cairn-ai 0.2.3 → 0.2.5

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cairn",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Token-efficient agent harness with tool readiness for Codex, Claude Code, and Antigravity.",
   "author": {
     "name": "WkNam"
@@ -21,18 +21,13 @@
       "Tool Readiness"
     ],
     "defaultPrompt": [
-      "Use Cairn to create MEMORY.md and PLAN.md for this repository.",
-      "Every agent must read the project-root MEMORY.md before planning, implementation, review, or delegation. Keep MEMORY.md and PLAN.md as short indexes; open only current-task details.",
-      "Resolve Cairn runtime resources only through the installed locator, keep repoRoot separate, and run toolcheck before implementation planning. Tool installation requires explicit approval.",
-      "Run cairn-plan before non-trivial changes. Understand the whole work, split it into executable tasks/sub-tasks, record Light/Heavy Path triage, and finalize a decision-complete implementation plan before editing.",
-      "The user-called/main agent is the orchestrator. Delegate bounded implementation edits to worker subagents when allowed; otherwise the main agent implements and records takeover evidence.",
-      "With a progress-reporting channel, subagents report start, direction, periodic progress, and finish; relay those events immediately. Otherwise relay assignment, waiting, and final completion.",
-      "Delegated agents read MEMORY.md, preserve others' edits, return a final report, and may recursively delegate only bounded work. Capture evidence, close/release the agent, then review its report before completion.",
-      "Implementation/continue requests authorize an active Cairn goal even without the word goal. After MEMORY.md, write an initial plan with triage-plan active; before exploration call update_plan, then create_goal, then start/attach the repository goal. Triage finalizes the repository and UI plans before implementation. Keep roadmap/current-task recovery context; consultation, explanation, and plan-only requests stay goal-free.",
-      "Use a test contract first: spend reasoning on requirements, invariants, boundaries, and failure modes; design executable tests before implementation; make the minimum implementation that passes. Treat tool exit codes and machine summaries as authoritative, and expand context only for failing tests.",
-      "Missing, failed, skipped, stale, or placeholder evidence never completes work. Advance a UI step only after the matching repository task passes bound evidence; workers report only assigned tasks; active is not complete.",
-      "Use goal verify -- <argv>, quiet state mutations, and concise success summaries. Run focused tests and one final full check. Inspect package lifecycle scripts before packaging: run normal npm pack --dry-run by default; never skip content-producing or unknown scripts with --ignore-scripts, and use it only for absent or proven content-neutral scripts while evidence is fresh.",
-      "If blocked, pause/block/cancel explicitly. Answer side questions briefly, then resume the current task unless asked to pause, stop, or switch."
+      "Use Cairn's repository-local MEMORY.md, PLAN.md, and persisted goal state as the recovery spine; every agent reads root MEMORY.md before planning, implementation, review, or delegation.",
+      "For non-trivial work, load the phase skill (cairn-plan, cairn-work, or cairn-review), then restore the active plan and current-task references before acting.",
+      "After compaction, restart, handoff, or delegation, restore MEMORY.md → phase skill → active plan → current task references; do not rely on conversation recall.",
+      "If state, skill, plan, or a required reference is missing, unreadable, or inconsistent, fail closed: do not edit, delegate, or complete work; report or block the discrepancy.",
+      "Missing, failed, skipped, stale, or placeholder evidence never completes work; advance UI state only after bound repository evidence passes.",
+      "Before external-state changes, run dry-run/check and bind the resulting evidence to the current task.",
+      "Answer side questions briefly, then resume the current task unless asked to pause, stop, or switch."
     ]
   }
 }

package/README.de.md

@@ -108,6 +108,8 @@ cairn toolcheck
 
 Der custom marketplace lifecycle hält source und versioned runtime getrennt. Staged validation geht jedem commit voraus, das ownership manifest bindet alle managed digests, und ein Fehler führt zu reverse-order rollback. Modified oder unmanaged artifacts werden preserved und als conflict gemeldet. Cairn ändert nur eigene TOML sections und erzwingt keine öffentlichen feature/agent settings.
 
+Clean uninstall entfernt den Cairn marketplace cache root nur, wenn alle managed scaffold directories leer sind; unmanaged Inhalte bleiben erhalten. Source repository und repository state, das globale `cairn-ai` package, package-manager caches sowie legacy backups/settings außerhalb des aktuellen ownership manifest werden nicht automatisch gelöscht.
+
 Codex verwendet `skills/` und `commands/`. Claude Code verwendet gespiegelte commands und agent definitions unter `.claude/`. Antigravity verwendet `.agents/workflows` und globale skills mirrors.
 
 ## Antigravity Compatibility

package/README.es.md

@@ -108,6 +108,8 @@ cairn toolcheck
 
 El custom marketplace lifecycle mantiene separados source y versioned runtime. Staged validation precede cada commit, el ownership manifest vincula todos los managed digests y un fallo aplica reverse-order rollback. Los artifacts modified o unmanaged se preservan y se reportan como conflict. Cairn modifica solo sus propias TOML sections y no fuerza feature/agent settings públicos.
 
+Clean uninstall elimina el Cairn marketplace cache root solo cuando todos los managed scaffold directories están vacíos; cualquier contenido unmanaged se conserva. No elimina el source repository ni su state, el paquete global `cairn-ai`, los package-manager caches ni legacy backups/settings fuera del ownership manifest actual.
+
 Codex usa `skills/` y `commands/`. Claude Code usa comandos reflejados y definiciones de agentes bajo `.claude/`. Antigravity usa `.agents/workflows` y mirrors globales de skills.
 
 ## Antigravity Compatibility

package/README.fr.md

@@ -108,6 +108,8 @@ cairn toolcheck
 
 Le custom marketplace lifecycle sépare source et versioned runtime. Staged validation précède chaque commit, le ownership manifest lie tous les managed digests et un échec déclenche un reverse-order rollback. Les artifacts modified ou unmanaged sont preserved et signalés comme conflict. Cairn ne modifie que ses propres TOML sections et ne force aucun feature/agent setting public.
 
+Clean uninstall supprime le Cairn marketplace cache root uniquement lorsque tous les managed scaffold directories sont vides ; tout contenu unmanaged est conservé. Il ne supprime ni le source repository et son state, ni le package global `cairn-ai`, les package-manager caches ou les legacy backups/settings hors du ownership manifest courant.
+
 Codex utilise `skills/` et `commands/`. Claude Code utilise les commandes miroir et définitions d'agents sous `.claude/`. Antigravity utilise `.agents/workflows` et les global skills mirrors.
 
 ## Antigravity Compatibility

package/README.ja.md

@@ -108,6 +108,8 @@ cairn toolcheck
 
 custom marketplace lifecycle は source と versioned runtime を分離します。各 commit 前に staged validation を行い、ownership manifest が全 managed digest を結び、失敗時は reverse-order rollback します。modified または unmanaged artifacts は preserve して conflict として報告します。Cairn-owned TOML sections だけを変更し、public feature/agent settings は強制しません。
 
+Clean uninstall は、すべての managed scaffold directory が空の場合に限り Cairn marketplace cache root を削除し、unmanaged content は保持します。source repository と repository state、global `cairn-ai` package、package-manager cache、現在の ownership manifest 外の legacy backup/settings は自動削除しません。
+
 Codex は `skills/` と `commands/` を使います。Claude Code は `.claude/` 配下の mirrored commands と agent definitions を使います。Antigravity は `.agents/workflows` と global skills mirrors を使います。
 
