jeo-code 0.8.19 → 0.8.21

package/CHANGELOG.md

@@ -6,6 +6,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.21] - 2026-07-10
+_"반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping._
+
+### Added
+- **Session draft-restore** (`src/agent/session.ts`, `src/commands/launch/session-slash.ts`, `src/commands/launch.ts`, `src/commands/launch/input.ts`) — an unsent, half-typed prompt now survives a hard exit (Ctrl+D/EOF/disconnected terminal) and is restored into the prompt box on `/resume` (gajae-code parity). The read-side plumbing (`updateSessionDraft`, `header.draft`, `runSessionSlash` surfacing it) already existed; `launch.ts` never consumed it. Added `persistSessionDraft` (mirrors the existing `persistSessionModel` pattern) and a new pure predicate `draftFromUnsentLine` (`launch/input.ts`), wired into all 3 resume paths — the interactive picker, the mid-loop `/session resume` command, and `--resume <id>`/`--continue`'s non-interactive startup path (this third path had NO draft restoration at all before this fix). Live-verified: seeded a real session's draft, launched the real `bun src/cli.ts --resume <id>` under a genuine PTY, confirmed the exact unsent text appeared in the live prompt box.
+- **Evidence-gated goal verification** (`src/agent/goal-verifier.ts`, `src/agent/engine.ts`, `src/commands/launch.ts`) — an LLM-judged `MET` goal verdict is now deterministically downgraded to `NOT_MET` when the turn mutated files with no fresh verification evidence, closing the "gate theater" failure mode (an LLM asserting success without re-checked evidence). `applyEvidenceGate` (pure, already unit-tested with 5 tests) existed but was never called anywhere — the same disconnected-scaffolding pattern `RouteHistory` shipped with in 0.8.16/0.8.17. `onBeforeDone`'s signature now carries the SAME `sawMutation`/`sawVerification`/`verificationStale` signals the engine's own done-gate already computes; `launch.ts`'s goal-verifier closure now gates `verifyGoal`'s raw verdict through it before persisting or acting on it.
+
+### Fixed
+- **`toolTarget` dedup** (`src/agent/step-budget.ts`, `src/agent/task-tool.ts`) — `task-tool.ts` had a private copy of the same coarse-call-target labeler `step-budget.ts` needed for a new edit-thrashing novelty rule (a model rewriting the same file with different content every attempt no longer earns endless step-budget extensions — only the first attempt at a given target counts as novel). Moved to `step-budget.ts` (exported), `task-tool.ts` now imports it — confirmed byte-identical, zero behavior change.
+
+### Added (catalog)
+- **`gpt-5.6`** (`src/ai/model-catalog.ts`) — OpenAI's newest catalogued model, consistent with existing entries; correctly excluded from the OAuth-only `CODEX_MODELS` allow-list (live discovery handles that drift per its own documented contract, not a static edit).
+
+### Verified
+- `bun test test/launch-flags.test.ts test/session-draft-restore.test.ts test/step-budget.test.ts test/goal-verifier.test.ts test/task-tool.test.ts test/doctor.test.ts test/prompt-router-tiers.test.ts test/model-catalog.test.ts` — 128 pass / 0 fail.
+- Full `bun test` — 2906 pass / 0 fail across 291 files.
+- `bun run typecheck` — no errors.
+- Live PTY end-to-end: real session seeded with `updateSessionDraft`, real `bun src/cli.ts --resume <id>` subprocess, confirmed the exact restored text in the live prompt box.
+
+## [0.8.20] - 2026-07-10
+_"모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here._
+
+### Fixed
+- **README `[!CAUTION]` block updated for the Antigravity exception** (`README.md`, `README.ko.md`, `README.ja.md`, `README.zh.md`) — the block's `high`/`complex` tier-fallback description ("scan for the strongest live-credentialed model... land on a different model each turn") stopped being accurate for Antigravity-/Gemini-OAuth-credentialed sessions after v0.8.19's `antigravityCompanyPoolPick` (default-on, no opt-in): those sessions instead spread across ONE model per company, session-stably (same session -> same pick every turn, not varying). Added an explicit exception clause in all 4 languages.
+- **CHANGELOG 0.8.18 test-count error** — "69 pass" for `test/route-history.test.ts test/route-slash.test.ts test/launch-prompt-routing.test.ts` corrected to the actual **71 pass** (independently reproduced twice, including in an isolated `git worktree` pinned to commit 50bd0b1).
+- **`RouteHistory`/`route-slash.ts` doc comments corrected** (`src/agent/route-history.ts`, `src/commands/launch/route-slash.ts`) — `turnNumber`'s doc comment now states it's a sequential ADD-counter (increments once per pre-call route AND once per mid-turn fallback retry), not a 1:1 conversational-turn counter as the old wording implied; `RouteHistory`'s hardcoded `maxSize` default (10) is now documented as an unconditional retention cap that `/route history <n>` can only narrow, never widen — `/route history 50` silently returns at most 10 entries. No behavior changed, doc-only.
+- **Tightened an over-loose test assertion** (`test/prompt-router.test.ts`) — the antigravity multi-company reachability test asserted `gemini-3.5-flash-low OR gemini-pro-agent` for Google's "high"-tier company slot, when the code's actual behavior (confirmed by independent manual trace against `MODEL_CATALOG`) is fully deterministic: `gemini-3.5-flash-low` always wins the recency tiebreak, `gemini-pro-agent` never does. Replaced the OR with two precise assertions.
+
+### Verified
+- 4 independent subagent audits, zero trust in prior claims: CodeCorrectnessAuditor (manual pen-and-paper trace of 2 antigravity routing scenarios against live `MODEL_CATALOG` — both confirmed correct), TestIntegrityAuditor (mutation-tested `onModelSwitch` and the `/model`-pin gate — both confirmed to genuinely fail when reverted; zero `.skip`/`.todo`/weakened assertions found across all 5 touched test files), LiveBehaviorVerifier (re-reproduced all 4 behavioral claims with self-generated session ids/mock server/HTTP status code — all PASS), DocsAccuracyAuditor (cross-checked every README/CHANGELOG claim in isolated `git worktree`s pinned to the exact historical commits).
+- Full `bun test` — 2898 pass / 0 fail across 291 files (290 tracked at this commit; the +1 is an unrelated concurrent session's untracked file, not part of this change).
+- `bun run typecheck` — no errors.
+- `bun run changelog:sync` — idempotent, zero diff on a clean run (independently confirmed by DocsAccuracyAuditor before this entry was added).
+
 ## [0.8.19] - 2026-07-09
 _"프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools._
 
