@dzhechkov/p-replicator 1.10.4 → 1.13.1

package/CHANGELOG.md

@@ -5,6 +5,238 @@ All notable changes to `@dzhechkov/p-replicator` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+**Phase 0.5 gains the instrument for its `путь` axis: the source product is CLICKED THROUGH in a
+browser instead of the axis staying permanently empty.**
+
+Staged, not published — a disk version is not a shipped one.
+
+### Added
+
+- **`.claude/hooks/capture-source-path.cjs`** — the browser click-through. `clone-website` captures
+  what is visible at ONE url; the route a person takes through a product — registration, onboarding,
+  first value, paywall — was captured by nothing, so the `путь` column shipped in 1.13.0 had no way
+  to be filled. This walks it and emits rows in the SAME `FR-LOOK-nnn` family, continuing the
+  profile's numbering. No second identifier family, no second artifact: the axis is a COLUMN.
+
+  Three outcomes, each with its own exit code — `0` captured · `1` the source opened but has no
+  onward step (a one-screen product: a legitimate `ИСТОЧНИКА НЕТ` for this axis, and a PROVEN
+  negative rather than blindness) · `2` `НЕ ИЗМЕРЕНО` with a reason from the closed list, printed as
+  the exact profile lines to paste.
+
+  **The zero-dependency contract is untouched.** Playwright is an EXTERNAL prerequisite exactly like
+  `clone-website`'s browser MCP: the module is resolved on the machine at run time
+  (`PLAYWRIGHT_MODULE` → the project → `npm root -g`) and its absence is the honest outcome
+  `no-browser`, never a crash.
+
+  **The legality boundary is executable, not merely described.** REGULARITIES are captured — the
+  spacing step, the type scale, how many hierarchy levels, how many form fields, how many screens to
+  first value — never VALUES to carry over. Third-party CSS and DOM are copyrighted code, so they
+  are not stored by default (`--keep-dom` warns out loud); the evidence directory ships its own
+  `.gitignore` and a note that it holds someone else's material; `robots.txt` is read before
+  crawling more than one page and a refusal is the outcome `robots-disallowed`; authentication and
+  any circumvention are refused outright, with a login screen recorded as the legitimate last step;
+  the User-Agent is honest, because masquerading as an ordinary browser would itself be
+  circumvention. Politeness is enforced, not advised: one thread, a pause (default 1500 ms, floor
+  250), a hard page cap of 12 — exceeding either is clamped ALOUD.
+
+  **Brittleness is designed out.** Only computed styles and semantic roles (aria, form types,
+  accessible names) are read; class names are read NOWHERE, because bundlers change them on every
+  build of someone else's site.
+
+### Changed
+
+- **Each axis of the Source Product Profile now answers for itself** — `**Статус съёмки:**` for
+  `облик`, `**Статус съёмки (путь):**` for `путь`. They FAIL APART (a landing page captures while
+  the click-through dies on a 403), so one shared status would have to lie about one of them. This
+  is one extra header line in the SAME artifact, not a second document, and the path declaration is
+  demanded only when the axis carries no rows — rows are its answer.
+
+- `check-look-trace.cjs` now refuses an EMPTY, UNDECLARED `путь` axis with exit `2`. Before the
+  instrument existed, silence about the path was unavoidable; now it is a gap, and reading it as
+  clean would bless every profile that only ever looked at one screen. A `НЕ ИЗМЕРЕНО` path axis
+  keeps a fully traced profile at `2` — everything written down is traced, yet half the phase never
+  ran. A declared `ИСТОЧНИКА НЕТ` path axis does NOT block a clean bill, because the trace set is
+  non-empty and an honest answer must stay able to reach `0`. A proven loss outranks an unanswered
+  axis: `1` beats `2`.
+
+- The closed reason list grew by the four ways a CLICK-THROUGH fails, each naming a different
+  repair: `no-browser`, `bot-protected`, `timeout`, `robots-disallowed`. `no-browser-mcp` (the
+  `clone-website` prerequisite) and `no-browser` (a local Playwright) stay separate entries — they
+  are different missing tools, and the matcher is pinned so neither spelling swallows the other.
+
+### Measured
+
+- Nine live runs against a local fixture on 2026-09-01 exercised every outcome: captured,
+  one-screen, `no-browser`, `robots-disallowed` (both an explicit `Disallow` and an unreadable
+  robots.txt), `bot-protected` (403), `auth-required`, `out-of-scope`, `unreachable`. Politeness was
+  measured rather than asserted: at `--delay-ms 2000` the gap between requests was 2613 ms and
+  exactly two pages were fetched under `--max-pages 2`.
+
+- **The spacing step is inferred by SHARE, not by GCD, and that is a measurement, not a preference.**
+  One browser default expressed in `em` (an `h1` at 56px yields a 38px margin) collapses the GCD to
+  1–2 on a site with an honest 4px grid. On the probe histogram 8/12/16/20/24 the share for 4 is
+  0.91 and for 8 is 0.73, so 4 is named and the share is printed alongside — "step 4px, share 0.91"
+  is checkable, "step 4px" is not.
+
+- Six mutations, all discriminating: removing the path-axis gate (4 red), un-naming the instrument
+  in the rule (1), deleting the legality boundary from the rule (1), replacing the share inference
+  with an exact GCD (2), ignoring the politeness delay (1), skipping the robots.txt gate (1).
+
+- The always-loaded corpus grew by +1158.75 estimated tokens (1.33% of the re-pinned preimage),
+  inside the untouched 4037.75 trigger. The instrument's own doctrine lives in its file header,
+  which is not part of that corpus — nothing reads a hook on every run.
+
+## [1.13.0] - 2026-09-01
+
+**MINOR — `/replicate` gains a mandatory Phase 0.5 (Source Product Profile): when a project
+reproduces an existing product, its LOOK is captured on the record instead of being invented.**
+
+Staged, not published — a disk version is not a shipped one.
+
+### Added
+
+- **Phase 0.5 — Source Product Profile**, a phase of its own between the Phase 0 checkpoint and
+  Phase 1. It asks, in every run, whether the project reproduces a NAMED existing product and what
+  that product looks like, and writes `docs/source-product-profile.md` in all three outcomes:
+  `СНЯТ` (captured — a filled `FR-LOOK-nnn` seed table), `ИСТОЧНИКА НЕТ` (the project replicates
+  nothing — a legitimate answer), and `НЕ ИЗМЕРЕНО` (a source was named but could not be captured,
+  with a reason from the closed list `no-browser-mcp` | `unreachable` | `auth-required` |
+  `out-of-scope`).
+
+  It is a SEPARATE phase, not a seventh module of `reverse-engineering-unicorn`, because Phase 0 is
+  skipped entirely by the `--from-docs` / `--skip-discovery` entry. A look-capture inside Phase 0
+  would switch itself off for exactly the projects that arrive with someone else's documentation —
+  which are, more often than not, replications of someone else's product.
+
+  Identifiers are ONE family: `FR-LOOK-<nnn>` with the axis (`облик` / `путь`) as a COLUMN. A second
+  namespace such as `FR-FLOW-nnn` would have to be kept in step with the first; one family with a
+  column does not.
+
+- `.claude/hooks/check-look-trace.cjs` — the deterministic half. Did the Phase-0.5 seed reach
+  `docs/Specification.md`? Three exit codes, and the third is the point: `0` traced (or rejected
+  with a reason), `1` proven loss with the ids NAMED, `2` THE CHECK DID NOT RUN — no profile, no
+  Specification, an untouched template table, a reused id, a row with no axis, or either of the two
+  legitimate non-captures. Per the shipped `honest-configuration` rule (CFG-I4), an unreachable
+  source of truth yields UNKNOWN, never a plausible value.
+
