@ngockhoale/ukit 3.4.70 → 3.4.72

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to UKit are documented here.
 
+## 3.4.72 - 2026-10-28
+
+- Native evidence: reject background, masked and test-expression exits as operation/verification proof; retain supported foreground controls across shared Claude Code/Codex/OMP fixtures. No live-host certification.
+- Completion: retained publication-only debt uses task-owned registry proof only without a real operation goal; unrelated Git/service duties remain enforced.
+- Self-improve: serialize deferred AUTO queue replay/merge, retain snapshots/provenance and corrupt/legacy entries, drain only written tasks; dry-run remains read-only.
+- Release recovery: bind mandatory phase exits and independent final review to unchanged candidate bytes; publish lifecycle refuses missing prerequisites. Local evidence files are integrity checks, not cryptographic identity proof. Final acceptance and isolated registry consumers remain pending; 3.4.71 incident evidence is preserved below.
+
+## 3.4.71 - 2026-10-28
+
+**F-7 intent scope, release-freeze coordination and Claude Code operation-receipt exit proof; no native-host certification.**
+
+- Classification (F-7): an inspection verb followed by an interrogative object ("review how the publish and deploy flow works", "explain why update failed") no longer lets its coordinated fragments become orders. The collapse ends at `then` or any coordinator followed by an action verb, so real orders after the question (including bare-verb, Vietnamese and adverb-interposed forms) keep their kind. Independent review probed ~490 prompt pairs against 3.4.70 with no remaining executable-to-READ_ONLY regression except intended compound-noun cases.
+- Self-improve: added a verifier freeze marker and deferred AUTO queue. Later review found repeated frozen passes could overwrite queued proposals; the original no-loss claim was incorrect.
+- Completion evidence: added Claude Code clean-PostToolUse shell-exit inference. Later review found background-child attribution unsafe; shell success alone is not native-operation success. No live-host certification.
+- Verification: full `yarn test` 698 files / 11,371 passed / 3 skipped, exit 0; official verifier PASS. Unpacked budget 11,200,000 owner-approved. Published before final independent CHANGES-REQUESTED review; normal-update testing also changed the owner's global installation instead of staying isolated. 3.4.71 was published, not fully accepted. Wrapper/correlation/stale-obligation and P2 work remained open.
+
 ## 3.4.70 - 2026-10-26
 
 **Task-owned completion evidence and bounded reminder recovery; no native-host certification.**

package/manifests/documentation.yaml

@@ -4,6 +4,7 @@ description: >-
   Machine-readable ownership/source registry for every documentation surface.
   Hand-authored per SPEC §7; enforced by tests/consistency/docRegistry.test.js.
 entries:
+  - {id: release-3472, path: docs/analysis/RELEASE-3472-EVIDENCE-INTEGRITY.md, class: canonical, audience: [maintainer, agent], owner: release, source_of_truth: docs/analysis/RELEASE-3472-EVIDENCE-INTEGRITY.md, merge_strategy: none, load_policy: on-demand, validation: [manual], archive_policy: never}
   - id: systematic-loop-audit-2026-10-26
     path: docs/analysis/SYSTEMATIC-LOOP-AUDIT-2026-10-26.md
     class: canonical

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.70",
+  "version": "3.4.72",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",
@@ -34,6 +34,7 @@
     "!scripts/dev/capture-omp-stall.mjs",
     "!scripts/install/generate-semantic-engine.mjs",
     "!scripts/release/progress-reporter.mjs",
+    "!scripts/release/publish-guard-core.mjs",
     "!scripts/audit/c100/attribution-gap.mjs",
     "!scripts/audit/c100/implementer-attribution.mjs",
     "!scripts/audit/c100/trees-lifetimes.mjs",
@@ -76,6 +77,7 @@
     "test:artifact": "vitest run tests/integration/packageArtifact.test.js tests/integration/artifactReferenceIntegrity.test.js",
     "test:release-core": "vitest run --exclude tests/integration/packageArtifact.test.js",
     "release:verify": "node ./scripts/release/verify-release.mjs",
+    "prepublishOnly": "node ./scripts/release/publish-guard.mjs",
     "test": "vitest run",
     "test:liveness": "vitest run tests/liveness/",
     "test:handoff": "node ./scripts/test/run-handoff-isolated.mjs",

package/scripts/release/freeze.mjs

@@ -0,0 +1,23 @@
+import { readFileSync, writeFileSync, unlinkSync, mkdirSync } from 'node:fs';
+import path from 'node:path';
+
+// Release freeze marker: while a release verifier owns a candidate fingerprint, generators that write
+// into the candidate tree (self-improve AUTO tasks) must defer. Lives under .ukit/storage/, which the
+// fingerprint excludes. A marker is live only while its owner pid is alive and within the TTL.
+export const FREEZE_REL = path.join('.ukit', 'storage', 'release-freeze.json');
+const TTL_MS = 3 * 60 * 60 * 1000;
+
+export function engageFreeze(root, info = {}) {
+  const file = path.join(root, FREEZE_REL);
+  mkdirSync(path.dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString(), ...info })}\n`);
+  return () => { try { if (JSON.parse(readFileSync(file, 'utf8')).pid === process.pid) unlinkSync(file); } catch { /* already thawed */ } };
+}
+
+export function activeFreeze(root, now = Date.now()) {
+  let marker;
+  try { marker = JSON.parse(readFileSync(path.join(root, FREEZE_REL), 'utf8')); } catch { return null; }
+  if (!marker || !Number.isInteger(marker.pid) || now - Date.parse(marker.startedAt) > TTL_MS) return null;
+  try { process.kill(marker.pid, 0); } catch (error) { if (error.code !== 'EPERM') return null; }
+  return marker;
+}

package/scripts/release/publish-guard.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// Shipped prepublishOnly dispatcher for the release publish gate (3.4.72).
+// In the UKit development repository it hands over to the maintainer-only gate core
+// (scripts/release/publish-guard-core.mjs, which enforces verification PASS, independent
+// exactly-APPROVED review and genuine owner authorization before any npm publish).
+// In an installed copy of @ngockhoale/ukit the core does not exist — publishing happens
+// only from the development repository — and this script must fail CLOSED with a clear
+// refusal, never a MODULE_NOT_FOUND crash.
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const core = path.join(path.dirname(fileURLToPath(import.meta.url)), 'publish-guard-core.mjs');
+if (!existsSync(core)) {
+  console.error('[release:publish-guard] REFUSED: the release publish gate is maintainer-only and is not part of the installed @ngockhoale/ukit package.');
+  console.error('[release:publish-guard] `npm publish` is only supported from the UKit development repository, where scripts/release/publish-guard-core.mjs enforces the release prerequisites.');
+  process.exit(1);
+}
+const gate = await import(core);
+await gate.main();

