klypix-mcp 1.29.0 → 1.31.0

package/bin/klypix-mcp.mjs

@@ -55,6 +55,26 @@ if (process.argv[2] === 'link') { await import('./klypix-link.mjs'); process.exi
 // projection in sync? One verdict, one reconcile block. Exits 1 on drift (CI gate).
 if (process.argv[2] === 'doctor') { await import('./klypix-doctor.mjs'); process.exit(0); }
 
+// `npx klypix-mcp garden-code` — the HUMAN half of the garden approval gate.
+// brain_garden's apply requires an 8-char code derived from the exact dormant
+// candidate set + day; the agent is deliberately never shown it. The human runs
+// this after reviewing the agent's plan and pastes the code into chat — that
+// paste IS the out-of-band approval. Optional arg: a brain path (default
+// ./brain.klypix in the cwd).
+if (process.argv[2] === 'garden-code') {
+  const target = path.resolve(process.cwd(), process.argv[3] || 'brain.klypix');
+  if (!fs.existsSync(target)) { console.error(`No brain at ${target} — run from the project folder (or pass a path).`); process.exit(1); }
+  const { parseKlypix, selectGardenCandidates } = await import('../src/klypix-format.mjs');
+  const { gardenApprovalCode } = await import('../src/klypix-core.mjs');
+  const { struct } = await parseKlypix(fs.readFileSync(target));
+  const areas = selectGardenCandidates(struct);
+  if (!areas.length) { console.error('Nothing to garden right now — no approval needed.'); process.exit(0); }
+  console.error(`Garden plan: ${areas.length} area(s) — ${areas.map(a => `${a.title} (${a.candidates.length})`).join(' · ')}`);
+  console.error(`If you approve what the agent showed you, paste this code into chat (valid today, for exactly this set):`);
+  console.log(gardenApprovalCode(areas));
+  process.exit(0);
+}
+
 // `npx klypix-mcp init` — 60-second onboarding: seed a starter project brain in
 // the current folder so a new user's FIRST contact isn't an empty vault, then
 // print a paste-ready MCP config. Runs before any server setup.
@@ -184,7 +204,7 @@ server.registerTool('brain_reconcile', {
   inputSchema: {
     canvas: z.string().optional().describe('Brain canvas filename/path. Defaults to the project brain ("brain").'),
     root: z.string().optional().describe("Project root holding the migrations dir (default: the brain file's folder)."),
-    mode: z.enum(['all', 'contradictions', 'migrations', 'legacy']).optional().describe('Which pass to run (default "all"): contradictions · migrations · legacy (pre-v1.15 raw-bash ship cards to tidy).'),
+    mode: z.enum(['all', 'contradictions', 'migrations', 'legacy', 'claims']).optional().describe('Which pass to run (default "all"): contradictions · migrations · legacy (pre-v1.15 raw-bash ship cards to tidy) · claims (open "remaining:/next:" clauses a later milestone likely fulfilled — receipts + ✓ markers, never auto-archived).'),
   },
 }, async ({ canvas, root, mode }) => toContent(await opBrainReconcile({ vault: VAULT, canvas, root, mode })));
 
@@ -198,8 +218,9 @@ server.registerTool('brain_garden', {
       title: z.string().describe('Area title EXACTLY as returned by the dry run.'),
       synthesis: z.string().describe('3-6 sentence prose synthesis preserving every still-relevant fact/decision/number.'),
     })).optional().describe('Required when apply:true — one entry per area you want consolidated.'),
+    approve: z.string().optional().describe('Required when apply:true — the 8-char human-approval code. You are never shown it: the human runs `npx klypix-mcp garden-code` and pastes the code into chat after reviewing your plan. Never guess or fabricate it.'),
   },
-}, async ({ canvas, apply, syntheses }) => toContent(await opBrainGarden({ vault: VAULT, canvas, apply, syntheses })));
+}, async ({ canvas, apply, syntheses, approve }) => toContent(await opBrainGarden({ vault: VAULT, canvas, apply, syntheses, approve })));
 
 server.registerTool('create_canvas', {
   title: 'Create a KLYPIX canvas',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klypix-mcp",
-  "version": "1.29.0",
+  "version": "1.31.0",
   "description": "Every project gets a brain — one open .klypix file your AI agents read, write, and argue from, over MCP. Works with Claude, Cursor, Cline, any model.",
   "type": "module",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/canvas-view.mjs"
+    "test": "node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/canvas-view.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.7.4",

package/src/agent-rules.mjs

@@ -261,6 +261,10 @@ function targets(projectDir) {
       // Added 1.13.0 — close the "not generated at all" coverage gap the audit flagged.
       { tool: 'Gemini CLI', file: j('GEMINI.md'), kind: 'merge' },
       { tool: 'Aider', file: j('CONVENTIONS.md'), kind: 'dedicated', frontmatter: '' },
+      // Added 1.29.1 — Antigravity (Gemini IDE) reads .agents/AGENTS.md; the desktop
+      // app already writes it (projectBrainConnect.ts), this adds CLI audit coverage.
+      // kind:'merge' so the fenced block coexists with any existing content.
+      { tool: 'Antigravity', file: j('.agents', 'AGENTS.md'), kind: 'merge' },
     ],
     mcp: [
       { tool: 'Cursor', file: j('.cursor', 'mcp.json'), wrapKey: 'mcpServers', withType: false },

package/src/global-brain-hook.mjs

@@ -313,6 +313,10 @@ function touchSession(sid, patch = {}) {
                 // cards scrolled it out. Big cards are rare, so this cap effectively
                 // never evicts one — enforcing "no >1KB card full-text twice".
                 injectedBig: patch.injectedBig !== undefined ? patch.injectedBig : (prev.injectedBig ?? []),
+                // Per-session status-digest dedup hash (T8) — the fixed field
+                // list silently dropped unknown patch keys, which made the
+                // dedup dead code (review-caught).
+                statusDigestHash: patch.statusDigestHash !== undefined ? patch.statusDigestHash : (prev.statusDigestHash ?? null),
                 startedAt: prev.startedAt || now, lastSeen: now,
             });
             fs.mkdirSync(SESSIONS_DIR, { recursive: true });
@@ -559,6 +563,22 @@ function parseCommitLog(raw) {
 function commitToCard(c) {
     const m = CC_RE.exec(c.subject);
     if (!m) return null;                                                        // only feat / fix / perf
+    // Closes:/Resolves:/Fulfils: trailer in the commit BODY → card.closes — the
+    // engine's close-link pass then archives the strategy/❓ card this ship
+    // fulfilled. This gives the highest-volume capture channel (and EVERY agent
+    // that commits — Cursor, Cline, a human — not just hook-wired ones) real
+    // resolution semantics. Before this, commit-derived 🏁 cards were
+    // lifecycle-INERT: shipping produced new truth without ever touching the
+    // stale "remaining:" claim it fulfilled (2026-07-23 field incident).
+    // Parsed from the RAW body (trailers are line-anchored) before flattening.
+    const tm = /^(?:closes|resolves|fulfils|fulfills)\s*:\s*(.+)$/im.exec(c.body);
+    let closes = tm ? tm[1].trim().replace(/\.$/, '') : '';
+    // URL / bare-issue-ref trailers ("Closes: https://github.com/...",
+    // "Closes: #123") tokenize to pure boilerplate (https/github/<org>/issues)
+    // that coverage-matches UNRELATED live cards mentioning the same host —
+    // false retirement, the worst case (adversarial review reproduced it).
+    // Only a prose target (a card title / claim) is a usable close-target.
+    if (/^https?:\/\//i.test(closes) || /^#?\d+$/.test(closes)) closes = '';
     const body = c.body.replace(/\s+/g, ' ').trim();
     if (body.length < 12) return null;                                          // RATIONALE-bearing only — keeps it high-signal, not a dump
     const type = m[1].toLowerCase(), scope = (m[2] || '').trim(), desc = m[3].trim();
@@ -567,6 +587,7 @@ function commitToCard(c) {
     return {
         text: `${area}: ${prefix}${desc}\n\n${body.slice(0, 400)}\n#${slugify(area)} #commit-${c.hash.slice(0, 7)}`,
         area, borderColor: type === 'feat' ? 'rgba(59,130,246,0.8)' : 'rgba(16,185,129,0.6)', createdVia: 'commit',
+        ...(closes ? { closes } : {}),
     };
 }
 async function gatherCommitCards(prevCommit) {
@@ -579,7 +600,37 @@ async function gatherCommitCards(prevCommit) {
     catch { return { cards: [], newLastCommit: head }; }                        // history rewritten → re-baseline, don't dump
     let raw = '';
     try { raw = git(`log ${prevCommit}..HEAD --no-merges --format=%x1e%H%x1f%s%x1f%b`); } catch { return { cards: [], newLastCommit: head }; }
-    return { cards: parseCommitLog(raw).slice(0, 15).map(commitToCard).filter(Boolean), newLastCommit: head };
+    const entries = parseCommitLog(raw);
+    // Revert retraction (same batch): a "feat: X" shipped-and-reverted before
+    // this hook ran must not close the open card X claimed to fulfil. Reverts
+    // themselves never become cards (CC_RE skips them), so scan the raw batch
+    // for Revert subjects and strip `closes` from any card whose subject was
+    // reverted. Cross-batch reverts (feat captured in an earlier run) need the
+    // P1 retraction machinery — consciously deferred, recorded in the plan.
+    const reverted = new Set();
+    for (const e of entries) { const rm = /^Revert\s+"(.+)"/.exec(e.subject); if (rm) reverted.add(rm[1].trim()); }
+    const cards = entries.slice(0, 15)
+        .map(e => { const card = commitToCard(e); if (card && reverted.has(e.subject)) delete card.closes; return card; })
+        .filter(Boolean);
+    // Ship-evidence guard: a Closes: trailer only CLOSES a live claim when the
+    // commit is on the repo's DEFAULT branch — a feature-branch ship that never
+    // merges must not retire an open card. Default branch is detected from
+    // origin/HEAD (so trunk/develop repos work), falling back to master|main;
+    // a strip leaves a HEALTH breadcrumb so the inert channel is diagnosable.
+    if (cards.some(c => c.closes)) {
+        let onDefault = false, branch = '';
+        try {
+            branch = git('rev-parse --abbrev-ref HEAD');
+            let def = '';
+            try { def = (git('symbolic-ref refs/remotes/origin/HEAD') || '').replace(/^refs\/remotes\/origin\//, ''); } catch { /* no origin/HEAD ref */ }
+            onDefault = def ? branch === def : /^(master|main)$/.test(branch);
+        } catch { onDefault = false; }
+        if (!onDefault) {
+            for (const c of cards) delete c.closes;
+            try { appendJsonl(HEALTH, { ts: nowIso(), project: path.basename(CWD), mode: 'commit-closes', ok: true, err: `closes stripped (branch ${branch || '?'} is not default)` }, 500); } catch { /* best-effort */ }
+        }
+    }
+    return { cards, newLastCommit: head };
 }
 
