claude-spotter 1.9.2 → 1.9.4

package/CHANGELOG.md

@@ -3,6 +3,32 @@
 各節はそのversion公開時点の変更記録であり、後続versionにより置換された仕様を含む。
 現行runtime契約は[`docs/00_overview.md`](https://github.com/kitepon/Spotter/blob/main/docs/00_overview.md)から辿る。
 
+## 1.9.4 — 2026-10-09
+
+- Windowsで、監査の制限時間と同時にCodexが自分で終わった時、`taskkill`がrootを見つけられず（exit 128）、
+  Spotterが「process treeの終了を確認できない」（`E_CODEX_CLI_TERMINATION`）として扱っていた。この失敗は
+  汎用の失敗として`SPOTTER.AUDITOR.UNAVAILABLE`へ即時登録される。child自身のclose（終了と全stdio pipeのEOF）を
+  確認できた時だけ終了済みとし、監査はtimeoutのまま扱う。closeを確認できない時と、128以外の`taskkill`失敗は
+  従来どおり`E_CODEX_CLI_TERMINATION`にする。
+- CodexとGrokの失敗hook eventへ、失敗した段の内部code（`internalCode`）と、あればその原因のcode・終了status
+  （`causeCode`、`causeExitCode`）を残す。これまでは表示用にまとめた`code`だけが残り、1回の失敗の種類を
+  logから読み戻せなかった。記録するのは固定の識別子と終了statusだけで、hookの出力とstderrは変えていない。
+
+## 1.9.3 — 2026-10-07
+
+- 監査backendへ届かない・応じてもらえない失敗（network、timeout、認証、利用上限、5xx）を、1回ごとに
+  runtime errorへ登録しない。Spotterは固定の通知を出し、親のturnと入力を保ち、次の監査で再試行する。
+  1回の失敗はhook eventとdaemon logに残り、backendごとの連続失敗として`auditor-availability-v1.json`に持つ。
+  完了した監査が挟まらないまま30分以上続いた時だけ、`SPOTTER.AUDITOR.UNRECOVERED`（`high`）を
+  障害1件につき1回登録する。原因は決めつけない。それ以外の監査失敗は従来どおり毎回
+  `SPOTTER.AUDITOR.UNAVAILABLE`（`warn`）へ登録する。BugHubへ送る項目は変えていない。
+- 重大度を、止まる範囲と復帰の有無に合わせた。sessionまたはbackendの監査が止まり復帰が観測されない物は
+  `high`、影響が監査1回・hookの要求1回までの物は`warn`。入力・会話・結果の喪失と二重実行はどの種類にも無い。
+- hookとの接続1本の障害を、daemonが待ち受けられない失敗（`SPOTTER.DAEMON.TRANSPORT`、`high`）から分け、
+  `SPOTTER.DAEMON.CONNECTION`（`warn`）として登録する。daemonは他の接続を処理し続ける。
+- `SPOTTER.AUDITOR.UNRECOVERED`または`SPOTTER.DAEMON.CONNECTION`の記録を持つstoreは、1.9.2以前のSpotterでは
+  読めない（未知の記録として拒否する）。
+
 ## 1.9.2 — 2026-10-06
 
 - daemonが起動直後にsessionのcwdを離れ、`~/.spotter`へ移る。hostが`SessionEnd`を実行せずに終わると、

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-spotter",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "description": "Audit agent running alongside Claude Code that catches missed tool calls — 気づく役と実行する役の分離",
   "type": "module",
   "bin": {

