@r1z4x/tezgah 1.3.0 → 1.5.0

package/hooks/tezgah_attest.py

@@ -27,6 +27,7 @@ import json
 import os
 
 import tezgah_paths as tp
+import tezgah_store
 
 ROOT = tp.PLUGIN_ROOT
 CONTRACT_SHA = os.path.join(tp.CONFIG_DIR, "contract.sha256")
@@ -194,13 +195,13 @@ def drift(host, root=ROOT, shas=None):
     return found, unknown
 
 
-def drift_mark(session_id, host):
-    """The mark one host's drifted session start leaves; its text is the drift
-    list. Keyed by session AND host: two hosts can share a session id (a
-    `tezgah-context attest` run by hand, a host whose ids collide), and a clean
-    start on one must not clear the other's mark."""
-    return os.path.join(tp.cache_dir(), "harness-drift", "%s.%s" % (
-        hashlib.sha256(str(session_id).encode()).hexdigest()[:16], host))
+def drift_key(session_id, host):
+    """The key of the mark one host's drifted session start leaves in the
+    `harness_drift` store; its value is the drift list. Keyed by session AND
+    host: two hosts can share a session id (a `tezgah-context attest` run by
+    hand, a host whose ids collide), and a clean start on one must not clear
+    the other's mark."""
+    return "%s.%s" % (hashlib.sha256(str(session_id).encode()).hexdigest()[:16], host)
 
 
 def mark_text(session_id):
@@ -209,11 +210,8 @@ def mark_text(session_id):
         return ""
     texts = []
     for host in CODE_TARGETS:
-        try:
-            with open(drift_mark(session_id, host), encoding="utf-8") as fh:
-                text = fh.read().strip()
-        except OSError:
-            continue
+        text = tezgah_store.doc("harness_drift", drift_key(session_id, host))
+        text = text.strip() if isinstance(text, str) else ""
         if text and text not in texts:
             texts.append(text)
     return "; ".join(texts)
@@ -242,14 +240,9 @@ def run(host, session_id, cwd=None):
     import tezgah_integrity
     tezgah_integrity.note(session_id, "attest", detail, host=host,
                           switches=",".join(switches()) or None)
-    mark = drift_mark(session_id, host)
-    try:
-        if found:
-            os.makedirs(os.path.dirname(mark), exist_ok=True)
-            with open(mark, "w", encoding="utf-8") as fh:
-                fh.write("; ".join(found) + "\n")
-        elif os.path.exists(mark):
-            os.remove(mark)
-    except OSError:
-        pass
+    key = drift_key(session_id, host)
+    if found:
+        tezgah_store.put_doc("harness_drift", key, "; ".join(found))
+    else:
+        tezgah_store.drop("harness_drift", key)
     return found

package/hooks/tezgah_context.py

@@ -17,7 +17,8 @@ import time
 import tezgah_embed
 import tezgah_orca
 import tezgah_research
-from tezgah_guard import import_crash_mark
+import tezgah_store
+from tezgah_guard import import_crash_key
 from tezgah_integrity import (STEP_KINDS, _heredocs, _path as _ledger_path,
                               _shell_segments, bind_session,
                               changed_files, cut, last_check, note,
@@ -25,8 +26,9 @@ from tezgah_integrity import (STEP_KINDS, _heredocs, _path as _ledger_path,
                               UNTRUSTED_CHANNEL)
 from tezgah_lessons import (lesson_key, lines as lesson_lines,
                             tainted as tainted_lessons)
-from tezgah_policy import (CONDITIONAL_KEYS, CORE, POINTERS, PROMPT_REMINDER,
-                           REPLY_LANG_TEXT, open_lines_note, pony_level_line)
+from tezgah_policy import (CONDITIONAL_KEYS, CORE, FANOUT_ACTION, POINTERS,
+                           PROMPT_REMINDER, REPLY_LANG_TEXT, open_lines_note,
+                           pony_level_line)
 from tezgah_paths import (CACHE, REPO_MARKS, SWITCHES, ai_research_dir, armed,
                           cache_dir, codegraph_bin, consult_options,
                           ensure_workspace, fallback_cache, have_judge_key, off,
@@ -105,6 +107,21 @@ def _tr_ui_ask(word):
     return (r"(?:\b(?:%s)\w*[^.!?\n]{0,40}\b(?:%s))" % (TR_UI_OBJECTS, word))
 
