@ngockhoale/ukit 3.4.68 → 3.4.70

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+export { classifyTaskSemantics, applyTaskSemantics, isVerificationOnlyRequest } from './publication-intent.mjs';
 // route-resolver.mjs — shared route resolver (C84 TASK-004, BL-006).
 //
 // Installed mirror of src/index/routeResolver.js. One resolver computes the
@@ -1068,293 +1069,3 @@ export function deriveRouteFields({
 
 // What exactly was ordered, so a receipt for a DIFFERENT verb/service/probe cannot discharge it.
 // Unnamed specifics stay empty (any proven receipt of the domain counts); named ones are required.
-const NOT_A_SERVICE = new Set(['it', 'this', 'that', 'them', 'the', 'all', 'everything', 'service', 'services', 'again', 'now', 'to', 'and', 'then']);
-function nativeOperationGoal(domain, actionable, text) {
-  const goal = { domain, target: null, desiredState: 'verified', completionSemantics: 'execute-and-verify', requiredTargets: [] };
-  const clauses = actionable.join(' . ');
-  if (domain === 'git-integrity') {
-    const verbs = [...clauses.matchAll(/\bgit\s+(push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b/g)].map((m) => m[1]);
-    if (/\bpush\s+(?:to\s+)?origin\b/.test(clauses)) verbs.push('push');
-    goal.requiredTargets = [...new Set(verbs)];
-    goal.check = /\bfsck\b/.test(text) ? 'fsck' : /\bdiff\s+--check\b/.test(text) ? 'diff-check' : null;
-    return goal;
-  }
-  const services = [...clauses.matchAll(/\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\s+(?:the\s+|lai\s+)?([a-z0-9][\w.-]*)/g)]
-    .map((m) => m[1]).filter((name) => !NOT_A_SERVICE.has(name));
-  goal.requiredTargets = [...new Set(services)];
-  const probePath = text.match(/(?:^|\s)(\/[a-z0-9_.-]+(?:\/[a-z0-9_.-]+)*)/)?.[1] || null;
-  const probeStatus = text.match(/\b(?:returns?|returning|responds?(?:\s+with)?|http|status(?:\s+code)?)\s+([1-5]\d\d)\b/)?.[1] || null;
-  if (probePath || probeStatus) goal.probe = { path: probePath, status: probeStatus };
-  return goal;
-}
-
-// Task semantics are independent of source execution strategy and observed progress.
-// P1-A (forensic false block): the clause splitter below cuts at commas, so a negation only reached the
-// FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
-// the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
-// sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
-// Vietnamese negators scope to the sentence end as well. Noun uses of verbs ("write/verification advisory", "each proposed
-// fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
-const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
-// Declared verification purpose ("Mục tiêu: xác nhận ...", "Goal: verify ..."). Under that declaration a
-// conditional repair/release branch ("Nếu phát hiện lỗi ... sửa ...", "Neu co source fix ... publish") is a
-// branch the check MAY take, not an unconditional order, and disposable test-project setup ("Tạo project thử
-// nghiệm độc lập") is scaffolding of the check. Unconditional orders in the same request keep blocking.
-const VERIFICATION_GOAL = /(?:^|\n)[ \t*#_-]*(?:muc tieu|goal|purpose|objective)\s*:[^\n]*\b(?:xac nhan|verify|confirm|kiem tra|validate|double-?check|re-?run)\b/;
-const CONDITIONAL_BRANCH = /(?:^|\n|\.\s+)[ \t]*(?:\d+[.)]\s*)?(?:neu\s+(?:phat hien\s+(?:false-block|loi|bug|defect)|co\s+(?:source fix|sua doi))|if\s+(?:(?:a\s+)?(?:bug|defect|failure)\s+is\s+found|(?:you\s+)?find\s+(?:a\s+)?(?:bug|defect)))\b[^\n]*?(?=\.\s+|$|\n)/g;
-const GOAL_LABEL = /\b(?:muc tieu|goal|purpose|objective)\s*:/g;
-const DISPOSABLE_SETUP = /\b(?:tao|create)\s+(?:mot\s+)?(?:project|du an)\s+(?:thu nghiem|test|disposable|doc lap)\b(?:\s+(?:doc lap|independent))?/g;
-// Round-2b (FS-01 B5): a bare "no <verb>, <verb>, ..." enumeration names operations that are NOT
-// ordered ("no commit, release, publish"). The clause splitter cuts at commas, so without this the
-// tails ("release", "publish") would look like separate imperative clauses to the request-wide order
-// guard. Only a "no"-headed verb list is consumed; a real order never starts with "no". Built lazily
-// because ORDER_VERBS is declared below this function.
-const noVerbList = () => new RegExp(`\\bno\\s+(?:${ORDER_VERBS})\\b(?:\\s*,\\s*(?:${ORDER_VERBS})\\b)*`, 'g');
-function neutralizeNonOrders(text) {
-  let source = String(text).replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
-  if (VERIFICATION_GOAL.test(source)) source = source.replace(GOAL_LABEL, ' ').replace(CONDITIONAL_BRANCH, '\n').replace(DISPOSABLE_SETUP, ' ');
-  return source.replace(noVerbList(), ' ')
-    // A list item that DESCRIBES test cases ("Negative controls: yêu cầu thực sự chỉnh config/restart/deploy ...") is
-    // specification of the work, not an order; it runs to the next bullet or blank line.
-    .replace(/^[ \t]*(?:[-*+\u2022]|\d+[.)])[ \t]*(?:negative|positive)\s+controls?\b[^\n]*(?:\n(?![ \t]*(?:[-*+\u2022]|\d+[.)])|[ \t]*\n)[^\n]*)*/gm, ' ')
-    // A header that negates the list under it ("Authorization ... không cho phép:", "Prohibitions:", "not allowed:")
-    // makes every bullet an item of the prohibition, not an order.
