ruvnet-brain 4.7.19 → 4.7.21

package/plugin/scripts/brain-footprint.mjs

@@ -5,7 +5,8 @@
 //
 //   must-exist      the live KB, the active Stable Spine generation, each registered plugin generation
 //   may-exist       bounded state: logs under a size cap, lease-held plugin generations, the newest npx
-//                   copy, lifecycle evidence under its own retention policy, models, small state files
+//                   copy, lifecycle evidence under its own retention policy, models, small state files,
+//                   the newest rescued operational files of released KB copies (kb-copy-rescued/)
 //   must-not-exist  every other full-KB copy (kb.bak-*, kb.install-preserved-*, kb.pre-update-*, …,
 //                   *-quarantine-* dirs), stale install stages and forge candidates, older npx copies,
 //                   stale leases, ruflo scratch debris, rotated-away log bytes
@@ -14,6 +15,7 @@
 // SAFETY (non-negotiable, each one has a test that breaks it and goes red):
 //   * A KB copy is removed only after kbCopyProof() shows nothing in it is unique (every private-store file
 //     byte-identical in live, everything else of public provenance); a KEPT proof is cached (footprint-io).
+//     Its operational files (logs, ruflo scratch) are copied out and verified first (rescueOperationalFiles).
 //   * Nothing is followed through a symlink; a removal target must sit directly inside the real directory it
 //     was inventoried in, itself inside an owned root (footprint-io removeWithin).
 //   * Kept: non-terminal transaction trees; every KB sibling and npx copy while someone else holds the refresh
@@ -26,7 +28,9 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { isKbTree, kbCopyProof } from './kb-copy-proof.mjs';
 import { brainLocation } from './brain-location.mjs';
 import { RUFLO_CWD_ARTIFACTS } from './ruflo-bin.mjs';
-import { assessMoveLeftovers, cachedKept, cmpVersion, isVolumeMetadata, keptCopyFix, physical, pidAlive, readProofCache, rememberKept, removeWithin, rotate,
+import { isDirectInvocation } from './entrypoint.mjs';
+import { RESCUE_DIR, archiveRoots, archiveUniqueFiles, assessMoveLeftovers, discardArchiveIfMirrored, cachedKept, cmpVersion, isVolumeMetadata,
+  keptCopyFix, physical, pidAlive, readProofCache, rememberKept, removeWithin, rescueOperationalFiles, rotate,
   treeBytes, truncateToTail } from './footprint-io.mjs';
 
 export { cmpVersion, physical, treeBytes } from './footprint-io.mjs';
@@ -43,6 +47,7 @@ export const FOOTPRINT_POLICY = Object.freeze({
   staleForgeCandidateMs: 24 * 3_600_000,
   staleLeaseMs: 6 * 3_600_000,       // plugin/scripts/update-apply.mjs LEASE_FRESH_MS
   staleRufloRunMs: 3_600_000,        // plugin/scripts/ruflo-bin.mjs STALE_RUN_MS
+  rescuedCopiesKept: 5,              // kb-copy-rescued/<copy>: the newest five released copies' logs are kept
 });
 
 /** Every full-KB copy name this product (or a recovery) has ever created beside the live KB. A superset of
@@ -185,6 +190,10 @@ export function inventoryFootprint({ env = process.env, home = os.homedir(), now
     }
   };
   const classifySibling = (name, full, st) => {
+    if (name === `${base}.archive` && st.isDirectory() && !st.isSymbolicLink()) { // #335: written only by --clean --archive
+      return void add({ id: 'kb-archive', path: full, class: 'may-exist', kind: 'kb-archive', action: 'keep', bytes: bytes(full),
+        reason: 'files unique to released KB copies, archived on request (--clean --archive); never removed automatically' });
+    }
     {
       const prefix = kbCopyPrefixes(base).find((p) => name.startsWith(p));
       if (prefix === `${base}.bak-` && !BRAIN_BACKUP_STAMP.test(name.slice(prefix.length))) {
@@ -264,6 +273,20 @@ export function inventoryFootprint({ env = process.env, home = os.homedir(), now
         reason: 'the one retained rotation of a capped log (replaced at the next rotation)' });
       continue;
     }
+    // Operational files rescued from released KB copies (footprint-io rescueOperationalFiles), one directory
+    // per copy, each file <= 2 MiB and <= 16 MiB per copy (kb-copy-proof RESCUE_*_CAP_BYTES): bounded like a
+    // rotated log, by keeping the newest few directories.
+    if (name === RESCUE_DIR && st.isDirectory() && !st.isSymbolicLink()) {
+      const rescued = names(full).map((n) => ({ n, s: lstat(path.join(full, n)) })).filter((r) => r.s)
+        .sort((a, b) => b.s.mtimeMs - a.s.mtimeMs || a.n.localeCompare(b.n));
+      rescued.forEach(({ n }, i) => {
+        const keep = i < policy.rescuedCopiesKept;
+        add({ id: 'rescued', path: path.join(full, n), class: keep ? 'may-exist' : 'must-not-exist', kind: 'rescued-kb-logs',
+          action: keep ? 'keep' : 'remove', bytes: bytes(path.join(full, n)),
+          reason: keep ? 'logs rescued from a released KB copy (one of the newest kept)' : `older than the newest ${policy.rescuedCopiesKept} rescued KB-copy logs` });
+      });
+      continue;
+    }
     if (TEXT_LOG.test(name) && st.isFile()) {
       const over = st.size > policy.textLogCapBytes;
       add({ id: 'log', path: full, class: over ? 'must-not-exist' : 'may-exist', kind: 'text-log', action: over ? 'truncate' : 'keep', bytes: st.size,
@@ -366,6 +389,7 @@ export function inventoryFootprint({ env = process.env, home = os.homedir(), now
   const newestVersion = npx.map((n) => n.version).sort(cmpVersion).at(-1);
   const keepVersion = current && cmpVersion(newestVersion, current) < 0 ? null : newestVersion;
   const keeper = npx.find((n) => n.running) || npx.filter((n) => n.version === keepVersion).sort((a, b) => b.mtime - a.mtime)[0];
+  const refVersion = keeper?.version ?? current ?? newestVersion; // #420 item 3: "older" only when strictly below what is kept
   for (const n of npx) {
     const keep = n === keeper || n.running;
     // An older copy fetched < 2h ago may be running in another terminal; none goes during an update/install (S6).
@@ -373,7 +397,10 @@ export function inventoryFootprint({ env = process.env, home = os.homedir(), now
     const hold = !keep && (kbBlocked || (recent ? 'fetched in the last 2h; it may be running now' : null));
     add({ id: 'npx', path: n.dir, version: n.version, bytes: bytes(n.dir), class: keep ? 'may-exist' : 'must-not-exist', kind: 'npx-copy',
       action: keep || hold ? (keep ? 'keep' : 'report') : 'remove', blocked: hold || null,
-      reason: keep ? (n.running ? 'the installer running now' : 'the newest installer copy') : `an older installer copy (${n.version})` });
+      reason: keep ? (n.running ? 'the installer running now' : 'the newest installer copy')
+        : cmpVersion(n.version, refVersion) < 0 ? `an older installer copy (${n.version})`
+          : cmpVersion(n.version, refVersion) === 0 ? `a duplicate installer copy at the kept version (${n.version}); one copy is enough`
+            : `an installer copy (${n.version}) newer than the kept one (${refVersion}); one copy is enough` });
   }
 
