ruvnet-brain 4.6.3 → 4.6.4

package/plugin/scripts/learn-capture.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 // PostToolUse captures only a fixed workflow vocabulary, then schedules bounded orphan recovery.
+import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
 import { spawn } from 'node:child_process';
@@ -7,38 +8,70 @@ import { fileURLToPath } from 'node:url';
 import { readStdinBounded } from './hook-input.mjs';
 import { learningContext } from './runtime-preferences.mjs';
 import { learningTarget } from './learning-store.mjs';
-import { safeQueue, safeAction, writeExclusive, takeQueueLock, releaseQueueLock } from './learning-queue.mjs';
+import { safeQueue, safeAction, writeExclusive, takeQueueLock, releaseQueueLock, queueFiles } from './learning-queue.mjs';
 
-try {
-  const context = learningContext();
-  if (!context.enabled) process.exit(0);
-  const raw = await readStdinBounded({ maxBytes: 65536, emptyMs: 150 });
-  const input = JSON.parse(raw.toString());
-  if (input.hook_event_name && input.hook_event_name !== 'PostToolUse') process.exit(0);
-  const response = input.tool_response;
-  if (typeof response === 'string') {
-    const exit = /^Process exited with code (-?\d+)\s*$/m.exec(response);
-    if ((exit && Number(exit[1]) !== 0) || /Process running with session ID/.test(response)) process.exit(0);
-  }
-  if (input.error || input.is_error === true || response?.error || response?.interrupted === true || response?.signal
-    || response?.success === false || response?.is_error === true || response?.isError === true
-    || [response?.exit_code, response?.exitCode, response?.status].some(value => Number.isInteger(value) && value !== 0)) process.exit(0);
-  const tool = input.tool_name;
-  if (!['Bash', 'Write', 'Edit', 'MultiEdit'].includes(tool)) process.exit(0);
-  const action = safeAction(tool, tool === 'Bash' ? input.tool_input?.command : 'edit file');
-  if (!action) process.exit(0);
-  const fresh = learningContext();
-  if (!fresh.enabled || fresh.queueDir !== context.queueDir) process.exit(0);
-  learningTarget(fresh); // Existing authorized user store is required before creating any user queue bytes.
-  const dir = safeQueue(fresh, true);
-  const sid = createHash('sha256').update(String(input.session_id || process.env.CLAUDE_SESSION_ID || 'default')).digest('hex').slice(0, 24);
-  writeExclusive(path.join(dir, `session-${sid}-${randomUUID()}.jsonl`), JSON.stringify({ tool, action }) + '\n');
-  // Per-scope lock in the flusher suppresses duplicate workers; capture never waits on the learner.
-  const token = takeQueueLock(fresh);
-  if (!token) process.exit(0);
-  const child = spawn(process.execPath, [fileURLToPath(new URL('./learn-flush.mjs', import.meta.url)), '--supervisor'], {
-    cwd: fresh.projectDir, detached: true, stdio: 'ignore', windowsHide: true, env: { ...process.env, RUVNET_LEARN_WORKER_TOKEN: token },
-  });
-  child.on('error', () => releaseQueueLock(fresh, token)); child.unref();
-} catch { /* advisory transport; unsafe/malformed input produces no persisted payload */ }
-process.exit(0);
+/**
+ * One PostToolUse observation. Since ADR-106 it runs IN-PROCESS from session-snapshot's PostToolUse
+ * boundary (one registration instead of two); the script entry below stays for explicit invocation.
+ * learningContext() owns consent and brain-off, so the fold keeps ADR-054's OFF contract.
+ */
+export function captureLearning(input) {
+  try {
+    const context = learningContext();
+    if (!context.enabled || !input || typeof input !== 'object') return false;
