klypix-mcp 1.41.0 → 1.43.0

package/bin/klypix-conformance.mjs

@@ -57,6 +57,15 @@ fs.writeFileSync(path.join(vault, 'brain.klypix'), await buildKlypixMap({
 const baseEnv = Object.fromEntries(
   Object.entries(process.env).filter(([, value]) => typeof value === 'string'),
 );
+// The harness simulates two INDEPENDENT hosts. When it itself runs inside an
+// agent session (Claude Code exports CLAUDE_PID + CLAUDE_CODE_SESSION_ID to
+// children), both simulated clients would inherit the SAME host identity and
+// be correctly treated as one session's twin halves — failing every two-client
+// check. Strip host/session identity; each client gets its own KLYPIX_SESSION_ID.
+for (const key of [
+  'CLAUDE_PID', 'KLYPIX_HOST_PID', 'CLAUDE_CODE_SESSION_ID', 'CLAUDE_SESSION_ID',
+  'CODEX_THREAD_ID', 'CURSOR_SESSION_ID', 'CLINE_SESSION_ID', 'WINDSURF_SESSION_ID',
+]) delete baseEnv[key];
 
 async function connect(name, sessionId) {
   const logs = [];

package/bin/klypix-worker.mjs

@@ -329,6 +329,24 @@ server.registerTool('brain_sync', {
 }, async ({ project, intent, files, phase, include_context }) => {
   const totalStartedAt = Date.now();
   const report = mcpPresence.sync({ project, intent, files, phase });
+  // Class-C ship observation, host-neutral: brain_sync is the ONE surface every
+  // MCP host calls at task start, so an MCP-only project (no Claude/Codex hook)
+  // still notices a release nobody narrated. Queued here, drained at the next
+  // brain write. Zero network, ~2 cheap git/fs reads, never throws.
+  let shipNotice = '';
+  if (phase === 'start') {
+    try {
+      const dir = project ? path.resolve(project) : mcpPresence.vault;
+      if (typeof brainFormat.observeShipDrift === 'function' && dir) {
+        const { execFileSync } = await import('child_process');
+        shipNotice = brainFormat.observeShipDrift(dir, {
+          gitRun: (args) => execFileSync('git', String(args).split(/\s+/).filter(Boolean), {
+            cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 4000,
+          }),
+        }).notice || '';
+      }
+    } catch { /* observation is best-effort — never fail a sync */ }
+  }
   let taskContext = null;
   if (phase !== 'complete' && include_context !== false && (intent || files?.length)) {
     taskContext = await opBrainTaskContext({
@@ -368,7 +386,7 @@ server.registerTool('brain_sync', {
   return {
     content: [{
       type: 'text',
-      text: [report.text, contextText, timingText].filter(Boolean).join('\n\n'),
+      text: [report.text, shipNotice, contextText, timingText].filter(Boolean).join('\n\n'),
     }],
     structuredContent,
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klypix-mcp",
-  "version": "1.41.0",
+  "version": "1.43.0",
   "description": "Every project gets a brain — one open .klypix file your AI agents read, write, and argue from, over MCP. Works with Claude, Codex, Cursor, Cline, any model.",
   "type": "module",
   "license": "Apache-2.0",
@@ -58,7 +58,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/mcp-auto-update.mjs && node test/mcp-supervisor.mjs && node test/codex-hooks.mjs && node test/agent-presence.mjs && node test/context-gateway.mjs && node test/conformance.mjs && node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/canvas-view.mjs && node test/status-completeness.mjs && node test/semantic-gate.mjs && node test/decay-status.mjs && node test/decay-hook.mjs"
+    "test": "node test/mcp-auto-update.mjs && node test/mcp-supervisor.mjs && node test/codex-hooks.mjs && node test/agent-presence.mjs && node test/context-gateway.mjs && node test/conformance.mjs && node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/canvas-view.mjs && node test/status-completeness.mjs && node test/semantic-gate.mjs && node test/decay-status.mjs && node test/decay-hook.mjs && node test/presence-visibility.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.7.4",

package/src/agent-presence.mjs

@@ -113,6 +113,29 @@ function pruneMessages(messages, now) {
     .filter((message) => message?.id && now - Number(message.ts || 0) < MESSAGE_FRESH_MS);
 }
 
