@dzhechkov/harness-core 0.8.37 → 0.8.39

package/src/run-records.ts

@@ -141,6 +141,17 @@ function priceLookup(modelId: string, table: Readonly<Record<string, LedgerPrice
   return best;
 }
 
+// instrument-round-b fix-round-1 (Codex r1 HIGH finding 3, ADR-001 D4 amended): `--no-strict` was a
+// BLANKET opt-out — since the one demonstrated automatic writer (the pipeline) always passed it, the
+// new strict-by-default was operationally empty for every real caller. Replaced by a NAMED, SCOPED
+// allowance: the caller states exactly which fields it expects to be incomplete
+// (`allowIncomplete`) and WHY, from a closed set of reason codes — an incomplete row is written only
+// when its actual incompleteness is a SUBSET of what was named AND the reason is recognized.
+// Growing the incompleteness beyond what was declared (e.g. `envelope` going missing tomorrow) is
+// refused, by construction, without anyone having to remember to tighten a flag.
+export const INCOMPLETE_REASON_CODES = ['sandbox-metrics-unavailable', 'manual-entry'] as const;
+export type IncompleteReasonCode = typeof INCOMPLETE_REASON_CODES[number];
+
 export type RecordKind = 'ledger' | 'training-pair';
 
 export type RecordVerdict =
@@ -290,6 +301,22 @@ export function decideRecordWrite(input: {
   /** measurement-integrity FR-5/FR-6: rollout-log + price enrichment for a ledger row. Absent ⇒ zero
    *  behavior change (NFR-1). */
   enrich?: LedgerEnrichInput;
+  /**
+   * instrument-round-b FR-4/A5 (ADR-001 D4), fix-round-1 (Codex r1 HIGH finding 3): an AUTO ledger
+   * row that would be written `complete:false` is refused (exit 2, before any write) UNLESS the
+   * actual incompleteness is fully covered by this NAMED, SCOPED allowance — the CLI's
+   * `--allow-incomplete <fields>`. A field this row is incomplete in that is NOT in this set still
+   * refuses, naming exactly the uncovered field(s). `--no-strict` (a blanket opt-out) is gone —
+   * see {@link INCOMPLETE_REASON_CODES}.
+   */
+  allowIncomplete?: readonly string[];
+  /**
+   * instrument-round-b fix-round-1 (Codex r1 HIGH finding 3): WHY the row is legitimately
+   * incomplete — the CLI's `--incomplete-reason <code>`, required alongside `allowIncomplete` and
+   * validated against the closed {@link INCOMPLETE_REASON_CODES} set. An unrecognized or absent
+   * reason refuses the write even when every incomplete field IS named in `allowIncomplete`.
+   */
+  incompleteReason?: string | null;
 }): RecordDecision {
   const { kind, payloadRaw, stage } = input;
   if (kind !== 'ledger' && kind !== 'training-pair') {
@@ -350,7 +377,20 @@ export function decideRecordWrite(input: {
   // carry `auto:true` too (not just gate on it transiently), so every downstream reader of the
   // PERSISTED line keeps seeing the same signal `shapeMismatch` already gated on above. A no-op when
   // the payload already said `auto:true` (shapeMismatch already refused any OTHER value).
-  if (kind === 'ledger' && input.auto === true) stamped['auto'] = true;
+  // Lead delta after Codex r2 (N1 HIGH): `auto:true` used to be indistinguishable between "the
+  // CLI-level trusted marker was present" and "a hand-built payload said so", so a manual row could
+  // read as an automatic one. STRIPPING the claim was tried and rejected: the minutes-delta contract
+  // (auto + runId) legitimately rides payload-declared auto rows, and 28 existing callers write
+  // them. So the claim SURVIVES and its PROVENANCE is recorded instead — `autoSource` is the field a
+  // reader filters on when it needs trusted automatic rows only.
+  if (kind === 'ledger') {
+    if (input.auto === true) {
+      stamped['auto'] = true;
+      stamped['autoSource'] = 'cli-flag';
+    } else if (stamped['auto'] === true) {
+      stamped['autoSource'] = 'payload-claim';
+    }
+  }
   const isGap = (v: unknown): boolean => v === null || v === undefined || (typeof v === 'string' && v.trim() === '');
   if (input.timestamp != null && input.timestamp !== '') {
     // An EMPTY STRING is a gap, not a value. Stamping only over null/undefined let
@@ -553,6 +593,89 @@ export function decideRecordWrite(input: {
     }
   }
 