   // ── lifecycle evidence, judged by its own policy ────────────────────────────────────────────
@@ -390,7 +417,7 @@ function summarize({ roots, items, policy, kbCopyDirs, lockHeld }) {
   const owned = items.filter((i) => i.class !== 'unowned');
   const kbBytes = sum(items.filter((i) => i.kind === 'live-kb'));
   const modelBytes = sum(items.filter((i) => i.kind === 'models'));
-  const budgetBytes = kbBytes + modelBytes + policy.fixedAllowanceBytes;
+  const budgetBytes = kbBytes + modelBytes + sum(items.filter((i) => i.kind === 'kb-archive')) + policy.fixedAllowanceBytes;
   const breakdown = {};
   for (const i of owned) {
     const group = i.kind === 'live-kb' ? 'knowledge base' : i.kind === 'models' ? 'models' : /plugin|spine/.test(i.kind) ? 'plugins'
@@ -419,13 +446,40 @@ function summarize({ roots, items, policy, kbCopyDirs, lockHeld }) {
  * every refusal is returned with its reason. `collectPluginGenerations` is the caller's lease-aware
  * collector (bin/install.mjs prunePluginGenerations); `pruneEvidence` is kb's pruneLifecycleEvidence.
  */
-export function sweepFootprint({ apply = false, collectPluginGenerations = null, pruneEvidence = null,
+export function sweepFootprint({ apply = false, archive = false, collectPluginGenerations = null, pruneEvidence = null,
   proveCopy = kbCopyProof, beforeRemove = null, ...options } = {}) {
   const before = inventoryFootprint(options);
   const { roots } = before;
   const owned = [...new Set([roots.kbParent, roots.brainHome, ...roots.brainHomeParents, roots.npxRoot].map(physical))];
-  const prove = (copyDir) => {
-    const proof = proveCopy({ copyDir, liveDir: roots.kbDir });
+  // #335: copies that STAY on disk this sweep may account for a later copy's files (kept siblings). Only
+  // final decisions are added: archive trees, copies a cached proof keeps (outside --archive, which re-proves
+  // them), and each copy this sweep keeps. A copy is never a reference for one evaluated before it.
+  const archiveDir = path.join(roots.kbParent, `${path.basename(roots.kbDir)}.archive`);
+  const stampDir = path.join(archiveDir, new Date(options.now ?? Date.now()).toISOString().replace(/[:.]/g, '-'));
+  const archiving = apply && archive;
+  const reArchive = (item) => archiving && ['kb-copy', 'quarantine'].includes(item.kind) && item.keptUnique && !item.blocked;
+  // Correctness relies on SORTED directory order across concurrent sweeps: inventory and archiveRoots list
+  // entries sorted, so two sweeps evaluate copies in the same order and agree which copy of a duplicate pair
+  // is the kept reference; with unsorted order each could release the copy the other kept as its reference.
+  const refs = [...archiveRoots(archiveDir), ...before.items.filter((i) => i.kind === 'kb-copy' && i.keptUnique && !reArchive(i)).map((i) => i.path)];
+  const prove = (copyDir, label = path.basename(copyDir)) => {
+    let proof = proveCopy({ copyDir, liveDir: roots.kbDir, keptSiblings: [...refs] });
+    if (!proof.disposable && archiving && proof.unique?.length) {
+      const archived = archiveUniqueFiles({ copyDir, unique: proof.unique, stampDir, label, now: options.now ?? Date.now() });
+      if (archived.ok) {
+        refs.push(archived.root);
+        const again = proveCopy({ copyDir, liveDir: roots.kbDir, keptSiblings: [...refs] });
+        if (again.disposable) proof = { ...again, reason: `archived ${archived.files.length} unique file(s) to ${archived.root}; ${again.reason}` };
+        else { // the copy is kept (e.g. unreadable metadata on the re-proof): if it still holds every archived byte, no archive is left behind
+          const discard = discardArchiveIfMirrored({ root: archived.root, copyDir, files: archived.files });
+          if (discard.discarded) {
+            refs.pop();
+            proof = { ...again, reason: `${again.reason}; not archived: the copy is kept, so its archive was removed` };
+          } else proof = { ...again, reason: `${again.reason}; the archive at ${archived.root} is kept: ${discard.reason}` };
+        }
+      } else proof = { ...proof, reason: `${proof.reason}; not archived: ${archived.reason}` };
+    }
+    if (!proof.disposable) refs.push(copyDir);
     if (apply && !proof.disposable && isKbTree(roots.kbDir)) rememberKept(roots.brainHome, copyDir, roots.kbDir, proof); // a dry run writes nothing
     return proof;
   };
@@ -435,8 +489,13 @@ export function sweepFootprint({ apply = false, collectPluginGenerations = null,
       kept: [{ path: roots.location.path, kind: 'unmounted-brain', reason: before.items[0].reason }], freedBytes: 0, before, after: before };
   }
   const record = (item, freed, note) => removed.push({ path: item.path, kind: item.kind, bytes: freed ?? item.bytes, reason: note || item.reason });
-  for (const item of before.items) {
-    if (!['remove', 'remove-if-proven', 'rotate', 'truncate'].includes(item.action)) {
+  // Rescue retention is applied only AFTER every rescue of this sweep, and never to a destination this sweep used: a
+  // retry that re-validates an aged-out rescue and then releases its copy must not also delete that rescue (review C).
+  const rescuedNow = new Set(); const rescue = (...args) => { const dest = rescueOperationalFiles(...args); if (dest) rescuedNow.add(dest); };
+  const deferred = before.items.filter((i) => i.kind === 'rescued-kb-logs' && i.action === 'remove');
+  for (const item of [...before.items.filter((i) => !deferred.includes(i)), ...deferred]) {
+    if (deferred.includes(item) && rescuedNow.has(item.path)) { kept.push({ path: item.path, kind: item.kind, reason: 'used by a rescue in this sweep; retention applies at the next sweep' }); continue; }
+    if (!['remove', 'remove-if-proven', 'rotate', 'truncate'].includes(item.action) && !reArchive(item)) {
       if (item.class === 'must-not-exist' || item.class === 'unowned') kept.push({ path: item.path, kind: item.kind, reason: item.blocked || item.reason, fix: item.fix || null });
       continue;
     }
@@ -449,6 +508,7 @@ export function sweepFootprint({ apply = false, collectPluginGenerations = null,
       if (item.kind === 'kb-copy') {
         const proof = prove(item.path);
         if (!proof.disposable) { kept.push({ path: item.path, kind: item.kind, reason: `KEPT: ${proof.reason}`, unique: proof.unique }); continue; }
+        if (apply) rescue(item.path, proof.rescue, roots.brainHome); // throws -> the copy is kept
         record(item, apply ? removeWithin(item.path, item.realParent, owned) : item.bytes, proof.reason);
         continue;
       }
@@ -456,9 +516,10 @@ export function sweepFootprint({ apply = false, collectPluginGenerations = null,
       const quarantineReal = physical(item.path);
       for (const child of names(item.path)) {
         const childPath = path.join(item.path, child);
-        const proof = isKbTree(childPath) ? prove(childPath)
+        const proof = isKbTree(childPath) ? prove(childPath, `${path.basename(item.path)}--${child}`)
           : { disposable: false, unique: [], reason: 'not a KB copy; not ours to judge' };
         if (!proof.disposable) { uniqueLeft = true; kept.push({ path: childPath, kind: 'quarantined-copy', reason: `KEPT: ${proof.reason}`, unique: proof.unique }); continue; }
+        if (apply) rescue(childPath, proof.rescue, roots.brainHome, `${path.basename(item.path)}--${child}`); // throws -> kept
         record({ path: childPath, kind: 'quarantined-copy', bytes: treeBytes(childPath) }, apply ? removeWithin(childPath, quarantineReal, owned) : undefined, proof.reason);
       }
       if (!uniqueLeft && apply) removeWithin(item.path, item.realParent, owned);
@@ -488,7 +549,7 @@ export async function loadKbReaders(kbDir) {
 }
 
