ruvnet-brain 4.7.20 → 4.7.22

package/plugin/scripts/brain-footprint.mjs

@@ -5,7 +5,8 @@
 //
 //   must-exist      the live KB, the active Stable Spine generation, each registered plugin generation
 //   may-exist       bounded state: logs under a size cap, lease-held plugin generations, the newest npx
-//                   copy, lifecycle evidence under its own retention policy, models, small state files
+//                   copy, lifecycle evidence under its own retention policy, models, small state files,
+//                   the newest rescued operational files of released KB copies (kb-copy-rescued/)
 //   must-not-exist  every other full-KB copy (kb.bak-*, kb.install-preserved-*, kb.pre-update-*, …,
 //                   *-quarantine-* dirs), stale install stages and forge candidates, older npx copies,
 //                   stale leases, ruflo scratch debris, rotated-away log bytes
@@ -14,6 +15,7 @@
 // SAFETY (non-negotiable, each one has a test that breaks it and goes red):
 //   * A KB copy is removed only after kbCopyProof() shows nothing in it is unique (every private-store file
 //     byte-identical in live, everything else of public provenance); a KEPT proof is cached (footprint-io).
+//     Its operational files (logs, ruflo scratch) are copied out and verified first (rescueOperationalFiles).
 //   * Nothing is followed through a symlink; a removal target must sit directly inside the real directory it
 //     was inventoried in, itself inside an owned root (footprint-io removeWithin).
 //   * Kept: non-terminal transaction trees; every KB sibling and npx copy while someone else holds the refresh
@@ -26,7 +28,9 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { isKbTree, kbCopyProof } from './kb-copy-proof.mjs';
 import { brainLocation } from './brain-location.mjs';
 import { RUFLO_CWD_ARTIFACTS } from './ruflo-bin.mjs';
-import { assessMoveLeftovers, cachedKept, cmpVersion, isVolumeMetadata, keptCopyFix, physical, pidAlive, readProofCache, rememberKept, removeWithin, rotate,
+import { isDirectInvocation } from './entrypoint.mjs';
+import { RESCUE_DIR, archiveRoots, archiveUniqueFiles, assessMoveLeftovers, discardArchiveIfMirrored, cachedKept, cmpVersion, isVolumeMetadata,
+  keptCopyFix, physical, pidAlive, readProofCache, rememberKept, removeWithin, rescueOperationalFiles, rotate,
   treeBytes, truncateToTail } from './footprint-io.mjs';
 
 export { cmpVersion, physical, treeBytes } from './footprint-io.mjs';
@@ -43,6 +47,7 @@ export const FOOTPRINT_POLICY = Object.freeze({
   staleForgeCandidateMs: 24 * 3_600_000,
   staleLeaseMs: 6 * 3_600_000,       // plugin/scripts/update-apply.mjs LEASE_FRESH_MS
   staleRufloRunMs: 3_600_000,        // plugin/scripts/ruflo-bin.mjs STALE_RUN_MS
+  rescuedCopiesKept: 5,              // kb-copy-rescued/<copy>: the newest five released copies' logs are kept
 });
 
 /** Every full-KB copy name this product (or a recovery) has ever created beside the live KB. A superset of
@@ -185,6 +190,10 @@ export function inventoryFootprint({ env = process.env, home = os.homedir(), now
     }
   };
   const classifySibling = (name, full, st) => {
+    if (name === `${base}.archive` && st.isDirectory() && !st.isSymbolicLink()) { // #335: written only by --clean --archive
+      return void add({ id: 'kb-archive', path: full, class: 'may-exist', kind: 'kb-archive', action: 'keep', bytes: bytes(full),
+        reason: 'files unique to released KB copies, archived on request (--clean --archive); never removed automatically' });
+    }
     {
       const prefix = kbCopyPrefixes(base).find((p) => name.startsWith(p));
       if (prefix === `${base}.bak-` && !BRAIN_BACKUP_STAMP.test(name.slice(prefix.length))) {
@@ -264,6 +273,20 @@ export function inventoryFootprint({ env = process.env, home = os.homedir(), now
         reason: 'the one retained rotation of a capped log (replaced at the next rotation)' });
       continue;
     }
+    // Operational files rescued from released KB copies (footprint-io rescueOperationalFiles), one directory
+    // per copy, each file <= 2 MiB and <= 16 MiB per copy (kb-copy-proof RESCUE_*_CAP_BYTES): bounded like a
+    // rotated log, by keeping the newest few directories.
+    if (name === RESCUE_DIR && st.isDirectory() && !st.isSymbolicLink()) {
+      const rescued = names(full).map((n) => ({ n, s: lstat(path.join(full, n)) })).filter((r) => r.s)
+        .sort((a, b) => b.s.mtimeMs - a.s.mtimeMs || a.n.localeCompare(b.n));
+      rescued.forEach(({ n }, i) => {
+        const keep = i < policy.rescuedCopiesKept;
+        add({ id: 'rescued', path: path.join(full, n), class: keep ? 'may-exist' : 'must-not-exist', kind: 'rescued-kb-logs',
+          action: keep ? 'keep' : 'remove', bytes: bytes(path.join(full, n)),
+          reason: keep ? 'logs rescued from a released KB copy (one of the newest kept)' : `older than the newest ${policy.rescuedCopiesKept} rescued KB-copy logs` });
+      });
+      continue;
+    }
     if (TEXT_LOG.test(name) && st.isFile()) {
       const over = st.size > policy.textLogCapBytes;
       add({ id: 'log', path: full, class: over ? 'must-not-exist' : 'may-exist', kind: 'text-log', action: over ? 'truncate' : 'keep', bytes: st.size,
@@ -366,6 +389,7 @@ export function inventoryFootprint({ env = process.env, home = os.homedir(), now
   const newestVersion = npx.map((n) => n.version).sort(cmpVersion).at(-1);
   const keepVersion = current && cmpVersion(newestVersion, current) < 0 ? null : newestVersion;
   const keeper = npx.find((n) => n.running) || npx.filter((n) => n.version === keepVersion).sort((a, b) => b.mtime - a.mtime)[0];
+  const refVersion = keeper?.version ?? current ?? newestVersion; // #420 item 3: "older" only when strictly below what is kept
   for (const n of npx) {
     const keep = n === keeper || n.running;
     // An older copy fetched < 2h ago may be running in another terminal; none goes during an update/install (S6).
@@ -373,7 +397,10 @@ export function inventoryFootprint({ env = process.env, home = os.homedir(), now
     const hold = !keep && (kbBlocked || (recent ? 'fetched in the last 2h; it may be running now' : null));
     add({ id: 'npx', path: n.dir, version: n.version, bytes: bytes(n.dir), class: keep ? 'may-exist' : 'must-not-exist', kind: 'npx-copy',
       action: keep || hold ? (keep ? 'keep' : 'report') : 'remove', blocked: hold || null,
-      reason: keep ? (n.running ? 'the installer running now' : 'the newest installer copy') : `an older installer copy (${n.version})` });
+      reason: keep ? (n.running ? 'the installer running now' : 'the newest installer copy')
+        : cmpVersion(n.version, refVersion) < 0 ? `an older installer copy (${n.version})`
+          : cmpVersion(n.version, refVersion) === 0 ? `a duplicate installer copy at the kept version (${n.version}); one copy is enough`
+            : `an installer copy (${n.version}) newer than the kept one (${refVersion}); one copy is enough` });
   }
 
