@vincemakes/kiso-code 0.46.1 → 0.46.2

package/dist/chat.js

@@ -8,8 +8,8 @@ import { readFileSync, statSync } from "node:fs";
 import { escapeTerminal, cacheHitPct, decodeRate, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, STATUS_GLYPHS, kUnit, namedPickView, } from "@vincemakes/kiso-tui";
 import { askView, coldResumeLine, coldResumeView, deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, isProtectedPath, protectedIdentity, shellProgressPath } from "@vincemakes/kiso-tools-node";
-import { liveTasks, mergedConfig, queuedSwitchLines, seenUnknownTasks, setExitTasks, tasksFor } from "./state.js";
-import { taskCounts, taskNoticeRow } from "./task-notice.js";
+import { deliveryLines, liveTasks, lostToldOf, mergedConfig, queuedSwitchLines, setExitTasks, tasksFor, taskWhatOf } from "./state.js";
+import { taskCounts, taskNoticeLines } from "./task-notice.js";
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
 import { canonicalizeUsage, RunClosedError } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
@@ -953,7 +953,8 @@ onInputLanded) {
                     // any run that carries one, as replay.ts does for old logs.
                     // ADR-0058: a task notice is a row, never the person's chip
                     if (ev.via?.kind === "tasks") {
-                        body.notice(taskNoticeRow(ev.via.items));
+                        for (const row of deliveryLines(session.id, ev.via.items))
+                            body.notice(row);
                         break;
                     }
                     if (ev.source === "system") {
@@ -1536,7 +1537,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         const manager = tasksFor(session.id);
         if (manager === undefined)
             return undefined;
-        if (fresh || taskRow === null || Date.now() - taskRow.at > 1_000 || taskRow.seen !== seenUnknownTasks.size) {
+        if (fresh || taskRow === null || Date.now() - taskRow.at > 1_000) {
             let list = [];
             try {
                 list = manager.list();
@@ -1544,7 +1545,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
             catch {
                 // a corrupt journal is reported where it is read on purpose
             }
-            taskRow = { at: Date.now(), seen: seenUnknownTasks.size, counts: taskCounts(list, seenUnknownTasks) };
+            taskRow = { at: Date.now(), counts: taskCounts(list) };
         }
         return taskRow.counts;
     };
@@ -1621,7 +1622,7 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         spentUsd = (spentUsd ?? 0) + usd;
     };
     const queueTurn = (line, via) => {
-        const slot = { line: via?.kind === "skill" ? via.line : via?.kind === "tasks" ? taskNoticeRow(via.items) : line, content: line, ...(via !== undefined ? { via } : {}), cancelled: false };
+        const slot = { line: via?.kind === "skill" ? via.line : via?.kind === "tasks" ? (deliveryLines(session.id, via.items).join(" · ") || taskNoticeLines(via.items, taskWhatOf(session.id)).join(" · ")) : line, content: line, ...(via !== undefined ? { via } : {}), cancelled: false };
         pendingTurns.push(slot);
         queued += 1;
         chainRef.current = chainRef.current.then(async () => {
@@ -1706,6 +1707,15 @@ export async function chat(session, faux, input, autoCompact, nav, seed) {
         : session.useTasks(taskManager, {
             wake: mergedConfig.taskWake !== false,
             onWake: (w) => queueTurn(w.content, w.via),
+            // Amendment 8: a loss is said when kiso concludes it — the
+            // model's notice still rides the next run, and is not said again
+            onLost: (ids) => {
+                const told = lostToldOf(session.id);
+                for (const id of ids)
+                    told.add(id);
+                for (const line of taskNoticeLines(ids.map((taskId) => ({ taskId, transition: "unknown" })), taskWhatOf(session.id)))
+                    body.notice(line);
+            },
             ...(Number.isFinite(autoDetachFromEnv) && autoDetachFromEnv >= 0 ? { autoDetachMinAgeMs: autoDetachFromEnv } : {}),
         });
     // 3e: a task's change repaints the row it is counted on

package/dist/config.d.ts

@@ -151,7 +151,8 @@ export declare function loadUserConfig(): KisoConfig | null;
 /** The project config — read ONLY when the project's .kiso passed the E3
  *  trust gate (an untrusted project's config is never even read). */
 export declare function loadProjectConfig(cwd: string, trusted: boolean): KisoConfig | null;
-/** Merge: project wins over user (each layer's own keys only). */
+/** Merge: a project's keys win over the user's (each layer's own keys
+ *  only) — except that a project may only tighten (assertProjectTightens). */
 export declare function mergeConfigs(user: KisoConfig | null, project: KisoConfig | null): KisoConfig;
 /** What a profile's sign-in actually IS. The two shapes are not
  *  interchangeable: an API key is a string an adapter holds, an OAuth
@@ -210,6 +211,9 @@ export declare function resolveContextWindow(merged: KisoConfig, profile?: Model
 /** Auto-compact: env (KISO_AUTO_COMPACT) > config.autoCompact > off. An
  *  invalid env value is OFF (it set the env → it wins, and it is invalid). */
 export declare function resolveAutoCompact(merged: KisoConfig): AutoCompactConfig | undefined;
-/** Project-trust policy: config.projectTrust (project wins over user) —
- *  "ask" (the E3 gate, default) or "never" (the gate auto-refuses). */
+/** Project-trust policy: the USER config's projectTrust — "ask" (the E3
+ *  gate, default) or "never" (the gate auto-refuses). The gate passes
+ *  loadUserConfig() alone (trust-ui.ts): a project never relaxes its own
+ *  gate, and it could not anyway, since an untrusted project's config is
+ *  never read. */
 export declare function resolveProjectTrustPolicy(merged: KisoConfig): "ask" | "never";

