blun-king-cli 9.1.597 → 9.1.600

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # BLUN King Changelog
 
+## 9.1.600
+
+- Bound each response-review attempt to 120 seconds while retaining the 30-second default for generic reviewers and the existing maximum of two outer attempts.
+- Allow up to 90 seconds for first meaningful native-review text once per attempt, then renew a 30-second idle budget on meaningful text and ordered release and verification stages without extending the absolute deadline.
+- Preserve cancellation, exact response binding, receipt expiry, and authorization; these changes do not establish a fix for live HTTP 502 errors.
+- Pin AgentSpine 0.73.0 and Translate Native 6.155.0; keep the guard protocol at 6.20.0.
+
+## 9.1.599
+
+Local candidate; not published or installed.
+
+- Show localized personal-memory actions and complete previews of settings changes or remembered text, with terminal control characters escaped.
+- Offer one-shot approval for valid memory changes and rejection only for invalid inputs.
+- Prevent session-wide approval from automatically accepting queued requests that require individual approval.
+
+## 9.1.598
+
+- Distinguish lower-bound input counts from exact counts in upstream context rejections.
+- Reduce the output allowance once for a lower-bound rejection without discarding messages or tools; retain cancellation and bounded retry behavior.
+- Verify moving tokenization thresholds and exact-count counterexamples in the compiled program.
+- Include the previously missing package notes for 9.1.595 through 9.1.597.
+- Restore the original 150 rotating activity words without additional model requests.
+- Keep media payloads out of AgentSpine's text-only hook input while preserving complete model attachments and policy checks.
+
+## 9.1.597
+
+- Classify explicit context-limit errors wrapped in HTTP 502 and allow one corrected request with a smaller output allowance.
+- Preserve messages, tools, cancellation, and the rule against replaying an already-started response.
+- Known limitation: this initial correction treated lower-bound input counts as exact. The additional correction is included in 9.1.598.
+
+## 9.1.596
+
+- Distinguish owner cancellation from automatic turn interruption.
+
+## 9.1.595
+
+- Defer tool and skill descriptions until they are needed, while keeping discovery available.
+- Bound greeting context without deleting saved task history or weakening permissions.
+
 ## 9.1.594
 
 - Preserve private Telegram replies while group messages wait, and retain slash-command routing.

package/README.md

@@ -9,7 +9,7 @@ Voraussetzung ist Node.js 24.15 oder neuer. Die geprüfte Version wird exakt
 installiert:
 
 ```powershell
-npm install -g blun-king-cli@9.1.36
+npm install -g blun-king-cli@9.1.600
 ```
 
 ## Reproduzierbares Staging und Packen
@@ -40,6 +40,22 @@ eingerichtet. Die Anmeldung erfolgt anschließend in der
 Konsole mit `/login` über den BLUN-OAuth-Server. Das Paket erzeugt keine
 statische Anbieter- oder API-Key-Konfiguration.
 
+## Persönliches Gedächtnis
+
+Seit Version 9.1.599 zeigt BLUN King Freigaben für das persönliche Gedächtnis mit übersetzten Aktionstiteln und vollständigen Vorschauen der tatsächlichen Einstellungsänderungen oder des zu speichernden Textes. Gültige Änderungen lassen sich nur einmalig freigeben, ungültige Eingaben nur ablehnen. Eine Sitzungsfreigabe genehmigt solche wartenden Anfragen nicht automatisch. Steuerzeichen werden sichtbar maskiert; der Originalinhalt bleibt unverändert.
+
+## Zeitgrenzen für die Antwortprüfung
+
+Version 9.1.600 begrenzt die Antwortprüfung pro äußerem Prüfversuch auf insgesamt 120 Sekunden. Allgemeine Prüfer behalten die bisherige Frist von 30 Sekunden. Bei der nativen Sprachprüfung stehen nach dem bestätigten Start einmalig bis zu 90 Sekunden für den ersten inhaltlichen Text bereit; auch dabei gilt die Gesamtgrenze. Inhaltlicher Text innerhalb der zulässigen Ausgabelänge sowie die geordneten Übergänge zur Freigabe und zur Belegprüfung setzen die Wartefrist jeweils auf 30 Sekunden zurück, ohne die Gesamtgrenze zu verlängern. Es bleibt bei höchstens zwei äußeren Prüfversuchen.
+
+Abbruch, exakte Bindung an den Antworttext, Belegablauf und Autorisierung bleiben unverändert. Damit ist keine Behebung von HTTP-502-Fehlern im Live-Betrieb nachgewiesen.
+
+## Festgelegte Komponentenstände
+
+- AgentSpine 0.73.0, Commit `38cb94760b19e3a82e7efdf12538a1adf5324964`.
+- Translate Native 6.155.0, Commit `21efc66da8f77992c8c63ac0f145a106c31e7eb2`.
+- Guard-Protokoll unverändert auf 6.20.0.
+
 ## Nachweisbare Arbeitsabläufe
 
 Version 9.1.0 enthält sieben zusätzliche, getrennt nutzbare Befehlsgruppen:

package/agent-spine-plugin/CHANGELOG.md

@@ -58,7 +58,7 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ### Fixed
 
-- King keeps complete instructions within the existing source-reader resource bounds, resolves its isolated profile first, and accounts for JSON escaping without adding an instruction-size gate. Routine hooks, lifecycle receipts and process advisories use quiet `additionalContext`; actual denials and exact source/receipt checks remain unchanged. Synthetic fresh/upgrade probes cover large and combined sources, escaping and byte preservation. Package allowance grows by 4 KiB unpacked for the helper and install checks; packed and file-count limits stay fixed. Live King/macOS acceptance remains separate.
+- King reader overflow stays explicit and non-blocking; sources remain unchanged.
 - The portal/thread lifecycle probe that starts a fresh process now runs outside the shared Windows I/O pool. Its existing assertions and process deadlines are unchanged.
 - The hermetic runner isolates the real host-origin source-attestation probe from concurrent Windows filesystem pressure, preserving its existing fail-closed result and timing boundaries without increasing a timeout.
 - Reuse host-verified, assignment-bound briefing observations in MCP delivery preparation without a second content fetch; keep missing proof advisory and document provider-specific history limits.

package/agent-spine-plugin/docs/host-integration.md

@@ -10,7 +10,7 @@ Provider evidence is not interchangeable. Each adapter separately binds its life
 |---|---|---|---|
 | Project instructions | `CLAUDE.md` hierarchy | `AGENTS.md` hierarchy | `AGENTS.md` through the isolated BLUN profile |
 | Hook package | Native `hooks/hooks.json` | Explicit `hooks/codex.json` | Manifest lifecycle hooks |
-| Verified hook briefing → delivery knowledge | Native `additionalContext` handoff receipt | Native `additionalContext` handoff receipt | Bounded model-only `additionalContext` handoff receipt; live acceptance open |
+| Verified hook briefing → delivery knowledge | Native `additionalContext` handoff receipt | Native `additionalContext` handoff receipt | Native bounded `message` handoff receipt; live acceptance open |
 | Historical transcript enrollment | Bounded registered Claude source | Bounded Codex `sessions` source with verified headers | Protected King agent-wire mapping; live mapping open |
 | Cross-provider evidence handoff | Explicit opt-in; Claude provenance retained | Explicit opt-in; Codex provenance retained | Same contract; live launcher unverified |
 | Native permissions/trust | Host-owned | Host-owned | Host-owned; enforcement of returned block decisions remains externally unverified |
@@ -19,20 +19,6 @@ Provider evidence is not interchangeable. Each adapter separately binds its life
 
 Adapter acceptance uses bounded synthetic A/B sessions and covers restart, source mutation, foreign scope, private exclusion and service failure. Cross-provider recall still needs local opt-in plus `includePriorProviders: true` with `includePriorSessions: true`. Report repository, installed-host and model observations separately.
 
-King preparation, lifecycle receipts and process advisories do not emit visible
-`message` prompts. Required instructions remain byte-exact; `UserPromptSubmit`
-uses model-only `additionalContext`. Other events also return that quiet field;
-whether the host consumes it is a separate lifecycle contract. Actual deny/block
-decisions retain their original error schema.
-King uses the existing source-reader safety bounds of 4 MiB per document and
-8 MiB for the source set, not Codex's 32 KiB instruction cap. When both King
-environment bindings are present, `BLUN_HOME` owns the profile even if an unrelated
-`CODEX_HOME` is inherited. These are resource limits, not recommended file sizes.
-Codex/King internal hook envelopes account for the serialized verified briefing,
-including JSON escaping. King's emitted runtime context remains at most 1200
-bytes; its native instruction loader separately supplies full instructions.
-Claude's existing instruction and context limits remain unchanged.
-
 ## Claude Code
 
 | Component | Path | Purpose |

package/agent-spine-plugin/docs/preflight-recall.md

@@ -6,7 +6,7 @@ The receipt binds agent and optional persona, user, tenant, host, instruction ho
 
 ## Host instructions
 
-Claude Code uses its resolved user and project `CLAUDE.md` hierarchy. Codex uses the corresponding `AGENTS.override.md`/`AGENTS.md` hierarchy. A generic host must explicitly bind `instruction_host` to `claude` or `codex`; AgentSpine does not guess. The mandatory preflight section contains the complete bytes of every active instruction document. The standard budget is 8 KiB, with aggregate overflow up to 16 KiB for Claude or 32 KiB for Codex. King uses its own profile and the existing source-reader resource limits: 4 MiB per source and 8 MiB total, not a recommended instruction size (see [host integration](host-integration.md)). The mode, used bytes, overflow and hard limit are bound into the signed exact-turn receipt and revalidated before consumption. An unreadable, replaced, deleted, resource-oversized, out-of-scope, or symlinked mandatory file blocks immediately with a visible bounded diagnostic instead of degrading to a descriptor or waiting silently.
+Claude Code uses its resolved user and project `CLAUDE.md` hierarchy. Codex uses the corresponding `AGENTS.override.md`/`AGENTS.md` hierarchy. A generic host must explicitly bind `instruction_host` to `claude` or `codex`; AgentSpine does not guess. The mandatory preflight section contains the complete bytes of every loaded instruction document. The standard budget is 8 KiB, with aggregate overflow up to 16 KiB for Claude or 32 KiB for Codex. King uses its own profile and bounded source-reader resources; a rule outside that resource budget remains explicitly unverified without blocking the native-host turn. Loaded bytes, overflow and hard limit are bound into the signed exact-turn receipt and revalidated before consumption. Unreadable, replaced, deleted, out-of-scope or symlinked mandatory files still fail closed.
 
 Claude Code's `InstructionsLoaded` lifecycle event is registered as an additional observability signal, while `UserPromptSubmit` remains the blocking and injection boundary. Codex uses its own manifest-selected hook set without that unsupported Claude-only event. The preflight does not rely on the model remembering to read a file or call a tool.
 

package/agent-spine-plugin/scripts/check-install.js

@@ -12,7 +12,6 @@ import {
   invokeInstalledBlockingProtocols, invokeInstalledBlunPostWriteDigest, invokeInstalledHook
 } from "./check-install-hook.js";
 import { invokeInstalledSelfstarter as runInstalledSelfstarter } from "./check-install-selfstarter.js";
-import { invokeInstalledKingInstructions } from "./check-install-king.js";
 
 function hash(value) {
   return createHash("sha256").update(value).digest("hex");
@@ -365,15 +364,13 @@ export async function checkInstall(root = process.cwd()) {
     await mkdir(userProject, { recursive: true });
     await writeFile(source, "# Existing soul\n\nNever modify me.\n", "utf8");
     await writeFile(join(userProject, "CLAUDE.md"), "# Installed Claude rules\n\nLoad this before every answer.\n", "utf8");
-    const largeCodexRules = `# Installed Codex rules\n\n${"x".repeat(17_590 - 25)}`;
-    await writeFile(join(userProject, "AGENTS.md"), largeCodexRules, "utf8");
+    await writeFile(join(userProject, "AGENTS.md"), `# Installed Codex rules\n\n${"x".repeat(17565)}`, "utf8");
     const protectedInstallSources = [source, join(userProject, "CLAUDE.md"), join(userProject, "AGENTS.md")];
     const sourceHashes = new Map(await Promise.all(protectedInstallSources.map(async (path) => [path, hash(await readFile(path))])));
 
     const fresh = join(workspace, "fresh", "agent-spine");
     await copyBundle(root, fresh);
     const freshResult = await checkHosts(fresh);
-    const freshKing = await invokeInstalledKingInstructions(fresh, join(workspace, "king-fresh"));
     const aliasRoot = join(workspace, "fresh-alias");
     await symlink(join(workspace, "fresh"), aliasRoot, process.platform === "win32" ? "junction" : "dir");
     const aliasResult = await checkHosts(join(aliasRoot, "agent-spine"));
@@ -413,7 +410,6 @@ export async function checkInstall(root = process.cwd()) {
     await removeTree(installed);
     await rename(staging, installed);
     const upgraded = await checkHosts(installed);
-    const upgradedKing = await invokeInstalledKingInstructions(installed, join(workspace, "king-upgrade"));
     const upgradeState = join(workspace, "state-upgrade");
     const upgradedHook = await invokeInstalledHook(installed, userProject, upgradeState, "codex");
     const upgradedBlockingProtocols = await invokeInstalledBlockingProtocols(
@@ -443,7 +439,6 @@ export async function checkInstall(root = process.cwd()) {
       automaticBriefing: { fresh: freshHook, upgrade: upgradedHook },
       blockingProtocols: { fresh: freshBlockingProtocols, upgrade: upgradedBlockingProtocols },
       blunPostWriteDigest: { fresh: freshBlunPost, upgrade: upgradedBlunPost },
-      kingInstructions: { fresh: freshKing, upgrade: upgradedKing },
       automaticAttention: { fresh: freshAttention, upgrade: upgradedAttention },
       automaticSelfstarter: { fresh: freshSelfstarter, upgrade: upgradedSelfstarter },
       automaticChannelWake: { fresh: freshChannelWake, upgrade: upgradedChannelWake },

package/agent-spine-plugin/scripts/hermetic-process.js

@@ -6,6 +6,14 @@ export const TIMEOUT_EXIT_CODE = 124;
 const MAX_CAPTURE_CHARS = 1_000_000;
 const TASKKILL_TIMEOUT_MS = 5_000;
 
+export function selectTestShard(files, spec) {
+  if (!spec) return files;
+  const match = /^([1-9]\d*)\/([1-9]\d*)$/.exec(spec);
+  const index = +match?.[1]; const count = +match?.[2];
+  if (!match || count < 2 || index > count) throw new Error("SHARD");
+  return files.filter((_, i) => i % count === index - 1);
+}
+
 function running(child) {
   return child?.pid && child.exitCode === null && child.signalCode === null;
 }

package/agent-spine-plugin/scripts/release-check.js

@@ -8,8 +8,7 @@ const SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?
 // Includes the bounded user-feedback candidate path; this is not semantic acceptance.
 // Measured code growth before documentation: 1874 packed / 7830 unpacked bytes.
 const MAX_PACKED_BYTES = 544 * 1024;
-// King instruction/handoff fix and copied-install probes add about 4 KiB unpacked.
-const MAX_UNPACKED_BYTES = 2434 * 1024;
+const MAX_UNPACKED_BYTES = 2430 * 1024;
 const REQUIRED_PACKAGE_FILES = [
   "blun.plugin.json", ".claude-plugin/plugin.json", ".codex-plugin/plugin.json", ".mcp.json",
   "CHANGELOG.md", "LICENSE", "README.md", "bin/agentspine.js", "bin/agentspine-mcp.js",
@@ -79,7 +78,7 @@ function validatePackageReport(report, version) {
   assert(typeof item.integrity === "string" && item.integrity.startsWith("sha512-"), "npm pack did not report SHA-512 integrity");
   assert(Number.isInteger(item.entryCount) && item.entryCount > 0 && item.entryCount <= 500, "npm package file count is outside the release limit");
   assert(Number.isInteger(item.size) && item.size > 0 && item.size <= MAX_PACKED_BYTES, "npm package exceeds the 544 KiB packed release limit");
-  assert(Number.isInteger(item.unpackedSize) && item.unpackedSize > 0 && item.unpackedSize <= MAX_UNPACKED_BYTES, "npm package exceeds the 2434 KiB unpacked release limit");
+  assert(Number.isInteger(item.unpackedSize) && item.unpackedSize > 0 && item.unpackedSize <= MAX_UNPACKED_BYTES, "npm package exceeds the 2430 KiB unpacked release limit");
   const paths = (item.files || []).map((file) => file.path);
   assert(paths.length === new Set(paths).size, "npm package contains duplicate paths");
   for (const path of REQUIRED_PACKAGE_FILES) assert(paths.includes(path), `npm package is missing required file: ${path}`);

package/agent-spine-plugin/scripts/run-tests-hermetic.js

@@ -4,16 +4,14 @@ import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { githubErrorCommand } from "./github-actions.js";
-import { configuredTestTimeout, runBoundedProcess } from "./hermetic-process.js";
+import { configuredTestTimeout, runBoundedProcess, selectTestShard } from "./hermetic-process.js";
 
 const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
 const base = await mkdtemp(join(tmpdir(), "agentspine-hermetic-tests-"));
-const testFiles = (await readdir(join(root, "test"))).filter((name) => name.endsWith(".test.js")).sort();
-// Windows process creation and antivirus-backed temporary I/O contend sharply
-// when several hermetic files each spawn MCP children. Preserve the real child
-// deadlines by reducing runner load there, rather than relaxing any deadline.
-const concurrencyCeiling = process.platform === "win32" ? 2 : 4;
-const concurrency = Math.max(1, Math.min(concurrencyCeiling, cpus().length));
+const testFiles = selectTestShard((await readdir(join(root, "test")))
+  .filter((name) => name.endsWith(".test.js")).sort(), process.env.AGENTSPINE_TEST_SHARD);
+const win=process.platform==="win32";
+const concurrency = Math.max(1, Math.min(win ? 3 : 4, cpus().length));
 const testTimeoutMs = configuredTestTimeout();
 const slowTestTimeouts = new Map([
   ["indexed-memory.test.js", 300_000]
@@ -55,10 +53,6 @@ async function runOne(file, mode, index) {
 async function runMode(mode) {
   const indexed = testFiles.map((file, index) => ({ file, index }));
   const results = [];
-  // Installation copies complete bundles, while the MCP and route-lifecycle tests
-  // start real children with fixed deadlines and host-origin enrollment attests a
-  // live source plus signed state. Keep those probes off the shared Windows I/O pool.
-  // Both profiles still run them once, with unchanged assertions and limits.
   const isolatedNames = new Set([
     "assignment-continuation-boundaries.test.js",
     "assignment-continuation.test.js",
@@ -80,6 +74,9 @@ async function runMode(mode) {
     "session-timeline-invocation.test.js",
     "timeline-natural-feedback.test.js"
   ]);
+  if (win) for (const { file } of indexed) {
+    if (file.includes("timeline") || file === "preflight-large-agents.test.js") isolatedNames.add(file);
+  }
   const isolated = indexed.filter(item => isolatedNames.has(item.file));
   const queue = indexed.filter(item => !isolatedNames.has(item.file));
   for (const item of isolated) results.push(await runOne(item.file, mode, item.index));

