claude-spotter 1.4.18 → 1.4.19

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 1.4.19
+
+親セッションの暴走を誘発できたHook出力の信頼境界を修正する。監査用AIは内部で構造化判定を返すだけとし、
+その自由文やprovider出力を親モデルへ渡さない。親向け出力はSpotterプログラムが検証済みtool IDから
+決定論的に生成する、採否を親が独立判断できる非命令形の助言へ限定する。
+
+### 変更点
+
+- **共通parent-output projector**: Claude / Codexの両Hookが同じprojectorを使う。tool IDは
+  ASCII grammar、160文字、5件、重複排除、安定sort、助言全体2,000文字の上限を持ち、改行・制御文字・
+  backtick・Markdown・超長大IDを拒否する。監査用AIの`reason` / `raw`はAPI入力に持たない。
+- **非命令形のUserPrompt助言**: `additionalContext`はcatalog照合済みtool IDと固定テンプレートだけから
+  作る。「使え」「補正せよ」「ユーザーへ伝えよ」といった命令や監査用AIの説明文を含めない。
+- **failure分離**: backend codeをallow-list済みの固定状態へ写像し、固定`systemMessage`・固定stderr・
+  構造Hook eventへ出す。backend message、provider stdout / stderr、未知code本文を反射しない。この保証は
+  Hook出力生成までで、全Codex App/background面でのUI可視性は未保証。
+- **Stop持ち越し廃止**: finding / failureを`.spotter/pending/`へ新規保存せず、次の無関係な
+  UserPromptSubmitへ配送しない。findingは構造Hook event、failureは固定診断として当該Stopで完結する。
+  旧same-session pendingは内容を読まずにunlinkし、`ENOENT`以外の失敗も固定診断だけにする。
+- **安全性維持**: `decision:"block"`、Stop継続、UserPromptSubmit exit 2の範囲拡大は行わず、既存の
+  再帰Hook / daemon proliferation防止、marker、short prompt、non-blocking failure契約を維持する。
+
+### 検証
+
+projector / Claude / Codexのtargeted testとfull suiteを実行し、447件中445 pass・0 fail・既存2 skip。
+AI/backend/provider sentinel、unsafe ID、legacy pending非読取unlink、Stop次turn非配送、catalog/transcript
+読込例外の固定degradationを確認した。敵対的再監査は初回BLOCKER 2件（Codex読込例外の境界外、
+UI可視性の過剰主張）を検出・修正し、再監査BLOCKER 0。`npm pack --dry-run`は62 files、global
+`spotter 1.4.19`へlocal installし、projector smoke・Hook diagnostics・global UserPromptSubmit smokeを
+確認した。公開前release gateとしてfull test、pack、秘密混入、CI、registry tarballを再検証し、
+`v1.4.19` tag・npm `latest`・GitHub Release・global installを同一versionへ揃える。
+
 ## 1.4.18
 
 auditor model の更新を model 名の場当たり的な置換から切り離し、versioned policy と再現可能な比較 eval を

package/README.ja.md

@@ -15,7 +15,7 @@
 
 Claude には「使えるツールがあるのに、使うべきタイミングで使わない」という構造的な弱点があります。記録すべき決定を memory / caveat MCP に残さない、docs lookup MCP を呼ばずに古い知識で応答する、ブラウザ自動化 MCP で確認せず UI 状態を推測する — **「分からないと自覚できない」から、ツールを取りに行けない**。
 
-Spotter はツールカタログを完全に把握した別の監査エージェントで、ユーザー入力と主役 AI の応答を並走監査します。自動選択では Claude host は Codex CLI があればそれを、なければ session-scoped Haiku を選び、Codex host は Codex CLI を既定にします。明示 backend override は host より優先しますが、runtime failure で別 backend へ黙って切り替えません。見落としは透明化された指摘として次に利用できる文脈へ届けます。**主役 AI が自覚して自己監査する**設計は本プロダクトの存在意義を破壊するため、hook 経由でその意思と独立に検出します。
+Spotter はツールカタログを完全に把握した別の監査エージェントで、ユーザー入力と主役 AI の応答を並走監査します。自動選択では Claude host は Codex CLI があればそれを、なければ session-scoped Haiku を選び、Codex host は Codex CLI を既定にします。明示 backend override は host より優先しますが、runtime failure で別 backend へ黙って切り替えません。応答前は検証済みtool IDだけを固定・非命令形の助言へ変換でき、応答後のfindingは構造eventに留めて後続turnへ注入しません。監査用AIの自由文が親セッションへ入ることはありません。**主役 AI が自覚して自己監査する**設計は本プロダクトの存在意義を破壊するため、hook 経由でその意思と独立に検出します。
 
 <p align="center">
   <img src=".github/concept.svg" alt="Claude が答え、Spotter が見ている" width="80%">
@@ -62,6 +62,7 @@ Codex 側では現行の `[features].hooks = true` を有効化し、互換の
 Spotter が所有する Codex handler は現行の同期 command schema で生成します。install / upgrade 後は `/hooks` で review して新しい Codex session を開いてください。`spotter codex-hook diagnostics` は登録と readiness を診断しますが、trust を内部状態から推測しません。
 
 Spotter を upgrade した後、release note で hook 設定変更が案内されている場合は、各 install 済みプロジェクトで `spotter install` を再実行してください。global package update でコード経路は変わりますが、既存 `.claude/settings.json` の timeout 値は自動では書き換わりません。
+`v1.4.19`はruntimeの出力変換だけを変更するため、install済みprojectで`spotter install`をやり直す必要はありません。global packageを更新し、新しいClaude/Codexセッションを開いてください。
 
 ```bash
 spotter uninstall        # このプロジェクトの hook 登録を解除
@@ -88,20 +89,19 @@ spotter codex-hook install
 
 ### 1 ターンの監査フロー
 
-Claude Code と Codex では `Stop` の受け口が違います。下の図は Claude host の流れです。
-Codex native `Stop` は遅延配送で、不足ツールの指摘を queue し、次の same-session
-`UserPromptSubmit` で提示します。
+Claude Code と Codex は同じ安全なparent-output projectorを使います。監査用AIの自由文は内部に留め、
+`UserPromptSubmit`では検証済みtool IDだけを固定・非命令形の助言へ変換します。`Stop` findingは
+構造eventに記録し、後のturnへ注入しません。
 
