@redue/cli 0.1.0-alpha.30 → 0.1.0-alpha.32

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # Changelog
 
+## 0.1.0-alpha.32 — 2026-11-05
+
+REDUE's status is now the point: what is verified on the code as it is
+now, what is stale, what is due.
+
+- **`redue verify`.** Runs every check that is due (STALE, or UNVERIFIED
+  with a program that exists), starting the observer if needed, then shows
+  the full status. It exits 0 only when every check that can be verified
+  ends CURRENT / PASS. `--json` gives `verified`, the checks it ran and the
+  status. It runs what is due up to three rounds, since a run can make
+  another check due.
+- **Not verifiable.** A check no run can confirm shows as NOT VERIFIABLE
+  with the reason: a recording-only check, or one whose last two passing
+  runs changed the same inputs while they ran (a test script that rebuilds
+  a tracked bundle). `verify`, its exit code, the end-of-turn check and the
+  status line's due count leave it out; the status line shows it ("✓ 3
+  verified · 1 not verifiable"). Any other change, or a failing run, makes
+  it due again. JSON: `"verifiable": false` and a `not_verifiable` count.
+- **A status line in Claude Code.** `redue setup claude` adds one:
+  "REDUE ✓ 3 verified", "REDUE ✓ 1 verified · 2 due: typecheck, test",
+  "REDUE ✗ 1 failing: lint". A status line you already have stays; setup
+  prints the command instead.
+- **End-of-turn check.** When the agent changed files during a turn and a
+  check is due, the hook asks it once to run `redue verify` before it
+  finishes. It never asks twice in a turn. `"endOfTurnCheck": false` in
+  the config turns it off.
+- **Faster sandboxed runs.** Receipts and checkpoints keep each installed
+  tree (`.venv`, `node_modules`) as one digest, a run computes only its own
+  check's context, and Linux keeps the Landlock probe's answer. What `redue
+  run` adds to a sub-second check on GitHub's Linux runners fell from
+  270-514 ms to 125-205 ms (lighter's ruff 514 to 155 ms); on macOS from
+  390-710 ms to 310-435 ms, where an FSEvents history stall (150-190 ms in
+  about a third of checkpoints) remains. The Landlock launcher now refuses
+  a network-less run on a kernel below ABI 4.
+- **Windows.** A status call before the first `redue start` no longer
+  leaves a file that makes `start` refuse the state directory.
+
+Measured with the verification-gap study (21 tasks on 7 repositories, 2
+runs, Claude Code headless): sessions that ended with every check verified
+on the final code went from 5 of 42 to 41 of 42 with Sonnet 5.5, and from
+20 of 42 to 42 of 42 with Opus 5.5, with no check REDUE called CURRENT /
+PASS failing on the final code. In the product census, 73% of 330 checks
+had a definite answer (CURRENT or STALE) after their second run (alpha.29:
+71%); 97% of those on the sandboxed recipe with ignored files and
+documentation hidden. `init` on the 13 slowest census repos took 3874 s on
+Linux and 4797 s on macOS (alpha.31: 4139 s and 5517 s), with the same
+checks chosen.
+
+## 0.1.0-alpha.31 — 2026-11-03
+
+A check that runs longer than init's trial limit no longer holds up
+`init` for three runs, and can be set up in the sandbox later.
+
+- **A run past the trial limit never agrees.** Each trial run at `init`
+  stops after 5 minutes. alpha.30 counted a timeout on both sides as
+  agreement and ran every trial of a check that timed out. Now, when the
+  plain run reaches the limit, `init` runs nothing in the sandbox and
+  writes the fallback; when a sandboxed run reaches it, no further trial
+  follows. On the 13 census repos with the slowest checks, `init --dry-run`
+  took 6224 s in all with alpha.30 and 3670 s now on Linux, 8331 s and
+  4776 s on macOS. ADOSMissionControl went from 1138 s to 581 s (Linux),
+  agent-afk from 936 s to 323 s, Nomi from 860 s to 528 s (macOS). Checks
+  that moved from the sandbox to their fallback: 2 of 210 on Linux
+  (ts-liveview typecheck, open-science lint), 3 of 210 on macOS (Nomi and
+  ts-liveview typecheck, OneUptime lint).
+- **`redue init --no-time-limit`.** `redue setup` names the checks that
+  ran past the limit and prints one command, such as
+  `redue init --check typecheck --no-time-limit`. It runs their trials with
+  no limit and updates only their rows in the existing config (a row that
+  runs the same script), restarts a running observer, and leaves the
+  config one `redue remove` still deletes. `init --json` gives such a
+  check's kind as `time_limit`.