 ## Antigravity Compatibility

package/README.ko.md

@@ -103,7 +103,7 @@ cairn toolcheck
 - `cairn install`: custom marketplace source, versioned Codex runtime cache, Cairn-owned config section, Claude Code mirror, 현재 Antigravity IDE/CLI skill 표면을 transaction으로 설치합니다.
 - `cairn upgrade`: ownership manifest의 installed digest와 현재 값이 같은 항목만 교체하며, staged validation과 역순 rollback을 적용합니다.
 - `cairn doctor`: ownership manifest, managed digest, 유효 Codex feature, 실제 plugin installed/enabled/version, mirror/runtime locator를 수정 없이 진단합니다.
-- `cairn uninstall`: 수정되지 않은 ownership manifest 항목만 제거·복원하고, modified/unmanaged target은 conflict로 보존하며 실패 시 rollback합니다.
+- `cairn uninstall`: 수정되지 않은 ownership manifest 항목만 제거·복원한 뒤 빈 managed cache scaffold를 정리합니다. modified/unmanaged target과 그 상위 디렉터리는 보존하고 commit 전 실패는 rollback합니다.
 - `cairn toolcheck`: 저장소 스택과 필요한 LSP·검증 도구를 확인하며, 승인된 지원 installer만 실행합니다.
 - `cairn goal ...`: 저장소의 영속 goal을 시작·조회·일시정지·재개·차단·취소·완료합니다. 기본 tool-bound 정책은 `goal verify -- <argv>`가 명령을 직접 실행해 성공 증거를 기록합니다. `goal receipt`는 기존 선언 증거를 가져오는 호환 명령입니다.
 - `cairn-memory`: 도메인 지식을 탐색하고 `MEMORY.md`를 갱신합니다.
@@ -117,6 +117,8 @@ cairn toolcheck
 
 `install`과 `upgrade`는 custom marketplace lifecycle을 유지하며 `codex plugin add`를 호출하지 않습니다. candidate를 staging에서 검증한 뒤 commit하고, 모든 managed destination과 digest를 ownership manifest에 기록하며 실패 시 완료된 phase를 역순 rollback합니다. 수정되지 않은 지원 legacy 설치만 release-integrity 검증 뒤 인수하고, 수정되거나 알 수 없는 artifact는 보존한 채 거부합니다. Cairn-owned TOML section만 편집하고 public feature/agent 설정은 강제하지 않습니다. lifecycle command는 교체 대상 cache copy가 아니라 게시/전역 package에서 실행해야 합니다.
 
+Clean uninstall은 모든 managed scaffold가 비었을 때만 recursive 삭제 없이 빈 디렉터리 제거로 Cairn marketplace cache root를 정리합니다. 소스 저장소와 저장소의 `MEMORY.md`/`PLAN.md`/`.cairn` 상태, 전역 `cairn-ai` package, package-manager download cache, legacy backup, 현재 ownership manifest 밖의 legacy shared setting은 지우지 않으며 별도의 명시적 정리 판단이 필요합니다.
+
 Codex는 `skills/`와 `commands/`를 사용합니다. Claude Code는 `.claude/` 아래의 mirror command와 agent definition을 사용합니다. Antigravity는 `.agents/workflows`와 global skills mirror를 사용합니다.
 
 ## Antigravity Compatibility

package/README.md

@@ -111,7 +111,7 @@ cairn toolcheck
 - `cairn install`: transactionally installs the custom marketplace source, versioned Codex runtime cache, Cairn-owned config sections, Claude Code mirrors, and current Antigravity IDE/CLI skill surfaces.
 - `cairn upgrade`: replaces only ownership-manifest entries whose installed digests still match, with staged validation and reverse-order rollback on failure.
 - `cairn doctor`: validates the ownership manifest, managed digests, effective Codex features, actual installed/enabled/version plugin state, and mirror/runtime locators without repairing them.
-- `cairn uninstall`: removes or restores only ownership-manifest entries that remain unmodified; modified or unmanaged targets are preserved as conflicts and failures roll back.
+- `cairn uninstall`: removes or restores only ownership-manifest entries that remain unmodified, then prunes empty managed cache scaffolds; modified or unmanaged targets and their parent directories are preserved, and pre-commit failures roll back.
 - `cairn toolcheck`: detects repository stacks and checks required LSP and verification tools; installation runs only for an approved supported installer.
 - `cairn goal ...`: starts, inspects, pauses, resumes, blocks, cancels, and completes a persisted repository goal; the default tool-bound policy records successful evidence by executing `goal verify -- <argv>`. The legacy `goal receipt` command imports declared evidence only.
 - `cairn-memory`: explores domain knowledge and updates `MEMORY.md`.
@@ -125,6 +125,8 @@ For token-efficient execution, Cairn puts reasoning into a focused executable te
 
 Install and upgrade keep the custom marketplace lifecycle; they do not invoke `codex plugin add`. Candidates are staged and validated before commit, every managed destination and digest is recorded in an ownership manifest, and committed phases roll back in reverse order on failure. An exact unmodified supported legacy installation can be adopted after release-integrity validation; modified or unknown artifacts are preserved and rejected. Cairn edits only its own TOML sections and never forces public feature or agent settings. The source plugin manifest stays validator-friendly; only the installed cache copy gets a `hooks` field. Lifecycle commands must run from the published/global package, not from the cached copy that they replace.
 
+Clean uninstall removes the Cairn marketplace cache root only when every managed scaffold is empty, using empty-directory removal rather than recursive deletion. It does not delete the source repository or repository `MEMORY.md`/`PLAN.md`/`.cairn` state, the global `cairn-ai` package, package-manager download caches, legacy backups, or legacy shared settings outside the current ownership manifest; those require a separate explicit cleanup decision.
+
 Codex uses `skills/` and `commands/`. Claude Code uses mirrored commands and agent definitions under `.claude/`. Antigravity uses `.agents/workflows` and global skills mirrors.
 
 ## Antigravity Compatibility

package/README.pt.md

@@ -108,6 +108,8 @@ cairn toolcheck
 
 O custom marketplace lifecycle separa source e versioned runtime. Staged validation precede cada commit, o ownership manifest vincula todos os managed digests e uma falha aciona reverse-order rollback. Artifacts modified ou unmanaged sao preserved e relatados como conflict. O Cairn altera apenas suas TOML sections e nao forca feature/agent settings publicos.
 
+Clean uninstall remove o Cairn marketplace cache root somente quando todos os managed scaffold directories estao vazios; qualquer conteudo unmanaged e preservado. O source repository e seu state, o package global `cairn-ai`, package-manager caches e legacy backups/settings fora do ownership manifest atual nao sao removidos automaticamente.
+
 Codex usa `skills/` e `commands/`. Claude Code usa comandos espelhados e agent definitions em `.claude/`. Antigravity usa `.agents/workflows` e global skills mirrors.
 
 ## Antigravity Compatibility

package/README.zh.md

@@ -108,6 +108,8 @@ cairn toolcheck
 
 custom marketplace lifecycle 将 source 与 versioned runtime 分离。每次 commit 前执行 staged validation，ownership manifest 绑定全部 managed digests，失败时执行 reverse-order rollback。modified 或 unmanaged artifacts 会 preserve 并报告 conflict。Cairn 只修改自身 TOML sections，不强制 public feature/agent settings。
 
+Clean uninstall 仅在所有 managed scaffold directory 均为空时删除 Cairn marketplace cache root，并保留任何 unmanaged content。它不会自动删除 source repository 及其 state、全局 `cairn-ai` package、package-manager cache，或当前 ownership manifest 之外的 legacy backup/settings。
+
 Codex 使用 `skills/` 和 `commands/`。Claude Code 使用 `.claude/` 下的 mirrored commands 和 agent definitions。Antigravity 使用 `.agents/workflows` 和 global skills mirrors。
 
 ## Antigravity Compatibility

package/agents/explorer.md

@@ -10,6 +10,8 @@ Handle read-only discovery and verification tasks.
 
 Before doing any assigned task, read the project-root `MEMORY.md`. Treat it as the domain knowledge and repository policy index, then read only the relevant `docs/memory/*.md` notes needed for the task.
 