 // CLI: the detached SessionStart sweep. `node brain-footprint.mjs --sweep [--apply] [--json]`.
-if (process.argv[1] && pathToFileURL(physical(process.argv[1])).href === pathToFileURL(physical(fileURLToPath(import.meta.url))).href) {
+if (isDirectInvocation(import.meta.url)) {
   const argv = process.argv.slice(2);
   const roots = footprintRoots();
   const readers = await loadKbReaders(roots.kbDir);

package/plugin/scripts/capability-registry.mjs

@@ -622,7 +622,7 @@ export const CAPABILITIES = [
       if (config.err) return row(STATE.UNKNOWN, 'managed native routing settings are unreadable; routing and savings are not inferred');
       if (!config.missing) {
         const value = config.value;
-        if (!value || !path.isAbsolute(value.runtimeRoot || '') || !/^[a-f0-9]{64}$/.test(value.runtimeDigest || '')) return row(STATE.UNKNOWN, 'managed routing declaration is incomplete; no execution claim is made');
+        if (!value || !path.isAbsolute(value.runtimeRoot || '') || !/^[a-f0-9]{64}$/.test(value.runtimeDigest || '')) return row(STATE.UNKNOWN, 'managed routing declaration is incomplete (no absolute runtimeRoot or 64-hex runtimeDigest), so routing could not be checked; no execution claim is made');
         return row(STATE.UNKNOWN, 'a managed native routing runtime is configured. The retired Task dispatch hook is not a prerequisite. Configuration alone does not prove normal entry wiring, model allocation, execution or savings; those runtime facts were not checked by this declaration-only probe.');
       }
       return row(STATE.UNKNOWN, 'no managed routing declaration was observed in this inspected location; legacy Task routing receipts or binary presence do not establish current native routing or its absence');

package/plugin/scripts/capacity-aware-parallel-work.mjs

@@ -13,6 +13,7 @@ import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { isHarnessGenerated } from './hook-input.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export const UNKNOWN_RUNTIME_TOTAL_AGENT_CEILING = 4;
 const INPUT_LIMIT = 32 * 1024;
@@ -257,4 +258,4 @@ function main() {
   }
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main();
+if (isDirectInvocation(import.meta.url)) main();

