klypix-mcp 1.40.2 → 1.41.0

package/bin/klypix-worker.mjs

@@ -33,6 +33,10 @@ import {
 import { mcpServerEntry } from '../src/agent-rules.mjs';
 import { createMcpPresence, KLYPIX_MCP_INSTRUCTIONS } from '../src/mcp-presence.mjs';
 import { spawnAutoUpdateHelper } from '../src/mcp-auto-update.mjs';
+// Namespace import (already in-process via the klypix-core chain, so zero added
+// load cost) so a bundle whose klypix-format predates classifyDecay degrades
+// gracefully — a named import of a missing export would kill the whole server.
+import * as brainFormat from '../src/klypix-format.mjs';
 
 // Real package version for the MCP handshake (was hardcoded '1.0.0', which
 // misled every client/version diagnosis — it could never reflect the true release).
@@ -118,7 +122,21 @@ const server = new McpServer(
     capabilities: { logging: {} },
   },
 );
-const mcpPresence = createMcpPresence({ server, initialVault: VAULT });
+// Decay-aware LAST-KNOWN stamps for every MCP delivery surface (2026-07-28
+// post-mortem, class B): the classifier lives ONCE in klypix-format.mjs and is
+// INJECTED here so mcp-presence/agent-presence stay builtin-only. The typeof
+// guards let a bundle predating the feature degrade to unstamped delivery —
+// no crash, no stamp, never a throw.
+const mcpPresence = createMcpPresence({
+  server,
+  initialVault: VAULT,
+  decay: typeof brainFormat.classifyDecay === 'function' ? {
+    classifyDecay: brainFormat.classifyDecay,
+    decayStaleMs: brainFormat.DECAY_STALE_MS,
+    decayMessageStamp: typeof brainFormat.decayMessageStamp === 'function' ? brainFormat.decayMessageStamp : undefined,
+    formatDecayAge: typeof brainFormat.formatDecayAge === 'function' ? brainFormat.formatDecayAge : undefined,
+  } : {},
+});
 
 // Map a protocol-neutral core result → an MCP tool result.
 const toContent = (r) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "klypix-mcp",
-  "version": "1.40.2",
-  "description": "Every project gets a brain — one open .klypix file your AI agents read, write, and argue from, over MCP. Works with Claude, Codex, Cursor, Cline, any model.",
+  "version": "1.41.0",
+  "description": "Every project gets a brain — one open .klypix file your AI agents read, write, and argue from, over MCP. Works with Claude, Codex, Cursor, Cline, any model.",
   "type": "module",
   "license": "Apache-2.0",
   "keywords": [
@@ -58,7 +58,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/mcp-auto-update.mjs && node test/mcp-supervisor.mjs && node test/codex-hooks.mjs && node test/agent-presence.mjs && node test/context-gateway.mjs && node test/conformance.mjs && node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/canvas-view.mjs && node test/status-completeness.mjs"
+    "test": "node test/mcp-auto-update.mjs && node test/mcp-supervisor.mjs && node test/codex-hooks.mjs && node test/agent-presence.mjs && node test/context-gateway.mjs && node test/conformance.mjs && node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/canvas-view.mjs && node test/status-completeness.mjs && node test/semantic-gate.mjs && node test/decay-status.mjs && node test/decay-hook.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.7.4",

package/src/agent-presence.mjs

@@ -417,12 +417,62 @@ export function formatPresenceMessage(sessions, selfId, { includeSolo = false, n
   return lines.join('\n');
 }
 
-export function formatReceivedMessages(messages, now = Date.now()) {
+// ── Decay-aware LAST-KNOWN stamps (2026-07-28 post-mortem, class B) ──────────
+// A delivered inter-session message is MEMORY, not a SENSOR: one older than 6h
+// whose text asserts fast-decay build/deploy status ("no TestFlight upload
+// triggered yet") must never read as CURRENT state — the ENGINE stamps it,
+// never the reading model. The classifier lives ONCE in klypix-format.mjs;
+// this file stays builtin-only, so consumers INJECT it (the optional third
+// `decay` argument). With no injection the output is byte-identical to the
+// unstamped form — an old bundle degrades to no stamp, never a throw. Each
+// stamp is its OWN line appended AFTER the 400-char render slice (the v1.32.0
+// law: a warning is never subject to the budget/cut it warns about) and exists
+// in render output only — the lane file is never mutated.
+const MSG_DECAY_STAMP_MS = 6 * 60 * 60 * 1000;
+// classifyDecay is precision-first; mirror that here — only an explicit `true`
+// or an explicitly fast-shaped object stamps. Anything ambiguous does NOT
+// (a false stamp erodes trust in every stamp).
+const isFastDecayResult = (r) => r === true || r === 'fast'
+  || (!!r && typeof r === 'object' && (r.fast === true || r.fastDecay === true || r.decay === 'fast' || r.class === 'fast' || r.kind === 'fast'));
+const decayAgeLabel = (ms) => {
+  const h = Math.floor(Math.max(0, ms) / 3_600_000);
+  return h >= 48 ? `${Math.floor(h / 24)}d` : `${Math.max(1, h)}h`;
+};
+
+// Decay verdict for ONE delivered message: null, or { age, stampText } when it
+// is stale (ts older than the engine threshold) AND its RAW text classifies
+// fast-decay (raw, not the render slice — a claim cut out of the 400 chars
+// must still stamp). Threshold, wording, and age format come from the injected
+// engine surface ({ classifyDecay, decayStaleMs, decayMessageStamp,
+// formatDecayAge }) so the renderers can never drift apart; the local
+// fallbacks mirror klypix-format verbatim for a bundle old enough to carry the
+// classifier but not the helpers.
+export function messageDecayInfo(message, now = Date.now(), decay = {}) {
+  const { classifyDecay, decayStaleMs, decayMessageStamp, formatDecayAge } = decay || {};
+  if (typeof classifyDecay !== 'function') return null;
+  try {
+    const ts = Number(message?.ts) || 0;
+    const staleMs = Number(decayStaleMs) > 0 ? Number(decayStaleMs) : MSG_DECAY_STAMP_MS;
+    if (!ts || now - ts < staleMs) return null;
+    if (!isFastDecayResult(classifyDecay(String(message?.text || '')))) return null;
+    const ageMs = now - ts;
+    return {
+      age: typeof formatDecayAge === 'function' ? String(formatDecayAge(ageMs)) : decayAgeLabel(ageMs),
+      stampText: typeof decayMessageStamp === 'function'
+        ? String(decayMessageStamp(ageMs))
+        : `⏱️ This message is ${decayAgeLabel(ageMs)} old and contains build/deploy status — treat as LAST KNOWN, verify live before reporting it.`,
+    };
+  } catch { return null; }   // stamping is best-effort — a classifier bug must never break delivery
+}
+
+export function formatReceivedMessages(messages, now = Date.now(), decay = {}) {
   if (!Array.isArray(messages) || !messages.length) return '';
   const lines = ['KLYPIX message(s) from another active session:'];
   for (const message of messages) {
     const ageMin = Math.max(0, Math.round((now - Number(message.ts || now)) / 60_000));
     lines.push(`- from ${String(message.from || '?').slice(0, 12)} (${ageMin}m ago): ${String(message.text || '').replace(/\s+/g, ' ').trim().slice(0, 400)}`);
+    const info = messageDecayInfo(message, now, decay);
+    if (info) lines.push(`  ${info.stampText}`);
   }
   return lines.join('\n');
 }

package/src/brain-doctor.mjs

@@ -29,6 +29,16 @@ import { auditProject, codexGlobalInstructionsInstalled, resolveVersion } from '
 import { codexPresenceHookStatus } from './codex-hooks.mjs';
 import { inspectAutoUpdate } from './mcp-auto-update.mjs';
 
+// klypix-format is the DECAY-GUARD seam (classifyDecay + the status renderer),
+// loaded failure-tolerant: the doctor's doctrine is "an absent seam is a fact
+// to report, not an error" — klypix-format pulls jszip, and a broken/partial
+// install must degrade the layer to 'unknown', never kill the doctor. The
+// sibling './' specifier resolves identically in the package (src/) and the
+// flat deployed (~/.claude/project-brain) layouts; top-level await keeps
+// inspect() synchronous for its existing callers.
+let fmtLib = null;
+try { fmtLib = await import('./klypix-format.mjs'); } catch { fmtLib = null; }
+
 const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 const sha = (s) => crypto.createHash('sha1').update(String(s)).digest('hex').slice(0, 16);
@@ -220,6 +230,49 @@ function inspectPeers(brainDir, brainPath, now) {
   return { file, live, count: live.length };
 }
 
