karajan-code 4.38.0 → 4.39.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.38.0",
+  "version": "4.39.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/packages/ai-trash/src/destructive-parser.js

@@ -35,14 +35,43 @@ function classifyMv(tokens) {
   return { destructive: true, kind: "mv-overwrite", paths: positional.slice(-1), reason: "mv may overwrite destination" };
 }
 
+// KJC-BUG-0240 (#1886): checkout and restore drop uncommitted work file by file,
+// and a bundle keeps commits only, so the named files are kept as files and a
+// discard of the whole tree marks it (worktree) for the hook to keep every dirty file.
+function classifyDiscard(tokens, sub) {
+  const args = tokens.slice(2);
+  const has = (...flags) => flags.some((f) => args.includes(f));
+  const SAFE = { destructive: false, kind: "git-safe", paths: [] };
+  if (sub === "restore" && has("--staged", "-S") && !has("--worktree", "-W")) return { ...SAFE, reason: "restore --staged only unstages" };
+  // -B resets an existing branch: its commits need the bundle.
+  if (sub === "checkout" && has("-B")) return { destructive: true, kind: "git-checkout-reset-branch", bundle: true, paths: [], reason: "git checkout -B resets an existing branch" };
+  if (sub === "checkout" && has("-b", "--orphan")) return { ...SAFE, reason: "checkout -b creates a branch" };
+  const dd = args.indexOf("--");
+  const named = [];
+  let sourceValue = false;
+  args.forEach((a, i) => {
+    if (sourceValue) sourceValue = false;
+    else if (a === "-s" || a === "--source") sourceValue = true;
+    else if ((dd >= 0 && i > dd) || !a.startsWith("-")) named.push(a);
+  });
+  if (!named.length && !has("-f", "--force")) return { ...SAFE, reason: `${sub} with nothing to discard` };
+  const whole = has("-f", "--force") || named.includes(".") || named.includes(":/");
+  return { destructive: true, kind: `git-${sub}-discard`, paths: named.filter((p) => p !== "." && p !== ":/"), ...(whole ? { worktree: "tracked" } : {}), reason: `git ${sub} discards local edits` };
+}
+
 function classifyGit(tokens) {
   const sub = tokens[1];
   const has = (...flags) => flags.some((f) => tokens.includes(f));
-  if (sub === "reset" && has("--hard")) return { destructive: true, kind: "git-reset-hard", paths: [], reason: "git reset --hard drops working tree" };
-  if (sub === "clean" && has("-f", "-fd", "-xdf")) return { destructive: true, kind: "git-clean", paths: [], reason: "git clean -f removes untracked files" };
-  if (sub === "branch" && has("-D")) return { destructive: true, kind: "git-branch-D", paths: [], reason: "git branch -D drops unmerged branch" };
-  if (sub === "push" && has("--force", "-f", "--force-with-lease")) return { destructive: true, kind: "git-push-force", paths: [], reason: "git push --force rewrites remote history" };
-  if (sub === "checkout" && has("--", ".")) return { destructive: true, kind: "git-checkout-discard", paths: [], reason: "git checkout -- discards local edits" };
+  if (sub === "reset" && has("--hard")) return { destructive: true, kind: "git-reset-hard", bundle: true, worktree: "tracked", paths: [], reason: "git reset --hard drops working tree" };
+  if (sub === "clean" && tokens.some((t) => t === "--force" || /^-[a-zA-Z]*f/.test(t))) {
+    // -x / -X also remove ignored files.
+    const ignored = tokens.some((t) => /^-[a-zA-Z]*[xX]/.test(t));
+    return { destructive: true, kind: "git-clean", bundle: true, worktree: ignored ? "untracked+ignored" : "untracked", paths: [], reason: "git clean -f removes untracked files" };
+  }
+  if (sub === "branch" && has("-D")) return { destructive: true, kind: "git-branch-D", bundle: true, paths: [], reason: "git branch -D drops unmerged branch" };
+  if (sub === "push" && has("--force", "-f", "--force-with-lease")) return { destructive: true, kind: "git-push-force", bundle: true, paths: [], reason: "git push --force rewrites remote history" };
+  if (sub === "checkout" || sub === "restore") return classifyDiscard(tokens, sub);
+  if (sub === "switch" && has("-f", "--force", "--discard-changes")) return { destructive: true, kind: "git-switch-discard", worktree: "tracked", paths: [], reason: "git switch --discard-changes drops local edits" };
   return { destructive: false, kind: "git-safe", paths: [], reason: "git op without destructive flags" };
 }
 

package/packages/ai-trash/src/hook.js

@@ -4,6 +4,7 @@
 // throws, deny the op so Claude never destroys without a recovery copy.
 
 import { promises as fs } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { isAbsolute, resolve } from "node:path";
 import process from "node:process";
 import { classifyCommand } from "./destructive-parser.js";
@@ -47,6 +48,29 @@ async function snapshotExistingPaths(root, paths, cwd, command) {
   return snapshots;
 }
 
+// KJC-BUG-0240 (#1886): the dirty files a whole-tree discard would drop, kept as
+// files (a bundle keeps commits only). `which`: "tracked" changes, "untracked"
+// files, or "untracked+ignored" (git clean -x/-X removes ignored files too).
+async function snapshotDirtyFiles(root, cwd, command, which) {
+  if (!cwd) return [];
+  const top = spawnSync("git", ["-C", cwd, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+  if (top.status !== 0) return [];
+  const withIgnored = which === "untracked+ignored";
+  // traditional + all: every file inside an ignored directory is listed one by one.
+  const st = spawnSync("git", ["-C", cwd, "status", "--porcelain", "-z", "--untracked-files=all", ...(withIgnored ? ["--ignored=traditional"] : [])], { encoding: "utf8" });
+  if (st.status !== 0) throw new Error(`git status failed: ${st.stderr.trim()}`);
+  const wanted = (rec) => (which === "tracked" ? !rec.startsWith("??") && !rec.startsWith("!!") : rec.startsWith("??") || (withIgnored && rec.startsWith("!!")));
+  const files = [];
+  let renameSource = false; // a rename or copy record is followed by its source path
+  for (const rec of st.stdout.split("\0")) {
+    if (renameSource) { renameSource = false; continue; }
+    if (rec.length < 4) continue;
+    if (wanted(rec)) files.push(rec.slice(3));
+    renameSource = "RC".includes(rec[0]);
+  }
+  return snapshotExistingPaths(root, files, top.stdout.trim(), command);
+}
+
 async function snapshotGitRepo(root, cwd, command, kind) {
   if (!cwd) return { snapshots: [], skipped: "no cwd" };
   try {
@@ -86,11 +110,9 @@ export async function handleHookPayload(payload, { root, stdin }) {
     await assertOwnedByCurrentUser(root);
     let snapshots = [];
     let skipped = null;
-    if (verdict.kind.startsWith("git-")) {
-      ({ snapshots, skipped } = await snapshotGitRepo(root, data.cwd, command, verdict.kind));
-    } else {
-      snapshots = await snapshotExistingPaths(root, verdict.paths, data.cwd, command);
-    }
+    if (verdict.bundle) ({ snapshots, skipped } = await snapshotGitRepo(root, data.cwd, command, verdict.kind));
+    snapshots.push(...(await snapshotExistingPaths(root, verdict.paths, data.cwd, command)));
+    if (verdict.worktree) snapshots.push(...(await snapshotDirtyFiles(root, data.cwd, command, verdict.worktree)));
     if (snapshots.length) {
       const m = await loadManifest(root);
       for (const s of snapshots) m.entries.push(s);
@@ -106,7 +128,7 @@ export async function handleHookPayload(payload, { root, stdin }) {
     if (snapshots.length) {
       return reply(
         "allow",
-        `ai-trash: snapshotted ${snapshots.length} ${verdict.kind.startsWith("git-") ? "git bundle" : "path(s)"} before ${verdict.kind}`
+        `ai-trash: snapshotted ${snapshots.length} ${snapshots.some((s) => s.type === "git-bundle") ? "item(s), git bundle included," : "path(s)"} before ${verdict.kind}`
       );
     }
     return reply(

package/src/checks/method.js

@@ -36,7 +36,7 @@ export async function collectMethodStats({ projectDir, run = runCommand, sample
   const blocks = blocksRes.exitCode === 0
     ? blocksRes.stdout.split(/^@.*$/m).map((b) => b.split("\n").map((l) => l.trim()).filter(Boolean)).filter((b) => b.length > 0)
     : [];
-  const offenders = blocks.filter((files) => checkTestsWithCode({ config: {}, stagedFiles: files, env: {} }).mode !== "pass").length;
+  const offenders = blocks.filter((files) => checkTestsWithCode({ config: {}, stagedFiles: files }).mode !== "pass").length;
 
   const verdicts = recentVerdicts(projectDir, sample);
   const stamped = verdicts.filter((v) => v.workspace);

package/src/checks/release-check.js

@@ -34,7 +34,9 @@ async function policyRangeCheck(projectDir) {
     // protects the supervisor. `kj review` and `kj policy check` already lift
     // what the sealed provenance backs; without this the release check blocked
     // every version cut after a human `kj harden --commit`, by its own seal.
-    const sup = liftSealedSupervisorViolations({ projectDir, violations: raw });
+    // KJC-BUG-0259: the history is judged on what is versioned (hooks, provenance);
+    // the machine-local guards were verified when the seal was reviewed.
+    const sup = liftSealedSupervisorViolations({ projectDir, violations: raw, trackedOnly: true });
     const violations = sup.violations;
     const hard = violations.filter((v) => v.enforcement === "deny");
     const skipped = prScoped.size > 0 ? `; ${prScoped.size} diff-threshold invariant(s) skipped (PR-scoped)` : "";

