', 'big', 'len', 'go', 'to', 'make', 'bump', 'use', 'dung', 'switch', 'move', 'up', 'only', 'cu', 'luon', 'nhe', 'ban', 'minor', 'patch']);
+export function shortVersionPolicyText(folded) {
+  if (folded.length > SHORT_POLICY_MAX_CHARS) return false;
+  // Clause structure: every clause must itself be conditional. An unconditional clause
+  // ("Update this.", "Bump to 3.5;") is a direct order even when a later clause is a condition.
+  const clauses = folded.split(SHORT_POLICY_CLAUSE_SPLIT).map((clause) => clause.trim()).filter(Boolean);
+  if (clauses.some((clause) => !SHORT_POLICY_MARKER.test(clause))) return false;
+  const marker = SHORT_POLICY_MARKER.exec(folded);
+  if (!marker) return false;
+  const tail = folded.slice(marker.index + marker[0].length);
+  const term = SHORT_POLICY_TERMINATOR.exec(tail);
+  let consequent;
+  if (term) consequent = tail.slice(term.index + term[0].length);
+  else if (marker.index > 0) consequent = folded.slice(0, marker.index);
+  else {
+    const glue = SHORT_POLICY_GLUE.exec(tail);
+    if (!glue) return false;
+    // The skipped condition span must not carry an order verb ("if you publish, go to 3.5").
+    if (SHORT_POLICY_CONDITION_ORDER.test(tail.slice(0, glue.index))) return false;
+    consequent = tail.slice(glue.index);
+  }
+  if (!SHORT_POLICY_VERSION_TEST.test(consequent)) return false;
+  // Judge the WHOLE sentence, not only the consequent ("Publish 3.4.70 now. ..." is an
+  // order); magnitude noun frames (update nhiều / thay đổi lớn) are stripped first.
+  const words = folded.replace(SHORT_POLICY_VERSION_ALL, ' ').replace(CONDITION_HEAD_NOUN_FRAME, ' ').split(/[^a-z]+/).filter(Boolean);
+  return words.every((word) => SHORT_POLICY_ALLOWED.has(word));
+}
+
+export function isGuidanceOnlySupplementText(text) {
+  const value = String(text ?? '').trim();
+  if (!value || value.length > GUIDANCE_MAX_CHARS) return false;
+  if (GATE_CONTINUATION_PREFIX.test(value)) return false;
+  const folded = value.normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/đ/g, 'd').toLowerCase();
+  if (/^(?:hi|hello|hey|ok|okay|thanks|thank you|cam on|chao|alo)\b[\s,!.]*$/.test(folded)) return false;
+  if (GUIDANCE_QUESTION.test(folded)) return false;
+  // A short conditional version-policy note is self-describing (its consequent allowlist is
+  // the order check) and needs no linkage phrase; everything else takes the gated path.
+  if (shortVersionPolicyText(folded)) return true;
+  if (!GUIDANCE_FRAME.test(folded)) return false;
+  if (!GUIDANCE_LINKAGE.test(folded)) return false;
+  // Compound nouns (create/coverage) stripped so head check + residue see names, not verbs;
+  // execution compounds (implement/apply) survive the strip and reach the order checks.
+  const probe = folded.replace(GUIDANCE_NOUN_FRAME_CHANGE, ' changes ').replace(GUIDANCE_COMPOUND_NOUN, guidanceCompoundOrKeep);
+  // Conditional HEADS run against the COMPLETE supported vocabulary before the conditional
+  // strip below removes them; noun frames are stripped from the HEAD text only.
+  for (const head of probe.match(CONDITION_HEAD_SPAN) || []) {
+    if (CONDITION_HEAD_ORDER.test(head.replace(CONDITION_HEAD_NOUN_FRAME, ' '))) return false;
+  }
+  // Quoted context and nonexecuting negations are neutralized FIRST, so a quoted or
+  // negated "after release" never reaches the temporal execution check.
+  // A negation's scope is a CLAUSE, not a token run: it ends at a clause boundary (. , ; :
+  // em dash, newline), and at a sequencing or contrast word that starts a new clause
+  // (then / rồi / và sau / sau đó / after that / but / nhưng ...). Coordination ("or publish",
+  // "and publish") stays inside the negation, so a negated coordinated verb keeps its binding.
+  // "do not change config and then after that publish" negates only "change config"; the
+  // affirmative later clause stays visible to the effective order checks.