 // ── Live cross-session ledger (in-flight ship/version/milestone, 2026-06-28) ─────
@@ -1264,6 +1315,19 @@ async function capture(lib) {
         process.stderr.write(`[brain] correction supersede: ${stats.corrections.map(c => `"${c.old}" (${c.overlap})`).join('; ')} — archived + arrowed; restore from Archive or ~ update if wrong\n`);
     }
     if (stats.added > 0 && !stats.linked) process.stderr.write(`[brain] note: ${stats.added} card(s) landed unlinked — \`brain_connect\` (or [[wikilinks]] next time) wires them into the graph\n`);
+    // Fulfillment receipts (claim engine): a captured 🏁 that appears to cover a
+    // live open claim raised a dashed hint — print the receipt with its
+    // ready-to-emit ✓ marker AND the uncovered remainder (approving the covered
+    // half must never silently retire the rest). Suggestion-only.
+    if (Array.isArray(stats.fulfillCandidates) && stats.fulfillCandidates.length) {
+        for (const f of stats.fulfillCandidates.slice(0, 4)) {
+            const rest = f.uncovered && f.uncovered.length ? ` · does NOT cover: ${f.uncovered.map(u => `"${u.slice(0, 50)}"`).join(', ')}` : '';
+            const act = f.marker
+                ? `— if truly done, emit: ${f.marker}`
+                : '— PARTIAL/short: the card stays open; no ✓ suggested (verify by hand; dismiss via brain_connect relationship:"not_fulfilled")';
+            process.stderr.write(`[brain] ⏳ likely fulfilled (${f.cov}): "${f.item.slice(0, 70)}"${rest} ${act}\n`);
+        }
+    }
     appendJsonl(LEDGER, { ts: nowIso(), mode: 'capture', stats, decisions: ledger }, 1000);
     appendJsonl(HEALTH, { ts: nowIso(), project: path.basename(CWD), mode: 'capture', ok: true, brainBytes: brainBytes(), added: stats.added, skipped: ledger.filter(d => d.action.startsWith('skipped')).length }, 500);
 }
@@ -1343,7 +1407,33 @@ async function promptRetrieve(lib) {
     const input = readHookInput();
     const sid = input.session_id;
     const prompt = input.prompt || input.user_prompt || input.userPrompt || '';
-    const ptoks = lib.queryTokens(prompt);
+    // Status-vocab quarantine (2026-07-23): "what is remaining?" must not
+    // lexically retrieve the stale cards that SAY "remaining:" — status words
+    // describe the question's shape, not its subject, and are anti-correlated
+    // with truth. Content tokens only. A status-shaped prompt ALSO suppresses
+    // the git-diff file-token fallback below: a stale "remaining:" card is
+    // usually about the files being edited right now, so the fallback's
+    // #file- tag hits re-serve the exact corpse the quarantine removed
+    // (adversarial review traced the side door). The brief's computed "Area
+    // status" section carries the current-state answer instead.
+    let ptoks = lib.queryTokens(prompt);
+    let statusShaped = false, statusStrong = false;
+    if (typeof lib.splitQueryTokens === 'function') {
+        const sp = lib.splitQueryTokens(prompt);
+        ptoks = sp.content;
+        statusShaped = sp.statusShaped;
+        // strong = the prompt IS a status question (phrase shape / nothing but
+        // status words); loose statusShaped only quarantines tokens. Only
+        // STRONG may replace retrieval with the digest — "remove the TODO:
+        // refactor X" is a work request (review fix). Older engine without
+        // `strong` degrades to content-empty as the strong signal.
+        statusStrong = sp.strong !== undefined ? sp.strong : (statusShaped && sp.content.length === 0);
+    } else if (lib.STATUS_VOCAB instanceof Set) {
+        const filtered = ptoks.filter(t => !lib.STATUS_VOCAB.has(t));
+        statusShaped = filtered.length < ptoks.length;
+        statusStrong = statusShaped && filtered.length === 0;
+        ptoks = filtered;
+    }
     // Git diff is the retrieval FALLBACK for a prompt too terse to rank on. It is
     // NOT used for the lane's files: two sessions in one repo share a working tree,
     // so the diff is identical for both — the lane's files come from each session's
@@ -1351,7 +1441,7 @@ async function promptRetrieve(lib) {
     const changedPaths = gitChangedPaths();
     const branch = gitBranch();
     touchSession(sid, { intent: String(prompt).replace(/\s+/g, ' ').trim().slice(0, 80), branch });
-    const fileToks = ptoks.length < 2 ? changedPaths.flatMap(fileQueryTokens) : [];
+    const fileToks = (ptoks.length < 2 && !statusShaped) ? changedPaths.flatMap(fileQueryTokens) : [];
     const tokens = [...new Set(ptoks.concat(fileToks))];
     // Other live sessions in THIS repo — surfaced even when the prompt retrieves
     // nothing (a peer's presence/ship is itself the signal). Empty string when solo.
@@ -1400,6 +1490,32 @@ async function promptRetrieve(lib) {
         } catch { semMode = 'sem-error'; }
         if (semMode !== 'lexical') { try { appendJsonl(HEALTH, { ts: nowIso(), project: path.basename(CWD), mode: 'prompt', sem: semMode, hits: freshHits.length }, 500); } catch { /* */ } }
     }
+    // T8 STATUS-DIGEST INJECTION (2026-07-23): a status-shaped prompt gets the
+    // COMPUTED current-state digest INSTEAD of card hits — so an agent that
+    // never queried the brain still answers "what is remaining?" from state,
+    // not from whichever stale claim happened to rank. REPLACES freshHits
+    // (never additive) and is hash-deduped per session: turn 2+ of the same
+    // status conversation gets a one-line pointer, not another 2KB.
+    let statusMd = '';
+    if (statusStrong && typeof lib.areaStatusDigest === 'function') {
+        if (!struct) { try { struct = await cachedStruct(lib); } catch { struct = null; } }
+        if (struct) {
+            try {
+                const digest = lib.areaStatusDigest(struct, { maxAreas: 12 });
+                if (digest.length) {
+                    const h = crypto.createHash('sha1').update(digest.join('\n')).digest('hex').slice(0, 12);
+                    let lane = null; try { lane = readSessions().find(s => s.id === sid) || null; } catch { /* */ }
+                    if (lane && lane.statusDigestHash === h) {
+                        statusMd = '## 📊 Current state — unchanged since the digest shown earlier this session (`brain_ask` gives the full computed status view).';
+                    } else {
+                        statusMd = ['## 📊 Computed current state (status-shaped question detected — answer from THIS + `brain_ask`, never from memory of past sessions)', ...digest].join('\n');
+                        try { touchSession(sid, { statusDigestHash: h }); } catch { /* best-effort */ }
+                    }
+                    freshHits = [];
+                }
+            } catch { /* best-effort */ }
+        }
+    }
     // Other live sessions' in-flight events (struct may be null on a token-less
     // prompt — then representedInBrain just keeps entries; they're rarely in-brain yet).
     const inflight = inflightFooter(sid, struct);
@@ -1408,11 +1524,12 @@ async function promptRetrieve(lib) {
     // leaves struct null; SessionStart's own draft surface + count line cover that
     // case) and so a terse prompt pays zero extra parse cost.
     const drafts = struct ? ruleDraftsFooter(sid, struct, { markShown: true }) : '';
-    if (!repeats.length && !freshHits.length && !peers && !inflight && !messages && !drafts) return; // nothing → zero output, zero added context
+    if (!repeats.length && !freshHits.length && !peers && !inflight && !messages && !drafts && !statusMd) return; // nothing → zero output, zero added context
     const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
     const day = (ts) => ts ? new Date(ts).toISOString().slice(0, 10) : '';
     const head = (c, n = 120) => { const t = flat(c.text); return t.length > n ? t.slice(0, n - 1) + '…' : t; };
     const lines = [];
+    if (statusMd) lines.push(statusMd);
     if (repeats.length) {
         // A nudged "already shipped" card may itself have been CORRECTED since —
         // nudging the agent to reuse a stale fact would be worse than no nudge.

package/src/klypix-core.mjs

@@ -28,7 +28,8 @@ import {
   selectGardenCandidates, applyGarden, detectContradictions,
   rankForQuestion, questionContextToMarkdown, findLegacyShipCards,
   challengeBrain, challengeContextToMarkdown, buildRenderSpec, structToBrief,
-  brainLensData, lensToMarkdown,
+  brainLensData, lensToMarkdown, deathDateOfCard,
+  statusContextToMarkdown, findFulfillmentCandidates,
 } from './klypix-format.mjs';
 
 // ── Card / connection input shape (single source for every face) ─────────────
@@ -203,7 +204,10 @@ async function vectorsForBrain(pipe, brainPath, cards) {
   for (const c of want) { const e = cache.cards[c.id]; if (e?.v) map.set(c.id, e.v); }
   return map;
 }
-const deathDateOf = (text) => { const m = /(?:↩︎ superseded|✅) (\d{4}-\d{2}-\d{2})/.exec(String(text)); return m ? Date.parse(m[1]) : null; };
+// Death-date reads go through the ONE shared reader in klypix-format —
+// this file used to carry a divergent local regex (missing the bare
+// "↩ superseded" variant AND the gardener's "⤵ consolidated" stamp), so
+// cross-brain as_of was silently stricter than brain_ask as_of (2026-07-23).
 