+  The capture itself is performed by the canonical `clone-website` skill from the separate
+  `@dzhechkov/skills-website-cloner` package, run recon-only. It is **called, never vendored**
+  (ADR-0001): the pre-shipped skill contract stays at ten.
+
+### Changed
+
+- `reverse-engineering-unicorn/modules/025-cjm-prototype.md`: the industry palette table
+  (Health→Emerald, Fintech→Blue, …) is now a **labelled FALLBACK**, reachable only through
+  «источника нет» and «облик НЕ ИЗМЕРЕН», with a precedence block above it. A pipeline whose job is
+  to reproduce a product was assigning that product a palette by industry; the guess is not one of
+  two equal options, it is worse than a measurement by exactly the distance between invented and
+  observed. The table stays — it is the right answer when there is no source — and in those states
+  it is signed as a fallback, because an unlabelled palette and a labelled one look identical to the
+  next reader and mean different things.
+- Hook inventory: **11** utilities in `.claude/hooks/` (was 10). `replicate-pipeline.md` had said
+  «Hooks (8 files)» since the ninth and tenth landed — a second-generation lie fixed in the same
+  change, along with the README hook table, which listed only seven of them.
+- `replicate.md`, `rules/replicate-pipeline.md` and `agents/replicate-coordinator.md` — the three
+  places that declare the phase sequence — all carry Phase 0.5 and the same artifact path; a test
+  pins their agreement and the section ORDER.
+
+### Tests
+
+- `tests/unit/check-look-trace.test.js` — 15 behaviour tests over real temporary projects: a filled
+  table with no promotion exits 1 with the lost ids NAMED; an absent profile exits 2, never 0; an
+  untouched bracketed template exits 2 rather than reading as "the phase ran"; each of the three
+  outcomes, the closed reason list, a reused id, a missing axis, and one binary producing all three
+  verdicts in a single run.
+- `tests/unit/look-phase-contract.test.js` — 9 tests pinning the phase in the prose: the Phase 0.5
+  section index lies between the Phase 0 checkpoint and the Phase 1 heading, the three declaring
+  files agree, the industry palette is labelled a fallback with the precedence block ABOVE the
+  table, the capture skill is not vendored, and the advertised hook count matches what ships.
+  MEASURED: three independent mutations (renaming the section heading, unlabelling the table
+  caption, unregistering the hook) each turn the suite red.
+
+## [1.12.0] - 2026-08-31
+
+**MINOR — the pre-shipped rule contract moves from seven rules to nine, and the port check gains a
+second, deliberately chosen scope.**
+
+Note for anyone upgrading from 1.10.4: `1.11.0` was prepared but never published, so this release
+carries its ladder work as well. Read both entries.
+
+### Added
+
+- `check-ports.cjs --machine`: a second scope that inventories the running containers of the current
+  Docker context, recognizes storage through the shared image taxonomy, attributes Compose ownership
+  from labels, and probes Redis auth live. The rule always stated a MACHINE invariant while the check
+  answered for one DIRECTORY — a green receipt was reported on a host where three neighbouring
+  databases sat on `0.0.0.0` and a Redis ran with no password at all. Catalog mode never queries the
+  runtime; the loopback exception stays, and revoking it would be a separate decision.
+- `swarm-file-evidence` rule: every parallel work unit has a named file result. A narrative reply is
+  only a pointer, silence is neither progress nor completion, and a status of `running` beside a dead
+  recorded PID closes the unit as failed rather than reporting work from silence.
+- `honest-configuration` rule: a value governing external output, access, limits, routing, or an
+  authoritative measurement must not become plausible or permissive when its meaning is absent or
+  unproven. `undefined` stays distinct from `''`, the allowlist lives in code while the environment
+  only selects from it, and `0/0` renders unavailable rather than `0%`.
+- The packaged `write-insight.cjs` boundary is the required final persistence gate for quick and full
+  `/harvest` runs carrying a candidate. Its structured-stdin contract lazily creates the Markdown
+  carrier, preserves prior bytes on append, and returns `duplicate` for an exact normalized replay.
+  Runtime behaviour has no `dz` dependency. Until this landed, `/harvest` had no writer at all: a
+  field project ran three days and 69 commits with 19 fixes and zero insights recorded, every
+  surface green.
+- Exact-artifact acceptance installs `npm pack` output into a fresh consumer and exercises
+  absent → create → append → replay → delete → doctor → recreate without checkout substitution.
+- Targeted mutation defenses for receipt enforcement, first-write creation, exact-repeat idempotence
+  and missing-carrier visibility.
+- `doctor` reports the insight FLOW: fix commits against insight records for a named period. It is
+  informational by construction — a low ratio can equally mean the work went smoothly — and it never
+  changes doctor's exit code.
+
+### Changed
+
+- The SessionStart insight hook now prints `инсайтов пока нет; /myinsights создаст первую запись`
+  when the carrier is absent, while remaining exit-zero and non-mutating; empty and read-error states
+  stay distinct from that ordinary missing branch. The hook's silence was the named cause of the
+  three-day invisibility above.
+- The pre-shipped hook/utility contract grows from 9 to 10.
+- Insight delivery delegates to `dz` only when recall is genuinely ARMED. `command -v dz` is not the
+  condition: local output is suppressed only after a successful, non-empty recall carrying
+  `--domain p-replicator-insights`. Absent, failing, and empty recall each fall back to local output,
+  and a failure is named rather than swallowed. Markdown remains the source of truth throughout.
+- `docker-ports.md` now names EXPOSURE as the consequence of a miss instead of port conflicts, and
+  explains that the left-hand side of `${DB_PORT:-11432}:5432` says nothing about the publish
+  address — the address is the third element, defaulting to all interfaces.
+
+### Honest limits
+
+- An unreadable state — no git, not a repository, an unreadable carrier, a config that cannot be
+  parsed — renders as NOT PERFORMED with its reason named, never as a measured zero. A check that
+  answers "clean" about a state it could not read is worse than no check.
+- `--machine` is a snapshot of the current Docker context at the moment it is invoked. It is not
+  continuous monitoring, and it says nothing about stopped containers or another context.
+- The flow check counts; it does not judge whether the captured insights are worth anything.
+
+## [1.11.0] - 2026-08-30
+
+**MINOR — the pre-shipped consumer rule contract moves from six rules to seven.**
+
+### Added
+
+- Added the consumer-local `cost-of-detection-ladder` rule: five enforcement layers, signal-fit
+  check selection, and an owned reaction for every violation.
+- Registered and shipped the ladder as the seventh rule required by `init`, `doctor`, and `verify`,
+  with link-backs from the two ADR-named quality-gate rules.
+
+### Fixed
+
+- Made the backlink contract ignore the ladder link itself when detecting prose allusions, so
+  removing either required link now makes the focused gate fail.
+- Replaced the distribution tautology with an assertion over the actual `npm pack --dry-run --json`
+  file listing.
+- Added a mutation-gate case for removing the seventh-rule requirement, restored the count scanner's
+  cross-line reach, and aligned the signed manifest with the files npm actually packs.
+
 ## [1.10.0] - 2026-08-27
 
