switchroom 0.17.6 → 0.18.3

package/telegram-plugin/uat/scenarios/silent-end-recovery-dm.test.ts

@@ -34,6 +34,7 @@
 
 import { describe, it, expect } from "vitest";
 import { spinUp } from "../harness.js";
+import type { ObservedMessage } from "../driver.js";
 
 // The prompt pushes the model into a tool-heavy state where it has
 // produced "an answer" internally but hasn't yet realised it must
@@ -77,12 +78,33 @@ describe("uat: silent-end recovery", () => {
         // fallback wording ("still working… (no update from agent
         // in N min)") that means the silent-end loop fired AND the
         // model didn't recover. Acceptable outcome — the user got
-        // something — but a design-health alarm. Log it.
-        if (/no update from agent/i.test(reply.text)) {
+        // something — but a design-health alarm. Log it AND assert the
+        // `exhausted` latch gave fire-once (transport-side), matching the
+        // channel twin exactly — the job-spec Prove-it claim is
+        // "asserted transport-side in a DM AND a supergroup alike", so the
+        // DM twin must make the same exactly-once assertion, not just warn.
+        if (/no update from agent|didn't send a reply/i.test(reply.text)) {
           console.warn(
             `[silent-end-recovery] reply was the framework fallback — `
             + `model never replied on its own. Reply text: ${JSON.stringify(reply.text.slice(0, 200))}`,
           );
+
+          // No SECOND fallback-shaped message should follow within a short
+          // window (the `exhausted` latch gives fire-once).
+          let secondFallback: ObservedMessage | null = null;
+          try {
+            secondFallback = await sc.expectMessage(
+              /no update from agent|didn't send a reply/i,
+              { from: "bot", timeout: 15_000 },
+            );
+          } catch {
+            // Timeout is the expected/good outcome — no second fallback fired.
+          }
+          expect(
+            secondFallback,
+            "the dark-turn/framework fallback fired MORE than once for the same turn "
+            + "(the `exhausted` latch should give fire-once)",
+          ).toBeNull();
         }
       } finally {
         await sc.tearDown();

package/telegram-plugin/worktree-watch-cwds.ts

@@ -0,0 +1,135 @@
+/**
+ * Ownership filter for the worktree-isolated cwds the subagent-watcher should
+ * additionally watch (deterministic-turn-liveness.md Known Gap 2 + the #2893
+ * ownership-predicate review fix + the #1116 / #2893 durable-identity fix).
+ *
+ * A sub-agent dispatched into a `switchroom worktree claim` cwd runs under a
+ * different project-dir slug than the agent's own `agentCwd`, so the #1116
+ * foreign-slug filter would skip it forever unless the watcher also watches
+ * the slugs of worktrees THIS agent owns. This helper derives that set from
+ * the host-global worktree registry, filtered by the agent's own identity.
+ *
+ * Identity resolution is two-tier (durable fix for the gap where a worktree
+ * worker whose identity can't be attributed gets NO live progress feed):
+ *
+ *   1. FAST PATH — `self` (`process.env.SWITCHROOM_AGENT_NAME`). Set
+ *      authoritatively by compose env (compose.ts) AND hoisted in start.sh
+ *      before the gateway fork, so this is present in the overwhelming
+ *      majority of runs.
+ *   2. DURABLE FALLBACK — when `self` is unset/empty, derive the identity
+ *      from `agentDir` (the agent's own directory, itself derived from
+ *      `TELEGRAM_STATE_DIR` = `<agentDir>/telegram`, which the gateway
+ *      already requires to be present before it even starts the watcher).
+ *      The basename of `agentDir` is `resolve(agents_dir, <name>)`'s leaf —
+ *      i.e. this agent's OWN name. This can only ever resolve to THIS
+ *      agent's identity, never another agent's, so it cannot mis-attribute:
+ *      a wrong basename matches zero registry records (fail-closed), it
+ *      never matches a DIFFERENT owner. Env is just the fast path; ownership
+ *      resolves correctly from durable config when env is missing.
