@visual-z/xeno 0.7.1 → 0.8.0

package/src/apps/shell.ts

@@ -6,10 +6,13 @@
  * by scripts, while the interactive app projects the durable transcript.
  */
 
+import { criterionSummary, draftGoal, pickCriteria, type PendingGoal } from "./goal-flow.ts";
+import { closeAppSession, switchAppSession } from "./session-lifecycle.ts";
 import { basename, dirname, join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { assertNever } from "../core/exhaustive.ts";
+import type { CounterVerdict } from "../core/acceptance.ts";
 import type { LogEvent } from "../core/events.ts";
 import type { Skill } from "../core/skills.ts";
 import { workReadiness } from "../core/work-state.ts";
@@ -29,7 +32,7 @@ import {
   type ContextDecision, type ContextLimits, type ContextPolicy, type GaugeLevel,
 } from "../core/context-policy.ts";
 import { anchoredCount, estimateTokens, type Anchor, type TokenCounter } from "../core/tokens.ts";
-import type { RestorePoint, RewindMode } from "../runtime/loop.ts";
+import type { RestorePoint, RewindMode, RequestOptions } from "../runtime/loop.ts";
 import { createProvider, providerSessionId, findModelByPattern, groupedModels, loadCatalog } from "../runtime/catalog.ts";
 import { outputTokenBudget, type Effort, type ModelSpec } from "../runtime/model.ts";
 import { scopedModels } from "../runtime/model-scope.ts";
@@ -335,10 +338,10 @@ async function fileIndexFor(app: App, refresh = false): Promise<FileIndex> {
 
 export async function runPrompt(app: App, prompt: string): Promise<void> {
   await bindExtensions(app);
-  if (app.shutdownRequested) { await app.session.dispose(); await app.extensions?.dispose(); return; }
+  if (app.shutdownRequested) { await closeAppSession(app); return; }
   let ok: boolean;
   try { ok = await run(app, prompt); }
-  finally { await app.session.dispose(); await app.extensions?.dispose(); }
+  finally { await closeAppSession(app); }
   printUsage(app);
   // One-shot mode is scriptable, so a failed turn has to be a failed exit.
   if (!ok) process.exit(1);
@@ -387,8 +390,7 @@ async function runLines(app: App): Promise<void> {
     if (typeof outcome === "object") awaitingKeyFor = outcome.login;
   }
   await cancelPendingOAuth(app);
-  await app.session.dispose();
-  await app.extensions?.dispose();
+  await closeAppSession(app);
   printUsage(app);
 }
 
@@ -408,7 +410,8 @@ async function runTui(app: App, releaseEarlyTty?: () => void): Promise<void> {
  */
 export const interactiveHooks = {
   handleLine: (app: App, text: string, ui: Ui) => handleLine(app, text, ui),
-  run: (app: App, prompt: string, signal: AbortSignal | undefined, ui: Ui | undefined, images: readonly ImageRef[] = [], skill?: Skill) => run(app, prompt, signal, ui, images, skill),
+  run: (app: App, prompt: string, signal: AbortSignal | undefined, ui: Ui | undefined, images: readonly ImageRef[] = [], skill?: Skill, options?: RequestOptions) =>
+    run(app, prompt, signal, ui, images, skill, options),
   parseLine: (app: App, text: string) => parseLine(app, text),
   bindExtensions: (app: App, ui?: Ui) => bindExtensions(app, ui),
   extensionContext: (app: App, ui?: Ui) => extensionContext(app, ui),
@@ -503,6 +506,9 @@ async function execute(app: App, command: Command, tui: Ui | null): Promise<Outc
       await app.session.acceptCriterion(command.criterion);
       await printAcceptance(app);
       return "continue";
+    case "goal":
+      await goalCommand(app, command, tui ?? undefined);
+      return "continue";
     case "help":
       printHelp(app);
       return "continue";
@@ -656,7 +662,7 @@ async function execute(app: App, command: Command, tui: Ui | null): Promise<Outc
     }
     case "update":
       if (tui) tui.checkForUpdate();
-      else await runManualUpdate({ offline: app.args.offline === true }, app.io.say);
+      else await runManualUpdate({ offline: app.args.offline === true, install: true }, app.io.say);
       return "continue";
     case "copy":
       await copyLastReply(app, tui ?? undefined);
@@ -693,6 +699,70 @@ async function handleLine(app: App, text: string, tui: Ui): Promise<Outcome> {
   return execute(app, parseLine(app, text), tui);
 }
 