package/plugin/scripts/codex-overnight-notice.mjs

@@ -0,0 +1,33 @@
+// codex-overnight-notice.mjs — the unattended nightly never reloads the shared Codex app-server (owner decision,
+// 4.7.21 review r2): a reload reaches Codex sessions already open, and Brain hooks pause in them until re-reviewed in
+// /hooks, which nobody is awake to do. The nightly records this one-line notice instead; the next SessionStart shows
+// it ONCE. Same claim-before-say contract as the other once-only SessionStart lines (.star-ask-shown, turn-capture
+// notices): the file is claimed by an atomic rename BEFORE the line is emitted, so two sessions starting together
+// cannot both show it, and a killed session cannot repeat it.
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const CODEX_OVERNIGHT_FILE = 'codex-hooks-overnight-notice.json';
+export const CODEX_OVERNIGHT_PREFIX = '[RuvNet Brain — CODEX HOOKS CHANGED OVERNIGHT]';
+export const CODEX_OVERNIGHT_TEXT = 'Codex hooks changed overnight; open Codex sessions will pick them up on restart or after /hooks review.';
+
+/** Written by the unattended update. Never throws: an unrecorded notice must not fail the nightly. */
+export function recordCodexOvernightNotice(brainHome, { now = Date.now() } = {}) {
+  try {
+    fs.mkdirSync(brainHome, { recursive: true });
+    const file = path.join(brainHome, CODEX_OVERNIGHT_FILE);
+    const tmp = `${file}.tmp-${process.pid}`;
+    fs.writeFileSync(tmp, `${JSON.stringify({ schemaVersion: 1, at: new Date(now).toISOString() })}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    return true;
+  } catch { return false; }
+}
+
+/** Read by SessionStart: the line to show, at most once; '' when there is none or another session claimed it. */
+export function claimCodexOvernightNotice(brainHome) {
+  const file = path.join(brainHome, CODEX_OVERNIGHT_FILE);
+  const claimed = `${file}.shown-${process.pid}`;
+  try { fs.renameSync(file, claimed); } catch { return ''; }
+  try { fs.rmSync(claimed, { force: true }); } catch { /* claimed already; a leftover is never shown again */ }
+  return `${CODEX_OVERNIGHT_PREFIX} ${CODEX_OVERNIGHT_TEXT}`;
+}

package/plugin/scripts/completion-claim-evidence.mjs

@@ -16,13 +16,14 @@
  *   (3) the answer discloses what is NOT verified.
  *   Anything else is one correction request. No claim recognised → no verdict about the prose.
  *
- * HOSTS. Claude Code transcripts (`transcript_path`, JSONL) are parsed. Codex's Stop payload also
- * carries `transcript_path`, but its rollout format is NOT parsed anywhere in this repository
- * (turn-outcome-capture.mjs declines it), so on Codex the
- * transcript half is UNKNOWN and only the answer-side half (2)+(3) is enforced — disclosed in the
- * correction text, never silently treated as proven.
+ * HOSTS. Claude Code transcripts (`transcript_path`, JSONL) are parsed. A Codex rollout is read through
+ * the shared native-turn-transcript normalizer (#423) and held to a stricter evidence rule: a command
+ * counts as a check only with an explicit exit 0 (normalizeToolOutcome `pass`), an unknown native tool
+ * is a change boundary, and a rollout without a current-turn boundary yields no evidence (UNKNOWN).
  */
 import { readSettledTranscript } from './turn-outcome-capture.mjs';
+import { nativeTurnLines } from './native-turn-transcript.mjs';
+import { normalizeToolOutcome } from './continuity-events.mjs';
 
 const MAX_SENTENCE = 400;
 export const PROMISE_KIND = 'assistant-commitment';
@@ -135,8 +136,17 @@ export function currentTurnRecords(lines) {
   return { boundaryFound: start >= 0, prompt: start >= 0 ? textOf(recs[start].message?.content) : '', recs: recs.slice(start + 1) };
 }
 
-/** Ordered events for the current turn of a Claude JSONL transcript. */
-export function claudeTurnEvents(lines) {
+// Codex tools that neither change state nor run a check; every other unrecognised tool is a change (fail
+// toward asking). Grounded in codex-cli 0.164.0's tool handlers (plan, view_image, tool_search,
+// mcp_resource/{list_mcp_resources,list_mcp_resource_templates,read_mcp_resource}, current_time,
+// get_context_remaining, wait_for_environment, multi_agents/wait, sleep, request_user_input[_async]) and real
+// rollouts (code-mode `wait` on a cell, `wait_agent`/`list_agents`). web_search is a hosted search, read-only.
+// Acting tools stay changes: spawn_agent, send_message, followup_task, interrupt_agent, js, exec, update_goal.
+const CODEX_NEUTRAL = /^(?:update_plan|view_image|sleep|list_agents|wait_agent|wait|request_user_input(?:_async)?|tool_search|web_search|list_mcp_resources|list_mcp_resource_templates|read_mcp_resource|current_time|get_context_remaining|wait_for_environment)$/;
+
+/** Ordered events for the current turn of a Claude JSONL (or normalized Codex) transcript. */
+export function claudeTurnEvents(lines, { host = 'claude' } = {}) {
+  const codex = host === 'codex';
   const { boundaryFound, recs: turnRecs } = currentTurnRecords(lines);
   const results = new Map();
   for (const o of turnRecs) {
@@ -145,7 +155,8 @@ export function claudeTurnEvents(lines) {
     for (const r of c) {
       if (r?.type === 'tool_result' && r.tool_use_id) {
         results.set(r.tool_use_id, { error: r.is_error === true || o.toolUseResult?.interrupted === true,
-          present: textOf(r.content).trim().length > 0 || String(o.toolUseResult?.stdout || '').trim().length > 0 });
+          present: textOf(r.content).trim().length > 0 || String(o.toolUseResult?.stdout || '').trim().length > 0,
+          ...(codex ? { passed: normalizeToolOutcome(r).outcome === 'pass', nativeOk: r.is_error === false && r.status === 'completed' } : {}) });
       }
     }
   }
@@ -156,8 +167,10 @@ export function claudeTurnEvents(lines) {
     for (const u of c) {
       if (u?.type !== 'tool_use') continue;
       const input = u.input || {};
-      const result = results.get(u.id) || { present: false, error: false };
-      if (['Edit', 'Write', 'MultiEdit', 'NotebookEdit'].includes(u.name)) {
+      const found = results.get(u.id) || { present: false, error: false };
+      // Codex: a check needs an explicit exit 0 (commands) or a completed native status (MCP).
+      const { passed, nativeOk, ...result } = codex ? { ...found, error: found.error || !(u.name === 'Bash' ? found.passed : found.nativeOk) } : found;
+      if (['Edit', 'Write', 'MultiEdit', 'NotebookEdit'].includes(u.name) || (codex && u.name === 'apply_patch')) {
         events.push({ kind: 'change', what: `${u.name} ${input.file_path || input.notebook_path || ''}`.trim() });
       } else if (u.name === 'Bash') {
         for (const seg of segments(input.command)) {
@@ -169,6 +182,8 @@ export function claudeTurnEvents(lines) {
       } else if (String(u.name || '').startsWith('mcp__')) {
         events.push(MCP_MUTATING.test(u.name) ? { kind: 'change', what: u.name }
           : { kind: 'check', what: u.name, name: u.name.split('__').pop(), ...result });
+      } else if (codex && !CODEX_NEUTRAL.test(String(u.name || ''))) {
+        events.push({ kind: 'change', what: `codex ${String(u.name || 'tool').slice(0, 60)}` });
       }
     }
   }
@@ -185,9 +200,12 @@ export function postChangeVerification(turn) {
     staleChecks: events.slice(0, Math.max(0, lastChange)).filter((e) => e.kind === 'check').length };
 }
 
-export function readClaudeTurn(transcriptPath, { read = readSettledTranscript } = {}) {
+export function readClaudeTurn(transcriptPath, { read = readSettledTranscript, host = 'claude' } = {}) {
   if (typeof transcriptPath !== 'string' || !/\.jsonl$/i.test(transcriptPath)) return null;
-  try { return claudeTurnEvents(read(transcriptPath, { maxMs: 0 })); } catch { return null; }
+  try {
+    const turn = claudeTurnEvents(nativeTurnLines(read(transcriptPath, { maxMs: 0 }), host), { host });
+    return host === 'codex' && !turn.boundaryFound ? null : turn;
+  } catch { return null; }
 }
 
 /**
@@ -227,6 +245,10 @@ const PROMISE_REJECT = /\?|:\*\*|\b(?:if|unless|once|when|whenever|as\s+soon\s+a
 const TRIVIAL_PROMISE = /^(?:not|never|be|say|mention|note|admit|point|flag|stop|stay|leave|keep|summari[sz]e|explain|answer|respond|reply|report|remember|give|tell|send|paste|bring|hand|show|walk|notify|post|update\s+you|come\s+back|get\s+back|handle|only|stand|work)\b/i;
 const OWNER_DEPENDENT_OFFER = /\b(?:say\s+the\s+word|(?:just|simply)\s+(?:ask|say)|ask\s+me|let\s+me\s+know|give\s+me\s+the\s+(?:word|go|nod|ok)|on\s+your\s+(?:word|go|ok|say)|up\s+to\s+you)\b/i;
 const STANDING_APPROVAL = /^(?:ask|confirm|check\s+with\s+you|clear\s+(?:it|this|that)\s+with\s+you|run\s+.+\s+by\s+you)\b.*\b(?:before|first)\b/i;
+// "hide it the same way", "check for it then": a verb whose only object is a pronoun has no referent
+// once the turn's context is gone (#369), so no later session could ever close it honestly.
+const PRONOUN_OBJECT = /\b(?:it|this|that|them|these|those)\b/i;
+const PRONOUN_ONLY = /^\S+(?:\s+(?:it|this|that|them|these|those|the|same|way|then|again|too|also|now|later|for|to|on|in|into|at|about|with|up|out|back|down|over|off|as|well|a|an|there|here|first|next))*$/i;
 
 export const normalizePromise = (value) => String(value || '').toLowerCase().replace(/[`*_"“”'’]/g, '')
   .replace(/[^a-z0-9./:+-]+/g, ' ').trim().slice(0, 160);
@@ -248,6 +270,7 @@ export function extractCommitments(message) {
       if (PROMISE_REJECT.test(whole) || OWNER_DEPENDENT_OFFER.test(whole)
         || STANDING_APPROVAL.test(action.trim()) || TRIVIAL_PROMISE.test(action.trim())) continue;
       const text = action.replace(/\s+/g, ' ').trim().replace(/[,;:]$/, '');
+      if (PRONOUN_OBJECT.test(text) && PRONOUN_ONLY.test(text)) continue;
       const key = normalizePromise(text);
       if (key.length < 6 || seen.has(key)) continue;
       seen.add(key);
@@ -269,3 +292,24 @@ export function claimClosesPromise(claimText, promiseText) {
   const hit = want.filter((t) => have.has(t)).length;
   return hit >= 2 && hit / want.length >= 0.4;
 }
+
+const unquoted = (value) => String(value).replace(/"([^"\n]{0,300})"|“([^”\n]{0,300})”/g, (_, a, b) => a ?? b);
+
+/**
+ * The claim that closes `promiseText`, or null. Only a PASS verdict can close a promise. strippedProse()
+ * removes double-quoted text, so `"push the branch itself" is done` extracts only `is done`; that claim
+ * may still close the promise through its raw sentence (quotes kept), which becomes the evidence. The
+ * sentence must be a recognised claim outside its quotes, so quoting alone never makes a claim (#369).
+ */
+export function promiseClosingClaim(completion, answer, promiseText) {
+  // DORMANT: auditCompletionClaims no longer returns PASS (only OBSERVED_CHECK/UNKNOWN/FAIL/NONE), so this never closes a promise today.
+  if (completion?.verdict !== 'PASS') return null;
+  const direct = completion.claims.find((c) => claimClosesPromise(c.text, promiseText));
+  if (direct) return direct;
+  for (const raw of String(answer || '').split(/(?<=[.!?])\s+|\n+/)) {
+    const own = sentences(raw);
+    const claim = completion.claims.find((c) => own.includes(c.text));
+    if (claim && claimClosesPromise(unquoted(raw), promiseText)) return { ...claim, text: raw.trim() };
+  }
+  return null;
+}

