gentle-pi 4.0.0 → 4.2.0

package/runtime/review-integration-v2.mjs

@@ -78,8 +78,8 @@ export const REVIEW_START_STATE = {
 const START_ACTIONS = ["created", "resumed", "closed", "blocked-scope-action"]         ;
 const RISK_LEVELS = ["low", "medium", "high"]         ;
 const REVIEW_LENSES = ["review-risk", "review-resilience", "review-readability", "review-reliability"]         ;
-const RISK_REASON_CODES = ["configuration_change", "empty_content", "executable_change", "executable_mode", "hot_path", "large_change", "non_executable_only", "process_boundary", "process_scan_limit", "service_token", "shell_source"]         ;
-const RISK_SIGNALS = ["auth", "update", "security", "payments", "permissions", "shell_process"]         ;
+const RISK_REASON_CODES = ["agent_escalation", "configuration_change", "dangerous_sink", "empty_content", "executable_change", "executable_mode", "hot_path", "large_change", "non_executable_only", "process_boundary", "process_scan_limit", "service_token", "shell_source"]         ;
+const RISK_SIGNALS = ["auth", "update", "security", "payments", "permissions", "shell_process", "dangerous_sink", "agent_escalation"]         ;
 // "collect" and "execute" are the v2 envelope's projection of a live
 // transaction whose next_transition is mandatory: the root action names the
 // transition kind instead of reading as a terminal stop.
@@ -637,6 +637,23 @@ const ESCALATION_REFUTER_OUTCOMES = ["corroborated", "refuted", "inconclusive"]
 
 
 
+function decodeReviewEscalationV1(value         , label        )                     {
+	const source = exactRecord(value, label, ["cause", "finding_ids"], ["refuter_outcomes"]);
+	const escalation                     = {
+		cause: enumeration(source.cause, ESCALATION_CAUSES, `${label}.cause`),
+		findingIds: stringArray(source.finding_ids, `${label}.finding_ids`),
+	};
+	if (Object.hasOwn(source, "refuter_outcomes")) escalation.refuterOutcomes = array(source.refuter_outcomes, `${label}.refuter_outcomes`, (entry, itemLabel) => {
+		const row = exactRecord(entry, itemLabel, ["finding_id", "outcome", "proof"]);
+		return {
+			findingId: nonempty(row.finding_id, `${itemLabel}.finding_id`),
+			outcome: enumeration(row.outcome, ESCALATION_REFUTER_OUTCOMES, `${itemLabel}.outcome`),
+			proof: nonempty(row.proof, `${itemLabel}.proof`),
+		};
+	});
+	return escalation;
+}
+
 
 
 
@@ -2105,23 +2122,9 @@ export function decodeReviewStatusV3(value         )                 {
 		};
 	}
 
-	let escalation                                ;
-	if (Object.hasOwn(body, "escalation")) {
-		const label = "status.escalation";
-		const source = exactRecord(body.escalation, label, ["cause", "finding_ids"], ["refuter_outcomes"]);
-		escalation = {
-			cause: enumeration(source.cause, ESCALATION_CAUSES, `${label}.cause`),
-			findingIds: stringArray(source.finding_ids, `${label}.finding_ids`),
-		};
-		if (Object.hasOwn(source, "refuter_outcomes")) escalation.refuterOutcomes = array(source.refuter_outcomes, `${label}.refuter_outcomes`, (entry, itemLabel) => {
-			const row = exactRecord(entry, itemLabel, ["finding_id", "outcome", "proof"]);
-			return {
-				findingId: nonempty(row.finding_id, `${itemLabel}.finding_id`),
-				outcome: enumeration(row.outcome, ESCALATION_REFUTER_OUTCOMES, `${itemLabel}.outcome`),
-				proof: nonempty(row.proof, `${itemLabel}.proof`),
-			};
-		});
-	}
+	const escalation = Object.hasOwn(body, "escalation")
+		? decodeReviewEscalationV1(body.escalation, "status.escalation")
+		: undefined;
 