+/**
+ * S.2 / S.5. Line mode keeps a drafted goal until `/goal accept` names the
+ * criteria to keep; the TUI asks with a checklist instead.
+ */
+const pendingGoals = new WeakMap<App, PendingGoal>();
+
+async function goalCommand(app: App, command: Extract<Command, { kind: "goal" }>, tui?: Ui): Promise<void> {
+  const C = app.io.palette;
+  switch (command.action) {
+    case "status": await printGoal(app); return;
+    case "clear": app.io.say(await app.session.clearGoal() ? C.green("  goal cleared") : C.dim("  no active goal")); return;
+    case "set": {
+      if (tui) { tui.startGoal(command.objective); return; }
+      const drafted = await draftGoal(app, command.objective, (prompt, options) => run(app, prompt, undefined, undefined, [], undefined, options));
+      if (!drafted) return;
+      pendingGoals.set(app, drafted);
+      app.io.say(C.bold("\ndrafted criteria") + C.dim("  (accept with /goal accept all, or /goal accept 1,3)"));
+      drafted.criteria.forEach((item, index) => app.io.say(`  ${index + 1}. ${item.id} · ${criterionSummary(item)}`));
+      return;
+    }
+    case "accept": {
+      const drafted = pendingGoals.get(app);
+      if (!drafted) { app.io.say(C.yellow("  no drafted goal; run /goal <objective> first")); return; }
+      const picked = pickCriteria(drafted.criteria, command.pick);
+      if (!picked.ok) { app.io.say(C.yellow(`  ${picked.error}`)); return; }
+      pendingGoals.delete(app);
+      await app.session.setGoal({ ...drafted, accepted: picked.ids });
+      app.io.say(C.green(`  goal set with ${picked.ids.length} accepted criteria`));
+      await run(app, drafted.objective);
+      await printGoal(app);
+      return;
+    }
+    default: return assertNever(command, "goal command");
+  }
+}
+
+async function printGoal(app: App): Promise<void> {
+  const C = app.io.palette, goal = await app.session.goal();
+  if (!goal) { app.io.say(C.dim("  no active goal; /goal <objective> drafts one")); return; }
+  const request = await app.session.requestState();
+  const current = request?.acceptance?.contract_id === goal.contract.id ? request : undefined;
+  app.io.say(C.bold("\ngoal") + `  ${goal.objective}`);
+  for (const item of goal.contract.criteria) {
+    const criterion = current?.criteria.find(entry => entry.id === item.id), status = criterion?.status ?? "not_run";
+    const guard = item.kind === "command" && item.guard === true;
+    app.io.say(`  ${status === "pass" || status === "accepted" ? C.green("✓") : C.yellow("○")} ${item.id}${guard ? " (guard)" : ""} · ${status} · ${item.description}` +
+      (criterion?.counter ? counterSuffix(C, criterion.counter) : ""));
+  }
+  for (const blocker of current?.reported_blockers ?? []) app.io.say(C.yellow(`  reported blocker: ${blocker.reason}`));
+  if (current && current.evidence.independent !== "not_applicable") app.io.say(`  blind checks      ${current.evidence.independent}`);
+}
+
+/** One counter-check verdict after a criterion, in the words of its role (S.7). */
+function counterSuffix(C: App["io"]["palette"], verdict: CounterVerdict): string {
+  switch (verdict) {
+    case "vacuous": return C.yellow(" · also passes without the changes; it does not test them");
+    case "discriminating": return C.green(" · fails without the changes");
+    case "held": return C.green(" · held before the changes too");
+    case "not_held": return C.dim(" · did not hold before the changes; it tests them rather than guarding");
+    case "unavailable": return C.dim(" · counter-check unavailable");
+    default: return assertNever(verdict, "counter verdict");
+  }
+}
+
 function printUsage(app: App): void {
   const C = app.io.palette;
   const t = app.session.totals;
@@ -756,7 +826,10 @@ async function printState(app: App): Promise<void> {
     app.io.say(`  command evidence  ${request.commands.filter(command => command.status === "pass").length} current passes / ${request.commands.length} receipts`);
     app.io.say(`  observations      ${request.progress.observations.length} new; artifact changes ${request.progress.artifact_changes.length}; acceptance advances ${request.progress.acceptance_advances.length}`);
     app.io.say(`  diagnostics       ${request.progress.new_diagnostics.length} new; unchanged retries ${request.progress.unchanged_retries.length}; unknown ${request.progress.unknown_diagnostics.length}`);
-    if (!request.acceptance) app.io.say("  task verification no declared acceptance contract; command success alone does not verify the task");
+    app.io.say(`  evidence          ran ${request.evidence.ran} · discriminating ${request.evidence.discriminating} · independent ${request.evidence.independent} · human ${request.evidence.human}`);
+    for (const gap of request.unmet) app.io.say(`  unmet             ${gap}`);
+    for (const blocker of request.reported_blockers) app.io.say(`  reported blocker  ${blocker.reason}`);
+    if (!request.acceptance) app.io.say("  task verification no declared contract; a fresh check shows only that the changes ran, not that the request was met");
   }
   if (s.handoff) {
     const h = s.handoff;
@@ -805,7 +878,7 @@ async function printAcceptance(app: App): Promise<void> {
     app.io.say(`    build ${target.build_event ?? "none"}; instance ${target.binding ?? "unknown"}; observation ${target.observation ?? "none"}; ${target.reason ?? "start the declared target after its build"}`);
   }
   for (const item of state?.criteria ?? []) {
-    app.io.say(`  ${item.id}: ${item.status} · ${item.description}`);
+    app.io.say(`  ${item.id}${item.kind === "command" && item.guard ? " (guard)" : ""}: ${item.status} · ${item.description}`);
     if (item.kind === "command") app.io.say(`    command: ${item.command}; evidence: ${item.evidence?.event_id ?? "none"}`);
     else if (item.status !== "accepted") app.io.say(`    /accept ${item.id} records your acceptance${item.target ? ` of the observed target ${item.target}` : ""}`);
   }
@@ -841,8 +914,7 @@ async function applySettingsCommand(
   app.io.say(app.io.palette.bold("\nsettings"));
   app.io.say(`  theme             ${s?.theme ?? "dark"}`);
   app.io.say(`  thinking          ${s?.thinking ?? app.providerConfig.effort}`);
-  app.io.say(`  statusBar         ${s?.statusBar === false ? "off" : "on"}`);
-  app.io.say(app.io.palette.dim("  /settings <theme|thinking|statusBar> <value> to change.\n"));
+  app.io.say(app.io.palette.dim("  /settings <theme|thinking> <value> to change; /settings alone opens every option.\n"));
   return "continue";
 }
 