+    if (input.hook_event_name && input.hook_event_name !== 'PostToolUse') return false;
+    const response = input.tool_response;
+    if (typeof response === 'string') {
+      const exit = /^Process exited with code (-?\d+)\s*$/m.exec(response);
+      if ((exit && Number(exit[1]) !== 0) || /Process running with session ID/.test(response)) return false;
+    }
+    if (input.error || input.is_error === true || response?.error || response?.interrupted === true || response?.signal
+      || response?.success === false || response?.is_error === true || response?.isError === true
+      || [response?.exit_code, response?.exitCode, response?.status].some(value => Number.isInteger(value) && value !== 0)) return false;
+    const tool = input.tool_name;
+    if (!['Bash', 'Write', 'Edit', 'MultiEdit'].includes(tool)) return false;
+    const action = safeAction(tool, tool === 'Bash' ? input.tool_input?.command : 'edit file');
+    if (!action) return false;
+    const fresh = learningContext();
+    if (!fresh.enabled || fresh.queueDir !== context.queueDir) return false;
+    learningTarget(fresh); // Existing authorized user store is required before creating any user queue bytes.
+    const dir = safeQueue(fresh, true);
+    const sid = createHash('sha256').update(String(input.session_id || process.env.CLAUDE_SESSION_ID || 'default')).digest('hex').slice(0, 24);
+    writeExclusive(path.join(dir, `session-${sid}-${randomUUID()}.jsonl`), JSON.stringify({ tool, action }) + '\n');
+    // Per-scope lock in the flusher suppresses duplicate workers; capture never waits on the learner.
+    const token = takeQueueLock(fresh);
+    if (!token) return true;
+    const child = spawn(process.execPath, [fileURLToPath(new URL('./learn-flush.mjs', import.meta.url)), '--supervisor'], {
+      cwd: fresh.projectDir, detached: true, stdio: 'ignore', windowsHide: true, env: { ...process.env, RUVNET_LEARN_WORKER_TOKEN: token },
+    });
+    child.on('error', () => releaseQueueLock(fresh, token)); child.unref();
+    return true;
+  } catch { return false; /* advisory transport; unsafe/malformed input produces no persisted payload */ }
+}
+
+/**
+ * Lifecycle recovery (formerly its own SessionStart/SessionEnd registration, ADR-106): when learning
+ * is enabled, start learn-flush detached so an orphaned queue is drained by one finite worker. The
+ * caller never waits; learn-flush owns the lock, the deadline and the consent re-checks.
+ */
+export function scheduleLearningRecovery({ cwd = process.cwd(), env = process.env, spawnFn = spawn } = {}) {
+  try {
+    const context = learningContext({ env, cwd });
+    if (!context.enabled) return false;
+    // Nothing queued, nothing to recover. Spawning anyway cost a process at every session boundary and,
+    // on Windows, a live worker holds the project directory as its cwd (EBUSY on delete/move).
+    if (queueFiles(context, { limit: 1, deadline: Date.now() + 100 }).length === 0) return false;
+    const child = spawnFn(process.execPath, [fileURLToPath(new URL('./learn-flush.mjs', import.meta.url))], {
+      cwd, detached: true, stdio: 'ignore', windowsHide: true, env });
+    child.on?.('error', () => {}); child.unref?.();
+    return true;
+  } catch { return false; }
+}
+
+const isMain = (() => { try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })();
+if (isMain) {
+  try {
+    if (learningContext().enabled) captureLearning(JSON.parse((await readStdinBounded({ maxBytes: 65536, emptyMs: 150 })).toString()));
+  } catch { /* malformed input produces no persisted payload */ }
+  process.exit(0);
+}

package/plugin/scripts/project-transition-hook.mjs

@@ -15,7 +15,7 @@ import { normalizeHostEvent } from './hook-input.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
 import { withProgressionReader } from './project-progression-reader.mjs';
 import { redactProgression, restoreProjectProgression, digestCanonical, validateProgressionSnapshot } from './project-progression-contract.mjs';
-import { runSessionSnapshotHook, effectiveBudgetMs, queueCapture, replayOutboxDetached, runOutboxReplay } from './session-snapshot-hook.mjs';
+import { runSessionSnapshotHook, queueCapture, replayOutboxDetached } from './session-snapshot-hook.mjs';
 
 const EVENTS = new Set(['UserPromptSubmit', 'PreToolUse', 'PostToolUse', 'PostToolUseFailure', 'SubagentStop']);
 const TOPICS = [
@@ -197,8 +197,23 @@ export function captureNormalizedTransition(job, { readHistory = readTransitionH
   return { ...result, eventId: normalized.observation.id };
 }
 
+/** Queued work older than this is no longer in flight; the boundary says so (continuity-journal STUCK_AFTER_MS). */
+export const QUEUE_STUCK_AFTER_MS = 10 * 60_000;
+
+/**
+ * Prompt and tool boundaries (UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure,
+ * SubagentStop) do only bounded, local work: consent and identity, fsync the observation into the
+ * durable queue, hand the queue to the detached replay worker, return. No native store write runs
+ * inline. Measured 2026-10-11: each inline commit cost one ~3 s native write per boundary, queued
+ * debt made every later boundary spend its full 6.5 s budget, and under load the host killed the
+ * hook at its 10 s timeout and discarded its output. A queued-and-handed-off observation is the
+ * NORMAL state and says nothing; only an unwritable queue or work stuck past
+ * QUEUE_STUCK_AFTER_MS is reported. Exact readback is unchanged: the worker commits each item only
+ * by exact readback (captureNormalizedTransition), and Stop/PreCompact/SessionEnd keep their own
+ * bounded synchronous budgets.
+ */
 export function runProjectTransitionHook(projectDir, event, { payload = {}, host = process.env.RUVNET_HOOK_HOST || 'claude',
-  readHistory = readTransitionHistory, capture = runSessionSnapshotHook, env = process.env } = {}) {
+  env = process.env, spawnReplay = replayOutboxDetached, now = Date.now } = {}) {
   if (developmentHooksSuspended(projectDir)) return { state: 'skipped', reason: 'development hooks suspended' };
   const suspended = automaticProgressionSuspensionResult(env, { state: 'suspended', reason: 'automatic project progression is operator-suspended' });
   if (suspended) return suspended;
@@ -218,12 +233,16 @@ export function runProjectTransitionHook(projectDir, event, { payload = {}, host
     payload: { session_id: payload.session_id, hook_event_name: transportEvent,
       normalizedTransition: { observation, sourceIdentity: observeTransitionSource(resolution, projectDir) } } });
   if (!queued) return { state: 'degraded', reason: 'normalized observation queue unwritable', eventId: observation.id };
-  let result = null;
-  runOutboxReplay({ projectDir: resolution.projectRoot, env, budgetMs: Math.min(6500, effectiveBudgetMs(env)),
-    captureNormalized: (job, options) => captureNormalizedTransition(job, { ...options, env, readHistory, capture }),
-    onCaptured: (captured) => { if (captured?.eventId === observation.id) result = captured; } });
-  if (!result?.receipt) replayOutboxDetached({ projectDir: resolution.projectRoot, env });
-  return { state: result?.progressionCaptured && result.receipt ? 'committed' : 'pending', eventId: observation.id, result };
+  const handed = spawnReplay({ projectDir: resolution.projectRoot, env });
+  let oldest = Infinity;
+  try {
+    for (const name of fs.readdirSync(path.join(resolution.projectRoot, '.swarm'))) {
+      if (!/^\.progression-capture-(?:queue|claimed)-.*\.json$/.test(name)) continue;
+      oldest = Math.min(oldest, fs.statSync(path.join(resolution.projectRoot, '.swarm', name)).mtimeMs);
+    }
+  } catch { /* the observation itself is already durable */ }
+  if (now() - oldest > QUEUE_STUCK_AFTER_MS) return { state: 'stuck', eventId: observation.id, handed, oldestQueuedAt: new Date(oldest).toISOString() };
+  return { state: 'queued', eventId: observation.id, handed };
 }
 
 /** One pending-readback condition across prompt/tool boundaries and both CLI entrypoints. */
@@ -238,8 +257,10 @@ if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.me
     const payload = JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
     const projectDir = payload.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
     const result = runProjectTransitionHook(projectDir, process.argv[2], { payload });
-    if (result.state === 'pending') {
-      const message = transitionPendingNotice(projectDir, payload, 'Project memory transition is pending; exact AgentDB readback was not verified at this boundary.');
+    if (result.state === 'stuck' || result.state === 'degraded') {
+      const message = transitionPendingNotice(projectDir, payload, result.state === 'stuck'
+        ? `Project memory capture is stuck: queued work since ${result.oldestQueuedAt} has not been committed by exact readback.`
+        : 'Project memory capture degraded: the observation queue is unwritable.');
       if (message) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: process.argv[2], additionalContext: message } }));
     }
   } catch { process.stdout.write(JSON.stringify({ systemMessage: 'Project memory transition capture degraded; exact readback was not verified.' })); }

package/plugin/scripts/session-snapshot-hook.mjs

@@ -323,8 +323,13 @@ if (process.argv[1] && path.resolve(process.argv[1]).endsWith('session-snapshot-
     const payload = JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
     const projectDir = payload.cwd || projectDirectory();
     const result = runProjectTransitionHook(projectDir, process.argv[2], { payload });
-    if (result.state === 'pending') {
-      const message = transitionPendingNotice(projectDir, payload, 'Project memory transition remains pending; exact readback was not verified.');
+    // ADR-106: learning capture rides this boundary instead of a second PostToolUse registration.
+    if (process.argv[2] === 'PostToolUse') { try { (await import('./learn-capture.mjs')).captureLearning(payload); } catch { /* advisory */ } }
+    // A queued, handed-off observation is normal and silent (ADR-106); only stuck or degraded speaks.
+    if (result.state === 'stuck' || result.state === 'degraded') {
+      const message = transitionPendingNotice(projectDir, payload, result.state === 'stuck'
+        ? `Project memory capture is stuck: queued work since ${result.oldestQueuedAt} has not been committed by exact readback.`
+        : 'Project memory capture degraded: the observation queue is unwritable.');
       if (message) process.stdout.write(JSON.stringify({ systemMessage: message }));
     }
   } catch { process.stdout.write(JSON.stringify({ systemMessage: 'Project memory transition capture degraded; exact readback was not verified.' })); }
@@ -340,6 +345,10 @@ if (process.argv[1] && path.resolve(process.argv[1]).endsWith('session-snapshot-
       if (typeof cwd === 'string' && path.isAbsolute(cwd)) originProjectDir = cwd;
     } catch { /* malformed input keeps the host's project fallback */ }
     const result = runSessionSnapshotHook(originProjectDir, process.argv[2] || 'SessionEnd', { rawInput });
+    // ADR-106: learning recovery rides SessionEnd instead of a second SessionEnd registration.
+    if ((process.argv[2] || 'SessionEnd') === 'SessionEnd') {
+      import('./learn-capture.mjs').then((m) => m.scheduleLearningRecovery({ cwd: originProjectDir })).catch(() => {});
+    }
     // FAIL LOUDLY, NEVER SILENTLY — AND ONCE. When recording is stuck (events pending past STUCK_AFTER_MS,
     // a quarantined conflict, a corrupt outbox line, a cap drop) Claude Code shows this systemMessage, at
     // most once per session per condition (stopNotice; it used to repeat at every turn). "Not applicable"

package/plugin/scripts/session-start-core.mjs

@@ -34,6 +34,7 @@ import {
 } from './session-start-fsutil.mjs';
 import { maintainerIssueEntitlement, surfaceIssuePointer } from './session-start-issue-alert.mjs';
 import { surfaceSignals } from './session-start-signals.mjs';
+import { failureLine, FAILURE_LINE_PREFIX } from './hook-failures.mjs';
 import { brainState, health, knowledgeCurrency, mcpReadiness, KNOWLEDGE_LINE_PREFIX } from './session-start-health.mjs';
 import { stableSpine, heartbeat, knowledgeAutoUpdate, footprintCheck } from './session-start-update-plane.mjs';
 import { FOOTPRINT_LINE_PREFIX } from './brain-confirmation.mjs';
@@ -98,6 +99,7 @@ export async function runSessionStart({
   probeConsoleAlias = probeCodexConsoleAlias,
   startedAt = Date.now(),
   deadlineAt = Infinity,
+  scheduleRecovery = true,
 } = {}) {
   const hookDeadlineAt = Math.min(deadlineAt, sessionStartDeadlineAt({ host: env.RUVNET_HOOK_HOST || 'claude', env, startedAt }));
   const lines = [];
@@ -137,7 +139,8 @@ export async function runSessionStart({
       || s.startsWith('[RuvNet Brain — PROJECT CONTINUITY UNKNOWN]')
       || s.startsWith('[RuvNet Brain — PROJECT CONTINUITY RESTORED]')
       || s.startsWith('[RuvNet Brain — COME UP TO SPEED')
-      || s.startsWith('[RuvNet Brain — MAINTAINER ONLY:');
+      || s.startsWith('[RuvNet Brain — MAINTAINER ONLY:')
+      || s.startsWith(FAILURE_LINE_PREFIX);
   };
   // An alarm's HEADER line always matches isSafeStatus on its own dedicated prefix (above); its
   // explanatory BODY lines do not, and without this they were silently dropped — a real gap this
@@ -170,6 +173,8 @@ export async function runSessionStart({
   const home = env.HOME || env.USERPROFILE || os.homedir();
   const stateDir = env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain');
   resetInjectionDedupe(stateDir, Date.now());
+  // ADR-106: advisory hooks fail open, so a failed one is reported here, once, never per fire.
+  try { const failed = failureLine(stateDir); if (failed) emit(failed); } catch { /* the summary must not cost the session */ }
   const hookDir = path.dirname(fileURLToPath(import.meta.url));
   const now = Date.now();
   const consoleInvoke = env.RUVNET_HOOK_HOST === 'codex' ? '$ruvnet-brain:rnbc' : '/rnbc';
@@ -449,6 +454,9 @@ export async function runSessionStart({
   stdout.write(output);
   trace('body-finished');
   recordProof({ stages: tracer.table(), restore: restoreProof, bodyFailed, bannerFallback: !bannerEmitted });
+  // ADR-106: learning recovery rides SessionStart instead of a second SessionStart registration.
+  // learningContext() inside owns consent and brain-off; the detached worker is never awaited.
+  if (scheduleRecovery) { try { (await import('./learn-capture.mjs')).scheduleLearningRecovery({ cwd, env }); } catch { /* advisory */ } }
   return { ok: true, outputBytes: Buffer.byteLength(output, 'utf8'), platform };
 }
 

package/plugin/scripts/turn-outcome-capture.mjs

@@ -41,7 +41,7 @@ import { fileURLToPath } from 'node:url';
 import { nativeTurnLines } from './native-turn-transcript.mjs';
 import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
 import { rufloCwdFor, rufloScratchRoot } from './project-progression-store.mjs';
-import { redactText, userLevelAgentdbHooks } from './continuity-events.mjs';
+import { redactText } from './continuity-events.mjs';
 import { resolveProjectStore, globalEnrollmentAllowed } from './project-store-resolver.mjs';
 import { digest, journalTurn, readJournal, pendingTurnFiles, acknowledgeJournal, appendReceipt, storeData } from './turn-transport-journal.mjs';
 import { contentPathExcludes, pathIsExcluded, privateTurn, maskExcludedPaths, captureFailureReason, firstTurnCaptureNotice } from './turn-capture-privacy.mjs';
@@ -287,17 +287,10 @@ export function captureTurnOutcome({
   const project = projectName(projectRoot);
   const receipts = path.join(brainHome, 'turn-capture', 'receipts.jsonl');
 