 **Every guard in this package can now be shown to fail — and three that could not, now can.**

package/MULTIPLATFORM_ROADMAP.md

@@ -112,7 +112,7 @@ Beyond Level 2 — adapt logic for platform-specific capabilities:
 | `/myinsights`, `/docs`, `/harvest`, `/start`, `/deploy` | ✅ universal | path-translate | **Yes** |
 | 10 skills (sparc-prd-mini, etc.) | ⚠️ Claude-specific composition | inline-compile into commands | **Compromise** — sacrifice runtime-loading |
 | 4 pre-shipped agents | ⚠️ Claude Task-tool specific | translate to platform sub-agents | **Yes if platform supports** |
-| 6 rules | ✅ universal markdown | path-translate | **Yes** |
+| 13 rules | ✅ universal markdown | path-translate | **Yes** |
 | Hooks (SessionStart insights, Stop autocommit) | ❌ Claude-only | bake into commands as instructions | **Compromise** — degraded UX |
 | Statusline dashboard | ❌ Claude-only | optional `progress.md` file? | **Skip** — Claude-exclusive feature |
 | `verify` CLI command | ✅ universal | works as-is | **Yes** (already works) |

package/README/eng/01_quickstart.md

@@ -22,7 +22,7 @@ This creates:
 - `.claude/skills/` — 10 pre-shipped skills
 - `.claude/commands/` — 11 slash commands (`/replicate`, `/run`, `/feature`, ...)
 - `.claude/agents/` — 4 pipeline agents
-- `.claude/rules/` — 5 governance rules
+- `.claude/rules/` — 9 governance rules
 - `.claude/hooks/` — 6 cross-platform Node scripts
 - `.claude/settings.json` — hooks + statusline configuration
 - `.p-replicator.json` — install manifest
@@ -162,7 +162,7 @@ npx @dzhechkov/p-replicator verify
 
 The command checks:
 
-- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json
+- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 13 rules + settings.json
 - **Post-/replicate hints** (advisory): CLAUDE.md, project-specific agents,
   feature-roadmap.json, security rules, etc.
 
@@ -225,7 +225,7 @@ your-project/
 │   ├── skills/              # 10 skills
 │   ├── commands/            # 11 slash commands
 │   ├── agents/              # 4 pipeline agents
-│   ├── rules/               # 6 rules
+│   ├── rules/               # 13 rules
 │   ├── hooks/               # 6 Node scripts
 │   └── settings.json        # hooks + statusline config
 ├── .p-replicator.json       # install manifest

package/README/eng/02_user_guide.md

@@ -501,7 +501,7 @@ npx @dzhechkov/p-replicator verify
 ```
 
 Should report:
-- ✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 6 rules + settings.json)
+- ✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 13 rules + settings.json)
 - ✅ Post-/replicate hints — many will be absent in Mode 2 (this is normal)
 - 📊 Per-feature artifacts: `docs/features/<id>/01_specification.md`...`05_completion.md`,
   `validation-report.md`, `review-report.md`

package/README/eng/03_admin_guide.md

@@ -83,7 +83,7 @@ P-Replicator V1.5.0 ● user │ Sonnet 4.7
 🚀 Pipeline   /<cmd> ▓▓▓░░░░ 50%  │ Phase: VALIDATE (2/4)  │ Last: /replicate
 🎯 Roadmap    [●●●○○○○○] mvp 3/8   │ Done 5/12  │ ▶ auth-jwt  │ Domain: banking
 📊 SPARC      ●11/11  │ 🟢 78/100  │ Plans ●3  │ ADRs ●2  │ Harvest 2026-05-05
-🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●6+2 │ Hooks ●7/7
+🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●13+2 │ Hooks ●17/17
 💡 Insights   ●12 (2026-05-06) │ Tests 85/85 ✓ │ MCP ●1/1 │ Settings ✓ │ 🧬 Keysarium ✓
 ```
 
