kibi-opencode 0.13.0 → 0.15.0

package/dist/plugin.js

@@ -4,10 +4,12 @@ import { computeBriefIntent } from "./brief-intent.js";
 import { fetchBriefingResult, } from "./briefing-runtime.js";
 import { analyzeCodeFile, } from "./comment-analysis.js";
 import { getE2eCoverageSignal } from "./e2e-coverage-signals.js"; // implements REQ-opencode-file-context-guidance-v1
+import { buildDirtyRelevantFingerprint, buildEnforcementScopeKey, } from "./enforcement-scope.js";
 import { getFileLinkedEntityIds } from "./file-entity-links.js"; // implements REQ-opencode-file-context-guidance-v1
 import * as fileFilter from "./file-filter.js";
 import { deriveFileOperationReminder } from "./file-operation-reminders.js"; // implements REQ-opencode-file-context-guidance-v1
 import { createFileOperationState, } from "./file-operation-state.js"; // implements REQ-opencode-file-context-guidance-v1
+import { KibiCheckpointRunner, } from "./kibi-checkpoint-runner.js";
 import { getInitKibiCommandCapability, registerInitKibiCommand, } from "./init-kibi-capability.js";
 import { computeAuditDelta, getAuditTailCursor, guardBranchChanged, } from "./idle-brief-audit.js";
 import { hasTuiSeenBrief, selectLatestUnreadBrief, } from "./idle-brief-reader.js";
@@ -20,13 +22,18 @@ import { SENTINEL, buildPrompt } from "./prompt.js";
 import { reconcileAuditEntries } from "./reconcile-engine.js";
 import { isMustPriorityRequirement } from "./requirement-doc.js";
 import { classifyRisk } from "./risk-classifier.js";
+import { createSyncScheduler } from "./scheduler.js";
 import { createSessionEditState, } from "./session-edit-state.js";
 import { syncSessionBaselineState, } from "./session-fingerprint.js";
 import { getSessionTracker } from "./session-tracker.js";
 import { notifyStartup, } from "./startup-notifier.js";
+import { readKibiPackageVersions } from "./version-metadata.js";
 import { sendToast, } from "./toast.js";
 import { announceBriefTui, } from "./tui-brief-delivery.js";
+import { createKbFreshnessEvidenceStore, evaluateKbFreshness, } from "./kb-freshness-state.js";
+import { classifyMeaningfulChange } from "./meaningful-change-classifier.js";
 import { deletePendingBriefMarkers, loadPendingBriefMarkers, } from "./utils/brief-marker.js";
+import { resolveWorkContext, } from "./work-context-resolver.js";
 import * as fs from "node:fs";
 function deriveFileBucket(kind) {
     return kind;
@@ -44,17 +51,6 @@ function resolveIdleBriefDeliveryDelayMs(worktree) {
         return 0;
     return Math.min(60_000, Math.trunc(configValue));
 }
-function readKibiOpencodePackageVersion() {
-    try {
-        const packageJson = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
-        return typeof packageJson.version === "string"
-            ? packageJson.version
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 const startupNotifyGlobals = globalThis;
 /**
  * Lint requirement documents for embedded scenarios/tests and oversized content.
@@ -125,7 +121,7 @@ const kibiOpencodePlugin = async (input) => {
     if (!startup) {
         return {};
     }
-    const { cfg, workspaceHealth, posture, currentBranch, cache, runtimeOverlay, scheduler, maintenanceDegraded, getMaintenanceDegraded, getEffectiveMode, latchRuntimeDegraded, } = startup;
+    const { cfg, workspaceHealth, posture, currentBranch, cache, runtimeOverlay, scheduler: startupScheduler, maintenanceDegraded, getMaintenanceDegraded, getEffectiveMode, latchRuntimeDegraded, } = startup;
     const hooks = {};
     const initKibiCommandCapability = getInitKibiCommandCapability();
     if (initKibiCommandCapability.supported) {
@@ -146,12 +142,151 @@ const kibiOpencodePlugin = async (input) => {
     const toastedFingerprints = new Set();
     let lastRiskClass = null;
     let lastRiskFilePath = null;
-    const sessionEditState = createSessionEditState({ worktree: input.worktree });
-    const fileOperationState = createFileOperationState({
-        worktree: input.worktree,
-    }); // implements REQ-opencode-file-context-guidance-v1
+    let lastRiskScopeKey = null;
+    const schedulerRegistry = new Map();
+    if (startupScheduler) {
+        schedulerRegistry.set(path.resolve(input.worktree), startupScheduler);
+    }
+    const schedulerFactoryGlobals = globalThis;
+    const sessionEditStateRegistry = new Map();
+    const fileOperationStateRegistry = new Map();
+    const checkpointRunnerRegistry = new Map();
+    const pathKindCacheRegistry = new Map();
+    const freshnessStore = createKbFreshnessEvidenceStore();
+    function resolveScopedWorkContext(filePath) {
+        return resolveWorkContext({
+            inputDirectory: input.directory,
+            inputWorktree: input.worktree,
+            ...(filePath !== undefined ? { filePath } : {}),
+            ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}),
+            ...(input.agentIdentity !== undefined
+                ? { agentIdentity: input.agentIdentity }
+                : {}),
+        });
+    }
+    function buildStateScopeKey(context, lane) {
+        return buildEnforcementScopeKey({
+            sessionId: context.sessionId,
+            agentIdentity: context.agentIdentity,
+            worktreeRoot: context.worktreeRoot,
+            branch: context.branch,
+            dirtyRelevantFingerprint: lane,
+        });
+    }
+    function getSessionEditState(context) {
+        const key = buildStateScopeKey(context, "session-edits");
+        let state = sessionEditStateRegistry.get(key);
+        if (!state) {
+            state = createSessionEditState({ worktree: context.worktreeRoot });
+            sessionEditStateRegistry.set(key, state);
+        }
+        return state;
+    }
+    function getFileOperationState(context) {
+        const key = buildStateScopeKey(context, "file-operations");
+        let state = fileOperationStateRegistry.get(key);
+        if (!state) {
+            state = createFileOperationState({
+                worktree: context.worktreeRoot,
+            }); // implements REQ-opencode-file-context-guidance-v1
+            fileOperationStateRegistry.set(key, state);
+        }
+        return state;
+    }
+    function getCheckpointRunnerForContext(context) {
+        const key = buildStateScopeKey(context, "checkpoint-runner");
+        let runner = checkpointRunnerRegistry.get(key);
+        if (!runner) {
+            runner = new KibiCheckpointRunner({
+                config: cfg,
+                onRunComplete: (meta) => {
+                    const normalizedReason = meta.reason.endsWith(".trailing")
+                        ? meta.reason.slice(0, -".trailing".length)
+                        : meta.reason;
+                    const isSmartEnforcementSync = normalizedReason.startsWith("smart-enforcement.");
+                    if (meta.exitCode !== 0 && !isSmartEnforcementSync) {
+                        latchRuntimeDegraded("scheduler_sync_failed");
+                    }
+                    if (meta.checkExitCode !== undefined && meta.checkExitCode !== 0) {
+                        latchRuntimeDegraded("scheduler_check_failed");
+                    }
+                },
+            });
+            checkpointRunnerRegistry.set(key, runner);
+        }
+        return runner;
+    }
+    function getPathKindCache(context) {
+        const key = buildStateScopeKey(context, "path-kind-cache");
+        let scopedCache = pathKindCacheRegistry.get(key);
+        if (!scopedCache) {
+            scopedCache = new Map();
+            pathKindCacheRegistry.set(key, scopedCache);
+        }
+        return scopedCache;
+    }
+    function getSchedulerForContext(context) {
+        if (!cfg.sync.enabled) {
+            return null;
+        }
+        const worktreeRoot = path.resolve(context.worktreeRoot);
+        const existing = schedulerRegistry.get(worktreeRoot);
+        if (existing) {
+            return existing;
+        }
+        const schedulerFactory = schedulerFactoryGlobals.__kibi_test_scheduler_factory_by_worktree?.get(worktreeRoot) ??