@@ -36,7 +70,7 @@ _"라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동
 ### Verified
 - Live PTY re-verification (`bun src/cli.ts`, isolated `JEO_CONFIG_DIR`, real Anthropic credentials): 5 prompts of varying complexity in one session routed to 5 distinct tier/model pairs (trivial→claude-haiku-4-5, complex→claude-fable-5, trivial→claude-haiku-4-5, high→claude-sonnet-5, trivial→claude-haiku-4-5); `/route why` and `/route status` matched the actual serving model on every turn.
 - Live post-call-fallback reproduction: a real `Bun.serve` mock returning HTTP 500 on every call forced `launch.ts`'s equivalent-pool fallback to fire mid-turn; `/route why` immediately after correctly reported the POST-fallback model and a `warning: … switched to equivalent …` field, not the original pre-call pick.
-- `bun test test/route-history.test.ts test/route-slash.test.ts test/launch-prompt-routing.test.ts` — 69 pass / 0 fail.
+- `bun test test/route-history.test.ts test/route-slash.test.ts test/launch-prompt-routing.test.ts` — 71 pass / 0 fail.
 - `bun test test/tui-app.test.ts` — 51 pass / 0 fail (50 pre-existing + 1 new, covering the footer live-update fix).
 - Full `bun test` — 2885 pass / 0 fail across 290 files.
 - `bun run typecheck` — no errors.

package/README.ja.md

@@ -91,7 +91,7 @@ jeo --tmux               # 独立した tmux セッションで実行
 | `jeo autopilot status` | スコア方向、keep/revert 数、次アクションを示す ratchet ステータスフィールド |
 
 > [!CAUTION]
-> **`/model <name>` で特定モデルを手動指定すると、そのセッション中ルーティングが固定されます。** プロンプトルーティング(`/route`)はモデルが手動固定されていない間のみ毎ターン再評価されます。`/model <name>` で特定モデルを選ぶとその選択が固定され、`/model auto`(ピンを完全に解除)を実行するか、`/route on`(ピンを消さずに優先度だけ上げる — `/route off` した瞬間ピンが復活)を実行するまでルーティングは切り替わりません。`roles.*` 未設定時に `defaultModel` へ確定フォールバックするのは `standard` ティアのみで、`high`/`complex` ティアはフォールバック前にライブでクレデンシャル済みの最強モデルを先に探索するため、未設定でも毎ターン別モデルに着地することがあります。
+> **`/model <name>` で特定モデルを手動指定すると、そのセッション中ルーティングが固定されます。** プロンプトルーティング(`/route`)はモデルが手動固定されていない間のみ毎ターン再評価されます。`/model <name>` で特定モデルを選ぶとその選択が固定され、`/model auto`(ピンを完全に解除)を実行するか、`/route on`(ピンを消さずに優先度だけ上げる — `/route off` した瞬間ピンが復活)を実行するまでルーティングは切り替わりません。`roles.*` 未設定時に `defaultModel` へ確定フォールバックするのは `standard` ティアのみで、`high`/`complex` ティアは通常フォールバック前にライブでクレデンシャル済みの最強モデルを先に探索するため、未設定でも毎ターン別モデルに着地することがあります。**例外:** Antigravity または Gemini OAuth でクレデンシャルされたセッションは一つの資格情報で Anthropic/Google/OpenAI のモデルを再公開しており、その場合 `high`/`complex` は(必ずしも最強ではなく)会社ごとに1モデルへセッション単位で安定的に分散されるため、ターンごとに変わらずそのセッション中は固定されます。
 
 ## Spec-first ワークフロー
 
@@ -265,11 +265,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
+- **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
 - **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
-- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
-- **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -92,7 +92,7 @@ jeo --tmux               # 독립 tmux 세션에서 실행
 | `jeo autopilot status` | 점수 방향, keep/revert 횟수, 다음 액션을 보여주는 ratchet 상태 필드 |
 
 > [!CAUTION]
-> **`/model <name>`으로 특정 모델을 수동 지정하면 그 세션 동안 라우팅이 고정됩니다.** 프롬프트 라우팅(`/route`)은 모델이 수동으로 고정되지 않은 동안만 매 턴 재평가됩니다. `/model <name>`으로 특정 모델을 선택하면 그 선택이 그대로 고정되며, `/model auto`(핀을 완전히 해제)를 실행하거나 `/route on`(핀을 지우지 않고 그보다 우선순위를 높임 — `/route off` 하는 즉시 핀이 다시 살아남)을 실행하기 전까지는 라우팅이 다시 전환되지 않습니다. `roles.*` 항목 미설정 시 `defaultModel`로 확정 폴백되는 건 `standard` 티어뿐이며, `high`/`complex` 티어는 폴백 전에 실시간으로 크레덴셜된 가장 강력한 모델을 먼저 탐색하므로, 설정이 없어도 매 턴 다른 모델로 갈 수 있습니다.
+> **`/model <name>`으로 특정 모델을 수동 지정하면 그 세션 동안 라우팅이 고정됩니다.** 프롬프트 라우팅(`/route`)은 모델이 수동으로 고정되지 않은 동안만 매 턴 재평가됩니다. `/model <name>`으로 특정 모델을 선택하면 그 선택이 그대로 고정되며, `/model auto`(핀을 완전히 해제)를 실행하거나 `/route on`(핀을 지우지 않고 그보다 우선순위를 높임 — `/route off` 하는 즉시 핀이 다시 살아남)을 실행하기 전까지는 라우팅이 다시 전환되지 않습니다. `roles.*` 항목 미설정 시 `defaultModel`로 확정 폴백되는 건 `standard` 티어뿐이며, `high`/`complex` 티어는 보통 폴백 전에 실시간으로 크레덴셜된 가장 강력한 모델을 먼저 탐색하므로, 설정이 없어도 매 턴 다른 모델로 갈 수 있습니다. **예외:** Antigravity 또는 Gemini OAuth로 크레덴셜된 세션은 하나의 크레덴셜로 Anthropic/Google/OpenAI 모델을 함께 재노출하는데, 이 경우 `high`/`complex`는 (항상 최강 모델이 아니라) 회사당 모델 1개로 세션-안정적으로 분산되어, 턴마다 바뀌지 않고 해당 세션 내내 고정됩니다.
 