+  // experiment-instrument FR-2/A3 (ADR-001): completeness of an AUTO ledger row. `minutes` is
+  // fill-only-null from a `wallSec` the payload carries (the workflow sandbox has a clock delta even
+  // when it has no wall clock of its own — FR-2's `wallSec` field, distinct from `minutesSincePrev`
+  // above, which needs a PREVIOUS row and a runId neither of which every auto row has). `tokens` is
+  // judged complete when it is a real number OR the row already NAMES why it is not (`tokensSource`,
+  // set above by the FR-5 rollout match, or supplied by the caller) — an unexplained non-number is the
+  // one shape that is actually incomplete. Gated on `auto` only: a MANUAL row never gains any of these
+  // three keys, so it stays byte-identical to before this feature (NFR-1).
+  if (kind === 'ledger' && stamped['auto'] === true) {
+    const incompleteReasons: string[] = [];
+    if (stamped['minutes'] === null || stamped['minutes'] === undefined) {
+      const wallSec = stamped['wallSec'];
+      if (typeof wallSec === 'number' && Number.isFinite(wallSec) && wallSec >= 0) {
+        stamped['minutes'] = Math.round((wallSec / 60) * 10) / 10;
+        stamped['minutesSource'] = 'wallSec';
+      } else {
+        incompleteReasons.push('minutes');
+      }
+    }
+    // r1-10 (Codex r1 HIGH #10): completeness requires a real, finite NUMBER of tokens. Naming why
+    // tokens are missing (`tokensSource:'unavailable'`, or any other provenance) is diagnostic, never
+    // a substitute for the number itself — ADR-001 says missing tokens makes the row incomplete, full
+    // stop. The old check (`tokensSource === undefined`) treated a NAMED absence as if it were data.
+    if (typeof stamped['tokens'] !== 'number' || !Number.isFinite(stamped['tokens'])) {
+      incompleteReasons.push('tokens');
+    }
+    // r1-11 (Codex r1 MEDIUM #11): a payload that ALREADY declared itself incomplete (its own
+    // `complete:false` + `incompleteReasons`, e.g. a workflow-side `'artifact'` reason this module
+    // knows nothing about) must never be overwritten back to `complete:true` just because THIS
+    // module's own minutes/tokens checks both passed — that erases a true fact and leaves a
+    // contradictory row (`complete:true` alongside a stale `incompleteReasons`). Preserve and MERGE.
+    const existingCompleteRaw = stamped['complete'];
+    const existingWasIncomplete = existingCompleteRaw === false;
+    const existingReasonsRaw = stamped['incompleteReasons'];
+    const existingReasons = Array.isArray(existingReasonsRaw)
+      ? existingReasonsRaw.filter((r): r is string => typeof r === 'string')
+      : [];
+    const mergedReasons = existingWasIncomplete
+      ? [...new Set([...existingReasons, ...incompleteReasons])]
+      : incompleteReasons;
+    const complete = mergedReasons.length === 0 && !existingWasIncomplete;
+    // A3/A5 (круг B, ADR-001 D4), fix-round-1 (Codex r1 HIGH finding 3, finding 9): incompleteness
+    // is a REFUSAL by DEFAULT, before any write — but the escape hatch is now a NAMED, SCOPED
+    // allowance, not a blanket flag: the row writes only when EVERY name in `mergedReasons` is
+    // covered by `input.allowIncomplete` AND `input.incompleteReason` is one of the closed
+    // {@link INCOMPLETE_REASON_CODES}. This is the load-bearing condition finding 9 asked for a
+    // real discriminating mutation against — an omitted allowance (the ordinary caller who never
+    // heard of this option) refuses exactly like круг B's original default; a caller naming the
+    // wrong reason, or a wider incompleteness than it declared, ALSO refuses.
+    // Lead delta after Codex r2 (N3 MEDIUM): the closed-list check used to live INSIDE the
+    // incomplete branch, so a COMPLETE row could carry `--incomplete-reason bogus` and be written
+    // with an unrecognized code sitting in its arguments. A supplied reason is validated whenever it
+    // is supplied, complete or not.
+    const suppliedReason = input.incompleteReason ?? null;
+    if (suppliedReason !== null && !(INCOMPLETE_REASON_CODES as readonly string[]).includes(suppliedReason)) {
+      return refuse(`--incomplete-reason ${JSON.stringify(suppliedReason)} is not a recognized reason code — expected one of ${INCOMPLETE_REASON_CODES.join(', ')}`);
+    }
+    if (!complete) {
+      const allowedFields = new Set(input.allowIncomplete ?? []);
+      const reason = suppliedReason;
+      const reasonKnown = reason !== null && (INCOMPLETE_REASON_CODES as readonly string[]).includes(reason);
+      // Lead delta after Codex r2 (N2 HIGH): a payload marked `complete:false` with NO concrete
+      // reasons cannot be covered by any allowance — the subset relation has nothing to check, so
+      // `uncovered` came out empty and the row slipped through. An unexplained incompleteness is a
+      // refusal: name the fields, or do not claim incompleteness.
+      if (mergedReasons.length === 0) {