@@ -245,7 +245,7 @@ from PRD MVP scope, or by hand).
 
 | Tool | Checks | When |
 |---|---|---|
-| `npx @dzhechkov/p-replicator doctor` | Pre-shipped contract: 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 7 hooks + git on PATH | After init / when something seems broken |
+| `npx @dzhechkov/p-replicator doctor` | Pre-shipped contract: 10 skills + 11 commands + 4 agents + 13 rules + settings.json + 17 hooks + git on PATH | After init / when something seems broken |
 | `npx @dzhechkov/p-replicator verify` | Pre-shipped + post-/replicate hints (CLAUDE.md, planner.md, security.md, feature-roadmap.json, etc.) | After every `/replicate` to confirm |
 
 **`doctor` exit codes:**

package/README/eng/04_api_reference.md

@@ -51,7 +51,7 @@ Formal reference: CLI commands, flags, JSON schemas.
   ],
   "shippedDefaults": {
     "settings.json": {
-      "hooks": { "SessionStart": [...], "Stop": [...] },
+      "hooks": { "SessionStart": [...], "UserPromptSubmit": [...], "Stop": [...] },
       "statusLine": { "type": "command", "command": "..." }
     }
   }
@@ -176,6 +176,7 @@ node .claude/hooks/state-update.cjs --json '{"currentCommand":"/run", ...}'
   },
   "hooks": {
     "SessionStart": [ /* matchers + hooks */ ],
+    "UserPromptSubmit": [ /* matchers + hooks */ ],
     "Stop": [ /* matchers + hooks */ ],
     "PreToolUse": [ /* user-added */ ],
     "PostToolUse": [ /* user-added */ ]
@@ -216,6 +217,7 @@ Each entry:
 
 **Event types in Claude Code:**
 - `SessionStart` — at session start (stdout injected into context)
+- `UserPromptSubmit` — after the real user prompt is available (structured context injection)
 - `Stop` — at turn end (side-effects: commit, log)
 - `PreToolUse`, `PostToolUse` — around tool calls
 
@@ -268,10 +270,14 @@ Used by `verify`, `doctor`, `list` for uniform path resolution.
 
 ### `session-insights.cjs`
 
-**Trigger:** `SessionStart` hook.
-**Reads:** `.claude/insights/index.md` (`## YYYY-MM-DD` headings)
-**Writes:** stdout (Claude Code injects into session context)
-**Output:** up to 3 recent insights as `## Recent project insights\n\n## ... ## ... ## ...`
+**Trigger:** `SessionStart` and `UserPromptSubmit` hooks.
+**Reads:** the Markdown source of truth at `.claude/insights/index.md`; prompt-time delivery also
+invokes optional `dz recall` with the project root pinned.
+**Writes:** the missing-carrier hint at SessionStart, or one UserPromptSubmit context envelope.
+**Output:** only a successful, non-empty dz recall result suppresses local output. Absent, failing,
+or empty recall uses the local fallback of up to 3 recent Markdown entries; failure is named and the
+other two states are quiet. The writer establishes Markdown first and only then attempts a
+best-effort, idempotent `dz teach` duplicate, so projection failure cannot erase the record.
 
 ### `autocommit-roadmap.cjs` / `autocommit-insights.cjs` / `autocommit-plans.cjs`
 

package/README/eng/05_architecture.md

@@ -73,7 +73,7 @@ function getItemRelativePath(comp, itemKey) {
 
 **Design principle:** zero shell dependency.
 
-All 7 hook scripts are pure Node, using `execFileSync('git', [...])`
+All 15 hook scripts are pure Node, using `execFileSync('git', [...])`
 instead of shell pipes. This works equivalently on:
 - Windows cmd.exe (no `2>/dev/null`, no `2>nul` — neither needed)
 - Bash / zsh / Git Bash on Windows

package/README/eng/README.md

@@ -6,7 +6,8 @@ product development in Claude Code (Vibe Coding).
 ## What it is
 
 `p-replicator` installs a ready-made `.claude/` toolkit into any project:
-**11 slash commands**, **10 skills**, **4 agents**, **6 rules**, **7 hook
+**11 slash commands**, **10 skills**, **4 agents**, **13 rules**, **15 hook
+**11 slash commands**, **10 skills**, **4 agents**, **13 rules**, **7 hook
 scripts**, and a `settings.json` with pre-configured hooks. The flagship
 `/replicate` command takes a project through a 5-phase pipeline (Discovery →
 Planning → Validation → Toolkit Generation → Finalize), generating SPARC

package/README/ru/01_quickstart.md

@@ -22,7 +22,7 @@ npx @dzhechkov/p-replicator init
 - `.claude/skills/` — 10 предустановленных skills
 - `.claude/commands/` — 11 slash-команд (`/replicate`, `/run`, `/feature`, ...)
 - `.claude/agents/` — 4 пайплайн-агента
-- `.claude/rules/` — 5 governance-правил
+- `.claude/rules/` — 9 governance-правил
 - `.claude/hooks/` — 6 cross-platform Node-скриптов
 - `.claude/settings.json` — конфигурация hooks + statusline
 - `.p-replicator.json` — манифест установки
@@ -162,7 +162,7 @@ npx @dzhechkov/p-replicator verify
 
 Команда проверит:
 
-- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json
+- **Pre-shipped contract** (must-have): 10 skills + 11 commands + 4 agents + 13 rules + settings.json
 - **Post-/replicate hints** (advisory): CLAUDE.md, project-specific агенты,
   feature-roadmap.json, security-правила и т.д.
 