package/scripts/release/release-steps.mjs

@@ -0,0 +1,63 @@
+import path from 'node:path';
+import os from 'node:os';
+
+// Single source of truth for the release verifier's mandatory phases: verify-release.mjs executes
+// them in this order, and publish-guard.mjs binds a run's result.json phases to exactly these
+// labels, in this order, at this count — a run may never declare its own step list.
+// Ships with verify-release.mjs so installed --post-publish checks can load.
+export const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
+
+export const releaseSteps = [
+  {
+    label: 'Rendered instructions up to date (fix: yarn docs:render)',
+    command: 'yarn',
+    args: ['docs:render:check'],
+    env: process.env,
+  },
+  {
+    label: 'Live documentation preflight (headers, budgets, current status)',
+    command: 'yarn',
+    args: ['vitest', 'run', 'tests/consistency/liveStateDocs.test.js', 'tests/consistency/advisorStatusDocs.test.js'],
+    env: process.env,
+  },
+  {
+    label: 'Consistency suite (template<->active sync, watchdog coverage, render parity)',
+    command: 'yarn',
+    args: ['vitest', 'run', 'tests/consistency'],
+    env: process.env,
+  },
+  {
+    label: 'Artifact smoke',
+    command: 'yarn',
+    args: ['test:artifact'],
+    env: process.env,
+  },
+  {
+    label: 'Doc contracts',
+    command: 'yarn',
+    args: ['vitest', 'run', 'tests/consistency/docContracts.test.js'],
+    env: process.env,
+  },
+  {
+    // Bounded behavioral lane: runs the handoff suite in a disposable copy (never the checkout).
+    label: 'Handoff isolated lane',
+    command: 'yarn',
+    args: ['test:handoff'],
+    env: process.env,
+  },
+  {
+    label: 'Core test suite',
+    command: 'yarn',
+    args: ['test:release-core', '--bail', '5'], // stop after 5 failures instead of finishing a doomed 4 min run
+    env: process.env,
+  },
+  {
+    label: 'Local package dry-run',
+    command: 'npm',
+    args: ['pack', '--dry-run', '--json', '--cache', npmCacheDir],
+    env: {
+      ...process.env,
+      npm_config_cache: npmCacheDir,
+    },
+  },
+];

package/scripts/release/verify-release.mjs

@@ -4,21 +4,14 @@ import crypto from 'node:crypto';
 import os from 'node:os';
 import path from 'node:path';
 import { candidateFingerprint } from './candidate-state.mjs';
+import { engageFreeze } from './freeze.mjs';
+import { npmCacheDir, releaseSteps } from './release-steps.mjs';
 
 const rootDir = process.cwd();
-const npmCacheDir = path.join(os.tmpdir(), 'ukit-npm-cache');
 
-// BUG-C22-20: every spawned child carries an explicit timeout + killSignal so a
-// wedged npm/yarn child (network partition, hung credential helper) fails the
-// step instead of hanging the verifier forever. Per-step budgets: release test
-// steps are the slowest (full suite); the registry read is a single network call.
-// UKIT_VERIFY_STEP_TIMEOUT_MS overrides the step budget for tests.
 const STEP_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_STEP_TIMEOUT_MS) || 10 * 60 * 1000; // 10 min
 const REGISTRY_TIMEOUT_MS = Number(process.env.UKIT_VERIFY_REGISTRY_TIMEOUT_MS) || 60 * 1000; // 1 min
 
-// Opt-in post-publish registry-parity check (Release Policy invariant: npm and git always hold
-// the same latest version). Only meaningful AFTER `npm publish` — before publish the registry is
-// behind by definition — so it is gated behind --post-publish and never runs by default.
 const postPublish = process.argv.includes('--post-publish');
 
 if (postPublish) {
@@ -41,12 +34,8 @@ if (postPublish) {
 }
 
 
-// Single-instance guard (full verification takes ~4 min). Starting a second run while one is
-// alive (e.g. after the first was moved to the background by a tool timeout) only makes both
-// slower and flakier — wait for / read the first run's result instead.
 let lockPath = null;
 function acquireVerifyLock() {
-  // Nested runs (the release suite's own tests spawn this script) and test workers must not contend.
   if (process.env.UKIT_RELEASE_VERIFY_ACTIVE === '1' || process.env.VITEST || process.env.UKIT_VERIFY_NO_LOCK === '1') return;
   lockPath = path.join(os.tmpdir(), `ukit-release-verify-${crypto.createHash('sha1').update(rootDir).digest('hex').slice(0, 10)}.lock`);
   if (existsSync(lockPath)) {
@@ -67,68 +56,15 @@ function acquireVerifyLock() {
 
 acquireVerifyLock();
 
-// Cheap, deterministic gates FIRST (seconds): a stale instruction render or a consistency drift
-// used to surface only after the ~4 min full suite.
-const steps = [
-  {
-    label: 'Rendered instructions up to date (fix: yarn docs:render)',
-    command: 'yarn',
-    args: ['docs:render:check'],
-    env: process.env,
-  },
-  {
-    label: 'Live documentation preflight (headers, budgets, current status)',
-    command: 'yarn',
-    args: ['vitest', 'run', 'tests/consistency/liveStateDocs.test.js', 'tests/consistency/advisorStatusDocs.test.js'],
-    env: process.env,
-  },
-  {
-    label: 'Consistency suite (template<->active sync, watchdog coverage, render parity)',
-    command: 'yarn',
-    args: ['vitest', 'run', 'tests/consistency'],
-    env: process.env,
-  },
-  {
-    label: 'Artifact smoke',
-    command: 'yarn',
-    args: ['test:artifact'],
-    env: process.env,
-  },
-  {
-    label: 'Doc contracts',
-    command: 'yarn',
-    args: ['vitest', 'run', 'tests/consistency/docContracts.test.js'],
-    env: process.env,
-  },
-  {
-    // Bounded behavioral lane: runs the handoff suite in a disposable copy (never the checkout).
-    label: 'Handoff isolated lane',
-    command: 'yarn',
-    args: ['test:handoff'],
-    env: process.env,
-  },
-  {
-    label: 'Core test suite',
-    command: 'yarn',
-    args: ['test:release-core', '--bail', '5'], // stop after 5 failures instead of finishing a doomed 4 min run
-    env: process.env,
-  },
-  {
-    label: 'Local package dry-run',
-    command: 'npm',
-    args: ['pack', '--dry-run', '--json', '--cache', npmCacheDir],
-    env: {
-      ...process.env,
-      npm_config_cache: npmCacheDir,
-    },
-  },
-];
+const steps = releaseSteps;
 
 const runDirectory = mkdtempSync(path.join(os.tmpdir(), 'ukit-release-run-'));
 const candidate = candidateFingerprint(rootDir);
-const run = { pid: process.pid, candidate, startedAt: new Date().toISOString(), phase: null, result: 'running', exitCode: null };
+const run = { pid: process.pid, candidate, startedAt: new Date().toISOString(), phase: null, result: 'running', exitCode: null, expectedPhases: steps.length, phases: [] };
 const persistRun = () => writeFileSync(path.join(runDirectory, 'result.json'), `${JSON.stringify(run, null, 2)}\n`);
 persistRun();
+const thaw = engageFreeze(rootDir, { candidate });
+process.on('exit', thaw);
 console.log(`[release:verify] Candidate ${candidate}; run evidence ${runDirectory}`);
 process.on('exit', (code) => {
   run.exitCode = code;
@@ -149,11 +85,20 @@ for (const step of steps) {
   run.phaseStartedAt = new Date().toISOString();
   run.phaseResult = null;
   step.env = { ...step.env, UKIT_VERIFY_PROGRESS_FILE: path.join(runDirectory, `phase-${steps.indexOf(step)}-progress.json`) };
+  const candidateBefore = candidateFingerprint(rootDir);
   persistRun();
   console.log(`\n[release:verify] ${step.label}`);
   console.log(`[release:verify] > ${step.command} ${step.args.join(' ')}`);
 
   const exitCode = await runStep(step);
+  const candidateAfter = candidateFingerprint(rootDir);
+  run.phases.push({
+    label: step.label,
+    ...run.phaseResult,
+    candidateBefore,
+    candidateAfter,
+  });
+  persistRun();
   assertCandidate();
   if (exitCode !== 0) {
     console.error(`[release:verify] FAILED at step: ${step.label}`);
@@ -166,16 +111,11 @@ run.result = 'passed';
 persistRun();
 console.log('\n[release:verify] All release checks passed.');
 