+
 ## 0.1.0-alpha.30 — 2026-11-03
 
 `init` runs a check fewer times, and tests try the sandbox first.

package/README.md

@@ -31,8 +31,10 @@ stops before writing anything if the dependencies are not installed. It:
   workflows, Makefile, justfile, tox, nox or scripts give them: mypy,
   pyright and ty (typecheck), ruff (lint) and pytest (test). It says which
   checks it left out and why, and which it can only record, not reuse;
-- connects Claude Code: a short section in `CLAUDE.md`, a skill, and two hooks
-  in `.claude/settings.local.json`;
+- connects Claude Code: a short section in `CLAUDE.md`, a skill, hooks in
+  `.claude/settings.local.json`, and a status line there that shows what is
+  verified on the code as it is now ("REDUE ✓ 3 verified", "REDUE 2 due:
+  typecheck, test"). A status line you already have stays;
 - starts REDUE's file observer, waits while it indexes the project (a minute
   or more in a large one), then runs each check that can qualify once, so
   there is a first result to reuse, and prints one line per run (the run's
@@ -42,7 +44,10 @@ stops before writing anything if the dependencies are not installed. It:
 Then start a new Claude Code session in the project and work as usual. When
 the agent is about to rerun a check whose last pass still applies, the hook
 skips it and tells the agent why. After an edit, the hook runs the check
-through REDUE so the new result is recorded.
+through REDUE so the new result is recorded. When the agent is about to finish a
+turn in which files changed while a check is due, the hook asks it once to
+run `redue verify` first (`"endOfTurnCheck": false` in the config turns
+this off).
 
 To look yourself:
 
@@ -63,6 +68,15 @@ the agent's hook does. `redue status --cached` gives the last answer the
 observer published without checking; it can say UNVERIFIED ("cannot confirm
 your execution context") where `redue status` would say CURRENT.
 
+`redue verify` runs every check that is due (STALE, or UNVERIFIED with a
+command it can run), then prints the status. It exits 0 only when every check
+ends CURRENT / PASS, so it answers "is everything verified on the code as it
+is now?" in one command. A check no run can confirm is shown as NOT
+VERIFIABLE with the reason, and left out: a recording-only check, or one
+whose runs change its own inputs (two passing runs in a row changed the same
+files, such as a test script that rebuilds a tracked bundle). Any other
+change, or a failing run, makes it due again.
+
 `redue stats` shows, per check, the reruns the hook skipped, the time saved,
 the recorded runs and the top reasons a check was UNVERIFIED, from a log kept
 on your machine.
@@ -171,6 +185,7 @@ redue init          # write redue.config.json from your scripts
 redue start         # start the file observer
 redue run typecheck # run a check through REDUE and record the result
 redue status        # what still holds
+redue verify        # run what is due; exit 0 when everything is CURRENT / PASS
 ```
 
 Codex is supported too (`redue agent setup codex --apply`); see

package/bin/redue.mjs

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import {mark,traceBase,traceContext,traceEnvironment,traceId} from '../src/decision-profile.mjs';
 traceBase({...traceContext(),request:traceId(),work:'client'});
-mark('client.loaded');
+mark('client.loaded',{sinceStartMs:Math.round(performance.now())});
 import {directCompiler,directQualification,directEnvironment,directInstalledInputs,directInterpretation} from '../src/direct-typescript.mjs';
 import {runArgv,tscRun} from '../src/typescript-invocation.mjs';
 import {testEnvironment,testRunnerAt,testsInterpretation,testsQualification} from '../src/test-direct.mjs';
@@ -33,7 +33,10 @@ Commands:
                        init, agent setup claude, start, one recorded run per check
   remove [--yes]       Undo setup: integration, observer state, and the config setup created
   init [--dry-run] [--workspace NAME] [--check KIND] [--recipe typescript-direct|tests-direct|node-script|sandbox]
-                       Discover existing scripts; optionally select one workspace/check
+       [--no-time-limit]
+                       Discover existing scripts; optionally select one workspace/check.