package/src/cli/codex-hook-cmd.mjs

@@ -28,10 +28,14 @@ import {
 } from '../hooks/parent-output-projector.mjs';
 import {
   appendHookEvent,
+  failureEventFields,
   hookEventsPath,
   summarizeHookEvents,
 } from '../core/hook-event-log.mjs';
-import { observeRuntimeErrorIsolatedSafe } from '../core/runtime-error-store.mjs';
+import {
+  observeAuditorAvailabilityIsolatedSafe, observeRuntimeErrorIsolatedSafe,
+} from '../core/runtime-error-store.mjs';
+import { reportAuditorFailure, reportAuditorSuccess } from '../core/auditor-outcome.mjs';
 import { createEvaluationStore } from '../core/evaluation-store.mjs';
 import { loadEvaluationContext } from '../core/evaluation-context.mjs';
 import {
@@ -87,11 +91,17 @@ export async function runCodexHookCommand({ argv = process.argv.slice(2) } = {})
     return;
   }
   if (sub === 'user-prompt-submit') {
-    await runCodexUserPromptSubmitHook({ runtimeErrorObserver: observeRuntimeErrorIsolatedSafe });
+    await runCodexUserPromptSubmitHook({
+      runtimeErrorObserver: observeRuntimeErrorIsolatedSafe,
+      auditorAvailabilityObserver: observeAuditorAvailabilityIsolatedSafe,
+    });
     return;
   }
   if (sub === 'stop') {
-    await runCodexStopHook({ runtimeErrorObserver: observeRuntimeErrorIsolatedSafe });
+    await runCodexStopHook({
+      runtimeErrorObserver: observeRuntimeErrorIsolatedSafe,
+      auditorAvailabilityObserver: observeAuditorAvailabilityIsolatedSafe,
+    });
     return;
   }
   process.stderr.write(`unknown codex-hook subcommand: ${sub}\n${CODEX_HOOK_USAGE}`);
@@ -130,6 +140,7 @@ export async function runCodexUserPromptSubmitHook({
   writeOutput = (text) => process.stdout.write(text),
   writeError = (text) => process.stderr.write(text),
   runtimeErrorObserver = async () => ({ collected: false, reason: 'observer_not_configured' }),
+  auditorAvailabilityObserver = async () => ({ collected: false, reason: 'observer_not_configured' }),
   createEvaluationStoreFn = createEvaluationStore,
   loadEvaluationContextFn = loadEvaluationContext,
   randomUUIDFn = randomUUID,
@@ -206,7 +217,9 @@ export async function runCodexUserPromptSubmitHook({
     });
   } catch (err) {
     await recordEvaluation({ auditStatus: 'error', backend: err?.backend ?? null, model: err?.diagnostics?.modelSelection?.effectiveModel ?? null });
-    if (enteredAuditorBoundary) await observeRuntimeFailure(runtimeErrorObserver, 'auditor_unavailable');
+    if (enteredAuditorBoundary) {
+      await reportAuditorFailure(err, { runtimeErrorObserver, auditorAvailabilityObserver, backend: backend?.name });
+    }
     const failure = projectBackendFailure(err?.code);
     safeWriteError(writeError, failure.stderr);
     await recordCodexHookEventSafe(recordHookEventFn, {
@@ -216,6 +229,7 @@ export async function runCodexUserPromptSubmitHook({
         status: 'error',
         backend: err?.backend ?? null,
         code: failure.code,
+        ...failureEventFields(err),
         ...compactCodexModelSelectionForEvent(err?.diagnostics?.modelSelection),
         legacyPendingDiagnostic: legacyPending.diagnostic,
         durationMs: Date.now() - startedAt,
@@ -224,6 +238,7 @@ export async function runCodexUserPromptSubmitHook({
     writeCodexSystemMessage({ systemMessage: failure.systemMessage, writeOutput });
     return;
   }
+  await reportAuditorSuccess(judgment, { auditorAvailabilityObserver, backend: backend.name });
   await recordCodexHookEventSafe(recordHookEventFn, {
     projectRoot,
     event: {
@@ -267,6 +282,7 @@ export async function runCodexStopHook({
   writeOutput = (text) => process.stdout.write(text),
   writeError = (text) => process.stderr.write(text),
   runtimeErrorObserver = async () => ({ collected: false, reason: 'observer_not_configured' }),
+  auditorAvailabilityObserver = async () => ({ collected: false, reason: 'observer_not_configured' }),
   createEvaluationStoreFn = createEvaluationStore,
   codexHome = process.env.CODEX_HOME || join(homedir(), '.codex'),
   now = () => Date.now(),
@@ -325,6 +341,7 @@ export async function runCodexStopHook({
         hook: 'Stop',
         status: 'error',
         code: failure.code,
+        ...failureEventFields(err),
         reason: 'tool_usage_observation',
         usedToolCount: 0,
         durationMs: Date.now() - startedAt,
@@ -368,7 +385,9 @@ export async function runCodexStopHook({
     backend = createCodexHookAuditorBackend({ catalog, projectRoot, createAuditorBackendFn });
     judgment = await backend.judge({ stage: 'turn_end', finalResponse, usedTools });
   } catch (err) {
-    if (enteredAuditorBoundary) await observeRuntimeFailure(runtimeErrorObserver, 'auditor_unavailable');
+    if (enteredAuditorBoundary) {
+      await reportAuditorFailure(err, { runtimeErrorObserver, auditorAvailabilityObserver, backend: backend?.name });
+    }
     const failure = projectBackendFailure(err?.code);
     reportError(failure.stderr);
     writeCodexSystemMessage({ systemMessage: failure.systemMessage, writeOutput });
@@ -379,6 +398,7 @@ export async function runCodexStopHook({
         status: 'error',
         backend: err?.backend ?? null,
         code: failure.code,
+        ...failureEventFields(err),
         ...compactCodexModelSelectionForEvent(err?.diagnostics?.modelSelection),
         usedToolCount: usedTools.length,
         ...toolUsageEvent,
@@ -387,6 +407,7 @@ export async function runCodexStopHook({
     }, reportError);
     return;
   }
+  await reportAuditorSuccess(judgment, { auditorAvailabilityObserver, backend: backend.name });
   if (judgment.pass === true) {
     await recordCodexHookEventSafe(recordHookEventFn, {
       projectRoot,
@@ -701,14 +722,6 @@ function createCodexHookAuditorBackend({ catalog, projectRoot, createAuditorBack
   });
 }
 
-async function observeRuntimeFailure(observer, kind) {
-  try {
-    await observer(kind);
-  } catch {
-    // Runtime error telemetry must not alter hook output or exit behavior.
-  }
-}
-
 function resolveCodexHookAuditorBackend({ env }) {
   return selectAuditorBackend({ hostAgent: 'codex', env }).backend;
 }

package/src/cli/daemon-cmd.mjs

@@ -5,7 +5,9 @@ import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { open } from 'node:fs/promises';
 import { writeFileSync } from 'node:fs';
-import { observeRuntimeErrorIsolatedSafe } from '../core/runtime-error-store.mjs';
+import {
+  observeAuditorAvailabilityIsolatedSafe, observeRuntimeErrorIsolatedSafe,
+} from '../core/runtime-error-store.mjs';
 