-// BUG-C22-20: bounded spawn — an armed watchdog SIGKILLs the child's whole
-// process group on expiry (detached: true puts the child in its own group so
-// grandchildren like `sh -c "sleep …"` can't keep our stdio pipes open).
 function spawnBounded(command, args, opts, timeoutMs) {
   const child = spawn(command, args, { ...opts, detached: true });
   child.ukitTimedOut = false;
   const watchdog = setTimeout(() => {
     child.ukitTimedOut = true;
-    // One bounded native snapshot before termination, never a polling watcher.
-    // ps contains no argv/environment (credentials); unsupported hosts record the error.
     if (!postPublish && opts.env?.UKIT_VERIFY_PROGRESS_FILE) try {
       const snapshot = execFileSync('ps', ['-axo', 'pid,ppid,pgid,stat,etime,time,comm'], {
         encoding: 'utf8', timeout: 1000, maxBuffer: 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'],

package/src/learning/codeProposals.js

@@ -1,39 +1,29 @@
-// codeProposals.js — self-improve code lane (SELF_IMPROVE_CODE_LANE plan).
-//
-// Turns mined, recurring failure patterns into HANDOFF TASK FILES
-// (`docs/AI_HANDOFF/tasks/AUTO-<seq>.md`) — proposals for the normal
-// executor + reviewer + tests chain, never code writes or commits from
-// self-improve itself. Whitelist-only fix classes; anything outside the
-// deterministic mapping is `skipped`.
-//
-// Contracts:
-//   * NEVER THROWS — missing dirs, unreadable files, write failures →
-//     partial result, no exception escapes.
-//   * Eligible: count >= minCount (default 3) AND sessions >= 2.
-//   * Whitelist fix classes only (timeout/hang, missing-fallback,
-//     empty-output, stale-doc); unknown shapes → status 'skipped'.
-//   * Denylist: targets under src/decision/, src/core/agentRuntime/,
-//     runtimeConfig, auth/security/secret/credential/token code are never
-//     proposed.
-//   * Dedupe: a signature already carried by any `.md` in
-//     docs/AI_HANDOFF/tasks/ or docs/AI_HANDOFF/archive/ → 'duplicate'.
-//   * Cap: at most maxTasks (default 3) AUTO files per pass.
-//   * Writes are confined to docs/AI_HANDOFF/tasks/AUTO-<seq>.md via
-//     exclusive-create (`wx`); `dryRun` writes nothing.
+// codeProposals.js — self-improve code lane (SELF_IMPROVE_CODE_LANE plan):
+// mined recurring failure patterns → docs/AI_HANDOFF/tasks/AUTO-<seq>.md
+// proposals for the normal executor+reviewer+tests chain (never direct code
+// writes/commits). Contracts: never throws (failures → partial result);
+// eligible = count >= minCount(3) AND sessions >= 2; whitelist fix classes
+// (timeout/hang, missing-fallback, empty-output, stale-doc) else 'skipped';
+// denylist src/decision/, src/core/agentRuntime/, runtimeConfig,
+// auth/security/secret/credential/token targets; signature already in any
+// tasks//archive/ .md → 'duplicate'; cap maxTasks(3)/pass; writes confined to
+// AUTO-<seq>.md via `wx`; dryRun writes nothing.
 
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { withFileLock, writeFileAtomic } from '../core/fileOps.js';
+import { activeFreeze } from '../../scripts/release/freeze.mjs';
 
 const TASKS_DIR_REL = path.join('docs', 'AI_HANDOFF', 'tasks');
 const ARCHIVE_DIR_REL = path.join('docs', 'AI_HANDOFF', 'archive');
 const ARTIFACT_REL = path.join('.ukit', 'storage', 'cache', 'failure-patterns.json');
+const DEFERRED_REL = path.join('.ukit', 'storage', 'cache', 'deferred-auto-tasks.json');
 const PLAN_REL = 'docs/plans/SELF_IMPROVE_CODE_LANE.md';
 const SIGNATURE_FIELD_RE = /signature["']?\s*:\s*(?:`([^`\n]*)`|"((?:[^"\\\n]|\\.)*)"|'([^'\n]*)')/gi;
 const MIN_SESSIONS = 2;
 const AUTO_NAME_RE = /^AUTO-(\d+)\.md$/;
 
-// Protected lanes — the same areas keepMainModelFor guards. A mined pattern
-// pointing here is skipped, never proposed.
+// Protected lanes (same areas keepMainModelFor guards) — never proposed.
 const DENIED_TARGET_RES = [
   /^src\/decision\//,
   /^src\/core\/agentRuntime\//,
@@ -43,7 +33,7 @@ const DENIED_TARGET_RES = [
   /secret|credential|token/i,
 ];
 
-// Whitelist fix classes — bounded deterministic mapping only.
+// Whitelist — bounded deterministic mapping only.
 const FIX_CLASSES = [
   {
     id: 'timeout-hang',
@@ -72,7 +62,7 @@ function isObject(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
 
-// Evidence haystack: signature + example commands + files, lowercased.
+// Evidence haystack: signature + commands + files, lowercased.
 function haystack(pattern) {
   return [
     pattern.signature,
@@ -81,10 +71,7 @@ function haystack(pattern) {
   ].join(' ').toLowerCase();
 }
 
-/**
- * Map a mined pattern to a whitelisted fix class.
- * @returns {{id: string, change: string}|null}
- */
+/** Map a mined pattern to a whitelisted fix class; null = none. */
 export function mapPatternToFixTarget(pattern) {
   if (!isObject(pattern)) return null;
   const hay = haystack(pattern);
@@ -94,10 +81,9 @@ export function mapPatternToFixTarget(pattern) {
   return null;
 }
 
-// W3-F4: strip ./ and resolve ../ so syntactic variants can't slip past the
-// denylist. On case-insensitive filesystems (win32/darwin) a case variant
-// names the same denied file, so the patterns are folded there — Linux keeps
-// case-sensitive matching (denylist semantics unchanged, planner note).
+// W3-F4: resolve ./ and ../ so variants can't slip past the denylist; on
+// case-insensitive filesystems (win32/darwin) case-fold the patterns (a case
+// variant names the same denied file); Linux stays case-sensitive.
 const DENY_TARGET_RES = (process.platform === 'win32' || process.platform === 'darwin')
   ? DENIED_TARGET_RES.map((re) => (re.ignoreCase ? re : new RegExp(re.source, `${re.flags}i`)))
   : DENIED_TARGET_RES;
@@ -148,7 +134,7 @@ async function listMarkdownFiles(dir, depth = 0) {
   return files;
 }
 
-// Signatures already claimed by a task/archived file + highest AUTO seq.
+// Claimed signatures (tasks+archive .md) + highest AUTO seq.
 async function scanHandoffDirs(projectRoot) {
   const signatures = new Set();
   let maxSeq = 0;
@@ -167,8 +153,7 @@ async function scanHandoffDirs(projectRoot) {
       for (const match of text.matchAll(SIGNATURE_FIELD_RE)) {
         const raw = (match[1] ?? match[2] ?? match[3] ?? '').trim();
         if (!raw) continue;
-        // JSON "…" captures may carry escapes; decode so the scanned signature
-        // equals the raw pattern.signature stored in the evidence block.
+        // decode JSON escapes so scanned signature == evidence-block pattern.signature
         let sig = raw;
         if (match[2] !== undefined) {
           try {
@@ -184,6 +169,43 @@ async function scanHandoffDirs(projectRoot) {
   return { signatures, maxSeq };
 }
 
