@consiliency/agent-board-cli 1.23.0 → 1.24.0

package/dist/doctor_scopes.js

@@ -55,8 +55,168 @@
 //                   user is used, and managed scopes are ranked above all.
 //   grok            unmeasured (display-only, above): ranked like codex, which it mirrors.
 //
-// Floors: plugin-contributed MCP servers and hooks (claude `enabledPlugins`, codex plugins) are
-// not read; claude's `.mcp.json` approval state and pi/grok project trust are not modelled (a
+// CCPLUGIN IF-0-CCPLUGIN-3 — claude plugins are read by a dedicated reader (`readClaudePluginScopes`),
+// not a `ScopeRow`. SL-2.0 measured it with `claude plugin list --json`, `plugin install/enable/
+// disable --scope …` and `claude mcp get` (which spawns the server, so a marker command shows
+// WHICH tree ran), in temp `HOME`/`CLAUDE_CONFIG_DIR`s, claude 2.1.283 on dev0, 2026-09-26:
+//   enable       `enabledPlugins` is per plugin id, local > project > user, the highest scope that
+//                holds a BOOLEAN wins (all 18 user/project/local combinations of true/false/absent
+//                measured). A non-boolean (`["1.31.0"]`, `"true"`, `1`, `null`, `{}`) defines
+//                nothing: `plugin list` shows it disabled at user scope and the user value
+//                standing under a local one. Managed settings are ranked above all (inferred: not
+//                writable without root).
+//   row          `installed_plugins.json` is `{version: 2, plugins: {<id>: [row…]}}`, a row
+//                `{scope, installPath, version, installedAt, lastUpdated, gitCommitSha?,
+//                projectPath?}` (`projectPath` on local and project rows). AMENDS the plan: the
+//                loaded row is NOT the one whose scope matches the winning enable. It is the FIRST
+//                row, in array order, that applies to the cwd — scope user/managed, or a
+//                `projectPath` equal to the cwd or in the same git repository (the binary's
+//                `uw`). Measured by reordering rows: [user, local(cwd)] loads the user row's tree
+//                in the local row's own project; [local(cwd), user] loads the local one. Claude
+//                skips a first row whose path fails its own trust check and takes the next; doctor
+//                stops there with `plugin_path_untrusted` instead (stricter, deliberately).
+//   source       a github marketplace source is `{source:"github", repo, ref?, path?,
+//                sparsePaths?, skipLfs?}`, identical in `extraKnownMarketplaces` and
+//                `known_marketplaces.json` (measured: `marketplace add anthropics/claude-code@main`).
+//                There is no marketplace-level `sha`; that is the plugin-entry source's, and the
+//                installed row carries `gitCommitSha`. `source_ref` is `ref`. Repos compare
+//                case-insensitively, as the binary's own matcher does.
+//   tree         a github-sourced plugin runs from its row's `installPath` in the cache (measured:
+//                editing the cached `plugin.json` changed what ran, the marketplace clone's did
+//                not). A DIRECTORY-sourced plugin runs from the source directory, not the cache
+//                (editing the source without reinstalling changed what ran). Ours never has a
+//                directory source; for a FOREIGN directory plugin this is a floor: doctor reads
+//                the cache copy, which may not be what runs.
+//   auto-update  off globally when `DISABLE_UPDATES` or `DISABLE_AUTOUPDATER` is truthy
+//                (1/true/yes/on), `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` is non-empty, or
+//                `.claude.json` has `autoUpdates: false` (unless `installMethod` is native and
+//                `autoUpdatesProtectedForNative`); `FORCE_AUTOUPDATE_PLUGINS` lifts that gate.
+//                Then per marketplace: the highest settings scope DECLARING it (its `autoUpdate`,
+//                if boolean), else `known_marketplaces.json`, else a default that is on only for
+//                official names (read from the binary, not run). Floor: the binary reads a repo
+//                scope's (project/local) declaration only behind an internal gate doctor cannot
+//                see; doctor counts it. Env inputs are as doctor sees them.
+//
+//   disabled     `.claude.json` `projects[<key>].disabledMcpServers` turns a server off in ONE project
+//                (measured 2026-09-26, `claude mcp get`/`mcp list` with marker commands: the
+//                disabled server shows "Disabled for this project" and is never spawned). `<key>`
+//                is the git root of the cwd's REALPATH, else that realpath: a subdirectory and a
+//                symlinked cwd are covered, a key naming the subdirectory itself is not, and a
+//                non-git parent's key does not reach a child. Entries match the server name
+//                EXACTLY (case- and space-sensitive); non-string entries are skipped and a
+//                non-array list is ignored. It disables a user, local or project (`.mcp.json`)
+//                server of that name, and a PLUGIN server by `plugin:<plugin>:<server>` (the bare
+//                server name or `plugin:<plugin>` does not). A LOCAL server
+//                (`projects[<key>].mcpServers`) is keyed the same way (measured: a local server
+//                under the root key runs in a subdirectory), so every `.claude.json` `projects`
+//                read goes through `claudeProjectKey` (pinned by DM-8's source scan).
+//   handlers     (panel B2; read from the binary's hook schema and executors, not run) a hook
+//                handler's `type` is `command`, `http`, `prompt`, `agent` or `mcp_tool`.
+//                FileChanged runs through the outside-REPL executor, which runs command, http and
+//                mcp_tool handlers and refuses prompt and agent ("not yet supported outside
+//                REPL"). SessionStart runs through the main executor, where prompt and agent run
+//                when a conversation context exists (refused otherwise, and agent always on
+//                PermissionRequest). Stop, PreToolUse and UserPromptSubmit run all five. Doctor
+//                keeps EVERY handler: our plugin must be exactly the frozen set (both events, one
+//                command handler each, nothing else of any type on any event), and ANY non-command
+//                handler on SessionStart or FileChanged, in any scope, makes registration
+//                undetermined (`unjudgeable_hook`) — conservatively including a prompt/agent one
+//                on FileChanged that the binary refuses. Its url, prompt, server or tool is never
+//                kept, so never echoed. Floor: what such a handler does is not judged.
+//   hook policy  (round-2 F027/F028) MEASURED with `claude --init-only` ("Run Setup and
+//                SessionStart:startup hooks, then exit": no model, no credentials in the temp
+//                config), 2.1.283, 2026-09-26, marker-writing SessionStart hooks in user settings
+//                and a directory plugin: `disableAllHooks: true` in user, project OR local
+//                settings stops every settings and plugin hook; the highest scope holding a
+//                boolean wins (local false over user true → hooks run); `allowManagedHooksOnly`
+//                and `strictPluginOnlyCustomization` outside managed settings change nothing;
+//                `CLAUDE_CODE_SAFE_MODE` or `CLAUDE_CODE_SIMPLE` truthy stops them all (`0` does
+//                not). MANAGED settings need root, so their rules are READ from the binary (hook
+//                loader and plugin-hook gate), not run: managed `disableAllHooks` → no hooks;
+//                managed `allowManagedHooksOnly`, safe mode, or a non-managed `disableAllHooks` →
+//                managed settings hooks only, and plugin hooks only from plugins managed
+//                `enabledPlugins` enables (none in safe mode); managed
+//                `strictPluginOnlyCustomization` (true, or listing "hooks") → settings hooks from
+//                managed settings only, plugins unaffected. Doctor applies this BEFORE counting:
+//                a wake hook the policy switches off is `hooks_disabled_by_policy` (a failure,
+//                never a pass). The binary takes the managed-plugin set from managed
+//                `prependPlugins`/`appendPlugins` when present; doctor cannot evaluate that, so a
+//                restricted policy with either is undetermined (`hook_policy_unjudgeable`).