 ## Spec-first 워크플로
 
@@ -266,11 +266,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
+- **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
 - **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
-- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
-- **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -97,7 +97,7 @@ Inside the `jeo` REPL (Tab autocompletes; `/` opens the palette).
 | `jeo autopilot status` | Ratchet status field with score direction, keep/revert counts, and next action |
 
 > [!CAUTION]
-> **`/model <name>` locks routing for the rest of the session.** Prompt routing (`/route`) only re-evaluates per turn while no model is manually pinned. Picking a specific model via `/model <name>` freezes that choice — routing will *not* switch away from it again until you run `/model auto` (which clears the pin), or `/route on` (which *outranks* an active pin without clearing it — the pin reasserts itself the moment you run `/route off`). Missing a `roles.*` entry only guarantees a `defaultModel` fallback on the `standard` tier; the `high`/`complex` tiers first scan for the strongest live-credentialed model before falling back, so they can still land on a different model each turn even when unconfigured.
+> **`/model <name>` locks routing for the rest of the session.** Prompt routing (`/route`) only re-evaluates per turn while no model is manually pinned. Picking a specific model via `/model <name>` freezes that choice — routing will *not* switch away from it again until you run `/model auto` (which clears the pin), or `/route on` (which *outranks* an active pin without clearing it — the pin reasserts itself the moment you run `/route off`). Missing a `roles.*` entry only guarantees a `defaultModel` fallback on the `standard` tier; the `high`/`complex` tiers otherwise scan for the strongest live-credentialed model, so they can still land on a different model each turn even when unconfigured. **Exception:** an Antigravity- or Gemini-OAuth-credentialed session re-exports Anthropic/Google/OpenAI models under one credential — `high`/`complex` there instead session-stably spread across one model per company (not necessarily the strongest), so the pick stays fixed for that session rather than varying turn to turn.
 
 ## Spec-first workflow
 
@@ -273,11 +273,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
+- **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
 - **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
-- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
-- **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -91,7 +91,7 @@ jeo --tmux               # 在独立 tmux 会话中运行
 | `jeo autopilot status` | 显示分数方向、keep/revert 次数和下一步动作的 ratchet 状态字段 |
 
 > [!CAUTION]
-> **通过 `/model <name>` 手动指定模型后，路由会在本会话内保持锁定。** Prompt routing(`/route`)只在没有手动锁定模型时才会逐轮重新评估。用 `/model <name>` 选定具体模型后，该选择会被锁定 — 直到你运行 `/model auto`(彻底解除锁定)，或运行 `/route on`(不会清除锁定，只是优先级更高 — 一旦运行 `/route off`，锁定会立刻恢复)之前，路由都不会再切换。未配置 `roles.*` 条目时，只有 `standard` 层级会确定性地退回到 `defaultModel`；`high`/`complex` 层级会先实时扫描已配置凭证中最强的可用模型再决定是否回退，所以即使未配置，也可能每轮落到不同的模型上。
+> **通过 `/model <name>` 手动指定模型后，路由会在本会话内保持锁定。** Prompt routing(`/route`)只在没有手动锁定模型时才会逐轮重新评估。用 `/model <name>` 选定具体模型后，该选择会被锁定 — 直到你运行 `/model auto`(彻底解除锁定)，或运行 `/route on`(不会清除锁定，只是优先级更高 — 一旦运行 `/route off`，锁定会立刻恢复)之前，路由都不会再切换。未配置 `roles.*` 条目时，只有 `standard` 层级会确定性地退回到 `defaultModel`；`high`/`complex` 层级通常会先实时扫描已配置凭证中最强的可用模型再决定是否回退，所以即使未配置，也可能每轮落到不同的模型上。**例外:** 通过 Antigravity 或 Gemini OAuth 授权的会话会用同一个凭证重新导出 Anthropic/Google/OpenAI 的模型 —此时 `high`/`complex` 会按公司各选一个模型、以会话为单位稳定分布(不一定是最强的那个)，因此在同一会话内保持固定，而不是逐轮变化。
 