+// Cap the message lane WITHOUT silently destroying undelivered notes: the old
+// flat `.slice(-30)` evicted the OLDEST rows first regardless of delivery, so a
+// burst of >30 messages could destroy a note nobody had seen yet. Evict
+// delivered (seen-by-someone) messages first, oldest first; only then the
+// oldest undelivered ones. Order of survivors is preserved.
+export function capMessages(messages, cap = 30) {
+  const list = Array.isArray(messages) ? messages : [];
+  if (list.length <= cap) return list;
+  let excess = list.length - cap;
+  const dropped = new Set();
+  const evict = (predicate) => {
+    for (const message of list) {
+      if (!excess) return;
+      if (dropped.has(message) || !predicate(message)) continue;
+      dropped.add(message);
+      excess--;
+    }
+  };
+  evict((m) => Array.isArray(m?.seen) && m.seen.length > 0);   // delivered at least once
+  evict(() => true);                                            // still over cap → oldest of the rest
+  return list.filter((message) => !dropped.has(message));
+}
+
 function normalizeFiles(files) {
   const seen = new Set();
   const out = [];
@@ -140,11 +163,13 @@ export function upsertSession({
   permissionMode = null,
   branch = null,
   intent,
+  intentSource = null,
   files,
   replaceFiles = false,
   event = null,
   channel = null,
   cwd = null,
+  hostPid = null,
   home,
   now = Date.now(),
 }) {
@@ -162,6 +187,14 @@ export function upsertSession({
     const mergedFiles = files === undefined
       ? normalizeFiles(previous.files)
       : normalizeFiles(replaceFiles ? files : [...(previous.files || []), ...(files || [])]);
+    // Intent freshness is its OWN timestamp: lastSeen is refreshed by heartbeats
+    // that never touch intent, so without intentAt a 100-minute-old intent renders
+    // under "active just now" (2026-07-29 audit). Stamped only when the intent
+    // VALUE actually changes; additive — old rows/readers are unaffected.
+    const nextIntent = intent !== undefined
+      ? String(intent || '').replace(/\s+/g, ' ').trim().slice(0, 160)
+      : (previous.intent || '');
+    const intentChanged = intent !== undefined && nextIntent !== (previous.intent || '');
     const next = {
       ...previous,
       id: String(id),
@@ -172,13 +205,19 @@ export function upsertSession({
       model: model ?? previous.model ?? null,
       permissionMode: permissionMode ?? previous.permissionMode ?? null,
       branch: branch ?? previous.branch ?? null,
-      intent: intent !== undefined ? String(intent || '').replace(/\s+/g, ' ').trim().slice(0, 160) : (previous.intent || ''),
+      intent: nextIntent,
+      ...(intentChanged ? { intentAt: now, intentSource: intentSource || 'declared' }
+        : (previous.intentAt ? { intentAt: previous.intentAt, intentSource: previous.intentSource || null } : {})),
       files: mergedFiles,
       event: event ?? previous.event ?? null,
       ...(Object.keys(channelSeen).length
         ? { channels: Object.keys(channelSeen), channelSeen }
         : {}),
       cwd: cwd ? path.resolve(cwd) : (previous.cwd || path.dirname(brainPath)),
+      // Host-process correlation (e.g. Claude Code exports CLAUDE_PID to every
+      // child): lets readers recognize one logical session's lifecycle row and
+      // MCP row as TWINS instead of two independent peers.
+      hostPid: Number(hostPid) || previous.hostPid || null,
       startedAt: previous.startedAt || now,
       lastSeen: now,
     };
@@ -188,7 +227,7 @@ export function upsertSession({
     fs.writeFileSync(laneFile, JSON.stringify({
       ...data,
       sessions: kept.slice(-40),
-      messages: pruneMessages(data.messages, now).slice(-30),
+      messages: capMessages(pruneMessages(data.messages, now), 30),
     }));
     return kept.sort((a, b) => Number(b.lastSeen || 0) - Number(a.lastSeen || 0));
   } finally {
@@ -226,7 +265,7 @@ export function removeSession({ brainPath, id, channel = null, home, now = Date.
     fs.writeFileSync(laneFile, JSON.stringify({
       ...data,
       sessions,
-      messages: pruneMessages(data.messages, now).slice(-30),
+      messages: capMessages(pruneMessages(data.messages, now), 30),
     }));
     return sessions;
   } finally {
@@ -271,24 +310,45 @@ export function receiveMessages({
       && messageTargetsSession(message, me, sessionId));
     if (!unseen.length) return [];
 