package/dist/config.js

@@ -153,6 +153,10 @@ export function parseConfig(text, source) {
         out.model = obj.model;
     }
     if (obj.models !== undefined) {
+        // 0.46.2: a profile names where requests go and which of the
+        // person's env vars is the key — a repository must never choose that
+        if (source.startsWith("<cwd>"))
+            fail("models", 'belongs in the USER config — a project may pick one of your profiles with "model", never define one');
         if (obj.models === null || typeof obj.models !== "object" || Array.isArray(obj.models))
             fail("models", "expected an object of profiles");
         const models = {};
@@ -261,15 +265,43 @@ export function loadProjectConfig(cwd, trusted) {
         return null;
     return readConfigFile(join(cwd, ".kiso", "config.json"), "<cwd>/.kiso/config.json");
 }
-/** Merge: project wins over user (each layer's own keys only). */
+/** 0.46.2 — how much a tier lets run without a person, strictest first;
+ *  `manual` sits with `default` (both ask). */
+const MODE_LOOSENESS = { plan: 0, manual: 1, default: 1, "accept-edits": 2, "full-access": 3 };
+/**
+ * 0.46.2 — a repository's config may only make kiso STRICTER. A project
+ * mode looser than the user level (the user config's mode, else
+ * `default`) is refused, and a project may turn don't-ask on but never off
+ * — including the switch the old `dontAsk` mode spelling carries. Flags
+ * and env are the person's own choice and are not judged here.
+ */
+function assertProjectTightens(u, p) {
+    const where = "config <cwd>/.kiso/config.json";
+    const base = parseMode(u.mode ?? "default");
+    const proj = p.mode !== undefined ? parseMode(p.mode) : undefined;
+    if (proj !== undefined && base !== undefined && MODE_LOOSENESS[proj.mode] > MODE_LOOSENESS[base.mode]) {
+        const than = u.mode !== undefined ? `your config's "${u.mode}"` : "the default";
+        throw new ConfigError(`${where}: mode — "${p.mode}" is looser than ${than}: a project can make the mode stricter, never looser`);
+    }
+    if (p.dontAsk === false) {
+        throw new ConfigError(`${where}: dontAsk — a project can turn don't-ask on, never off`);
+    }
+    if (base?.dontAsk === true && proj !== undefined && proj.dontAsk !== true && p.dontAsk !== true) {
+        throw new ConfigError(`${where}: mode — "${p.mode}" would turn off the don't-ask switch your config's "${u.mode}" carries: a project can turn don't-ask on, never off`);
+    }
+}
+/** Merge: a project's keys win over the user's (each layer's own keys
+ *  only) — except that a project may only tighten (assertProjectTightens). */
 export function mergeConfigs(user, project) {
     const u = user ?? {};
     const p = project ?? {};
+    assertProjectTightens(u, p);
     return {
         ...(u.model !== undefined ? { model: u.model } : {}),
         ...(p.model !== undefined ? { model: p.model } : {}),
+        // 0.46.2: profiles come from the user config only — parseConfig
+        // refuses a project's `models`, so there is nothing here to merge
         ...(u.models !== undefined ? { models: u.models } : {}),
-        ...(p.models !== undefined ? { models: { ...u.models, ...p.models } } : u.models !== undefined ? { models: u.models } : {}),
         ...(u.mode !== undefined ? { mode: u.mode } : {}),
         ...(p.mode !== undefined ? { mode: p.mode } : {}),
         ...(u.dontAsk !== undefined ? { dontAsk: u.dontAsk } : {}),
@@ -521,8 +553,11 @@ export function resolveAutoCompact(merged) {
     }
     return merged.autoCompact;
 }
-/** Project-trust policy: config.projectTrust (project wins over user) —
- *  "ask" (the E3 gate, default) or "never" (the gate auto-refuses). */
+/** Project-trust policy: the USER config's projectTrust — "ask" (the E3
+ *  gate, default) or "never" (the gate auto-refuses). The gate passes
+ *  loadUserConfig() alone (trust-ui.ts): a project never relaxes its own
+ *  gate, and it could not anyway, since an untrusted project's config is
+ *  never read. */
 export function resolveProjectTrustPolicy(merged) {
     return merged.projectTrust ?? "ask";
 }

package/dist/create-coding-agent.js

@@ -18,8 +18,8 @@ import { builtInLayer } from "./builtin.js";
 import { recordLearnedWindow, useLearnedWindows } from "./learned-windows.js";
 import { compactionDiscardedNotice, contextWindowTokens, knownContextWindow, unknownWindowNotice, windowLearnedNotice } from "./chat.js";
 import {} from "@vincemakes/kiso-core";
-import { guardSavedAllow, isProtectedWrite } from "./protected-writes.js";
-import { floorExtension, isDestructiveCall } from "./floor.js";
+import { guardSavedAllow, neverInheritedCall } from "./protected-writes.js";
+import { floorExtension } from "./floor.js";
 import { protectedShellExtension } from "./protected-shell.js";
 import { homedir } from "node:os";
 import { breakerExtension } from "./breaker.js";
@@ -230,9 +230,10 @@ export async function createCodingAgent(sessionId, input, modelFlag) {
     // 0.40.0: the read-only shell allow sits after the tiers — an allow from
     // it outranks a tier's ask and names itself in decidedBy.
     // 0.40.0: a saved allow never carries a write into .git/ or .kiso/, nor
-    // a destructive shell command.
+    // a destructive shell command; 0.46.2: nor a command across the remote
+    // boundary (remote-boundary.ts).
     const workspaceRoot = () => codingToolOptions().workspaceRoot;
-    const neverInherited = (call) => isProtectedWrite(call, workspaceRoot()) || isDestructiveCall(call);
+    const neverInherited = (call) => neverInheritedCall(call, workspaceRoot());
     setNeverInherited(neverInherited);
     // 0.40.0: the catastrophe floor, at the chain's HEAD — a deny there
     // names itself in decidedBy and outranks every tier, bypass included.

package/dist/dispatch.js

@@ -17,8 +17,8 @@ import { preferences, rememberEffort, setPreference } from "./preferences.js";
 import { settingsRows } from "./settings.js";
 import { floorOn, settingsLayers } from "./state.js";
 import { currentGround } from "@vincemakes/kiso-tui-cells/render";
-import { queuedSwitchLines, seenUnknownTasks, tasksFor } from "./state.js";
-import { taskOutput, taskRow, taskStateLabel } from "./task-notice.js";
+import { queuedSwitchLines, tasksFor } from "./state.js";
+import { lostReason, taskOutput, taskRow, taskStateLabel } from "./task-notice.js";
 import { contextWindowTokens, microcompactThresholdFor, startStatusSpinner, statedContextWindow, windowSourceNote } from "./chat.js";
 import { authForProfile, directWriteProfile, profileAvailable, resolveContextWindow, unavailableReason } from "./config.js";
 import { shellTool } from "@vincemakes/kiso-tools-node";
@@ -1255,8 +1255,8 @@ export function dispatch(line, ctx) {
 /** ADR-0058 (3e) — `/tasks`, `/tasks show <id>`, `/tasks stop <id>`. On a
  *  dock the bare command is a pick: a task, then what to do with it. A
  *  stop is REQUESTED here; the row says `stopping` until the journal says
- *  how it ended. Looking at the list counts as having seen its unknown
- *  tasks (the status row stops counting them). */
+ *  how it ended. A task kiso lost track of says why in `show`
+ *  (Amendment 8). */
 async function tasksCommand(arg, ctx) {
     const manager = tasksFor(ctx.session.id);
     if (manager === undefined) {
@@ -1273,6 +1273,10 @@ async function tasksCommand(arg, ctx) {
     }
     const show = (t) => {
         const lines = taskOutput(t);
+        // Amendment 8: a lost task says why, before its output
+        const why = lostReason(t);
+        if (why !== undefined)
+            bodyLog(`${t.id} — lost track: ${why}; it may still be running`);
         bodyLog(`${t.id} — ${t.agent !== undefined ? "its answer" : "its last output"}${lines.length === 0 ? ": nothing yet" : ""}`);
         for (const line of lines)
             bodyLog(`  ${line}`);
@@ -1299,9 +1303,6 @@ async function tasksCommand(arg, ctx) {
         bodyLog("no tasks in this session");
         return;
     }
-    for (const t of list)
-        if (t.state.kind === "unknown")
-            seenUnknownTasks.add(t.id);
     if (!dock.active) {
         for (const t of list) {
             const r = taskRow(t);