 	// status/v7 top-level optional digest (gentle-ai v2.6.0): resolves #4066's
 	// closed loop where `sdd-attempt finish` named a digest status never
@@ -2584,7 +2587,11 @@ function assertReviewApprovedAcknowledgementExecuteShapeV1(execute
 	if (execute.arguments.length !== REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS.length) throw new TypeError(`acknowledgement.execute.arguments must carry exactly ${REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS.length} provider-issued arguments`);
 	const values = execute.arguments.map((argument, index) => { const name = REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS[index] ; if (argument.name !== name) throw new TypeError(`acknowledgement.execute.arguments[${index}].name must be ${name}`); const value = nonempty(argument.value, `acknowledgement.execute.arguments[${index}].value`); if (nonempty(argument.token, `acknowledgement.execute.arguments[${index}].token`) !== `--${name}=${value}`) throw new TypeError(`acknowledgement.execute.arguments[${index}].token must exactly match ${name}`); return value; });
 	if (execute.preconditions.length !== 1 || execute.preconditions[0]?.name !== "state" || execute.preconditions[0]?.value !== "approved") throw new TypeError("acknowledgement.execute.preconditions must be the single approved state precondition");
-	return { tokens: execute.arguments.map((argument) => argument.token )                                                , values: values                                                     , lineageId: lineage(execute.binding.lineageId, "acknowledgement.execute.binding.lineage_id"), targetIdentity: sha256(execute.binding.targetIdentity, "acknowledgement.execute.binding.target_identity"), revision: sha256(execute.binding.revision, "acknowledgement.execute.binding.revision") };
+	const tokens = execute.arguments.map((argument) => argument.token );
+	// The exact five-argument check above validates both vectors before tuple construction.
+	const tokenTuple                                               = [tokens[0] , tokens[1] , tokens[2] , tokens[3] , tokens[4] ];
+	const valueTuple                                                    = [values[0] , values[1] , values[2] , values[3] , values[4] ];
+	return { tokens: tokenTuple, values: valueTuple, lineageId: lineage(execute.binding.lineageId, "acknowledgement.execute.binding.lineage_id"), targetIdentity: sha256(execute.binding.targetIdentity, "acknowledgement.execute.binding.target_identity"), revision: sha256(execute.binding.revision, "acknowledgement.execute.binding.revision") };
 }
 
 /**
@@ -2689,6 +2696,28 @@ const REVIEW_LAST_EVENT_CAUSAL_DISPOSITIONS = ["introduced", "behavior-activated
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -2836,18 +2865,67 @@ function decodeReviewLastEventReviewerResultV1(value         , label        )
 	};
 }
 
+function decodeReviewTargetedValidatorCheckEvidenceV1(value         , label        )                                         {
+	const check = exactRecord(value, label, ["passed", "evidence"], ["regressions"]);
+	const regressions = Object.hasOwn(check, "regressions")
+		? array(check.regressions, `${label}.regressions`, (entry, entryLabel) => {
+			const row = exactRecord(entry, entryLabel, ["location", "claim", "proof_refs"], ["id"]);
+			return {
+				...(Object.hasOwn(row, "id") ? { id: nonempty(row.id, `${entryLabel}.id`) } : {}),
+				location: nonempty(row.location, `${entryLabel}.location`),
+				claim: nonempty(row.claim, `${entryLabel}.claim`),
+				proofRefs: stringArray(row.proof_refs, `${entryLabel}.proof_refs`, { minimum: 1 }),
+			};
+		}) : undefined;
+	return {
+		passed: boolean(check.passed, `${label}.passed`),
+		// Native admission rejects observations containing only Unicode whitespace.
+		evidence: stringArray(check.evidence, `${label}.evidence`, { minimum: 1, pattern: /[^\p{White_Space}]/u }),
+		...(regressions === undefined ? {} : { regressions }),
+	};
+}
+
+function decodeReviewTargetedValidatorEvidenceV1(value         , label        )                                    {
+	const body = exactRecord(value, label, ["targeted_validation_request_hash", "correction_target_identity", "original_criteria", "correction_regression", "follow_ups"]);
+	return {
+		targetedValidationRequestHash: sha256(body.targeted_validation_request_hash, `${label}.targeted_validation_request_hash`),
+		correctionTargetIdentity: sha256(body.correction_target_identity, `${label}.correction_target_identity`),
+		originalCriteria: decodeReviewTargetedValidatorCheckEvidenceV1(body.original_criteria, `${label}.original_criteria`),
+		correctionRegression: decodeReviewTargetedValidatorCheckEvidenceV1(body.correction_regression, `${label}.correction_regression`),
+		followUps: array(body.follow_ups, `${label}.follow_ups`, (entry, entryLabel) => {
+			const row = exactRecord(entry, entryLabel, ["observation", "proof_refs"]);
+			return { observation: nonempty(row.observation, `${entryLabel}.observation`), proofRefs: stringArray(row.proof_refs, `${entryLabel}.proof_refs`, { minimum: 1 }) };
+		}),
+		raw: body,
+	};
+}
+
 export function decodeReviewLastEventClosureV1(value         )                           {
-	const body = exactRecord(value, "last_event_closure", ["schema", "operation", "lineage_id", "state", "store_revision"], ["target_identity", "request_hash", "correction_lines", "action", "advisory_findings", "reviewer_results", "status_continuation", "acknowledgement"]);
+	const body = exactRecord(value, "last_event_closure", ["schema", "operation", "lineage_id", "state", "store_revision"], ["target_identity", "request_hash", "correction_lines", "action", "escalation", "targeted_validator_evidence", "advisory_findings", "reviewer_results", "status_continuation", "acknowledgement"]);
 	if (body.schema !== REVIEW_LAST_EVENT_CLOSURE_SCHEMA) throw new TypeError(`last_event_closure.schema must be ${REVIEW_LAST_EVENT_CLOSURE_SCHEMA}`);
 	const operation = enumeration(body.operation, Object.values(REVIEW_LAST_EVENT_CLOSURE_OPERATION), "last_event_closure.operation")                                   ;
 	const state = enumeration(body.state, REVIEW_LAST_EVENT_TERMINAL_STATES, "last_event_closure.state")                               ;
+	if (Object.hasOwn(body, "targeted_validator_evidence") && (operation !== REVIEW_LAST_EVENT_CLOSURE_OPERATION.CAPTURE_VALIDATION || state !== "escalated")) {
+		throw new TypeError("last_event_closure targeted_validator_evidence requires escalated review/capture-validation");
+	}
+	// Diagnostic evidence is optional for older providers and never controls terminal authority.
+	const targetedValidatorEvidence = Object.hasOwn(body, "targeted_validator_evidence")
+		? decodeReviewTargetedValidatorEvidenceV1(body.targeted_validator_evidence, "last_event_closure.targeted_validator_evidence")
+		: undefined;
+	if (Object.hasOwn(body, "escalation") && state !== "escalated") throw new TypeError("last_event_closure escalation requires escalated state");
+	// Older native closures omit this diagnostic; its presence never grants a continuation.
+	const escalation = Object.hasOwn(body, "escalation")
+		? decodeReviewEscalationV1(body.escalation, "last_event_closure.escalation")
+		: undefined;
 	const shared = {
 		schema: REVIEW_LAST_EVENT_CLOSURE_SCHEMA,
 		operation,
 		lineageId: lineage(body.lineage_id, "last_event_closure.lineage_id"),
 		state,
 		storeRevision: sha256(body.store_revision, "last_event_closure.store_revision"),
-	};
+		...(escalation === undefined ? {} : { escalation }),
+		...(targetedValidatorEvidence === undefined ? {} : { targetedValidatorEvidence }),
+	}         ;
 	if (operation === REVIEW_LAST_EVENT_CLOSURE_OPERATION.CAPTURE_CORRECTION_PLAN) {
 		if (body.reviewer_results !== undefined) throw new TypeError("last_event_closure reviewer_results requires approved state");
 		if (body.action !== undefined || body.advisory_findings !== undefined || body.status_continuation !== undefined) throw new TypeError("last_event_closure correction-plan cannot carry action, advisory_findings, or status_continuation");

package/runtime/review-risk-assessment.mjs

@@ -140,18 +140,23 @@ const DUE_REVIEW_REASONS                             = [REVIEW_DUE_REASON.HIGH_R
 
 /**
  * Rejects a review_due/review_due_reason/consumed combination the native
- * schema can never produce. `already_reviewed` takes precedence exactly when
- * the candidate is consumed, so the two must agree in both directions. A
- * contradictory envelope is never trusted, least of all as closure evidence.
- * Envelopes without the pair (older binaries) are not checked here.
+ * schema can never produce. A consumed candidate must report
+ * `already_reviewed`, but that reason can also describe an acknowledged
+ * committed predecessor followed by a passive delta (#1954). It does not
+ * prove this exact candidate was consumed; preserve native's explicit false.
+ * Native v2 requires consumed, so missing evidence with already_reviewed is
+ * still rejected. Envelopes without the pair (older binaries) are unchecked.
  */
 function validateReviewDueConsistency(reviewDue         , reviewDueReason                 , candidate                           )       {
 	if (reviewDue !== DUE_REVIEW_REASONS.includes(reviewDueReason)) {
 		throw new TypeError(`review assessment review_due ${reviewDue} contradicts review_due_reason ${reviewDueReason}`);
 	}
 	const alreadyReviewed = reviewDueReason === REVIEW_DUE_REASON.ALREADY_REVIEWED;
-	if (alreadyReviewed !== (candidate.consumed === true)) {
-		throw new TypeError("review assessment review_due_reason already_reviewed must be reported exactly when candidate.consumed is true");
+	if (candidate.consumed === true && !alreadyReviewed) {
+		throw new TypeError("review assessment candidate.consumed true requires review_due_reason already_reviewed");
+	}
+	if (alreadyReviewed && candidate.consumed === undefined) {
+		throw new TypeError("review assessment review_due_reason already_reviewed requires explicit candidate.consumed evidence");
 	}
 }
 
@@ -260,6 +265,53 @@ export const VERIFICATION_TIER = {
 }         ;
 
 
+// ---------------------------------------------------------------------------
+// Agent-raised risk (gentle-shell#1494). The agent that made the change may
+// raise its risk to high by citing one item of the high-risk list in the
+// always-on Task Size section; it can never lower a tier. Lowering stays with
+// the deterministic native assessment.
+// ---------------------------------------------------------------------------
+
+export const HIGH_RISK_ITEMS = Object.freeze({
+	1: "data or irreversible effects",
+	2: "security",
+	3: "changing or removing contracts others already consume",
+	4: "concurrency",
+	5: "delivery or environment",
+	6: "no test would catch a regression",
+}         );
+
+
+
+
+
+
+
+export const AGENT_RISK_ESCALATION_REASON_MAX = 500;
+
+export function decodeAgentRiskEscalation(value         )                      {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error("escalate must be an object with item and reason");
+	}
+	const record = value                           ;
+	const unexpected = Object.keys(record).find((key) => key !== "item" && key !== "reason");
+	if (unexpected !== undefined) throw new Error(`escalate does not accept ${unexpected}`);
+	const { item, reason } = record;
+	if (typeof item !== "number" || !Number.isInteger(item) || !(item in HIGH_RISK_ITEMS)) {
+		throw new Error("escalate item must be an integer from 1 to 6 naming a high-risk item");
+	}
+	if (typeof reason !== "string" || reason.trim() === "" || reason.length > AGENT_RISK_ESCALATION_REASON_MAX) {
+		throw new Error(`escalate reason must be a non-empty string of at most ${AGENT_RISK_ESCALATION_REASON_MAX} characters`);
+	}
+	return Object.freeze({ item: item                , reason });
+}
+
+/** Raises passive or medium to high when the agent escalated; never lowers. */
+export function escalatedRisk(risk                  , escalation                                 )                   {
+	if (escalation === undefined) return risk;
+	return risk === VERIFICATION_TIER.PASSIVE || risk === VERIFICATION_TIER.MEDIUM ? VERIFICATION_TIER.HIGH : risk;
+}
+
 export const RDD_LINE = {
 	ON: "on",
 	OFF: "off",
@@ -364,59 +416,33 @@ function nonClosedOutcomeClause(outcome                     )         {
 }
 
 /**
- * Computes who verifies a delegated writer's change, exactly as
- * gentle-pi#662/#668 specify:
+ * Computes who verifies a delegated writer's change. Verification follows the
+ * native risk tier whatever the RDD line and native review outcome
+ * (verify-always-rdd-high S1, superseding the gentle-pi#662/#668 on-path): the
+ * native review is an additional outside view and never replaces or skips the
+ * tier's verification. `nativeReviewOutcome` only shapes the reason text.
  *
- * - `rdd: "on"` AND the native review reached `NATIVE_REVIEW_OUTCOME.CLOSED`
- *   for this candidate: the writer self-verifies and no independent verifier
- *   runs, because the closed native review is the check -- except `passive`,
- *   which gets a structural readback by the parent instead.
- * - `rdd: "on"` with any other outcome (`declined`, `unavailable`, or the
- *   fail-closed `unknown` default for an omitted/unrecognized outcome): the
- *   `on` branch never held for this candidate, so the risk-gated path below
- *   applies exactly as `off` -- declining a review is candidate-scoped and
- *   never lowers the bar below the RDD-off path.
- * - `rdd: "off"` or `"unknown"` (both gate identically, so an unknown RDD line
- *   never lowers a tier relative to `off`; `nativeReviewOutcome` is ignored
- *   entirely on these lines):
- *   - `passive`: structural readback by the parent only; no verifier, no
- *     tests.
- *   - `medium`: the writer self-verifies; a separate independent verifier
- *     runs only when `writerProfile` is `"small"` -- the small-model bias
- *     raises the tier by one for verification purposes (medium -> high). An
- *     unknown or omitted writer profile resolves to `"small"` before it
- *     reaches this function (see `resolveWriterProfile`), so an unrecognized
- *     profile never lowers a tier below what a known small model would get.
- *   - `high` or `unassessable` (a failed or unrecognized native assessment is
- *     always treated as high): the writer self-verifies and an independent
- *     verifier always runs.
+ * - `passive`: structural readback by the parent only; no verifier, no tests.
+ * - `medium`: the writer self-verifies; a separate independent verifier runs
+ *   only when `writerProfile` is `"small"` -- the small-model bias raises the
+ *   tier by one for verification purposes (medium -> high). An unknown or
+ *   omitted writer profile resolves to `"small"` before it reaches this
+ *   function (see `resolveWriterProfile`), so an unrecognized profile never
+ *   lowers a tier below what a known small model would get.
+ * - `high` or `unassessable` (a failed or unrecognized native assessment is
+ *   always treated as high): the writer self-verifies and an independent
+ *   verifier always runs.
  */
 export function verificationPlan(input                       )                   {
 	const { rddLine, risk, writerProfile } = input;
 
 	if (rddLine === RDD_LINE.ON) {
 		const outcome = input.nativeReviewOutcome ?? NATIVE_REVIEW_OUTCOME.UNKNOWN;
-		if (outcome === NATIVE_REVIEW_OUTCOME.CLOSED) {
-			if (risk === VERIFICATION_TIER.PASSIVE) {
-				return Object.freeze({
-					writerSelfVerification: false,
-					structuralReadbackOnly: true,
-					independentVerifier: false,
-					reason: "receipt-driven development is on and the native review closed for this candidate; the assessment also reports passive risk: a structural readback by the parent replaces both the writer's self-verification and any separate verifier.",
-				});
-			}
-			return Object.freeze({
-				writerSelfVerification: true,
-				structuralReadbackOnly: false,
-				independentVerifier: false,
-				reason: "receipt-driven development is on and the native review closed for this candidate: the writer's self-verification is the record and the closed native review was the independent check the writer cannot influence, so no separate verifier is required.",
-			});
-		}
-		// The on branch holds only while the native review reaches a terminal
-		// outcome for this candidate. Anything else -- declined, unavailable, or
-		// unknown -- falls back to the exact same risk-gated path as off.
+		const clause = outcome === NATIVE_REVIEW_OUTCOME.CLOSED
+			? "the native review closed for this candidate"
+			: nonClosedOutcomeClause(outcome);
 		return riskGatedPlan(
-			`receipt-driven development is on, but ${nonClosedOutcomeClause(outcome)}, so the risk-gated path applies exactly as receipt-driven development off, and`,
+			`receipt-driven development is on and ${clause}; the native review is an additional outside view that never replaces verification, so the risk-gated path applies exactly as receipt-driven development off, and`,
 			risk,
 			writerProfile,
 		);

package/runtime/status-timing-diagnostics.mjs

@@ -0,0 +1,202 @@
+// Generated by scripts/build-runtime-modules.mjs. Do not edit.
+import { AsyncLocalStorage } from "node:async_hooks";
+
+
+
+const MAX_STATUSES = 8;
+const MAX_ACTIVE_OBSERVATIONS = 8;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const hostScope = new AsyncLocalStorage                 ();
+const nativeScope = new AsyncLocalStorage                   ();
+
+// Observer failures must never replace the operation's result or exception.
+function safely   (run         )                {
+	try { return run(); } catch { return undefined; }
+}
+function now(host                 )         {
+	const value = safely(host.clock);
+	if (value !== undefined && Number.isFinite(value) && value >= 0) return value;
+	host.summary.clock_unavailable = true;
+	return 0;
+}
+function elapsed(start        , end        )         { return Math.max(0, end - start); }
+
+// Failure/v2 codes and next_action are extensible strings, not safe diagnostic
+// text. Only recognized values enter this summary; no messages or raw envelopes.
+const CLI_CODES = new Set(["unavailable", "timeout", "non-zero", "signal", "unexpected-stderr", "output-limit", "empty-output", "malformed-json", "schema-incompatible", "identity-mismatch", "version-incompatible", "cancelled", "package-local-binary-missing", "unsupported-transition-operation"]);
+const NATIVE_CODES = new Set(["operation_timeout", "invalid_request", "binding_revision_conflict", "internal_error", "cancelled"]);
+function outcome(error         )          {
+	return safely(()          => {
+		if (typeof error !== "object" || error === null) return { kind: "unknown" };
+		const value = error                                                                                 ;
+		if (value.name === "NativeReviewCliError") return { kind: "cli_error", code: typeof value.code === "string" && CLI_CODES.has(value.code) ? value.code : "other" };
+		if (value.name !== "NativeReviewIntegrationError" || !value.failureEnvelope) return { kind: "unknown" };
+		const failure = value.failureEnvelope;
+		const result          = { kind: "native_failure", code: typeof failure.code === "string" && NATIVE_CODES.has(failure.code) ? failure.code : "other" };
+		if (["preflight", "pre_native", "native_running", "native_committed", "reconciliation"].includes(String(failure.phase))) result.phase = String(failure.phase);
+		if (["not_started", "committed", "unknown"].includes(String(failure.mutationOutcome))) result.mutation_outcome = String(failure.mutationOutcome);
+		if (typeof failure.retrySafe === "boolean") result.retry_safe = failure.retrySafe;
+		if (["stop", "review.status"].includes(String(failure.nextAction))) result.next_action = String(failure.nextAction);
+		return result;
+	}) ?? { kind: "unknown" };
+}
+
+/** The next already-authorized STATUS-bearing tool call consumes the arm. */
+export class StatusTimingDiagnostics {
+	        armed = false;
+	        epoch = 0;
+	        manager                                                ;
+	        session                    ;
+	        last                     ;
+	                 active = new Set                 ();
+	                 clock              ;
+	constructor(clock = () => performance.now()) { this.clock = clock; }
+
+	reset(ctx                   )       {
+		this.epoch++;
+		this.armed = false;
+		this.last = undefined;
+		for (const host of this.active) host.summary.statuses.length = 0;
+		this.active.clear();
+		this.manager = ctx?.sessionManager;
+		this.session = safely(() => ctx?.sessionManager.getSessionId());
+	}
+	        matches(ctx                  )          {
+		return safely(() => this.manager === ctx.sessionManager && !!this.session && this.session === ctx.sessionManager.getSessionId()) === true;
+	}
+	command(args        , ctx                  )       {
+		if (!this.matches(ctx)) this.reset(ctx);
+		const action = args.trim() || "show";
+		if (action === "enable") {
+			this.reset(ctx);
+			this.armed = !!this.session;
+			ctx.ui.notify(this.armed
+				? "STATUS timing armed for the next separately authorized STATUS-bearing tool call. No STATUS is invoked or retried. Use /gentle:status-timing show to consult the completed summary."
+				: "STATUS timing requires a live session.", "info");
+		} else if (action === "disable") {
+			this.reset(ctx);
+			ctx.ui.notify("STATUS timing disabled; in-memory observations cleared.", "info");
+		} else if (action === "show") {
+			ctx.ui.notify(this.last ? JSON.stringify(this.last, null, 2) : `No completed STATUS timing summary. Diagnostic is ${this.armed ? "armed" : "off"}.`, "info");
+		} else {