 function parseArgs(argv) {
   const out = { sessionId: null, projectRoot: null };
@@ -94,6 +96,7 @@ export async function runDaemonStart({ argv }) {
       projectRoot,
       logFn: log,
       runtimeErrorObserver: observeRuntimeErrorIsolatedSafe,
+      auditorAvailabilityObserver: observeAuditorAvailabilityIsolatedSafe,
     });
   } catch (err) {
     if (err instanceof DaemonAlreadyRunningError) {

package/src/cli/grok-hook-cmd.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 import { randomUUID } from 'node:crypto';
 import { createAuditorBackend } from '../core/auditor-backend.mjs';
 import { createEvaluationStore } from '../core/evaluation-store.mjs';
-import { appendHookEventSafe } from '../core/hook-event-log.mjs';
+import { appendHookEventSafe, failureEventFields } from '../core/hook-event-log.mjs';
 import { projectBackendFailure, projectToolIds } from '../hooks/parent-output-projector.mjs';
 import { findSpotterMarker, isChildCall, readStdinJson, requireString } from '../hooks/lib.mjs';
 import { readLocal, refresh } from '../tool-db/refresh.mjs';
@@ -154,7 +154,7 @@ export async function runGrokHook({
     const failure = projectBackendFailure(error?.code);
     writeError(failure.stderr);
     await record(projectRoot, expected, {
-      status: 'degraded', code: failure.code, durationMs: Date.now() - startedAt,
+      status: 'degraded', code: failure.code, ...failureEventFields(error), durationMs: Date.now() - startedAt,
     }, recordFn);
     if (prompt !== null) await recordGrokEvaluation({ createEvaluationStoreFn, projectRoot, input, prompt, status: 'error', writeError });
     return;

package/src/core/auditor-outcome.mjs

@@ -0,0 +1,56 @@
+// Decides how one auditor outcome reaches the runtime error store. A single failure to reach
+// or be served by the external backend is a handled, self-retrying condition: Spotter shows the
+// fixed notice, keeps the parent turn and the user's input, and audits again on the next turn.
+// It stays in the hook-event and daemon logs. It is registered only when it does not recover.
+
+export const AUDITOR_AVAILABILITY_BACKENDS = new Set(['jev', 'haiku', 'codex-cli', 'unknown']);
+
+// The code picks only when to register. It does not say whether the product or the
+// environment is at fault: a timeout or a rejected login can be either.
+const AUDITOR_BACKEND_ACCESS_CODES = new Set([
+  'E_JEV_NETWORK', 'E_JEV_TIMEOUT', 'E_JEV_AUTH', 'E_JEV_USAGE_LIMIT',
+  'E_CODEX_CLI_TIMEOUT', 'E_CODEX_CLI_AUTH', 'E_CODEX_CLI_USAGE_LIMIT',
+  'E_HAIKU_TIMEOUT',
+]);
+
+// 'immediate' keeps the registration on every occurrence. 'on_unrecovered' is registered
+// only when the failure streak outlives the recovery window without a successful audit.
+export function auditorFailureLane(error) {
+  const code = error?.code;
+  if (AUDITOR_BACKEND_ACCESS_CODES.has(code)) return 'on_unrecovered';
+  const status = error?.diagnostics?.status;
+  if (code === 'E_JEV_HTTP' && Number.isSafeInteger(status) && status >= 500) return 'on_unrecovered';
+  return 'immediate';
+}
+
+export function auditorAvailabilityBackend(value) {
+  return AUDITOR_AVAILABILITY_BACKENDS.has(value) ? value : 'unknown';
+}
+
+export async function reportAuditorFailure(error, {
+  runtimeErrorObserver, auditorAvailabilityObserver, backend,
+}) {
+  try {
+    if (auditorFailureLane(error) === 'immediate') {
+      await runtimeErrorObserver('auditor_unavailable');
+      return;
+    }
+    await auditorAvailabilityObserver({
+      outcome: 'failure', backend: auditorAvailabilityBackend(error?.backend ?? backend),
+    });
+  } catch {
+    // Runtime error telemetry must not alter hook output, exit behavior or daemon state.
+  }
+}
+
+// A judgment produced without contacting the backend proves nothing about its availability.
+export async function reportAuditorSuccess(judgment, { auditorAvailabilityObserver, backend }) {
+  if (judgment?.meta?.mode === 'empty_catalog') return;
+  try {
+    await auditorAvailabilityObserver({
+      outcome: 'success', backend: auditorAvailabilityBackend(judgment?.meta?.backend ?? backend),
+    });
+  } catch {
+    // Same telemetry safety boundary as reportAuditorFailure.
+  }
+}

package/src/core/hook-event-log.mjs

@@ -24,7 +24,10 @@
 //     backendDurationMs?: number | null,
 //     usedToolCount?: number,
 //     legacyPendingDiagnostic?: string | null,
-//     toolName?: string | null
+//     toolName?: string | null,
+//     internalCode?: string | null,   // failing step's own code; `code` is the projected one
+//     causeCode?: string,
+//     causeExitCode?: number
 //   }
 
 import { appendFile, mkdir, readFile } from 'node:fs/promises';
@@ -34,6 +37,23 @@ const HOOK_EVENTS_FILE = 'hook-events.jsonl';
 export const HOOK_EVENT_SCHEMA = 'spotter.hook_event.v1';
 export const HOOK_EVENTS_SUMMARY_SCHEMA = 'spotter.hook_events_summary.v1';
 