   // ── lifecycle evidence, judged by its own policy ────────────────────────────────────────────
@@ -390,7 +417,7 @@ function summarize({ roots, items, policy, kbCopyDirs, lockHeld }) {
   const owned = items.filter((i) => i.class !== 'unowned');
   const kbBytes = sum(items.filter((i) => i.kind === 'live-kb'));
   const modelBytes = sum(items.filter((i) => i.kind === 'models'));
-  const budgetBytes = kbBytes + modelBytes + policy.fixedAllowanceBytes;
+  const budgetBytes = kbBytes + modelBytes + sum(items.filter((i) => i.kind === 'kb-archive')) + policy.fixedAllowanceBytes;
   const breakdown = {};
   for (const i of owned) {
     const group = i.kind === 'live-kb' ? 'knowledge base' : i.kind === 'models' ? 'models' : /plugin|spine/.test(i.kind) ? 'plugins'
@@ -419,13 +446,40 @@ function summarize({ roots, items, policy, kbCopyDirs, lockHeld }) {
  * every refusal is returned with its reason. `collectPluginGenerations` is the caller's lease-aware
  * collector (bin/install.mjs prunePluginGenerations); `pruneEvidence` is kb's pruneLifecycleEvidence.
  */
-export function sweepFootprint({ apply = false, collectPluginGenerations = null, pruneEvidence = null,
+export function sweepFootprint({ apply = false, archive = false, collectPluginGenerations = null, pruneEvidence = null,
   proveCopy = kbCopyProof, beforeRemove = null, ...options } = {}) {
   const before = inventoryFootprint(options);
   const { roots } = before;
   const owned = [...new Set([roots.kbParent, roots.brainHome, ...roots.brainHomeParents, roots.npxRoot].map(physical))];
-  const prove = (copyDir) => {
-    const proof = proveCopy({ copyDir, liveDir: roots.kbDir });
+  // #335: copies that STAY on disk this sweep may account for a later copy's files (kept siblings). Only
+  // final decisions are added: archive trees, copies a cached proof keeps (outside --archive, which re-proves
+  // them), and each copy this sweep keeps. A copy is never a reference for one evaluated before it.
+  const archiveDir = path.join(roots.kbParent, `${path.basename(roots.kbDir)}.archive`);
+  const stampDir = path.join(archiveDir, new Date(options.now ?? Date.now()).toISOString().replace(/[:.]/g, '-'));
+  const archiving = apply && archive;
+  const reArchive = (item) => archiving && ['kb-copy', 'quarantine'].includes(item.kind) && item.keptUnique && !item.blocked;
+  // Correctness relies on SORTED directory order across concurrent sweeps: inventory and archiveRoots list
+  // entries sorted, so two sweeps evaluate copies in the same order and agree which copy of a duplicate pair
+  // is the kept reference; with unsorted order each could release the copy the other kept as its reference.
+  const refs = [...archiveRoots(archiveDir), ...before.items.filter((i) => i.kind === 'kb-copy' && i.keptUnique && !reArchive(i)).map((i) => i.path)];
+  const prove = (copyDir, label = path.basename(copyDir)) => {
+    let proof = proveCopy({ copyDir, liveDir: roots.kbDir, keptSiblings: [...refs] });
+    if (!proof.disposable && archiving && proof.unique?.length) {
+      const archived = archiveUniqueFiles({ copyDir, unique: proof.unique, stampDir, label, now: options.now ?? Date.now() });
+      if (archived.ok) {
+        refs.push(archived.root);
+        const again = proveCopy({ copyDir, liveDir: roots.kbDir, keptSiblings: [...refs] });
+        if (again.disposable) proof = { ...again, reason: `archived ${archived.files.length} unique file(s) to ${archived.root}; ${again.reason}` };
+        else { // the copy is kept (e.g. unreadable metadata on the re-proof): if it still holds every archived byte, no archive is left behind
+          const discard = discardArchiveIfMirrored({ root: archived.root, copyDir, files: archived.files });
+          if (discard.discarded) {
+            refs.pop();
+            proof = { ...again, reason: `${again.reason}; not archived: the copy is kept, so its archive was removed` };
+          } else proof = { ...again, reason: `${again.reason}; the archive at ${archived.root} is kept: ${discard.reason}` };
+        }
+      } else proof = { ...proof, reason: `${proof.reason}; not archived: ${archived.reason}` };
+    }
+    if (!proof.disposable) refs.push(copyDir);
     if (apply && !proof.disposable && isKbTree(roots.kbDir)) rememberKept(roots.brainHome, copyDir, roots.kbDir, proof); // a dry run writes nothing
     return proof;
   };
@@ -435,8 +489,13 @@ export function sweepFootprint({ apply = false, collectPluginGenerations = null,
       kept: [{ path: roots.location.path, kind: 'unmounted-brain', reason: before.items[0].reason }], freedBytes: 0, before, after: before };
   }
   const record = (item, freed, note) => removed.push({ path: item.path, kind: item.kind, bytes: freed ?? item.bytes, reason: note || item.reason });
-  for (const item of before.items) {
-    if (!['remove', 'remove-if-proven', 'rotate', 'truncate'].includes(item.action)) {
+  // Rescue retention is applied only AFTER every rescue of this sweep, and never to a destination this sweep used: a
+  // retry that re-validates an aged-out rescue and then releases its copy must not also delete that rescue (review C).
+  const rescuedNow = new Set(); const rescue = (...args) => { const dest = rescueOperationalFiles(...args); if (dest) rescuedNow.add(dest); };
+  const deferred = before.items.filter((i) => i.kind === 'rescued-kb-logs' && i.action === 'remove');
+  for (const item of [...before.items.filter((i) => !deferred.includes(i)), ...deferred]) {
+    if (deferred.includes(item) && rescuedNow.has(item.path)) { kept.push({ path: item.path, kind: item.kind, reason: 'used by a rescue in this sweep; retention applies at the next sweep' }); continue; }
+    if (!['remove', 'remove-if-proven', 'rotate', 'truncate'].includes(item.action) && !reArchive(item)) {
       if (item.class === 'must-not-exist' || item.class === 'unowned') kept.push({ path: item.path, kind: item.kind, reason: item.blocked || item.reason, fix: item.fix || null });
       continue;
     }
@@ -449,6 +508,7 @@ export function sweepFootprint({ apply = false, collectPluginGenerations = null,
       if (item.kind === 'kb-copy') {
         const proof = prove(item.path);
         if (!proof.disposable) { kept.push({ path: item.path, kind: item.kind, reason: `KEPT: ${proof.reason}`, unique: proof.unique }); continue; }
+        if (apply) rescue(item.path, proof.rescue, roots.brainHome); // throws -> the copy is kept
         record(item, apply ? removeWithin(item.path, item.realParent, owned) : item.bytes, proof.reason);
         continue;
       }
@@ -456,9 +516,10 @@ export function sweepFootprint({ apply = false, collectPluginGenerations = null,
       const quarantineReal = physical(item.path);
       for (const child of names(item.path)) {
         const childPath = path.join(item.path, child);
-        const proof = isKbTree(childPath) ? prove(childPath)
+        const proof = isKbTree(childPath) ? prove(childPath, `${path.basename(item.path)}--${child}`)
           : { disposable: false, unique: [], reason: 'not a KB copy; not ours to judge' };
         if (!proof.disposable) { uniqueLeft = true; kept.push({ path: childPath, kind: 'quarantined-copy', reason: `KEPT: ${proof.reason}`, unique: proof.unique }); continue; }
+        if (apply) rescue(childPath, proof.rescue, roots.brainHome, `${path.basename(item.path)}--${child}`); // throws -> kept
         record({ path: childPath, kind: 'quarantined-copy', bytes: treeBytes(childPath) }, apply ? removeWithin(childPath, quarantineReal, owned) : undefined, proof.reason);
       }
       if (!uniqueLeft && apply) removeWithin(item.path, item.realParent, owned);
@@ -488,7 +549,7 @@ export async function loadKbReaders(kbDir) {
 }
 