 ```mermaid
 flowchart TD
     U([User 発話]) --> UPH[UserPromptSubmit hook<br/>Spotter が発話とカタログから一次判定]
-    UPH --> BT[Claude Thinking<br/>Spotter の推奨を<br/>additionalContext で受信]
+    UPH --> BT[Host model<br/>検証済みtool IDの<br/>固定助言を受け取る場合がある]
     BT --> BA([Claude の最初の応答])
     BA --> SH[Stop hook<br/>応答と使用済みツールから最終チェック]
     SH --> DEC{見落とし<br/>あり?}
     DEC -->|なし| DONE([完了])
-    DEC -->|あり| SB[.spotter/pending/ に積む<br/>v1.4.8 deferred delivery]
-    SB --> NEXT([次の UserPromptSubmit で<br/>additionalContext として配信])
+    DEC -->|あり| EVT[構造Hook eventへ記録<br/>次turnへは注入しない]
 ```
 
 ### カタログの収集経路
@@ -209,15 +209,16 @@ profile から production へ自動昇格しません。`latest` alias や
 
 ## 既知の制約
 
-- v1.4.8 以降、Claude / Codex 両 host で `Stop` hook は **遅延配送 (deferred delivery)** に統一されています。`Stop` で見落としツールを検出した場合、Spotter は `<projectRoot>/.spotter/pending/<sessionId>.json` に指摘を積み、次の same-session `UserPromptSubmit` で `additionalContext` として配信します。当ターンの最初の応答は transcript にそのまま残ります
-- pending ファイルは Claude / Codex が同じパス (`.spotter/pending/`) を共有します。host-neutral 設計です
-- **Haiku の JSON スキーマ違反は v0.5.0 以降「想定済み異常」として session renew + `role_collapse_reset` で回復**します。**v1.4.15 以降、auditor/daemon の失敗はプロンプトをブロックしません**: `UserPromptSubmit` は `[Spotter からの警告]` を出して exit 0。`Stop` 失敗も warning pending に積み、次の same-session prompt で1回配信します。直後に session が終わる場合だけ、配送先となる次 prompt がありません
+- `Stop` hookは最初の応答がstream済みになった後で発火します。v1.4.19以降は応答の書換え・継続強制・次turnへの監査文配送をせず、findingを構造Hook eventへ記録します。pre-responseの`UserPromptSubmit`精度が引き続き主軸です
+- `UserPromptSubmit.additionalContext`は受動的metadataではなくモデル可視contextです。v1.4.19以降はcatalog一致・grammar検証済みtool IDだけから決定論的に生成し、監査用AIのreason、backend message、provider stdout/stderrを反射しません
+- **Haiku の JSON スキーマ違反は v0.5.0 以降「想定済み異常」として session renew + `role_collapse_reset` で回復**します。**v1.4.19以降、auditor/daemonの失敗はモデルcontextにせずnon-blockingを維持**します。allow-list済み固定`systemMessage`・固定stderr・構造Hook eventだけを出してexit 0にします
 
 <details>
 <summary><strong>📋 最近のハイライト</strong></summary>
 
+- **親出力をルールベース化** (v1.4.19) — 監査用AIの自由文は親セッションへ入りません。検証済みtool IDだけがUserPromptSubmitの任意助言になり、Stop findingは無関係な次turnへ持ち越されません
 - **daemon は異常死しても復活する** (v1.4.16) — daemon が graceful shutdown を経ず死んでも (マシンスリープ / 強制終了 / `SessionEnd` 前の crash)、残った Unix socket が以後の起動を塞がなくなった。`startDaemon` が bind 前に orphan socket を除去するので、次の `UserPromptSubmit` の auto-resurrect が `EADDRINUSE` で crash-loop せずに成功し、「そのセッションが永久に未監査」になる事態を防ぐ
-- **失敗は声に出して縮退、host を固めない** (v1.4.15) — auditor backend が失敗したとき (例: codex のログイン失効) も、`UserPromptSubmit` hook はプロンプトを黙って消さずに `[Spotter からの警告]` を出して通す。codex ログイン失効時は直し方 (`codex login`) を明示する
+- **失敗は声に出して縮退、hostを固めない** (v1.4.15) — この版でbackend failureによるpromptのsilent消去を止めた。v1.4.19以降もnon-blocking挙動は維持し、旧model可視警告文は固定`systemMessage`・stderr・構造event診断へ置換した
 - **プラグイン形式の MCP サーバー対応** — `plugin:everything-claude-code:context7` のように名前に内部コロンを含むサーバーを正しくパースし、配下のツールをカタログに取り込めるようになった (旧版はこの形式のサーバーをすべて単一の `"plugin"` に潰して、Claude の監査から silent に脱落させていた)
 - **プロジェクト単位の監査隔離** — daemon が監査に使うのはローカル DB のみ。グローバル DB は description 再利用キャッシュに役割限定。**他プロジェクト**でインストールしたツールが現プロジェクトの監査に混入することはない
 - **手放しでカタログ維持** — `spotter install` が Claude DB を自動 seed、Claude / Codex それぞれの SessionStart が host-local DB を bg refresh する。手書き管理は一切不要

package/README.md

@@ -15,7 +15,7 @@
 
 Claude has a structural blind spot: **it can't reach for a tool it doesn't realize it needs**. It may skip a project memory MCP when a decision should be recorded, answer from stale memory instead of a docs-lookup MCP, or reason about UI state without a browser-automation MCP. The model can't always tell when it doesn't know — so the tool stays unused.
 
-Spotter runs a separate auditor with the full tool catalog and checks both the user's prompt and the primary agent's reply. Automatic selection uses Codex CLI on a Claude host when available, otherwise the session-scoped Haiku path; on a Codex host it defaults to Codex CLI. An explicit backend override takes precedence, but a runtime failure never silently switches backend. When Spotter finds a missed tool, it injects a transparent recommendation into the next available context. **The primary agent is never asked to self-audit** — that would defeat the premise. Detection happens through hooks, independent of the primary agent's intent.
+Spotter runs a separate auditor with the full tool catalog and checks both the user's prompt and the primary agent's reply. Automatic selection uses Codex CLI on a Claude host when available, otherwise the session-scoped Haiku path; on a Codex host it defaults to Codex CLI. An explicit backend override takes precedence, but a runtime failure never silently switches backend. Before the primary reply, validated tool IDs may become fixed, non-directive advice; after the reply, findings remain structured events and are not injected into a later turn. Auditor prose never enters the parent session. **The primary agent is never asked to self-audit** — that would defeat the premise. Detection happens through hooks, independent of the primary agent's intent.
 
 <p align="center">
   <img src=".github/concept.svg" alt="Claude answers · Spotter watches" width="80%">
@@ -62,6 +62,7 @@ For Codex, install enables the current `[features].hooks = true` flag and still
 Installer-owned Codex handlers use the current synchronous command schema. After install or upgrade, review them with `/hooks`, then open a fresh Codex session; `spotter codex-hook diagnostics` reports registration/readiness but does not guess hook trust.
 
 After upgrading Spotter, re-run `spotter install` in each installed project when release notes mention hook setting changes. The global package update changes the code path, but existing `.claude/settings.json` timeout values are not rewritten automatically.
+`v1.4.19` changes runtime output projection only, so already installed projects do not need another `spotter install`; update the global package and open a fresh Claude/Codex session.
 
 ```bash
 spotter uninstall        # remove hooks from this project
@@ -88,20 +89,19 @@ spotter codex-hook install
 
 ### Audit flow per turn
 
-Claude Code and Codex have different `Stop` surfaces. The diagram below is the Claude
-host flow. Codex native `Stop` uses deferred delivery: findings are queued and shown on
-the next same-session `UserPromptSubmit`.
+Claude Code and Codex share the same safe parent-output projector. Auditor prose stays
+internal; only validated tool IDs can become fixed, non-imperative advice on
+`UserPromptSubmit`. `Stop` records structured findings without injecting them into a later turn.
 
 ```mermaid
 flowchart TD
     U([User prompt]) --> UPH[UserPromptSubmit hook<br/>Spotter audits prompt against catalog]
-    UPH --> BT[Claude thinking<br/>receives Spotter's recommendations<br/>as additionalContext]
+    UPH --> BT[Host model<br/>may receive fixed advisory<br/>with validated tool IDs]
     BT --> BA([Claude's first answer])
     BA --> SH[Stop hook<br/>Spotter re-audits answer + tools used]
     SH --> DEC{Missed<br/>tool?}
     DEC -->|No| DONE([Done])
-    DEC -->|Yes| SB[Queue finding to .spotter/pending/<br/>v1.4.8 deferred delivery]
-    SB --> NEXT([Surfaces as additionalContext<br/>on next UserPromptSubmit])
+    DEC -->|Yes| EVT[Record structured Hook event<br/>no next-turn injection]
 ```
 
 ### Catalog discovery
@@ -211,15 +211,16 @@ the production values for controlled experiments; diagnostics mark overrides as
 