+// Deferred AUTO queue — freeze-pushed-back signatures, each with the full
+// vetted pattern snapshot so a thaw replays the deferral even if the original
+// pattern vanished. Merged, never overwritten: first provenance wins; entries
+// whose task now exists drain (no duplicate AUTOs); corrupt file preserved
+// untouched, surfaced via result.error.
+function corruptQueueMessage(reason) {
+  return `deferred queue corrupt; preserved without overwrite: ${DEFERRED_REL}${reason ? ` (${reason})` : ''}`;
+}
+
+// Returns the RAW array — consumers validate; malformed content survives intact.
+async function loadDeferredQueue(projectRoot) {
+  let raw;
+  try {
+    raw = await fs.readFile(path.join(projectRoot, DEFERRED_REL), 'utf8');
+  } catch (err) {
+    if (err?.code === 'ENOENT') return { queue: [] };
+    // EACCES/EISDIR/...: corrupt, not empty.
+    return { queue: [], corrupt: true, reason: err?.code ?? String(err) };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && Array.isArray(parsed.deferred)) return { queue: parsed.deferred };
+  } catch {
+    // corrupt — reported, never rewritten.
+  }
+  return { queue: [], corrupt: true, reason: 'malformed content' };
+}
+
+async function saveDeferredQueue(projectRoot, queue) {
+  const file = path.join(projectRoot, DEFERRED_REL);
+  if (queue.length === 0) {
+    await fs.rm(file, { force: true });
+    return;
+  }
+  await writeFileAtomic(file, `${JSON.stringify({ deferred: queue }, null, 2)}\n`);
+}
+
 function renderTaskFile({ seq, pattern, fixClass, targets, now }) {
   const id = `AUTO-${String(seq).padStart(3, '0')}`;
   const signature = pattern.signature;
@@ -263,15 +285,10 @@ Auto-generated by \`ukit self-improve\` at ${new Date(now).toISOString()} from m
 
 /**
  * Propose AUTO handoff task files from mined failure patterns.
- *
- * @param {string} projectRoot
- * @param {{ minCount?: number, maxTasks?: number, dryRun?: boolean,
- *   now?: number }} [options]
- * @returns {Promise<{generatedAt: string, dryRun: boolean,
- *   patternsScanned: number, eligible: number, created: number,
- *   results: Array<{signature: string, fixClass: string|null,
- *     status: 'proposed'|'duplicate'|'skipped', reason?: string,
- *     taskFile: string|null, written: boolean}>, error?: string}>}
+ * @returns {Promise<{generatedAt: string, dryRun: boolean, patternsScanned:
+ *   number, eligible: number, created: number, deferred?: number, error?: string,
+ *   results: Array<{signature: string, fixClass: string|null, status: string,
+ *   reason?: string, taskFile: string|null, written: boolean}>}>}
  */
 export async function proposeCodeFixTasks(projectRoot, {
   minCount = 3,
@@ -288,14 +305,38 @@ export async function proposeCodeFixTasks(projectRoot, {
     results: [],
   };
 
-  try {
-    const patterns = await loadPatterns(projectRoot);
-    result.patternsScanned = patterns.length;
+  // One serialized pass — read → scan → replay → task writes → queue merge —
+  // under the shared token-owned file lock: independent processes can neither
+  // lose queue entries nor double-create AUTO tasks. Fail-closed: expired
+  // wait skips the whole pass (journaled by fileOps) and surfaces an error.
+  const runPass = async () => {
+    const live = await loadPatterns(projectRoot);
+    result.patternsScanned = live.length;
     const known = await scanHandoffDirs(projectRoot);
+    const queueRead = await loadDeferredQueue(projectRoot);
+    if (queueRead.corrupt) {
+      result.error = corruptQueueMessage(queueRead.reason);
+    }
+    // Replay queued snapshots (original provenance) first, then unqueued live patterns.
+    const candidates = [];
+    if (!queueRead.corrupt) {
+      for (const entry of queueRead.queue) {
+        if (isObject(entry) && isObject(entry.pattern) && typeof entry.pattern.signature === 'string') {
+          candidates.push({ pattern: entry.pattern, origin: entry });
+        }
+      }
+    }
+    const replaySignatures = new Set(candidates.map((candidate) => candidate.pattern.signature));
+    for (const pattern of live) {
+      const signature = typeof pattern?.signature === 'string' ? pattern.signature : null;
+      if (!signature || replaySignatures.has(signature)) continue;
+      candidates.push({ pattern, origin: null });
+    }
     let seq = known.maxSeq;
     let emitted = 0;
+    const deferred = [];
 
-    for (const pattern of patterns) {
+    for (const { pattern, origin } of candidates) {
       const signature = typeof pattern?.signature === 'string' ? pattern.signature : null;
       if (!signature) continue;
       const entry = {
@@ -344,8 +385,44 @@ export async function proposeCodeFixTasks(projectRoot, {
 
       if (dryRun) continue;
 
+      // A release verifier owns the candidate bytes — writing now would
+      // invalidate its fingerprint. Record (never drop); regenerate after thaw.
+      const recordDeferral = (frozenBy) => {
+        entry.status = 'skipped';
+        entry.reason = 'release-frozen';
+        entry.taskFile = null;
+        result.created -= 1;
+        emitted -= 1;
+        seq -= 1;
+        known.signatures.delete(signature);
+        // replayed entries are already queued — push/count only new deferrals.
+        if (!origin) {
+          deferred.push({
+            signature,
+            fixClass: fixClass.id,
+            targets,
+            pattern,
+            deferredAt: origin?.deferredAt ?? result.generatedAt,
+            frozenBy,
+          });
+        }
+      };
+
+      // A verifier may already be engaged — defer before touching the tree.
+      const freezeBefore = activeFreeze(projectRoot);
+      if (freezeBefore) {
+        recordDeferral(origin?.frozenBy ?? freezeBefore.pid);
+        continue;
+      }
+
       try {
         await fs.mkdir(path.join(projectRoot, TASKS_DIR_REL), { recursive: true });
+        // Recheck after the awaited mkdir — a verifier may engage mid-pass.
+        const freezeNow = activeFreeze(projectRoot);
+        if (freezeNow) {
+          recordDeferral(origin?.frozenBy ?? freezeNow.pid);
+          continue;
+        }
         await fs.writeFile(
           path.join(projectRoot, TASKS_DIR_REL, fileName),
           renderTaskFile({ seq, pattern, fixClass, targets, now }),
@@ -358,8 +435,65 @@ export async function proposeCodeFixTasks(projectRoot, {
         entry.written = false;
         result.created -= 1;
         emitted -= 1;
+        // undo the propose-time claim: nothing landed, so the queued entry survives.
+        known.signatures.delete(signature);
       }
     }
+    if (!dryRun && !queueRead.corrupt) {
+      // Merge, never overwrite: keep earlier deferrals (first provenance
+      // wins), drain entries whose task exists, preserve malformed in place.
+      try {
+        const fresh = await loadDeferredQueue(projectRoot);
+        if (fresh.corrupt) {
+          result.error = corruptQueueMessage(fresh.reason);
+        } else {
+          const merged = new Map(); // first wins — earlier provenance is preserved
+          for (const item of fresh.queue) {
+            if (isObject(item) && typeof item.signature === 'string' && !merged.has(item.signature)) {
+              merged.set(item.signature, item);
+            }
+          }
+          for (const item of deferred) {
+            if (!merged.has(item.signature)) merged.set(item.signature, item);
+          }
+          for (const signature of merged.keys()) {
+            if (known.signatures.has(signature)) merged.delete(signature);
+          }
+          // Rebuild: merged versions (drained dropped, on-disk dups once),
+          // malformed in place, then append deferrals not yet on disk.
+          const out = [];
+          const emittedSignatures = new Set();
+          for (const item of fresh.queue) {
+            if (isObject(item) && typeof item.signature === 'string') {
+              if (emittedSignatures.has(item.signature)) continue;
+              emittedSignatures.add(item.signature);
+              const kept = merged.get(item.signature);
+              if (kept) out.push(kept);
+            } else {
+              out.push(item);
+            }
+          }
+          for (const [signature, item] of merged) {
+            if (!emittedSignatures.has(signature)) out.push(item);
+          }
+          await saveDeferredQueue(projectRoot, out);
+          if (deferred.length) result.deferred = deferred.length;
+        }
+      } catch (err) {
+        result.error = `deferred queue save failed: ${err?.message ?? String(err)}`;
+      }
+    }
+    return true; // sentinel: "ran" vs withFileLock skip-undefined
+  };
+
+  try {
+    if (dryRun) {
+      // dryRun writes nothing — read-only, no lock (acquiring it writes state).
+      await runPass();
+    } else {
+      const ran = await withFileLock(path.join(projectRoot, DEFERRED_REL), runPass);
+      if (!ran) result.error = `deferred-queue lock busy; pass skipped: ${DEFERRED_REL}`;
+    }
   } catch (err) {
     result.error = err?.message ?? String(err);
   }