package/plugin/scripts/continuation-gate.mjs

@@ -53,9 +53,10 @@ import { deferralAtStop } from './deferral-evidence.mjs';
 import { readSettledTranscript } from './turn-outcome-capture.mjs';
 import { continuationProjectIdentity, authorizedContinuationObjective, authorizedPromiseItems, assistantCommitmentOwned, setAssistantCommitmentState } from './continuation-objective.mjs';
 import {
-  auditCompletionClaims, readClaudeTurn, extractCommitments, claimClosesPromise,
+  auditCompletionClaims, readClaudeTurn, extractCommitments, promiseClosingClaim,
   PROMISE_KIND, PROMISE_CAP_OPEN,
 } from './completion-claim-evidence.mjs';
+import { writeAtomic } from './user-settings.mjs';
 
 const HOME = os.homedir();
 
@@ -181,7 +182,12 @@ function load() {
 function save(led) {
   try {
     fs.mkdirSync(path.dirname(LEDGER), { recursive: true });
-    fs.writeFileSync(LEDGER, JSON.stringify({ ...led, updated: new Date().toISOString() }, null, 2) + '\n');
+    // writeAtomic (not a bare writeFileSync): writeFileSync truncates the target before writing the
+    // new bytes, so a kill -9 / ENOSPC / EIO between those two steps leaves LEDGER empty — and load()'s
+    // catch-all JSON.parse failure then reads that as "nothing was ever committed", silently discarding
+    // every item a prior turn agreed to do, not just the one being added now. Same house pattern as
+    // user-settings.mjs's own writeAtomic(): temp-in-the-same-directory + fsync + rename.
+    writeAtomic(LEDGER, JSON.stringify({ ...led, updated: new Date().toISOString() }, null, 2) + '\n');
     return true;
   } catch { return false; /* the ledger is advisory — never break a turn over it */ }
 }
@@ -366,15 +372,15 @@ const HOST = process.env.RUVNET_HOOK_HOST === 'codex' ? 'codex' : 'claude';
  * COMPLETION CLAIMS (ADR-074 class `completion`, owner 2026-09-30: "You can never ever tell me
  * something is done and implemented without having tested it end to end"). Audited ONCE per Stop:
  * the verdict both requests a correction (below, under every loop guard) and is the only evidence
- * that may close a captured promise. Claude transcripts are parsed; Codex's rollout format is not
- * parsed anywhere in this repo, so on Codex only the answer-side half is enforced and the transcript
- * half is reported UNKNOWN (completion-claim-evidence.mjs header). Fails open: a throw is NONE.
+ * that may close a captured promise. Claude transcripts and Codex rollouts (through the shared
+ * nativeTurnLines reader, #423) are parsed; a Codex rollout that cannot be read or has no current-turn
+ * boundary stays UNKNOWN (completion-claim-evidence.mjs header). Fails open: a throw is NONE.
  */
 const completion = (() => {
   const message = String(hookInput.last_assistant_message || '');
   if (!message || !hookInput.session_id) return { verdict: 'NONE', claims: [] };
   try {
-    const turn = HOST === 'claude' ? readClaudeTurn(hookInput.transcript_path) : null;
+    const turn = readClaudeTurn(hookInput.transcript_path, { host: HOST });
     // Claude always sends a JSONL transcript; one we cannot read is OUR failure, and a Stop hook
     // fails open on its own machinery (ADR-074 failure semantics) — never a correction request.
     // Missing native evidence stays UNKNOWN; it cannot silently validate a completion claim.
@@ -401,7 +407,7 @@ function promiseBookkeeping() {
     if (completion.verdict === 'PASS') {
       for (const item of led.items) {
         if (!assistantCommitmentOwned(item, hookInput.session_id, projectIdentity)) continue;
-        const claim = completion.claims.find((c) => claimClosesPromise(c.text, item.text));
+        const claim = promiseClosingClaim(completion, hookInput.last_assistant_message, item.text);
         if (!claim) continue;
         const verifiedCompletion = completion.verdict === 'PASS' && Boolean(claim);
         Object.assign(item, { done: verifiedCompletion, state: verifiedCompletion ? 'completed' : item.state, doneAt: at, completionEvidence: { claim: claim.text,
@@ -715,7 +721,19 @@ if (observations.length && STOP_NUDGES_FULL) console.error(JSON.stringify({ kind
   authority: false, items: observations.map(({ text, at }) => ({ text, at })) }));
 // ONE correction per turn: a single item however many claims the answer made; the stop_hook_active
 // exit and the cooldown lock below bound it to one request per stop episode.
-const completionWork = ['FAIL', 'UNKNOWN'].includes(completion.verdict) ? [{
+// #425 (owner decision): an UNKNOWN whose ONLY problem is task scope — a check observed after the last
+// change, named in the answer, with what is NOT verified disclosed — is not a correction. The audit
+// recognizes check-scoped sentences only; it has no representation for a scoped task outcome, so
+// re-running checks or rewording cannot satisfy it. The verdict stays UNKNOWN (never PASS: it closes
+// no promise and grants no completion authority); under `full` the limitation is reported, not enforced.
+const scopeOnlyUnknown = completion.verdict === 'UNKNOWN' && completion.namesCheck === true
+  && completion.disclosesGaps === true && (completion.verification?.checks?.length || 0) > 0;
+if (scopeOnlyUnknown && STOP_NUDGES_FULL) console.error(JSON.stringify({ kind: 'completion-scope-advisory',
+  authority: false, verdict: 'UNKNOWN', text: `"${completion.claims[0].text.slice(0, 160)}": a check ran after the last change`
+    + ' and the answer names it and discloses what is not verified. This gate cannot judge whether that task outcome'
+    + ' is complete (it only qualifies check-scoped statements), so completion stays UNKNOWN. Not blocking: more checks'
+    + ' or rewording cannot change this verdict.' }));
+const completionWork = ['FAIL', 'UNKNOWN'].includes(completion.verdict) && !scopeOnlyUnknown ? [{
   text: `You claimed "${completion.claims[0].text.slice(0, 160)}" is done; ${completion.problems.join('; ')}. Run the real consumer path, or restate it as UNVERIFIED.`,
   at: new Date(nowMs).toISOString(), derived: true, kind: 'completion-claim-integrity',
 }] : [];
@@ -815,7 +833,8 @@ function claimCooldown(now, windowMs) {
     if (Number.isFinite(prev) && (now - prev) < windowMs) return false; // fresh lock: someone forced recently
     fs.unlinkSync(LOCK);                                                 // stale: clear it so we can re-claim
   } catch { /* no lock yet */ }
-  try { fs.writeFileSync(LOCK, new Date(now).toISOString(), { flag: 'wx' }); return true; }
+  // A fresh install has no work-ledgers/ folder until the first save(); ENOENT here is not a lost race.
+  try { fs.mkdirSync(path.dirname(LOCK), { recursive: true }); fs.writeFileSync(LOCK, new Date(now).toISOString(), { flag: 'wx' }); return true; }
   catch { return false; }                                               // lost the race / cannot persist → fail closed
 }
 if (!claimCooldown(nowMs, COOLDOWN_MS)) process.exit(EXIT_ALLOW);