 // CLI: the detached SessionStart sweep. `node brain-footprint.mjs --sweep [--apply] [--json]`.
-if (process.argv[1] && pathToFileURL(physical(process.argv[1])).href === pathToFileURL(physical(fileURLToPath(import.meta.url))).href) {
+if (isDirectInvocation(import.meta.url)) {
   const argv = process.argv.slice(2);
   const roots = footprintRoots();
   const readers = await loadKbReaders(roots.kbDir);

package/plugin/scripts/capability-registry.mjs

@@ -622,7 +622,7 @@ export const CAPABILITIES = [
       if (config.err) return row(STATE.UNKNOWN, 'managed native routing settings are unreadable; routing and savings are not inferred');
       if (!config.missing) {
         const value = config.value;
-        if (!value || !path.isAbsolute(value.runtimeRoot || '') || !/^[a-f0-9]{64}$/.test(value.runtimeDigest || '')) return row(STATE.UNKNOWN, 'managed routing declaration is incomplete; no execution claim is made');
+        if (!value || !path.isAbsolute(value.runtimeRoot || '') || !/^[a-f0-9]{64}$/.test(value.runtimeDigest || '')) return row(STATE.UNKNOWN, 'managed routing declaration is incomplete (no absolute runtimeRoot or 64-hex runtimeDigest), so routing could not be checked; no execution claim is made');
         return row(STATE.UNKNOWN, 'a managed native routing runtime is configured. The retired Task dispatch hook is not a prerequisite. Configuration alone does not prove normal entry wiring, model allocation, execution or savings; those runtime facts were not checked by this declaration-only probe.');
       }
       return row(STATE.UNKNOWN, 'no managed routing declaration was observed in this inspected location; legacy Task routing receipts or binary presence do not establish current native routing or its absence');

package/plugin/scripts/capacity-aware-parallel-work.mjs

@@ -13,6 +13,7 @@ import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { isHarnessGenerated } from './hook-input.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export const UNKNOWN_RUNTIME_TOTAL_AGENT_CEILING = 4;
 const INPUT_LIMIT = 32 * 1024;
@@ -257,4 +258,4 @@ function main() {
   }
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) main();
+if (isDirectInvocation(import.meta.url)) main();