package/template_project/.claude/hooks/skill-router.sh

@@ -201,9 +201,9 @@ const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || ''
 setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 
 (async () => {
-// BEGIN GENERATED SEMANTIC ENGINE sha256=4a3ee8d8789589bab57ab21ad404a2a09a1ff45b31e5d5204c87a2604e305fd2
+// BEGIN GENERATED SEMANTIC ENGINE sha256=914a1f777384deec2f0c27b74e66346855c752f09e8662ccb7f307086088555c
 // Canonical task semantics; intent never grants authorization or proves completion.
-const SEMANTIC_ENGINE_VERSION = 'round4-semantic-1:1dcaa0253e7bc7f4356b02fe5de33b1edda6f0e00d9f2022d9c8cdbe907003a2';
+const SEMANTIC_ENGINE_VERSION = 'round4-semantic-1:092abf191252a5a8f601b66235084726e76c2757b6875cfe5a5243dbbc6f9f6c';
 
 function semanticContractIdentity({ promptText = '', targetFile = '', taskInstanceId = null } = {}) {
   return { taskInstanceId, targetFile, engineVersion: SEMANTIC_ENGINE_VERSION,
@@ -429,7 +429,7 @@ function ordersPublication(promptText = '') {
 }
 
 function ordersPublicationText(promptText = '') {
-  let active = publicationScope(promptText).text.replace(/```[^]*?```|~~~[^]*?~~~/g, '')
+  let active = collapseInspectionSentences(publicationScope(promptText).text).replace(/```[^]*?```|~~~[^]*?~~~/g, '')
     .replace(/^[ \t]*>.*$/gm, '').replace(/[“"][^”"\n]*[”"]|‘[^’\n]*’/g, '');
   for (const branch of defectRepairBranches(active)) active = active.replace(branch, '');
   let ordered = false;
@@ -597,11 +597,19 @@ function classifyTaskSemantics(input = {}) {
   return analyzeTaskIntent(input).semantic;
 }
 
+// A sentence led by an inspection verb whose object is an interrogative clause ("review how the publish and
+// deploy flow works", "explain why update failed") describes behaviour; none of its coordinated fragments is an
+// order. Collapse it to its lead verb so "and"/"then" splitting cannot promote a fragment to an imperative.
+// The collapse stops at "then" or at any coordinator (and/also/comma/roi) followed by an action verb, so an order
+// coordinated after the question stays visible; an action word used as a compound-noun modifier ("deploy flow") is not.
+const INSPECTION_SENTENCE = /(^|[;\n]|\.\s+)([\s*+•>\d.)-]*(?:(?:please|just|hay|vui long|now|also)\s+)*)(audit|inspect|review|analy[sz]e|explain|investigate|read|kiem tra|phan tich|dieu tra)\s+(?:(?:again|carefully|exactly)\s+)?(?:how|what|why|whether|when|where|which|ra sao|the sao|tai sao)\b[^;\n]*?(?=\.(?:\s|$)|[;\n]|$|\s*,?\s*(?:and\s+)?then\b|(?:(?:\s*,\s*(?:(?:and|then|also|but|roi|va|nhung)\s+)*|\s+(?:and|then|also|but|roi|va|nhung)\s+(?:(?:and|then|also)\s+)*)(?:(?:also|now|please|just|finally|afterwards|after that|next|later|eventually|lastly)\s+)*(?:deploy|redeploy|publish|push|fix|commit|release|ship|restart|apply|implement|edit|modify|update|tag|merge|rebase|refactor|rewrite|patch|delete|remove|run|add|build|create|revert|install|migrate|write|change|set|enable|disable|drop|reset|clean|git|npm|yarn|sua|sửa|phat hanh|xoa)\b(?!\s+(?:flow|flows|step|steps|process|processes|pipeline|pipelines|script|scripts|command|commands|logic|path|paths|stage|stages|workflow|workflows|phase|phases|routine|routines|mechanism|handler|handlers|procedure|procedures|policy|policies|lifecycle|sequence|job|jobs|task|tasks|mode|modes|gate|gates)\b)))/gi;
+const collapseInspectionSentences = (text) => text.replace(INSPECTION_SENTENCE, (_m, head, lead, verb) => `${head}${lead}${verb}`);
+
 function actionableClauses(promptText) {
-  const text = neutralizeBannedLists(neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()));
+  const text = neutralizeBannedLists(neutralizeNonOrders(collapseInspectionSentences(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase())));
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong)\b|^[\s*+•>\d.)-]*(?:(?:vui long|xin|hay|please)\s+)*dung\b/.test(clause)
-    && !/^[\s*+•>\d.)-]*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause)
+    && !/^[\s*+•>\d.)-]*(?:(?:please|just|hay|vui long|now|also)\s+)*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause)
     // A fragment led by a subordinator continues the previous clause's predicate ("…, including source
     // fixes F-3" is prose about the past, never a new imperative).
     && !/^[\s*+•>\d.)-]*(?:including|such as|e\.g\.|i\.e\.|via|per)\b/.test(clause));

package/template_project/.claude/ukit/index/publication-intent.mjs

@@ -1,6 +1,6 @@
 // Canonical task semantics; intent never grants authorization or proves completion.
 import crypto from 'node:crypto';
-export const SEMANTIC_ENGINE_VERSION = 'round4-semantic-1:1dcaa0253e7bc7f4356b02fe5de33b1edda6f0e00d9f2022d9c8cdbe907003a2';
+export const SEMANTIC_ENGINE_VERSION = 'round4-semantic-1:092abf191252a5a8f601b66235084726e76c2757b6875cfe5a5243dbbc6f9f6c';
 
 export function semanticContractIdentity({ promptText = '', targetFile = '', taskInstanceId = null } = {}) {
   return { taskInstanceId, targetFile, engineVersion: SEMANTIC_ENGINE_VERSION,
@@ -226,7 +226,7 @@ export function ordersPublication(promptText = '') {
 }
 
 function ordersPublicationText(promptText = '') {
-  let active = publicationScope(promptText).text.replace(/```[^]*?```|~~~[^]*?~~~/g, '')
+  let active = collapseInspectionSentences(publicationScope(promptText).text).replace(/```[^]*?```|~~~[^]*?~~~/g, '')
     .replace(/^[ \t]*>.*$/gm, '').replace(/[“"][^”"\n]*[”"]|‘[^’\n]*’/g, '');
   for (const branch of defectRepairBranches(active)) active = active.replace(branch, '');
   let ordered = false;
@@ -394,11 +394,19 @@ export function classifyTaskSemantics(input = {}) {
   return analyzeTaskIntent(input).semantic;
 }
 