 ## Spec-first 工作流
 
@@ -265,11 +265,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.21]** (2026-07-10) — "반영할꺼 같은방식으로 체크하고 배포까지" — a rescan of the working tree (after the prior audit pass) turned up 15 uncommitted files: 3 genuinely distinct features left unwired by a concurrent session, partially casualty of an earlier accidental `git checkout` incident this session (disclosed in the 0.8.20 entry above). Each was independently traced from its existing plumbing, wired to a real call site, tested, and one live-verified end-to-end over a real PTY before shipping.
+- **[0.8.20]** (2026-07-10) — "모든 검증 다시 리뷰하고 변경사항 모두 체크해" — 4 fresh, skeptical subagents independently re-audited every change from v0.8.17-0.8.19 (bc8768f..92c6b7d) with zero trust in prior claims: a code-correctness auditor manually traced the Antigravity routing logic against the live catalog, a test-integrity auditor mutation-tested the new tests (confirmed each one genuinely fails when its fix is reverted) and ran the suite fresh, a live-behavior verifier re-reproduced all 4 behavioral claims from scratch with self-generated data (own session ids, own mock server, own HTTP status code), and a docs-accuracy auditor cross-checked every README/CHANGELOG claim against current code in isolated git worktrees. Verdict: all core logic and tests GENUINE/CONFIRMED CORRECT — but the audit surfaced 1 real doc staleness gap, 1 changelog count error, and 2 minor precision gaps, all fixed here.
 - **[0.8.19]** (2026-07-09) — "프롬프트 라우팅에 안티그라비티 프로바이더의 경우, 안티그라비티용 소넷과 오퍼스도 3.5급으로 라우팅될수있도록해줘" — Antigravity re-exports 3 distinct model families (Anthropic Claude, Google Gemini, OpenAI GPT-OSS) behind one credential, structurally unlike every other provider. `high`/`complex` tier auto-select always resolved to Google's Gemini 3.5 rows: Anthropic's real 64,000-token output ceiling lost a same-thinking-tier tie to Google's 65,536 by a margin with no practical significance, and Gemini's 1M-token context further outranked Claude's real 200K window — so `antigravity/claude-sonnet-4-6`/`antigravity/claude-opus-4-6-thinking` were NEVER reachable through auto-select, even though both were already correctly `sizeClass`-tagged into the `high`/`complex` pools.
 - **[0.8.18]** (2026-07-09) — "라우팅 매 프롬프트마다 변경되는지, route why 의도대로 동작하는지 검증하고 배포할게있는지 확인해줘" — 2 parallel subagents live-verified per-prompt routing + `/route why` (including the previously-only-unit-tested post-call equivalent-model fallback path, now reproduced against a real mock 500-error server) and audited a disconnected `RouteHistory` class shipped as incomplete scaffolding in 0.8.16/0.8.17 (class + 11 tests existed, but nothing ever called it — no `/route history` subcommand, no wiring into the turn loop). Live testing also surfaced one real bug: the TUI footer's model/provider label never updated after a mid-turn fallback, staying on the pre-fallback model for the rest of that turn's render even though the backend decision (`lastRouteDecision`) was already correct.
 - **[0.8.17]** (2026-07-09) — "서브에이전트 이용해. 병렬루 부가 나머지모두 개선하고 검증후 배포까지하자" — a prior 4-way parallel subagent cross-verification pass found the README `[!CAUTION]` routing-lock block (added this session for "프롬프트 라우팅이 한번 정해지면 안바뀌는데?") was directionally correct but had 2 real inaccuracies, plus a concrete test-coverage gap: every existing pin/override regression test drove the lock via the `--model` CLI startup flag, never via typing `/model <name>` as an interactive slash command mid-session, and none proved persistence across 3+ consecutive turns.
-- **[0.8.16]** (2026-07-09) — "jeo code의 computer use 기능은 / 명령어로 설정할수있도록하고, 실동작검증까지진행해줘" — the desktop-automation `computer` tool was only togglable by hand-editing `computer.enabled` in `~/.jeo/config.json`; there was no in-session way to enable it for a single run without leaving a permanent config change behind.
-- **[0.8.15]** (2026-07-09) — "api 인증 모델도 사용가능하도록 딥리서치하고 개선해줘" — traced the API-authenticated GPT path to a routing catalog gap: `GET /models` with an OpenAI API key or an OpenAI-compatible provider returned real account-scoped model ids, and `/model` could show/pin them, but prompt routing still built its auto-select pools from static `MODEL_CATALOG` rows only. A custom `openaiBaseUrl` made this worse by treating every public OpenAI row as servable, so routing could choose `gpt-*`/`o*` ids that the configured local/Azure/proxy endpoint never listed.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.19",
+  "version": "0.8.21",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/engine.ts

@@ -27,7 +27,8 @@ import { isContextOverflowError, isRefusalError, friendlyProviderError } from ".
 import { runPreToolHooks, runPostTurnHooksForBatch } from "./hooks";
 import { truncateToolOutput, formatToolResultBody } from "./tool-output";
 export { TOOL_OUTPUT_MAX, READ_OUTPUT_MAX, TOOL_SPILL_THRESHOLD, MAX_TOOL_ARTIFACTS, truncateToolOutput, spillToolResult } from "./tool-output";
-import { StepBudget, dynamicStepBudgetConfig, resolveStepBudgetConfig, hashSignature, type StepBudgetConfig } from "./step-budget";
+import { StepBudget, dynamicStepBudgetConfig, resolveStepBudgetConfig, hashSignature, toolTarget, type StepBudgetConfig } from "./step-budget";
+
 import { historyTokens, trimToolResultsInPlace, stripReasoningArtifactsInPlace } from "./compaction";
 import { jeoEnv } from "../util/env";
 import { GUARD_LIMITS, isVerificationSignal, repeatHint, classifyDoneGate } from "./loop-guards";
@@ -258,8 +259,17 @@ export interface AgentLoopEvents {
   /** Consulted when a lone `done` arrives. Return a corrective message to bounce
    *  the done ONCE (e.g. "todo list still shows unfinished items — update it
    *  first"); return null to let the turn finish. The engine guarantees at most
-   *  one bounce per turn, so a stubborn model can never loop here. */
-  onBeforeDone?(reason: string): Promise<string | null> | string | null;
+   *  one bounce per turn, so a stubborn model can never loop here. `evidence` is
+   *  the SAME mutation/verification signal the engine's own done-gate already
+   *  computed (see `classifyDoneGate` above) — a caller-owned gate (e.g. the goal
+   *  verifier) can use it to deterministically downgrade an LLM-judged MET verdict
+   *  when the turn mutated files without a fresh passing verification, instead of
+   *  trusting the transcript self-report alone. */
+  onBeforeDone?(
+    reason: string,
+    evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean }
+  ): Promise<string | null> | string | null;
+
   /** Fired when a mid-turn steering message (an additional user query typed while
    *  the turn is running) is injected into the live history. `text` is the raw
    *  user line — drives a TUI notice so the user sees their input was picked up. */
@@ -994,7 +1004,12 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       // [DONE] with the Todos checklist still showing 1 in-progress + 4 pending
       // because nothing ever forced a status update.
       if (!beforeDoneNudgeUsed && ev.onBeforeDone) {
-        const nudge = await ev.onBeforeDone((toolCalls[0].arguments?.reason as string) ?? "");
+        const nudge = await ev.onBeforeDone((toolCalls[0].arguments?.reason as string) ?? "", {
+          sawMutation,
+          sawVerification,
+          verificationStale: sawMutation && lastMutationSeq > lastVerificationSeq,
+        });
+
         if (nudge) {
           beforeDoneNudgeUsed = true;
           pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
@@ -1044,6 +1059,22 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     // once per call here (instead of joining full sigs, hashing, then re-hashing
     // inside budget.record) avoids re-scanning a large write body 3× per step.
     const callSigs = toolCalls.map(c => hashSignature(`${c.tool}:${JSON.stringify(c.arguments ?? {})}`));
+    // Coarse per-call TARGET (e.g. `edit src/x.ts`) — feeds the budget's novelty rule
+    // separately from the exact-args digest above. A model that keeps rewriting the
+    // SAME file/command with slightly different content each attempt produces a fresh
+    // `callSigs` entry every time (never "seen" before) but the SAME `callTargets`
+    // entry, so that thrashing stops earning step-budget extensions after its first try.
+    // `toolTarget` falls back to the bare tool name when it can't find an identifying
+    // field (e.g. a custom/dynamic tool with no filePath/command/pattern argument) — that
+    // generic case carries NO real identity ("work" for every call), so treat it as "no
+    // coarse target" and let `budget.record` fall back to the exact-args signature
+    // instead (unchanged legacy novelty for tools this helper doesn't specifically know).
+    const callTargets = toolCalls.map(c => {
+      const t = toolTarget(c.tool, c.arguments);
+      return t.toLowerCase() === (c.tool || "").toLowerCase() ? undefined : t;
+    });
+
+
     const sig = callSigs.length === 1 ? callSigs[0] : hashSignature(callSigs.join(" | "));
     if (sig === lastSig) repeatCount++;
     else {
@@ -1299,7 +1330,8 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
     // edits plus one trivial successful read must not look like a progressing
     // step to the extension heuristic (that loophole earned endless extensions).
     for (let i = 0; i < toolCalls.length; i++) {
-      if (results[i].executed) budget.record(callSigs[i], results[i].success);
+      if (results[i].executed) budget.record(callSigs[i], results[i].success, callTargets[i]);
+
     }
     // done-verification guard bookkeeping: write/edit successes mark the turn as
     // mutating; a successful bash whose command/output looks like a test/build run

package/src/agent/goal-verifier.ts

@@ -78,8 +78,47 @@ Do not include any other text, markdown formatting, or code blocks. Output raw J
       verdict: "NOT_MET",
       reason: `Goal verification failed to parse or execute: ${(err as Error).message}. Please verify the goal manually.`
     };
+
   }
 }
+
+/** Evidence the engine's own done-gate already computed this turn (see
+ *  `classifyDoneGate`/`engine.ts`) — NOT re-derived here, just consumed, so this
+ *  stays a pure function over already-verified signals rather than a second
+ *  regex/text scan. */
+export interface TurnEvidence {
+  sawMutation: boolean;
+  sawVerification: boolean;
+  verificationStale: boolean;
+}
+
+/**
+ * Deterministic downgrade gate: an LLM-judged MET verdict is trustworthy only when
+ * the turn either made no file changes, or made changes AND a fresh (non-stale)
+ * verification signal (test/build/typecheck/lint) was observed. A turn that mutated
+ * files with no verification at all, or whose only verification predates the last
+ * mutation, cannot self-report MET on the transcript alone — that is exactly the
+ * "gate theater" failure mode (an LLM asserting success without re-checked evidence).
+ * NOT_MET/IMPOSSIBLE verdicts pass through unchanged: this only ever tightens MET,
+ * never loosens a verdict the LLM itself already found lacking.
+ */
+export function applyEvidenceGate(verdict: GoalVerdict, evidence: TurnEvidence): GoalVerdict {
+  if (verdict.verdict !== "MET") return verdict;
+  if (!evidence.sawMutation) return verdict; // nothing changed — the transcript judgment stands
+  if (evidence.sawVerification && !evidence.verificationStale) return verdict; // fresh verification backs the claim
+
+  const gap = !evidence.sawVerification
+    ? "the turn modified files but no test/build/typecheck/lint run was observed"
+    : "the turn's only verification run predates its last file modification (stale evidence)";
+  return {
+    verdict: "NOT_MET",
+    reason:
+      `Goal verifier LLM judged MET, but this was overridden by deterministic evidence: ${gap}. ` +
+      `Re-run the relevant verification AFTER the last file change, then call done again. ` +
+      `(Original LLM reason: ${verdict.reason})`,
+  };
+}
+
  
 
 export interface GoalState {

package/src/agent/route-history.ts

@@ -9,12 +9,21 @@ import type { RouteDecision } from "./prompt-router";
 
 export interface RouteHistoryEntry extends RouteDecision {
   timestamp: number; // Date.now()
-  turnNumber: number; // 1-indexed turn in this session
+  /** 1-indexed sequence number of this RECORDED DECISION (not the REPL turn) —
+   *  `add()` fires once for the pre-call routing pick AND once more per
+   *  mid-turn equivalent-pool fallback (launch.ts's retry loop), so a single
+   *  user turn that hits a fallback can produce several CONSECUTIVE entries
+   *  here. Do not treat this as a 1:1 conversational-turn counter. */
+  turnNumber: number;
 }
 
 /**
  * Bounded FIFO queue of routing decisions. Oldest entries are dropped when
- * the queue exceeds `maxSize`.
+ * the queue exceeds `maxSize`. The REPL constructs this with the default
+ * `maxSize` (10) — `/route history <n>`'s `n` argument only WINDOWS this
+ * already-capped retention (`launch.ts`'s single `new RouteHistory()` call
+ * site never passes a wider size), so `/route history 50` silently returns
+ * at most the last 10 decisions recorded this session, not 50.
  */
 export class RouteHistory {
   private entries: RouteHistoryEntry[] = [];

package/src/agent/step-budget.ts

@@ -168,17 +168,29 @@ export class StepBudget {
   }
 
   /** Record an executed tool call (ring-buffered to the scoring window).
-   *  Stored as a fixed-size digest — see `hashSignature` (memory bound). */
-  record(signature: string, success: boolean): void {
+   *  Stored as a fixed-size digest — see `hashSignature` (memory bound).
+   *
+   *  `targetKey` (optional) is the COARSE target (e.g. `edit src/x.ts`) the novelty rule
+   *  scores against, instead of `signature`'s full-args hash. Without it, retrying an
+   *  edit on the SAME file with slightly different content each attempt looks "novel"
+   *  forever (the exact args hash never repeats) and the extension heuristic reads that
+   *  edit-thrashing loop as endless progress. With it, only the FIRST attempt at a given
+   *  target counts as novel; grinding on the same file/command afterwards does not, so a
+   *  stuck rewrite loop stops earning extensions even though every individual call
+   *  "succeeds" and every exact signature is technically unique. Falls back to `signature`
+   *  when omitted (unchanged behavior for existing callers/tests). */
+  record(signature: string, success: boolean, targetKey?: string): void {
     const sig = hashSignature(signature);
-    if (!this.seen.has(sig)) {
-      this.seen.add(sig);
+    const noveltyKey = hashSignature(targetKey ?? signature);
+    if (!this.seen.has(noveltyKey)) {
+      this.seen.add(noveltyKey);
       this.novelSinceExtension++;
     }
     this.window.push({ signature: sig, success });
     if (this.window.length > this.cfg.windowSize) this.window.shift();
   }
 