-    .replace(/(?:^|(?<=[.;][ \t]))[^.;\n]*\b(?:khong\s+(?:cho\s+phep|duoc|lam)|(?:does|do|did|is|are)\s+not\s+(?:allow|permit|authori[sz]e)\w*|not\s+(?:allowed|permitted|authori[sz]ed)|prohibitions?|prohibited(?:\s+actions?)?|forbidden(?:\s+actions?)?|banned|must\s+not\s+do)\s*:[ \t]*(?:\n[ \t]*(?:[-*+\u2022]|\d+[.)])[^\n]*)+/gm, ' ')
-    .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
-    .replace(new RegExp(`\\b(?:khong|chua)\\s+[^.;\\n]*?(?=\\s+(?:nhung|tuy nhien)\\b|[.;\\n]|$)`, 'g'), ' ')
-    .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
-    .replace(/\b(?:uu tien|prefer(?:red)?)\s+(?:a\s+|an\s+)?(?:configuration|config|cau hinh)\s+(?:change|changes|update|thay doi)\b/g, ' ')
-    .replace(/\b(?:neu\s+(?:chi\s+)?(?:phai|can|thieu|khong du|bang chung chua du)(?![^.;\n]*\b(?:restart|deploy|xoa|delete|remove|cancel)\b)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
-    .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
-    .replace(/\bchinh\s+(?:xac|sach)\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b|\b(?:diem|cho|muc|phan)\s+(?:phai|can|nen)\s+(?:sua|fix)\b/g, ' ')
-    .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
-    .replace(/\bwrite\s+permission\b/g, 'permission')
-    .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
-    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
-    // An output/deliverable spec ("Output: fix direction", "each: title, fix direction", "Output:
-    // fixes / fix list / acceptance to close") NAMES the artifacts the answer must contain; inside
-    // such a clause "fix" is a deliverable noun, not a mutation order, so a read-only audit with a
-    // fix-shaped deliverable list must not owe write evidence (FS-01). A determiner object inside
-    // the span ("Output: fix the bug in parser.ts") stays a real order - fail closed.
-    // Round-2 (FS-01 B1-B4): a span runs through a file-extension dot ("fix items.ts"), a bare singular
-    // "fix" is an order (never a noun), and a span keeps its order unless EVERY fix token in it is a
-    // deliverable noun and no order verb / "then" remains in the clause ("fix list, commit and push").
-    .replace(/(?:^|[\n.;])[ \t]*(?:[-*+•]|\d+[.)])?[ \t]*(?:outputs?|reports?|deliverables?|each|lists?|includes?|fields?|format|sections?|columns?)(?:\s+\w+){0,3}?\s*:(?:[^\n.;]|\.(?=\w))*/g,
-      (span) => {
-        const fixNouns = /\bfix(?:es)?(?:\s+applied\b|\s+(?:directions?|lists?|plans?|suggestions?|proposals?|items?|entries?|notes?|findings?|acceptance|recommendations?)\b)(?=\s*(?:,|$))|\bfixes\b(?=\s*(?:,|$))/g;
-        const residual = span.replace(fixNouns, ' ');
-        if (residual === span) return span;
-        if (new RegExp(`\\b(?:then|${NON_ORDER_VERBS}|${ORDER_VERBS})\\b`).test(residual)) return span;
-        return residual;
-      });
-}
-
-// Explicit scope declaration (intent ownership): when the request itself declares it is read-only
-// ("READ-ONLY audit", "chi doc", "make no source changes") and carries no explicit order to change
-// anything, verbs and operation names inside it are descriptions (a "git stash" that already ran, "a
-// worklog edit", "confirmed fixes"), not orders - so they must not demand write or operation proof.
-// An explicit order (imperative-initial or modal request) keeps the request MIXED/IMPLEMENTATION:
-// the declaration never overrides a real instruction, and fenced/quoted/blockquoted text is never one.
-// A bare verb with no object is the tail of a negated list ("no commit, release, publish"), not an order.
-const READ_ONLY_DECLARATION = /\bread[\s-]*only(?:\s+\w+){0,3}?\s+(?:audit|investigation|review|analysis|inspection|inventory|task|request|session|pass|check|diagnos\w+|verification|forensics?|reports?)\b|(?:^|\n)[\s*#>_-]*read[\s-]*only\s*[.:!—-]|\b(?:audit|investigation|review|analysis|inventory)[\s-]*only\b|[(,]\s*read[\s-]*only\s*[).]|\bchi\s+(?:doc|audit|kiem tra|kiem ke|phan tich|dieu tra)\b|\bkhong\s+sua\b|\b(?:make|with)\s+no\s+(?:source\s+|code\s+|file\s+)?(?:changes|edits|modifications)\b|\b(?:do\s+not|don't|dont|never)\s+(?:\w+\s+){0,2}edits?\b/;
-const ORDER_VERBS = 'implement|fix|apply|refactor|modify|edit|write|update|add|create|build|install|deploy|redeploy|restart|push|commit|rename|remove|delete|replace|change|sua|viet|chinh|them|tao|xoa|enable|disable|set|toggle|configure|migrate|upgrade|publish|release|trien khai|khoi dong lai|(?:run|execute)\\s+(?:git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)|(?:npm|yarn)\\s+publish)|git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)';
-const IMPERATIVE_ORDER = new RegExp(`^(?:[-*+\\u2022>\\d.)\\s]*)(?:(?:please|hay|vui long|now|also|first|then)\\s+)*(?:${ORDER_VERBS})\\b\\s+\\S`);
-const MODAL_ORDER = new RegExp(`\\b(?:please|hay|vui long|need to|needs to|must|should|want(?:\\s+you)? to|toi muon|can phai|yeu cau)\\s+(?:[\\w-]+\\s+){0,2}(?:${ORDER_VERBS})\\b`);
-function hasExplicitOrder(clauses) {
-  return clauses.some((clause) => IMPERATIVE_ORDER.test(clause) || MODAL_ORDER.test(clause));
-}
-// Round-2b (FS-01 B5): a clause AFTER the output span still orders a change ("Output: fix lists\ncommit
-// the changes", "Output: fix lists; commit"). Order detection must be request-wide, not span-local: any
-// non-negated clause whose command position is an ORDER verb - with or without an object, so a bare
-// trailing "commit" counts - is an explicit order. The vocabulary is the order class the read-only
-// declaration must never absorb (git/publish/release/apply/run-implementation); noun-ish scaffolding
-// ("tao timeline ...", "create a list") is NOT an order and must not defeat a read-only audit.