package/plugin/scripts/codex-overnight-notice.mjs

@@ -0,0 +1,33 @@
+// codex-overnight-notice.mjs — the unattended nightly never reloads the shared Codex app-server (owner decision,
+// 4.7.21 review r2): a reload reaches Codex sessions already open, and Brain hooks pause in them until re-reviewed in
+// /hooks, which nobody is awake to do. The nightly records this one-line notice instead; the next SessionStart shows
+// it ONCE. Same claim-before-say contract as the other once-only SessionStart lines (.star-ask-shown, turn-capture
+// notices): the file is claimed by an atomic rename BEFORE the line is emitted, so two sessions starting together
+// cannot both show it, and a killed session cannot repeat it.
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const CODEX_OVERNIGHT_FILE = 'codex-hooks-overnight-notice.json';
+export const CODEX_OVERNIGHT_PREFIX = '[RuvNet Brain — CODEX HOOKS CHANGED OVERNIGHT]';
+export const CODEX_OVERNIGHT_TEXT = 'Codex hooks changed overnight; open Codex sessions will pick them up on restart or after /hooks review.';
+
+/** Written by the unattended update. Never throws: an unrecorded notice must not fail the nightly. */
+export function recordCodexOvernightNotice(brainHome, { now = Date.now() } = {}) {
+  try {
+    fs.mkdirSync(brainHome, { recursive: true });
+    const file = path.join(brainHome, CODEX_OVERNIGHT_FILE);
+    const tmp = `${file}.tmp-${process.pid}`;
+    fs.writeFileSync(tmp, `${JSON.stringify({ schemaVersion: 1, at: new Date(now).toISOString() })}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    return true;
+  } catch { return false; }
+}
+
+/** Read by SessionStart: the line to show, at most once; '' when there is none or another session claimed it. */
+export function claimCodexOvernightNotice(brainHome) {
+  const file = path.join(brainHome, CODEX_OVERNIGHT_FILE);
+  const claimed = `${file}.shown-${process.pid}`;
+  try { fs.renameSync(file, claimed); } catch { return ''; }
+  try { fs.rmSync(claimed, { force: true }); } catch { /* claimed already; a leftover is never shown again */ }
+  return `${CODEX_OVERNIGHT_PREFIX} ${CODEX_OVERNIGHT_TEXT}`;
+}

package/plugin/scripts/completion-claim-evidence.mjs

@@ -16,13 +16,14 @@
  *   (3) the answer discloses what is NOT verified.
  *   Anything else is one correction request. No claim recognised → no verdict about the prose.
  *
- * HOSTS. Claude Code transcripts (`transcript_path`, JSONL) are parsed. Codex's Stop payload also
- * carries `transcript_path`, but its rollout format is NOT parsed anywhere in this repository
- * (turn-outcome-capture.mjs declines it), so on Codex the
- * transcript half is UNKNOWN and only the answer-side half (2)+(3) is enforced — disclosed in the
- * correction text, never silently treated as proven.
+ * HOSTS. Claude Code transcripts (`transcript_path`, JSONL) are parsed. A Codex rollout is read through
+ * the shared native-turn-transcript normalizer (#423) and held to a stricter evidence rule: a command
+ * counts as a check only with an explicit exit 0 (normalizeToolOutcome `pass`), an unknown native tool
+ * is a change boundary, and a rollout without a current-turn boundary yields no evidence (UNKNOWN).
  */
 import { readSettledTranscript } from './turn-outcome-capture.mjs';
+import { nativeTurnLines } from './native-turn-transcript.mjs';
+import { normalizeToolOutcome } from './continuity-events.mjs';
 
 const MAX_SENTENCE = 400;
 export const PROMISE_KIND = 'assistant-commitment';
@@ -105,6 +106,54 @@ function segmentMutates(segment) {
   return /(?:^|[^0-9&>])>{1,2}\s*(?!&|\/dev\/null)(['"]?)([^\s'"]+)/.test(segment)
     && !TMP_PATH.test((/>{1,2}\s*['"]?([^\s'"]+)/.exec(segment) || [])[1] || '');
 }
+/**
+ * #369/#425: the exit status a transcript reports is the WHOLE command's. It is the status of one check only
+ * when the command is one simple command, or an `&&` chain (which reaches its end only if every part passed).
+ * Returns the reason a command is NOT such a shape (pipe, `||`, `;`, `&`, newline, substitution, subshell,
+ * redirection other than 2>&1 / /dev/null), or null. When unsure it names a reason: never binds by default.
+ */
+export function compoundReason(command) {
+  const s = String(command || '');
+  // A leading `!` (also after `&&`, after optional VAR=x prefixes) inverts the exit status: a failing check reports success.
+  if (/(?:^|&&)\s*(?:[A-Za-z_]\w*=\S*\s+)*!\s/.test(s)) return 'negated exit status (`!`)';
+  let q = '';
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    const n = s[i + 1];
+    if (q === "'") { if (c === "'") q = ''; continue; }
+    if (c === '\\') { i++; continue; }
+    if (q === '"') {
+      if (c === '"') q = '';
+      else if (c === '`' || (c === '$' && n === '(')) return 'command substitution';
+      continue;
+    }
+    if (c === "'" || c === '"') { q = c; continue; }
+    if (c === '|') return n === '|' ? '`||` fallback' : 'pipe';
+    if (c === ';') return '`;` sequence';
+    if (c === '\n' || c === '\r') return 'multiple lines';
+    if (c === '`' || c === '(' || c === ')' || (c === '$' && n === '(')) return 'subshell or substitution';
+    if (c === '&') {
+      if (n === '&') { i++; continue; }
+      if (/^&>/.test(s.slice(i))) return 'redirection';
+      return 'background `&`';
+    }
+    if (c === '>' || c === '<') {
+      const m = /^(?:>&\d|>>?\s*\/dev\/null)/.exec(s.slice(i));
+      if (m) { i += m[0].length - 1; continue; }
+      return 'redirection';
+    }
+  }
+  return null;
+}
+const SAFE_REDIRECT = /\s*\d?>>?\s*\/dev\/null|\s*\d?>&\d/g;
+/** The command a claim would name: safe redirects (2>&1, >/dev/null) are not part of it. */
+const withoutSafeRedirects = (seg) => seg.replace(SAFE_REDIRECT, '').trim();
+/** For an unbound segment: the leading command a claim could have named (cut at the first operator). */
+function headsOf(seg) {
+  const lead = seg.replace(/^[\s(]*(?:\$\()?/, '');
+  const cut = (t) => t.split(/[|;&<>()`$\n]/)[0].trim();
+  return [...new Set([cut(seg), cut(lead)].filter((h) => h.length >= 4))];
+}
 const segmentChecks = (segment) => !TRIVIAL.test(segment) && !segmentMutates(segment);
 function checkName(segment) {
   const words = segment.replace(/^(?:[A-Z_][A-Z0-9_]*=\S+\s+)+/, '').split(/\s+/);
@@ -132,12 +181,24 @@ export function currentTurnRecords(lines) {
     const isToolResult = Array.isArray(c) && c.some((x) => x?.type === 'tool_result');
     if (o?.type === 'user' && (o.message?.role || 'user') === 'user' && !isToolResult && !o.isMeta && textOf(c).trim()) start = i;
   });
-  return { boundaryFound: start >= 0, prompt: start >= 0 ? textOf(recs[start].message?.content) : '', recs: recs.slice(start + 1) };
+  // `openerId` identifies the turn by its opening record (uuid, else its position among the main-thread records),
+  // never by the prompt text: a repeated "continue" is a different turn with the same words.
+  const openerId = start < 0 ? '' : (typeof recs[start].uuid === 'string' && recs[start].uuid ? `uuid:${recs[start].uuid}` : `pos:${start}`);
+  return { boundaryFound: start >= 0, prompt: start >= 0 ? textOf(recs[start].message?.content) : '', openerId, recs: recs.slice(start + 1) };
 }
 
-/** Ordered events for the current turn of a Claude JSONL transcript. */
-export function claudeTurnEvents(lines) {
-  const { boundaryFound, recs: turnRecs } = currentTurnRecords(lines);
+// Codex tools that neither change state nor run a check; every other unrecognised tool is a change (fail
+// toward asking). Grounded in codex-cli 0.164.0's tool handlers (plan, view_image, tool_search,
+// mcp_resource/{list_mcp_resources,list_mcp_resource_templates,read_mcp_resource}, current_time,
+// get_context_remaining, wait_for_environment, multi_agents/wait, sleep, request_user_input[_async]) and real
+// rollouts (code-mode `wait` on a cell, `wait_agent`/`list_agents`). web_search is a hosted search, read-only.
+// Acting tools stay changes: spawn_agent, send_message, followup_task, interrupt_agent, js, exec, update_goal.
+const CODEX_NEUTRAL = /^(?:update_plan|view_image|sleep|list_agents|wait_agent|wait|request_user_input(?:_async)?|tool_search|web_search|list_mcp_resources|list_mcp_resource_templates|read_mcp_resource|current_time|get_context_remaining|wait_for_environment)$/;
+
+/** Ordered events for the current turn of a Claude JSONL (or normalized Codex) transcript. */
+export function claudeTurnEvents(lines, { host = 'claude' } = {}) {
+  const codex = host === 'codex';
+  const { boundaryFound, prompt: turnPrompt, openerId, recs: turnRecs } = currentTurnRecords(lines);
   const results = new Map();
   for (const o of turnRecs) {
     const c = o?.message?.content;
@@ -145,7 +206,8 @@ export function claudeTurnEvents(lines) {
     for (const r of c) {
       if (r?.type === 'tool_result' && r.tool_use_id) {
         results.set(r.tool_use_id, { error: r.is_error === true || o.toolUseResult?.interrupted === true,
-          present: textOf(r.content).trim().length > 0 || String(o.toolUseResult?.stdout || '').trim().length > 0 });
+          present: textOf(r.content).trim().length > 0 || String(o.toolUseResult?.stdout || '').trim().length > 0,
+          ...(codex ? { passed: normalizeToolOutcome(r).outcome === 'pass', nativeOk: r.is_error === false && r.status === 'completed' } : {}) });
       }
     }
   }
@@ -156,23 +218,32 @@ export function claudeTurnEvents(lines) {
     for (const u of c) {
       if (u?.type !== 'tool_use') continue;
       const input = u.input || {};
-      const result = results.get(u.id) || { present: false, error: false };
-      if (['Edit', 'Write', 'MultiEdit', 'NotebookEdit'].includes(u.name)) {
+      const found = results.get(u.id) || { present: false, error: false };
+      // Codex: a check needs an explicit exit 0 (commands) or a completed native status (MCP).
+      const { passed, nativeOk, ...result } = codex ? { ...found, error: found.error || !(u.name === 'Bash' ? found.passed : found.nativeOk) } : found;
+      if (['Edit', 'Write', 'MultiEdit', 'NotebookEdit'].includes(u.name) || (codex && u.name === 'apply_patch')) {
         events.push({ kind: 'change', what: `${u.name} ${input.file_path || input.notebook_path || ''}`.trim() });
       } else if (u.name === 'Bash') {
+        const unbound = compoundReason(input.command);
         for (const seg of segments(input.command)) {
           if (segmentMutates(seg)) events.push({ kind: 'change', what: seg.slice(0, 120) });
-          else if (segmentChecks(seg)) events.push({ kind: 'check', what: seg.slice(0, 120), name: checkName(seg), ...result });
+          else if (segmentChecks(seg)) {
+            const cmd = unbound ? seg : withoutSafeRedirects(seg);
+            events.push({ kind: 'check', what: cmd.slice(0, 120), command: cmd.slice(0, 400), name: checkName(seg), ...result,
+              ...(unbound ? { unbound: `the command uses ${unbound}, so its exit status is not this check's`, heads: headsOf(seg) } : {}) });
+          }
         }
       } else if (u.name === 'Agent' || u.name === 'Task') {
         if (!READ_ONLY_AGENTS.test(String(input.subagent_type || ''))) events.push({ kind: 'change', what: `${u.name} ${input.subagent_type || 'agent'}` });
       } else if (String(u.name || '').startsWith('mcp__')) {
         events.push(MCP_MUTATING.test(u.name) ? { kind: 'change', what: u.name }
           : { kind: 'check', what: u.name, name: u.name.split('__').pop(), ...result });
+      } else if (codex && !CODEX_NEUTRAL.test(String(u.name || ''))) {
+        events.push({ kind: 'change', what: `codex ${String(u.name || 'tool').slice(0, 60)}` });
       }
     }
   }
-  return { boundaryFound, events };
+  return { boundaryFound, prompt: turnPrompt, openerId, events };
 }
 