-  // ONE WRITER PER TURN (ADR-100 §3). Measured 2026-10-01 on this repo's real store: 624 `turns` rows
-  // in five days for 323 distinct outcomes — this writer (host-tagged) and the owner's user-level
-  // ~/.claude/hooks/agentdb-turn-capture.mjs both recorded every Claude turn. The user-level hook is
-  // the owner's and is never edited by the product, so where it is registered the product DEFERS
-  // (RUVNET_TURN_CAPTURE=force keeps both). Codex turns are not seen by that Claude-only hook.
-  const deferTo = event === 'Stop' && host === 'claude' && String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() !== 'force'
-    && userLevelAgentdbHooks({ home, event, projectDir, env }).turnCapture;
-  if (deferTo) {
-    report.skipped = 'deferred: an enabled user-level Stop writer explicitly targets the canonical turn store; actual native delivery is unproven';
-    report.deferredToUserLevel = true;
-  } else if (['Stop', 'SessionEnd', 'PreCompact'].includes(event)) {
+  // ONE WRITER PER TURN (ADR-105 §7): the product is the only writer of project turn history. The
+  // former deferral to a user-level ~/.claude hook (ADR-100 §3) could never fire — its probe never
+  // reported a writer — and cost a git call on every Stop, so it was removed (ADR-106).
+  if (['Stop', 'SessionEnd', 'PreCompact'].includes(event)) {
     const sessionKey = String(payload.session_id || payload.transcript_path || '');
     const message = typeof payload.last_assistant_message === 'string' ? payload.last_assistant_message.trim() : '';
     let turn = { finalText: '', files: [], actions: [] };
@@ -487,8 +480,7 @@ export function turnRecordingStatus({ projectDir = process.cwd(), env = process.
   let target;
   try { target = resolveTurnDb({ projectDir, brainHome }); } catch { return { state: 'unknown', line: 'turn recording unavailable: canonical store resolution failed' }; }
   if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off' || target.skipped) return { state: 'unknown', line: `turn recording n/a — ${target.skipped || 'RUVNET_TURN_CAPTURE=off'}` };
-  const deferred = String(env.RUVNET_HOOK_HOST || 'claude') === 'claude' && String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() !== 'force' && userLevelAgentdbHooks({ home, event: 'Stop', projectDir, env }).turnCapture;
-  const notice = noticeOnFirstUse && !deferred ? firstTurnCaptureNotice({ target, brainHome, policyFile: turnCapturePolicyFile(brainHome), env }) : null;
+  const notice = noticeOnFirstUse ? firstTurnCaptureNotice({ target, brainHome, policyFile: turnCapturePolicyFile(brainHome), env }) : null;
   const status = (value) => ({ ...value, ...(notice ? { notice } : {}) });
   let rows = [];
   try {

package/scripts/deferral-replay.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+/**
+ * deferral-replay.mjs — measure continuation-gate's `no-deferral` check (ADR-106) on REAL Claude Code
+ * transcripts, read-only. Same turn model as completion-claim-replay.mjs: a turn runs from one genuine
+ * user message to the next and its final assistant text stands in for `last_assistant_message`;
+ * authorization is read from the owner prompts up to and including that turn.
+ *
+ *   node scripts/deferral-replay.mjs [--root ~/.claude/projects] [--limit 60] [--skip 0] [--out sample.jsonl]
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { transcripts, turnsOf, finalText } from './completion-claim-replay.mjs';
+import { auditDeferral, ownerPrompts } from '../plugin/scripts/deferral-evidence.mjs';
+
+const argv = process.argv.slice(2);
+const opt = (flag, fallback) => { const i = argv.indexOf(flag); return i >= 0 && argv[i + 1] ? argv[i + 1] : fallback; };
+const root = path.resolve(opt('--root', path.join(os.homedir(), '.claude', 'projects')));
+const limit = Number(opt('--limit', '60'));
+const skip = Number(opt('--skip', '0')); // held-out evaluation: skip the newest N transcripts
+const out = opt('--out', null);
+const report = { root, transcripts: 0, turns: 0, deferralPhrase: 0, blocked: 0, unauthorized: 0, forced: 0, byKind: {} };
+const samples = [];
+for (const file of transcripts(root, skip + limit).slice(skip)) {
+  report.transcripts += 1;
+  const lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
+  const prompts = [];
+  for (const turn of turnsOf(lines)) {
+    report.turns += 1;
+    prompts.push(...ownerPrompts(turn.slice(0, 1)));
+    const message = finalText(turn);
+    if (!message) continue;
+    const v = auditDeferral(message, { prompts });
+    if (v.verdict === 'NONE') continue;
+    report.deferralPhrase += 1;
+    if (v.verdict === 'BLOCKER') report.blocked += 1;
+    if (v.verdict === 'UNAUTHORIZED') report.unauthorized += 1;
+    if (v.verdict === 'DEFERRAL') {
+      report.forced += 1;
+      report.byKind[v.deferral.kind] = (report.byKind[v.deferral.kind] || 0) + 1;
+      samples.push({ file: path.basename(file), phrase: v.deferral.phrase, authorization: v.authorization, tail: message.slice(-500) });
+    }
+  }
+}
+report.forcedRate = report.turns ? Number((report.forced / report.turns).toFixed(4)) : 0;
+if (out) fs.writeFileSync(out, samples.map((s) => JSON.stringify(s)).join('\n') + '\n');
+console.log(JSON.stringify(report, null, 2));