@@ -225,7 +225,7 @@ npx @dzhechkov/p-replicator doctor
 │   ├── skills/              # 10 skills
 │   ├── commands/            # 11 slash-команд
 │   ├── agents/              # 4 pipeline-агента
-│   ├── rules/               # 6 правил
+│   ├── rules/               # 13 правил
 │   ├── hooks/               # 6 Node-скриптов
 │   └── settings.json        # hooks + statusline config
 ├── .p-replicator.json       # манифест установки

package/README/ru/02_user_guide.md

@@ -502,7 +502,7 @@ npx @dzhechkov/p-replicator verify
 ```
 
 Должен показать:
-- ✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 6 rules + settings.json)
+- ✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 13 rules + settings.json)
 - ✅ Post-/replicate hints — для Mode 2 многие будут отсутствовать (это нормально)
 - 📊 Per-feature artifacts: `docs/features/<id>/01_specification.md`...`05_completion.md`,
   `validation-report.md`, `review-report.md`

package/README/ru/03_admin_guide.md

@@ -83,7 +83,7 @@ P-Replicator V1.5.0 ● user │ Sonnet 4.7
 🚀 Pipeline   /<cmd> ▓▓▓░░░░ 50%  │ Phase: VALIDATE (2/4)  │ Last: /replicate
 🎯 Roadmap    [●●●○○○○○] mvp 3/8   │ Done 5/12  │ ▶ auth-jwt  │ Domain: banking
 📊 SPARC      ●11/11  │ 🟢 78/100  │ Plans ●3  │ ADRs ●2  │ Harvest 2026-05-05
-🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●6+2 │ Hooks ●7/7
+🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●13+2 │ Hooks ●17/17
 💡 Insights   ●12 (2026-05-06) │ Tests 85/85 ✓ │ MCP ●1/1 │ Settings ✓ │ 🧬 Keysarium ✓
 ```
 
@@ -248,7 +248,7 @@ echo ".claude/.last-test.json" >> .gitignore
 
 | Инструмент | Что проверяет | Когда |
 |---|---|---|
-| `npx @dzhechkov/p-replicator doctor` | Pre-shipped contract: 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 7 hooks + git on PATH | После init / при подозрении что что-то сломалось |
+| `npx @dzhechkov/p-replicator doctor` | Pre-shipped contract: 10 skills + 11 commands + 4 agents + 13 rules + settings.json + 17 hooks + git on PATH | После init / при подозрении что что-то сломалось |
 | `npx @dzhechkov/p-replicator verify` | Pre-shipped + post-/replicate hints (CLAUDE.md, planner.md, security.md, feature-roadmap.json, и т.д.) | После каждого `/replicate` для уверенности |
 
 **`doctor` exit codes:**

package/README/ru/04_api_reference.md

@@ -51,7 +51,7 @@
   ],
   "shippedDefaults": {
     "settings.json": {
-      "hooks": { "SessionStart": [...], "Stop": [...] },
+      "hooks": { "SessionStart": [...], "UserPromptSubmit": [...], "Stop": [...] },
       "statusLine": { "type": "command", "command": "..." }
     }
   }
@@ -180,6 +180,7 @@ node .claude/hooks/state-update.cjs --json '{"currentCommand":"/run", ...}'
   },
   "hooks": {
     "SessionStart": [ /* matchers + hooks */ ],
+    "UserPromptSubmit": [ /* matchers + hooks */ ],
     "Stop": [ /* matchers + hooks */ ],
     "PreToolUse": [ /* user-added */ ],
     "PostToolUse": [ /* user-added */ ]
@@ -220,6 +221,7 @@ node .claude/hooks/state-update.cjs --json '{"currentCommand":"/run", ...}'
 
 **Event types в Claude Code:**
 - `SessionStart` — при начале сессии (stdout инжектится в context)
+- `UserPromptSubmit` — после появления реального пользовательского prompt (structured context)
 - `Stop` — при завершении turn'а (side-effects: commit, log)
 - `PreToolUse`, `PostToolUse` — вокруг tool-вызовов
 
@@ -299,10 +301,14 @@ const COMPONENTS = {
 
 ### `session-insights.cjs`
 
-**Trigger:** `SessionStart` hook.
-**Reads:** `.claude/insights/index.md` (`## YYYY-MM-DD` headings)
-**Writes:** stdout (Claude Code инжектит в session context)
-**Output:** до 3 свежих insights в `## Recent project insights\n\n## ... ## ... ## ...` format
+**Trigger:** hooks `SessionStart` и `UserPromptSubmit`.
+**Reads:** Markdown-источник истины `.claude/insights/index.md`; prompt-time выдача также вызывает
+optional `dz recall` с закреплённым корнем проекта.
+**Writes:** missing-carrier hint на SessionStart либо один context-envelope UserPromptSubmit.
+**Output:** только успешный непустой вывод recall подавляет локальную выдачу. Отсутствующий,
+падающий или пустой recall использует локальный fallback до 3 свежих Markdown-записей; failure
+назван, отсутствие и пустой вывод тихие. Writer сначала сохраняет Markdown и только затем делает
+best-effort идемпотентный дубль через `dz teach`, поэтому отказ проекции не стирает запись.
 
 ### `autocommit-roadmap.cjs` / `autocommit-insights.cjs` / `autocommit-plans.cjs`
 

package/README/ru/05_architecture.md

@@ -73,7 +73,7 @@ function getItemRelativePath(comp, itemKey) {
 
 **Дизайн-принцип:** zero shell dependency.
 
-Все 7 hook-скриптов написаны на pure Node, используют `execFileSync('git', [...])`
+Все 15 hook-скриптов написаны на pure Node, используют `execFileSync('git', [...])`
 вместо shell-pipes. Это эквивалентно работает на:
 - Windows cmd.exe (нет `2>/dev/null`, есть `2>nul` — не нужен ни тот ни другой)
 - Bash / zsh / Git Bash на Windows

package/README/ru/README.md

@@ -6,7 +6,8 @@ toolkit для AI-assisted разработки в Claude Code (Vibe Coding).
 ## Что это
 