+            schedulerFactoryGlobals.__kibi_test_scheduler_factory ??
+            createSyncScheduler;
+        try {
+            const scopedScheduler = schedulerFactory({
+                worktree: worktreeRoot,
+                config: cfg,
+                onRunComplete: (meta) => {
+                    const normalizedReason = meta.reason.endsWith(".trailing")
+                        ? meta.reason.slice(0, -".trailing".length)
+                        : meta.reason;
+                    const isSmartEnforcementSync = normalizedReason.startsWith("smart-enforcement.");
+                    if (meta.exitCode !== 0 && !isSmartEnforcementSync) {
+                        latchRuntimeDegraded("scheduler_sync_failed");
+                    }
+                    if (meta.checkExitCode !== undefined && meta.checkExitCode !== 0) {
+                        latchRuntimeDegraded("scheduler_check_failed");
+                    }
+                },
+            });
+            schedulerRegistry.set(worktreeRoot, scopedScheduler);
+            return scopedScheduler;
+        }
+        catch {
+            latchRuntimeDegraded("scheduler_unavailable");
+            return null;
+        }
+    }
+    function buildScopedCacheKey(context, riskClass, fileBucket, dirtyRelevantInputs) {
+        const cacheKey = {
+            workspaceRoot: context.worktreeRoot,
+            branch: context.branch,
+            posture: context.posture,
+            riskClass,
+            fileBucket,
+        };
+        if (getEffectiveMode() === "hard") {
+            cacheKey.scopeKey = buildEnforcementScopeKey({
+                sessionId: context.sessionId,
+                agentIdentity: context.agentIdentity,
+                worktreeRoot: context.worktreeRoot,
+                branch: context.branch,
+                dirtyRelevantFingerprint: buildDirtyRelevantFingerprint(dirtyRelevantInputs),
+            });
+        }
+        return cacheKey;
+    }
+    const rootWorkContext = resolveScopedWorkContext();
+    const sessionEditState = getSessionEditState(rootWorkContext);
+    const fileOperationState = getFileOperationState(rootWorkContext);
+    const scheduler = getSchedulerForContext(rootWorkContext);
     let degradedWarnedOnce = false;
-    const pathKindCache = new Map();
+    const pathKindCache = getPathKindCache(rootWorkContext);
     // Idle-brief state — dedupe via semantic contentHash (persisted envelope is the delivery authority)
     let idleBriefInFlight = false;
     let idleBriefTrailingRerun = false;
@@ -177,18 +312,21 @@ const kibiOpencodePlugin = async (input) => {
         sessionBaselineCursor = nextState.cursor;
     }
     syncSessionBaseline(currentBranch);
-    function normalizeSessionPath(filePath) {
+    function normalizeSessionPath(filePath, worktree = input.worktree) {
         if (path.isAbsolute(filePath)) {
-            const relativePath = path.relative(input.worktree, filePath);
+            const relativePath = path.relative(worktree, filePath);
             return relativePath.startsWith("..") ? filePath : relativePath;
         }
         return filePath;
     }
-    function resolveWorktreePath(filePath) {
-        return input.worktree && !path.isAbsolute(filePath)
-            ? path.join(input.worktree, filePath)
+    function resolveWorktreePath(filePath, worktree = input.worktree) {
+        return worktree && !path.isAbsolute(filePath)
+            ? path.join(worktree, filePath)
             : filePath;
     }
+    function buildRiskPathScopeKey(context, filePath) {
+        return `${buildStateScopeKey(context, "risk")}:${normalizeSessionPath(filePath, context.worktreeRoot)}`;
+    }
     function getKbSnapshotFingerprint(worktree, branch) {
         try {
             const snapshotPath = path.join(worktree, ".kb", "branches", branch, "kb.rdf");
@@ -243,33 +381,33 @@ const kibiOpencodePlugin = async (input) => {
         }
         return normalizeSessionPath(directPath);
     }
-    function readFileContent(filePath) {
+    function readFileContent(filePath, worktree = input.worktree) {
         try {
-            return fs.readFileSync(resolveWorktreePath(filePath), "utf-8");
+            return fs.readFileSync(resolveWorktreePath(filePath, worktree), "utf-8");
         }
         catch {
             return "";
         }
     }
-    function updateRecentEditsFromSession(sessionEdits) {
+    function updateRecentEditsFromSession(sessionEdits, scopedPathKindCache) {
         recentEdits = sessionEdits.slice(-MAX_RECENT_EDITS).map((entry) => ({
             path: entry.filePath,
-            kind: pathKindCache.get(entry.filePath) ?? "unknown",
+            kind: scopedPathKindCache.get(entry.filePath) ?? "unknown",
             timestamp: entry.lastReconciledAt,
         }));
         return recentEdits;
     }
-    function deriveRiskContext(filePath) {
-        const normalizedFilePath = normalizeSessionPath(filePath);
-        const pathAnalysis = analyzePath(normalizedFilePath, input.worktree);
-        pathKindCache.set(normalizedFilePath, pathAnalysis.kind);
-        const fileContent = readFileContent(normalizedFilePath);
+    function deriveRiskContext(context, filePath, scopedPathKindCache) {
+        const normalizedFilePath = normalizeSessionPath(filePath, context.worktreeRoot);
+        const pathAnalysis = analyzePath(normalizedFilePath, context.worktreeRoot);
+        scopedPathKindCache.set(normalizedFilePath, pathAnalysis.kind);
+        const fileContent = readFileContent(normalizedFilePath, context.worktreeRoot);
         const hasMustPriority = pathAnalysis.kind === "requirement"
-            ? isMustPriorityRequirement(normalizedFilePath, input.worktree)
+            ? isMustPriorityRequirement(normalizedFilePath, context.worktreeRoot)
             : false;
         let precomputedSuggestion = null;
         if (pathAnalysis.kind === "code" && cfg.guidance.commentDetection.enabled) {
-            precomputedSuggestion = analyzeCodeFile(resolveWorktreePath(normalizedFilePath), {
+            precomputedSuggestion = analyzeCodeFile(resolveWorktreePath(normalizedFilePath, context.worktreeRoot), {
                 minLines: cfg.guidance.commentDetection.minLines,
             });
         }
@@ -287,6 +425,7 @@ const kibiOpencodePlugin = async (input) => {
             pathAnalysis.kind === "code" ? precomputedSuggestion : null;
         lastRiskClass = effectiveRiskClass;
         lastRiskFilePath = normalizedFilePath;
+        lastRiskScopeKey = buildRiskPathScopeKey(context, normalizedFilePath);
         return {
             effectiveRiskClass,
             pathAnalysis,
@@ -294,17 +433,17 @@ const kibiOpencodePlugin = async (input) => {
             precomputedSuggestion,
         };
     }
-    function buildBriefingWorkspaceContext() {
+    function buildBriefingWorkspaceContext(context = rootWorkContext, branch = context.branch) {
         return {
-            workspaceRoot: input.worktree,
-            branch: currentBranch,
-            directory: input.directory,
+            workspaceRoot: context.worktreeRoot,
+            branch,
+            directory: context.worktreeRoot,
             ...(input.workspace !== undefined ? { workspace: input.workspace } : {}),
         };
     }
-    function buildWorkspaceContextForBranch(branch) {
+    function buildWorkspaceContextForBranch(branch, context = rootWorkContext) {
         return {
-            ...buildBriefingWorkspaceContext(),
+            ...buildBriefingWorkspaceContext(context),
             branch,
         };
     }
@@ -312,8 +451,8 @@ const kibiOpencodePlugin = async (input) => {
         if (!intentResult.eligible ||
             !input.client ||
             getMaintenanceDegraded() ||
-            (posture.state !== "root_active" &&
