Harden task continuity and simplify CLI evidence

.github/workflows/ci.yml

@@ -26,6 +26,11 @@ jobs:
       - run: npm run format:check
       - run: npm run lint
       - run: npm run typecheck
+      - name: Prepare pinned pnpm for the Windows adapter test
+        if: runner.os == 'Windows'
+        env:
+          COREPACK_DEFAULT_TO_LATEST: "0"
+        run: corepack prepare pnpm@10.0.0
       - run: npm test
       - run: npm run build
       - run: npm run test:built

README.md

@@ -54,15 +54,15 @@ documentation current. If no reusable lesson exists, nothing is added. Completed
 expires after the configured retention window and is capped by count. Active and incomplete work is
 preserved.
 
-Because project knowledge is plain Markdown, you can inspect it in GitHub, your editor, or
-optionally Obsidian. Raw prompts, application sessions, credentials, and user data do not become
-project memory.
+Read project knowledge in GitHub, your editor, or Obsidian. It excludes raw prompts, application
+sessions, credentials, and user data.
 
 ## Checks that match the change
 
-During setup, Noxroot finds existing lint, type-check, test, build, and native eval commands. You
-approve which may run. `finish` applies the relevant checks to the changed paths. Wider or sensitive
-changes can require independent review.
+During setup, Noxroot looks for existing lint, type-check, test, build, and native eval commands.
+Legacy or custom commands may need explicit configuration. You approve which may run. `finish`
+applies the relevant checks to the changed paths. Wider or sensitive changes can require independent
+review.
 
 Noxroot shows which files changed, which commands ran, what passed or failed, and anything it could
 not verify. A missing relevant check produces `incomplete`, never `approved`. Inspect the exact plan
@@ -109,32 +109,37 @@ Instruction discovery varies by coding tool, so the commands remain available fo
 
 ### What setup can add
 
-| Surface                           | Actual path or command                                                                                      | Purpose                                                                    |
-| --------------------------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
-| Agent entrypoint and config       | `AGENTS.md`, `.noxroot/config.yml`                                                                          | Connect compatible agents to the project workflow                          |
-| Project-memory index              | `.noxroot/knowledge/INDEX.md`                                                                               | Route agents to relevant existing documentation                            |
-| Task-context routes               | `.noxroot/routes.yml`                                                                                       | Select relevant files, rules, tests, decisions, and skills                 |
-| Verification policy and skill     | `.noxroot/verification.yml`, `.noxroot/skills/verify-change/SKILL.md`                                       | Define approved checks and the procedure for checking a change             |
-| Review skills                     | `.noxroot/skills/independent-review/SKILL.md`, `.noxroot/skills/product-ux-review/SKILL.md` when applicable | Provide fresh review procedures when the change requires them              |
-| Learning procedure after finish   | `finish`, then `learn` through the pinned `npx` command                                                     | Propose a small knowledge update when something reusable was validated     |
-| Local task state created by start | `.git/noxroot/runs/*.json` in a standard checkout                                                           | Store baselines and results without treating them as project documentation |
+| Surface                           | Actual path or command                                                                                      | Purpose                                                                  |
+| --------------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| Agent entrypoint and config       | `AGENTS.md`, `.noxroot/config.yml`                                                                          | Connect compatible agents to the project workflow                        |
+| Project-memory index              | `.noxroot/knowledge/INDEX.md`                                                                               | Route agents to relevant existing documentation                          |
+| Task-context routes               | `.noxroot/routes.yml`                                                                                       | Select relevant files, rules, tests, decisions, and skills               |
+| Verification policy and skill     | `.noxroot/verification.yml`, `.noxroot/skills/verify-change/SKILL.md`                                       | Define approved checks and the procedure for checking a change           |
+| Review skills                     | `.noxroot/skills/independent-review/SKILL.md`, `.noxroot/skills/product-ux-review/SKILL.md` when applicable | Provide fresh review procedures when the change requires them            |
+| Learning procedure after finish   | `finish`, then `learn` through the pinned `npx` command                                                     | Propose a small knowledge update when something reusable was validated   |
+| Local task state created by start | `.noxroot/local/runs/*.json` in a new Git checkout                                                          | Store ignored baselines and results, separate from project documentation |
 
 Only missing capabilities are proposed. Mature repositories may need nothing. Existing documentation
 remains discoverable without being copied.
 
+Existing `.git/noxroot` records stay in place, without a second store. If an agent cannot write task
+state, it must stop and request access before continuing.
+
 `SKILL.md` files are portable, on-demand instructions. The generated verification skill tells an
 agent how to check a change; the independent-review and optional product/UX skills describe their
 reviews. Context loading comes from `AGENTS.md`, the knowledge index, and context routes, not a
 generated context skill. Learning comes from `finish` and `learn`, not a generated learning skill.
 
-Skills do not prove that code works. The actual tests, type checks, builds, evals, and review
-results do. An incomplete result can be handed off locally, but it cannot become approved or qualify
-for a future automatic merge. Noxroot does not push, merge, publish, or deploy.
+Skills are instructions, not test evidence. Incomplete work cannot become approved. Noxroot does not
+push, merge, publish, or deploy.
 
 `context "<task>"` is read-only. It does not start a task or run checks. Selection is advisory, not
 permission to edit. "Do not deploy" remains an exclusion; it never activates deployment work. Use
 `start` to record the task baseline and `finish` to check the resulting change.
 
+Large files get bounded line ranges when relevant text is found. Partial context is labelled; agents
+still inspect the surrounding code. Existing routes stay unchanged.
+
 ## Try the read-only diagnosis
 
 Noxroot is not published to npm yet. From source, use Node.js `>=22.12 <27`:

docs/architecture.md

@@ -35,8 +35,12 @@ evidence.
 
 The orchestrator accepts adapter, verification, and diff interfaces. This permits a deterministic
 fake in tests and keeps worker/reviewer invocations distinct. Delegated Git runs create `noxroot/*`
-branches and worktrees; local evidence is stored under the Git common directory, not
-`.noxroot/knowledge/`.
+branches and worktrees. New Git repositories store local evidence under `.noxroot/local/`, with a
+self-contained ignore rule. Detection excludes this directory even if Git ignores are bypassed. New
+worktrees have separate local state; repository, branch, and baseline checks still apply. Existing
+Git-common-directory state is preserved, including shared worktree records. If both stores exist,
+Noxroot refuses to choose. Non-Git repositories retain their application-state location. No task
+evidence belongs in `.noxroot/knowledge/`.
 
 Guided orchestration is a two-command lifecycle. Start persists repository identity, clean revision,
 bounded context, effective autonomy, and a hash of the approved verification policy. Finish derives

docs/commands.md

@@ -10,14 +10,14 @@ without changing JSON.
 
 Exit codes:
 
-| Code | Meaning                                           |
-| ---- | ------------------------------------------------- |
-| 0    | Requested operation completed                     |
-| 2    | Usage, configuration, or validation error         |
-| 3    | Required confirmation was refused or unavailable  |
-| 4    | Verification failed, timed out, or is incomplete  |
-| 5    | Connected agent or required review did not finish |
-| 130  | Interrupted                                       |
+| Code | Meaning                                                |
+| ---- | ------------------------------------------------------ |
+| 0    | Requested operation completed                          |
+| 2    | Usage, configuration, or validation error              |
+| 3    | Required confirmation or task-state access unavailable |
+| 4    | Verification failed, timed out, or is incomplete       |
+| 5    | Connected agent or required review did not finish      |
+| 130  | Interrupted                                            |
 
 ## `preview`
 
@@ -70,10 +70,38 @@ does not broadly rewrite the repository.
 
 ## `context`
 
-`context "task"` shows the outcome, selected paths, likely source and tests, approved checks, an
-exclusion count, and estimated tokens. `--verbose` adds selection reasons, individual exclusions,
-constraints, conflicts, unknowns, and byte counts. It stores paths and evidence, not copied source
-files.
+`context "task"` shows the outcome, a bounded selection of paths, likely source and tests, approved
+checks with their working directories, an exclusion count, and estimated tokens. Exclusions and
+conflicts remain visible. `--verbose` adds every selected path, selection reasons, individual
+exclusions, unknowns, and byte counts. JSON retains the complete bounded context package.
+
+Large source and test files can be selected as up to three line ranges rather than whole files.
+Human output labels these as partial. JSON adds `lineRanges` (one-based, inclusive) and
+`sourceBytes`; `bytes` counts only the selected ranges. These are reading hints, not embedded code
+or complete functions. Inspect surrounding code and refresh context after edits move the lines.
+Inspection remains capped at 96,000 bytes per file and 1,000,000 bytes across candidates. Missing
+owners, partial files, and inspection limits prevent high confidence.
+
+Fresh setup includes root-level source extensions in its routes. Existing route files are not
+rewritten by `init` or `sync`. If context reports excluded source files, review the includes in
+`.noxroot/routes.yml` before widening scope; updating the CLI alone does not change those
+boundaries.
+
+Routine `start`, continuation, and `finish` output separates the result from supporting evidence.
+The short finish view still shows failures, verification gaps, pending review, and a path to the
+full local record. Passing tests alone never turn a pending review into approval.
+
+### Local task-state access
+
+New Git repositories use `.noxroot/local/runs/`, inside the writable worktree rather than Git's
+metadata. Its managed `.gitignore` contains `*`; never force-add task records to Git. Inspection and
+read-only conversation create no state. Retention rules are unchanged.
+
+Existing `.git/noxroot` state remains authoritative. Noxroot does not move active tasks during an
+upgrade. If this legacy directory is sandbox-protected, approve access only to the reported state
+directory, or run the lifecycle command yourself in a trusted terminal. Do not disable the sandbox
+or create another store. A blocked start means stop before editing; a blocked finish means the task
+is not complete. Sync updates the managed instructions with these rules after you review its diff.
 
 ## `status`
 
@@ -82,6 +110,9 @@ working-tree state, active Noxroot tasks, changed paths since each baseline, whe
 matches the current diff, and the next applicable action. It does not invoke an agent or restore a
 chat session.
 
+Before resuming edits, repeat `start` with the active task's text. `status` does not check whether
+task state is writable and is not a substitute for `start`.
+
 ## `verify`
 
 `verify --plan` displays the confirmed policy without running it. `verify --changed` reads Git

docs/development.md

@@ -4,6 +4,9 @@ Requirements: Node.js `>=22.12 <27`, npm, and Git for lifecycle/worktree integra
 the full matrix on Node 24 across Linux, macOS, and Windows and installed-package smoke tests on
 Node 22 and 26 on Linux.
 
+On Windows with Corepack installed, first run `corepack prepare pnpm@10.0.0`. This caches the pinned
+test version. The adapter test then runs offline; CI performs preparation as a separate step.
+
 ```bash
 npm ci
 npm run format:check

src/adapters/vcs.ts

@@ -1,7 +1,7 @@
 import { lstat, mkdir, readFile, realpath } from "node:fs/promises";
 import path from "node:path";
 import { runProcess } from "./process.js";
-import { localStateRoot } from "../state/local.js";
+import { prepareStateRoot } from "../state/local.js";
 import { isSuspectedSecret, resolveWithin } from "../security/paths.js";
 
 export interface IsolatedWorktree {
@@ -166,7 +166,7 @@ export async function prepareIsolatedWorktree(
   }
   const status = await git(root, ["status", "--porcelain=v1"]);
   if (status.exitCode !== 0) throw new Error("Git status could not be inspected safely.");
-  const stateRoot = await localStateRoot(root);
+  const stateRoot = await prepareStateRoot(root);
   const worktreesRoot = path.join(stateRoot, "worktrees");
   await mkdir(worktreesRoot, { recursive: true });
   const worktreePath = path.join(worktreesRoot, id);