 `p-replicator` устанавливает в проект готовый набор `.claude/`-инструментов:
-**11 slash-команд**, **10 skills**, **4 агента**, **6 правил**, **7 hook-скриптов**
+**11 slash-команд**, **10 skills**, **4 агента**, **13 правил**, **15 hook-скриптов**
+**11 slash-команд**, **10 skills**, **4 агента**, **13 правил**, **7 hook-скриптов**
 и `settings.json` с pre-configured хуками. Главная команда `/replicate`
 проводит проект через 5-фазный pipeline (Discovery → Planning → Validation →
 Toolkit Generation → Finalize), генерирует SPARC-документацию и project-specific

package/README/ru/html/index.html

@@ -112,7 +112,7 @@
 <h1 id="dokumentatsiya-dzhechkovp-replicator">Документация @dzhechkov/p-replicator</h1>
 <p>Полный комплект документации к npm-пакету <code>@dzhechkov/p-replicator</code> — toolkit для AI-assisted разработки в Claude Code (Vibe Coding).</p>
 <h2 id="index-chto-eto">Что это</h2>
-<p><code>p-replicator</code> устанавливает в проект готовый набор <code>.claude/</code>-инструментов: <strong>11 slash-команд</strong>, <strong>10 skills</strong>, <strong>4 агента</strong>, <strong>6 правил</strong>, <strong>7 hook-скриптов</strong> и <code>settings.json</code> с pre-configured хуками. Главная команда <code>/replicate</code> проводит проект через 5-фазный pipeline (Discovery → Planning → Validation → Toolkit Generation → Finalize), генерирует SPARC-документацию и project-specific артефакты.</p>
+<p><code>p-replicator</code> устанавливает в проект готовый набор <code>.claude/</code>-инструментов: <strong>11 slash-команд</strong>, <strong>10 skills</strong>, <strong>4 агента</strong>, <strong>13 правил</strong>, <strong>17 hook-скриптов</strong> и <code>settings.json</code> с pre-configured хуками. Главная команда <code>/replicate</code> проводит проект через 5-фазный pipeline (Discovery → Planning → Validation → Toolkit Generation → Finalize), генерирует SPARC-документацию и project-specific артефакты.</p>
 <h2 id="index-navigatsiya">Навигация</h2>
 <div class="table-wrap"><table><thead><tr><th>Раздел</th><th>Описание</th></tr></thead><tbody><tr><td><a href="#quickstart">01_quickstart.md</a></td><td>Установка, первый запуск, проверка</td></tr><tr><td><a href="#user-guide">02_user_guide.md</a></td><td>Все команды и workflow с примерами</td></tr><tr><td><a href="#admin-guide">03_admin_guide.md</a></td><td>Настройка hooks, settings.json, statusline, insights</td></tr><tr><td><a href="#api-reference">04_api_reference.md</a></td><td>CLI-флаги, схемы манифеста, roadmap, state</td></tr><tr><td><a href="#architecture">05_architecture.md</a></td><td>Архитектура: pre-shipped vs generated, SSOT, hooks</td></tr><tr><td><a href="#troubleshooting">06_troubleshooting.md</a></td><td>Решение типичных проблем</td></tr><tr><td><a href="#changelog">07_changelog.md</a></td><td>История версий 1.3.x → 1.5.x</td></tr></tbody></table></div>
 <h2 id="index-yazyki">Языки</h2>
@@ -140,7 +140,7 @@ claude                              # открыть Claude Code
 <p>В корне вашего проекта:</p>
 <pre data-lang="bash"><code class="language-bash">npx @dzhechkov/p-replicator init</code></pre>
 <p>Это создаст:</p>
-<ul><li><code>.claude/skills/</code> — 10 предустановленных skills</li><li><code>.claude/commands/</code> — 11 slash-команд (<code>/replicate</code>, <code>/run</code>, <code>/feature</code>, ...)</li><li><code>.claude/agents/</code> — 4 пайплайн-агента</li><li><code>.claude/rules/</code> — 5 governance-правил</li><li><code>.claude/hooks/</code> — 6 cross-platform Node-скриптов</li><li><code>.claude/settings.json</code> — конфигурация hooks + statusline</li><li><code>.p-replicator.json</code> — манифест установки</li></ul>
+<ul><li><code>.claude/skills/</code> — 10 предустановленных skills</li><li><code>.claude/commands/</code> — 11 slash-команд (<code>/replicate</code>, <code>/run</code>, <code>/feature</code>, ...)</li><li><code>.claude/agents/</code> — 4 пайплайн-агента</li><li><code>.claude/rules/</code> — 9 governance-правил</li><li><code>.claude/hooks/</code> — 6 cross-platform Node-скриптов</li><li><code>.claude/settings.json</code> — конфигурация hooks + statusline</li><li><code>.p-replicator.json</code> — манифест установки</li></ul>
 <p>Установка идемпотентна: <code>init</code> не перезапишет существующие файлы без флага <code>--force</code>.</p>
 <h2 id="quickstart-pervyy-zapusk">Первый запуск</h2>
 <pre data-lang="bash"><code class="language-bash">claude                                    # открыть Claude Code в проекте</code></pre>
@@ -186,7 +186,7 @@ mv docs/your-arch.md  docs/Architecture.md
 <p>После <code>/replicate</code> выполните:</p>
 <pre data-lang="bash"><code class="language-bash">npx @dzhechkov/p-replicator verify</code></pre>
 <p>Команда проверит:</p>
-<ul><li><strong>Pre-shipped contract</strong> (must-have): 10 skills + 11 commands + 4 agents + 6 rules + settings.json</li><li><strong>Post-/replicate hints</strong> (advisory): CLAUDE.md, project-specific агенты, feature-roadmap.json, security-правила и т.д.</li></ul>
+<ul><li><strong>Pre-shipped contract</strong> (must-have): 10 skills + 11 commands + 4 agents + 13 rules + settings.json</li><li><strong>Post-/replicate hints</strong> (advisory): CLAUDE.md, project-specific агенты, feature-roadmap.json, security-правила и т.д.</li></ul>
 <p>Exit code <code>0</code> означает что pre-shipped контракт цел; warnings показывают что из project-specific артефактов ещё не создано.</p>