+        return refuse('auto ledger row is marked `complete:false` but names no incompleteReasons — an allowance cannot cover an unnamed gap; list the incomplete field(s) or drop the claim');
+      }
+      const uncovered = mergedReasons.filter((r) => !allowedFields.has(r));
+      if (uncovered.length > 0 || !reasonKnown) {
+        if (reason === null && allowedFields.size === 0) {
+          return refuse(`auto ledger row is incomplete (${mergedReasons.join(', ') || 'previously marked incomplete'}) — refused by default; pass --allow-incomplete <fields> and --incomplete-reason <code> to permit a scoped incomplete write`);
+        }
+        if (!reasonKnown) {
+          return refuse(`--incomplete-reason ${JSON.stringify(reason)} is not a recognized reason code — expected one of ${INCOMPLETE_REASON_CODES.join(', ')}`);
+        }
+        return refuse(`auto ledger row is incomplete in field(s) not covered by --allow-incomplete: ${uncovered.join(', ')} (incomplete: ${mergedReasons.join(', ') || 'previously marked incomplete'})`);
+      }
+    }
+    stamped['complete'] = complete;
+    if (!complete) stamped['incompleteReasons'] = mergedReasons.length > 0 ? mergedReasons : existingReasons;
+  }
+
   let line: string;
   try {
     line = JSON.stringify(stamped);
@@ -604,3 +727,54 @@ export function decideReadBack(appended: string, lastLineOnDisk: string | null):
 export function recordVerdictLine(kind: RecordKind, stage: string, d: RecordDecision): string {
   return `feature-adr record (${kind}/${stage}): ${d.verdict.toUpperCase()} — ${d.reason}`;
 }
+
+/** experiment-instrument FR-1/FR-3 (ADR-001): what `round.ts`'s `readOpenRoundTaskId` returns — the
+ *  single source `applyTaskId` fills from. Duplicated here rather than imported so this pure module
+ *  never depends on `round.ts`'s own shape; the CLI is the one holding both and wiring them together.
+ *  r1-1/r1-2 (Codex r1 #1/#2): extended with `'derived-legacy'` and `'unavailable'` to stay in
+ *  lockstep with `round.ts`'s own `readOpenRoundTaskId` return type. */
+export interface TaskIdLookup {
+  readonly taskId: string | null;
+  readonly source: 'open-round' | 'derived-legacy' | 'no-open-round' | 'ambiguous' | 'unavailable';
+}
+
+/**
+ * experiment-instrument FR-1/FR-3/A8 (ADR-001): propagate `taskId` onto a ledger/training-pair payload
+ * BEFORE it reaches {@link decideRecordWrite} — fill-only-null, never overwritten.
+ *
+ * - The payload already names a non-empty `taskId` string ⇒ it is authoritative. When it DISAGREES
+ *   with the round's own current taskId, that disagreement is a real fact worth keeping — recorded as
+ *   `taskIdConflict: {payload, round}` — never silently resolved either way (A8).
+ * - The payload's `taskId` key is absent, or explicitly `null`/`undefined` ⇒ filled from `lookup`,
+ *   INCLUDING the honest `null` case: no open round (A4) or two of them (A5) still stamps `taskId:
+ *   null` + `taskIdSource` naming why, rather than leaving the field silently absent — absence with a
+ *   named reason beats absence with none.
+ * - r1-3 (Codex r1 HIGH #3): the payload's `taskId` key is PRESENT with a value that is neither a
+ *   non-empty string nor null/undefined (a number, a boolean, an object, or a blank/whitespace-only
+ *   string) ⇒ that is a present-but-INVALID value, a THIRD case distinct from both of the above. It
+ *   used to be treated exactly like "absent" (`typeof !== 'string'` fell through to the fill branch),
+ *   silently replacing the caller's own (malformed) value with the round's — violating both
+ *   fill-only-null and "a present payload value always wins". Now: the row's own value is preserved
+ *   UNTOUCHED (never replaced with a guess about what the caller meant), and the problem is named in
+ *   `taskIdInvalid` so a reader can see the row was neither filled nor trusted blindly.
+ *
+ * Pure: no filesystem, no clock. The CALLER (the cli) is the one that read `.dz/rounds/` to build
+ * `lookup` in the first place.
+ */
+export function applyTaskId(row: Record<string, unknown>, lookup: TaskIdLookup): Record<string, unknown> {
+  const hasTaskIdKey = Object.prototype.hasOwnProperty.call(row, 'taskId');
+  const rawPayloadTaskId = row['taskId'];
+  if (hasTaskIdKey && rawPayloadTaskId !== null && rawPayloadTaskId !== undefined) {
+    if (typeof rawPayloadTaskId === 'string' && rawPayloadTaskId.trim() !== '') {
+      const payloadTaskId = rawPayloadTaskId.trim();
+      if (lookup.taskId !== null && lookup.taskId !== payloadTaskId) {
+        return { ...row, taskIdConflict: { payload: payloadTaskId, round: lookup.taskId } };
+      }
+      return { ...row };
+    }
+    // r1-3: present but not a usable identity (non-string, or blank after trim) — refuse to replace
+    // it with a lookup guess; preserve it verbatim and name the problem.
+    return { ...row, taskIdInvalid: { value: rawPayloadTaskId, reason: 'taskId present but not a non-empty string' } };
+  }
+  return { ...row, taskId: lookup.taskId, taskIdSource: lookup.source };
+}