-    const unseenIds = new Set(unseen.map((message) => message.id));
-    for (const message of messages) {
-      if (!unseenIds.has(message.id)) continue;
-      if (!Array.isArray(message.seen)) message.seen = [];
-      if (!message.seen.includes(sessionId)) message.seen.push(sessionId);
-    }
-    fs.writeFileSync(laneFile, JSON.stringify({ ...data, sessions, messages }));
-
+    // Deliver-then-ack, never ack-then-truncate: the old path acked EVERY unseen
+    // message under lock but returned only the first 6 — anything past the cap
+    // was marked seen without ever being shown, permanently lost under the
+    // delivered-once contract (2026-07-29 audit). Ack exactly: the delivered 6,
+    // plus self-ignored texts and text-duplicates OF a delivered message (their
+    // content was shown once via the twin). Overflow stays unacked and arrives
+    // on the next call.
+    const normText = (message) => String(message.text || '').replace(/\s+/g, ' ').trim().toLowerCase();
     const ignored = new Set(ignoreTexts.map((text) => String(text || '').replace(/\s+/g, ' ').trim().toLowerCase()));
     const shown = [];
+    const dropped = [];   // ignored (own sends) — content intentionally never shown
     const seenText = new Set();
+    const dupesByText = new Map();
     for (const message of unseen) {
-      const key = String(message.text || '').replace(/\s+/g, ' ').trim().toLowerCase();
-      if (!key || ignored.has(key) || seenText.has(key)) continue;
+      const key = normText(message);
+      if (!key || ignored.has(key)) { dropped.push(message); continue; }
+      if (seenText.has(key)) {
+        if (!dupesByText.has(key)) dupesByText.set(key, []);
+        dupesByText.get(key).push(message);
+        continue;
+      }
       seenText.add(key);
       shown.push(message);
     }
-    return shown.slice(0, 6);
+    const delivered = shown.slice(0, 6);
+    const ackIds = new Set(delivered.map((message) => message.id));
+    for (const message of dropped) ackIds.add(message.id);
+    for (const message of delivered) {
+      for (const dupe of dupesByText.get(normText(message)) || []) ackIds.add(dupe.id);
+    }
+    if (ackIds.size) {
+      for (const message of messages) {
+        if (!ackIds.has(message.id)) continue;
+        if (!Array.isArray(message.seen)) message.seen = [];
+        if (!message.seen.includes(sessionId)) message.seen.push(sessionId);
+      }
+      fs.writeFileSync(laneFile, JSON.stringify({ ...data, sessions, messages }));
+    }
+    return delivered;
   } finally {
     if (gotLock) releaseLock(lockFile);
   }
@@ -368,7 +428,7 @@ export function postPresenceMessage({
     fs.writeFileSync(laneFile, JSON.stringify({
       ...data,
       sessions,
-      messages: messages.slice(-30),
+      messages: capMessages(messages, 30),
     }));
     return { posted: true, message };
   } finally {
@@ -405,15 +465,22 @@ export function formatPresenceMessage(sessions, selfId, { includeSolo = false, n
   lines.push('Other active sessions:');
   for (const session of others.slice(0, 8)) {
     const ageMin = Math.max(0, Math.round((now - Number(session.lastSeen || now)) / 60_000));
+    // A heartbeat refreshes lastSeen while carrying an old intent forward — show
+    // the INTENT's own age when it meaningfully lags the heartbeat, so a
+    // 100-minute-old task line can never read as "what they're doing right now".
+    const intentAgeMin = session.intentAt ? Math.max(0, Math.round((now - Number(session.intentAt)) / 60_000)) : null;
+    const intentAge = intentAgeMin !== null && intentAgeMin - ageMin > 3 ? ` (intent set ${intentAgeMin}m ago)` : '';
     const details = [
       clientLabel(session),
       session.branch ? `branch ${session.branch}` : null,
-      session.intent ? `"${String(session.intent).slice(0, 90)}"` : null,
+      session.intent ? `"${String(session.intent).slice(0, 90)}"${intentAge}` : null,
       `${ageMin}m ago`,
     ].filter(Boolean);
     lines.push(`- ${String(session.id).slice(0, 8)}: ${details.join(' | ')}`);
   }
-  lines.push('Coordinate before touching shared files; use brain_message for a targeted note.');
+  // v1.32.0 law: a truncated list must never render as a complete one.
+  if (others.length > 8) lines.push(`- …and ${others.length - 8} more live session(s) not listed — brain_doctor shows all.`);
+  lines.push(`Presence is point-in-time (as of ${new Date(now).toISOString().slice(11, 16)}Z) — re-check before coordinating; use brain_message for a targeted note.`);
   return lines.join('\n');
 }
 