package/src/cli/register-pipeline.js

@@ -201,7 +201,8 @@ export function registerPipeline(program, { pkgVersion }) {
   program
     .command("solomon")
     .description("Ask a third AI to arbitrate a rejected review verdict (brain ≠ reviewer ≠ solomon)")
-    .requiredOption("--position <text>", "Why the brain disagrees with the reviewer")
+    .option("--position <text>", "Why the brain disagrees with the reviewer")
+    .option("--position-file <path>", "Read the position from a file (no quoting to get right)")
     .option("--range <range>", "Arbitrate a git range instead of the staged diff")
     .action(async (flags) => {
       await withConfig(pkgVersion, "solomon", flags, async ({ config, logger }) => {

package/src/commands/review-gate.js

@@ -42,7 +42,6 @@ async function enforceCardFirst({ config, projectDir }) {
   // KJC-TSK-0732: the verification LEVEL is part of the verdict — a pass on
   // branch-ref alone must never read as a tracker-verified pass.
   if (card.note) console.log(`⚠ card-first: ${card.note}`);
-  if (card.mode === "exempt" && card.reason.includes("KJ_ALLOW_NO_CARD")) console.log(`⚠ card-first exempt: ${card.reason}`);
   if (!card.ok) {
     console.log(`✗ card-first gate: ${card.reason}`);
     process.exitCode = 1;
@@ -139,6 +138,14 @@ function printVerdict(record) {
  */
 export async function solomonCommand({ config, logger = null, flags = {} }) {
   const projectDir = config?.projectDir || process.cwd();
+  // KJC-BUG-0260: a position is prose with blanks and slashes; from a file it
+  // needs no quoting the lane guard has to tell apart from a path.
+  const position = flags.positionFile ? readFileSync(flags.positionFile, "utf8").trim() : flags.position;
+  if (!position) {
+    console.log("✗ kj solomon: give the brain's position with --position <text> or --position-file <path>");
+    process.exitCode = 1;
+    return { ruling: "reject", reasoning: "no position given" };
+  }
   const diff = await rawDiff(flags.range);
   // KJC-TSK-0734 (PL-B): un hallazgo de policy de clase seguridad no es
   // arbitrable — solomon se niega antes de gastar un token. Y una policy
@@ -162,7 +169,7 @@ export async function solomonCommand({ config, logger = null, flags = {} }) {
     process.exitCode = 1;
     return { ruling: "reject", reasoning: "security-class policy denial — not arbitrable" };
   }
-  const res = await runSolomonArbitration({ diff, position: flags.position, config, logger, projectDir });
+  const res = await runSolomonArbitration({ diff, position, config, logger, projectDir });
   if (res.ruling === "approve") {
     console.log(`⚖ Solomon (${res.solomon}) rules for the brain — verdict recorded, the gate is open.`);
   } else {
@@ -256,10 +263,9 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
       // partitioning is a decision, and it must never split code from its tests.
       const split = testAdded > 0 ? ` (${added - testAdded} source + ${testAdded} accompanying tests — partition by feature, never code from its tests)` : "";
       const sizePolicy = config?.method_gates?.pr_size || "warn";
-      if (process.env.KJ_ALLOW_LARGE_PR === "1") {
-        console.log(`⚠ pr-size exempt: ${added} lines added — KJ_ALLOW_LARGE_PR=1 (explicit escape hatch)`);
-      } else if (sizePolicy === "block") {
-        const reason = `${added} lines added${split} exceeds the ${sizeWarn}-line budget (${sizeSource}; method_gates.pr_size: block) — partition the work, or get your user's explicit OK and re-run with KJ_ALLOW_LARGE_PR=1`;
+      // ADR 0015: no env escape — an exception is the user's label on the PR, judged in CI.
+      if (sizePolicy === "block") {
+        const reason = `${added} lines added${split} exceeds the ${sizeWarn}-line budget (${sizeSource}; method_gates.pr_size: block) — partition the work; an exception is your user's large-pr-justified label on the PR`;
         console.log(`✗ pr-size gate: ${reason}`);
         process.exitCode = 1;
         return { verdict: "rejected", reviewer: "pr-size", issues: [{ severity: "high", description: reason }] };
@@ -269,7 +275,7 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     }
   }
   // KJC-TSK-0705 (PV-B): the outbound privacy boundary at commit time.
-  // Denylist data rejects (KJ_ALLOW_PII=1 is the named escape); generic PII
+  // Denylist data rejects with no escape (ADR 0015: false positives go in the allow list); generic PII
   // warns (privacy.generic: "block" hardens). Added lines only — deletions
   // don't publish. In the SEA binary the privacy module is stubbed and
   // throws: the gate degrades with a note instead of crashing.
@@ -288,25 +294,19 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     for (const f of warns) console.log(`⚠ privacy: [${f.type}] ${f.source}:${f.line} → ${f.masked} — personal data? move it out before it ships`);
     const hardened = config?.privacy?.generic === "block" && warns.length > 0;
     if (blocks.length > 0 || hardened) {
-      if (process.env.KJ_ALLOW_PII === "1") {
-        console.log(`⚠ privacy exempt: ${blocks.length} denylist hit(s) — KJ_ALLOW_PII=1 (explicit escape hatch)`);
-      } else {
-        for (const f of blocks) console.log(`✗ privacy: [${f.type}] ${f.source}:${f.line} → ${f.masked}`);
-        const reason = `${blocks.length || warns.length} personal-data finding(s) in the staged diff — this must not reach the repo (KJ_ALLOW_PII=1 to override consciously)`;
-        console.log(`✗ privacy gate: ${reason}`);
-        process.exitCode = 1;
-        return { verdict: "rejected", reviewer: "privacy", issues: [{ severity: "high", description: reason }] };
-      }
+      for (const f of blocks) console.log(`✗ privacy: [${f.type}] ${f.source}:${f.line} → ${f.masked}`);
+      const reason = `${blocks.length || warns.length} personal-data finding(s) in the staged diff — this must not reach the repo (a confirmed false positive goes in the allow list of ~/.karajan/privacy.yml)`;
+      console.log(`✗ privacy gate: ${reason}`);
+      process.exitCode = 1;
+      return { verdict: "rejected", reviewer: "privacy", issues: [{ severity: "high", description: reason }] };
     }
   } catch (err) {
     // Known degradation: the SEA stub throws its install-from-npm message.
     // Anything else fails CLOSED — a silent skip would defeat the guarantee.
     if (/standalone binary/i.test(err?.message || "")) {
       console.log("⚠ privacy gate unavailable in this build — skipping");
-    } else if (process.env.KJ_ALLOW_PII === "1") {
-      console.log(`⚠ privacy gate errored (${err.message}) — KJ_ALLOW_PII=1 (explicit escape hatch)`);
     } else {
-      const reason = `privacy gate error: ${err.message} — refusing to pass the boundary unchecked (KJ_ALLOW_PII=1 to override consciously)`;
+      const reason = `privacy gate error: ${err.message} — refusing to pass the boundary unchecked`;
       console.log(`✗ ${reason}`);
       process.exitCode = 1;
       return { verdict: "rejected", reviewer: "privacy", issues: [{ severity: "high", description: reason }] };
@@ -330,9 +330,8 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
 
   // KJC-TSK-0734 (PL-B): la policy declarativa como gate determinista, en
   // --staged Y en --check — el pre-commit hereda los dientes sin regenerar
-  // hooks. enforcement=warn avisa; deny cierra salvo excepción probatoria
-  // (KJ_ALLOW_POLICY=1 + KJ_POLICY_REASON, registrada con identidad y hash
-  // del diff); class=security cierra sin escape y sin arbitraje.
+  // hooks. enforcement=warn avisa; deny cierra sin excepción por diff (ADR
+  // 0015); class=security cierra además sin arbitraje.
   // KJC-BUG-0208: el mismo modulo que decide el presupuesto decide el metrico
   // del invariante. Sumar aqui el numstat entero daba dos cifras para la misma
   // regla en dos lineas seguidas del mismo comando.