 
+# The fan-out hint's parts (PROMPT_HINTS["fanout"]). A list item's marker:
+# `1.`, `1)`, `1 -`, `1:`, `a)`, or a `-`/`*`/`+`/`•` bullet, then its text.
+_FAN_ITEM = r"(?:\d+[ \t]*[.):\u2013-]|[a-z]\)|[-*+\u2022])[ \t]+\S"
+# A file a prompt names: a path with a directory, or a name with an extension.
+# Anchored at a token start: unanchored, a long run of word characters made
+# every position a start and the search quadratic (100 KB took minutes).
+_FAN_FILE = (r"(?<![\w./-])[`'\"]?(?:(?:[\w.-]+/)+[\w.-]*\w|"
+             r"\w[\w-]*\.[a-z]{1,4}\b)[`'\"]?")
+# The imperative that opens an English clause and closes a Turkish one.
+_FAN_VERB_EN = (r"(?:fix|add|update|write|remove|delete|rename|move|refactor|"
+                r"document|bump|create|implement|migrate|replace)")
+_FAN_VERB_TR = (r"(?:düzelt|güncelle|ekle|yaz|sil|kaldır|taşı|bitir|tamamla|"
+                r"incele|oluştur|değiştir)")
+
+
 PROMPT_HINTS = (
     ("spec", r"\b(normal (user )?behaviou?r|clean ui|nicer|more intuitive|"
              r"un?professional|polish(ed)?|improve the (ui|ux)|make it (better|"
@@ -339,9 +356,22 @@ PROMPT_HINTS = (
     # had to say "do everything with subagents and in parallel" on every task
     # because nothing armed the fan-out rule from the shape of the request.
     # `parallelize` alone is code work, so only the delegation phrasings count.
-    ("fanout", r"(?ms:^[ \t]*\d+[.)][ \t]+\S.*?^[ \t]*\d+[.)][ \t]+\S)|"
-               r"(?ms:^[ \t]*[-*•][ \t]+\S.*?^[ \t]*[-*•][ \t]+\S)|"
-               r"\b(?:in parallel|paralel\w*|sub-?agents?|alt ?ajan\w*|"
+    # The owner's own shapes armed nothing until 2026-10-09: `1 - `, `1- `,
+    # `1:`, `a)`, `+` items, an inline `1. ... 2. ...`, "subagentlerle", three
+    # files named as one list, "First, ... Second, ...", and three imperative
+    # clauses in one sentence (clause-initial in English, clause-final in
+    # Turkish). A timestamp, a range and a traceback stay out (the corpus).
+    ("fanout", r"(?ms:^[ \t]*" + _FAN_ITEM + r".*?^[ \t]*" + _FAN_ITEM + r")|"
+               r"(?<![\w.])1[ \t]*[.)-][ \t]+\S[^\n]*?(?<![\w.])2[ \t]*[.)-][ \t]+\S|"
+               + _FAN_FILE + r"(?:[ \t]*(?:,[ \t]*(?:(?:and|ve)[ \t]+)?|"
+               r"(?:and|ve|&)[ \t]+)" + _FAN_FILE + r"){2,}|"
+               r"(?s:\bfirst(?:ly)?[,:].*?\bsecond(?:ly)?[,:])|"
+               r"(?s:\bbirinci(?:si)?[,:].*?\bikinci(?:si)?[,:])|"
+               r"(?m:(?:(?:^|[,;]|\band\b)[ \t]*(?:and[ \t]+)?" + _FAN_VERB_EN
+               + r"\b[^\n]*?){3})|"
+               r"(?m:(?:\b" + _FAN_VERB_TR + r"\w{0,4}[ \t]*(?:[,;.]|\bve\b|$)"
+               r"[^\n]*?){3})|"
+               r"\b(?:in parallel|paralel\w*|sub-?agent\w*|alt ?ajan\w*|"
                r"worktrees?|fan[- ]?out|orchestrat\w*|orkestra\w*)\b"),
 )
 