-// Negated lists ("no commit, release, publish", "Khong npm publish, git push, release") are blanked
-// first by neutralizeNonOrders, so their bare tails never read as orders.
-const CLAUSE_ORDER_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:commit|push(?!\s+back\b)|publish|release(?!\s+(?:notes?|process|works?|plan|candidate|checklist)\b)|apply|(?:run|execute)\s+(?:the\s+)?(?:implementation|build|migration|deploy(?:ment)?|publish|release|script|command))\b/;
-function ordersChangeAcrossClauses(clauses) {
-  return clauses.some((clause) => CLAUSE_ORDER_LEAD.test(clause));
-}
-function declaredReadOnly(promptText, releasePolicy) {
-  if (releasePolicy) return false;
-  const plain = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
-    .replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
-  if (!READ_ONLY_DECLARATION.test(plain)) return false;
-  const text = neutralizeNonOrders(plain);
-  const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
-    .map((clause) => clause.split(/\bwithout\b/)[0])
-    .filter((clause) => !/\b(?:do not|don't|never|khong)\b|^[\s*+•>\d.)-]*(?:(?:vui long|xin|hay|please)\s+)*dung\b/.test(clause));
-  return /\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|investigation|inventory|forensic|root cause|kiem tra|kiem ke|phan tich|dieu tra|doc log|tim hieu)\b/.test(text)
-    && !hasExplicitOrder(clauses)
-    && !ordersChangeAcrossClauses(clauses);
-}
-
-// Verification-only request. Root cause of a false `write-evidence` block on a "verify / re-run /
-// confirm" prompt: the vocabulary scans counted nouns and compounds ("coordinator fix", "re-run",
-// "template/install", "source change") as mutation orders. Order is structural: a request whose
-// command-position verbs are verification verbs, with no explicit order (hasExplicitOrder) and no
-// change-leading clause, orders no change - it owes verification evidence, not a write.
-const VERIFY_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:(?:keep|continue|tiep tuc)\s+)?(?:verify|re-?run|confirm|xac nhan|validate|double-?check|wait(?:ing)?|monitor|watch|cho(?=\s+(?:dung\s+)?(?:job|verifier|build|test|suite|gate|ci|run|task|ket qua|xong|output)\b))\b/;
-const CHANGE_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:make|rebuild|redo|rewrite|restore|revert|correct|clean|patch|resolve|ensure|run(?!(?=[^.]*\b(?:tests?|suite|gate|checks?|lint|typecheck|pilot|smoke|e2e|verif\w*|vitest|jest|audit)\b)))\b/;
-export function isVerificationOnlyRequest(promptText) {
-  const plain = String(promptText ?? '').normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
-    .replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
-  const clauses = neutralizeNonOrders(plain).split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b|\broi\b)\s*/)
-    .map((clause) => clause.split(/\bwithout\b/)[0]);
-  return clauses.some((clause) => VERIFY_LEAD.test(clause)) && !hasExplicitOrder(clauses)
-    && !clauses.some((clause) => CHANGE_LEAD.test(clause));
-}
-
-// "Deploy and restart are banned", "Forbidden: deploy", "deploy: banned" name operations to prohibit them. The clause split on
-// "and"/commas would separate the ban from the first operation, so a banned operation list is removed before splitting.
-function neutralizeBannedLists(text) {
-  const OP = '(?:restart|redeploy|deploy(?:ment)?|trien khai|khoi dong lai|git\\s+push|push\\s+(?:to\\s+)?origin)';
-  const LIST = `${OP}(?:\\s*(?:,|/|\\band\\b|\\bor\\b|\\bva\\b|\\bhoac\\b|\\balso\\b)\\s*${OP})*`;
-  const BAN = '(?:bi\\s+(?:cam|chan)|forbidden|prohibited|banned|not\\s+allowed|not\\s+permitted|disallowed)';
-  const LIFT = /\b(?:was|were|previously|before|formerly|no\s+longer|even\s+though|although|though|now\s+allows?|now\s+permits?|owner\s+allows?|khong\s+bi|da\s+duoc\s+phep|except)\b/;
-  const span = new RegExp(`\\b(?:(?:forbidden|prohibited|banned)\\s*:\\s*${LIST}|${LIST}\\s*:?\\s*(?:(?:is|are|remains?|van|con)\\s+)?(?:both\\s+)?${BAN})\\b`, 'g');
-  return text.replace(span, (m, offset, whole) => {
-    const start = Math.max(whole.lastIndexOf('.', offset), whole.lastIndexOf(';', offset), whole.lastIndexOf('\n', offset)) + 1;
-    const stops = [whole.indexOf('.', offset + m.length), whole.indexOf(';', offset + m.length), whole.indexOf('\n', offset + m.length)].filter((i) => i >= 0);
-    const end = stops.length ? Math.min(...stops) : whole.length;
-    return LIFT.test(whole.slice(start, end)) ? m : ' ';
-  });
-}
-
-export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
-  const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
-  const preflight = releaseText.match(/\b(?:yarn\s+release:verify|npm\s+run\s+release:verify)\b/)?.[0];
-  const releasePolicy = preflight && /\b(?:if|neu|only when|only if)\b[^\n.;]*(?:pass|go)\b[^\n.;]*(?:release|publish)\b/.test(releaseText)
-    && /\b(?:fail|no-go)\b[^\n.;]*(?:do not publish|don't publish|no publish|khong publish|khong npm publish)\b/.test(releaseText)
-    ? { kind: 'conditional-release', preflight } : null;
-  const text = neutralizeBannedLists(neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()));
-  const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
-  // Folded đúng (correctly) is also "dung"; only command-position đừng negates an order.
-  const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong)\b|^[\s*+•>\d.)-]*(?:(?:vui long|xin|hay|please)\s+)*dung\b/.test(clause)
-    && !/^[\s*+•>\d.)-]*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
-  if (declaredReadOnly(promptText, releasePolicy)) return { taskKind: 'READ_ONLY' };
-  const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
-    && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
-  const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
-  const reportArtifact = String(promptText).match(/(?:^|\s)((?:docs\/|reports\/)[A-Za-z0-9_./-]+\.(?:md|txt))(?=\s|[.,;:]|$)/)?.[1];
-  const documentation = !sourceOrder && !/\b(?:implement|fix|refactor|modify|edit|update|sua|chinh)\b/.test(actionable.join(' ')) && reportArtifact && actionable.some((clause) => /\b(?:write|create|save|viet|tao|luu)\b/.test(clause))
-    && /\b(?:report|bao cao|analysis|phan tich|document)\b/.test(text);
-  const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
-  // A cron/job MENTION is not an operation: with a code-change verb in the request, an
-  // operation needs a concrete target id; otherwise it is a coding task about scheduling.
-  const cronOperation = actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy|ensure|dam bao)\b/.test(clause)
-    && /\bcron\b|scheduled\s+(?:cron\s+)?(?:task|job)|tac vu\s+(?:cron|dinh ky)/.test(clause))
-    && (!codeChangeVerb || hasOperationId);
-  // Non-source operations (git history/push, service restart/deploy): ordered only by an
-  // actionable clause (negated/deferred/audit clauses are already filtered out). Git and
-  // runtime are separate domains with separate proof; a prompt naming both stays a coding
-  // task rather than being half-verified. A code-change verb anywhere keeps write evidence.
-  // A clause that STATES an operation is prohibited ("production deploy vẫn bị cấm", "forbidden deploy") or merely lists a
-  // production operation as a bare noun item ("* Production restart.") names it; it does not order it.
-  const operationNotOrdered = (clause) => {
-    const OP = '(?:restart|redeploy|deploy(?:ment)?|trien khai|khoi dong lai|git\\s+push|push\\s+(?:to\\s+)?origin)';
-    const BAN = '(?:bi\\s+(?:cam|chan)|forbidden|prohibited|banned|not\\s+allowed|not\\s+permitted|disallowed)';
-    // A lift or past marker ("was prohibited, owner now allows", "even though it is not allowed", "khong bi chan")
-    // means the prohibition is history or lifted: the clause still orders the operation.
-    if (/\b(?:was|were|previously|before|formerly|no\s+longer|even\s+though|although|though|now\s+allows?|now\s+permits?|owner\s+allows?|khong\s+bi|da\s+duoc\s+phep|except)\b/.test(clause)) return false;
-    if (/^[\s*+•>\d.)-]*(?:production|prod|staging)\s+(?:restart|redeploy|deploy(?:ment)?)\s*$/.test(clause)) return true;
-    // Evaluated per operation occurrence: the clause orders nothing only when EVERY operation in it is prohibited.
-    // The ban must attach to its own operation: no parenthesis, dash, colon, conjunction, relative pronoun or second operation in between.
-    const gap = `(?:(?!\\b(?:which|that|who|where|when|if|and|but|then)\\b|${OP})[^.;,()\\-:]){0,40}?`;
-    const banAfter = new RegExp(`^${gap}\\b(?:(?:is|are|remains?|van|con)\\s+)?${BAN}\\b(?!\\s+(?:to|from)\\b)`);
-    // "deploy/restart is forbidden", "deploy and restart are banned": operations joined as a list share one ban.
-    const joined = new RegExp(`^\\s*(?:/|,|and|or|va|hoac)\\s*${OP}\\b`);
-    const bannedAfter = (rest) => {
-      if (banAfter.test(rest)) return true;
-      const j = joined.exec(rest);
-      return j ? bannedAfter(rest.slice(j[0].length)) : false;
-    };
-    const banBefore = /\b(?:forbidden|prohibited|banned)\s+(?:(?:production|prod)\s+)?$/;
-    let total = 0;
-    let banned = 0;
-    for (const match of clause.matchAll(new RegExp(`\\b${OP}\\b`, 'g'))) {
-      total += 1;
-      if (bannedAfter(clause.slice(match.index + match[0].length)) || banBefore.test(clause.slice(0, match.index))) banned += 1;
-    }
-    return total > 0 && banned === total;
-  };
-  const gitOperation = actionable.some((clause) => !operationNotOrdered(clause) && /\bgit\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b|\bpush\s+(?:to\s+)?origin\b/.test(clause));
-  // 'trien khai' is Vietnamese for both "deploy" and "implement": it orders a runtime operation only
-  // when it names a runtime target; bare it describes work ("Tier 3 truc tiep trien khai thay Tier 2").
-  // "restart"/"deploy" after a noun modifier ("process restart", "after redeploy") is a scenario, not an order.
-  const runtimeOperation = actionable.some((clause) => !operationNotOrdered(clause) && /(?<!\b(?:process|crash|hard|soft|graceful|after|upon|during|across|following)\s)\b(?:restart|redeploy|deploy|khoi dong lai|trien khai\s+(?:len\s+)?(?:service|server|production|prod|staging|dich vu|may chu|moi truong))\b/.test(clause)
-    && !/\.[cm]?[jt]sx?\b/.test(clause) && !/\bgit\b/.test(clause));
-  const nativeDomain = cronOperation ? 'scheduled-job' : gitOperation !== runtimeOperation ? (gitOperation ? 'git-integrity' : 'service-runtime') : null;
-  const operation = Boolean(nativeDomain);
-  // A verification-only request orders no change; a concrete operation order (cancel/restart/push) stays operational.