package/src/harden/harness-hooks.js

@@ -3,8 +3,9 @@
  * Field case 2026-08-02: text rules were not enough — the environment must
  * impose them AT TOOL TIME. `kj harden` writes a PreToolUse script and wires
  * it into the project's `.claude/settings.json` (merged, never clobbered):
- * Write over an existing file blocks ("use Edit", KJ_ALLOW_WRITE=1 escapes);
- * Bash that reserializes whole JSON files blocks (KJ_ALLOW_REWRITE=1).
+ * Write over an existing file blocks ("use Edit"), with no escape (ADR 0015).
+ * Writes through Bash are the Sentinel's bash-write guard (KJC-BUG-0237), which
+ * replaced the JSON-reserialization guard that lived here.
  * Claude-only v1 — the abstraction arrives with the second host that
  * supports tool hooks.
  */
@@ -19,94 +20,15 @@ const SCRIPT_BODY = `#!/usr/bin/env node
 // so a gate bug never bricks the session.
 import console from "node:console";
 import process from "node:process";
-import { existsSync, realpathSync } from "node:fs";
-import { dirname, join, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-// El guard vive en <repo>/.karajan/harness/, asi que el arbol es dos arriba.
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+import { existsSync } from "node:fs";
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
     const { tool_name: tool, tool_input: input = {} } = JSON.parse(raw);
-    if (tool === "Write" && process.env.KJ_ALLOW_WRITE !== "1") {
-      if (input.file_path && existsSync(input.file_path)) {
-        console.error("kj tool gate: Write over an EXISTING file destroys unseen changes — use Edit for targeted changes (KJ_ALLOW_WRITE=1 to override consciously).");
-        process.exit(2);
-      }
-    }
-    if (tool === "Bash") {
-      const cmd = String(input.command || "");
-      // KJC-BUG-0227: el escape tambien viaja en el PROPIO comando, como en el
-      // resto de guardias. Mirando solo process.env el agente no tenia salida:
-      // un export dentro del comando jamas llega a este proceso.
-      // Solo cuentan las asignaciones DEL PRINCIPIO, que son las que el shell
-      // aplica al comando. Buscarla en cualquier parte del texto dejaba pasar
-      // un "echo KJ_ALLOW_REWRITE=1; python3 ..." (catch de la review).
-      const toks = cmd.trim().split(/\\s+/);
-      let i = 0;
-      let named = false;
-      while (i < toks.length && /^[A-Z][A-Z0-9_]*=/.test(toks[i])) {
-        if (toks[i] === "KJ_ALLOW_REWRITE=1") named = true;
-        i += 1;
-      }
-      // Una asignacion delante solo alcanza a SU comando, asi que el escape del
-      // comando vale unicamente en un comando SIMPLE: en "VAR=1 true && python"
-      // o "VAR=1 && python" el python nunca la recibe (catch de la review). Lo
-      // que va entre comillas no encadena nada, asi que no cuenta.
-      // Tampoco es simple si hay sustitucion: el proceso de dentro de $( ) no
-      // hereda la asignacion (catch de la review). Mismo criterio que el resto
-      // de guardias del Sentinel.
-      // Dentro de comillas SIMPLES todo es literal; dentro de dobles, un ; no
-      // encadena pero $( ) si ejecuta. Por eso se miran dos cosas distintas.
-      const noSingle = cmd.replaceAll(/'[^']*'/g, "");
-      const substitutes = noSingle.includes("$(") || noSingle.includes("\\u0060");
-      const bare = noSingle.replaceAll(/"[^"]*"/g, "");
-      const simple = !substitutes && !/[;&|]/.test(bare) && !bare.includes("\\n");
-      const cmdEscape = named && simple && i < toks.length;
-      const escaped = process.env.KJ_ALLOW_REWRITE === "1" || cmdEscape;
-      // Un escape ignorado EN SILENCIO era el bug: si esta puesto y no vale, se dice.
-      if (named && !cmdEscape) console.error("kj tool gate: KJ_ALLOW_REWRITE=1 presente pero IGNORADO — solo vale delante del comando y en uno simple (sin ; | & fuera de comillas).");
-      const writes = /open\\s*\\([^)]*["'][wa]["']|>\\s*\\S+\\.json\\b/.test(cmd);
-      // KJC-BUG-0227: y solo se vigila lo que esta DENTRO del arbol. Un fichero
-      // temporal del scratchpad no es asunto de este guard, y bloquearlo
-      // ensenaba a rodearlo. Sin ruta reconocible se vigila: el lado seguro.
-      const targets = cmd.match(/[\\w./-]+\\.json\\b/g) || [];
-      // Solo se exime lo que se puede establecer CON CERTEZA: una ruta absoluta
-      // fuera del arbol. Una relativa depende del cwd del shell, que este hook
-      // no conoce — "cd packages && ... open(\\"../package.json\\")" escribe
-      // dentro del repo (catch de la review), asi que se sigue vigilando.
-      // Un enlace puede apuntar dentro: /tmp/link.json escribiria en el repo
-      // (catch de la review). Se resuelve el padre real antes de clasificar, y
-      // si no se puede resolver, se vigila.
-      // Fuera del arbol es SALIR de el, no que el nombre empiece por dos puntos:
-      // <repo>/..config.json esta dentro (catch de la review).
-      const escapesRoot = (rel) => rel === ".." || rel.startsWith("../");
-      const outsideForSure = (t) => {
-        if (!t.startsWith("/")) return false;
-        const abs = resolve(t);
-        try {
-          const root = realpathSync(ROOT);
-          // El propio fichero puede SER el enlace (/tmp/link.json -> repo/cfg.json),
-          // asi que se resuelve entero cuando existe; si aun no existe, manda su
-          // directorio real.
-          if (existsSync(abs)) return escapesRoot(relative(root, realpathSync(abs)));
-          const parts = abs.split("/");
-          const name = parts.pop();
-          return escapesRoot(relative(root, realpathSync(parts.join("/") || "/") + "/" + name));
-        } catch {
-          return false;
-        }
-      };
-      // Con expansion del shell no se sabe a donde apunta nada: "$PWD/cfg.json"
-      // deja el trozo "/cfg.json", que parece absoluto y ajeno sin serlo (catch
-      // de la review). Ante la duda se vigila.
-      const expands = /[$~]/.test(cmd) || cmd.includes("\\u0060");
-      const mine = expands || targets.length === 0 || !targets.every(outsideForSure);
-      if (!escaped && mine && /json\\.dumps?\\s*\\(/.test(cmd) && writes) {
-        console.error("kj tool gate: reserializing a whole JSON file makes the diff unreviewable — make targeted edits instead (KJ_ALLOW_REWRITE=1 to override consciously).");
-        process.exit(2);
-      }
+    if (tool === "Write" && input.file_path && existsSync(input.file_path)) {
+      console.error("kj tool gate: Write over an EXISTING file destroys unseen changes — use Edit for targeted changes.");
+      process.exit(2);
     }
   } catch { /* fail open */ }
   process.exit(0);

package/src/harden/hook-templates.js

@@ -62,10 +62,11 @@ function baseBranchGuard(baseBranch) {
   return [
     "# Branch-first guard — the base branch only moves via PR. KJC-BUG-0186:",
     "# the bootstrap commit is exempt, there is no commit to branch from yet.",
-    'if [ "$KJ_ALLOW_BASE_COMMIT" != "1" ] && git rev-parse --verify HEAD >/dev/null 2>&1; then',
+    "# No escape (ADR 0015): an env prefix on git commit was one the agent could raise.",
+    "if git rev-parse --verify HEAD >/dev/null 2>&1; then",
     '  current_branch=$(git symbolic-ref --short HEAD 2>/dev/null || echo "")',
     `  if [ "$current_branch" = "${baseBranch}" ]; then`,
-    `    echo 'kj harden: direct commits on ${baseBranch} are not allowed — create a branch and open a PR (KJ_ALLOW_BASE_COMMIT=1 to override)'; exit 1`,
+    `    echo 'kj harden: direct commits on ${baseBranch} are not allowed — create a branch and open a PR'; exit 1`,
     "  fi",
     "fi",
   ];
@@ -78,7 +79,7 @@ function baseBranchGuard(baseBranch) {
 function identityGuard(hook) {
   const head = [
     "# Identity lock (IDN-C, ADR 0005) — this clone's declared identity governs.",
-    'if [ "$KJ_ALLOW_IDENTITY" != "1" ] && [ -f .karajan/identity.local.yml ]; then',
+    "if [ -f .karajan/identity.local.yml ]; then",
   ];
   const tail = [
     "elif [ ! -f .karajan/identity.local.yml ]; then",
@@ -92,7 +93,7 @@ function identityGuard(hook) {
       "  kj_author=$(git var GIT_AUTHOR_IDENT | sed 's/.*<\\(.*\\)>.*/\\1/')",
       "  kj_committer=$(git var GIT_COMMITTER_IDENT | sed 's/.*<\\(.*\\)>.*/\\1/')",
       '  if [ -n "$kj_declared_email" ] && { [ "$kj_author" != "$kj_declared_email" ] || [ "$kj_committer" != "$kj_declared_email" ]; }; then',
-      '    echo "kj harden: identity lock — committing as $kj_author / $kj_committer but this clone is declared as $kj_declared_email (kj identity show; KJ_ALLOW_IDENTITY=1 to override)"; exit 1',
+      '    echo "kj harden: identity lock — committing as $kj_author / $kj_committer but this clone is declared as $kj_declared_email (kj identity show)"; exit 1',
       "  fi",
       ...tail,
     ];
@@ -103,7 +104,7 @@ function identityGuard(hook) {
     '  kj_hosts="${GH_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/gh}/hosts.yml"',
     "  kj_active_gh=$(awk '/^github.com:/{f=1;next} f&&/^[^[:space:]]/{f=0} f&&/^[[:space:]]*user:/{sub(/^[[:space:]]*user:[[:space:]]*/,\"\");print;exit}' \"$kj_hosts\" 2>/dev/null)",
     '  if [ -n "$kj_declared_gh" ] && [ "$kj_active_gh" != "$kj_declared_gh" ]; then',
-    '    echo "kj harden: identity lock — gh session is ${kj_active_gh:-none} but this clone is declared as $kj_declared_gh — run: gh auth switch --user $kj_declared_gh (KJ_ALLOW_IDENTITY=1 to override)"; exit 1',
+    '    echo "kj harden: identity lock — gh session is ${kj_active_gh:-none} but this clone is declared as $kj_declared_gh — run: gh auth switch --user $kj_declared_gh"; exit 1',
     "  fi",
     ...tail,
   ];

package/src/harden/sentinel/sentinel-discard.mjs

@@ -2,7 +2,7 @@
 // ADR 0014). An agent does not discard changes it did not make. Copied byte for
 // byte into .karajan/harness; `root` is the project root, injected.
 import { spawnSync } from "node:child_process";
-import { relative, resolve } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 import process from "node:process";
 import { headIndex, shortOpts } from "./sentinel-shell.mjs";
 