 <p>Альтернатива (для общей health-проверки):</p>
 <pre data-lang="bash"><code class="language-bash">npx @dzhechkov/p-replicator doctor</code></pre>
@@ -213,7 +213,7 @@ mv docs/your-arch.md  docs/Architecture.md
 │   ├── skills/              # 10 skills
 │   ├── commands/            # 11 slash-команд
 │   ├── agents/              # 4 pipeline-агента
-│   ├── rules/               # 6 правил
+│   ├── rules/               # 13 правил
 │   ├── hooks/               # 6 Node-скриптов
 │   └── settings.json        # hooks + statusline config
 ├── .p-replicator.json       # манифест установки
@@ -429,7 +429,7 @@ claude
 <p>После <code>/feature</code> (или <code>/run</code>) запустите:</p>
 <pre data-lang="bash"><code class="language-bash">npx @dzhechkov/p-replicator verify</code></pre>
 <p>Должен показать:</p>
-<ul><li>✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 6 rules + settings.json)</li><li>✅ Post-/replicate hints — для Mode 2 многие будут отсутствовать (это нормально)</li><li>📊 Per-feature artifacts: <code>docs/features/&lt;id&gt;/01_specification.md</code>...<code>05_completion.md</code>, <code>validation-report.md</code>, <code>review-report.md</code></li></ul>
+<ul><li>✅ Pre-shipped contract intact (10 skills + 11 commands + 4 agents + 13 rules + settings.json)</li><li>✅ Post-/replicate hints — для Mode 2 многие будут отсутствовать (это нормально)</li><li>📊 Per-feature artifacts: <code>docs/features/&lt;id&gt;/01_specification.md</code>...<code>05_completion.md</code>, <code>validation-report.md</code>, <code>review-report.md</code></li></ul>
 <h4 id="user-guide-future-enhancement-m3-v-knownlimitations">Future enhancement (M3 в KNOWN_LIMITATIONS)</h4>
 <p><code>docPaths</code> config в <code>.p-replicator.json</code> для нестандартных путей доков — в roadmap'е. Tier S effort, чисто config + spec-read изменения, без изменений CLI-кода.</p>
 <hr>
@@ -551,7 +551,7 @@ Set DATABASE_URL_SHADOW env var explicitly to a separate database.
 🚀 Pipeline   /&lt;cmd&gt; ▓▓▓░░░░ 50%  │ Phase: VALIDATE (2/4)  │ Last: /replicate
 🎯 Roadmap    [●●●○○○○○] mvp 3/8   │ Done 5/12  │ ▶ auth-jwt  │ Domain: banking
 📊 SPARC      ●11/11  │ 🟢 78/100  │ Plans ●3  │ ADRs ●2  │ Harvest 2026-05-05
-🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●6+2 │ Hooks ●7/7
+🛠️ Toolkit   Skills ●10/10 │ Cmds ●11/11 │ Agents ●4+3 │ Rules ●13+2 │ Hooks ●17/17
 💡 Insights   ●12 (2026-05-06) │ Tests 85/85 ✓ │ MCP ●1/1 │ Settings ✓ │ 🧬 Keysarium ✓</code></pre>
 <p><strong>Источники (heuristic + state-file):</strong></p>
 <div class="table-wrap"><table><thead><tr><th>Метрика</th><th>Откуда</th></tr></thead><tbody><tr><td>Pipeline command + phase + progress</td><td><code>.claude/.p-replicator-state.json</code> (state-file)</td></tr><tr><td>Roadmap progress</td><td><code>.claude/feature-roadmap.json</code></td></tr><tr><td>SPARC count</td><td><code>docs/{PRD,Architecture,...}.md</code> files</td></tr><tr><td>Validation score</td><td>regex extract from <code>docs/validation-report.md</code></td></tr><tr><td>Plans count</td><td><code>docs/plans/*.md</code></td></tr><tr><td>ADRs count</td><td><code>docs/ADR.md</code> <code>## ADR-...</code> headings, или <code>docs/adr/*.md</code>, или <code>docs/ddd/adr/*.md</code></td></tr><tr><td>Insights count + last date</td><td><code>## YYYY-MM-DD</code> headings в <code>.claude/insights/index.md</code></td></tr><tr><td>Toolkit counts</td><td>filesystem walk <code>.claude/{skills,commands,agents,rules,hooks}/</code></td></tr><tr><td>Settings status</td><td>deep-equals current vs <code>manifest.shippedDefaults</code> → <code>defaults</code>/<code>merged</code></td></tr><tr><td>MCP servers</td><td><code>.mcp.json</code></td></tr><tr><td>Domain</td><td>keyword grep <code>CLAUDE.md</code> (banking/retail/enterprise/healthcare)</td></tr><tr><td>Last harvest</td><td><code>TOOLKIT_HARVEST.md</code> mtime</td></tr><tr><td>Last test</td><td>optional <code>.claude/.last-test.json</code> cache</td></tr></tbody></table></div>
@@ -638,7 +638,7 @@ echo ".claude/.last-test.json" &gt;&gt; .gitignore</code></pre>
 <p><strong>Auto-commit</strong> через <code>autocommit-roadmap.cjs</code> (Stop hook) при изменениях.</p>
 <hr>
 <h2 id="admin-guide-doctor-verify-dva-raznyh-instrumenta">Doctor + Verify — два разных инструмента</h2>
-<div class="table-wrap"><table><thead><tr><th>Инструмент</th><th>Что проверяет</th><th>Когда</th></tr></thead><tbody><tr><td><code>npx @dzhechkov/p-replicator doctor</code></td><td>Pre-shipped contract: 10 skills + 11 commands + 4 agents + 6 rules + settings.json + 7 hooks + git on PATH</td><td>После init / при подозрении что что-то сломалось</td></tr><tr><td><code>npx @dzhechkov/p-replicator verify</code></td><td>Pre-shipped + post-/replicate hints (CLAUDE.md, planner.md, security.md, feature-roadmap.json, и т.д.)</td><td>После каждого <code>/replicate</code> для уверенности</td></tr></tbody></table></div>
+<div class="table-wrap"><table><thead><tr><th>Инструмент</th><th>Что проверяет</th><th>Когда</th></tr></thead><tbody><tr><td><code>npx @dzhechkov/p-replicator doctor</code></td><td>Pre-shipped contract: 10 skills + 11 commands + 4 agents + 13 rules + settings.json + 17 hooks + git on PATH</td><td>После init / при подозрении что что-то сломалось</td></tr><tr><td><code>npx @dzhechkov/p-replicator verify</code></td><td>Pre-shipped + post-/replicate hints (CLAUDE.md, planner.md, security.md, feature-roadmap.json, и т.д.)</td><td>После каждого <code>/replicate</code> для уверенности</td></tr></tbody></table></div>