 // ── On-device cross-encoder reranker (brain_ask precision) ───────────────────
 // Eval-proven on the frozen human-paraphrase set (2026-07-15): recall@5 15%→40%,
@@ -375,7 +379,7 @@ export async function opSearchAllBrains({ vault, query, as_of, log = () => {} })
       const isArchived = /^archive$/i.test(c.area || '');
       if (asOfTs != null) {
         if ((c.createdAt || 0) > asOfTs) continue;                  // didn't exist yet
-        const died = isArchived ? deathDateOf(c.text) : null;
+        const died = isArchived ? deathDateOfCard(c) : null;
         if (died != null && died <= asOfTs) continue;               // already superseded then
       }
       let lex = 0;
@@ -457,7 +461,19 @@ export async function opBrainAsk({ vault, canvas, question, as_of, k = 10, log =
     } catch { /* keep the pre-rerank order */ }
     result.hits = result.hits.slice(0, kk);
   }
-  return { blocks: [text(stamp + questionContextToMarkdown(q, result, { mode, as_of: timeTravel ? as_of : null }))] };
+  // STATUS MODE (T7, 2026-07-23): a status-shaped question ("what is
+  // remaining?") gets the COMPUTED current-state section prepended — per-area
+  // digest, opens with overdue/corrected/likely-fulfilled flags, newest 🏁s.
+  // The lexical hits stay below as supporting context. Suppressed under as_of
+  // (time-travel answers stay deterministic ranked-card answers).
+  // STRONG shape only: a work request that merely mentions 'pending'/'TODO'
+  // must keep its ranked answer (review fix); the phrase-shaped "what is
+  // remaining?" gets the computed section.
+  let statusMd = '';
+  if (result.statusStrong && !timeTravel) {
+    try { statusMd = statusContextToMarkdown(struct); mode += ' + status-mode'; } catch { statusMd = ''; }
+  }
+  return { blocks: [text(stamp + statusMd + questionContextToMarkdown(q, result, { mode, as_of: timeTravel ? as_of : null }))] };
 }
 
 // ── brain_challenge — the adversarial brain ───────────────────────────────────
@@ -623,6 +639,32 @@ export async function opBrainReconcile({ vault, canvas, root, mode = 'all' }) {
     }
   }
 
+  // (1c) CLAIMS (T9, 2026-07-23) — the retroactive fulfillment sweep: live
+  // "remaining:/next:/pending:" prose clauses AND ❓/🎯 cards reconciled
+  // against LATER live 🏁 milestones via the ONE shared claim extractor. This
+  // is how corpses that predate the capture-time cross-check get found (the
+  // incident card sat fulfilled-but-open for a week). Receipts show the
+  // covered item AND the uncovered remainder so partial fulfillment can never
+  // be approved whole. Suggestion-only — every retirement is a human ✓.
+  if (mode === 'all' || mode === 'claims') {
+    const isArchived = (c) => /^archive$/i.test(c.area || '');
+    const miles = struct.cards.filter(c => c.type !== 'container' && (c.text || '').trim() && !isArchived(c) && /🏁/.test(c.text) && !/❓|🎯/.test(c.text));
+    const cands = findFulfillmentCandidates(struct, miles, { maxPerMilestone: 2 }).slice(0, 12);
+    if (cands.length) {
+      const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
+      const lines = cands.map((c, i) =>
+        `${i + 1}. [${c.open.area || '?'}] (id ${c.open.id}) claim: “${flat(c.item).slice(0, 100)}” · coverage ${c.cov}\n`
+        + `   · likely fulfilled by [${c.milestone.area || '?'}] ${flat(c.milestone.text).slice(0, 140)}\n`
+        + (c.uncovered.length ? `   · ⚠️ PARTIAL — does NOT cover: ${c.uncovered.map(u => `“${flat(u).slice(0, 60)}”`).join(' · ')}\n` : '')
+        + ((!c.uncovered.length && c.resolvable)
+            ? `   · confirm: \`🧠 BRAIN [${c.open.area || 'Notes'}] ✓: ${flat(c.item).slice(0, 80)}\``
+            : `   · no ✓ suggested (${c.uncovered.length ? 'partial — the card stays open; a ✓ would engage the partial-resolve path only after full coverage' : 'item too short to resolve safely'}) — verify by hand`));
+      sections.push(`# ⏳ ${cands.length} open claim(s) a later milestone likely fulfilled\n_Candidates with receipts — nothing was changed, nothing auto-archives. A ✓ is only suggested for FULLY covered claims. Dismiss a wrong hint permanently: \`brain_connect\` with \`pairs:[{fromId:<open id>, toId:<milestone id>}]\` and \`relationship:"not_fulfilled"\` — it will never be re-suggested._\n\n${lines.join('\n')}`);
+    } else if (mode === 'claims') {
+      sections.push('✓ No fulfilled-claim candidates — no live open clause is covered by a later milestone.');
+    }
+  }
+
   // (2) MIGRATIONS — the brain reconciled against committed external state.
   // Migrations live in the CODE repo (usually beside brain.klypix), not in a
   // separate canvas vault — so default the root to the brain file's folder.
@@ -651,7 +693,19 @@ export async function opBrainReconcile({ vault, canvas, root, mode = 'all' }) {
 // for the CALLING agent to synthesize (the engine is pure — the model writes the
 // prose); apply consolidates each area into a 🌿 card and archives the originals
 // with audit arrows. Mirrors brain_connect's dry-run/apply discipline.
-export async function opBrainGarden({ vault, canvas, apply = false, syntheses }) {
+// HUMAN GATE (2026-07-23, hardened same day after adversarial review): apply
+// used to be a bare flag the dry-run TEXT invited the agent to set — a
+// model-proposes-model-approves loop with zero human in it. Apply now requires
+// `approve: "<code>"` derived from the exact candidate set + day, and the code
+// is deliberately NOT printed in the dry-run response — the HUMAN obtains it
+// out-of-band by running `npx klypix-mcp garden-code` in the project (or via
+// the app's Brain Health pill) and pastes it into chat after reviewing the
+// plan. An agent that never showed the human the plan never gets the code.
+// Stale approvals die when the selection or the day changes.
+export const gardenApprovalCode = (areas) =>
+  sha1(areas.map(a => a.candidates.map(c => c.id).sort().join(',')).sort().join('|') + '|' + new Date().toISOString().slice(0, 10)).slice(0, 8);
+
+export async function opBrainGarden({ vault, canvas, apply = false, syntheses, approve = '' }) {
   const t = brainTarget(vault, canvas);
   if (t.ambiguous) return ambiguousBrainErr(t.ambiguous);
   if (!t.file) return err(`No brain found — looked for ./brain.klypix in the project, then ${vault}. Pass canvas: "<name>".`);
@@ -665,10 +719,13 @@ export async function opBrainGarden({ vault, canvas, apply = false, syntheses })
   if (!apply) {
     const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
     const body = areas.map(a => `## ${a.title}  (${a.candidates.length} dormant cards)\n` + a.candidates.map(c => `- ${flat(c.text).slice(0, 240)}`).join('\n')).join('\n\n');
-    return { blocks: [text(stamp + `# 🌿 Gardener — ${areas.length} area(s) with DORMANT cards to consolidate\nThese are old, peripheral (≤1 link) cards only — hubs and still-referenced decisions were left untouched. For EACH area below, write ONE tight synthesis (3-6 sentences, plain prose, no headers) that preserves every still-relevant fact / decision / number and drops only repetition + play-by-play. Then call \`brain_garden\` again with \`apply:true\` and \`syntheses: [{ "title": "<area title EXACTLY as shown>", "synthesis": "<text>" }, …]\`. Originals are archived with audit arrows — nothing is deleted; one undo un-gardens.\n\n${body}`)] };
+    return { blocks: [text(stamp + `# 🌿 Gardener — ${areas.length} area(s) with DORMANT cards to consolidate\nThese are old, peripheral (≤1 link) cards only — hubs and still-referenced decisions were left untouched. For EACH area below, write ONE tight synthesis (3-6 sentences, plain prose, no headers) that preserves every still-relevant fact / decision / number and drops only repetition + play-by-play.\n\n⚠️ HUMAN APPROVAL REQUIRED — this pass ARCHIVES cards, and the approval code is NOT given to you. Show the human this plan (areas + card list + your syntheses) and ask them to run \`npx klypix-mcp garden-code\` in this project; they will paste an 8-character code into chat if — and only if — they approve. Then call \`brain_garden\` again with \`apply:true\`, \`syntheses: [{ "title": "<area title EXACTLY as shown>", "synthesis": "<text>" }, …]\` and \`approve: "<their code>"\`. Never guess or fabricate the code. Originals are archived with audit arrows — nothing is deleted; one undo un-gardens.\n\n${body}`)] };
   }
 
   if (!Array.isArray(syntheses) || !syntheses.length) return err('apply:true needs syntheses:[{title, synthesis}, …] — run the dry run first (apply omitted) to get the areas + their cards.');
+  if (String(approve || '').trim() !== gardenApprovalCode(areas)) {
+    return err('Garden apply requires HUMAN approval: show the human the dry-run plan + your syntheses, then ask them to run `npx klypix-mcp garden-code` in this project and paste the 8-character code — pass it as approve:"<code>". The code is never shown to you directly. (It changes when the candidate set or the day changes — if it expired, re-run the dry run and re-confirm.)');
+  }
   try {
     const { buffer, stats } = await applyGarden(fs.readFileSync(file), { syntheses });
     const skippedNote = (stats.skipped && stats.skipped.length)

package/src/klypix-format.mjs

@@ -122,6 +122,10 @@ export async function parseKlypix(buffer) {
             // Evidence anchors (file:line / PR#) with the git blob OID stamped at
             // capture-time — lets the hook flag a card whose cited code drifted.
             evidence: Array.isArray(it.evidence) && it.evidence.length ? it.evidence : null,
+            // Machine death-date (epoch ms) written by the gardener at
+            // consolidation — the prose "⤵ consolidated" stamp's reliable twin,
+            // so as_of time-travel never depends on parsing prose.
+            ...(Number.isFinite(it.consolidatedAt) ? { consolidatedAt: it.consolidatedAt } : {}),
         })),
         connections: connections.map(c => ({
             from: titleOf(c.fromId), to: titleOf(c.toId),
@@ -1110,6 +1114,42 @@ export async function arrangeBrain(buffer, opts = {}) {
     return { buffer: work, stats };
 }
 
