klypix-mcp 1.73.2 → 1.74.0

package/bin/klypix-conformance.mjs

@@ -223,12 +223,16 @@ try {
           offeredAt: now - 900,
           acknowledgedAt: now - 500,
           consumedAt: now - 250,
+          // The STRONG claim: this peer sent a real receipt. Without this marker the
+          // record is an auto-lease or unknown, and the renderer must not say
+          // "explicitly" — the conformance fixture has to state which it means.
+          consumedVia: 'receipt',
         }],
         seen: ['finding-owner'],
       }],
       sessions: lane, selfId: 'finding-sender', now,
     });
-    checks.findingReceiptRendered = /explicitly consumed by all 1 target peer\(s\) after model-context delivery \(not human-read\)/.test(renderReceiptSummary(receipt));
+    checks.findingReceiptRendered = /explicitly consumed by all 1 target peer\(s\) via receipt \(not human-read\)/.test(renderReceiptSummary(receipt));
   }
 
   // ── Cross-PC presence: simulated two-machine scenario ─────────────────────

package/bin/klypix-worker.mjs

@@ -562,7 +562,7 @@ server.registerTool('project_map_scan', {
 
 server.registerTool('project_map_drift', {
   title: 'Check brain cards against the repo\'s real files (drift report)',
-  description: 'Read-only drift check: every brain card that references THIS project\'s files is verified against the working tree. Reports cards whose referenced files are gone or moved (with rename candidates by unique basename), and headlines when the checkout itself is behind its origin default branch — in that state a "missing" file may simply not be in this checkout. Slash-joined name enumerations and other-project paths are recognized and skipped, not reported as drift. Nothing is written; fix cards with a CORRECTION marker or by editing them in KLYPIX.',
+  description: 'Read-only drift check: every brain card that references THIS project\'s files is verified against the working tree. Reports cards whose referenced files are gone or moved (with rename candidates by unique basename), and headlines the checkout\'s own position against its origin default branch — reporting BOTH ahead and behind, so a DIVERGED checkout is named as diverged rather than merely behind. In either state a "missing" file may simply not be in this checkout. Slash-joined name enumerations and other-project paths are recognized and skipped, not reported as drift. Nothing is written; fix cards with a CORRECTION marker or by editing them in KLYPIX.',
   annotations: { destructiveHint: false, idempotentHint: true, openWorldHint: false },
   inputSchema: {
     project: z.string().optional().describe('Absolute project root. Defaults to this MCP connection\'s configured project/vault.'),
@@ -691,7 +691,7 @@ server.registerTool('brain_note', {
 
 server.registerTool('brain_message', {
   title: 'Message the other live agent sessions on this project (one-time note, not a brain card)',
-  description: 'Leave a DELIBERATE, targeted note for the OTHER active agent sessions working on this project right now ("merged the hook refactor — rebase before you commit", "don\'t touch canvasStore, mid-refactor"). Any MCP client can send and receive through the shared machine-local presence lane. A supported lifecycle event or KLYPIX tool result offers the note into model-visible context; a later independent supported action acknowledges that offer. Pending/offered notes replay after reconnect, while expiry or capacity loss leaves a failed per-recipient receipt instead of silently disappearing. Acknowledged means a later action followed the offer — it is NOT proof a human read it. Delivery remains OS-user-local, machine-local, bounded by a 24h TTL, and unavailable to a peer that never takes a supported action. Ephemeral and NOT persisted to the brain — for a durable decision use brain_note instead.',
+  description: 'Leave a DELIBERATE, targeted note for the OTHER active agent sessions working on this project right now ("merged the hook refactor — rebase before you commit", "don\'t touch canvasStore, mid-refactor"). Any MCP client can send and receive through the shared machine-local presence lane. A supported lifecycle event or KLYPIX tool result offers the note into model-visible context; a later independent supported action acknowledges that offer. Pending/offered notes replay after reconnect, while expiry or capacity loss leaves a failed per-recipient receipt instead of silently disappearing. Acknowledged means a later action followed the offer — it is NOT proof a human read it. A note then retires either by an explicit brain_message_receipt ("acted on it") or by AUTO-CONSUMPTION on a further independent action, with no receipt; your receipt line names which, and auto-consumption evidences activity, not uptake. Delivery remains OS-user-local, machine-local, bounded by a 24h TTL, and unavailable to a peer that never takes a supported action. Ephemeral and NOT persisted to the brain — for a durable decision use brain_note instead.',
   inputSchema: {
     text: z.string().describe('The note to deliver (kept to 400 chars).'),
     to: z.string().optional().describe('Target hint — a peer session id-prefix or branch name; omit or "all" for every live session.'),
@@ -790,7 +790,7 @@ server.registerTool('brain_sync', {
     releaseIntent: z.object({
       version: z.string().max(64).describe('The version this session intends to release (e.g. "1.70.0").'),
       ref: z.string().max(200).describe('The git ref (branch or tag) the release will be cut from.'),
-      acknowledge: z.array(z.string().max(40)).max(64).optional().describe('Commit shas this release DELIBERATELY leaves behind. Only needed after a refusal: if the ref would drop finished work, the lease is refused and the response names every sha. Re-declare with those shas here to proceed — and tell the user what they are first.'),
+      acknowledge: z.array(z.string().max(40)).max(1024).optional().describe('Commit shas this release DELIBERATELY leaves behind. Only needed after a refusal: if the ref would drop finished work, the lease is refused and the response names every sha. Re-declare with those shas here to proceed — and tell the user what they are first.'),
     }).optional().describe('Declare EXCLUSIVE intent to prepare a release of this project. The first declarer takes a ~2h lease (refreshed by checkpoints, freed by phase "complete", by expiry, or when the holder session ends); a second declarer gets a structured hard conflict naming the holder, version, and ref. While any lease is active every peer\'s sync gains a "release in preparation" footer line. A NEW declaration is also checked against what the release would LEAVE BEHIND: if the ref is missing commits that are on trunk or on a branch a live peer session is working on, the lease is REFUSED (nothing is changed) and the response lists them — report those commits to the user, then re-declare with acknowledge:[...] naming each sha if the release should go ahead without them.'),
   },
 }, async ({ project, intent, files, phase, include_context, results, releaseIntent }, extra) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klypix-mcp",
-  "version": "1.73.2",
+  "version": "1.74.0",
   "description": "Shared project brain and MCP coordination server for multi-agent coding.",
   "type": "module",
   "license": "Apache-2.0",
@@ -83,7 +83,7 @@
     "bench": "node bin/klypix-mcp.mjs bench",
     "test:bench": "node test/bench.mjs",
     "pretest": "node test/publish-workflow.mjs",
-    "test": "node test/publish-verdict.mjs && node test/project-graph.mjs && node test/project-map-cli.mjs && node test/mcp-auto-update.mjs && node test/mcp-supervisor.mjs && node test/runtime-inspector.mjs && node test/codex-hooks.mjs && node test/request-identity.mjs && node test/session-identity-core.mjs && node test/agent-presence.mjs && node test/message-delivery-v3.mjs && node test/claude-message-delivery-v3.mjs && node test/result-reconcile.mjs && node test/evidence-publication-gate.mjs && node test/release-evidence-cli.mjs && node test/intent-guard.mjs && node test/git-capture-install.mjs && node test/brain-history.mjs && node test/brain-graveyard.mjs && node test/archived-visibility.mjs && node test/finding-routing.mjs && node test/finding-routing-hook.mjs && node test/presence-relay.mjs && node test/install-version.mjs && node test/install-rename-backoff.mjs && node test/project-binding-rebind.mjs && node test/context-gateway.mjs && node test/repo-state.mjs && node test/released-tag-guard.mjs && node test/conformance.mjs && node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brain-connect-orphans.mjs && node test/orphan-gardener.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/retrieval-fusion.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/skill-staleness.mjs && node test/canvas-view.mjs && node test/status-completeness.mjs && node test/semantic-security.mjs && node test/semantic-gate.mjs && node test/memory-runtime.mjs && node test/semantic-cache.mjs && node test/decay-status.mjs && node test/decay-hook.mjs && node test/evidence-anchors.mjs && node test/presence-visibility.mjs && node test/undeclared-active.mjs && node test/presence-liveness.mjs && node test/observed-scope.mjs && node test/release-lease.mjs && node test/release-ancestry.mjs && node test/release-handshake.mjs && node test/completion-guard.mjs && node test/merge-brains.mjs && node test/concurrent-writes.mjs && node test/lock-interop.mjs && node test/capture-write-failure.mjs && node test/a2a-smoke.mjs && node test/one-command-setup.mjs && node test/cli-args.mjs && node test/format-guard.mjs && node test/git-tools.mjs && node test/uninstall.mjs",
+    "test": "node test/publish-verdict.mjs && node test/project-graph.mjs && node test/project-map-cli.mjs && node test/mcp-auto-update.mjs && node test/mcp-supervisor.mjs && node test/runtime-inspector.mjs && node test/codex-hooks.mjs && node test/request-identity.mjs && node test/session-identity-core.mjs && node test/agent-presence.mjs && node test/message-delivery-v3.mjs && node test/claude-message-delivery-v3.mjs && node test/result-reconcile.mjs && node test/evidence-publication-gate.mjs && node test/release-evidence-cli.mjs && node test/intent-guard.mjs && node test/git-capture-install.mjs && node test/brain-history.mjs && node test/brain-graveyard.mjs && node test/archived-visibility.mjs && node test/finding-routing.mjs && node test/finding-routing-hook.mjs && node test/presence-relay.mjs && node test/install-version.mjs && node test/install-rename-backoff.mjs && node test/project-binding-rebind.mjs && node test/context-gateway.mjs && node test/repo-state.mjs && node test/released-tag-guard.mjs && node test/conformance.mjs && node test/brain-doctor.mjs && node test/version-currency.mjs && node test/ship-capture.mjs && node test/lane-message.mjs && node test/brain-quality.mjs && node test/brain-connect-orphans.mjs && node test/orphan-gardener.mjs && node test/brief-and-recall.mjs && node test/layout-cluster.mjs && node test/brain-ask.mjs && node test/retrieval-fusion.mjs && node test/field-report-2026-07-04.mjs && node test/autoprop.mjs && node test/overlay-recency-2026-07-12.mjs && node test/brain-challenge.mjs && node test/brain-lens.mjs && node test/brain-kind.mjs && node test/rule-drafts.mjs && node test/claim-engine.mjs && node test/skill-staleness.mjs && node test/canvas-view.mjs && node test/status-completeness.mjs && node test/semantic-security.mjs && node test/semantic-gate.mjs && node test/memory-runtime.mjs && node test/semantic-cache.mjs && node test/decay-status.mjs && node test/decay-hook.mjs && node test/evidence-anchors.mjs && node test/presence-visibility.mjs && node test/undeclared-active.mjs && node test/presence-liveness.mjs && node test/observed-scope.mjs && node test/release-lease.mjs && node test/release-ancestry.mjs && node test/release-claim-join.mjs && node test/release-handshake.mjs && node test/completion-guard.mjs && node test/merge-brains.mjs && node test/concurrent-writes.mjs && node test/lock-interop.mjs && node test/capture-write-failure.mjs && node test/a2a-smoke.mjs && node test/one-command-setup.mjs && node test/cli-args.mjs && node test/format-guard.mjs && node test/git-tools.mjs && node test/uninstall.mjs",
     "test:memory": "node test/memory-runtime.mjs",
     "test:memory:soak": "node --expose-gc test/memory-soak.mjs",
     "runtime": "node bin/klypix-runtime.mjs"