 <p><strong><code>doctor</code> exit codes:</strong></p>
 <ul><li><code>0</code> — всё в порядке</li><li><code>1</code> — что-то отсутствует из must-have (используйте <code>init --force</code> для repair)</li></ul>
 <p><strong><code>verify</code> exit codes:</strong></p>
@@ -914,7 +914,7 @@ npx @dzhechkov/p-replicator@latest init --force --reset-settings</code></pre>
 <hr>
 <h2 id="architecture-cross-platform-hooks-v141">Cross-platform hooks (v1.4.1)</h2>
 <p><strong>Дизайн-принцип:</strong> zero shell dependency.</p>
-<p>Все 7 hook-скриптов написаны на pure Node, используют <code>execFileSync('git', [...])</code> вместо shell-pipes. Это эквивалентно работает на:</p>
+<p>Все 17 hook-скриптов написаны на pure Node, используют <code>execFileSync('git', [...])</code> вместо shell-pipes. Это эквивалентно работает на:</p>
 <ul><li>Windows cmd.exe (нет <code>2&gt;/dev/null</code>, есть <code>2&gt;nul</code> — не нужен ни тот ни другой)</li><li>Bash / zsh / Git Bash на Windows</li><li>PowerShell</li></ul>
 <p><strong>Pattern для autocommit-скрипта:</strong></p>
 <pre data-lang="javascript"><code class="language-javascript">const fs = require('node:fs');
@@ -1277,7 +1277,7 @@ find docs/ -type f -name "*.md" | wc -l</code></pre>
 <ul><li>🐛 <strong>Cross-platform hooks:</strong> заменены bash-chains на 4 Node-скрипта (<code>session-insights</code>, <code>autocommit-{roadmap,insights,plans}</code>)</li><li>🐛 <strong><code>verify.js</code> SSOT:</strong> <code>kind: 'pre-shipped' | 'project-generated'</code> field + 3 новых project-generated groups</li><li>🐛 <strong>Meta-tests</strong> для <code>replicate.md</code> ↔ <code>replicate-pipeline.md</code> consistency</li><li>🐛 <strong>Critical regression discovered + fixed:</strong> <code>sync-templates.js</code> cleanDir тихо удалял pre-shipped файлы во время <code>npm publish --dry-run</code>. Switched to MERGE mode</li><li>🆕 6th COMPONENTS group: <code>hooks</code> (4 cross-platform Node scripts)</li><li>🆕 <code>getItemRelativePath()</code> helper для централизованного path-derivation</li><li>📊 74 tests, +14 от v1.4.0</li></ul>
 <h2 id="changelog-v140-2026-05-06">v1.4.0 — 2026-05-06</h2>
 <p><strong>Major release — 9 pre-shipped команд + verify command.</strong></p>
-<ul><li>✨ Закрыт корневой источник pain: <code>/replicate</code> Phase 3 больше не пытается генерировать generic команды. Все 11 commands + 5 rules + settings.json + 4 hooks теперь pre-shipped через <code>init</code></li><li>✨ <strong>9 новых pre-shipped команд:</strong> <code>/start</code>, <code>/plan</code>, <code>/feature</code>, <code>/go</code>, <code>/run</code>, <code>/next</code>, <code>/myinsights</code>, <code>/docs</code>, <code>/deploy</code></li><li>✨ <strong>3 новых pre-shipped rules:</strong> <code>git-workflow</code>, <code>insights-capture</code>, <code>feature-lifecycle</code></li><li>✨ <strong>Settings.json shipped</strong> with hooks (SessionStart insights inject + Stop auto-commit)</li><li>✨ <strong><code>verify</code> command</strong> — replaces user's manual verification prompt</li><li>🐛 5 sources of truth divergence (<code>replicate.md</code>, <code>replicate-pipeline.md</code>, cc-toolkit modules, README, cli help) unified via <code>utils.COMPONENTS.items</code></li><li>📊 60 tests, +8 от v1.3.1</li></ul>
+<ul><li>✨ Закрыт корневой источник pain: <code>/replicate</code> Phase 3 больше не пытается генерировать generic команды. Все 11 commands + 13 rules + settings.json + 17 hooks теперь pre-shipped через <code>init</code></li><li>✨ <strong>9 новых pre-shipped команд:</strong> <code>/start</code>, <code>/plan</code>, <code>/feature</code>, <code>/go</code>, <code>/run</code>, <code>/next</code>, <code>/myinsights</code>, <code>/docs</code>, <code>/deploy</code></li><li>✨ <strong>3 новых pre-shipped rules:</strong> <code>git-workflow</code>, <code>insights-capture</code>, <code>feature-lifecycle</code></li><li>✨ <strong>Settings.json shipped</strong> with hooks (SessionStart insights inject + Stop auto-commit)</li><li>✨ <strong><code>verify</code> command</strong> — replaces user's manual verification prompt</li><li>🐛 5 sources of truth divergence (<code>replicate.md</code>, <code>replicate-pipeline.md</code>, cc-toolkit modules, README, cli help) unified via <code>utils.COMPONENTS.items</code></li><li>📊 60 tests, +8 от v1.3.1</li></ul>
 <h2 id="changelog-v131-2026-05-06">v1.3.1 — 2026-05-06</h2>
 <p><strong>Two real bug fixes.</strong></p>
 <ul><li>🐛 <strong><code>cli.js</code> --help showed «1 rule» while <code>EXPECTED_RULES</code> had 2 entries.</strong> SSOT fix: <code>COMPONENTS.&lt;group&gt;.items</code> map is single source of truth for counts, used by doctor/list/cli.js help via dynamic derivation</li><li>🐛 <strong><code>update.js</code> corrupted manifest</strong> — walked user's full <code>.claude/</code>, capturing project-generated files into <code>manifest.files</code>. Subsequent <code>remove</code> would delete them, contradicting documented behavior. Fixed by using <code>getRelativePaths(templateClaude)</code> instead</li><li>🐛 Bonus: <code>update</code> now removes orphan template files (files in old manifest but not in new template) — addresses original v1.3.0 concern about ignored <code>missing[]</code> from <code>diffFiles</code></li><li>📊 52 tests, +7 от v1.3.0</li></ul>