 ## Known limitations
 
-- The `Stop` hook fires **after** the first answer has already been streamed. Spotter therefore queues a finding for the next same-session prompt instead of rewriting that answer. Detection accuracy in `UserPromptSubmit` (the *pre-response* stage) remains the primary quality axis
-- `Stop` hook is **deferred** for both Claude and Codex hosts as of v1.4.8. When Spotter finds a missed tool at `Stop`, it appends the finding to `<projectRoot>/.spotter/pending/<sessionId>.json` and surfaces it on the next same-session `UserPromptSubmit` as `additionalContext`. The original assistant message stays as the turn's final transcript entry — no `decision:"block"` re-generation cycle. The same pending file is shared by Claude and Codex (host-neutral path)
-- **Since v0.5.0, JSON schema violations from Haiku are treated as expected anomalies** (session renew + `role_collapse_reset`). **Since v1.4.15, an auditor/daemon failure no longer blocks the prompt**: `UserPromptSubmit` emits a loud `[Spotter からの警告]` and exits 0. A `Stop` failure is queued as the same kind of warning and delivered once on the next same-session prompt. If the session ends immediately, no later prompt exists and that final warning cannot be surfaced
+- The `Stop` hook fires **after** the first answer has already been streamed. Spotter records a structured finding but does not rewrite the answer, force a continuation, or inject auditor text into the next prompt. Detection accuracy in `UserPromptSubmit` (the *pre-response* stage) remains the primary quality axis
+- `UserPromptSubmit.additionalContext` is model-visible context, not passive metadata. Since v1.4.19 it is generated only by a deterministic projector from catalog-matched, grammar-checked tool IDs. Auditor reasons, backend messages, and provider stdout/stderr are never reflected into it
+- **Since v0.5.0, JSON schema violations from Haiku are treated as expected anomalies** (session renew + `role_collapse_reset`). **Since v1.4.19, an auditor/daemon failure remains non-blocking without becoming model context**: Claude and Codex emit only an allow-listed fixed `systemMessage`, fixed stderr, and a structured Hook event, then exit 0
 
 <details>
 <summary><strong>📋 Recent highlights</strong></summary>
 
+- **Rule-based parent output boundary** (v1.4.19) — auditor AI prose cannot enter parent-session Hook output. Validated tool IDs become optional fixed advice on `UserPromptSubmit`; `Stop` findings stay structured and are never carried into an unrelated next turn
 - **Daemon recovers after an ungraceful death** (v1.4.16) — if the daemon dies without graceful shutdown (machine sleep, force-quit, crash before `SessionEnd`), the Unix socket it leaves behind no longer bricks every restart. `startDaemon` removes the orphaned socket before binding, so the next `UserPromptSubmit` auto-resurrect succeeds instead of crash-looping on `EADDRINUSE` and leaving the session permanently unaudited
-- **Failures degrade loudly, never freeze the host** (v1.4.15) — when the auditor backend fails (e.g. codex login expired), the `UserPromptSubmit` hook surfaces a `[Spotter からの警告]` and lets your prompt through instead of silently erasing it. codex login expiry names the one-line fix (`codex login`)
+- **Failures degrade loudly, never freeze the host** (v1.4.15) — this release stopped backend failure from silently erasing a prompt. Since v1.4.19, the non-blocking behavior remains but the old model-visible warning text is replaced by fixed `systemMessage`, stderr, and structured event diagnostics
 - **Plugin-scoped MCP servers** — names like `plugin:everything-claude-code:context7` (with internal colons) are now parsed correctly and their tools enter the catalog. Earlier versions silently collapsed all plugin MCP servers into a single literal `"plugin"`, dropping their tools from Claude's audit
 - **Per-project / per-host audit isolation** — the daemon audits against the local DB only; global DBs are host-specific description caches. Tools discovered in *other* projects or another host can never bleed into this project's audit set
 - **Zero-touch catalog** — `spotter install` seeds the Claude DB automatically; Claude and Codex SessionStart hooks keep their host-local DBs fresh in the background. You never have to maintain the tool list by hand

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-spotter",
-  "version": "1.4.18",
+  "version": "1.4.19",
   "description": "Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離",
   "type": "module",
   "bin": {

package/src/cli/codex-hook-cmd.mjs

@@ -7,22 +7,22 @@ import { fileURLToPath } from 'node:url';
 import { createAuditorBackend, selectAuditorBackend } from '../core/auditor-backend.mjs';
 import { resolveCodexAuditorModelSelection } from '../core/codex-auditor-model-policy.mjs';
 import { codexLastAssistantMessage, readCodexToolUsage } from '../core/codex-transcript.mjs';
-import { legacyResultFromJudgment } from '../core/judgment.mjs';
 import { readLocal } from '../tool-db/refresh.mjs';
 import { spawnRefreshDetached } from '../hooks/spawn-daemon.mjs';
 import {
   die,
   findSpotterMarker,
-  formatTransparentBlockReason,
-  formatTransparentContext,
   isChildCall,
   readStdinJson,
   requireString,
 } from '../hooks/lib.mjs';
+import { discardLegacyPending } from '../hooks/pending-context.mjs';
 import {
-  appendPendingContext,
-  drainPendingContexts,
-} from '../hooks/pending-context.mjs';
+  STOP_FINDING_SYSTEM_MESSAGE,
+  projectBackendFailure,
+  projectParentAdvice,
+  projectToolIds,
+} from '../hooks/parent-output-projector.mjs';
 import {
   appendHookEvent,
   hookEventsPath,
@@ -113,6 +113,7 @@ export async function runCodexUserPromptSubmitHook({
   readLocalFn = readLocal,
   createAuditorBackendFn = createAuditorBackend,
   recordHookEventFn = appendCodexHookEvent,
+  discardLegacyPendingFn = discardLegacyPending,
   writeOutput = (text) => process.stdout.write(text),
   writeError = (text) => process.stderr.write(text),
 } = {}) {
@@ -123,7 +124,7 @@ export async function runCodexUserPromptSubmitHook({
   const startedAt = Date.now();
 
   const prompt = requireString(input, 'prompt');
-  const contexts = await drainPendingContexts({ projectRoot, sessionId: codexSessionId(input) });
+  const legacyPending = await discardLegacyPendingFn({ projectRoot, sessionId: codexSessionId(input) });
   if ([...prompt.trim()].length <= SHORT_PROMPT_MAX_CHARS) {
     await recordCodexHookEventSafe(recordHookEventFn, {
       projectRoot,
@@ -131,35 +132,36 @@ export async function runCodexUserPromptSubmitHook({
         hook: 'UserPromptSubmit',
         status: 'skipped',
         reason: 'short_prompt',
-        pendingContextCount: contexts.length,
+        legacyPendingDiagnostic: legacyPending.diagnostic,
         durationMs: Date.now() - startedAt,
       },
     }, writeError);
-    writeCodexUserPromptContexts({ contexts, writeOutput });
     return;
   }
 
-  const catalog = await readLocalFn({ projectRoot, hostAgent: 'codex' });
+  let catalog;
   let backend;
   let judgment;
   try {
+    catalog = await readLocalFn({ projectRoot, hostAgent: 'codex' });
     backend = createCodexHookAuditorBackend({ catalog, projectRoot, createAuditorBackendFn });
     judgment = await backend.judge({ stage: 'user_input', userInput: prompt });
   } catch (err) {
-    contexts.push(formatCodexHookBackendError(err));
+    const failure = projectBackendFailure(err?.code);
+    safeWriteError(writeError, failure.stderr);
     await recordCodexHookEventSafe(recordHookEventFn, {
       projectRoot,
       event: {
         hook: 'UserPromptSubmit',
         status: 'error',
         backend: err?.backend ?? null,
-        code: err?.code ?? 'E_INTERNAL',
+        code: failure.code,
         ...compactCodexModelSelectionForEvent(err?.diagnostics?.modelSelection),
-        pendingContextCount: contexts.length,
+        legacyPendingDiagnostic: legacyPending.diagnostic,
         durationMs: Date.now() - startedAt,
       },
     }, writeError);
-    writeCodexUserPromptContexts({ contexts, writeOutput });
+    writeCodexSystemMessage({ systemMessage: failure.systemMessage, writeOutput });
     return;
   }
   await recordCodexHookEventSafe(recordHookEventFn, {
@@ -169,20 +171,20 @@ export async function runCodexUserPromptSubmitHook({
       status: 'success',
       backend: judgment.meta?.backend ?? backend.name ?? 'unknown',
       pass: judgment.pass,
-      missingTools: judgment.findings.map((finding) => finding.toolName),
+      missingTools: projectToolIds(judgment.findings.map((finding) => finding.toolName)),
       ...compactCodexModelSelectionForEvent(judgment.meta?.modelSelection),
-      pendingContextCount: contexts.length,
+      legacyPendingDiagnostic: legacyPending.diagnostic,
       backendDurationMs: judgment.meta?.durationMs ?? null,
       durationMs: Date.now() - startedAt,
     },
   }, writeError);
   if (judgment.pass === true) {
-    writeCodexUserPromptContexts({ contexts, writeOutput });
     return;
   }
 
-  contexts.push(formatTransparentContext(legacyResultFromJudgment(judgment).missing_tools));
-  writeCodexUserPromptContexts({ contexts, writeOutput });
+  const toolIds = projectToolIds(judgment.findings.map((finding) => finding.toolName));
+  const advice = projectParentAdvice(toolIds);
+  if (advice) writeCodexUserPromptContexts({ contexts: [advice], writeOutput });
 }
 
 export async function runCodexStopHook({
@@ -190,7 +192,6 @@ export async function runCodexStopHook({
   readLocalFn = readLocal,
   createAuditorBackendFn = createAuditorBackend,
   readCodexToolUsageFn = readCodexToolUsage,
-  appendPendingContextFn = appendPendingContext,
   recordHookEventFn = appendCodexHookEvent,
   writeOutput = (text) => process.stdout.write(text),
   writeError = (text) => process.stderr.write(text),
@@ -202,33 +203,28 @@ export async function runCodexStopHook({
   if (!projectRoot) return;
   const startedAt = Date.now();
   const reportError = (text) => safeWriteError(writeError, text);
-  const persistPending = async ({ text, kind }) => {
-    let queued = false;
-    let pendingWriteError = null;
-    const currentProjectRoot = findSpotterMarker(input.cwd);
-    if (currentProjectRoot !== projectRoot) {
-      pendingWriteError = 'Spotter project marker no longer identifies the original project';
-    } else {
-      try {
-        queued = await appendPendingContextFn({
-          projectRoot,
-          sessionId: codexSessionId(input),
-          text,
-        }) === true;
-        if (!queued) pendingWriteError = 'appendPendingContext returned false';
-      } catch (err) {
-        pendingWriteError = String(err?.message ?? err) || 'unknown pending context persistence error';
-      }
-    }
-    if (!queued) {
-      reportError(`Spotter Codex Stop ${kind} persistence failed: ${pendingWriteError}\n${text}\n`);
-    }
-    return { queued, pendingWriteError };
-  };
-
   const transcriptPath = requireString(input, 'transcript_path');
   const finalResponse = codexLastAssistantMessage(input) ?? '(no final response available)';
-  const toolUsage = await readCodexToolUsageFn(transcriptPath);
+  let toolUsage;
+  try {
+    toolUsage = await readCodexToolUsageFn(transcriptPath);
+  } catch (err) {
+    const failure = projectBackendFailure(err?.code);
+    reportError(failure.stderr);
+    writeCodexSystemMessage({ systemMessage: failure.systemMessage, writeOutput });
+    await recordCodexHookEventSafe(recordHookEventFn, {
+      projectRoot,
+      event: {
+        hook: 'Stop',
+        status: 'error',
+        code: failure.code,
+        reason: 'tool_usage_observation',
+        usedToolCount: 0,
+        durationMs: Date.now() - startedAt,
+      },
+    }, reportError);
+    return;
+  }
   const usedTools = Array.isArray(toolUsage?.usedTools) ? toolUsage.usedTools : [];
   const toolUsageEvent = compactCodexToolUsageForEvent(toolUsage);
   if (toolUsageEvent.toolUsageAnomalyCount === 0
@@ -246,29 +242,25 @@ export async function runCodexStopHook({
     }, reportError);
     return;
   }
-  const catalog = await readLocalFn({ projectRoot, hostAgent: 'codex' });
+  let catalog;
   let backend;
   let judgment;
   try {
+    catalog = await readLocalFn({ projectRoot, hostAgent: 'codex' });
     backend = createCodexHookAuditorBackend({ catalog, projectRoot, createAuditorBackendFn });
     judgment = await backend.judge({ stage: 'turn_end', finalResponse, usedTools });
   } catch (err) {
-    const errorText = formatCodexHookBackendError(err);
-    reportError(`${errorText}\n`);
-    const { queued: warningQueued, pendingWriteError } = await persistPending({
-      text: errorText,
-      kind: 'warning',
-    });
+    const failure = projectBackendFailure(err?.code);
+    reportError(failure.stderr);
+    writeCodexSystemMessage({ systemMessage: failure.systemMessage, writeOutput });
     await recordCodexHookEventSafe(recordHookEventFn, {
       projectRoot,
       event: {
         hook: 'Stop',
         status: 'error',
         backend: err?.backend ?? null,
-        code: err?.code ?? 'E_INTERNAL',
+        code: failure.code,
         ...compactCodexModelSelectionForEvent(err?.diagnostics?.modelSelection),
-        warningQueued,
-        ...(!warningQueued ? { pendingWriteError } : {}),
         usedToolCount: usedTools.length,
         ...toolUsageEvent,
         durationMs: Date.now() - startedAt,
@@ -295,22 +287,16 @@ export async function runCodexStopHook({
     return;
   }
 
-  const findingText = formatTransparentBlockReason(legacyResultFromJudgment(judgment).missing_tools);
-  const { queued: findingQueued, pendingWriteError } = await persistPending({
-    text: findingText,
-    kind: 'finding',
-  });
+  writeCodexSystemMessage({ systemMessage: STOP_FINDING_SYSTEM_MESSAGE, writeOutput });
   await recordCodexHookEventSafe(recordHookEventFn, {
     projectRoot,
     event: {
       hook: 'Stop',
-      status: findingQueued ? 'queued' : 'degraded',
+      status: 'finding',
       backend: judgment.meta?.backend ?? backend.name ?? 'unknown',
       pass: false,
-      missingTools: judgment.findings.map((finding) => finding.toolName),
+      missingTools: projectToolIds(judgment.findings.map((finding) => finding.toolName)),
       ...compactCodexModelSelectionForEvent(judgment.meta?.modelSelection),
-      findingQueued,
-      ...(!findingQueued ? { pendingWriteError } : {}),
       usedToolCount: usedTools.length,
       ...toolUsageEvent,
       backendDurationMs: judgment.meta?.durationMs ?? null,
@@ -614,34 +600,8 @@ function writeCodexUserPromptContexts({ contexts, writeOutput }) {
   }));
 }
 