package/src/agent-presence.mjs

@@ -2471,7 +2471,7 @@ export function formatReceivedMessages(messages, now = Date.now(), decay = {}, s
     lines.push(`- from ${senderLabel} (${ageMin}m ago): ${neutralizeMarkers(String(message.text || '').replace(/\s+/g, ' ').trim().slice(0, 400))}`);
     const receipts = group.map((item) => messageDeliveryReceipt(item, sessionId)).filter(Boolean);
     if (receipts.length) {
-      lines.push(`  Receipt(s): ${receipts.map((receipt) => `${receipt.messageId}:${receipt.offerToken}`).join(', ')}. After incorporating ${receipts.length === 1 ? 'it' : 'them'}, call brain_message_receipt with each exact message_id and offer_token.`);
+      lines.push(`  Receipt(s): ${receipts.map((receipt) => `${receipt.messageId}:${receipt.offerToken}`).join(', ')}. After incorporating ${receipts.length === 1 ? 'it' : 'them'}, call brain_message_receipt with each exact message_id and offer_token — that is the ONLY way the sender learns you acted on ${receipts.length === 1 ? 'it' : 'them'}. If you skip it, your next independent action auto-consumes ${receipts.length === 1 ? 'this note' : 'these notes'} and the sender is told only that ${receipts.length === 1 ? 'it was' : 'they were'} auto-consumed.`);
     }
     const info = messageDecayInfo({ ...message, ts: oldestTs }, now, decay);
     if (info) lines.push(`  ${info.stampText}`);

package/src/finding-routing.mjs

@@ -511,6 +511,14 @@ const receiptRecordMap = (message) => {
       state: ['pending', 'offered', 'acknowledged', 'consumed', 'failed'].includes(raw?.state)
         ? raw.state : 'offered',
       reason: raw?.reason ? String(raw.reason) : null,
+      // HOW consumption happened, not just THAT it did. Dropping this during
+      // normalization is the root cause of the receipt surfaces calling every
+      // consumption "explicit": the distinction was recorded on disk by
+      // agent-presence and then discarded one layer before the renderer, so no
+      // renderer could tell the strong claim from the weak one. Only the two
+      // values the writer actually sets are honoured; anything else is unknown.
+      consumedVia: raw?.consumedVia === 'receipt' || raw?.consumedVia === 'auto-lease'
+        ? raw.consumedVia : null,
     });
   }
   // Historical `seen` was stamped before output transport/model injection. It
@@ -551,6 +559,17 @@ export function summarizeReceipts({ messages, sessions, selfId, now = Date.now()
     const failed = stateIds('failed');
     const pending = candidateIds.filter((id) => !records.has(id) || records.get(id)?.state === 'pending');
     const unresolved = [...pending, ...offered, ...acknowledged].map((id) => String(id).slice(0, 8));
+    // WHY consumption is split: 'consumed' is reached two very different ways.
+    // 'receipt' is the strong claim — the recipient named the message id and offer
+    // token, i.e. "I acted on it". 'auto-lease' is the weak one — a later independent
+    // action merely followed the offer, which is evidence of activity, not of uptake.
+    // An ABSENT consumedVia is UNKNOWN, never auto-lease: the field is serialized only
+    // when set (agent-presence.mjs:507) and deleted on state reset (:588), so records
+    // written by an older bundled engine carry no marker and must not be miscounted.
+    const via = (id) => records.get(id)?.consumedVia || null;
+    const consumedByReceipt = consumed.filter((id) => via(id) === 'receipt');
+    const consumedByLease = consumed.filter((id) => via(id) === 'auto-lease');
+    const consumedUnknownVia = consumed.filter((id) => via(id) === null);
     return {
       id: m.id,
       to: m.to || 'all',
@@ -560,6 +579,9 @@ export function summarizeReceipts({ messages, sessions, selfId, now = Date.now()
       text: String(m.text || '').slice(0, 120),
       acknowledged: acknowledged.length,
       consumed: consumed.length,
+      consumedByReceipt: consumedByReceipt.length,
+      consumedByLease: consumedByLease.length,
+      consumedUnknownVia: consumedUnknownVia.length,
       // Compatibility alias for programmatic consumers. It now means a later
       // model-context acknowledgement milestone (including subsequently
       // consumed deliveries), never `seen` and never human-read.
@@ -571,6 +593,8 @@ export function summarizeReceipts({ messages, sessions, selfId, now = Date.now()
       offeredIds: offered.map((id) => String(id).slice(0, 8)),
       acknowledgedIds: acknowledged.map((id) => String(id).slice(0, 8)),
       consumedIds: consumed.map((id) => String(id).slice(0, 8)),
+      consumedByReceiptIds: consumedByReceipt.map((id) => String(id).slice(0, 8)),
+      consumedByLeaseIds: consumedByLease.map((id) => String(id).slice(0, 8)),
       failedIds: failed.map((id) => String(id).slice(0, 8)),
       deadLetterReason: m.deadLetter?.reason ? String(m.deadLetter.reason) : null,
     };
@@ -578,6 +602,35 @@ export function summarizeReceipts({ messages, sessions, selfId, now = Date.now()
   return { sent: receipts.length, receipts };
 }
 