+                       --no-time-limit: trial runs have no 5-minute limit; with a config, the checks
+                       it does not run in the sandbox are tried, and those that qualify are updated
   agent setup codex|claude [--dry-run|--apply] [--json]
   agent doctor [codex|claude] [--json]
   agent remove codex|claude [--dry-run|--apply] [--json]
@@ -46,6 +49,8 @@ Commands:
   detail [CHECK] [--json]  Alias for explain
   run CHECK [--if-due] Execute one configured check and record its outcome; with --if-due,
                        only when its last pass does not apply to the files as they are now
+  verify [--json]      Run every check that is due (STALE, or UNVERIFIED with a runnable command),
+                       then show the status; exit 0 only when every check is CURRENT / PASS
   stats [--json]       Per check: skips, time saved, recorded runs, why checks were UNVERIFIED
   remove-state         Stop and remove only this configuration's owned local state
 
@@ -63,6 +68,12 @@ if(args.length===3&&args[0]==='agent'&&args[1]==='hook'&&args[2]==='claude'){
   const {runClaudeHook}=await import('../src/claude-hook.mjs');
   await runClaudeHook(fileURLToPath(import.meta.url));process.exit(0);
 }
+// Claude Code's status line, also before config discovery: it prints one
+// line, or nothing where REDUE is not set up.
+if(args.length===3&&args[0]==='agent'&&args[1]==='statusline'&&args[2]==='claude'){
+  const {runStatusLine}=await import('../src/claude-hook.mjs');
+  await runStatusLine(fileURLToPath(import.meta.url));await exit(0);
+}
 if(args.length===1&&args[0]==='--version'){console.log(version);process.exit(0);}
 // Internal: the entry this command runs, so setup and the hook can tell
 // whether the `redue` on PATH (a link, a package manager's shim, a wrapper)
@@ -96,7 +107,7 @@ if(command==='agent'){
   catch(e){error(e.message);}
   await exit(0);
 }
-if(!['init','start','stop','status','detail','explain','run','stats','remove-state'].includes(command))
+if(!['init','start','stop','status','detail','explain','run','verify','stats','remove-state'].includes(command))
   error(`unknown command ${command||'<none>'}; use --help`);
 const json=args.includes('--json');
 // run --if-due: run the check only when its last pass does not apply now.
@@ -118,11 +129,13 @@ if(command==='init')for(let i=0;i<args.length;){
 }
 const check=['run','detail','explain'].includes(command)&&args[0]&&!args[0].startsWith('--')?args.shift():null;
 if(command==='run'&&!check)error('run requires a check name');
-if(args.some(value=>!['--json','--sync','--cached','--dry-run','--short'].includes(value)))error('unknown option; use --help');
+if(args.some(value=>!['--json','--sync','--cached','--dry-run','--short','--no-time-limit'].includes(value)))error('unknown option; use --help');
 if(sync&&!['status','detail','explain'].includes(command))error('--sync is for status or detail');
 if(cachedOnly&&(command!=='status'||args.includes('--sync')))error('--cached is a status option; do not combine it with --sync');
 if(short&&(command!=='status'||json||args.includes('--sync')))error('--short is a cached status option; do not combine it with --sync or --json');
 if(dryRun&&command!=='init')error('--dry-run is for init');
+const noTimeLimit=args.includes('--no-time-limit');
+if(noTimeLimit&&command!=='init')error('--no-time-limit is for init');
 
 if(command==='init'){
   const {discoverNodeProject,sourceLinkIssue}=await import('../src/node-onboarding.mjs');
@@ -164,36 +177,63 @@ if(command==='init'){
   // where the plain run passes. Any other difference is tried once with the
   // whole checkout, reusing the plain run. Otherwise init writes what it
   // would have without the sandboxed recipe, with the reason. Each check
-  // costs one plain run and one or two sandboxed runs.
+  // costs one plain run and one or two sandboxed runs. A run past the trial
+  // limit ends the check's trials (time_limit); --no-time-limit sets none.
   const trialIssue=trial=>trial.issue?`the sandbox cannot run here (${trial.issue})`:
+    trial.timedOut?`it ran past init's 5-minute trial limit${trial.timedOut==='sandboxed'?' inside the sandbox':''}`+
+      ` (redue init --check ${trial.kind} --no-time-limit tries it without the limit)`:
     // A failure both ways that shows a refusal cannot be told from a real one.
     trial.same?null:trial.plain!==trial.sandboxed?`exit ${trial.sandboxed} inside the sandbox, ${trial.plain} outside it${trial.line?` (${trial.line})`:''}`:
     trial.line?`it fails both ways (exit ${trial.plain}), with a sign of a refusal inside the sandbox (${trial.line})`:
     `the output differs inside the sandbox: ${JSON.stringify(trial.output.sandboxed)} instead of ${JSON.stringify(trial.output.plain)}`;
+  // With --no-time-limit and a config, the checks the config has and does
+  // not run in the sandbox are tried, and one it lacks when --check names
+  // it. Those that qualify replace their rows (a row that runs the same
+  // script) or are added.