+At the start and after compaction, restart, or handoff, restore context in this order: root `MEMORY.md` → the phase skill named by the assignment → the active plan → current-task references → model guidance recorded by that plan. The assignment must identify the plan and current task whenever persisted work is active. If a required reference is missing, unreadable, or inconsistent with the assignment or goal state, report a blocker and do not perform the assigned discovery or delegate it.
+
 When subagent tools are available, you may recursively delegate bounded read-only sub-tasks to subagents. Every child subagent must read the project-root `MEMORY.md`, keep the assigned scope, and preserve others' edits.
 
 Use for:

package/agents/worker.md

@@ -10,6 +10,8 @@ Handle narrow, focused tasks.
 
 Before doing any assigned task, read the project-root `MEMORY.md`. Treat it as the domain knowledge and repository policy index, then read only the relevant `docs/memory/*.md` notes needed for the task.
 
+At the start and after compaction, restart, or handoff, restore context in this order: root `MEMORY.md` → the phase skill named by the assignment → the active plan → current-task references → model guidance recorded by that plan. The assignment must identify the plan and current task whenever persisted work is active. If a required reference is missing, unreadable, or inconsistent with the assignment or goal state, report a blocker and do not edit, delegate, or claim completion.
+
 When subagent tools are available, you may recursively delegate bounded sub-tasks to subagents. Every child subagent must read the project-root `MEMORY.md`, keep the assigned scope, and preserve others' edits.
 
 Use for:

package/commands/cairn-uninstall.md

@@ -17,4 +17,6 @@ Managed items:
 - Claude Code `cairn-*` commands and agents mirror files.
 - Antigravity IDE/CLI `cairn-*` skills and workflows mirror files.
 
-The source work folder is not deleted. The custom marketplace root is removed last, after external mirrors and config have committed successfully.
+After the transaction commits, Cairn removes empty managed scaffold directories bottom-up and removes the custom marketplace root only after releasing its own lifecycle lock. A directory containing any unmanaged child is preserved; pruning never uses recursive deletion.
+
+The source work folder and repository `MEMORY.md`, `PLAN.md`, `docs/`, and `.cairn/state.json` are not deleted. The globally installed `cairn-ai` package, package-manager download caches, legacy backup files, and legacy shared settings not recorded by the current ownership manifest are also outside this command's scope and require a separate, explicit cleanup decision.

package/docs/model-guidance/README.md

@@ -14,6 +14,7 @@ The goal is not to make prompts long by model. The goal is to stabilize the same
 
 ## Common Rules
 
+- On every fresh entry, compaction recovery, restart, delegation, or handoff, restore context in this order: root `MEMORY.md` → current phase skill → active plan → current-task references → model guidance recorded by the plan. If persisted state or an assignment requires a reference that is missing, unreadable, or inconsistent, fail closed: do not edit, delegate, approve, or complete; report or record a blocker.
 - Keep root `MEMORY.md` and `PLAN.md` as indexes only.
 - Keep repository-specific judgment in `docs/memory/` and `docs/plan/`. Keep Cairn's model guidance in the installed plugin and reference it with `cairn://docs/model-guidance/...`.
 - Preserve proper nouns, file names, variable names, service names, alert names, MCP tool names, and agent names exactly as written.
@@ -36,6 +37,15 @@ The goal is not to make prompts long by model. The goal is to stabilize the same
 - Limit each task to two verification passes by default. After two failed passes, record the blocker or split it into sub-tasks instead of continuing a repeated loop.
 - User-visible responses and generated or updated documentation, plans, and memory artifacts must follow the OS locale unless the user asks for another language.
 
+## Prompt Cache Shape
+
+- Keep `.codex-plugin/plugin.json` `defaultPrompt` as a small, stable policy and recovery kernel. Put detailed bootstrap, delegation, test, package, and verification procedures in the phase skills and this installed guidance.
+- Put static instructions before dynamic goal data. Hook capsules must be deterministic for the same locale, event, and persisted state; prompt text and turn IDs must not change their content.
+- Idle capsules reference root `MEMORY.md` and `cairn-plan`; active-work capsules reference the active plan, current task, and `cairn-work`; all-tasks-complete capsules reference `cairn-review`.
+- A foreign session receives only a generic ownership-conflict capsule on session/prompt events. It must not expose goal, plan, or task details, and it must not make stop hooks block work owned by another session.
+- Character budgets are regression proxies for cache-friendly prompt shape, not measurements of provider cache hits or cost. Cairn does not require provider cache keys, breakpoints, or live API telemetry.
+- Do not add read receipts that claim model attention. Restore references on every re-entry and use readable state plus fresh bound evidence as the enforceable contract.
+
 ## Delegation Defaults
 
 - `explorer`: use for read-only codebase discovery, impact analysis, pattern searches, and read-only verification when available.

package/docs/model-guidance/codex.md

@@ -17,6 +17,7 @@ Codex-family models are strong at small implementation tasks, explicit tool use,
 
 ## Adjustment Rules
 
+- On every fresh entry, compaction recovery, restart, delegation, or handoff, restore root `MEMORY.md` → current phase skill → active plan → current-task references → recorded model guidance. If persisted state or the assignment requires a missing, unreadable, or inconsistent reference, fail closed and report a blocker before editing, delegating, approving, or completing.
 - Do not start implementation without a plan.
 - Do not stop before local implementation solely because subagent tools are unavailable; the main agent takes over implementation directly and records that takeover in evidence.
 - Keep work units small. Split large changes into smaller plan tasks.
@@ -26,6 +27,7 @@ Codex-family models are strong at small implementation tasks, explicit tool use,
 - Do not skip LSP, typecheck, lint, dry-run, or verification because a tool is missing. Try repository-local installation or record the failed install attempt as a blocker.
 - Do not continue an open-ended verification loop. Use at most two verification passes per task unless the plan records a risk-based exception.
 - Write user-visible responses and generated or updated documentation, plans, and memory artifacts in the OS locale unless the user asks for another language.
+- Preserve the stable prompt prefix: keep detailed workflow in phase skills/model guidance, and do not vary a hook capsule with prompt text or turn ID when persisted state is unchanged.
 
 ## Path Guidance
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cairn-ai",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Token-efficient agent harness with tool readiness for Codex, Claude Code, and Antigravity",
   "license": "MIT",
   "author": {

package/scripts/cairn-goal.mjs

@@ -10,6 +10,9 @@ import { assertNoSymlinkComponents, safeMkdir, safeWriteFile, withStateLock } fr
 export const GOAL_STATE_VERSION = 2;
 export const GOAL_STATUSES = new Set(["active", "paused", "blocked", "cancelled", "completed"]);
 export const TASK_STATUSES = new Set(["pending", "active", "blocked", "completed"]);
+export const PLAN_ID_MAX_LENGTH = 128;
+export const TASK_ID_MAX_LENGTH = 64;
+export const RECOVERY_REFERENCE_MAX_LENGTH = 160;
 
 const terminalGoalStatuses = new Set(["cancelled", "completed"]);
 const evidencePolicies = new Set(["declared", "tool-bound"]);
@@ -48,7 +51,7 @@ export async function readGoalState({ root = process.cwd() } = {}) {
 
 export async function startGoal({ root = process.cwd(), goal, planId, tasks, completionCriteria = [], requiredEvidence = defaultGoalEvidence, ownerSessionId = null, evidencePolicy = "tool-bound" } = {}) {
   const normalizedGoal = requiredText(goal, "goal");
-  const normalizedPlanId = requiredText(planId, "planId");
+  const normalizedPlanId = boundedRequiredText(planId, "planId", PLAN_ID_MAX_LENGTH);
   if (!Array.isArray(tasks) || tasks.length === 0) throw new Error("tasks must contain at least one task");
 