+// ONE phrase, shared by every receipt surface. Two renderers drifting apart is how
+// "explicitly consumed" survived after auto-lease made it untrue on most paths, so
+// the wording lives in exactly one place and both callers below must use it.
+// `receipt.consumed === receipt.candidates` is the caller's precondition.
+export function fullConsumptionPhrase(receipt) {
+  const weak = (receipt.consumedByLease || 0) + (receipt.consumedUnknownVia || 0);
+  if (!weak) {
+    return `explicitly consumed by all ${receipt.candidates} target peer(s) via receipt (not human-read)`;
+  }
+  const parts = [];
+  if (receipt.consumedByReceipt) parts.push(`${receipt.consumedByReceipt} by explicit receipt`);
+  if (receipt.consumedByLease) parts.push(`${receipt.consumedByLease} auto-consumed after a later independent action`);
+  if (receipt.consumedUnknownVia) parts.push(`${receipt.consumedUnknownVia} consumed by an unrecorded route`);
+  return `consumed by all ${receipt.candidates} target peer(s) — ${parts.join(', ')}; auto-consumption is not proof the note was acted on, and never proof a human read it`;
+}
+
+// Shown only when some peers consumed by the weak route, so a partial line still
+// distinguishes uptake from mere activity.
+function partialConsumptionSplit(receipt) {
+  if (!receipt.consumed) return '';
+  const weak = (receipt.consumedByLease || 0) + (receipt.consumedUnknownVia || 0);
+  if (!weak) return '';
+  // 'auto-consumed' is itself a mechanism claim; an unknown-route record (older
+  // engine wrote it) must not be folded into it (2026-08-17 review catch).
+  return receipt.consumedUnknownVia
+    ? ` (${receipt.consumedByReceipt || 0} by receipt, ${weak} auto-consumed or unrecorded)`
+    : ` (${receipt.consumedByReceipt || 0} by receipt, ${weak} auto-consumed)`;
+}
+
 // One honest line per receipt. `pending` is listed by id-prefix up to 4 — a name
 // you can chase beats a number you can't.
 export function renderReceipt(receipt) {
@@ -590,14 +643,14 @@ export function renderReceipt(receipt) {
     return `- ${who}, ${age}: queued with no live local target snapshot; no local delivery is claimed. “${receipt.text}”`;
   }
   if (receipt.consumed === receipt.candidates && !receipt.failed) {
-    return `- ${who}, ${age}: explicitly consumed by all ${receipt.candidates} target peer(s) after model-context delivery (not human-read). “${receipt.text}”`;
+    return `- ${who}, ${age}: ${fullConsumptionPhrase(receipt)}. “${receipt.text}”`;
   }
   const pending = receipt.pendingIds.slice(0, 4).join(', ');
   const more = receipt.pendingIds.length > 4 ? ` +${receipt.pendingIds.length - 4} more` : '';
   const offered = receipt.offered ? ` · offered ${receipt.offered}, awaiting later-action ack` : '';
   const acknowledged = receipt.acknowledged ? ` · acknowledged ${receipt.acknowledged}, awaiting explicit consumption` : '';
   const failed = receipt.failed ? ` · failed ${receipt.failed}${failure ? ` (${failure})` : ''}` : '';
-  return `- ${who}, ${age}: consumed ${receipt.consumed} of ${receipt.candidates}${offered}${acknowledged}${failed}${pending ? ` · unresolved ${pending}${more}` : ''}. “${receipt.text}”`;
+  return `- ${who}, ${age}: consumed ${receipt.consumed} of ${receipt.candidates}${partialConsumptionSplit(receipt)}${offered}${acknowledged}${failed}${pending ? ` · unresolved ${pending}${more}` : ''}. “${receipt.text}”`;
 }
 
 // Compact, text-free receipt for surfaces that must stay cheap (SessionStart
@@ -615,14 +668,14 @@ export function renderReceiptSummary(summary) {
       : `📬 Your last note${target} (${age}): queued with no live local target snapshot; no local delivery claimed.`;
   }
   if (receipt.consumed === receipt.candidates && !receipt.failed) {
-    return `📬 Your last note${target} (${age}): explicitly consumed by all ${receipt.candidates} target peer(s) after model-context delivery (not human-read).`;
+    return `📬 Your last note${target} (${age}): ${fullConsumptionPhrase(receipt)}.`;
   }
   const pending = receipt.pendingIds.slice(0, 4).join(', ');
   const more = receipt.pendingIds.length > 4 ? ` +${receipt.pendingIds.length - 4} more` : '';
   const offered = receipt.offered ? ` · offered ${receipt.offered}, awaiting ack` : '';
   const acknowledged = receipt.acknowledged ? ` · acknowledged ${receipt.acknowledged}, awaiting explicit consumption` : '';
   const failed = receipt.failed ? ` · failed ${receipt.failed}${failure ? ` (${failure})` : ''}` : '';
-  return `📬 Your last note${target} (${age}): consumed ${receipt.consumed} of ${receipt.candidates}${offered}${acknowledged}${failed}${pending ? ` · unresolved ${pending}${more}` : ''}.`;
+  return `📬 Your last note${target} (${age}): consumed ${receipt.consumed} of ${receipt.candidates}${partialConsumptionSplit(receipt)}${offered}${acknowledged}${failed}${pending ? ` · unresolved ${pending}${more}` : ''}.`;
 }
 
 export function renderReceipts(summary, { limit = 3 } = {}) {

package/src/global-brain-hook.mjs

@@ -958,7 +958,11 @@ function peerFooter(sid) {
             const legend = marked.some(f => f.endsWith('*')) ? ' (* = observed from live edits, scope not declared)' : '';
             warn = `  · ⚠️ both edited: ${marked.join(', ')} — expect a conflict, KEEP BOTH${legend}`;
         }
-        else if (p.branch && myBranch && p.branch === myBranch) warn = '  · ⚠️ same branch — pull/rebase before you commit';
+        // State the fact, never the git operation. This runs in a latency-sensitive
+        // hook and must not spawn git, so it cannot know whether the branch is merely
+        // behind or has DIVERGED — and on a diverged branch "pull/rebase" is advice
+        // the real state contradicts. Naming the collision is what this footer is for.
+        else if (p.branch && myBranch && p.branch === myBranch) warn = '  · ⚠️ same branch — your commits will interleave; coordinate before you commit';
         // Unique over the full live list (not just shown peers) — the MSG router
         // resolves a prefix against every row, so uniqueness must match that set.
         lines.push(`- session ${shortestUniquePeerPrefix(list, p.id)} · ${bits.join(' · ')}${warn}`);
@@ -966,7 +970,7 @@ function peerFooter(sid) {
     // v1.32.0 law: a truncated list must never render as a complete one. This
     // overflow line is unconditional — never subject to any budget.
     if (peers.length > 4) lines.push(`- …and ${peers.length - 4} more live session(s) not shown — \`npx klypix-mcp doctor\` or brain_sync lists all.`);
-    lines.push('Coordinate BEFORE touching shared files: reply with `🧠 MSG [<their id-prefix or branch>]: <text>` (or call `brain_message`). KLYPIX queues it for supported lifecycle/MCP actions and replays it until the receiving model explicitly records consumption with `brain_message_receipt`. Check the brain for durable decisions/ships.');
+    lines.push('Coordinate BEFORE touching shared files: reply with `🧠 MSG [<their id-prefix or branch>]: <text>` (or call `brain_message`). KLYPIX queues it for supported lifecycle/MCP actions and replays it until the offer is acknowledged; the receiver then either records uptake with `brain_message_receipt` or a further independent action auto-consumes it without one. Check the brain for durable decisions/ships.');
     return lines.join('\n');
 }
 

package/src/klypix-core.mjs

@@ -1189,7 +1189,7 @@ export async function opBrainMessage({ vault, canvas, text: msgText, to, via, fr
   const message = result.message;
   const candidates = Array.isArray(message.candidateIds) ? message.candidateIds.length : 0;
   return {
-    blocks: [text(`📨 queued in this project's coordination lane (to: ${message.to}; id: ${message.id}) — ${candidates} live target session(s) were snapshotted. Delivery is pending until a supported lifecycle/MCP action offers it into model-visible context; it replays through acknowledgement until the receiver explicitly records consumption with brain_message_receipt. This is a coordination receipt, not proof a human read it and not a brain card — use brain_note for durable project decisions.`)],
+    blocks: [text(`📨 queued in this project's coordination lane (to: ${message.to}; id: ${message.id}) — ${candidates} live target session(s) were snapshotted. Delivery is pending until a supported lifecycle/MCP action offers it into model-visible context, and it replays until the offer is acknowledged. AFTER acknowledgement it retires one of two ways: the receiver calls brain_message_receipt with the exact message id and offer token ("acted on it"), or a further independent action AUTO-CONSUMES it without any receipt. Your receipt line names which. Auto-consumption is not proof the note was acted on, and no path here is proof a human read it. Not a brain card — use brain_note for durable project decisions.`)],
     message,
   };
 }

package/src/klypix-format.mjs

@@ -2002,6 +2002,33 @@ export function rankForQuestion(struct, question, { semantic = null, k = 10, as_
         // the embedding side, not from reweighting here. The kept behaviors are
         // pinned numerically in test/retrieval-fusion.mjs — a change that trips
         // that suite must re-run the harness before shipping.
+        //
+        // THE EMBEDDING SIDE WAS THEN SWEPT TOO (2026-08-17, n=113 frozen v2,
+        // real 2,553-card brain, production contract via embedTexts — prefix,
+        // CLS, normalize; ordering = this function's semantic formula):
+        //   bge-small q8 (ships)  MRR .436 · @5 61 · paraphrase 46   baseline
+        //   bge-small fp32        MRR .456 · @5 60 · paraphrase 46   — so the
+        //     q8 quantization is NOT the ceiling; the 384-dim model is.
+        //   bge-base  q8 (768d)   MRR .475 · @5 61 · paraphrase 51 [39,63] vs
+        //     [34,58] — every needle right, none CI-clearing, at 2.4× embed
+        //     cost (622s vs 255s full-brain) and ~3× download. NOT flipped.
+        //   exact-duplicate collapse at rank time: FLAT (61→61, para 46→46),
+        //     confirming the MMR-deferral result above by a second route.
+        //   1,500-char truncation: measurably NOT a failure mode — gold cards
+        //     >1,500 chars score BETTER (@5 71% vs 57%), and 0 of 34 paraphrase
+        //     misses attribute to it. "We truncate, therefore we miss" is
+        //     falsified; do not chunk on that rationale.
+        //   (gte-small collapsed to MRR .17 under this contract — it wants mean
+        //     pooling and no prefix, so that number is contract mismatch, not a
+        //     fair test of gte.)
+        // Failure signature stands: cosine COMPRESSION — on paraphrase misses
+        // the gold sits a median 0.040 cosine below the 5th hit, 21/34 at rank
+        // >50, 6/34 outside the 200 pool. Same-class drop-in models do not fix
+        // that on this corpus. The remaining live path is DOC-SIDE enrichment
+        // (capture-time question/intent text embedded alongside the card) or a
+        // genuinely larger embedder — both are product decisions with shipping
+        // costs, not tuning. Runner: scratchpad ab-runner.mjs pattern — embed
+        // through embedTexts with a swapped pipe, never a hand-copied contract.
         const semRank = new Map(scored
             .filter(hit => Number.isFinite(hit.sem))
             .sort((a, b) => b.sem - a.sem)

package/src/mcp-presence.mjs

@@ -40,7 +40,7 @@ import {
 // canonical copy lives in the pure module because that one is import-restricted
 // (crypto only), so it can never grow a dependency this file would inherit.
 import { normalizeFileKey } from './finding-routing.mjs';
-import { cmpSemver3, collectRepoState, releaseAncestry, releaseAncestryWarnings, repoStateWarnings } from './repo-state.mjs';
+import { cmpSemver3, collectRepoState, commitFiles, releaseAncestry, releaseAncestryWarnings, repoStateWarnings } from './repo-state.mjs';
 import { recordResultManifests } from './result-reconcile.mjs';
 
