kenaz 0.3.10 → 0.3.12

package/core/.collaboration/core/task-api.test.js

@@ -17,11 +17,10 @@ const assert = require('assert');
 const fs = require('fs').promises;
 const path = require('path');
 const os = require('os');
-const { TaskAPI, CONFIG, parseYAML, toYAML, loadAlayaGate, echoAlayaLessons } = require('./task-api.js');
+const { TaskAPI, CONFIG, parseYAML, toYAML } = require('./task-api.js');
 // TASK_2104: same shared gate task-api.js loads at runtime — used here only
 // to read its constants for assertions (query building + gate behavior
 // itself is covered by prompt.test.js against the one implementation).
-const alayaGate = require('../../.formation/tools/alaya-gate.js');
 
 // ============================================================================
 // 測試工具
@@ -1129,140 +1128,4 @@ runner.test('shared-mode: id_alloc stamp on task when local_fallback', async ()
 });
 
 
-// ============================================================================
-// 測試案例: TASK_1992 — Alaya process-lessons echo (create command)
-// ============================================================================
-
-/**
- * Captures console.log calls made during fn() and returns them as an array
- * of joined-argument strings, restoring console.log afterward.
- */
-async function captureLogs(fn) {
-  const original = console.log;
-  const logs = [];
-  console.log = (...a) => logs.push(a.join(' '));
-  try {
-    await fn();
-  } finally {
-    console.log = original;
-  }
-  return logs;
-}
-
-function mcpTextResponse(bodyObj) {
-  return {
-    ok: true,
-    json: async () => ({
-      jsonrpc: '2.0', id: 1,
-      result: { content: [{ type: 'text', text: JSON.stringify(bodyObj) }] },
-    }),
-  };
-}
-
-const ALAYA_TASK_DATA = { title: 'Fix appendCortexContext dedup bug', scope_paths: ['.formation/tools/prompt.js'] };
-
-runner.test('alaya-gate buildTaskContextQuery (shared with prompt.js): builds a query from title + scope_paths, null when empty', () => {
-  const q = alayaGate.buildTaskContextQuery(ALAYA_TASK_DATA);
-  assert.ok(q && q.includes('prompt'));
-  assert.strictEqual(alayaGate.buildTaskContextQuery({}), null);
-});
-
-runner.test('echoAlayaLessons: requests the candidate pool with min_cosine, prints up to 3 gated seeds from a mocked fetch', async () => {
-  let calledUrl = null;
-  let calledOpts = null;
-  const fetchMock = async (url, opts) => {
-    calledUrl = url;
-    calledOpts = opts;
-    return mcpTextResponse({
-      // js/.formation stack overlap with ALAYA_TASK_DATA's scope_paths, and
-      // cosine clears ALAYA_MIN_COSINE_DEFAULT — both must pass the gate.
-      bijas: [
-        { id: 'a1', seed_type: 'failure_seed', origin: 'local', content: 'Root cause one.', cosine: 0.75, tags: 'js' },
-        { id: 'a2', seed_type: 'lesson_seed', origin: 'remote', content: 'Lesson two.', cosine: 0.72, tags: 'js' },
-      ],
-      mode_effective: 'hybrid',
-    });
-  };
-
-  const logs = await captureLogs(() => echoAlayaLessons(ALAYA_TASK_DATA, fetchMock));
-
-  assert.strictEqual(calledUrl, 'http://127.0.0.1:18080/api/mcp');
-  const body = JSON.parse(calledOpts.body);
-  assert.strictEqual(body.params.name, 'alaya_recall');
-  assert.strictEqual(body.params.arguments.mode, 'hybrid');
-  assert.deepStrictEqual(body.params.arguments.seed_types, ['failure_seed', 'lesson_seed']);
-  assert.strictEqual(body.params.arguments.limit, alayaGate.ALAYA_CANDIDATE_POOL);
-  assert.strictEqual(body.params.arguments.min_cosine, alayaGate.ALAYA_MIN_COSINE_DEFAULT);
-
-  assert.ok(logs.some(l => l.includes('Alaya lessons for this card:')));
-  assert.ok(logs.some(l => l.includes('[failure_seed/local] Root cause one.')));
-  assert.ok(logs.some(l => l.includes('[lesson_seed/remote] Lesson two.')));
-});
-
-runner.test('echoAlayaLessons: TASK_2104 gate drops a below-floor bija and never prints it', async () => {
-  const fetchMock = async () => mcpTextResponse({
-    bijas: [
-      // Below ALAYA_MIN_COSINE_DEFAULT (0.70) — must be dropped even though
-      // it stack-matches (tags: 'js') and would render fine otherwise.
-      { id: 'b1', seed_type: 'failure_seed', origin: 'local', content: 'Stale noise seed.', cosine: 0.5, tags: 'js' },
-    ],
-    mode_effective: 'hybrid',
-  });
-  const logs = await captureLogs(() => echoAlayaLessons(ALAYA_TASK_DATA, fetchMock));
-  assert.strictEqual(logs.length, 0, 'a below-floor bija must print nothing, not fall back to ungated output');
-});
-
-runner.test('echoAlayaLessons: TASK_2104 gate keeps an above-floor stack-matching bija', async () => {
-  const fetchMock = async () => mcpTextResponse({
-    bijas: [
-      { id: 'c1', seed_type: 'lesson_seed', origin: 'local', content: 'On-topic lesson.', cosine: 0.8, tags: 'js' },
-    ],
-    mode_effective: 'hybrid',
-  });
-  const logs = await captureLogs(() => echoAlayaLessons(ALAYA_TASK_DATA, fetchMock));
-  assert.ok(logs.some(l => l.includes('[lesson_seed/local] On-topic lesson.')));
-});
-
-runner.test('echoAlayaLessons: gate module unavailable (e.g. sub-project with no .formation/) silently skips, never falls back to ungated output', async () => {
-  let fetchCalled = false;
-  const fetchMock = async () => { fetchCalled = true; return mcpTextResponse({ bijas: [{ id: 'd1', seed_type: 'failure_seed', origin: 'local', content: 'never printed' }] }); };
-  const logs = await captureLogs(() => echoAlayaLessons(ALAYA_TASK_DATA, fetchMock, null));
-  assert.strictEqual(logs.length, 0);
-  assert.strictEqual(fetchCalled, false, 'must return before ever calling fetch when the gate cannot be loaded');
-});
-
-runner.test('echoAlayaLessons: silent when fetch rejects (network error / timeout)', async () => {
-  const fetchMock = async () => { throw new Error('AbortError: The operation was aborted'); };
-  const logs = await captureLogs(() => echoAlayaLessons(ALAYA_TASK_DATA, fetchMock));
-  assert.strictEqual(logs.length, 0);
-});
-
-runner.test('echoAlayaLessons: silent when fetch resolves non-ok', async () => {
-  const fetchMock = async () => ({ ok: false, status: 500 });
-  const logs = await captureLogs(() => echoAlayaLessons(ALAYA_TASK_DATA, fetchMock));
-  assert.strictEqual(logs.length, 0);
-});
-
-runner.test('echoAlayaLessons: silent when the MCP result has zero bijas', async () => {
-  const fetchMock = async () => mcpTextResponse({ bijas: [], mode_effective: 'hybrid' });
-  const logs = await captureLogs(() => echoAlayaLessons(ALAYA_TASK_DATA, fetchMock));
-  assert.strictEqual(logs.length, 0);
-});
-
-runner.test('echoAlayaLessons: KENAZ_NO_ALAYA_ECHO=1 suppresses the echo entirely (fetch never called)', async () => {
-  let fetchCalled = false;
-  const fetchMock = async () => { fetchCalled = true; return mcpTextResponse({ bijas: [{ id: 'x', seed_type: 'failure_seed', origin: 'local', content: 'never printed' }] }); };
-
-  const prev = process.env.KENAZ_NO_ALAYA_ECHO;
-  process.env.KENAZ_NO_ALAYA_ECHO = '1';
-  try {
-    const logs = await captureLogs(() => echoAlayaLessons(ALAYA_TASK_DATA, fetchMock));
-    assert.strictEqual(logs.length, 0);
-    assert.strictEqual(fetchCalled, false);
-  } finally {
-    if (prev === undefined) delete process.env.KENAZ_NO_ALAYA_ECHO;
-    else process.env.KENAZ_NO_ALAYA_ECHO = prev;
-  }
-});
-
 runner.run();