@@ -58,6 +58,30 @@ export const discardOf = (words, root) => {
   return pos.length > 1 ? { cwd, paths: pos.slice(1) } : null;
 };
 
+/**
+ * KJC-BUG-0261: the tracked files an `rm` or `git rm` removes, relative to root.
+ * Removing a file is the session touching it, so its state is noted before it
+ * goes and restoring it later is not taken for someone else's change.
+ * @param {string[]} words
+ * @param {string} root
+ * @param {string} cwd where relative paths resolve (the session's cwd)
+ * @returns {string[]}
+ */
+export const removedFiles = (words, root, cwd = process.cwd()) => {
+  const i = headIndex(words, ["rm", "git"]);
+  const head = words[i]?.split("/").at(-1);
+  const isGitRm = head === "git" && words[i + 1] === "rm";
+  if (head !== "rm" && !isGitRm) return [];
+  const args = words.slice(i + (isGitRm ? 2 : 1));
+  const dd = args.indexOf("--");
+  const named = dd < 0 ? args.filter((a) => !a.startsWith("-")) : [...args.slice(0, dd).filter((a) => !a.startsWith("-")), ...args.slice(dd + 1)];
+  const rels = named.map((p) => relative(root, resolve(cwd, p))).filter((r) => r && !r.startsWith("..") && !isAbsolute(r));
+  if (rels.length === 0) return [];
+  // ls-files expands a directory (rm -r dir) into the tracked files it holds.
+  const r = spawnSync("git", ["-C", root, "ls-files", "-z", "--", ...rels], { encoding: "utf8" });
+  return r.status === 0 ? String(r.stdout).split("\0").filter(Boolean) : [];
+};
+
 /**
  * Files the discard would lose that the session did not own: dirty now and not
  * clean at first touch. Anything unreadable, or another repo, is foreign.
@@ -84,7 +108,10 @@ export const foreignLost = (d, touch, root) => {
   }
   // Fail-closed: a path git does not know (misparsed, $VAR, substitution) cannot
   // be proven safe; git would refuse to check it out anyway.
-  if (spawnSync("git", ["-C", d.cwd, "ls-files", "--error-unmatch", "--", ...d.paths]).status !== 0) return [`(ruta no resoluble: ${d.paths.join(" ")})`];
+  if (spawnSync("git", ["-C", d.cwd, "ls-files", "--error-unmatch", "--", ...d.paths]).status !== 0) {
+    // KJC-BUG-0261: what the session removed with git rm left the index, and it is still its own.
+    return d.paths.map((p) => relative(root, resolve(d.cwd, p))).every(own) ? [] : [`(ruta no resoluble: ${d.paths.join(" ")})`];
+  }
   const r = spawnSync("git", ["-C", d.cwd, "status", "--porcelain", "-z", "--untracked-files=no", "--", ...d.paths], { encoding: "utf8" });
   if (r.status !== 0) return ["(git status fallo)"];
   const files = [];

package/src/harden/sentinel/sentinel-shell.mjs

@@ -86,10 +86,25 @@ export const stripInertQuotes = (cmd) => {
 };
 
 // Options whose value is prose, never a path (gh, git, kj).
-const TEXT_OPTION = /(^|\s)(--title|--body|--message|-m|--notes|--description|--ac|--criteria|--reason|--decision|--context|--consequences)(=|\s+)("[^"$`\\]*"|'[^']*')/g;
+const TEXT_OPTIONS = new Set(["--title", "--body", "--message", "-m", "--notes", "--description", "--ac", "--criteria", "--reason", "--decision", "--context", "--consequences", "--position"]);
+const QUOTED_OPTION_VALUE = /(^|\s)(--?[a-z]+)(=|\s+)("[^"$`\\]*"|'[^']*')/g;
 
 /** KJC-BUG-0243: blank the inert quoted value of a text option (--title "a/b c"): prose, not a path. */
-export const stripTextOptionValues = (cmd) => cmd.replace(TEXT_OPTION, (_m, pre, opt, sep, val) => `${pre}${opt}${sep}${val[0]}${val[0]}`);
+export const stripTextOptionValues = (cmd) => cmd.replace(QUOTED_OPTION_VALUE, (m, pre, opt, sep, val) => (TEXT_OPTIONS.has(opt) ? `${pre}${opt}${sep}${val[0]}${val[0]}` : m));
+
+/**
+ * KJC-BUG-0245: the values of the named options, read by the shell reader, so a
+ * `;`, `&&` or `|` right after a path ends the word instead of joining it.
+ * Covers `--opt value` and `--opt=value`.
+ * @param {string} cmd
+ * @param {string[]} names
+ * @returns {string[]}
+ */
+export const optionValues = (cmd, names) => shellSegments(cmd).flatMap((words) => words.flatMap((w, i) => {
+  if (names.includes(w) && i + 1 < words.length) return [words[i + 1]];
+  const eq = w.indexOf("=");
+  return eq > 0 && names.includes(w.slice(0, eq)) ? [w.slice(eq + 1)] : [];
+}));
 
 /** Short flags of a cluster stop at "e": the rest is -e's value (-fen = -f -e n). */
 export const shortOpts = (a) => (/^-[a-zA-Z]/.test(a) ? a.slice(1).split("e")[0] : "");

package/src/harden/sentinel-hooks.js

@@ -28,8 +28,7 @@ export function resolveSentinelRoot(dir = process.cwd()) {
 
 const LIB_BODY = `// kj sentinel shared lib (KJC-TSK-0714) — managed by \`kj harden\`.
 // Single source for every sentinel script: state, branch, classification,
-// violations, and escape recording.
-import console from "node:console";
+// and violations.
 import { readFileSync, writeFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
@@ -81,8 +80,20 @@ export const bootstrapPhase = () => {
   try { execSync("git rev-parse --verify HEAD", { cwd: ROOT, stdio: ["ignore", "ignore", "ignore"] }); return false; }
   catch { return true; }
 };
-export const violations = (s, branch) => {
-  const v = pendingMoves(s).map(pendingText);
+// KJC-BUG-0198/0262: a card split across PRs is carried while another PR of it is
+// open. kj decides with that checkable fact, the same answer for commit and push
+// (the Stop gate still holds the turn: the board owes the move); when kj does not
+// answer, every pending move blocks.
+export const boardGate = (sid, pend) => {
+  if (!pend.length) return { blocking: [], carried: [] };
+  const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
+  if (!bg.error && (bg.status === 0 || bg.status === 2)) {
+    try { const d = JSON.parse(bg.stdout); return { blocking: d.blocking || [], carried: d.carried || [] }; } catch { /* unreadable: as always */ }
+  }
+  return { blocking: pend, carried: [] };
+};
+export const violations = (s, branch, pending = pendingMoves(s)) => {
+  const v = pending.map(pendingText);
   if (!s || !(s.edited_sources || []).length) return v;
   if (bootstrapPhase()) return v;
   if (BASE_BRANCHES.has(branch)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion");
@@ -105,26 +116,6 @@ const sessionAddsCode = (s) => {
     return a === "-" || Number(a) > 0;
   });
 };
-export const recordEscape = (sid, escape, tool) => {
-  const state = load();
-  const s = session(state, sid);
-  s.at = Date.now();
-  if (!s.escapes.includes(escape)) s.escapes.push(escape);
-  (state.escape_events ||= []).push({ escape, tool, sid, ts: Date.now() });
-  save(state);
-  // GOV-F (KJC-TSK-0768): el escape es una excepcion consciente — entra en el
-  // decision log hash-encadenado (kj policy seal), no solo en este estado.
-  // Best-effort CON aviso: fail-closed aqui encerraria la sesion justo cuando
-  // kj no carga, que es cuando mas se usa el escape (restaurar con git).
-  try {
-    const args = ["policy", "seal", "--escape", escape];
-    if (tool) args.push("--tool", String(tool));
-    const r = spawnSync("kj", args, { cwd: ROOT, encoding: "utf8" });
-    if (r.error || r.status !== 0) console.error("karajan sentinel: escape " + escape + " usado pero NO sellado en el decision log (kj policy seal " + (r.error ? r.error.message : "exit " + r.status) + ") — revisa kj; el escape queda solo en sentinel-state.json" + doc("escapes"));
-  } catch (e) {
-    console.error("karajan sentinel: escape " + escape + " usado pero NO sellado en el decision log: " + e.message + doc("escapes"));
-  }
-};
 `;
 