+//                Floors: `--safe-mode` and `--bare` on a launch's argv are invisible (env only,
+//                as doctor sees it); a settings file the binary rejects as invalid is dropped
+//                whole by it and read by doctor.
+//   managed tier (round-3 N1, evidence-first per the owner; READ from the 2.1.283 binaries —
+//                linux-x64, darwin-arm64 and win32-x64 packages — not run) the managed tier is ONE
+//                source, first-wins: server-managed > MDM > the managed-settings file (+ `.d`).
+//                Doctor looks for EVIDENCE of each non-file source and never reads its content:
+//                - remote: `<config home>/remote-settings.json` (`TJ()`; the config home is
+//                  `CLAUDE_CONFIG_DIR` or `~/.claude`; no env override). A planted file did not
+//                  change `--init-only` in a temp config with no account (measured): it is
+//                  honoured only for an eligible account. (`JE()` names a
+//                  `CLAUDE_CODE_REMOTE_SETTINGS_PATH` override in a log line, but returns
+//                  undefined in 2.1.283: compiled out.)
+//                - remote, storage-v5 (round 4): with the v5 backend on (`N()`), the payload is
+//                  written to the state store, `Re.state("remote-settings")` = namespace `state`,
+//                  id `remote-settings`, and the signed-cache sidecars
+//                  `remote-settings.json.signature.json` / `.signature-iat.json` go beside the
+//                  json path. The config home lists `state` and `storage-v2`, but the store's
+//                  exact on-disk name (file or directory, extension) is NOT recoverable from
+//                  strings, so doctor probes every candidate — `state/remote-settings[.json]`,
+//                  `storage-v2/state/remote-settings[.json]` (source `remote_settings_state`) — and
+//                  both sidecars (`remote_settings_signature`); any present is evidence. Whether v5
+//                  is on is decided at runtime by a server-served flag (`tengu_hover_rest`, pinned
+//                  once per process), so its default cannot be told from the binary.
+//                - macOS: `/Library/Managed Preferences/<login>/com.anthropic.claudecode.plist`
+//                  ("per-user managed preferences", login = `os.userInfo().username`) and
+//                  `/Library/Managed Preferences/com.anthropic.claudecode.plist` ("device-level");
+//                  the binary converts them with `/usr/bin/plutil`. Existence only. No login name
+//                  (os.userInfo() throws or gives none) → `managed_policy_check_failed:login_unavailable`,
+//                  never a silent skip.
+//                - Windows: `%SYSTEMROOT%\System32\reg.exe query <key> /v Settings` (default
+//                  `C:\Windows`) for `HKLM\SOFTWARE\Policies\ClaudeCode` and
+//                  `HKCU\SOFTWARE\Policies\ClaudeCode`, 5 s timeout. Doctor runs the same query
+//                  (argv array, no shell): exit 0 → evidence; reg's "unable to find" → none (the
+//                  binary's own test); anything else, a timeout or no reg.exe →
+//                  `managed_policy_check_failed:<reg_failed|reg_timeout|reg_unavailable>`.
+//                - WSL (the binary's test: `WSL_DISTRO_NAME`, or /proc/version naming microsoft or
+//                  wsl): Windows policy is inherited only when an ADMIN Windows source sets
+//                  `wslInheritsWindowsSettings` — `/mnt/c/Program Files/ClaudeCode/managed-settings.json`
+//                  (+ `.d`) or HKLM, queried through `/mnt/c/Windows/System32/reg.exe` when present.
+//                  Evidence of either → the tier is replaced; HKCU alone cannot apply on WSL and is
+//                  not probed; no interop reg.exe → HKLM is not queried (the binary cannot either).
+//                Evidence (or a probe that cannot finish) → the managed FILE tier contributes no
+//                policy, hooks or servers, and registration is `hook_policy_unjudgeable` (or the
+//                check-failed code) unless a failure outside it stands. No evidence → judged
+//                normally. The `managed_policy` report field and its one text line say what was
+//                checked; they never change the exit code. The managed-settings directory
+//                defaults to the binary's per platform (`Zh()`): `/etc/claude-code`,
+//                `/Library/Application Support/ClaudeCode`, `C:\Program Files\ClaudeCode`.
+//                Floors: a macOS profile delivering settings under another domain, a storage-v5
+//                layout other than the probed candidates, and a plist's, key's or store's
+//                CONTENT are not read — presence is the whole signal. `scripts/check-child-argv-credentials.mjs`
+//                passes but does not inspect this call: its program is a variable, which that
+//                checker skips (probed: a planted credential in this argv still scanned clean).
+//   trust        the binary skips hook execution when the workspace trust dialog is not
+//                accepted (`Tie()`); doctor does not read trust (floor).
+//   matchers     (round-2 F029) a group's `matcher` filters: on SessionStart the start source
+//                (measured: "resume" did not fire on startup; "" and "*" did), on FileChanged
+//                basename(file_path), where it also adds static watch paths (binary). Our frozen
+//                groups carry none (absent or ""); a settings or foreign wake hook with any other
+//                matcher is `unjudgeable_hook`.
+//   freeze       (F025) our hooks are compared on type, command, matcher, and the exact handler
+//                and group key NAMES: FileChanged `{type, command, asyncRewake: true}`,
+//                SessionStart `{type, command}`, so a `timeout`, `if`, `statusMessage` or a
+//                SessionStart `asyncRewake` is a mismatch. Floor: the hook script's bytes are not
+//                hashed (a github source of our repository is trusted by source).
+//   disabled vs identity (panel S4, intended): the foreign-plugin and stanza checks read a
+//                plugin's declared tree whether or not `disabledMcpServers` turns its server off
+//                here. What a plugin IS does not depend on one project's switch; only the
+//                registration count and the pin (which need a launched server) honour it.
+//
+// Floors: codex plugins are not read; a plugin's `userConfig`, managed servers under
+// `disabledMcpServers` (unmeasured, so never excluded), and an `--add-dir`/`--settings` layer are
+// not modelled; claude's `.mcp.json`
+// approval state and pi/grok project trust are not modelled (a
 // project entry is counted as loaded); opencode's `OPENCODE_CONFIG`/`OPENCODE_CONFIG_DIR` are not
 // read; `managed-mcp.json`'s exclusive-control mode is not modelled; `claude mcp get` still showed
 // a local entry carrying `disabled: true`, so doctor's reading of that field as "not launched" is
@@ -65,16 +225,46 @@
 // Config text is DATA. Every object the readers build has a null prototype and every lookup is an
 // own-property lookup; a `__proto__`, `constructor` or `prototype` key makes the file unparseable
 // (round 1, Astra 1: `[__proto__.mcp_servers.x]` used to write onto `Object.prototype`).
+import { spawnSync } from "node:child_process";
 import * as nodeFs from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 export const BOARD_MCP_MARKER = "agent-board-mcp";
 export const METADATA_ONLY_FLAG = "--metadata-only";
 export const OPENCODE_PLUGIN_PACKAGE = "@consiliency/agent-board-opencode";
 export const PI_PACKAGE = "npm:@consiliency/agent-board-pi";
 /** Claude Code events that each need exactly one `wake-hook.sh` hook (`docs/local-wake-signal.md`). */
 export const CLAUDE_REQUIRED_HOOK_EVENTS = Object.freeze(["SessionStart", "FileChanged"]);
+/** A wake hook is a command with a token whose BASENAME is this (see `namesWakeHook`). */
 export const WAKE_HOOK_MARKER = "wake-hook.sh";
 const WRAPPER_MAX_BYTES = 64 * 1024;
+// IF-0-CCPLUGIN-1, as frozen on outcome B (`plans/CCPLUGIN-SPIKE.md`). SL-1's manifest check owns
+// the plugin tree; these are the same frozen strings, read from the plan, not from its files.
+export const CLAUDE_PLUGIN_ID = "agent-board@message-board";
+export const CLAUDE_PLUGIN_MARKETPLACE = "message-board";
+/** Compared lower-cased, as Claude Code compares repos. */
+export const CLAUDE_PLUGIN_REPO = "consiliency/message-board";
+export const CLAUDE_PLUGIN_SERVER = "agent-board";
+export const CLAUDE_PLUGIN_MCP_PACKAGE = "@consiliency/agent-board-mcp";
+/** The SL-0 outcome: `B` = the FileChanged hook carries `asyncRewake: true`. */
+export const CLAUDE_WAKE_SHAPE = "B";
+export const CLAUDE_PLUGIN_HOOK_COMMANDS = Object.freeze({
+    SessionStart: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/wake-hook.sh\" SessionStart",
+    FileChanged: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/wake-hook.sh\" FileChanged",
+});
+/** The stanza a plugin of version `version` must carry: the pin IS the plugin version. */
+export function claudePluginStanza(version) {
+    return { command: "npx", args: ["-y", `${CLAUDE_PLUGIN_MCP_PACKAGE}@${version}`, "--harness", "claude"] };
+}
+/**
+ * Whether a hook command names the wake hook. The tokenizer is frozen: split on whitespace, strip
+ * quotes, no comment handling; a token matches when its basename is exactly `wake-hook.sh`, so
+ * `codex-wake-hook.sh` does not. Floor: a hook that never names the basename is invisible.
+ */
+export function namesWakeHook(command) {
+    // Quotes are removed by split/join, not a regex: a quote inside a regex literal desyncs the
+    // comment/literal stripper that the #403 class checks run over this file.
+    return command.split(/\s+/).some((token) => token.split("\"").join("").split("'").join("").split("/").pop() === WAKE_HOOK_MARKER);
+}
 const missing = (error) => {
     const code = error.code;
     return code === "ENOENT" || code === "ENOTDIR";
@@ -120,6 +310,16 @@ export const nodeRegistrationFs = {
             return false;
         }
     },
+    realpath(path) {
+        try {
+            return nodeFs.realpathSync(path);
+        }
+        catch (error) {
+            if (missing(error))
+                return null;
+            throw error;
+        }
+    },
     getuid: () => process.getuid?.() ?? -1,
 };
 // ---------------------------------------------------------------------------------------------
@@ -425,6 +625,8 @@ export function parseRestrictedToml(text) {
             fail("trailing characters");
     }
 }
+/** A `type: "command"` handler with a command: the only kind doctor can judge. */
+const isCommand = (hook) => hook.type === "command" && hook.command !== null;
 const empty = () => ({ mcp: [], hooks: Object.create(null), packages: [] });
 const isObject = (value) => !!value && typeof value === "object" && !Array.isArray(value);
 /** Judge-relevant fields of one entry, from its own fields only. */
@@ -473,10 +675,22 @@ function hooksFrom(settings) {
             const hooks = isObject(group) ? own(group, "hooks") : undefined;
             if (!Array.isArray(hooks))
                 throw new UnparseableConfigError(`hooks.${event} has a group with no hooks array`);
+            // EVERY handler is kept, whatever its type: an http/mcp_tool/prompt/agent handler still
+            // runs (panel B2), so dropping it would hide it from the exact-set and unjudgeable checks.
+            const matcher = own(group, "matcher");
             for (const hook of hooks) {
+                if (!isObject(hook))
+                    throw new UnparseableConfigError(`hooks.${event} has a handler that is not an object`);
+                const type = own(hook, "type");
                 const command = own(hook, "command");
-                if (isObject(hook) && typeof command === "string")
-                    (out[event] ??= []).push(command);
+                (out[event] ??= []).push({
+                    type: typeof type === "string" ? type : "",
+                    command: type === "command" && typeof command === "string" ? command : null,
+                    asyncRewake: own(hook, "asyncRewake") === true,
+                    hasMatcher: matcher !== undefined && matcher !== "",
+                    handlerKeys: Object.keys(hook).sort(),
+                    groupKeys: Object.keys(group).sort(),
+                });
             }
         }
     }
@@ -563,7 +777,7 @@ export const HARNESS_CONFIG_SCOPES = Object.freeze({
             extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcpServers"), "claude") }) }),
         row({ name: "claude_local_mcp", parser: "json", rank: 30, paths: (ctx) => [claudeJsonPath(ctx)],
             extract: (doc, ctx) => {
-                const project = own(own(doc, "projects"), resolve(ctx.cwd));
+                const project = own(own(doc, "projects"), claudeProjectKey(ctx));
                 return { ...empty(), mcp: mcpFromMap(own(project, "mcpServers"), "claude") };
             } }),
         row({ name: "claude_project_mcp", parser: "json", rank: 20, paths: (ctx) => [join(ctx.cwd, ".mcp.json")],
@@ -636,6 +850,494 @@ function opencodeContribution(doc) {
     return { ...empty(), mcp: mcpFromMap(own(doc, "mcp"), "opencode"), packages: packageSpecs(own(doc, "plugin"), "plugin") };
 }
 // ---------------------------------------------------------------------------------------------
+// Claude Code plugins (IF-0-CCPLUGIN-3; the measurements are in the header)
+// ---------------------------------------------------------------------------------------------
+/** Synthetic row names: authored, so no plugin id, marketplace name or path reaches a reason. */
+export const CLAUDE_PLUGIN_ROW = "claude_plugin";
+export const CLAUDE_FOREIGN_PLUGIN_ROW = "claude_plugin_foreign";
+const INSTALLED_PLUGINS_SCHEMA = 2;
+// Managed (admin) policy sources other than the managed-settings file, exactly as Claude Code
+// 2.1.283 reads them (strings of the linux-x64, darwin-arm64 and win32-x64 binaries; read, not
+// run; see the header's `managed tier`). Doctor looks for EVIDENCE of each and never reads content.
+export const CLAUDE_REMOTE_SETTINGS_FILE = "remote-settings.json";
+/**
+ * Storage-v5 (round 4): the binary writes the server-managed payload to its state store
+ * (`Re.state("remote-settings")`, a `state` namespace in the config home) and a signed-cache
+ * sidecar beside the json path. The store's exact on-disk name is not recoverable from strings,
+ * so every candidate is probed; any one present is evidence.
+ */
+export const CLAUDE_REMOTE_SETTINGS_STATE_CANDIDATES = Object.freeze([
+    join("state", "remote-settings"), join("state", "remote-settings.json"),
+    join("storage-v2", "state", "remote-settings"), join("storage-v2", "state", "remote-settings.json"),
+]);
+export const CLAUDE_REMOTE_SETTINGS_SIDECARS = Object.freeze([
+    "remote-settings.json.signature.json", "remote-settings.json.signature-iat.json",
+]);
+export const MACOS_MANAGED_PREFERENCES = "/Library/Managed Preferences";
+export const MACOS_POLICY_PLIST = "com.anthropic.claudecode.plist";
+export const WINDOWS_POLICY_KEYS = Object.freeze({
+    hklm: "HKLM\\SOFTWARE\\Policies\\ClaudeCode",
+    hkcu: "HKCU\\SOFTWARE\\Policies\\ClaudeCode",
+});
+export const WINDOWS_POLICY_VALUE = "Settings";
+/** Where WSL's Windows interop puts reg.exe; the binary reads HKLM policy through this path. */
+export const WSL_REG_EXE = "/mnt/c/Windows/System32/reg.exe";
+export const WSL_WINDOWS_MANAGED_DIR = "/mnt/c/Program Files/ClaudeCode";
+const REG_TIMEOUT_MS = 5000;
+/**
+ * The binary's own query: `reg query <key> /v Settings`, an argv array, no shell, 5 s. Exit 0 →
+ * the value is there; reg's "unable to find" → not there (the binary's own test); anything else —
+ * no reg.exe, a timeout, another failure — is an error, never "absent".
+ */
+export function regQueryWith(timeoutMs) {
+    return (regExe, key) => {
+        const result = spawnSync(regExe, ["query", key, "/v", WINDOWS_POLICY_VALUE], {
+            encoding: "utf8", timeout: timeoutMs, windowsHide: true, stdio: ["ignore", "pipe", "pipe"],
+        });
+        if (result.error) {
+            return { kind: "error", cause: result.error.code === "ETIMEDOUT" ? "reg_timeout" : "reg_unavailable" };
+        }
+        if (result.signal !== null)
+            return { kind: "error", cause: "reg_timeout" };
+        if (result.status === 0)
+            return { kind: "present" };
+        return /unable to find/i.test(`${result.stdout ?? ""}${result.stderr ?? ""}`) ? { kind: "absent" } : { kind: "error", cause: "reg_failed" };
+    };
+}
+export const nodeRegQuery = regQueryWith(REG_TIMEOUT_MS);
+/** The binary's WSL test: `WSL_DISTRO_NAME`, or /proc/version naming microsoft or wsl. */
+function onWsl(ctx) {
+    if (ctx.env.WSL_DISTRO_NAME)
+        return true;
+    const version = (ctx.fs.readFile("/proc/version") ?? "").toLowerCase();
+    return version.includes("microsoft") || version.includes("wsl");
+}
+export function probeManagedPolicy(ctx) {
+    const checked = [];
+    const evidence = [];
+    const errors = [];
+    const present = (name, path) => {
+        checked.push(name);
+        if (ctx.fs.exists(path))
+            evidence.push(name);
+    };
+    const registry = (name, regExe, key) => {
+        checked.push(name);
+        const outcome = (ctx.regQuery ?? nodeRegQuery)(regExe, key);
+        if (outcome.kind === "present")
+            evidence.push(name);
+        else if (outcome.kind === "error")
+            errors.push(outcome.cause);
+    };
+    const anyOf = (name, paths) => {
+        checked.push(name);
+        if (paths.some((path) => ctx.fs.exists(path)))
+            evidence.push(name);
+    };
+    const home = claudeUserDir(ctx);
+    present("remote_settings", join(home, CLAUDE_REMOTE_SETTINGS_FILE));
+    anyOf("remote_settings_state", CLAUDE_REMOTE_SETTINGS_STATE_CANDIDATES.map((relative) => join(home, relative)));
+    anyOf("remote_settings_signature", CLAUDE_REMOTE_SETTINGS_SIDECARS.map((relative) => join(home, relative)));
+    const platform = ctx.platform ?? "linux";
+    if (platform === "darwin") {
+        // No login name → the per-user plist cannot be located: an unfinished probe, never a skip.
+        if (ctx.userName)
+            present("macos_user_plist", join(MACOS_MANAGED_PREFERENCES, ctx.userName, MACOS_POLICY_PLIST));
+        else {
+            checked.push("macos_user_plist");
+            errors.push("login_unavailable");
+        }
+        present("macos_device_plist", join(MACOS_MANAGED_PREFERENCES, MACOS_POLICY_PLIST));
+        return { checked, evidence, errors, unreadableSourcesPossible: true, platformLabel: "macOS" };
+    }
+    if (platform === "win32") {
+        const regExe = `${ctx.env.SYSTEMROOT || "C:\\Windows"}\\System32\\reg.exe`;
+        registry("windows_hklm", regExe, WINDOWS_POLICY_KEYS.hklm);
+        registry("windows_hkcu", regExe, WINDOWS_POLICY_KEYS.hkcu);
+        return { checked, evidence, errors, unreadableSourcesPossible: true, platformLabel: "Windows" };
+    }
+    if (onWsl(ctx)) {
+        // WSL inherits Windows policy only when an ADMIN Windows source enables it (HKLM or the
+        // Program Files file); HKCU alone cannot, so it is not probed here.
+        present("wsl_program_files_settings", join(WSL_WINDOWS_MANAGED_DIR, "managed-settings.json"));
+        present("wsl_program_files_settings_d", join(WSL_WINDOWS_MANAGED_DIR, "managed-settings.d"));
+        if (ctx.fs.exists(WSL_REG_EXE))
+            registry("wsl_windows_hklm", WSL_REG_EXE, WINDOWS_POLICY_KEYS.hklm);
+        return { checked, evidence, errors, unreadableSourcesPossible: true, platformLabel: "WSL" };
+    }
+    return { checked, evidence, errors, unreadableSourcesPossible: false, platformLabel: "Linux" };
+}
+/** The binary's `Le`: an env flag is on when it is 1/true/yes/on. */
+const truthyFlag = (value) => value !== undefined && ["1", "true", "yes", "on"].includes(value.toLowerCase().trim());
+/** Evidence of (or an unfinished probe for) a tier that replaces the managed settings FILE. */
+export const managedFileTierReplaced = (probe) => probe.evidence.length > 0 || probe.errors.length > 0;
+function claudeHookPolicy(ctx, allLayers, probe) {
+    // The caller drops the managed FILE layers when a tier doctor cannot read replaces them (round-4
+    // codex: one filter, at the read, for every consumer); this function only reports the fact.
+    const managedTierUnreadable = managedFileTierReplaced(probe);
+    const layers = allLayers;
+    // The highest layer holding a boolean wins (measured for disableAllHooks: local false over user true).
+    const lastBoolean = (key, only) => {
+        let value;
+        for (const layer of layers) {
+            if (only === "managed" && !layer.managed)
+                continue;
+            const candidate = own(layer.document, key);
+            if (typeof candidate === "boolean")
+                value = candidate;
+        }
+        return value;
+    };
+    const managedIds = new Set();
+    let strict;
+    let unjudgeable = false;
+    for (const layer of layers) {
+        if (!layer.managed)
+            continue;
+        const enabled = own(layer.document, "enabledPlugins");
+        if (isObject(enabled)) {
+            for (const id of Object.keys(enabled)) {
+                // As the binary merges managed documents (read, not run): its schema takes a boolean, a
+                // version array or an object here, and reads anything else as UNSET, so a later string,
+                // number or null leaves the earlier value standing. A valid non-true value replaces it,
+                // and `eb()` counts only a literal true.
+                const value = own(enabled, id);
+                if (value === true && id.includes("@"))
+                    managedIds.add(id);
+                else if (value === false || Array.isArray(value) || isObject(value))
+                    managedIds.delete(id);
+            }
+        }
+        const value = own(layer.document, "strictPluginOnlyCustomization");
+        if (value !== undefined)
+            strict = value;
+        if (own(layer.document, "prependPlugins") !== undefined || own(layer.document, "appendPlugins") !== undefined)
+            unjudgeable = true;
+    }
+    const managedDisableAll = lastBoolean("disableAllHooks", "managed") === true;
+    const managedOnly = lastBoolean("allowManagedHooksOnly", "managed") === true;
+    const anyDisableAll = lastBoolean("disableAllHooks") === true;
+    const safeMode = truthyFlag(ctx.env.CLAUDE_CODE_SAFE_MODE);
+    const bare = truthyFlag(ctx.env.CLAUDE_CODE_SIMPLE);
+    const strictHooks = strict === true || (Array.isArray(strict) && strict.includes("hooks"));
+    const managedPluginIds = managedIds;
+    if (bare || managedDisableAll)
+        return { settings: "none", plugins: "none", managedPluginIds, unjudgeable: false, managedTierUnreadable, probe };
+    const settings = managedOnly || safeMode || strictHooks || anyDisableAll ? "managed_only" : "all";
+    const plugins = safeMode ? "none" : managedOnly || anyDisableAll ? "managed_only" : "all";
+    return { settings, plugins, managedPluginIds, unjudgeable: unjudgeable && plugins === "managed_only", managedTierUnreadable, probe };
+}
+class UntrustedPluginPathError extends Error {
+}
+const claudePluginsDir = (ctx) => join(claudeUserDir(ctx), "plugins");
+/** Settings files that carry `enabledPlugins`/`extraKnownMarketplaces`, in ascending precedence. */
+const claudeSettingsLayers = (ctx) => [
+    join(claudeUserDir(ctx), "settings.json"),
+    join(ctx.cwd, ".claude", "settings.json"),
+    join(ctx.cwd, ".claude", "settings.local.json"),
+    ...managedSettingsPaths(ctx),
+];
+const within = (path, root) => path.startsWith(root.endsWith(sep) ? root : root + sep);
+/** The git repository root at or above `dir`, or null outside one. */
+function gitRootOf(dir, fs) {
+    const walked = walkToGitRoot(dir, fs);
+    const top = walked[walked.length - 1];
+    return fs.exists(join(top, ".git")) ? top : null;
+}
+/**
+ * Claude Code's row applicability (`uw`): user/managed rows everywhere, a project's rows in its
+ * repository. Measured from a symlinked cwd (panel S2): Claude's cwd is the REALPATH, while the
+ * row's `projectPath` is compared as recorded — a projectPath that is itself a symlink never
+ * applies, even from that symlink.
+ */
+function rowApplies(row, ctx) {
+    const scope = own(row, "scope");
+    if (scope === "user" || scope === "managed")
+        return true;
+    const projectPath = own(row, "projectPath");
+    if (typeof projectPath !== "string" || projectPath === "")
+        return false;
+    const cwd = ctx.fs.realpath(ctx.cwd) ?? resolve(ctx.cwd);
+    if (resolve(projectPath) === cwd)
+        return true;
+    const root = gitRootOf(cwd, ctx.fs);
+    return root !== null && gitRootOf(resolve(projectPath), ctx.fs) === root;
+}
+function readJsonFile(fs, path) {
+    const text = fs.readFile(path);
+    return text === null ? null : parseJson(text);
+}
+const truthyEnv = (value) => value !== undefined && ["1", "true", "yes", "on"].includes(value.toLowerCase().trim());
+/** `source` names a github marketplace of this repository, with no alternate manifest path. */
+function isOurMarketplaceSource(source) {
+    const repo = own(source, "repo");
+    return isObject(source) && own(source, "source") === "github" && typeof repo === "string"
+        && repo.toLowerCase() === CLAUDE_PLUGIN_REPO && own(source, "path") === undefined;
+}
+/**
+ * Reads one plugin tree, confined to the cache. `installPath` must resolve (realpath) strictly
+ * inside `<configDir>/plugins/cache/`, and so must every file read under it, else
+ * `UntrustedPluginPathError` and nothing beyond it is read: the only call made on an untrusted
+ * path is the `realpath` that judged it.
+ */
+function readPluginTree(ctx, installPath, serverPrefix) {
+    if (!isAbsolute(installPath))
+        throw new UntrustedPluginPathError();
+    const cache = ctx.fs.realpath(join(claudePluginsDir(ctx), "cache"));
+    const root = cache === null ? null : ctx.fs.realpath(installPath);
+    if (cache === null || root === null || !within(root, cache))
+        throw new UntrustedPluginPathError();
+    const confined = (relative) => {
+        const lexical = resolve(root, relative);
+        if (!within(lexical, root))
+            throw new UntrustedPluginPathError();
+        const real = ctx.fs.realpath(lexical);
+        if (real !== null && !within(real, root))
+            throw new UntrustedPluginPathError();
+        return real;
+    };
+    // Each file is read at most once: a manifest naming the default file (`"hooks":
+    // "./hooks/hooks.json"`) must not count its hooks twice.
+    const consumed = new Set();
+    const readConfined = (relative) => {
+        const real = confined(relative);
+        if (real === null || consumed.has(real))
+            return null;
+        consumed.add(real);
+        return readJsonFile(ctx.fs, real);
+    };
+    const manifest = readConfined(join(".claude-plugin", "plugin.json")) ?? dict();
+    const contribution = empty();
+    const addServers = (map) => {
+        for (const entry of mcpFromMap(map, "claude"))
+            contribution.mcp.push({ ...entry, name: `${serverPrefix}:${entry.name}` });
+    };
+    const serversIn = (document) => own(document, "mcpServers") ?? document;
+    const addHooks = (document) => {
+        const hooks = hooksFrom(isObject(own(document, "hooks")) ? document : overlay({ hooks: document }));
+        for (const event of Object.keys(hooks))
+            (contribution.hooks[event] ??= []).push(...hooks[event]);
+    };
+    // A manifest field is an inline object, a path relative to the plugin root, or a list of either.
+    const eachDeclared = (value, field, add, inline) => {
+        if (value === undefined)
+            return;
+        for (const item of Array.isArray(value) ? value : [value]) {
+            if (typeof item === "string") {
+                const document = readConfined(item);
+                if (document !== null)
+                    add(document);
+            }
+            else if (isObject(item))
+                inline(item);
+            else
+                throw new UnparseableConfigError(`plugin ${field} is neither a path nor an object`);
+        }
+    };
+    eachDeclared(own(manifest, "mcpServers"), "mcpServers", (document) => addServers(serversIn(document)), addServers);
+    const dotMcp = readConfined(".mcp.json");
+    if (dotMcp !== null)
+        addServers(serversIn(dotMcp));
+    const hooksFile = readConfined(join("hooks", "hooks.json"));
+    if (hooksFile !== null)
+        addHooks(hooksFile);
+    eachDeclared(own(manifest, "hooks"), "hooks", addHooks, addHooks);
+    return { contribution, manifest };
+}
+/**
+ * One handler, exactly as frozen (round-2 F025/F029): type `command`, the frozen command, no
+ * filtering matcher, `asyncRewake: true` on FileChanged and ABSENT on SessionStart, and no other
+ * handler or group field (so a `timeout`, `if` or `statusMessage` is a mismatch too).
+ */
+function matchesFrozenHandler(event, hook) {
+    const handlerKeys = event === "FileChanged" && CLAUDE_WAKE_SHAPE === "B" ? ["asyncRewake", "command", "type"] : ["command", "type"];
+    return isCommand(hook) && hook.command === CLAUDE_PLUGIN_HOOK_COMMANDS[event]
+        && !hook.hasMatcher && hook.groupKeys.every((key) => key === "hooks" || key === "matcher")
+        && JSON.stringify(hook.handlerKeys) === JSON.stringify(handlerKeys)
+        && (handlerKeys.includes("asyncRewake") ? hook.asyncRewake : true);
+}
+function sameKeys(value, keys) {
+    return isObject(value) && Object.keys(value).sort().join("\n") === [...keys].sort().join("\n");
+}
+/** Ours carries exactly the frozen stanza, derived from its own `version`, and exactly the frozen hooks. */
+function oursMatchesFreeze(contribution, version) {
+    if (version === null)
+        return false;
+    const expected = claudePluginStanza(version);
+    const servers = contribution.mcp;
+    const stanzaOk = servers.length === 1
+        && servers[0].name.endsWith(`:${CLAUDE_PLUGIN_SERVER}`)
+        && sameKeys(servers[0].fields, ["command", "args"])
+        && own(servers[0].fields, "command") === expected.command
+        && JSON.stringify(own(servers[0].fields, "args")) === JSON.stringify(expected.args);
+    // Exactly the frozen set: both events, one command handler each, and no other handler of any
+    // type on any event (panel B2a, S3).
+    const events = Object.keys(contribution.hooks).filter((event) => contribution.hooks[event].length > 0).sort();
+    const hooksOk = JSON.stringify(events) === JSON.stringify(Object.keys(CLAUDE_PLUGIN_HOOK_COMMANDS).sort())
+        && events.every((event) => contribution.hooks[event].length === 1 && matchesFrozenHandler(event, contribution.hooks[event][0]));
+    return stanzaOk && hooksOk;
+}
+function claudeAutoUpdate(ctx, declarations, known) {
+    const envDisabled = truthyEnv(ctx.env.DISABLE_UPDATES) || truthyEnv(ctx.env.DISABLE_AUTOUPDATER)
+        || !!ctx.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC;
+    let claudeJson;
+    try {
+        claudeJson = readJsonFile(ctx.fs, claudeJsonPath(ctx));
+    }
+    catch (error) {
+        if (!(error instanceof UnparseableConfigError))
+            throw error;
+        return { effective: false, source: "undetermined" };
+    }
+    const configDisabled = own(claudeJson, "autoUpdates") === false
+        && !(own(claudeJson, "installMethod") === "native" && own(claudeJson, "autoUpdatesProtectedForNative") === true);
+    if ((envDisabled || configDisabled) && !truthyEnv(ctx.env.FORCE_AUTOUPDATE_PLUGINS)) {
+        return { effective: false, source: envDisabled ? "env_disabled" : "config_disabled" };
+    }
+    // The highest settings scope that declares the marketplace replaces the lower ones whole.
+    const fromSettings = declarations.length > 0 ? own(declarations[declarations.length - 1], "autoUpdate") : undefined;
+    if (typeof fromSettings === "boolean")
+        return { effective: fromSettings, source: "settings" };
+    const fromKnown = own(own(known, CLAUDE_PLUGIN_MARKETPLACE), "autoUpdate");
+    if (typeof fromKnown === "boolean")
+        return { effective: fromKnown, source: "known_marketplaces" };
+    return { effective: false, source: "default" };
+}
+/**
+ * IF-0-CCPLUGIN-3: every plugin enabled for `ctx.cwd`, followed from `enabledPlugins` to its
+ * installed row and read from the cache. Ours is the plugin id `agent-board@message-board` whose
+ * marketplace is declared, EVERYWHERE it is declared, as the github repository
+ * Consiliency/message-board; anything else contributing a board server or a wake hook is foreign.
+ */
+export function readClaudePluginScopes(ctx) {
+    const unparseable = new Set();
+    const failures = new Set();
+    const files = [];
+    let untrusted = false;
+    const summary = {
+        installed: false, serverActive: false, version: null, pinnedMcpVersion: null, sourceRef: null, autoUpdate: { effective: false, source: "default" },
+    };
+    const tolerant = (read, fallback) => {
+        try {
+            return read();
+        }
+        catch (error) {
+            if (!(error instanceof UnparseableConfigError))
+                throw error;
+            unparseable.add(CLAUDE_PLUGIN_ROW);
+            return fallback;
+        }
+    };
+    // Round-4 codex: when a tier doctor cannot read replaces the managed settings FILE, that file is
+    // not read at all, so it feeds NO consumer — plugin enablement, marketplace declarations (and so
+    // provenance and "ours"), the source ref, auto-update, the hook policy — and its parse errors are
+    // not reported. Only the probe's own evidence speaks for it.
+    const probe = probeManagedPolicy(ctx);
+    const managedPaths = new Set(managedSettingsPaths(ctx));
+    const fileTierReplaced = managedFileTierReplaced(probe);
+    const layers = claudeSettingsLayers(ctx).flatMap((path) => {
+        const managed = managedPaths.has(path);
+        if (managed && fileTierReplaced)
+            return [];
+        const document = tolerant(() => readJsonFile(ctx.fs, path), null);
+        return document === null ? [] : [{ managed, document }];
+    });
+    const settings = layers.map((layer) => layer.document);
+    const hookPolicy = claudeHookPolicy(ctx, layers, probe);
+    const known = tolerant(() => readJsonFile(ctx.fs, join(claudePluginsDir(ctx), "known_marketplaces.json")), null);
+    const installed = tolerant(() => {
+        const document = readJsonFile(ctx.fs, join(claudePluginsDir(ctx), "installed_plugins.json"));
+        if (document !== null && (own(document, "version") !== INSTALLED_PLUGINS_SCHEMA || !isObject(own(document, "plugins")))) {
+            throw new UnparseableConfigError("installed_plugins.json has an unknown shape");
+        }
+        return document;
+    }, null);
+    // enabledPlugins: the highest scope holding a boolean wins; anything else defines nothing.
+    const enabled = new Map();
+    for (const document of settings) {
+        const map = own(document, "enabledPlugins");
+        if (!isObject(map))
+            continue;
+        for (const id of Object.keys(map)) {
+            const value = own(map, id);
+            if (typeof value === "boolean")
+                enabled.set(id, value);
+        }
+    }
+    const declarationsOf = (marketplace) => settings.flatMap((document) => {
+        const declaration = own(own(document, "extraKnownMarketplaces"), marketplace);
+        return declaration === undefined ? [] : [declaration];
+    });
+    const ourDeclarations = declarationsOf(CLAUDE_PLUGIN_MARKETPLACE);
+    const ourKnown = own(known, CLAUDE_PLUGIN_MARKETPLACE);
+    const everyDeclaration = [...ourDeclarations, ...(ourKnown === undefined ? [] : [ourKnown])];
+    const marketplaceIsOurs = everyDeclaration.length > 0
+        && everyDeclaration.every((declaration) => isOurMarketplaceSource(own(declaration, "source")));
+    if (marketplaceIsOurs) {
+        // The winning declaration's ref: the highest settings scope, else known_marketplaces.json.
+        const ref = own(own(everyDeclaration[ourDeclarations.length > 0 ? ourDeclarations.length - 1 : 0], "source"), "ref");
+        summary.sourceRef = typeof ref === "string" ? ref : null;
+    }
+    summary.autoUpdate = tolerant(() => claudeAutoUpdate(ctx, ourDeclarations, known), { effective: false, source: "undetermined" });
+    for (const [id, on] of enabled) {
+        if (!on)
+            continue;
+        const at = id.lastIndexOf("@");
+        if (at <= 0)
+            continue;
+        const name = id.slice(0, at);
+        const rows = own(own(installed, "plugins"), id);
+        if (rows === undefined)
+            continue;
+        if (!Array.isArray(rows)) {
+            unparseable.add(CLAUDE_PLUGIN_ROW);
+            continue;
+        }
+        // The first applicable row is THE row: one without a string installPath stops here like an
+        // untrusted path, rather than falling through to a later row (panel S8).
+        const row = rows.find((candidate) => rowApplies(candidate, ctx));
+        if (row === undefined)
+            continue;
+        if (typeof own(row, "installPath") !== "string") {
+            untrusted = true;
+            continue;
+        }
+        const ours = id === CLAUDE_PLUGIN_ID && marketplaceIsOurs;
+        let tree;
+        try {
+            tree = readPluginTree(ctx, own(row, "installPath"), `plugin:${name}`);
+        }
+        catch (error) {
+            if (error instanceof UntrustedPluginPathError) {
+                untrusted = true;
+                continue;
+            }
+            if (!(error instanceof UnparseableConfigError))
+                throw error;
+            unparseable.add(ours ? CLAUDE_PLUGIN_ROW : CLAUDE_FOREIGN_PLUGIN_ROW);
+            continue;
+        }
+        const { contribution, manifest } = tree;
+        files.push({ row: ours ? CLAUDE_PLUGIN_ROW : CLAUDE_FOREIGN_PLUGIN_ROW, path: own(row, "installPath"), contribution, pluginId: id });
+        if (ours) {
+            const version = own(manifest, "version");
+            summary.installed = true;
+            summary.version = typeof version === "string" ? version : null;
+            const pinArg = contribution.mcp[0]?.args.find((arg) => arg.startsWith(`${CLAUDE_PLUGIN_MCP_PACKAGE}@`));
+            summary.pinnedMcpVersion = pinArg === undefined ? null : pinArg.slice(CLAUDE_PLUGIN_MCP_PACKAGE.length + 1);
+            if (!oursMatchesFreeze(contribution, summary.version))
+                failures.add("plugin_stanza_mismatch");
+        }
+        else {
+            const boardServer = contribution.mcp.some((entry) => judgeMcpEntry(entry, ctx.fs).board);
+            const wakeHook = Object.keys(contribution.hooks).some((event) => contribution.hooks[event].some((hook) => isCommand(hook) && namesWakeHook(hook.command)));
+            if (boardServer || wakeHook)
+                failures.add("foreign_board_plugin");
+        }
+    }
+    return { files, unparseable: [...unparseable], untrusted, failures: [...failures], summary, hookPolicy };
+}
+// ---------------------------------------------------------------------------------------------
 // Judgement
 // ---------------------------------------------------------------------------------------------
 /** A package spec's identity without its version: `@scope/name@1.2.3` → `@scope/name`. */
@@ -693,10 +1395,42 @@ export function readScopes(harness, ctx) {
     }
     return { files, unparseable };
 }
+const MANAGED_MCP_ROWS = new Set(["claude_managed_mcp", "claude_managed_settings"]);
+/** The `.claude.json` `projects` key Claude Code uses for `cwd`: the git root of its realpath, else the realpath. */
+export function claudeProjectKey(ctx) {
+    const real = ctx.fs.realpath(ctx.cwd) ?? resolve(ctx.cwd);
+    return gitRootOf(real, ctx.fs) ?? real;
+}
+/**
+ * Server names `projects[<key>].disabledMcpServers` turns off here (see the header). An
+ * unparseable `.claude.json` disables nothing: its own row already reports it.
+ */
+function claudeDisabledServers(ctx) {
+    let document;
+    try {
+        document = readJsonFile(ctx.fs, claudeJsonPath(ctx));
+    }
+    catch (error) {
+        if (error instanceof UnparseableConfigError)
+            return new Set();
+        throw error;
+    }
+    const list = own(own(own(document, "projects"), claudeProjectKey(ctx)), "disabledMcpServers");
+    return new Set(Array.isArray(list) ? list.filter((name) => typeof name === "string") : []);
+}
 /** IF-0-CREDPATH-4 registration, for one working directory. */
 export function judgeRegistration(harness, ctx) {
-    const { files, unparseable } = readScopes(harness, ctx);
-    const failures = [];
+    const scopes = readScopes(harness, ctx);
+    // claude plugins are synthetic files ranked above user settings. Their server names are
+    // namespaced (`plugin:<name>:<server>`), so no same-name override crosses them either way.
+    const plugins = harness === "claude" ? readClaudePluginScopes(ctx) : null;
+    // When a server-managed or MDM tier replaces the managed settings FILE (round-3 N1), that file
+    // contributes nothing — neither servers nor hooks; the verdict is held undetermined below.
+    const fileTierReplaced = plugins?.hookPolicy.managedTierUnreadable === true;
+    const files = [...scopes.files.filter((file) => !(fileTierReplaced && file.row === "claude_managed_settings")), ...(plugins?.files ?? [])];
+    const scopeUnparseable = scopes.unparseable.filter((row) => !(fileTierReplaced && row === "claude_managed_settings"));
+    const unparseable = plugins ? [...scopeUnparseable, ...plugins.unparseable] : scopes.unparseable;
+    const failures = plugins ? [...plugins.failures] : [];
     // The EFFECTIVE server map first: a higher layer's same-named entry overrides (replacing it, or
     // overlaying its fields), so a board entry disabled or re-pointed above is judged as such.
     const effective = new Map();
@@ -712,9 +1446,12 @@ export function judgeRegistration(harness, ctx) {
     const boardNames = new Set();
     const boardRows = new Set();
     let flagged = false;
+    const disabledHere = harness === "claude" ? claudeDisabledServers(ctx) : new Set();
     for (const { entry, row: scopeRow } of effective.values()) {
         if (entry.disabled)
             continue;
+        if (disabledHere.has(entry.name) && !MANAGED_MCP_ROWS.has(scopeRow))
+            continue;
         const verdict = judgeMcpEntry(entry, ctx.fs);
         if (!verdict.board)
             continue;
@@ -735,23 +1472,64 @@ export function judgeRegistration(harness, ctx) {
     else if (boardNames.size === 0) {
         failures.push("no_registration");
     }
-    if (harness === "claude") {
+    let hookCounts;
+    let unjudgeable = false;
+    let policyUnjudgeable = false;
+    let policyCheckFailed = [];
+    if (harness === "claude" && plugins) {
+        // The EFFECTIVE hooks first (round-2 F027/F028): a file whose hooks the policy switches off
+        // contributes none. Dropping a wake hook that way is a failure of its own, never a pass.
+        const policy = plugins.hookPolicy;
+        const isPluginFile = (file) => file.row === CLAUDE_PLUGIN_ROW || file.row === CLAUDE_FOREIGN_PLUGIN_ROW;
+        const runs = (file) => isPluginFile(file)
+            ? policy.plugins === "all" || (policy.plugins === "managed_only" && (policy.unjudgeable || policy.managedPluginIds.has(file.pluginId ?? "")))
+            : policy.settings === "all" || (policy.settings === "managed_only" && file.row === "claude_managed_settings");
+        const namesAWakeHook = (file) => Object.keys(file.contribution.hooks)
+            .some((event) => file.contribution.hooks[event].some((hook) => isCommand(hook) && namesWakeHook(hook.command)));
+        if (files.some((file) => !runs(file) && namesAWakeHook(file)))
+            failures.push("hooks_disabled_by_policy");
+        policyUnjudgeable = policy.unjudgeable || policy.probe.evidence.length > 0;
+        policyCheckFailed = [...new Set(policy.probe.errors)].map((cause) => `managed_policy_check_failed:${cause}`);
+        const hooksOf = (file, event) => runs(file) ? file.contribution.hooks[event] ?? [] : [];
+        const wakeHooks = (event) => files.flatMap((file) => hooksOf(file, event).filter((hook) => isCommand(hook) && namesWakeHook(hook.command)));
+        // A non-command handler on a wake event runs, but doctor cannot tell what it does (panel B2b);
+        // nor can it tell what a settings or foreign wake hook filtered by a matcher fires on (F029).
+        // Ours with a matcher is a stanza mismatch instead.
+        unjudgeable = CLAUDE_REQUIRED_HOOK_EVENTS.some((event) => files.some((file) => hooksOf(file, event)
+            .some((hook) => !isCommand(hook) || (hook.hasMatcher && file.row !== CLAUDE_PLUGIN_ROW && namesWakeHook(hook.command)))));
+        hookCounts = { SessionStart: 0, FileChanged: 0 };
         for (const event of CLAUDE_REQUIRED_HOOK_EVENTS) {
-            const count = files.reduce((sum, file) => sum + (file.contribution.hooks[event] ?? []).filter((command) => command.includes(WAKE_HOOK_MARKER)).length, 0);
+            const count = wakeHooks(event).length;
+            hookCounts[event] = count;
             if (count === 0)
                 failures.push(`missing_hook:${event}`);
             if (count > 1)
                 failures.push(`duplicate_hook:${event}`);
         }
+        // Shape B: a FileChanged wake hook wakes an idle session only through asyncRewake.
+        if (CLAUDE_WAKE_SHAPE === "B" && wakeHooks("FileChanged").some((hook) => !hook.asyncRewake))
+            failures.push("hook_not_rewake");
     }
+    const extras = plugins
+        ? { plugin: { ...plugins.summary, serverActive: boardRows.has(CLAUDE_PLUGIN_ROW) }, hookCounts, managedPolicy: plugins.hookPolicy.probe }
+        : {};
     // An absence is only evidence when every file was read: the missing entry may be in the file
-    // that did not parse. A duplicate or the flag, seen in files that DID parse, stands.
-    const standing = unparseable.length === 0
+    // that did not parse, under the plugin path doctor refused to follow, or a handler doctor
+    // cannot judge. A duplicate or the flag, seen in files that DID parse, stands.
+    const complete = unparseable.length === 0 && !plugins?.untrusted && !unjudgeable && !policyUnjudgeable && policyCheckFailed.length === 0;
+    const standing = complete
         ? failures
         : failures.filter((failure) => failure !== "no_registration" && !failure.startsWith("missing_hook:"));
     if (standing.length > 0)
-        return { status: "fail", reason: standing.join(",") };
-    if (unparseable.length > 0)
-        return { status: "undetermined", reason: `unparseable:${[...new Set(unparseable)].join("+")}` };
-    return { status: "pass", reason: "registered" };
+        return { status: "fail", reason: standing.join(","), ...extras };
+    const unknowns = [
+        ...(unparseable.length > 0 ? [`unparseable:${[...new Set(unparseable)].join("+")}`] : []),
+        ...(plugins?.untrusted ? ["plugin_path_untrusted"] : []),
+        ...(unjudgeable ? ["unjudgeable_hook"] : []),
+        ...(policyUnjudgeable ? ["hook_policy_unjudgeable"] : []),
+        ...policyCheckFailed,
+    ];
+    if (unknowns.length > 0)
+        return { status: "undetermined", reason: unknowns.join(","), ...extras };
+    return { status: "pass", reason: "registered", ...extras };
 }