package/core/.collaboration/core/task-replica.js

@@ -0,0 +1,189 @@
+'use strict';
+/**
+ * task-replica.js (TASK_2421)
+ *
+ * Shared-room card replicas. Task IDs are allocated room-wide via relay leases
+ * but card files live only on the creating node (.kenaz/tasks is gitignored), so
+ * other nodes got "任務不存在" for ids they saw in git/messages. When the project
+ * is in an active shared room, `task-api create` also publishes a READ-ONLY
+ * replica of the card to the relay tasks table, and `get/update/move/complete`
+ * on an unknown id look that replica up.
+ *
+ * Why status 'assigned' with NO assigned_to (no relay change needed):
+ *   - GET /api/tasks defaults to status=pool, so the pool list never shows it
+ *   - kenaz_pool_pull (inbox) filters assigned_to == this node, so the creator's
+ *     own inbox does not fill with replicas either
+ *   - 'assigned' is already a valid, non-pool relay status
+ *   Residual: relay claim is not status-gated, so an explicit claim by exact id
+ *   would still succeed; replicas are documented as non-claimable (full_yaml
+ *   carries `replica: true`).
+ *
+ * Everything here is best-effort and never throws into a caller: a relay problem
+ * must never fail a local create/move.
+ */
+
+const http = require('http');
+const https = require('https');
+const path = require('path');
+
+const TIMEOUT_MS = 3000;
+// local status dir -> relay status. Backlog/pending stays the non-pool 'assigned'.
+const RELAY_STATUS = {
+  backlog: 'assigned', pending: 'assigned',
+  active: 'in_progress', blocked: 'blocked', done: 'done', cancel: 'cancelled',
+};
+const ALL_STATUSES = 'assigned,in_progress,blocked,done,cancelled,completed,claimed,pool';
+
+/** Shared-room condition, identical to generateTaskID's. */
+function isSharedRoom(yggConfig) {
+  return !!(yggConfig && yggConfig.enabled !== false &&
+    yggConfig.relay_url && String(yggConfig.relay_url).trim() !== '' &&
+    yggConfig.shared_task_ids !== false);
+}
+
+/** Replica publishing: shared room AND not opted out (`share_cards: false`). */
+function shouldShareCards(yggConfig) {
+  return isSharedRoom(yggConfig) && yggConfig.share_cards !== false;
+}
+
+function projectOf(yggConfig, projectRoot) {
+  return (yggConfig.yggdrasil_project && String(yggConfig.yggdrasil_project).trim()) ||
+    path.basename(projectRoot) || 'default';
+}
+
+function nodeOf(yggConfig, gitUserName) {
+  return (yggConfig.node_name && String(yggConfig.node_name).trim()) || gitUserName || 'unknown';
+}
+
+function relayRequest(yggConfig, key, method, pathAndQuery, bodyObj) {
+  return new Promise((resolve, reject) => {
+    const base = String(yggConfig.relay_url).replace(/^wss:\/\//, 'https://').replace(/^ws:\/\//, 'http://');
+    let url;
+    try { url = new URL(pathAndQuery, base); } catch { reject(new Error('invalid relay_url')); return; }
+    const isHttps = url.protocol === 'https:';
+    const body = bodyObj !== undefined ? JSON.stringify(bodyObj) : null;
+    let settled = false;
+    const req = (isHttps ? https : http).request({
+      hostname: url.hostname, port: url.port || (isHttps ? 443 : 80),
+      path: url.pathname + url.search, method,
+      headers: {
+        ...(body ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } : {}),
+        ...(key ? { Authorization: `Bearer ${key}` } : {}),
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => {
+        if (settled) return; settled = true;
+        if (res.statusCode < 200 || res.statusCode >= 300) { reject(new Error(`relay HTTP ${res.statusCode}`)); return; }
+        try { resolve(data ? JSON.parse(data) : null); } catch (e) { reject(new Error(`relay parse error: ${e.message}`)); }
+      });
+    });
+    req.on('error', (e) => { if (!settled) { settled = true; reject(e); } });
+    const timer = setTimeout(() => { if (!settled) { settled = true; req.destroy(); reject(new Error('relay timeout')); } }, TIMEOUT_MS);
+    req.on('close', () => clearTimeout(timer));
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
+/** Plain-object copy of the card without internal `_` keys. */