+const EVENT_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+
+function eventCode(value) {
+  return typeof value === 'string' && EVENT_CODE_PATTERN.test(value) ? value : null;
+}
+
+// `code` holds the projected, user-facing code, which folds many failures into one generic value.
+// These fields keep the failing step's own code so a single failure can be read back from the log.
+// Only fixed identifiers and an exit status are taken; messages and provider output never are.
+export function failureEventFields(error) {
+  const fields = { internalCode: eventCode(error?.code) };
+  const causeCode = eventCode(error?.cause?.code);
+  if (causeCode !== null) fields.causeCode = causeCode;
+  if (Number.isInteger(error?.cause?.exitCode)) fields.causeExitCode = error.cause.exitCode;
+  return fields;
+}
+
 export function hookEventsPath(projectRoot) {
   if (typeof projectRoot !== 'string' || projectRoot.length === 0) {
     throw new TypeError('hookEventsPath: projectRoot must be a non-empty string');

package/src/core/runtime-error-store-worker.mjs

@@ -1,10 +1,10 @@
-import { hasRuntimeErrorReceipt, observeRuntimeError } from './runtime-error-store.mjs';
+import { hasRuntimeErrorReceipt, observeAuditorAvailability, observeRuntimeError } from './runtime-error-store.mjs';
 
 async function main() {
   if (process.env.SPOTTER_RUNTIME_ERROR_WORKER !== '1' || process.argv.length !== 5) process.exit(2);
   const action = process.argv[2];
   const value = process.argv[3];
-  if (action !== 'observe' && action !== 'receipt') process.exit(2);
+  if (action !== 'observe' && action !== 'receipt' && action !== 'availability') process.exit(2);
   let options;
   try {
     const encoded = process.argv[4];
@@ -15,8 +15,11 @@ async function main() {
   }
   const allowed = action === 'observe'
     ? new Set(['configPath', 'productConfigPath', 'storePath', 'productVersion', 'platform', 'arch', 'beforeOpenDelayMs', 'observationId'])
-    : new Set(['configPath', 'productConfigPath', 'storePath', 'productVersion', 'platform', 'arch', 'observationId', 'expectedFingerprint', 'waitMs']);
-  const required = new Set(['configPath', 'storePath', 'productVersion', 'platform', 'arch', 'observationId']);
+    : action === 'availability'
+      ? new Set(['configPath', 'productConfigPath', 'storePath', 'productVersion', 'platform', 'arch'])
+      : new Set(['configPath', 'productConfigPath', 'storePath', 'productVersion', 'platform', 'arch', 'observationId', 'expectedFingerprint', 'waitMs']);
+  const required = new Set(['configPath', 'storePath', 'productVersion', 'platform', 'arch']);
+  if (action !== 'availability') required.add('observationId');
   if (!options || typeof options !== 'object' || Array.isArray(options)
     || Object.keys(options).some((key) => !allowed.has(key))
     || [...required].some((key) => !Object.hasOwn(options, key))
@@ -26,7 +29,7 @@ async function main() {
     || typeof options.productVersion !== 'string' || options.productVersion.length < 1 || options.productVersion.length > 64
     || typeof options.platform !== 'string' || !/^[a-z0-9_-]{1,32}$/.test(options.platform)
     || typeof options.arch !== 'string' || !/^[A-Za-z0-9_-]{1,32}$/.test(options.arch)
-    || typeof options.observationId !== 'string' || !/^[a-f0-9]{32}$/.test(options.observationId)
+    || (action !== 'availability' && (typeof options.observationId !== 'string' || !/^[a-f0-9]{32}$/.test(options.observationId)))
     || (action === 'receipt' && (typeof options.expectedFingerprint !== 'string'
       || !/^[a-f0-9]{64}$/.test(options.expectedFingerprint)
       || !Number.isSafeInteger(options.waitMs) || options.waitMs < 10 || options.waitMs > 10_000))
@@ -42,6 +45,14 @@ async function main() {
       } while (Date.now() < deadline);
       process.exit(11);
     }
+    if (action === 'availability') {
+      const separator = value.indexOf(':');
+      if (separator < 1) process.exit(2);
+      const result = await observeAuditorAvailability({
+        outcome: value.slice(0, separator), backend: value.slice(separator + 1),
+      }, options);
+      process.exit(result.collected ? 0 : 10);
+    }
     const result = await observeRuntimeError(value, options);
     process.exit(result.collected ? 0 : 10);
   } catch {

package/src/core/runtime-error-store.mjs

@@ -16,33 +16,68 @@ import { DatabaseSync } from 'node:sqlite';
 import { fileURLToPath } from 'node:url';
 import { version } from '../version.mjs';
 import { WINDOWS_POWERSHELL_COMMAND } from '../platform/spawn.mjs';
+import { AUDITOR_AVAILABILITY_BACKENDS } from './auditor-outcome.mjs';
 import { readRuntimeReportConfig } from './runtime-report-config.mjs';
 
 export const RUNTIME_ERROR_STORE_SCHEMA = 'spotter.runtime_errors.v1';
 export const RUNTIME_ERROR_STATE_SCHEMA_VERSION = '1.0';
 export const RUNTIME_ERROR_STORE_FAILURE_DIAGNOSTIC = 'spotter-runtime-errors: local aggregate store unavailable\n';
 
+// Severity follows what stops, what is lost and whether it comes back. No kind loses the user's
+// input, conversation or results, and none runs anything twice, so none is fatal.
+// - high: audits are stopped across a whole session or backend and no recovery is observed.
+// - warn: at most one audit or one hook request is affected and the next one runs normally.
 export const RUNTIME_ERROR_DEFINITIONS = deepFreeze({
+  // The daemon could not listen, or its listening server failed. A daemon that cannot listen
+  // exits: every audit of that Claude session is missing from the first prompt, and each
+  // UserPromptSubmit retries the start and waits up to 3 s for it. It comes back only when the
+  // cause on the terminal is gone. For an error after listening the daemon keeps running and
+  // the extent is not determined here.
   daemon_transport: {
     component: 'daemon_transport',
     errorCode: 'SPOTTER.DAEMON.TRANSPORT',
     messageTemplate: 'Spotter daemon transport failed',
     severity: 'high',
   },
+  // A fault on one live hook connection. The daemon keeps serving and the next request opens
+  // a new connection. A hook that goes away before the reply does not raise it.
+  daemon_connection: {
+    component: 'daemon_transport',
+    errorCode: 'SPOTTER.DAEMON.CONNECTION',
+    messageTemplate: 'Spotter daemon connection to a hook failed; at most one hook request was affected',
+    severity: 'warn',
+  },
+  // The PID file could not be written, so the daemon closes its listener and exits. Same
+  // effect on the session as a daemon that cannot listen.
   daemon_persistence: {
     component: 'daemon_persistence',
     errorCode: 'SPOTTER.DAEMON.PERSISTENCE',
     messageTemplate: 'Spotter daemon state persistence failed',
     severity: 'high',
   },
+  // One audit failed for a reason other than backend access. The next audit runs normally.
   auditor_unavailable: {
     component: 'auditor',
     errorCode: 'SPOTTER.AUDITOR.UNAVAILABLE',
     messageTemplate: 'Spotter auditor backend was unavailable',
     severity: 'warn',
   },
+  // Registered once per outage, only after backend access kept failing with no completed
+  // audit in between: every audit through that backend on this terminal has been missing for
+  // 30 minutes or more and no recovery is observed.
+  auditor_unrecovered: {
+    component: 'auditor',
+    errorCode: 'SPOTTER.AUDITOR.UNRECOVERED',
+    messageTemplate: 'Spotter auditor backend access kept failing for over 30 minutes with no successful audit; cause not determined',
+    severity: 'high',
+  },
 });
 
+export const AUDITOR_AVAILABILITY_SCHEMA = 'spotter.auditor_availability.v1';
+export const AUDITOR_UNRECOVERED_AFTER_MS = 30 * 60 * 1_000;
+const AUDITOR_AVAILABILITY_FILE = 'auditor-availability-v1.json';
+const AUDITOR_AVAILABILITY_OUTCOMES = new Set(['success', 'failure']);
+
 const CONFIG_TOP_KEYS = new Set(['schema_version', 'host', 'collection', 'reporting']);
 const HOST_KEYS = new Set(['id', 'profile']);
 const COLLECTION_KEYS = new Set(['enabled']);
@@ -151,56 +186,220 @@ export async function observeRuntimeError(input, options = {}) {
   const definition = RUNTIME_ERROR_DEFINITIONS[kind];
   const fingerprint = runtimeErrorFingerprint(definition);
   const storePath = options.storePath ?? defaultRuntimeErrorStorePath(options);
-  const result = await mutateStore(storePath, options, (store) => {
-    const receipt = observationId
-      ? store.receipts.find((candidate) => candidate.id === observationId)
-      : null;
-    if (receipt) {
-      if (receipt.fingerprint !== fingerprint) {
-        throw storeError('runtime error observation id conflicts with another fingerprint');
-      }
-      const existing = store.records.find((record) => record.fingerprint === fingerprint);
-      return { collected: true, fingerprint, sequence: existing?.sequence ?? null, duplicate: true };
+  return mutateStore(storePath, options, (store) => (
+    applyObservation(store, definition, fingerprint, observationId, options)
+  ));
+}
+
+function applyObservation(store, definition, fingerprint, observationId, options) {
+  const receipt = observationId
+    ? store.receipts.find((candidate) => candidate.id === observationId)
+    : null;
+  if (receipt) {
+    if (receipt.fingerprint !== fingerprint) {
+      throw storeError('runtime error observation id conflicts with another fingerprint');
     }
-    const timestamp = nowIso(options.now);
     const existing = store.records.find((record) => record.fingerprint === fingerprint);
-    const sequence = store.next_sequence++;
-    if (existing) {
-      existing.product_version = validateProductVersion(options.productVersion ?? version);
-      existing.occurrence_count += 1;
-      existing.last_seen = timestamp;
-      existing.status = 'open';
-      existing.resolved_at = null;
-      existing.reason_code = null;
-      existing.sequence = sequence;
-    } else {
-      store.records.push({
-        product: 'spotter',
-        product_version: validateProductVersion(options.productVersion ?? version),
-        component: definition.component,
-        error_code: definition.errorCode,
-        message_template: definition.messageTemplate,
-        severity: definition.severity,
-        fingerprint,
-        occurrence_count: 1,
-        first_seen: timestamp,
-        last_seen: timestamp,
-        state_schema_version: RUNTIME_ERROR_STATE_SCHEMA_VERSION,
-        os: validatePlatform(options.platform ?? currentPlatform()),
-        arch: validateArch(options.arch ?? currentArch()),
-        status: 'open',
-        resolved_at: null,
-        reason_code: null,
-        sequence,
-      });
+    return { collected: true, fingerprint, sequence: existing?.sequence ?? null, duplicate: true };
+  }
+  const timestamp = nowIso(options.now);
+  const existing = store.records.find((record) => record.fingerprint === fingerprint);
+  const sequence = store.next_sequence++;
+  if (existing) {
+    existing.product_version = validateProductVersion(options.productVersion ?? version);
+    existing.occurrence_count += 1;
+    existing.last_seen = timestamp;
+    existing.status = 'open';
+    existing.resolved_at = null;
+    existing.reason_code = null;
+    existing.sequence = sequence;
+  } else {
+    store.records.push({
+      product: 'spotter',
+      product_version: validateProductVersion(options.productVersion ?? version),
+      component: definition.component,
+      error_code: definition.errorCode,
+      message_template: definition.messageTemplate,
+      severity: definition.severity,
+      fingerprint,
+      occurrence_count: 1,
+      first_seen: timestamp,
+      last_seen: timestamp,
+      state_schema_version: RUNTIME_ERROR_STATE_SCHEMA_VERSION,
+      os: validatePlatform(options.platform ?? currentPlatform()),
+      arch: validateArch(options.arch ?? currentArch()),
+      status: 'open',
+      resolved_at: null,
+      reason_code: null,
+      sequence,
+    });
+  }
+  if (observationId) {
+    store.receipts.push({ id: observationId, fingerprint });
+    if (store.receipts.length > MAX_RECEIPTS) store.receipts.splice(0, store.receipts.length - MAX_RECEIPTS);
+  }
+  return { collected: true, fingerprint, sequence };
+}
+
+export function auditorAvailabilityPath(storePath) {
+  return join(dirname(storePath), AUDITOR_AVAILABILITY_FILE);
+}
+
+export async function observeAuditorAvailability(input, options = {}) {
+  const { outcome, backend } = validateAvailabilityInput(input);
+  const collection = await readRuntimeCollectionMode(options);
+  if (!collection.enabled) return { collected: false, reason: collection.mode };
+  const storePath = options.storePath ?? defaultRuntimeErrorStorePath(options);
+  const statePath = auditorAvailabilityPath(storePath);
+  return enqueue(storePath, async () => {
+    await ensurePrivateDirectory(dirname(storePath), options);
+    return withStoreLock(runtimeErrorLockPath(storePath), options, async () => {
+      const state = await readAvailabilityState(statePath, options);
+      const streak = state.streaks[backend];
+      if (outcome === 'success') {
+        if (!streak) return { collected: true, streak: 'none' };
+        delete state.streaks[backend];
+        await writeAvailabilityState(statePath, state);
+        return { collected: true, streak: 'cleared' };
+      }
+      const timestamp = nowIso(options.now);
+      // A clock that moved backwards restarts the streak instead of producing a negative age.
+      const current = streak && streak.first_failed_at <= timestamp
+        ? { ...streak, last_failed_at: timestamp }
+        : { first_failed_at: timestamp, last_failed_at: timestamp, registered: false };
+      let registered = false;
+      if (!current.registered
+        && Date.parse(timestamp) - Date.parse(current.first_failed_at) >= AUDITOR_UNRECOVERED_AFTER_MS) {
+        const definition = RUNTIME_ERROR_DEFINITIONS.auditor_unrecovered;
+        const fingerprint = runtimeErrorFingerprint(definition);
+        // The streak start identifies the outage, so a retry after a failed state write
+        // cannot count the same outage twice.
+        const observationId = createHash('sha256')
+          .update(`auditor_unrecovered\n${backend}\n${current.first_failed_at}`, 'utf8').digest('hex').slice(0, 32);
+        const store = await readStore(storePath, options);
+        applyObservation(store, definition, fingerprint, observationId, { ...options, now: () => timestamp });
+        validateStore(store);
+        const atomicWriteFn = options.atomicWriteFn ?? atomicWriteStore;
+        await atomicWriteFn(storePath, `${JSON.stringify(store)}\n`, options);
+        current.registered = true;
+        registered = true;
+      }
+      state.streaks[backend] = current;
+      await writeAvailabilityState(statePath, state);
+      return { collected: true, streak: current.registered ? 'registered' : 'open', registered };
+    });
+  });
+}
+
+// Success is the hot path of every audit. A worker is started only when this backend has a
+// failure streak to end; the unlocked read is a hint and the worker re-reads under the lock.
+export async function observeAuditorAvailabilityIsolatedSafe(input, options = {}) {
+  let parsed;
+  try {
+    parsed = validateAvailabilityInput(input);
+  } catch {
+    return emitFixedStoreFailure(options);
+  }
+  const storePath = options.storePath ?? defaultRuntimeErrorStorePath(options);
+  if (parsed.outcome === 'success') {
+    let streaks;
+    try {
+      streaks = JSON.parse(await readFile(auditorAvailabilityPath(storePath), 'utf8'))?.streaks;
+    } catch (error) {
+      if (error?.code === 'ENOENT') return { collected: false, reason: 'no_failure_streak' };
+      return emitFixedStoreFailure(options);
     }
-    if (observationId) {
-      store.receipts.push({ id: observationId, fingerprint });
-      if (store.receipts.length > MAX_RECEIPTS) store.receipts.splice(0, store.receipts.length - MAX_RECEIPTS);
+    if (!streaks || typeof streaks !== 'object') return emitFixedStoreFailure(options);
+    if (!Object.hasOwn(streaks, parsed.backend)) return { collected: false, reason: 'no_failure_streak' };
+  }
+  const platform = options.platform ?? process.platform;
+  const timeoutMs = options.timeoutMs ?? (platform === 'win32'
+    ? WINDOWS_DEFAULT_ISOLATED_TIMEOUT_MS
+    : DEFAULT_ISOLATED_TIMEOUT_MS);
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 10 || timeoutMs > 10_000) {
+    return emitFixedStoreFailure(options);
+  }
+  const workerOptions = {
+    configPath: options.configPath ?? null,
+    productConfigPath: options.productConfigPath,
+    storePath,
+    productVersion: options.productVersion ?? version,
+    platform: options.platform ?? process.platform,
+    arch: options.arch ?? process.arch,
+  };
+  const encoded = Buffer.from(JSON.stringify(workerOptions), 'utf8').toString('base64url');
+  const observed = await runRuntimeWorker(
+    options.workerPath ?? RUNTIME_ERROR_WORKER,
+    ['availability', `${parsed.outcome}:${parsed.backend}`, encoded],
+    timeoutMs,
+  );
+  if (observed.kind === 'exit' && observed.code === 0) return { collected: true };
+  if (observed.kind === 'exit' && observed.code === 10) return { collected: false, reason: 'collection_disabled' };
+  return emitFixedStoreFailure(options);
+}
+
+function validateAvailabilityInput(input) {
+  assertExactObject(input, new Set(['outcome', 'backend']));
+  if (!AUDITOR_AVAILABILITY_OUTCOMES.has(input.outcome) || !AUDITOR_AVAILABILITY_BACKENDS.has(input.backend)) {
+    throw inputError('invalid auditor availability observation');
+  }
+  return { outcome: input.outcome, backend: input.backend };
+}
+
+async function readAvailabilityState(statePath, options) {
+  let raw;
+  try {
+    raw = decodeUtf8(await readPrivateFile(statePath, options, { enforceWindowsAcl: false }));
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { schema: AUDITOR_AVAILABILITY_SCHEMA, streaks: {} };
+    throw error;
+  }
+  let state;
+  try {
+    state = JSON.parse(raw);
+  } catch {
+    throw storeError('auditor availability state is malformed');
+  }
+  if (!state || typeof state !== 'object' || Array.isArray(state)
+    || !hasOnlyKeys(state, new Set(['schema', 'streaks'])) || Object.keys(state).length !== 2
+    || state.schema !== AUDITOR_AVAILABILITY_SCHEMA
+    || !state.streaks || typeof state.streaks !== 'object' || Array.isArray(state.streaks)
+    || !hasOnlyKeys(state.streaks, AUDITOR_AVAILABILITY_BACKENDS)) {
+    throw storeError('auditor availability state schema mismatch');
+  }
+  const streakKeys = new Set(['first_failed_at', 'last_failed_at', 'registered']);
+  for (const streak of Object.values(state.streaks)) {
+    if (!streak || typeof streak !== 'object' || Array.isArray(streak)
+      || !hasOnlyKeys(streak, streakKeys) || Object.keys(streak).length !== streakKeys.size
+      || !validTimestamp(streak.first_failed_at) || !validTimestamp(streak.last_failed_at)
+      || streak.first_failed_at > streak.last_failed_at || typeof streak.registered !== 'boolean') {
+      throw storeError('auditor availability state schema mismatch');
     }
-    return { collected: true, fingerprint, sequence };
-  });
-  return result;
+  }
+  return state;
+}
+
+// The directory is already owner-private (0700, or the owner-only inherited ACL on Windows),
+// and the state holds only backend names and timestamps.
+async function writeAvailabilityState(statePath, state) {
+  if (Object.keys(state.streaks).length === 0) {
+    await rm(statePath, { force: true });
+    return;
+  }
+  const temporary = `${statePath}.${process.pid}.${randomUUID()}.tmp`;
+  let handle;
+  try {
+    handle = await open(temporary, 'wx', 0o600);
+    await handle.writeFile(`${JSON.stringify(state)}\n`, 'utf8');
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    await rename(temporary, statePath);
+  } catch (error) {
+    await handle?.close().catch(() => {});
+    await rm(temporary, { force: true }).catch(() => {});
+    throw error;
+  }
 }
 
 export async function observeRuntimeErrorSafe(input, options = {}) {

package/src/daemon/daemon.mjs

@@ -35,6 +35,7 @@ import { readFile } from 'node:fs/promises';
 import { createServer, ensureRuntimeDir, removeStaleSocketFile, secureSocketFile, socketPath } from './transport.mjs';
 import { readLocal } from '../tool-db/refresh.mjs';
 import { legacyResultFromJudgment } from '../core/judgment.mjs';
+import { reportAuditorFailure, reportAuditorSuccess } from '../core/auditor-outcome.mjs';
 import {
   createAuditorBackend,
   DEFAULT_HAIKU_AUDITOR_TIMEOUT_MS,
@@ -86,6 +87,7 @@ export async function startDaemon({
   auditorEnv = process.env,
   stopShortFinalMaxChars = resolveStopShortFinalMaxChars(process.env),
   runtimeErrorObserver = async () => ({ collected: false, reason: 'observer_not_configured' }),
+  auditorAvailabilityObserver = async () => ({ collected: false, reason: 'observer_not_configured' }),
   createAuditorBackendFn = createAuditorBackend,
   createServerFn = createServer,
   removeStaleSocketFileFn = removeStaleSocketFile,
@@ -180,14 +182,20 @@ export async function startDaemon({
   // Tests may pass haikuCallWindowMs: 0 to disable this guard.
   let lastAuditorCallAt = 0;
 
