@dzhechkov/harness-core 0.3.130 → 0.3.132

package/src/guard.ts

@@ -52,6 +52,8 @@ export interface GuardFacts {
   readonly counts?: readonly { readonly label: string; readonly a: number; readonly b: number }[];
   /** for store-bloat-cap: current learned-store size vs its cap. */
   readonly store?: { readonly count: number; readonly cap: number };
+  /** for skills-registrable: per skill pack, dirs that would ship un-registrable (no depth-1 SKILL.md). */
+  readonly skillPacks?: readonly { readonly name: string; readonly nonRegistrable: readonly string[] }[];
   /** for readme-first: per publishable package, is a version bump staged without a README change? */
   readonly readmeFirst?: readonly { readonly name: string; readonly versionBumped: boolean; readonly readmeChanged: boolean }[];
 }
@@ -62,6 +64,7 @@ export const DEFAULT_RULES: readonly GuardRule[] = [
   { id: 'no-skill-drift', severity: 'hard', ops: ['publish', 'consolidate'], description: 'no unexpected byte-drift between shared skill copies' },
   { id: 'no-secrets', severity: 'hard', ops: ['teach', 'publish'], description: 'no private key or API token in lesson text or a published file' },
   { id: 'readme-consistency', severity: 'soft', ops: ['publish'], description: 'README counts agree (CJM header vs All Commands, etc.)' },
+  { id: 'skills-registrable', severity: 'soft', ops: ['publish'], description: 'every skill directory in a skill pack has a depth-1 SKILL.md (a buried or missing one ships un-registrable — the health-advisor 1.2.0 class)' },
   { id: 'readme-first', severity: 'soft', ops: ['publish'], description: 'a package with a staged version bump must update its own README.md in the same change (README-first)' },
   { id: 'store-bloat-cap', severity: 'soft', ops: ['teach', 'consolidate'], description: 'the learned store is within its size cap' },
 ];
@@ -123,6 +126,22 @@ const CHECKERS: Record<string, (f: GuardFacts, sev: GuardSeverity) => Violation[
     }
     return out;
   },
+  'skills-registrable': (f, sev) => {
+    // The health-advisor 1.2.0 class, mechanized at publish time: a skill directory that ships with
+    // no depth-1 SKILL.md registers NOWHERE, however green the tests are. SOFT: the discriminator is
+    // a heuristic (a pack counts only if it already has one registrable skill, and only
+    // markdown-bearing dirs are considered intended), so it informs rather than blocks.
+    const out: Violation[] = [];
+    for (const p of f.skillPacks ?? []) {
+      if (!p || !Array.isArray(p.nonRegistrable) || p.nonRegistrable.length === 0) continue;
+      out.push({
+        rule: 'skills-registrable',
+        severity: sev,
+        detail: `${p.name}: ${p.nonRegistrable.length} skill dir(s) would ship un-registrable (no depth-1 SKILL.md): ${p.nonRegistrable.join(', ')} — run \`dz skills-verify --static\``,
+      });
+    }
+    return out;
+  },
   'readme-first': (f, sev) => {
     // The 2026-07-18 violation shape, mechanized: a package about to publish (version bumped in the diff)
     // whose own README.md is untouched in the same diff. SOFT: some republishes legitimately need no doc

package/src/skills-verify.ts

@@ -14,7 +14,7 @@
  * FAIL-CLOSED: anything that prevents an honest observation yields `inconclusive`, never `pass`.
  */
 
-import { existsSync, lstatSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync } from 'node:fs';
 import { basename, isAbsolute, join, resolve } from 'node:path';
 
 // ── Layer 1: static layout scan ─────────────────────────────────────
@@ -55,7 +55,17 @@ export interface StaticScan {
    * it did not register and that is a failure (QE4 #1 — without this, making the container advisory
    * re-opened the vacuous pass and the gate stopped catching health-advisor 1.2.0).
    */
-  readonly containers: readonly { readonly dir: string; readonly candidates: readonly string[] }[];
+  readonly containers: readonly {
+    readonly dir: string;
+    /** Absolute path of the container — matched against `init.plugins[].path` (QE5 #1). */
+    readonly path: string;
+    /** The name the container's OWN manifest declares (may differ from the dir name — QE5 #1b). */
+    readonly manifestName: string | null;
+    /** Skill names it would provide: discovered on disk AND declared by the manifest (QE5 #4). */
+    readonly candidates: readonly string[];
+    /** True when the dir ALSO has a depth-1 SKILL.md — a single-skill plugin (QE5 #2). */
+    readonly alsoBare: boolean;
+  }[];
   /**
    * Set when the scan could not complete (unreadable dir, `.claude/skills` is a file, …). A failed
    * scan must NOT read as "a clean empty project" — the classifier turns this into `inconclusive`
@@ -64,7 +74,10 @@ export interface StaticScan {
   readonly scanError?: string;
 }
 
-const MAX_BURIED_DEPTH = 4; // enough to catch extended/<name>/SKILL.md without walking the world
+// Bounded on purpose: deep enough for every real layout seen (extended/<name>/, skills/<name>/,
+// base/<dep>/), shallow enough not to walk a whole tree. A SKILL.md below this bound is not seen —
+// a stated limit, not a silent one (QE6 #9).
+const MAX_BURIED_DEPTH = 6;
 
 function findBuriedSkillMd(dir: string, depth: number, acc: string[], errors: string[]): void {
   if (depth > MAX_BURIED_DEPTH) return;
@@ -98,6 +111,65 @@ function hasPluginManifest(dir: string): boolean {
   return existsSync(join(dir, '.claude-plugin', 'plugin.json'));
 }
 
+/**
+ * Read a container's own `.claude-plugin/plugin.json`: the name it DECLARES and the skill paths it
+ * declares. A manifest may point at a custom path deeper than the on-disk walk, which otherwise left
+ * the container with zero candidates and restored a vacuous PASS (QE5 #4).
+ */
+function readContainerManifest(dir: string): { name: string | null; declared: string[] } {
+  try {
+    const raw = readFileSync(join(dir, '.claude-plugin', 'plugin.json'), 'utf8');
+    const obj = JSON.parse(raw) as Record<string, unknown>;
+    const name = typeof obj.name === 'string' && obj.name ? obj.name : null;
+    const declared = Array.isArray(obj.skills)
+      ? obj.skills
+          .filter((x): x is string => typeof x === 'string')
+          .map((rel) => basename(rel.replace(/\/+$/, '')))
+          .filter(Boolean)
+      : [];
+    return { name, declared };
+  } catch {
+    return { name: null, declared: [] }; // unreadable/!JSON: the manifest's INTENT still counts
+  }
+}
+
+/**
+ * Does this directory look like it was INTENDED as a skill? A dir with no markdown at all is
+ * ordinary content (`scripts/`, `bin/`, `templates/`) — calling it a failed skill is a false FAIL
+ * (Codex QE5 #7). MEASURED: naively flagging every dir marked ~40 healthy directories across 9
+ * npx-toolkit packages (reproducer: the pack survey in features/skills-verify/08_qe_report.md).
+ */
+export function looksLikeSkillDir(dir: string): boolean {
+  const walk = (d: string, depth: number): boolean => {
+    if (depth > 2) return false;
+    let entries: string[];
+    try {
+      entries = readdirSync(d);
+    } catch {
+      return false;
+    }
+    for (const name of entries) {
+      if (name.startsWith('.') || name === 'node_modules') continue;
+      const full = join(d, name);
+      let isDir = false;
+      try {
+        isDir = statSync(full).isDirectory();
+      } catch {
+        continue;
+      }
+      if (isDir) {
+        // A DIRECTORY named SKILL.md is a botched skill file, not ordinary content — clear intent.
+        if (name === 'SKILL.md') return true;
+        if (walk(full, depth + 1)) return true;
+      } else if (name.toLowerCase().endsWith('.md')) {
+        return true;
+      }
+    }
+    return false;
+  };
+  return walk(dir, 1);
+}
+
 /**
  * A directory registers only if `SKILL.md` is a regular FILE. `existsSync` also answers true for a
  * DIRECTORY named SKILL.md, which registers nothing yet suppressed every other check (QE2 #4).
@@ -193,7 +265,13 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
   const registrable: string[] = [];
   const findings: SkillLayoutFinding[] = [];
   const advisories: SkillLayoutFinding[] = [];
-  const containers: { dir: string; candidates: string[] }[] = [];
+  const containers: {
+    dir: string;
+    path: string;
+    manifestName: string | null;
+    candidates: string[];
+    alsoBare: boolean;
+  }[] = [];
   const scanErrors: string[] = [];
 
   let entries: string[] = [];
@@ -224,9 +302,17 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
       scanErrors.push(`cannot stat ${dir}: ${error instanceof Error ? error.message : String(error)}`);
       continue;
     }
+    // A `SKILL.md` sitting directly in `.claude/skills/` registers nothing, whether it is a FILE or
+    // a DIRECTORY — the directory form previously slipped into the ordinary branch (QE6 #6).
+    if (name === 'SKILL.md') {
+      findings.push({
+        dir: '.',
+        kind: 'no-skill-md',
+        detail: 'SKILL.md sits directly in .claude/skills/ — a skill must live in its own directory to register',
+      });
+      continue;
+    }
     if (!isDir) {
-      // A SKILL.md dropped directly into .claude/skills/ registers nothing — it is a real defect,
-      // not something to skip silently (QE #4).
       if (name === 'SKILL.md') {
         findings.push({
           dir: '.',
@@ -238,22 +324,31 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
     }
 
     const registers = hasSkillFile(dir);
-    // A manifest-backed CONTAINER (`<dir>/.claude-plugin/plugin.json`) is a plugin-shaped layout.
+    // A manifest makes this a plugin CONTAINER even when it ALSO has a depth-1 SKILL.md — that is a
+    // single-skill plugin, whose skills are namespaced, so expecting the bare name false-FAILs (QE5 #2).
     // It did not register in measured practice, but the class may be supported under workspace
     // trust — so the WHOLE container is advisory. Emitting the generic `no-skill-md` /
     // `buried-skill-md` findings for it killed the layout anyway, which was the over-claim (QE4 #1).
-    const isPluginContainer = !registers && hasPluginManifest(dir);
+    const isPluginContainer = hasPluginManifest(dir);
     const bucket = isPluginContainer ? advisories : findings;
 
-    if (registers) {
+    if (registers && !isPluginContainer) {
       registrable.push(name);
+    } else if (registers && isPluginContainer) {
+      // A single-skill plugin: it has a depth-1 SKILL.md AND a manifest, so it registers NAMESPACED.
+      // Expecting the bare directory name here was a false FAIL (QE5 #2); the container check below
+      // accepts either form.
     } else {
-      bucket.push({
+      // A dir with no markdown was never meant to be a skill — advisory, not a failure (QE5 #7).
+      const intended = looksLikeSkillDir(dir);
+      (isPluginContainer || !intended ? advisories : findings).push({
         dir: name,
         kind: 'no-skill-md',
         detail: isPluginContainer
           ? `${name}/ is a plugin-shaped container (advisory): it has no depth-1 SKILL.md, so it registers only if the client loads it as a plugin`
-          : `no SKILL.md at ${name}/SKILL.md — this directory cannot register`,
+          : intended
+            ? `no SKILL.md at ${name}/SKILL.md — this directory cannot register`
+            : `${name}/ holds no markdown (advisory): it looks like ordinary content, not a skill that failed to register`,
       });
     }
 
@@ -262,11 +357,26 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
     // Only a report when the dir registers NOTHING: a dir with its own depth-1 SKILL.md registers
     // fine and a stray manifest beside it is inert, not a blocker (Codex QE #8).
     if (isPluginContainer) {
-      // What would this container provide? The dir name of every nested SKILL.md.
+      // What would this container provide? Names found on disk UNION names its manifest declares —
+      // a manifest may point at a custom path deeper than the walk, which previously left the
+      // container with zero candidates and let it slip through (QE5 #4).
       const inner: string[] = [];
       findBuriedSkillMd(dir, 1, inner, scanErrors);
-      const candidates = [...new Set(inner.map((f) => basename(join(f, '..'))))];
-      containers.push({ dir: name, candidates });
+      const manifest = readContainerManifest(dir);
+      const candidates = [
+        ...new Set([
+          ...inner.map((f) => basename(join(f, '..'))),
+          ...manifest.declared,
+          ...(registers ? [manifest.name ?? name] : []), // the single-skill plugin's own skill (QE5 #2)
+        ]),
+      ];
+      containers.push({
+        dir: name,
+        path: dir,
+        manifestName: manifest.name,
+        candidates,
+        alsoBare: registers,
+      });
       advisories.push({
         dir: name,
         kind: 'plugin-manifest-trap',
@@ -280,6 +390,20 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
     // register may legitimately bundle nested SKILL.md files as its own resources — health-advisor
     // 1.2.1 co-locates its base deps under the master exactly so they do NOT register. Only a dir
     // that registers NOTHING while hiding SKILL.md files inside is the 1.2.0 defect shape.
+    if (registers && !isPluginContainer) {
+      const nested: string[] = [];
+      findBuriedSkillMd(dir, 1, nested, scanErrors);
+      if (nested.length > 0) {
+        advisories.push({
+          dir: name,
+          kind: 'buried-skill-md',
+          detail:
+            `${name}/ bundles ${nested.length} nested SKILL.md file(s) as resources — they do NOT register ` +
+            `(correct for co-located dependencies; a real skill placed there would be invisible)`,
+        });
+      }
+    }
+
     if (!registers) {
       const buried: string[] = [];
       findBuriedSkillMd(dir, 1, buried, scanErrors);
@@ -310,12 +434,18 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
 export interface InitPlugin {
   readonly name: string;
   readonly version?: string;
+  /** Where the plugin was loaded FROM — the only identity that cannot be spoofed by a name (QE5 #1). */
+  readonly path?: string;
+  /** e.g. `telegram@claude-plugins-official`, `health-advisor@skills-dir`. */
+  readonly source?: string;
 }
 
 export interface InitFacts {
   /** Registered skill names. `null` means the key was ABSENT (schema drift) — never "none". */
   readonly skills: readonly string[] | null;
   readonly plugins: readonly InitPlugin[];
+  /** False when the `plugins` key was absent or not an array — unreadable, not empty (QE6 #7). */
+  readonly pluginsReadable: boolean;
   /** The project the session actually read — the built-in control. */
   readonly cwd: string | null;
   readonly clientVersion: string | null;
@@ -379,19 +509,28 @@ function parseStream(streamText: string): StreamParse {
       : null;
 
     const rawPlugins = obj.plugins;
+    // An ABSENT or non-array `plugins` key is unreadable schema, not proof that nothing loaded —
+    // with containers present that difference decides FAIL vs INCONCLUSIVE (QE6 #7).
+    const pluginsReadable = Array.isArray(rawPlugins);
     const plugins: InitPlugin[] = Array.isArray(rawPlugins)
       ? rawPlugins
           .filter((p): p is Record<string, unknown> => !!p && typeof p === 'object')
           .map((p) => {
             const name = typeof p.name === 'string' ? p.name : '(unnamed)';
-            // exactOptionalPropertyTypes: omit `version` rather than set it to undefined.
-            return typeof p.version === 'string' ? { name, version: p.version } : { name };
+            // exactOptionalPropertyTypes: omit a field rather than set it to undefined.
+            return {
+              name,
+              ...(typeof p.version === 'string' ? { version: p.version } : {}),
+              ...(typeof p.path === 'string' ? { path: p.path } : {}),
+              ...(typeof p.source === 'string' ? { source: p.source } : {}),
+            };
           })
       : [];
 
     found.push({
       skills,
       plugins,
+      pluginsReadable,
       // An empty or relative cwd testifies to nothing — `resolve("")` silently becomes the caller's
       // own cwd and can forge a match (Codex QE #6). Only an absolute path counts as evidence.
       cwd: typeof obj.cwd === 'string' && obj.cwd !== '' && isAbsolute(obj.cwd) ? obj.cwd : null,
@@ -475,6 +614,11 @@ export function verifyRegistration(evidence: RegistrationEvidence, options: Skil
   if (!evidence.scan || !evidence.probe || !evidence.provenance || typeof evidence.projectDir !== 'string') {
     return bad('incomplete evidence (scan, probe, provenance and projectDir are all required)');
   }
+  // …and the scan must be SHAPED like a scan: a partial object crashed on `layout.length` (QE6 #8).
+  const sc = evidence.scan as Partial<StaticScan>;
+  if (!Array.isArray(sc.findings) || !Array.isArray(sc.registrable) || !Array.isArray(sc.advisories) || !Array.isArray(sc.containers)) {
+    return bad('malformed scan (findings, registrable, advisories and containers must all be arrays)');
+  }
   const { projectDir, scan, probe, provenance } = evidence;
   // The contract is CANONICAL identity: a lexical `resolve` alone reports a symlinked project as a
   // different one and turns a correct registration into `inconclusive` (QE4 #3).
@@ -520,6 +664,15 @@ export function verifyRegistration(evidence: RegistrationEvidence, options: Skil
   }
   if (scan.scanError !== undefined) return fail('inconclusive', `layout scan failed: ${scan.scanError}`);
 
+  // 1b. A load-blocking layout finding is DETERMINISTIC evidence — it needs no session at all.
+  //     Evaluating it only after the probe meant a definite failure degraded to `inconclusive`
+  //     whenever `claude` was missing (Codex QE5 #5).
+  if (layout.length > 0) {
+    return fail('fail', `${layout.length} layout problem(s) can never register — proven from the layout alone`, {
+      missing: [],
+    });
+  }
+
   // 2. The probe must have produced a stream.
   if (!probe.ok) return fail('inconclusive', `probe failed: ${probe.error}`);
 
@@ -593,17 +746,58 @@ export function verifyRegistration(evidence: RegistrationEvidence, options: Skil
     };
   }
 
-  // 6b. A plugin-shaped container is forgiven ONLY if the SESSION says that plugin loaded.
-  //     Matching on skill NAMES was wrong: one incidental collision with an unrelated plugin's skill
-  //     (e.g. `deep-research`) forgave the whole container, and the gate PASSED the broken
-  //     health-advisor 1.2.0 (MEASURED — reproducer: `dz skills-verify` against that published
-  //     install). `init.plugins` names what actually loaded, so ask that instead.
-  const loadedPlugins = new Set(facts.plugins.map((p) => p.name));
-  // Only the LOADED-PLUGIN list counts. A namespaced-name fallback (`<dir>:<skill>` present in the
-  // listing) was still name-based evidence — the very class that made the gate pass a broken install
-  // — and `init.plugins` already covers every legitimate case.
-  const deadContainers = scan.containers.filter((c) => c.candidates.length > 0 && !loadedPlugins.has(c.dir));
-  if (deadContainers.length > 0) {
+  // 6b. A plugin-shaped container must be ATTRIBUTED, then its skills must actually be listed.
+  //
+  //     Identity is `path`/`source`, never the display name: matching by name both passed a broken
+  //     container that shared a name with an unrelated marketplace plugin AND failed a correct
+  //     container whose directory name differs from the name its manifest declares (Codex QE5 #1).
+  //     And a loaded plugin is not proof its skills registered — a misconfigured skill can be absent
+  //     from the authoritative listing while the plugin itself loads fine (QE5 #3).
+  if (scan.containers.length > 0 && !facts.pluginsReadable) {
+    return fail('inconclusive', 'the init event carried no readable `plugins` list — a container cannot be attributed', {
+      ...common,
+      missing,
+    });
+  }
+
+  const containerProblems: string[] = [];
+  const verifiedContainers: string[] = [];
+  for (const c of scan.containers) {
+    const loaded = facts.plugins.find((p) => {
+      if (typeof p.path === 'string' && p.path) {
+        try {
+          if (resolvePath(p.path) === resolvePath(c.path)) return true; // strongest: same directory
+        } catch {
+          /* an unresolvable path is simply not a match */
+        }
+      }
+      // A skills-directory plugin reports `<declared-name>@skills-dir`; fall back to that, then to
+      // the declared name itself. The container's DIRECTORY name is never used as identity.
+      if (c.manifestName) {
+        if (p.source === `${c.manifestName}@skills-dir`) return true;
+        if (p.name === c.manifestName && (p.source ?? '').endsWith('@skills-dir')) return true;
+      }
+      return false;
+    });
+
+    if (!loaded) {
+      containerProblems.push(
+        `${c.dir}/ declares a plugin${c.manifestName ? ` (${c.manifestName})` : ''} that did not load — ` +
+          `${c.candidates.length} skill(s) inside would register nowhere`,
+      );
+      continue;
+    }
+    // It loaded. We deliberately DO NOT verify its individual skills here.
+    //
+    // Doing so requires reproducing Claude Code's command-name resolution: a plugin skill's
+    // frontmatter `name` replaces the final command segment, and a manifest's `skills` field may be a
+    // string or point at a directory of children. That contract is undocumented-to-us and moving, and
+    // six review rounds showed every attempt to model it produced a NEW false verdict. A narrow
+    // promise kept exactly beats a broad promise kept unreliably — so the gate reports the gap
+    // instead of guessing (see the advisory below and the README).
+    verifiedContainers.push(`${c.dir}/ → plugin "${loaded.name}" loaded`);
+  }
+  if (containerProblems.length > 0) {
     return {
       expected,
       layout,
@@ -611,11 +805,7 @@ export function verifyRegistration(evidence: RegistrationEvidence, options: Skil
       ...common,
       missing,
       verdict: 'fail',
-      reason:
-        `${deadContainers.length} plugin-shaped container(s) did not load — ` +
-        deadContainers
-          .map((c) => `${c.dir}/ (${c.candidates.length} skill(s) inside, but no such plugin in the session)`)
-          .join('; '),
+      reason: `${containerProblems.length} plugin container problem(s) — ${containerProblems.join('; ')}`,
     };
   }
 
@@ -635,11 +825,18 @@ export function verifyRegistration(evidence: RegistrationEvidence, options: Skil
     );
   }
 
+  const containerAdvisories: SkillLayoutFinding[] = verifiedContainers.map((v) => ({
+    dir: v.split('/')[0] ?? v,
+    kind: 'plugin-manifest-trap' as const,
+    detail: `${v} — its individual skills are NOT verified: a plugin skill's command name depends on frontmatter this gate does not model`,
+  }));
+  const allAdvisories = [...scan.advisories, ...containerAdvisories];
+
   if (missing.length > 0) {
     return {
       expected,
       layout,
-      advisories: scan.advisories,
+      advisories: allAdvisories,
       ...common,
       missing,
       verdict: 'fail',
@@ -650,7 +847,7 @@ export function verifyRegistration(evidence: RegistrationEvidence, options: Skil
   return {
     expected,
     layout,
-    advisories: scan.advisories,
+    advisories: allAdvisories,
     ...common,
     missing: [],
     verdict: 'pass',
@@ -708,3 +905,45 @@ export function renderRegistrationReport(result: RegistrationResult, scan?: Stat
   }
   return out.join('\n');
 }
+
+// ── The publish-time guard fact ─────────────────────────────────────
+
+/**
+ * Scan a PACKAGE directory for skill dirs that could never register.
+ *
+ * Discriminator (MEASURED before it was chosen — a naive "every dir needs SKILL.md" rule flagged ~40
+ * healthy directories across 9 npx-toolkit packages, and a markdown-based one still flagged `docs/`):
+ *   1. a package counts as a SKILL PACK only if it already has at least one `<dir>/SKILL.md`;
+ *   2. inside it, a dir is broken only when a `SKILL.md` EXISTS somewhere inside but not at depth 1.
+ * That second rule is unambiguous — the skill file is there, just where nothing will load it (exactly
+ * health-advisor 1.2.0). A dir with no SKILL.md anywhere is ordinary content, not a failed skill.
+ */
+export function findNonRegistrableSkillDirs(packDir: string): string[] {
+  let entries: string[];
+  try {
+    entries = readdirSync(packDir);
+  } catch {
+    return [];
+  }
+  const dirs: string[] = [];
+  for (const name of entries) {
+    if (name.startsWith('.') || name === 'node_modules') continue;
+    const full = join(packDir, name);
+    try {
+      if (statSync(full).isDirectory()) dirs.push(name);
+    } catch {
+      /* unreadable entries are not evidence of a defect */
+    }
+  }
+  const isSkillPack = dirs.some((d) => hasSkillFile(join(packDir, d)));
+  if (!isSkillPack) return [];
+  return dirs
+    .filter((d) => {
+      const full = join(packDir, d);
+      if (hasSkillFile(full)) return false; // registers fine
+      const buried: string[] = [];
+      findBuriedSkillMd(full, 1, buried, []);
+      return buried.length > 0; // a SKILL.md exists, but nothing will load it from there
+    })
+    .sort();
+}