package/src/score.ts

@@ -20,6 +20,7 @@
  * PURE: the CLI reads the artifact files; this module only classifies.
  */
 
+import { maskMarkdown } from './markdown-masker.js';
 import { amendmentIdsIn } from './amendment-trace.js';
 import { QE_SEVERITIES, findInvalidQeVerdictLines, parseQeFindings, readQeVerdictLines, type QeFindingsRefusedRow, type QeFindingsSummary } from './qe-findings.js';
 
@@ -103,7 +104,13 @@ export function observabilityAnswer(architectureMarkdown: string | undefined | n
   // Fenced blocks are stripped FIRST: a `## Observability` inside an example fence is not a section
   // of this document, and accepting one is a false pass anybody could write by accident
   // (cross-family review, finding 1).
-  const text = String(architectureMarkdown ?? '').replace(/\r\n/g, '\n').replace(/^ {0,3}(```|~~~)[\s\S]*?^ {0,3}\1[^\n]*$/gm, '');
+  // Block scoping is DELEGATED to the canonical masker, not a local paired-fence regex. The regex
+  // it replaces required a MATCHING CLOSE, so an UNCLOSED fence stripped nothing at all and a
+  // `## Observability` quoted inside the example counted as a real section — MEASURED 2026-09-20,
+  // exactly the false pass the comment above warns about. `unclosed: 'hide'` is the CommonMark
+  // reading (an unclosed fence runs to end of document) and is the safe direction for a gate:
+  // a section that may be code must not be accepted as an answer.
+  const text = String(maskMarkdown(String(architectureMarkdown ?? '').replace(/\r\n/g, '\n'), { unclosed: 'hide' }));
   // CommonMark: up to three leading spaces, then #s, then REQUIRED whitespace. `##Observability` is
   // not a heading and must not pass; an indented one is, and must not be missed (finding 2).
   const headingRe = new RegExp('^ {0,3}#{1,6}[ \t]+' + OBSERVABILITY_SECTION + '\\b.*$', 'gim');

package/src/sign.ts

@@ -769,3 +769,56 @@ export function decideVerifyPolicy(verdict: PackVerdict, requireSigning: boolean
     ? { action: 'fail', reason: 'pack is unsigned and --require-signing was passed' }
     : { action: 'report', reason: 'pack is unsigned — not verified' };
 }
+
+/**
+ * Файлы, которые npm НИКОГДА не кладёт в тарбол, а рабочее дерево несёт почти всегда.
+ * Список намеренно короткий: каждая позиция — не эвристика вкуса, а правило упаковщика или
+ * общепринятый файл разработки, отсутствующий в опубликованном артефакте.
+ */
+const DEV_TREE_MARKERS: readonly string[] = [
+  'node_modules',        // npm исключает ВСЕГДА, безусловно
+  '.git',
+  'tsconfig.json',
+  'tsconfig.tsbuildinfo',
+  'vitest.config.ts',
+  'vitest.config.mts',
+  'vitest.config.js',
+  'CHANGELOG.md',
+  'test',
+  'tests',
+];
+
+/**
+ * Объяснение к ПРОВАЛИВШЕЙСЯ проверке подписи, когда каталог похож на рабочее дерево.
+ *
+ * ЗАЧЕМ ЭТО СУЩЕСТВУЕТ. Манифест описывает ОПУБЛИКОВАННЫЙ ТАРБОЛ, а не рабочее дерево: при
+ * публикации package.json переписывается (`workspace:*` разворачивается, версия бампается), а
+ * файлы разработки отфильтровываются. Поэтому сверка неотфильтрованного дерева расходится
+ * ПО ПОСТРОЕНИЮ, и вывод выглядит как «подпись сломана» или «дерево подменили».
+ *
+ * ИЗМЕРЕНО 2026-09-01: обход 55 подписанных пакетов в рабочем дереве дал 54 отказа из 55, и за
+ * один день на это независимо попались ТРОЕ — ведущий агент и два роя; один внёс это в отчёт
+ * как системный дефект подписей, другой предложил завести задачу, третий чуть не поднял тревогу
+ * о взломе доверия. Инструмент, трижды за день обманувший опытного пользователя, дефектен сам.
+ *
+ * ПОЧЕМУ ЭТО ОБЪЯСНЕНИЕ, А НЕ КЛАССИФИКАЦИЯ. Соседний путь (обход установленных пакетов) считает
+ * исходным деревом всё, что лежит не под `node_modules`. Здесь так нельзя: законно распакованный
+ * тарбол в /tmp тоже лежит не под `node_modules`, и его объявили бы деревом. Поэтому функция
+ * НИЧЕГО НЕ УТВЕРЖДАЕТ о природе каталога — она НАЗЫВАЕТ НАЙДЕННЫЕ УЛИКИ и оставляет вывод
+ * человеку. Нет улик — нет и объяснения: молчание здесь честнее догадки.
+ *
+ * @param entries имена верхнего уровня в проверяемом каталоге
+ * @returns текст пояснения или null, если улик рабочего дерева не нашлось
+ */
+export function explainPackVerificationFailure(entries: readonly string[]): string | null {
+  const found = DEV_TREE_MARKERS.filter((marker) => entries.includes(marker));
+  if (found.length === 0) return null;
+  return [
+    '',
+    'Прежде чем читать это как подделку: манифест описывает ОПУБЛИКОВАННЫЙ ТАРБОЛ, а не рабочее дерево.',
+    `Этот каталог несёт файлы разработки, которых в тарболе нет: ${found.join(', ')}.`,
+    'При публикации package.json переписывается, а файлы разработки отфильтровываются, поэтому',
+    'сверка неотфильтрованного дерева расходится ПО ПОСТРОЕНИЮ — это не улика подделки.',
+    'Проверять надо артефакт: npm pack <имя>@<версия> → распаковать → dz verify-pack --pack <распакованное>.',
+  ].join('\n');
+}