@@ -858,7 +930,7 @@ async function commitSetting(app: App, field: string, value: string, tui: Ui | n
     if (effort) await applyThinking(app, effort, tui);
     return;
   }
-  const parsed = settingPatch(key === "status" ? "statusBar" : field, value);
+  const parsed = settingPatch(field, value);
   if (parsed.diagnostics.length) { app.io.say(C.yellow(parsed.diagnostics.join("\n"))); return; }
   if (key === "theme") {
     const diagnostics: string[] = [];
@@ -1639,25 +1711,7 @@ async function resumeSession(app: App, idOrPath: string, tui?: Ui): Promise<void
 
 async function adoptLogDir(app: App, logDir: string): Promise<boolean> {
   try {
-    app.session.cancel(); await app.session.whenIdle();
-    if (app.extensions && !await app.extensions.releaseIntegrations()) throw Error("An integration still owns unfinished work or unconfirmed cleanup. Wait for it to settle before switching sessions.");
-    const opened = await openSessionFor({ ...app, logDir, fallback: app.providerConfig, interactive: true });
-    await app.session.dispose();
-    await app.extensions?.dispose();
-    app.session = opened.session;
-    app.providerConfig = opened.providerConfig;
-    app.credential = opened.credential;
-    app.logDir = logDir;
-    app.workspace = opened.workspace;
-    app.blobDir = opened.blobDir;
-    app.system = opened.system;
-    app.loadedContext = opened.resources.loadedContext;
-    app.slash = opened.resources.slash;
-    app.ui = opened.resources.ui;
-    app.resources = opened.resources.index;
-    app.projectTrusted = opened.resources.trusted;
-    app.extensions = opened.resources.extensions;
-    app.foundation = opened.resources.foundation;
+    await switchAppSession(app, logDir, (current, target) => openSessionFor({ ...current, logDir: target, fallback: current.providerConfig, interactive: true }));
   } catch (err) {
     app.io.say(app.io.palette.red(`  ${describeError(err)}`));
     return false;
@@ -1793,7 +1847,7 @@ async function nameSession(app: App, name: string, tui?: Ui): Promise<void> {
 }
 
 /** Runs a prompt. Returns false if the turn failed, having already said why. */
-async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Ui, images: readonly ImageRef[] = [], skill?: Skill): Promise<boolean> {
+async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Ui, images: readonly ImageRef[] = [], skill?: Skill, options?: RequestOptions): Promise<boolean> {
   if (app.extensions && !initializedExtensions.has(app.extensions)) await bindExtensions(app, tui);
   for (const result of await app.extensions?.emit("input", { text: prompt, images, source: "interactive" }) ?? []) {
     if (result["action"] === "handled") return true;
@@ -1873,7 +1927,7 @@ async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Ui, ima
     return false;
   }
   try {
-    await runTurn(app, input, signal, tui, skill);
+    await runTurn(app, input, signal, tui, skill, options);
     return true;
   } catch (error) {
     tui?.discardStream();
@@ -1895,6 +1949,7 @@ export async function runTurn(
   signal?: AbortSignal,
   tui?: TurnSurface,
   skill?: Skill,
+  options?: RequestOptions,
 ): Promise<void> {
   // A pipe cannot unwrite bytes. Non-tty / -p therefore does not stream:
   // deltas and discard are ignored, and the final block prints once.
@@ -1914,7 +1969,7 @@ export async function runTurn(
   }
   await registry?.emit("agent_start");
   await registry?.emit("turn_start", { turnIndex: 0 });
-  try { for await (const e of skill ? app.session.sendSkill(skill, prompt, signal) : sessionControl(app.session).send(prompt, signal, pull)) {
+  try { for await (const e of skill ? app.session.sendSkill(skill, prompt, signal) : sessionControl(app.session).send(prompt, signal, pull, options)) {
     // The log retains every response, but a script's final answer must be the
     // accepted last response. A rejected JSON document cannot be unwritten.
     if (e.kind === "turn_start" || e.kind === "discard") finalText = [];
@@ -1943,7 +1998,7 @@ export async function runTurn(
         if (e.kind === "discard") tui.discardStream();
         await tui.syncTranscript();
         if (["assistant_text", "thinking", "tool_call", "tool_result", "done", "cut"].includes(e.kind)) tui.commitStream();
-        if (e.kind === "snapshot_failed" || e.kind === "undeclared_change" || e.kind === "stop_and_ask") {
+        if (e.kind === "stop_and_ask") {
           for (const line of formatEvent(e, app.io.palette, Math.max(20, (process.stdout.columns ?? 80) - 1), {}, app.ui?.style)) app.io.say(line);
         }
       }

package/src/apps/startup.ts

@@ -1,3 +1,6 @@
+import { loadBlindChecks } from "../store/blind-checks.ts";
+import type { BlindChecks } from "../core/blind-checks.ts";
+import { appSessionFields } from "./session-lifecycle.ts";
 import { release } from "node:os";
 import { codingWorkingProtocol } from "../core/continuation.ts";
 import { taskGuidance } from "../core/prompt-policy.ts";
@@ -40,6 +43,7 @@ import { readModelSources, readCatalogCacheText, writeCatalogCache, catalogCache
 import { refreshRemoteCatalog } from "../runtime/models-fetch.ts";
 import { readCursor, writeCursor, type Cursor } from "../store/log.ts";
 import { getBlob } from "../store/blobs.ts";
+import { parseSessionContext } from "../core/session-format.ts";
 import { resolveLogDir, findSessionByPrefix, listSessions, sessionsDir, type ResolveLogOpts } from "../store/sessions.ts";
 import { recoverCut } from "../store/recovery.ts";
 import { planSessionEntry, restoreSessionModel } from "../core/session-entry.ts";
@@ -111,12 +115,12 @@ export function sessionEnvironment(workspace: string): SessionEnvironment {
  * Session policy a CLI coding session differs from a benchmark run in.
  * Benchmarks construct their own SessionConfig and keep the core defaults.
  */
-export function cliSessionConfig(args: Args): { continuationAfter: number; workingSet: true; workingSetVersion: 2; guidanceVersion: 1; strictVerification: true; timeBudgetMs?: number } {
+export function cliSessionConfig(args: Args): { continuationAfter: number; workingSet: true; strictVerification: true; timeBudgetMs?: number } {
   // Never within a request. A real Kimi K3 run with the reminder at reply six
   // spent half its requests on notes after the work was already verified
   // (fix-cli-continuation-noise). The reminder still fires where it earns its
   // place: a resumed handoff that cannot continue, and boundary preparation.
-  return { continuationAfter: Infinity, workingSet: true, workingSetVersion: 2, guidanceVersion: 1, strictVerification: true, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
+  return { continuationAfter: Infinity, workingSet: true, strictVerification: true, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
 }
 
 /**
@@ -190,6 +194,8 @@ export interface Args {
   /** New sessions default to coding; restored context keeps its frozen schemas. */
   toolProfile?: ToolProfile;
   acceptanceFile?: string;
+  /** feat-blind-checks: a directory outside the workspace holding blind.json and its fixtures. */
+  blindChecks?: string;
   excludeTools: string[];
   noTools: boolean;
   /** `--no-builtin-tools`. False when the flag was not passed. */
@@ -288,6 +294,7 @@ const KNOWN_FLAGS: readonly string[] = [
   "--tools", "-t",
   "--tool-profile",
   "--acceptance-file",
+  "--blind-checks",
   "--exclude-tools", "-xt",
   "--no-tools", "-nt",
   "--no-builtin-tools",
@@ -359,7 +366,9 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
   let updateExtensions = false;
   const args: Args = {
     cliFlags: argv.filter(value => value.startsWith("-")),
-    workspace: process.cwd(), logDir: "", maxTurns: 40, prompt: "",
+    // No default request cap (S.6 item 1): the stall watchdog ends a run that
+    // stops producing evidence; --max-turns or an agent budget sets a hard cap.
+    workspace: process.cwd(), logDir: "", maxTurns: Infinity, prompt: "",
     // Overridable so a node boundary can be forced in a short session --
     // otherwise cutting is only reachable after tens of thousands of tokens,
     // which makes the most interesting path the least exercised one.
@@ -443,6 +452,10 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
     else if (a === "--system-prompt") args.systemPrompt = argv[++i] ?? "";
     else if (a === "--append-system-prompt") args.appendSystemPrompt.push(argv[++i] ?? "");
     else if (a === "--tools" || a === "-t") args.tools = parseToolList(argv[++i] ?? "");
+    else if (a === "--blind-checks") {
+      const path = argv[++i]; if (!path || path.startsWith("--")) throw new Error("--blind-checks requires a directory outside the workspace");
+      args.blindChecks = path;
+    }
     else if (a === "--acceptance-file") {
       const path = argv[++i]; if (!path || path.startsWith("--")) throw new Error("--acceptance-file requires a JSON path");
       args.acceptanceFile = path;
@@ -942,6 +955,7 @@ export function createSessionFor(opts: {
   extensions?: ExtensionRegistry;
   foundation?: FoundationRuntime;
   acceptanceContract?: AcceptanceContract;
+  blindChecks?: BlindChecks;
   skills?: readonly Skill[];
 }): Session {
   const { args, workspace, logDir, blobDir, system, providerConfig, credential, io, askSlot } = opts;
@@ -975,6 +989,7 @@ export function createSessionFor(opts: {
       ...cliSessionConfig(args),
       ...(opts.skills ? { skills: opts.skills } : {}),
       ...(opts.acceptanceContract ? { acceptanceContract: opts.acceptanceContract } : {}),
+      ...(opts.blindChecks ? { blindChecks: opts.blindChecks } : {}),
       // Explicit legacy thresholds still select that experiment unless overridden.
       contextPolicy: args.contextPolicy ?? (args.trigger > 0 ? "segmented" : DEFAULT_CONTEXT_POLICY),
       ...(args.trigger > 0
@@ -1115,26 +1130,16 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   if (priorCursor?.context_ref) {
     const savedContext = await getBlob(join(opts.logDir, "artifacts"), priorCursor.context_ref);
     if (!savedContext) throw Error("missing frozen session context");
-    const metadata: unknown = JSON.parse(savedContext);
-    if (metadata && typeof metadata === "object") {
-      if (!("agentProfile" in metadata) && !opts.args.cliFlags?.includes("--workflow") && "workflowMode" in metadata) {
-        if (metadata.workflowMode !== "build" && metadata.workflowMode !== "plan") throw Error("unsupported saved workflow mode");
-        opts.args.workflow = metadata.workflowMode;
-      }
-      if ("workflowToolProfile" in metadata && metadata.workflowToolProfile !== undefined) {
-        if (metadata.workflowToolProfile !== "foundation") throw Error("unsupported saved workflow tool profile");
-        if (!opts.args.cliFlags?.some(flag => ["--tool-profile", "--tools", "-t", "--no-tools", "--no-builtin-tools"].includes(flag))) opts.args.toolProfile = "foundation";
-      }
-    }
-    if (metadata && typeof metadata === "object" && "agentProfile" in metadata && metadata.agentProfile !== undefined) {
-      const role = metadata.agentProfile;
-      if (!role || typeof role !== "object" || !("name" in role) || typeof role.name !== "string" || !/^[a-z][a-z0-9_-]{0,63}$/.test(role.name) || !("workflowExplicit" in role) || typeof role.workflowExplicit !== "boolean") throw Error("unsupported saved agent profile selector");
-      if (!opts.args.cliFlags?.includes("--agent")) opts.args.agent = role.name;
-      if (role.workflowExplicit && !opts.args.cliFlags?.includes("--workflow") && "workflowMode" in metadata) {
-        if (metadata.workflowMode !== "build" && metadata.workflowMode !== "plan") throw Error("unsupported saved workflow mode");
-        opts.args.workflow = metadata.workflowMode; opts.args.cliFlags = [...opts.args.cliFlags ?? [], "--workflow"];
+    // S.3: the same parser Session.start uses; there is one reader of this format.
+    const saved = parseSessionContext(JSON.parse(savedContext));
+    const explicit = (...flags: string[]) => opts.args.cliFlags?.some(flag => flags.includes(flag)) === true;
+    if (saved.agentProfile) {
+      if (!explicit("--agent")) opts.args.agent = saved.agentProfile.name;
+      if (saved.agentProfile.workflowExplicit && saved.workflowMode && !explicit("--workflow")) {
+        opts.args.workflow = saved.workflowMode; opts.args.cliFlags = [...opts.args.cliFlags ?? [], "--workflow"];
       }
-    }
+    } else if (saved.workflowMode && !explicit("--workflow")) opts.args.workflow = saved.workflowMode;
+    if (saved.workflowToolProfile && !explicit("--tool-profile", "--tools", "-t", "--no-tools", "--no-builtin-tools")) opts.args.toolProfile = "foundation";
   }
   const workspace = priorCursor?.workspace ?? opts.workspace;
   if (opts.args.pathRoot) {
@@ -1196,6 +1201,8 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   const oauth = (model: ModelSpec, got: Resolved) => got.ok && storedIsOAuth(opts.auth, model.provider) && opts.args.apiKey.length === 0;
   const acceptanceContract = priorCursor === null
     ? await loadAcceptanceContract(workspace, resources.trusted, opts.args.acceptanceFile) : undefined;
+  // Frozen at session start like the contract; a resumed session reads its own copy from the saved context.
+  const blindChecks = priorCursor === null && opts.args.blindChecks ? await loadBlindChecks(opts.args.blindChecks, workspace) : undefined;
   const session = createSessionFor({
     ...opts,
     system: resources.system,
@@ -1203,6 +1210,7 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
     foundation: resources.foundation,
     skills: [...resources.slash.skills.values()],
     ...(acceptanceContract ? { acceptanceContract } : {}),
+    ...(blindChecks ? { blindChecks } : {}),
     workspace: priorCursor?.workspace ?? opts.workspace,
     blobDir: priorCursor?.blob_dir ?? (priorCursor?.workspace && priorCursor.workspace !== opts.workspace
       ? statePaths(priorCursor.workspace, opts.args.stateDir).blobs : opts.blobDir),
@@ -1429,7 +1437,6 @@ export async function startup(args: Args, input?: StartupInput): Promise<App> {
       sessionOpts = { explicit: picked };
     }
     const resolved = await resolveLogDir(workspace, sessionOpts);
-    if (resolved.legacyNotice !== null && !args.logDir) io.say(C.yellow(`  ${resolved.legacyNotice}`));
     logDir = resolved.logDir;
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
@@ -1483,13 +1490,7 @@ export async function startup(args: Args, input?: StartupInput): Promise<App> {
     tools: visible.map((t) => t.name),
   });
 
-  return {
-    args, session, workspace: opened.workspace, logDir, blobDir: opened.blobDir, system: opened.system, providerConfig, credential,
-    auth, effects, loadedContext: opened.resources.loadedContext, credentialOf, catalog, io, askSlot,
-    ui: opened.resources.ui, slash: opened.resources.slash, resources: opened.resources.index, projectTrusted: opened.resources.trusted,
-    extensions: opened.resources.extensions,
-    foundation: opened.resources.foundation,
-  };
+  return { args, logDir, auth, effects, credentialOf, catalog, io, askSlot, ...appSessionFields(opened) };
 }
 
 /** The banner's words for the shared limits; the loop acts at exactly these numbers. */
@@ -1588,7 +1589,7 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [-n|--name name] [--session-id id] [--version|-v]\n" +
           "            [models --refresh]\n" +
           "            [install|remove <source>... [--local]] [update [source] [--extensions]] [list]\n" +
-          "            [update --check]  Check for a newer xeno without installing\n" +
+          "            [update --check]  Check for a newer xeno without installing (/update installs)\n" +
           "            [config [--local]] [--export session [output.html]] [--offline]\n" +
           "            [--system-prompt <text-or-file>] [--append-system-prompt <text>]\n" +
           "            [--no-context-files|-nc]\n" +
@@ -1596,7 +1597,7 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [--tool-profile coding|readonly|research|data|foundation|full]\n" +
           "            [--workflow build|plan] [--agent name]\n" +
           "            [--output-schema schema.json] [--output-last-message file]\n" +
-          "            [--acceptance-file contract.json]\n" +
+          "            [--acceptance-file contract.json] [--blind-checks dir]\n" +
           "            [--control-socket /private/directory/control.sock]\n" +
           "            [--no-builtin-tools]\n" +
           "            [--allow-tools names] [--yolo|-y] [--approve|--no-approve]\n" +

package/src/apps/ui/app.ts

@@ -10,6 +10,10 @@
  * either rebuilt from the log (transcript) or deliberately lost on exit
  * (draft queue that was never sent, scroll position).
  */
+import { ladderView } from "./control-model.ts";
+import { criterionSummary, draftGoal } from "../goal-flow.ts";
+import type { RequestOptions } from "../../runtime/loop.ts";
+import { closeAppSession } from "../session-lifecycle.ts";
 import { homedir } from "node:os";
 import { basename, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -29,7 +33,7 @@ import { DISPLAY_SETTINGS, settingValue, settingValues } from "../../core/settin
 import { THINKING_LEVELS, asThinkingLevel, supportedThinkingLevels } from "../../core/thinking.ts";
 import { builtinTheme } from "../../core/theme.ts";
 import { projectTranscript, type TranscriptItem } from "../../core/transcript.ts";
-import { DEFAULT_FULLSCREEN_EXIT_OUTPUT, sessionExitStatus } from "../../core/session-exit.ts";
+import { DEFAULT_FULLSCREEN_EXIT_OUTPUT, resumeCommand, sessionExitStatus } from "../../core/session-exit.ts";
 import { lastAssistantText } from "../../core/export.ts";
 import type { PermissionRequest } from "../../core/permissions.ts";
 import type { ApprovalChoice } from "../../runtime/tools.ts";
@@ -37,14 +41,17 @@ import { attachImageBytes, attachImageFile } from "../../runtime/images.ts";
 import { readClipboard, writeClipboard, type ClipboardContent } from "../../runtime/clipboard.ts";
 import { highlightCode, transformMermaid, warmSyntaxLanguages } from "../../runtime/rich-text.ts";
 import { SOURCE_PROVIDERS } from "../../runtime/model-data.ts";
-import { SUBSCRIPTION_OPTIONS, subscriptionById, loginGitHubCopilot, startCallbackServer, XENO_VERSION } from "../../runtime/oauth.ts";
+import { SUBSCRIPTION_OPTIONS, subscriptionById, loginGitHubCopilot, startCallbackServer } from "../../runtime/oauth.ts";
+import { XENO_VERSION } from "../../runtime/version.ts";
 import { reportedCost } from "../../runtime/usage.ts";
 import { UpdateChecks } from "../update-check.ts";
 import { updateNotice } from "../../core/update-check.ts";
+import { assertNever } from "../../core/exhaustive.ts";
 import { isUpgrade } from "../../core/version.ts";
 import type { Effort } from "../../runtime/model.ts";
 import { readNode, readCursor, setSessionLabel } from "../../store/log.ts";
 import { readNodeHistory } from "../../store/restore.ts";
+import { sessionsDir } from "../../store/sessions.ts";
 import { readGitStatus } from "../../store/git-status.ts";
 import type { GitStatus } from "../../core/git-status.ts";
 import { activityStatus } from "../../core/activity-status.ts";
@@ -361,13 +368,17 @@ export class InteractiveApp implements Ui {
   checkForUpdate(): void {
     // The explicit action owns its result even when it joins a startup request.
     this.manualUpdateRequested = true;
-    void this.updateChecks.manual({ offline: this.app.args.offline === true }, (text, tone) => {
+    void this.updateChecks.manual({ offline: this.app.args.offline === true, install: true }, (text, tone) => {
       if (!this.disposed) this.notice(text, tone);
     }, activity => {
       if (this.disposed) return;
-      this.screen.setTransientActivity(activity.state === "checking" ? {
-        label: `Checking for xeno updates (current ${activity.current})`, timeoutMs: activity.timeoutMs,
-      } : undefined);
+      switch (activity.state) {
+        case "checking": this.screen.setTransientActivity({ label: `Checking for xeno updates (current ${activity.current})`, timeoutMs: activity.timeoutMs }); break;
+        case "installing": this.screen.setTransientActivity({ label: `Installing xeno ${activity.version}`, timeoutMs: activity.timeoutMs,
+          startedAt: activity.startedAt, ...(activity.detail ? { detail: activity.detail } : {}) }); break;
+        case "idle": this.screen.setTransientActivity(undefined); break;
+        default: assertNever(activity, "manual update activity");
+      }
     }).catch(() => {
       if (!this.disposed) {
         this.screen.setTransientActivity(undefined);
@@ -590,6 +601,7 @@ export class InteractiveApp implements Ui {
         status: this.controlSnapshot.goal.state.status,
         execution: this.inflight ? "running" : this.controlSnapshot.goal.state.execution?.reason ?? "idle",
         observations: this.controlSnapshot.goal.state.progress.observations.length,
+        ...ladderView(this.controlSnapshot.goal.state),
         retries: this.controlSnapshot.goal.state.progress.unchanged_retries.length } } : {}),
       files: this.files,
       resources: { contextFiles: app.loadedContext.agents.map(file => basename(file.path)), skills: app.slash?.skills.size ?? 0, extensions: app.extensions?.loaded.length ?? 0 },
@@ -846,7 +858,31 @@ export class InteractiveApp implements Ui {
     this.paint();
   }
 
-  private async runPromptTurn(text: string, images: readonly ImageRef[] = [], skill?: import("../../core/skills.ts").Skill): Promise<void> {
+  /**
+   * S.2 / S.5. The draft runs as an ordinary, visible and cancellable turn;
+   * its checklist opens once the reply is in. Only the checked criteria
+   * become the goal, and the goal's own request starts from the objective.
+   */
+  startGoal(objective: string): void {
+    this.track(async () => {
+      const pending = await draftGoal(this.app, objective, async (prompt, options) => {
+        await this.runPromptTurn(prompt, [], undefined, options);
+        // A cancelled draft is not a draft to accept, nor one to send back.
+        return this.lastOutcome?.status !== "cancelled";
+      });
+      if (!pending) return;
+      this.push({ kind: "list", title: `Accept the checks for: ${objective}`, multi: true, checked: pending.criteria.map(item => item.id), search: false,
+        items: pending.criteria.map(item => ({ value: item.id, label: item.id, description: criterionSummary(item) })),
+        onSubmitChecked: async ids => {
+          if (ids.length === 0) { this.notice("No criteria accepted; the goal was not set.", "warning"); return; }
+          await this.app.session.setGoal({ ...pending, accepted: ids });
+          this.notice(`Goal set with ${ids.length} accepted ${ids.length === 1 ? "check" : "checks"}.`, "success");
+          this.turn = this.runPromptTurn(objective).catch(error => this.notice(describeError(error), "error"));
+        } });
+    });
+  }
+
+  private async runPromptTurn(text: string, images: readonly ImageRef[] = [], skill?: import("../../core/skills.ts").Skill, options?: RequestOptions): Promise<void> {
     this.abort = new AbortController();
     this.inflight = true;
     this.lastOutcome = undefined;
@@ -855,7 +891,7 @@ export class InteractiveApp implements Ui {
     this.executionKind = text.startsWith("!") ? "bash" : "model";
     this.paint();
     try {
-      const sent = await this.hooks.run(this.app, text, this.abort.signal, this, images, skill);
+      const sent = await this.hooks.run(this.app, text, this.abort.signal, this, images, skill, options);
       if (!sent && !this.app.credential.ok) {
         this.programResult = true; this.program?.update(programStatus({ running: false, waiting: "auth" }));
       }
@@ -1553,7 +1589,7 @@ export async function runInteractive(app: App, hooks: Hooks, releaseEarlyTty?: (
     await ui.closed;
     await ui.settle();
   } finally {
-    try { await app.session.dispose(); await app.extensions?.dispose(); await hooks.cancelPendingOAuth(app); }
+    try { await closeAppSession(app); await hooks.cancelPendingOAuth(app); }
     finally {
       ui.dispose();
       if (!renderer) r.destroy();
@@ -1577,7 +1613,8 @@ async function printExit(app: App): Promise<void> {
     }
   }
   process.stdout.write(`\n  ${history.ok ? sessionExitStatus(events) : "session saved · history unavailable; inspect before continuing"}\n`);
-  process.stdout.write(`\n  resume with: xeno --session ${JSON.stringify(app.logDir)}\n`);
+  const path = resolve(app.logDir);
+  process.stdout.write(`\n  resume with: ${resumeCommand({ id: basename(path), directory: dirname(path), path }, resolve(sessionsDir(process.cwd())))}\n`);
 }
 
 /** The session-start rule first, then the projection (refactor-tui-dock-layout DoD 7). */

package/src/apps/ui/control-model.ts

@@ -1,5 +1,15 @@
 import type { ControlSnapshot } from "../../runtime/session-control.ts";
 import type { ControlPanelModel } from "../../tui/ui/control-panel.ts";
+import type { RequestState } from "../../core/request-state.ts";
+import { evidenceLadder, ladderGlyph, RUNGS } from "../../core/evidence-ladder.ts";
+
+/** The sidebar's compact ladder: rung names with their glyphs, then the reading. */
+export function ladderView(state: RequestState): { ladder?: { glyphs: string; summary: string } } {
+  const ladder = evidenceLadder(state);
+  if (!ladder) return {};
+  const names = { ran: "ran", discriminating: "tests", independent: "blind", human: "human" } as const;
+  return { ladder: { glyphs: RUNGS.map(rung => `${names[rung]} ${ladderGlyph(ladder[rung])}`).join("  "), summary: ladder.summary } };
+}
 
 export function controlModel(snapshot: ControlSnapshot): ControlPanelModel {
   const goal = snapshot.goal, state = goal?.state, context = snapshot.context;
@@ -7,7 +17,7 @@ export function controlModel(snapshot: ControlSnapshot): ControlPanelModel {
   return { thread: snapshot.threadId, turn: snapshot.activeTurnId ?? state?.request.event ?? null,
     goal: goal?.text ?? "Send a request to establish a goal.", status: state?.status ?? "idle",
     execution: snapshot.waiting ? `waiting for ${snapshot.waiting}` : snapshot.activeTurnId ? "running" : state?.execution?.reason ?? "idle",
-    gaps: goal?.gaps ?? [], checks: state?.commands.map(command => `${command.status} · exit ${command.exit} · ${command.command} · ${command.source.node}/${command.source.event}`) ?? [],
+    gaps: [...ladderLines(state), ...goal?.gaps ?? []], checks: state?.commands.map(command => `${command.status} · exit ${command.exit} · ${command.command} · ${command.source.node}/${command.source.event}`) ?? [],
     progress: state ? [
       progress("New observations", state.progress.observations),
       progress("Artifact changes", state.progress.artifact_changes),
@@ -24,3 +34,10 @@ export function controlModel(snapshot: ControlSnapshot): ControlPanelModel {
       (section.recovery ? ` · history(${JSON.stringify(section.recovery)})` : "")),
   };
 }
+
+/** The control panel's goal page spells each rung out on its own line. */
+function ladderLines(state: RequestState | undefined): string[] {
+  const ladder = state ? evidenceLadder(state) : null;
+  if (!ladder) return [];
+  return [`Evidence: ${ladder.summary}`, ...RUNGS.map(rung => `  ${ladderGlyph(ladder[rung])} ${rung}: ${ladder[rung]}`), ""];
+}

package/src/apps/ui/surface.ts

@@ -55,6 +55,8 @@ export interface Ui extends TurnSurface {
   openTree(): Promise<void>;
   openResources(): Promise<void>;
   openControl(tab?: "goal" | "progress" | "context"): Promise<void>;
+  /** S.5: draft criteria for an objective, ask the user which to accept, then work toward them. */
+  startGoal(objective: string): void;
   openTrust(): Promise<void>;
   openAttachments(): void;