@aria_asi/cli 0.2.39 → 0.2.41

package/dist/runtime/hooks/lib/stop-hook-protocol.mjs

@@ -0,0 +1,166 @@
+// doctrine-self-check-file: preferred over|optional|fallback layer naming-the-pattern subject-of-rung — the lib documents Claude Code's external Stop hook protocol shape (which has optional fields per Claude Code spec, NOT Aria doctrine). All "optional" mentions are quoting Claude Code's protocol specification verbatim, not asserting Aria policy preferences.
+
+/**
+ * stop-hook-protocol.mjs — M9.DRIFT.10t Stop hook output validator + emitter.
+ *
+ * Closes Bug 3 the operator's local agent reported 2026-05-08:
+ *   "Stop hook error: Hook JSON output validation failed —
+ *    (root): Invalid input."
+ *
+ * Claude Code's runtime validates each hook's stdout JSON against a
+ * canonical schema and rejects at the root level when extra keys
+ * appear OR when hook-class-specific keys (e.g., hookSpecificOutput
+ * which is SessionStart-only) appear at the wrong hook event.
+ *
+ * STOP HOOK CANONICAL OUTPUT SHAPE (per Claude Code hook docs):
+ *
+ *   stdout valid forms:
+ *     1. empty                   -> allow
+ *     2. JSON {
+ *          decision?: "block" | "approve",   // optional; absent = allow
+ *          reason?: string,                  // required when decision === "block"
+ *          continue?: boolean,               // optional; controls whether processing continues
+ *          stopReason?: string,              // optional; companion to continue
+ *          suppressOutput?: boolean          // optional
+ *        }
+ *
+ *   exit codes:
+ *     0 with empty stdout         -> allow
+ *     0 with valid JSON           -> apply decision
+ *     2 with stderr               -> block with stderr as reason (legacy)
+ *
+ *   ANY other root key in stdout JSON  -> "(root): Invalid input"
+ *   hookSpecificOutput at root         -> SessionStart-only; rejected for Stop
+ *
+ * Two-part fix in M9.DRIFT.10t:
+ *   Part A: this lib — validateStopHookOutput + emitStopHookDecision
+ *   Part B: update the two confirmed offenders in repo siblings to
+ *           use this lib instead of raw console.log + JSON.stringify
+ */
+
+const ALLOWED_ROOT_KEYS = Object.freeze([
+  'decision',
+  'reason',
+  'continue',
+  'stopReason',
+  'suppressOutput',
+]);
+
+const ALLOWED_DECISIONS = Object.freeze(['block', 'approve']);
+
+/**
+ * Validate a candidate Stop hook stdout payload.
+ *
+ * @param {object} obj  the payload that would be written to stdout
+ * @returns {{ ok: boolean, errors: string[] }}
+ */
+export function validateStopHookOutput(obj) {
+  const errors = [];
+  if (obj === null || obj === undefined) {
+    return { ok: true, errors }; // empty stdout = allow
+  }
+  if (typeof obj !== 'object' || Array.isArray(obj)) {
+    errors.push(`stdout payload must be a non-array object or null; got ${Array.isArray(obj) ? 'array' : typeof obj}`);
+    return { ok: false, errors };
+  }
+  // Reject extra root keys.
+  for (const key of Object.keys(obj)) {
+    if (!ALLOWED_ROOT_KEYS.includes(key)) {
+      errors.push(
+        `extra root key "${key}" — Claude Code Stop hook protocol allows only: ${ALLOWED_ROOT_KEYS.join(', ')}. ` +
+        `Embed this data in the "reason" string OR write to disk via recovery-context.mjs.`,
+      );
+    }
+  }
+  // decision enum check.
+  if ('decision' in obj && !ALLOWED_DECISIONS.includes(obj.decision)) {
+    errors.push(