+			ctx.ui.notify("Unknown /gentle:status-timing sub-action. Use enable, disable, or show.", "warning");
+		}
+	}
+	tool                                   (definition                                   )                                    {
+		return {
+			...definition,
+			execute: async (toolCallId, params, signal, onUpdate, ctx) => {
+				const run = () => definition.execute(toolCallId, params, signal, onUpdate, ctx);
+				if (!this.matches(ctx)) this.reset(ctx);
+				if (!this.armed || this.active.size >= MAX_ACTIVE_OBSERVATIONS) return run();
+				const epoch = this.epoch;
+				const host                  = {
+					clock: this.clock,
+					current: () => this.epoch === epoch && this.matches(ctx),
+					claim: () => {
+						if (!host.current() || !this.armed) return false;
+						this.armed = false;
+						return true;
+					},
+					claimed: false, started: 0, lastNativeEnd: 0,
+					summary: { schema: "gentle-pi.status-timing/v1", host_total_ms: 0, dispatch_ms: 0, sidebar_ms: 0, completion_ms: 0, truncated: false, statuses: [] },
+				};
+				this.active.add(host);
+				host.started = now(host);
+				return hostScope.run(host, async () => {
+					try { return await run(); }
+					finally {
+						this.active.delete(host);
+						safely(() => {
+							if (!host.claimed || !host.current()) return;
+							const ended = now(host);
+							host.summary.host_total_ms = elapsed(host.started, ended);
+							host.summary.completion_ms = elapsed(host.lastNativeEnd, ended);
+							this.last = host.summary;
+						});
+					}
+				});
+			},
+		};
+	}
+}
+
+/** Only called by the existing STATUS entry points; never invokes one itself. */
+export async function observeNativeStatus   (timeoutMs        , run                  )             {
+	const host = hostScope.getStore();
+	if (!host || !safely(host.current)) return run();
+	if (!host.claimed) {
+		if (!safely(host.claim)) return run();
+		host.claimed = true;
+		host.summary.dispatch_ms = elapsed(host.started, now(host));
+	}
+	const sample               = { timeout_ms: timeoutMs, total_ms: 0, resolution_ms: 0, adapter_ms: 0, decode_ms: 0, outcome: { kind: "success" } };
+	if (host.summary.statuses.length < MAX_STATUSES) host.summary.statuses.push(sample);
+	else host.summary.truncated = true;
+	const started = now(host);
+	return nativeScope.run({ host, sample }, async () => {
+		try { return await run(); }
+		catch (error) { safely(() => { sample.outcome = outcome(error); }); throw error; }
+		finally {
+			safely(() => {
+				const ended = now(host);
+				sample.total_ms = elapsed(started, ended);
+				host.lastNativeEnd = ended;
+			});
+		}
+	});
+}
+
+function activeNative()                                {
+	const observation = nativeScope.getStore();
+	return observation && safely(observation.host.current) ? observation : undefined;
+}
+export function measureStatusSync   (stage                         , run         )    {
+	const observation = activeNative();
+	if (!observation) return run();
+	const started = now(observation.host);
+	try { return run(); }
+	finally { safely(() => { observation.sample[`${stage}_ms`] += elapsed(started, now(observation.host)); }); }
+}
+export async function measureStatusAsync   (stage           , run                  )             {
+	const observation = activeNative();
+	if (!observation) return run();
+	const started = now(observation.host);
+	try { return await run(); }
+	finally { safely(() => { observation.sample[`${stage}_ms`] += elapsed(started, now(observation.host)); }); }
+}
+export function measureStatusSidebar   (run         )    {
+	const host = hostScope.getStore();
+	if (!host || !safely(host.current)) return run();
+	const started = now(host);
+	try { return run(); }
+	finally { safely(() => { host.summary.sidebar_ms += elapsed(started, now(host)); }); }
+}

package/runtime/telemetry-trigger.mjs

@@ -1,5 +1,6 @@
 // Generated by scripts/build-runtime-modules.mjs. Do not edit.
 import { spawn as nodeSpawn } from "node:child_process";
+import { gentleAiIsolationEnv } from "./gentle-ai-binary.mjs";
 
 // gentle-ai#4309 owns anonymous usage telemetry end to end: install and
 // heartbeat events, the notice, every kill switch, and the wire contract.
@@ -129,7 +130,8 @@ export function spawnTelemetryTrigger(options                              )
 	try {
 		const child = spawnImpl(options.executable, ["telemetry", "trigger", "--json"], {
 			cwd: options.cwd,
-			env: options.env,
+			// S9: a bundled install keeps Gentle AI's telemetry state inside its prefix.
+			env: gentleAiIsolationEnv(options.env),
 			detached: true,
 			windowsHide: true,
 			stdio: "ignore",