-                posture.state !== "hybrid_root_plus_vendored")) {
+            ((options.postureState ?? posture.state) !== "root_active" &&
+                (options.postureState ?? posture.state) !== "hybrid_root_plus_vendored")) {
             return;
         }
         if (options.skipIfCachedResultExists === true &&
@@ -322,7 +461,7 @@ const kibiOpencodePlugin = async (input) => {
         }
         const client = input.client;
         const fingerprint = intentResult.fingerprint;
-        const workspaceCtx = buildBriefingWorkspaceContext();
+        const workspaceCtx = options.workspaceCtx ?? buildBriefingWorkspaceContext();
         void fetchBriefingResult(client, workspaceCtx, intentResult).then((result) => {
             autoBriefResults.set(fingerprint, result);
             if (!toastedFingerprints.has(fingerprint)) {
@@ -336,6 +475,37 @@ const kibiOpencodePlugin = async (input) => {
     hooks.event = async ({ event }) => {
         const activeBranch = resolveCurrentBranch(input.worktree);
         syncSessionBaseline(activeBranch);
+        // Observe KB tool execution events for freshness evidence (best-effort)
+        const TOOL_EVENT_TYPES = new Set([
+            "tool.execute.after", "tool.executed", "tool.call.completed",
+            "tool.Execute.after", "tool.Call.completed",
+        ]);
+        if (TOOL_EVENT_TYPES.has(event.type)) {
+            const props = event.properties ?? {};
+            const toolName = (props.tool ?? props.toolName ?? props.name ??
+                props.call?.name ??
+                props.input?.tool);
+            if (typeof toolName === "string" && toolName.startsWith("kb_")) {
+                const scope = {
+                    ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}),
+                    agentIdentity: input.agentIdentity ?? "unknown",
+                    worktree: input.worktree,
+                    branch: activeBranch,
+                    fingerprint: `${input.sessionId ?? ""}-${activeBranch}`,
+                };
+                try {
+                    freshnessStore.recordToolEvidence(scope, toolName);
+                    logger.info("kb-freshness.tool-evidence", {
+                        event: "kb_freshness_tool_evidence",
+                        tool: toolName,
+                    });
+                }
+                catch {
+                    // best-effort, never crash the event handler
+                }
+            }
+            return; // tool events don't need file lifecycle processing
+        }
         // Handle session.idle for idle-brief generation. OpenCode can emit idle
         // while an assistant is between tool calls, so debounce until the work
         // burst settles before generating/delivering a brief.
@@ -506,71 +676,63 @@ const kibiOpencodePlugin = async (input) => {
             .properties.file;
         if (!filePath)
             return;
+        const eventContext = resolveScopedWorkContext(filePath);
+        const scopedSessionEditState = getSessionEditState(eventContext);
+        const scopedFileOperationState = getFileOperationState(eventContext);
+        const scopedPathKindCache = getPathKindCache(eventContext);
+        const scopedScheduler = getSchedulerForContext(eventContext);
+        const normalizedFilePath = normalizeSessionPath(filePath, eventContext.worktreeRoot);
         // Record lifecycle event into file-operation-state // implements REQ-opencode-file-context-guidance-v1
         const lifecycle = event.type === "file.created"
             ? "created"
             : event.type === "file.deleted"
                 ? "deleted"
                 : "edited";
-        fileOperationState.recordLifecycle(filePath, lifecycle, Date.now());
-        fileOperationState.normalizePath(filePath);
-        const pathAnalysis = analyzePath(filePath, input.worktree);
+        scopedFileOperationState.recordLifecycle(filePath, lifecycle, Date.now());
+        scopedFileOperationState.normalizePath(filePath);
+        const pathAnalysis = analyzePath(normalizedFilePath, eventContext.worktreeRoot);
         // For file.deleted: derive path kind without reading content, classify for reminder routing only
         if (lifecycle === "deleted") {
             // Preserve last known semantic risk if path was already tracked during session
-            const lastKnownKind = pathKindCache.get(filePath);
+            const lastKnownKind = scopedPathKindCache.get(normalizedFilePath);
             if (lastKnownKind) {
                 // Path was tracked — preserve last known semantic risk for reminder routing
-                pathKindCache.set(filePath, pathAnalysis.kind);
+                scopedPathKindCache.set(normalizedFilePath, pathAnalysis.kind);
             }
             else {
                 // Not tracked — classify only for reminder routing, not auto-briefing
-                pathKindCache.set(filePath, pathAnalysis.kind);
+                scopedPathKindCache.set(normalizedFilePath, pathAnalysis.kind);
             }
-            sessionEditState.recordEventHint(filePath, pathAnalysis.kind, Date.now());
-            sessionEditState.reconcilePath(filePath);
-            const sessionEdits = sessionEditState.getSessionEdits();
-            recentEdits = sessionEdits.slice(-MAX_RECENT_EDITS).map((e) => ({
-                path: e.filePath,
-                kind: pathKindCache.get(e.filePath) ?? "unknown",
-                timestamp: e.lastReconciledAt,
-            }));
+            scopedSessionEditState.recordEventHint(normalizedFilePath, pathAnalysis.kind, Date.now());
+            scopedSessionEditState.reconcilePath(normalizedFilePath);
+            const sessionEdits = scopedSessionEditState.getSessionEdits();
+            updateRecentEditsFromSession(sessionEdits, scopedPathKindCache);
             // Schedule background sync for deleted files that pass shouldHandleFile // implements REQ-opencode-file-context-guidance-v1
             if (cfg.sync.enabled &&
-                scheduler &&
-                fileFilter.shouldHandleFile(filePath, input.worktree)) {
-                scheduler.scheduleSync("file.deleted", filePath);
+                scopedScheduler &&
+                fileFilter.shouldHandleFile(normalizedFilePath, eventContext.worktreeRoot)) {
+                scopedScheduler.scheduleSync("file.deleted", normalizedFilePath);
             }
             return;
         }
-        sessionEditState.recordEventHint(filePath, pathAnalysis.kind, Date.now());
-        sessionEditState.reconcilePath(filePath);
-        pathKindCache.set(filePath, pathAnalysis.kind);
-        const sessionEdits = sessionEditState.getSessionEdits();
-        const focusEdit = sessionEditState.getFocusEdit();
+        scopedSessionEditState.recordEventHint(normalizedFilePath, pathAnalysis.kind, Date.now());
+        scopedSessionEditState.reconcilePath(normalizedFilePath);
+        scopedPathKindCache.set(normalizedFilePath, pathAnalysis.kind);
+        const sessionEdits = scopedSessionEditState.getSessionEdits();
+        const focusEdit = scopedSessionEditState.getFocusEdit();
         // Schedule background sync for file.created/file.edited that pass shouldHandleFile // implements REQ-opencode-file-context-guidance-v1
         if (cfg.sync.enabled &&
-            scheduler &&
-            fileFilter.shouldHandleFile(filePath, input.worktree)) {
-            scheduler.scheduleSync(lifecycle === "created" ? "file.created" : "file.edited", filePath);
-        }
-        let fileContent = "";
-        try {
-            const resolvedPath = input.worktree && !path.isAbsolute(filePath)
-                ? path.join(input.worktree, filePath)
-                : filePath;
-            fileContent = fs.readFileSync(resolvedPath, "utf-8");