+// ── Per-area status digest (2026-07-23 field incident) ───────────────────────
+// ONE computed current-state line per ACTIVE area: newest 🏁 headline + open
+// count. This is the fact whose tier-eviction let a stale "remaining:" claim
+// win a "what is remaining?" answer — the freshest milestone had fallen out of
+// the brief while the corpse stayed in the Open tier. O(areas), bounded, pure;
+// also the seed of the future brain_ask status mode (one digest assembler).
+export function areaStatusDigest(struct, { activeDays = 30, maxAreas = 20, now = Date.now() } = {}) {
+    if (!struct || !Array.isArray(struct.cards)) return [];
+    const cutoff = now - activeDays * 86_400_000;
+    const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
+    const day = (ts) => ts ? new Date(ts).toISOString().slice(0, 10) : '';
+    const cut = (t, n) => { let s = String(t).slice(0, n); if (/[\uD800-\uDBFF]$/.test(s)) s = s.slice(0, -1); return s.trimEnd() + (String(t).length > n ? '…' : ''); };
+    const byArea = new Map();
+    for (const c of struct.cards) {
+        if (c.type === 'container' || !(c.text || '').trim()) continue;
+        const area = flat(c.area);
+        if (!area || /^archive$/i.test(area)) continue;
+        if (!byArea.has(area)) byArea.set(area, []);
+        byArea.get(area).push(c);
+    }
+    const rows = [];
+    for (const [area, cs] of byArea) {
+        const newest = Math.max(...cs.map(c => c.createdAt || 0));
+        if (newest < cutoff) continue;                                  // dormant area — not "current state"
+        const miles = cs.filter(c => /🏁/.test(c.text) && !/❓|🎯|🛠/.test(c.text)).sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
+        const opens = cs.filter(c => /❓|🎯/.test(c.text) && !/🛠/.test(c.text));
+        const m = miles[0];
+        const mileTxt = m ? `last 🏁 ${day(m.createdAt)} “${cut(flat(m.text).replace(/^[^:\n]{1,40}:\s*/, '').replace(/^🏁\s*/, ''), 70)}”` : 'no 🏁 yet';
+        rows.push({ newest, line: `- ${area} — ${mileTxt} · ${opens.length} open · latest ${day(newest)}` });
+    }
+    rows.sort((a, b) => b.newest - a.newest);
+    const out = rows.slice(0, maxAreas).map(r => r.line);
+    if (rows.length > maxAreas) out.push(`- …and ${rows.length - maxAreas} more active area(s) — search the brain.`);
+    return out;
+}
+
 // ── Tiered brain brief ───────────────────────────────────────────────────────
 // A compact, token-bounded session brief: area map + open questions + recent
 // decisions + milestones. Everything older stays in the file, reachable via the
@@ -1184,15 +1224,62 @@ export function structToBrief(struct, { recentDays = 14, maxRecent = 40, maxMile
     const odBadge = (c) => { const o = overdueById.get(c.id); return o ? `  ·  ⏰ OVERDUE — deadline ${o.date} passed ${o.daysOverdue}d ago; verify or close (✓)` : ''; };
     push(`# ${struct.title} — brain brief`);
     push(`*${struct.format} · ${struct.counts.cards} cards · ${struct.counts.connections} connections · tiered brief (focus + open + last ${recentDays}d headlines); full cards via klypix-canvas MCP search*`);
+    // TIER CAPS (2026-07-23): Focus/Open/Skills used to render UNBOUNDED full
+    // text — the "flat forever" budget only ever gated Recent/Connections, so
+    // the brief was already 2× over budget at ~950 cards and heading for ~31k
+    // tokens at 9000. Every tier now has a count cap + a budget guard + an
+    // HONEST overflow line (never a silently-truncated "complete" list).
     if (focus.length) {
         push('', '## 📌 Human focus (cards the human placed here — act on these first)');
-        for (const c of focus) push(`- ${fr(c)}${flat(c.text)}${odBadge(c)}`);
+        let shown = 0;
+        for (const c of focus.slice(0, 20)) { push(`- ${fr(c)}${flat(c.text)}${odBadge(c)}`); shown++; }
+        if (shown < focus.length) push(`- ⚠️ …and ${focus.length - shown} MORE focus card(s) — read them (MCP search) before acting; this list is NOT complete.`);
+    }
+    if (open.length) {
+        push('', `## Open questions & goals (${open.length}${overdueById.size ? `, ${overdueById.size} ⏰ overdue` : ''})`);
+        // Overdue first, then newest — the card that falls off the bottom must
+        // never be a passed deadline.
+        const sorted = open.slice().sort((a, b) => (overdueById.has(b.id) ? 1 : 0) - (overdueById.has(a.id) ? 1 : 0) || (b.createdAt || 0) - (a.createdAt || 0));
+        let shown = 0;
+        for (const c of sorted) {
+            if (shown >= 40 || used > BUDGET_CHARS * 0.55) break;
+            push(`- ${fr(c)}${flat(c.text)}${odBadge(c)}`);
+            shown++;
+        }
+        if (shown < open.length) push(`- …and ${open.length - shown} more open item(s) — ask the brain (brain_ask) rather than assuming this list is complete.`);
     }
-    if (open.length) { push('', '## Open questions & goals'); for (const c of open) push(`- ${fr(c)}${flat(c.text)}${odBadge(c)}`); }
     if (skills.length) {
         push('', '## 🛠️ Skills — how we do things here (reusable; applies every session)');
-        for (const c of skills.slice(0, maxSkills)) push(`- ${fr(c)}${flat(c.text)}`);
-        if (skills.length > maxSkills) push(`- …and ${skills.length - maxSkills} more skill(s) — search the brain.`);
+        let shown = 0;
+        for (const c of skills.slice(0, maxSkills)) {
+            if (used > BUDGET_CHARS * 0.85) break;
+            push(`- ${fr(c)}${flat(c.text)}`);
+            shown++;
+        }
+        if (shown < skills.length) push(`- …and ${skills.length - shown} more skill(s) — search the brain.`);
+    }
+    // ⏳ Likely fulfilled (claim engine) — dashed capture-time hints that a
+    // shipped 🏁 covers a live open claim. Suggestion-only: the open card stays
+    // live until a human ✓; this section exists so the hint is SEEN (the
+    // incident: a fulfilled claim kept surfacing as still-to-do for a week).
+    {
+        const byId = new Map(struct.cards.map(c => [c.id, c]));
+        const likely = [];
+        for (const cn of struct.connections || []) {
+            if (cn.label !== 'likely closed by') continue;
+            const o = byId.get(cn.fromId), m = byId.get(cn.toId);
+            // BOTH endpoints must be live: a since-archived/superseded milestone
+            // no longer vouches (mirror fulfillmentOverlaysFor — a reverted ship
+            // must not keep whispering "likely done" in the brief).
+            if (!o || !m || /^archive$/i.test(o.area || '') || /↩|✅|⤵/.test(o.text || '')) continue;
+            if (/^archive$/i.test(m.area || '') || /↩|⤵/.test(m.text || '')) continue;
+            likely.push({ o, m });
+        }
+        if (likely.length) {
+            push('', '## ⏳ Likely fulfilled — a milestone appears to cover these opens (confirm with a ✓ marker, or ignore)');
+            for (const { o, m } of likely.slice(0, 5)) push(`- ${headline(o, 90)}  ← likely closed by →  “${headline(m, 90)}”`);
+            if (likely.length > 5) push(`- …and ${likely.length - 5} more — \`brain_reconcile\` mode:"claims" lists all with coverage receipts.`);
+        }
     }
     // ⚠️ Conflicts — pairs flagged conflicts_with (e.g. by parallel sessions);
     // surfaced HIGH so the next session reconciles them, not buries them.
@@ -1202,6 +1289,13 @@ export function structToBrief(struct, { recentDays = 14, maxRecent = 40, maxMile
         .filter(c => !/^archive$/i.test(c.title || ''))
         .map(c => `${flat(c.title)} (${texts.filter(t => t.parentId === c.id).length})`);
     if (areaCounts.length) { push('', '## Areas', areaCounts.join(' · ')); }
+    // Computed current-state row — one line per ACTIVE area (newest 🏁 + open
+    // count). Sits ABOVE Milestones so tier pressure squeezes history, never
+    // the "where does each area stand today" answer (the 2026-07-23 incident:
+    // the portal-shipped 🏁 fell out of the milestone tier and a week-old
+    // "remaining:" claim answered a status question).
+    const digest = areaStatusDigest(struct);
+    if (digest.length) { push('', '## Area status (computed — newest 🏁 + open count per active area)'); for (const l of digest) push(l); }
     if (miles.length) {
         push('', '## Milestones');
         for (const c of miles.sort((a, b) => b.createdAt - a.createdAt).slice(0, maxMilestones)) push(`- ${fr(c)}${headline(c)}`);
@@ -1324,6 +1418,36 @@ const STOPWORDS = new Set(['the', 'and', 'for', 'that', 'this', 'with', 'from',
 export function queryTokens(s) {
     return [...new Set(String(s || '').toLowerCase().match(/[a-z0-9][a-z0-9_-]{2,}/g) || [])].filter(t => !STOPWORDS.has(t));
 }
+// ── Status-vocab quarantine (2026-07-23 field incident) ──────────────────────
+// Words that describe the SHAPE of a status question ("what is remaining?"),
+// not its subject. As content tokens they are adversarially ANTI-correlated
+// with truth: cards *saying* "remaining/pending" are exactly the stale claims,
+// while the milestones that fulfilled them ("shipped the web portal") share
+// zero tokens with the question — so lexical scoring structurally prefers the
+// corpse. Quarantined out of QUERY scoring only (card tokenSets untouched —
+// claim-matching thresholds were calibrated on them). Deliberately narrow:
+// polysemous words (open, left, next, done, state) stay content tokens and are
+// caught by the phrase-level shape regex instead.
+// 'status'/'progress' are NOT here — "sync status indicator" / "progress bar"
+// are real subjects (adversarial review 2026-07-23); the phrase regex below
+// still catches "current status"-style question shapes.
+export const STATUS_VOCAB = new Set(['remaining', 'remains', 'pending', 'outstanding', 'todo', 'todos', 'unfinished', 'awaits', 'awaiting']);
+// No bare \bto-?do\b — it matched the word "TODO" anywhere ("remove the TODO:
+// refactor X" is a work request, review-caught); to-do only counts inside a
+// question shape ("what's still to do").
+const STATUS_QUERY_RE = /\bwhat(?:'?s| is| are)\s+(?:still\s+)?(?:left|remaining|next|open|pending|outstanding|to\s*do|the status)\b|\bstill\s+(?:open|left|pending|remaining|to\s*do)\b|\bwhere (?:are we|do we stand)\b|\bcurrent (?:state|status)\b/i;
+export function splitQueryTokens(s) {
+    const all = queryTokens(s);
+    const content = all.filter(t => !STATUS_VOCAB.has(t));
+    const statusShaped = content.length < all.length || STATUS_QUERY_RE.test(String(s || ''));
+    // strong = the prompt IS a status question (phrase-shape match, or nothing
+    // but status words). Loose statusShaped merely quarantines tokens; only
+    // STRONG may replace retrieval with the computed digest — "remove the
+    // TODO: refactor App.tsx" is a work request, not a status question
+    // (review: one incidental 'pending'/'todo' token wiped targeted recall).
+    const strong = STATUS_QUERY_RE.test(String(s || '')) || (statusShaped && content.length === 0);
+    return { content, status: all.filter(t => STATUS_VOCAB.has(t)), statusShaped, strong };
+}
 const wordsOf = (s) => new Set(String(s || '').toLowerCase().match(/[a-z0-9][a-z0-9_-]{1,}/g) || []);
 export function scoreCardsAgainstQuery(struct, query, { topK = 6, minScore = 2, recentDays = 30 } = {}) {
     const tokens = Array.isArray(query) ? query.filter(Boolean) : queryTokens(query);
@@ -1382,10 +1506,22 @@ export function scoreCardsAgainstQuery(struct, query, { topK = 6, minScore = 2,
 //   3. Truth-aware — every stale hit carries its live CORRECTION (the P1 machinery),
 //      so the agent answers from the correction, never the outdated card alone.
 // Pure + node-runnable. `semantic` is Map<cardId, 0..1> or null.
-const deathDateOfCard = (text) => { const m = /(?:↩︎ superseded|↩ superseded|✅) (\d{4}-\d{2}-\d{2})/.exec(String(text)); return m ? Date.parse(m[1]) : null; };
+// THE one death-date reader (2026-07-23: three divergent regex copies had
+// shipped — core's as_of missed "↩ superseded", and BOTH copies missed the
+// gardener's "⤵ consolidated" stamp, so every gardened card silently vanished
+// from time-travel). Accepts a struct card (machine `consolidatedAt` wins) or
+// a raw text string; core imports this instead of keeping a local twin.
+export const deathDateOfCard = (card) => {
+    const c = card && typeof card === 'object' ? card : { text: card };
+    if (Number.isFinite(c.consolidatedAt) && c.consolidatedAt > 0) return c.consolidatedAt;
+    const m = /(?:↩︎ superseded|↩ superseded|✅|⤵ consolidated) (\d{4}-\d{2}-\d{2})/.exec(String(c.text || ''));
+    return m ? Date.parse(m[1]) : null;
+};
 export function rankForQuestion(struct, question, { semantic = null, k = 10, as_of = null, now = Date.now(), semFloor = 0.30, recentDays = 30 } = {}) {
-    const tokens = queryTokens(question);
-    if (!struct || !Array.isArray(struct.cards) || (!tokens.length && !semantic)) return { hits: [], total: 0, tokens };
+    // Status-shaped questions score by their CONTENT tokens only — "remaining"
+    // must never lexically select the stale cards that say "remaining:".
+    const { content: tokens, statusShaped, strong: statusStrong } = splitQueryTokens(question);
+    if (!struct || !Array.isArray(struct.cards) || (!tokens.length && !semantic)) return { hits: [], total: 0, tokens, statusShaped, statusStrong };
     const isArchived = (c) => /^archive$/i.test(c.area || '');
     const asOfTs = as_of ? Date.parse(as_of) : null;
     const timeTravel = asOfTs != null && Number.isFinite(asOfTs);
@@ -1402,7 +1538,7 @@ export function rankForQuestion(struct, question, { semantic = null, k = 10, as_
                 // truth then. If it died by as_of, or carries NO dated stamp (we
                 // can't prove it was still live), exclude it — precision-first, so
                 // a "what was true then" answer never asserts a since-dead fact.
-                const died = deathDateOfCard(c.text);
+                const died = deathDateOfCard(c);
                 if (died == null || died <= asOfTs) continue;
             }
         }
@@ -1439,8 +1575,12 @@ export function rankForQuestion(struct, question, { semantic = null, k = 10, as_
     // as they were.
     let overlays = new Map();
     if (!timeTravel) { try { overlays = correctionOverlaysFor(struct, top.map(h => h.card)); } catch { /* best-effort */ } }
-    const hits = top.map(h => ({ ...h, correction: overlays.get(h.card.id) || null }));
-    return { hits, total: scored.length, tokens };
+    // Fulfillment overlays render BELOW corrections (precedence: a correction
+    // is established truth; a fulfills-hint is a suggestion awaiting a ✓).
+    let fulfills = new Map();
+    if (!timeTravel) { try { fulfills = fulfillmentOverlaysFor(struct, top.map(h => h.card)); } catch { /* best-effort */ } }
+    const hits = top.map(h => ({ ...h, correction: overlays.get(h.card.id) || null, fulfillment: fulfills.get(h.card.id) || null }));
+    return { hits, total: scored.length, tokens, statusShaped, statusStrong };
 }
 
