[okisdev]

summary

• codex and grok job records from older companions migrate to the current schema on first read (rewritten under the record lock) instead of being rejected. on a second host running 0.0.65, 260 of 438 codex and 12 of 64 grok records were unreadable to record-acceptance, /codex:result, history, and retention
• engine settlement no longer depends on the package workspace: the companion runs from its own directory, so a queued verdict for a removed worktree still lands (all 43 "upgrade the plugin" errors), a spawn failure reports itself, and the queued and --record paths share one salvage rule (29 "pass --accept-failed-transport" failures). companion selection prefers fusion's own version, then semver, instead of newest mtime
• lifecycle: a SendMessage continuation of a peer wrapper gets a fresh budget baseline (33 of 40 continued codex wrappers were stopped as over budget right after continuing); grok independence and live-web get their own high effort instead of burst's low; role fields after ·, ,, or ; are recognized so cursor briefs get their model
• host wide peer capacity: a peer wrapper launch is denied while all sessions together already run one peer per 3 GiB of memory (at least two). the 16 GB host panicked from memory exhaustion with up to 19 peer jobs in flight
• the inline guard credits verification through the shared evidence rules and treats && chains and pipefail pipelines as exit observable (it credited 30 of 1,136 passing commands); generic fork, general-purpose, and claude Agents get an untracked work advisory
• codex upstream connectivity failures classify as network; grok records the message inside a multi line Internal error: {; /fusion:stats reports parent context at dispatch, and its advisory default drops from 600k to 250k tokens; jev drops its mixed concern check (all 96 advisories, no acceptance difference: 89.2% flagged against 90.5% unflagged)
• rules: grok's strict sandbox is described as not a flag (5 of 23 grok dispatches failed on --sandbox), settlement chains behind verification in one call, ci waits use one background command, host constraints ride in peer briefs, cursor reads stay inside its workspace, and the stale lifecycle defaults sentence is corrected
• release 0.0.67: plugin and marketplace versions bumped together, changelog entry, rules-manifest.json regenerated

test plan

already verified

• npm test -> 1655 tests, 1652 pass, 0 fail, 3 skipped
• claude plugin validate on plugins/codex, plugins/grok, plugins/cursor, plugins/fusion, and . -> all passed
• migration replay over copies of both hosts' real codex and grok job states -> 0 unreadable record shapes on the first and second read pass (before: 5 codex and 4 grok shapes on one host, 2 and 15 on the other)
• new suites: tests/record-migration.test.mjs, tests/engine-acceptance.test.mjs, tests/lifecycle-defaults.test.mjs, tests/host-capacity.test.mjs, plus a hook level capacity denial case in tests/fusion-worker-lifecycle.test.mjs

reviewer should verify

• after the marketplace update, /fusion:stats --record <id>=accepted for a job whose worktree was already removed records on the engine ledger instead of asking for a plugin upgrade
• on a 16 GB host, a sixth concurrent peer wrapper launch across two sessions is denied with the host capacity message

notes

• rules edits, per CONTRIBUTING's checklist: the grok sentence "Consult, write, and review all use --sandbox strict" is reworded, not softened (strict stays mandatory, only its reading as a companion flag goes); every other change adds a sentence or corrects a stale number, and no load bearing invariant is touched
• the jev bench drops its two mixed concern briefs along with the check