+            scopedScheduler &&
+            fileFilter.shouldHandleFile(normalizedFilePath, eventContext.worktreeRoot)) {
+            scopedScheduler.scheduleSync(lifecycle === "created" ? "file.created" : "file.edited", normalizedFilePath);
         }
-        catch { }
+        const fileContent = readFileContent(normalizedFilePath, eventContext.worktreeRoot);
         const hasMustPriority = pathAnalysis.kind === "requirement"
-            ? isMustPriorityRequirement(filePath, input.worktree)
+            ? isMustPriorityRequirement(normalizedFilePath, eventContext.worktreeRoot)
             : false;
         let precomputedSuggestion = null;
         if (pathAnalysis.kind === "code" && cfg.guidance.commentDetection.enabled) {
-            const resolvedPath = input.worktree && !path.isAbsolute(filePath)
-                ? path.join(input.worktree, filePath)
-                : filePath;
-            precomputedSuggestion = analyzeCodeFile(resolvedPath, {
+            precomputedSuggestion = analyzeCodeFile(resolveWorktreePath(normalizedFilePath, eventContext.worktreeRoot), {
                 minLines: cfg.guidance.commentDetection.minLines,
             });
         }
@@ -587,18 +749,20 @@ const kibiOpencodePlugin = async (input) => {
         const isAutoBriefRisk = effectiveRiskClass === "behavior_candidate" ||
             effectiveRiskClass === "traceability_candidate";
         lastRiskClass = effectiveRiskClass;
+        lastRiskFilePath = normalizedFilePath;
+        lastRiskScopeKey = buildRiskPathScopeKey(eventContext, normalizedFilePath);
         logger.info("smart-enforcement.risk", {
             event: "smart_enforcement_risk",
-            file: filePath,
+            file: normalizedFilePath,
             path_kind: pathAnalysis.kind,
             risk_class: effectiveRiskClass,
-            posture_state: posture.state,
+            posture_state: eventContext.posture,
             maintenance_state: getMaintenanceDegraded()
                 ? "maintenance_degraded"
                 : "maintenance_available",
             under_kb: pathAnalysis.isUnderKb,
             has_must_priority: hasMustPriority,
-            posture: posture.state,
+            posture: eventContext.posture,
             reason_code: effectiveRiskClass,
             effective_mode: getEffectiveMode(),
             static_degraded: posture.maintenanceDegraded,
@@ -613,13 +777,13 @@ const kibiOpencodePlugin = async (input) => {
             runtimeOverlay.primaryCause === "scheduler_check_failed";
         if (!targetedChecksBlocked &&
             cfg.sync.enabled &&
-            scheduler &&
+            scopedScheduler &&
             cfg.guidance.targetedChecks.enabled) {
             const traceabilityRules = effectiveRiskClass === "traceability_candidate"
                 ? ["symbol-traceability"]
                 : null;
             const kbStructuralRules = effectiveRiskClass === "kb_doc_structural" &&
-                fileFilter.shouldHandleFile(filePath, input.worktree)
+                fileFilter.shouldHandleFile(normalizedFilePath, eventContext.worktreeRoot)
                 ? [
                     "required-fields",
                     "no-dangling-refs",
@@ -633,10 +797,10 @@ const kibiOpencodePlugin = async (input) => {
             if (checkRules) {
                 logger.info("smart-enforcement.targeted-checks", {
                     event: "smart_enforcement_targeted_checks",
-                    file: filePath,
+                    file: normalizedFilePath,
                     risk_class: effectiveRiskClass,
-                    posture: posture.state,
-                    posture_state: posture.state,
+                    posture: eventContext.posture,
+                    posture_state: eventContext.posture,
                     guidance_action: "targeted_checks",
                     effective_mode: getEffectiveMode(),
                     rules: checkRules,
@@ -645,43 +809,33 @@ const kibiOpencodePlugin = async (input) => {
                     merged_degraded: getMaintenanceDegraded(),
                     overlay_cause: runtimeOverlay.primaryCause ?? null,
                 });
-                logger.info(`kibi-opencode: scheduling sync for ${filePath}`);
-                scheduler.scheduleSync(effectiveRiskClass === "traceability_candidate"
+                logger.info(`kibi-opencode: scheduling sync for ${normalizedFilePath}`);
+                scopedScheduler.scheduleSync(effectiveRiskClass === "traceability_candidate"
                     ? "smart-enforcement.traceability"
-                    : "smart-enforcement.kb-doc", filePath, checkRules);
+                    : "smart-enforcement.kb-doc", normalizedFilePath, checkRules);
             }
         }
-        recentEdits = sessionEdits.slice(-MAX_RECENT_EDITS).map((e) => ({
-            path: e.filePath,
-            kind: pathKindCache.get(e.filePath) ?? "unknown",
-            timestamp: e.lastReconciledAt,
-        }));
+        updateRecentEditsFromSession(sessionEdits, scopedPathKindCache);
         if (effectiveRiskClass === "safe_docs_only" ||
             effectiveRiskClass === "safe_test_only") {
             recentCommentSuggestion = null;
             return;
         }
-        const cacheKey = {
-            workspaceRoot: input.worktree,
-            branch: currentBranch,
-            posture: posture.state,
-            riskClass: effectiveRiskClass,
-            fileBucket: deriveFileBucket(pathAnalysis.kind),
-        };
+        const cacheKey = buildScopedCacheKey(eventContext, effectiveRiskClass, deriveFileBucket(pathAnalysis.kind), [normalizedFilePath, pathAnalysis.kind, effectiveRiskClass]);
         // Always process manual_kb_edit before cache check — this is a critical safety signal
         if (effectiveRiskClass === "manual_kb_edit") {
             hasRecentKbEdit = true;
             if (cfg.guidance.warnOnKbEdits) {
-                logger.warn(`kibi-opencode: .kb edit detected for ${filePath}`);
-                getSessionTracker().recordWarning("kb-edit", filePath, `Manual .kb edit: ${filePath}`);
+                logger.warn(`kibi-opencode: .kb edit detected for ${normalizedFilePath}`);
+                getSessionTracker().recordWarning("kb-edit", normalizedFilePath, `Manual .kb edit: ${normalizedFilePath}`);
             }
             return;
         }
         // Always emit requirement lint warnings before cache check — these are safety signals
         if (effectiveRiskClass === "req_policy_candidate") {
-            const lintWarnings = lintRequirementDoc(filePath, input.worktree);
+            const lintWarnings = lintRequirementDoc(normalizedFilePath, eventContext.worktreeRoot);
             for (const warning of lintWarnings) {
-                getSessionTracker().recordWarning(warning.category, filePath, warning.message);
+                getSessionTracker().recordWarning(warning.category, normalizedFilePath, warning.message);
             }
         }
         // Cache check: after critical signals have been emitted
@@ -690,10 +844,10 @@ const kibiOpencodePlugin = async (input) => {
                 event: "smart_enforcement_cache",
                 cache_hit: true,
                 cache_state: "hit",
-                file: filePath,
+                file: normalizedFilePath,
                 risk_class: effectiveRiskClass,
-                posture: posture.state,
-                posture_state: posture.state,
+                posture: eventContext.posture,
+                posture_state: eventContext.posture,
             });
             if (!isAutoBriefRisk) {
                 return;
@@ -703,10 +857,10 @@ const kibiOpencodePlugin = async (input) => {
             event: "smart_enforcement_cache",
             cache_hit: false,
             cache_state: "miss",