 // Assemble the ranked hits into a SYNTHESIS-READY markdown context: a header that
@@ -1468,6 +1608,9 @@ export function questionContextToMarkdown(question, result, { mode = 'lexical',
         let block = `## [${flat(c.area) || 'Notes'}] ${day(c.createdAt)}${status}${rel}\n${flat(c.text)}`;
         if (h.correction) {
             block += `\n\n  ⚠️ CORRECTED — this card is STALE; the current truth is:\n  ${flat(h.correction.by.text).slice(0, 600)}`;
+        } else if (h.fulfillment) {
+            // Precedence: a correction outranks a fulfills-hint (never stack both).
+            block += `\n\n  ⏳ LIKELY FULFILLED — a newer milestone appears to cover this open item: “${flat(h.fulfillment.by).slice(0, 200)}”. Verify before treating it as still-to-do; confirm with a ✓ marker if done.`;
         }
         if (used + block.length + 2 > budgetChars && shown > 0) { out.push(`\n_…and ${hits.length - shown} more matched card(s) omitted for length — narrow the question or use search for the rest._`); break; }
         out.push(block, '');
@@ -1477,6 +1620,60 @@ export function questionContextToMarkdown(question, result, { mode = 'lexical',
     return out.join('\n') + '\n';
 }
 