+// ── DECAY-GUARD layer (fast-decay status protection, 2026-07-28) ─────────────
+// The brain is MEMORY, not a SENSOR: completed-status claims near release nouns
+// ("uploaded", "LIVE", "installed", TestFlight/build N/npm/rollout) decay in
+// hours, and a bundle that renders them as current state reproduces the stale-
+// "what is remaining" incident class. This layer proves the protection is
+// PRESENT, end-to-end: (a) the loaded engine exports classifyDecay; (b) its
+// status renderer actually stamps a synthetic 20h-old stale claim as ⏱️ LAST
+// KNOWN (behavior, not just an export string); (c) the DEPLOYED bundle files
+// carry the feature. A bundle that predates the feature reads as DRIFT —
+// silently lacking protection is exactly the failure mode — while an
+// unloadable engine reads as a reportable fact, never a doctor crash.
+export function inspectDecayGuard(brainDir, lib, now = Date.now()) {
+  const libLoaded = !!lib;
+  const exported = !!(lib && typeof lib.classifyDecay === 'function');
+  let rendererStamps = null;   // null = not testable (no lib / no renderer export)
+  if (exported && typeof lib.statusContextToMarkdown === 'function') {
+    try {
+      // Minimal parseKlypix-shaped struct: one 20h-old fast-decay milestone.
+      const struct = {
+        title: 'decay-probe', format: 'probe', counts: { cards: 1, connections: 0 },
+        cards: [{
+          id: 'decay-probe-1', type: 'text', title: '', links: [], tags: [],
+          text: 'Release: 🏁 build 26 uploaded to TestFlight — rollout LIVE',
+          area: 'Release', createdAt: now - 20 * 3_600_000, parentId: null, evidence: null,
+        }],
+        connections: [],
+      };
+      const md = String(lib.statusContextToMarkdown(struct, { budgetChars: 4200, now }) || '');
+      rendererStamps = /⏱/.test(md) && /LAST KNOWN/i.test(md);
+    } catch { rendererStamps = false; }   // a throwing renderer is NOT protecting anything
+  }
+  // Deployed-bundle currency (inspectVersion/inspectTools idiom: read the
+  // DEPLOYED file text — the running package can be newer than the machine's
+  // bundle). Absent files are a fact (null), never drift on their own.
+  const deployedFmt = readText(path.join(brainDir, 'klypix-format.mjs'));
+  const deployedHook = readText(path.join(brainDir, 'global-brain-hook.mjs'));
+  return {
+    libLoaded, exported, rendererStamps,
+    deployedFmtCurrent: deployedFmt == null ? null : /export (?:function|const) classifyDecay\b/.test(deployedFmt),
+    deployedHookCurrent: deployedHook == null ? null : deployedHook.includes('classifyDecay'),
+  };
+}
+
 /**
  * Inspect this machine's brain (+ a project's harness projection) as one report.
  * @param {{ projectDir?: string, home?: string, now?: number, npmLatest?: string|null }} [opts]
@@ -246,6 +299,8 @@ export function inspect(opts = {}) {
   };
   const tools = inspectTools(brainDir, PKG_ROOT);
   const peers = inspectPeers(brainDir, brainPath, now);
+  // opts.fmtLib is a test seam (stub engines); production uses the module lib.
+  const decayGuard = inspectDecayGuard(brainDir, opts.fmtLib !== undefined ? opts.fmtLib : fmtLib, now);
 
   // Harness drift only counts toward the verdict for a real brain project; auditProject
   // against the BAKED brain version (the deployed truth) when available.
@@ -275,6 +330,13 @@ export function inspect(opts = {}) {
         ? 'optional'
         : (codexHooks.executionStatus === 'observed' ? 'ok' : 'warning')),
     harness: hasBrain ? (harness.ok ? 'ok' : 'drift') : 'n/a',
+    // DECAY-GUARD drifts when the protection is provably missing: the loaded
+    // engine lacks classifyDecay, its renderer left the synthetic stale claim
+    // unstamped, or a deployed bundle file predates the feature. An unloadable
+    // engine is 'unknown' (a reportable fact, not a verdict flip).
+    decayGuard: !decayGuard.libLoaded ? 'unknown'
+      : (!decayGuard.exported || decayGuard.rendererStamps === false
+        || decayGuard.deployedFmtCurrent === false || decayGuard.deployedHookCurrent === false) ? 'drift' : 'ok',
   };
   const drifted = Object.values(layers).filter(s => s === 'drift').length;
   const verdict = !version.installed ? 'NOT-INSTALLED' : (drifted ? 'DRIFTED' : 'ALIGNED');
@@ -289,9 +351,10 @@ export function inspect(opts = {}) {
     if (version.supervisorCapable && running.known && !supervisors.active) actions.push('/mcp reconnect once   # activate the zero-restart supervisor; compatible future core updates hot-swap automatically');
     if (hooks.missing.length) actions.push(`npx klypix-mcp install   # half-wired: hooks not active — ${hooks.missing.join(', ')}`);
     if (hasBrain && !harness.ok) actions.push('npx klypix-mcp link      # harness configs drifted — re-project managed blocks');
+    if (layers.decayGuard === 'drift') actions.push('npx klypix-mcp install   # decay-aware status guard missing/stale — stale build/deploy claims can render as CURRENT state');
   }
 
-  return { verdict, layers, drifted, version, running, supervisors, autoUpdate, hooks, codexSmart, codexHooks, tools, peers, sessions: peers, harness, npm, project: { dir: projectDir, brainPath, hasBrain }, brainDir, actions };
+  return { verdict, layers, drifted, version, running, supervisors, autoUpdate, hooks, codexSmart, codexHooks, tools, peers, sessions: peers, harness, npm, decayGuard, project: { dir: projectDir, brainPath, hasBrain }, brainDir, actions };
 }
 
 // One-line drift summary (empty when clean) — for a footer / status line.
@@ -304,6 +367,7 @@ export function driftLine(r) {
   if (r.running && r.running.matchesInstalled === false) bits.push(`live server v${r.running.version}≠installed v${r.version.baked} (/mcp reconnect)`);
   if (r.hooks.missing.length) bits.push(`${r.hooks.missing.length} hook(s) unwired`);
   if (r.project.hasBrain && !r.harness.ok) bits.push(`${r.harness.drift.length} harness file(s) drifted`);
+  if (r.layers?.decayGuard === 'drift') bits.push('decay-guard stale (fast-decay status claims unstamped)');
   return bits.length ? `⚠️ brain DRIFTED: ${bits.join(' · ')}` : '';
 }
 
@@ -388,6 +452,23 @@ export function render(r, opts = {}) {
   // TOOLS
   L.push(`${ok} ${c.bold}TOOLS${c.rst}    ${r.tools.count} MCP verb(s)${r.tools.hash ? ` ${c.dim}[#${r.tools.hash}, ${r.tools.source}]${c.rst}` : ''}${r.tools.count ? `: ${c.dim}${r.tools.names.join(', ')}${c.rst}` : ''}`);
 
+  // DECAY-GUARD (fast-decay status claims must stamp as LAST KNOWN, not current)
+  if (r.decayGuard) {
+    const d = r.decayGuard;
+    const dmark = r.layers.decayGuard === 'ok' ? ok : warn;
+    if (r.layers.decayGuard === 'ok') {
+      L.push(`${dmark} ${c.bold}DECAY${c.rst}    stale build/deploy claims stamp as ⏱️ LAST KNOWN ${c.dim}(classifyDecay + renderer self-test pass)${c.rst}`);
+    } else if (r.layers.decayGuard === 'unknown') {
+      L.push(`${dmark} ${c.bold}DECAY${c.rst}    ${c.dim}engine not loadable — decay stamping unverified${c.rst}`);
+    } else {
+      const why = !d.exported ? 'engine predates classifyDecay'
+        : d.rendererStamps === false ? 'status renderer left a synthetic 20h-old stale claim UNSTAMPED'
+          : d.deployedFmtCurrent === false ? 'deployed klypix-format.mjs predates the decay guard'
+            : 'deployed global-brain-hook.mjs predates message stamps';
+      L.push(`${dmark} ${c.bold}DECAY${c.rst}    ${c.red}${why} — stale status claims can render as CURRENT state${c.rst}`);
+    }
+  }
+
   // SESSIONS: this is an all-session count. A recent-chat row is not a heartbeat.
   if (!r.sessions.count) L.push(`${ok} ${c.bold}SESSIONS${c.rst}  0 active sessions ${c.dim}(saved/recent chats are history, not active)${c.rst}`);
   else {