+
   /** A mid-turn steering message arrived — fresh, user-driven work. Grant headroom
    *  (capped at the hard cap, without consuming the extension budget) and clear the
    *  scoring window so the new instruction is never declined by the previous
@@ -239,3 +251,31 @@ export class StepBudget {
     };
   }
 }
+/**
+ * A concise, gjc-style label for a tool call's actual TARGET (file / command / glob) —
+ * not just the bare tool name plus its full argument blob. Two calls that touch the SAME
+ * target (e.g. `edit src/x.ts` twice with different bodies) collapse to the same target
+ * key here even though `hashSignature` of their full arguments differs. Shared by the
+ * budget's novelty rule (below) and `task-tool.ts`'s live subagent monitor label — kept
+ * pure/local (no TUI dependency in the agent layer).
+ */
+export function toolTarget(tool: string, rawArgs: unknown): string {
+  const a = (rawArgs && typeof rawArgs === "object" && !Array.isArray(rawArgs) ? rawArgs : {}) as Record<string, unknown>;
+  const t = (tool || "").toLowerCase();
+  const str = (...keys: string[]): string => {
+    for (const k of keys) { const v = a[k]; if (typeof v === "string" && v.length > 0) return v; }
+    return "";
+  };
+  if (t === "bash") {
+    const cmd = str("command", "cmd").split("\n")[0]!.trim();
+    return cmd ? `bash: ${cmd.length > 80 ? cmd.slice(0, 79) + "…" : cmd}` : "bash";
+  }
+  if (t === "read" || t === "write" || t === "edit") {
+    const f = str("filePath", "path");
+    return f ? `${t} ${f}` : t;
+  }
+  if (t === "find") { const g = str("globPattern", "pattern"); return g ? `find ${g}` : "find"; }
+  if (t === "search") { const p = str("pattern"); return p ? `search ${p}` : "search"; }
+  if (t === "task") { const r = str("role"); return r ? `task ${r}` : "task"; }
+  return tool || "tool";
+}

package/src/agent/task-tool.ts

@@ -10,6 +10,8 @@
  * `task` itself, so delegation cannot recurse infinitely.
  */
 import { runAgentLoop, type ToolHandler } from "./engine";
+import { toolTarget } from "./step-budget";
+
 import type { ToolResult } from "./tools";
 import type { Message } from "./loop";
 import { loadProjectContext, withProjectContext } from "./context-files";
@@ -146,31 +148,6 @@ export function taskToolProtocolLine(config?: Pick<Config, "subagents">): string
   );
 }
 
-/**
- * A concise, gjc-style label for a subagent's tool call — the actual TARGET (file / command /
- * glob), not just the bare tool name — so the parent's live monitor shows "read src/x.ts" or
- * "bash: bun test" instead of "read"/"bash". Kept local (no TUI dependency in the agent layer).
- */
-function toolTarget(tool: string, rawArgs: unknown): string {
-  const a = (rawArgs && typeof rawArgs === "object" && !Array.isArray(rawArgs) ? rawArgs : {}) as Record<string, unknown>;
-  const t = (tool || "").toLowerCase();
-  const str = (...keys: string[]): string => {
-    for (const k of keys) { const v = a[k]; if (typeof v === "string" && v.length > 0) return v; }
-    return "";
-  };
-  if (t === "bash") {
-    const cmd = str("command", "cmd").split("\n")[0]!.trim();
-    return cmd ? `bash: ${cmd.length > 80 ? cmd.slice(0, 79) + "…" : cmd}` : "bash";
-  }
-  if (t === "read" || t === "write" || t === "edit") {
-    const f = str("filePath", "path");
-    return f ? `${t} ${f}` : t;
-  }
-  if (t === "find") { const g = str("globPattern", "pattern"); return g ? `find ${g}` : "find"; }
-  if (t === "search") { const p = str("pattern"); return p ? `search ${p}` : "search"; }
-  if (t === "task") { const r = str("role"); return r ? `task ${r}` : "task"; }
-  return tool || "tool";
-}
 
 function firstUsefulLine(output: string | undefined): string {
   if (!output) return "";

package/src/ai/model-catalog.ts

@@ -98,7 +98,8 @@ export const MODEL_CATALOG: readonly CatalogModel[] = [
   { canonical: "claude-sonnet-4-6", provider: "anthropic", providerModel: "claude-sonnet-4-6", contextTokens: 1_000_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-02" },
   { canonical: "claude-opus-4-6", provider: "anthropic", providerModel: "claude-opus-4-6", contextTokens: 1_000_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-02" },
   { canonical: "claude-haiku-4-5", provider: "anthropic", providerModel: "claude-haiku-4-5-20251001", contextTokens: 200_000, maxOutputTokens: 64_000, thinking: FULL, images: true, releaseDate: "2025-10" },
-  // OpenAI (newest first: gpt-5.5 > gpt-5.4 > o4-mini/o3/gpt-4.1 > o3-mini > gpt-4o-mini > gpt-4o)
+  // OpenAI (newest first: gpt-5.6 > gpt-5.5 > gpt-5.4 > o4-mini/o3/gpt-4.1 > o3-mini > gpt-4o-mini > gpt-4o)
+  { canonical: "gpt-5.6", provider: "openai", providerModel: "gpt-5.6", contextTokens: 400_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-06" },
   { canonical: "gpt-5.5", provider: "openai", providerModel: "gpt-5.5", contextTokens: 400_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-04" },
   { canonical: "gpt-5.4", provider: "openai", providerModel: "gpt-5.4", contextTokens: 400_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-03" },
   { canonical: "gpt-5.4-mini", provider: "openai", providerModel: "gpt-5.4-mini", contextTokens: 272_000, maxOutputTokens: 128_000, thinking: FULL, images: true, releaseDate: "2026-03" },

package/src/commands/launch/input.ts

@@ -415,6 +415,19 @@ export function captureLivePromptInputChunk(state: PromptInputQueue, chunk: stri
   return accepted;
 }
 