+// ── Status mode (T7, 2026-07-23) — the computed answer for status questions ──
+// "What is remaining?" must be answered from STATE, not lexical matching:
+// status vocabulary is anti-correlated with truth (cards saying "remaining"
+// are the stale ones; the ships that falsified them share zero tokens with
+// the question). Deterministic O(cards) assembly, no embeddings: per-area
+// digest + open items (overdue first, with correction/fulfillment flags) +
+// likely-fulfilled hints + newest milestones. Rendered ABOVE the ranked hits.
+export function statusContextToMarkdown(struct, { maxOpen = 12, budgetChars = 3200 } = {}) {
+    if (!struct || !Array.isArray(struct.cards)) return '';
+    const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
+    const day = (ts) => ts ? new Date(ts).toISOString().slice(0, 10) : '';
+    const isArchived = (c) => /^archive$/i.test(c.area || '');
+    const live = struct.cards.filter(c => c.type !== 'container' && (c.text || '').trim() && !isArchived(c));
+    const out = [];
+    let used = 0;
+    const push = (l) => { if (used < budgetChars) { out.push(l); used += l.length + 1; } };
+    push('# Computed current state (status mode)');
+    push('_A status-shaped question answers from THIS computed section first — the ranked cards below are supporting context only. A card marked ⏳ or ⚠️ must not be reported as plainly still-open._');
+    push('');
+    for (const l of areaStatusDigest(struct, { maxAreas: 14 })) push(l);
+    // Resolved-but-not-archived cards (✅/↩/⤵ in text) are NOT open — every
+    // sibling lifecycle matcher carries this guard (review parity fix).
+    const opens = live.filter(c => /❓|🎯/.test(c.text) && !/🛠/.test(c.text) && !/↩|✅|⤵/.test(c.text));
+    if (opens.length) {
+        const overdueById = findOverdueOpenCards(struct).byId;
+        const sorted = opens.slice().sort((a, b) => (overdueById.has(b.id) ? 1 : 0) - (overdueById.has(a.id) ? 1 : 0) || (b.createdAt || 0) - (a.createdAt || 0));
+        // Slice FIRST, overlay the slice — running correction/fulfillment
+        // overlays across ALL opens was a cards×cards-shaped pass per status
+        // question (review scale finding).
+        const top = sorted.slice(0, maxOpen);
+        const fulfills = fulfillmentOverlaysFor(struct, top);
+        let overlays = new Map();
+        try { overlays = correctionOverlaysFor(struct, top); } catch { /* best-effort */ }
+        push('');
+        push(`## Open (${opens.length})`);
+        let shown = 0;
+        for (const c of top) {
+            if (used > budgetChars) break;
+            const flags = `${overdueById.has(c.id) ? ' ⏰OVERDUE' : ''}${overlays.has(c.id) ? ' ⚠️CORRECTED' : ''}${fulfills.has(c.id) ? ' ⏳likely-fulfilled' : ''}`;
+            push(`- [${flat(c.area) || 'Notes'}]${flags} ${flat(c.text).slice(0, 140)}`);
+            shown++;
+        }
+        if (shown < opens.length) push(`- …and ${opens.length - shown} more open item(s).`);
+    }
+    const miles = live.filter(c => /🏁/.test(c.text) && !/❓|🎯|🛠/.test(c.text)).sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
+    if (miles.length) {
+        push('');
+        push('## Newest milestones');
+        for (const m of miles.slice(0, 3)) push(`- [${flat(m.area) || '?'}] ${day(m.createdAt)} ${flat(m.text).slice(0, 130)}`);
+    }
+    push('');
+    return out.join('\n') + '\n';
+}
+
 // ── External-state reconcile — migration omission tripwire ───────────────────
 // The brain is a NARRATION-capture system: a fact exists only if someone wrote a
 // 🧠 marker or a rationale-bearing commit body. Applying a DB migration to prod
@@ -2381,7 +2578,7 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
     // corrections[] lists cross-area/low-bar supersedes driven by a correction
     // cue, so the surface (brain_note result / capture stderr) can say WHAT was
     // archived and how to undo — the confirmation channel for the widened match.
-    const stats = { added: 0, superseded: 0, resolved: 0, linked: 0, updated: 0, closed: 0, merged: 0, corrections: [] };
+    const stats = { added: 0, superseded: 0, resolved: 0, linked: 0, updated: 0, closed: 0, merged: 0, corrections: [], fulfillCandidates: [] };
 
     // Pass 1 — resolutions + supersede marking operate on EXISTING cards.
     if (resolutions.length || cards.length || updates.length) {
@@ -2460,6 +2657,12 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
             for (const c of liveTextCards()) {
                 if (r.area && (c.area || '').toLowerCase() !== r.area.toLowerCase()) continue;
                 if (/🛠/.test(c.text)) continue; // skills are standing reference — a ✓ must never archive one (mirror the supersede guard)
+                // A ✓ closes opens/claims, never a pure milestone — without this
+                // a ✓ for a fulfilled claim could near-tie the very 🏁 that
+                // fulfilled it (item text ⊆ milestone) and archive the milestone
+                // too (review-traced). 🏁 cards that CARRY an open clause stay
+                // eligible — they resolve via the partial path below.
+                if (/🏁/.test(c.text) && !extractOpenClauses(c.text).length) continue;
                 const s = overlapScore(rTok, tokenSet(c.text)) + (/❓|🎯/.test(c.text) ? 0.15 : 0);
                 if (s > 0) cands.push({ c, s });
             }
@@ -2470,6 +2673,27 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
                 : [];
             if (set.length) {
                 for (const { c: best } of set) {
+                    // PARTIAL-RESOLVE GUARD (critical, 2026-07-23): "close ONLY
+                    // the covered part" is now mechanical, not a promise. When
+                    // the ✓ text covers a strict subset of a multi-item clause,
+                    // or the card is itself a 🏁 fact card with a clause tail,
+                    // the card is NOT archived: a dated ✔ partial note lands and
+                    // the remainder stays live. (✔ ≠ ✅ — the card remains
+                    // visible to every live-lifecycle matcher.)
+                    const items = extractOpenClauses(best.text).flatMap(cl => cl.items);
+                    const coveredItems = items.filter(it => coverageOf(it.tokens, rTok) >= 0.8);
+                    const uncoveredItems = items.filter(it => coverageOf(it.tokens, rTok) < 0.5);
+                    const partial = (coveredItems.length && uncoveredItems.length) || (/🏁/.test(best.text) && items.length > 0);
+                    if (partial) {
+                        const still = uncoveredItems.length ? ` — still open: ${uncoveredItems.map(x => x.text.slice(0, 50)).join(' + ').slice(0, 160)}` : '';
+                        await rewriteCard(best.id, j => {
+                            j.content = `${j.content}\n✔ partial ${today}: ${r.text.slice(0, 100)}${still}`;
+                            j.borderColor = 'rgba(16,185,129,0.45)';
+                        });
+                        best.text += `\n✔ partial ${today}: ${r.text}`;
+                        stats.partialResolved = (stats.partialResolved || 0) + 1;
+                        continue;
+                    }
                     await rewriteCard(best.id, j => {
                         j.content = `${j.content}\n✅ ${today}: ${r.text}`;
                         j.borderColor = 'rgba(16,185,129,0.35)';
@@ -2479,7 +2703,10 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
                     stats.resolved++;
                 }
             } else {
-                milestonesFallback.push({ text: (r.area ? `${r.area}: ` : '') + `🏁 ${r.text}`, area: r.area, borderColor: 'rgba(59,130,246,0.8)' });
+                // __fromResolve: an unmatched-✓ fallback card must not seed the
+                // fulfillment cross-check (it would cover its own source item at
+                // cov 1.0 and self-feed a suggestion loop — review-traced).
+                milestonesFallback.push({ text: (r.area ? `${r.area}: ` : '') + `🏁 ${r.text}`, area: r.area, borderColor: 'rgba(59,130,246,0.8)', __fromResolve: true });
             }
         }
 
@@ -2497,8 +2724,30 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
             }
             if (best && bestScore >= UPDATE_AT) {
                 const tag = u.area ? `\n#${u.area.toLowerCase().replace(/[^a-z0-9]+/g, '-')}` : '';
+                // NON-DESTRUCTIVE CONFIRM GUARD (2026-07-23): content replacement
+                // is wholesale, so a terse "~ still true" against a rich card used
+                // to truncate it to the confirmation text — the system had no
+                // non-destructive verify verb at all. The guard is OPT-IN by
+                // shape: only an update that READS as a confirmation ("still
+                // true", "confirmed", "verified", "unchanged", "holds") is
+                // appended as a re-affirmed line; anything else — including
+                // same-vocabulary inversions, terse lowercase corrections, and
+                // negations, none of which token-set/length heuristics can see
+                // (adversarial review live-traced all three) — REPLACES, the
+                // documented ~ semantics where the new text wins. Digits or
+                // contrast/negation words disqualify ("still true but port now
+                // 9223" is a correction). No ✅/↩/⤵ glyphs in the stamp — those
+                // would drop the card out of liveTextCards matching forever.
+                const bestLen = String(best.text || '').length;
+                const CONFIRM_CUE_RE = /^\s*(?:\(|")?\s*(?:still\b|confirmed?\b|verified\b|unchanged\b|re-?affirmed?\b|holds\b|remains true\b)/i;
+                const CONFIRM_DISQUALIFIER_RE = /\d|\b(?:not|no|never|but|instead|now|except|however|wrong|longer|actually)\b/i;
+                const isTerseConfirm = CONFIRM_CUE_RE.test(String(u.text || ''))
+                    && !CONFIRM_DISQUALIFIER_RE.test(String(u.text || ''))
+                    && String(u.text || '').length < bestLen * 0.6
+                    && !hasCorrectionCue(u.text);
                 await rewriteCard(best.id, j => {
-                    j.content = (u.area ? `${u.area}: ` : '') + u.text + tag;
+                    if (isTerseConfirm) j.content = `${j.content}\n(re-affirmed ${today}: ${u.text})`;
+                    else j.content = (u.area ? `${u.area}: ` : '') + u.text + tag;
                     j.createdAt = now;
                     j.borderColor = 'rgba(16,185,129,0.6)';
                     if (u.createdVia) j.createdVia = String(u.createdVia);
@@ -2506,7 +2755,7 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
                     // verifiedAt), so confirming/correcting a drifted fact marks it ✅.
                     if (Array.isArray(u.evidence) && u.evidence.length) j.evidence = u.evidence;
                 });
-                best.text = u.text;
+                best.text = isTerseConfirm ? `${best.text}\n(re-affirmed ${today}: ${u.text})` : u.text;
                 stats.updated++;
             } else {
                 cards.push({ text: (u.area ? `${u.area}: ` : '') + u.text + (u.area ? `\n#${u.area.toLowerCase().replace(/[^a-z0-9]+/g, '-')}` : ''), area: u.area, createdVia: u.createdVia, ...(Array.isArray(u.evidence) && u.evidence.length ? { evidence: u.evidence } : {}) });
@@ -2633,6 +2882,38 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
         }
 