@@ -1055,32 +1085,18 @@ def state_stamp(root):
             "lessons": _lessons_state(root)}
 
 
-def _stamp_path(session_id):
-    return os.path.join(cache_dir(), "turns", slug(str(session_id)) + ".json")
-
-
 def read_stamp(session_id):
     """The stamp this session's previous turn wrote, or None when there is none."""
     if not session_id:
         return None
-    try:
-        with open(_stamp_path(session_id), encoding="utf-8") as fh:
-            got = json.load(fh)
-    except (OSError, ValueError):
-        return None
+    got = tezgah_store.doc("turns", slug(str(session_id)))
     return got if isinstance(got, dict) and got.get("root") else None
 
 
 def write_stamp(session_id, root, stamp):
     """Remember this turn's stamp. Best effort: a host may sandbox hook writes."""
-    if not session_id:
-        return
-    try:
-        os.makedirs(os.path.join(cache_dir(), "turns"), exist_ok=True)
-        with open(_stamp_path(session_id), "w", encoding="utf-8") as fh:
-            json.dump(dict(stamp, root=root), fh)
-    except OSError:
-        pass
+    if session_id:
+        tezgah_store.put_doc("turns", slug(str(session_id)), dict(stamp, root=root))
 
 
 def forget_seen(session_id):
@@ -1107,8 +1123,13 @@ ARMED_RESURFACE = 20
 def armed_again(key):
     """The one line a matching prompt pays for a paragraph this session was
     already shown. The research rule keeps its `{OPEN_LINES}` slot: the open
-    lines are a fact about the repo now, not rule text the session holds."""
+    lines are a fact about the repo now, not rule text the session holds. The
+    fan-out rule keeps its action (`FANOUT_ACTION`): the rule is a thing to do
+    on this turn's list, and a bare reminder that it exists was not done."""
     label = dict(CORE_RULES)[key]
+    if key == "fanout":
+        return ("%s Armed again: %s The full rule is in the `tezgah-contract` "
+                "skill." % (label, FANOUT_ACTION))
     return ("%s Armed again: the full rule was given earlier this session and "
             "is in the `tezgah-contract` skill.%s"
             % (label, "{OPEN_LINES}" if key == "research" else ""))
@@ -1627,10 +1648,11 @@ POST_TOOL_ROWS = frozenset(k.encode() for k in STEP_KINDS + ("external", "unknow
 
 
 def _ledger_lines(path):
+    """The ledger's rows at `path` as their JSON bytes, oldest first."""
     try:
-        with open(path, "rb") as fh:
-            return fh.read().split(b"\n")
-    except OSError:
+        return [text.encode("utf-8", "replace")
+                for text in tezgah_store.evidence_rows(path)]
+    except tezgah_store.ERRORS:
         return []
 
 
@@ -1672,12 +1694,10 @@ def _ledger_since(session_id):
     return None, False
 
 
-def _gate_mark(session_id):
-    return os.path.join(cache_dir(), "gate-inactive", slug(str(session_id)))
-
-
-def _switch_baseline(session_id):
-    return os.path.join(cache_dir(), "switches", slug(str(session_id)) + ".json")
+def gate_marked(session_id):
+    """True when the prompt hook left the disarmed-gate mark for this session
+    (`gate_inactive`)."""
+    return tezgah_store.marked("gate_inactive", slug(str(session_id)))
 