 const POST_BODY = `#!/usr/bin/env node
@@ -137,7 +128,6 @@ import { relative } from "node:path";
 import { spawnSync } from "node:child_process";
 import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
 import { remindersFor } from "./sentinel-reminders.mjs";
-const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD", "KJ_ALLOW_NO_RAG", "KJ_ALLOW_NO_VERIFY"];
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
@@ -293,11 +283,6 @@ process.stdin.on("end", () => {
     const rel = relative(ROOT, file).replaceAll("\\\\", "/");
     const bucket = TESTS.test(rel) ? s.edited_tests : CODE.test(rel) ? s.edited_sources : null;
     if (bucket && !bucket.includes(rel)) bucket.push(rel);
-    for (const e of ESCAPES)
-      if (process.env[e] === "1" && !s.escapes.includes(e)) {
-        s.escapes.push(e);
-        (state.escape_events ||= []).push({ escape: e, tool, sid, ts: Date.now() });
-      }
     // KJC-TSK-0910: the branch size while it is written, with the CI budget
     // (kj pr-size), said once per threshold crossed. Context, never a block.
     let sizeNote = null;
@@ -417,7 +402,6 @@ process.stdin.on("end", () => {
       s.blocks = 0;
       const notes = [];
       if (claimsNote) notes.push(claimsNote);
-      if ((s.escapes || []).length) notes.push("karajan sentinel: esta sesion uso " + s.escapes.length + " escape(s): " + s.escapes.join(", ") + " — decision registrada; detalle en kj sentinel status.");
       if ((s.closed_cards || []).length) {
         notes.push("karajan sentinel: card(s) cerrada(s) en este turno: " + s.closed_cards.join(", ") + " — el board las muestra: " + boardHint());
         s.closed_cards = [];
@@ -454,10 +438,10 @@ import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 // KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
-import { shellSegments, stripInertQuotes, stripTextOptionValues } from "./sentinel-shell.mjs";
-import { DISCARD_VERBS, discardOf, foreignLost } from "./sentinel-discard.mjs";
+import { optionValues, shellSegments, stripInertQuotes, stripTextOptionValues } from "./sentinel-shell.mjs";
+import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
 import { shellWrites, writesRepo } from "./sentinel-bash-write.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
 // KJC-BUG-0204: el comando real lleva flags EN MEDIO del verbo
@@ -481,6 +465,21 @@ process.stdin.on("end", () => {
     process.on("exit", (code) => {
       if (code === 2) console.error("karajan: Karajan gobierna y se le obedece. No rodees el gate ni cambies la politica para pasarlo; si te parece injusto, diselo a tu usuario o usa kj report-issue.");
     });
+    // KJC-BUG-0238 (#1886): de quien es cada cambio. La primera vez que la
+    // sesion toca un fichero se anota si estaba limpio: solo entonces un
+    // descarte posterior pierde nada mas que lo de la sesion. Antes de
+    // cualquier escape; git que falla cuenta como sucio (fail-closed).
+    const noteFirstTouch = (relT) => {
+      const st = load();
+      const touch = (session(st, sid).first_touch ||= {});
+      // hasOwn + defineProperty: a file named __proto__ or toString is a path, not a prototype key.
+      if (Object.hasOwn(touch, relT)) return;
+      // --ignored: a user's ignored .env is theirs too (git clean -x deletes it).
+      const gs = spawnSync("git", ["-C", ROOT, "status", "--porcelain", "--ignored", "--", relT], { encoding: "utf8" });
+      const value = gs.status === 0 && String(gs.stdout).trim() === "" ? "clean" : "dirty";
+      Object.defineProperty(touch, relT, { value, enumerable: true, writable: true, configurable: true });
+      save(st);
+    };
     // Self-protection (KJC-TSK-0715) rules run BEFORE any escape, including
     // KJ_SENTINEL_OFF: the sentinel is not dismantled from inside a session —
     // only the human, editing outside it.
@@ -497,23 +496,10 @@ process.stdin.on("end", () => {
         console.error("karajan sentinel: " + relT + " es configuracion de gobierno (politicas, gates, exclusiones): la cambia tu usuario, no la sesion. Si un gate te parece injusto, proponselo a tu usuario o usa kj report-issue." + doc("governance"));
         process.exit(2);
       }
-      // KJC-BUG-0238 (#1886): de quien es cada cambio. La primera vez que la
-      // sesion toca un fichero se anota si estaba limpio: solo entonces un
-      // descarte posterior pierde nada mas que lo de la sesion. Antes de
-      // cualquier escape; git que falla cuenta como sucio (fail-closed).
-      if (relT && !relT.startsWith("..") && !relT.startsWith("/")) {
-        const st = load();
-        const touch = (session(st, sid).first_touch ||= {});
-        // hasOwn + defineProperty: a file named __proto__ or toString is a path, not a prototype key.
-        if (!Object.hasOwn(touch, relT)) {
-          // --ignored: a user's ignored .env is theirs too (git clean -x deletes it).
-          const gs = spawnSync("git", ["-C", ROOT, "status", "--porcelain", "--ignored", "--", relT], { encoding: "utf8" });
-          const value = gs.status === 0 && String(gs.stdout).trim() === "" ? "clean" : "dirty";
-          Object.defineProperty(touch, relT, { value, enumerable: true, writable: true, configurable: true });
-          save(st);
-        }
-      }
+      if (relT && !relT.startsWith("..") && !relT.startsWith("/")) noteFirstTouch(relT);
     }
+    // KJC-BUG-0261: rm / git rm is the session touching those files, noted before they go.
+    if (tool === "Bash") for (const words of shellSegments(String(input.command || ""))) for (const f of removedFiles(words, ROOT)) noteFirstTouch(f);
     // Any Bash that NAMES the supervisor's files is denied — a write-verb
     // blocklist is bypassable (cp, dd, one-liners), and reading them is what
     // the Read/Grep tools are for. Shell indirection (variables, globs,
@@ -536,8 +522,8 @@ process.stdin.on("end", () => {
       if (tool === "Bash" && /(^|[^a-zA-Z])gh([^a-zA-Z]|$)/.test(ghCmd) && /(^|[^a-z])(pr|issue|release)([^a-z]|$)/.test(ghCmd) && /(^|[^a-z])(create|edit|comment|review)([^a-z]|$)/.test(ghCmd)) {
         const attrib = /co-authored-by:.{0,120}(claude|gpt|copilot|gemini)|(generated|written|created) (by|with).{0,120}(claude|gpt|copilot|gemini|codex)|generated with [[]?claude|🤖/is;
         let corpus = ghCmd;
-        for (const m of ghCmd.matchAll(/--(?:body-file|notes-file|comment-file)[= ]+("([^"]+)"|'([^']+)'|([^ ]+))/g)) {
-          const bodyPath = m[2] || m[3] || m[4];
+        // KJC-BUG-0245: the shell reader ends the path at ; && | (a regex took "pr.md;").
+        for (const bodyPath of optionValues(ghCmd, ["--body-file", "--notes-file", "--comment-file"])) {
           try { corpus += "\\n" + readFileSync(bodyPath, "utf8"); } catch {
             console.error("karajan sentinel: no puedo leer " + bodyPath + " para el escaneo de atribucion — sin escaneo no se publica." + doc("attribution"));
             process.exit(2);
@@ -598,68 +584,11 @@ process.stdin.on("end", () => {
       }
     }
     if (process.env.KJ_SENTINEL_OFF === "1") process.exit(0);
-    // KJC-BUG-0142: cada deny anuncia su escape como prefijo del comando
-    // (KJ_ALLOW_X=1 cmd), pero el hook corre con el env del HOST — el
-    // prefijo jamas llegaba a process.env y el escape era inalcanzable
-    // (deadlock real del gate de release: la landing solo se pone verde
-    // tras el deploy y el deploy estaba bloqueado por el mismo gate). Un
-    // escape es una excepcion CONSCIENTE y auditada, no un boundary de
-    // seguridad (security sigue sin escape y la autoprotecion corre antes),
-    // asi que el TEXTO del comando es fuente valida: solo asignaciones
-    // LITERALES al inicio (tokens VAR=VAL antes del primer verbo) y solo
-    // sobre un comando SIMPLE — con ;|& $() backtick o salto de linea el
-    // prefijo shell no alcanzaria a los comandos posteriores (catch de
-    // codex: "X=1 true && npm publish" escaparia sin serlo), asi que el
-    // escape por texto se rechaza y queda la via env de siempre.
+    // ADR 0015 (KJC-TSK-0927): no gate has an escape any more, so the command
+    // text is read only by the identity lock below.
     const CMD_TEXT = tool === "Bash" ? String(input.command || "") : "";
     const ESC_TAB = String.fromCharCode(9);
     const ESC_NL = String.fromCharCode(10);
-    const ESC_BT = String.fromCharCode(96);
-    const escOn = (name) => {
-      if (process.env[name] === "1") return true;
-      let found = false;
-      let i = 0;
-      while (i < CMD_TEXT.length) {
-        while (i < CMD_TEXT.length && (CMD_TEXT[i] === " " || CMD_TEXT[i] === ESC_TAB)) i += 1;
-        const start = i;
-        while (i < CMD_TEXT.length && CMD_TEXT[i] !== " " && CMD_TEXT[i] !== ESC_TAB && CMD_TEXT[i] !== ESC_NL) i += 1;
-        const tok = CMD_TEXT.slice(start, i);
-        const eq = tok.indexOf("=");
-        if (eq <= 0 || !/^[A-Z][A-Z0-9_]*$/.test(tok.slice(0, eq))) break;
-        if (tok === name + "=1") found = true;
-      }
-      if (!found) return false;
-      // KJC-BUG-0147: lo que va ENTRE COMILLAS no encadena comandos — un
-      // mensaje "fix(x): ... (KJC-TSK-1)" es un comando simple. Dentro de
-      // comillas dobles $ y backtick siguen expandiendo (se rechazan); en
-      // comillas simples todo es literal. Y si el escape esta pero se ignora,
-      // SE DICE: un escape ignorado en silencio era el bug.
-      const bad = escSimple();
-      if (bad === null) return true;
-      if (!escNoted.has(name)) {
-        escNoted.add(name);
-        console.error("karajan sentinel: " + name + "=1 presente pero IGNORADO — el escape solo vale en un comando simple y este contiene " + JSON.stringify(bad) + " fuera de comillas simples (sin ; | & $ ( ) backtick ni salto de linea: parte el comando o usa -F fichero)" + doc("escapes"));
-      }
-      return false;
-    };
-    const escNoted = new Set();
-    const escSimple = () => {
-      let q = null;
-      for (let i = 0; i < CMD_TEXT.length; i += 1) {
-        const c = CMD_TEXT[i];
-        if (q === "'") { if (c === "'") q = null; continue; }
-        if (q === '"') {
-          if (c === '"') q = null;
-          else if (c === "$" || c === ESC_BT) return c;
-          else if (c === "\\\\") i += 1;
-          continue;
-        }
-        if (c === "\\\\") { i += 1; continue; }
-        if (c === "'" || c === '"') { q = c; continue; }
-        if (c === ";" || c === "|" || c === "&" || c === ESC_NL || c === ESC_BT || c === "$" || c === "(" || c === ")") return c;
-      }
-      return q === null ? null : "comilla sin cerrar";
-    };
     // IDN-B (KJC-TSK-0763, ADR 0005): identity lock — gh and mutating git never
     // run under an account other than the one THIS CLONE declared (the incident:
     // a gh comment without switch went out as the client account). Deny BEFORE
@@ -755,11 +684,8 @@ process.stdin.on("end", () => {
       };
       scan(CMD_TEXT, 0);
       if (problems.length > 0) {
-        if (escOn("KJ_ALLOW_IDENTITY")) { recordEscape(sid, "KJ_ALLOW_IDENTITY", tool); }
-        else {
-          console.error("karajan sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(KJ_ALLOW_IDENTITY=1 = excepcion consciente, queda registrada)" + doc("identity"));
-          process.exit(2);
-        }
+        console.error("karajan sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(sin escape, ADR 0015: pon la cuenta en el comando)" + doc("identity"));
+        process.exit(2);
       }
     }
     // MONO-0 (KJC-TSK-0737, ADR 0002): cada sesion muta solo SU worktree;
@@ -779,8 +705,7 @@ process.stdin.on("end", () => {
       return d ? foreignLane(d) : null;
     };
     const laneDeny = (what, lane) => {
-      if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); return false; }
-      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Cruce deliberado: KJ_ALLOW_CROSS_LANE=1, queda registrado." + doc("cross-lane"));
+      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Sin escape (ADR 0015): un cruce deliberado lo hace tu usuario en su terminal." + doc("cross-lane"));
       return true;
     };
     if (EDIT_TOOLS.includes(tool)) {
@@ -817,11 +742,8 @@ process.stdin.on("end", () => {
         // directorio se deniega conservadoramente — el remedio es no
         // necesitarlo (git -C, npm --prefix, rutas absolutas).
         if (/(^|[;&|(\\s])(cd|pushd)([ \\t]|$)/.test(cmd)) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd." + doc("cross-lane"));
+          process.exit(2);
         }
         // Absolute AND dot-relative tokens (../lane escapaba al primer scan —
         // reviewer catch); relative se resuelve contra el cwd de la sesion.
@@ -836,11 +758,8 @@ process.stdin.on("end", () => {
         // de tokens de abajo; el residuo (expansion anidada en segmentos
         // runner) queda documentado como en la regla de ficheros PROTECTED.
         if (/>{1,2}[ \\t]*["']?[$\`]/.test(cmd)) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL." + doc("cross-lane"));
+          process.exit(2);
         }
         // Sustitucion de comandos ($(...) o backticks) EJECUTA su contenido
         // en cualquier posicion, y una ruta entrecomillada con espacios es
@@ -904,20 +823,14 @@ process.stdin.on("end", () => {
         // KJC-BUG-0243: inert quoted text is not a substitution, and the prose value
         // of a text option (--title, -m...) is not a path.
         if (/\\$\\(|\`/.test(stripInertQuotes(cmd)) || quotedPathWithSpaces(stripTextOptionValues(cmd))) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion." + doc("cross-lane"));
+          process.exit(2);
         }
         const SAFE_EXP_SEG = /^([A-Za-z_][A-Za-z0-9_]*=[^ \\t]*[ \\t]*)*((npm|pnpm|yarn|vitest|jest|kj|gh|echo|printf|true|test)\\b|git[ \\t](?![^\\n]*(-C[ \\t]|--git-dir|--work-tree)))[^;|&\\n]*$|^[A-Za-z_][A-Za-z0-9_]*=[^;|&\\n]*$/;
         const segs = cmd.split(/&&|\\|\\||[;|\\n]/).map((s) => s.trim()).filter(Boolean);
         if (!segs.every((s) => !/[$]/.test(s) || SAFE_EXP_SEG.test(s))) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain." + doc("cross-lane"));
+          process.exit(2);
         }
         // ...incluidas relativas A PELO (los carriles kj viven en
         // .kj/worktrees/). Un falso token (s/a/b/) resuelve al arbol propio
@@ -955,8 +868,8 @@ process.stdin.on("end", () => {
     // Fail CLOSED por defecto (catches de codex; doctrina KJC-BUG-0095: un
     // gate no se cae en silencio): solo exit 0 permite. kj inejecutable =
     // deny duro (el remedio es restaurar kj); cualquier otro fallo de
-    // evaluacion = deny con escape humano registrable — la sesion no queda
-    // presa de un typo de YAML, pero abrirla es decision del usuario.
+    // evaluacion = deny sin escape (ADR 0015): un typo de YAML lo corrige el
+    // usuario fuera de la sesion.
     if ((EDIT_TOOLS.includes(tool) || tool === "Bash") && existsSync(resolve(ROOT, ".karajan", "policy.yml"))) {
       // PL-C: el rol que ACTÚA (KJ_POLICY_ROLE, sembrado por los runners de
       // kj run en los subprocesos) — el anfitrión-brain evalúa como coder.
@@ -970,11 +883,9 @@ process.stdin.on("end", () => {
         let v = null;
         try { v = JSON.parse(String(pres.stdout || "").trim().split("\\n").pop()); } catch { /* mensaje generico */ }
         const secure = !!(v && v.class === "security");
-        if (!secure && escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
-        else {
-          console.error("karajan sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada; el commit exigira ademas KJ_POLICY_REASON)") + doc("policy"));
-          process.exit(2);
-        }
+        // ADR 0015 (KJC-TSK-0932): no escape; a rule that misfires is fixed by PR.
+        console.error("karajan sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (sin escape: si la regla falla, tu usuario corrige .karajan/policy.yml por PR)") + doc("policy"));
+        process.exit(2);
       } else if (pres.status !== 0) {
         // KJC-BUG-0207: un kj que NO ARRANCA no es una violacion de policy. Con
         // kj linkado al arbol, un error de sintaxis transitorio en src/ dejaba
@@ -999,9 +910,8 @@ process.stdin.on("end", () => {
             console.error("karajan sentinel: kj no arranca (" + broken[0] + (at ? " en " + at : "") + "), asi que la policy no se puede evaluar y NADA MAS pasa: edita " + (brokenFile || "el fichero que rompe kj") + " para arreglarlo. No es un deny de policy, es kj roto." + doc("policy"));
             process.exit(2);
           }
-        } else if (escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
-        else {
-          console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check y corrige .karajan/policy.yml fuera de la sesion (o KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada)." + doc("policy"));
+        } else {
+          console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check; .karajan/policy.yml lo corrige tu usuario fuera de la sesion." + doc("policy"));
           process.exit(2);
         }
       }
@@ -1022,11 +932,8 @@ process.stdin.on("end", () => {
           let blockOn = false;
           try { blockOn = /steward:\\s*["']?block/.test(readFileSync(join(ROOT, ".karajan", "kj.config.yml"), "utf8")); } catch { /* no config — no block */ }
           if (hard.length && blockOn) {
-            if (escOn("KJ_ALLOW_STEWARD")) { recordEscape(sid, "KJ_ALLOW_STEWARD", tool); }
-            else {
-              console.error("karajan sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(KJ_ALLOW_STEWARD=1 = excepcion consciente de esta sesion, queda registrada)" + doc("steward"));
-              process.exit(2);
-            }
+            console.error("karajan sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(sin escape, ADR 0015: si el trabajo sigue, tu usuario cambia method_gates.steward a inform)" + doc("steward"));
+            process.exit(2);
           }
           const st = load();
           const s = session(st, sid);
@@ -1043,11 +950,11 @@ process.stdin.on("end", () => {
       if (rel && CODE.test(rel) && !TESTS.test(rel)) {
         const branch = branchOf();
         const why = !branch ? null : BASE_BRANCHES.has(branch) ? "base" : !CARD.test(branch) ? "nocard" : null;
+        // ADR 0015 (KJC-TSK-0925): no escape. Without a card there is no work.
         if (why) {
-          if (escOn("KJ_ALLOW_NO_CARD")) { recordEscape(sid, "KJ_ALLOW_NO_CARD", tool); process.exit(0); }
           console.error(why === "base"
-            ? "karajan sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)" + doc("card-first")
-            : "karajan sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)" + doc("card-first"));
+            ? "karajan sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion." + doc("card-first")
+            : "karajan sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion." + doc("card-first"));
           process.exit(2);
         }
         // KJC-TSK-0848 (ADR 0010, RAG-B): the RAG must have answered about this
@@ -1070,15 +977,14 @@ process.stdin.on("end", () => {
         // KJC-BUG-0190: with nothing indexed, no query can cover anything —
         // the gate asks for kj rag index instead of denying the impossible.
         const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || ((rs.rag_queries || []).length > 0 && fresh()) || rs.rag_index_empty === true;
+        // ADR 0015 (KJC-TSK-0925): no escape. The cases it covered (new file, empty
+        // index, not indexable) are decided by the gate itself.
         if (!covered) {
-          if (escOn("KJ_ALLOW_NO_RAG")) {
-            // Recorded ONCE per session: the escape is a conscious exception, not a per-edit tax.
-            if (!(rs.escapes || []).includes("KJ_ALLOW_NO_RAG")) recordEscape(sid, "KJ_ALLOW_NO_RAG", tool);
-          } else {
+          {
             // KJC-BUG-0216 (issue #1807): un .astro, un .php o cualquier fichero
             // sin adapter NO puede estar en el indice, asi que exigir una
             // respuesta del RAG sobre el es pedir lo imposible, y empujaba a
-            // dejar KJ_ALLOW_NO_RAG puesta para siempre. La exencion es SOLO
+            // dejar el escape puesto para siempre. La exencion es SOLO
             // esa: un indice vacio o por detras si tiene arreglo (kj rag index)
             // y sigue bloqueando, porque si no el gate desapareceria en
             // cualquier proyecto sin indexar. Nada legible = se bloquea.
@@ -1098,7 +1004,7 @@ process.stdin.on("end", () => {
               console.error("karajan sentinel: rag-first — el indice aun no tiene " + rel + " (" + absent + "); indexalo y consulta despues: kj_rag_query / kj rag query <que hace " + rel + ">" + doc("rag-first"));
               process.exit(2);
             } else {
-              console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>. (KJ_ALLOW_NO_RAG=1 = excepcion consciente, queda registrada)" + doc("rag-first"));
+              console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>." + doc("rag-first"));
               process.exit(2);
             }
           }
@@ -1133,11 +1039,10 @@ process.stdin.on("end", () => {
       // depender de como parta las palabras el separador (catch de la review).
       const movesHooks = cmd.toLowerCase().includes("core.hookspath");
       if ((inOrder(["git", "commit"], words) && words.some(skipsVerify)) || movesHooks) {
-        if (escOn("KJ_ALLOW_NO_VERIFY")) { recordEscape(sid, "KJ_ALLOW_NO_VERIFY", tool); }
-        else {
-          console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta, es una decision de tu usuario. (KJ_ALLOW_NO_VERIFY=1 = excepcion consciente, queda registrada)" + doc("escapes"));
-          process.exit(2);
-        }
+        // ADR 0015 (KJC-TSK-0926): no escape. A broken hook is fixed; skipping it,
+        // if it ever must happen, is the user's act in their own terminal.
+        console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta saltarlo, lo hace tu usuario en su terminal." + doc("escapes"));
+        process.exit(2);
       }
       const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
       const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
@@ -1145,20 +1050,14 @@ process.stdin.on("end", () => {
       const pend = pendingMoves(load().sessions?.[sid]);
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
         // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
-        // por su primera mitad. kj decide con un hecho comprobable (otra PR
-        // abierta de la card); si kj no responde, se bloquea como siempre.
-        const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
-        let blocking = pend, carried = [];
-        if (!bg.error && (bg.status === 0 || bg.status === 2)) {
-          try { const d = JSON.parse(bg.stdout); blocking = d.blocking || []; carried = d.carried || []; } catch { /* sin respuesta legible: como siempre */ }
-        }
+        // por su primera mitad (boardGate, en la lib).
+        const { blocking, carried } = boardGate(sid, pend);
         for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
+        // ADR 0015 (KJC-TSK-0925): no escape; an epic and a card split across PRs
+        // are already decided above (KJC-BUG-0230, 0198).
         if (blocking.length > 0) {
-          if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
-          else {
-            console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)" + doc("board-sync"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + doc("board-sync"));
+          process.exit(2);
         }
       }
       // (the pending entry itself is recorded by the PostToolUse hook, only once
@@ -1167,9 +1066,9 @@ process.stdin.on("end", () => {
       // there misleads every future reader. When the command writes one from a
       // file, kj crosses ITS data against this turn's outputs; the hook carries
       // no policy (kj reads method_gates.claims; off = this check does not exist).
-      const bodyFile = /\\bgh\\s+pr\\s+(?:create|edit)\\b/.test(cmd) ? /--body-file[= ]+("([^"]+)"|'([^']+)'|([^\\s"']+))/.exec(cmd) : null;
-      if (bodyFile && transcript) {
-        const body = bodyFile[2] || bodyFile[3] || bodyFile[4];
+      // KJC-BUG-0245: the path is read by the shell reader, so "pr.md;" is "pr.md".
+      const body = /\\bgh\\s+pr\\s+(?:create|edit)\\b/.test(cmd) ? optionValues(cmd, ["--body-file"])[0] : undefined;
+      if (body && transcript) {
         const g = spawnSync("kj", ["claims", "gate", "--transcript", transcript, "--file", body], { cwd: ROOT, encoding: "utf8" });
         if (!g.error && g.status === 2) {
           console.error("karajan sentinel: claims — un dato del cuerpo de la PR esta DESMENTIDO por las salidas de este turno:\\n" + (g.stderr || "").trim() + "\\nVerificalo o marcalo como no comprobado antes de crear la PR. Detalle: kj claims check --transcript " + transcript + " --file " + body + doc("claims"));
@@ -1177,7 +1076,8 @@ process.stdin.on("end", () => {
         }
       }
       if (isPublish(cmd)) {
-        if (escOn("KJ_ALLOW_RELEASE")) { recordEscape(sid, "KJ_ALLOW_RELEASE", tool); process.exit(0); }
+        // ADR 0015 (KJC-TSK-0932): no escape — KJC-BUG-0204 and 0259 keep the
+        // check from blocking its own fix.
         // KJC-BUG-0204: el check se evalua PARA este comando. Un item que
         // declara remedied_by no bloquea el comando que lo repara (desplegar
         // la landing era justo lo que el check pedia); publicar no se exime.
@@ -1194,19 +1094,15 @@ process.stdin.on("end", () => {
         if (res.status !== 0) {
           let items = "";
           try { items = (parsed.checks || []).filter((c) => !c.ok && c.lifted !== true).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
-          console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(KJ_ALLOW_RELEASE=1 = excepcion consciente, queda registrada)" + doc("release"));
+          console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(sin escape: se repara lo que el check nombra)" + doc("release"));
           process.exit(2);
         }
       } else if (PUSH.test(cmd)) {
-        // KJC-BUG-0147: the board escape covers the push too — a pending move
-        // blocks the push like it blocks the commit, and the SAME conscious,
-        // recorded escape opens both (multi-PR cards are a legitimate plan).
+        // KJC-BUG-0147: a pending move blocks the push like it blocks the commit.
+        // ADR 0015 (KJC-TSK-0925): with no escape.
+        // KJC-BUG-0262: a carried card does not block the push the commit let through.
         const sess = load().sessions?.[sid];
-        let v = violations(sess, branchOf());
-        if (v.length && pendingMoves(sess).length && escOn("KJ_ALLOW_BOARD")) {
-          recordEscape(sid, "KJ_ALLOW_BOARD", tool);
-          v = violations({ ...sess, pending_moves: [] }, branchOf());
-        }
+        const v = violations(sess, branchOf(), boardGate(sid, pendingMoves(sess)).blocking);
         if (v.length) {
           console.error("karajan sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve antes de empujar. Estado: kj sentinel status" + doc("push-gate"));
           process.exit(2);