-            file: filePath,
+            file: normalizedFilePath,
             risk_class: effectiveRiskClass,
-            posture: posture.state,
-            posture_state: posture.state,
+            posture: eventContext.posture,
+            posture_state: eventContext.posture,
         });
         if (effectiveRiskClass === "req_policy_candidate") {
             if (getMaintenanceDegraded()) {
@@ -715,10 +869,10 @@ const kibiOpencodePlugin = async (input) => {
                     : logger.info;
                 logFn("smart-enforcement.degraded", {
                     event: "smart_enforcement_degraded",
-                    file: filePath,
+                    file: normalizedFilePath,
                     risk_class: effectiveRiskClass,
-                    posture: posture.state,
-                    posture_state: posture.state,
+                    posture: eventContext.posture,
+                    posture_state: eventContext.posture,
                     maintenance_state: getMaintenanceDegraded()
                         ? "maintenance_degraded"
                         : "maintenance_available",
@@ -733,8 +887,8 @@ const kibiOpencodePlugin = async (input) => {
             }
             if (!getMaintenanceDegraded() &&
                 cfg.sync.enabled &&
-                scheduler &&
-                fileFilter.shouldHandleFile(filePath, input.worktree)) {
+                scopedScheduler &&
+                fileFilter.shouldHandleFile(normalizedFilePath, eventContext.worktreeRoot)) {
                 let checkRules;
                 if (cfg.guidance.targetedChecks.enabled) {
                     if (hasMustPriority && getEffectiveMode() === "strict") {
@@ -744,7 +898,7 @@ const kibiOpencodePlugin = async (input) => {
                             "must-priority-coverage",
                             "strict-req-fact-pairing",
                         ];
-                        logger.info(`kibi-opencode: must-priority requirement detected, scheduling elevated checks for ${filePath}`);
+                        logger.info(`kibi-opencode: must-priority requirement detected, scheduling elevated checks for ${normalizedFilePath}`);
                     }
                     else {
                         checkRules = [
@@ -756,10 +910,10 @@ const kibiOpencodePlugin = async (input) => {
                 }
                 logger.info("smart-enforcement.targeted-checks", {
                     event: "smart_enforcement_targeted_checks",
-                    file: filePath,
+                    file: normalizedFilePath,
                     risk_class: effectiveRiskClass,
-                    posture: posture.state,
-                    posture_state: posture.state,
+                    posture: eventContext.posture,
+                    posture_state: eventContext.posture,
                     guidance_action: "targeted_checks",
                     effective_mode: getEffectiveMode(),
                     rules: checkRules ?? [],
@@ -768,7 +922,7 @@ const kibiOpencodePlugin = async (input) => {
                     merged_degraded: getMaintenanceDegraded(),
                     overlay_cause: runtimeOverlay.primaryCause ?? null,
                 });
-                scheduler?.scheduleSync("file.edited", filePath, checkRules);
+                scopedScheduler.scheduleSync("file.edited", normalizedFilePath, checkRules);
             }
             return;
         }
@@ -779,10 +933,10 @@ const kibiOpencodePlugin = async (input) => {
                     : logger.info;
                 logFn("smart-enforcement.degraded", {
                     event: "smart_enforcement_degraded",
-                    file: filePath,
+                    file: normalizedFilePath,
                     risk_class: effectiveRiskClass,
-                    posture: posture.state,
-                    posture_state: posture.state,
+                    posture: eventContext.posture,
+                    posture_state: eventContext.posture,
                     maintenance_state: getMaintenanceDegraded()
                         ? "maintenance_degraded"
                         : "maintenance_available",
@@ -803,7 +957,7 @@ const kibiOpencodePlugin = async (input) => {
                 const suggestion = precomputedSuggestion;
                 if (suggestion) {
                     recentCommentSuggestion = suggestion;
-                    const dedupeKey = `${filePath}:${suggestion.suggestionType}:${suggestion.fingerprint}`;
+                    const dedupeKey = `${buildRiskPathScopeKey(eventContext, normalizedFilePath)}:${suggestion.suggestionType}:${suggestion.fingerprint}`;
                     if (!seenFingerprints.has(dedupeKey)) {
                         seenFingerprints.add(dedupeKey);
                         const warningCategory = suggestion.suggestionType === "fact"
@@ -811,8 +965,8 @@ const kibiOpencodePlugin = async (input) => {
                             : suggestion.suggestionType === "adr"
                                 ? "long-comment-missed-adr"
                                 : "missing-traceability";
-                        logger.warn(`kibi-opencode: detected durable ${suggestion.suggestionType} knowledge in ${filePath}`);
-                        getSessionTracker().recordWarning(warningCategory, filePath, `Consider routing this ${suggestion.suggestionType} knowledge to Kibi instead of inline comments: ${suggestion.reasoning}`);
+                        logger.warn(`kibi-opencode: detected durable ${suggestion.suggestionType} knowledge in ${normalizedFilePath}`);
+                        getSessionTracker().recordWarning(warningCategory, normalizedFilePath, `Consider routing this ${suggestion.suggestionType} knowledge to Kibi instead of inline comments: ${suggestion.reasoning}`);
                     }
                 }
                 else {
@@ -827,16 +981,20 @@ const kibiOpencodePlugin = async (input) => {
                 return;
             }
             const sessionSourceFiles = sessionEdits.map((e) => e.filePath);
+            const briefingContext = resolveScopedWorkContext(focusEdit.filePath);
             const intentResult = computeBriefIntent({
                 riskClass: effectiveRiskClass,
-                posture: posture.state,
+                posture: briefingContext.posture,
                 maintenanceDegraded: getMaintenanceDegraded(),
                 sourceFiles: sessionSourceFiles,
                 focusFilePath: focusEdit.filePath,
-                worktreeRoot: input.worktree,
-                branch: currentBranch,
+                worktreeRoot: briefingContext.worktreeRoot,
+                branch: briefingContext.branch,
+            });
+            queueBriefingFetch(intentResult, {
+                workspaceCtx: buildBriefingWorkspaceContext(briefingContext),
+                postureState: briefingContext.posture,
             });
-            queueBriefingFetch(intentResult);
         }
         return;
     };
@@ -853,31 +1011,39 @@ const kibiOpencodePlugin = async (input) => {
                     cfg.guidance.smartEnforcement.degradedMode === "warn-once" &&
                     !degradedWarnedOnce;
                 const transformFocusFilePath = getTransformFocusFilePath(transformInput);
-                sessionEditState.reconcileKnownPaths();
+                const promptWorkContext = resolveScopedWorkContext(transformFocusFilePath ?? undefined);
+                const promptSessionEditState = getSessionEditState(promptWorkContext);
+                const promptFileOperationState = getFileOperationState(promptWorkContext);
+                const promptPathKindCache = getPathKindCache(promptWorkContext);
+                promptSessionEditState.reconcileKnownPaths();
                 if (transformFocusFilePath) {