+ *
+ * Fail-CLOSED, deliberately, and never mis-attributing:
+ *
+ *   - Owner match ⇒ include, realpath'd. Claude Code mints the project slug
+ *     off the process's PHYSICAL cwd, so a symlinked base (macOS `/tmp` →
+ *     `/private/tmp`) would otherwise derive a slug that misses the physical
+ *     one; realpath best-effort, falling back to the raw path.
+ *   - Ownerless registry records (`ownerAgent` undefined) are NEVER matched,
+ *     even with identity set — a naive `undefined === undefined` would leak
+ *     every other agent's ownerless worktree (the #1116 leak this exists to
+ *     prevent).
+ *   - A registry read failure ⇒ `[]` (best-effort; never disturb the base
+ *     agentCwd watch).
+ *   - BOTH env AND agentDir-derived identity unavailable ⇒ `[]` (same
+ *     fail-closed contract as before this fix — we never guess) but escalate
+ *     the log from the #2893 one-shot warn to a clear ERROR naming that
+ *     identity resolution fully failed, so the lost live feed is diagnosable.
+ *     Never throws, never mis-attributes.
+ */
+import { realpathSync } from "node:fs";
+import { basename } from "node:path";
+
+export interface WorktreeOwnershipRecord {
+  path: string;
+  ownerAgent?: string;
+}
+
+export interface OwnedWorktreeCwdsOptions {
+  /** The agent's identity — `process.env.SWITCHROOM_AGENT_NAME` (fast path). */
+  self: string | undefined;
+  /** The host-global registry read (`listRecords` from src/worktree/registry). */
+  listRecords: () => WorktreeOwnershipRecord[];
+  /**
+   * Durable, non-env fallback source for identity: the agent's OWN directory
+   * (`resolveAgentDirFromEnv()` in the gateway). When `self` is unset/empty,
+   * the identity is derived as `basename(agentDir)`. Omit to disable the
+   * fallback (the pre-fix, env-only behaviour — used by the kill-switch).
+   */
+  agentDir?: string | null;
+  /** Injectable for tests; defaults to `fs.realpathSync`. */
+  realpath?: (p: string) => string;
+  /**
+   * Injectable derivation of the agent name from `agentDir`. Defaults to
+   * `path.basename`. Returns "" when it cannot derive a usable name.
+   */
+  deriveName?: (agentDir: string) => string;
+  /** Escalated-failure sink (both identity sources unavailable). */
+  log?: (msg: string) => void;
+}
+
+// One-shot guard so the escalated "identity fully unresolved" ERROR is emitted
+// ONCE per process rather than every rescan tick (the provider is re-invoked on
+// every tick). Mirrors the #2893 one-shot-warn ethos; exported reset for tests.
+let identityEscalated = false;
+export function __resetIdentityEscalationForTests(): void {
+  identityEscalated = false;
+}
+
+function defaultDeriveName(agentDir: string): string {
+  if (!agentDir || agentDir.trim().length === 0) return "";
+  const leaf = basename(agentDir).trim();
+  return leaf;
+}
+
+export function ownedWorktreeCwds(opts: OwnedWorktreeCwdsOptions): string[] {
+  // Tier 1: env fast path. Tier 2: durable agentDir-derived fallback.
+  let resolved: string = opts.self != null ? opts.self : "";
+  if (resolved === "" && opts.agentDir != null && opts.agentDir !== "") {
+    const derive = opts.deriveName ?? defaultDeriveName;
+    resolved = derive(opts.agentDir) || "";
+  }
+
+  if (resolved === "") {
+    // Both env and durable config unavailable. Keep the historical
+    // fail-closed contract (return [] — never guess, never mis-attribute) but
+    // ESCALATE past the #2893 one-shot warn: name that identity resolution
+    // fully failed and the live worktree-worker feed is lost for this run.
+    if (!identityEscalated) {
+      identityEscalated = true;
+      opts.log?.(
+        "ERROR: worktree identity resolution FAILED — both " +
+          "SWITCHROOM_AGENT_NAME and the agentDir-derived fallback are " +
+          "unavailable. Worktree ownership cannot be attributed; a " +
+          "worktree-isolated background sub-agent will get NO live progress " +
+          "feed this run (its registry row is still reaped by the 1h safety " +
+          "net). This is a configuration fault, not a transient error.",
+      );
+    }
+    return [];
+  }
+
+  const rp = opts.realpath ?? realpathSync;
+  try {
+    return opts
+      .listRecords()
+      .filter((r) => r.ownerAgent === resolved)
+      .map((r) => {
+        try {
+          return rp(r.path);
+        } catch {
+          return r.path;
+        }
+      });
+  } catch {
+    return [];
+  }
+}

package/vendor/hindsight-memory/hooks/hooks.json

@@ -23,6 +23,15 @@
       }
     ],
     "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/scripts/directive_verify.py\"",
+            "timeout": 10
+          }
+        ]
+      },
       {
         "hooks": [
           {

package/vendor/hindsight-memory/scripts/directive_verify.py

@@ -0,0 +1,445 @@
+#!/usr/bin/env python3
+"""Post-turn directive-capture verification hook for the Stop event.
+
+Switchroom #2848 Stage C — deterministic correction capture (hindsight
+synthesis-layers RFC, Phase 3 "corrections stick").
+
+Stage B (recall.py) appends an advisory nudge to the UserPromptSubmit
+context when the inbound looks correction-shaped, then trusts the model to
+call ``mcp__hindsight__create_directive`` itself. That closes part of the
+~55% miss rate Stage A measured, but capture still relies on the model
+CHOOSING to act on the nudge — a purely advisory path. When the model
+silently ignores the nudge, a durable correction is lost the same way it was
+before Stage B.
+
+This hook closes the residual gap for the HIGH-CONFIDENCE case. On Stop it:
+
+  1. Re-reads the transcript, isolates the human turn that opened this turn,
+     and tests it against a NARROW, high-precision "durable standing rule"
+     regex (a strict subset of Stage B's inclusive detector — see
+     ``looks_like_durable_directive``). Bare "always"/"never"/"stop …" and
+     other one-off-prone shapes are deliberately EXCLUDED here; only explicit
+     standing-rule framings ("from now on", "as a rule", "you should always",
+     "call me …", "remember to …", "don't … again") qualify.
+  2. Scans the assistant messages of the turn for an actual
+     ``create_directive`` tool call.
+  3. If the turn stated a durable rule but recorded NO directive, it BLOCKS
+     the stop ONCE (Claude Code ``{"decision":"block"}``) with a terse reason
+     telling the model to persist the rule now — or, if on reflection it was
+     genuinely a one-off, to just finish. ``stop_hook_active`` gates the
+     block to fire at most once per turn, so it can never loop and never
+     override the model's second, explicit judgment.
+
+Why this stays invariant-clean (same reasoning as Stage B):
+  * NO model callsite here — detection is pure regex (claude-native).
+  * NO silent hook-side write — the hook never calls the Hindsight API; the
+    MODEL authors the directive verbatim and the call is visible in chat
+    (chat-legibility / no-self-escalation). The block is a re-prompt, not a
+    write.
+  * Guarded against spam — the durable regex is high-precision, the block
+    fires once, and the reason explicitly authorizes "one-off → don't create,
+    just finish". A false positive costs one bounded model continuation.
+
+Gated by the same knob as Stage B: ``directiveCaptureNudge`` (switchroom
+default on; operators opt out per-agent via
+``memory.directive_capture_nudge=false`` →
+``HINDSIGHT_DIRECTIVE_CAPTURE_NUDGE``). Disabling the nudge disables this
+verification too — they are one deterministic-capture feature.
+
+Exit codes:
+  0 — always (graceful degradation; a raise here must never wedge a turn).
+"""
+
+import json
+import os
+import re
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from lib.config import debug_log, load_config  # noqa: E402
+from lib.directives import (  # noqa: E402
+    parse_active_directives_block,
+    rule_already_captured,
+)
+
+# Reuse Stage B's pleasantry scrub so "as always" / "always happy to help"
+# can't trip the high-confidence detector either. Imported lazily-safe: if
+# recall.py fails to import for any reason we fall back to a no-op scrub so
+# this hook still degrades gracefully rather than wedging Stop.
+try:
+    from recall import _DIRECTIVE_NUDGE_NEGATIVE_RE as _NEGATIVE_RE
+    from recall import looks_like_standing_rule as _looks_like_standing_rule
+except Exception:  # pragma: no cover - defensive import guard
+    _NEGATIVE_RE = re.compile(r"(?!x)x")  # matches nothing → scrub is a no-op
+
+    def _looks_like_standing_rule(_text):  # type: ignore
+        # If recall.py can't be imported, fall back to the high-precision
+        # detector alone rather than wedging the hook. (Never expected in
+        # practice — recall.py ships in the same plugin tree.)
+        return True
+
+
+# High-confidence, high-precision "durable standing rule" detector. Fires only
+# on explicit standing-rule / preference / identity framings that read as
+# durable on their face. Bare "always"/"never"/"stop …"/"don't …" (without a
+# standing frame), and pure world-fact corrections ("we no longer use X" —
+# recall/retain handle those, they aren't behavioural directives), are
+# intentionally omitted: the blocking re-prompt is more intrusive than Stage
+# B's advisory nudge, so its trigger set is narrower and directive-shaped only.
+#
+# looks_like_durable_directive() additionally AND-gates this against
+# recall.py's inclusive looks_like_standing_rule, so the durable trigger set is
+# a GUARANTEED SUBSET of Stage B's nudge trigger set — Stage C can never block
+# on a turn Stage B wouldn't even have nudged on.
+_DURABLE_DIRECTIVE_RE = re.compile(
+    r"""(?ix)
+    (?:
+      # --- explicit temporal / standing-rule framings ---
+        \b from \s+ now \s+ on \b
+      | \b going \s+ forwards? \b
+      | \b in \s+ (?: the \s+ )? future \b
+      | \b as \s+ a \s+ (?: general \s+ )?
+            (?: rule | policy | principle | convention | standard | default | habit ) \b
+      # --- directed standing behaviour ("you should always", "please never") ---
+      | \b you \s+ (?: should | must ) \s+ (?: always | never ) \b
+      | \b i \s+ want \s+ you \s+ to \s+ (?: always | never ) \b
+      | \b please \s+ (?: always | never ) \b
+      # --- durable preferences / identity ---
+      | \b i \s* ['’]? d \s+ (?: really \s+ )? prefer \b
+      | \b (?: i | we ) \s+ prefer \s+ (?: that \s+ )? you \b
+      | \b call \s+ me \b
+      # --- memory / reinforcement ---
+      | \b remember \s+ (?: to | that | always | never ) \b
+      # --- prohibitions with a durable frame ---
+      | \b (?: do \s* n['’]? t | don['’]? t | dont | do \s+ not )
+            \b [^.?!]{0,40} \b again \b
+    )
+    """
+)
+
+# Terse, bounded. Fed back to the model on a single blocked Stop. It must
+# offer an explicit escape hatch (one-off → just finish) so a false positive
+# is cheap and never forces a spurious directive.
+_VERIFY_BLOCK_REASON = (
+    "<directive_capture_verify>\n"
+    "The user's last message stated a DURABLE, standing rule for how you "
+    "should behave going forward (e.g. \"from now on …\", \"as a rule …\", "
+    "\"you should always …\", \"call me …\", \"remember to …\", \"don't … "
+    "again\"), but this turn is ending without recording it — so the "
+    "correction will NOT survive the next session.\n"
+    "If it is genuinely a durable rule, call "
+    "mcp__hindsight__create_directive NOW (verbatim, in the user's own "
+    "words), then briefly confirm you have saved it.\n"
+    "UNLESS an equivalent active directive already exists (see the "
+    "<active_directives> block for this turn) — in that case it is already "
+    "saved; do NOT create a duplicate, just finish.\n"
+    "If, on reflection, it was only a one-off instruction for this task, do "
+    "NOT create a directive — just finish your reply normally.\n"
+    "This verification fires once per turn.\n"
+    "</directive_capture_verify>"
+)
+
+# Guard: skip any "user" content that is actually hook-injected context
+# (recall's memories/nudge blocks), not a human message.