package/src/skills-verify.ts

@@ -6,8 +6,8 @@
  * the PROPERTY (registration). This module makes the property observable.
  *
  * Two layers:
- *   L1 `scanSkillsLayout`  — instant, no Claude session: which names CAN register, plus the three
- *                            layout shapes that produced the 1.2.0 defect.
+ *   L1 `scanSkillsLayout`  — instant, no Claude session: names whose on-disk form passes the
+ *                            static checks, plus known issue shapes.
  *   L2 `parseInitFacts`    — the authoritative listing, parsed from the `system/init` event of
  *      + `classifyRegistration`  `claude -p --output-format stream-json --verbose`. No model prose.
  *
@@ -19,13 +19,15 @@ import { basename, isAbsolute, join, resolve } from 'node:path';
 
 // ── Layer 1: static layout scan ─────────────────────────────────────
 
-/** The three non-registrable shapes, all observed in the health-advisor 1.2.0 defect. */
+/** The seven static issue shapes this scanner reports. */
 export type SkillIssueKind =
   | 'no-skill-md'          // a skill dir with no SKILL.md at depth 1 → never registers
   | 'buried-skill-md'      // a SKILL.md at depth >= 2 → the loader does not scan that deep
   | 'plugin-manifest-trap' // .claude-plugin/plugin.json under .claude/skills → does NOT auto-register
   | 'wildcard-allowed-tools' // `allowed-tools: *` → every tool granted; a FINDING (see below)
-  | 'empty-allowed-tools';   // `allowed-tools:` with no value → looks restrictive, restricts nothing
+  | 'empty-allowed-tools'    // `allowed-tools:` with no value → looks restrictive, restricts nothing
+  | 'missing-frontmatter-fence' // measured absent from the registry without an opening `---`
+  | 'missing-description';      // measured absent from the registry without a non-empty description
 
 export interface SkillLayoutFinding {
   readonly dir: string;
@@ -38,7 +40,10 @@ export interface StaticScan {
   readonly projectDir: string;
   readonly skillsRoot: string;
   readonly exists: boolean;
-  /** Names that CAN register: a dir with SKILL.md exactly one level deep. */
+  /**
+   * Bare skill names whose on-disk form passes static layout and measured frontmatter checks.
+   * Actual registration is established only by the Layer-2 session listing.
+   */
   readonly registrable: readonly string[];
   /** Load-blocking problems: these make the verdict FAIL. */
   readonly findings: readonly SkillLayoutFinding[];
@@ -228,6 +233,39 @@ export function parseAllowedTools(markdown: string): AllowedToolsState {
   return { state: 'listed', values, wildcard: values.includes('*') };
 }
 
+type SkillFrontmatterIssue = 'missing-frontmatter-fence' | 'missing-description';
+
+/**
+ * Read the registration-relevant frontmatter fields, line by line and only before its closing fence.
+ * Scanning the whole file would let `description:` in skill documentation suppress a real finding,
+ * the same false-positive/false-negative boundary guarded by `parseAllowedTools` above.
+ *
+ * The two conditions are measured as absence from the registry, not refusal of invocation. Each
+ * measurement used a fresh session, so it also does not establish appearance in the same response
+ * without a restart.
+ */
+function findSkillFrontmatterIssue(markdown: string): SkillFrontmatterIssue | null {
+  const lines = markdown.split(/\r?\n/);
+  // NO explicit BOM strip, and that is deliberate: `String.prototype.trim()` already removes U+FEFF
+  // (it is <ZWNBSP>, part of the WhiteSpace production), so a BOM-prefixed fence compares equal to
+  // a bare one. MEASURED 2026-09-19: adding a strip left the mutant "don't strip" 70/70 green —
+  // dead code. The tolerance is pinned by a test instead, so replacing `trim()` with anything
+  // stricter goes red rather than silently rejecting every BOM-prefixed skill.
+  if (lines[0]?.trim() !== '---') return 'missing-frontmatter-fence';
+
+  let description: string | null = null;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i] ?? '';
+    if (line.trim() === '---') break;
+    const match = /^description:(.*)$/.exec(line);
+    if (match) {
+      description = match[1] ?? '';
+      break;
+    }
+  }
+  return description === null || description.trim() === '' ? 'missing-description' : null;
+}
+
 /**
  * Privilege findings for one skill directory.
  *
@@ -426,16 +464,38 @@ export function scanSkillsLayout(projectDir: string): StaticScan {
     const isPluginContainer = hasPluginManifest(dir);
     const bucket = isPluginContainer ? advisories : findings;
 
+    // Read under a guard, exactly like scanSkillPrivileges: an unreadable SKILL.md is another
+    // check's business, and this scanner's contract is to REPORT findings, never to throw out of
+    // the whole sweep over one bad file.
+    let frontmatterIssue: SkillFrontmatterIssue | null = null;
+    if (registers) {
+      try {
+        frontmatterIssue = findSkillFrontmatterIssue(readFileSync(join(dir, 'SKILL.md'), 'utf8'));
+      } catch {
+        frontmatterIssue = null;
+      }
+    }
+    if (frontmatterIssue) {
+      findings.push({
+        dir: name,
+        kind: frontmatterIssue,
+        detail: frontmatterIssue === 'missing-frontmatter-fence'
+          ? 'SKILL.md has no opening frontmatter fence — measured absent from the registry without it'
+          : 'SKILL.md has no non-empty frontmatter description — measured absent from the registry without one',
+      });
+    }
+
     // Права проверяются у КАЖДОГО навыка с читаемым SKILL.md, включая одно-навыковый плагин: щедрая
     // выдача не становится безопаснее оттого, что навык лежит в контейнере.
     if (registers) scanSkillPrivileges(dir, name, findings, advisories);
 
-    if (registers && !isPluginContainer) {
-      registrable.push(name);
-    } else if (registers && isPluginContainer) {
+    if (registers) {
+      if (!isPluginContainer && !frontmatterIssue) {
+        registrable.push(name);
+      }
       // A single-skill plugin: it has a depth-1 SKILL.md AND a manifest, so it registers NAMESPACED.
       // Expecting the bare directory name here was a false FAIL (QE5 #2); the container check below
-      // accepts either form.
+      // accepts either form. A frontmatter finding likewise keeps the bare name out of registrable.
     } else {
       // A dir with no markdown was never meant to be a skill — advisory, not a failure (QE5 #7).
       const intended = looksLikeSkillDir(dir);

package/src/store-guard-prune.ts

@@ -0,0 +1,81 @@
+import { sep } from 'node:path';
+
+export type StoreGuardPruneBucket = 'stale-temp' | 'live' | 'gone-outside-tmp' | 'unreadable';
+
+export interface StoreGuardPruneEntry {
+  readonly file: string;
+  readonly project: string | null;
+  readonly bytes: number;
+  readonly bucket: StoreGuardPruneBucket;
+}
+
+export interface StoreGuardPrunePlan {
+  readonly entries: readonly StoreGuardPruneEntry[];
+  readonly counts: Readonly<Record<StoreGuardPruneBucket, number>>;
+  readonly reclaimableBytes: number;
+}
+
+export interface StoreGuardPruneDeps {
+  readonly exists: (path: string) => boolean;
+  readonly tmpDirs: readonly string[];
+}
+
+/**
+ * A temp-root candidate that authorizes deletion must be a REAL directory path, never the filesystem
+ * root or an empty string. MEASURED 2026-09-20 (cross-family review, P1): `TMPDIR=/` makes
+ * `os.tmpdir()` return the single character `"/"` (node strips a trailing slash only when the path is
+ * longer than one character), and `isUnder` then matches EVERY absolute path — so every
+ * `gone-outside-tmp` mark, which FR-3 exists to protect, would be classified `stale-temp` and deleted.
+ * A degenerate candidate authorizes nothing and is dropped here, in the pure half, where it is testable.
+ */
+function isUsableTmpDir(tmpDir: string): boolean {
+  const trimmed = tmpDir.trim();
+  return trimmed.length > 1 && trimmed !== sep && trimmed !== '/';
+}
+
+function isUnder(project: string, tmpDir: string): boolean {
+  const prefix = tmpDir.endsWith(sep) ? tmpDir : `${tmpDir}${sep}`;
+  return project === tmpDir || project.startsWith(prefix);
+}
+
+export function planStoreGuardPrune(
+  input: readonly { readonly file: string; readonly bytes: number; readonly text: string }[],
+  deps: StoreGuardPruneDeps,
+): StoreGuardPrunePlan {
+  const counts: Record<StoreGuardPruneBucket, number> = {
+    'stale-temp': 0,
+    live: 0,
+    'gone-outside-tmp': 0,
+    unreadable: 0,
+  };
+  let reclaimableBytes = 0;
+
+  const entries = input.map(({ file, bytes, text }): StoreGuardPruneEntry => {
+    let value: unknown;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      counts.unreadable += 1;
+      return { file, project: null, bytes, bucket: 'unreadable' };
+    }
+
+    if (typeof value !== 'object' || value === null
+      || typeof (value as { project?: unknown }).project !== 'string'
+      || (value as { project: string }).project.length === 0) {
+      counts.unreadable += 1;
+      return { file, project: null, bytes, bucket: 'unreadable' };
+    }
+
+    const project = (value as { project: string }).project;
+    const bucket: StoreGuardPruneBucket = deps.exists(project)
+      ? 'live'
+      : deps.tmpDirs.filter(isUsableTmpDir).some((tmpDir) => isUnder(project, tmpDir))
+        ? 'stale-temp'
+        : 'gone-outside-tmp';
+    counts[bucket] += 1;
+    if (bucket === 'stale-temp') reclaimableBytes += bytes;
+    return { file, project, bytes, bucket };
+  });
+
+  return { entries, counts, reclaimableBytes };
+}

package/src/sweep-failure-classify.ts

@@ -0,0 +1,88 @@
+/**
+ * Различитель красных обхода: ЛОГИЧЕСКИЙ отказ против отказа ПОД НАГРУЗКОЙ.
+ *
+ * ЗАЧЕМ. Запись 9e48a975 установила класс: набор harness-core детерминирован В ОДИНОЧКУ и
+ * краснеет ТОЛЬКО под параллельной нагрузкой (пять последовательных прогонов — ноль красных;
+ * те же тесты под фоновым вторым набором — красные поодиночке и в разных сочетаниях).
+ * Подпись класса: тест (а) читает собранный `dist`, (б) порождает процессы, (в) несёт явный
+ * таймаут, близкий к измеренному времени.
+ *
+ * ИЗМЕРЕНО 2026-09-19, новый экземпляр того же класса: `scout` прошёл в одном обходе и упал в
+ * следующем через 17 минут — `deep-analyzer.test.ts`, `Test timed out in 5000ms`, 192 из 193
+ * зелёные; тот же файл в одиночку 5 из 5. Единственное различие между прогонами — загрузка
+ * машины (подкачка 2342 → 2671 МБ).
+ *
+ * Класс диагностирован, но МЕХАНИЗМА не имел: каждый экземпляр стоил ручного разбора. Этот
+ * модуль — чистая половина механизма: он извлекает из журнала обхода ИМЕНА упавших файлов и
+ * классифицирует результат ПЕРЕПРОГОНА В ОДИНОЧКУ. Запуск живёт в скрипте, здесь его нет.
+ *
+ * ТРЁХЗНАЧНОСТЬ ОБЯЗАТЕЛЬНА. Перепрогон, который не удалось выполнить, — это НЕ «прошёл»;
+ * прибор, который не смог посмотреть, не имеет права на вердикт.
+ */
+
+/** Вердикт перепрогона одного файла в одиночку. */
+export type RerunVerdict = 'does-not-reproduce-alone' | 'reproduces-alone' | 'inconclusive';
+
+/**
+ * Имена упавших тестовых файлов из журнала набора. Понимает ОБА формата, которые даёт обход:
+ *   vitest    ` FAIL  test/x.test.ts > describe > it`
+ *   node:test `    location: '/abs/.../test/x.test.mjs:95:1'`
+ *
+ * Пути приводятся к виду, относительному каталогу пакета, потому что перепрогон запускается
+ * из него. Порядок сохраняется, дубликаты убираются: один файл перепрогоняется один раз.
+ */
+export function parseFailedTestFiles(logText: string, packageDir?: string): string[] {
+  const out: string[] = [];
+  const seen = new Set<string>();
+  const add = (raw: string): void => {
+    let p = raw.trim();
+    if (packageDir !== undefined && p.startsWith(packageDir)) {
+      p = p.slice(packageDir.length).replace(/^\/+/, '');
+    }
+    // Абсолютный путь к ЧУЖОМУ пакету перепрогонять нельзя: он не относителен нашему каталогу.
+    if (p.startsWith('/')) return;
+    if (p === '' || seen.has(p)) return;
+    seen.add(p);
+    out.push(p);
+  };
+  for (const line of logText.split('\n')) {
+    const vitest = /^\s*FAIL\s+(?:\|[^|]*\|\s*)?(\S+\.(?:test|spec)\.[cm]?[jt]s)\b/.exec(line);
+    if (vitest?.[1] !== undefined) { add(vitest[1]); continue; }
+    const node = /location:\s*'([^']+\.(?:test|spec)\.[cm]?[jt]s):\d+/.exec(line);
+    if (node?.[1] !== undefined) { add(node[1]); }
+  }
+  return out;
+}
+
+/**
+ * Вердикт по исходу перепрогона.
+ *
+ * @param sweepFailed упал ли файл в обходе (иначе классифицировать нечего)
+ * @param rerun       результат одиночного прогона, или null если запустить не удалось
+ */
+export function classifyRerun(
+  sweepFailed: boolean,
+  rerun: { readonly exitCode: number; readonly ranAnyTest: boolean } | null,
+): RerunVerdict {
+  if (!sweepFailed) return 'inconclusive';
+  if (rerun === null) return 'inconclusive';
+  // «Ни одного теста не запустилось» — это не зелёный прогон, а несостоявшаяся проба: так
+  // выглядит и опечатка в пути, и набор, который не грузится. Читать это как «прошёл» значит
+  // объявить файл нагрузочно-зависимым на основании того, что его никто не проверил.
+  if (!rerun.ranAnyTest) return 'inconclusive';
+  return rerun.exitCode === 0 ? 'does-not-reproduce-alone' : 'reproduces-alone';
+}
+
+/** Человеческая расшифровка вердикта — одна строка, называющая, что делать дальше. */
+export function describeVerdict(verdict: RerunVerdict): string {
+  if (verdict === 'does-not-reproduce-alone') {
+    // НЕ «зависит от нагрузки»: у зелёного одиночного прогона есть ДВЕ причины, и различить их
+    // перепрогоном нельзя — нагрузка обхода ЛИБО починка, внесённая уже после него. Называть
+    // одну из двух значило бы выдать догадку за измерение.
+    return 'в одиночку ЗЕЛЁНЫЙ — либо отказ зависел от нагрузки обхода, либо починка легла после него; перепрогон эти две причины не различает';
+  }
+  if (verdict === 'reproduces-alone') {
+    return 'в одиночку ТОЖЕ красный — настоящий дефект, нагрузка ни при чём';
+  }
+  return 'НЕ УСТАНОВЛЕНО — перепрогон не состоялся; это не «прошёл»';
+}

package/src/workflow-run-dispatch.ts

@@ -11,6 +11,7 @@
  * a convention whose reason is lost is the next thing somebody "cleans up".
  */
 
+import { CODEX_EXEC_PROMPT_CEILING_CHARS } from './feature-adr-routing.js';
 import type { Deliverable } from './loop-plan.js';
 import { claudeProbeArgs, claudeReviewArgs, extractClaudeResult, interpretClaudeProbe, type BridgeFamily } from './qe-bridge.js';
 import type { WfRunReason } from './workflow-run.js';
@@ -149,13 +150,24 @@ export const CODEX_SCOPING_PREFIX =
   'Answer directly from this prompt text alone; no commands, no files, no tools.';
 
 /**
- * The REAL prompt ceiling for `codex exec`.
+ * The REAL prompt ceiling for `codex exec` — RE-EXPORTED, never re-declared.
  *
  * The folk value 1200 is refuted history: it came from an era when the prompt travelled through a
  * fire-and-forget wrapper. Over-ceiling ⇒ a LOUD `prompt-over-ceiling`, never truncation — a
  * truncated prompt produces a confident answer to a question nobody asked.
+ *
+ * ONE NUMBER, ONE DEFINITION. Until 2026-09-20 this module declared its own `= 24_000` beside the
+ * one in `feature-adr-routing.ts`, and NOTHING compared them: no test imported both, so the two
+ * could diverge in silence and `codexExecPlan` would route to Claude at a different threshold than
+ * `makeCodexExecDispatcher` rejects at. Measured: `feature-adr-codex-dispatch.test.ts` asserts only
+ * `> 4000`, and the mirror guard in `codex-scoped-review.test.ts` ties routing.ts to the four
+ * workflow copies but knows nothing about this file.
+ *
+ * The definition lives in `feature-adr-routing.ts` and not here because THAT module is lifted
+ * verbatim into the workflow sandbox by `scripts/gen-loop-blobs.mjs` and therefore may not import
+ * anything. The dependency can only point this way.
  */
-export const CODEX_EXEC_PROMPT_CEILING_CHARS = 24_000;
+export { CODEX_EXEC_PROMPT_CEILING_CHARS };
 
 /**
  * argv for one codex dispatch. The prompt travels as ONE argv element (no shell, no quoting), and