v5.4.2 — Traceability truth + Sensory Register buffer close-loop

This release is about making the low-level truth match the story again. It does not remove any Claude/Opus/Codex-assisted path. It hardens the mechanical layer around that assisted intelligence so warnings, queues, and docs stop lying by accident.

What was misleading

The diary warning for missing commit_ref was counting too much. Repo edits, local runtime writes, server-side operations, and other out-of-band changes were all being collapsed into one scary number. That made the release traceability signal noisier than the underlying reality.

At the same time, session_buffer.jsonl was behaving more like a leaky bucket than a queue: the nocturnal postmortem only looked at "today", ignored older pending events, and did not actually prune the lines it had already consumed.

What changed in v5.4.2

• Traceability warnings are honest again. Repo-tracked files still require a real git hash. Local/runtime/server-side operations can now be recorded with explicit markers such as server-direct or local-uncommitted instead of being treated as if they were missing repo commits.
• The Sensory Register buffer now closes its loop. The nocturnal postmortem consumes pending events from session_buffer.jsonl, renders useful hook/tool activity into the Sensory Register, and removes only the lines that were actually ingested.
• Pending means pending, not "today only". If an event stayed in the buffer from an earlier run, it no longer gets stranded forever just because the calendar day changed.
• Buffer rewrite is atomic. The queue is now rewritten through a temp file + replace step so a partial write cannot leave the file truncated mid-drain.
• Docs now describe the real boundary. README and the reflection script both say plainly that nexo-reflection.py is a standalone analyzer, not something the stop hook auto-triggers today.

What did not change

The assisted layer stays. Nightly consolidation can still use Claude/Opus/Codex-backed intelligence where the product expects it. This patch does not replace that with "dumb Python". It only makes the purely mechanical edges more trustworthy.

Why this matters

Shared-brain systems degrade when low-level evidence becomes noisy. A warning that overcounts debt teaches the operator to ignore warnings. A queue that never quite drains teaches the operator to distrust the memory pipeline. A doc that describes an old trigger path teaches the next session the wrong architecture. v5.4.2 closes those gaps without changing the higher-level product promise.

Update

npm update -g nexo-brain
nexo update