-                    sessionEditState.forceEdit(transformFocusFilePath);
+                    promptSessionEditState.forceEdit(normalizeSessionPath(transformFocusFilePath, promptWorkContext.worktreeRoot));
                 }
-                const transformSessionEdits = sessionEditState.getSessionEdits();
-                const transformFocusEdit = sessionEditState.getFocusEdit();
+                const transformSessionEdits = promptSessionEditState.getSessionEdits();
+                const transformFocusEdit = promptSessionEditState.getFocusEdit();
                 const transformRecentEdits = transformSessionEdits
                     .slice(-MAX_RECENT_EDITS)
                     .map((e) => ({
                     path: e.filePath,
-                    kind: pathKindCache.get(e.filePath) ?? "unknown",
+                    kind: promptPathKindCache.get(e.filePath) ?? "unknown",
                 }));
                 const transformPromptFocusEdit = transformFocusEdit
                     ? {
                         path: transformFocusEdit.filePath,
-                        kind: pathKindCache.get(transformFocusEdit.filePath) ?? "unknown",
+                        kind: promptPathKindCache.get(transformFocusEdit.filePath) ??
+                            "unknown",
                     }
                     : null;
                 const riskContextFilePath = transformFocusEdit?.filePath ?? transformFocusFilePath;
-                let effectiveRiskClass = riskContextFilePath && lastRiskFilePath === riskContextFilePath
+                const riskScopeKey = riskContextFilePath
+                    ? buildRiskPathScopeKey(promptWorkContext, riskContextFilePath)
+                    : null;
+                let effectiveRiskClass = riskScopeKey !== null && lastRiskScopeKey === riskScopeKey
                     ? lastRiskClass
                     : null;
                 if (riskContextFilePath &&
-                    (lastRiskClass === null || lastRiskFilePath !== riskContextFilePath)) {
-                    const riskCtx = deriveRiskContext(riskContextFilePath);
+                    (lastRiskClass === null || lastRiskScopeKey !== riskScopeKey)) {
+                    const riskCtx = deriveRiskContext(promptWorkContext, riskContextFilePath, promptPathKindCache);
                     effectiveRiskClass = riskCtx.effectiveRiskClass;
                     if (!recentCommentSuggestion && riskCtx.precomputedSuggestion) {
                         recentCommentSuggestion = riskCtx.precomputedSuggestion;
@@ -891,11 +1057,11 @@ const kibiOpencodePlugin = async (input) => {
                 const intentResult = effectiveRiskClass
                     ? computeBriefIntent({
                         riskClass: effectiveRiskClass,
-                        posture: posture.state,
+                        posture: promptWorkContext.posture,
                         maintenanceDegraded,
                         sourceFiles: promptSourceFiles,
-                        worktreeRoot: input.worktree,
-                        branch: currentBranch,
+                        worktreeRoot: promptWorkContext.worktreeRoot,
+                        branch: promptWorkContext.branch,
                         ...(promptFocusFilePath !== undefined
                             ? {
                                 focusFilePath: promptFocusFilePath,
@@ -909,7 +1075,11 @@ const kibiOpencodePlugin = async (input) => {
                 const isAutoBriefRisk = effectiveRiskClass === "behavior_candidate" ||
                     effectiveRiskClass === "traceability_candidate";
                 if (!autoBriefResult && isAutoBriefRisk && intentResult) {
-                    queueBriefingFetch(intentResult, { skipIfCachedResultExists: true });
+                    queueBriefingFetch(intentResult, {
+                        skipIfCachedResultExists: true,
+                        workspaceCtx: buildBriefingWorkspaceContext(promptWorkContext),
+                        postureState: promptWorkContext.posture,
+                    });
                 }
                 // Replay latest unread idle brief if available // implements REQ-opencode-kibi-briefing-v4
                 if (input.worktree && currentBranch && input.client) {
@@ -936,10 +1106,14 @@ const kibiOpencodePlugin = async (input) => {
                 }
                 // Steps 3-4: File-operation reminder selection with suppression // implements REQ-opencode-file-context-guidance-v1
                 let fileOperationReminder;
+                let hardGateBlock;
+                let hardGateConsumedPath;
+                let hardGateFingerprint;
+                let hardGateReminderKindsToMark = [];
                 const focusPathForReminder = transformFocusFilePath ?? promptFocusFilePath;
                 if (focusPathForReminder) {
-                    const normalizedFocusPath = fileOperationState.normalizePath(focusPathForReminder);
-                    const pendingLifecycle = fileOperationState.peekPending(normalizedFocusPath);
+                    const normalizedFocusPath = promptFileOperationState.normalizePath(focusPathForReminder);
+                    const pendingLifecycle = promptFileOperationState.peekPending(normalizedFocusPath);
                     if (pendingLifecycle) {
                         // Check if any reminder kind for this lifecycle has not yet been shown
                         const reminderKindsForLifecycle = pendingLifecycle.lifecycle === "deleted"
@@ -947,12 +1121,41 @@ const kibiOpencodePlugin = async (input) => {
                             : pendingLifecycle.lifecycle === "created"
                                 ? ["kibi_write", "e2e_write"]
                                 : ["e2e_write"];
-                        const hasUnshownReminder = reminderKindsForLifecycle.some((kind) => !fileOperationState.hasShown(normalizedFocusPath, kind));
+                        const hasUnshownReminder = reminderKindsForLifecycle.some((kind) => !promptFileOperationState.hasShown(normalizedFocusPath, kind));
                         if (hasUnshownReminder) {
                             // Resolve linked entities and e2e signal
-                            const linkedEntityResult = getFileLinkedEntityIds(input.worktree, focusPathForReminder);
-                            const e2eSignal = getE2eCoverageSignal(input.worktree, focusPathForReminder);
-                            const focusPathKind = pathKindCache.get(normalizedFocusPath) ?? "unknown";
+                            const linkedEntityResult = getFileLinkedEntityIds(promptWorkContext.worktreeRoot, focusPathForReminder);
+                            const e2eSignal = getE2eCoverageSignal(promptWorkContext.worktreeRoot, focusPathForReminder);
+                            const focusPathKind = promptPathKindCache.get(normalizedFocusPath) ?? "unknown";
+                            const effectiveMode = getEffectiveMode();
+                            let checkpointEvidence = false;
+                            let checkpointRunner = null;
+                            let checkpointContext = null;
+                            const checkpointFingerprint = buildDirtyRelevantFingerprint([
+                                normalizedFocusPath,
+                                pendingLifecycle.lifecycle,
+                                focusPathKind,
+                                effectiveRiskClass ?? "safe_docs_only",
+                            ]);
+                            if (effectiveMode === "hard" && promptWorkContext.isAuthoritative) {
+                                checkpointRunner = getCheckpointRunnerForContext(promptWorkContext);
+                                checkpointContext = {
+                                    workContext: promptWorkContext,