package/src/policy/supervisor-verify.js

@@ -24,7 +24,7 @@ const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
  * @returns {{files: Set<string>, reason?: string}} rutas repo-relativas de
  * supervisor cuyo estado actual está respaldado por la provenance sellada.
  */
-export function verifiedSupervisorFiles({ projectDir }) {
+export function verifiedSupervisorFiles({ projectDir, trackedOnly = false }) {
   let prov;
   try {
     prov = JSON.parse(readFileSync(resolve(projectDir, PROVENANCE_FILE), "utf8"));
@@ -37,7 +37,11 @@ export function verifiedSupervisorFiles({ projectDir }) {
   }
   const ok = new Set();
   const unjudgeable = new Set();
-  const entries = Array.isArray(prov?.files) ? prov.files : [];
+  // KJC-BUG-0259 (user's decision, option A): history is judged with the kj of
+  // when it was committed. The harness guards are machine-local and never in the
+  // repo; the review and each PR's CI verify them when the seal is made. A check
+  // over the repo's history (release check) judges only what is versioned.
+  const entries = (Array.isArray(prov?.files) ? prov.files : []).filter((e) => !trackedOnly || !String(e?.file).startsWith(HARNESS_PREFIX));
   // KJC-BUG-0211: desde KJC-BUG-0197 el sello cubre tambien los guardias del
   // supervisor, y aqui solo se sabian verificar los hooks. Como `complete`
   // exige que TODAS las entradas verifiquen, el sello no se podia ni commitear.
@@ -93,10 +97,10 @@ export function verifiedSupervisorFiles({ projectDir }) {
  * `note` dice lo que este sitio NO ha podido juzgar, para que un levantamiento
  * mas laxo de lo que parece no pase por silencio (KJC-BUG-0212).
  */
-export function liftSealedSupervisorViolations({ projectDir, violations }) {
+export function liftSealedSupervisorViolations({ projectDir, violations, trackedOnly = false }) {
   const RULE = "defaults.supervisor.write";
   if (!violations.some((v) => v.rule_id === RULE && v.file)) return { violations, lifted: 0 };
-  const sealed = verifiedSupervisorFiles({ projectDir });
+  const sealed = verifiedSupervisorFiles({ projectDir, trackedOnly });
   // La violación sobre la PROPIA provenance solo se alza si la provenance
   // entera verificó — a medias no describe la verdad y sigue denegada.
   const liftable = (v) =>

package/src/review/card-first.js

@@ -4,7 +4,8 @@
  * hu-board → the branch must reference a LIVE card (block by default);
  * planning-game/external → card-shaped reference required (warn default,
  * block via method_gates.card_first). Exemptions explicit and visible:
- * base branch, configured prefixes (releases), KJ_ALLOW_NO_CARD=1.
+ * base branch and configured prefixes (releases). No escape (ADR 0015): a
+ * gate an agent can switch off is a suggestion.
  */
 import { listPlans, loadPlan } from "../plan/plan-store.js";
 import { escapeRegExp } from "../utils/escape-regexp.js";
@@ -48,10 +49,7 @@ async function findLiveCardInBranch(projectDir, branch) {
   return closedHit;
 }
 
-export async function checkCardFirst({ config = {}, projectDir = process.cwd(), branch, env = process.env, deps = {} }) {
-  if (env.KJ_ALLOW_NO_CARD === "1") {
-    return { ok: true, mode: "exempt", reason: "KJ_ALLOW_NO_CARD=1 (explicit escape hatch)" };
-  }
+export async function checkCardFirst({ config = {}, projectDir = process.cwd(), branch, deps = {} }) {
   const exempt = config.method_gates?.card_first_exempt_branches || DEFAULT_EXEMPT_PREFIXES;
   if (exempt.some((p) => branch.startsWith(p))) {
     return { ok: true, mode: "exempt", reason: `branch prefix exempt (${branch.split("/")[0]}/…)` };

package/src/review/policy-gate.js

@@ -1,10 +1,9 @@
 /**
  * Adaptador del gate de policy en el flujo de review de karajan-code
  * (GOV-A, KJC-TSK-0745). La decisión warn/deny/inexcepcionable/excepción
- * vive en el kernel (@karajan-family/governance); aquí solo el dominio: la
- * excepción se pide con KJ_ALLOW_POLICY=1 + KJ_POLICY_REASON, y el
- * artefacto de este dominio es el diff staged — por eso el alcance
- * registrado dice "este diff exacto".
+ * vive en el kernel (@karajan-family/governance); aquí solo el dominio: el
+ * artefacto es el diff staged. Sin excepción por diff (ADR 0015,
+ * KJC-TSK-0932): una regla que falla se corrige por PR.
  */
 import { evaluateGate } from "@karajan-family/governance";
 
@@ -13,13 +12,12 @@ import { evaluateGate } from "@karajan-family/governance";
  */
 export function evaluatePolicyGate({
   policy, errors = [], role = "coder", files = [], netLinesAdded = null,
-  diffHashValue = null, env = process.env, recordException = () => {},
+  diffHashValue = null, recordException = () => {},
   standingExceptions = [], now = new Date(),
 }) {
   return evaluateGate({
     policy, errors, role, files, netLinesAdded,
     artifactHash: diffHashValue,
-    exemption: { requested: env.KJ_ALLOW_POLICY === "1", justification: env.KJ_POLICY_REASON, hint: 'KJ_POLICY_REASON="por qué"' },
     recordException: (entry) => recordException({ ...entry, scope: "este diff exacto" }),
     standingExceptions, now,
   });

package/src/review/sonar-pregate.js

@@ -110,9 +110,9 @@ export async function runSonarPregate({ config, stagedFiles = [], touchedLines =
       }
       for (const f of own) indexed.add(`${prefix}${f}`);
       keys.push(scan.projectKey);
-      // The scan above ALWAYS runs before issues are read (single-flight): the
-      // verdict is about the code as it is now, never a stale server analysis
-      // (KJC-TSK-0795 AC2 — that failure mode has no route here, by design).
+      // The scan above ALWAYS runs before issues are read (single-flight), and
+      // it returns once the server has processed it (KJC-BUG-0263: before, the
+      // upload returned first and the issues read were the previous analysis).
       const res = await getOpenIssues(config, scan.projectKey);
       totalProject += res.total ?? (res.issues || []).length;
       // Issue components are package-relative: made repo-relative here.

package/src/review/tests-with-code.js

@@ -5,7 +5,7 @@
  * `method_gates.tests_with_code`. Test-FIRST remains the reviewer's
  * judgment; test-PRESENT belongs to the gate. Patterns come from the
  * project's own `development.*` config (same ones headless enforces).
- * KJ_ALLOW_NO_TESTS=1 is the explicit escape hatch.
+ * No escape (ADR 0015): deletions and comment-only cleanups already pass.
  */
 
 const DEFAULT_TEST_PATTERNS = ["/tests/", "/__tests__/", ".test.", ".spec."];
@@ -28,10 +28,7 @@ export function sourceFilesOf(config = {}, files = []) {
   };
 }
 
-export function checkTestsWithCode({ config = {}, stagedFiles = [], numstat = null, env = process.env }) {
-  if (env.KJ_ALLOW_NO_TESTS === "1") {
-    return { ok: true, mode: "exempt", reason: "KJ_ALLOW_NO_TESTS=1 (explicit escape hatch)" };
-  }
+export function checkTestsWithCode({ config = {}, stagedFiles = [], numstat = null }) {
   const { sources, hasTests } = sourceFilesOf(config, stagedFiles);
 
   if (sources.length === 0 || hasTests) return { ok: true, mode: "pass" };
@@ -51,7 +48,7 @@ export function checkTestsWithCode({ config = {}, stagedFiles = [], numstat = nu
   }
 
   const policy = config.method_gates?.tests_with_code || "warn";
-  const reason = `source changes without any test change (${sources.slice(0, 5).join(", ")}${sources.length > 5 ? "…" : ""}) — the failing test comes first; add one or KJ_ALLOW_NO_TESTS=1 for a deliberate exception`;
+  const reason = `source changes without any test change (${sources.slice(0, 5).join(", ")}${sources.length > 5 ? "…" : ""}) — the failing test comes first: add one`;
   return policy === "block"
     ? { ok: false, mode: "block", sources, reason }
     : { ok: true, mode: "warn", sources, reason };

package/src/sonar/api.js

@@ -82,6 +82,27 @@ async function sonarFetch(config, urlPath) {
   );
 }
 
+const CE_FINAL = new Set(["SUCCESS", "FAILED", "CANCELED"]);
+const sleepMs = (ms) => new Promise((done) => setTimeout(done, ms));
+
+/**
+ * KJC-BUG-0263 — the scanner uploads the analysis and returns; the server
+ * processes it in the background, and issues read before that task ends are
+ * the PREVIOUS analysis. Polls /api/ce/task until it reaches a final status.
+ * @returns {Promise<{ok: boolean, status: string, timedOut?: boolean}>}
+ */
+export async function waitForAnalysis(config, taskId, { timeoutMs = 120_000, intervalMs = 1000, sleep = sleepMs } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let status = "UNKNOWN";
+  while (Date.now() < deadline) {
+    const body = await sonarFetch(config, `/api/ce/task?id=${encodeURIComponent(taskId)}`);
+    try { status = JSON.parse(body).task?.status || "UNKNOWN"; } catch { status = "UNKNOWN"; }
+    if (CE_FINAL.has(status)) return { ok: status === "SUCCESS", status };
+    await sleep(intervalMs);
+  }
+  return { ok: false, status, timedOut: true };
+}
+
 /**
  * KJC-BUG-0226 (issue #1838) — de donde sale la clave que se CONSULTA. El
  * scanner sube el analisis con la que el repo declara en su

package/src/sonar/scanner.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import os from "node:os";
 import { runCommand } from "../utils/process.js";
 import { sonarUp } from "./manager.js";
+import { waitForAnalysis } from "./api.js";
 import { resolveSonarProjectKey } from "./project-key.js";
 import {
   resolveSonarHost,
@@ -380,14 +381,32 @@ export async function runSonarScan(config, projectKey = null, { verbose = false,
   }
 
   const result = await runCommand(cmd, args, { timeout: scannerTimeout, env, cwd: scanCwd });
+  // KJC-BUG-0263: the scan is done when the server has processed it; whoever reads
+  // the issues next would otherwise get the previous analysis. Said out loud when
+  // the log names no task to wait for.
+  let ok = result.exitCode === 0;
+  let analysisNote = null;
+  if (ok) {
+    const taskId = /api\/ce\/task\?id=([\w-]+)/.exec(String(result.stdout || ""))?.[1];
+    if (taskId) {
+      const done = await waitForAnalysis({ ...config, sonarqube: { ...sonarConfig, host: apiHost } }, taskId);
+      if (!done.ok) {
+        ok = false;
+        analysisNote = `sonar: the server did not finish analysis ${taskId} (${done.status}${done.timedOut ? ", timed out" : ""}) — its issues would be the previous analysis`;
+      }
+    } else {
+      analysisNote = "sonar: the scanner log names no analysis task, so kj could not wait for the server — issues may belong to the previous analysis";
+    }
+  }
   return {
-    ok: result.exitCode === 0,
+    ok,
     projectKey: effectiveProjectKey,
     cwd: scanCwd,
     scanner: pick.type,
-    note,
+    note: [note, analysisNote].filter(Boolean).join("; ") || null,
     stdout: result.stdout,
-    stderr: result.stderr,
+    // A scan that failed on the server's side says so, not with the scanner's own log.
+    stderr: !ok && result.exitCode === 0 ? analysisNote : result.stderr,
     exitCode: result.exitCode
   };
 }