package/src/agent-rules.mjs

@@ -521,8 +521,15 @@ function classifyFenced(file, version, frontmatter = null) {
   const raw = fs.readFileSync(file, 'utf8');
   const fence = parseFence(raw);
   if (!fence) return { status: 'missing' };
-  if (fence.hash && sha8(fence.body.trim()) !== fence.hash) return { status: 'hand-edited', stampedVersion: fence.version };
-  const bodyCurrent = sha8(fence.body.trim()) === INSTRUCTIONS_HASH;
+  // Normalize CRLF before hashing (matching norm() in the frontmatter branch
+  // below): the stamped hash is always computed from the LF-only canonical
+  // instructions, so a git-autocrlf checkout or CRLF-saving editor flipped
+  // EVERY projected file to hand-edited at once — the destructive-repair class
+  // — when the true status was a losslessly healable 'stale' (2026-07-29 audit,
+  // the likely cause of "9/14 HAND-EDITED at the same stamp").
+  const bodyHash = sha8(fence.body.replace(/\r\n/g, '\n').trim());
+  if (fence.hash && bodyHash !== fence.hash) return { status: 'hand-edited', stampedVersion: fence.version };
+  const bodyCurrent = bodyHash === INSTRUCTIONS_HASH;
   const stampConsistent = !fence.hash || fence.hash === INSTRUCTIONS_HASH;
   if (bodyCurrent && stampConsistent) {
     // Owned dedicated files are OURS wholesale — frontmatter included. Compare the
@@ -541,11 +548,20 @@ function classifyFenced(file, version, frontmatter = null) {
 