-function formatCodexHookBackendError(err) {
-  const code = typeof err?.code === 'string' && err.code ? ` ${err.code}` : '';
-  const backend = typeof err?.backend === 'string' && err.backend ? ` ${err.backend}` : '';
-  const message = err?.message ? String(err.message) : String(err);
-  const diagnostics = formatBackendDiagnostics(err?.diagnostics);
-  return [
-    `Spotter auditor backend error${code}${backend}: ${message}`,
-    'No fallback auditor was used.',
-    diagnostics,
-  ].filter(Boolean).join('\n');
-}
-
-function formatBackendDiagnostics(diagnostics) {
-  if (!diagnostics || typeof diagnostics !== 'object') return '';
-  const stderr = typeof diagnostics.stderr === 'string' ? diagnostics.stderr.trim() : '';
-  const stdout = typeof diagnostics.stdout === 'string' ? diagnostics.stdout.trim() : '';
-  const sections = [];
-  const model = diagnostics.modelSelection;
-  if (model && typeof model === 'object') {
-    sections.push(
-      `auditor model: model=${model.effectiveModel ?? 'unknown'} effort=${model.effectiveReasoningEffort ?? 'unknown'} source=${model.modelSource ?? 'unknown'}/${model.effortSource ?? 'unknown'} availability=${model.availability ?? 'unknown'}`,
-    );
-  }
-  const output = [];
-  if (stdout) output.push(`stdout:\n${stdout.split('\n').slice(-4).join('\n')}`);
-  if (stderr) output.push(`stderr:\n${stderr.split('\n').slice(-4).join('\n')}`);
-  if (output.length > 0) sections.push(`backend output:\n${output.join('\n')}`);
-  return sections.join('\n');
+function writeCodexSystemMessage({ systemMessage, writeOutput }) {
+  writeOutput(JSON.stringify({ systemMessage }));
 }
 
 function compactCodexModelSelectionForEvent(selection) {
@@ -661,10 +621,8 @@ function codexSessionId(payload) {
   return typeof value === 'string' && value.length > 0 ? value : null;
 }
 
-// Phase B (hook parity, 2026-05-08): pending-context helpers were moved to
-// `src/hooks/pending-context.mjs` and the on-disk path migrated from
-// `.spotter/codex-pending/` to host-neutral `.spotter/pending/`. The Claude Stop hook
-// now writes to the same queue.
+// v1.4.19: legacy pending migration is handled only by `discardLegacyPending` on
+// UserPromptSubmit. Stop findings are never persisted for a future parent prompt.
 
 // Phase D (hook parity, 2026-05-08): Codex hook events now go through the host-neutral
 // `appendHookEvent` so Claude / Codex events live in the same `.spotter/hook-events.jsonl`.

package/src/core/hook-event-log.mjs

@@ -3,9 +3,9 @@
 // Codex side previously wrote `.spotter/codex-hook-events.jsonl` with schema
 // `spotter.codex_hook_event.v1`. v1.4.8 unifies that into `.spotter/hook-events.jsonl`
 // with schema `spotter.hook_event.v1` + a `host` field, and Claude hooks now write to
-// the same file. Records every hook firing with skip / success / error / queued status
+// the same file. Records every hook firing with skip / success / error / finding status
 // so `spotter diagnostics logs` can surface hook-side observations the daemon log alone
-// never sees (short-prompt skip, drained pending count, hook-level transport errors).
+// never sees (short-prompt skip, legacy pending discard diagnostics, hook-level transport errors).
 //
 // File path: `<projectRoot>/.spotter/hook-events.jsonl` (append-only, no rotation yet).
 // Record schema (v1):
@@ -23,7 +23,7 @@
 //     durationMs?: number,
 //     backendDurationMs?: number | null,
 //     usedToolCount?: number,
-//     pendingContextCount?: number,
+//     legacyPendingDiagnostic?: string | null,
 //     toolName?: string | null
 //   }
 

package/src/hooks/lib.mjs

@@ -2,9 +2,9 @@
 //
 // Exit code contract (§14.3 / §14.4):
 //   0 = success (normal flow), OR a LOUD degradation: the audit could not run but the failure
-//       is surfaced in-band via a `[Spotter からの警告]` additionalContext block, so the host
-//       stays responsive and the user's prompt is never erased. UserPromptSubmit uses this for
-//       any daemon / auditor-backend failure (e.g. codex login expired) — see user-prompt.mjs.
+//       is surfaced through a fixed systemMessage and fixed stderr, so the host stays responsive
+//       and the user's prompt is never erased. UserPromptSubmit uses this for any daemon /
+//       auditor-backend failure — see user-prompt.mjs.
 //   1 = expected abnormal, non-blocking (Claude Code proceeds; first stderr line shown to user).
 //   2 = unexpected protocol/contract violation (malformed Claude Code envelope, missing required
 //       field). Reserved for cases where there is no real user prompt worth preserving — a
@@ -126,16 +126,6 @@ export function die(message, exitCode = 2) {
   process.exit(exitCode);
 }
 
-export function formatTransparentContext(missingTools) {
-  // §12.2: transparent phrasing — header `[Spotter からの推奨ツール]` 自体が出典明示を担う。
-  const lines = missingTools.map((m) => `- \`${m.name}\`: ${m.reason}`);
-  return [
-    '[Spotter からの推奨ツール]',
-    'このプロンプトに応答する前に、以下のツールを使うべきか検討してください。',
-    ...lines,
-  ].join('\n');
-}
-
 // Phase D (hook parity, 2026-05-08): hook-event JSONL helper for Claude-side hooks.
 // Each Claude hook calls this once with its observation; failures are silenced (a
 // missing diagnostics file is acceptable, but the hook itself must not break).
@@ -150,55 +140,3 @@ export async function recordClaudeHookEvent({ projectRoot, event, writeError } =
     writeError: writeError ?? ((text) => process.stderr.write(text)),
   });
 }
-
-export function formatTransparentBlockReason(missingTools) {
-  // §12.3: transparent phrasing — header `[Spotter からの指摘]` 自体が出典明示を担う。
-  const lines = missingTools.map((m) => `- \`${m.name}\`: ${m.reason}`);
-  return [
-    '[Spotter からの指摘]',
-    '上記応答ではツールが不足している可能性があります。以下を検討し、必要なら呼び出した上で応答を補正してください。',
-    ...lines,
-  ].join('\n');
-}
-
-// Loud degradation notice (§0 / §14.1): the auditor could not run this turn. Surfaced via the
-// same additionalContext channel as findings so the host stays responsive AND the user is told
-// they are temporarily unprotected (and, for an expired codex login, exactly how to recover).
-// This is the opposite of a silent fallback.
-export function formatSpotterWarning({ code, message, stage = 'user_input' } = {}) {
-  const header = '[Spotter からの警告]';
-  const stopFailure = stage === 'stop';
-  if (code === 'E_CODEX_CLI_AUTH') {
-    return [
-      header,
-      stopFailure
-        ? 'Spotter の監査エンジン (codex) のログインが失効しているため、直前の応答を Stop 時に監査できませんでした。'
-        : 'Spotter の監査エンジン (codex) のログインが失効しているため、今回の入力は監査できませんでした。',
-      stopFailure
-        ? 'ユーザーに、直前の応答が未監査だったことと「端末で `codex login` を実行して再ログインすれば Spotter の監査が復旧する」ことを伝えてください。'
-        : 'この応答を続ける前に、ユーザーに「端末で `codex login` を実行して再ログインすれば Spotter の監査が復旧する」ことを伝えてください。',
-    ].join('\n');
-  }
-  if (code === 'E_CODEX_CLI_USAGE_LIMIT') {
-    return [
-      header,
-      stopFailure
-        ? 'Spotter の監査エンジン (codex) が利用上限に達したため、直前の応答を Stop 時に監査できませんでした。'
-        : 'Spotter の監査エンジン (codex) が利用上限に達したため、今回の入力は監査できませんでした。',
-      stopFailure
-        ? 'ユーザーに、直前の応答が未監査だったことと、表示されたリセット時刻まで待つか Codex プランを確認すれば監査を再開できることを伝えてください。'
-        : 'この応答を続ける前に、ユーザーに、表示されたリセット時刻まで待つか Codex プランを確認すれば監査を再開できることを伝えてください。',
-    ].join('\n');
-  }
-  const lines = [
-    header,
-    stopFailure
-      ? `Spotter は直前の応答を Stop 時に監査できませんでした (理由コード: ${code ?? 'unknown'})。直前の応答は未監査です。`
-      : `Spotter は今回の入力を監査できませんでした (理由コード: ${code ?? 'unknown'})。この応答は監査されていません。`,
-    stopFailure
-      ? 'ユーザーに、直前の応答が未監査だったことと Spotter の監査が一時的に無効だったことを伝えてください。'
-      : 'この応答を続ける前に、ユーザーに Spotter の監査が一時的に無効になっていることを伝えてください。',
-  ];
-  if (typeof message === 'string' && message.length > 0) lines.push(`詳細: ${message}`);
-  return lines.join('\n');
-}

package/src/hooks/parent-output-projector.mjs

@@ -0,0 +1,80 @@
+const TOOL_ID_PATTERN = /^[A-Za-z0-9_.:/-]+$/;
+const MAX_TOOL_ID_LENGTH = 160;
+const MAX_TOOL_IDS = 5;
+const MAX_ADVICE_LENGTH = 2000;
+
+const FAILURE_KINDS = new Map([
+  ['E_CODEX_CLI_AUTH', 'auth'],
+  ['E_CODEX_CLI_USAGE_LIMIT', 'usage_limit'],
+  ['E_CODEX_CLI_MODEL_UNAVAILABLE', 'model_unavailable'],
+  ['E_CODEX_CLI_TIMEOUT', 'timeout'],
+  ['E_TIMEOUT', 'timeout'],
+  ['E_HAIKU_TIMEOUT', 'timeout'],
+]);
+
+const FAILURE_OUTPUTS = Object.freeze({
+  auth: Object.freeze({
+    code: 'E_SPOTTER_AUDIT_AUTH',
+    systemMessage: 'Spotter の監査は認証状態を確認できないため、このターンでは利用できませんでした。',
+  }),
+  usage_limit: Object.freeze({
+    code: 'E_SPOTTER_AUDIT_USAGE_LIMIT',
+    systemMessage: 'Spotter の監査は利用上限のため、このターンでは利用できませんでした。',
+  }),
+  model_unavailable: Object.freeze({
+    code: 'E_SPOTTER_AUDIT_MODEL_UNAVAILABLE',
+    systemMessage: 'Spotter の監査は選択中のモデルを利用できないため、このターンでは利用できませんでした。',
+  }),
+  timeout: Object.freeze({
+    code: 'E_SPOTTER_AUDIT_TIMEOUT',
+    systemMessage: 'Spotter の監査は時間内に完了しなかったため、このターンでは利用できませんでした。',
+  }),
+  generic: Object.freeze({
+    code: 'E_SPOTTER_AUDIT_GENERIC',
+    systemMessage: 'Spotter の監査は一時的な問題のため、このターンでは利用できませんでした。',
+  }),
+});
+
+export const STOP_FINDING_SYSTEM_MESSAGE = 'Spotter は直前の応答について利用可能ツールの確認候補を記録しました。';
+
+export function projectParentAdvice(toolIds) {
+  const accepted = projectToolIds(toolIds);
+  if (accepted.length === 0) return '';
+  const lines = [
+    '[Spotter からの参考情報]',
+    '関連する可能性がある利用可能ツール:',
+  ];
+  for (const toolId of accepted) {
+    const next = [...lines, `- \`${toolId}\``, '', '適用可否は、現在の依頼と利用条件に基づいて独立に判断できます。'].join('\n');
+    if (next.length > MAX_ADVICE_LENGTH) break;
+    lines.push(`- \`${toolId}\``);
+  }
+  if (lines.length === 2) return '';
+  lines.push('', '適用可否は、現在の依頼と利用条件に基づいて独立に判断できます。');
+  return lines.join('\n');
+}
+
+export function projectToolIds(toolIds) {
+  return normalizeToolIds(toolIds);
+}
+
+export function projectBackendFailure(code) {
+  const kind = FAILURE_KINDS.get(code) ?? 'generic';
+  const output = FAILURE_OUTPUTS[kind];
+  return Object.freeze({
+    code: output.code,
+    systemMessage: output.systemMessage,
+    stderr: `spotter-hook: ${output.systemMessage}\n`,
+  });
+}
+
+function normalizeToolIds(toolIds) {
+  if (!Array.isArray(toolIds)) return [];
+  const unique = new Set();
+  for (const toolId of toolIds) {
+    if (typeof toolId !== 'string' || toolId.length === 0 || toolId.length > MAX_TOOL_ID_LENGTH) continue;
+    if (!TOOL_ID_PATTERN.test(toolId)) continue;
+    unique.add(toolId);
+  }
+  return [...unique].sort().slice(0, MAX_TOOL_IDS);
+}

package/src/hooks/pending-context.mjs

@@ -1,18 +1,8 @@
-// Phase B (hook parity, 2026-05-08): host-neutral pending-context queue.
-//
-// Stop hook が pass:false を出した時、当ターンで block するのではなく次の UserPromptSubmit
-// で `additionalContext` として配信するための queue ファイル。Claude / Codex 両 host から
-// 同じヘルパを通すことで、ファイル形式・パス命名を統一する。
-//
-// File path: `<projectRoot>/.spotter/pending/<sanitizedSessionId>.json`
-// File format: JSON 配列 `[<text>, <text>, ...]` (Codex 側 `codex-pending/` 既存形式と互換)
-//
-// 同 session 内のみ参照される。drain (= UserPromptSubmit が読み出す) で file は削除される。
-// session が事故等で残った pending file は次 session の sanitizedSessionId と一致しない
-// 限り読まれない (= 副作用なし) ので、cleanup は best-effort。
+// Legacy pending migration only. Historical files are never read or parsed because they may
+// contain untrusted auditor text; the matching same-session file is best-effort unlinked.
 
-import { mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { unlink } from 'node:fs/promises';
+import { join } from 'node:path';
 
 const PENDING_DIR = 'pending';
 
@@ -24,42 +14,14 @@ export function pendingPath({ projectRoot, sessionId } = {}) {
   return join(projectRoot, '.spotter', PENDING_DIR, `${clean}.json`);
 }
 
-export async function readPendingContexts(path) {
-  if (typeof path !== 'string' || path.length === 0) return [];
+export async function discardLegacyPending({ projectRoot, sessionId, unlinkFn = unlink } = {}) {
+  const path = pendingPath({ projectRoot, sessionId });
+  if (!path) return { discarded: false, diagnostic: 'legacy_pending_invalid_path' };
   try {
-    const raw = await readFile(path, 'utf8');
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed)
-      ? parsed.map((item) => (typeof item === 'string' ? item.trim() : '')).filter(Boolean)
-      : [];
+    await unlinkFn(path);
+    return { discarded: true, diagnostic: null };
   } catch (err) {
-    if (err.code === 'ENOENT') return [];
-    throw err;
-  }
-}
-
-export async function appendPendingContext({ projectRoot, sessionId, text } = {}) {
-  const path = pendingPath({ projectRoot, sessionId });
-  const value = String(text ?? '').trim();
-  if (!path || !value) return false;
-  const contexts = await readPendingContexts(path);
-  // De-dupe so repeated identical findings within the same session don't pile up.
-  if (!contexts.includes(value)) contexts.push(value);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, JSON.stringify(contexts, null, 2) + '\n', 'utf8');
-  return true;
-}
-
-export async function drainPendingContexts({ projectRoot, sessionId } = {}) {
-  const path = pendingPath({ projectRoot, sessionId });
-  if (!path) return [];
-  const contexts = await readPendingContexts(path);
-  if (contexts.length > 0) {
-    try {
-      await unlink(path);
-    } catch (err) {
-      if (err.code !== 'ENOENT') throw err;
-    }
+    if (err?.code === 'ENOENT') return { discarded: true, diagnostic: null };
+    return { discarded: false, diagnostic: 'legacy_pending_discard_failed' };
   }
-  return contexts;
 }

package/src/hooks/stop.mjs

@@ -1,48 +1,27 @@
-// Stop hook — send turn_end to daemon. Phase B (hook parity, 2026-05-08): deferred delivery.
-//
-// Prior behavior (pre-v1.4.8): on `pass:false` returned `{decision:"block", reason:<text>}` so
-// Claude Code re-asks Bell to regenerate the response. This worked but caused a UX defect —
-// the regenerated reply (= the corrective answer) became the transcript's final message and
-// the original "A" topic got lost in transcript review.
-//
-// Phase B behavior: on `pass:false` we instead append the same transparent block-reason text
-// to `<projectRoot>/.spotter/pending/<sessionId>.json`. The next UserPromptSubmit drains the
-// queue and folds the entries into `additionalContext`, so Bell receives the audit finding
-// alongside the next user input. The original A reply stays as the turn's final message.
-//
-// `decision:"block"` is no longer emitted from this hook. Backend / transport errors do NOT
-// force a continuation (a Stop exit 2 would block stopping = harmful noise on a Spotter-side
-// failure); they are recorded as `degraded` and exit 0. Their loud `[Spotter からの警告]` is
-// persisted in the same pending queue as findings, then delivered by the next
-// UserPromptSubmit. A persistence failure is written to stderr but never turns Stop into exit 2.
-// `stop_hook_active:true` is still observed: the daemon early-passes on it, so we just
-// receive `pass:true` and return without writing pending context.
-//
-// v0.2 gates: see src/hooks/session-start.mjs comment.
+// Stop hook — send turn_end to daemon and emit only fixed system messages. It never blocks the
+// host and never carries auditor findings or failures into a future UserPromptSubmit.
 
 import {
   readStdinJson,
   requireString,
   die,
   findSpotterMarker,
-  formatTransparentBlockReason,
-  formatSpotterWarning,
   isChildCall,
   isSubagentCall,
   recordClaudeHookEvent,
 } from './lib.mjs';
 import { getLastAssistantText } from './transcript-reader.mjs';
 import { sendRequest } from '../daemon/transport.mjs';
-import { appendPendingContext } from './pending-context.mjs';
+import { STOP_FINDING_SYSTEM_MESSAGE, projectBackendFailure, projectToolIds } from './parent-output-projector.mjs';
 
 const TIMEOUT_MS = 50_000;
 
 export async function runStop({
   readInput = readStdinJson,
   sendRequestFn = sendRequest,
-  appendPendingContextFn = appendPendingContext,
   getLastAssistantTextFn = getLastAssistantText,
   recordHookEventFn = recordClaudeHookEvent,
+  writeOutput = (text) => process.stdout.write(text),
   writeError = (text) => process.stderr.write(text),
 } = {}) {
   if (isChildCall()) return;
@@ -66,48 +45,19 @@ export async function runStop({
     }
   };
 
-  const persistPending = async ({ text, kind }) => {
-    let queued = false;
-    let pendingWriteError = null;
-    // Never redirect a pending entry into a different installed ancestor if the original marker
-    // disappears while the daemon request is in flight.
-    const currentProjectRoot = findSpotterMarker(input.cwd);
-    if (currentProjectRoot !== projectRoot) {
-      pendingWriteError = 'Spotter project marker no longer identifies the original project';
-    } else {
-      try {
-        queued = await appendPendingContextFn({
-          projectRoot,
-          sessionId,
-          text,
-        }) === true;
-        if (!queued) pendingWriteError = 'appendPendingContext returned false';
-      } catch (err) {
-        pendingWriteError = String(err?.message ?? err) || 'unknown pending context persistence error';
-      }
-    }
-    if (!queued) {
-      // Include the original warning/finding as well as the persistence failure. If the durable
-      // channel is unavailable, stderr is the only remaining loud surface for this Stop event.
-      reportError(`Spotter Stop ${kind} persistence failed: ${pendingWriteError}\n${text}\n`);
-    }
-    return { queued, pendingWriteError };
-  };
-
-  const recordFailure = async ({ code, message, reason }) => {
-    const text = formatSpotterWarning({ code, message, stage: 'stop' });
-    const { queued: warningQueued, pendingWriteError } = await persistPending({ text, kind: 'warning' });
+  const recordFailure = async ({ code, reason }) => {
+    const failure = projectBackendFailure(code);
+    reportError(failure.stderr);
+    writeOutput(JSON.stringify({ systemMessage: failure.systemMessage }));
     await recordHookEventFn({
       projectRoot,
       writeError: reportError,
       event: {
         hook: 'Stop',
         status: 'degraded',
-        code: code ?? 'E_INTERNAL',
+        code: failure.code,
         reason,
         durationMs: Date.now() - startedAt,
-        warningQueued,
-        ...(!warningQueued ? { pendingWriteError } : {}),
       },
     });
   };
@@ -129,22 +79,18 @@ export async function runStop({
       timeoutMs: TIMEOUT_MS,
     });
   } catch (err) {
-    // Spotter-side failure (daemon unreachable, etc.): persist a loud warning and exit 0. Do NOT
-    // force the model to continue: a Stop exit 2 blocks stopping.
+    // Spotter-side failure is surfaced only through fixed diagnostics; a Stop exit 2 would block stopping.
     await recordFailure({
       code: err?.code ?? 'E_INTERNAL',
-      message: err?.message ?? '',
       reason: 'transport',
     });
     return;
   }
 
   if (response.ok !== true) {
-    // Auditor backend failed (e.g. codex login expired): queue its actionable warning and exit 0.
-    // Forcing a continuation (exit 2) on a Spotter-side failure is harmful.
+    // Auditor backend failure is fixed-diagnostic only; forcing a continuation is harmful.
     await recordFailure({
       code: response.error?.code ?? 'E_INTERNAL',
-      message: response.error?.message ?? '',
       reason: 'daemon_error',
     });
     return;
@@ -166,25 +112,19 @@ export async function runStop({
     return; // nothing to defer
   }
 
-  // Phase B: queue the finding for the next UserPromptSubmit instead of returning
-  // decision:"block". Using the same transparent block-reason wording keeps the user-facing
-  // text identical to the prior block flow.
-  const text = formatTransparentBlockReason(result.missing_tools);
-  const { queued: findingQueued, pendingWriteError } = await persistPending({ text, kind: 'finding' });
+  writeOutput(JSON.stringify({ systemMessage: STOP_FINDING_SYSTEM_MESSAGE }));
   await recordHookEventFn({
     projectRoot,
     writeError: reportError,
     event: {
       hook: 'Stop',
-      status: findingQueued ? 'queued' : 'degraded',
+      status: 'finding',
       pass: false,
-      missingTools: result.missing_tools.map((m) => m.name),
+      missingTools: projectToolIds(Array.isArray(result.missing_tools) ? result.missing_tools.map((entry) => entry?.name) : []),
       durationMs: Date.now() - startedAt,
-      findingQueued,
-      ...(!findingQueued ? { pendingWriteError } : {}),
     },
   });
-  // No stdout output — Stop hook just exits 0. Pending will surface on next UserPromptSubmit.
+  // No continuation or pending delivery is requested.
 }
 
 if (import.meta.url === `file://${process.argv[1]?.replace(/\\/g, '/')}`) {

package/src/hooks/user-prompt.mjs

@@ -1,4 +1,5 @@
-// UserPromptSubmit hook — send user_input to daemon, inject additionalContext (§12.2 transparent).
+// UserPromptSubmit hook — send user_input to daemon and project only validated tool IDs into
+// fixed non-imperative additionalContext text.
 // v0.2 gates: see src/hooks/session-start.mjs comment.
 //
 // v0.12.0: auto-resurrect. If sendRequest fails with E_UNREACHABLE (daemon was
@@ -7,18 +8,13 @@
 // natural recovery point — the start of a new turn — so the user's prompt is still
 // audited even after long pauses or daemon failures.
 //
-// Phase B (hook parity, 2026-05-08): deferred Stop delivery. Drain
-// `<projectRoot>/.spotter/pending/<sessionId>.json` populated by the previous turn's Stop
-// hook and merge those entries into the same additionalContext. Drain runs even on the
-// short-prompt early-return path so pending context never gets stuck behind a "ok" / "thanks"
-// reply.
+// Legacy pending files are never read or delivered. The same-session path is best-effort
+// removed before both short and normal prompt paths.
 