+function cleanCard(task) {
+  const out = {};
+  for (const [k, v] of Object.entries(task || {})) if (!k.startsWith('_')) out[k] = v;
+  return out;
+}
+
+/**
+ * Publish a replica. ctx = { yggConfig, key, projectRoot, node, toYAML }.
+ * Returns {ok:true} | {ok:false, error}.
+ */
+async function publishReplica(ctx, task, localStatusDir) {
+  try {
+    const card = cleanCard(task);
+    const replicaCard = {
+      replica: true,
+      origin_node: ctx.node,
+      id: card.id, title: card.title, description: card.description,
+      priority: card.priority, status: card.status, alias: card.alias || null,
+      requirements: card.requirements || [], acceptance_criteria: card.acceptance_criteria || [],
+      created_by: card.created_by || null,
+    };
+    await relayRequest(ctx.yggConfig, ctx.key, 'POST', '/api/tasks', {
+      task_id: task.id,
+      project: projectOf(ctx.yggConfig, ctx.projectRoot),
+      status: RELAY_STATUS[localStatusDir || 'backlog'] || 'assigned',
+      priority: card.priority || 'P2',
+      title: card.title,
+      description: card.description,
+      created_by: ctx.node,
+      full_yaml: ctx.toYAML(replicaCard),
+    });
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+
+/** Push a status (and refreshed card) to an existing replica row. */
+async function syncReplica(ctx, task, localStatusDir) {
+  try {
+    const card = cleanCard(task);
+    const body = {
+      project: projectOf(ctx.yggConfig, ctx.projectRoot),
+      title: card.title, description: card.description, priority: card.priority,
+      full_yaml: ctx.toYAML({
+        replica: true, origin_node: ctx.node, id: card.id, title: card.title,
+        description: card.description, priority: card.priority, status: card.status,
+        alias: card.alias || null, requirements: card.requirements || [],
+        acceptance_criteria: card.acceptance_criteria || [], created_by: card.created_by || null,
+      }),
+    };
+    if (localStatusDir && RELAY_STATUS[localStatusDir]) body.status = RELAY_STATUS[localStatusDir];
+    await relayRequest(ctx.yggConfig, ctx.key, 'PATCH',
+      `/api/tasks/${encodeURIComponent(task.id)}?project=${encodeURIComponent(body.project)}`, body);
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+
+/**
+ * Look a card up on the relay by TASK id or alias. Returns
+ * { found:true, row, replica } | { found:false } | { found:false, error }.
+ * `replica` is the parsed full_yaml (or a minimal object from row columns).
+ */
+async function fetchReplica(ctx, idOrAlias, parseYAML) {
+  try {
+    const project = projectOf(ctx.yggConfig, ctx.projectRoot);
+    const rows = await relayRequest(ctx.yggConfig, ctx.key, 'GET',
+      `/api/tasks?project=${encodeURIComponent(project)}&status=${ALL_STATUSES}&limit=1000&include_blocked=1`);
+    const list = Array.isArray(rows) ? rows : [];
+    const want = String(idOrAlias).toLowerCase();
+    for (const row of list) {
+      let card = null;
+      try { card = row.full_yaml ? parseYAML(row.full_yaml) : null; } catch { card = null; }
+      const alias = card && card.alias ? String(card.alias).toLowerCase() : null;
+      if (String(row.task_id).toLowerCase() === want || (alias && alias === want)) {
+        return { found: true, row, replica: card && Object.keys(card).length ? card : {
+          id: row.task_id, title: row.title, description: row.description, priority: row.priority,
+        } };
+      }
+    }
+    return { found: false };
+  } catch (e) {
+    return { found: false, error: e.message };
+  }
+}
+
+/** Human-readable "read-only replica" notice. */
+function replicaNotice(taskId, row, replica) {
+  const node = (replica && replica.origin_node) || (row && row.created_by) || 'unknown';
+  return `read-only replica; card lives on node ${node}. ` +
+    `To track it locally: node .collaboration/core/task-api.js pull ${taskId}`;
+}
+
+module.exports = {
+  isSharedRoom, shouldShareCards, projectOf, nodeOf, relayRequest,
+  publishReplica, syncReplica, fetchReplica, replicaNotice, RELAY_STATUS,
+};

package/core/.formation/.merge-lock

@@ -0,0 +1 @@
+{"pid":32452,"taskId":"TASK_2356","acquiredAt":"2026-10-09T10:19:19.033Z"}

package/core/.formation/bifrost/codex-doctor.js

@@ -127,10 +127,20 @@ function diagnose() {
   if (unreg.length) notes.push('Kenaz hooks not registered for: ' + unreg.join(', ') + '. Run: node .formation/bifrost/setup-codex.js');
   if (untrusted.length) notes.push('Kenaz hooks registered but NOT trusted (' + untrusted.join(', ') + '); codex does not run them. Open codex, type /hooks, and trust the kenaz entries (re-trust after any change to the hook command).');
   if (trust.UserPromptSubmit.registered && !trust.UserPromptSubmit.pull) notes.push('UserPromptSubmit hook lacks --pull, so independently opened codex sessions receive no peer mail. Remove the kenaz hook blocks from config.toml and re-run setup-codex.js.');
-  return { trust, delivery_mode: deliveryMode(trust), ok: notes.length === 0, notes };
+  const managed = managedDaemon();
+  const mode = deliveryMode(trust);
+  if (managed && mode === 'pull-on-prompt') notes.push(MANAGED_NOTE);
+  return { trust, delivery_mode: mode, managed_daemon: managed, ok: notes.filter((n) => n !== MANAGED_NOTE).length === 0, notes };
 }
 
-module.exports = { promptText, skillText, installPrompts, installAgentsBlock, removeAgentsBlock, agentsBlock, hookTrust, deliveryMode, diagnose, SHIM_REL, EVENTS };
+// TASK_2419: Codex desktop managed app-server daemon (unix control socket / pid file under CODEX_HOME).
+function managedDaemon(home) {
+  const h = home || codexHome();
+  return fs.existsSync(path.join(h, 'app-server-control', 'app-server-control.sock')) || fs.existsSync(path.join(h, 'app-server-daemon', 'daemon.pid'));
+}
+const MANAGED_NOTE = 'Codex managed daemon detected: Kenaz has no push channel into it. Peer mail arrives on your next prompt via the UserPromptSubmit --pull hook (delivery_mode pull-on-prompt).';
+
+module.exports = { managedDaemon, MANAGED_NOTE, promptText, skillText, installPrompts, installAgentsBlock, removeAgentsBlock, agentsBlock, hookTrust, deliveryMode, diagnose, SHIM_REL, EVENTS };
 
 if (require.main === module) {
   if (process.argv.includes('--install-prompts')) console.log(JSON.stringify(installPrompts()));