         cards.push(...milestonesFallback);
+
+        // FULFILLMENT CROSS-CHECK (T6, 2026-07-23) — the write-side twin of the
+        // incident fix: a new 🏁 that carries no explicit closes: still gets
+        // reconciled against live open claims (prose "remaining:" clauses AND
+        // ❓/🎯 cards) via the ONE shared extractor. Output is a dashed "likely
+        // closed by" edge + a coverage receipt (covers / does NOT cover) that
+        // the hook prints with a ready-to-emit ✓ marker. NEVER archives —
+        // commit-derived milestones used to be lifecycle-INERT (the supersede
+        // pass skips 🏁 by design); now they at least raise their hand.
+        for (const card of cards) {
+            if (!/🏁/.test(card.text) || card.__fromResolve) continue;
+            const closed = new Set(card.__closesIds || []);
+            const cands = findFulfillmentCandidates(struct, [{ text: card.text, createdAt: now }], { maxPerMilestone: 2 })
+                .filter(c => !closed.has(c.open.id));
+            if (!cands.length) continue;
+            card.__fulfills = cands.map(c => c.open.id);
+            for (const c of cands) {
+                stats.fulfillCandidates.push({
+                    open: String(c.open.text || '').replace(/\s+/g, ' ').slice(0, 90),
+                    area: c.open.area || null,
+                    item: c.item,
+                    uncovered: c.uncovered,
+                    cov: c.cov,
+                    // A ✓ is suggested ONLY when the claim is FULLY covered and
+                    // its tokens can actually clear the resolve matcher's ≥4
+                    // floor — a partial ✓ used to archive the whole card
+                    // (critical review finding), and a tiny-item ✓ resolved
+                    // nothing and spawned a junk 🏁 fallback instead.
+                    marker: (!c.uncovered.length && c.resolvable) ? `🧠 BRAIN [${c.open.area || 'Notes'}] ✓: ${c.item.slice(0, 80)}` : null,
+                });
+            }
+        }
         stampBrainKind(manifest);
         work = await finalizeBrainZip(zip, canvas, manifest, now);
     }
@@ -2647,9 +2928,9 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
         const rand = () => Math.random().toString(36).slice(2, 10);
         canvas.connections = Array.isArray(canvas.connections) ? canvas.connections : [];
         const hasConn = (a, b) => canvas.connections.some(cn => (cn.fromId === a && cn.toId === b) || (cn.fromId === b && cn.toId === a));
-        const addConn = (fromId, toId, label, relationship) => {
+        const addConn = (fromId, toId, label, relationship, opts = {}) => {
             if (!fromId || !toId || fromId === toId || hasConn(fromId, toId)) return;
-            canvas.connections.push({ id: `con_${rand()}`, fromId, toId, relationship, label, arrowHead: true, width: 2, color: '#10b981', style: 'solid' });
+            canvas.connections.push({ id: `con_${rand()}`, fromId, toId, relationship, label, arrowHead: true, width: opts.width ?? 2, color: opts.color ?? '#10b981', style: opts.style ?? 'solid' });
             stats.linked++;
         };
         // Locate each appended card by exact text match (newest first wins).
@@ -2671,6 +2952,9 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
             newIds.add(created.id);
             if (card.__supersedes) addConn(card.__supersedes, created.id, 'superseded by', undefined);
             for (const cid of (card.__closesIds || [])) addConn(cid, created.id, 'closed by', undefined);
+            // Dashed, muted hint — a suggestion must never render pixel-identical
+            // to a confirmed 'closed by' verdict edge on the human's canvas.
+            for (const cid of (card.__fulfills || [])) addConn(cid, created.id, 'likely closed by', undefined, { style: 'dashed', width: 1.5, color: 'rgba(16,185,129,0.55)' });
             for (const link of (created.links || [])) {
                 const want = String(link).trim().toLowerCase();
                 if (!want) continue;
@@ -2754,7 +3038,7 @@ export function selectGardenCandidates(struct, { keepNewest = GARDEN_KEEP_NEWEST
         const title = (ctn.title || '').trim();
         if (!title || GARDEN_PROTECTED.test(title)) continue;
         const children = struct.cards
-            .filter(c => c.type === 'text' && c.parentId === ctn.id && (c.text || '').trim() && !/⤵|↩|✅|🛠/.test(c.text))  // 🛠️ skills are standing reference — never consolidate them away
+            .filter(c => c.type === 'text' && c.parentId === ctn.id && (c.text || '').trim() && !/⤵|↩|✅|🛠|❓|🎯/.test(c.text))  // 🛠️ skills are standing reference — never consolidate them away; ❓/🎯 are OPEN items — dormancy is not resolution, and consolidating one is silent false-retirement (2026-07-23 audit; GARDEN_PROTECTED only shields containers *titled* "open questions")
             .sort((a, b) => (a.createdAt || 0) - (b.createdAt || 0));
         const autoCutoff = now - GARDEN_AUTO_MIN_AGE_DAYS * 86_400_000;
         const isAuto = (c) => (c.tags || []).some(t => String(t).toLowerCase().replace(/^#/, '') === 'auto');
@@ -2858,13 +3142,18 @@ export async function applyGarden(buffer, { syntheses = [] } = {}) {
         const span = `${new Date(area.candidates[0].createdAt || now).toISOString().slice(0, 10)} → ${new Date(area.candidates[area.candidates.length - 1].createdAt || now).toISOString().slice(0, 10)}`;
         const content = wrapText(`${area.title}: 🌿 Consolidated history (${span}, ${area.candidates.length} cards)\n${finalSynth}`);
         const sid = `txt_${rand()}`;
-        zip.file(`items/${shard(sid)}/${sid}.json`, JSON.stringify({ type: 'text', locked: false, createdAt: now, createdBy: 'agent', createdVia: 'gardener', content, fontSize: 12, color: '#e8e8ed', border: true, borderColor: 'rgba(59,130,246,0.6)', heading: false }));
+        // `sources` = machine lineage (which originals fed this synthesis, with
+        // their birth dates) — as_of and future provenance passes read the
+        // field, never the prose.
+        zip.file(`items/${shard(sid)}/${sid}.json`, JSON.stringify({ type: 'text', locked: false, createdAt: now, createdBy: 'agent', createdVia: 'gardener', content, fontSize: 12, color: '#e8e8ed', border: true, borderColor: 'rgba(59,130,246,0.6)', heading: false, sources: area.candidates.map(c => ({ id: c.id, createdAt: c.createdAt || 0 })) }));
         canvas.positions[sid] = { x: ctnPos.x + 20, y: ctnPos.y + (ctnPos.h || 0) + 10, w: 300, h: measureCardH(content), zKey: nextZKey(), zIndex: canvas.order.length, parentId: area.containerId };
         canvas.order.push(sid);
         newCards.push(sid);
         stats.synthCards++;
         for (const cand of area.candidates) {
-            await rewriteCard(cand.id, j => { j.content = `⤵ consolidated ${today}\n${j.content}`; j.borderColor = 'rgba(120,120,135,0.5)'; });
+            // consolidatedAt = the machine death-date deathDateOfCard prefers —
+            // as_of must never depend on the prose stamp parsing correctly.
+            await rewriteCard(cand.id, j => { j.content = `⤵ consolidated ${today}\n${j.content}`; j.borderColor = 'rgba(120,120,135,0.5)'; j.consolidatedAt = now; });
             await archiveCard(cand.id);
             canvas.connections.push({ id: `con_${rand()}`, fromId: cand.id, toId: sid, relationship: 'relates_to', label: 'consolidated into', arrowHead: true, width: 1.5, color: 'rgba(120,120,135,0.7)', style: 'solid' });
             stats.archived++;
@@ -2896,6 +3185,173 @@ export async function applyGarden(buffer, { syntheses = [] } = {}) {
     return { buffer: out, stats };
 }
 