package/dist/floor.d.ts

@@ -63,6 +63,27 @@ export declare function innerLines(argv: readonly LooseWord[], home: string): {
     readonly lines: readonly string[];
     readonly subshell: boolean;
 } | null;
+/** How deep command lines inside command lines are followed — `sh -c`,
+ *  `eval` — and how many are read in all: eval's two readings would
+ *  otherwise double at every level. */
+export declare const MAX_INNER_DEPTH = 16;
+export declare const MAX_INNER_LINES = 256;
+/** git's global options, read to the subcommand. Shared by the floor and
+ *  the remote boundary (remote-boundary.ts), which must find the same
+ *  subcommand the floor does: an option without a value is one word
+ *  skipped, whatever it is, so `git --no-pager push` reads as push. */
+export interface GitInvocation {
+    readonly sub: string | undefined;
+    readonly rest: readonly LooseWord[];
+    /** B7: several -C compose, each relative to the one before */
+    readonly cds: readonly LooseWord[];
+    /** B7: --work-tree X IS the tree a whole-tree command works on */
+    readonly workTree: LooseWord | undefined;
+    /** B7: --git-dir X is a target in itself (space and = forms both) */
+    readonly gitDirs: readonly LooseWord[];
+}
+/** `args` is git's argv without `git`. */
+export declare function gitInvocation(args: readonly LooseWord[]): GitInvocation;
 /**
  * Would the floor refuse this command line? `workspaceRoot` is where the
  * shell runs it.

package/dist/floor.js

@@ -344,8 +344,8 @@ export function innerLines(argv, home) {
 /** How deep command lines inside command lines are followed — `sh -c`,
  *  `eval` — and how many are read in all: eval's two readings would
  *  otherwise double at every level. */
-const MAX_INNER_DEPTH = 16;
-const MAX_INNER_LINES = 256;
+export const MAX_INNER_DEPTH = 16;
+export const MAX_INNER_LINES = 256;
 const SELECTING = new Set([
     "-name", "-iname", "-path", "-ipath", "-wholename", "-iwholename", "-regex", "-iregex", "-newer", "-mtime", "-mmin", "-atime",
     "-amin", "-ctime", "-cmin", "-size", "-empty", "-user", "-group", "-perm", "-samefile", "-links",
@@ -355,6 +355,38 @@ const SELECTING = new Set([
 const pathShaped = (t) => t === "." || t === "./" || t.startsWith("/") || t.startsWith("~") || t.includes("/") || t.startsWith(":") || (hostDialect().msys && (t.includes("\\") || /^[A-Za-z]:/.test(t)));
 /** B7: pathspec magic from the top of the repository */
 const topMagic = (t) => t.startsWith(":/") || t.startsWith(":(top");
+/** `args` is git's argv without `git`. */
+export function gitInvocation(args) {
+    let i = 0;
+    const cds = [];
+    let workTree;
+    const gitDirs = [];
+    while (i < args.length && args[i].text.startsWith("-")) {
+        const t = args[i].text;
+        const eq = /^--(work-tree|git-dir)=(.*)$/.exec(t);
+        if (eq !== null) {
+            const value = { ...args[i], text: eq[2], unknownAt: -1, tilde: eq[2].startsWith("~") };
+            if (eq[1] === "work-tree")
+                workTree = value;
+            else
+                gitDirs.push(value);
+        }
+        if ((t === "-C" || t === "--work-tree" || t === "--git-dir") && i + 1 < args.length) {
+            if (t === "-C")
+                cds.push(args[i + 1]);
+            else if (t === "--work-tree")
+                workTree = args[i + 1];
+            else
+                gitDirs.push(args[i + 1]);
+            i += 2;
+        }
+        else if (t === "-c" || t === "--namespace" || t === "--exec-path")
+            i += 2;
+        else
+            i += 1;
+    }
+    return { sub: args[i]?.text, rest: args.slice(i + 1), cds, workTree, gitDirs };
+}
 /** The destructive command's targets, or null when it is not destructive. */
 function destructiveTargets(argv) {
     const name = basename(argv[0]?.text ?? "");
@@ -398,39 +430,7 @@ function destructiveTargets(argv) {
     }
     if (name !== "git")
         return null;
-    let i = 0;
-    // B7: several -C compose, each relative to the one before
-    const cds = [];
-    // B7: --work-tree X IS the tree a whole-tree command works on; --git-dir
-    // X is a target in itself (space and = forms both)
-    let workTree;
-    const gitDirs = [];
-    while (i < args.length && args[i].text.startsWith("-")) {
-        const t = args[i].text;
-        const eq = /^--(work-tree|git-dir)=(.*)$/.exec(t);
-        if (eq !== null) {
-            const value = { ...args[i], text: eq[2], unknownAt: -1, tilde: eq[2].startsWith("~") };
-            if (eq[1] === "work-tree")
-                workTree = value;
-            else
-                gitDirs.push(value);
-        }
-        if ((t === "-C" || t === "--work-tree" || t === "--git-dir") && i + 1 < args.length) {
-            if (t === "-C")
-                cds.push(args[i + 1]);
-            else if (t === "--work-tree")
-                workTree = args[i + 1];
-            else
-                gitDirs.push(args[i + 1]);
-            i += 2;
-        }
-        else if (t === "-c" || t === "--namespace" || t === "--exec-path")
-            i += 2;
-        else
-            i += 1;
-    }
-    const sub = args[i]?.text;
-    const rest = args.slice(i + 1);
+    const { sub, rest, cds, workTree, gitDirs } = gitInvocation(args);
     const flags = new Set(rest.filter((a) => a.text.startsWith("-")).map((a) => a.text));
     const as = (targets) => ({
         targets: [...targets.map((t) => (t === "repo" && workTree !== undefined ? workTree : t)), ...gitDirs],