+  const configured=fs.existsSync(configFile);
+  let existing=null,existingText=null;
+  if(configured&&noTimeLimit){
+    try{existingText=fs.readFileSync(configFile,'utf8');existing=JSON.parse(existingText);}catch(e){error(`cannot read ${configFile}: ${e.message}`);}
+    if(!Array.isArray(existing?.checks))error(`cannot read ${configFile}: it has no checks`);
+    if((existing.root??'.')!=='.'||!samePath(realObservedPath(path.dirname(configFile)),discovery.root))
+      error('init updates only a config at the repository root, without root; run it there');
+  }
+  const timeout=noTimeLimit?0:undefined,improved=new Map();
   let trials=0;
   for(const [at,row] of [...discovery.checks.entries()]){
     if(row.qualification!==sandboxQualification||row.level!=='ready')continue;
+    const old=existing?.checks.find(check=>check.name===row.config.name);
+    const sameRun=old&&old.kind===row.config.kind&&(row.config.script?old.script===row.config.script:
+      JSON.stringify(old.command)===JSON.stringify(row.config.command));
+    const notTried=!existing?null:!old?(checkSelection?null:'the config does not have it; name its kind with --check to add it'):
+      isSandboxed(old.qualification)?'the config already runs it in the sandbox':sameRun?null:'the config runs something else under that name';
+    if(notTried){discovery.checks[at]=null;discovery.skipped.push({kind:row.config.name,reason:`${row.config.name}: not tried; ${notTried}`});continue;}
     if(!json)console.error(`Running ${row.config.name} inside and outside the sandbox to confirm it...`);
-    const docs=await sandboxTrial(discovery.root,row.config,{hide:'docs'});
+    const docs={...await sandboxTrial(discovery.root,row.config,{hide:'docs',timeout}),kind:row.config.kind};
     if(!docs.issue)trials++;
     if(!docs.issue&&docs.same){
       row.config={...row.config,qualification:docsQualification};row.qualification=docsQualification;
-      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore, except its documentation, are its input")+`; ran both ways at init, exit ${docs.plain}`;continue;}
-    if(!docs.issue&&docs.refusedHidden){
-      row.reason+=`; at init it passed, then failed reading a file that was hidden (${docs.refusedHidden}), so the whole checkout is its input, not run that way at init`;continue;}
+      row.reason=row.reason.replace('the whole checkout is its input',"the checkout's files git doesn't ignore, except its documentation, are its input")+`; ran both ways at init, exit ${docs.plain}`;
+      improved.set(row.config.name,row.config);continue;}
+    if(!docs.issue&&!docs.timedOut&&docs.refusedHidden){
+      row.reason+=`; at init it passed, then failed reading a file that was hidden (${docs.refusedHidden}), so the whole checkout is its input, not run that way at init`;
+      improved.set(row.config.name,row.config);continue;}
     // Without a list of the ignored files or the documentation, the whole checkout is tried on its own.
-    const trial=docs.plainRun?await sandboxTrial(discovery.root,row.config,{plain:docs.plainRun}):
-      [hiddenListIssue,hiddenDocsIssue].includes(docs.issue)?await sandboxTrial(discovery.root,row.config):docs;
+    const trial=docs.timedOut?docs:docs.plainRun?{...await sandboxTrial(discovery.root,row.config,{plain:docs.plainRun,timeout}),kind:row.config.kind}:
+      [hiddenListIssue,hiddenDocsIssue].includes(docs.issue)?{...await sandboxTrial(discovery.root,row.config,{timeout}),kind:row.config.kind}:docs;
     if(trial!==docs&&!trial.issue)trials++;
     const issue=trialIssue(trial);
     if(!issue){row.reason+=`; ran both ways at init, exit ${trial.plain}; the whole checkout is its input: `+
-      (docs.issue?docs.issue:`with the files git ignores and the documentation hidden, ${trialIssue(docs)}`);continue;}
-    if(row.fallback)discovery.checks[at]={...row.fallback,reason:`Sandboxed recipe unavailable: ${issue}; ${row.fallback.reason}`};
-    else{discovery.checks[at]=null;discovery.skipped.push({kind:row.config.name,reason:`${row.config.name}: sandboxed recipe unavailable: ${issue}`});}
+      (docs.issue?docs.issue:`with the files git ignores and the documentation hidden, ${trialIssue(docs)}`);
+      improved.set(row.config.name,row.config);continue;}
+    // time_limit: the kind that --check takes to try it without the limit.