+  const sanitized = probe
+    .replace(/"[^"\n]*"|«[^»\n]*»/g, ' ')
+    .replace(/\b(?:do not|don't|dont|must not|never|not|khong(?:\s+duoc)?|dung|chua)\b(?:(?!\b(?:but|nhung|tuy nhien|however|although|then|roi|va\s+sau|sau\s+do|after\s+that)\b)[^.,;:\n—])*/g, ' ');
+  // Effective temporal execution tail rejects BEFORE the reference strip below removes it.
+  if (GUIDANCE_TEMPORAL_EXECUTION.test(sanitized)) return false;
+  const residue = sanitized
+    .replace(/\b(?:if|neu)\s+[^.,;:\n]*?(?:\b(?:thi|then)\b|(?=[.,;:\n]|$))/g, ' ')
+    // Temporal framing is stripped ONLY when the suffix beginning at sau/after does not
+    // START with a recognized order phrase from the COMPLETE vocabulary ("sau nâng cấp
+    // config" keeps the order whole; "sau đó/audit" strips) — a temporal reference must
+    // never consume a recognized order of any class.
+    .replace(/\b(?:sau|after)\s+[a-z]+/g, (temporal, offset, text) => (GUIDANCE_TEMPORAL_ORDER_HEAD.test(text.slice(offset)) ? temporal : ' '));
+  // LEADING is start-anchored, so it is also applied to the head of each AFFIRMATIVE clause
+  // (the text after a sequence word, colon, em dash, comma/semicolon/period, or contrast word):
+  // "do not change config then release 3.5" opens a new order after "then".
+  // A clause head whose order verb is the SUBJECT of a declarative predicate ("release policy
+  // remains unchanged", "phát hành vẫn theo policy") is a preservation note, not an imperative:
+  // the verb is followed by a declarative predicate word, so that head is not an order. Any
+  // other head (object tail, version, imperative) stays an order.
+  // Declarative subject + FINITE predicate only (remains/stays/van/giu nguyen/khong doi); a bare
+  // participle ("unchanged") is an object complement and never exempts.
+  const DECLARATIVE_SUBJECT_PREDICATE = new RegExp(`^\\s*(?:policy|version|config|chinh\\s+sach)\\s+(?:remains?|stays?|van|se\\s+giu\\s+nguyen|giu\\s+nguyen|khong\\s+doi)\\b|^\\s*(?:release|phat\\s+hanh)\\s+(?:notes?|policy|chinh\\s+sach)\\s+(?:remains?|stays?|van|giu\\s+nguyen|khong\\s+doi)\\b|^\\s*(?:phat\\s+hanh|release)\\s+van\\s+theo\\s+(?:policy|chinh\\s+sach)\\b`);
+  // An "and/và" clause headed by an order verb is an affirmative execution tail.
+  const AFFIRMATIVE_COORDINATED_TAIL = new RegExp(`\\b(?:and|va)\\s+(?:please\\s+)?(?:${GUIDANCE_LEADING_ORDER_VERBS}|${GUIDANCE_ANY_ORDER_VERBS})\\b(?!\\s+(?:notes?|policy|chinh\\s+sach)\\s+(?:remains?|stays?|van|giu\\s+nguyen|khong\\s+doi)\\b)`);
+  const residueHeads = [residue, ...[...residue.matchAll(/[.,;:\n—]|\b(?:then|roi|va\s+sau|sau\s+do|after\s+that|but|nhung|tuy\s+nhien|however|although)\b/g)].map((m) => residue.slice(m.index + m[0].length))];
+  // A preservation head stays exempt only when no affirmative order tail follows it.
+  if (residueHeads.some((head) => GUIDANCE_LEADING_ORDER.test(head) && !(DECLARATIVE_SUBJECT_PREDICATE.test(head) && !AFFIRMATIVE_COORDINATED_TAIL.test(head)))) return false;
+  if (AFFIRMATIVE_COORDINATED_TAIL.test(residue) && residueHeads.some((head) => DECLARATIVE_SUBJECT_PREDICATE.test(head))) return false;
+  if (GUIDANCE_ANY_ORDER.test(residue)) return false;
+  if (GUIDANCE_MUTATION_VERB.test(residue)) return false;
+  if (GUIDANCE_LOOKUP_ORDER.test(residue)) return false;
+  return true;
+}
+
 export function reuseOrMintTaskInstanceId({ previousState = {}, promptText = '', commandText = '', targetFile = null, explicitId = null, continuingTask = false } = {}) {
   const explicit = typeof explicitId === 'string' ? explicitId.trim() : '';
   if (explicit && TASK_INSTANCE_ID_SHAPE.test(explicit)) return { id: explicit, origin: null };
   const prevId = previousState?.taskInstanceId;
   if (prevId) {
-    // 'system' (a gate continuation the HOOK verified via positive provenance —
-    // marker or native origin metadata — and stamped into route state) keeps the
-    // same-prompt refresh rights as a hook-owned id: the task must persist across
-    // the synthetic continuation, resolve-context and tool receipts until a real
-    // new request. The CLI itself is not a provenance source: it only honors the
-    // origin the hook already established.