+/**
+ * Whether an in-flight readline line buffer (captured right before a hard
+ * exit — Ctrl+D/EOF/disconnected terminal) should be persisted as an unsent
+ * draft (gajae-code "unsent prompt survives /resume" parity). Whitespace-only
+ * or empty input is never a real draft. Pure predicate so the exit-path
+ * wiring in launch.ts (which owns the actual persistence side effect) stays
+ * thin and this decision is independently testable.
+ */
+export function draftFromUnsentLine(line: string | undefined): string | undefined {
+  const trimmed = (line ?? "").trim();
+  return trimmed ? trimmed : undefined;
+}
+
 /**
  * TTY "new input first" contract: fold any queued FULL lines (stray
  * Enter-terminated buffer noise, or older persisted queues) into the editable

package/src/commands/launch/route-slash.ts

@@ -69,7 +69,10 @@ function explainDecision(decision: RouteDecision | { note: string } | null): str
 /**
  * Format the last `n` history entries (default 10) as one line each:
  * `turn N: tier -> model (source, confidence X.XX)`, oldest of the selected
- * window first — matches `getAll()`'s chronological ordering.
+ * window first — matches `getAll()`'s chronological ordering. `entries` is
+ * ALREADY capped to `RouteHistory`'s `maxSize` (default 10) by the caller —
+ * `n` only narrows that window further, it can never widen it, so a large
+ * `n` (e.g. 50) silently returns at most `maxSize` entries.
  */
 function formatHistory(entries: RouteHistoryEntry[], n: number): string[] {
   if (entries.length === 0) return ["No routing decisions recorded yet this session."];

package/src/commands/launch.ts

@@ -50,7 +50,7 @@ import { readGlobalConfig, saveConfigPatch, resolveWikiRoot } from "../agent/sta
 import { rememberModelPatch, recentModelsForDisplay } from "../agent/model-recency";
 import { describeModel, describeAllProviders, describeProvider, resolveProvider, thinkingMaxTokens, resolveMaxOutputTokens, thinkingToReasoningEffort, discoverModels, flattenModels, resolveSelection, catalogMetadata, catalogByProvider, resolveRoleModel, CODEX_MODELS, qualifyModelId, modelServableWithConfig, isLocalProviderReachable } from "../ai";
 import type { ProviderModelsResult, PickEntry, ProviderName, ModelRole, ThinkLevel } from "../ai";
-import { readGoalState, writeGoalState, clearGoalState, verifyGoal } from "../agent/goal-verifier";
+import { readGoalState, writeGoalState, clearGoalState, verifyGoal, applyEvidenceGate } from "../agent/goal-verifier";
 import { routePrompt, deriveCacheSessionKey, warnOnce, tierModelPool, selectFromPool, PROMPT_TIERS, withRoutingTierSetting, inferTierForModel, type PromptTier, type RouteDecision } from "../agent/prompt-router";
 import { RouteHistory } from "../agent/route-history";
 
@@ -111,7 +111,6 @@ import {
   exportSession,
   updateSessionModel,
   updateSessionDraft,
-
   appendCompaction,
   resolveSessionRef,
 } from "../agent/session";
@@ -165,6 +164,7 @@ import {
   boxVerticalNavAction,
   queuePromptInputChunk,
   captureLivePromptInputChunk,
+  draftFromUnsentLine,
   restoreQueuedLinesToPrefill,
   createInFlightAbortHarness,
   classifyMidTurnLine,
@@ -264,6 +264,7 @@ export {
   boxVerticalNavAction,
   queuePromptInputChunk,
   captureLivePromptInputChunk,
+  draftFromUnsentLine,
   restoreQueuedLinesToPrefill,
   createInFlightAbortHarness,
   classifyMidTurnLine,
@@ -689,6 +690,12 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   let lastUserInput = "";
   // Full untruncated text of the last assistant reply — surfaced in detail by Ctrl+O.
   let lastReply = "";
+  // Unsent draft restored from a NON-interactive resume path (`--resume <id>`,
+  // `--continue`/`-c`) — the interactive-picker and mid-loop `/session resume`
+  // paths feed `queuedPromptInput.partial` directly (declared much later); this
+  // one exists because `queuedPromptInput` isn't in scope yet at startup. Read
+  // once by `queuedPromptInput`'s own initializer below, then not touched again.
+  let startupDraft: string | undefined;
   // Full untruncated output of the most recent tool call — the clipped forge
   // card's `⟦Ctrl+O for more⟧` hint resolves here.
   let lastToolDetail: { tool: string; output: string } | null = null;
@@ -754,10 +761,6 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
 
   // pi-style session persistence: resume an existing session or create a new one.
   let sessionId: string | undefined;
-  // Unsent input-box draft restored from a resumed session's header (gajae-code
-  // parity) — folded into the very first prompt once `queuedPromptInput` exists.
-  let restoredDraft = "";
-
   let compactionSeq = 0;
   if (!flags.noSession) {
     if (flags.resumeInteractive) {
@@ -776,8 +779,6 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             for (const m of messages) history.push(m);
             sessionId = id;
             if (!initialSessionModel && header.model) sessionModel = header.model;
-            if (header.draft) restoredDraft = header.draft;
-
             const modelNote = sessionModel ? ` · model ${sessionModel}` : "";
             console.log(`Resumed session ${id} (${messages.length} messages).${modelNote}`);
           } catch (err) {
@@ -816,8 +817,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           // Restore the model this session was last using unless the CLI explicitly
           // pinned one (flags.model/role/provider → initialSessionModel wins).
           if (!initialSessionModel && header.model) sessionModel = header.model;
-          if (header.draft) restoredDraft = header.draft;
-
+          // Restore the unsent input-box draft (gajae-code parity) — see
+          // startupDraft's own doc comment for why this path can't feed
+          // queuedPromptInput.partial directly yet.
+          if (header.draft) startupDraft = header.draft;
           const modelNote = sessionModel ? ` · model ${sessionModel}` : "";
           console.log(`Resumed session ${id} (${messages.length} messages).${modelNote}`);
         } catch (err) {
@@ -851,6 +854,18 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     } catch { /* best-effort */ }
   };
 
+  // Persist (or clear) the unsent input-box draft into the session header so a
+  // later `/resume` restores it into the prompt (gajae-code parity: an
+  // in-progress prompt survives a quit + resume instead of being silently
+  // lost). Best-effort, same contract as persistSessionModel above — a
+  // header-rewrite failure must never abort the exit path that calls this.
+  const persistSessionDraft = async (draft: string): Promise<void> => {
+    if (flags.noSession || !sessionId) return;
+    try {
+      await updateSessionDraft(sessionId, draft, cwd);
+    } catch { /* best-effort */ }
+  };
+
   // `step N/M` display seed: the explicit --max-steps cap, else the dynamic budget's
   // rolling base — the engine's onBudget event keeps the denominator honest as it grows.
   const initialStepLimit = flags.maxSteps > 0 ? flags.maxSteps : initialDynamicStepLimit();
@@ -1292,7 +1307,10 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         // Todos checklist used to end a finished turn stuck at "✓0 ◐1 ·4 / 5"
         // because nothing ever forced the model to update item statuses).
         let turnTodos: { title: string; status: string }[] = [];
-        const onBeforeDone = async (reason: string): Promise<string | null> => {
+        const onBeforeDone = async (
+          reason: string,
+          evidence: { sawMutation: boolean; sawVerification: boolean; verificationStale: boolean },
+        ): Promise<string | null> => {
           const unfinished = turnTodos.filter(t => t.status !== "done");
           if (turnTodos.length > 0 && unfinished.length > 0) {
             return (
@@ -1314,7 +1332,12 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
             }
 
             if (tui) tui.events().onNotice?.("[Goal Verifier] Running goal verification...");
-            const verdict = await verifyGoal(goalState.condition, history, activeModel);
+            const llmVerdict = await verifyGoal(goalState.condition, history, activeModel);
+            // Deterministic downgrade: a fresh MET from the transcript-only LLM
+            // judge still needs mutation/verification evidence to back it up —
+            // see applyEvidenceGate's own docs (goal-verifier.ts). NOT_MET/
+            // IMPOSSIBLE pass through unchanged; this only ever tightens MET.
+            const verdict = applyEvidenceGate(llmVerdict, evidence);
 
             goalState.verdicts.push({
               at: Date.now(),
@@ -2192,13 +2215,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // IMMEDIATELY on its next iteration, bypassing the "new input first" prefill contract
   // (the user explicitly invoked them — no second Enter).
   const pendingMidTurnCommands: string[] = [];
-  const queuedPromptInput: PromptInputQueue = { pendingLines: pendingStdinLines, partial: "", pastedLines: [], inPaste: false };
-  // Fold a restored `/resume` draft (session header `draft`) into the very first
-  // prompt the same way a queued mid-turn prefill lands — visible in the input box,
-  // Enter to run, Esc/Ctrl+U to discard (gajae-code parity: an in-progress prompt
-  // survives a quit + resume instead of being silently lost).
-  if (restoredDraft) queuedPromptInput.partial = restoredDraft;
-
+  const queuedPromptInput: PromptInputQueue = { pendingLines: pendingStdinLines, partial: startupDraft ?? "", pastedLines: [], inPaste: false };
   queueBusyInput = (chunk: string) => captureLivePromptInputChunk(queuedPromptInput, chunk);
   queueBusyPasteActive = () => queuedPromptInput.inPaste;
   queueBusySnapshot = () => ({
@@ -2210,19 +2227,6 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // default routes to the immediate-dispatch queue served at the top of the loop.
     (jeoEnv("NO_MIDTURN_DISPATCH") === "1" ? pendingStdinLines : pendingMidTurnCommands).push(line);
   };
-  // Persist (or clear) the unsent input-box draft into the session header so a later
-  // `/resume` restores it (gajae-code parity). Best-effort, mirrors persistSessionModel;
-  // reads readline's own line buffer since that is the single source of truth for
-  // "what's currently typed but not submitted" (same buffer the box-render/prefill
-  // logic above reads from).
-  const persistSessionDraft = async (): Promise<void> => {
-    if (flags.noSession || !sessionId) return;
-    const current = (rl as unknown as { line?: string }).line ?? queuedPromptInput.partial ?? "";
-    try {
-      await updateSessionDraft(sessionId, current, cwd);
-    } catch { /* best-effort */ }
-  };
-
   // Bracketed-paste line routing at the PROMPT: readline strips the 2004 markers
   // and replays pasted lines as synthetic keypresses, emitting paste-start /
   // paste-end around them. Lines submitted INSIDE that window are intentional
@@ -2280,6 +2284,13 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     // hard break, not a graceful `/exit`. Some Bun/tmux paths leave stdin.isTTY
     // false while stdout is still a TTY, so accept either side as interactive.
     if ((process.stdin.isTTY || process.stdout.isTTY || previewEnabled) && !gracefulReadlineClose) {
+      // Best-effort, fire-and-forget: persist whatever's still typed but unsent
+      // (Ctrl+D / EOF / disconnected terminal — no explicit discard gesture, unlike
+      // Ctrl+C's own "clear the box" contract, which stays untouched here) so
+      // `/resume` can restore it (see persistSessionDraft above). Must not block
+      // process.exit() below.
+      const draft = draftFromUnsentLine((rl as unknown as { line?: string }).line);
+      if (draft) void persistSessionDraft(draft);
       hardExitOnLoopEnd = true;
       forceExitFromCtrlC();
     }
@@ -3724,8 +3735,11 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     if (pickResult.sessionModel !== undefined) sessionModel = pickResult.sessionModel;
     if (pickResult.lastUserInput !== undefined) lastUserInput = pickResult.lastUserInput;
     if (pickResult.lastReply !== undefined) lastReply = pickResult.lastReply;
+    // Restore the unsent input-box draft left over at last save (gajae-code
+    // parity) — feeds the SAME "new input first" prefill path queued mid-turn
+    // lines already use, so it's visible in the box, Enter to run, Esc/Ctrl+U
+    // to discard, on the very first prompt of this resumed session.
     if (pickResult.draft) queuedPromptInput.partial = pickResult.draft;
-
   }
 
   // Remote (Telegram) free-text reply / config command routing — wired here,
@@ -3927,10 +3941,13 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         });
         sessionId = result.sessionId;
         if (result.sessionModel !== undefined) sessionModel = result.sessionModel;
+        if (result.lastUserInput !== undefined) lastUserInput = result.lastUserInput;
         if (result.lastReply !== undefined) lastReply = result.lastReply;
+        // Restore the unsent input-box draft (see the resumeInteractive call
+        // site above for the full rationale) — `continue` below immediately
+        // re-enters the loop top, which consumes `queuedPromptInput.partial`
+        // as this next prompt's prefill.
         if (result.draft) queuedPromptInput.partial = result.draft;
-
-        if (result.lastReply !== undefined) lastReply = result.lastReply;
         continue;
       }
       if (input === "/retry") {
@@ -4631,9 +4648,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
       }
     }
   disarmPreview(); // clear footer + restore full-screen scrolling before leaving the REPL
-  await persistSessionDraft();
   if (hardExitOnLoopEnd) {
-
     try {
       disarmPreview();
       out.write("\x1b[?25h\n");