+    const limited=trial.timedOut?{timeLimit:row.config.kind}:{};
+    if(row.fallback)discovery.checks[at]={...row.fallback,...limited,reason:`Sandboxed recipe unavailable: ${issue}; ${row.fallback.reason}`};
+    else{discovery.checks[at]=null;discovery.skipped.push({kind:row.config.name,...trial.timedOut?{time_limit:row.config.kind}:{},reason:`${row.config.name}: sandboxed recipe unavailable: ${issue}`});}
   }
   discovery.checks=discovery.checks.filter(Boolean).map(({fallback,...row})=>row);
   discovery.config.checks=discovery.checks.map(row=>row.config);
-  const configured=fs.existsSync(configFile),unsupported=Boolean(discovery.observationIssue||
+  const unsupported=Boolean(discovery.observationIssue||
     discovery.manager.issue&&!['npm','yarn','pnpm'].includes(discovery.manager.name)||
     discovery.manager.name==='yarn'&&!discovery.manager.version);
   const willWrite=!dryRun&&!configured&&!unsupported&&discovery.checks.length>0;
@@ -202,9 +242,9 @@ if(command==='init'){
     installation_layout:discovery.manager.layout,
     issue:discovery.observationIssue||discovery.manager.issue,workspaces:discovery.workspaces,
     ambiguous:discovery.ambiguous,skipped:discovery.skipped||[],
-    checks:discovery.checks.map(({config:check,level,reason})=>({name:check.name,
+    checks:discovery.checks.map(({config:check,level,reason,timeLimit})=>({name:check.name,
       script:check.script||null,command:check.command||null,
-      workspace:check.workspace||null,level,reason})),config:configFile,
+      workspace:check.workspace||null,level,reason,...timeLimit?{time_limit:timeLimit}:{}})),config:configFile,
     written:willWrite,existing:configured,writable:!configured&&!unsupported&&discovery.checks.length>0};
   if(!json) {
     if(summary.package_manager||!discovery.python)console.log(`Node ${summary.node}; ${summary.package_manager||'unknown package manager'}`+
@@ -223,7 +263,8 @@ if(command==='init'){
       console.log(`  ${row.kind}: ambiguous scripts (${row.scripts.join(', ')}); choose one explicitly`);
     for(const row of summary.skipped)console.log(`  Skipped: ${row.reason}`);
     if(!summary.checks.length)console.log('No useful existing verification scripts found.');
-    console.log(configured?`Existing ${configFile} left unchanged.`:
+    console.log(existing&&improved.size?(dryRun?`Preview only; ${configFile} was not updated.`:`Updating ${[...improved.keys()].join(', ')} in ${configFile}.`):
+      configured?`Existing ${configFile} left unchanged.`:
       dryRun?`Preview only; ${configFile} was not written.`:
         willWrite?`Writing ${configFile}; inspect it before running checks.`:'No configuration will be written.');
   }
@@ -236,6 +277,23 @@ if(command==='init'){
       console.log(`Next: review the config, then redue start and redue run ${JSON.stringify(discovery.checks[0].config.name)}.`);
       console.log('Connect your agent: redue agent setup codex (or claude). Preview with --dry-run.');
       console.log('Then redue status says whether each result applies to the files as they are now.');}
+  } else if(existing&&improved.size&&!dryRun){
+    if(fs.readFileSync(configFile,'utf8')!==existingText)error(`${configFile} changed while the checks ran; nothing was written. Run init again`);
+    // The observer keeps the config it started with: it is restarted around the update.
+    const state=stateOverride||projectState(discovery.root,configFile);
+    let running=false;try{running=processAlive(Number(fs.readFileSync(path.join(state,'observer.lock','pid'),'utf8')));}catch{}
+    const self=action=>spawnSync(process.execPath,[process.argv[1],'--config',configFile,...stateOverride?['--state-dir',stateOverride]:[],action],
+      {stdio:['ignore','pipe','pipe'],encoding:'utf8'});
+    if(running&&self('stop').status!==0)error('the observer did not stop; nothing was written');
+    const names=new Set(existing.checks.map(check=>check.name));
+    existing.checks=[...existing.checks.map(check=>improved.get(check.name)??check),...[...improved.values()].filter(check=>!names.has(check.name))];
+    const text=JSON.stringify(existing,null,2)+'\n';
+    fs.writeFileSync(configFile,text);
+    // A config setup created is still one redue remove deletes.