+  const auditorOutcomeObservers = {
+    runtimeErrorObserver, auditorAvailabilityObserver, backend: auditorBackend.name,
+  };
   const runAuditorJudgment = async (input) => {
     lastAuditorCallAt = Date.now();
+    let judgment;
     try {
-      return await auditorBackend.judge(input);
+      judgment = await auditorBackend.judge(input);
     } catch (error) {
-      await observeFailure('auditor_unavailable');
+      await reportAuditorFailure(error, auditorOutcomeObservers);
       throw error;
     }
+    await reportAuditorSuccess(judgment, auditorOutcomeObservers);
+    return judgment;
   };
 
   // v0.12.0: heartbeat. Reset on every envelope; if no event arrives within
@@ -405,9 +413,9 @@ export async function startDaemon({
     if (envelope?.event === 'tool_used' && envelope.payload?.evaluation_observed === true) {
       state.evaluationUsageIncomplete = true;
     }
-    // Handler/auditor failures are owned above. A connection-level error has no
-    // envelope and belongs to the transport boundary here.
-    if (envelope === null) void observeFailure('daemon_transport');
+    // Handler/auditor failures are owned above. A connection-level error has no envelope.
+    // It affects that one connection; the daemon keeps serving the others.
+    if (envelope === null) void observeFailure('daemon_connection');
   };
 
   const { server, path } = createServerFn({ sessionId, handler, onError: onErrorFn });

package/src/index.mjs

@@ -48,6 +48,7 @@ export {
   summarizeDaemonLogText,
   summarizeDaemonLogs,
 } from './core/daemon-log-diagnostics.mjs';
+export { auditorFailureLane } from './core/auditor-outcome.mjs';
 export {
   RUNTIME_ERROR_DEFINITIONS,
   RUNTIME_ERROR_STORE_SCHEMA,
@@ -55,6 +56,8 @@ export {
   compactRuntimeErrors,
   defaultFactoryReporterConfigPath,
   defaultRuntimeErrorStorePath,
+  observeAuditorAvailability,
+  observeAuditorAvailabilityIsolatedSafe,
   observeRuntimeError,
   observeRuntimeErrorIsolatedSafe,
   observeRuntimeErrorSafe,

package/src/platform/spawn.mjs

@@ -134,12 +134,41 @@ export function npmShimEntryPath(source, shimDir) {
   return win32.join(shimDir, ...segments);
 }
 
+// taskkill は root の pid が存在しない時に 128 で終わる。この時 taskkill は何も終了していない。
+const TASKKILL_PROCESS_NOT_FOUND = 128;
+
+// 'close' は process の終了と全 stdio pipe の EOF を意味する。root より長生きした子孫が
+// pipe を持っている間は stream が閉じないので、ここは false になる。
+function childHasClosed(child) {
+  if (!Number.isInteger(child.exitCode) && typeof child.signalCode !== 'string') return false;
+  return [child.stdin, child.stdout, child.stderr].every((stream) => !stream || stream.destroyed === true);
+}
+
+function waitForChildClose(child, graceMs) {
+  if (childHasClosed(child)) return Promise.resolve(true);
+  if (typeof child.once !== 'function' || typeof child.off !== 'function') return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const onClose = () => {
+      clearTimeout(timer);
+      resolve(true);
+    };
+    const timer = setTimeout(() => {
+      child.off('close', onClose);
+      resolve(childHasClosed(child));
+    }, graceMs);
+    child.once('close', onClose);
+  });
+}
+
 // cmd.exe shim のみ kill すると孫の CLI が残り得るため、Windows は process tree を
 // taskkill で終了する。taskkill 自体の起動・終了に失敗した時だけ direct kill へ戻す。
+// taskkill が root を見つけられなかった時は、child 自身の close を確認できた場合だけ終了済みとする。
+// timeout と同時に自分で終わった process を「終了未確認」にしないためで、close が無ければ従来どおり失敗する。
 export function terminateProcessTree(child, {
   platform = process.platform,
   spawnFn = spawn,
   timeoutMs = 5_000,
+  closeGraceMs = 500,
 } = {}) {
   if (!child || typeof child.kill !== 'function') return Promise.resolve();
   if (platform !== 'win32' || !Number.isSafeInteger(child.pid) || child.pid <= 0) {
@@ -184,9 +213,20 @@ export function terminateProcessTree(child, {
           finish();
           return;
         }
-        const error = new Error(`taskkill exited with code ${code}`);
-        error.code = 'E_PROCESS_TREE_TERMINATION';
-        finish(error);
+        const fail = () => {
+          const error = new Error(`taskkill exited with code ${code}`);
+          error.code = 'E_PROCESS_TREE_TERMINATION';
+          error.exitCode = code;
+          finish(error);
+        };
+        if (code !== TASKKILL_PROCESS_NOT_FOUND) {
+          fail();
+          return;
+        }
+        waitForChildClose(child, closeGraceMs).then((closed) => {
+          if (closed) finish();
+          else fail();
+        });
       });
     } catch (cause) {
       const error = new Error(`taskkill spawn failed: ${cause.message}`);