package/core/.formation/bifrost/codex-doctor.test.js

@@ -67,3 +67,18 @@ test('global AGENTS.md gets one managed Kenaz block (wish / field report guidanc
   assert.doesNotMatch(after, /kenaz:begin|kenaz_wish_create/);
   delete process.env.CODEX_HOME;
 });
+
+test('TASK_2419: managed daemon detected from CODEX_HOME markers; diagnose reports it without failing ok', () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'cx-md-'));
+  assert.strictEqual(D.managedDaemon(home), false); // control: empty home
+  fs.mkdirSync(path.join(home, 'app-server-control'));
+  fs.writeFileSync(path.join(home, 'app-server-control', 'app-server-control.sock'), '');
+  assert.strictEqual(D.managedDaemon(home), true);
+  process.env.CODEX_HOME = home;
+  fs.writeFileSync(path.join(home, 'config.toml'), cfg(true, true));
+  const d = D.diagnose();
+  assert.strictEqual(d.managed_daemon, true);
+  assert.strictEqual(d.delivery_mode, 'pull-on-prompt');
+  assert.ok(d.notes.includes(D.MANAGED_NOTE)); assert.strictEqual(d.ok, d.notes.length === 1); // the managed note alone is informational
+  delete process.env.CODEX_HOME;
+});

package/core/.formation/bifrost/launch.js

@@ -276,7 +276,7 @@ function renderMemoryStartupDoc() {
 
 function renderOverride(prompt, bootContext, { policy = BOOT_POLICY, projectPath = PROJECT_PATH, memoryStartupDoc = '' } = {}) {
   const projectInstruction = projectPath
-    ? `You are working on sub-project: ${projectPath}\nAll task-api.js commands must include --project-path="${projectPath}".\nAll MCP tool calls (synapse_*, hippocampus_*, etc.) must include projectPath="${projectPath}".\n\n`
+    ? `You are working on sub-project: ${projectPath}\nAll task-api.js commands must include --project-path="${projectPath}".\nAll MCP tool calls (kenaz_*) must include projectPath="${projectPath}".\n\n`
     : '';
   const codexDdxInjection = renderCodexAntiDrift();
 
@@ -491,7 +491,7 @@ async function main() {
     ? runFastBoot()
     : await fetchBootContext({ specialist: SPECIALIST, projectRoot: ROOT, projectPath: PROJECT_PATH || ROOT, includeCanary: false });
   const offlineNote = probe.reachable ? ''
-    : '# Boot context availability\nInitial Kenaz MCP probe failed; live recall availability is not established. Local fast boot context is not proof of a successful synapse_status check.\n\n';
+    : '# Boot context availability\nInitial Kenaz MCP probe failed; server availability is not established. Local fast boot context is not proof of a successful kenaz_ping check.\n\n';
   writeOverride(prompt, offlineNote + bootCtx);
   // ── SessionStart hook (TASK_1230) ─────────────────────────────────────────
   // Fires after prompt is written (AGENTS.override.md exists) but before Codex

package/core/.formation/bifrost/launch.test.js

@@ -23,7 +23,7 @@ function mockRequest(scenario = 'offline') {
       if (scenario === 'incomplete') { res.complete = false; res.emit('close'); return; }
       if (scenario === 'oversized') { res.emit('data', 'x'.repeat(1024 * 1024 + 1)); return; }
       const body = {
-        ok: JSON.stringify({ jsonrpc: '2.0', id: 1, result: { tools: [{ name: 'synapse_status' }] } }),
+        ok: JSON.stringify({ jsonrpc: '2.0', id: 1, result: { tools: [{ name: 'kenaz_ping' }] } }),
         malformed: '{', empty: '{"result":{"tools":[]}}',
         'rpc-error': '{"error":{"code":-1}}', null: 'null',
       }[scenario] || '{}';
@@ -135,7 +135,7 @@ test('offline default Ansuz continues once with elixir, truthful status and pinn
   assert.deepEqual(Array.from(effects.promptCalls[0].args.slice(-2)), ['--project-path', project]);
   assert.ok(effects.promptCalls[0].args.includes('--external-boot-context'));
   const override = effects.writes.find(write => write.name.endsWith('AGENTS.override.md'));
-  assert.match(override.content, /live recall availability is not established/);
+  assert.match(override.content, /server availability is not established/);
   assert.match(override.content, /Fixture fast context banner/);
   assert.equal((override.content.match(/## Codex Bootstrap Policy \(fast\)/g) || []).length, 1);
   assert.ok(override.content.includes(`projectPath="${project}"`));

package/core/.formation/bifrost/setup-codex.js

@@ -225,7 +225,7 @@ function uninstall(options = {}) {
   for (let n = 0; n < segs.length; n++) {
     const [h, body] = segs[n], nx = segs[n + 1];
     if (h && /^\s*\[\[hooks\.\w+\]\]\s*$/.test(h) && nx && nx[0] && /^\s*\[\[hooks\.\w+\.hooks\]\]/.test(nx[0]) &&
-        nx[1].join('\n').split('\\').join('/').includes(HOOK_SHIM_REL)) { n++; res.hooks = 'removed'; continue; }
+        isKenazHandler(nx)) { n++; res.hooks = 'removed'; continue; } // TASK_2418: any checkout's shim, same identity rule as missingHookEvents
     out.push(...body.filter((l) => !/^# kenaz-dashboard native hooks/.test(l)));
   }
   if (res.hooks === 'removed' && !dryRun) fs.writeFileSync(cfg, out.join('\n').replace(/\n{3,}/g, '\n\n'), 'utf8');
@@ -283,23 +283,82 @@ function getHookShimPath(_projectRoot) {
   return path.resolve(__dirname, '..', '..', HOOK_SHIM_REL);
 }
 