 /** Verification that ran AFTER the last state change this turn, with a present, non-error result. */
@@ -180,14 +251,21 @@ export function postChangeVerification(turn) {
   const events = turn?.events || [];
   let lastChange = -1;
   events.forEach((e, i) => { if (e.kind === 'change') lastChange = i; });
-  const checks = events.slice(lastChange + 1).filter((e) => e.kind === 'check' && e.present && !e.error);
-  return { lastChange: lastChange >= 0 ? events[lastChange].what : null, checks,
+  const after = events.slice(lastChange + 1).filter((e) => e.kind === 'check' && e.present && !e.error);
+  // `checks` is STRICT (binds a claim or a promise). `maskedChecks` ran with output and no error, but the command
+  // is a pipe / `||` / `;` / file redirect, so its exit status is not attributable: counted only as "a check ran".
+  const checks = after.filter((e) => !e.unbound);
+  const maskedChecks = after.filter((e) => e.unbound);
+  return { lastChange: lastChange >= 0 ? events[lastChange].what : null, checks, maskedChecks,
     staleChecks: events.slice(0, Math.max(0, lastChange)).filter((e) => e.kind === 'check').length };
 }
 
-export function readClaudeTurn(transcriptPath, { read = readSettledTranscript } = {}) {
+export function readClaudeTurn(transcriptPath, { read = readSettledTranscript, host = 'claude' } = {}) {
   if (typeof transcriptPath !== 'string' || !/\.jsonl$/i.test(transcriptPath)) return null;
-  try { return claudeTurnEvents(read(transcriptPath, { maxMs: 0 })); } catch { return null; }
+  try {
+    const turn = claudeTurnEvents(nativeTurnLines(read(transcriptPath, { maxMs: 0 }), host), { host });
+    return host === 'codex' && !turn.boundaryFound ? null : turn;
+  } catch { return null; }
 }
 