 
 def disarmed(session_id):
@@ -1694,24 +1714,17 @@ def disarmed(session_id):
     # the files alone (`armed`, unlatched): a switch the latch ignores is still
     # the tamper shape this records
     now = sorted(n for n in SWITCHES if armed(n))
-    path = _switch_baseline(session_id)
+    state = tezgah_store.doc("switches", slug(str(session_id)))
     try:
-        with open(path, encoding="utf-8") as fh:
-            state = json.load(fh)
         start, seen = list(state["start"]), list(state["seen"])
-    except (OSError, ValueError, KeyError, TypeError):
+    except (KeyError, TypeError):
         start, seen = now, []
     moved = [n for n in now if n not in start]
     for name in moved:
         if name not in seen:
             note(session_id, "disarm", name)
             seen.append(name)
-    try:
-        os.makedirs(os.path.dirname(path), exist_ok=True)
-        with open(path, "w", encoding="utf-8") as fh:
-            json.dump({"start": start, "seen": seen}, fh)
-    except OSError:
-        pass
+    tezgah_store.put_doc("switches", slug(str(session_id)), {"start": start, "seen": seen})
     return moved
 
 
@@ -1730,14 +1743,13 @@ def gate_inactive(session_id, payload):
         calls = 0 if since is None or rows else _transcript_calls(
             p.get("transcript_path"), since)
     inactive = calls >= GATE_MIN_CALLS
-    mark = _gate_mark(session_id)
+    key = slug(str(session_id))
     try:
         if inactive or moved:
-            os.makedirs(os.path.dirname(mark), exist_ok=True)
-            open(mark, "w", encoding="utf-8").close()
-        elif os.path.exists(mark):
-            os.remove(mark)
-    except OSError:
+            tezgah_store.mark("gate_inactive", key)
+        else:
+            tezgah_store.drop("gate_inactive", key)
+    except tezgah_store.ERRORS:
         pass
     return GATE_INACTIVE % calls if inactive else ""
 
@@ -2210,6 +2222,10 @@ def context_for(event, cwd, payload=None, with_core=True):
                 tezgah_taste.learn_later(taste_root)
             except Exception:
                 pass
+        # The legacy JSONL ledgers into the evidence database: a detached
+        # bulk import at most daily (tezgah_store.import_later).
+        if event == "session_start":
+            tezgah_store.import_later(cache_dir())
         broken = tezgah_research.failing(root) if not off("research-off") else []
         if broken:
             line_slug, err = broken[0]
@@ -2408,62 +2424,22 @@ def record(session_id, kind):
     if kind == "orch":
         note(session_id, "orch")
     try:
-        d = os.path.join(cache_dir(), "sessions")
-        os.makedirs(d, exist_ok=True)
-        with open(os.path.join(d, slug(session_id) + ".jsonl"), "a", encoding="utf-8") as fh:
-            fh.write(json.dumps({"kind": kind}) + "\n")
-    except OSError:
+        tezgah_store.use(slug(session_id), kind)
+    except tezgah_store.ERRORS:
         pass
 
 
-# Past this size `used()` compacts the store to one row per kind. Every reader
-# of the store takes it as a set, so nothing is lost, and the next read is a
-# few hundred bytes however long the session ran.
-USED_MAX_BYTES = 65536
-
-
 def used(session_id):
-    if not session_id:
-        return set()
-    out = set()
-    path = os.path.join(cache_dir(), "sessions", slug(session_id) + ".jsonl")
-    try:
-        with open(path, encoding="utf-8") as fh:
-            size = os.fstat(fh.fileno()).st_size
-            for line in fh:
-                try:
-                    out.add(json.loads(line)["kind"])
-                except (ValueError, KeyError):
-                    pass
-        # a row appended since the open changes the size: skip, never lose it
-        if size > USED_MAX_BYTES and os.path.getsize(path) == size:
-            tmp = path + ".tmp"
-            with open(tmp, "w", encoding="utf-8") as fh:
-                fh.writelines(json.dumps({"kind": k}) + "\n"
-                              for k in sorted(k for k in out
-                                              if isinstance(k, str)))
-            os.replace(tmp, path)
-    except OSError:
-        pass
-    return out
+    """The kinds this session recorded, a set (one `used` row per kind)."""
+    return tezgah_store.used(slug(session_id)) if session_id else set()
 