+// TASK_2418: what counts as a kenaz hook, and what counts as a CURRENT one.
+// A handler is kenaz's when its command runs codex-hook-shim.js (any checkout). It is current only when it
+// runs exactly this core's shim (absolute path, slashes normalized, Windows case-insensitive) and the
+// UserPromptSubmit one carries --pull (TASK_2379). Stale ones are replaced in place, never duplicated; handlers
+// that do not run our shim are never touched.
+const HOOK_SHIM_NAME = path.posix.basename(HOOK_SHIM_REL);
+const HOOK_MARKER = /^# kenaz-dashboard native hooks/;
+const HANDLER_HEADER = /^\s*\[\[hooks\.(\w+)\.hooks\]\]\s*$/;
+const GROUP_HEADER = /^\s*\[\[hooks\.(\w+)\]\]\s*$/;
+const slashes = (s) => String(s).replace(/\\/g, '/');
+const foldCase = (s) => (process.platform === 'win32' ? s.toLowerCase() : s);
+
+function parseSegments(text) { // [header line | null, body lines]
+  const segs = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (/^\s*\[/.test(line) || !segs.length) segs.push([/^\s*\[/.test(line) ? line : null, [line]]);
+    else segs[segs.length - 1][1].push(line);
+  }
+  return segs;
+}
+const isKenazHandler = (seg) => slashes(seg[1].join('\n')).includes(HOOK_SHIM_NAME);
+function isCurrentHandler(ev, seg, projectRoot) {
+  const m = slashes(seg[1].join('\n')).match(/^\s*command\s*=\s*(.*)$/m);
+  if (!m) return false;
+  const cmd = foldCase(m[1]);
+  const shim = foldCase(slashes(getHookShimPath(projectRoot)));
+  const at = cmd.indexOf('"' + shim + '"');
+  if (at < 0) return false;
+  return ev !== 'UserPromptSubmit' || /(^|\s)--pull(\s|['"]|$)/.test(cmd.slice(at + shim.length + 2));
+}
+/** Per event: segment indexes of kenaz handlers, split into current / stale. */
+function scanKenazHooks(text, projectRoot) {
+  const segs = parseSegments(text), found = {};
+  segs.forEach((seg, i) => {
+    const m = seg[0] && seg[0].match(HANDLER_HEADER);
+    if (!m || !HOOK_EVENTS.includes(m[1]) || !isKenazHandler(seg)) return;
+    const f = found[m[1]] || (found[m[1]] = { current: [], stale: [] });
+    (isCurrentHandler(m[1], seg, projectRoot) ? f.current : f.stale).push(i);
+  });
+  return { segs, found };
+}
+/** config text without the kenaz handlers of `events` (and the empty group each one leaves behind). */
+function stripKenazHooks(text, events, projectRoot) {
+  const { segs, found } = scanKenazHooks(text, projectRoot);
+  const drop = new Set();
+  for (const ev of events) {
+    for (const i of [...(found[ev] ? found[ev].current : []), ...(found[ev] ? found[ev].stale : [])]) {
+      drop.add(i);
+      const prev = segs[i - 1], next = segs[i + 1];
+      const g = prev && prev[0] && prev[0].match(GROUP_HEADER);
+      if (g && g[1] === ev && !(next && next[0] && HANDLER_HEADER.test(next[0]) && next[0].includes('.' + ev + '.'))
+          && prev[1].slice(1).every((l) => !l.trim())) drop.add(i - 1);
+    }
+  }
+  const out = [];
+  segs.forEach((seg, i) => {
+    if (!drop.has(i)) { out.push(...seg[1]); return; }
+    out.push(...seg[1].slice(1).filter((l) => /^\s*#/.test(l) && !HOOK_MARKER.test(l))); // keep neighbours' comments
+  });
+  return out.join('\n');
+}
+
 function areHooksAlreadyRegistered(projectRoot) {
   const configPath = getCodexConfigPath();
   if (!fs.existsSync(configPath)) return false;
-  const content = fs.readFileSync(configPath, 'utf8');
-  const shimPath = getHookShimPath(projectRoot);
-  // Registered if config contains our shim path in any hooks entry
-  return content.includes(HOOK_SHIM_REL) || content.includes(shimPath.split('\\').join('/'));
+  // at least one CURRENT kenaz handler: a block left by an old checkout does not run this core's shim
+  const { found } = scanKenazHooks(fs.readFileSync(configPath, 'utf8'), projectRoot);
+  return Object.values(found).some((f) => f.current.length > 0);
 }
 