   return withStateLock(root, async () => {
@@ -60,6 +63,7 @@ export async function startGoal({ root = process.cwd(), goal, planId, tasks, com
     const now = timestamp();
     const goalId = `goal-${randomUUID()}`;
     const normalizedTasks = tasks.map((task, index) => normalizeTask(task, index, index === 0 ? "active" : "pending"));
+    for (const task of normalizedTasks) assertRecoveryReferenceBudget(normalizedPlanId, task.id);
     const state = {
       schemaVersion: GOAL_STATE_VERSION,
       revision: 1,
@@ -206,7 +210,9 @@ async function recordEvidence({
       || state.goal.planId !== expectedIdentity.planId
     )) throw new Error("Goal identity changed during verification; evidence was not recorded");
     if (expectedIdentity && normalizedScope === "task" && (
-      task?.id !== expectedIdentity.taskId || task?.status !== expectedIdentity.taskStatus
+      task?.id !== expectedIdentity.taskId
+      || task?.status !== expectedIdentity.taskStatus
+      || task?.assignedAgentId !== expectedIdentity.taskAgentId
     )) throw new Error("Verification task changed during verification; evidence was not recorded");
     if (expectedFingerprint && workspaceFingerprint(root, watchPaths) !== expectedFingerprint) {
       throw new Error("Watched workspace changed during verification; evidence was not recorded");
@@ -252,12 +258,15 @@ export async function verifyAndRecord({
   assertGoalMutable(initialState);
   const normalizedTaskId = normalizedScope === "task" ? requiredText(taskId, "taskId") : undefined;
   const initialTask = normalizedScope === "task" ? taskById(initialState, normalizedTaskId) : null;
-  if (initialTask && initialTask.status !== "active") throw new Error(`Verification task must be active: ${initialTask.id}`);
+  if (initialTask && !["active", "completed"].includes(initialTask.status)) {
+    throw new Error(`Verification task must be active or completed: ${initialTask.id}`);
+  }
   const identity = {
     goalId: initialState.goal.id,
     planId: initialState.goal.planId,
     taskId: normalizedTaskId,
     taskStatus: initialTask?.status,
+    taskAgentId: initialTask?.assignedAgentId,
   };
   const initialFingerprint = workspaceFingerprint(root, normalizedWatchPaths);
   const result = runner(normalizedArgv[0], normalizedArgv.slice(1), {
@@ -283,8 +292,11 @@ export async function verifyAndRecord({
   if (!postState || postState.goal.id !== identity.goalId || postState.goal.planId !== identity.planId) {
     throw new Error("Goal identity changed during verification; evidence was not recorded");
   }
-  if (normalizedScope === "task" && taskById(postState, normalizedTaskId).status !== identity.taskStatus) {
-    throw new Error("Verification task is no longer active; evidence was not recorded");
+  if (normalizedScope === "task") {
+    const postTask = taskById(postState, normalizedTaskId);
+    if (postTask.status !== identity.taskStatus || postTask.assignedAgentId !== identity.taskAgentId) {
+      throw new Error("Verification task changed during verification; evidence was not recorded");
+    }
   }
   const command = normalizedArgv.map((value) => JSON.stringify(value)).join(" ");
   const state = await recordEvidence({
@@ -457,7 +469,7 @@ async function mutateGoal(root, mutate) {
 function normalizeTask(task, index, defaultStatus) {
   const source = typeof task === "string" ? { title: task } : task;
   if (!source || typeof source !== "object") throw new Error(`tasks[${index}] must be a string or object`);
-  const id = source.id === undefined ? `task-${index + 1}` : requiredText(source.id, `tasks[${index}].id`);
+  const id = source.id === undefined ? `task-${index + 1}` : boundedRequiredText(source.id, `tasks[${index}].id`, TASK_ID_MAX_LENGTH);
   const title = requiredText(source.title, `tasks[${index}].title`);
   return {
     id,
@@ -495,7 +507,7 @@ function validateState(value) {
   const goal = value.goal;
   requiredText(goal.id, "goal.id");
   requiredText(goal.title, "goal.title");
-  requiredText(goal.planId, "goal.planId");
+  const planId = boundedRequiredText(goal.planId, "goal.planId", PLAN_ID_MAX_LENGTH);
   validGoalStatus(goal.status);
   validEvidencePolicy(goal.evidencePolicy);
   validTimestamp(goal.createdAt);
@@ -511,7 +523,8 @@ function validateState(value) {
   let activeTasks = 0;
   for (const task of value.tasks) {
     if (!task || typeof task !== "object") throw new Error("Each task must be an object");
-    requiredText(task.id, "task.id");
+    const taskId = boundedRequiredText(task.id, "task.id", TASK_ID_MAX_LENGTH);
+    assertRecoveryReferenceBudget(planId, taskId);
     if (ids.has(task.id)) throw new Error(`Duplicate task id: ${task.id}`);
     ids.add(task.id);
     requiredText(task.title, "task.title");
@@ -622,6 +635,19 @@ function requiredText(value, label) {
   return value.trim();
 }
 
+function boundedRequiredText(value, label, maxLength) {
+  const text = requiredText(value, label);
+  if (value !== text) throw new Error(`${label} must not have leading or trailing whitespace`);
+  if (text.length > maxLength) throw new Error(`${label} must be at most ${maxLength} characters`);
+  return text;
+}
+
+function assertRecoveryReferenceBudget(planId, taskId) {
+  if (planId.length + taskId.length > RECOVERY_REFERENCE_MAX_LENGTH) {
+    throw new Error(`planId and taskId must total at most ${RECOVERY_REFERENCE_MAX_LENGTH} characters for exact recovery context`);
+  }
+}
+
 function validGoalStatus(value) {
   if (!GOAL_STATUSES.has(value)) throw new Error(`Invalid goal status: ${value}`);
   return value;

package/scripts/cairn-lifecycle.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createHash, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { realpathSync } from "node:fs";
+import { constants as fsConstants, realpathSync } from "node:fs";
 import {
-  copyFile, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, writeFile,
+  copyFile, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, rmdir, writeFile,
 } from "node:fs/promises";
 import { homedir, hostname, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
@@ -47,7 +47,7 @@ if (isCliEntry()) {
     const command = process.argv[2] ?? "help";
     if (command === "install" || command === "upgrade") await withLifecycleLock(() => install(command));
     else if (command === "doctor") await doctor();
-    else if (command === "uninstall") await withLifecycleLock(uninstall);
+    else if (command === "uninstall") await withLifecycleLock(uninstall, { afterRelease: pruneUninstallRoots });
     else help();
   } catch (error) {
     console.error(`Cairn lifecycle error: ${error.message}`);
@@ -107,7 +107,7 @@ async function install(mode) {
     console.log(`Codex versioned runtime: ${versionedPluginRoot}`);
     console.log(`Ownership manifest: ${ownershipPath}`);
   } catch (error) {
-    await rollback(transaction);
+    if (transaction.state !== "committed") await rollback(transaction);
     throw error;
   }
 }
@@ -119,17 +119,18 @@ async function uninstall() {
   const conflicts = [];
   for (const record of ownership.targets) {
     const current = await targetDigest(record.path, record.type);
-    if (current !== record.installedDigest) conflicts.push(record.path);
+    if (record.type !== "config" && current !== record.installedDigest) conflicts.push(record.path);
   }
   if (conflicts.length > 0) throw new Error(`Refusing to uninstall modified managed artifacts: ${conflicts.join(", ")}`);
   const transaction = await createTransaction();
   try {
     const configRecord = ownership.targets.find((record) => record.type === "config");
-    if (configRecord) {
+    if (configRecord && await exists(configRecord.path)) {
+      const snapshot = await readSharedConfigSnapshot(configRecord.path);
       const staged = join(transaction.stageRoot, "uninstall-config.toml");
       await mkdir(dirname(staged), { recursive: true });
-      await writeFile(staged, removeCairnConfig(await readText(configRecord.path)));
-      await replaceTarget({ ...configRecord, staged }, transaction);
+      await writeFile(staged, removeCairnConfig(snapshot.text));
+      await replaceTarget({ ...configRecord, staged, configSourceDigest: snapshot.digest }, transaction);
     }
     injectFailure("uninstall-after-config");
     for (const phase of ["antigravity", "claude"]) {
@@ -141,11 +142,13 @@ async function uninstall() {
     await removeManagedTarget({ id: "ownership", phase: "manifest", path: ownershipPath, type: "file" }, transaction);
     injectFailure("uninstall-after-ownership");
     await finishTransaction(transaction);
-    console.log(t("uninstallComplete"));
+    injectFailure("uninstall-after-commit");
   } catch (error) {
-    await rollback(transaction);
+    if (transaction.state !== "committed") await rollback(transaction);
     throw error;
   }
+  await pruneUninstallScaffolds();
+  console.log(t("uninstallComplete"));
 }
 