 export const MCP_HEARTBEAT_MS = 60_000;
@@ -61,7 +61,7 @@ export const KLYPIX_MCP_INSTRUCTIONS = [
   'At the start of each task, call brain_sync with the current project root, a one-sentence intent, and any expected files before editing; the explicit project root keeps separate repositories on separate brains even when an MCP host launches servers from its own install directory.',
   'A session that never calls brain_sync appears to every peer as a connection with no declared scope — sync early so concurrent sessions can coordinate with you.',
   'Use its active-task, message, and file-overlap report to coordinate concurrent work.',
-  'A coordination note is not consumed merely because it was offered: after a later independent KLYPIX action acknowledges the offer, call brain_message_receipt with its exact message id and offer token only when you actually incorporated it into your work.',
+  'A coordination note is not consumed merely because it was offered: after a later independent KLYPIX action acknowledges the offer, call brain_message_receipt with its exact message id and offer token only when you actually incorporated it into your work. If you do not, a further independent action auto-consumes the note without a receipt — which records activity, not uptake — so the sender is told it was auto-consumed rather than acted on. Sending an explicit receipt is what makes your uptake visible to them.',
   'Call brain_sync again when your file scope materially changes, and with phase "complete" before your final response.',
   'When a task publishes a quantified or otherwise machine-checkable claim, include its validated result manifest in the completion sync; conflicting or incomparable peer results retain the task scope until reconciled.',
   'A session preparing a RELEASE of the project should declare it by adding releaseIntent {version, ref} to brain_sync: the first declarer takes an exclusive lease every peer sees, and a second declarer gets a hard conflict naming the holder.',
@@ -250,11 +250,23 @@ export function validateReleaseIntent(value) {
     if (!Array.isArray(value.acknowledge)) {
       errors.push('releaseIntent.acknowledge must be an array of commit shas the release deliberately leaves behind');
     } else {
-      acknowledge = value.acknowledge
+      acknowledge = [...new Set(value.acknowledge
         .filter((s) => typeof s === 'string')
         .map((s) => s.trim().toLowerCase())
-        .filter((s) => /^[0-9a-f]{4,40}$/.test(s))
-        .slice(0, 64);
+        .filter((s) => /^[0-9a-f]{4,40}$/.test(s)))];
+      // NEVER silently slice (2026-08-17 review blocker, verified by execution).
+      // The old `.slice(0, 64)` combined with a gate that demands EVERY dropped
+      // sha meant any release leaving >64 commits behind — the v1.3.120 field
+      // case was 71 — could never be acknowledged: the caller echoed the full
+      // acknowledgeRequired list, the validator quietly kept 64, the gate
+      // demanded them all, and the refusal named no cap. An agent obeying the
+      // instructions verbatim looped forever. The bound now exceeds the
+      // ancestry scan cap (500 per source, two sources), and overflowing it is
+      // a LOUD error naming the number — a divergence that large should be
+      // resolved, not acknowledged.
+      if (acknowledge.length > 1024) {
+        errors.push(`releaseIntent.acknowledge carries ${acknowledge.length} shas — the limit is 1024. A divergence this size should be resolved (merge or rebase the ref) rather than acknowledged away.`);
+      }
     }
   }
   if (errors.length) return { provided: true, ok: false, errors };
@@ -273,6 +285,153 @@ export function validateReleaseIntent(value) {
  * Prefix-tolerant in both directions so a caller may echo the short shas we
  * printed or the full ones from their own `git log`.
  */
+/**
+ * JOIN the leave-behind set to the presence table.
+ *
+ * The engine modelled "which files are two sessions editing right now" and,
+ * separately, "what would this release drop", and never connected them. So a
+ * dropped commit reached the human as an anonymous sha even when its author was
+ * live in the same lane, had declared the exact files, and had already told the
+ * human the work would be in that build.
+ *
+ * Field case, desktop v1.3.120 (2026-08-16): cdcddb1 and 086bb17 touch
+ * Toolbar.tsx / StrokePanel.tsx / useCanvasInteraction.ts, all DECLARED by a
+ * live session; b493ead touches strokeScale.ts, OBSERVED on another. Both were
+ * dropped, both owners were online, and the refusal named neither. A sha with a
+ * name attached is a different conversation from a sha without one.
+ *
+ * Declared scope and observed scope both count: observed is how the engine
+ * adopts scope for work a session never got round to declaring, and the whole
+ * point here is to catch work whose owner never said the right thing.
+ *
+ * Bounded and fail-open-to-anonymous: if the git probe cannot run we return the
+ * ancestry untouched. Never invent an owner — a wrong name is worse than none.
+ */
+export function annotateAncestryOwnership(ancestry, sessions, { projectRoot, selfId, execGit } = {}) {
+  if (!ancestry || !Array.isArray(ancestry.sources) || !ancestry.sources.length) return ancestry;
+  const peers = (Array.isArray(sessions) ? sessions : []).filter((s) => s && s.id !== selfId);
+  if (!peers.length || !projectRoot) return ancestry;
+
+  // Probe the FULL dropped set (bounded by commitFiles' own max), not the
+  // 8-per-source display list. Probing only the display meant a live peer's
+  // dropped commit at recency rank ≥9 stayed anonymous, peerOwnedCount
+  // undercounted the headline, and "owned commits sort to the top" was
+  // unimplementable — all four pre-release reviews converged on this
+  // (2026-08-17). Newest-first within each source so the bound spends itself
+  // on the commits someone is most likely waiting for.
+  const shas = ancestry.sources.flatMap((s) => (
+    Array.isArray(s.allShas) && s.allShas.length ? s.allShas : (s.missing || []).map((c) => c.sha)
+  )).filter(Boolean);
+  if (!shas.length) return ancestry;
+  let touched;
+  try {
+    touched = commitFiles(projectRoot, shas, execGit ? { execGit } : {});
+  } catch {
+    return ancestry;                      // probe failed — anonymous, never wrong
+  }
+  if (!touched || !touched.size) return ancestry;
+
+  // Declared ∪ observed, normalized against the project root so an absolute
+  // path from one session matches a repo-relative one from another.
+  const scopeOf = (peer) => new Set([
+    ...(Array.isArray(peer.files) ? peer.files : []),
+    ...(Array.isArray(peer.observedFiles) ? peer.observedFiles : []),
+  ].map((f) => normalizeFileKey(f, projectRoot)).filter(Boolean));
+  const peerScopes = peers.map((p) => ({ peer: p, scope: scopeOf(p) })).filter((e) => e.scope.size);
+  if (!peerScopes.length) return ancestry;
+
+  // SHARED FILES DO NOT ESTABLISH OWNERSHIP. Some paths are touched by everyone
+  // — a pending release-notes file, a strings catalog, a barrel index. If a
+  // commit's only overlap with a session is one of those, calling that session
+  // its owner is noise, and this codebase already records that alarm fatigue is
+  // itself a release-integrity defect. Ownership therefore requires at least one
+  // file that is NOT in most peers' scope; commits whose overlap is entirely
+  // shared are still reported, just not promoted or counted as peer-owned.
+  // The RELEASING session's own scope counts toward "shared", though it can
+  // never be an owner: with a single scoped peer the old threshold of 2 was
+  // unreachable, so a universal file (the pending release-notes doc, a strings
+  // catalog) that both the peer and the releaser had declared made the peer
+  // "owner" of every commit touching it (2026-08-17 review catch).
+  const self = (Array.isArray(sessions) ? sessions : []).find((s) => s && s.id === selfId);
+  const selfScope = self ? scopeOf(self) : new Set();
+  const claimCount = new Map();
+  for (const { scope } of peerScopes) {
+    for (const key of scope) claimCount.set(key, (claimCount.get(key) || 0) + 1);
+  }
+  for (const key of selfScope) claimCount.set(key, (claimCount.get(key) || 0) + 1);
+  const sharedThreshold = Math.max(2, Math.ceil((peerScopes.length + (selfScope.size ? 1 : 0)) / 2));
+  const isShared = (key) => (claimCount.get(key) || 0) >= sharedThreshold;
+
+  const lookup = (sha) => {
+    const key = String(sha || '').toLowerCase();
+    for (const [full, entry] of touched) if (full.startsWith(key) || key.startsWith(full)) return entry;
+    return null;
+  };
+
+  const ownersFor = (sha) => {
+    const entry = lookup(sha);
+    if (!entry || !entry.files || !entry.files.length) return { owners: null, entry };
+    const keys = entry.files.map((f) => normalizeFileKey(f, projectRoot)).filter(Boolean);
+    const owners = peerScopes
+      .map(({ peer, scope }) => {
+        const overlap = keys.filter((k) => scope.has(k));
+        if (!overlap.length) return null;
+        const distinctive = overlap.filter((k) => !isShared(k));
+        return {
+          sessionId: peer.id,
+          prefix: String(peer.id).slice(0, 8),
+          branch: peer.branch || null,
+          intent: peer.intent ? String(peer.intent).slice(0, 120) : null,
+          // Lead with the files that actually identify this owner.
+          files: [...distinctive, ...overlap.filter((k) => isShared(k))].slice(0, 4),
+          sharedScopeOnly: distinctive.length === 0,
+        };
+      })
+      .filter(Boolean);
+    if (!owners.length) return { owners: null, entry };
+    const strong = owners.filter((o) => !o.sharedScopeOnly);
+    return { owners: [...strong, ...owners.filter((o) => o.sharedScopeOnly)], strong: strong.length > 0, entry };
+  };
+
+  let peerOwnedCount = 0;
+  const sources = ancestry.sources.map((source) => {
+    const displayed = new Map((source.missing || []).map((c) => [String(c.sha || '').toLowerCase(), c]));
+    const annotated = (source.missing || []).map((commit) => {
+      const { owners, strong } = ownersFor(commit.sha);
+      if (!owners) return commit;
+      if (strong) peerOwnedCount++;
+      return { ...commit, owners };
+    });
+    // PROMOTE strong-owned commits that fell outside the display into it: the
+    // whole point of the join is that a commit with a live owner must never be
+    // invisible. Their subject comes from the same bounded git probe. Bounded to
+    // the display cap so a pathological lane cannot flood the refusal.
+    const promoted = [];
+    const candidateShas = Array.isArray(source.allShas) && source.allShas.length
+      ? source.allShas : [];
+    for (const full of candidateShas) {
+      if (promoted.length >= 8) break;
+      const isDisplayed = [...displayed.keys()].some((short) => full.startsWith(short) || short.startsWith(full));
+      if (isDisplayed) continue;
+      const { owners, strong, entry } = ownersFor(full);
+      if (!owners || !strong) continue;
+      peerOwnedCount++;
+      promoted.push({ sha: full.slice(0, 9), subject: (entry && entry.subject) || '', owners, promoted: true });
+    }
+    // Peer-owned commits sort to the TOP: they are the ones with a person
+    // attached, and the list is truncated for display, so they must not be the
+    // entries that fall off the bottom.
+    const strongOwned = (c) => Array.isArray(c.owners) && c.owners.some((o) => !o.sharedScopeOnly);
+    const ordered = [
+      ...annotated.filter(strongOwned),
+      ...promoted,
+      ...annotated.filter((c) => !strongOwned(c)),
+    ];
+    return { ...source, missing: ordered };
+  });
+  return { ...ancestry, sources, peerOwnedCount };
+}
+
 export function ancestryAcknowledged(ancestry, acknowledge = []) {
   if (!ancestry) return true;
   if (ancestry.isDescendant || ancestry.status === 'ok') return true;
@@ -293,7 +452,21 @@ export function ancestryAcknowledged(ancestry, acknowledge = []) {
   // to ignore the gate.
   if (ancestry.status === 'unnameable') return false;
   if (ancestry.status === 'unknown') return ancestry.reason !== 'target-unresolved';
-  const listed = (ancestry.sources || []).flatMap((s) => s.missing || []).map((c) => String(c.sha || '').toLowerCase());
+  // THE COMPLETE SET, never the display list. `missing` is the 8-per-source the
+  // prose names; `allShas` is everything the release drops. Deriving the
+  // requirement from `missing` is what let desktop v1.3.120 clear a gate over 71
+  // dropped commits by naming 10 — and the 61 it never had to name included the
+  // two features live sessions had promised the founder would be in that build.
+  // The contract is that the lease cannot be taken without REPRODUCING the shas;
+  // reproducing a truncated sample is not that contract.
+  // `allShas` is absent on ancestry objects built by an older engine, so fall
+  // back to the display list rather than vacuously passing.
+  const required = (ancestry.sources || []).flatMap((s) => (
+    Array.isArray(s.allShas) && s.allShas.length
+      ? s.allShas
+      : (s.missing || []).map((c) => c.sha)
+  )).map((s) => String(s || '').toLowerCase()).filter(Boolean);
+  const listed = [...new Set(required)];
   if (!listed.length) return false;
   const given = (acknowledge || []).map((s) => String(s || '').toLowerCase()).filter(Boolean);
   return listed.every((sha) => given.some((g) => g.startsWith(sha) || sha.startsWith(g)));
@@ -2532,6 +2705,13 @@ export function createMcpPresence({
                 .filter(Boolean)),
             ];
             gateAncestry = releaseAncestry(path.dirname(brainPath), releaseIntentChecked.ref, { peerBranches });
+            // Attach the live owner of every dropped commit BEFORE the gate
+            // decides, so a refusal can say whose work this is rather than
+            // handing the human a list of anonymous shas.
+            gateAncestry = annotateAncestryOwnership(gateAncestry, report.sessions, {
+              projectRoot: path.dirname(brainPath),
+              selfId: sessionId,
+            });
           } catch {
             // A probe that throws is not an all-clear either.
             gateAncestry = { status: 'unknown', reason: 'git-unavailable', ref: releaseIntentChecked.ref, isDescendant: false, missingCount: 0, sources: [], missing: [] };
@@ -2588,7 +2768,27 @@ export function createMcpPresence({
       } : null;
       if (outcome?.status === 'ancestry-unacknowledged') {
         const anc = outcome.ancestry;
-        const shas = (anc.sources || []).flatMap((s) => s.missing || []).map((c) => c.sha);
+        // The COMPLETE set the gate will demand, not the subset the prose names.
+        // These two used to be the same list, which is how a release dropping 71
+        // commits was acknowledged by naming 10. The prose still shows 8 per
+        // source — a wall of 71 shas teaches people to skim — but the requirement
+        // is now honest about its own size, and the text below says both numbers.
+        const shas = [...new Set((anc.sources || []).flatMap((s) => (
+          Array.isArray(s.allShas) && s.allShas.length
+            ? s.allShas
+            : (s.missing || []).map((c) => c.sha)
+        )).map((s) => String(s || '')).filter(Boolean))];
+        // PREFIX-tolerant, both directions (2026-08-17 review catch, verified by
+        // execution): the prose shows abbreviated `%h` shas while allShas are
+        // full 40-char, so an exact Set.has never matched and the honesty NOTE
+        // claimed "only 0 spelled out above" on every refusal — the one sentence
+        // added for honesty contradicted the sha list directly above it.
+        const namedInProse = [...new Set((anc.sources || [])
+          .flatMap((s) => s.missing || []).map((c) => String(c.sha || '').toLowerCase()).filter(Boolean))];
+        const unnamed = shas.filter((s) => {
+          const full = String(s).toLowerCase();
+          return !namedInProse.some((p) => full.startsWith(p) || p.startsWith(full));
+        }).length;
         releaseLease = {
           status: 'refused',
           kind: 'release-would-leave-work-behind',
@@ -2601,8 +2801,13 @@ export function createMcpPresence({
             sources: anc.sources,
           },
           // Exactly what the retry must echo. Named so a caller never has to
-          // guess the shape of the second call.
-          acknowledgeRequired: shas,
+          // guess the shape of the second call. NEVER populated on the
+          // 'unnameable' path: the gate refuses that status unconditionally, so
+          // listing shas there instructs an acknowledge that can never succeed
+          // (2026-08-17 review catch — the primary fix renders bare shas at the
+          // source so 'unnameable' now truly means no shas at all; this guard is
+          // the belt to that suspender).
+          acknowledgeRequired: anc.status === 'unnameable' ? [] : shas,
         };
         releaseText = [
           'KLYPIX release lease REFUSED — the lease was not taken. No release state changed.',
@@ -2613,8 +2818,14 @@ export function createMcpPresence({
           // retry made the bypass the easiest thing on screen — an agent could
           // copy it and never say a word to anyone. The shas are listed above;
           // reproducing them is the work, and the work is the point.
-          shas.length
-            ? `To proceed anyway, re-send releaseIntent with an "acknowledge" array naming each of the ${shas.length} sha(s) listed above. Only do that after the user has been told and has decided.`
+          (anc.status !== 'unnameable' && shas.length)
+            ? [
+              `To proceed anyway, re-send releaseIntent with an "acknowledge" array naming each of the ${shas.length} sha(s) in acknowledgeRequired.`,
+              unnamed
+                ? `NOTE: only ${shas.length - unnamed} of those ${shas.length} are spelled out above — ${unnamed} more are in acknowledgeRequired and are NOT shown in this text. Read them before you decide; the prose is a sample, the requirement is the whole set.`
+                : '',
+              'Only do that after the user has been told and has decided.',
+            ].filter(Boolean).join(' ')
             : 'This release cannot be acknowledged automatically — the missing work could not be listed. Resolve it with the user before continuing.',
         ].join('\n');
       } else if (outcome?.status === 'conflict') {