package/src/brain-semantic.mjs

@@ -82,13 +82,24 @@ function readCachedVecs(brainPath, cards) {
 // the hook keeps its exact lexical behavior). NEVER throws, NEVER embeds cards.
 export async function semanticVecs(brainPath, struct, query, { timeoutMs = 1200 } = {}) {
     try {
-        const pipe = await Promise.race([getEmbedder(), new Promise(r => setTimeout(() => r(null), timeoutMs))]);
-        if (!pipe) return null;
         const q = String(query || '').toLowerCase().trim();
         if (!q) return null;
+        // Deploy-gate, ENFORCED (2026-07-29): read the warm card-vector cache
+        // BEFORE any model work. This lane never embeds cards, so with no cached
+        // vectors there is nothing to rank against — and importing transformers
+        // here would spin onnxruntime worker threads inside a ONE-SHOT hook that
+        // process.exit(0)s the moment retrieval returns. On Windows (Node 24)
+        // that exit-vs-thread-teardown race aborts the whole hook process
+        // (libuv "!(handle->flags & UV_HANDLE_CLOSING)" in async.c), because
+        // `import('@huggingface/transformers')` resolves from ANY ambient
+        // node_modules (a dev repo's) even where the semantic install is absent.
+        // Empty cache → pure-lexical, zero model load, zero threads.
+        const vecsMap = readCachedVecs(brainPath, (struct && struct.cards) || []);
+        if (!vecsMap.size) return null;
+        const pipe = await Promise.race([getEmbedder(), new Promise(r => setTimeout(() => r(null), timeoutMs))]);
+        if (!pipe) return null;
         const [qv] = await embedTexts(pipe, [q]);
         if (!qv) return null;
-        const vecsMap = readCachedVecs(brainPath, (struct && struct.cards) || []);
         return { qv, vecsMap, dot };
     } catch { return null; }
 }

package/src/codex-brain-hook.mjs

@@ -15,6 +15,10 @@ import {
 } from './agent-presence.mjs';
 import { recordCodexHookExecution } from './codex-hooks.mjs';
 import { opBrainTaskContext } from './klypix-core.mjs';
+// Namespace import (already in-process via the klypix-core chain, so zero added
+// load cost) so a bundle whose klypix-format predates classifyDecay degrades
+// gracefully — a named import of a missing export would kill the whole hook.
+import * as brainFormat from './klypix-format.mjs';
 import { findPresenceConflicts } from './mcp-presence.mjs';
 
 function readInput() {
@@ -87,6 +91,77 @@ function emitSystemMessage(parts) {
   process.stdout.write(JSON.stringify({ continue: true, systemMessage }));
 }
 
+// ── Decay-aware LAST-KNOWN stamps (2026-07-28 post-mortem, class B) ──────────
+// Codex-lane parity with the Claude hook's messageFooter: a delivered message
+// older than 6h whose text asserts fast-decay build/deploy status must never
+// read as current state — the ENGINE stamps it, never the reading model. The
+// classifier lives ONCE in klypix-format (typeof-guarded: a stale bundle
+// degrades to no stamp, never a throw). Stamps are appended AFTER
+// formatReceivedMessages' 400-char render slice so no cut can eat them (the
+// v1.32.0 law: a warning is never subject to the budget it warns about), and
+// exist in render output only — the lane file, its dedup keys, and its ack
+// semantics are untouched. The shared renderer (agent-presence) stamps
+// internally when handed the classifier; the pass below is belt-and-braces for
+// a mixed bundle whose agent-presence predates that, and its dedup is
+// per-MESSAGE — a message the renderer already stamped is skipped without
+// suppressing stamps the other messages still need.
+const MSG_DECAY_STAMP_MS = 6 * 60 * 60 * 1000;
+// Precision-first consumption (mirrors the Claude hook): only an explicit
+// `true` / explicitly fast-shaped object stamps — ambiguity never does.
+const isFastDecayResult = (r) => r === true || r === 'fast'
+  || (!!r && typeof r === 'object' && (r.fast === true || r.fastDecay === true || r.decay === 'fast' || r.class === 'fast' || r.kind === 'fast'));
+export function stampReceivedMessages(messages, now = Date.now(),
+  classifier = (typeof brainFormat.classifyDecay === 'function' ? brainFormat.classifyDecay : null)) {
+  const list = Array.isArray(messages) ? messages : [];
+  // Thread the full engine surface through — the shared renderer stamps each
+  // qualifying message internally (agent-presence stays builtin-only, so the
+  // engine functions ride the same injection; guarded for a stale bundle).
+  const base = classifier
+    ? formatReceivedMessages(list, now, {
+      classifyDecay: classifier,
+      decayStaleMs: brainFormat.DECAY_STALE_MS,
+      decayMessageStamp: typeof brainFormat.decayMessageStamp === 'function' ? brainFormat.decayMessageStamp : undefined,
+      formatDecayAge: typeof brainFormat.formatDecayAge === 'function' ? brainFormat.formatDecayAge : undefined,
+    })
+    : formatReceivedMessages(list, now);
+  if (!base || !classifier) return base;
+  const staleMs = Number(brainFormat.DECAY_STALE_MS) > 0 ? Number(brainFormat.DECAY_STALE_MS) : MSG_DECAY_STAMP_MS;   // threshold single-sourced in the engine
+  const stamps = list.map((m) => {
+    try {
+      const ts = Number(m?.ts) || 0;
+      if (!ts || now - ts < staleMs) return '';
+      if (!isFastDecayResult(classifier(String(m?.text || '')))) return '';
+      // Wording single-sourced in the engine (decayMessageStamp) so the
+      // renderers can never drift apart; local fallback for a stale bundle.
+      if (typeof brainFormat.decayMessageStamp === 'function') return `  ${brainFormat.decayMessageStamp(now - ts)}`;
+      const h = Math.floor((now - ts) / 3_600_000);
+      const label = h >= 48 ? `${Math.floor(h / 24)}d` : `${Math.max(1, h)}h`;
+      return `  ⏱️ This message is ${label} old and contains build/deploy status — treat as LAST KNOWN, verify live before reporting it.`;
+    } catch { return ''; }   // best-effort — a classifier bug must never break delivery
+  });
+  if (!stamps.some(Boolean)) return base;
+  // Per-MESSAGE dedup granularity, not whole-output: pair each `- from …`
+  // render line with its message and add a stamp only when the line right
+  // after it is not already a stamp. A ⏱ inside a message's own quoted text is
+  // NOT a stamp and must not suppress the stamps the OTHER messages need (the
+  // old whole-output includes('⏱') guard silenced them all).
+  const isStampLine = (l) => /^\s*⏱/.test(String(l || ''));
+  const lines = base.split('\n');
+  const out = [];
+  let msgIdx = -1;
+  for (let i = 0; i < lines.length; i++) {
+    out.push(lines[i]);
+    if (!lines[i].startsWith('- from ')) continue;
+    msgIdx++;
+    if (msgIdx >= list.length || !stamps[msgIdx]) continue;
+    if (isStampLine(lines[i + 1])) { stamps[msgIdx] = ''; continue; }   // renderer already stamped this one
+    out.push(stamps[msgIdx]);
+    stamps[msgIdx] = '';
+  }
+  const leftovers = stamps.filter(Boolean);   // unknown layout → stamps still delivered at the end
+  return leftovers.length ? [...out, ...leftovers].join('\n') : out.join('\n');
+}
+
 function formatConflictWarning(conflicts, event) {
   if (!conflicts.length) return '';
   const moment = event === 'PreToolUse' ? 'before this edit runs' : 'after this file operation';
@@ -187,7 +262,7 @@ async function main() {
   if (event === 'SessionStart') {
     emitSystemMessage([
       formatPresenceMessage(sessions, sessionId, { includeSolo: true }),
-      formatReceivedMessages(messages),
+      stampReceivedMessages(messages),
     ]);
     return;
   }
@@ -197,18 +272,24 @@ async function main() {
     emitSystemMessage([
       context,
       formatPresenceMessage(sessions, sessionId),
-      formatReceivedMessages(messages),
+      stampReceivedMessages(messages),
     ]);
     return;
   }
   if (event === 'PreToolUse' || event === 'PostToolUse') {
     emitSystemMessage([
       formatConflictWarning(conflicts, event),
-      formatReceivedMessages(messages),
+      stampReceivedMessages(messages),
     ]);
     return;
   }
-  if (messages.length) emitSystemMessage([formatReceivedMessages(messages)]);
+  if (messages.length) emitSystemMessage([stampReceivedMessages(messages)]);
 }
 
-main().catch(() => {}).finally(() => process.exit(0));
+// Run as the hook by default. The ONLY skip is the explicit opt-out flag a
+// hermetic test sets before importing this module for its pure exports —
+// production never sets it (mirrors global-brain-hook.mjs), so runtime
+// behavior is byte-identical.
+if (!process.env.KLYPIX_BRAIN_NO_MAIN) {
+  main().catch(() => {}).finally(() => process.exit(0));
+}

package/src/global-brain-hook.mjs

@@ -40,6 +40,11 @@ const STATE = path.resolve(CWD, '.claude', 'brain-capture-state.json');
 //                · ev: <path[:line]>, <path>, PR#<n> — evidence anchors; file
 //                  paths get their git blob OID stamped so the brief can later
 //                  flag the card when that code drifts.
+//                · verify: <command> — the exact live-probe for a fast-decay
+//                  status claim (build/deploy/release state). Once the claim is
+//                  stale, the status renderer re-prints it as "VERIFY: <cmd>"
+//                  instead of asserting the claim as current. Emit PS-5.1-safe
+//                  commands (no && chaining; use `;` or separate lines).
 const MARKER = /🧠\s*BRAIN\s*(?:\[([^\]]+)\])?\s*([?!✓~+]?)\s*:\s*(.+)$/i;
 const sha = (s) => crypto.createHash('sha1').update(s).digest('hex').slice(0, 16);
 // Numeric semver compare (major.minor.patch; pre-release tags ignored). <0 if
@@ -72,20 +77,25 @@ function parseEvidence(s) {
     }
     return refs.length ? refs : null;
 }
-// Pull optional `closes:` / `ev:` suffixes off the END of a marker body (either
-// order), returning the cleaned body + parsed extras. The suffix region starts
-// at the first " closes:"/" ev:" key, so a decision can carry neither, either,
-// or both without the keywords leaking into the card text.
+// Pull optional `closes:` / `ev:` / `verify:` suffixes off the END of a marker
+// body (any order), returning the cleaned body + parsed extras. The suffix
+// region starts at the first known key, so a decision can carry none, any, or
+// all without the keywords leaking into the card text. The three value regexes
+// must stay in LOCKSTEP: each value ends at the NEXT known key (or end of
+// line), so omitting a key from one lookahead silently folds "verify: …" into
+// that key's value — parseEvidence would mint junk file refs from it.
 function splitMarkerSuffixes(body) {
-    const m = body.match(/\s+(?:closes|ev):/i);
-    if (!m) return { body, closes: '', evidence: null };
+    const m = body.match(/\s+(?:closes|ev|verify):/i);
+    if (!m) return { body, closes: '', evidence: null, verify: '' };
     const suffix = body.slice(m.index);
-    const closesM = suffix.match(/\bcloses:\s*(.+?)\s*(?=\s+\bev:|$)/i);
-    const evM = suffix.match(/\bev:\s*(.+?)\s*(?=\s+\bcloses:|$)/i);
+    const closesM = suffix.match(/\bcloses:\s*(.+?)\s*(?=\s+\bev:|\s+\bverify:|$)/i);
+    const evM = suffix.match(/\bev:\s*(.+?)\s*(?=\s+\bcloses:|\s+\bverify:|$)/i);
+    const verifyM = suffix.match(/\bverify:\s*(.+?)\s*(?=\s+\bcloses:|\s+\bev:|$)/i);
     return {
         body: body.slice(0, m.index).trim(),
         closes: closesM ? closesM[1].trim() : '',
         evidence: evM ? parseEvidence(evM[1].trim()) : null,
+        verify: verifyM ? verifyM[1].trim().slice(0, 200) : '',
     };
 }
 // ── Self-healing brain (decision lifecycle, part 3) ──────────────────────────
@@ -421,8 +431,43 @@ function ownMcpSendTexts(tp) {
         return out;
     } catch { return new Set(); }
 }
+// ── Decay-aware message stamps (2026-07-28 post-mortem, class B) ─────────────
+// A delivered inter-session message is MEMORY, not a SENSOR: a peer's "no
+// TestFlight upload triggered yet" relayed ~12h later read as CURRENT state and
+// produced the third stale-"what is remaining" incident. The ENGINE stamps any
+// delivered message older than 6h whose text asserts fast-decay build/deploy
+// status — the discipline lives in the output contract, never in the reading
+// model's judgment. The classifier lives ONCE in klypix-format.mjs
+// (lib.classifyDecay), consumed behind a typeof guard so an older bundled lib
+// degrades to no stamp — never a throw. The stamp is its OWN line appended
+// AFTER the 400-char render slice (the v1.32.0 law: a warning is never subject
+// to the budget/cut it warns about) and lives in render output only — the lane
+// file is never mutated (dedup + ack key on the RAW message text).
+const MSG_DECAY_STAMP_MS = 6 * 60 * 60 * 1000;
+// classifyDecay is precision-first; mirror that here — only an explicit `true`
+// or an explicitly fast-shaped object stamps. Anything ambiguous does NOT
+// (a false stamp erodes trust in every stamp).
+const isFastDecayResult = (r) => r === true || r === 'fast'
+    || (!!r && typeof r === 'object' && (r.fast === true || r.fastDecay === true || r.decay === 'fast' || r.class === 'fast' || r.kind === 'fast'));
+const msgAgeLabel = (ms) => { const h = Math.floor(ms / 3_600_000); return h >= 48 ? `${Math.floor(h / 24)}d` : `${Math.max(1, h)}h`; };
+function decayStampForMessage(text, ts, now, lib) {
+    try {
+        if (!lib || typeof lib.classifyDecay !== 'function') return '';   // old bundled lib → no stamp, never a throw
+        const t = Number(ts) || 0;
+        const staleMs = Number(lib.DECAY_STALE_MS) > 0 ? Number(lib.DECAY_STALE_MS) : MSG_DECAY_STAMP_MS;   // threshold single-sourced in the engine
+        if (!t || now - t < staleMs) return '';
+        if (!isFastDecayResult(lib.classifyDecay(String(text || '')))) return '';
+        // Wording single-sourced in the engine (lib.decayMessageStamp) so the
+        // renderers can never drift apart; local fallback only for a lib old
+        // enough to have the classifier but not the stamp builder.
+        return typeof lib.decayMessageStamp === 'function'
+            ? lib.decayMessageStamp(now - t)
+            : `⏱️ This message is ${msgAgeLabel(now - t)} old and contains build/deploy status — treat as LAST KNOWN, verify live before reporting it.`;
+    } catch { return ''; }   // stamping is best-effort — a classifier bug must never break delivery
+}
 // Surface unseen messages addressed to me, mark them seen (delivered once) under lock.
-function messageFooter(sid, tp) {
+// `lib` (the loaded klypix-format) is optional — absent/old lib just skips stamps.
+function messageFooter(sid, tp, lib) {
     if (!sid) return '';
     let data = {}; try { data = JSON.parse(fs.readFileSync(SESSIONS_FILE, 'utf8')); } catch { return ''; }
     const all = Array.isArray(data.messages) ? data.messages : [];
@@ -455,7 +500,12 @@ function messageFooter(sid, tp) {
     if (!showUniq.length) return '';
     const ago = (ts) => { const mm = Math.max(0, Math.round((now - (ts || now)) / 60000)); return mm <= 0 ? 'just now' : `${mm}m ago`; };
     const out = ['', '## 📨 Message(s) from another session in this project (delivered once — act on or reply to them)'];
-    for (const m of showUniq.slice(0, 6)) out.push(`- from ${String(m.from || '?').slice(0, 8)} · ${ago(m.ts)}: ${String(m.text).replace(/\s+/g, ' ').trim().slice(0, 400)}`);
+    for (const m of showUniq.slice(0, 6)) {
+        out.push(`- from ${String(m.from || '?').slice(0, 8)} · ${ago(m.ts)}: ${String(m.text).replace(/\s+/g, ' ').trim().slice(0, 400)}`);
+        // Engine-emitted LAST-KNOWN stamp — its own line, after the 400-char slice.
+        const stamp = decayStampForMessage(m.text, m.ts, now, lib);
+        if (stamp) out.push(`  ${stamp}`);
+    }
     out.push('Reply with `🧠 MSG [<their-id or all>]: <text>` — it reaches them on their next prompt.');
     return '\n' + out.join('\n');
 }
@@ -1149,9 +1199,10 @@ async function capture(lib) {
             const m = MARKER.exec(trimmed); if (!m) continue;
             const area = (m[1] || '').trim(), type = m[2] || '';
             let body = m[3].trim(); if (!body) continue;
-            // Strip optional `closes:` / `ev:` suffixes off the body so they don't
-            // leak into the card text; they drive the close-link + evidence below.
-            const { body: cleanBody, closes, evidence } = splitMarkerSuffixes(body);
+            // Strip optional `closes:` / `ev:` / `verify:` suffixes off the body so
+            // they don't leak into the card text; they drive the close-link,
+            // evidence, and live-probe below.
+            const { body: cleanBody, closes, evidence, verify } = splitMarkerSuffixes(body);
             body = cleanBody; if (!body) continue;
             const preview = body.slice(0, 90);
             // EXAMPLE/doc guard — rejects marker-SYNTAX documentation (which
@@ -1183,7 +1234,7 @@ async function capture(lib) {
             // ✓ resolves an EXISTING card (stamped ✅ + archived) — not a new card.
             if (type === '✓') { resolutions.push({ area, text: body }); ledger.push({ action: 'resolve', area, preview }); continue; }
             // ~ updates the matching card in place (small corrections).
-            if (type === '~') { updates.push({ area, text: body, createdVia: 'claude-code', ...(evidence ? { evidence } : {}) }); ledger.push({ action: 'update', area, preview, ...(evidence ? { ev: evidence.map(e => e.ref) } : {}) }); continue; }
+            if (type === '~') { updates.push({ area, text: body, createdVia: 'claude-code', ...(evidence ? { evidence } : {}), ...(verify ? { verify } : {}) }); ledger.push({ action: 'update', area, preview, ...(evidence ? { ev: evidence.map(e => e.ref) } : {}) }); continue; }
             // Type → scannable prefix + border color: ? open question (amber),
             // ! milestone (blue), + skill (violet), else decision (green). A plain
             // decision whose text reads as a reusable RULE is AUTO-promoted to a
@@ -1199,7 +1250,7 @@ async function capture(lib) {
             const fileTags = recentTags.slice(-4).filter(t => t !== areaTag);
             const tagLine = [areaTag, ...fileTags].filter(Boolean).join(' ');
             const card = (area ? `${area}: ${prefix}${body}` : `${prefix}${body}`) + (tagLine ? `\n${tagLine}` : '');
-            cards.push({ text: card, area, borderColor, ...(closes ? { closes } : {}), ...(evidence ? { evidence } : {}) });
+            cards.push({ text: card, area, borderColor, ...(closes ? { closes } : {}), ...(evidence ? { evidence } : {}), ...(verify ? { verify } : {}) });
             ledger.push({ action: type === '?' ? 'add-question' : type === '!' ? 'add-milestone' : isSkill ? 'add-skill' : 'add-decision', area, preview, files: fileTags, ...(closes ? { closes } : {}), ...(evidence ? { ev: evidence.map(e => e.ref) } : {}) });
         }
     }
@@ -1286,7 +1337,7 @@ async function capture(lib) {
     try {
         const merged = readState(); for (const k of seen) merged.add(k);
         const res = await lib.captureIntoBrain(fs.readFileSync(BRAIN), {
-            cards: cards.map(c => ({ text: c.text, color: '#e8e8ed', borderColor: c.borderColor, area: c.area, createdVia: c.createdVia || 'claude-code', ...(c.closes ? { closes: c.closes } : {}), ...(c.evidence ? { evidence: c.evidence } : {}) })),
+            cards: cards.map(c => ({ text: c.text, color: '#e8e8ed', borderColor: c.borderColor, area: c.area, createdVia: c.createdVia || 'claude-code', ...(c.closes ? { closes: c.closes } : {}), ...(c.evidence ? { evidence: c.evidence } : {}), ...(c.verify ? { verify: c.verify } : {}) })),
             resolutions,
             updates,
         });
@@ -1449,7 +1500,7 @@ async function promptRetrieve(lib) {
     // Other live sessions in THIS repo — surfaced even when the prompt retrieves
     // nothing (a peer's presence/ship is itself the signal). Empty string when solo.
     const peers = peerFooter(sid);
-    const messages = messageFooter(sid, input.transcript_path);   // 📨 deliberate notes another session left for me (delivered once)
+    const messages = messageFooter(sid, input.transcript_path, lib);   // 📨 deliberate notes another session left for me (delivered once)
     let hits = [], repeats = [], struct = null;
     if (tokens.length) {
         struct = await cachedStruct(lib);
@@ -1984,7 +2035,7 @@ async function read(lib) {
         + ruleDraftsFooter(input.session_id, struct, { markShown: false })
         + selfCheckFooter() + doctorFooter() + versionCurrencyFooter() + legendFooter() + memoryFooter();
     const emitFull = () => {
-        process.stdout.write(full + messageFooter(input.session_id || '', input.transcript_path));
+        process.stdout.write(full + messageFooter(input.session_id || '', input.transcript_path, lib));
         appendJsonl(HEALTH, { ts: nowIso(), project: path.basename(CWD), mode: 'read', ok: true, briefBytes: Buffer.byteLength(full), cards: struct?.counts?.cards ?? null }, 500);
     };
     // --full = everything to stdout (manual runs); also the fallback when the
@@ -2021,7 +2072,7 @@ async function read(lib) {
     // 📨 messages are delivered-ONCE (acked the moment this reads them) — they
     // go right after the ultra brief, at the top of the visible window, never
     // after a stack of footers that could push them past a preview cut.
-    const messages = messageFooter(input.session_id || '', input.transcript_path);
+    const messages = messageFooter(input.session_id || '', input.transcript_path, lib);
     const out = ultra + messages + healLine + draftLine
         + inflightFooter(input.session_id, struct)
         + selfCheckFooter() + doctorFooter() + versionCurrencyFooter();
@@ -2103,5 +2154,5 @@ if (!process.env.KLYPIX_BRAIN_NO_MAIN) {
 
 // Exported for hermetic unit tests only (gated by KLYPIX_BRAIN_NO_MAIN above so the
 // import doesn't run main()/exit the test). Not part of the runtime hook contract.
-export { refreshNpmCurrency, versionCurrencyFooter, bakedBrainVersion, httpsFetchLatest, cmpSemver };
+export { refreshNpmCurrency, versionCurrencyFooter, bakedBrainVersion, httpsFetchLatest, cmpSemver, decayStampForMessage, messageFooter, splitMarkerSuffixes };
 // (shouldSelfUpdate is exported at its declaration above — the auto-propagation decision seam for tests)

package/src/klypix-core.mjs

@@ -31,6 +31,7 @@ import {
   brainLensData, lensToMarkdown, deathDateOfCard,
   statusContextToMarkdown, findFulfillmentCandidates,
   splitQueryTokens, scoreCardsAgainstQuery, correctionOverlaysFor,
+  isFastDecayCard, DECAY_STALE_MS, formatDecayAge,
 } from './klypix-format.mjs';
 import { findProjectBrain } from './agent-presence.mjs';
 
@@ -482,14 +483,26 @@ export async function opBrainTaskContext({
     const clean = flat(value);
     return clean.length > limit ? `${clean.slice(0, limit - 1)}…` : clean;
   };
+  // Decay-aware status (2026-07-28 post-mortem): a fast-decay build/deploy
+  // claim >6h old is stamped ⏱️ LAST KNOWN at the ENTRY level, so every
+  // brain_sync host (Codex included — this is its only context surface, it
+  // never calls statusContextToMarkdown) gets the warning from the engine,
+  // not from model judgment. Best-effort: classification failure → no stamp.
+  const nowTs = Date.now();
   const entries = hits.map((hit) => {
     const correction = overlays.get(hit.card.id)?.by || null;
+    let decayAge = null;
+    try {
+      const ageMs = (hit.card.createdAt || 0) > 0 ? nowTs - hit.card.createdAt : 0;
+      if (ageMs > DECAY_STALE_MS && isFastDecayCard(hit.card)) decayAge = formatDecayAge(ageMs);
+    } catch { decayAge = null; }
     return {
       id: hit.card.id,
       area: flat(hit.card.area) || 'Notes',
       text: clip(hit.card.text, 420),
       score: Number(hit.score.toFixed(2)),
       correctedBy: correction ? clip(correction.text, 420) : null,
+      ...(decayAge ? { lastKnown: true, age: decayAge } : {}),
     };
   });
   const maxChars = Math.max(800, Math.min(5000, Number(budgetChars) || 2800));
@@ -501,7 +514,11 @@ export async function opBrainTaskContext({
   } else {
     for (const entry of entries) {
       if (entry.correctedBy) lines.push(`- [${entry.area}] CURRENT CORRECTION: ${entry.correctedBy}`);
-      lines.push(`- [${entry.area}]${entry.correctedBy ? ' superseded context:' : ''} ${entry.text}`);
+      // The LAST KNOWN stamp is a PREFIX: the final .slice(0, maxChars) can cut
+      // a line's tail, and the warning must never be the part that gets cut
+      // (v1.32.0 law — a claim may truncate, its warning may not).
+      const stamp = entry.lastKnown ? ` ⏱️ LAST KNOWN (${entry.age} old — verify live before reporting):` : '';
+      lines.push(`- [${entry.area}]${entry.correctedBy ? ' superseded context:' : ''}${stamp} ${entry.text}`);
       if (lines.join('\n').length >= maxChars) break;
     }
     lines.push('This is a bounded start-of-task capsule, not the whole brain; use brain_ask for broad status/history questions.');
@@ -568,6 +585,9 @@ export async function opBrainAsk({ vault, canvas, question, as_of, k = 10, log =
   // STRONG shape only: a work request that merely mentions 'pending'/'TODO'
   // must keep its ranked answer (review fix); the phrase-shaped "what is
   // remaining?" gets the computed section.
+  // Decay-aware stamps (⏱️ LAST KNOWN + VERIFY probe on >6h build/deploy
+  // claims) ride IN the renderer — statusContextToMarkdown stamps internally,
+  // so this call inherits them with no options needed (now defaults inside).
   let statusMd = '';
   if (result.statusStrong && !timeTravel) {
     try { statusMd = statusContextToMarkdown(struct); mode += ' + status-mode'; } catch { statusMd = ''; }

package/src/klypix-format.mjs

@@ -63,6 +63,21 @@ export async function atomicWrite(filePath, buf) {
     catch (e) { try { fs.rmSync(tmp); } catch { /* */ } throw e; }
 }
 
+// ── verify: suffix (decay-aware status, 2026-07-28 post-mortem) ──────────────
+// A card may carry the EXACT live-probe command for its fast-decay claim as a
+// `verify:` suffix ("🏁 build 26 uploaded verify: gh run list --limit 5"), the
+// same marker grammar as closes:/ev: (value runs to the next known key or end
+// of line). The hook strips+persists it as a machine field at capture; cards
+// authored by humans/the app/brain_note keep it in prose — so parseKlypix
+// falls back to a prose parse and every render surface sees ONE `verify` field.
+const VERIFY_SUFFIX_RE = /(?:^|\s)verify:\s*([^\n]+)/i;
+export function parseVerifySuffix(text) {
+    const m = VERIFY_SUFFIX_RE.exec(String(text || ''));
+    if (!m) return null;
+    const v = m[1].split(/\s+\b(?:closes|ev):/i)[0].trim();
+    return v || null;
+}
+
 /**
  * Parse a .klypix/.any buffer into a structured object + the loaded zip (so
  * callers can extract binary assets). Throws on a non-canvas file.
@@ -122,6 +137,11 @@ export async function parseKlypix(buffer) {
             // Evidence anchors (file:line / PR#) with the git blob OID stamped at
             // capture-time — lets the hook flag a card whose cited code drifted.
             evidence: Array.isArray(it.evidence) && it.evidence.length ? it.evidence : null,
+            // Live-probe command for a fast-decay status claim (decay-aware
+            // status): machine field when captured via a verify: marker suffix,
+            // else parsed from prose so non-hook-authored cards count too.
+            verify: (typeof it.verify === 'string' && it.verify.trim()) ? it.verify.trim()
+                : (it.type === 'text' ? parseVerifySuffix(it.content) : null),
             // Machine death-date (epoch ms) written by the gardener at
             // consolidation — the prose "⤵ consolidated" stamp's reliable twin,
             // so as_of time-travel never depends on parsing prose.
@@ -518,6 +538,8 @@ export async function appendIntoContainers(buffer, addition) {
             ...(card.createdVia ? { createdVia: String(card.createdVia) } : {}),
             // Evidence anchors (file:line / PR#) — additive, ignored by older readers.
             ...(Array.isArray(card.evidence) && card.evidence.length ? { evidence: card.evidence } : {}),
+            // Live-probe command for a fast-decay claim — additive, ignored by older readers.
+            ...(typeof card.verify === 'string' && card.verify.trim() ? { verify: card.verify.trim() } : {}),
             content: wrapped, fontSize: G.FONT,
             color: card.color || '#e8e8ed', border: true, borderColor: card.borderColor || card.color || 'rgba(16,185,129,0.45)',
             fillColor: 'rgba(18,18,26,0.85)', heading: !!card.heading, fontFamily: 'Thmanyah Sans',
@@ -1182,7 +1204,15 @@ export function areaStatusDigest(struct, { activeDays = 30, maxAreas = 20, now =
         const miles = cs.filter(isMilestoneCard).sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
         const opens = cs.filter(isOpenCard);
         const m = miles[0];
-        const mileTxt = m ? `last 🏁 ${day(m.createdAt)} “${cut(flat(m.text).replace(/^[^:\n]{1,40}:\s*/, '').replace(/^🏁\s*/, ''), 70)}”` : 'no 🏁 yet';
+        // Decay-aware headline (2026-07-28 post-mortem): a fast-decay milestone
+        // older than DECAY_STALE_MS never leads an area as bare current state.
+        // The engine appends the age + a verify cue — the brief is the one
+        // surface every session reads, and models do not compute ages from the
+        // ISO date on their own (that omission was the exact incident).
+        const mAge = m ? now - (m.createdAt || 0) : 0;
+        const mileStale = m && mAge >= DECAY_STALE_MS && isFastDecayCard(m)
+            ? ` (${formatDecayAge(mAge)} — verify live)` : '';
+        const mileTxt = m ? `last 🏁 ${day(m.createdAt)}${mileStale} “${cut(flat(m.text).replace(/^[^:\n]{1,40}:\s*/, '').replace(/^🏁\s*/, ''), 70)}”` : 'no 🏁 yet';
         rows.push({ newest, line: `- ${area} — ${mileTxt} · ${opens.length} open · latest ${day(newest)}` });
     }
     rows.sort((a, b) => b.newest - a.newest);
@@ -1678,6 +1708,86 @@ export function questionContextToMarkdown(question, result, { mode = 'lexical',
     return out.join('\n') + '\n';
 }
 