 async function doctor() {
@@ -164,7 +167,7 @@ async function doctor() {
   checks.push(["installed CLI script", await exists(join(versionedPluginRoot, "scripts", "cairn.mjs"))]);
   checks.push(["installed plan template", await exists(join(versionedPluginRoot, "templates", "work-plan.md"))]);
   checks.push(["installed model guidance", await exists(join(versionedPluginRoot, "docs", "model-guidance", "codex.md"))]);
-  const config = await readText(configPath);
+  const config = (await readSharedConfigSnapshot(configPath)).text;
   checks.push(["config marketplace", splitSections(config).some((section) => section.header === "marketplaces.cairn")]);
   checks.push(["config plugin enabled", hasSetting(config, 'plugins."cairn@cairn"', "enabled", "true")]);
   checks.push(["Claude runtime locator", await validRuntimeLocator(claudeRuntimeLocatorPath)]);
@@ -202,7 +205,7 @@ async function ownershipDigestsValid(ownership) {
 
 async function stageInstall(stageRoot) {
   const targets = [];
-  const add = (id, phase, destination, staged, type = "tree") => targets.push({ id, phase, path: destination, staged, type });
+  const add = (id, phase, destination, staged, type = "tree", details = {}) => targets.push({ id, phase, path: destination, staged, type, ...details });
   const sourceStage = join(stageRoot, "codex-source");
   const runtimeStage = join(stageRoot, "codex-runtime");
   await copyPluginCandidate(sourceStage, versionedPluginRoot);
@@ -237,8 +240,9 @@ async function stageInstall(stageRoot) {
 
   const configStage = join(stageRoot, "config.toml");
   const hookStates = await trustedHookStates(runtimeStage);
-  await writeFile(configStage, updateConfig(await readText(configPath), hookStates));
-  add("codex-config", "config", configPath, configStage, "config");
+  const configSnapshot = await readSharedConfigSnapshot(configPath);
+  await writeFile(configStage, updateConfig(configSnapshot.text, hookStates));
+  add("codex-config", "config", configPath, configStage, "config", { configSourceDigest: configSnapshot.digest });
   for (const target of targets) await assertRegularTree(target.staged);
   return targets;
 }
@@ -328,8 +332,10 @@ async function withLifecycleLock(operation, {
   timeoutMs = Number(process.env.CAIRN_LIFECYCLE_LOCK_TIMEOUT_MS ?? DEFAULT_LIFECYCLE_LOCK_TIMEOUT_MS),
   retryMs = 25,
   malformedStaleMs = 30_000,
+  afterRelease,
 } = {}) {
   await mkdir(dirname(lifecycleLockPath), { recursive: true });
+  if (process.env.CAIRN_TEST_PRUNE_LOCK_PARENT_BEFORE_ACQUIRE === "1") await rmdir(dirname(lifecycleLockPath));
   const owner = { schemaVersion: 1, pid: process.pid, hostname: hostname(), nonce: randomUUID(), acquiredAt: new Date().toISOString() };
   const deadline = Date.now() + timeoutMs;
   while (true) {
@@ -342,21 +348,76 @@ async function withLifecycleLock(operation, {
       if (acquired?.nonce !== owner.nonce) throw new Error("Cairn lifecycle lock ownership changed after acquisition");
       break;
     } catch (error) {
+      if (error?.code === "ENOENT") {
+        if (Date.now() >= deadline) throw new Error(`Timed out waiting for Cairn lifecycle lock after ${timeoutMs}ms`);
+        await mkdir(dirname(lifecycleLockPath), { recursive: true });
+        continue;
+      }
       if (error?.code !== "EEXIST") throw error;
       if (await reclaimLifecycleLock(malformedStaleMs)) continue;
       if (Date.now() >= deadline) throw new Error(`Timed out waiting for Cairn lifecycle lock after ${timeoutMs}ms`);
       await delay(Math.min(retryMs, Math.max(1, deadline - Date.now())));
     }
   }
+  let operationSucceeded = false;
   try {
-    return await operation();
+    const result = await operation();
+    operationSucceeded = true;
+    return result;
   } finally {
-    try {
-      const current = parseLifecycleLock(await readFile(lifecycleLockPath, "utf8"));
-      if (current?.nonce === owner.nonce) await rm(lifecycleLockPath, { force: true });
-    } catch (error) {
-      if (error?.code !== "ENOENT") throw error;
+    if (process.env.CAIRN_TEST_REPLACE_LOCK_BEFORE_RELEASE === "1") {
+      await writeFile(lifecycleLockPath, `${JSON.stringify({ ...owner, nonce: randomUUID() })}\n`);
     }
+    const released = await releaseLifecycleLock(owner);
+    if (operationSucceeded && released && afterRelease) await afterRelease();
+  }
+}
+
+async function releaseLifecycleLock(owner) {
+  let current;
+  try {
+    current = parseLifecycleLock(await readFile(lifecycleLockPath, "utf8"));
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+  if (current?.nonce !== owner.nonce) return false;
+  const releasedPath = `${lifecycleLockPath}.released.${owner.nonce}`;
+  try {
+    await rename(lifecycleLockPath, releasedPath);
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+  const released = parseLifecycleLock(await readFile(releasedPath, "utf8"));
+  if (released?.nonce !== owner.nonce) {
+    if (!(await exists(lifecycleLockPath))) await rename(releasedPath, lifecycleLockPath);
+    return false;
+  }
+  await rm(releasedPath, { force: true });
+  return true;
+}
+
+async function pruneUninstallScaffolds() {
+  for (const path of [
+    join(marketplaceRoot, "plugins"),
+    join(marketplaceRoot, pluginName),
+    join(marketplaceRoot, ".agents", "plugins"),
+    join(marketplaceRoot, ".agents"),
+    transactionRoot,
+  ]) await removeEmptyDirectory(path);
+}
+
+async function pruneUninstallRoots() {
+  await removeEmptyDirectory(dirname(lifecycleLockPath));
+  await removeEmptyDirectory(marketplaceRoot);
+}
+
+async function removeEmptyDirectory(path) {
+  try {
+    await rmdir(path);
+  } catch (error) {
+    if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(error?.code)) throw error;
   }
 }
 