-// TASK_2299: HOOK_EVENTS that have no [[hooks.EV.hooks]] block pointing at our shim in config.toml.
-function missingHookEvents() {
+// TASK_2299: HOOK_EVENTS without exactly one current kenaz handler. TASK_2418: stale (old checkout path,
+// UserPromptSubmit without --pull) and duplicated ones count as missing, so registerHooks rewrites them.
+function missingHookEvents(projectRoot) {
   const configPath = getCodexConfigPath();
-  const content = fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf8').replace(/\\/g, '/') : '';
-  return HOOK_EVENTS.filter((ev) => {
-    const blocks = content.match(new RegExp('\\[\\[hooks\\.' + ev + '\\.hooks\\]\\][^\\[]*', 'g')) || [];
-    return !blocks.some((blk) => blk.includes(HOOK_SHIM_REL));
-  });
+  const { found } = scanKenazHooks(fs.existsSync(configPath) ? fs.readFileSync(configPath, 'utf8') : '', projectRoot);
+  return HOOK_EVENTS.filter((ev) => !found[ev] || found[ev].stale.length > 0 || found[ev].current.length !== 1);
 }
 
 // True when the codex CLI both supports hooks AND our shim is registered.
@@ -313,6 +372,7 @@ function nativeHooksActive(projectRoot) {
 function registerHooks(log, projectRoot, events) {
   const shimPath = getHookShimPath(projectRoot).split('\\').join('/');
   const configPath = getCodexConfigPath();
+  const evs = events || HOOK_EVENTS;
 
   // Ensure ~/.codex dir exists
   const codexDir = path.dirname(configPath);
@@ -322,8 +382,16 @@ function registerHooks(log, projectRoot, events) {
 
   // [[hooks.X]] array-of-tables entries are additive-safe TOML: appending is valid
   // even if the user already has their own [[hooks.X]] entries from other tools.
-  const lines = ['', '# kenaz-dashboard native hooks (TASK_1733) -- auto-registered by setup-codex.js'];
-  for (const ev of events || HOOK_EVENTS) {
+  // TASK_2418: kenaz handlers already present for these events (stale or not) are dropped first, so each
+  // event ends with exactly one current handler.
+  let kept = '';
+  try {
+    kept = fs.existsSync(configPath) ? stripKenazHooks(fs.readFileSync(configPath, 'utf8'), evs, projectRoot) : '';
+    if (!Object.keys(scanKenazHooks(kept, projectRoot).found).length) kept = kept.split('\n').filter((l) => !HOOK_MARKER.test(l)).join('\n');
+  } catch (err) { log('hook registration failed: ' + err.message); return { success: false, action: 'hooks_failed', error: err.message }; }
+  const lines = [''];
+  if (!kept.split('\n').some((l) => HOOK_MARKER.test(l))) lines.push('# kenaz-dashboard native hooks (TASK_1733) -- auto-registered by setup-codex.js');
+  for (const ev of evs) {
     lines.push(
       '[[hooks.' + ev + ']]',
       '',
@@ -337,8 +405,8 @@ function registerHooks(log, projectRoot, events) {
   const hookBlock = lines.join('\n');
 
   try {
-    fs.appendFileSync(configPath, hookBlock, 'utf8');
-    log('kenaz hooks appended to ' + configPath);
+    fs.writeFileSync(configPath, kept + (kept && !kept.endsWith('\n') ? '\n' : '') + hookBlock, 'utf8');
+    log('kenaz hooks written to ' + configPath);
     return { success: true, action: 'hooks_registered' };
   } catch (err) {
     log('hook registration failed: ' + err.message);