+                                    config: cfg,
+                                    filePath: normalizedFocusPath,
+                                    maintenanceDegraded,
+                                    lifecycleEvents: [
+                                        {
+                                            normalizedPath: normalizedFocusPath,
+                                            lifecycle: pendingLifecycle.lifecycle,
+                                        },
+                                    ],
+                                    pathKinds: [focusPathKind],
+                                    linkedEntityResults: [linkedEntityResult],
+                                    e2eSignals: [e2eSignal],
+                                };
+                                checkpointEvidence = checkpointRunner.isCheckpointPassed(checkpointFingerprint, checkpointContext);
+                            }
                             const reminderResult = deriveFileOperationReminder({
                                 normalizedPath: normalizedFocusPath,
                                 lifecycle: pendingLifecycle.lifecycle,
@@ -960,26 +1163,98 @@ const kibiOpencodePlugin = async (input) => {
                                 linkedEntityResult,
                                 e2eSignal,
                                 currentSemanticRisk: effectiveRiskClass ?? "safe_docs_only",
-                                posture: posture.state,
+                                posture: promptWorkContext.posture,
+                                effectiveMode,
+                                resolvedContext: promptWorkContext,
+                                checkpointEvidence,
                             });
-                            fileOperationReminder = {
-                                path: normalizedFocusPath,
-                                lifecycleReminder: reminderResult.lifecycleReminder,
-                                e2eReminder: reminderResult.e2eReminder,
-                            };
+                            if (reminderResult.policyDecision === "hard_block") {
+                                const policyResult = reminderResult.policyResult;
+                                hardGateBlock = {
+                                    shownPaths: "shownPaths" in policyResult ? policyResult.shownPaths : [normalizedFocusPath],
+                                    remainingCount: "remainingCount" in policyResult ? policyResult.remainingCount : 0,
+                                    reason: "checkpoint_required",
+                                };
+                                hardGateConsumedPath = normalizedFocusPath;
+                                hardGateFingerprint = checkpointFingerprint;
+                                hardGateReminderKindsToMark = reminderResult.reminderKindsToMark;
+                                if (checkpointRunner && checkpointContext) {
+                                    const checkpointContextWithGuidance = {
+                                        ...checkpointContext,
+                                        hardGuidanceText: reminderResult.lifecycleReminder,
+                                    };
+                                    const request = checkpointRunner.requestCheckpoint(checkpointContextWithGuidance, checkpointFingerprint);
+                                    if (request.kind === "requested") {
+                                        void checkpointRunner
+                                            .runCheckpoint(checkpointContextWithGuidance, checkpointFingerprint)
+                                            .then((result) => {
+                                            logger.info("smart-enforcement.checkpoint", {
+                                                event: "smart_enforcement_checkpoint",
+                                                fingerprint: checkpointFingerprint,
+                                                result: result.kind,
+                                                reason: "reason" in result.metadata
+                                                    ? result.metadata.reason
+                                                    : undefined,
+                                            });
+                                        })
+                                            .catch((error) => {
+                                            logger.errorStructuredOnly("smart-enforcement.checkpoint-failed", {
+                                                event: "smart_enforcement_checkpoint_failed",
+                                                fingerprint: checkpointFingerprint,
+                                                error: error instanceof Error
+                                                    ? error.message
+                                                    : String(error),
+                                            });
+                                        });
+                                    }
+                                }
+                            }
+                            else {
+                                fileOperationReminder = {
+                                    path: normalizedFocusPath,
+                                    lifecycleReminder: reminderResult.lifecycleReminder,
+                                    e2eReminder: reminderResult.e2eReminder,
+                                };
+                            }
                         }
                     }
                 }
+                // Build freshness evidence for the current dirty fingerprint
+                let freshnessEval;
+                const freshnessFingerprint = `${promptWorkContext.sessionId ?? ""}-${promptWorkContext.branch}`;
+                const freshnessScope = {
+                    ...(promptWorkContext.sessionId !== undefined ? { sessionId: promptWorkContext.sessionId } : {}),
+                    agentIdentity: promptWorkContext.agentIdentity,
+                    worktree: promptWorkContext.worktreeRoot,
+                    branch: promptWorkContext.branch,
+                    fingerprint: freshnessFingerprint,
+                };
+                if (transformFocusFilePath) {
+                    const normalizedFocusPathForFreshness = promptFileOperationState.normalizePath(transformFocusFilePath);
+                    const focusPathKindForFreshness = promptPathKindCache.get(normalizedFocusPathForFreshness) ?? "unknown";
+                    const pendingLifecycleForFreshness = promptFileOperationState.peekPending(normalizedFocusPathForFreshness);
+                    const effectiveRiskClassForFreshness = effectiveRiskClass ?? "safe_docs_only";
+                    const meaningfulChange = classifyMeaningfulChange({
+                        normalizedPath: normalizedFocusPathForFreshness,
+                        pathKind: focusPathKindForFreshness,
+                        lifecycle: pendingLifecycleForFreshness?.lifecycle ?? "edited",
+                        riskClass: effectiveRiskClassForFreshness,
+                    });
+                    if (meaningfulChange === "requires-kb-evidence") {
+                        const freshnessEvidence = freshnessStore.getEvidence(freshnessScope, [normalizedFocusPathForFreshness]);
+                        freshnessEval = evaluateKbFreshness(freshnessEvidence);
+                    }
+                }
                 const guidance = buildPrompt({
                     recentEdits: transformRecentEdits,
                     focusEdit: transformPromptFocusEdit,
                     workspaceHealth,
                     hasRecentKbEdit,
                     recentCommentSuggestion,
-                    posture: posture.state,
+                    posture: promptWorkContext.posture,
                     cache,
-                    workspaceRoot: input.worktree,
-                    branch: currentBranch,
+                    workspaceRoot: promptWorkContext.worktreeRoot,
+                    branch: promptWorkContext.branch,
                     completionReminder: cfg.guidance.smartEnforcement.completionReminder,
                     maintenanceDegraded,
                     degradedMode: cfg.guidance.smartEnforcement.degradedMode,
@@ -991,12 +1266,17 @@ const kibiOpencodePlugin = async (input) => {
                     ...(fileOperationReminder !== undefined
                         ? { fileOperationReminder }
                         : {}),
+                    ...(hardGateBlock !== undefined ? { hardGateBlock } : {}),
+                    ...(freshnessEval ? { kbFreshness: freshnessEval } : {}),
+                    ...(freshnessEval && transformSessionEdits.length > 0
+                        ? { freshnessChangedPaths: [...new Set(transformSessionEdits.map(e => e.filePath))].slice(0, 5) }
+                        : {}),
                 });
                 logger.info("smart-enforcement.guidance", {
                     event: "smart_enforcement_guidance",
                     emitted: guidance.trim() !== "" && guidance.trim() !== SENTINEL,
-                    posture: posture.state,
-                    posture_state: posture.state,
+                    posture: promptWorkContext.posture,
+                    posture_state: promptWorkContext.posture,
                     guidance_action: guidance.trim() !== "" && guidance.trim() !== SENTINEL
                         ? "emit"
                         : "skip",
@@ -1015,8 +1295,8 @@ const kibiOpencodePlugin = async (input) => {
                     logger.info("smart-enforcement.completion-reminder", {
                         event: "smart_enforcement_completion_reminder",
                         risk_class: lastRiskClass,
-                        posture: posture.state,
-                        posture_state: posture.state,
+                        posture: promptWorkContext.posture,
+                        posture_state: promptWorkContext.posture,
                         guidance_action: "completion_reminder",
                         reminder: "kb_check",
                         static_degraded: posture.maintenanceDegraded,
@@ -1036,42 +1316,59 @@ const kibiOpencodePlugin = async (input) => {
                     const e2eEmitted = e2eReminderText !== null && guidance.includes(e2eReminderText);
                     // Mark shown and log only for reminders that were actually emitted
                     if (lifecycleEmitted) {
-                        const kind = fileOperationState.peekPending(focusPathForConsume)?.lifecycle ===
+                        const kind = promptFileOperationState.peekPending(focusPathForConsume)
+                            ?.lifecycle ===
                             "deleted"
                             ? "kibi_delete"
                             : "kibi_write";
-                        fileOperationState.markShown(focusPathForConsume, kind);
+                        promptFileOperationState.markShown(focusPathForConsume, kind);
                         logger.info("smart-enforcement.file-operation-reminder", {
                             event: "smart_enforcement_file_operation_reminder",
                             file: focusPathForConsume,
-                            lifecycle: fileOperationState.peekPending(focusPathForConsume)
+                            lifecycle: promptFileOperationState.peekPending(focusPathForConsume)
                                 ?.lifecycle ?? null,
-                            posture_state: posture.state,
+                            posture_state: promptWorkContext.posture,
                             risk_class: effectiveRiskClass,
                         });
                     }
                     if (e2eEmitted) {
-                        const kind = fileOperationState.peekPending(focusPathForConsume)?.lifecycle ===
+                        const kind = promptFileOperationState.peekPending(focusPathForConsume)
+                            ?.lifecycle ===
                             "deleted"
                             ? "e2e_delete"
                             : "e2e_write";
-                        fileOperationState.markShown(focusPathForConsume, kind);
-                        const e2eSignalForLog = getE2eCoverageSignal(input.worktree, focusPathForConsume);
+                        promptFileOperationState.markShown(focusPathForConsume, kind);
+                        const e2eSignalForLog = getE2eCoverageSignal(promptWorkContext.worktreeRoot, focusPathForConsume);
                         logger.info("smart-enforcement.e2e-reminder", {
                             event: "smart_enforcement_e2e_reminder",
                             file: focusPathForConsume,
-                            lifecycle: fileOperationState.peekPending(focusPathForConsume)
+                            lifecycle: promptFileOperationState.peekPending(focusPathForConsume)
                                 ?.lifecycle ?? null,
                             signal_level: e2eSignalForLog.level,
-                            posture_state: posture.state,
+                            posture_state: promptWorkContext.posture,
                             risk_class: effectiveRiskClass,
                         });
                     }
                     // Consume pending only if at least one reminder was emitted
                     if (lifecycleEmitted || e2eEmitted) {
-                        fileOperationState.consumePending(focusPathForConsume);
+                        promptFileOperationState.consumePending(focusPathForConsume);
                     }
                 }
+                if (hardGateBlock &&
+                    hardGateConsumedPath &&
+                    guidance.includes("🛑 Kibi hard gate blocked")) {
+                    for (const kind of hardGateReminderKindsToMark) {
+                        promptFileOperationState.markShown(hardGateConsumedPath, kind);
+                    }
+                    promptFileOperationState.consumePending(hardGateConsumedPath);
+                    logger.info("smart-enforcement.hard-gate-consumed", {
+                        event: "smart_enforcement_hard_gate_consumed",
+                        file: hardGateConsumedPath,
+                        fingerprint: hardGateFingerprint ?? null,
+                        posture_state: promptWorkContext.posture,
+                        risk_class: effectiveRiskClass,
+                    });
+                }
                 // Latch degraded advisory warning-once state
                 if (showDegradedAdvisory && guidance.includes("Maintenance degraded")) {
                     degradedWarnedOnce = true;
@@ -1104,11 +1401,17 @@ const kibiOpencodePlugin = async (input) => {
                 setTimeout(callback, delayMs);
             });
         scheduleStartupNotify(() => {
-            const version = readKibiOpencodePackageVersion();
+            const meta = readKibiPackageVersions();
+            const versions = {};
+            for (const key of ["opencode", "mcp", "cli", "core"]) {
+                if (meta[key] !== "unknown")
+                    versions[key] = meta[key];
+            }
             notifyStartup(makeStartupClient(client), {
                 suppressToast: cfg.ux.toastStartup === false,
                 directory: input.directory,
-                ...(version ? { version } : {}),
+                ...(Object.keys(versions).length > 0 ? { versions } : {}),
+                versionMetadataSource: meta.source,
             });
         }, 2000);
     }