package/plugin/scripts/decision-gate.mjs

@@ -25,13 +25,12 @@ import { fileURLToPath } from 'node:url';
 // an install hint into the middle of a refusal reason, or manufactured stderr on an allow. Read the
 // signature, do not infer it from the name.
 import { resolveBash } from './hook-shim-bash.mjs';
-import { append as appendOutcome, actionKey, recordRefusal, resolve as resolveOutcome, sweepStale } from './decision-outcomes.mjs';
+import { append as appendOutcome, actionKey, recordRefusal, reportBudget, reportSelfSkipped, resolve as resolveOutcome, sweepStale } from './decision-outcomes.mjs';
 // Grok sends its own tool names (`write`) and a snake_case event; every policy below reads Claude's
 // shape. Normalised ONCE here, so the policies (four of them bash, matching tool_name textually) never
 // see a host-native spelling — the 4.4 measurement was a Grok write silently allowed. hook-input.mjs.
 import { normalizePayloadText } from './hook-input.mjs';
-
-const QUIET_FULL = String(process.env.RUVNET_STOP_NUDGES || '').toLowerCase() === 'full';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const SCRIPTS_DIR = path.dirname(fileURLToPath(import.meta.url));
 const EVENT = process.argv[2] || '';
@@ -93,8 +92,8 @@ export const MIN_HEADROOM_MS = 3000;
  *
  * 1. ALLOW ON TIMEOUT. A policy still running at the budget is killed and the write is ALLOWED — a gate
  *    that blocks because it is slow is one users switch off. Never silent: the outcome ledger records
- *    `budget-exceeded` with the policies that did not vote, and ONE stderr line says the allow was a
- *    timeout, not a verdict (reportBudget below).
+ *    `budget-exceeded` with the policies that did not vote; a stderr line saying the allow was a timeout,
+ *    not a verdict, is printed only on a refusal or under RUVNET_STOP_NUDGES=full (decision-outcomes.mjs).
  *
  * 2. OVERSIZE: ONLY THE FIRST 64 KiB IS CHECKED. The host hands this gate the payload through
  *    hook-shim.mjs, which reads at most TRANSPORT_CAP_BYTES (its TABLE entry), and the bash policies cap
@@ -206,7 +205,7 @@ export function policiesFor(event, registry = REGISTRY, all = REFUSAL_POLICIES)
 /**
  * Resolved once per invocation by the runtime block below; null means no bash on this host.
  *
- * Declared HERE, and not next to runPolicy() where it reads more naturally: the `if (isMain())`
+ * Declared HERE, and not next to runPolicy() where it reads more naturally: the runtime
  * block runs during module evaluation, so a `let` declared after it sits in the temporal dead zone
  * and the assignment throws — the identical mistake `speechEventFor` was already a hoisted
  * `function` to avoid, recorded a few lines further down.
@@ -285,13 +284,14 @@ function payloadInput(payload) { return parsed(payload).tool_input || {}; }
 /**
  * The sub-event token unprompted-runtime switches on.
  *
- * A hoisted `function`, not a `const` arrow: the `if (isMain())` block below runs DURING module
+ * A hoisted `function`, not a `const` arrow: the runtime block below runs DURING module
  * evaluation, so an arrow declared after it sits in the temporal dead zone — it threw
  * `Cannot access 'speechEventFor' before initialization` on this gate's first live refusal.
  */
 function speechEventFor(event) { return event === 'bash' ? 'PreToolUse-bash' : 'PreToolUse-write'; }
 // ── Runtime ──────────────────────────────────────────────────────────────────────────────────────
-if (isMain()) {
+// isDirectInvocation never throws (entrypoint.mjs), so an importer cannot be crashed by this guard.
+if (isDirectInvocation(import.meta.url)) {
   const started = Date.now();
   const payload = normalizePayloadText(readPayload());
   const shape = classifyPayload(payload);
@@ -348,14 +348,14 @@ if (isMain()) {
     }
   } catch { /* a ledger must never break a tool call */ }
   };
-  reportSelfSkipped({ session, selfSkipped });
+  reportSelfSkipped({ event: EVENT, session, selfSkipped });
   if (decision.allow && shape.truncated) {
     // OVERSIZE POLICY (header): allowed on a check of the first TRANSPORT_CAP_BYTES only. Recorded, never silent.
     try { appendOutcome({ kind: 'payload-oversize', event: EVENT, session, bytesSeen: shape.bytes, capBytes: TRANSPORT_CAP_BYTES, tool: shape.tool, filePath: shape.filePath, ts: Date.now() }); } catch { /* a ledger must never break a tool call */ }
   }
   if (!decision.allow) {
     measureFinalDecision(false);
-    reportBudget({ session, unconsulted, trace, started, budgetMs, refused: true });
+    reportBudget({ event: EVENT, session, unconsulted, trace, started, budgetMs, refused: true });
     process.stderr.write(`${decision.reason}\n`);
     process.exit(REFUSE);
   }
@@ -373,65 +373,22 @@ if (isMain()) {
     if (speech.skipped === 'budget') unconsulted.push(SPEECH.id);