-  if (!releasePolicy && !operation && isVerificationOnlyRequest(promptText)) return { taskKind: 'READ_ONLY', verificationOnly: true };
-  // A config MENTION is not a config change: the same clause needs a mutation verb, and a
-  // request that also changes source/code is a coding task (config is part of its tests/fixtures).
-  // A DIAGNOSTIC report of past changes ("which parameters/configuration has changed, if any" /
-  // "tham so/cau hinh nao da thay doi, neu co") is a question about history, never an authorization
-  // to mutate: only a forward order ("change X to Y") stays a config mutation.
-  const CONFIG_CHANGE_REPORT_CLAUSE = /\b(?:da|has|have|had|already)\s+(?:doi|thay doi|changed?|updated?)\b|\b(?:nao|gi|which|what|report|bao cao)\b[^.;]*?\b(?:doi|thay doi|changed?|updated?)\b/;
-  // A relative past-change clause inside a FORWARD imperative ("Set the config that
-  // has changed to dark mode") names WHICH config — it does not make the sentence a
-  // report. The override holds only when the clause's FIRST mutation word precedes
-  // the config noun AND no reporting/question frame opens the clause or precedes
-  // that word: in "Report what change was made to the config" the mutation word is
-  // a question's noun, never an order.
-  const CONFIG_MUTATION_VERB = /\b(?:set|change|toggle|enable|disable|switch|turn|configure|modify|update|edit|doi(?!\s+chieu\b)|bat(?!\s+dau\b)|tat(?!\s+ca\b)|chinh)\b/;
-  const CONFIG_NOUN = /\b(?:configuration|config|toggle|cau hinh)\b/;
-  const CONFIG_REPORT_FRAME = /^\s*(?:report|show|tell|list|describe|explain|summari[sz]e|bao cao|cho biet|liet ke|mo ta)\b/;
-  const CONFIG_QUESTION_FRAME_PREFIX = /\b(?:what|which|how|report|bao cao|nao|gi)\b/;
-  const config = !sourceOrder && actionable.some((clause) => {
-    if (!CONFIG_NOUN.test(clause) || !CONFIG_MUTATION_VERB.test(clause)) return false;
-    if (CONFIG_REPORT_FRAME.test(clause)) return false;
-    const verb = CONFIG_MUTATION_VERB.exec(clause);
-    if (CONFIG_QUESTION_FRAME_PREFIX.test(clause.slice(0, verb.index))) return false;
-    const noun = CONFIG_NOUN.exec(clause);
-    return !CONFIG_CHANGE_REPORT_CLAUSE.test(clause) || Boolean(noun && noun.index > verb.index);
-  });
-  const repository = Boolean(targetFile) || /[\w.-]+\.(?:json|ya?ml|toml|ini)\b/.test(text);
-  // A status/result lookup ("check the suite output and report") orders no change: it needs a
-  // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
-  const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
-  // A bounded, recognizable reporting QUESTION about what changed ("Tham số/cấu hình
-  // nào đã thay đổi, nếu có." / "which configuration has changed, if any") is a
-  // status report even without a lookup verb — but ONLY when no actionable clause
-  // actually orders a mutation: a mixed request ("Add a dark-mode button; report
-  // which configuration changed") keeps its implementation contract and evidence.
-  // The two lookbehinds keep a question's noun ("what change was made") and the
-  // Vietnamese past-tense verb "thay đổi" from counting as mutation orders.
-  const ACTIONABLE_MUTATION_ORDER = /(?<!\b(?:what|which|how|nao|gi)\s)(?<!thay )\b(?:implement|fix(?:es)?|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/;
-  const configReportQuestion = !actionable.some((clause) => ACTIONABLE_MUTATION_ORDER.test(clause))
-    && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh|tham so)\b/.test(clause)
-      && CONFIG_CHANGE_REPORT_CLAUSE.test(clause));
-  const statusReport = (configReportQuestion || (!mutationWord
-      && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text)))
-    && !operation && !config;
-  // Round-2b (FS-01 B5): order detection is request-wide. A later clause that commands an order verb
-  // ("Output: fix lists\ncommit the changes", "...; publish") keeps the mutation even when the output
-  // span itself was neutralised to deliverable nouns; a true noun-only audit output stays read-only.