+// ── Claim engine (2026-07-23, Week 2-3 of the truth-maintenance plan) ────────
+// THE one shared claim extractor — every fulfillment surface (capture-time
+// cross-check, brain_reconcile mode:'claims', findStaleOpenCards, the brief's
+// ⏳ section) calls THIS, never a private regex twin (the design review killed
+// four divergent implementations). A "claim" is a cue-anchored open clause
+// inside ANY live card ("remaining: X + Y", "next: Z") — the incident class:
+// prose claims invisible to the ❓/🎯 glyph-gated lifecycle. Multi-item clauses
+// split on + / · / ; so partial fulfillment stays visible ("covers X, does NOT
+// cover Y" — approving the covered half must not retire the uncovered half).
+// Cue precision (adversarial review 2026-07-23): bare 'left' is GONE (CSS
+// `left: 12px`, "left the meeting at 15:30" were probe-confirmed extractions),
+// and 'next'/'awaits' require an IMMEDIATE colon — the 40-char bridge let
+// `await client.messages.create({ model: … })` become a claim. Claim tokens
+// are stopword- and URL-free: raw tokenSet keeps any ≥4-char word, so
+// from/this/with/https/github cleared the 0.6 coverage bar against unrelated
+// milestones (four probe-confirmed FP classes, incl. the live dogfood noise).
+const CLAIM_CUE_RE = /\b(?:remaining|pending|still\s+to\s+do|to-?do|outstanding|open\s+items?)\b[^:\n]{0,40}:\s*([^\n]+)|\b(?:next|awaits?)\s*:\s*([^\n]+)/gi;
+const claimTokens = (s) => new Set([...tokenSet(String(s || '').replace(/https?:\/\/\S+/g, ' '))].filter(t => !STOPWORDS.has(t)));
+export function extractOpenClauses(text) {
+    const out = [];
+    for (const m of String(text || '').matchAll(CLAIM_CUE_RE)) {
+        const clause = (m[1] || m[2] || '').trim();
+        if (!clause) continue;
+        const items = clause.split(/\s*(?:\+|·|;)\s*/)
+            .map(t => t.trim()).filter(t => t.length >= 4)
+            .map(t => ({ text: t, tokens: claimTokens(t) }))
+            .filter(it => it.tokens.size >= 1);
+        if (items.length) out.push({ clause, items });
+    }
+    return out;
+}
+
+// One-sided fulfillment scan: which live open claims do these milestones appear
+// to fulfil? O(claims × milestones) — NEVER an all-pairs brain scan. Returns
+// receipt-bearing candidates ({covered item, uncovered siblings, coverage}) and
+// ARCHIVES NOTHING — callers draw dashed "likely closed by" edges / prompt for
+// a human ✓; retirement always stays a human act. Skills (🛠) and already-dead
+// cards are never claim sources; a milestone must post-date the claim card.
+export function findFulfillmentCandidates(struct, milestones, { coverAt = 0.6, requireNewer = true, maxPerMilestone = 3 } = {}) {
+    if (!struct || !Array.isArray(struct.cards) || !Array.isArray(milestones) || !milestones.length) return [];
+    const isArchived = (c) => /^archive$/i.test(c.area || '');
+    const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
+    // 🏁 cards ARE claim sources for their prose clauses — the incident's own
+    // shape was "🏁 Phase 1 VERIFIED. remaining: X + Y", and excluding 🏁 made
+    // the incident class invisible to this very scan (review finding). Only
+    // dead/skill cards are excluded; self-match is guarded below.
+    const live = struct.cards.filter(c => c.type !== 'container' && (c.text || '').trim()
+        && !isArchived(c) && !/↩|✅|⤵|🛠/.test(c.text));
+    // Dismissals + existing hints: a pair the human rejected (not_fulfilled
+    // edge via brain_connect) or that already carries a hint edge is never
+    // re-suggested — wrong hints must be dismissable, not permanent.
+    const settled = new Set();
+    for (const cn of struct.connections || []) {
+        if (cn.label === 'likely closed by' || cn.relationship === 'not_fulfilled') settled.add(`${cn.fromId}|${cn.toId}`);
+    }
+    // Milestone token sets ONCE — this used to sit in the innermost item loop
+    // (claims × items × milestones tokenizations; output caps bound results,
+    // not work — the 9000-card constraint is about work).
+    const mPre = milestones.map(m => ({ m, tok: tokenSet(m.text) }));
+    const out = [];
+    for (const o of live) {
+        const clauses = extractOpenClauses(o.text);
+        // A whole ❓/🎯 card with no prose clause IS the claim (glyph-gated
+        // path; never for 🏁 cards — their claim is only the explicit clause).
+        if (!clauses.length && /❓|🎯/.test(o.text) && !/🏁/.test(o.text)) {
+            const tk = claimTokens(o.text);
+            if (tk.size >= 4) clauses.push({ clause: null, items: [{ text: flat(o.text).slice(0, 120), tokens: tk }] });
+        }
+        for (const cl of clauses) {
+            for (const it of cl.items) {
+                if (it.tokens.size < 2) continue;              // one-token items match everything
+                for (const { m, tok: mTok } of mPre) {
+                    if (m.id && m.id === o.id) continue;       // a milestone never fulfils its own clause
+                    if (m.id && settled.has(`${o.id}|${m.id}`)) continue;
+                    if (requireNewer && Number.isFinite(m.createdAt) && m.createdAt <= (o.createdAt || 0)) continue;
+                    const cov = coverageOf(it.tokens, mTok);
+                    if (cov < coverAt) continue;
+                    const uncovered = cl.items.filter(x => x !== it && coverageOf(x.tokens, mTok) < coverAt).map(x => x.text);
+                    out.push({ open: o, clause: cl.clause, item: it.text, uncovered, milestone: m, cov: Math.round(cov * 100) / 100, resolvable: it.tokens.size >= 4 });
+                }
+            }
+        }
+    }
+    // Best candidate per (open card, milestone) pair; bounded per milestone so
+    // one generic ship can never spray edges across the brain.
+    const byPair = new Map();
+    for (const c of out) {
+        const key = `${c.open.id}|${c.milestone.id || milestones.indexOf(c.milestone)}`;
+        if (!byPair.has(key) || byPair.get(key).cov < c.cov) byPair.set(key, c);
+    }
+    // GENERICITY GUARD (mirror the close-pass >4-match rule): an item whose
+    // tokens are covered by MANY different milestones is too generic to be a
+    // useful hint ("shipped desktop bundle" matches every release card) —
+    // drop it entirely; a real claim matches the one or two ships that
+    // actually fulfilled it. Then at most 2 hints per item, capped per
+    // milestone so one generic ship can never spray edges across the brain.
+    const byItem = new Map();
+    for (const c of byPair.values()) {
+        const k = `${c.open.id}|${c.item}`;
+        if (!byItem.has(k)) byItem.set(k, []);
+        byItem.get(k).push(c);
+    }
+    const perMile = new Map();
+    const kept = [];
+    for (const group of byItem.values()) {
+        if (group.length > 3) continue;                    // too generic — no hint
+        for (const c of group.sort((a, b) => b.cov - a.cov).slice(0, 2)) {
+            const mk = c.milestone.id || milestones.indexOf(c.milestone);
+            const n = perMile.get(mk) || 0;
+            if (n >= maxPerMilestone) continue;
+            perMile.set(mk, n + 1);
+            kept.push(c);
+        }
+    }
+    kept.sort((a, b) => b.cov - a.cov);
+    return kept;
+}
+
+// Serving-time fulfillment overlay: a recalled open card that a live milestone
+// likely fulfilled (a dashed "likely closed by" edge exists) must never render
+// as plain open truth — the reader gets the hint + the confirm receipt. Renders
+// BELOW a correction overlay when both exist (correction wins precedence).
+export function fulfillmentOverlaysFor(struct, cards) {
+    const map = new Map();
+    if (!struct || !Array.isArray(struct.connections)) return map;
+    const byId = new Map(struct.cards.map(c => [c.id, c]));
+    const want = new Set((cards || []).map(c => c.id));
+    for (const cn of struct.connections) {
+        if (cn.label !== 'likely closed by' || !want.has(cn.fromId)) continue;
+        const m = byId.get(cn.toId);
+        if (!m || /^archive$/i.test(m.area || '')) continue;    // a since-archived milestone no longer vouches
+        const head = String(m.text || '').replace(/\s+/g, ' ').trim().slice(0, 100);
+        if (!map.has(cn.fromId)) map.set(cn.fromId, { by: head, byId: m.id });
+    }
+    return map;
+}
+
+// Corpse-rate (T10): the release-gated staleness metric. Fixtures are mined
+// from the brain's OWN supersede/close edges: for each archived card with a
+// live successor, build the ambiguous shared-subject question both could
+// answer and check who ranks higher. corpse-rate = fraction of pairs where the
+// corpse outranks its successor — the exact 2026-07-23 failure, measurable.
+export function corpseRate(struct, { k = 5, maxPairs = 40 } = {}) {
+    if (!struct || !Array.isArray(struct.cards)) return { rate: 0, pairs: 0, served: [] };
+    const byId = new Map(struct.cards.map(c => [c.id, c]));
+    const isArchived = (c) => /^archive$/i.test(c.area || '');
+    const pairs = [];
+    for (const cn of struct.connections || []) {
+        if (cn.label !== 'superseded by' && cn.label !== 'closed by') continue;
+        const corpse = byId.get(cn.fromId), successor = byId.get(cn.toId);
+        if (!corpse || !successor || !isArchived(corpse) || isArchived(successor)) continue;
+        const succTok = tokenSet(successor.text);
+        const shared = [...tokenSet(corpse.text)].filter(t => succTok.has(t)).slice(0, 6);
+        if (shared.length < 3) continue;
+        pairs.push({ corpse, successor, q: `what is the state of ${shared.join(' ')}?` });
+        if (pairs.length >= maxPairs) break;
+    }
+    const served = [];
+    for (const p of pairs) {
+        const { hits } = rankForQuestion(struct, p.q, { k });
+        const ci = hits.findIndex(h => h.card.id === p.corpse.id);
+        const si = hits.findIndex(h => h.card.id === p.successor.id);
+        if (ci !== -1 && (si === -1 || ci < si)) served.push({ q: p.q, corpse: String(p.corpse.text || '').slice(0, 80) });
+    }
+    return { rate: pairs.length ? Math.round((served.length / pairs.length) * 100) / 100 : 0, pairs: pairs.length, served };
+}
+
 // ── Stale-open reconcile ("marked open, but a milestone says it's done") ─────
 // The READ-side twin of the closes: write path. An open ❓/🎯 card lingers as
 // "still to do" forever unless someone emits a ✓/closes: for it — so a goal that
@@ -2918,10 +3374,20 @@ export function findStaleOpenCards(struct, { coverAt = 0.6, max = 5 } = {}) {
     for (const o of opens) {
         const oTok = tokenSet(o.text);
         if (oTok.size < 3) continue;                       // too vague to match safely → leave it
+        // CLAUSE-KEYED coverage (2026-07-23): the old whole-card denominator
+        // meant a 6-token "remaining: X" clause inside a 40-token card could
+        // NEVER reach the bar against a terse milestone — the incident card's
+        // exact geometry. Score each open clause item separately and take the
+        // best of (whole card, any clause item ≥2 tokens).
+        // ≥3 tokens per clause item: 2-token items ('docs update') hit cov 1.0
+        // against unrelated milestones (probe-confirmed false stale flags).
+        const clauseToks = extractOpenClauses(o.text).flatMap(cl => cl.items.map(it => it.tokens)).filter(t => t.size >= 3);
         let best = null, bestCov = 0;
         for (const m of miles) {
             if ((m.createdAt || 0) <= (o.createdAt || 0)) continue; // only a milestone shipped AFTER the goal
-            const cov = coverageOf(oTok, tokenSet(m.text));          // how much of the goal the milestone covers
+            const mTok = tokenSet(m.text);
+            let cov = coverageOf(oTok, mTok);              // how much of the goal the milestone covers
+            for (const ct of clauseToks) cov = Math.max(cov, coverageOf(ct, mTok));
             if (cov > bestCov) { bestCov = cov; best = m; }
         }
         if (best && bestCov >= coverAt) out.push({ open: o, by: best, cov: Math.round(bestCov * 100) / 100 });