 /**
@@ -196,16 +274,19 @@ export function readClaudeTurn(transcriptPath, { read = readSettledTranscript }
  */
 export function auditCompletionClaims(message, { turn = null, host = 'claude' } = {}) {
   const claims = extractCompletionClaims(message);
-  if (!claims.length) return { verdict: 'NONE', claims };
+  if (!claims.length) return { verdict: 'NONE', claims, outcomes: [] };
   const text = String(message || '');
   const verification = turn ? postChangeVerification(turn) : null;
-  const names = verification?.checks.map((c) => String(c.name || '').toLowerCase()).filter((n) => n.length >= 3) || [];
+  // Naming a check that ran is not binding it: masked checks count here so an inline mention is not 'unnamed'; transcriptOk below still uses strict checks only.
+  const names = verification ? [...verification.checks, ...verification.maskedChecks].map((c) => String(c.name || '').toLowerCase()).filter((n) => n.length >= 3) : [];
   const namesCheck = NAMED_CHECK.test(text) || names.some((n) => text.toLowerCase().includes(n));
   const disclosesGaps = DISCLOSES_GAPS.test(strippedProse(text).replace(/```[\s\S]*?```/g, ''))
     || DISCLOSES_GAPS.test(text);
   const problems = [];
   if (!turn) problems.push(`this host's (${host}) transcript is unavailable or not parsed, so whether a check ran after the change is UNKNOWN`);
-  else if (!verification.checks.length) {
+  else if (!verification.checks.length && verification.maskedChecks.length) {
+    problems.push('a check ran after the last change, but its command uses a pipe, `||`, `;` or a file redirect, so its exit status is not attributable to it; completion is UNKNOWN');
+  } else if (!verification.checks.length) {
     problems.push(verification.lastChange
       ? `no end-to-end check ran this turn after the last change (${verification.lastChange})`
       : 'no end-to-end check ran this turn');
@@ -218,7 +299,81 @@ export function auditCompletionClaims(message, { turn = null, host = 'claude' }
   if (transcriptOk && namesCheck && disclosesGaps && !scopedCheck) problems.push('observed checks cover only their executed scope; whole-task completion is UNKNOWN');
   const verdict = transcriptOk && namesCheck && disclosesGaps && scopedCheck ? 'OBSERVED_CHECK'
     : namesCheck && disclosesGaps ? 'UNKNOWN' : 'FAIL';
-  return { verdict, claims, verification, namesCheck, disclosesGaps, problems };
+  return { verdict, claims, verification, namesCheck, disclosesGaps, problems, outcomes: claimOutcomes(claims, text, turn) };
+}
+
+// ── per-claim outcomes (#425) ───────────────────────────────────────────────────────────────────
+// Evidence per claimed outcome, NOT completion authority: `authority:false` always, the verdict above is
+// computed without it, and no state here is PASS. A claim is `observed-check` only when its own sentence
+// (or a line-start `Verified:` line) NAMES the command of a check that ran after the last change, produced
+// output and did not error. Anything else is reported as what it is: stale, failed, or unbound.
+const VERIFIED_LINE = /(?:^|\n)[ \t]*(?:[-*•][ \t]*|\*\*)*verified\b[^\n:—–]{0,4}?(?:\*\*)?[ \t]*[:—–][ \t]*([^\n]+)/gi;
+// Env-var prefixes are part of the command (`SKIP_HOOKS=1 npm run x` is not `npm run x`): never stripped.
+const squash = (value) => String(value || '').replace(/\s+/g, ' ').trim().toLowerCase();
+/** `hay` contains `cmd` as a whole command: not preceded by an env-var assignment or a word character. */
+export function containsCommand(hay, cmd) {
+  const h = String(hay || ''); const c = String(cmd || '');
+  if (!c) return false;
+  for (let at = h.indexOf(c); at >= 0; at = h.indexOf(c, at + 1)) {
+    const before = h.slice(0, at);
+    if (/[\w./:=-]$/.test(before) || /^[\w:-]/.test(h.slice(at + c.length))) continue;
+    if (/(?:^|[\s`'"(])[A-Za-z_][A-Za-z0-9_]*=\S*\s+$/.test(before)) continue;
+    return true;
+  }
+  return false;
+}
+
+function rawSentenceOf(message, claim) {
+  for (const raw of String(message || '').split(/(?<=[.!?])\s+|\n+/)) if (sentences(raw).includes(claim.text)) return raw;
+  return claim.text;
+}
+
+export function claimOutcomes(claims, message, turn) {
+  const events = turn?.events || [];
+  let lastChange = -1;
+  events.forEach((e, i) => { if (e.kind === 'change') lastChange = i; });
+  const checks = events.map((e, i) => ({ e, i })).filter(({ e }) => e.kind === 'check' && String(e.command || '').length >= 4);
+  const verifiedLines = [...String(message || '').matchAll(VERIFIED_LINE)].map((m) => squash(m[1])).join('\n');
+  return (claims || []).map((claim) => {
+    const own = squash(rawSentenceOf(message, claim));
+    const namedAll = checks.filter(({ e }) => { const c = squash(e.command); const hit = (h) => containsCommand(own, h) || containsCommand(verifiedLines, h);
+      return hit(c) || (e.unbound && (e.heads || []).some((h) => hit(squash(h)))); });
+    const named = namedAll.filter(({ e }) => !e.unbound);
+    const good = named.filter(({ e, i }) => i > lastChange && e.present && !e.error);
+    const state = good.length ? 'observed-check'
+      : named.some(({ e, i }) => i > lastChange && !(e.present && !e.error)) ? 'failed-check'
+        : named.length ? 'stale' : 'unbound';
+    const reason = state === 'unbound' ? namedAll.find(({ e }) => e.unbound)?.e.unbound : undefined;
+    return { claim: claim.text.slice(0, 200), state, ...(reason ? { reason } : {}),
+      checks: (state === 'observed-check' ? good : named).slice(-3).map(({ e }) => ({ command: e.command, name: e.name })), authority: false };
+  });
+}
+
+/**
+ * #425 (sparkling): the audit category of a correction, independent of wording. A correction is delivered
+ * at most once per session + user turn + category, so rewording the answer or waiting cannot rearm it.
+ */
+export function completionCategory(completion) {
+  const ids = (completion?.problems || []).map((p) => /unavailable or not parsed/.test(p) ? 'transcript-unavailable'
+    : /no end-to-end check ran/.test(p) ? 'no-check' : /not attributable/.test(p) ? 'check-unattributed' : /does not name the check/.test(p) ? 'check-unnamed'
+      : /does not disclose/.test(p) ? 'gaps-undisclosed' : /observed checks cover only/.test(p) ? 'scope' : 'other');
+  return `${completion?.verdict || 'NONE'}:${[...new Set(ids)].sort().join('+')}`;
+}
+
+/** Correction copy for a FAIL/UNKNOWN verdict. When checks DID run, ask for an outcome-by-outcome report. */
+export function completionCorrectionText(completion) {
+  const lead = `You claimed "${completion.claims[0].text.slice(0, 160)}" is done; ${completion.problems.join('; ')}.`;
+  return (completion.verification?.checks?.length || 0) + (completion.verification?.maskedChecks?.length || 0) > 0
+    ? `${lead} A check ran, but it does not cover every claim: report outcome by outcome, naming the check that ran for each claim or restating it as UNVERIFIED.`
+    : `${lead} Run the real consumer path, or restate it as UNVERIFIED.`;
+}
+
+/** Non-blocking advisory text: which claims have an observed check and which do not. */
+export function outcomeAdvisoryText(completion) {
+  const lines = (completion.outcomes || []).map((o) => `- ${o.state}: "${o.claim.slice(0, 100)}"${o.checks.length ? ` (${o.checks.map((c) => c.command).join('; ')})` : ''}`);
+  const masked = !(completion.verification?.checks?.length) && (completion.verification?.maskedChecks?.length || 0) > 0;
+  return `A check ran after the last change${masked ? ' (its command uses a pipe, `||`, `;` or a redirect, so its exit status is not attributable to it)' : ''} and the answer names it and discloses what is not verified. Per claimed outcome:\n${lines.join('\n')}\n`
+    + 'This is evidence per outcome, not completion authority: completion stays UNKNOWN. Not blocking: more checks or rewording cannot change it.';
 }
 
 // ── promises (first-person commitments) ─────────────────────────────────────────────────────────
@@ -227,6 +382,10 @@ const PROMISE_REJECT = /\?|:\*\*|\b(?:if|unless|once|when|whenever|as\s+soon\s+a
 const TRIVIAL_PROMISE = /^(?:not|never|be|say|mention|note|admit|point|flag|stop|stay|leave|keep|summari[sz]e|explain|answer|respond|reply|report|remember|give|tell|send|paste|bring|hand|show|walk|notify|post|update\s+you|come\s+back|get\s+back|handle|only|stand|work)\b/i;
 const OWNER_DEPENDENT_OFFER = /\b(?:say\s+the\s+word|(?:just|simply)\s+(?:ask|say)|ask\s+me|let\s+me\s+know|give\s+me\s+the\s+(?:word|go|nod|ok)|on\s+your\s+(?:word|go|ok|say)|up\s+to\s+you)\b/i;
 const STANDING_APPROVAL = /^(?:ask|confirm|check\s+with\s+you|clear\s+(?:it|this|that)\s+with\s+you|run\s+.+\s+by\s+you)\b.*\b(?:before|first)\b/i;
+// "hide it the same way", "check for it then": a verb whose only object is a pronoun has no referent
+// once the turn's context is gone (#369), so no later session could ever close it honestly.
+const PRONOUN_OBJECT = /\b(?:it|this|that|them|these|those)\b/i;
+const PRONOUN_ONLY = /^\S+(?:\s+(?:it|this|that|them|these|those|the|same|way|then|again|too|also|now|later|for|to|on|in|into|at|about|with|up|out|back|down|over|off|as|well|a|an|there|here|first|next))*$/i;
 
 export const normalizePromise = (value) => String(value || '').toLowerCase().replace(/[`*_"“”'’]/g, '')
   .replace(/[^a-z0-9./:+-]+/g, ' ').trim().slice(0, 160);
@@ -248,13 +407,31 @@ export function extractCommitments(message) {
       if (PROMISE_REJECT.test(whole) || OWNER_DEPENDENT_OFFER.test(whole)
         || STANDING_APPROVAL.test(action.trim()) || TRIVIAL_PROMISE.test(action.trim())) continue;
       const text = action.replace(/\s+/g, ' ').trim().replace(/[,;:]$/, '');
+      if (PRONOUN_OBJECT.test(text) && PRONOUN_ONLY.test(text)) continue;
       const key = normalizePromise(text);
       if (key.length < 6 || seen.has(key)) continue;
       seen.add(key);
       out.push({ text, key });
     }
   }
-  return out.slice(0, PROMISE_CAP_PER_TURN);
+  return out.slice(0, PROMISE_CAP_PER_TURN).map((p) => {
+    const evidenceCommands = promiseCommands(message, p.key);
+    return evidenceCommands.length ? { ...p, evidenceCommands } : p;
+  });
+}
+
+// #369: inline-code commands in the promise's own sentence are what the promise says it will run. They are
+// recorded at capture (max 2) so a later observed check can be matched to them; prose alone never is.
+const COMMAND_SPAN = /`([^`\n]{4,160})`/g;
+function promiseCommands(message, key) {
+  for (const raw of String(message || '').split(/(?<=[.!?])\s+|\n+/)) {
+    const prose = strippedProse(raw).replace(/^\s*(?:\d+[.)]|[-*•])\s+/, '').trim();
+    const action = PROMISE_LEAD.exec(prose)?.[1] ?? prose;
+    if (normalizePromise(action) !== key) continue;
+    const found = [...raw.matchAll(COMMAND_SPAN)].map((m) => squash(m[1])).filter((c) => /\s/.test(c) || c.startsWith('./'));
+    return [...new Set(found)].slice(0, 2);
+  }
+  return [];
 }
 
 const STOP = new Set(['the', 'a', 'an', 'and', 'or', 'to', 'of', 'in', 'on', 'for', 'with', 'it', 'is', 'are',
@@ -269,3 +446,44 @@ export function claimClosesPromise(claimText, promiseText) {
   const hit = want.filter((t) => have.has(t)).length;
   return hit >= 2 && hit / want.length >= 0.4;
 }
+
+const unquoted = (value) => String(value).replace(/"([^"\n]{0,300})"|“([^”\n]{0,300})”/g, (_, a, b) => a ?? b);
+
+/**
+ * The claim that closes `promiseText`, or null. Only a PASS verdict can close a promise. strippedProse()
+ * removes double-quoted text, so `"push the branch itself" is done` extracts only `is done`; that claim
+ * may still close the promise through its raw sentence (quotes kept), which becomes the evidence. The
+ * sentence must be a recognised claim outside its quotes, so quoting alone never makes a claim (#369).
+ */
+export function promiseClosingClaim(completion, answer, promiseText) {
+  // DORMANT: auditCompletionClaims no longer returns PASS (only OBSERVED_CHECK/UNKNOWN/FAIL/NONE), so this never closes a promise today.
+  if (completion?.verdict !== 'PASS') return null;
+  return matchingClaim(completion, answer, promiseText);
+}
+
+function matchingClaim(completion, answer, promiseText) {
+  const direct = completion.claims.find((c) => claimClosesPromise(c.text, promiseText));
+  if (direct) return direct;
+  for (const raw of String(answer || '').split(/(?<=[.!?])\s+|\n+/)) {
+    const own = sentences(raw);
+    const claim = completion.claims.find((c) => own.includes(c.text));
+    if (claim && claimClosesPromise(unquoted(raw), promiseText)) return { ...claim, text: raw.trim() };
+  }
+  return null;
+}
+
+/**
+ * #369: the evidence that moves a promise to the NON-completed state `evidenced`, or null. Never `done`, never
+ * PASS, never authority. ALL must hold: a command the promise itself named ran after the last change with
+ * output and no error; the answer names that command and states what is not verified; a claim sentence
+ * matches the promise; the verdict is not FAIL. (Same-session ownership is checked by the caller.)
+ */
+export function promiseEvidence(completion, answer, item) {
+  const commands = Array.isArray(item?.evidenceCommands) ? item.evidenceCommands.map(squash) : [];
+  if (!commands.length || !completion?.claims?.length || !['OBSERVED_CHECK', 'UNKNOWN'].includes(completion.verdict)
+    || completion.disclosesGaps !== true) return null;
+  const said = squash(answer);
+  const check = (completion.verification?.checks || []).find((c) => !c.unbound && commands.includes(squash(c.command)) && containsCommand(said, squash(c.command)));
+  const claim = check && matchingClaim(completion, answer, item.text);
+  return claim ? { command: squash(check.command), check: check.what, claim: claim.text, auditVerdict: completion.verdict, authority: false } : null;
+}