+    // A 'system' origin (verified gate continuation stamped by the hook) keeps same-prompt refresh
+    // rights like a hook-owned id; the CLI honors the origin the hook established, never mints it.
     const hookTurn = HOOK_STATE_SOURCES.includes(previousState.source)
       || (previousState.source === 'task-route' && (previousState.taskIdOrigin === 'hook' || previousState.taskIdOrigin === 'system'));
     const stored = previousState.routingContext?.lastExplicitUserPromptText;
     const samePrompt = Boolean(stored) && stored === promptText;
     const promptlessRefresh = Boolean(stored) && !promptText && Boolean(commandText || targetFile);
-    if (hookTurn && (samePrompt || promptlessRefresh)) return { id: prevId, origin: 'hook' };
+    // Guidance-only supplement (hook mirror): order-free owner note on open active work appends to
+    // the same task; work orders, lookups, gate text and sealed contracts mint fresh.
+    const guidanceOnly = !targetFile && !commandText
+      && Boolean(stored) && Boolean(previousState?.routeSummary?.executionContract?.taskKind)
+      && isGuidanceOnlySupplementText(promptText)
+      && Array.isArray(previousState?.routeSummary?.executionContract?.completionEvidence)
+      && previousState.routeSummary.executionContract.completionEvidence.length > 0
+      && previousState?.routeSummary?.continuationState?.required !== false;
+    if (hookTurn && (samePrompt || promptlessRefresh || guidanceOnly)) {
+      return guidanceOnly && !samePrompt
+        ? { id: prevId, origin: 'hook', guidance: true }
+        : { id: prevId, origin: 'hook' };
+    }
+    // Native CLI-only owner note: never stamps origin 'hook'; reuses the id only with open obligations.
+    const cliGuidance = previousState.source === 'task-route' && Boolean(stored) && guidanceOnly;
+    if (cliGuidance) return { id: prevId, origin: null, guidance: true };
     if (continuingTask) return { id: prevId, origin: null };
   }
   return { id: `task-${crypto.randomBytes(16).toString('hex')}`, origin: null };
@@ -1223,7 +1376,7 @@ async function main() {
   const continuingTask = Boolean(previousState.taskInstanceId && lastPrompt
     && /^(?:continue|resume|keep going|go on|proceed|tiep tuc|lam tiep)(?:\s+(?:with\s+)?(?:the\s+|this\s+)?(?:previous\s+|last\s+|current\s+|same\s+)?(?:implementation\s+)?(?:task|work))?(?:\s+(?:thoi|di|đi|nhe|nao|nua|a|ha|please|pls|now|then))*\s*[.!]?$/i.test(
       promptText.normalize('NFD').replace(/[̀-ͯ]/g, '').trim()));
-  const { id: taskInstanceId, origin: taskIdOrigin } = reuseOrMintTaskInstanceId({
+  const { id: taskInstanceId, origin: taskIdOrigin, guidance: guidanceReuse } = reuseOrMintTaskInstanceId({
     previousState,
     promptText,
     commandText,
@@ -1231,7 +1384,21 @@ async function main() {
     explicitId: readFlagValue(args, '--task-instance-id'),
     continuingTask,
   });
-  if (continuingTask) promptText = lastPrompt;
+  // Guidance is neither a new request nor a progress event; restore live obligations at each emission.