-  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text.replace(/\bread[\s-]*only\b/g, ' ')) || statusReport)
-    && !sourceOrder && !codeChangeVerb && !operation && !config && !ordersChangeAcrossClauses(actionable);
-  const taskKind = operation ? (sourceOrder || codeChangeVerb ? 'MIXED' : 'OPERATIONAL')
-    : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
-  const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
-  return { taskKind, ...(releasePolicy ? { releasePolicy } : {}), ...(documentation ? { reportArtifact } : {}), ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
-    ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
-    ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
-      completionSemantics: /\b(?:ensure|dam bao)\b/.test(text)
-        || actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy)\b/.test(clause)
-          && /\b(?:if\s+(?:it\s+)?(?:still\s+)?exists|if\s+present|neu\s+(?:van\s+|con\s+)?ton tai)\b/.test(clause))
-        ? 'ensure-state' : 'execute-and-verify' } } : {}) };
-}
-
-export function applyTaskSemantics(contract, semantic) {
-  const evidence = contract?.completionEvidence || [];
-  const operationOnly = semantic.taskKind === 'OPERATIONAL'
-    || (semantic.taskKind === 'CONFIGURATION' && semantic.configurationScope === 'external');
-  return { ...(contract || {}), ...semantic,
-    completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
-      : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
-        : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
-        : semantic.taskKind === 'READ_ONLY' ? (semantic.verificationOnly || (evidence.length === 1 && evidence[0] === 'verification-evidence') ? ['verification-evidence'] : ['impact-evidence']) : evidence };
-}

package/template_project/.claude/ukit/index/route-task.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { classifyTaskSemantics, applyTaskSemantics } from './route-resolver.mjs';
+import { semanticContractIdentity, ordersAdditiveChange } from './publication-intent.mjs';
 import fs from 'node:fs/promises';
 // `fsSync` aliases the SAME fs module — used ONLY by the process.on('exit')
 // audit-sidecar fold below (event loop is gone; async cannot run) and by the
@@ -4858,7 +4859,10 @@ function hasMutationOrder({ promptText = '', commandText = '' } = {}) {
     .replace(/[^\n.,;?]{0,80}\b(?:chua|duoc khong|dung khong|khong nhi|nhi|roi|a)\s*[?]?\s*$/g, ' ')
     .replace(/^(?!.*\b(?:giup|giuong|cho|ho|dum)\b)[^\n.,;?]{0,80}\b(?:khong|không)\s*[?]?\s*$/g, ' ')
     .replace(/\b(?:co|có)\s+(?:nen|can|phai)\s+[^\n?]*[?]?/g, ' ');
-  return /(?<![A-Za-z0-9_])(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\s+the|cap\s+nhat|viet|chay|cai|chinh|trien\s+khai|cau\s+hinh)(?![A-Za-z0-9_])/.test(residue);
+  return /(?<![A-Za-z0-9_])(?:implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|sua|them|tao|xoa|doi|thay\s+the|cap\s+nhat|viet|chay|cai|chinh|trien\s+khai|cau\s+hinh)(?![A-Za-z0-9_])/.test(residue)
+      // The canonical engine is the authority on additive/imperative change orders (bo sung, bat buoc them ...)
+      // that the residue stripping above treats as obligation prose; the copies must not disagree.
+      || ordersAdditiveChange(promptText);
 }
 
 
@@ -6005,6 +6009,13 @@ function createSharedRouteState({
     ...(sessionId ? { sessionId } : {}),
     requestKey,
     taskInstanceId,
+    ...(route.routeSummary?.executionContract ? {
+      contractOrigin: 'classified',
+      semanticIdentity: semanticContractIdentity({
+        promptText: route.routingContext?.lastExplicitUserPromptText || '',
+        targetFile: route.routingContext?.targetFile || '', taskInstanceId,
+      }),
+    } : {}),
     fingerprint: buildRouteStateFingerprint(route),
     ts: Date.now(),
     source,
@@ -6038,6 +6049,7 @@ function compactRoutingContext(routingContext = {}) {
   return {
     adapter: routingContext.adapter ?? 'claude',
     lastExplicitUserPromptText: routingContext.lastExplicitUserPromptText ?? '',
+    targetFile: routingContext.targetFile ?? null,
     taskType: routingContext.taskType ?? null,
     intentMode: routingContext.intentMode ?? null,
     executionMode: routingContext.executionMode ?? null,

package/template_project/.claude/ukit/runtime/async-lock.mjs

@@ -588,10 +588,10 @@ export async function withAsyncLock(filePath, { signal, deadlineMs = LOCK_MAX_SL
   // Abort between acquire and the critical section releases the owned lock through
   // the normal finally path and reports 'aborted' instead of running fn after the
   // caller was cancelled.
-  if (signal?.aborted) {
-    return { ok: false, reason: 'aborted', waitedMs: Date.now() - startedAt };
-  }
   try {
+    if (signal?.aborted) {
+      return { ok: false, reason: 'aborted', waitedMs: Date.now() - startedAt };
+    }
     return { ok: true, value: await fn() };
   } finally {
     // `owned` is only true when the mkdir AND the owner stamp both succeeded, so a

package/template_project/.claude/ukit/runtime/block-breaker.mjs

@@ -10,6 +10,29 @@
 // Contract: advisory only (never changes allow/deny), fail-open (any error → '' or a short
 // visible note), off-switch `.ukit/storage/config.json` → blockBreaker.enabled=false or
 // env UKIT_BLOCK_BREAKER=0. State: `.ukit/storage/cache/block-breaker.json` (bounded).
+//
+// Stop reconciliation (task-scoped): when a denial exhausts the threshold, the entry is
+// stamped `exhaustedAt` and scoped to the CURRENT per-session route task identity (the
+// route-state sidecar's taskInstanceId, owner-verified — the same contract as
+// execution-ledger.readSessionRouteState; with no sidecar the scope falls back to
+// `session:<sid>`, never to a global/shared key, so another session's route can never
+// leak in). `readActiveExhaustedBreaker()` lets the stop-coordinator end such a run
+// truthfully (BLOCKED_AND_STOP, never COMPLETE, and never a Stop block that re-asks the
+// denied action) while a changed owner task or an expired window reads as no active
+// denial — a stale breaker never wedges a later task.
+//
+// Release is conservative and structural — there is NO reset/delete API and no guard or
+// ledger is disabled by this module: an entry stops matching only when (a) the session's
+// route moves to a different task identity, (b) its window expires (conditions moved on),
+// (c) an authoritative success for the SAME denied condition (same tool + target, explicit
+// exit-0 / is_error:false proof) is recorded, or (d) the stop-coordinator releases a Stop
+// block whose PRIMARY reason carries this exhausted obligation's FULL normalized cause
+// (strict denialCauseMatchesStopReason — no token/path overlap), owned by a releasable
+// block owner (never fail-closed/infrastructure), with no other independent obligation in
+// the merge.
+// Unsupported remediation cases stay escalated: a denial that needs an owner decision
+// (permission, credential, external service) is never auto-released — the breaker stays
+// armed and the stop reports BLOCKED/ESCALATED verbatim.
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -53,6 +76,39 @@ function readState(file) {
   }
 }
 
+// Same sidecar filename normalization as execution-ledger.mjs safeSegment().
