@codyswann/lisa 4.73.9 → 4.74.1

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.73.9",
+  "version": "4.74.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/rules/reference/bdd-e2e-coverage.md

@@ -22,8 +22,9 @@ Default locations (a project that already has an equivalent contract keeps its o
 |---|---|---|
 | Scenarios | `bdd/features/*.feature` | Gherkin, the product-level behavior contract |
 | Coverage map | `bdd/coverage-map.json` | scenario → runner/platform/file/evidence mappings, plus waivers, per-runner test-discovery roots, and exclusions |
-| Generated matrix | `docs/bdd-scenario-matrix.md` | regenerated, never hand-edited |
-| Burndown | `docs/e2e-bdd-coverage.md` | current coverage per platform |
+| Generated matrix | `docs/bdd-scenario-matrix/` | per-source-file leaves, regenerated, never hand-edited; static navigation at `docs/bdd-scenario-matrix.md` |
+| Burndown | `docs/e2e-bdd-coverage/` | per-source-file mapping gaps and waivers; static navigation at `docs/e2e-bdd-coverage.md` |
+| Feature JSON | `bdd/reports/v1/features/` | versioned local declarations/evidence; full aggregate remains in runtime `--report` and CI |
 
 ## Scenario shape
 
@@ -180,9 +181,10 @@ exclusion whose file is gone, whose title was renamed, or that no discovery root
 
 Two commands, wired into the project's script surface and into CI:
 
-1. **Regenerate** — recompute coverage from features + map, rewrite the generated matrix
-   (`docs/bdd-scenario-matrix.md`) and the burndown (`docs/e2e-bdd-coverage.md`), and refresh the
-   machine-readable report. Low coverage is reported honestly and does **not** fail this command.
+1. **Regenerate** — recompute coverage from features + map and write the feature-local matrix,
+   burndown and JSON under `docs/bdd-scenario-matrix/`, `docs/e2e-bdd-coverage/` and
+   `bdd/reports/v1/features/`. Shared entry points contain static guidance. Reportable coverage
+   defects still produce paperwork; the coverage CLI keeps its original failing exit.
 2. **Check** — the CI gate. It fails on contract defects, not on ambition:
    - a duplicate or malformed scenario ID;
    - a scenario declaring a platform with no configured runner;
@@ -197,7 +199,7 @@ Two commands, wired into the project's script surface and into CI:
    - coverage given back: an obligation mapped at the base revision that nothing maps here;
    - new behavior nobody mapped or waived.
 
-   Regeneration is never blocked by the check: `--write` rewrites the report and burndown whenever a
+   Regeneration is never blocked by a reportable coverage defect: `--write` rewrites feature reports whenever a
    report can be built at all, so a stale evidence string can never hold hostage the paperwork that
    documents it.
 
@@ -277,7 +279,7 @@ A repo with no contract yet, taking its first frontend work item:
    Pre-existing tests that align to no product behavior are recorded as `exclusions` with reasons
    during this step, never left undisclosed.
 3. **Write only this item's scenarios.** The first item is not a backfill project. Pre-existing
-   uncovered behavior becomes burndown in `docs/e2e-bdd-coverage.md`, and the floor starts where the
+   uncovered behavior becomes feature-local burndown under `docs/e2e-bdd-coverage/`, and the floor starts where the
    repo actually is. That is a one-time act, not a recurring one: from here on the floor stays put
    and what protects each new obligation is the per-obligation check, not the number.
 4. **Seal this item's obligations** and commit the regenerated matrix and burndown with the change.

package/plugins/src/base/skills/lisa-parity-sentry-sdk-setup/SKILL.md

@@ -84,6 +84,8 @@ Inspect the project before choosing an SDK. Read `package.json`
 - `pyproject.toml` / `requirements.txt`; `django`/`flask`/`fastapi` →
   **Python** (and which web framework)
 - A plain Node library/CLI → **Node**
+- AWS Lambda handlers or a Serverless/SAM/CDK function runtime → inspect the
+  function's actual runtime and wrapper before choosing **Node/Lambda**.
 
 If the runtime is genuinely ambiguous, ask which app to instrument rather than
 guessing. Respect the project's package manager (bun/npm/pnpm/yarn — match the
@@ -98,6 +100,7 @@ Use the project's package manager. Examples (swap `bun add` for your manager):
 | React (browser) | `@sentry/react` |
 | Next.js | `@sentry/nextjs` |
 | Node / Express / Fastify | `@sentry/node` (+ `@sentry/profiling-node` for profiling) |
+| AWS Lambda | `@sentry/aws-serverless` for a compatible Lambda wrapper, or `@sentry/node` for an unwrapped async handler |
 | NestJS | `@sentry/nestjs` (+ `@sentry/node`) |
 | React Native / Expo | `@sentry/react-native` |
 | Vue | `@sentry/vue` |
@@ -148,6 +151,107 @@ Sentry.init({
 
 Then, after routes are defined: `Sentry.setupExpressErrorHandler(app);`
 
+### Node24 Lambda completion
+
+Review the actual function runtime and installed SDK before migrating. Node24
+LTS is Lisa's default for new TypeScript hosts; an existing host's explicit
+engine and create-only workflows remain host-owned. On AWS Lambda `nodejs24.x`,
+callback-style handlers and legacy context completion APIs, including
+`callbackWaitsForEmptyEventLoop`, are removed. Do not assign those properties,
+including to frozen/non-extensible context objects. Supported async handlers,
+synchronous returns and response streaming are distinct forms; follow the
+[AWS handler contract](https://docs.aws.amazon.com/lambda/latest/dg/nodejs-handler.html).
+
+Earlier non-streaming async handlers already returned without waiting for
+unresolved background promises. Node24 aligns streaming completion with that
+behavior; await work that must finish before returning or ending the stream.
+Do not claim all Node20/22 async handlers drained arbitrary background work.
+For streaming, flush at the appropriate point before `responseStream.end()` or
+inside the awaited streaming pipeline, rather than after the stream is ended.
+[AWS's Node24 migration explanation](https://aws.amazon.com/blogs/compute/node-js-24-runtime-now-available-in-aws-lambda/)
+is the runtime authority; ordinary local Node process behavior is not deployed
+Lambda evidence.
+
+For an **unwrapped async** scheduled, queue or Cognito handler, initialize Sentry
+once at module startup with the DSN from the environment. Await a finite positive
+flush budget on both success and original-error paths. A false flush result or
+rejection must not turn successful queue work into a retry or replace its real
+error. Keep diagnostics local and non-throwing, and preserve the client for warm
+invocations: `close()` disables it. The following helper wraps the host's existing
+business operation; it neither mutates context nor adds a Lambda callback.
+
+<!-- lisa-node24-unwrapped-example:start -->
+```ts
+import * as Sentry from "@sentry/node";
+
+// Initialize early, once outside the handler, with DSN from the environment.
+function reportFlushProblem(message: string): void {
+  try {
+    console.warn(message);
+  } catch {
+    // Telemetry diagnostics must preserve the business outcome too.
+  }
+}
+
+export async function withSentryFlush<T>(
+  work: () => Promise<T>,
+  timeoutMs = 2000
+): Promise<T> {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new RangeError("Choose a finite positive Sentry flush budget");
+  }
+  try {
+    return await work();
+  } catch (originalError) {
+    try {
+      Sentry.captureException(originalError);
+    } catch {
+      // Preserve the original handler error even if capture fails.
+    }
+    throw originalError;
+  } finally {
+    try {
+      if (!(await Sentry.flush(timeoutMs))) {
+        reportFlushProblem("Sentry flush did not finish in time");
+      }
+    } catch {
+      reportFlushProblem("Sentry flush rejected");
+    }
+  }
+}
+```
+<!-- lisa-node24-unwrapped-example:end -->
+
+In the existing async handler, return
+`withSentryFlush(() => performBusinessWork(event, context))`; use the host's
+actual business operation and preserve its return/error contract. Select a
+positive budget that fits remaining invocation time with a safety margin.
+Do not omit the timeout or use zero as a finite cap. The SDK's timeout argument
+does not cancel every custom transport or guarantee completion before Lambda's
+hard timeout, and a drained local queue does not prove tenant ingestion.
+[Sentry API semantics](https://docs.sentry.io/platforms/javascript/guides/aws-lambda/configuration/apis.md)
+describe `flush()` and `close()`.
+
+For a **compatible `Sentry.wrapHandler`**, its documented default flush is up
+to2000ms, configurable through `flushTimeout`; avoid a redundant manual flush
+when that wrapper already handles completion. Check the installed version's
+context behavior, too: `@sentry/aws-serverless`11.6.0 unconditionally assigns
+`context.callbackWaitsForEmptyEventLoop` before invoking the business handler.
+It throws on a non-extensible context lacking that removed property. Changing
+the option does not remove the assignment. Use the unwrapped form when this
+incompatibility applies; do not clone/unfreeze context or pre-add an obsolete
+property to claim compatibility. See the [wrapper documentation](https://docs.sentry.io/platforms/javascript/guides/aws-lambda/configuration/lambda-wrapper.md)
+and [versioned implementation](https://github.com/getsentry/sentry-javascript/blob/11.6.0/packages/aws-serverless/src/sdk.ts).
+
+Treat Node types and optional native profiling as migration checks. Examples
+using `Array.at` need an ES2022-or-later TypeScript `lib`; keep a host's business
+compiler target deliberate. Confirm optional profiling prebuilds against the
+actual Node ABI (Node24 uses137) only when profiling is in use; do not install an
+unused profiling package. Verify the helper with the real installed SDK and
+local transport, including success/error, timeout/false, rejected flush and a
+second warm invocation. Label local observations honestly; actual Lambda
+deployment and Sentry event ingestion require their own provider proof.
+
 **NestJS** — import `./instrument` first in `main.ts`, then add Sentry's module:
 
 ```ts

package/plugins/src/base/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -63,7 +63,9 @@ import {
 export function locate(name, exec = boundedChildOutput) {
   try {
     return String(
-      exec("command", ["-v", name], { encoding: "utf8", shell: true })
+      exec("sh", ["-c", 'command -v -- "$1"', "lisa-locate", name], {
+        encoding: "utf8",
+      })
     ).trim();
   } catch {
     // probe-direction: fail-closed — null means "not proven present", and the

package/scripts/check-shell-guard-refusal-coverage.mjs

@@ -35,9 +35,17 @@
  *   --trace-out FILE
  *                  also write the judged trace to FILE, so a later step in the
  *                  same job can read what this run observed. Never commit it.
+ *   --collect-only --shard I/3 --trace-out NEW_DIRECTORY/trace.jsonl
+ *                  collect one complete native Actions shard without judging
+ *                  its individual trace. All canonical candidates are supplied.
+ *   --merge-traces DIRECTORY --trace-out FILE
+ *                  validate all three current run/attempt shard receipts, then
+ *                  apply the original judge once to their combined trace.
+ *                  A new Actions attempt must reproduce all three shards.
  *
  * Exit codes (mirroring the sibling check-* scripts):
- *   0 — every guard the run drove was observed refusing and allowing.
+ *   0 — the judgment passed, or --collect-only retained a complete eligible
+ *       shard without judging its individual trace.
  *   1 — >=1 finding.
  *   2 — operational error: unknown flag, vitest could not run, or ZERO guards
  *       observed.
@@ -59,9 +67,15 @@ import {
   parseTrace,
   tracerIndex,
 } from "./lib/shell-guard-refusal-coverage.mjs";
+import {
+  collectShard,
+  mergeCollected,
+} from "./lib/shell-guard-shard-runner.mjs";
 
 /** The flag naming a file the produced trace should also be written to. */
 const TRACE_OUT_FLAG = "--trace-out";
+/** Collection receipts to combine before the original judgment. */
+const MERGE_TRACES_FLAG = "--merge-traces";
 
 /** Wall-clock ceiling for the traced vitest run. */
 const RUN_TIMEOUT_MS = 45 * 60_000;
@@ -233,8 +247,20 @@ function keepTrace(root, args, trace) {
  */
 export function main() {
   const args = process.argv.slice(2);
-  const known = new Set(["--json", "--trace", TRACE_OUT_FLAG]);
-  const valueFlags = new Set(["--trace", TRACE_OUT_FLAG]);
+  const known = new Set([
+    "--json",
+    "--trace",
+    TRACE_OUT_FLAG,
+    "--collect-only",
+    "--shard",
+    MERGE_TRACES_FLAG,
+  ]);
+  const valueFlags = new Set([
+    "--trace",
+    TRACE_OUT_FLAG,
+    "--shard",
+    MERGE_TRACES_FLAG,
+  ]);
   const unknown = args.find(
     (arg, at) =>
       arg.startsWith("--") &&
@@ -249,13 +275,45 @@ export function main() {
     return;
   }
   const root = process.cwd();
+  if (args.includes("--collect-only")) {
+    try {
+      collectShard(root, candidateSuites, args);
+    } catch (error) {
+      console.error(`check:shell-guard-refusal-coverage: ${String(error)}`);
+      process.exitCode = 2;
+    }
+    return;
+  }
+  if (args.includes("--shard")) {
+    console.error(
+      "check:shell-guard-refusal-coverage: --shard requires --collect-only"
+    );
+    process.exitCode = 2;
+    return;
+  }
   const population = guardPopulation(root);
   const at = args.indexOf("--trace");
   const supplied = at === -1 ? undefined : args[at + 1];
-  const produced =
-    supplied === undefined
-      ? produceTrace(root, population)
-      : { trace: readOrEmpty(root, supplied), suites: 0, ok: true, detail: "" };
+  let produced;
+  if (args.includes(MERGE_TRACES_FLAG)) {
+    try {
+      produced = mergeCollected(root, candidateSuites, args);
+    } catch (error) {
+      console.error(`check:shell-guard-refusal-coverage: ${String(error)}`);
+      process.exitCode = 2;
+      return;
+    }
+  } else {
+    produced =
+      supplied === undefined
+        ? produceTrace(root, population)
+        : {
+            trace: readOrEmpty(root, supplied),
+            suites: 0,
+            ok: true,
+            detail: "",
+          };
+  }
   if (!produced.ok) {
     console.error(`check:shell-guard-refusal-coverage: ${produced.detail}`);
     process.exitCode = 2;

package/scripts/generate-lisa-owned-hash-ledger.mjs

@@ -160,6 +160,9 @@ function git(root, args) {
  */
 export function isLisaOwned(destination) {
   return (
+    // Exact runtime-policy destination only, mirrored by the runtime predicate.
+    // Enrol historical hashes too so custom/newer host content stays protected.
+    destination === ".nvmrc" ||
     destination.startsWith(ENFORCEMENT_TREE) ||
     destination
       .split("/")