+  const guidanceRefresh = Boolean(guidanceReuse) && Boolean(lastPrompt);
+  if (continuingTask || guidanceRefresh) promptText = lastPrompt;
+  const carryGuidanceState = (state) => {
+    if (!guidanceRefresh || state.taskInstanceId !== previousState.taskInstanceId) return state;
+    state.requestKey = previousState.requestKey;
+    state.routingContext = { ...previousState.routingContext };
+    state.routeSummary ||= {};
+    for (const key of ['executionContract', 'expectedSourceFiles', 'completionState', 'continuationState', 'executionMode']) {
+      if (previousState.routeSummary[key] !== undefined) state.routeSummary[key] = previousState.routeSummary[key];
+      else delete state.routeSummary[key];
+    }
+    state.fingerprint = buildRouteStateFingerprint(state);
+    return state;
+  };
   const preparedRoute = await prepareTaskRoute({
     rootDir,
     promptText,
@@ -1326,7 +1493,7 @@ async function main() {
         historySignals,
       };
     }
-    const sharedState = { ...reusableState, taskInstanceId, taskIdOrigin, source: 'task-route', ts: Date.now() };
+    const sharedState = carryGuidanceState({ ...reusableState, taskInstanceId, taskIdOrigin, source: 'task-route', ts: Date.now() });
     if (canPersistRouteState) {
       try { await persistSharedRouteState(sharedStatePath, sharedState); }
       catch (error) { console.error(`route-task: state persist degraded — ${error?.message ?? error}`); }
@@ -1423,6 +1590,7 @@ async function main() {
       requestKey,
       routeSummary: rescuedRouteSummary,
     };
+    carryGuidanceState(sharedState);
     sharedState.fingerprint = buildRouteStateFingerprint(sharedState);
     if (canPersistCachedRouteState) {
       // Advisory persistence — an EACCES/ENOSPC under the lock must never lose
@@ -1481,6 +1649,7 @@ async function main() {
     taskInstanceId,
   });
   if (taskIdOrigin) sharedState.taskIdOrigin = taskIdOrigin;
+  carryGuidanceState(sharedState);
   if (canPersistRouteState) {
     // Advisory persistence — an EACCES/ENOSPC under the lock must never lose
     // the printed route; degrade to stderr and print anyway.

package/template_project/.claude/ukit/index/source-snapshot.mjs

@@ -0,0 +1,172 @@
+#!/usr/bin/env node
+// source-snapshot.mjs — verbatim SOURCE.md writer for the handoff create/planner phase.
+//
+// Roadmap-create field regression (2026-10-24): a real `claude -p /ukit:handoff-create`
+// run recorded no SOURCE.md / sha256 at all, so the review chain had nothing durable to
+// start from. This helper makes the snapshot step deterministic — ONE simple command,
+// exclusive write, verbatim byte copy, recorded sha256 — instead of a model hand-editing
+// a wrapper file (which is how the copy and the hash get lost or paraphrased).
+//
+// Usage:
+//   node .claude/ukit/index/source-snapshot.mjs <original-path> [output-path]
+//   node .claude/ukit/index/source-snapshot.mjs --check <snapshot> [original-path]
+//
+//   write: copies <original-path> byte-for-byte into the snapshot (default
+//          docs/AI_HANDOFF/SOURCE.md, created if missing), recording the origin path,
+//          the sha256 of the ORIGINAL bytes and the byte count. Exclusive create: an
+//          existing snapshot is never overwritten (exit 3) — re-snapshot deliberately
+//          by removing the old file first.
+//   --check: re-hashes the embedded copy against the recorded SHA-256 (exit 1 on
+//          mismatch/corrupt wrapper); with [original-path], also fails when the live
+//          original drifted from the snapshot.
+//
+// Output: deterministic — no timestamps, no ambient state. Exit codes: 0 ok,
+// 1 hash/drift mismatch (or --check failure), 2 usage/read error, 3 target exists.
+//
+// Partial-write recovery (review minor, 2026-10-24): if the write fails AFTER the
+// exclusive open created the file (e.g. ENOSPC mid-write), the partial snapshot is
+// removed so a plain retry does not hit the exit-3 tombstone. The file is only ever
+// unlinked after THIS invocation's own `wx` open succeeded — a pre-existing snapshot
+// always fails the open with EEXIST first and is never touched. `writeSnapshot` is
+// also exported (main-guarded CLI) so tests can inject a torn write in-process.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+
+function isDirectRun() {
+  try {
+    return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+
+const BEGIN_MARKER = '<!-- BEGIN VERBATIM SOURCE — every byte below this line is the unmodified original -->';
+const DEFAULT_OUTPUT = path.join('docs', 'AI_HANDOFF', 'SOURCE.md');
+
+function sha256(buf) {
+  return createHash('sha256').update(buf).digest('hex');
+}
+
+export function writeSnapshot(sourceArg, outputArg) {
+  const original = path.resolve(sourceArg);
+  let bytes;
+  try {
+    bytes = fs.readFileSync(original);
+  } catch (err) {
+    console.error(`source-snapshot: cannot read original ${sourceArg} (${err && err.code ? err.code : 'error'})`);
+    process.exit(2);
+  }
+  const output = path.resolve(outputArg || DEFAULT_OUTPUT);
+  const header = [
+    '# SOURCE.md — verbatim source snapshot',
+    '',
+    `- Origin: ${original}`,
+    `- SHA-256: ${sha256(bytes)}`,
+    `- Bytes: ${bytes.length}`,
+    '- The copy below is byte-identical to the original file. Verify with:',
+    `    node .claude/ukit/index/source-snapshot.mjs --check ${output}`,
+    '',
+    BEGIN_MARKER,
+  ];
+  const snapshot = Buffer.concat([Buffer.from(header.join('\n'), 'utf8'), Buffer.from('\n', 'utf8'), bytes]);
+
+  let fd;
+  try {
+    fs.mkdirSync(path.dirname(output), { recursive: true });
+    // Exclusive flag: an existing snapshot is never overwritten (EEXIST → exit 3).
+    fd = fs.openSync(output, 'wx');
+  } catch (err) {
+    if (err && err.code === 'EEXIST') {
+      console.error(`source-snapshot: refuses overwrite — ${output} already exists`);
+      process.exit(3);
+    }
+    console.error(`source-snapshot: cannot write ${output} (${err && err.code ? err.code : 'error'})`);
+    process.exit(2);
+  }
+  try {
+    fs.writeFileSync(fd, snapshot);
+    fs.closeSync(fd);
+  } catch (err) {
+    // The `wx` open above CREATED this file, so the partial snapshot is ours — remove
+    // it so a retry does not hit exit 3. A pre-existing snapshot can never reach this
+    // path: the exclusive open would already have failed with EEXIST.
+    try { fs.closeSync(fd); } catch { /* already closed */ }
+    try { fs.unlinkSync(output); } catch { /* best effort — report below still fires */ }
+    console.error(`source-snapshot: cannot write ${output} (${err && err.code ? err.code : 'error'}) — partial snapshot removed, safe to retry`);
+    process.exit(2);
+  }
+  console.log(`source-snapshot: wrote ${output}`);
+  console.log(`source-snapshot: origin ${original}`);
+  console.log(`source-snapshot: sha256 ${sha256(bytes)} (${bytes.length} bytes)`);
+  process.exit(0);
+}
+
+function checkSnapshot(snapshotArg, originalArg) {
+  const snapshotPath = path.resolve(snapshotArg);
+  let raw;
+  try {
+    raw = fs.readFileSync(snapshotPath);
+  } catch (err) {
+    console.error(`source-snapshot: cannot read snapshot ${snapshotArg} (${err && err.code ? err.code : 'error'})`);
+    process.exit(1);
+  }
+  // Byte-offset arithmetic must use the marker's UTF-8 byte length, not the string's
+  // .length — the marker holds multi-byte dashes, and a short offset corrupts the hash.
+  const markerBuf = Buffer.from(`${BEGIN_MARKER}\n`, 'utf8');
+  const markerIdx = raw.indexOf(markerBuf);
+  if (markerIdx < 0) {
+    console.error(`source-snapshot: ${snapshotArg} has no verbatim marker — not a snapshot this tool wrote`);
+    process.exit(1);
+  }
+  const copy = raw.subarray(markerIdx + markerBuf.length);
+  const recorded = /^- SHA-256: ([0-9a-f]{64})$/m.exec(raw.toString('utf8'));
+  if (!recorded) {
+    console.error(`source-snapshot: ${snapshotArg} records no SHA-256 line`);
+    process.exit(1);
+  }
+  const actual = sha256(copy);
+  if (actual !== recorded[1]) {
+    console.error(`source-snapshot: sha256 MISMATCH for embedded copy — recorded ${recorded[1]}, copy hashes ${actual}`);
+    process.exit(1);
+  }
+  if (originalArg) {
+    let original;
+    try {
+      original = fs.readFileSync(path.resolve(originalArg));
+    } catch (err) {
+      console.error(`source-snapshot: cannot read original ${originalArg} (${err && err.code ? err.code : 'error'})`);
+      process.exit(1);
+    }
+    if (!original.equals(copy)) {
+      console.error(`source-snapshot: DRIFT — live original ${originalArg} differs from the snapshot copy`);
+      process.exit(1);
+    }
+  }
+  console.log(`source-snapshot: ok — copy matches recorded sha256 ${actual}${originalArg ? ' and the live original' : ''}`);
+  process.exit(0);
+}
+
+// Main guard: the CLI dispatch only runs when executed directly, so tests can import
+// the exported helpers without triggering a write.
+const isMain = isDirectRun();
+
+if (isMain) {
+  const [, , first, second, third] = process.argv;
+  if (first === '--check') {
+    if (!second) {
+      console.error('usage: source-snapshot.mjs --check <snapshot> [original-path]');
+      process.exit(2);
+    }
+    checkSnapshot(second, third);
+  } else if (first) {
+    writeSnapshot(first, second);
+  } else {
+    console.error('usage: source-snapshot.mjs <original-path> [output-path]');
+    console.error('       source-snapshot.mjs --check <snapshot> [original-path]');
+    process.exit(2);
+  }
+}