package/agent-spine-plugin/src/hook.js

@@ -13,22 +13,18 @@ import { syncPersonaRosterFromEnvironment } from "./lib/persona-runtime.js";
 import { captureMustRememberPrompt, recordPreflightFailure, runPreflight, verifyPreflightReceipt } from "./lib/preflight.js";
 import { actionLessonRecall } from "./lib/action-lesson-recall.js";
 import { captureSessionTimelineLifecycle, finalizeUserPromptSessionTimeline } from "./lib/hook-timeline.js";
+import { fitTimelineRecallToHostContext } from "./lib/pre-answer-timeline-recall.js";
 import { timelineToolKind } from "./lib/mcp-timeline-tools.js";
 import { emitTimelineToolGuard, runTimelineToolGuard } from "./lib/timeline-tool-guard.js";
 import { readHookInput, SILENT_OVERSIZE_POST_TOOL_USE, SILENT_OVERSIZE_POST_TOOL_USE_ARG } from "./lib/hook-input.js";
 import { isMainModule } from "./lib/runtime.js";
-import { deliveryActorSession, deliverySuccessEvidence, recordDeliveryToolUse,
-  recordDeliveryWriteIntent } from "./lib/delivery-verification.js";
-import { blockPrompt, blockStop, blunRuntimeContext, blunRuntimeMessage, denyTool, hookOutput,
-  lifecycleOutput } from "./lib/hook-output.js";
+import { deliveryActorSession, deliverySuccessEvidence, recordDeliveryToolUse, recordDeliveryWriteIntent } from "./lib/delivery-verification.js";
+import { blockPrompt, blockStop, blunRuntimeContext, blunRuntimeMessage, denyTool, hookOutput, lifecycleOutput } from "./lib/hook-output.js";
 import { ATTENTION_WRITE_EVENTS, boundedId, captureAttentionLifecycle, hookDeliveryId, hostContextLimit, hostFromInput,
-  promptFromInput, renderContext, runtimeScope, selfstarterInput, selfstarterRootSkipped,
-  selfstarterScope, sessionId, startChannelEvent, startSelfstarter, toolResult,
-  toolSucceeded } from "./lib/hook-context.js";
-import { auditGuard, auditSkippedScans, candidatePaths, finishScanFailure, hookScanFailureFailsOpen,
-  isMutationTool, isScanFailOpenTool, shellTargetsProtected } from "./lib/hook-protection.js";
-import { captureJavaScriptBeforeWrite, inspectWrittenJavaScript, verifyBaselineBeforeWrite,
-  verifyDeliveredArtifacts } from "./lib/hook-artifact-guards.js";
+  promptFromInput, renderContext, runtimeScope, selfstarterInput, selfstarterRootSkipped, selfstarterScope, sessionId,
+  startChannelEvent, startSelfstarter, toolResult, toolSucceeded } from "./lib/hook-context.js";
+import { auditGuard, auditSkippedScans, candidatePaths, finishScanFailure, hookScanFailureFailsOpen, isMutationTool, isScanFailOpenTool, shellTargetsProtected } from "./lib/hook-protection.js";
+import { captureJavaScriptBeforeWrite, inspectWrittenJavaScript, verifyBaselineBeforeWrite, verifyDeliveredArtifacts } from "./lib/hook-artifact-guards.js";
 import { isPremortemWrite, prepareHookPremortem, recordHookPremortemWrite,
   recordHookPremortemWriteIntent, verifyHookPremortemWrite } from "./lib/hook-premortem.js";
 import { verifyHookStopContracts } from "./lib/hook-stop-verification.js";
@@ -38,7 +34,7 @@ export { blunRuntimeContext, blunRuntimeMessage } from "./lib/hook-output.js";
 const CONTEXT_EVENTS = new Set(["SessionStart", "UserPromptSubmit", "PreCompact", "PostCompact"]);
 const KNOWN_EVENTS = new Set([...CONTEXT_EVENTS, "InstructionsLoaded", "PreToolUse", "PostToolUse", "Stop", "SubagentStop"]);
 async function writeContextOutput(output, host) {
-  const field = Object.hasOwn(output.hookSpecificOutput, "message") ? "message" : "additionalContext", content = output.hookSpecificOutput[field];
+  const field = Object.hasOwn(output.hookSpecificOutput, "additionalContext") ? "additionalContext" : "message", content = output.hookSpecificOutput[field];
   await new Promise((resolveWrite, rejectWrite) => process.stdout.write(`${JSON.stringify(output)}\n`, (error) => error ? rejectWrite(error) : resolveWrite()));
   return { schema: "agentspine.host-context-handoff/v1", host, field, bytes: Buffer.byteLength(content), digest: createHash("sha256").update(content).digest("hex") };
 }
@@ -99,17 +95,15 @@ async function runHookCore(input, payload, options) {
   }
   const root = resolvedSources.projectRoot;
   const catalog = resolvedSources.catalog;
-  const catalogPath = await saveCatalog(catalog), sourceWarning = resolvedSources.diagnostics.warning || null;
-  let scope = null;
-  let selfstarter = null;
-  let channelEvent = null;
-  let learningDelivery = null;
-  let deliveryVerification = null;
-  let artifactGuard = null;
-  let premortem = null;
-  let lessonRecall = null;
-  if (event === "PreToolUse" && isScanFailOpenTool(input.tool_name) && resolvedSources.diagnostics.skipped?.length) {
-    await auditSkippedScans(input, "source-resolution", resolvedSources.diagnostics.skipped);
+  const diagnostics=resolvedSources.diagnostics,catalogPath=await saveCatalog(catalog),sourceWarning=[...new Set([diagnostics.warning,...resolvedSources.unverified.map((item)=>item.message),...(diagnostics.warnings||[]).map((item)=>item.message)].filter(Boolean))].join("\nAgentSpine source warning: ")||null;
+  if (CONTEXT_EVENTS.has(event) && resolvedSources.unverified.length && !catalog.summary.total) {
+    if (payload) return { blocked: false, sourceUnverified: true, sourceWarning };
+    process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: event, message: sourceWarning } })}\n`); return;
+  }
+  let scope = null, selfstarter = null, channelEvent = null, learningDelivery = null;
+  let deliveryVerification = null, artifactGuard = null, premortem = null, lessonRecall = null;
+  if (event === "PreToolUse" && isScanFailOpenTool(input.tool_name) && diagnostics.skipped?.length) {
+    await auditSkippedScans(input, "source-resolution", diagnostics.skipped);
   }
   if (event === "PreToolUse" && isMutationTool(input.tool_name)) {
     const { graph } = await loadGraph(root, catalog);
@@ -129,7 +123,8 @@ async function runHookCore(input, payload, options) {
         }
       }
     }
-    const protectedDocuments = catalog.documents.filter((doc) => protectedRelative.has(doc.relativePath));
+    const protectedDocuments = [...catalog.documents.filter((doc) => protectedRelative.has(doc.relativePath)),
+      ...resolvedSources.unverified.map((item) => ({ path: item.path, relativePath: item.id }))];
     const protectedPaths = new Set(protectedDocuments.map((doc) => resolve(doc.path)));
     const targets = await Promise.all(candidatePaths(input.tool_input || input.tool_args).map(async (path) => {
       const target = resolve(cwd, path);
@@ -141,7 +136,8 @@ async function runHookCore(input, payload, options) {
     const hit = targets.find((path) => protectedPaths.has(path));
     const shellHit = shellTargetsProtected(input, protectedDocuments, cwd, root);
     if (hit || shellHit) {
-      const relativePath = shellHit?.relativePath || catalog.documents.find((doc) => resolve(doc.path) === hit)?.relativePath || hit;
+      const relativePath = shellHit?.relativePath
+        || protectedDocuments.find((doc) => resolve(doc.path) === hit)?.relativePath || hit;
       const reason = `AgentSpine protected source: ${relativePath}. Existing identity, rule, soul, and memory documents are read-only to agents.`;
       if (payload) return { blocked: true, reason };
       denyTool(reason);
@@ -170,7 +166,7 @@ async function runHookCore(input, payload, options) {
       });
     }
   }
-  if (event === "PreToolUse" && !selfstarterRootSkipped(resolvedSources.diagnostics)) {
+  if (event === "PreToolUse" && !selfstarterRootSkipped(diagnostics)) {
     try {
       scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
       const exact = await selfstarterScope(input, scope, root, "effect");
@@ -241,7 +237,7 @@ async function runHookCore(input, payload, options) {
         }
       }
     } else {
-      const activeJob = selfstarterRootSkipped(resolvedSources.diagnostics)
+      const activeJob = selfstarterRootSkipped(diagnostics)
         ? null : await selfstarterScope(input, scope, root, "resume");
       const pauseRequested = Boolean(activeJob && selfstarterInput(input)?.status !== "completed");
       let contracts = await verifyHookStopContracts({
@@ -285,7 +281,7 @@ async function runHookCore(input, payload, options) {
     scope = await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
     attentionEvent = await captureAttentionLifecycle(input, event, root, scope, catalog);
   }
-  if (event === "PostToolUse" && !selfstarterRootSkipped(resolvedSources.diagnostics)) {
+  if (event === "PostToolUse" && !selfstarterRootSkipped(diagnostics)) {
     scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
     const exact = await selfstarterScope(input, scope, root, "effect");
     if (exact) {
@@ -297,7 +293,7 @@ async function runHookCore(input, payload, options) {
   }
   if (["Stop", "SubagentStop"].includes(event)) {
     scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
-    const exact = selfstarterRootSkipped(resolvedSources.diagnostics)
+    const exact = selfstarterRootSkipped(diagnostics)
       ? null : await selfstarterScope(input, scope, root, "resume");
     if (exact && !scope.currentTaskId) scope.currentTaskId = exact.taskId;
     try {
@@ -327,12 +323,12 @@ async function runHookCore(input, payload, options) {
       await syncPersonaRosterFromEnvironment({ root, env: process.env, now: input.timestamp || new Date(), catalog });
       scope ||= await runtimeScope(input, root, resolvedSources.userStateRoot, catalog);
       if (event !== "UserPromptSubmit") {
-        try { resolvedSources.diagnostics.timeline = await captureSessionTimelineLifecycle({ root, event, input, scope,
+        try { diagnostics.timeline = await captureSessionTimelineLifecycle({ root, event, input, scope,
           hostHome: resolvedSources.hostHome, catalog }); }
-        catch (error) { resolvedSources.diagnostics.timeline = { status: "degraded", reason: error.message, authority: "context-only" }; }
+        catch (error) { diagnostics.timeline = { status: "degraded", reason: error.message, authority: "context-only" }; }
       }
       channelEvent = await startChannelEvent(input, event, root, scope, catalog);
-      selfstarter = await startSelfstarter(input, event, root, scope, resolvedSources.diagnostics);
+      selfstarter = await startSelfstarter(input, event, root, scope, diagnostics);
       if (selfstarter?.job && !scope.currentTaskId) scope.currentTaskId = selfstarter.job.taskId;
       if (event === "UserPromptSubmit") {
         const prompt = promptFromInput(input);
@@ -372,14 +368,14 @@ async function runHookCore(input, payload, options) {
         focusActive: true, includeSourceContent: event === "UserPromptSubmit" ? false : !scope.groupId,
         maxBytes: event === "UserPromptSubmit" ? 4096 : scope.config.maxBriefingBytes,
