minima-cli 0.9.0__tar.gz → 0.10.0__tar.gz

{minima_cli-0.9.0 → minima_cli-0.10.0}/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to Minima are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project aims to follow
 [Semantic Versioning](https://semver.org/).
 
+## [0.10.0] - 2026-07-12
+
+### Fixed
+- **Ground-truth spine hardened end-to-end** (still opt-in via `MINIMA_TUI_GROUND_TRUTH=1`):
+  - Gate verdicts now carry the `rec_id` of the turn that minted them, so grounded
+    feedback can never be poisoned by a stale gate from an earlier prompt, and a
+    blocked step's red verdict is superseded by its retry (content-first flip
+    identity). Plans close when their last flip is verified, instead of haunting
+    every later turn.
+  - Step identity survives rewording (token-set matching), a step's baseline resets
+    when its `verify` command changes (no fabricated red→green), and resuming a run
+    re-adopts its active plan.
+  - Bash writes and sub-agent writes are attributed to the run; unattributed
+    ("blind") writes cap confidence at 🟡 instead of silently passing.
+  - Check runner: verify commands run in their own process group and are killed as a
+    group on timeout/abort (no orphaned children), run under a minimal env allowlist,
+    and honor `MINIMA_TUI_CHECK_TIMEOUT`.
+  - `/plan` council: injected findings are fenced as untrusted data, the whole plan
+    turn aborts cleanly on Esc (partial research kept), and each council round is
+    budget-metered ($0.25/round soft cap).
+- **Default path** (no flag required): the SQLite migration runner is race-safe across
+  concurrent sessions and self-heals a previously wedged DB; a bash tool timeout/abort
+  kills the whole process group; a throwing after-hook no longer wedges the agent loop;
+  the `task` tool is blocked in plan mode.
+- Gate-focus modal: keyboard verdict overrides (approve / reject / steer with a note)
+  reach the correct gate, and the TUI footer/overlay no longer overflow on narrow
+  terminals.
+
+### Added
+- With `MINIMA_LLM_JUDGE=1`, judge grading spend is now booked to the session wallet —
+  visible in `/cost` (as `judge overhead`), the footer, and enforced by `--budget` —
+  while staying out of feedback's `actual_cost_usd` so the cost model Minima learns
+  from stays clean.
+
 ## [0.9.0] - 2026-07-10
 
 ### Added

{minima_cli-0.9.0 → minima_cli-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: minima-cli
-Version: 0.9.0
+Version: 0.10.0
 Summary: Minima CLI: cost-aware LLM model routing — recommend cheaper models, backed by Mubit memory.
 Project-URL: Homepage, https://docs.minima.sh
 Project-URL: Documentation, https://docs.minima.sh

{minima_cli-0.9.0 → minima_cli-0.10.0}/docs/ground-truth-build-guide.md

@@ -246,7 +246,7 @@ _By the end of this stage each step carries a check command, and you can run it
 - **Goal (plain):** a helper that runs a command and tells you pass/fail + output.
 - **Why:** the single primitive everything in Stages 4–6 leans on.
 - **Build:**
-  - Mirror the `/undo` git shell-out pattern: spawn the command, capture exit code + stdout/stderr, enforce a timeout (`MINIMA_TIMEOUT`), return `{ pass: boolean, output: string, durationMs }`.
+  - Mirror the `/undo` git shell-out pattern: spawn the command in its own process group with an allowlisted env (`MINIMA_TUI_CHECK_ENV` adds names), capture exit code + stdout/stderr, enforce a timeout (`MINIMA_TUI_CHECK_TIMEOUT`, seconds — independent of the `MINIMA_TIMEOUT` routing timeout), return `{ pass: boolean, output: string, durationMs }`.
 - **See it work:** unit test: `runCheck("true")` → pass; `runCheck("false")` → fail; a sleeping command → times out cleanly.
 - **Done when:** `bun test` covers pass, fail, and timeout.
 

{minima_cli-0.9.0 → minima_cli-0.10.0}/packages/tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "minima-tui",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Minima harness + TUI — the `minima` CLI (TypeScript/Ink; successor to the removed Python harness). Talks to the Python FastAPI recommender service over the /v1/* contract.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

{minima_cli-0.9.0 → minima_cli-0.10.0}/packages/tui/src/agent/loop.ts

@@ -374,16 +374,25 @@ async function runOneTool(
   }
 
   if (config.afterToolCall) {
-    const ar = await config.afterToolCall({
-      toolCall: p.tc,
-      result,
-      isError,
-      context: state,
-    } satisfies AfterToolCallContext);
-    if (ar) {
-      if (ar.terminate) result = { ...result, terminate: true };
-      if (ar.details) result = { ...result, details: { ...(result.details ?? {}), ...ar.details } };
-      if (ar.content) result = { ...result, content: ar.content };
+    // A throwing after-hook must not unwind the batch: with Promise.all a single throw
+    // rejected the whole executeToolCalls pass BEFORE any completion entry ran its
+    // pendingToolCalls.delete, leaking the ids for the rest of the session (hooks are
+    // bookkeeping; enforcement lives in beforeToolCall).
+    try {
+      const ar = await config.afterToolCall({
+        toolCall: p.tc,
+        result,
+        isError,
+        context: state,
+      } satisfies AfterToolCallContext);
+      if (ar) {
+        if (ar.terminate) result = { ...result, terminate: true };
+        if (ar.details)
+          result = { ...result, details: { ...(result.details ?? {}), ...ar.details } };
+        if (ar.content) result = { ...result, content: ar.content };
+      }
+    } catch {
+      // degrade to the raw tool result
     }
   }
 

{minima_cli-0.9.0 → minima_cli-0.10.0}/packages/tui/src/ai/providers/faux.ts

@@ -49,10 +49,20 @@ function estimateUsage(msg: AssistantMessage): void {
   msg.usage.output = Math.max(1, Math.floor(charLen / CHARS_PER_TOKEN));
 }
 
+/** One captured request — lets tests assert on the exact prompt content a model would see. */
+export interface FauxRequest {
+  model: string;
+  systemPrompt: string | null;
+  messageCount: number;
+  /** Concatenated text of the LAST user message — the prompt under test. */
+  user: string;
+}
+
 /** Observable per-registration state. */
 export class FauxProviderState {
   callCount = 0;
   responses: AssistantMessage[] = [];
+  requests: FauxRequest[] = [];
   get pendingResponseCount(): number {
     return this.responses.length;
   }
@@ -115,13 +125,20 @@ class FauxProvider implements Provider {
 
   async *stream(
     model: Model,
-    _context: Context,
+    context: Context,
     opts?: { options?: Record<string, unknown>; signal?: AbortSignal },
   ): AsyncIterable<StreamEvent> {
     // Honor a pre-aborted signal like the real providers, so abort behaviour is
     // exercisable in hermetic tests.
     if (opts?.signal?.aborted) throw new DOMException("Aborted", "AbortError");
     this.state.callCount += 1;
+    const lastUser = [...context.messages].reverse().find((m) => m.role === "user");
+    this.state.requests.push({
+      model: model.id,
+      systemPrompt: context.system_prompt ?? null,
+      messageCount: context.messages.length,
+      user: lastUser?.textContent ?? "",
+    });
     const queued = this.state.responses.shift();
     if (!queued) {
       const err = new AssistantMessage({

{minima_cli-0.9.0 → minima_cli-0.10.0}/packages/tui/src/cli/main.ts

@@ -360,13 +360,18 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<numb
 
   // Judge: abstains by default (honest — no fabricated quality). MINIMA_LLM_JUDGE=1 turns
   // on real LLM grading (staged default-off: it spends money where ConstJudge spent zero).
+  // Judge spend books to the session wallet (meter overhead + budget) but NEVER into
+  // feedback's actual_cost_usd — folding it in would inflate the routed model's observed
+  // $/call and poison the observed/rescaled cost basis. Late-bound: the agent (and its
+  // optional budget) doesn't exist yet at judge construction.
+  let bookJudgeSpend: (usd: number) => void = () => {};
   let judge: ConstJudge | LLMJudge = new ConstJudge(null);
   if (process.env.MINIMA_LLM_JUDGE === "1") {
     const jm = findModelById(config.judgeModel);
     if (jm && providerKeyPresent(jm.provider)) {
-      judge = new LLMJudge(jm);
+      judge = new LLMJudge(jm, { onCostUsd: (usd) => bookJudgeSpend(usd) });
       process.stderr.write(
-        `minima: LLM judge on (${jm.id}) — grading adds a small per-prompt cost\n`,
+        `minima: LLM judge on (${jm.id}) — grading adds a small per-prompt cost (booked to /cost + budget)\n`,
       );
     } else {
       process.stderr.write(
@@ -382,6 +387,13 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<numb
     judge,
     systemPrompt,
   });
+  // agent.budget is attached later (--budget) — read it at call time. Children share this
+  // judge instance (spawn.ts), so their grading books here too, never into their own
+  // meter rows (which the parent reads as the child's routed cost).
+  bookJudgeSpend = (usd) => {
+    agent.meter?.addOverhead(usd);
+    agent.budget?.bookSpend(usd, "judge");
+  };
   // Apply the --thinking CLI flag to the initial reasoning level. It was parsed but never used;
   // the agent kept its default, so the flag was a silent no-op.
   const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];

{minima_cli-0.9.0 → minima_cli-0.10.0}/packages/tui/src/db/minima_db.ts

@@ -34,6 +34,27 @@ export function newId(): string {
   return crypto.randomUUID();
 }
 
+function isBusyError(e: unknown): boolean {
+  const msg = e instanceof Error ? e.message : String(e);
+  return msg.includes("SQLITE_BUSY") || msg.includes("database is locked");
+}
+
+function tokenJaccard(a: string, b: string): number {
+  const tokens = (s: string) =>
+    new Set(
+      s
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter(Boolean),
+    );
+  const ta = tokens(a);
+  const tb = tokens(b);
+  if (ta.size === 0 || tb.size === 0) return 0;
+  let hit = 0;
+  for (const t of ta) if (tb.has(t)) hit += 1;
+  return hit / (ta.size + tb.size - hit);
+}
+
 /** Ordered, idempotent migrations. schema_meta.version = index of the last applied + 1. */
 const MIGRATIONS: string[][] = [
   // v1 — core spine
@@ -200,6 +221,22 @@ const MIGRATIONS: string[][] = [
     "ALTER TABLE routing_decisions ADD COLUMN gt_verified_by TEXT",
     "ALTER TABLE routing_decisions ADD COLUMN gt_confidence TEXT",
   ],
+  // v6 — gate identity: rec_id scopes every gate row to the routed rung that minted it
+  // (NULL = pre-identity/manual, invisible to the feedback join by construction);
+  // session_id/agent_id are reporting/provenance only, never feedback inputs. plans.closed_at
+  // records closure; plan_steps.verify_cwd is a seam for per-check cwd policy (no writer yet);
+  // user_signals.note carries the steer key's free text.
+  [
+    "ALTER TABLE gates ADD COLUMN rec_id TEXT",
+    "ALTER TABLE gates ADD COLUMN session_id TEXT",
+    "ALTER TABLE gates ADD COLUMN agent_id TEXT",
+    "ALTER TABLE file_changes ADD COLUMN agent_id TEXT",
+    "ALTER TABLE plans ADD COLUMN closed_at REAL",
+    "ALTER TABLE plan_steps ADD COLUMN verify_cwd TEXT",
+    "ALTER TABLE user_signals ADD COLUMN note TEXT",
+    "CREATE INDEX IF NOT EXISTS ix_gates_rec ON gates(rec_id)",
+    "CREATE INDEX IF NOT EXISTS ix_gates_session ON gates(session_id, created_at)",
+  ],
 ];
 
 export interface RunRow {
@@ -263,6 +300,7 @@ export interface PlanRow {
   title: string | null;
   status: string | null;
   created_at: string | null;
+  closed_at: number | null;
 }
 
 export interface PlanStepRow {
@@ -274,6 +312,7 @@ export interface PlanStepRow {
   verify: string | null;
   baseline: Baseline | null;
   created_at: string | null;
+  verify_cwd: string | null;
 }
 
 export interface FileChangeRow {
@@ -284,6 +323,7 @@ export interface FileChangeRow {
   kind: string | null;
   origin: string | null;
   created_at: string | null;
+  agent_id: string | null;
 }
 
 export interface GateRow {
@@ -296,6 +336,9 @@ export interface GateRow {
   verified_by: VerifiedBy | null;
   factors_json: string | null;
   created_at: string | null;
+  rec_id: string | null;
+  session_id: string | null;
+  agent_id: string | null;
 }
 
 export interface UserSignalRow {
@@ -303,6 +346,7 @@ export interface UserSignalRow {
   gate_id: string | null;
   action: UserAction | null;
   at: string | null;
+  note: string | null;
 }
 
 /** One todo as handed to the ledger (a subset of the todowrite tool's TodoTask). */
@@ -331,27 +375,76 @@ export class MinimaDb {
     this.path = path;
     if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });
     this.db = new Database(path, { create: true });
-    this.db.exec("PRAGMA journal_mode=WAL");
-    this.db.exec("PRAGMA foreign_keys=ON");
     this.db.exec("PRAGMA busy_timeout=5000");
+    // The delete->WAL header flip needs a brief exclusive lock and does NOT honor the
+    // busy handler, so a concurrent fresh open can see SQLITE_BUSY here.
+    for (let attempt = 0; ; attempt += 1) {
+      try {
+        this.db.exec("PRAGMA journal_mode=WAL");
+        break;
+      } catch (e) {
+        if (attempt < 20 && isBusyError(e)) {
+          Bun.sleepSync(25);
+          continue;
+        }
+        throw e;
+      }
+    }
+    this.db.exec("PRAGMA foreign_keys=ON");
     this.migrate();
   }
 
   private migrate(): void {
     this.db.exec("CREATE TABLE IF NOT EXISTS schema_meta (version INTEGER NOT NULL)");
-    const row = this.db.query("SELECT version FROM schema_meta").get() as {
-      version: number;
-    } | null;
-    let version = row?.version ?? 0;
-    if (!row) this.db.exec("INSERT INTO schema_meta VALUES (0)");
-    while (version < MIGRATIONS.length) {
-      const steps = MIGRATIONS[version]!;
-      const apply = this.db.transaction(() => {
-        for (const ddl of steps) this.db.exec(ddl);
-        this.db.exec("UPDATE schema_meta SET version = ?", [version + 1]);
-      });
-      apply();
-      version += 1;
+    const settled = this.db
+      .query("SELECT COUNT(*) AS n, MAX(version) AS v FROM schema_meta")
+      .get() as {
+      n: number;
+      v: number | null;
+    };
+    if (settled.n === 1 && settled.v !== null && settled.v >= MIGRATIONS.length) return;
+    // One batch per IMMEDIATE transaction: the version re-read happens under the write
+    // lock, so concurrent openers serialize instead of double-applying a batch.
+    const step = this.db.transaction((): boolean => {
+      this.db.exec(
+        `DELETE FROM schema_meta WHERE rowid NOT IN
+           (SELECT rowid FROM schema_meta ORDER BY version DESC, rowid ASC LIMIT 1)`,
+      );
+      this.db.exec(
+        "INSERT INTO schema_meta (version) SELECT 0 WHERE NOT EXISTS (SELECT 1 FROM schema_meta)",
+      );
+      const version = (
+        this.db.query("SELECT version FROM schema_meta").get() as { version: number }
+      ).version;
+      if (version >= MIGRATIONS.length) return false;
+      for (const ddl of MIGRATIONS[version]!) this.execStep(ddl);
+      this.db.exec("UPDATE schema_meta SET version = ?", [version + 1]);
+      return version + 1 < MIGRATIONS.length;
+    });
+    for (;;) {
+      let more: boolean | undefined;
+      for (let attempt = 0; ; attempt += 1) {
+        try {
+          more = step.immediate();
+          break;
+        } catch (e) {
+          if (attempt < 2 && isBusyError(e)) continue;
+          throw e;
+        }
+      }
+      if (!more) break;
+    }
+  }
+
+  // Self-heal for DBs wedged by the pre-fix race: version regressed while a later batch's
+  // columns are already present, so re-applying ADD COLUMN throws forever.
+  private execStep(ddl: string): void {
+    try {
+      this.db.exec(ddl);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      if (/ADD COLUMN/i.test(ddl) && msg.includes("duplicate column name")) return;
+      throw e;
     }
   }
 
@@ -627,7 +720,25 @@ export class MinimaDb {
   }
 
   setPlanStatus(planId: string, status: string): void {
-    this.db.run("UPDATE plans SET status = ? WHERE id = ?", [status, planId]);
+    this.db.run(
+      "UPDATE plans SET status = ?, closed_at = CASE WHEN ? = 'active' THEN NULL ELSE COALESCE(closed_at, ?) END WHERE id = ?",
+      [status, status, Date.now() / 1000, planId],
+    );
+  }
+
+  /**
+   * Re-key the old run's still-active plans onto the resuming run (MOVE semantics — the last
+   * resumer wins on a single-user local DB). Everything plan_id-keyed (steps, file_changes,
+   * gates) follows for free; the old run's session-keyed gate rows are deliberately NOT
+   * adopted — historical verdicts of past prompts must not leak into the resumed run's
+   * feedback. Returns the number of plans moved.
+   */
+  adoptActivePlans(fromSession: string, toSession: string): number {
+    this.db.run("UPDATE plans SET session_id = ? WHERE session_id = ? AND status = 'active'", [
+      toSession,
+      fromSession,
+    ]);
+    return (this.db.query("SELECT changes() AS n").get() as { n: number }).n;
   }
 
   /** M0.3: insert one step. Returns its id. */
@@ -684,13 +795,19 @@ export class MinimaDb {
   }
 
   /**
-   * The content-based step matcher SHARED by upsertPlanFromTodos and completionsForTodos —
-   * one implementation so the done-gate's preview (M4.1) can never match steps differently
-   * than the upsert it previews (if they drifted, the gate would check the wrong step).
-   * Trimmed content, first-come queue on duplicates; each call consumes at most one row, so
-   * callers must invoke it once per incoming todo, in list order, statuses notwithstanding.
+   * The step matcher SHARED by upsertPlanFromTodos and completionsForTodos — one
+   * implementation, computed ONCE per todo list, so the done-gate's preview (M4.1) can never
+   * match steps differently than the upsert it previews. Pass 1 is the historical exact
+   * trimmed-content match (first-come queues on duplicates). Pass 2 rescues reworded steps:
+   * still-unmatched todos adopt a still-unmatched row when their token-set Jaccard is >= 0.6
+   * (ties broken by smallest position distance) — so an accidental rewording keeps the step's
+   * id, sticky verify, and gate history instead of shedding them. Deterministic, zero deps.
    */
-  private stepMatcher(existing: PlanStepRow[]): (content: string) => PlanStepRow | undefined {
+  private matchStepsToTodos(
+    existing: PlanStepRow[],
+    tasks: TodoInput[],
+  ): (PlanStepRow | undefined)[] {
+    const out: (PlanStepRow | undefined)[] = new Array(tasks.length).fill(undefined);
     const byContent = new Map<string, PlanStepRow[]>();
     for (const s of existing) {
       const key = (s.content ?? "").trim();
@@ -698,7 +815,36 @@ export class MinimaDb {
       if (queue) queue.push(s);
       else byContent.set(key, [s]);
     }
-    return (content) => byContent.get(content.trim())?.shift();
+    const taken = new Set<string>();
+    for (let i = 0; i < tasks.length; i++) {
+      const s = byContent.get(tasks[i]!.content.trim())?.shift();
+      if (s) {
+        out[i] = s;
+        taken.add(s.id);
+      }
+    }
+    for (let i = 0; i < tasks.length; i++) {
+      if (out[i]) continue;
+      let best: PlanStepRow | undefined;
+      let bestScore = 0;
+      let bestDist = Number.POSITIVE_INFINITY;
+      for (const s of existing) {
+        if (taken.has(s.id)) continue;
+        const score = tokenJaccard(tasks[i]!.content, s.content ?? "");
+        if (score < 0.6) continue;
+        const dist = Math.abs(s.idx - i);
+        if (score > bestScore || (score === bestScore && dist < bestDist)) {
+          best = s;
+          bestScore = score;
+          bestDist = dist;
+        }
+      }
+      if (best) {
+        out[i] = best;
+        taken.add(best.id);
+      }
+    }
+    return out;
   }
 
   /**
@@ -713,17 +859,21 @@ export class MinimaDb {
    * enforces one todowrite per assistant message (ground_truth.ts same-batch guard).
    */
   completionsForTodos(sessionId: string, tasks: TodoInput[]): CompletionFlip[] {
-    const plan = this.getActivePlan(sessionId);
-    const nextMatch = this.stepMatcher(plan ? this.getPlanSteps(plan.id) : []);
+    const plan = this.planForTodos(sessionId, tasks);
+    const matched = this.matchStepsToTodos(plan ? this.getPlanSteps(plan.id) : [], tasks);
     const flips: CompletionFlip[] = [];
-    for (const t of tasks) {
-      const prev = nextMatch(t.content);
+    for (let i = 0; i < tasks.length; i++) {
+      const t = tasks[i]!;
+      const prev = matched[i];
       if (t.status !== "completed" || prev?.status === "completed") continue;
+      // A verify swap invalidates the old baseline: red→green evidence is only meaningful
+      // against the check that produced the red, so the flip carries NULL instead.
+      const verifyChanged = t.verify != null && prev?.verify != null && t.verify !== prev.verify;
       flips.push({
         content: t.content,
         stepId: prev?.id ?? null,
         verify: t.verify ?? prev?.verify ?? null,
-        baseline: prev?.baseline ?? null,
+        baseline: verifyChanged ? null : (prev?.baseline ?? null),
       });
     }
     return flips;
@@ -745,35 +895,64 @@ export class MinimaDb {
    * once-only). Each entry carries the post-COALESCE effective `verify` (may be null —
    * filtering verify-less steps is the caller's job).
    */
+  /**
+   * The plan a todowrite would apply to — the active plan, else (reopen over resurrect) the
+   * session's latest DONE plan when the incoming contents overlap it, so sticky verify/baseline
+   * survive a reopen-after-completion cycle while a disjoint list starts fresh. SHARED by
+   * completionsForTodos and upsertPlanFromTodos: the done-gate's preview must resolve the same
+   * plan the upsert will, or resends of a completed list would preview as brand-new flips.
+   */
+  private planForTodos(sessionId: string, tasks: TodoInput[]): PlanRow | null {
+    const active = this.getActivePlan(sessionId);
+    if (active) return active;
+    const latest = this.getLatestPlan(sessionId);
+    if (latest && latest.status === "done") {
+      const contents = new Set(this.getPlanSteps(latest.id).map((s) => (s.content ?? "").trim()));
+      if (tasks.some((t) => contents.has(t.content.trim()))) return latest;
+    }
+    return null;
+  }
+
   upsertPlanFromTodos(
     sessionId: string,
     tasks: TodoInput[],
     title?: string | null,
   ): { planId: string; stepIds: string[]; started: { id: string; verify: string | null }[] } {
-    const existingPlan = this.getActivePlan(sessionId);
+    const existingPlan = this.planForTodos(sessionId, tasks);
+    if (existingPlan && existingPlan.status === "done") {
+      this.setPlanStatus(existingPlan.id, "active");
+    }
     const planId =
       existingPlan?.id ??
       this.insertPlan({ sessionId, title: title ?? tasks[0]?.content ?? null, status: "active" });
     const existing = this.getPlanSteps(planId);
-    const nextMatch = this.stepMatcher(existing);
+    const matchedSteps = this.matchStepsToTodos(existing, tasks);
     const stepIds: string[] = [];
     const started: { id: string; verify: string | null }[] = [];
     const tx = this.db.transaction(() => {
       const matched = new Set<string>();
       for (let i = 0; i < tasks.length; i++) {
         const t = tasks[i]!;
-        const prev = nextMatch(t.content);
+        const prev = matchedSteps[i];
         if (prev) {
           matched.add(prev.id);
+          // baseline resets whenever the effective verify CHANGES: red→green evidence must
+          // always be scoped to the check that produced the red (a swapped-in check crediting
+          // the old check's red would fabricate verified_in_production).
           this.db.run(
-            "UPDATE plan_steps SET idx = ?, content = ?, status = ?, verify = COALESCE(?, verify) WHERE id = ?",
-            [i, t.content, t.status, t.verify ?? null, prev.id],
+            "UPDATE plan_steps SET idx = ?, content = ?, status = ?, baseline = CASE WHEN ? IS NOT NULL AND verify IS NOT NULL AND ? <> verify THEN NULL ELSE baseline END, verify = COALESCE(?, verify) WHERE id = ?",
+            [i, t.content, t.status, t.verify ?? null, t.verify ?? null, t.verify ?? null, prev.id],
           );
           stepIds.push(prev.id);
           const entered = t.status === "in_progress" && prev.status !== "in_progress";
           const gainedVerify =
             t.status === "in_progress" && prev.verify === null && t.verify != null;
-          if ((entered || gainedVerify) && prev.baseline === null) {
+          const changedVerify =
+            t.status === "in_progress" &&
+            t.verify != null &&
+            prev.verify !== null &&
+            t.verify !== prev.verify;
+          if (changedVerify || ((entered || gainedVerify) && prev.baseline === null)) {
             started.push({ id: prev.id, verify: t.verify ?? prev.verify ?? null });
           }
         } else {
@@ -807,10 +986,11 @@ export class MinimaDb {
     path: string;
     kind?: string | null;
     origin?: string | null;
+    agentId?: string | null;
   }): string {
     const id = opts.id ?? newId();
     this.db.run(
-      "INSERT INTO file_changes (id, plan_id, step_id, path, kind, origin, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",
+      "INSERT INTO file_changes (id, plan_id, step_id, path, kind, origin, created_at, agent_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
       [
         id,
         opts.planId,
@@ -819,6 +999,7 @@ export class MinimaDb {
         opts.kind ?? null,
         opts.origin ?? null,
         new Date().toISOString(),
+        opts.agentId ?? null,
       ],
     );
     return id;
@@ -848,10 +1029,13 @@ export class MinimaDb {
     confidence?: ConfidenceTier | null;
     verifiedBy?: VerifiedBy | null;
     factors?: unknown;
+    recId?: string | null;
+    sessionId?: string | null;
+    agentId?: string | null;
   }): string {
     const id = opts.id ?? newId();
     this.db.run(
-      "INSERT INTO gates (id, plan_id, step_id, kind, outcome, confidence, verified_by, factors_json, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      "INSERT INTO gates (id, plan_id, step_id, kind, outcome, confidence, verified_by, factors_json, created_at, rec_id, session_id, agent_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
       [
         id,
         opts.planId ?? null,
@@ -862,6 +1046,9 @@ export class MinimaDb {
         opts.verifiedBy ?? null,
         opts.factors === undefined ? null : JSON.stringify(opts.factors),
         new Date().toISOString(),
+        opts.recId ?? null,
+        opts.sessionId ?? null,
+        opts.agentId ?? null,
       ],
     );
     return id;
@@ -873,14 +1060,50 @@ export class MinimaDb {
       .all(planId) as GateRow[];
   }
 
+  /** The run's commands for one tool (lead + children), oldest first — blind-factor input. */
+  getRunToolCommands(runId: string, toolName: string): string[] {
+    const rows = this.db
+      .query("SELECT args FROM tool_calls WHERE run_id = ? AND tool_name = ? ORDER BY ts, rowid")
+      .all(runId, toolName) as { args: string | null }[];
+    const out: string[] = [];
+    for (const r of rows) {
+      if (!r.args) continue;
+      try {
+        const parsed = JSON.parse(r.args) as Record<string, unknown> | null;
+        const cmd = parsed?.command;
+        if (typeof cmd === "string" && cmd.trim()) out.push(cmd);
+      } catch {
+        // unparsable args carry no command
+      }
+    }
+    return out;
+  }
+
+  /** Blocked-attempt rows written before any plan existed — reachable only by session. */
+  getSessionOrphanGates(sessionId: string): GateRow[] {
+    return this.db
+      .query(
+        "SELECT * FROM gates WHERE session_id = ? AND plan_id IS NULL ORDER BY created_at, rowid",
+      )
+      .all(sessionId) as GateRow[];
+  }
+
+  /** Every gate minted under one routed rung (rec_id), oldest first — the feedback join. */
+  getGatesForRec(recId: string): GateRow[] {
+    return this.db
+      .query("SELECT * FROM gates WHERE rec_id = ? ORDER BY created_at, rowid")
+      .all(recId) as GateRow[];
+  }
+
   /** M6.3: record a user override against a gate (accept|reject|steer). */
-  recordUserSignal(gateId: string, action: UserAction): string {
+  recordUserSignal(gateId: string, action: UserAction, note?: string | null): string {
     const id = newId();
-    this.db.run("INSERT INTO user_signals (id, gate_id, action, at) VALUES (?, ?, ?, ?)", [
+    this.db.run("INSERT INTO user_signals (id, gate_id, action, at, note) VALUES (?, ?, ?, ?, ?)", [
       id,
       gateId,
       action,
       new Date().toISOString(),
+      note ?? null,
     ]);
     return id;
   }