@@ -406,6 +467,15 @@ function pidIsAlive(pid) {
 function delay(ms) { return new Promise((resolvePromise) => setTimeout(resolvePromise, ms)); }
 
 async function replaceTarget(target, transaction) {
+  let configProjection = null;
+  if (target.type === "config") {
+    const snapshot = await readSharedConfigSnapshot(target.path);
+    configProjection = cairnConfigProjection((await readSharedConfigSnapshot(target.staged)).text);
+    if (snapshot.digest !== target.configSourceDigest) {
+      await writeFile(target.staged, `${removeCairnConfig(snapshot.text)}${configProjection}`);
+      target.configSourceDigest = snapshot.digest;
+    }
+  }
   const existed = await exists(target.path);
   const backup = join(transaction.backupRoot, String(transaction.entries.length));
   await mkdir(dirname(backup), { recursive: true });
@@ -423,7 +493,30 @@ async function replaceTarget(target, transaction) {
   };
   transaction.entries.push(entry);
   await writeTransactionJournal(transaction);
-  if (existed) await rename(target.path, backup);
+  if (target.type === "config" && process.env.CAIRN_TEST_APPEND_CONFIG_BEFORE_REPLACE) {
+    const snapshot = await readSharedConfigSnapshot(target.path);
+    await writeFile(target.path, `${snapshot.text}${process.env.CAIRN_TEST_APPEND_CONFIG_BEFORE_REPLACE}`);
+  }
+  if (target.type === "config" && process.env.CAIRN_TEST_REMOVE_CONFIG_BEFORE_REPLACE === "1") {
+    await rm(target.path, { force: true });
+  }
+  if (target.type === "config") {
+    let capturedExists = true;
+    try {
+      await rename(target.path, backup);
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+      capturedExists = false;
+    }
+    if (process.env.CAIRN_TEST_CRASH_AFTER_CONFIG_CAPTURE === "1") process.exit(86);
+    const captured = await readSharedConfigSnapshot(backup);
+    if (capturedExists) await writeFile(target.staged, `${removeCairnConfig(captured.text)}${configProjection}`);
+    else await writeFile(target.staged, configProjection);
+    entry.existed = capturedExists;
+    entry.previousDigest = capturedExists ? await targetDigest(backup, target.type) : "missing";
+    entry.expectedNewDigest = await targetDigest(target.staged, target.type);
+    await writeTransactionJournal(transaction);
+  } else if (existed) await rename(target.path, backup);
   await mkdir(dirname(target.path), { recursive: true });
   await rename(target.staged, target.path);
   entry.status = "applied";
@@ -462,7 +555,12 @@ async function rollback(transaction) {
 
 async function finishTransaction(transaction) {
   transaction.state = "committed";
-  await writeTransactionJournal(transaction);
+  try {
+    await writeTransactionJournal(transaction);
+  } catch (error) {
+    transaction.state = "active";
+    throw error;
+  }
   await rm(transaction.root, { recursive: true, force: true });
   await rm(join(transactionRoot, transaction.id), { recursive: true, force: true });
   await rm(transactionPath, { force: true });
@@ -568,6 +666,18 @@ async function rollbackEntries(transaction) {
     const destinationExists = await exists(entry.path);
     const backupExists = await exists(entry.backup);
     if (backupExists) {
+      if (entry.type === "config" && entry.status === "prepared") {
+        const previousConfig = (await readSharedConfigSnapshot(entry.backup)).text;
+        if (destinationExists) {
+          const currentConfig = (await readSharedConfigSnapshot(entry.path)).text;
+          await writeFile(entry.path, `${removeCairnConfig(currentConfig)}${cairnConfigProjection(previousConfig)}`);
+          await rm(entry.backup, { force: true });
+        } else {
+          await mkdir(dirname(entry.path), { recursive: true });
+          await rename(entry.backup, entry.path);
+        }
+        continue;
+      }
       if (!entry.existed) throw new Error(`Cannot recover transaction because an unexpected backup exists: ${entry.path}`);
       if (await targetDigest(entry.backup, entry.type) !== entry.previousDigest) {
         throw new Error(`Cannot recover transaction because its durable backup changed: ${entry.path}`);
@@ -576,8 +686,8 @@ async function rollbackEntries(transaction) {
         const current = await targetDigest(entry.path, entry.type);
         if (current !== entry.expectedNewDigest) throw new Error(`Cannot recover transaction because destination changed: ${entry.path}`);
         if (entry.type === "config") {
-          const currentConfig = await readText(entry.path);
-          const previousConfig = await readText(entry.backup);
+          const currentConfig = (await readSharedConfigSnapshot(entry.path)).text;
+          const previousConfig = (await readSharedConfigSnapshot(entry.backup)).text;
           await writeFile(entry.path, `${removeCairnConfig(currentConfig)}${cairnConfigProjection(previousConfig)}`);
           await rm(entry.backup, { force: true });
           continue;
@@ -586,12 +696,14 @@ async function rollbackEntries(transaction) {
       }
       await mkdir(dirname(entry.path), { recursive: true });
       await rename(entry.backup, entry.path);
+    } else if (entry.type === "config" && entry.status === "prepared" && !destinationExists) {
+      continue;
     } else if (!entry.existed) {
       if (destinationExists) {
         const current = await targetDigest(entry.path, entry.type);
         if (current !== entry.expectedNewDigest) throw new Error(`Cannot recover new transaction target because it changed: ${entry.path}`);
         if (entry.type === "config") {
-          const preserved = removeCairnConfig(await readText(entry.path));
+          const preserved = removeCairnConfig((await readSharedConfigSnapshot(entry.path)).text);
           if (preserved.length > 0) await writeFile(entry.path, preserved);
           else await rm(entry.path, { force: true });
         } else await rm(entry.path, { recursive: true, force: true });
@@ -624,7 +736,7 @@ async function assertTargetsReplaceable(targets, ownership) {
     }
     const record = records.get(target.id);
     if (!record) {
-      if (target.type === "config" && cairnConfigProjection(await readText(target.path)).length === 0) continue;
+      if (target.type === "config" && cairnConfigProjection((await readSharedConfigSnapshot(target.path)).text).length === 0) continue;
       throw new Error(`Refusing to overwrite unmanaged artifact: ${target.path}`);
     }
     if (target.id === "codex-runtime" && ownership?.version !== releaseVersion) {
@@ -632,13 +744,14 @@ async function assertTargetsReplaceable(targets, ownership) {
     }
     if (record.path !== target.path || record.type !== target.type) throw new Error(`Ownership manifest target mismatch: ${target.id}`);
     const current = await targetDigest(target.path, target.type);
-    if (current !== record.installedDigest) throw new Error(`Managed artifact was modified: ${target.path}`);
+    if (target.type !== "config" && current !== record.installedDigest) throw new Error(`Managed artifact was modified: ${target.path}`);
   }
 }
 
 async function assertOwnershipDigests(ownership) {
   for (const record of ownership.targets) {
-    if (await targetDigest(record.path, record.type) !== record.installedDigest) {
+    const current = await targetDigest(record.path, record.type);
+    if (record.type !== "config" && current !== record.installedDigest) {
       throw new Error(`Managed artifact was modified: ${record.path}`);
     }
   }
@@ -742,7 +855,7 @@ function versionedRuntimeRoot(version) {
 async function anyManagedArtifactExists(targets) {
   for (const target of targets) {
     if (!(await exists(target.path))) continue;
-    if (target.type !== "config" || cairnConfigProjection(await readText(target.path)).length > 0) return true;
+    if (target.type !== "config" || cairnConfigProjection((await readSharedConfigSnapshot(target.path)).text).length > 0) return true;
   }
   return false;
 }
@@ -762,7 +875,7 @@ async function adoptLegacy(targets, transaction) {
       }
     }
     if (target.type === "config") {
-      const projection = cairnConfigProjection(await readText(target.path));
+      const projection = cairnConfigProjection((await readSharedConfigSnapshot(target.path)).text);
       if (!projection.includes("[marketplaces.cairn]") || !projection.includes('[plugins."cairn@cairn"]')) {
         throw new Error(`Legacy Cairn config cannot be identified: ${target.path}`);
       }
@@ -859,7 +972,7 @@ async function verifyLegacyMirror(target) {
 
 export async function targetDigest(path, type) {
   if (!(await exists(path))) return "missing";
-  if (type === "config") return sha(cairnConfigProjection(await readText(path)));
+  if (type === "config") return sha(cairnConfigProjection((await readSharedConfigSnapshot(path)).text));
   const info = await lstat(path);
   if (info.isSymbolicLink() || (!info.isFile() && !info.isDirectory())) throw new Error(`Managed artifact is not a regular file/tree: ${path}`);
   if (info.isFile()) return sha(await readFile(path));
@@ -905,19 +1018,60 @@ export function updateConfig(config, hookStates, { marketplacePath = marketplace
 }
 
 export function removeCairnConfig(config) {
-  return splitSections(config).filter((section) => {
-    if (section.header === null) return true;
-    if (section.header === "marketplaces.cairn") return false;
-    if (section.header === 'plugins."cairn@cairn"') return false;
-    return !(section.header.startsWith("hooks.state.") && section.header.includes("cairn@cairn:"));
-  }).map((section) => section.text).join("");
+  return splitSections(config).map((section) => isCairnConfigSection(section)
+    ? splitTrailingTomlTrivia(section.text).trivia
+    : section.text).join("");
 }
 
 function cairnConfigProjection(config) {
-  return splitSections(config).filter((section) => section.header === "marketplaces.cairn"
+  return splitSections(config).filter(isCairnConfigSection)
+    .map((section) => splitTrailingTomlTrivia(section.text).body).join("");
+}
+
+function isCairnConfigSection(section) {
+  return section.header === "marketplaces.cairn"
     || section.header === 'plugins."cairn@cairn"'
-    || (section.header?.startsWith("hooks.state.") && section.header.includes("cairn@cairn:")))
-    .map((section) => section.text).join("");
+    || (section.header?.startsWith("hooks.state.") && section.header.includes("cairn@cairn:"));
+}
+
+function splitTrailingTomlTrivia(text) {
+  const lines = text.split(/(?<=\n)/);
+  let boundary = lines.length;
+  while (boundary > 0) {
+    const line = lines[boundary - 1];
+    if (line.length === 0 || line.trim().length === 0 || line.trimStart().startsWith("#")) boundary -= 1;
+    else break;
+  }
+  return { body: lines.slice(0, boundary).join(""), trivia: lines.slice(boundary).join("") };
+}
+
+async function readSharedConfigSnapshot(path) {
+  let pathInfo;
+  try {
+    pathInfo = await lstat(path);
+  } catch (error) {
+    if (error?.code === "ENOENT") return { exists: false, text: "", digest: "missing" };
+    throw error;
+  }
+  if (pathInfo.isSymbolicLink() || !pathInfo.isFile()) throw new Error(`Managed config is not a regular file: ${path}`);
+  let handle;
+  try {
+    const flags = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0);
+    handle = await open(path, flags);
+  } catch (error) {
+    if (["ELOOP", "EFTYPE", "ENXIO"].includes(error?.code)) throw new Error(`Managed config is not a regular file: ${path}`);
+    throw error;
+  }
+  try {
+    const openedInfo = await handle.stat();
+    if (!openedInfo.isFile() || openedInfo.dev !== pathInfo.dev || openedInfo.ino !== pathInfo.ino) {
+      throw new Error(`Managed config changed identity while opening: ${path}`);
+    }
+    const text = await handle.readFile("utf8");
+    return { exists: true, text, digest: sha(text) };
+  } finally {
+    await handle.close();
+  }
 }
 
 export function ensureSetting(config, sectionName, key, value) {

package/scripts/cairn-state.mjs

@@ -117,7 +117,7 @@ const planTemplateKo = `# PLAN
 
 const contextLimits = {
   goalTitle: 64,
-  taskId: 32,
+  roadmapTaskId: 24,
   taskTitle: 40,
   roadmapWindow: 3,
 };
@@ -158,7 +158,9 @@ export async function runStateResult(event = "manual", {
 
   if (event === "session-start" || event === "user-prompt-submit") {
     const state = await readGoalState({ root: resolvedRoot });
-    if (!isGoalOwnedBySession(state, payload?.session_id)) return { status: 0, message: "", hookOutput: {} };
+    if (state?.goal?.status === "active" && !isGoalOwnedBySession(state, payload?.session_id)) {
+      return foreignSessionContextResult({ ko, event });
+    }
     return contextResult({ ko, state, event });
   }
 
@@ -222,57 +224,76 @@ async function writeIfMissing(root, path, content) {
 }
 
 function contextResult({ ko, state, event }) {
-  const base = ko ? "Cairn: 루트 MEMORY.md를 읽으세요." : "Cairn: read root MEMORY.md.";
+  const base = ko ? "Cairn kernel: 루트 MEMORY.md를 먼저 읽으세요." : "Cairn kernel: read root MEMORY.md first.";
   const idlePolicy = event === "user-prompt-submit"
     ? (ko
-      ? " 구현/계속 실행: 초기 트리아지 계획 작성 → update_plan → create_goal → 탐색 전 저장소 goal 시작 → 트리아지 후 계획 확정 → 구현. 상담·설명·계획 전용은 goal 없이 처리하세요."
-      : " Implementation/continue: write an initial triage plan; call update_plan, then create_goal; start the repository goal before exploration; finalize the plan after triage, then implement. Skip goals for consultation, explanation, or plan-only requests.")
-    : "";
-  if (!state || state.goal.status !== "active") return contextHookResult({ event, message: `${base}${idlePolicy}` });
+      ? " 구현/계속 실행이면 cairn-plan을 로드하고 active plan과 current task를 복원하거나 생성하세요. 상담·설명·계획 전용은 goal 없이 처리하세요."
+      : " For implementation/continue, load cairn-plan and restore or create the active plan and current task. Keep consultation, explanation, and plan-only requests goal-free.")
+    : (ko
+      ? " 중요 작업 전에 cairn-plan을 로드하고 active plan과 current task를 복원하세요."
+      : " Before non-trivial work, load cairn-plan and restore the active plan and current task.");
+  const failClosed = ko
+    ? " state, skill, plan 또는 required reference가 없거나 읽을 수 없거나 일치하지 않으면 수정·위임·완료하지 말고 보고하거나 차단하세요."
+    : " If state, skill, plan, or a required ref is missing, unreadable, or inconsistent, do not edit, delegate, or complete; report/block.";
+  if (!state || state.goal.status !== "active") return contextHookResult({ event, message: `${base}${idlePolicy}${failClosed}` });
   const task = state.tasks.find((item) => item.status === "active")
     ?? state.tasks.find((item) => item.status === "pending")
     ?? state.tasks.find((item) => item.status === "blocked");
-  const goalTitle = clipText(state.goal.title, contextLimits.goalTitle);
+  const planId = state.goal.planId;
+  const phase = task ? "cairn-work" : "cairn-review";
   const activeHeader = ko
-    ? `Cairn active: "${goalTitle}". ${base}`
-    : `Cairn active: "${goalTitle}". ${base}`;
+    ? `${base} ${phase}를 로드하고 정확한 plan ${planId}${task ? "과 아래 current task" : "의 완료 기준"}를 복원하세요. 압축·재시작·handoff·위임 뒤 다시 읽으세요.${failClosed}`
+    : `${base} Load ${phase}; restore exact plan ${planId}${task ? " and the current task below" : " completion criteria"}. Re-read after compaction/restart/handoff/delegation.${failClosed}`;
   if (!task) {
     return contextHookResult({
       event,
       message: [activeHeader, taskRoadmap(ko, state), activeGoalCompletionMessage(ko, state)].join("\n"),
     });
   }
-  const taskId = clipText(task.id, contextLimits.taskId);
+  const taskId = task.id;
   const taskTitle = clipText(task.title, contextLimits.taskTitle);
-  const continuation = ko
-    ? `현재: ${taskId} (${taskTitle}). 바인딩된 증거 뒤에만 완료하세요.`
-    : `Current: ${taskId} (${taskTitle}). Complete only after bound evidence.`;
-  const resume = event === "user-prompt-submit"
+  const continuation = taskId.length > 48
     ? (ko
-      ? `곁가지 질문 뒤 일시정지·중단·전환 요청이 없으면 ${taskId}를 재개하세요.`
-      : `After a side question, resume ${taskId} unless asked to pause, stop, or switch.`)
+      ? `정확한 current task: ${taskId}. 바인딩된 증거 뒤에만 완료하세요.`
+      : `Exact task: ${taskId}. Complete after bound evidence.`)
+    : (ko
+      ? `현재: ${taskId} (${taskTitle}). 바인딩된 증거 뒤에만 완료하세요.`
+      : `Current: ${taskId} (${taskTitle}). Complete only after bound evidence.`);
+  const resume = event === "user-prompt-submit"
+    ? (taskId.length > 48
+      ? (ko
+        ? "곁가지 질문 뒤 일시정지·중단·전환 요청이 없으면 위의 정확한 task를 재개하세요."
+        : "Resume that exact task after side questions unless paused, stopped, or switched.")
+      : (ko
+        ? `곁가지 질문 뒤 일시정지·중단·전환 요청이 없으면 ${taskId}를 재개하세요.`
+        : `After a side question, resume ${taskId} unless asked to pause, stop, or switch.`))
     : "";
   return contextHookResult({ event, message: [activeHeader, taskRoadmap(ko, state), continuation, resume].filter(Boolean).join("\n") });
 }
 