+// A sentence led by an inspection verb whose object is an interrogative clause ("review how the publish and
+// deploy flow works", "explain why update failed") describes behaviour; none of its coordinated fragments is an
+// order. Collapse it to its lead verb so "and"/"then" splitting cannot promote a fragment to an imperative.
+// The collapse stops at "then" or at any coordinator (and/also/comma/roi) followed by an action verb, so an order
+// coordinated after the question stays visible; an action word used as a compound-noun modifier ("deploy flow") is not.
+const INSPECTION_SENTENCE = /(^|[;\n]|\.\s+)([\s*+•>\d.)-]*(?:(?:please|just|hay|vui long|now|also)\s+)*)(audit|inspect|review|analy[sz]e|explain|investigate|read|kiem tra|phan tich|dieu tra)\s+(?:(?:again|carefully|exactly)\s+)?(?:how|what|why|whether|when|where|which|ra sao|the sao|tai sao)\b[^;\n]*?(?=\.(?:\s|$)|[;\n]|$|\s*,?\s*(?:and\s+)?then\b|(?:(?:\s*,\s*(?:(?:and|then|also|but|roi|va|nhung)\s+)*|\s+(?:and|then|also|but|roi|va|nhung)\s+(?:(?:and|then|also)\s+)*)(?:(?:also|now|please|just|finally|afterwards|after that|next|later|eventually|lastly)\s+)*(?:deploy|redeploy|publish|push|fix|commit|release|ship|restart|apply|implement|edit|modify|update|tag|merge|rebase|refactor|rewrite|patch|delete|remove|run|add|build|create|revert|install|migrate|write|change|set|enable|disable|drop|reset|clean|git|npm|yarn|sua|sửa|phat hanh|xoa)\b(?!\s+(?:flow|flows|step|steps|process|processes|pipeline|pipelines|script|scripts|command|commands|logic|path|paths|stage|stages|workflow|workflows|phase|phases|routine|routines|mechanism|handler|handlers|procedure|procedures|policy|policies|lifecycle|sequence|job|jobs|task|tasks|mode|modes|gate|gates)\b)))/gi;
+const collapseInspectionSentences = (text) => text.replace(INSPECTION_SENTENCE, (_m, head, lead, verb) => `${head}${lead}${verb}`);
+
 function actionableClauses(promptText) {
-  const text = neutralizeBannedLists(neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()));
+  const text = neutralizeBannedLists(neutralizeNonOrders(collapseInspectionSentences(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase())));
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong)\b|^[\s*+•>\d.)-]*(?:(?:vui long|xin|hay|please)\s+)*dung\b/.test(clause)
-    && !/^[\s*+•>\d.)-]*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause)
+    && !/^[\s*+•>\d.)-]*(?:(?:please|just|hay|vui long|now|also)\s+)*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause)
     // A fragment led by a subordinator continues the previous clause's predicate ("…, including source
     // fixes F-3" is prose about the past, never a new imperative).
     && !/^[\s*+•>\d.)-]*(?:including|such as|e\.g\.|i\.e\.|via|per)\b/.test(clause));

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -42,18 +42,13 @@ export function cronOperationReceipt(toolName, input, response, transportSuccess
     operation: { domain: capability.domain, role: capability.role, scope, ...state } };
 }
 
-// R2/R3: non-source operations (git integrity, service restart + HTTP check). A Bash command is
-// proof only when it IS the checked command (not text inside echo/quotes) and its exit status
-// is the command's own: no pipe without pipefail, no `;`/newline/`||` chain that can mask it.
-// The goal names WHAT was ordered (verbs, services, probe path/status): a receipt for another
-// verb, service, repo or endpoint never discharges it, and a dry run is not the operation.
+// R2/R3: attributable native operations only; wrong targets, dry runs and masked exits never discharge goals.
 const GIT_MUTATION = /^git\s+(?:push|commit|clean|reset|merge|rebase|stash|tag|checkout|restore|pull|cherry-pick|branch)\b/;
 const GIT_VERB = /^git\s+(push|commit|clean|reset|merge|rebase|stash|tag|checkout|restore|pull|cherry-pick|branch)\b/;
 const GIT_STATE = /^git\s+(?:fsck\b|diff\s+(?:--check|--exit-code|--quiet)\b|status\s+(?:--porcelain|-s|--short)\b)/;
 const SERVICE_MUTATION = /^(?:docker(?:\s+compose)?|docker-compose)\s+(?:restart|up|down|stop|start|build)\b|^(?:sudo\s+)?systemctl\s+(?:restart|start|stop|reload)\b|^pm2\s+(?:restart|reload|start)\b|^kubectl\s+(?:rollout|apply)\b|^launchctl\s+kickstart\b|^(?:\.\/)?(?:scripts\/)?deploy[\w.-]*(?:\s|$)|^(?:npm|yarn|pnpm)\s+(?:run\s+)?deploy\b/;
-// Authoritative remote observation: `git ls-remote <remote> refs/heads/<branch>` asks the remote itself (a local
-// tracking ref / `git status -sb` can be stale). The gate later requires that sha to equal live HEAD on the
-// branch's own tracking remote with a clean tree; successful native mutations are required separately.
+// Remote authority, not stale tracking refs: gate binds sha to clean live HEAD/tracking
+// remote. Native mutation success remains a separate requirement.
 const GIT_LS_REMOTE = /^git\s+ls-remote\s+(\S+)\s+(refs\/heads\/\S+)\s*$/;
 // Native GitHub repository postcondition: `gh repo view [repo] --json url,visibility` asks GitHub itself
 // (like ls-remote asks the Git remote). Strict: unmasked single command, BOTH JSON fields present, enum
@@ -66,7 +61,7 @@ const CURL = /^curl\s/;
 // A leading `cd <dir>;` / `cd <dir> &&` only selects the working directory: it prints nothing and the shell's
 // exit status is the next command's, so it must not turn an otherwise single, checked command into a "masked"
 // compound. Only ONE leading cd is dropped; any other `;`, `||`, pipe or extra segment still masks.
-const LEADING_CD = /^\s*cd\s+(?:"[^"\n]*"|'[^'\n]*'|[^\s;&|<>$`()]+)\s*(?:;|&&)\s*(?=\S)/;
+const LEADING_CD = /^\s*cd\s+(?:"[^"\n$`\\]*"|'[^'\n]*'|[^\s;&|<>$`()]+)\s*(?:;|&&)\s*(?=\S)/;
 export function stripLeadingCd(command) {
   return typeof command === 'string' ? command.replace(LEADING_CD, '') : command;
 }
@@ -79,6 +74,31 @@ function requiredTargetOf(segment, required) {
 function maskShellArguments(command) {
   return command.replace(/'[^']*'|"(?:\\.|[^"\\])*"|\\./g, (word) => ' '.repeat(word.length));
 }
+// This is a bounded attribution recognizer, not a shell parser. A native shell exit
+// proves a simple foreground command (or all commands in an && chain), never a
+// background child, pipeline, substitution, group, or status-swallowing sequence.
+export function preservesNativeOperationExit(raw) {
+  if (typeof raw !== 'string' || !raw.trim()) return false;
+  const text = stripLeadingCd(raw).trim();
+  let quote = null;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if (c === '\\' && quote !== "'") { if (++i >= text.length) return false; continue; }
+    if (quote === "'") { if (c === "'") quote = null; continue; }
+    // Expansions inside double quotes still execute; never hide them as arguments.
+    if (c === '`' || (c === '$' && text[i + 1] === '(')) return false;
+    if (quote === '"') { if (c === '"') quote = null; continue; }
+    if (c === "'" || c === '"') { quote = c; continue; }
+    if (';|(){}[]\n\r'.includes(c) || c === '#') return false;
+    if (c === '&') {
+      if (text[i + 1] === '&') { i += 1; continue; }
+      if (text[i - 1] === '>' || text[i - 1] === '<' || text[i + 1] === '>') continue;
+      return false;
+    }
+  }
+  if (quote) return false;
+  return !/(?:^|&&)\s*(?:!|\.(?:\s|$)|(?:if|then|else|elif|fi|for|while|until|case|function|eval|exec|source|nohup|coproc|setsid|test|command|time|trap)\b)/.test(text);
+}
 export function bashOperationReceipt(rawCommand, response, transportSuccess, goal, { sessionId, harness } = {}) {
   const command = stripLeadingCd(rawCommand);
   const domain = goal?.domain;
@@ -88,7 +108,7 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
   // Preserve offsets while hiding quoted arguments: only unquoted && separates commands.
   const bare = maskShellArguments(command);
   // Pipelines have no per-command exit proof here; the word "pipefail" is not shell state.
-  const masked = /;|\n|\|/.test(bare.replace(/&&/g, ''));
+  const masked = !preservesNativeOperationExit(rawCommand);
   const real = [];
   let start = 0;
   for (const separator of bare.matchAll(/&&/g)) {
@@ -185,7 +205,7 @@ const SEMVER_LINE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 export function releaseReceipt(rawCommand, response, transportSuccess) {
   if (typeof rawCommand !== 'string') return null;
   const command = stripLeadingCd(rawCommand);
-  const masked = /;|\n|\|/.test(maskShellArguments(command));
+  const masked = !preservesNativeOperationExit(rawCommand);
   const segments = command.split('&&').map((seg) => seg.trim()).filter((seg) => seg && !/^cd\s+\S+$/.test(seg));
   if (segments.length !== 1) return null;
   const [seg] = segments;

