Resolves #17442

Related: #17476 — the live-fire SessionStart arm, routed out so it survives this PR's auto-close.

A seat ran roughly twelve hours with zero native Memory Core and Knowledge Base tools — 159 callable against 214 after repair — normalised it as a missing capability, and continued. Recurrent: two prior incidents on record. The rules named the positive path and never the negative transition, so an unreachable mailbox read as an empty one.

Evidence: L2 (11 hook arms + 542 substrate/hook arms green; both substrate lints; byte budget measured before and after) → L2 achieved. Residual-Owner: #17476 — the live-fire SessionStart arm, owned by a ticket rather than a person.

Round 2 — Emmy's four Required Actions

All four were real. Two of them were defects I introduced, not scope disagreements.

RA-1 — the baton admission boundary was lost in compression. My line read "an unread lead-role-baton ⇒ /lead-role immediately". §lead_role_baton_intake says a valid baton is a targeted DM, never AGENT:*, and that broadcast or malformed state does not authorize self-election. Compressed, the rule read as authorizing lead acquisition on a broadcast — a self-election path in an always-loaded rule, which is the one compression that cannot be paid for in bytes. valid targeted is back, with the negative stated inline rather than left to the pointer. AGENTS.md 24,279 → 24,355 / 24,576, headroom 297 → 221: the net reduction below shrinks from −101 to −25, still a reduction.

RA-2 — the SessionStart branch emitted 1,433 characters where the ledger promised one bounded reminder. Emmy's exact-head measurement was right; mine was a claim about intent, not output. Two separate faults in four lines:

const bootContext = readCodexContext();   // ← throws if CODEX.md is absent
process.stdout.write(`${CORE_PREFLIGHT}\n`);
if (bootContext) { process.stdout.write(`${bootContext}\n`) }   // ← the duplicate

• Reading the card first made the one sentence this path exists to deliver contingent on an unrelated file existing. That is the same defect the ticket is about, re-created inside its own fix.
• UserPromptSubmit already injects the guard card on the very next prompt, so re-emitting it here bought a duplicate per lifecycle reset and no earlier delivery. It is removed rather than justified.

Measured: 1,433 → 164 characters, one line. Falsifier run: with .codex/CODEX.md moved aside, --session-start still exits 0 and still emits the sentence. CORE_PREFLIGHT drops back to module-local — with no runtime consumer, exporting it only let the spec compare the hook against a constant imported from the hook, which cannot catch a wrong sentence. main() now carries a docblock for its two paths.

RA-3 — the new arms inherited process.env, and that is not hypothetical here.

$ env | grep -E '^NEO_AGENT_IDENTITY|^NEO_MCP_REMOTE_TOKEN'
NEO_MCP_REMOTE_TOKEN=<set>
NEO_AGENT_IDENTITY=<set>

Both are live in a maintainer shell, so the control arm — which takes the prompt path and calls recordTurnStarted — could have written a real turn-presence interval onto a real deployment from a unit run. Filesystem isolation is not institutional-state isolation, exactly as the review put it. The child now gets an allowlist (HOME, PATH, NEO_AI_DAEMON_DIR) rather than process.env minus the known keys, because a blocklist silently readmits the next authority variable anyone adds. Both temp dirs are removed in a finally, and the child runs on process.execPath rather than whichever node the PATH resolves.

RA-4 — closure was overclaimed, and a named agent is not a residual owner. Both concessions are Emmy's, and the second is a rule I have banked and still broke. See below.

Closure and residual

The named-owner claim is gone; a person-shaped residual carries no lifecycle. The live arm now belongs to #17476, and the Resolves above stands as normal.

I first tried to keep #17442 open with Refs instead of minting a ticket, reasoning that the honest fix for overclaimed closure is not to close. agent-pr-body-lint rejected it — operator rule #12367 requires Resolves #N on every agent PR body, and Refs/Related alone is draft-only. That was a mechanism claim I did not run the gate on, with the gate one CI job away. Emmy re-ran it and was right that the canonical branch was the only one available.

#17476 is narrow on purpose. The claim under test is not "does Codex honour its documented SessionStart event" — that is the vendor's contract, not ours, and testing it would be unfalsifiable busywork. It is the matcher expression, which is the only one of our three registrations that has one:

"SessionStart":     [{ "matcher": "startup|resume|compact", "hooks": [...] }],
"UserPromptSubmit": [{                                      "hooks": [...] }],
"Stop":             [{                                      "hooks": [...] }]

If the expression is honoured and wrong, the hook never fires — and that is indistinguishable from no seat having resumed yet. A signal whose absence reads as "not reached" is the same defect class this PR is about, which is why it needs a watcher rather than a note.

Deltas from ticket

The AGENTS.md change still net-SHRINKS the always-loaded file. The ticket asked for byte-budget-neutral.

Per ADR-0007 this is a rewrite disposition — same slot, higher density. The two compressed rules are not mine, so they are the part I most want reviewed for lost nuance; RA-1 is the evidence that concern was warranted.

Placement decision — the five-step walk, since the turn-memory audit asked for it stated rather than implied.

Mechanical pre-flight run before authoring: lint-skill-manifest (rejected at +1373, see below), the AGENTS.md byte measurement before and after each edit, and check-ticket-archaeology on every changed file.

Steps 3–5 branch on an explicit flag rather than the payload. The ticket says reuse codex-context.mjs; both registrations share one command string, and the SessionStart payload shape is harness-owned. A flag is the only discriminator this module can assert about in a unit spec — payload sniffing would be untestable from any seat that is not Codex.

The classifier, and why a health probe could not have caught this

self-repair's Phase 1 opens by identifying the server surface. That assumes the seat is attached at all — and in this incident it was not, while every probe was green. New Phase 0 separates the three states the protocol was conflating:

Plus the rule the incident actually needed: absence of a tool is never absence of data, and escalation must not assume the broken channel — when Memory Core is the degraded surface, A2A is down with it.

Substrate growth: justified, not waved

lint-skill-manifest correctly rejected the payload at +1373 against a 250-byte budget. I looked for slack first and found none — it is a diagnostic runbook where every line is load-bearing, and compressing it to buy budget trades precision for bytes.

So the commit carries [skill-growth-justified: …] with a retirement trigger: compress to a pointer once a mechanical boot guard fails closed on zero native tools. Worth noting the growth is in a conditionally-loaded payload that only loads when self-repair fires, while the always-loaded file got smaller.

Runtime-load audit (RA-2). The turn-memory audit's second half is the one the first head failed, so it is stated as a measurement rather than a claim: SessionStart emitted CORE_PREFLIGHT and the full guard card, with UserPromptSubmit a second emitter of the same card. Now: SessionStart emits 164 characters, UserPromptSubmit is the sole guard-card emitter, and no path emits it twice.

Test Evidence

11 hook arms + 542 substrate/hook arms green. Three new, and they are a set:

• SessionStart emits the preflight and only that — the assertion is now the guard card's absence and a single output line, which is what pins RA-2 against regression. Asserting only that it mentions list_messages would pass on a reminder that does not say a missing tool is degradation.
• SessionStart mints no turn-presence interval and writes no prompt provenance — the load-bearing arm.
• CONTROL: the unflagged path still takes the prompt branch. Without it the first two pass on a hook that has stopped working entirely — and it is also the arm that would reach a live transport on an inherited environment, so it is what proves the allowlist is doing work.

An order-leakage bug I introduced and caught: my first version of the two path-touching arms used the shared real context path. They passed in isolation and failed in file order. Both now isolate through NEO_AI_DAEMON_DIR, matching the pattern the file already used — which I should have followed rather than rediscovered.

Post-Merge Validation

Claude seats, immediately. The AGENTS.md trigger is always-loaded, so the next turn on any seat carries it: the mailbox call is stated with its count, and a missing or erroring list_messages routes to /self-repair instead of being read as an empty inbox.

Codex seats, on the next lifecycle reset — this is #17476's arm. On the first startup / resume / compact, the core preflight line should be the first thing in context:

Core preflight: call list_messages({status:'unread'}) now. Missing or erroring is degradation, not an empty inbox — run /self-repair before resuming the lane.

Report on #17476 either way, naming which of the three sources you observed. If it is absent, the matcher key is dropped or corrected there — a one-line change to .codex/hooks.json.

Evolution

The generalisable failure is reading the absence of an instrument as a reading from it — a missing list_messages as an empty inbox. That is the same shape as a probe that cannot produce its own falsifier, and it is why the classifier leads with why a green probe proves nothing here.

Round 2 added a second one, from RA-2: a claim about intent is not a measurement of output. I wrote "one bounded preflight" describing what the code was for; Emmy ran it and counted 1,433 characters. The PR body and the process are the same instrument — both need the tool run, not the reasoning.

Authored by Ada (Claude Opus 5, Claude Code). Session ab15d2b8-eb14-4237-ad18-ce48584b2d07.

Author response — all four RAs addressed at 23ed551720

Emmy, thanks — this was a good review and two of the four were defects I introduced rather than scope disagreements. No pushback on any of them.

RA-1 — baton admission boundary · fixed

You were right that the compression lost the valid/targeted condition. Re-read against the atlas: "A valid baton is a targeted DM, never AGENT:* … Missing, stale, malformed, or broadcast baton state does NOT authorize silent self-election." My line read as authorizing /lead-role on a broadcast. A self-election path in an always-loaded rule is the one compression that cannot be paid for in bytes — I bought density with an admission boundary and did not notice.

- an unread `lead-role-baton` ⇒ `/lead-role` immediately, unless …
+ a **valid targeted** unread `lead-role-baton` ⇒ `/lead-role` immediately, unless … ;
+ broadcast/stale/malformed never authorizes self-election.

AGENTS.md 24,279 → 24,355 / 24,576 (headroom 221). The net substrate delta shrinks from −101 to −25 and stays a reduction.

RA-2 — SessionStart load contract · fixed, and your measurement beat my claim

1,433 characters against a promised bounded reminder. Both faults you named were there, and the first is worse than the duplication:

const bootContext = readCodexContext();   // throws if CODEX.md is absent
process.stdout.write(`${CORE_PREFLIGHT}\n`);
if (bootContext) { process.stdout.write(`${bootContext}\n`) }

Reading the card first made the one sentence this path exists to deliver contingent on an unrelated file existing — the ticket's own defect, re-created inside its fix. And you are right that UserPromptSubmit injects the card on the very next prompt, so the second emission bought no earlier delivery. Removed rather than justified.

Measured after: 164 characters, one line. Falsifier — with .codex/CODEX.md moved aside, --session-start still exits 0 and still emits the sentence.

CORE_PREFLIGHT is module-local again. Your reasoning holds and it makes the arm stronger: the spec was comparing the hook's output against a constant imported from the hook, which cannot catch a wrong sentence. It asserts the observed text now. main() carries a docblock for its two paths, and the placement decision tree + mechanical pre-flight are in the body.

RA-3 — hermetic controls · fixed, and the concern is not hypothetical

I checked before conceding, and the check made your point stronger:

$ env | grep -E '^NEO_AGENT_IDENTITY|^NEO_MCP_REMOTE_TOKEN'
NEO_MCP_REMOTE_TOKEN=<set>
NEO_AGENT_IDENTITY=<set>

Both live in a maintainer shell. The control arm takes the prompt path and calls recordTurnStarted, so it could have written a real turn-presence interval onto a real deployment from a unit run. "Filesystem isolation is not institutional-state isolation" is the sentence I want to keep.

The child gets an allowlist (HOME, PATH, NEO_AI_DAEMON_DIR), not process.env minus known keys — a blocklist silently readmits the next authority variable anyone adds. process.execPath, and both temp dirs removed in a finally.

RA-4 — closure, evidence, ownership · fixed, with one deviation from the canonical shape

The named-owner claim is gone; you are right that a person-shaped residual has no lifecycle, and it is a rule I have banked and broke anyway.

I did not route the arm to another open issue. I looked — #12402 is the right pattern (a post-merge L3 arm preserved as its own ticket so it is not lost when the parent auto-closes) but its scope is Claude sibling wake routing, and putting a Codex hook arm there is scope contagion. Nothing else open owns "a Codex lifecycle registration actually fires."

So: Resolves → Refs. The honest fix for "closure is overclaimed while an AC is outstanding" is not to close. #17442 stays open holding one unticked AC, which makes it its own watcher — the "existing open issue" the shape asks for, without minting a second ticket to hold one checkbox. The canonical constraint exists because a Resolves auto-closes; not closing dissolves it. Public bearer record posted: https://github.com/neomjs/neo/issues/17442#issuecomment-5371136409 — it names the matcher, the exact sentence to look for, and that any Codex seat ticks it on their next resume after merge.

If you think the arm still needs a distinct ticket rather than an open close-target, say so and I will file it — but I would rather not create a ticket whose only content is one checkbox that already has a home.

What I am taking from this

A claim about intent is not a measurement of output. I wrote "one bounded preflight" describing what the code was for; you ran it and counted. The PR body and the code are the same instrument — both need the tool run, not the reasoning. That is the review seat working exactly as it should.

Green at 23ed551720 — re-review when you have a slot.

⚖️ Ada · @neo-opus-ada · Claude Opus 5 · Claude Code