+function foreignSessionContextResult({ ko, event }) {
+  const message = ko
+    ? "Cairn kernel: 루트 MEMORY.md를 먼저 읽으세요. 저장소 goal을 다른 session이 소유합니다. cairn goal status로 상태를 확인하고 소유권이 해결될 때까지 Cairn 작업을 시작·수정·위임·완료하지 마세요. 이 capsule은 goal, plan, task 상세를 노출하지 않습니다."
+    : "Cairn kernel: read root MEMORY.md first. A repository goal is owned by another session. Inspect cairn goal status; until ownership is resolved, do not start, edit, delegate, or complete Cairn work. This capsule does not expose goal, plan, or task details.";
+  return contextHookResult({ event, message });
+}
+
 function taskRoadmap(ko, state) {
-  const formatTask = (task, index) => `${index + 1}. ${clipText(task.id, contextLimits.taskId)} [${task.status}] ${clipText(task.title, contextLimits.taskTitle)}`;
+  const formatTask = (task, index) => `${index + 1}. ${clipText(task.id, contextLimits.roadmapTaskId)} [${task.status}] ${clipText(task.title, contextLimits.taskTitle)}`;
   if (state.tasks.length <= contextLimits.roadmapWindow) {
     return `${ko ? "작업 단계" : "Work steps"}:\n${state.tasks.map(formatTask).join("\n")}`;
   }
 
   const currentIndex = Math.max(0, state.tasks.findIndex((task) => task.status === "active" || task.status === "pending"));
-  const maxStart = state.tasks.length - contextLimits.roadmapWindow;
-  const start = Math.min(Math.max(0, currentIndex - 1), maxStart);
-  const visible = state.tasks.slice(start, start + contextLimits.roadmapWindow);
   const counts = Object.fromEntries([...TASK_STATUS_NAMES].map((status) => [status, state.tasks.filter((task) => task.status === status).length]));
   const countSummary = Object.entries(counts).filter(([, count]) => count > 0).map(([status, count]) => `${status} ${count}`).join(", ");
-  const omitted = state.tasks.length - visible.length;
+  const omitted = state.tasks.length - 1;
   const header = ko
     ? `작업 단계 (${state.tasks.length}개; ${countSummary})`
     : `Work steps (${state.tasks.length}; ${countSummary})`;
   const omission = ko ? `… ${omitted}개 단계 생략` : `… ${omitted} steps omitted`;
-  return `${header}:\n${visible.map((task, index) => formatTask(task, start + index)).join("\n")}\n${omission}`;
+  const currentPosition = currentIndex + 1;
+  return `${header}. ${ko ? `현재 위치 ${currentPosition}` : `Current position ${currentPosition}`}; ${omission}`;
 }
 
 function contextHookResult({ event, message }) {

package/skills/cairn-plan/SKILL.md

@@ -17,6 +17,10 @@ Do not treat planning as optional for implementation work that is more than a na
 
 Plan from the whole work down. First understand the full requested outcome and affected surfaces, then classify the work into small executable tasks. If one task is still too broad to verify cleanly, split that task into sub-tasks.
 
+## Re-entry and Required References
+
+At the start and after compaction, restart, or handoff, restore context in this order: root `MEMORY.md` → `cairn-plan` → the active plan → current-task references → model guidance recorded by the plan. A new implementation request with no persisted goal may create its initial plan through the procedure below. If persisted state names a plan or task and that reference is missing, unreadable, or inconsistent, do not explore, edit, delegate, or complete work; report or record a blocker first. Do not add a read-receipt field that claims the model read a file: filesystem/state consistency and bound tool evidence remain the fail-closed authority.
+
 ## Runtime Location
 
 Resolve Cairn's read-only runtime from `references/cairn-runtime.json` next to this `SKILL.md`. Its `pluginRoot` contains Cairn's `scripts/`, `templates/`, commands, agents, and model guidance. In a source checkout where the locator does not exist, resolve the plugin root from this `SKILL.md` location (`../..`). Never search the target repository for Cairn scripts, templates, or model guidance, and never derive the plugin root from the current working directory.

package/skills/cairn-review/SKILL.md

@@ -13,6 +13,8 @@ Review is not another implementation loop. Confirm that the completed task satis
 
 Every review run and every delegated review agent must read the project-root `MEMORY.md` before doing assigned work.
 
+At the start and after compaction, restart, delegation, or handoff, restore context in this order: root `MEMORY.md` → `cairn-review` → the active plan → completed/current-task references → model guidance recorded by the plan. Confirm those references agree with persisted goal state before reviewing. If any required reference is missing, unreadable, or inconsistent, do not approve, delegate, record final review, or complete the goal; report a blocker. Do not use a read-receipt field as evidence that a model understood a reference.
+
 When subagent tools are available, each agent may recursively delegate bounded review sub-tasks to subagents. Every child subagent must read the project-root `MEMORY.md`, keep the assigned scope, and preserve others' edits.
 
 Resolve any `cairn://...` resource through `references/cairn-runtime.json` next to this `SKILL.md` (or this skill's `../..` source root during development). Never look for Cairn runtime resources in the target repository.

package/skills/cairn-work/SKILL.md

@@ -21,6 +21,10 @@ Delegated subagents must provide a final report before leaving. After the orches
 
 If the user asks a side question, status question, or narrow clarification while the selected task is still active, use the active goal's ordered task roadmap to preserve position, answer briefly, and then resume the current task unless the user explicitly asks to pause, stop, or switch tasks.
 
+## Re-entry and Required References
+
+At the start and after compaction, restart, delegation, or handoff, restore context in this order: root `MEMORY.md` → `cairn-work` → the active plan → current-task references → model guidance recorded by the plan. Confirm that the plan task, persisted current task, and worker assignment agree before acting. If state, skill, plan, assignment, or a required reference is missing, unreadable, or inconsistent, do not edit, delegate, record completion evidence, or complete work; report a blocker to the orchestrator. Do not introduce read receipts as proof of model attention: current state, readable references, and fresh tool-bound evidence are the authority.
+
 When subagent tools are available, each agent may recursively delegate bounded sub-tasks to subagents. Every child subagent must read the project-root `MEMORY.md`, keep the assigned scope, and preserve others' edits.
 
 ## Runtime Location