+function safeSegment(value) {
+  return String(value || 'default')
+    .trim()
+    .replace(/[^a-zA-Z0-9._-]/g, '_')
+    .slice(0, 96) || 'default';
+}
+
+/**
+ * Current per-session route task identity — the same storage contract and owner
+ * verification as execution-ledger.mjs `readSessionRouteState()` (sync, bounded): the
+ * per-session sidecar under `.ukit/storage/cache/route-state/`, adopted only when its
+ * embedded `session_id` equals the caller's session. Deliberately NO shared single-slot
+ * fallback: a foreign-owned or missing record returns null (the caller scopes to the
+ * session itself), so another session's task identity can never leak into this one.
+ * @returns {string|null} taskInstanceId, or null when this session has no owned route record.
+ */
+export function readSessionRouteTaskKey(projectRoot, sessionId) {
+  try {
+    const id = String(sessionId || '').trim();
+    if (!id || !projectRoot) return null;
+    const file = path.join(projectRoot, '.ukit', 'storage', 'cache', 'route-state', `${safeSegment(id)}.json`);
+    const state = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (!state || typeof state !== 'object') return null;
+    const owner = state.session_id ?? state.sessionId;
+    if (String(owner ?? '').trim() !== id) return null;
+    const key = state.taskInstanceId;
+    return typeof key === 'string' && key.trim() ? key.trim().slice(0, 120) : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Record one block and return the advisory text to append (or '' when under threshold / off).
  * @param {{projectRoot:string, payload?:object, reason:string, now?:number}} args
@@ -80,9 +136,21 @@ export function adviseOnBlock({ projectRoot, payload = {}, reason, now = Date.no
       if (!sigs || Object.keys(sigs).length === 0) delete state.sessions[id];
     }
     const sessions = state.sessions[sid] || (state.sessions[sid] = {});
-    const entry = sessions[sig] || (sessions[sig] = { count: 0, first: now, last: now, agents: [], tool });
+    // Task-scoped ownership: the newest denial belongs to the CURRENT route task. A
+    // session-scoped fallback (never a global key) keeps never-routed sessions bounded
+    // to themselves; a later route change simply stops matching (stale rejection).
+    const taskKey = readSessionRouteTaskKey(projectRoot, sid) || `session:${sid}`;
+    const entry = sessions[sig] || (sessions[sig] = { count: 0, first: now, last: now, agents: [], tool, reason: normalized });
     entry.count += 1;
     entry.last = now;
+    entry.taskKey = taskKey;
+    // Structured target of the denied action (path-like), so only the SAME condition's success can clear it.
+    const denied = authoritativeTarget({ tool_input: payload.tool_input });
+    if (denied) entry.target = denied;
+    // Pinned at the FIRST threshold crossing: from here the obligation is exhausted —
+    // the stop-coordinator may reconcile against it truthfully. (>= guards against a
+    // lowered threshold skipping the exact-equality crossing.)
+    if (entry.count >= cfg.threshold && !entry.exhaustedAt) entry.exhaustedAt = now;
     const agent = payload.agent_id || payload.agent_type;
     if (agent && !entry.agents.includes(String(agent)) && entry.agents.length < 50) entry.agents.push(String(agent));
 
@@ -116,3 +184,166 @@ export function adviseOnBlock({ projectRoot, payload = {}, reason, now = Date.no
     return `\n[ukit block-breaker unavailable: ${String(error?.message || error).slice(0, 120)} — block verdict unchanged]\n`;
   }
 }
+
+/**
+ * Conservative cause match — REPORT-ONLY (matchesStopReason field): does this Stop reason
+ * demand the SAME denied obligation the breaker recorded? True only on an affirmative match —
+ * the full normalized cause as a substring of the normalized Stop reason, or at least two
+ * distinctive tokens (≥8 chars) of the raw cause appearing in it. Release decisions must NOT
+ * use this (its token/path heuristics can over-match); they use the strict
+ * `denialCauseMatchesStopReason`. Anything ambiguous is false.
+ * @returns {boolean}
+ */
+export function denialMatchesStopReason(entry, stopReason) {
+  try {
+    const cause = String(entry?.reason || '').trim();
+    const stop = String(stopReason || '');
+    if (!cause || !stop.trim()) return false;
+    const stopNorm = normalizeBlockReason(stop);
+    const causeNorm = normalizeBlockReason(cause);
+    if (causeNorm && stopNorm && stopNorm.includes(causeNorm)) return true;
+    // Structured obligation identity: only STRUCTURED tokens (path/id-like, containing a separator,
+    // dot or digit) count as evidence — generic words such as "editable", "resolve" or "inaccessible"
+    // never identify an obligation. A PATH-LIKE token (contains '/') is a near-unique target identity:
+    // one path hit alone releases. Otherwise TWO structured tokens must both appear verbatim.
+    const structured = [...new Set(cause.split(/[^A-Za-z0-9_./-]+/).filter((t) => t.length >= 8 && /[./\-_\d]/.test(t)))];
+    if (structured.length === 0) return false;
+    const hits = structured.filter((t) => stop.includes(t));
+    return hits.some((t) => t.includes('/')) || hits.length >= 2;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * STRICT release match (the ONLY matcher a release decision may use): the denied obligation's
+ * FULL normalized cause must appear in the normalized Stop reason verbatim. No token-level,
+ * path-level or partial overlap counts — a shared path, id or word with a different demand is a
+ * different obligation and must keep the block. Anything ambiguous is false (the block stays).
+ * @returns {boolean}
+ */
+export function denialCauseMatchesStopReason(entry, stopReason) {
+  try {
+    const causeNorm = normalizeBlockReason(entry?.reason);
+    const stopNorm = normalizeBlockReason(stopReason);
+    return Boolean(causeNorm) && Boolean(stopNorm) && stopNorm.includes(causeNorm);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Allowed-success invalidation: an allowed (non-blocked) PostToolUse for a tool proves the
+ * denied condition for that tool moved on, so this session's exhausted entries for THAT tool
+ * are dropped for the current task only. Scoped: other tools, other sessions and other tasks
+ * are untouched (no blanket release, no reset API); the entry is removed, not disabled.