         now: input.timestamp || new Date(),
-        catalog, userStateRoot: resolvedSources.userStateRoot, sourceDiagnostics: event === "UserPromptSubmit" ? null : resolvedSources.diagnostics,
+        catalog, userStateRoot: resolvedSources.userStateRoot, sourceDiagnostics: event === "UserPromptSubmit" ? null : diagnostics,
         prompt: event === "UserPromptSubmit" ? promptFromInput(input) : null, preAnswer: event === "UserPromptSubmit"
       });
       if (event === "PostCompact") {
         try { lessonRecall = await actionLessonRecall({ catalog, event, input, scope }); }
         catch (error) { lessonRecall = { status: "degraded", items: [], reason: error.message, authority: "context-only" }; }
       }
-      let context = renderContext(event, catalog, briefing, signal, attentionEvent, selfstarter, channelEvent, resolvedSources.diagnostics, preflight, lessonRecall);
+      let context = renderContext(event, catalog, briefing, signal, attentionEvent, selfstarter, channelEvent, diagnostics, preflight, lessonRecall);
       if (event === "UserPromptSubmit" && Buffer.byteLength(context) > hostContextLimit(preflight)) {
         throw new Error("mandatory preflight context exceeds the host hook injection limit");
       }
@@ -388,7 +384,7 @@ async function runHookCore(input, payload, options) {
           prompt: promptFromInput(input), now: input.timestamp || new Date() });
         if (!finalized.preflightConsumed) throw new Error("preflight receipt could not be consumed atomically for this exact turn");
         briefingOrigin = finalized.briefingOrigin;
-        resolvedSources.diagnostics.timeline = finalized.timeline;
+        diagnostics.timeline = finalized.timeline;
       }
       if (event === "UserPromptSubmit") {
         const activeCanaries = briefing.learning.filter((item) => ["active", "revalidating"].includes(item.outcomeStatus));
@@ -420,17 +416,21 @@ async function runHookCore(input, payload, options) {
             status: "degraded", receipts: [], reason: error.message, authority: "context-only"
           };
         }
-        const enriched = renderContext(event, catalog, briefing, signal, attentionEvent, selfstarter, channelEvent,
-          resolvedSources.diagnostics, preflight, lessonRecall);
+        const fitted = fitTimelineRecallToHostContext({ timeline: diagnostics.timeline,
+          maximumBytes: hostContextLimit(preflight), render: (timeline) => renderContext(event, catalog, briefing,
+            signal, attentionEvent, selfstarter, channelEvent, { ...diagnostics, timeline },
+            preflight, lessonRecall) });
+        diagnostics.timeline = fitted.timeline;
+        const enriched = fitted.context;
         if (Buffer.byteLength(enriched) <= hostContextLimit(preflight)) context = enriched;
         else if (preflight.learningApplications.status === "degraded") {
           preflight.learningApplications = null;
           context = renderContext(event, catalog, briefing, signal, attentionEvent, selfstarter, channelEvent,
-            resolvedSources.diagnostics, preflight, lessonRecall);
+            diagnostics, preflight, lessonRecall);
         }
       }
       if (payload) return { blocked: false, context, briefing, preflight, signal, attentionEvent, channelEvent, lessonRecall, catalogPath };
-      const output = hookOutput(event, context);
+      const output = hookOutput(event, context, process.env, sourceWarning);
       const handoff = await writeContextOutput(output, process.env.BLUN_PLUGIN_ROOT ? "king"
         : process.env.PLUGIN_ROOT ? "codex" : process.env.CLAUDE_PLUGIN_ROOT ? "claude" : scope.host);
       if (event === "UserPromptSubmit" && briefingOrigin) {
@@ -452,7 +452,7 @@ async function runHookCore(input, payload, options) {
       const context = JSON.stringify({
         schema: "agentspine.hook-context/v1", event, loaded: false, failedClosed: true,
         indexedSources: catalog.summary.total,
-        sourceResolution: resolvedSources.diagnostics,
+        sourceResolution: diagnostics,
         error: error.message,
         instruction: "Do not claim AgentSpine recall succeeded. Continue with the current request under native host rules and run agentspine audit before using remembered context.",
         authority: "context-only"

package/agent-spine-plugin/src/lib/briefing.js

@@ -106,9 +106,12 @@ function feedbackCandidates(values) {
   const fields = ["id", "text", "message", "at",
     ...["provider", "digest", "session"].filter((key) => !shared.includes(key))];
   const expected = { id: "assertion:user-feedback-", message: "timeline-event:" };
-  const prefixes = fields.map((key) => expected[key] || (key === "at"
-    && values.every((item) => /^\d{4}-\d{2}-\d{2}T\d{2}:/.test(item[key]))
-    ? values[0][key].slice(0, 14) : ""));
+  const prefixes = fields.map((key) => {
+    const prefix = expected[key] || (key === "at"
+      && values.every((item) => /^\d{4}-\d{2}-\d{2}T\d{2}:/.test(item[key]))
+      ? values[0][key].slice(0, 14) : "");
+    return values.every((item) => item[key].startsWith(prefix)) ? prefix : "";
+  });
   return { fields, common: Object.fromEntries(shared.map((key) => [key, values[0][key]])), prefixes,
     rows: values.map((item) => fields.map((key, index) => item[key].slice(prefixes[index].length))) };
 }