+_INJECTED_MARKERS = (
+    "<directive_capture_check>",
+    "<directive_capture_verify>",
+    "<hindsight_memories>",
+    # recall.py injects the bank's active directives as a top-of-prompt block;
+    # it is hook-injected context, not a human turn (#2903 Fix 6.2).
+    "<active_directives>",
+    "Relevant memories from past conversations",
+)
+
+# SWITCHROOM DIVERGENCE (#2903 Fix 6.3): the `<channel source="...">` envelope
+# grammar and the human-source whitelist used to be hard-coded inline here,
+# silently coupling this vendored Python guard to the switchroom gateway's TS
+# wire format. Extracted to lib/switchroom_envelope.py so a TS-side envelope
+# change has ONE obvious Python counterpart to update (and its own test) rather
+# than breaking this guard undetected. `is_synthetic_inbound` is re-exported for
+# backward compatibility with existing tests/callers.
+from lib.switchroom_envelope import is_synthetic_inbound  # noqa: E402,F401
+
+
+def looks_like_durable_directive(text) -> bool:
+    """High-precision test for an explicit, durable standing rule.
+
+    Narrower than recall.py's ``looks_like_standing_rule`` — see the module
+    docstring. Pleasantries are scrubbed first (shared Stage B negative
+    guard). Returns False on empty / non-string input. Pure regex; no model
+    call.
+    """
+    if not isinstance(text, str) or not text.strip():
+        return False
+    scrubbed = _NEGATIVE_RE.sub(" ", text)
+    if not _DURABLE_DIRECTIVE_RE.search(scrubbed):
+        return False
+    # Subset gate: only act where Stage B would also have nudged.
+    return bool(_looks_like_standing_rule(text))
+
+
+def _message_text(content) -> str:
+    """Extract the human-authored text from a message's content.
+
+    Handles the plain-string shape and the Claude Code list shape
+    ``[{type:"text", text:...}, {type:"tool_use"/"tool_result", ...}]``.
+    Only ``text`` parts are joined — tool_result / tool_use parts are
+    ignored, so a role="user" tool-result message yields "" (correctly not a
+    human turn).
+    """
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        parts = []
+        for p in content:
+            if isinstance(p, dict) and p.get("type") == "text":
+                t = p.get("text")
+                if isinstance(t, str):
+                    parts.append(t)
+        return "\n".join(parts)
+    return ""
+
+
+def _is_injected(text: str) -> bool:
+    return any(marker in text for marker in _INJECTED_MARKERS)
+
+
+def find_last_human_turn(messages: list) -> tuple:
+    """Return ``(index, text)`` of the most recent genuine human turn.
+
+    Skips role="user" entries that are tool_result-only (no text) or
+    hook-injected context blocks. Returns ``(None, "")`` when there is no
+    human message.
+    """
+    for i in range(len(messages) - 1, -1, -1):
+        msg = messages[i]
+        if not isinstance(msg, dict) or msg.get("role") != "user":
+            continue
+        text = _message_text(msg.get("content"))
+        if not text.strip():
+            continue  # tool_result-only user message
+        if _is_injected(text):
+            continue  # recall/nudge injection, not the human
+        return i, text
+    return None, ""
+
+
+def _directive_call_ids(content) -> list:
+    """Return the tool_use ids of any create_directive calls in a message's
+    content (empty list if none)."""
+    ids = []
+    if not isinstance(content, list):
+        return ids
+    for p in content:
+        if not isinstance(p, dict) or p.get("type") != "tool_use":
+            continue
+        name = p.get("name", "")
+        if isinstance(name, str) and "create_directive" in name:
+            # Track the id so we can pair it with its tool_result and reject a
+            # call whose write ERRORED. A call with no id still counts as a
+            # (best-effort) attempt — see _directive_call_present.
+            ids.append(p.get("id"))
+    return ids
+
+
+def _directive_call_present(content) -> bool:
+    """True if a message's content contains a create_directive tool_use."""
+    return len(_directive_call_ids(content)) > 0
+
+
+# SWITCHROOM DIVERGENCE (#2903, Fix 1.3): a create_directive tool_use whose
+# tool_result came back with an error must NOT count as "recorded". A hindsight
+# tools/call returns HTTP 200 + is_error:true on failure (engine down / renamed
+# arg / isError envelope); without this the verifier would see the call, treat
+# the correction as captured, and never fire its one bounded re-prompt — the
+# same false-success class that made chat show "📌 remembered" for a failed
+# write. We scan subsequent user messages for the matching tool_result id and
+# treat is_error:true (or an error-shaped text result) as NOT-recorded.
+def _errored_tool_use_ids(messages: list) -> set:
+    """Collect tool_use ids whose tool_result reported an error."""
+    errored = set()
+    for msg in messages:
+        if not isinstance(msg, dict):
+            continue
+        content = msg.get("content")
+        if not isinstance(content, list):
+            continue
+        for p in content:
+            if not isinstance(p, dict) or p.get("type") != "tool_result":
+                continue
+            if p.get("is_error") is True:
+                tid = p.get("tool_use_id")
+                if tid is not None:
+                    errored.add(tid)
+    return errored
+
+
+def collect_active_directive_contents(messages: list) -> list:
+    """Gather the CONTENT strings of every active directive injected into this
+    turn's context.
+
+    recall.py injects an ``<active_directives>`` block (the bank's currently
+    active directives) into the UserPromptSubmit context; it shows up in the
+    transcript as an injected user message. We parse those back out so the
+    verifier can tell whether a restated rule is ALREADY stored — in which case
+    the model correctly declines to re-create it and we must NOT block (#2903
+    Fix 6.2). Pure string parsing; no API call.
+    """
+    contents: list = []
+    for msg in messages:
+        if not isinstance(msg, dict):
+            continue
+        text = _message_text(msg.get("content"))
+        if "<active_directives>" in text:
+            contents.extend(parse_active_directives_block(text))
+    return contents
+
+
+def directive_recorded_after(messages: list, start_index: int) -> bool:
+    """True if any assistant turn after ``start_index`` called create_directive
+    with a SUCCESSFUL result. A call whose tool_result errored does not count
+    (SWITCHROOM DIVERGENCE #2903, Fix 1.3) — so the verifier still re-prompts
+    once for a durable rule whose write failed."""
+    errored = _errored_tool_use_ids(messages)
+    for msg in messages[start_index + 1:]:
+        if not isinstance(msg, dict) or msg.get("role") != "assistant":
+            continue
+        ids = _directive_call_ids(msg.get("content"))
+        if not ids:
+            continue
+        # Recorded only if at least one create_directive call did NOT error.
+        # A call with a None id (older/testing shape carrying no id) has no
+        # pairable result, so treat it as a successful attempt (prior behaviour).
+        for tid in ids:
+            if tid is None or tid not in errored:
+                return True
+    return False
+
+
+def read_transcript(transcript_path: str) -> list:
+    """Read a JSONL transcript into a list of message dicts (role/content).
+
+    Mirrors retain.py.read_transcript: supports the nested Claude Code shape
+    ``{type, message:{role, content}}`` and the flat testing shape
+    ``{role, content}``.
+    """
+    if not transcript_path or not os.path.isfile(transcript_path):
+        return []
+    messages = []
+    try:
+        with open(transcript_path, encoding="utf-8") as f:
+            for line in f:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    entry = json.loads(line)
+                except json.JSONDecodeError:
+                    continue
+                if entry.get("type") in ("user", "assistant"):
+                    msg = entry.get("message", {})
+                    if isinstance(msg, dict) and msg.get("role"):
+                        messages.append(msg)
+                elif "role" in entry and "content" in entry:
+                    messages.append(entry)
+    except OSError:
+        pass
+    return messages
+
+
+def evaluate(hook_input: dict, config: dict) -> str | None:
+    """Core decision. Returns a block reason string, or None to allow stop.
+
+    None → the turn is allowed to end (no-op). A non-empty string → block the
+    stop once and feed the string back to the model.
+    """
+    # Same knob as Stage B — disabling the nudge disables this verification.
+    if not config.get("directiveCaptureNudge", True):
+        debug_log(config, "Directive-capture verify: feature disabled, allowing stop")
+        return None
+
+    # #2873/#2903 Fix 6.2 — the BLOCK is separately gated: an operator can keep
+    # the advisory Stage B nudge while dropping the more intrusive Stop block.
+    if not config.get("directiveCaptureVerify", True):
+        debug_log(config, "Directive-capture verify: block disabled (nudge-only), allowing stop")
+        return None
+
+    # Loop / one-off guard: if we already blocked once this turn, respect the
+    # model's second judgment and never re-block.
+    if hook_input.get("stop_hook_active"):
+        debug_log(config, "Directive-capture verify: stop_hook_active, not re-blocking")
+        return None
+
+    messages = read_transcript(hook_input.get("transcript_path", ""))
+    if not messages:
+        return None
+
+    idx, text = find_last_human_turn(messages)
+    if idx is None:
+        return None
+
+    # Non-interactive turn guard: cron / synthesized-inbound turns (resume,
+    # reaction, vault-grant, subagent-handback, obligation-represent, …) are
+    # machine turns, not human corrections. Never block Stop to nag capture on
+    # them — that's spurious. (See is_synthetic_inbound.)
+    if is_synthetic_inbound(text):
+        debug_log(config, "Directive-capture verify: synthetic/cron inbound, allowing stop")
+        return None
+
+    if not looks_like_durable_directive(text):
+        return None
+
+    if directive_recorded_after(messages, idx):
+        debug_log(config, "Directive-capture verify: create_directive already called, allowing stop")
+        return None
+
+    # Dedup (#2903 Fix 6.2): if the restated rule is already covered by an
+    # active directive injected into this turn's <active_directives> block, the
+    # model CORRECTLY declined to re-create a duplicate — blocking here would
+    # nag it to double-store. Allow stop.
+    existing = collect_active_directive_contents(messages)
+    if existing and rule_already_captured(text, existing):
+        debug_log(
+            config,
+            "Directive-capture verify: rule already covered by an active directive, allowing stop",
+        )
+        return None
+
+    debug_log(
+        config,
+        "Directive-capture verify: durable rule stated, no create_directive call — blocking once",
+    )
+    return _VERIFY_BLOCK_REASON
+
+
+def main():
+    try:
+        hook_input = json.load(sys.stdin)
+    except (json.JSONDecodeError, EOFError):
+        # No input → nothing to verify. Allow stop.
+        return
+    try:
+        config = load_config()
+    except Exception:
+        return
+    try:
+        reason = evaluate(hook_input, config)
+    except Exception as e:  # never wedge a turn on a verify bug
+        debug_log(config, f"Directive-capture verify error (allowing stop): {e}")
+        return
+    if reason:
+        # Claude Code Stop-hook block contract: emit decision=block + reason;
+        # the model continues the turn with `reason` as feedback.
+        print(json.dumps({"decision": "block", "reason": reason}))
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as e:  # absolute backstop — Stop must never hard-fail
+        print(f"[Hindsight] Unexpected error in directive_verify: {e}", file=sys.stderr)
+        try:
+            sys.exit(2 if load_config().get("debug") else 0)
+        except Exception:
+            sys.exit(0)