 // Shared markdown (AGENTS.md, copilot-instructions.md, GEMINI.md): merge our fenced
 // block in place, preserving the user's own prose outside the fence.
+// A hand-edited file is about to be rebuilt wholesale — keep the human's version.
+// One rolling .klypix-bak per file (repair stops being an all-or-nothing choice).
+function backupHandEdited(file, status) {
+  if (status !== 'hand-edited' || !exists(file)) return;
+  try { fs.copyFileSync(file, file + '.klypix-bak'); } catch { /* best-effort */ }
+}
+
 function fenceMerge(file, version) {
   // Zero-touch IFF the audit says 'ok' (same classifier, so check and write can
   // never disagree): current+consistent block → byte-identical file, no stamp-only
   // churn; a hand-edited stamp or stale body falls through and gets rebuilt.
-  if (classifyFenced(file, version).status === 'ok') return { action: 'unchanged' };
+  const status = classifyFenced(file, version).status;
+  if (status === 'ok') return { action: 'unchanged' };
+  backupHandEdited(file, status);
   let cur = '';
   let had = false;
   if (exists(file)) { cur = fs.readFileSync(file, 'utf8'); had = true; }
@@ -564,7 +580,9 @@ function fenceMerge(file, version) {
 function writeDedicated(file, frontmatter, version) {
   // Zero-touch IFF the audit says 'ok' — which for owned dedicated files includes
   // the frontmatter (a stripped alwaysApply/trigger MUST be repaired, not skipped).
-  if (classifyFenced(file, version, frontmatter || '').status === 'ok') return { action: 'unchanged' };
+  const status = classifyFenced(file, version, frontmatter || '').status;
+  if (status === 'ok') return { action: 'unchanged' };
+  backupHandEdited(file, status);
   const had = exists(file);
   const body = (frontmatter ? frontmatter + '\n' : '') + fencedBlock(version) + '\n';
   ensureDir(file); fs.writeFileSync(file, body, 'utf8');

package/src/brain-doctor.mjs

@@ -183,6 +183,11 @@ function inspectRunning(brainDir, baked, now, self) {
 }
 
 // ── PEERS (alignment) layer ──────────────────────────────────────────────────
+// A supervisor with a live pid can still be a ZOMBIE: recovery-failed means it
+// has NO worker and every queued host request hangs — the pid-alive check alone
+// rendered exactly that state as "✅ SUPERVISOR N live" (2026-07-29 audit,
+// field pid 12312 exit 0xC0000142). These statuses mean the transport is
+// impaired regardless of process liveness.
 function inspectSupervisors(brainDir, baked) {
   const dir = path.join(brainDir, '.supervisors');
   let names = [];
@@ -191,9 +196,15 @@ function inspectSupervisors(brainDir, baked) {
   for (const name of names) {
     const state = readJson(path.join(dir, name), null);
     if (!state?.pid || !isAlivePid(state.pid)) continue;
+    const status = state.status || 'unknown';
     live.push({
       pid: state.pid,
-      status: state.status || 'unknown',
+      status,
+      // IMPAIRED = no live worker outside the normal boot window: tool calls
+      // hang/fail. 'restart-required' with a live active worker is DEGRADED
+      // (an update was rejected, the old worker keeps serving) — flagging that
+      // red as "tool calls hang" would be factually wrong (review-caught).
+      impaired: !state.active && status !== 'starting' && status !== 'awaiting-initialize',
       activePid: state.active?.pid || null,
       activeVersion: state.active?.version || null,
       hotReloads: Number(state.hotReloads || 0),
@@ -205,29 +216,60 @@ function inspectSupervisors(brainDir, baked) {
     active: live.length > 0,
     count: live.length,
     live,
+    impaired: live.filter(state => state.impaired),
     matchesInstalled: live.length && baked
       ? live.every(state => state.activeVersion && cmpSemver(state.activeVersion, baked) === 0)
       : null,
   };
 }
 
+// Channel-aware liveness, mirroring agent-presence.mjs: an mcp-channel heartbeat
+// is dead after 3 minutes even though the flat 10-minute window keeps the row —
+// without this the hook, brain_sync, and doctor reported three different counts.
+const MCP_SESSION_FRESH_MS = 3 * 60 * 1000;
+const sessionLiveness = (s, now) => {
+  const channelSeen = (s?.channelSeen && typeof s.channelSeen === 'object' && !Array.isArray(s.channelSeen)) ? s.channelSeen : null;
+  if (channelSeen && Object.keys(channelSeen).length) {
+    const fresh = Object.entries(channelSeen)
+      .filter(([ch, seen]) => ch && now - Number(seen || 0) < (ch === 'mcp' ? MCP_SESSION_FRESH_MS : SESSION_FRESH_MS));
+    if (!fresh.length) return null;
+    return { lastSeen: Math.max(...fresh.map(([, seen]) => Number(seen))), channels: fresh.map(([ch]) => ch) };
+  }
+  const lastSeen = Number(s?.lastSeen || 0);
+  return now - lastSeen < SESSION_FRESH_MS ? { lastSeen, channels: Array.isArray(s?.channels) ? s.channels : [] } : null;
+};
+
 function inspectPeers(brainDir, brainPath, now) {
   const file = path.join(brainDir, 'sessions', `${sha(normBrainPath(brainPath))}.json`);
   const data = readJson(file, null);
   const sessions = Array.isArray(data?.sessions) ? data.sessions : [];
-  const live = sessions.filter(s => s && now - (s.lastSeen || 0) < SESSION_FRESH_MS)
-    .map(s => ({
+  const rawRecent = sessions.filter(s => s && now - (s.lastSeen || 0) < SESSION_FRESH_MS).length;
+  const live = sessions
+    .map(s => ({ s, liveness: sessionLiveness(s, now) }))
+    .filter(({ liveness }) => liveness)
+    .map(({ s, liveness }) => ({
       id: String(s.id || '').slice(0, 8),
-      client: s.client || 'claude-code',
+      // 'unknown' stays 'unknown' — the old 'claude-code' fallback silently
+      // relabeled client-less rows, masking the writer that forgot to stamp.
+      client: s.client || 'unknown',
       surface: s.surface || null,
       model: s.model || null,
       branch: s.branch || null,
       intent: s.intent || '',
+      intentAgeMin: s.intentAt ? Math.round((now - Number(s.intentAt)) / 60000) : null,
       files: Array.isArray(s.files) ? s.files : [],
-      channels: Array.isArray(s.channels) ? s.channels : [],
-      lastSeenMin: Math.round((now - (s.lastSeen || 0)) / 60000),
+      channels: liveness.channels,
+      hostPid: s.hostPid || null,
+      // Sync-rich vs sync-silent: has this session declared any task scope?
+      synced: Boolean(String(s.intent || '').trim() || (Array.isArray(s.files) && s.files.length)),
+      lastSeenMin: Math.round((now - liveness.lastSeen) / 60000),
     }));
-  return { file, live, count: live.length };
+  // Twin rows = channel merge NOT occurring: >1 live row sharing one hostPid is
+  // one logical session split across ids (each twin inflates every count).
+  const byHost = new Map();
+  for (const p of live) { if (p.hostPid) byHost.set(p.hostPid, [...(byHost.get(p.hostPid) || []), p.id]); }
+  const twinGroups = [...byHost.entries()].filter(([, ids]) => ids.length > 1).map(([hostPid, ids]) => ({ hostPid, ids }));
+  return { file, live, count: live.length, rawRecent, syncedCount: live.filter(p => p.synced).length, twinGroups };
 }
 
 // ── DECAY-GUARD layer (fast-decay status protection, 2026-07-28) ─────────────
@@ -319,7 +361,12 @@ export function inspect(opts = {}) {
     // stale-server incident. Unknown (server not booted since the heartbeat shipped)
     // is NOT drift; it's a reconnect prompt.
     running: !running.known ? 'unknown' : (running.matchesInstalled === false ? 'drift' : 'ok'),
-    supervisor: supervisors.active ? 'ok' : (version.supervisorCapable ? 'pending-reconnect' : 'legacy'),
+    // A recovery-failed / worker-less supervisor is an OUTAGE (queued tool calls
+    // hang), not health — pid-alive alone must never render it ok. A stale
+    // active-worker version is the same class of drift RUNNING reports.
+    supervisor: supervisors.active
+      ? (supervisors.impaired.length ? 'drift' : (supervisors.matchesInstalled === false ? 'drift' : 'ok'))
+      : (version.supervisorCapable ? 'pending-reconnect' : 'legacy'),
     autoUpdate: !autoUpdate.enabled ? 'off' : (autoUpdate.result === 'failed' ? 'warning' : 'ok'),
     hooks: !hooks.settingsPresent ? 'absent' : (hooks.missing.length ? 'drift' : 'ok'),
     // Codex MCP presence is the automatic baseline. Hooks are an OPTIONAL
@@ -352,6 +399,8 @@ export function inspect(opts = {}) {
     if (hooks.missing.length) actions.push(`npx klypix-mcp install   # half-wired: hooks not active — ${hooks.missing.join(', ')}`);
     if (hasBrain && !harness.ok) actions.push('npx klypix-mcp link      # harness configs drifted — re-project managed blocks');
     if (layers.decayGuard === 'drift') actions.push('npx klypix-mcp install   # decay-aware status guard missing/stale — stale build/deploy claims can render as CURRENT state');
+    for (const s of supervisors.impaired || []) actions.push(`/mcp reconnect   # supervisor pid ${s.pid} is ${s.status} with no live worker — its tool calls hang until reconnected`);
+    if (peers.twinGroups && peers.twinGroups.length) actions.push(`/mcp reconnect   # ${peers.twinGroups.length} session(s) split across twin lane rows (channel merge not occurring) — reconnect adopts the merged id`);
   }
 
   return { verdict, layers, drifted, version, running, supervisors, autoUpdate, hooks, codexSmart, codexHooks, tools, peers, sessions: peers, harness, npm, decayGuard, project: { dir: projectDir, brainPath, hasBrain }, brainDir, actions };
@@ -365,6 +414,7 @@ export function driftLine(r) {
   if (r.version.dirty) bits.push('dirty deploy');
   if (r.npm && r.npm.matches === false) bits.push(`v${r.version.baked}<${r.npm.latest}`);
   if (r.running && r.running.matchesInstalled === false) bits.push(`live server v${r.running.version}≠installed v${r.version.baked} (/mcp reconnect)`);
+  if (r.supervisors?.impaired?.length) bits.push(`${r.supervisors.impaired.length} supervisor(s) IMPAIRED — tool calls hang (/mcp reconnect)`);
   if (r.hooks.missing.length) bits.push(`${r.hooks.missing.length} hook(s) unwired`);
   if (r.project.hasBrain && !r.harness.ok) bits.push(`${r.harness.drift.length} harness file(s) drifted`);
   if (r.layers?.decayGuard === 'drift') bits.push('decay-guard stale (fast-decay status claims unstamped)');
@@ -405,9 +455,13 @@ export function render(r, opts = {}) {
   // SUPERVISOR (stable host connection + replaceable worker)
   if (r.supervisors?.active) {
     const totalReloads = r.supervisors.live.reduce((sum, state) => sum + state.hotReloads, 0);
-    L.push(`${ok} ${c.bold}SUPERVISOR${c.rst}  ${r.supervisors.count} live · zero-restart core activation ready${totalReloads ? ` · ${totalReloads} hot-swap${totalReloads === 1 ? '' : 's'}` : ''}`);
+    const impaired = r.supervisors.impaired || [];
+    const smark = impaired.length ? warn : ok;
+    const healthy = r.supervisors.count - impaired.length;
+    L.push(`${smark} ${c.bold}SUPERVISOR${c.rst}  ${healthy} healthy${impaired.length ? ` · ${c.red}${impaired.length} IMPAIRED (no live worker — its tool calls hang)${c.rst}` : ' · zero-restart core activation ready'}${totalReloads ? ` · ${totalReloads} hot-swap${totalReloads === 1 ? '' : 's'}` : ''}`);
     for (const state of r.supervisors.live) {
-      if (state.lastError) L.push(`        ${c.yel}· pid ${state.pid} ${state.status}: ${state.lastError}${c.rst}`);
+      if (state.impaired) L.push(`        ${c.red}· pid ${state.pid} ${state.status}${state.lastError ? `: ${state.lastError}` : ''} — /mcp reconnect${c.rst}`);
+      else if (state.lastError) L.push(`        ${c.yel}· pid ${state.pid} ${state.status}: ${state.lastError}${c.rst}`);
     }
   } else if (r.version.supervisorCapable) {
     L.push(`${warn} ${c.bold}SUPERVISOR${c.rst}  installed but this is a legacy direct-worker session · reconnect once to activate`);
@@ -472,8 +526,15 @@ export function render(r, opts = {}) {
   // SESSIONS: this is an all-session count. A recent-chat row is not a heartbeat.
   if (!r.sessions.count) L.push(`${ok} ${c.bold}SESSIONS${c.rst}  0 active sessions ${c.dim}(saved/recent chats are history, not active)${c.rst}`);
   else {
-    L.push(`${r.sessions.count > 1 ? warn : ok} ${c.bold}SESSIONS${c.rst}  ${r.sessions.count} active session${r.sessions.count === 1 ? '' : 's'} ${c.dim}(all hosts; MCP/lifecycle; 10-minute crash TTL)${c.rst}`);
-    for (const p of r.sessions.live) L.push(`        · ${p.client}:${p.id}${p.branch ? ' @' + p.branch : ''}${p.channels.length ? ` [${p.channels.join('+')}]` : ''}${p.intent ? ` “${p.intent.slice(0, 50)}”` : ''} ${c.dim}(${p.lastSeenMin}m ago)${c.rst}`);
+    const hiddenIdle = Math.max(0, (r.sessions.rawRecent || r.sessions.count) - r.sessions.count);
+    L.push(`${r.sessions.count > 1 ? warn : ok} ${c.bold}SESSIONS${c.rst}  ${r.sessions.count} active session${r.sessions.count === 1 ? '' : 's'} · ${r.sessions.syncedCount ?? r.sessions.count} with declared task scope ${c.dim}(all hosts; channel-aware liveness${hiddenIdle ? `; +${hiddenIdle} row(s) with only a dead mcp channel excluded` : ''})${c.rst}`);
+    for (const p of r.sessions.live) {
+      const intentAge = p.intentAgeMin !== null && p.intentAgeMin - p.lastSeenMin > 3 ? ` (set ${p.intentAgeMin}m ago)` : '';
+      L.push(`        · ${p.client}:${p.id}${p.branch ? ' @' + p.branch : ''}${p.channels.length ? ` [${p.channels.join('+')}]` : ''}${p.intent ? ` “${p.intent.slice(0, 50)}”${intentAge}` : ''}${p.synced ? '' : ` ${c.yel}· sync-silent (no brain_sync intent/scope)${c.rst}`} ${c.dim}(${p.lastSeenMin}m ago)${c.rst}`);
+    }
+    for (const g of (r.sessions.twinGroups || [])) {
+      L.push(`        ${c.yel}⚠ twin rows — channel merge NOT occurring: host pid ${g.hostPid} appears as ${g.ids.join(' + ')} (one logical session counted ${g.ids.length}×)${c.rst}`);
+    }
   }
 