package/dist/index.js

@@ -45,7 +45,7 @@ import { activeStoreDir, setActiveStoreDir, agentModel, atFiles, body, bodyLog,
 import { fauxSkip, readFauxScript } from "./faux-glue.js";
 import { chat, contextWindowTokens, displayCtxRatio, microcompactThresholdFor, statusModelLabel } from "./chat.js";
 import { preferences, usePreferences } from "./preferences.js";
-import { settingsLayers, setChildTurnBudget, stopAllTasks } from "./state.js";
+import { settingsLayers, setChildTurnBudget, stopAllTasks, taskWhatOf } from "./state.js";
 import { finishChild } from "./child-result.js";
 import { loadUserConfig, resolveAutoCompact } from "./config.js";
 import { checkForUpdate, knownUpdate, updateCardLines } from "./update-check.js";
@@ -1044,7 +1044,7 @@ async function chatLoop(first, firstId, input, autoCompact) {
             // prompt inside a conversation with thousands of events — the
             // durable log was right there and none of it was shown. Empty for
             // a fresh session, so `kiso chat` is byte-identical.
-            showResumeTail(session.log.all);
+            showResumeTail(session.log.all, session.id);
             // R2 (owner, 2026-08-27): the resume list is NOT on the opening
             // screen. `/resume` is where you go looking for a session; the
             // opening's job is to say what THIS one is.
@@ -1076,7 +1076,7 @@ async function chatLoop(first, firstId, input, autoCompact) {
         }
         else {
             bodyLog(`session ${id} (switched — previous: ${prev}, /resume ${prev} returns)\n`);
-            showResumeTail(session.log.all);
+            showResumeTail(session.log.all, session.id);
             if (currentFaux)
                 session.setAdapter(createFauxProvider(readFauxScript().slice(fauxSkip(id))));
         }
@@ -1188,10 +1188,11 @@ async function readSecret(prompt) {
  * there is no viewer and no cell renderer, so the plain text tail stays
  * (DC-51: one call, one cell).
  */
-function showResumeTail(events) {
+function showResumeTail(events, sessionId) {
     const W = process.stdout.columns ?? 80;
+    // Amendment 8: a lost task's replayed row names what it ran
     if (dock.active)
-        replayInto(body, events, W);
+        replayInto(body, events, W, taskWhatOf(sessionId));
     else
         bodyLog(resumeTail(events, W).join("\n"));
 }
@@ -1575,7 +1576,7 @@ async function main() {
                     session.setAdapter(createFauxProvider(readFauxScript().slice(fauxSkip(id))));
                 // REL-0152-D5 — the same tail on the explicit-id form. NOT on
                 // the -p path above: that one's stdout is a machine's input.
-                showResumeTail(session.log.all);
+                showResumeTail(session.log.all, session.id);
                 await resume(session, prompt, faux, input);
                 break;
             }
@@ -1857,7 +1858,7 @@ async function main() {
         // terminal (kill -9 excepted; `reset` saves it).
         dock.exit();
         for (const id of tasksAtExit.unconfirmed)
-            console.error(`${id}: stop unconfirmed — outcome unknown`);
+            console.error(`${id}: stop unconfirmed — it may still be running`);
         if (tasksAtExit.left.length > 0)
             console.error(`left running: ${tasksAtExit.left.join(", ")} — reopen this session to hear how ${tasksAtExit.left.length === 1 ? "it ends" : "they end"}`);
         // finding #8 (P1): extension dispose runs on the same exit path — a

package/dist/protected-writes.d.ts

@@ -18,6 +18,14 @@
 import type { PolicyCall } from "@vincemakes/kiso-core";
 import type { KisoExtension } from "@vincemakes/kiso-runtime";
 export declare function isProtectedWrite(call: PolicyCall, workspaceRoot: string): boolean;
+/**
+ * The calls a saved allow never carries — they reach a person every time
+ * in the asking tiers: a write into .git/ or .kiso/, a destructive
+ * command (floor.ts, which also answers yes for a line it cannot read),
+ * and a command across the remote boundary (remote-boundary.ts, 0.46.2).
+ * create-coding-agent.ts wires it into every guarded saved allow.
+ */
+export declare function neverInheritedCall(call: PolicyCall, workspaceRoot: string): boolean;
 /**
  * A saved allow ("yes, don't ask again for <tool>") allows by TOOL, so on
  * its own it would carry every later call of that tool — including the

package/dist/protected-writes.js

@@ -17,6 +17,8 @@
  */
 import { relative, sep } from "node:path";
 import { resolveShellPath } from "./shell-words.js";
+import { isDestructiveCall } from "./floor.js";
+import { isRemoteBoundaryCall } from "./remote-boundary.js";
 const PROTECTED = new Set([".git", ".kiso"]);
 const WRITERS = new Set(["write_file", "edit_file"]);
 export function isProtectedWrite(call, workspaceRoot) {
@@ -34,6 +36,16 @@ export function isProtectedWrite(call, workspaceRoot) {
         .some((seg) => PROTECTED.has(seg.toLowerCase()));
 }
 const ABSTAIN = { action: "abstain" };
+/**
+ * The calls a saved allow never carries — they reach a person every time
+ * in the asking tiers: a write into .git/ or .kiso/, a destructive
+ * command (floor.ts, which also answers yes for a line it cannot read),
+ * and a command across the remote boundary (remote-boundary.ts, 0.46.2).
+ * create-coding-agent.ts wires it into every guarded saved allow.
+ */
+export function neverInheritedCall(call, workspaceRoot) {
+    return isProtectedWrite(call, workspaceRoot) || isDestructiveCall(call) || isRemoteBoundaryCall(call);
+}
 /**
  * A saved allow ("yes, don't ask again for <tool>") allows by TOOL, so on
  * its own it would carry every later call of that tool — including the

package/dist/remote-boundary.d.ts

@@ -0,0 +1,55 @@
+/**
+ * 0.46.2 — the remote boundary (owner-ratified 2026-10-06, rev 2 with the
+ * review's amendments).
+ *
+ * Two families of shell command change state that other people share:
+ *
+ *  A. a destructive git push — history rewritten or refs removed:
+ *     --force / -f, --force-with-lease, --force-if-includes, a refspec
+ *     with a leading `+`, --mirror, --delete / -d, a deleting refspec
+ *     (`:branch`), --prune. A dry run is exempt, read as git reads it: the
+ *     last of -n / --dry-run / --no-dry-run wins, and git takes any
+ *     unambiguous prefix of a long option, so `--mirr` is --mirror and
+ *     `--no-dry` turns the dry run off. A prefix is read generously — a
+ *     prefix git would reject as ambiguous costs a question, not a pass.
+ *  B. a registry write — a package published, unpublished or deprecated,
+ *     or a dist-tag moved: npm or pnpm with `publish`, `unpublish`,
+ *     `deprecate`, or `dist-tag` / `dist-tags` with add (a, set, s) or rm
+ *     (r, del, d, remove) — pnpm hands the last three to npm; yarn with
+ *     `publish`, `npm publish`, or `tag` / `npm tag` with add, rm or
+ *     remove. Not as the script `npm run publish` names. A dry run is
+ *     exempt only where the command honours one, read as its parser reads
+ *     it (`--dry-run false` is a real publish): npm and pnpm publish and
+ *     unpublish take --dry-run, `yarn npm publish` takes -n / --dry-run;
+ *     deprecate, dist-tag and yarn classic's publish have none, so the
+ *     flag exempts nothing there. npm's abbreviations of a command
+ *     (`npm pub`) are read too, in the command's place — not after an
+ *     option that takes a value (`npm --registry x pub`). Listing tags
+ *     and `npm view` stay out.
+ *
+ * A saved "don't ask again for shell" never carries either
+ * (protected-writes.ts neverInheritedCall): permission remembered by TOOL
+ * NAME from some earlier call does not cross into a change other people
+ * share. Authority given now still does — every tier decides these as it
+ * decides any shell call, so full-access runs them, and an explicit user
+ * extension that allows them still allows them. That is the extension of
+ * launch-weekend plan §4 ("destructive commands never inherit a saved
+ * allow in the asking modes") to the remote; "bypass stays bypass" is
+ * untouched.
+ *
+ * The list is closed: a new family needs the owner's word. It reads
+ * direct invocations only, words as written — `npm run release`, a script
+ * file, a git alias, a `+` refspec in git config and a variable's value
+ * are not seen. A guardrail, not a sandbox. A line it cannot read is not
+ * its question: isDestructiveCall already answers yes for one, so a saved
+ * allow abstains either way, and the two readings never disagree on what
+ * "unreadable" means.
+ */
+import type { PolicyCall } from "@vincemakes/kiso-core";
+/** Whether a command line crosses the remote boundary — read as the floor
+ *  reads one: past wrappers (sudo, env, timeout), into `sh -c` and eval,
+ *  along every command of a chain. */
+export declare function isRemoteBoundary(commandLine: string): boolean;
+/** The policy-call form: a shell call whose command crosses. A throw is
+ *  not this reading's to answer — see the head comment. */
+export declare function isRemoteBoundaryCall(call: PolicyCall): boolean;