package/src/project-graph.mjs

@@ -791,10 +791,16 @@ function checkoutStaleness(root) {
   const target = (defaultRef || '').trim() || ['origin/main', 'origin/master']
     .find(ref => runGit(root, ['rev-parse', '--verify', '--quiet', ref]) != null);
   if (!target) return null;
-  const behindRaw = runGit(root, ['rev-list', '--count', `HEAD..${target}`]);
-  const behind = Number((behindRaw || '').trim());
-  if (!Number.isFinite(behind)) return null;
-  return { branch: (head || '').trim() || null, comparedTo: target, behind };
+  // Two-sided, deliberately: a checkout that is behind AND ahead has DIVERGED,
+  // and telling its agent to "pull" is advice the measurement itself contradicts.
+  // Same idiom as repo-state.mjs — one call answers both questions.
+  const counts = runGit(root, ['rev-list', '--left-right', '--count', `HEAD...${target}`]);
+  const match = (counts || '').trim().match(/^(\d+)\s+(\d+)$/);
+  if (!match) return null;
+  const ahead = Number(match[1]);
+  const behind = Number(match[2]);
+  if (!Number.isFinite(ahead) || !Number.isFinite(behind)) return null;
+  return { branch: (head || '').trim() || null, comparedTo: target, behind, ahead, diverged: ahead > 0 && behind > 0 };
 }
 