+// ── Decay-aware status assertions (2026-07-28 post-mortem, 3rd stale-status ──
+// incident). The brain is a MEMORY, not a SENSOR: for fast-decay facts (what's
+// on TestFlight, what's on npm, whether the rollout flipped) its job is to
+// carry WHERE to look, never assert WHAT is currently true. classifyDecay
+// detects texts that make such assertions so every render surface can stamp
+// them ⏱️ LAST KNOWN instead of presenting them as current state. This moves
+// the "verify before reporting" discipline from model judgment (fails on weak
+// models, occasionally on strong ones) into the engine's output contract.
+//
+// PRECISION OVER RECALL — a missed stamp is the status quo; a false stamp
+// erodes trust in every stamp. A text classifies ONLY when, inside one
+// sentence/line segment (split on .!?\n — NOT ';', the actual incident text
+// was "ready for next TestFlight build; no upload/tag triggered yet"), BOTH:
+//   VERB class — completed-status forms: uploaded / published / released /
+//     deployed / installed / shipped / submitted / staged / flipped /
+//     triggered / rolled out|back / went|is|now live / green — or a
+//     NEGATIVE-pending assertion ("no upload triggered yet", "not yet
+//     published", "awaiting App Store review"), which decays just as fast.
+//   NOUN class — release-shaped subjects: TestFlight / App Store / npm / CI /
+//     release(s) / rollout / build N / vX.Y[.Z] and X.Y.Z version literals.
+// Or the text carries an ev: run/release id ("ev: gh run 16204339183") — a
+// machine receipt is by definition a point-in-time observation.
+// DELIBERATE NON-MATCHES (each is a live false-positive class we tested out):
+//   · bare-infinitive process/architecture prose — "releases go through OIDC
+//     npm publish", "the release pipeline: build → sign → upload" (no
+//     completed verb form; 'publish'/'upload' ≠ 'published'/'uploaded');
+//   · "staged rollout/release/deployment" AND the hyphenated "staged-rollout"
+//     as adjectives (vs "draft staged") — the hyphen form was a live FP on the
+//     real brain's Capabilities card ("staged-rollout auto-updater");
+//   · 'released'/'shipped' with no release noun in the segment — "shipped the
+//     garden fix" is a durable milestone, not a fast-decay build status;
+//   · hyphenated 'live-' adjectives ("live-verified", "live-traced");
+//   · questions/plans about releasing ("should we upload nightly builds?").
+export const DECAY_STALE_MS = 6 * 3_600_000;   // older than this → LAST KNOWN, never current
+const DECAY_VERB_RE = /\b(?:uploaded|published|released|deployed|installed|shipped|submitted|flipped|triggered|green)\b|\bstaged\b(?![\s-]+(?:rollout|rollouts|release[sd]?|deploy\w*|migration\w*|approach))|\brolled[\s-]?(?:out|back)\b|\brolling[\s-]?out\b|\b(?:went|is|are|now|already)\s+live\b|\blive\b(?!-)/i;
+const DECAY_PENDING_RE = /\b(?:not\s+yet|hasn'?t(?:\s+been)?|haven'?t(?:\s+been)?|nothing(?:\s+has)?(?:\s+been)?|never)\s+(?:been\s+)?(?:uploaded|published|released|deployed|installed|shipped|triggered|tagged|submitted|gone\s+live)\b|\bno\s+(?:\w+[\s/-]+){0,2}?(?:upload|publish|deploy|release|install|build|tag|rollout)[\w/-]*(?:\s+\S+){0,3}?\s+(?:yet|so\s+far|triggered|started|fired|happened)\b|\b(?:awaiting|waiting\s+(?:for|on)|pending)\s+(?:apple|app\s?store|testflight|review|approval|upload|release|rollout)\b/i;
+const DECAY_NOUN_RE = /\btest\s?flight\b|\bapp\s?store\b|\bnpm\b|\bci\b|\brelease(?:s)?\b|\brollout(?:s)?\b|\bbuild\s*#?\s*\d+\b|\bv\d+(?:\.\d+)+\b|\b\d+\.\d+\.\d+\b/i;
+const DECAY_EVRUN_RE = /\bev:\s*[^\n]{0,60}?\b(?:run|workflow|release|build|rollout|deploy)[a-z-]*\s*[#:/]?\s*\d{3,}/i;
+export function classifyDecay(text) {
+    const t = String(text || '');
+    if (!t.trim()) return false;
+    if (DECAY_EVRUN_RE.test(t)) return true;
+    // A '.' only ends a segment when followed by whitespace/end — a bare-dot
+    // split shredded version literals ("1.3.28 live" became "1"/"3"/"28 live"
+    // and the noun never met its verb).
+    for (const seg of t.split(/[\n!?]+|\.(?=\s|$)/)) {
+        if (!seg.trim()) continue;
+        if (DECAY_NOUN_RE.test(seg) && (DECAY_VERB_RE.test(seg) || DECAY_PENDING_RE.test(seg))) return true;
+    }
+    return false;
+}
+// A struct card decays if its TEXT classifies, or its machine evidence carries
+// a run/release-shaped receipt (the ev: suffix is stripped from hook-captured
+// prose, so the text alone can't see it).
+export const isFastDecayCard = (c) => classifyDecay(c?.text)
+    || (Array.isArray(c?.evidence) && c.evidence.some(e => DECAY_EVRUN_RE.test('ev: ' + String(e?.ref || ''))));
+// Compact age for stamps ("20h", "3d") — both message renderers show minutes
+// only, which reads as noise at 12h+ ("720m ago").
+export const formatDecayAge = (ms) => {
+    const h = Math.floor(Math.max(0, ms) / 3_600_000);
+    if (h < 1) return `${Math.max(1, Math.floor(Math.max(0, ms) / 60_000))}m`;
+    return h < 48 ? `${h}h` : `${Math.floor(h / 24)}d`;
+};
+// The live-probe to print after a LAST KNOWN claim: the card's own verify:
+// command wins; else a per-area default; else a generic re-verify line.
+// Emitted probes must be PS-5.1-safe: ';' separators, never '&&'.
+export function decayVerifyProbe(card) {
+    const v = typeof card?.verify === 'string' && card.verify.trim() ? card.verify.trim() : null;
+    if (v) return v;
+    const a = String(card?.area || '').toLowerCase();
+    if (/release|app\s?store|appstore|\bios\b|testflight|ship|deploy|rollout/.test(a)) return 'gh run list --limit 5; gh release list --limit 5';
+    if (/drive|admin/.test(a)) return 'probe the live prod endpoint (HTTP) before reporting';
+    return 're-verify live before reporting this as current';
+}
+// Engine-emitted stamp for a delivered inter-session message (class B of the
+// post-mortem taxonomy) — EXACT wording from the brief, single-sourced here so
+// the Claude-hook and agent-presence renderers can never drift apart.
+export const decayMessageStamp = (ageMs) =>
+    `⏱️ This message is ${formatDecayAge(ageMs)} old and contains build/deploy status — treat as LAST KNOWN, verify live before reporting it.`;
+
 // ── Status mode (T7, 2026-07-23) — the computed answer for status questions ──
 // "What is remaining?" must be answered from STATE, not lexical matching:
 // status vocabulary is anti-correlated with truth (cards saying "remaining"
@@ -1688,10 +1798,24 @@ export function questionContextToMarkdown(question, result, { mode = 'lexical',
 // maxOpen defaults to NO cap: the open list is the answer to a status question,
 // so it is sized to fit (per-card width adapts) rather than sliced. Callers can
 // still pass a cap explicitly.
-export function statusContextToMarkdown(struct, { maxOpen = Infinity, budgetChars = 4200 } = {}) {
+export function statusContextToMarkdown(struct, { maxOpen = Infinity, budgetChars = 4200, now = Date.now() } = {}) {
     if (!struct || !Array.isArray(struct.cards)) return '';
     const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
     const day = (ts) => ts ? new Date(ts).toISOString().slice(0, 10) : '';
+    // ⏱️ LAST KNOWN (decay-aware status, 2026-07-28): a fast-decay claim older
+    // than 6h renders as last-known observation + live probe, NEVER as current
+    // state. The stamp scaffolding lives OUTSIDE cut() and rides pushAlways —
+    // the v1.32.0 law: a warning is never subject to the budget/width it warns
+    // about, so a crowded brain can shorten the CLAIM but never the WARNING.
+    // best-effort try: a malformed card must degrade to an unstamped line, not
+    // take down the whole status section (opBrainAsk catch would eat it all).
+    const decayStamp = (c) => {
+        try {
+            const age = (c.createdAt || 0) > 0 ? now - c.createdAt : 0;
+            if (age <= DECAY_STALE_MS || !isFastDecayCard(c)) return null;
+            return { age: formatDecayAge(age), probe: decayVerifyProbe(c) };
+        } catch { return null; }
+    };
     const isArchived = (c) => /^archive$/i.test(c.area || '');
     const live = struct.cards.filter(c => c.type !== 'container' && (c.text || '').trim() && !isArchived(c));
     const out = [];
@@ -1750,7 +1874,9 @@ export function statusContextToMarkdown(struct, { maxOpen = Infinity, budgetChar
         for (const c of top) {
             if (used > budgetChars) break;
             const flags = `${overdueById.has(c.id) ? ' ⏰OVERDUE' : ''}${overlays.has(c.id) ? ' ⚠️CORRECTED' : ''}${fulfills.has(c.id) ? ' ⏳likely-fulfilled' : ''}`;
-            pushAlways(`- [${flat(c.area) || 'Notes'}]${flags} ${cut(flat(c.text), perCard)}`);
+            const d = decayStamp(c);
+            if (d) pushAlways(`- [${flat(c.area) || 'Notes'}]${flags} ⏱️ LAST KNOWN (${d.age}): ${cut(flat(c.text), perCard)} — VERIFY: ${d.probe}`);
+            else pushAlways(`- [${flat(c.area) || 'Notes'}]${flags} ${cut(flat(c.text), perCard)}`);
             shown++;
         }
         if (shown < opens.length) pushAlways(`- ⚠️ …and ${opens.length - shown} more open item(s) — this list is NOT complete; call brain_ask before reporting what remains.`);
@@ -1759,7 +1885,11 @@ export function statusContextToMarkdown(struct, { maxOpen = Infinity, budgetChar
     if (miles.length) {
         pushAlways('');
         pushAlways('## Newest milestones');
-        for (const m of miles.slice(0, 3)) pushAlways(`- [${flat(m.area) || '?'}] ${day(m.createdAt)} ${cut(flat(m.text), 130)}`);
+        for (const m of miles.slice(0, 3)) {
+            const d = decayStamp(m);
+            if (d) pushAlways(`- [${flat(m.area) || '?'}] ${day(m.createdAt)} ⏱️ LAST KNOWN (${d.age}): ${cut(flat(m.text), 130)} — VERIFY: ${d.probe}`);
+            else pushAlways(`- [${flat(m.area) || '?'}] ${day(m.createdAt)} ${cut(flat(m.text), 130)}`);
+        }
     }
     pushAlways('');
     return out.join('\n') + '\n';
@@ -2870,13 +3000,14 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
                     // Self-heal: a ~ update re-stamps the evidence (fresh OID +
                     // verifiedAt), so confirming/correcting a drifted fact marks it ✅.
                     if (Array.isArray(u.evidence) && u.evidence.length) j.evidence = u.evidence;
+                    if (typeof u.verify === 'string' && u.verify.trim()) j.verify = u.verify.trim();
                 });
                 best.text = isTerseConfirm ? `${best.text}\n(re-affirmed ${today}: ${u.text})` : u.text;
                 stats.updated++;
             } else if (!nearDupExists(u.text)) {
                 // ~ fallback add is guarded like ✓'s: an unmatched ~ re-harvested
                 // from the transcript tail must not stack a copy every turn.
-                cards.push({ text: (u.area ? `${u.area}: ` : '') + u.text + (u.area ? `\n#${u.area.toLowerCase().replace(/[^a-z0-9]+/g, '-')}` : ''), area: u.area, createdVia: u.createdVia, ...(Array.isArray(u.evidence) && u.evidence.length ? { evidence: u.evidence } : {}) });
+                cards.push({ text: (u.area ? `${u.area}: ` : '') + u.text + (u.area ? `\n#${u.area.toLowerCase().replace(/[^a-z0-9]+/g, '-')}` : ''), area: u.area, createdVia: u.createdVia, ...(Array.isArray(u.evidence) && u.evidence.length ? { evidence: u.evidence } : {}), ...(typeof u.verify === 'string' && u.verify.trim() ? { verify: u.verify.trim() } : {}) });
             }
         }
 