package/dist/remote-boundary.js

@@ -0,0 +1,217 @@
+/**
+ * 0.46.2 — the remote boundary (owner-ratified 2026-10-06, rev 2 with the
+ * review's amendments).
+ *
+ * Two families of shell command change state that other people share:
+ *
+ *  A. a destructive git push — history rewritten or refs removed:
+ *     --force / -f, --force-with-lease, --force-if-includes, a refspec
+ *     with a leading `+`, --mirror, --delete / -d, a deleting refspec
+ *     (`:branch`), --prune. A dry run is exempt, read as git reads it: the
+ *     last of -n / --dry-run / --no-dry-run wins, and git takes any
+ *     unambiguous prefix of a long option, so `--mirr` is --mirror and
+ *     `--no-dry` turns the dry run off. A prefix is read generously — a
+ *     prefix git would reject as ambiguous costs a question, not a pass.
+ *  B. a registry write — a package published, unpublished or deprecated,
+ *     or a dist-tag moved: npm or pnpm with `publish`, `unpublish`,
+ *     `deprecate`, or `dist-tag` / `dist-tags` with add (a, set, s) or rm
+ *     (r, del, d, remove) — pnpm hands the last three to npm; yarn with
+ *     `publish`, `npm publish`, or `tag` / `npm tag` with add, rm or
+ *     remove. Not as the script `npm run publish` names. A dry run is
+ *     exempt only where the command honours one, read as its parser reads
+ *     it (`--dry-run false` is a real publish): npm and pnpm publish and
+ *     unpublish take --dry-run, `yarn npm publish` takes -n / --dry-run;
+ *     deprecate, dist-tag and yarn classic's publish have none, so the
+ *     flag exempts nothing there. npm's abbreviations of a command
+ *     (`npm pub`) are read too, in the command's place — not after an
+ *     option that takes a value (`npm --registry x pub`). Listing tags
+ *     and `npm view` stay out.
+ *
+ * A saved "don't ask again for shell" never carries either
+ * (protected-writes.ts neverInheritedCall): permission remembered by TOOL
+ * NAME from some earlier call does not cross into a change other people
+ * share. Authority given now still does — every tier decides these as it
+ * decides any shell call, so full-access runs them, and an explicit user
+ * extension that allows them still allows them. That is the extension of
+ * launch-weekend plan §4 ("destructive commands never inherit a saved
+ * allow in the asking modes") to the remote; "bypass stays bypass" is
+ * untouched.
+ *
+ * The list is closed: a new family needs the owner's word. It reads
+ * direct invocations only, words as written — `npm run release`, a script
+ * file, a git alias, a `+` refspec in git config and a variable's value
+ * are not seen. A guardrail, not a sandbox. A line it cannot read is not
+ * its question: isDestructiveCall already answers yes for one, so a saved
+ * allow abstains either way, and the two readings never disagree on what
+ * "unreadable" means.
+ */
+import { homedir } from "node:os";
+import { basename } from "node:path";
+import { MAX_INNER_DEPTH, MAX_INNER_LINES, gitInvocation, innerLines, unwrap } from "./floor.js";
+import { looseCommands, parseShellLooseChecked } from "./shell-words.js";
+/** git push options that take the next word as their value. */
+const PUSH_VALUED = new Set(["-o", "--push-option", "--repo", "--receive-pack", "--exec"]);
+/** git push options that rewrite or remove remote refs. */
+const PUSH_REWRITES = new Set(["--force", "--force-with-lease", "--force-if-includes", "--mirror", "--delete", "--prune"]);
+function destructivePush(args) {
+    let crosses = false;
+    let dryRun = false;
+    let options = true;
+    const positionals = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const t = args[i].text;
+        if (!options || !t.startsWith("-") || t === "-") {
+            positionals.push(t);
+            continue;
+        }
+        if (t === "--") {
+            options = false;
+            continue;
+        }
+        if (PUSH_VALUED.has(t)) {
+            i += 1;
+            continue;
+        }
+        if (t.startsWith("--")) {
+            const flag = t.split("=")[0];
+            if (flag === "--dry-run")
+                dryRun = true;
+            else if (flag.length >= "--no-d".length && "--no-dry-run".startsWith(flag))
+                dryRun = false;
+            else if (flag.length > 2 && [...PUSH_REWRITES].some((r) => r.startsWith(flag)))
+                crosses = true;
+            continue;
+        }
+        // a short cluster, `-uf`; `-o` takes the rest of the word, or the next
+        for (let k = 1; k < t.length; k += 1) {
+            const c = t[k];
+            if (c === "o") {
+                if (k === t.length - 1)
+                    i += 1;
+                break;
+            }
+            if (c === "n")
+                dryRun = true;
+            if (c === "f" || c === "d")
+                crosses = true;
+        }
+    }
+    // the first positional is the repository; the rest are refspecs
+    if (positionals.slice(1).some((r) => r.startsWith("+") || r.startsWith(":")))
+        crosses = true;
+    return crosses && !dryRun;
+}
+/** Whether a dry run is on, read as npm's option parser reads it: the last
+ *  setting wins, `--dry-run false` and `--dry-run=false` turn it off, and
+ *  only an explicit true counts. `-n` is a dry run where yarn says so. */
+function dryRun(words, short) {
+    let on = false;
+    for (let i = 0; i < words.length; i += 1) {
+        const w = words[i];
+        if (w === "--dry-run" || (short && w === "-n")) {
+            const next = words[i + 1];
+            on = next !== "false";
+            if (next === "true" || next === "false")
+                i += 1;
+        }
+        else if (w.startsWith("--dry-run="))
+            on = w === "--dry-run=true";
+        else if (w === "--no-dry-run")
+            on = false;
+    }
+    return on;
+}
+/** dist-tag (npm) and tag (yarn) write with these subcommands, and list
+ *  with the rest — a bare `npm dist-tag <pkg>` lists too. */
+const NPM_TAG_WRITES = new Set(["add", "a", "set", "s", "rm", "r", "del", "d", "remove"]);
+const NPM_TAG_READS = new Set(["ls", "l", "sl", "list"]);
+const YARN_TAG_WRITES = new Set(["add", "rm", "remove"]);
+const YARN_TAG_READS = new Set(["ls", "list"]);
+/** A tag command writes when a write subcommand follows it — unless the
+ *  first word after it names a listing (`npm dist-tag ls d` lists "d"). */
+function tagWrite(words, at, writes, reads) {
+    const after = words.slice(at + 1).filter((w) => !w.startsWith("-"));
+    if (after[0] !== undefined && reads.has(after[0]))
+        return false;
+    return after.some((w) => writes.has(w));
+}
+/** npm runs a unique prefix of a command name: `npm pub` is publish,
+ *  `npm unp` unpublish, `npm dep` deprecate (npm 10's own resolution).
+ *  Read generously, as git's options are — a prefix npm would reject as
+ *  ambiguous (`npm de`) costs a question. `un` is npm's alias for
+ *  uninstall; dist-tag has no abbreviation, every prefix of it being
+ *  ambiguous with dist-tags. */
+function npmCommand(first) {
+    if (first === undefined || first.length < 2 || first === "un")
+        return first;
+    return ["publish", "unpublish", "deprecate"].find((w) => w.startsWith(first)) ?? first;
+}
+function registryWrite(pm, args) {
+    const words = args.map((a) => a.text);
+    const first = words.find((w) => !w.startsWith("-"));
+    if (first === "run" || first === "run-script")
+        return false;
+    if (pm === "yarn") {
+        // berry spells the registry commands `yarn npm …`; classic has no
+        // unpublish or deprecate, and its publish takes no dry run
+        const berry = words.includes("npm");
+        if (words.includes("publish") && !(berry && dryRun(words, true)))
+            return true;
+        const tag = words.indexOf("tag");
+        return tag !== -1 && tagWrite(words, tag, YARN_TAG_WRITES, YARN_TAG_READS);
+    }
+    const command = pm === "npm" ? npmCommand(first) : first;
+    const publishes = words.includes("publish") || words.includes("unpublish") || command === "publish" || command === "unpublish";
+    if (publishes && !dryRun(words, false))
+        return true;
+    if (words.includes("deprecate") || command === "deprecate")
+        return true;
+    const tag = words.findIndex((w) => w === "dist-tag" || w === "dist-tags");
+    return tag !== -1 && tagWrite(words, tag, NPM_TAG_WRITES, NPM_TAG_READS);
+}
+function crossing(argv) {
+    const name = basename(argv[0]?.text ?? "");
+    if (name === "git") {
+        const inv = gitInvocation(argv.slice(1));
+        return inv.sub === "push" && destructivePush(inv.rest);
+    }
+    if (name === "npm" || name === "pnpm" || name === "yarn")
+        return registryWrite(name, argv.slice(1));
+    return false;
+}
+/** Whether a command line crosses the remote boundary — read as the floor
+ *  reads one: past wrappers (sudo, env, timeout), into `sh -c` and eval,
+ *  along every command of a chain. */
+export function isRemoteBoundary(commandLine) {
+    const seen = new Set();
+    const visit = (line, depth) => {
+        const read = parseShellLooseChecked(line);
+        return looseCommands(read.nodes).some(({ argv: raw }) => {
+            const argv = unwrap(raw);
+            const inner = innerLines(argv, homedir());
+            if (inner !== null) {
+                return (depth < MAX_INNER_DEPTH &&
+                    inner.lines.some((l) => {
+                        if (seen.has(l) || seen.size >= MAX_INNER_LINES)
+                            return false;
+                        seen.add(l);
+                        return visit(l, depth + 1);
+                    }));
+            }
+            return crossing(argv);
+        });
+    };
+    return visit(commandLine, 0);
+}
+/** The policy-call form: a shell call whose command crosses. A throw is
+ *  not this reading's to answer — see the head comment. */
+export function isRemoteBoundaryCall(call) {
+    if (call.name !== "shell" || typeof call.input.command !== "string")
+        return false;
+    try {
+        return isRemoteBoundary(call.input.command);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/replay.d.ts

@@ -49,5 +49,5 @@ export declare function turnsOf(events: readonly Ev[]): Ev[][];
  * Replay a session's durable events into the body. Returns the number of
  * turns it found (0: a fresh session — nothing is drawn).
  */
-export declare function replayInto(body: ReplayBody, events: readonly Ev[], W?: number): number;
+export declare function replayInto(body: ReplayBody, events: readonly Ev[], W?: number, what?: (taskId: string) => string | undefined): number;
 export {};

package/dist/replay.js

@@ -20,7 +20,7 @@
  *     the viewer — then any uncovered earlier turns folded as above.
  */
 import { echoText } from "@vincemakes/kiso-tui-cells/render";
-import { taskNoticeRow } from "./task-notice.js";
+import { taskNoticeLines } from "./task-notice.js";
 /** How many turns stay on screen in full. */
 const FULL_TURNS = 2;
 /** A user turn's opening line, or null when this input does not open one
@@ -48,7 +48,7 @@ export function turnsOf(events) {
 }
 /** One turn through the Body — consumeRun's mapping, minus everything that
  *  needs the live process (clocks, tailers, usage, the recap). */
-function replayTurn(body, turn) {
+function replayTurn(body, turn, what) {
     let thinking = false;
     let said = false;
     const results = new Set();
@@ -63,7 +63,8 @@ function replayTurn(body, turn) {
                 if (ask !== null)
                     body.userLine(ask);
                 else if (e.via?.kind === "tasks")
-                    body.notice(taskNoticeRow(e.via.items));
+                    for (const row of taskNoticeLines(e.via.items, what))
+                        body.notice(row);
                 else if (e.source === "system") {
                     body.notice("verification pass");
                     body.notice(`  ${typeof e.content === "string" ? e.content : ""}`);
@@ -124,7 +125,7 @@ const plural = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
  * Replay a session's durable events into the body. Returns the number of
  * turns it found (0: a fresh session — nothing is drawn).
  */
-export function replayInto(body, events, W = 80) {
+export function replayInto(body, events, W = 80, what) {
     // The latest checkpoint: the turns it covers are what the model will
     // read as its summary, not as turns.
     let checkpoint = null;
@@ -146,16 +147,16 @@ export function replayInto(body, events, W = 80) {
         const summary = checkpoint.summary;
         body.fold(`checkpoint · summarizes ${plural(covered.length, "earlier turn")} · ctrl+r to read`, () => {
             for (const t of covered)
-                replayTurn(body, t);
+                replayTurn(body, t, what);
         }, summary);
     }
     if (earlier.length > 0) {
         body.fold(`${plural(earlier.length, "earlier turn")} · ctrl+r to read`, () => {
             for (const t of earlier)
-                replayTurn(body, t);
+                replayTurn(body, t, what);
         });
     }
     for (const t of shown)
-        replayTurn(body, t);
+        replayTurn(body, t, what);
     return total;
 }

package/dist/state.d.ts

@@ -6,6 +6,7 @@
  * the moved modules read and mutate at call time.
  */
 import { Dock, type AtItem, type Body, type PanelVerdict, type PanelView, type SaferAnswer, type SessionCardView } from "@vincemakes/kiso-tui";
+import type { TaskDeliveryItem } from "@vincemakes/kiso-core";
 import type { KisoExtension, StoreRecord } from "@vincemakes/kiso-runtime";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
 import { type ShellTasks } from "@vincemakes/kiso-tools-node";
@@ -34,11 +35,14 @@ export declare function codingToolOptions(): {
     readonly protectedFiles: readonly string[];
     readonly tasks: (sessionId: string | undefined) => ShellTasks | undefined;
 };
+/** Amendment 8: what a session's task ran — a lost task's transcript row
+ *  names it. Undefined when the task or its journal cannot be read. */
+export declare function taskWhatOf(sessionId: string | undefined): (taskId: string) => string | undefined;
+export declare function lostToldOf(sessionId: string): Set<string>;
+/** The transcript lines a delivery shows: a loss already told is left out. */
+export declare function deliveryLines(sessionId: string, items: readonly TaskDeliveryItem[]): string[];
 export declare function tasksFor(sessionId: string | undefined): TaskManager | undefined;
 export declare function setExitTasks(choice: "stop" | "leave"): void;
-/** 3e: the unknown tasks the person has looked at in `/tasks` in this
- *  process — the status row stops counting them. */
-export declare const seenUnknownTasks: Set<string>;
 /** 3e: the live tasks of every session this process opened — a runner's
  *  (`durable`, it survives this process) and moved commands (`moved`). */
 export declare function liveTasks(): {

package/dist/state.js

@@ -14,6 +14,7 @@ import { AT_CAP, AT_SKIP, Dock } from "@vincemakes/kiso-tui";
 import { TaskManager } from "@vincemakes/kiso-runtime/internal";
 import { processTaskBackend } from "@vincemakes/kiso-tools-node";
 import { canonicalPath, LEGACY_SESSIONS_DIR, projectDirFor, projectLayoutActive } from "./projects.js";
+import { taskNoticeLines, taskWhat } from "./task-notice.js";
 /** finding #11: KISO_HOME is the ONE root — every default path derives from
  *  it (sessions, trust, extensions, mcp config, skills). The dedicated
  *  env vars (KISO_EXTENSIONS_DIR / KISO_MCP_CONFIG / KISO_SKILLS_DIR)
@@ -48,6 +49,34 @@ export function codingToolOptions() {
  *  — the `!` gesture — has none, and its shell is today's. */
 const taskManagers = new Map();
 let taskBackend;
+/** Amendment 8: what a session's task ran — a lost task's transcript row
+ *  names it. Undefined when the task or its journal cannot be read. */
+export function taskWhatOf(sessionId) {
+    return (taskId) => {
+        try {
+            const t = tasksFor(sessionId)?.get(taskId);
+            return t === undefined ? undefined : taskWhat(t);
+        }
+        catch {
+            return undefined; // a corrupt journal is reported where it is read on purpose
+        }
+    };
+}
+/** Amendment 8: the lost tasks this process has told the person of, per
+ *  session — when the model's notice of the same loss arrives later, its
+ *  row is not said again. */
+const toldLost = new Map();
+export function lostToldOf(sessionId) {
+    let told = toldLost.get(sessionId);
+    if (told === undefined)
+        toldLost.set(sessionId, (told = new Set()));
+    return told;
+}
+/** The transcript lines a delivery shows: a loss already told is left out. */
+export function deliveryLines(sessionId, items) {
+    const told = lostToldOf(sessionId);
+    return taskNoticeLines(items.filter((i) => !(i.transition === "unknown" && told.has(i.taskId))), taskWhatOf(sessionId));
+}
 export function tasksFor(sessionId) {
     if (sessionId === undefined || activeStoreDir === "")
         return undefined;
@@ -67,9 +96,6 @@ let exitTasks = "stop";
 export function setExitTasks(choice) {
     exitTasks = choice;
 }
-/** 3e: the unknown tasks the person has looked at in `/tasks` in this
- *  process — the status row stops counting them. */
-export const seenUnknownTasks = new Set();
 /** 3e: the live tasks of every session this process opened — a runner's
  *  (`durable`, it survives this process) and moved commands (`moved`). */
 export function liveTasks() {

package/dist/task-notice.d.ts

@@ -1,10 +1,19 @@
 import type { TaskDeliveryItem } from "@vincemakes/kiso-core";
-import type { TaskInfo } from "@vincemakes/kiso-runtime/internal";
-export declare function taskNoticeRow(items: readonly TaskDeliveryItem[]): string;
+import { type TaskInfo } from "@vincemakes/kiso-runtime/internal";
+/** The lines a delivery shows: today's `✦ task t1 exited · t2 failed` for
+ *  the ordinary items, and one `✦ lost track of …` row per lost task. The
+ *  shape is fixed (a design keys on it): the opening `✦ lost track of <id>
+ *  (<what>) — ` — the parenthesis only when the command is known — and the
+ *  LAST ` — ` part opening with "it may still be running". One line each. */
+export declare function taskNoticeLines(items: readonly TaskDeliveryItem[], what?: (taskId: string) => string | undefined): string[];
 /** A task's state in the person's words. A stop that was asked for and is
  *  not yet confirmed reads `stopping` — never `stopped` before the journal
- *  says so; an outcome nobody can know reads `◌ outcome unknown`. */
+ *  says so; a task kiso lost track of says so (Amendment 8). */
 export declare function taskStateLabel(task: TaskInfo): string;
+/** Why kiso lost track of a task, from its journal — or undefined when it
+ *  has not: a stop it could not confirm, a moved command whose kiso ended,
+ *  or a runner that is gone. */
+export declare function lostReason(task: TaskInfo): string | undefined;
 /** What the task is: the command, or the child's role and task. */
 export declare function taskWhat(task: TaskInfo): string;
 /** One `/tasks` row: `t3  running  1m 20s`, with the command beside it. */
@@ -14,9 +23,8 @@ export declare function taskRow(task: TaskInfo, now?: number): {
 };
 /** A task's last `lines` lines of output — or, for a child, its answer. */
 export declare function taskOutput(task: TaskInfo, lines?: number): string[];
-/** The status row's counts: live tasks, and the unknown ones the person
- *  has not looked at in `/tasks` in this process. */
-export declare function taskCounts(tasks: readonly TaskInfo[], seen: ReadonlySet<string>): {
+/** The status row's count: the tasks kiso manages (running or starting).
+ *  A lost task is not counted here (Amendment 8). */
+export declare function taskCounts(tasks: readonly TaskInfo[]): {
     readonly running: number;
-    readonly unknown: number;
 };