 /**
@@ -882,8 +888,21 @@ export function brainDriftMarkdown(result) {
   }
   const lines = ['# Brain drift — cards vs the repo\'s real files'];
   const stale = result.staleCheckout;
+  if (stale && stale.behind === 0 && stale.ahead > 0) {
+    // The FALSE NEGATIVE is the expensive half (desktop 1.3.107 shipped
+    // off-trunk in exactly this silence): a checkout carrying unpushed commits
+    // deserves a line even when it is not behind — files reported PRESENT below
+    // may exist only here.
+    lines.push(`⚠️ **This checkout is ${stale.ahead} commit(s) ahead of \`${stale.comparedTo}\`** (branch \`${stale.branch || '?'}\`). Files reported present below may exist only in THIS checkout, not on the default branch.`);
+  }
   if (stale && stale.behind > 0) {
-    lines.push(`⚠️ **This checkout is ${stale.behind} commit(s) behind \`${stale.comparedTo}\`** (branch \`${stale.branch || '?'}\`, as of the last fetch). Files reported missing below may simply not be in THIS checkout — pull before trusting the card verdicts.`);
+    // State the measurement, never the operation: on a diverged checkout "pull"
+    // is contradicted by the very numbers printed beside it, and this tool has
+    // no way to know whether the local commits are meant to be kept.
+    const where = `(branch \`${stale.branch || '?'}\`, as of the last fetch)`;
+    lines.push(stale.diverged
+      ? `⚠️ **This checkout has DIVERGED from \`${stale.comparedTo}\`: ${stale.ahead} commit(s) ahead, ${stale.behind} behind** ${where}. Files reported missing below may simply not be in THIS checkout, and files reported present may exist only here. The verdicts are unreliable until the two lines are reconciled — which is a decision about the ${stale.ahead} local commit(s), not a fast-forward.`
+      : `⚠️ **This checkout is ${stale.behind} commit(s) behind \`${stale.comparedTo}\`** ${where}. Files reported missing below may simply not be in THIS checkout; the verdicts are unreliable until this checkout matches \`${stale.comparedTo}\`.`);
   }
   const s = result.summary;
   lines.push(`Checked ${s.cards} card(s); ${s.cardsWithCheckableRefs} referenced this repo's files (${s.refsChecked} reference(s), ${s.refsOk} still valid). **${s.driftedCards} card(s) reference files that are gone or moved.**`);