 import {
   readStdinJson,
   requireString,
   die,
-  formatTransparentContext,
-  formatSpotterWarning,
   isChildCall,
   isSubagentCall,
   isOutsideSpotterProject,
@@ -27,7 +23,8 @@ import {
 } from './lib.mjs';
 import { sendRequest, TransportError } from '../daemon/transport.mjs';
 import { spawnDaemonAndWaitReady } from './spawn-daemon.mjs';
-import { drainPendingContexts } from './pending-context.mjs';
+import { discardLegacyPending } from './pending-context.mjs';
+import { projectBackendFailure, projectParentAdvice, projectToolIds } from './parent-output-projector.mjs';
 
 const TIMEOUT_MS = 50_000;
 const SHORT_PROMPT_MAX_CHARS = 10;
@@ -36,9 +33,10 @@ export async function runUserPrompt({
   readInput = readStdinJson,
   sendRequestFn = sendRequest,
   spawnDaemonAndWaitReadyFn = spawnDaemonAndWaitReady,
-  drainPendingContextsFn = drainPendingContexts,
+  discardLegacyPendingFn = discardLegacyPending,
   recordHookEventFn = recordClaudeHookEvent,
   writeOutput = (text) => process.stdout.write(text),
+  writeError = (text) => process.stderr.write(text),
 } = {}) {
   if (isChildCall()) return;
   const input = await readInput();
@@ -50,44 +48,35 @@ export async function runUserPrompt({
   const projectRoot = findSpotterMarker(input.cwd);
   const startedAt = Date.now();
 
-  // Phase B: drain pending Spotter findings deferred from the previous turn's Stop hook.
-  // We always attempt to drain — even on the short-prompt skip path — so pending text never
-  // gets stuck behind a one-liner reply.
-  const pendingContexts = projectRoot
-    ? await drainPendingContextsFn({ projectRoot, sessionId })
-    : [];
-
-  // Loud degradation (§0 / §14.1): the audit could not run, but the user's prompt is valid.
-  // Surface a visible [Spotter からの警告] (merged with any drained pending context) and exit 0
-  // so the prompt reaches the host — never erase it with a blocking exit 2.
-  const degrade = async ({ code, message, reason }) => {
-    const contexts = pendingContexts.slice();
-    contexts.push(formatSpotterWarning({ code, message }));
-    emitAdditionalContext(writeOutput, contexts);
+  const legacyPending = projectRoot
+    ? await discardLegacyPendingFn({ projectRoot, sessionId })
+    : { discarded: false, diagnostic: 'legacy_pending_invalid_path' };
+
+  const degrade = async ({ code, reason }) => {
+    const failure = projectBackendFailure(code);
+    emitSystemMessage(writeOutput, failure.systemMessage);
+    safeWriteError(writeError, failure.stderr);
     await recordHookEventFn({
       projectRoot,
       event: {
         hook: 'UserPromptSubmit',
         status: 'degraded',
-        code: code ?? 'E_INTERNAL',
+        code: failure.code,
         reason,
-        pendingContextCount: pendingContexts.length,
+        legacyPendingDiagnostic: legacyPending.diagnostic,
         durationMs: Date.now() - startedAt,
       },
     });
   };
 
   if ([...prompt.trim()].length <= SHORT_PROMPT_MAX_CHARS) {
-    if (pendingContexts.length > 0) {
-      emitAdditionalContext(writeOutput, pendingContexts);
-    }
     await recordHookEventFn({
       projectRoot,
       event: {
         hook: 'UserPromptSubmit',
         status: 'skipped',
         reason: 'short_prompt',
-        pendingContextCount: pendingContexts.length,
+        legacyPendingDiagnostic: legacyPending.diagnostic,
         durationMs: Date.now() - startedAt,
       },
     });
@@ -115,13 +104,12 @@ export async function runUserPrompt({
       } catch (recoverErr) {
         await degrade({
           code: recoverErr?.code ?? 'E_RESURRECT_FAILED',
-          message: recoverErr?.message ?? '',
           reason: 'resurrect_failed',
         });
         return;
       }
     } else {
-      await degrade({ code: err?.code ?? 'E_INTERNAL', message: err?.message ?? '', reason: 'transport' });
+      await degrade({ code: err?.code, reason: 'transport' });
       return;
     }
   }
@@ -129,20 +117,17 @@ export async function runUserPrompt({
   if (response.ok !== true) {
     await degrade({
       code: response.error?.code ?? 'E_INTERNAL',
-      message: response.error?.message ?? '',
       reason: 'daemon_error',
     });
     return;
   }
 
   const result = response.result;
-  const contexts = pendingContexts.slice();
-  if (result.pass !== true) {
-    contexts.push(formatTransparentContext(result.missing_tools));
-  }
-  if (contexts.length > 0) {
-    emitAdditionalContext(writeOutput, contexts);
-  }
+  const toolIds = projectToolIds(Array.isArray(result.missing_tools) ? result.missing_tools.map((entry) => entry?.name) : []);
+  const advice = result.pass !== true
+    ? projectParentAdvice(toolIds)
+    : '';
+  if (advice) emitAdditionalContext(writeOutput, advice);
 
   await recordHookEventFn({
     projectRoot,
@@ -150,15 +135,14 @@ export async function runUserPrompt({
       hook: 'UserPromptSubmit',
       status: 'success',
       pass: result.pass === true,
-      missingTools: Array.isArray(result.missing_tools) ? result.missing_tools.map((m) => m.name) : [],
-      pendingContextCount: pendingContexts.length,
+      missingTools: toolIds,
+      legacyPendingDiagnostic: legacyPending.diagnostic,
       durationMs: Date.now() - startedAt,
     },
   });
 }
 
-function emitAdditionalContext(writeOutput, contexts) {
-  const text = contexts.map((c) => String(c).trim()).filter(Boolean).join('\n\n');
+function emitAdditionalContext(writeOutput, text) {
   if (!text) return;
   const output = {
     hookSpecificOutput: {
@@ -169,6 +153,18 @@ function emitAdditionalContext(writeOutput, contexts) {
   writeOutput(JSON.stringify(output));
 }
 
+function emitSystemMessage(writeOutput, systemMessage) {
+  writeOutput(JSON.stringify({ systemMessage }));
+}
+
+function safeWriteError(writeError, text) {
+  try {
+    writeError(text);
+  } catch {
+    // A warning writer must not turn a valid user prompt into a blocking hook failure.
+  }
+}
+
 if (import.meta.url === `file://${process.argv[1]?.replace(/\\/g, '/')}`) {
   runUserPrompt().catch((err) => die(err.message, err.exitCode ?? 2));
 }