package/dist/task-notice.js

@@ -3,19 +3,40 @@
  * on resume. The model reads the notice's own lines; a person reads this.
  *
  * 3e: and what the person sees of the tasks themselves — the `/tasks` rows,
- * a task's output on request, and the counts on the status row. All of it
+ * a task's output on request, and the count on the status row. All of it
  * is drawn on the screen only: no `user_input`, nothing in the session log,
  * nothing the model sees (the model has its notices and `read_file`).
+ *
+ * Amendment 8: a task kiso lost track of (`unknown`) is said in the
+ * person's words — "lost track", and why — as its own transcript row, once;
+ * never a second count on the status row. The model's notice keeps the
+ * protocol's `unknown`.
  */
 import { closeSync, fstatSync, openSync, readFileSync, readSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { readRecords } from "@vincemakes/kiso-runtime/internal";
 import { elapsedLabel } from "@vincemakes/kiso-tui-cells";
-export function taskNoticeRow(items) {
-    return `✦ task ${items.map((i) => `${i.taskId} ${i.transition}`).join(" · ")}`;
+/** The lines a delivery shows: today's `✦ task t1 exited · t2 failed` for
+ *  the ordinary items, and one `✦ lost track of …` row per lost task. The
+ *  shape is fixed (a design keys on it): the opening `✦ lost track of <id>
+ *  (<what>) — ` — the parenthesis only when the command is known — and the
+ *  LAST ` — ` part opening with "it may still be running". One line each. */
+export function taskNoticeLines(items, what) {
+    const rows = [];
+    const ordinary = items.filter((i) => i.transition !== "unknown");
+    if (ordinary.length > 0)
+        rows.push(`✦ task ${ordinary.map((i) => `${i.taskId} ${i.transition}`).join(" · ")}`);
+    for (const i of items) {
+        if (i.transition !== "unknown")
+            continue;
+        const w = what?.(i.taskId)?.split("\n")[0]?.trim();
+        rows.push(`✦ lost track of ${i.taskId}${w ? ` (${w})` : ""} — it may still be running · /tasks shows it`);
+    }
+    return rows;
 }
 /** A task's state in the person's words. A stop that was asked for and is
  *  not yet confirmed reads `stopping` — never `stopped` before the journal
- *  says so; an outcome nobody can know reads `◌ outcome unknown`. */
+ *  says so; a task kiso lost track of says so (Amendment 8). */
 export function taskStateLabel(task) {
     const s = task.state;
     switch (s.kind) {
@@ -26,7 +47,7 @@ export function taskStateLabel(task) {
         case "running":
             return task.stoppedBy !== undefined ? "stopping" : s.ready ? "ready" : "running";
         case "unknown":
-            return "◌ outcome unknown";
+            return "lost track — may still be running";
         case "ended":
             if (s.stopped)
                 return "stopped";
@@ -35,6 +56,26 @@ export function taskStateLabel(task) {
             return s.exitCode !== null ? (s.exitCode === 0 ? "exited 0" : `failed ${s.exitCode}`) : `ended ${s.signal ?? ""}`.trim();
     }
 }
+/** Why kiso lost track of a task, from its journal — or undefined when it
+ *  has not: a stop it could not confirm, a moved command whose kiso ended,
+ *  or a runner that is gone. */
+export function lostReason(task) {
+    if (task.state.kind !== "unknown")
+        return undefined;
+    let records = [];
+    try {
+        records = readRecords(join(dirname(task.outputPath), "journal.jsonl"));
+    }
+    catch {
+        // an unreadable journal: the general reason below
+    }
+    const unconfirmed = records.find((r) => r.type === "stop_unconfirmed");
+    if (unconfirmed !== undefined)
+        return `its stop could not be confirmed (pids ${unconfirmed.pids.join(", ")})`;
+    if (task.backend === "foreground")
+        return "the kiso that held it ended without recording its end";
+    return "its runner is gone without recording its end";
+}
 /** What the task is: the command, or the child's role and task. */
 export function taskWhat(task) {
     return task.agent !== undefined ? task.command : task.command.split("\n")[0];
@@ -71,16 +112,12 @@ export function taskOutput(task, lines = 20) {
         return [];
     }
 }
-/** The status row's counts: live tasks, and the unknown ones the person
- *  has not looked at in `/tasks` in this process. */
-export function taskCounts(tasks, seen) {
+/** The status row's count: the tasks kiso manages (running or starting).
+ *  A lost task is not counted here (Amendment 8). */
+export function taskCounts(tasks) {
     let running = 0;
-    let unknown = 0;
-    for (const t of tasks) {
+    for (const t of tasks)
         if (t.state.kind === "running" || t.state.kind === "starting")
             running += 1;
-        else if (t.state.kind === "unknown" && !seen.has(t.id))
-            unknown += 1;
-    }
-    return { running, unknown };
+    return { running };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vincemakes/kiso-code",
-	"version": "0.46.1",
+	"version": "0.46.2",
 	"description": "kiso-code \u2014 the coding agent on kiso, the durable runtime for AI agents: kiso chat / kiso resume / kiso sessions.",
 	"type": "module",
 	"license": "MIT",
@@ -18,19 +18,19 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-ask-ext": "0.46.1",
-		"@vincemakes/kiso-core": "0.46.1",
-		"@vincemakes/kiso-evals": "0.46.1",
-		"@vincemakes/kiso-mcp-ext": "0.46.1",
-		"@vincemakes/kiso-provider-anthropic": "0.46.1",
-		"@vincemakes/kiso-provider-openai": "0.46.1",
-		"@vincemakes/kiso-provider-openai-responses": "0.46.1",
-		"@vincemakes/kiso-runtime": "0.46.1",
-		"@vincemakes/kiso-skills-ext": "0.46.1",
-		"@vincemakes/kiso-subagent-ext": "0.46.1",
-		"@vincemakes/kiso-tools-node": "0.46.1",
-		"@vincemakes/kiso-tui": "0.46.1",
-		"@vincemakes/kiso-tui-cells": "0.46.1"
+		"@vincemakes/kiso-ask-ext": "0.46.2",
+		"@vincemakes/kiso-core": "0.46.2",
+		"@vincemakes/kiso-evals": "0.46.2",
+		"@vincemakes/kiso-mcp-ext": "0.46.2",
+		"@vincemakes/kiso-provider-anthropic": "0.46.2",
+		"@vincemakes/kiso-provider-openai": "0.46.2",
+		"@vincemakes/kiso-provider-openai-responses": "0.46.2",
+		"@vincemakes/kiso-runtime": "0.46.2",
+		"@vincemakes/kiso-skills-ext": "0.46.2",
+		"@vincemakes/kiso-subagent-ext": "0.46.2",
+		"@vincemakes/kiso-tools-node": "0.46.2",
+		"@vincemakes/kiso-tui": "0.46.2",
+		"@vincemakes/kiso-tui-cells": "0.46.2"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",