package/src/repo-state.mjs

@@ -177,6 +177,50 @@ const UNIT_SEP = '';
  * @returns {null|{trunk, ref, isDescendant, missingCount, missing:Array<{sha,subject}>}}
  *   null when the question cannot be answered (no git, no trunk, unknown ref).
  */
+/**
+ * Which files each commit touched — one bounded batch call.
+ *
+ * This exists to JOIN the leave-behind set to the presence table. The engine
+ * has always modelled "which files are two sessions editing right now" and,
+ * separately, "what would this release drop", and never connected them. So a
+ * dropped commit arrived as an anonymous sha even when the session that wrote
+ * it was live in the same lane, had declared the exact files, and had told the
+ * human its work would be in the build. Field case: desktop v1.3.120.
+ *
+ * Merge commits legitimately yield no names under `--name-only`; feature work
+ * is what this join is for, so that is acceptable rather than worked around.
+ */
+export function commitFiles(projectDir, shas, { execGit = defaultExecGit, timeoutMs = 4000, max = 40 } = {}) {
+  const git = makeGit(execGit);
+  const dir = String(projectDir || '');
+  const list = [...new Set((shas || []).map((s) => String(s || '').trim()).filter(Boolean))].slice(0, max);
+  const out = new Map();
+  if (!dir || !list.length) return out;
+  // An explicit 
 sentinel before each sha, so blocks parse unambiguously.
+  // File paths may contain almost anything; a control char cannot appear in one.
+  const SENTINEL = '
';
+  // `core.quotepath=false` because git otherwise C-quotes non-ASCII paths
+  // ("\330\247..."), which normalizeFileKey can never match against a declared
+  // Arabic filename — attribution went silently blind for AR users (review
+  // catch, verified live). The subject rides the header line behind a unit
+  // separator so a commit promoted into the display from beyond the prose
+  // list still has a human-readable name.
+  const raw = git(dir, ['-c', 'core.quotepath=false', 'show', '--name-only', `--format=${SENTINEL}%H${UNIT_SEP}%s`, ...list], timeoutMs);
+  if (raw === null) return out;                       // probe failed: no owners, never a wrong owner
+  for (const block of String(raw).split(SENTINEL)) {
+    const lines = block.split('\n').map((l) => l.trim()).filter(Boolean);
+    if (!lines.length) continue;
+    const sep = lines[0].indexOf(UNIT_SEP);
+    const sha = sep < 0 ? lines[0] : lines[0].slice(0, sep);
+    if (!/^[0-9a-f]{7,40}$/i.test(sha)) continue;
+    out.set(sha.toLowerCase(), {
+      files: lines.slice(1),
+      subject: sep < 0 ? '' : lines[0].slice(sep + 1).slice(0, 120),
+    });
+  }
+  return out;
+}
+
 export function releaseAncestry(projectDir, ref, { execGit = defaultExecGit, peerBranches = [] } = {}) {
   const git = makeGit(execGit);
   const dir = String(projectDir || '');
@@ -290,16 +334,41 @@ export function releaseAncestry(projectDir, ref, { execGit = defaultExecGit, pee
     const cherry = git(dir, ['cherry', target, cand.ref], CHERRY_TIMEOUT_MS);
     let count;
     let shown;
+    // Every sha this source drops, not just the ones the prose will name. The
+    // acknowledgement handshake reads this; the prose reads `shown`.
+    let allMissingShas = [];
     let approximate = false;
     if (cherry !== null) {
-      const missingShas = cherry.split('\n')
+      const allCherry = cherry.split('\n')
         .filter((l) => l.startsWith('+ '))
         .map((l) => l.slice(2).trim())
-        .filter(Boolean)
-        .slice(0, MAX_CHERRY_SCAN);
-      count = missingShas.length;
+        .filter(Boolean);
+      // TAIL, not head. `git cherry` emits OLDEST first, so a head slice on a
+      // >500-commit divergence dropped the NEWEST commits from both the display
+      // AND the acknowledgement — the exact failure class the newest-first fix
+      // exists to prevent, reintroduced one level up (2026-08-17 review catch).
+      // The tail keeps the newest; `count` stays the TRUE total so missingCount
+      // never understates; `scanCapped` lets the warning text admit the cap.
+      const missingShas = allCherry.slice(-MAX_CHERRY_SCAN);
+      count = allCherry.length;
       if (count <= 0) continue;              // every change is already present
-      shown = missingShas.slice(0, MAX_MISSING_LISTED);
+      // NEWEST FIRST, and this is the whole point of the list. `git cherry` emits
+      // OLDEST first, so slicing it raw showed the eight most ANCIENT missing
+      // commits while hiding everything recent — and the fallback branch below,
+      // which uses `git log`, showed the eight NEWEST. The two paths disagreed,
+      // and the PRECISE one was the worse of the two.
+      //
+      // Field case 2026-08-16, desktop v1.3.120: the gate refused correctly and
+      // named 69 commits missing from master, but the eight it SHOWED were weeks
+      // old. The three the human was actually waiting for — an Arrow tool and a
+      // zoom-relative stroke-width pair committed 28 minutes earlier, which a peer
+      // session had already promised would "ride the next build" — sat at the end
+      // of the list and were never displayed. The human approved a narrow build on
+      // an accurate refusal whose visible evidence omitted the deciding facts.
+      // A truncated list is a RANKING problem: show what someone is most likely to
+      // be waiting for, which is always the most recent work.
+      allMissingShas = missingShas.reverse();          // newest first
+      shown = allMissingShas.slice(0, MAX_MISSING_LISTED);
     } else {
       // FALL BACK, never skip. rev-list is sha-based so it over-reports
       // rebases and squashes, but over-reporting is a conversation and
@@ -309,18 +378,31 @@ export function releaseAncestry(projectDir, ref, { execGit = defaultExecGit, pee
       count = Number(countRaw);
       if (!Number.isFinite(count) || count <= 0) continue;
       approximate = true;
-      const fallbackLog = git(dir, ['log', `--max-count=${MAX_MISSING_LISTED}`, '--format=%H', `${target}..${cand.ref}`]);
-      shown = (fallbackLog || '').split('\n').map((s) => s.trim()).filter(Boolean);
+      // Fetch the full bounded set, not just what will be shown: the gate needs
+      // every sha even on the approximate path, and `git log` is already
+      // newest-first so both branches now agree on ordering AND on completeness.
+      const fallbackLog = git(dir, ['log', `--max-count=${MAX_CHERRY_SCAN}`, '--format=%H', `${target}..${cand.ref}`]);
+      allMissingShas = (fallbackLog || '').split('\n').map((s) => s.trim()).filter(Boolean);
+      shown = allMissingShas.slice(0, MAX_MISSING_LISTED);
     }
     if (!shown.length) continue;
     // One bounded call for the subjects of just what will be shown.
     const log = git(dir, ['log', '--no-walk', `--format=%h%x1f%s`, ...shown]);
-    const parsed = (log || '').split('\n').filter(Boolean).map((line) => {
+    let parsed = (log || '').split('\n').filter(Boolean).map((line) => {
       const sep = line.indexOf(UNIT_SEP);
       return sep < 0
         ? { sha: line.trim(), subject: '' }
         : { sha: line.slice(0, sep).trim(), subject: line.slice(sep + 1).slice(0, 120) };
     });
+    // A failed SUBJECT probe must not erase the shas (2026-08-17 review catch).
+    // When this log call times out while cherry succeeded, `parsed` was empty,
+    // `missing` was empty, and the whole ancestry degraded to 'unnameable' —
+    // whose refusal then listed acknowledgeRequired from allShas while the gate
+    // unconditionally refused 'unnameable': an instruction that can never
+    // succeed. Shas without subjects are still NAMEABLE; render them bare.
+    if (!parsed.length && shown.length) {
+      parsed = shown.map((sha) => ({ sha: String(sha).slice(0, 9), subject: '' }));
+    }
     // Trunk and a peer sitting on trunk are the DEFAULT configuration, so the
     // same commits would otherwise be counted twice and demanded twice. Each
     // sha is attributed to the first source that reports it.
@@ -331,7 +413,35 @@ export function releaseAncestry(projectDir, ref, { execGit = defaultExecGit, pee
     // source, so the list may include work that is already present under a
     // different sha. Carried on the source so the text can say so rather than
     // asserting a precision it does not have.
-    sources.push({ ...cand, missingCount: count, missing, ...(approximate ? { approximate: true } : {}) });
+    // DISPLAY IS BOUNDED; THE GATE MUST NOT BE. `missing` is the 8 commits the
+    // prose will name. `allShas` is every sha this source drops, and it is what
+    // the acknowledgement handshake has to demand.
+    //
+    // Field case 2026-08-16, desktop v1.3.120: ancestryAcknowledged() derived its
+    // requirement from `missing` — the DISPLAY list — so a release dropping 71
+    // commits was cleared by naming 10. The design's whole contract is that a
+    // lease "cannot be taken without REPRODUCING the shas it is choosing to
+    // leave behind", on the reasoning that a model forced to reproduce them has
+    // in practice had to relay them. Deriving the requirement from a truncated
+    // list quietly reduced that contract to whatever happened to fit on screen.
+    // A truncated requirement is a truncated guarantee.
+    const allShas = (allMissingShas.length ? allMissingShas : parsed.map((c) => c.sha))
+      .map((s) => String(s || '').toLowerCase())
+      .filter(Boolean);
+    sources.push({
+      ...cand,
+      missingCount: count,
+      missing,
+      allShas,
+      // True when the prose cannot name everything this source drops, so the
+      // caller can say "8 of 71 shown" instead of implying the list is complete.
+      listTruncated: allShas.length > missing.length,
+      // True when even allShas is a cap (divergence beyond MAX_CHERRY_SCAN):
+      // the acknowledgement then covers the newest 500 but NOT everything, and
+      // the warning text must say so rather than let a capped ack read as full.
+      ...(count > allShas.length ? { scanCapped: true } : {}),
+      ...(approximate ? { approximate: true } : {}),
+    });
   }
 
   if (!sources.length) {
@@ -387,12 +497,31 @@ export function releaseAncestryWarnings(ancestry) {
   const lines = [
     `RELEASE WOULD LEAVE WORK BEHIND — ${missingCount} finished commit(s) already exist that this release does not include.`,
   ];
+  // The join to the presence table, stated first because it is the fact most
+  // likely to change the decision: some of this work belongs to somebody who is
+  // online now and may have already promised it would ship.
+  if (ancestry.peerOwnedCount) {
+    lines.push(`  ${ancestry.peerOwnedCount} of them touch files a LIVE session has declared or is editing — that session may have already told the user this work would be in the build. Name them to the user, and consider asking those sessions before you acknowledge.`);
+  }
   for (const s of sources) {
     lines.push(s.kind === 'trunk'
       ? `  ${s.missingCount} commit(s) on ${s.ref} (the main line) are not in ${ref}:`
       : `  ${s.missingCount} commit(s) on ${s.ref} — a branch someone is working on right now — are not in ${ref}:`);
-    for (const c of s.missing) lines.push(`    · ${c.sha} ${c.subject}`);
+    for (const c of s.missing) {
+      // A sha with a live owner attached is a different conversation from an
+      // anonymous one: it names a person who is online RIGHT NOW and who very
+      // likely believes this work is in the build. Say so on the same line.
+      const owners = (Array.isArray(c.owners) ? c.owners : []).filter((o) => !o.sharedScopeOnly);
+      const who = owners.length
+        ? `  ← OWNED BY LIVE SESSION ${owners.map((o) => o.prefix).join(', ')} (${owners[0].files.slice(0, 2).join(', ')})`
+        : '';
+      lines.push(`    · ${c.sha} ${c.subject}${who}`);
+    }
     if (s.missingCount > s.missing.length) lines.push(`    · …and ${s.missingCount - s.missing.length} more not listed`);
+    if (s.scanCapped) {
+      lines.push(`    (divergence exceeds the ${Array.isArray(s.allShas) ? s.allShas.length : 500}-commit scan cap — the acknowledgement below covers only the newest ${Array.isArray(s.allShas) ? s.allShas.length : 500};`);
+      lines.push('     a divergence this size should be RESOLVED, not acknowledged)');
+    }
     if (s.approximate) {
       lines.push('    (this list is approximate — the equivalence check could not run, so some of');
       lines.push('     these may already be in the release under a different commit id)');