     if (speech.code === REFUSE) {
       measureFinalDecision(false, [...decision.refusals, SPEECH.id]);
-      reportBudget({ session, unconsulted, trace, started, budgetMs, refused: true });
+      reportBudget({ event: EVENT, session, unconsulted, trace, started, budgetMs, refused: true });
       process.stderr.write(`${(speech.stderr || '').trim()}\n`);
       process.exit(REFUSE);
     }
-    reportBudget({ session, unconsulted, trace, started, budgetMs });
+    reportBudget({ event: EVENT, session, unconsulted, trace, started, budgetMs });
     measureFinalDecision(true);
     const context = policyContext(results, speech.stdout || '');
     if (context) process.stdout.write(context);
     process.exit(ALLOW);
   }
-  reportBudget({ session, unconsulted, trace, started, budgetMs });
+  reportBudget({ event: EVENT, session, unconsulted, trace, started, budgetMs });
   measureFinalDecision(true);
   const context = policyContext([...results, ...unconsulted.filter((id) => !results.some((r) => r.id === id && r.skipped)).map((id) => ({ id, skipped: 'budget' }))]);
   if (context) process.stdout.write(context);
   process.exit(ALLOW);
 }
-/**
- * ── A BUDGET THAT CAN BE EXCEEDED SILENTLY FAILS OPEN WITHOUT SAYING SO ──────────────────────────
- *
- * The old loop did `break` when the budget ran out. Every remaining policy AND the speech chokepoint
- * were then skipped with no record anywhere — the gate allowed, and nothing distinguished "five
- * policies agreed this was fine" from "we ran out of time and stopped asking". That is this repo's
- * signature defect wearing a different hat: silence standing in for a measurement. degradation-watch
- * exists because a warning was printed and skimmed; this exists because nothing was printed at all.
- *
- * TWO CHANNELS, because each fails differently:
- *   · the outcome ledger (~/.config/ruvnet-brain/, survives `--update`) so a trip COMPOUNDS into
- *     evidence instead of scrolling past. `kind: 'budget-exceeded'` is inert in report()'s buckets —
- *     it counts neither as a refusal nor as a resolution, so it cannot move the obedience rate.
- *   · one stderr line, unconditionally, allow or refuse. Yes, that puts bytes on stderr during an
- *     exit-0 allow, which tests/unit/decision-gate.test.mjs asserts never happens on an ordinary
- *     write. That assertion is now a SECOND tripwire and is meant to be: after the parallel batch and
- *     the applicability skip, an ordinary write measures ~360ms against a 4000ms budget, so a trip
- *     there is not noise to be tolerated — it is the defect, and the suite should go red for it.
- */
-function reportBudget({ session, unconsulted, trace, started, budgetMs, refused = false }) {
-  const elapsed = Date.now() - started;
-  if (process.env.RUVNET_DECISION_TRACE === '1') {
-    process.stderr.write(`[decision-gate] ${EVENT} ${elapsed}ms budget=${budgetMs}ms ${JSON.stringify(trace)}\n`);
-  }
-  if (!unconsulted.length) return;
-  try {
-    appendOutcome({ kind: 'budget-exceeded', event: EVENT, session, unconsulted, elapsedMs: elapsed, budgetMs, ts: Date.now() });
-  } catch { /* a ledger must never break a tool call */ }
-  // Quiet by default (2026-10-15): the outcome is already in the ledger above. On an ALLOW, a stderr line only
-  // makes the host show a hook "error" for a decision that was made. It is kept when the action was refused
-  // and under RUVNET_STOP_NUDGES=full.
-  if (refused || QUIET_FULL) process.stderr.write(
-    `[decision-gate] ${budgetMs}ms budget exhausted after ${elapsed}ms — ${refused ? 'REFUSED; UNCONSULTED' : 'ALLOWED WITHOUT CONSULTING'}: `
-    + `${unconsulted.join(', ')}. These policies did not vote; ${refused ? 'another policy refused the action.' : 'this allow is a timeout, not a verdict.'}\n`,
-  );
-}
-/** Record and print each policy that skipped itself (exit 3), with its own one-line reason. */
-function reportSelfSkipped({ session, selfSkipped }) {
-  for (const r of selfSkipped) {
-    try { appendOutcome({ kind: 'policy-skipped', event: EVENT, session, policy: r.id, reason: r.reason, ts: Date.now() }); } catch { /* a ledger must never break a tool call */ }
-    if (QUIET_FULL) process.stderr.write(`[decision-gate] ${r.reason || `${r.id} skipped`} — ${r.id} did not vote; it supplied no authorization verdict.\n`);
-  }
-}
 /**
  * Run one policy as a CAPTURED child. Never lets its bytes touch the real streams.
  *
@@ -494,10 +451,3 @@ function readPayload() {
   if (process.stdin.isTTY) return '';
   try { return fs.readFileSync(0, 'utf8'); } catch { return ''; }
 }
-/** Never able to crash a caller that merely imported this (see tests/unit/entrypoint-guard-safety). */
-function isMain() {
-  try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
-  } catch { return false; }
-}