+    (await import('../src/setup.mjs')).configRewritten(discovery.root,existingText,text);
+    Object.assign(summary,{written:true,updated:[...improved.keys()],observer:!running?'not running':self('start').status===0?'restarted':'not started'});
+    if(!json)console.log(`Updated ${[...improved.keys()].join(', ')} in ${configFile}.`+
+      {restarted:' Restarted the observer with it.','not started':' The observer did not start again: run redue start.','not running':''}[summary.observer]);
   } else if(unsupported&&!json)console.log(`No config written: ${summary.issue||'unsupported discovery boundary'}.`);
   if(json)console.log(JSON.stringify({...summary,proposed_config:discovery.config}));
   await exit(0);
@@ -269,7 +327,9 @@ if(publicConfig.schema!==1)error('config schema must be 1');
 if(!Array.isArray(publicConfig.checks)||!publicConfig.checks.length)
   error('config needs at least one explicitly defined check');
 for(const key of Object.keys(publicConfig))
-  if(!['schema','root','checks','packageManager'].includes(key))error(`unsupported config field ${key}`);
+  if(!['schema','root','checks','packageManager','endOfTurnCheck'].includes(key))error(`unsupported config field ${key}`);
+// The Claude Code hook's end-of-turn check; only the hook reads it.
+if(publicConfig.endOfTurnCheck!==undefined&&typeof publicConfig.endOfTurnCheck!=='boolean')error('endOfTurnCheck must be true or false');
 if(check&&!publicConfig.checks.some(row=>row.name===check))error(`unknown check ${check}; use redue status to list configured checks`);
 const root=realObservedPath(path.resolve(path.dirname(configFile),publicConfig.root||'.'));
 const state=stateOverride||projectState(root,configFile);
@@ -457,6 +517,75 @@ if(!maintenance&&!created){
   }
 }
 
+if(command==='verify'){
+  const self=(more,options)=>spawnSync(process.execPath,[fileURLToPath(import.meta.url),'--config',configFile,
+    ...(stateOverride?['--state-dir',stateOverride]:[]),...more],{env:process.env,...options});
+  const ask=()=>{const r=self(['status','--sync','--json'],{encoding:'utf8',stdio:['ignore','pipe','ignore'],timeout:600_000});
+    try{return JSON.parse(r.stdout);}catch{return null;}};
+  const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+  let status=ask();
+  // Nothing is confirmed without the observer: start it as the session hook
+  // does, and wait while it indexes.
+  if(!status?.observation?.healthy){
+    let pid=null;try{pid=Number(fs.readFileSync(path.join(state,'observer.lock','pid'),'utf8'));}catch{}
+    if(!(Number.isSafeInteger(pid)&&pid>0&&processAlive(pid))){
+      if(!json)console.error('redue verify: starting the observer');
+      self(['start'],{stdio:['ignore','ignore','inherit']});status=ask();
+    }
+    for(const until=Date.now()+120_000;!status?.observation?.healthy&&
+      ['discovery','indexing','reconciling','validating','initializing'].includes(status?.observation?.phase)&&Date.now()<until;){
+      await sleep(1000);status=ask();}
+  }
+  // A check is due when its last result does not apply to the files as they
+  // are now, and it can run: its program is there.
+  const runnable=row=>{const command=checks.find(item=>item.name===row.name)?.command?.[0];
+    if(typeof command!=='string'||command.endsWith('<unavailable>'))return false;
+    if(command.includes('/'))return fs.existsSync(path.resolve(root,checks.find(item=>item.name===row.name).cwd||'.',command));
+    return Boolean(findExecutable(command));};
+  // A check no run can confirm (recording-only, or one that rewrites its own
+  // inputs: verifiable false) is never due. A run can make another check due
+  // (a suite that writes an input), and a check that rewrites its own inputs
+  // shows that on its second run: verify runs what is due again, three rounds
+  // at most.
+  // In a round, a check whose last run changed its inputs runs first, so the
+  // checks its run makes due run after it.
+  // A check that already ran here is due again only when it is STALE or its
+  // inputs changed during its run: another UNVERIFIED reason would not clear.