 
-# How many of the newest recorded session files a fitness report reads. A row is
-# `{"kind": kind}` and carries no timestamp, so the window can only be files by
-# mtime - the moment the session last recorded anything, which for a used-kind
-# store is its last event.
+# How many of the sessions that recorded last a fitness report reads, by the
+# time each last recorded anything, which for a used-kind store is its last
+# event.
 FITNESS_WINDOW = 200
 
 
-def _mtime(path):
-    """A file's mtime, or 0 when it is gone: the window is a sort key, and a
-    session that vanished mid-report must not crash the report."""
-    try:
-        return os.path.getmtime(path)
-    except OSError:
-        return 0.0
-
-
 def skill_fitness(window=FITNESS_WINDOW):
     """Which shipped skills the recorded sessions opened, and which opened none.
 
@@ -2474,45 +2450,29 @@ def skill_fitness(window=FITNESS_WINDOW):
     skill a read opened). This is a measurement, not a gate - it names the
     candidates, and retiring one stays the owner's call.
 
-    The window is the newest `window` session files by mtime, because the rows
-    carry no timestamp. A session counts as having opened a skill when it
+    The window is the `window` sessions that recorded last. A session counts
+    as having opened a skill when it
     recorded that skill's kind: `skill:<name>`, or the mark the status line draws
     for the two marked skills, so reads recorded before `SKILL_KIND` existed
     still count. Sessions on a host that cannot see a read record neither, and
     the report cannot tell that session from one that read nothing - the number
     is a floor, not a census.
 
-    Returns `sessions` and `recorded` (the files read and the files present),
-    `skills` (the opened ones ranked by session count, each with the mark the
-    line draws for it, or None), and `never` (the shipped skills no session in
-    the window opened)."""
+    Returns `sessions` and `recorded` (the sessions read and the sessions
+    recorded), `skills` (the opened ones ranked by session count, each with the
+    mark the line draws for it, or None), and `never` (the shipped skills no
+    session in the window opened)."""
     catalog = shipped_skills()
-    d = os.path.join(cache_dir(), "sessions")
-    try:
-        files = sorted((os.path.join(d, n) for n in os.listdir(d)
-                        if n.endswith(".jsonl")),
-                       key=_mtime, reverse=True)
-    except OSError:
-        files = []
+    window_kinds, recorded = tezgah_store.used_sessions(window)
     opened = {}
-    for path in files[:window]:
-        kinds = set()
-        try:
-            with open(path, encoding="utf-8") as fh:
-                for line in fh:
-                    try:
-                        kinds.add(json.loads(line)["kind"])
-                    except (ValueError, KeyError, TypeError):
-                        pass  # a torn line, the way `used` reads one
-        except OSError:
-            continue
+    for kinds in window_kinds:
         for name in catalog:
             mark = SKILL_MARKS.get(name)
             if (SKILL_KIND + name) in kinds or (mark and mark in kinds):
                 opened[name] = opened.get(name, 0) + 1
     return {
-        "sessions": len(files[:window]),
-        "recorded": len(files),
+        "sessions": len(window_kinds),
+        "recorded": recorded,
         "skills": [{"name": name, "mark": SKILL_MARKS.get(name),
                     "sessions": count}
                    for name, count in sorted(opened.items(),
@@ -2801,7 +2761,7 @@ def health_segments(cwd, session_id=None, used_override=None, idx_override=None,
     segs = with_update_notice(version_segment())
     # Shown only when the prompt hook found the gate disarmed (gate_inactive):
     # first, because it says every other mark is not being enforced.
-    if session_id and os.path.exists(_gate_mark(session_id)):
+    if session_id and gate_marked(session_id):
         segs.append({"key": "gate", "state": "off", "glyph": GLYPHS["off"],
                      "text": "gate", "group": 0})
     # Shown when this session's start found tezgah's own hook entries changed
@@ -2819,7 +2779,7 @@ def health_segments(cwd, session_id=None, used_override=None, idx_override=None,
                      "text": "drift", "group": 0})
     # A hook of this session could not import its core (tezgah_guard.
     # import_failed): it failed open, so what it guards did not run.
-    if session_id and os.path.exists(import_crash_mark(session_id)):
+    if session_id and tezgah_store.doc("import_crash", import_crash_key(session_id)) is not None:
         segs.append({"key": "crash", "state": "off", "glyph": GLYPHS["off"],
                      "text": "crash", "group": 0})
     for name, on, meas in flags:

package/hooks/tezgah_gate.py

@@ -98,6 +98,8 @@ import re
 import shlex
 import time
 
+import tezgah_store
+
 from tezgah_integrity import (BASH_TOOLS, BEGAN_KIND, ENV_WORD, GIT_VALUE_OPTS,
                               HEREDOC_RISK, HOOKS_KEY, PATCH_FILE,
                               PLAIN_TAIL, SECRET_PREFIXED, STEP_KINDS,
@@ -587,25 +589,22 @@ def git_head(repo):
     return None
 
 
-def nudge_mark(session_id):
-    """The once-per-session mark: sha1(id)[:16], the key opencode's oncePerSession writes."""
-    return os.path.join(cache_dir(), "nudged", hashlib.sha1(
-        (session_id or "nosession").encode("utf-8")).hexdigest()[:16])
+def nudge_key(session_id):
+    """The once-per-session mark's key in the `nudged` store: sha1(id)[:16],
+    the key opencode's oncePerSession writes."""
+    return hashlib.sha1((session_id or "nosession").encode("utf-8")).hexdigest()[:16]
 
 
 def first_nudge(session_id):
     """Consume the once-per-session nudge. False when already spent/unwritable.
 
-    The mark lands in cache_dir(), so a sandboxed host (dsh) still gets the
-    one-shot nudge instead of the write failing open."""
-    mark = nudge_mark(session_id)
-    if os.path.exists(mark):
-        return False
+    The mark lands in cache_dir()'s database, so a sandboxed host (dsh) still
+    gets the one-shot nudge instead of the write failing open. One INSERT, so
+    of two calls at once exactly one is first."""
     try:
-        os.makedirs(os.path.dirname(mark), exist_ok=True)
-        open(mark, "w", encoding="utf-8").close()  # consume BEFORE denying: later greps pass
-        return True
-    except OSError:
+        # consume BEFORE denying: later greps pass
+        return tezgah_store.mark("nudged", nudge_key(session_id))
+    except tezgah_store.ERRORS:
         return False
 
 
@@ -1841,11 +1840,13 @@ HOOK_ENTRIES = frozenset(("projects-auto-init", "projects-pretooluse",
 HOOK_HOSTS = frozenset(("codex", "cursor", "omp"))
 # Programs that change a path named in their arguments. Every positional is a
 # target, except for the copiers, whose last one is (`cp switch /tmp` reads it).
-# `sed`/`perl` count only with an in-place flag.
+# `sed`/`perl` count only with an in-place flag. `sqlite3` rewrites the cache
+# stores, rows of `tezgah.db`, as `rm` would remove the files they were; its
+# SQL argument names no protected path.
 CONTROL_PROGRAMS = frozenset(("touch", "rm", "rmdir", "unlink", "shred",
                               "truncate", "chmod", "chown", "chgrp", "mv",
                               "mkdir", "tee", "cp", "ln", "install", "rsync",
-                              "dd", "sed", "perl"))
+                              "dd", "sed", "perl", "sqlite3"))
 CONTROL_COPIERS = frozenset(("cp", "mv", "ln", "install", "rsync"))
 # The programs that remove, disable or move a path. A directory that holds
 # protected state, a repository's husky hooks and the open plans (evidence) are
@@ -1867,13 +1868,15 @@ SHELL_NAMES = frozenset(("sh", "bash", "zsh", "dash", "ksh"))
 SHELL_KEYWORDS = frozenset(("if", "then", "elif", "else", "do", "while",
                             "until", "!", "{", "time"))
 SHELL_OPS = re.compile(r"^[;&|()<>]+$")
-# The cache subtrees whose rows the rules read: the evidence ledger, the session
-# store, the switch baseline (tezgah_context.disarmed), the gate mark, and the
-# marks the status line reads for a drifted hook entry
-# (tezgah_attest.drift_mark) and a core that failed to import
-# (tezgah_guard.import_crash_mark).
-CONTROL_CACHE = ("evidence", "sessions", "switches", "gate-inactive",
-                 "harness-drift", "import-crash", "workspace-index.json")
+# The cache subtrees whose rows the rules read: the cache database with its WAL
+# files (the evidence ledger, the used-kind marks, the switch baselines of
+# tezgah_context.disarmed, the gate mark, and the marks the status line reads
+# for a drifted hook entry and a core that failed to import), the evidence
+# JSONL files it imports, and the files the other stores it imports once
+# (tezgah_store.CACHE_LEGACY) had, until that import reads them.
+CONTROL_CACHE = ("evidence", "tezgah.db", "tezgah.db-wal", "tezgah.db-shm", "sessions",
+                 "switches", "gate-inactive", "harness-drift", "import-crash",
+                 "workspace-index.json")
 # Top-level keys tezgah writes into Claude's settings (bin/tezgah-setup
 # wire_claude_statusline, wire_claude_attribution), and the one that turns every
 # hook off at once; any other key or entry is tezgah's only when it names tezgah.
@@ -2830,7 +2833,7 @@ def _dry_decision(tool, inp, cwd, session_id, agent=None):
 
     g.update(note=lambda *a, **k: None, write_taint=lambda *a, **k: None,
              capture=None,
-             first_nudge=lambda sid: not os.path.exists(nudge_mark(sid)))
+             first_nudge=lambda sid: not tezgah_store.marked("nudged", nudge_key(sid)))
     try:
         return decision(tool, inp, cwd, session_id, agent=agent)
     finally:

package/hooks/tezgah_guard.py

@@ -135,13 +135,11 @@ def attest_session(host, session_id, cwd):
     return tezgah_attest.run(host, session_id, cwd)
 
 
-def import_crash_mark(session_id):
-    """The mark an import failure leaves for the status line, one per session.
-    Built here from stdlib alone (the same `~/.cache/tezgah` as
-    `tezgah_paths.CACHE`), because the module that failed may be tezgah_paths."""
+def import_crash_key(session_id):
+    """The key of the mark an import failure leaves for the status line, one
+    per session: the `import_crash` store of the cache database."""
     import hashlib
-    return os.path.join(os.path.expanduser("~"), ".cache", "tezgah", "import-crash",
-                        hashlib.sha256(str(session_id).encode()).hexdigest()[:16])
+    return hashlib.sha256(str(session_id).encode()).hexdigest()[:16]
 
 
 def import_failed(exc, code=0):
@@ -154,7 +152,7 @@ def import_failed(exc, code=0):
     the rename that crashed every omp hook). A hook fails open (`code` 0) like
     every other caught fault, so the dead core must be visible elsewhere: one
     stderr line always, a `crash` row when the ledger's own modules still
-    import, and a mark the status line draws (`import_crash_mark`). A CLI a
+    import, and a mark the status line draws (`import_crash_key`). A CLI a
     person or a tool asks for a verdict (`tezgah-gate check`) passes a non-zero
     `code`: an empty answer from it would read as a pass."""
     detail = "import: %s: %s" % (type(exc).__name__, str(exc)[:120])
@@ -163,10 +161,10 @@ def import_failed(exc, code=0):
                      % (os.path.basename(sys.argv[0] if sys.argv else "hook"), detail))
     session = _payload_session()
     try:
-        mark = import_crash_mark(session)
-        os.makedirs(os.path.dirname(mark), exist_ok=True)
-        with open(mark, "w", encoding="utf-8") as fh:
-            fh.write(detail + "\n")
+        # the store's own import may be what failed: then no mark, as no
+        # status line that imports it can draw one either
+        import tezgah_store
+        tezgah_store.put_doc("import_crash", import_crash_key(session), detail)
     except Exception:
         pass
     try: