@codyswann/lisa 4.42.3 → 4.42.4

package/package.json

@@ -57,11 +57,12 @@
     "generate:two-channel-couplings": "bun scripts/generate-two-channel-couplings.ts",
     "check:two-channel-couplings": "bun scripts/generate-two-channel-couplings.ts --check",
     "check:deletion-basis": "node scripts/check-deletion-basis.mjs",
-    "check:artifacts": "status=0; bun run check:upstream-evidence-manifest || status=1; bun run check:lisa-owned-hash-ledger || status=1; bun run check:nightly-guard-certificate || status=1; bun run check:two-channel-couplings || status=1; bun run check:deletion-basis || status=1; exit $status",
+    "check:artifacts": "failed=''; bun run check:upstream-evidence-manifest || failed=\"$failed upstream-evidence-manifest\"; bun run check:lisa-owned-hash-ledger || failed=\"$failed lisa-owned-hash-ledger\"; bun run check:nightly-guard-certificate || failed=\"$failed nightly-guard-certificate\"; bun run check:two-channel-couplings || failed=\"$failed two-channel-couplings\"; bun run check:deletion-basis || failed=\"$failed deletion-basis\"; if [ -n \"$failed\" ]; then echo \"check:artifacts FAILED, and these are the checks that failed:$failed\"; exit 1; fi; echo \"check:artifacts OK - all 5 generated-artifact checks passed.\"",
     "refresh:upstream-public-commits": "node scripts/generate-upstream-evidence-manifest.mjs --refresh-public-commits",
     "check:rules-pairing": "bash scripts/check-rules-pairing.sh",
     "check:pipeline-status-reads": "node scripts/check-pipeline-status-reads.mjs",
     "check:whole-output-guards": "node scripts/check-whole-output-guards.mjs",
+    "check:empty-subject-guards": "node scripts/check-empty-subject-guards.mjs",
     "check:shell-guard-refusals": "bun run build && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
     "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
@@ -172,7 +173,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -320,7 +321,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "545e66f595484fcc528b7d55904e5884d6996a34",
-  "gitHead": "545e66f595484fcc528b7d55904e5884d6996a34",
-  "lisaReleaseTag": "v4.42.3"
+  "lisaReleaseCommit": "42ae506a25e839bf0b979591dea52d56b334267b",
+  "gitHead": "42ae506a25e839bf0b979591dea52d56b334267b",
+  "lisaReleaseTag": "v4.42.4"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/rules/reference/falsifiable-checks.md

@@ -126,6 +126,26 @@ bash -e -o pipefail -c 'node -e "process.exit(1)" | tee /dev/null' -> 1
 
 `scripts/check-pipeline-status-reads.mjs` sweeps shipped shell scripts and workflow `run:` blocks for the pattern. It reports **how many pipelines it inspected** and exits 2 — not 0 — when that count is zero, because an empty inspection and a clean tree otherwise print the same tick.
 
+### A guard that reports OK when its comparison had no subject
+
+Not "the guard is wrong" — the guard did not run against anything, and said OK. Six instances were catalogued in one sweep (`#3888`), and this was the one still live:
+
+```text
+✓ no leftover conflict markers in 0 tracked files
+```
+
+That is a **required push gate** reporting on bytes nobody read. `git ls-files` in a repository with nothing tracked succeeds and prints nothing, so the scan loop ran zero times and the verdict came out the same as a clean tree's. Siblings in the same family: a type gate that compiled 0 of 1375 test files and reported success; a gate runner that recorded PASSED off an exit code, never the output; a review gate that went green off a review that never started.
+
+The distinguishing property is always the same. The guard had a **subject count** available and did not check it, or had a **reason string** available and did not read it. So:
+
+> **A guard that can report success must be able to state what it examined, and must fail closed when that count is zero.** A subject count of zero is not a pass.
+
+A guard with genuinely nothing to do is not the defect — it satisfies the rule by SAYING so (`not-adopted`, `nothing to register`) rather than printing a tick. The defect is a tick that cannot be told apart from a satisfied comparison.
+
+#### The executable half
+
+`scripts/check-empty-subject-guards.mjs` runs every root-scoped guard against an **empty git repository** and reports any that prints a success line and exits 0 anyway. It measures by executing rather than by reading, because a static heuristic that misses one reports a clean tree — the very failure being swept for. It prints how many guards it probed, how many declare no root override and so could not be, and exits 2 at zero probed.
+
 ## What a negative result is scoped to
 
 A clean result is a statement about what the check can perceive, not about the code. State the boundary:

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/rules/reference/falsifiable-checks.md

@@ -126,6 +126,26 @@ bash -e -o pipefail -c 'node -e "process.exit(1)" | tee /dev/null' -> 1
 
 `scripts/check-pipeline-status-reads.mjs` sweeps shipped shell scripts and workflow `run:` blocks for the pattern. It reports **how many pipelines it inspected** and exits 2 — not 0 — when that count is zero, because an empty inspection and a clean tree otherwise print the same tick.
 
+### A guard that reports OK when its comparison had no subject
+
+Not "the guard is wrong" — the guard did not run against anything, and said OK. Six instances were catalogued in one sweep (`#3888`), and this was the one still live:
+
+```text
+✓ no leftover conflict markers in 0 tracked files
+```
+
+That is a **required push gate** reporting on bytes nobody read. `git ls-files` in a repository with nothing tracked succeeds and prints nothing, so the scan loop ran zero times and the verdict came out the same as a clean tree's. Siblings in the same family: a type gate that compiled 0 of 1375 test files and reported success; a gate runner that recorded PASSED off an exit code, never the output; a review gate that went green off a review that never started.
+
+The distinguishing property is always the same. The guard had a **subject count** available and did not check it, or had a **reason string** available and did not read it. So:
+
+> **A guard that can report success must be able to state what it examined, and must fail closed when that count is zero.** A subject count of zero is not a pass.
+
+A guard with genuinely nothing to do is not the defect — it satisfies the rule by SAYING so (`not-adopted`, `nothing to register`) rather than printing a tick. The defect is a tick that cannot be told apart from a satisfied comparison.
+
+#### The executable half
+
+`scripts/check-empty-subject-guards.mjs` runs every root-scoped guard against an **empty git repository** and reports any that prints a success line and exits 0 anyway. It measures by executing rather than by reading, because a static heuristic that misses one reports a clean tree — the very failure being swept for. It prints how many guards it probed, how many declare no root override and so could not be, and exits 2 at zero probed.
+
 ## What a negative result is scoped to
 
 A clean result is a statement about what the check can perceive, not about the code. State the boundary:

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/rules/falsifiable-checks-reference.mdc

@@ -131,6 +131,26 @@ bash -e -o pipefail -c 'node -e "process.exit(1)" | tee /dev/null' -> 1
 
 `scripts/check-pipeline-status-reads.mjs` sweeps shipped shell scripts and workflow `run:` blocks for the pattern. It reports **how many pipelines it inspected** and exits 2 — not 0 — when that count is zero, because an empty inspection and a clean tree otherwise print the same tick.
 
+### A guard that reports OK when its comparison had no subject
+
+Not "the guard is wrong" — the guard did not run against anything, and said OK. Six instances were catalogued in one sweep (`#3888`), and this was the one still live:
+
+```text
+✓ no leftover conflict markers in 0 tracked files
+```
+
+That is a **required push gate** reporting on bytes nobody read. `git ls-files` in a repository with nothing tracked succeeds and prints nothing, so the scan loop ran zero times and the verdict came out the same as a clean tree's. Siblings in the same family: a type gate that compiled 0 of 1375 test files and reported success; a gate runner that recorded PASSED off an exit code, never the output; a review gate that went green off a review that never started.
+
+The distinguishing property is always the same. The guard had a **subject count** available and did not check it, or had a **reason string** available and did not read it. So:
+
+> **A guard that can report success must be able to state what it examined, and must fail closed when that count is zero.** A subject count of zero is not a pass.
+
+A guard with genuinely nothing to do is not the defect — it satisfies the rule by SAYING so (`not-adopted`, `nothing to register`) rather than printing a tick. The defect is a tick that cannot be told apart from a satisfied comparison.
+
+#### The executable half
+
+`scripts/check-empty-subject-guards.mjs` runs every root-scoped guard against an **empty git repository** and reports any that prints a success line and exits 0 anyway. It measures by executing rather than by reading, because a static heuristic that misses one reports a clean tree — the very failure being swept for. It prints how many guards it probed, how many declare no root override and so could not be, and exits 2 at zero probed.
+
 ## What a negative result is scoped to
 
 A clean result is a statement about what the check can perceive, not about the code. State the boundary:

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.42.3",
+  "version": "4.42.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/rules/reference/falsifiable-checks.md

@@ -126,6 +126,26 @@ bash -e -o pipefail -c 'node -e "process.exit(1)" | tee /dev/null' -> 1
 
 `scripts/check-pipeline-status-reads.mjs` sweeps shipped shell scripts and workflow `run:` blocks for the pattern. It reports **how many pipelines it inspected** and exits 2 — not 0 — when that count is zero, because an empty inspection and a clean tree otherwise print the same tick.
 
+### A guard that reports OK when its comparison had no subject
+
+Not "the guard is wrong" — the guard did not run against anything, and said OK. Six instances were catalogued in one sweep (`#3888`), and this was the one still live:
+
+```text
+✓ no leftover conflict markers in 0 tracked files
+```
+
+That is a **required push gate** reporting on bytes nobody read. `git ls-files` in a repository with nothing tracked succeeds and prints nothing, so the scan loop ran zero times and the verdict came out the same as a clean tree's. Siblings in the same family: a type gate that compiled 0 of 1375 test files and reported success; a gate runner that recorded PASSED off an exit code, never the output; a review gate that went green off a review that never started.
+
+The distinguishing property is always the same. The guard had a **subject count** available and did not check it, or had a **reason string** available and did not read it. So:
+
+> **A guard that can report success must be able to state what it examined, and must fail closed when that count is zero.** A subject count of zero is not a pass.
+
+A guard with genuinely nothing to do is not the defect — it satisfies the rule by SAYING so (`not-adopted`, `nothing to register`) rather than printing a tick. The defect is a tick that cannot be told apart from a satisfied comparison.
+
+#### The executable half
+
+`scripts/check-empty-subject-guards.mjs` runs every root-scoped guard against an **empty git repository** and reports any that prints a success line and exits 0 anyway. It measures by executing rather than by reading, because a static heuristic that misses one reports a clean tree — the very failure being swept for. It prints how many guards it probed, how many declare no root override and so could not be, and exits 2 at zero probed.
+
 ## What a negative result is scoped to
 
 A clean result is a statement about what the check can perceive, not about the code. State the boundary: