zelari-code 2.46.1 → 2.48.0

package/dist/cli/tools/taskTool.js

@@ -26,11 +26,12 @@ import { createKrakenWorktree, cleanupKrakenWorktree, formatWorktreeFooter, isKr
 import { krakenTentacleStart, krakenTentacleEnd } from './krakenLive.js';
 import { resolveWorktreeMode } from '../kraken/worktreeScheduling.js';
 import { randomUUID } from 'node:crypto';
-import { candidateInstructions, isKrakenSelectionEnabled, krakenRequiredChecks, parseCandidateReport, registerCandidate, reserveCandidateSlot, setKrakenCheckResults, } from '../kraken/candidateRegistry.js';
+import { candidateInstructions, isKrakenSelectionEnabled, krakenRequiredChecks, parseCandidateReport, registerCandidate, reserveCandidateSlot, setKrakenCheckResults, setLastVerifyToolTrace, getLastVerifyToolTrace, } from '../kraken/candidateRegistry.js';
 import { allUnknownCheckResults, parseVerifyReport } from '../kraken/verifyReport.js';
 import { recordCandidateTokens } from '../kraken/metrics.js';
 import { parseVerifyVerdict } from '@zelari/core';
 import { startTentacleHeartbeat } from './tentacleHeartbeat.js';
+import { emitVerifyDebtCleared, emitVerifyDebtOpen, enqueueVerifyDebtPersist, loadSessionEventsForVerifyDebt, replayOpenVerifyDebts, } from './verifyDebtSpine.js';
 /**
  * Wall-clock bound for the `task` tool wrapper (parent AgentHarness invoke).
  * Must cover a `general` writer on a slow reasoning model (thinking:max,
@@ -95,24 +96,196 @@ const VERIFY_PROMPT = [
     'Use status=unknown when you could NOT determine the outcome (degraded',
     'tool, timeout, inconclusive evidence) — never guess pass.',
 ].join('\n');
-/** Reset spawn counter (call at start of each parent user turn). */
-export function resetTaskSpawnCount() {
+/** Sentinel taskId used by the legacy single-slot seam (tests). */
+const SEED_TASK_ID = '__seed__';
+/**
+ * K3.3 / F16: bucket key for callers with NO session id (the unit-test seam
+ * and pre-session turn boundaries). It IS the legacy `globalThis` slot, so an
+ * id-less caller keeps exactly the process-wide behaviour it had before.
+ */
+const LEGACY_SESSION_KEY = 'default';
+/** K3.3 / F16: did the caller hand us a real session id? */
+function isSessionScoped(sessionId) {
+    return typeof sessionId === 'string' && sessionId.trim().length > 0;
+}
+/** K3.3 / F16: bucket key of a session id (the legacy slot when id-less). */
+function sessionKey(sessionId) {
+    return isSessionScoped(sessionId) ? sessionId : LEGACY_SESSION_KEY;
+}
+/** K3.3 / F16: spawn counters of every non-legacy session. */
+function spawnCountMap() {
+    const g = globalThis;
+    if (!g.__zelariTaskSpawnCountBySession)
+        g.__zelariTaskSpawnCountBySession = new Map();
+    return g.__zelariTaskSpawnCountBySession;
+}
+/**
+ * K3.3 / F16: charge one task spawn to `sessionId` and return THAT session's
+ * new count. Counting per session (same numeric cap as before) is what stops a
+ * concurrent session in the same process from eating another one's budget.
+ */
+function bumpTaskSpawnCount(sessionId) {
+    const g = globalThis;
+    const key = sessionKey(sessionId);
+    if (key === LEGACY_SESSION_KEY) {
+        g.__zelariTaskSpawnCount = (g.__zelariTaskSpawnCount ?? 0) + 1;
+        return g.__zelariTaskSpawnCount;
+    }
+    const next = (spawnCountMap().get(key) ?? 0) + 1;
+    spawnCountMap().set(key, next);
+    return next;
+}
+/**
+ * K3.3 / F16: verify-debt bucket of ONE session — the legacy `globalThis` slot
+ * for an id-less caller, `__zelariGeneralVerifyDebtBySession` otherwise.