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -8,7 +8,7 @@ import fsSync from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { withAsyncLock, LOCK_MAX_SLICE_MS } from './async-lock.mjs';
-import { cronOperationReceipt, bashOperationReceipt, releaseOperationReceipt } from './cron-operation-adapter.mjs';
+import { cronOperationReceipt, bashOperationReceipt, releaseOperationReceipt, preservesNativeOperationExit } from './cron-operation-adapter.mjs';
 import * as playbookExecution from './playbook-execution.mjs';
 import { operationCompletionPolicy, foldOperationEvidence, compactOperation, conditionalAbsenceGoal } from './operation-evidence.mjs';
 
@@ -705,10 +705,19 @@ function insideQuote(text, index) {
 
 const SHELL_C_WRAPPER = /(?:^|[\s;&|({])(?:ba|z|da|k)?sh\s+(?:-o\s+\w+\s+|-[a-z]+\s+)*-[a-z]*c\s+(?:'([^']*)'|"((?:[^"\\]|\\.)*)")/gi;
 
+// Keep executable substitutions visible even inside double quotes; single-quoted
+// examples are inert. Recognition only records UNPROVEN — it never executes shell text.
+function executableSubstitutions(command) {
+  return String(command || '').replace(/'[^']*'/g, '').match(/\$\([^]*?\)|`[^`]*`/g) || [];
+}
+
 function isVerificationCommand(command, depth = 0) {
   const raw = String(command || '').trim();
   if (!raw) return false;
   if (depth < 2) {
+    for (const sub of executableSubstitutions(raw)) {
+      if (isVerificationCommand(sub.slice(sub.startsWith('$(') ? 2 : 1, -1), depth + 1)) return true;
+    }
     for (const match of raw.matchAll(SHELL_C_WRAPPER)) {
       // A wrapper that is itself inside a quoted literal (`git commit -m "sh -c 'yarn test'"`) ran nothing.
       if (insideQuote(raw, match.index)) continue;
@@ -762,6 +771,7 @@ function verificationShellUnits(command) {
 
 function maskedVerificationStage(command, depth = 0) {
   const text = String(command || '').trim();
+  if (executableSubstitutions(text).length) return text;
   const units = verificationShellUnits(text);
   if (!units?.length || depth > 2) return text;
   let pipefail = false;
@@ -774,7 +784,7 @@ function maskedVerificationStage(command, depth = 0) {
     // turn the status of an earlier runner into PASS, even when it prints that status.
     if (sawRunner && units[i - 1]?.separator === ';' && !/^[)}]+$/.test(plain)) return unit.text;
     // Command position only: `vitest -t case` is an argument, not a loop.
-    if (/^(?:for|while|until|case|function|done)\b/.test(plain)) return unit.text;
+    if (/^(?:\[|(?:for|while|until|case|function|done|test|coproc|setsid)\b)/.test(plain)) return unit.text;
     // A later `exit 0`/`true`/`:` replaces the runner's status; a leading `!` inverts it.
     if (sawRunner && /^(?:exit\s+0|true|:)$/.test(plain)) return unit.text;
     if (/^!\s/.test(plain) && isVerificationCommand(unit.text)) return unit.text;
@@ -809,6 +819,16 @@ function maskedVerificationStage(command, depth = 0) {
 // Announce through the in-proc hook emitter only (never fd 1 from library callers).
 // Host launch acknowledgement of a backgrounded Bash call (Claude Code: structured
 // `backgroundTaskId`, or the fixed "running in background" text). Structured field first.
+// Claude Code reports a non-zero Bash exit as PostToolUseFailure and never attaches an exit code to a
+// successful result, so its clean PostToolUse (a real `interrupted: false` result, no background launch, no
+// return-code interpretation such as grep's "No matches found") is the host's proof of exit 0. Any other
+// host, or a response without that exact shape, keeps the fail-closed rule.
+function hostProvesCleanBashExit(harness, payload, response) {
+  return harness === 'claude-code' && payload?.hook_event_name === 'PostToolUse'
+    && response && typeof response === 'object' && !Array.isArray(response)
+    && response.interrupted === false && !response.backgroundTaskId && !response.returnCodeInterpretation;
+}
+
 function isBackgroundLaunchAck(response) {
   if (response && typeof response === 'object' && !Array.isArray(response)) {
     if (typeof response.backgroundTaskId === 'string' && response.backgroundTaskId) return true;
@@ -1450,18 +1470,9 @@ function appendReceipt(receipts, receipt) {
   return [...(receipts || []), compactReceipt(receipt)].slice(-MAX_RECEIPTS);
 }
 
-// TASK-026: the monotone verifiable-progress BANK. The digest used to be recomputed from
-// ledger.receipts, which appendReceipt caps at MAX_RECEIPTS by recency — so REPLAYED evidence
-// re-entered the set as older receipts evicted, moving the digest with zero new progress and
-// pinning noProgressCount at 0 forever (a stuck loop rewriting >MAX_RECEIPTS distinct targets
-// in rotation never reached VIBECODE_NO_PROGRESS_CAP). Evidence is now banked MONOTONICALLY:
-// the first successful write to a target, or the first successful run of a verification
-// command, mints a bank key that is NEVER evicted by later receipts — so a replay is a no-op
-// however much recency churn happens around it. Keys are hashed to keep the bank compact; it
-// lives for one request only (a genuinely new promptKey gets a fresh ledger). Reads are
-// deliberately excluded: an endless read-only loop must not reset an absolute liveness
-// escape. Route state is not consulted (the bank is derived from the ledger itself) so
-// journaled replays stay route-state-free.
+// TASK-026: monotone request-scoped progress bank; receipt-window eviction must never
+// turn replayed writes/verifications into new progress. Hashed keys never evict within
+// a request; reads never count. Derived from ledger alone, including journal replay.
 const EVIDENCE_BANK_KEY_LENGTH = 16;
 const BANK_FIELDS = { write: 'bankedWrites', verification: 'bankedVerifications' };
 
@@ -1678,22 +1689,11 @@ function freshLedger(payload, routeState, harness) {
   };
 }
 
-// --- TASK-027: fail-closed ledger events with a bounded lock-timeout journal -------------------
-// The ledger used to lock fail-open: when the wait expired, the read-modify-write ran
-// unlocked and parallel writers interleaved — evidence was lost exactly when the machine
-// was most contended. Every mutation now goes through recordLedgerEvent:
-//   * lock acquired  -> pending journal events are reconciled first (idempotent, by
-//     eventId), then the caller's event is applied, and ONE atomic ledger write lands.
-//     Reconciliation therefore happens inside the caller's own deadline, before its own
-//     evidence.
-//   * lock expired/aborted -> the main ledger is NEVER touched; the event is appended
-//     once to `<ledger>.journal` (JSONL, route-scoped) and reported as `journaled`.
-// Journal invariants: records are route-scoped (the sessionKey must match the journal
-// owner), idempotent (eventId deduped against ledger.journalSeen), bounded (record cap at
-// append time, bounded quarantine, bounded seen-list), and atomic per record (single
-// O_APPEND write; a torn trailing line is quarantined, never applied). Records carry
-// receipts and route metadata only — never prompt bodies or tool output; the receipt
-// whitelist below is the gate.
+// TASK-027: fail-closed ledger lock. Acquired: reconcile journal by eventId, apply,
+// atomically commit within caller deadline. Expired/aborted: never touch main ledger;
+// append once to route-scoped JSONL. Session ownership, record/quarantine/seen caps,
+// single O_APPEND records and torn-line quarantine bound replay. Whitelisted receipt
+// metadata only: never prompt bodies or tool output.
 const JOURNAL_VERSION = 1;
 const MAX_JOURNAL_SEEN = 64;
 const MAX_JOURNAL_RECORDS = 128;
@@ -2120,23 +2120,11 @@ async function drainJournal(target, { ledger, payload, signal, deadlineMs, proje
   return { ledger: next, applied, quarantined: malformed.length, commit };
 }
 
-// --- Playbook execution trace (observable progress, no LLM) ---------------------
-// A playbook is a text cue; the only durable signal of "was it followed" is the
-// receipt stream the hooks already record. This section folds that stream into
-// a bounded, deterministic `playbookTrace` record:
-//   loaded        — a Read receipt hit playbooks/<id>.md
-//   stepsDone     — receipt-derived evidence per the playbook's step map
-//   stepsSkipped  — non-essential steps on a simple/trivial route, justified
-//   outputs       — bounded list of written targets
-//   verification  — 'pending' | 'passed' | 'failed' | 'n/a'
-// No LLM call, no new store: everything derives from ledger.receipts plus the
-// route signals stamped beside them (playbookReason, taskType). The record is
-// persisted on the ledger at receipt-apply time so `ukit status` and the stop
-// message read it without re-deriving an evictable receipt window. Session and
-// request scoping are inherited from the ledger itself: a ledger only ever
-// holds its own session's receipts, and evaluateCompletion derives from the
-// same-request effective ledger, so another session's or patch's evidence can
-// never satisfy a step.
+// Playbook trace: deterministic, bounded receipt-derived progress, no LLM/new store.
+// loaded = playbook Read; stepsDone = step-map evidence; stepsSkipped = justified
+// non-essential simple/trivial work; outputs = written targets; verification =
+// pending/passed/failed/n/a. Persist at receipt-apply time to survive window eviction.
+// Ledger session/request ownership prevents another task's evidence satisfying steps.
 
 const PLAYBOOK_TRACE_EVIDENCE_MAX = 200;
 const MAX_PLAYBOOK_OUTPUTS = 8;
@@ -2322,29 +2310,14 @@ export async function playbookStatus(projectRoot, payload = {}) {
   };
 }
 
-// --- TASK-009 (BL-011): bug-fix completion floor --------------------------------
-// A green verdict on a `playbookId: bug-fix` route requires verbatim
-// `repro-before` (failing) + `repro-after` (passing) evidence receipts on the
-// SAME surface plus a named root cause in the exec-ledger — a symptom patch
-// without receipts cannot pass the gate. A defect that honest attempts cannot
-// reproduce ends INCONCLUSIVE with the attempt count and the runtime-forensics
-// follow-on named; the floor never fabricates a pass.
-//
-// Receipts may carry an explicit ARCH §Evidence Schema attestation
-// (`receipt.evidence = {class, surface, result, claim}`) — minted from
-// `payload.evidence`, `payload.tool_input.evidence`, or a leading
-// `UKIT_EVIDENCE=class=…;surface=…` env assignment on a Bash command. On a
-// bug-fix ledger the apply step additionally classifies every un-attested
-// verification receipt itself: a failed verification is a `repro-before`
-// (the old failure reproduced verbatim), and a success on a surface with a
-// recorded failure is the `repro-after` — so the live hook path produces the
-// floor without any attestation at all. Derived classes are stamped back onto
-// the receipt, which keeps them verbatim inside the receipt window.
-//
-// The bank lives in `ledger.bugFixFloor` and is monotone per request: receipts
-// evicted by the MAX_RECEIPTS window can never un-bank evidence. `seen` dedupes
-// per surface+class so replayed journal records and eval-time receipt folds
-// are idempotent.
+// TASK-009 (BL-011): bug-fix floor requires failing repro-before + passing repro-after
+// on the SAME surface and a named root cause. Unreproduced defects stay INCONCLUSIVE
+// with attempt count/forensics follow-on; no invented pass. Explicit {class,surface,
+// result,claim} evidence comes from payload/tool_input or leading UKIT_EVIDENCE env.
+// Otherwise failed verification derives repro-before; later same-surface success
+// derives repro-after. Stamp derived classes onto receipts. ledger.bugFixFloor is
+// monotone request-scoped; seen stamps make journal/eval replay idempotent despite
+// receipt-window eviction.
 const BUGFIX_PLAYBOOK_ID = 'bug-fix';
 const BUGFIX_REPRO_BEFORE = 'repro-before';
 const BUGFIX_REPRO_AFTER = 'repro-after';
@@ -3275,8 +3248,11 @@ export async function recordExecutionReceipt({
     Object.assign(receipt, bgCompletion);
   } else if (operationReceipt) {
     Object.assign(receipt, operationReceipt);
-    // An absent native exit is not successful execution, even when no error flag was supplied.
-    if (toolName === 'Bash' && exitCode === null) {
+    // An absent native exit is not successful execution, even when no error flag was supplied —
+    // except where the host's own contract carries the proof (see hostProvesCleanBashExit).
+    if (toolName === 'Bash' && (!preservesNativeOperationExit(toolInput.command)
+      || malformedNativeExitPayload(payload)
+      || (exitCode === null && !hostProvesCleanBashExit(harness, payload, toolResponse)))) {
       receipt.exitStatusUnproven = true;
       receipt.success = false;
     }
@@ -3490,7 +3466,14 @@ function evidenceSatisfied(evidence, ledger = {}, state = {}, { cwd } = {}) {
     try { return fsSync.statSync(target).isFile() && fsSync.statSync(target).size > 0; } catch { return false; }
   }
   if (evidence === 'operation-verification') {
-    return operationCompletionPolicy(scopedContract(state, ledger), null, withGitAuthority(ledger, cwd))?.complete === true;
+    const contract = scopedContract(state, ledger);
+    // Publication-only contracts have no generic native goal. A retained recipe/legacy
+    // class belongs to the same registry-bound postcondition, not an impossible null
+    // policy. Never use registry proof to discharge a real Git/service goal.
+    if (contract?.publication && !contract.operationGoal) {
+      return releasePublicationMissing(state, ledger, cwd) === null;
+    }
+    return operationCompletionPolicy(contract, null, withGitAuthority(ledger, cwd))?.complete === true;
   }
   if (evidence === 'write-evidence') {
     const expected = routeSummary.expectedSourceFiles || [];