+  const changedOwn=row=>/declared input event occurred during execution/.test(row.reason||'');
+  const ranNames=new Set();
+  const dueOf=value=>(value?.checks||[]).filter(row=>row.verifiable!==false&&
+    (row.freshness==='STALE'||row.freshness==='UNVERIFIED'&&runnable(row)&&(!ranNames.has(row.name)||changedOwn(row))))
+    .sort((a,b)=>changedOwn(b)-changedOwn(a));
+  // While the observer indexes or reconciles (a run may have changed a manifest).
+  const settle=async()=>{for(const until=Date.now()+120_000;!status?.observation?.healthy&&
+    ['discovery','indexing','reconciling','validating','initializing'].includes(status?.observation?.phase)&&Date.now()<until;){
+    await sleep(1000);status=ask();}};
+  const {note,dueNote}=await import('../src/stats.mjs');
+  const ran=[];
+  for(let round=0,due=dueOf(status);round<3&&due.length&&status?.observation?.healthy;round++,due=dueOf(status)){
+    for(const row of due){
+      const entry=dueNote(status,row.name);if(entry)note(state,entry);
+      if(!json)console.error(`redue verify: running ${row.name} (${row.freshness}: ${row.reason})`);
+      // With --json, the check's output goes to stderr; stdout carries the answer.
+      const r=self(['run',row.name],{stdio:json?['ignore',2,2]:'inherit'});
+      ran.push({check:row.name,was:row.freshness,exit:r.status});ranNames.add(row.name);
+    }
+    status=ask();await settle();
+  }
+  const final=status;
+  const counted=(final?.checks||[]).filter(row=>row.verifiable!==false);
+  const verified=Boolean(final?.observation?.healthy)&&counted.length>0&&counted.every(row=>row.freshness==='CURRENT'&&row.result==='PASS');
+  if(json)console.log(JSON.stringify({schema:1,verified,ran,status:final}));
+  else{
+    if(ran.length)console.log('');
+    console.log(final?renderStatus(final):'UNVERIFIED — status did not answer.');
+    const other=final?.checks?.length-counted.length;
+    console.log((verified?`Verified: every check that can be verified (${counted.length}) passed on the files as they are now.`:
+      counted.length?'Not verified: some checks did not end CURRENT / PASS.':'Not verified: no check can be verified here.')+
+      (other?` ${other} not verifiable, left out.`:''));
+  }
+  await exit(verified?0:1);
+}
 if(command==='status'&&!sync){
   const value=readCachedStatus(state,publicConfig.checks);
   console.log(json?JSON.stringify(value):renderStatus(value,{short}));

package/docs/user/agents.md

@@ -87,6 +87,32 @@ paths no longer exist. When the hook runs a check through REDUE for the
 agent, it likewise writes plain `redue run` only if its own PATH finds this
 install, else the absolute form.
 
+The same command also runs on UserPromptSubmit and Stop, for the end-of-turn
+check. At the start of a turn it notes the observer's count of file events
+and which checks are CURRENT (on Windows, from a synchronized status). When
+the agent stops, it asks status: if a check is due (STALE or UNVERIFIED) and
+files changed during the turn (the count moved, a check CURRENT at the start
+is due now, or the turn's transcript has an Edit, Write, MultiEdit or
+NotebookEdit call), it
+blocks the stop once with "Before you finish, run `redue verify` and report
+what it says". It never asks twice in a turn, and never on the stop that
+follows its reminder (`stop_hook_active`), so it cannot loop. A turn that
+changed nothing ends quietly even when a check is due, and so does any turn
+where the observer is not healthy. `"endOfTurnCheck": false` in the config
+turns it off.
+
+Setup also adds Claude Code's status line, `redue agent statusline claude`,
+in the same file and the same form. It prints one line from a synchronized
+status (the observer's cached one when that takes over 3 s): `REDUE ✓ 3
+verified`, `REDUE ✓ 1 verified · 2 due: typecheck, test`, `REDUE ✗ 1 failing:
+lint`, `REDUE ✓ 3 verified · 1 not verifiable`, `REDUE … checking files` while
+the observer indexes, or `REDUE ? observer not running`. A check that is not
+verifiable (see [the JSON interface](json.md)) is never due, here or for the
+end-of-turn check. Where Claude Code already has a status line (in the
+local or shared project settings, or your user settings), setup leaves it and
+prints the command, so you can add REDUE's line to yours. `redue agent remove
+claude --apply` and `redue remove` take out only REDUE's status line.
+
 Agents often chain an edit and a check (`printf … >> README.md && npm run
 lint`). In a simple chain (commands joined by `&&`, `||` or `;`, with no
 subshell, here-document, command substitution, background job or shell

package/docs/user/configuration.md

@@ -33,6 +33,14 @@ For the explicit direct compiler choice and generated exact argv, see
 A general check (`"qualification": "node-script-v1"`) has a `script` and no
 `command`; see the [general recipe](node-script.md).
 
+## End-of-turn check
+
+With Claude Code, REDUE's hook checks at the end of each agent turn: when the
+turn changed files and a check is due, it asks the agent once to run
+`redue verify` before it finishes ([agents](agents.md)). To turn this off,
+add `"endOfTurnCheck": false` at the top level of the config. Only the hook
+reads it; the observer does not need a restart.
+
 ## Arbitrary commands
 
 An unrecognized ecosystem can still record ordinary execution:

package/docs/user/getting-started.md

@@ -100,7 +100,8 @@ redue explain typecheck
 Use a check actually printed by `init`. For a workspace:
 `redue init --workspace @example/package --check typecheck`.
 Initialization previews detected commands and qualification confidence before writing
-`redue.config.json`. An existing config is never overwritten. No dependencies are
+`redue.config.json`. An existing config is not overwritten (`init --no-time-limit`
+updates the rows of checks it [qualifies](sandbox.md#files-git-ignores-and-documentation)). No dependencies are
 installed; a check proposed for the sandboxed recipe runs once plainly and once or
 twice in the sandbox, and no results are recorded. A missing/unsupported boundary is explained. `init` tries
 the strict recipes first and uses the [general recipe](node-script.md) for a root

package/docs/user/json.md

@@ -59,3 +59,21 @@ JSON summary. **Its stdout is not a JSON-only stream.** Query status/details aft
 completion for machine-readable evidence. Normal check exit codes are preserved;
 interruption/process-start failures are nonzero. REDUE retains metadata and receipts,
 not arbitrary terminal output. The CLI does not infer tests executed from prose.
+
+A check no run can confirm has `"verifiable": false` (its `freshness` stays
+UNVERIFIED and `reason` says why): a recording-only check (no qualification
+contract, inputs it cannot resolve), or one whose last two runs passed while
+the same inputs changed during them, with its plan, environment and every
+other input unchanged since. Anything else changing, a failing run or a
+clean run makes it verifiable (and due) again. Such checks are counted in
+`not_verifiable`, not in the other counts, and do not set `state`. A cached
+answer (`--cached`) never marks a check this way.
+
+`verify --json` writes one JSON object to stdout: `verified` (true only when the
+observer is healthy, at least one check is verifiable, and every verifiable
+check is CURRENT / PASS), `ran` (each check it ran, in order: `check`, `was`
+(STALE or UNVERIFIED) and the run's `exit`), and `status`, the synchronized
+status after those runs. It runs what is due up to three rounds, since a run
+can make another check due; a check whose last run changed its inputs runs
+first in a round. It never runs a check that is not verifiable. The checks'
+own output goes to stderr. It exits 0 when `verified` is true, else 1.

package/docs/user/sandbox.md

@@ -87,6 +87,20 @@ reusing the plain run, and writes `sandbox-v1` only if that agrees. So a
 check runs two or three times at init, not four. `init` no longer writes
 `sandbox-v2`; a check already set up with it keeps it.
 
+Each trial run stops after 5 minutes. A run that stops there never counts as
+agreeing: when the plain run reaches the limit, `init` runs nothing in the
+sandbox and writes the fallback; when a sandboxed run reaches it, no further
+trial follows. `init` marks such a check (`time_limit` in `--json` gives
+its kind), and `redue setup` names them and prints one command:
+`redue init --check typecheck --no-time-limit` (or `redue init
+--no-time-limit` for several kinds). With an existing config, that command
+runs with no limit the checks the config has and does not run in the
+sandbox, and a check it lacks when `--check` names its kind. It replaces
+the row of each that qualifies, if the row runs the same script, or adds
+it, and leaves the rest of the config as it was. It restarts a running
+observer with the new config, and `redue remove` still deletes a config
+`setup` created.
+
 With `sandbox-v3`, each run also hides the documentation: the files git
 lists (and does not ignore) named `*.md`, `*.mdx`, `*.rst`, `LICENSE*` or
 `CHANGELOG*` anywhere, and text, image and PDF files (`.txt`, `.adoc`,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@redue/cli",
   "private": false,
-  "version": "0.1.0-alpha.30",
+  "version": "0.1.0-alpha.32",
   "publishConfig": {
     "access": "public",
     "tag": "alpha"