+ */
+function debtStore(sessionId) {
+    const g = globalThis;
+    const key = sessionKey(sessionId);
+    if (key === LEGACY_SESSION_KEY) {
+        if (!g.__zelariGeneralVerifyDebt)
+            g.__zelariGeneralVerifyDebt = new Map();
+        return g.__zelariGeneralVerifyDebt;
+    }
+    if (!g.__zelariGeneralVerifyDebtBySession)
+        g.__zelariGeneralVerifyDebtBySession = new Map();
+    let bucket = g.__zelariGeneralVerifyDebtBySession.get(key);
+    if (!bucket) {
+        bucket = new Map();
+        g.__zelariGeneralVerifyDebtBySession.set(key, bucket);
+    }
+    return bucket;
+}
+/** K3.3 / F16: every non-legacy session bucket (aggregate gate reads). */
+function sessionDebtStores() {
+    const g = globalThis;
+    const bySession = g.__zelariGeneralVerifyDebtBySession;
+    return bySession ? [...bySession.values()] : [];
+}
+/**
+ * K3.3 / F16: the buckets a read must consult — ONE session when `sessionId`
+ * is given, EVERY session (legacy bucket first) when it is omitted. The
+ * id-less read is the strict-done gate's view (`runOneTurn.ts` and
+ * `useChatTurn.ts` call it with no argument) and stays FAIL-CLOSED: debt open
+ * in ANY session blocks the turn.
+ */
+function debtScopes(sessionId) {
+    return isSessionScoped(sessionId) ? [debtStore(sessionId)] : [debtStore(), ...sessionDebtStores()];
+}
+/**
+ * Reset the spawn counter (call at start of each parent user turn).
+ *
+ * K3.3 / F16: `sessionId` resets ONLY that session's budget and never touches
+ * a concurrent session; omitting it keeps the legacy process-wide reset used
+ * by the unit-test seam and the headless per-turn boundary.
+ */
+export function resetTaskSpawnCount(sessionId) {
     const g = globalThis;
-    g.__zelariTaskSpawnCount = 0;
+    if (!isSessionScoped(sessionId)) {
+        g.__zelariTaskSpawnCount = 0;
+        g.__zelariTaskSpawnCountBySession?.clear();
+        return;
+    }
+    if (sessionKey(sessionId) === LEGACY_SESSION_KEY) {
+        g.__zelariTaskSpawnCount = 0;
+        return;
+    }
+    g.__zelariTaskSpawnCountBySession?.delete(sessionId);
 }
-/** Reset the general⇒verify obligation (call at start of each parent user turn). */
-export function resetTaskVerifyObligation() {
+/**
+ * Reset the general⇒verify obligation (call at start of each parent user turn).
+ *
+ * K3.3 / F16: `sessionId` drops ONLY that session's debt and never a
+ * concurrent session's; omitting it keeps the legacy process-wide reset used
+ * by the unit-test seam and the headless per-turn boundary.
+ */
+export function resetTaskVerifyObligation(sessionId) {
     const g = globalThis;
-    g.__zelariGeneralVerifyDebt = null;
+    if (!isSessionScoped(sessionId)) {
+        g.__zelariGeneralVerifyDebt = new Map();
+        g.__zelariGeneralVerifyDebtBySession?.clear();
+        return;
+    }
+    if (sessionKey(sessionId) === LEGACY_SESSION_KEY) {
+        g.__zelariGeneralVerifyDebt = new Map();
+        return;
+    }
+    g.__zelariGeneralVerifyDebtBySession?.delete(sessionId);
 }
 /**
  * Open verify obligation, or null when every general this turn has been
  * verified PASS by the runtime auto-spawn (t78). Consulted by the headless
  * strict-done gate — an open obligation closes the turn blocked (exit 4).
+ *
+ * K1.1: returns the first open record (any one is enough to block). The map
+ * may carry MORE records than this returns; use `listTaskVerifyObligations()`
+ * or `hasOpenTaskVerifyDebt()` to see the full state.
+ *
+ * K3.3 / F16: scoped to ONE session when `sessionId` is given; an id-less read
+ * aggregates every session (fail-closed), so no session's debt is invisible.
  */
-export function taskVerifyObligation() {
-    const g = globalThis;
-    return g.__zelariGeneralVerifyDebt ?? null;
+export function taskVerifyObligation(sessionId) {
+    for (const store of debtScopes(sessionId)) {
+        if (store.size === 0)
+            continue;
+        // Map iteration is insertion-ordered; the newest insert wins (matches the
+        // pre-K1.1 "newest wins" semantics for the single open record).
+        const last = store.keys().next().value;
+        if (last)
+            return store.get(last) ?? null;
+    }
+    return null;
+}
+/**
+ * K1.1: number of open verify obligations (strict-gate invariant: > 0 ⇒
+ * blocked). Useful for diagnostics and tests; the strict gate itself keeps
+ * using the boolean `taskVerifyObligation() != null` check.
+ * K3.3 / F16: `sessionId` scopes the listing (id-less = every session).
+ */
+export function listTaskVerifyObligations(sessionId) {
+    return debtScopes(sessionId).flatMap((store) => [...store.values()]);
+}
+/**
+ * K1.1: did any general leave a runtime verify obligation open? Strict-gate
+ * friendly boolean — `true` ⇒ the strict-done gate must block the turn.
+ * K3.3 / F16: `sessionId` scopes the check (id-less = every session).
+ */
+export function hasOpenTaskVerifyDebt(sessionId) {
+    return debtScopes(sessionId).some((store) => store.size > 0);
+}
+/**
+ * K1.1: register (or replace) the verify obligation for one specific task.
+ * Used by `runAutoVerifyAfterGeneral` to record the debt of EACH general it
+ * services — multiple tasks can be open at the same time.
+ *
+ * K3.3 / F16: `sessionId` writes the debt into THAT session's bucket (id-less
+ * callers keep the legacy bucket), so a companion-serve session never opens
+ * debt in another session's view.
+ */
+export function addTaskVerifyObligation(taskId, debt, sessionId) {
+    debtStore(sessionId).set(taskId, debt);
+    enqueueVerifyDebtPersist(() => emitVerifyDebtOpen(undefined, {
+        taskId,
+        description: debt.description,
+        detail: debt.detail,
+        timestamp: Date.now(),
+    }));
+}
+/**
+ * K1.1: clear the verify obligation for ONE task. Used on a PASS of THAT
+ * task's verify tentacle — clearing is per-task, so a sibling general's
+ * debt stays open.
+ *
+ * K3.3 / F16: clear inside ONE bucket — the session that opened the debt
+ * (id-less callers keep the legacy bucket); a concurrent session's debt with
+ * the same taskId is never touched.
+ */
+export function clearTaskVerifyObligation(taskId, sessionId) {
+    const store = debtStore(sessionId);
+    if (!store.has(taskId))
+        return;
+    store.delete(taskId);
+    enqueueVerifyDebtPersist(() => emitVerifyDebtCleared(undefined, { taskId }));
 }
 /**
  * F3.3 (verify trust chain): memory only on PASS. `true` when no general⇒verify
@@ -124,17 +297,52 @@ export function taskVerifyObligation() {
  * and both `promoteOpsKnowledgeSafe` sites on this.
  */
 export function outcomeMemoryAllowed() {
-    return taskVerifyObligation() === null;
+    return !hasOpenTaskVerifyDebt();
 }
 /**
  * Test seam: seed an open general⇒verify obligation without running a tentacle.
  * Production code must never call this — the auto-verify chain owns the slot.
+ *
+ * K1.1: the optional `taskId` argument disambiguates which slot to seed; when
+ * omitted, the legacy sentinel key `'__seed__'` is used so the existing
+ * strict-exit test (`runOneTurn.strictExit.test.ts`) keeps working unchanged.
+ * K3.3 / F16: the optional `sessionId` seeds that session's bucket (omitted ⇒
+ * the legacy bucket, which the id-less strict gate still sees).
  */
-export function seedTaskVerifyObligation(debt) {
-    const g = globalThis;
-    g.__zelariGeneralVerifyDebt = debt;
+export function seedTaskVerifyObligation(debt, taskId = SEED_TASK_ID, sessionId) {
+    const store = debtStore(sessionId);
+    if (debt === null) {
+        store.delete(taskId);
+        return;
+    }
+    store.set(taskId, debt);
 }
-/** Max concurrent/serial task spawns per parent turn (env override). */
+/**
+ * K1.5 / F5: merge un-cleared `verify.debt_open` events into the process
+ * cache WITHOUT emitting (replay must not re-append). Existing slots
+ * (including the test seed) are overwritten for matching taskIds and
+ * otherwise left alone — callers that want a blank cache reset first.
+ *
+ * K3.3 / F16: hydrate the bucket of the session the log belongs to
+ * (`sessionId`), never the process-wide/other-session view.
+ */
+export function hydrateTaskVerifyDebtFromEvents(events, sessionId) {
+    const open = replayOpenVerifyDebts(events);
+    const store = debtStore(sessionId);
+    for (const [taskId, debt] of open) {
+        store.set(taskId, debt);
+    }
+    return open.size;
+}
+/**
+ * K1.5: hydrate the cache from `<sessionsDir>/<sessionId>/events.jsonl`.