   // HARNESS

package/src/codex-brain-hook.mjs

@@ -31,6 +31,21 @@ function readInput() {
   }
 }
 
+// Thin binding of the engine's host-neutral ship observer to a Codex project
+// dir. Guarded on the export so an older bundled klypix-format degrades to no
+// observation rather than killing the hook.
+function observeShipDrift(projectDir) {
+  try {
+    if (!projectDir || typeof brainFormat.observeShipDrift !== 'function') return '';
+    const gitRun = (args) => execFileSync('git', String(args).split(/\s+/).filter(Boolean), {
+      cwd: projectDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 4000,
+    });
+    return brainFormat.observeShipDrift(projectDir, { gitRun }).notice || '';
+  } catch {
+    return '';
+  }
+}
+
 function gitBranch(cwd) {
   try {
     const branch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
@@ -262,6 +277,11 @@ async function main() {
   if (event === 'SessionStart') {
     emitSystemMessage([
       formatPresenceMessage(sessions, sessionId, { includeSolo: true }),
+      // Class-C ship observation — the engine's, not a Claude-hook-local copy.
+      // Codex-driven projects had NO out-of-session ship detection at all, which
+      // is exactly where the incident class bites hardest (2026-07-29 review).
+      // The queue drains at the next brain write from any host.
+      observeShipDrift(projectDir),
       stampReceivedMessages(messages),
     ]);
     return;