+      `decision="${obj.decision}" not in allowed enum: ${ALLOWED_DECISIONS.join(', ')}`,
+    );
+  }
+  // reason required when decision === 'block'.
+  if (obj.decision === 'block') {
+    if (typeof obj.reason !== 'string' || obj.reason.length === 0) {
+      errors.push('decision="block" requires a non-empty reason string');
+    }
+  }
+  // type checks on optional fields.
+  if ('continue' in obj && typeof obj.continue !== 'boolean') {
+    errors.push(`continue must be boolean; got ${typeof obj.continue}`);
+  }
+  if ('stopReason' in obj && typeof obj.stopReason !== 'string') {
+    errors.push(`stopReason must be string; got ${typeof obj.stopReason}`);
+  }
+  if ('suppressOutput' in obj && typeof obj.suppressOutput !== 'boolean') {
+    errors.push(`suppressOutput must be boolean; got ${typeof obj.suppressOutput}`);
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+/**
+ * Emit a Stop hook decision to stdout, validated against the protocol.
+ *
+ * Default behavior (no opts): on valid -> writes JSON to process.stdout
+ * + exits 0; on invalid -> writes the violation list to process.stderr
+ * + exits 2 (legacy block path; safer than emitting invalid JSON which
+ * causes "(root): Invalid input" rejection).
+ *
+ * Test mode: pass opts.stdout / opts.stderr / opts.exit as injected
+ * functions to capture output without touching process.* globals.
+ *
+ * @param {object|null} obj  Stop hook payload (or null for empty allow)
+ * @param {object} [opts]
+ * @param {(s: string) => void} [opts.stdout]  injected stdout writer
+ * @param {(s: string) => void} [opts.stderr]  injected stderr writer
+ * @param {(code: number) => void} [opts.exit]  injected exit fn
+ * @returns {{ emitted: boolean, exitCode: number, errors: string[] }}
+ */
+export function emitStopHookDecision(obj, opts = {}) {
+  const stdout = opts.stdout || ((s) => process.stdout.write(s));
+  const stderr = opts.stderr || ((s) => process.stderr.write(s));
+  const exit = opts.exit || ((code) => process.exit(code));
+
+  // Empty payload = allow.
+  if (obj === null || obj === undefined) {
+    exit(0);
+    return { emitted: false, exitCode: 0, errors: [] };
+  }
+
+  const { ok, errors } = validateStopHookOutput(obj);
+  if (!ok) {
+    stderr(
+      '[stop-hook-protocol] REFUSED to emit invalid Stop hook JSON. ' +
+      `${errors.length} violation(s):\n` +
+      errors.map((e) => `  - ${e}`).join('\n') +
+      '\n',
+    );
+    // Exit 2 as a legacy block (safer than emitting invalid JSON which
+    // Claude Code rejects with "(root): Invalid input"). The stderr
+    // payload reaches the model as the block reason.
+    exit(2);
+    return { emitted: false, exitCode: 2, errors };
+  }
+
+  stdout(JSON.stringify(obj) + '\n');
+  exit(0);
+  return { emitted: true, exitCode: 0, errors: [] };
+}
+
+/**
+ * Helpers for building canonical Stop hook payloads.
+ */
+export function buildBlockDecision(reason) {
+  if (typeof reason !== 'string' || reason.length === 0) {
+    throw new Error('buildBlockDecision: reason must be a non-empty string');
+  }
+  return { decision: 'block', reason };
+}
+
+export function buildApproveDecision(reason) {
+  const out = { decision: 'approve' };
+  if (typeof reason === 'string' && reason.length > 0) out.reason = reason;
+  return out;
+}
+
+export const STOP_HOOK_PROTOCOL_ALLOWED_ROOT_KEYS = ALLOWED_ROOT_KEYS;
+export const STOP_HOOK_PROTOCOL_ALLOWED_DECISIONS = ALLOWED_DECISIONS;

package/dist/runtime/hooks/lib/surface-caught.mjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+/**
+ * surface-caught.mjs — shared stderr-surface helper for hook catch blocks.
+ *
+ * Phase 0 audit Cluster H finding M0.H.3 (CRITICAL): the hook stack had
+ * 86+ empty `} catch {}` blocks — code that ENFORCES the doctrine
+ * `feedback_no_graceful_degradation.md` (the FIRST entry in the
+ * doctrine_trigger_map) while violating it itself 86 times. The enforcer
+ * didn't live by its own law.
+ *
+ * This helper provides a single, consistent surface for caught errors.
+ * Each call site replaces an empty catch with a labeled stderr line so
+ * operators can grep `[hook:context] op failed:` to audit hook-internal
+ * failures without parsing every per-hook log file.
+ *
+ * Usage:
+ *   } catch (err) { surfaceCaught('aria-stop-gate', 'mizan-receipt-load', err); }
+ *
+ * The third arg is the actual caught error — string or Error. If it's
+ * an Error instance, the message is used; otherwise String(err).
+ *
+ * Doctrine bind: feedback_no_graceful_degradation.md +
+ * axiom_runtime_rule.admit_ignorance — surface failures, do not silently
+ * swallow.
+ *
+ * Mirror: this file MUST be byte-identical between
+ *   ops/claude-hooks/lib/surface-caught.mjs
+ *   packages/aria-connector/hooks/lib/surface-caught.mjs
+ */
+
+// M0.SELFREVIEW.5 — rate limit per (hookName, context) pair.
+// Under cascading failure (e.g., DB unavailable, every probe fails)
+// stderr volume could flood and cause container log backpressure.
+// Cap each (hook, context) at RATE_LIMIT_PER_SECOND emissions per
+// process; surplus drops with a counter. Next emit after the window
+// resets includes a "...(suppressed N similar)" suffix so operator
+// audit doesn't lose the count.
+const RATE_LIMIT_PER_SECOND = parseInt(process.env.ARIA_SURFACE_CAUGHT_RATE_LIMIT || '', 10) || 20;
+const _buckets = new Map(); // key="hook:context" -> { windowStart, count, suppressed }
+
+function rateGate(key) {
+  const now = Date.now();
+  let b = _buckets.get(key);
+  if (!b) {
+    b = { windowStart: now, count: 0, suppressed: 0 };
+    _buckets.set(key, b);
+  }
+  if (now - b.windowStart >= 1000) {
+    // Window rolled — return previously-suppressed count so caller can append it.
+    const prevSuppressed = b.suppressed;
+    b.windowStart = now;
+    b.count = 0;
+    b.suppressed = 0;
+    b.count++;
+    return { allow: true, suppressedSinceLast: prevSuppressed };
+  }
+  b.count++;
+  if (b.count > RATE_LIMIT_PER_SECOND) {
+    b.suppressed++;
+    return { allow: false, suppressedSinceLast: 0 };
+  }
+  return { allow: true, suppressedSinceLast: 0 };
+}
+
+/**
+ * Write a labeled error surface line to stderr.
+ *
+ * @param {string} hookName - the hook file's short label (e.g. 'aria-stop-gate')
+ * @param {string} context  - the operation that failed (e.g. 'mizan-receipt-load')
+ * @param {unknown} err     - the caught value
+ */
+export function surfaceCaught(hookName, context, err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  const key = `${hookName}:${context}`;
+  const gate = rateGate(key);
+  if (!gate.allow) return; // suppressed; counter increments inside rateGate
+  const suppressedSuffix = gate.suppressedSinceLast > 0
+    ? ` (suppressed ${gate.suppressedSinceLast} similar in prior window)`
+    : '';
+  try {
+    process.stderr.write(`[${hookName}:${context}] caught: ${msg}${suppressedSuffix}\n`);
+  } catch (writeErr) {
+    // Stderr write itself failed — last-resort console fallback. If even
+    // that fails (truly broken process), there is nowhere left to surface
+    // and we cannot do better. This is the only documented silent-by-design
+    // case in the helper itself.
+    // silent-by-design: stderr unavailable means the surface itself broke; nothing more to do
+    try { console.error(`[${hookName}:${context}] caught:`, msg); } catch (consoleErr) {
+      // silent-by-design: console also unavailable; truly broken process
+    }
+  }
+}
+
+export default { surfaceCaught };

package/dist/runtime/hooks/recovery-templates/force-reauthor.md

@@ -0,0 +1,67 @@
+{{!-- force-reauthor.md — recovery contract template
+
+Phase 0 audit Tier D Meta-X5 + cluster H M0.H.X11: extracted from
+ops/claude-hooks/aria-stop-gate.mjs:buildForceReauthorReason() (was: 70-line
+hardcoded teaching template baked in source). Operators can now edit the
+teaching prose without code change + redeploy + npm publish.
+
+Hot-reload: hook reads this file's mtime per call; if changed since last
+read, re-read. Allows operator to update teaching with immediate effect.
+
+Variables (substituted via simple {{var}} mustache-style replacement):
+  - {{source}}              decision source (e.g., 'stop/lens-missing')
+  - {{reason}}              one-line failure reason
+  - {{trigger_lines}}       formatted bullet list of doctrine triggers fired
+  - {{violations_section}}  formatted violations (or empty)
+  - {{rewritten_section}}   mizan rewrite seed (or empty)
+  - {{recipe_addendum}}     extra recipe text (or empty)
+  - {{required_lenses}}     integer count (default 8)
+  - {{lens_count}}          observed lens count
+--}}
+=== ARIA FORCE_REAUTHOR ===
+source: {{source}}
+reason: {{reason}}
+
+This is not a terminal error. It is a forced redo instruction for the next model draft.
+Do not emit the blocked text. Re-author it so the model learns the mechanism it violated.
+
+TEACHING:
+- Gates must force cognition and quality, not merely throw, warn, or stop.
+- The redo must change the answer shape: name the failed mechanism, cite real evidence, and remove the drift pattern.
+- Do not bypass by disabling tools, shortening runtime, asking the user to resolve memory-backed ambiguity, or giving an apology loop.
+
+{{trigger_lines}}{{violations_section}}{{rewritten_section}}{{recipe_addendum}}
+
+Recovery contract:
+1. Do not retry the same blocked text unchanged.
+2. Apply the teaching above to the next draft before re-emitting.
+3. Re-test by submitting the revised output through this same gate.
+4. If the blocker is stale state, name the stale state and clear or repair it before retrying.
+
+REQUIRED REDO SHAPE:
+1. One sentence: the failed mechanism, not an apology.
+2. Evidence checked: file/line, command output, endpoint response, or explicit "unverified".
+3. <cognition> with {{required_lenses}} substantive lenses. Observed: {{lens_count}}/{{required_lenses}}.
+4. <applied_cognition> with decision_delta, dominant_domain, binds_to, expected_predicate, and artifact_change.
+5. Corrected action/claim with no bypass, no downgraded path, and no fake proof.
+6. If work remains, state the exact next real action or tracked task. No verbal flag-and-move.
+
+COGNITION TEMPLATE:
+<cognition>
+truth: <verified facts and exact substrate>
+harm: <what goes wrong if this is false>
+trust: <how this honors Hamza directives and saved memory>
+power: <why this uses capability responsibly, not convenience>
+reflection: <mechanism failure and correction>
+context: <relevant repo/runtime state>
+impact: <expected next effect>
+beauty: <simplest durable form>
+</cognition>
+<applied_cognition>
+decision_delta: <what changed because cognition ran; not none>
+dominant_domain: <engineering_quality | trust | operations | security | product | ...>
+binds_to: <the exact answer, tool call, file mutation, deploy, review, or decision>
+expected_predicate: <observable numeric, boolean, state-string, command result, endpoint result, or explicit unverified boundary>
+artifact_change: <semantic effect on the artifact/output, not a task restatement>
+</applied_cognition>
+=== END FORCE_REAUTHOR ===

package/dist/runtime/hooks/recovery-templates/handoff-recovery.md

@@ -0,0 +1,25 @@
+{{!-- handoff-recovery.md — post-compact continuation handoff template
+
+Phase 0 audit Tier D Meta-X5 + cluster H M0.H.X11: extracted from
+ops/claude-hooks/aria-stop-gate.mjs:formatHandoffRecovery() (was: hardcoded
+in source). Operator can edit the recovery contract without redeploy.
+
+Variables:
+  - {{missing_fields}}  comma-separated list of missing handoff fields,
+                        or '(none)' when all present (this template only
+                        renders when at least one field is missing —
+                        renderer handles the empty case via short-circuit)
+--}}
+=== ARIA LOCAL OUTPUT BLOCK ===
+
+post-compact continuation handoff malformed: missing fields: {{missing_fields}}
+
+Recovery contract:
+1. Do not retry the same blocked text.
+2. Rewrite the output using this exact shape:
+post_compact_continuation
+current objective: <one sentence of the still-active task>
+known blockers: <specific blockers, or "none verified" if truly none>
+next executable step: <single command/edit/read/action the next agent should run first>
+what not to touch: <unrelated dirty files, secrets, protected systems, or deploys to avoid>
+verification already run: <commands/probes already run and exact result, or "not run">

package/dist/runtime/hooks/scripts/check-hard-risk-prefix.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+// check-hard-risk-prefix — CI lint enforcing the 'hard-risk ' prefix convention.
+//
+// The hardFindings filter at runtime-client.mjs uses
+// `finding.startsWith('hard-risk ')` to escalate findings to hard-risk
+// status. Any push to riskFindings / hardFindings whose argument doesn't
+// begin with 'hard-risk ' will be silently ignored by that filter — same
+// false-classification bug class as the bare-word credential regex that
+// was fixed 2026-05-17.
+//
+// Run from CI: `node ops/claude-hooks/scripts/check-hard-risk-prefix.mjs`
+// Exit 0 if all push sites comply, exit 1 if any violations.
+
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+
+const HOME = homedir();
+const SCAN_ROOTS = [
+  resolve(HOME, 'rei-ai-brain', 'ops', 'claude-hooks'),
+  resolve(HOME, '.claude', 'hooks'),
+  resolve(HOME, '.codex', 'hooks'),
+  resolve(HOME, '.opencode', 'hooks'),
+];
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build']);
+// Match riskFindings.push(<arg>) and hardFindings.push(<arg>) — capture <arg>
+// up to the first comma or closing paren at the same nesting level.
+const PUSH_RX = /\b(?:risk|hard)Findings\.push\s*\(\s*([^;\n]+?)\)\s*;?/g;
+// Accept any of: 'hard-risk ...', "hard-risk ...", `hard-risk ...` (template),
+// `hard-risk ${...}...` (template with interpolation in middle).
+const PREFIX_RX = /^[`'"]hard-risk /;
+
+function walkDir(root, files = []) {
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return files;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name) || entry.name.startsWith('.')) continue;
+      walkDir(join(root, entry.name), files);
+    } else if (entry.isFile() && /\.mjs$/i.test(entry.name) && !entry.name.endsWith('.test.mjs')) {
+      files.push(join(root, entry.name));
+    }
+  }
+  return files;
+}
+
+function scanFile(path) {
+  let text;
+  try {
+    text = readFileSync(path, 'utf8');
+  } catch {
+    return [];
+  }
+  const violations = [];
+  let m;
+  PUSH_RX.lastIndex = 0;
+  while ((m = PUSH_RX.exec(text)) !== null) {
+    const arg = m[1].trim();
+    // Skip if the arg is itself a variable (not a literal) — variable
+    // pushes are caller-responsibility and can't be statically checked.
+    if (!/^[`'"]/.test(arg)) continue;
+    if (!PREFIX_RX.test(arg)) {
+      // Find line number
+      const lineNo = text.slice(0, m.index).split('\n').length;
+      violations.push({ path, line: lineNo, arg: arg.slice(0, 80) });
+    }
+  }
+  return violations;
+}
+
+const allFiles = [];
+for (const root of SCAN_ROOTS) {
+  try {
+    if (statSync(root).isDirectory()) walkDir(root, allFiles);
+  } catch {
+    // Root doesn't exist — skip silently
+  }
+}
+
+const allViolations = [];
+for (const f of allFiles) allViolations.push(...scanFile(f));
+
+if (allViolations.length === 0) {
+  console.log(`PASS: scanned ${allFiles.length} hook file(s) across ${SCAN_ROOTS.length} root(s); all riskFindings.push / hardFindings.push call-sites use the 'hard-risk ' prefix convention.`);
+  process.exit(0);
+}
+
+console.error(`FAIL: ${allViolations.length} push-site(s) violate the 'hard-risk ' prefix convention`);
+console.error('Background: runtime-client.mjs:2233 hardFindings filter is structural (startsWith) — any push that omits the prefix is silently dropped from hard-risk escalation.');
+console.error('Fix: every literal-string riskFindings.push/hardFindings.push argument must begin with "hard-risk " (with trailing space).');
+console.error('');
+for (const v of allViolations) {
+  console.error(`  ${v.path}:${v.line}  →  ${v.arg}`);
+}
+process.exit(1);

package/dist/runtime/hooks/skills/aria-conversational-doctrine-discipline/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: aria-conversational-doctrine-discipline
+description: Use whenever I am about to make a factual claim to the operator about what code does, what is deployed, what caused an issue, what I have verified, or what is done. Loads the pre-emission ritual that closes the conversational-doctrine-recurrence gap documented at codex/plans/conversational-doctrine-recurrence-pattern.md.
+---
+
+# Aria Conversational Doctrine Discipline
+
+This skill addresses the recurrence pattern operator (Hamza) named in
+the 2026-05-07 session: the same agent gets caught violating the same
+doctrine class in conversation, fixes the individual instance, then
+introduces a new instance of the same class within 1–3 messages.
+
+The doctrine scanner catches trip-vocab in files + commits but does
+not catch claims I make in streaming conversation. This skill is the
+pre-emission ritual that closes part of the gap. The other part lives
+in `apps/arias-soul/scripts/scan-claim-evidence.mjs` (operator-invoked
+validator).
+
+## The pre-emission ritual
+
+Before any message I send to the operator that contains a factual
+claim — meaning anything of the form:
+
+- *"X is Y"* (state of code, deployed system, file content)
+- *"X does Y"* (behavior of a function, hook, script)
+- *"X caused Y"* (causal claim about an error or outcome)
+- *"X is not my work"* / *"this is not from my code"* (provenance disclaim)
+- *"X works"* / *"X passes"* / *"X is verified"* (status claim)
+- *"X is auto-generated"* / *"X is X"* (origin / classification claim)
+- *"X is done"* / *"complete"* / *"shipped"* (completion claim)
+
+I run the following ritual:
+
+### Step 1 — name the claim explicitly
+
+Write down (in my own working memory, before sending) the exact
+factual assertion I am about to make.
+
+### Step 2 — locate evidence
+
+For the claim, identify the verification source:
+
+| Claim type | Evidence source |
+|---|---|
+| Code behavior | `Read` the file + cite `file:line` |
+| Deployed system state | Run a probe (`Bash` + `kubectl`, `curl`, `git log`); cite the command output |
+| Test pass/fail | Run the test; cite the assertion count + exit code |
+| Provenance ("my work" or "not my work") | List the components I shipped that touch the relevant surface; cite SHAs |
+| Completion ("done"/"shipped") | Cite the commit SHA + the verify_predicate exit code |
+| Status of an external resource | Run the read-only probe; cite the response |
+
+### Step 3 — if evidence cannot be obtained
+
+Replace the claim with one of:
+
+- *"I do not know without access to <specific resource>"*
+- *"I have not verified this — checking now..."* then run the verification before continuing
+- *"My training suggests X but I have not verified against your codebase"* (acknowledging the substrate hierarchy: operator > codebase > training)
+
+NEVER assert without one of:
+1. Evidence cited inline
+2. Explicit ignorance acknowledgment
+3. Verification in progress
+
+### Step 4 — emit with evidence inline
+
+Structure the message so the evidence is adjacent to the claim, not
+buried elsewhere. Examples:
+
+- ✗ *"The validator passes its own spec."*
+- ✓ *"The validator passes its own spec — `node apps/arias-soul/scripts/check-ledger-spec.mjs M9.DRIFT.1` exits 0 (verified just now)."*
+
+- ✗ *"Not something my work caused."*
+- ✓ *"I cannot prove my code caused or didn't cause the socket close — `aria-stop-gate.mjs` and `aria-harness-via-sdk.mjs` are plausible candidates per [investigation], but I have no access to your local logs to confirm."*
+
+## What this skill does NOT do
+
+- It is **not** a runtime gate. The harness cannot intercept my
+  conversational tokens before they stream to the operator. If I drift
+  away from this ritual mid-session, nothing automatically catches me.
+- It is **not** a replacement for the operator's review. The operator
+  can invoke `apps/arias-soul/scripts/scan-claim-evidence.mjs` against
+  my response text to spot recurrence, but the operator must still
+  read my output.
+- It does **not** address the recurrence frequency at the model layer.
+  That is a training-signal problem outside the scope of any
+  individual rung.
+
+## Pattern documentation
+
+When a recurrence happens, append to the catches table at
+`codex/plans/conversational-doctrine-recurrence-pattern.md`. The
+running list is the operator-readable record of how the pattern
+behaves over time.
+
+## Self-bind
+
+This skill itself contains claims about behavior of the doctrine
+scanner, the harness lifecycle, and what the validator does. Each
+cited at the file path operator can read. If any claim in this skill
+becomes untrue (e.g., harness changes), the skill must be updated.

package/dist/runtime/hooks/test-aria-preturn-memory-gate.mjs

@@ -160,7 +160,7 @@ console.log('\nTest 2: transcript with all three context signals → allow');
   assert('no block decision in stdout (stdout is empty or non-block)', !parsed || parsed.decision !== 'block', parsed?.decision);
 
   // Cleanup
-  try { unlinkSync(transcriptFile); } catch {}
+  try { unlinkSync(transcriptFile); } catch (_err) { void _err; /* silent-by-design (M0.H.X3): test cleanup */ }
 }
 
 // ── Test 3: deduplication — gate already fired within 60s → skip ───────
@@ -231,7 +231,7 @@ console.log('\nTest 6: only harness packet signal (missing direction + memory re
     parsed?.reason?.slice(0, 200),
   );
 
-  try { unlinkSync(transcriptFile); } catch {}
+  try { unlinkSync(transcriptFile); } catch (_err) { void _err; /* silent-by-design (M0.H.X3): test cleanup */ }
   cleanTurnState(SESSION_ID);
 }
 

package/dist/runtime/hooks/test-tier-lens-labeling.mjs

@@ -1,4 +1,10 @@
 #!/usr/bin/env node
+// ── doctrine-self-check-file: cleanup batch (2026-05-06) ──
+// File-level acks for trigger patterns appearing in pre-existing comments
+// describing prior antipatterns being migrated. Each ack names a trigger
+// the doctrine_trigger_map covers; per-file ack covers all matches.
+// doctrine-self-check-file: tests.?(?:passed|pass|ed)|(?:smoke|unit|integration).?test.?(?:pass|ok|good) session-added-comments-describing-prior-state-or-migration
+// doctrine-self-check-file: want me to|should i session-added-comments-describing-prior-state-or-migration
 // Smoke test: Phase 11 #59 — canonical lens labeling
 //
 // Verifies that aria-pre-tool-gate.mjs and aria-stop-gate.mjs:
@@ -62,7 +68,12 @@ function restorePacket() {
     } else if (existsSync(PACKET_PATH)) {
       unlinkSync(PACKET_PATH);
     }
-  } catch {}
+  } catch (_err) {
+    // silent-by-design (M0.H.X3): test fixture restore — failure here
+    // doesn't affect production behavior; test harness will see the
+    // assertion failure if state was corrupted.
+    void _err;
+  }
 }
 
 function writeOwnerPacket() {
@@ -181,7 +192,7 @@ const tmpTranscriptStop = `/tmp/test-tier-stop-transcript-${Date.now()}.jsonl`;
 
 function cleanup() {
   [tmpTranscript, tmpTranscriptStop].forEach((p) => {
-    try { if (existsSync(p)) unlinkSync(p); } catch {}
+    try { if (existsSync(p)) unlinkSync(p); } catch (_err) { void _err; /* silent-by-design (M0.H.X3): test cleanup */ }
   });
   restorePacket();
 }
@@ -328,7 +339,7 @@ console.log('\nTest 4: aria-stop-gate — CLIENT tier keeps canonical lens label
 console.log('\nTest 5: missing packet cache → defaults to canonical labels');
 {
   // Remove the packet cache
-  try { unlinkSync(PACKET_PATH); } catch {}
+  try { unlinkSync(PACKET_PATH); } catch (_err) { void _err; /* silent-by-design (M0.H.X3): test cleanup */ }
   writeEmptyTranscript(tmpTranscript);
   const result = runPreToolGate(tmpTranscript);