+ * Fail-open: any error is ignored.
+ * @param {{projectRoot:string, payload?:object, now?:number}} args
+ * @returns {number} number of exhausted entries invalidated
+ */
+// Authoritative success = the PostToolUse tool_response carries an EXPLICIT affirmative native
+// result — Bash exit_code/exitCode === 0, or an explicit is_error/isError === false on a file-shaped
+// response that names the SAME file — and is for the SAME target the denial recorded
+// (authoritativeTarget). A MISSING response proves nothing, a failed exit is not success, and an
+// empty or stdout-only object is not affirmative proof.
+function authoritativeTarget(payload) {
+  const input = payload?.tool_input || {};
+  if (typeof input.file_path === 'string' && input.file_path) return `path:${input.file_path}`;
+  return null; // Bash and others carry no comparable target: never clears (conservative).
+}
+// Missing signal is NOT success: an affirmative native result is required. Either an explicit
+// exit 0 (Bash exit_code/exitCode), or an explicit is_error:false on a file-shaped response that
+// names the SAME file the denial recorded. Empty objects and stdout-only responses never clear.
+function isAuthoritativeSuccess(payload) {
+  const resp = payload?.tool_response;
+  if (resp === undefined || resp === null || resp === '') return false;
+  if (typeof resp !== 'object' || Array.isArray(resp)) return false;
+  if (resp.is_error === true || resp.isError === true) return false;
+  if (resp.exit_code !== undefined && resp.exit_code !== 0) return false;
+  if (resp.exitCode !== undefined && resp.exitCode !== 0) return false;
+  if (resp.exit_code === 0 || resp.exitCode === 0) return true;
+  const fileInput = payload?.tool_input?.file_path;
+  const fileShaped = typeof resp.filePath === 'string' && typeof fileInput === 'string' && resp.filePath === fileInput;
+  return fileShaped && (resp.is_error === false || resp.isError === false);
+}
+export function recordAllowedSuccess({ projectRoot, payload = {} } = {}) {
+  try {
+    if (process.env.UKIT_BLOCK_BREAKER === '0' || !projectRoot) return 0;
+    const sid = payload && payload.session_id ? String(payload.session_id).slice(0, 80) : '';
+    const tool = String(payload?.tool_name || '');
+    if (!sid || !tool) return 0;
+    if (!isAuthoritativeSuccess(payload)) return 0;
+    const target = authoritativeTarget(payload);
+    if (!target) return 0;
+    const file = path.join(projectRoot, '.ukit/storage/cache/block-breaker.json');
+    const state = readState(file);
+    const sigs = state.sessions[sid];
+    if (!sigs) return 0;
+    const currentTaskKey = readSessionRouteTaskKey(projectRoot, sid) || `session:${sid}`;
+    let removed = 0;
+    for (const [k, entry] of Object.entries(sigs)) {
+      if (entry && entry.exhaustedAt && entry.tool === tool && entry.taskKey === currentTaskKey
+        && entry.target === target) {
+        delete sigs[k];
+        removed += 1;
+      }
+    }
+    if (removed === 0) return 0;
+    if (Object.keys(sigs).length === 0) delete state.sessions[sid];
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(state)}\n`);
+    fs.renameSync(tmp, file);
+    return removed;
+  } catch {
+    return 0;
+  }
+}
+
+/**
+ * The active exhausted denial for THIS session's CURRENT route task, if any — the
+ * read-side of the breaker for stop reconciliation. Matching is task/session-scoped:
+ * an entry matches only while (a) its taskKey equals the session's CURRENT route task
+ * identity (session-scoped fallback; no global fallback), (b) its last denial is inside
+ * the configured window (expiry = conditions moved on), and (c) it actually crossed the
+ * threshold (`exhaustedAt`). Under-threshold entries and other sessions' entries never
+ * match. Fail-open: any read error returns null — an unreadable breaker never changes a
+ * stop verdict, and nothing here deletes or disables state.
+ * @param {{projectRoot:string, payload?:object, now?:number, stopReason?:string}} args
+ * @returns {object|null} { tool, reason, count, first, last, exhaustedAt, taskKey, matchesStopReason }
+ */
+export function readActiveExhaustedBreaker({ projectRoot, payload = {}, now = Date.now(), stopReason = '' } = {}) {
+  try {
+    if (process.env.UKIT_BLOCK_BREAKER === '0' || !projectRoot) return null;
+    const sid = payload && payload.session_id ? String(payload.session_id).slice(0, 80) : '';
+    if (!sid) return null;
+    if (!fs.existsSync(path.join(projectRoot, '.ukit/storage'))) return null;
+    const cfg = readConfig(projectRoot);
+    if (!cfg.enabled) return null;
+    const windowMs = cfg.windowMinutes * 60_000;
+    const file = path.join(projectRoot, '.ukit/storage/cache/block-breaker.json');
+    const sigs = readState(file).sessions[sid];
+    if (!sigs) return null;
+    const currentTaskKey = readSessionRouteTaskKey(projectRoot, sid) || `session:${sid}`;
+    let best = null;
+    for (const entry of Object.values(sigs)) {
+      if (!entry || !entry.exhaustedAt) continue;
+      if (now - (entry.last || 0) > windowMs) continue;
+      if (String(entry.taskKey || '') !== currentTaskKey) continue;
+      if (!best || (entry.last || 0) > (best.last || 0)) best = entry;
+    }
+    if (!best) return null;
+    return {
+      tool: best.tool,
+      reason: String(best.reason || ''),
+      count: best.count,
+      first: best.first,
+      last: best.last,
+      exhaustedAt: best.exhaustedAt,
+      taskKey: best.taskKey,
+      matchesStopReason: stopReason ? denialMatchesStopReason(best, stopReason) : null,
+    };
+  } catch {
+    return null;
+  }
+}