@@ -2901,6 +3032,7 @@ export async function captureIntoBrain(buffer, { cards = [], resolutions = [], u
                     j.createdAt = now;
                     if (card.createdVia) j.createdVia = String(card.createdVia);
                     if (Array.isArray(card.evidence) && card.evidence.length) j.evidence = card.evidence;
+                    if (typeof card.verify === 'string' && card.verify.trim()) j.verify = card.verify.trim();
                 });
                 best.text = String(card.text);
                 cards.splice(i, 1);
@@ -3561,17 +3693,17 @@ export function findOverdueOpenCards(struct, { now = Date.now() } = {}) {
 // (milestone) | '✓' (resolve+archive a match) | '~' (update a match in place) |
 // '+' (skill — a REUSABLE how-to/gotcha/procedure, standing reference that always
 // surfaces and never ages out, distinct from a point-in-time decision).
-export function noteToCaptureInput({ text = '', area = '', marker = '', closes = '', evidence = null, createdVia = 'mcp' } = {}) {
+export function noteToCaptureInput({ text = '', area = '', marker = '', closes = '', evidence = null, verify = null, createdVia = 'mcp' } = {}) {
     const body = String(text).trim();
     if (!body) return { cards: [], resolutions: [], updates: [] };
     const a = String(area || '').trim();
     if (marker === '✓') return { cards: [], resolutions: [{ area: a, text: body }], updates: [] };
-    if (marker === '~') return { cards: [], resolutions: [], updates: [{ area: a, text: body, createdVia, ...(evidence ? { evidence } : {}) }] };
+    if (marker === '~') return { cards: [], resolutions: [], updates: [{ area: a, text: body, createdVia, ...(evidence ? { evidence } : {}), ...(verify ? { verify } : {}) }] };
     const prefix = marker === '?' ? '❓ ' : marker === '!' ? '🏁 ' : marker === '+' ? '🛠️ ' : '';
     const borderColor = marker === '?' ? 'rgba(245,166,35,0.8)' : marker === '!' ? 'rgba(59,130,246,0.8)' : marker === '+' ? 'rgba(139,92,246,0.85)' : 'rgba(16,185,129,0.6)';
     const tag = a ? `\n#${a.toLowerCase().replace(/[^a-z0-9]+/g, '-')}` : '';
     const cardText = (a ? `${a}: ${prefix}${body}` : `${prefix}${body}`) + tag;
-    return { cards: [{ text: cardText, area: a, color: '#e8e8ed', borderColor, createdVia, ...(closes ? { closes } : {}), ...(evidence ? { evidence } : {}) }], resolutions: [], updates: [] };
+    return { cards: [{ text: cardText, area: a, color: '#e8e8ed', borderColor, createdVia, ...(closes ? { closes } : {}), ...(evidence ? { evidence } : {}), ...(verify ? { verify } : {}) }], resolutions: [], updates: [] };
 }
 
 /**

package/src/mcp-presence.mjs

@@ -12,6 +12,7 @@ import {
   findProjectBrain,
   formatPresenceMessage,
   formatReceivedMessages,
+  messageDecayInfo,
   peekMessages,
   postPresenceMessage,
   receiveMessages,
@@ -191,6 +192,14 @@ export function createMcpPresence({
   now = () => Date.now(),
   setIntervalFn = setInterval,
   clearIntervalFn = clearInterval,
+  // Decay-aware LAST-KNOWN stamps (2026-07-28 post-mortem, class B): the
+  // injected engine surface ({ classifyDecay, decayStaleMs, decayMessageStamp,
+  // formatDecayAge } from klypix-format.mjs) that lets every MCP delivery
+  // surface — pollInbox logging, touch/decorateToolResult notices, brain_sync
+  // text + structured messages — stamp a stale build/deploy message as LAST
+  // KNOWN. Injection (not an import) keeps this file builtin-only; absent or
+  // partial (old bundle), delivery degrades to unstamped — never a throw.
+  decay = {},
 } = {}) {
   const sessionId = resolveMcpSessionId({ env });
   const effectiveInboxPollMs = Number(env?.KLYPIX_MCP_INBOX_POLL_MS)
@@ -241,7 +250,7 @@ export function createMcpPresence({
       now: now(),
     }).filter((message) => !announcedMessageIds.has(message.id));
     if (!pending.length) return [];
-    if (sendNotice(formatReceivedMessages(pending, now()))) {
+    if (sendNotice(formatReceivedMessages(pending, now(), decay))) {
       for (const message of pending) announcedMessageIds.add(message.id);
       while (announcedMessageIds.size > 100) {
         announcedMessageIds.delete(announcedMessageIds.values().next().value);
@@ -296,7 +305,7 @@ export function createMcpPresence({
       : '';
     const notice = [
       presence,
-      formatReceivedMessages(messages, stamp),
+      formatReceivedMessages(messages, stamp, decay),
     ].filter(Boolean).join('\n\n');
     if (notice) sendNotice(notice);
     return { sessions, messages, notice };
@@ -428,7 +437,7 @@ export function createMcpPresence({
       ].join('\n')
       : 'No exact file overlap is currently reported by another synchronized task.';
     const durationMs = Math.max(0, Date.now() - syncStartedAt);
-    const messagesText = formatReceivedMessages(report.messages, stamp);
+    const messagesText = formatReceivedMessages(report.messages, stamp, decay);
     const structured = {
       schemaVersion: 1,
       status: completing ? 'complete' : 'active',
@@ -443,12 +452,19 @@ export function createMcpPresence({
       },
       peers: snapshot.peers,
       conflicts,
-      messages: report.messages.map((message) => ({
-        id: message.id,
-        from: message.from,
-        text: message.text,
-        ts: message.ts,
-      })),
+      messages: report.messages.map((message) => {
+        // Raw structured path gets the same decay verdict as the rendered
+        // text: a consumer reading structured.messages directly must see the
+        // LAST-KNOWN marking, not re-derive it (additive fields, schema 1).
+        const decayInfo = messageDecayInfo(message, stamp, decay);
+        return {
+          id: message.id,
+          from: message.from,
+          text: message.text,
+          ts: message.ts,
+          ...(decayInfo ? { lastKnown: true, age: decayInfo.age, stampText: decayInfo.stampText } : {}),
+        };
+      }),
       alertsQueued,
       delivery: {
         proactive: 'mcp-logging-best-effort',