+ * K3.3 / F16: the replay lands in the bucket of the session that owns the log.
+ */
+export async function hydrateTaskVerifyDebtFromSpine(source) {
+    const events = await loadSessionEventsForVerifyDebt(source);
+    return hydrateTaskVerifyDebtFromEvents(events, source.sessionId);
+}
+/** Max concurrent/serial task spawns per parent turn, PER SESSION (env override). */
 export function maxTaskSpawnsPerTurn() {
     const raw = process.env.ZELARI_KRAKEN_MAX_TASK_SPAWNS;
     if (raw === undefined || raw === '')
@@ -256,10 +464,14 @@ async function rememberVerifiedGeneralOutcome(opts) {
  * the task result (or null when nothing ran — e.g. explore/verify agents).
  */
 export async function runAutoVerifyAfterGeneral(opts) {
-    const g = globalThis;
     // Debt exists from the moment the general finished — even a mid-chain
     // failure must not leave the work silently "verified".
-    g.__zelariGeneralVerifyDebt = { description: opts.original.description };
+    //
+    // K1.1: key the slot by this general's `agentId` (always populated by
+    // TentacleSuccess) so a sibling general's PASS cannot clear our debt.
+    const debtKey = opts.general.agentId ?? opts.original.description;
+    // K3.3 / F16: the debt is opened in THIS session's bucket (opts.sessionId).
+    addTaskVerifyObligation(debtKey, { description: opts.original.description }, opts.sessionId);
     // t94: live phase captions on the general's activity row (agent_status)
     // mirrored into the radio 'progress' trail — the parent sees the general
     // flip to "verifying…" and then to the verdict without polling.
@@ -309,8 +521,20 @@ export async function runAutoVerifyAfterGeneral(opts) {
         sessionId: opts.sessionId,
         ...(opts.signal ? { signal: opts.signal } : {}),
     });
+    // K1.3 (rev): every inner-verify return MUST publish its tool trace to
+    // the per-turn channel `__zelariVerifyToolTrace` BEFORE we read it back
+    // at the floor check, because the inner verify is a direct `runTentacle`
+    // call that does NOT go through `createTaskTool.execute` (which is the
+    // only other publisher of that channel). Without this publish, (1) an
+    // honest PASS with tool captures still fails the floor (positive path
+    // broken), and (2) a stale trace from an earlier OUTER verify could be
+    // seen here (stale-trace leakage). The helper centralizes the rule.
+    const publishInnerVerifyTrace = (result) => {
+        setLastVerifyToolTrace(result.ok ? result.toolTrace ?? [] : []);
+    };
     emitVerifyPhase('verifying…');
     let verify = await runVerify(`verify: ${opts.original.description}`);
+    publishInnerVerifyTrace(verify);
     // Parsed like the graph executor: last VERDICT trailer wins; a failed run is
     // an unknown (degraded observation is never proof).
     let verdict = verify.ok ? parseVerifyVerdict(verify.result).verdict : 'unknown';
@@ -342,7 +566,10 @@ export async function runAutoVerifyAfterGeneral(opts) {
             });
             if (!rework.ok) {
                 const detail = `rework round ${round} failed: ${rework.error}`;
-                g.__zelariGeneralVerifyDebt = { description: opts.original.description, detail };
+                addTaskVerifyObligation(debtKey, {
+                    description: opts.original.description,
+                    detail,
+                }, opts.sessionId);
                 appendKrakenRadio(opts.parentCwd, opts.sessionId, {
                     kind: 'error',
                     agent: 'general',
@@ -355,12 +582,36 @@ export async function runAutoVerifyAfterGeneral(opts) {
                     `(${rework.error}). Work stays UNVERIFIED; strict done will close this turn blocked.`);
             }
             verify = await runVerify(`verify: ${opts.original.description} (rework ${round})`);
+            publishInnerVerifyTrace(verify);
             verdict = verify.ok ? parseVerifyVerdict(verify.result).verdict : 'unknown';
             findings = verify.ok ? parseVerifyVerdict(verify.result).findings : '';
         }
     }
     if (verdict === 'pass') {
-        g.__zelariGeneralVerifyDebt = null;
+        // K1.3: the verify trailer may say PASS but the verify must also have
+        // executed ≥ 1 tool (real bash / read / etc.) before the debt is cleared.
+        // A bare-text PASS — "I read the diff and it's fine" with no tool
+        // captures — is narrative-only and cannot clear the obligation.
+        const trace = getLastVerifyToolTrace();
+        const instrumental = Array.isArray(trace) && trace.length > 0;
+        if (!instrumental) {
+            const detail = 'verify produced VERDICT: PASS but executed no tool — narrative-only PASS does not satisfy the auto-verify floor';
+            addTaskVerifyObligation(debtKey, {
+                description: opts.original.description,
+                detail,
+            }, opts.sessionId);
+            emitVerifyPhase('verify PASS without tool evidence', false, 'failed');
+            appendKrakenRadio(opts.parentCwd, opts.sessionId, {
+                kind: 'error',
+                agent: 'verify',
+                description: `verify: ${opts.original.description}`,
+                detail,
+                ok: false,
+            });
+            return (`\n\n[kraken:auto-verify] ${detail}. Work stays UNVERIFIED; ` +
+                `strict done will close this turn blocked.`);
+        }
+        clearTaskVerifyObligation(debtKey, opts.sessionId);
         await rememberVerifiedGeneralOutcome(opts);
         emitVerifyPhase('verify PASS', true, 'completed');
         return `\n\n[kraken:auto-verify] verify PASS — general⇒verify obligation satisfied.`;
@@ -372,7 +623,10 @@ export async function runAutoVerifyAfterGeneral(opts) {
         : verify.ok
             ? 'verify produced no parseable VERDICT — unverified'
             : `verify tentacle failed: ${verify.error}`;
-    g.__zelariGeneralVerifyDebt = { description: opts.original.description, detail };
+    addTaskVerifyObligation(debtKey, {
+        description: opts.original.description,
+        detail,
+    }, opts.sessionId);
     appendKrakenRadio(opts.parentCwd, opts.sessionId, {
         kind: 'error',
         agent: 'verify',
@@ -647,18 +901,42 @@ export async function runTentacle(opts) {
     // never share the parent tree, and merges stay sequential.
     let worktree = null;
     let effectiveCwd = opts.cwdOverride || parentCwd;
+    const worktreeMode = resolveWorktreeMode(process.env.ZELARI_KRAKEN_WORKTREE);
     const wantWt = agent === 'general' &&
         deps.allowWorktree !== false &&
-        (isKrakenWorktreeEnabled() ||
-            resolveWorktreeMode(process.env.ZELARI_KRAKEN_WORKTREE) === 'auto');
+        (isKrakenWorktreeEnabled() || worktreeMode === 'auto');
     if (wantWt) {
         try {
             worktree = await createKrakenWorktree(parentCwd, args.description);
             if (worktree)
                 effectiveCwd = worktree.path;
         }
-        catch {
+        catch (err) {
+            // F12 (K2.4): creation failed → fail OPEN (the tentacle still runs) but
+            // make the degradation LOUD. Under ZELARI_KRAKEN_WORKTREE=auto the graph
+            // scheduler admits overlapping writers in parallel ONLY because it
+            // assumes worktree isolation; falling back silently would run them
+            // unisolated in the shared parent tree with no trace. The radio event
+            // plus the deps callback let the executor stop rescuing overlapping
+            // writers (serial admission) for the rest of the run.
+            const reason = err instanceof Error ? err.message : String(err);
             worktree = null;
+            appendKrakenRadio(parentCwd, sessionId, {
+                kind: 'worktree.fallback_shared_tree',
+                agent,
+                thoroughness,
+                description: args.description,
+                detail: `worktree creation failed — running in the shared parent tree: ${reason}`,
+                mode: worktreeMode,
+                reason,
+                ...(opts.nodeId !== undefined ? { nodeId: opts.nodeId } : {}),
+                ok: false,
+            });
+            deps.onWorktreeFallback?.({
+                reason,
+                mode: worktreeMode,
+                ...(opts.nodeId !== undefined ? { nodeId: opts.nodeId } : {}),
+            });
         }
     }
     appendKrakenRadio(parentCwd, sessionId, {
@@ -971,7 +1249,7 @@ export async function runTentacle(opts) {
         if (!kept && isKrakenWorktreeAutoMergeEnabled()) {
             emitPhase('merging…');
             try {
-                merge = await mergeKrakenWorktree(worktree, { message: `kraken: merge ${args.description.slice(0, 80)}` });
+                merge = await mergeKrakenWorktree(worktree, { message: `kraken: merge ${args.description.slice(0, 80)}`, sessionId });
             }
             catch (err) {
                 merge = {
@@ -1034,7 +1312,13 @@ export async function runTentacle(opts) {
     let memoryId;
     if (deps.memoryService && deps.memoryAutoWrite !== false) {
         try {
-            const verifyPass = agent === 'verify' && /(?:VERDICT:\s*PASS|status:\s*pass)/i.test(result);
+            // F4 (K1.4): memory only when the CANONICAL trailer parser says PASS.
+            // The previous free regex /(?:VERDICT:\s*PASS|status:\s*pass)/i matched
+            // any "status: pass" string inside the body (tables, quotes, prose) and
+            // could turn an actual trailer `VERDICT: FAIL` into a memory PASS.
+            // `parseVerifyVerdict` is the last-trailer-wins parser used everywhere
+            // else in the engine — reuse it so memory writes share the same gate.
+            const verifyPass = agent === 'verify' && parseVerifyVerdict(result).verdict === 'pass';
             // F3.3 (verify trust chain): memory only on PASS.
             //   - verify/verification: written only when its OWN verdict parsed PASS;
             //   - general/outcome: NEVER here — a general result is durable only once
@@ -1149,13 +1433,14 @@ export function createTaskTool(deps, policy = {}) {
                 candidateSlot = slot.index;
             }
             const thoroughness = args.thoroughness ?? 'medium';
-            const sessionId = ctx.sessionId || 'default';
+            const sessionId = ctx.sessionId || LEGACY_SESSION_KEY;
             const parentCwd = ctx.cwd || process.cwd();
-            // Per-process spawn cap (Kraken K3). Reset via resetTaskSpawnCount() each parent turn.
-            const g = globalThis;
-            g.__zelariTaskSpawnCount = (g.__zelariTaskSpawnCount ?? 0) + 1;
+            // Per-SESSION spawn cap (Kraken K3 + K3.3 / F16): the numeric limit is
+            // unchanged, but it is counted per sessionId — a concurrent session in
+            // the same process (companion serve) cannot exhaust this session's
+            // budget. Reset via resetTaskSpawnCount(sessionId) each parent turn.
             const spawnCap = maxTaskSpawnsPerTurn();
-            if (g.__zelariTaskSpawnCount > spawnCap) {
+            if (bumpTaskSpawnCount(sessionId) > spawnCap) {
                 return typedErr(`task: spawn cap reached (${spawnCap}). Finish the current slice or raise ZELARI_KRAKEN_MAX_TASK_SPAWNS.`);
             }
             const res = await runTentacle({
@@ -1224,11 +1509,18 @@ export function createTaskTool(deps, policy = {}) {
             // never proof. Only runs when a selection exists this turn (required
             // checks come from a `selected` verdict — Fase 6 routing).
             if (agent === 'verify') {
+                // K1.3: ALWAYS anchor the latest verify tentacle's tool trace on the
+                // per-turn channel so the auto-verify floor (≥ 1 tool execution per
+                // PASS) is observable even when no selection ran this turn (no
+                // required-checks path). The strict gate for PASS is
+                // `getLastVerifyToolTrace().length > 0`.
+                const verifyTrace = res.ok ? res.toolTrace ?? [] : [];
+                setLastVerifyToolTrace(verifyTrace);
                 const required = krakenRequiredChecks();
                 if (required.length > 0) {
                     setKrakenCheckResults(res.ok
                         ? parseVerifyReport(res.result, required)
-                        : allUnknownCheckResults(required, `verify tentacle failed: ${res.error}`), res.ok ? res.toolTrace : undefined);
+                        : allUnknownCheckResults(required, `verify tentacle failed: ${res.error}`), verifyTrace);
                 }
             }
             if (!res.ok)
@@ -1256,11 +1548,13 @@ export function createTaskTool(deps, policy = {}) {
                 }
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
-                    const gv = globalThis;
-                    gv.__zelariGeneralVerifyDebt = {
+                    // K1.1: key the debt by the runtime agentId (when present) so it
+                    // matches the key opened by runAutoVerifyAfterGeneral; fall back
+                    // to the description so an early throw still lands in the same slot.
+                    addTaskVerifyObligation(res.agentId ?? args.description, {
                         description: args.description,
                         detail: `auto-verify chain failed: ${msg}`,
-                    };
+                    }, sessionId);
                     result += `\n\n[kraken:auto-verify] auto-verify chain failed (${msg}) — work stays UNVERIFIED.`;
                 }
             }