package/core/.formation/bifrost/shared/ansuz-boot-policy.js

@@ -18,13 +18,13 @@ function resolveBootPolicy({ specialist = 'Ansuz', depth, bootMode, full = false
 function renderBootstrap({ policy, projectPath, port = '18080', contextual = false } = {}) {
   const fast = [
     'Ansuz fast boot (elixir) is the default. This bootstrap policy supersedes any older instruction to run Phase 0, including the Phase 0 sentence inside elixir.',
-    'Check synapse_status with the active projectPath when available. If unavailable, report that memory is unavailable and continue only read-only inspection and analysis using local evidence; do not claim recall succeeded.',
+    'Check kenaz_ping with the active projectPath when available. If unavailable, report that the Kenaz server is unavailable and continue only read-only inspection and analysis using local evidence.',
     'Lightweight Phase 0 uses the supplied boot context and local project evidence; do not run phase-gate Phase 0 or its boot rituals in fast mode. This also supersedes legacy handoff instructions that promise Phase 0 archival. When offline, defer state-changing execution and memory-dependent work until the required service is restored.',
     'Existing authorization, scope, verification, task tracking, and merge restrictions remain in force.',
   ].join('\n');
   const command = `node .specialist/tools/phase-gate.js enter --phase=0 --specialist=${(policy?.specialist || 'Ansuz').toLowerCase()}${projectPath ? ` --project-path="${projectPath}"` : ''}`;
-  const full = `Before running phase-gate enter, call synapse_status with the active projectPath. If it errors or times out, HALT and emit recovery: confirm Kenaz Dashboard on port ${port}, re-run setup-codex, and restart the Codex session.\nExecute Phase 0 initialization now: run \`${command}\` and follow its checklist.`;
-  if (contextual) return `## Codex Bootstrap Policy\n\nFor Ansuz without an explicit full boot or legacy depth:\n${fast}\n\nFor explicit --full / --boot-mode full or kernel depth, and for other specialists: retain the full bootstrap guard; call synapse_status before Phase 0 and HALT with recovery instructions if it is unavailable. Use the active specialist and project-path for Phase 0.\n`;
+  const full = `Before running phase-gate enter, call kenaz_ping with the active projectPath. If it errors or times out, HALT and emit recovery: confirm Kenaz Dashboard on port ${port}, re-run setup-codex, and restart the Codex session.\nExecute Phase 0 initialization now: run \`${command}\` and follow its checklist.`;
+  if (contextual) return `## Codex Bootstrap Policy\n\nFor Ansuz without an explicit full boot or legacy depth:\n${fast}\n\nFor explicit --full / --boot-mode full or kernel depth, and for other specialists: retain the full bootstrap guard; call kenaz_ping before Phase 0 and HALT with recovery instructions if it is unavailable. Use the active specialist and project-path for Phase 0.\n`;
   return `## Codex Bootstrap Policy (${policy.mode})\n\n${policy.mode === 'fast' ? fast : full}\n`;
 }
 

package/core/.formation/bifrost/shared/codex-injection.js

@@ -31,7 +31,7 @@ Guards against failure modes seen in long Codex Ansuz runs (2026-04-09 audit). R
 ## Anti-Drift 1: DDx First (mechanism before action)
 Non-trivial problem on first contact:
 - You MUST enumerate 3 or more competing hypotheses before the first domain-specific tool call.
-- You MUST perform recall (synapse_recall / cortex_recall) before acting when memory tools are available.
+- You MUST check the code first (kenaz_lsp_* / Grep) before acting.
 - You MUST NOT treat the first plausible idea as the plan.
 
 Direct attempt is only allowed when one of these is true:
@@ -100,22 +100,8 @@ Never accept an agent's self-report as verification. Phase 9 is NOT optional. Fo
 
 Only mark a task complete when EVERY requirement passes its grep/run check. If even one fails, create a FIX task and dispatch it. Half-done is not done.
 
-## Anti-Drift 8: PROACTIVE LESSON CAPTURE (R-301 alignment)
-Proactive lesson capture is mandatory (R-301), so the next session does not rediscover every gotcha.
-
-When you observe a non-obvious technical fact during a session — bug root cause, surprising tool behavior, infrastructure quirk, workflow trap, performance gotcha — inscribe it as an ash rune IMMEDIATELY without waiting for user prompt.
-
-Inscription protocol:
-1. Identify the closest STABLE existing code symbol as the rune anchor (file:function:kind format). Bare file paths are weak anchors and may fail FTS5 indexing silently.
-2. \`synapse_inscribe\` with type=ash, confidence>=0.85, content in ENGLISH (MEM-LANG-001 — FTS5 cannot tokenize CJK reliably).
-3. ALWAYS include trigger_phrases (3-5 natural language phrases) for semantic recall.
-4. WRITE-VERIFY: after inscribe, run \`synapse_recall\` with a unique substring from the rune content. If result_count=0, re-inscribe with a different verified symbol_id, OR fall back to writing to .kenaz/specialist/lessons_pending_index.jsonl.
-
-Anti-patterns to avoid:
-- Inscribing on a non-existent symbol_id (silent index failure).
-- Skipping write-verify ("trust the success message" — discovered 2026-04-09 that inscribe API can return success while FTS5 indexing does not happen).
-- Chinese/CJK content in rune body (FTS5 returns 0 results for CJK queries).
-- Generic content ("we hit a bug, fixed it") — provides no recall value.
+## Anti-Drift 8: PROACTIVE LESSON CAPTURE
+When you observe a non-obvious technical fact (bug root cause, surprising tool behavior, infrastructure quirk, workflow trap), record it immediately with \`kenaz learn add\` — do not wait for the user to ask. Keep it specific; a generic note ("we hit a bug, fixed it") has no recall value.
 
 ## Closing Note
 If a kernel/elixir rule and an Anti-Drift protocol conflict: kernel/elixir wins on identity and safety, Anti-Drift wins on execution and verification.