unverified-tag-ledger: gate the next-prompt reminder, default to stale only

[EdbertChan]

Summary

The reminder about open claims repeats every single turn, forever.

In one session it appeared eight times for one claim, and seven of those came after the proof had already been shown.

The code already works out which claims are old enough to matter, then ignores that list and prints them all.

This adds a setting with three values: off, stale only, or all. Stale only is the default.

Review Claim

The reminder repeats only for claims past the escalation age, and can be switched off entirely.

Review Lane

behavior

Review Unit

engine-runtime

Safety Invariant

Every value still records claims, so the ledger stays complete and minable. The setting gates display only. An unreadable setting file reports itself rather than silently choosing a value.

Slice Rationale

Changes one function's output and the switch that gates it. Kept apart from the change that lets a claim close, because either alone is useful and each can be reverted without the other.

Non-goals

Does not stop a claim being written into a reply, which would hide unchecked claims instead of reducing repeats. Does not change the Stop-time block.

Test Plan

Test Plan

Run at this commit:

python3 -m unittest discover -s engine/hooks/unverified-tag-ledger/tests
Ran 45 tests in 1.299s
OK

Cases: off prints nothing; unset shows a fresh claim nothing and an aged claim once; all keeps today's behaviour.

Revert Plan

Revert Plan

Revert this commit. The reminder returns to printing every open claim every turn. No stored data changes, so nothing needs migrating.

---

Note

Medium Risk
Touches hook install/wrapping, background judge delivery, and PR preflight gates used before publish; most changes are guarded by tests but mis-routing or a broken notify wrap could affect Codex sessions fleet-wide.

Overview
This PR is much wider than the title suggests: it tightens catstack hooks, routing, PR gates, and reflect/automation guidance in one pass.

Unverified-tag ledger: CATSTACK_UNVERIFIED_TAG_REMINDER now gates injection only (off / stale default / all); ledger recording and Stop blocking stay on. Discharging a claim now emits a reflect trigger for evidence-order misses (claim before check), complementing wrong-check-reflect phrase updates for the same pattern.

Hooks & metrics: Codex notify chains get wrapped by the metrics runner (wrap_installed, check_install_effective, run.py --notify). LLM-judge work emits stage events (judge_skipped / queued / finished) with a new report.py --judge --check leak detector. Codex rollouts resolve from thread-id; inbox reads last turns from the end of huge transcripts; subagent verdicts drain into parent sessions.

Execution routing: route_execution(units=N) routes multiple independent PR stacks to Invoker in parallel or subagent_worktree_per_unit, never serial parent-thread publishing.

PR / reflect / cost tooling: make-pr preflight runs the same Node PR-body schema validator as CI (fixes bodies that passed history-only checks). New fleet session scanners (scan_session_tokens.py, context_growth.py), token_audit marks Bash-only file access as unchecked for read/edit detectors, and reflect adds a User-did-it lens wired to automate-me. Smaller fixes: update_fleet.sh app-replace recovery, ci_logs note dedup, cat-mode ops rules (superseded-branch check, Bash cd anchoring in CLAUDE.learned.md).

^{Reviewed by Cursor Bugbot for commit ba95eda. Bugbot is set up for automated code reviews on this repo. Configure here.}

[EdbertChan]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	wrong-check-reflect: one shot per reply, and scope the reflect scan to the turn	#796
2	reflect: catch an evidence-order correction from the ledger transition, not from wording	#782
3	unverified-tag-ledger: gate the next-prompt reminder, default to stale only	#783	👈
4	diu-stop: a file citation buys silence only when it is backed	#784
5	diu-stop: the marker gate reads prose, so a mention is not a use	#785
6	cat-mode: show the escape-hatch tag in the form the gate accepts	#786
7	principle-subagent-inherits-scope: a brief carries decisions, not just facts and a question	#788
8	llm-judge: claude is the only default runner	#793

[EdbertChan]

Revision history

#	Type	Changes	Reason	Date
1	initial	ee35240		2026-09-22 18:38 UTC
2	rebase	ee35240 → 4d9f2f3 (rebase only)		2026-09-22 18:38 UTC
3	rebase	4d9f2f3 → 1d1cad5 (rebase only)		2026-09-23 14:06 UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4d9f2f3. Configure here.}

[EdbertChan]

Mergify repair stopped: GitHub reports merge conflict. The retry cap was reached for current head 1d1cad5.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b530443d-9b4a-4228-b84f-abd818f77705)

[EdbertChan]

Mergify repair stopped: missing required check lint

[EdbertChan]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-09-24 08:10 UTC · Rule: admin-bypass · triggered by @EdbertChan with the @mergifyio queue command
• ✅ Checks passed · on draft merge queue: checking #783 on main (a859be2), stacked on #826 #918
• ✅ Merged — 2026-09-24 08:53 UTC · at 78678c232a9a4ceb422f55be54681b4d597c8748 · squash

This pull request spent 43 minutes 15 seconds in the queue, including 30 minutes 33 seconds running CI.

Required conditions to merge

• check-success = lint
• check-success = test
• check-success = validate

[EdbertChan]

@Mergifyio queue

[mergify]

queue

☑️ Command queue ignored because it is already running from a previous command.