@dzhechkov/p-replicator 1.5.18 → 1.9.0

package/tests/unit/growth-module-b2b-gate.test.js

@@ -0,0 +1,122 @@
+'use strict';
+
+// Two callers disabled the exact branch the module they call declares. MEASURED:
+//
+//   commands/replicate.md:169        | M5: Growth Engine | If B2C/PLG | …
+//   agents/product-discoverer.md:22  | M5: Growth Engine | If B2C/PLG | …
+//   modules/05-growth-engine.md:62   - Если B2B → sales-led growth, не product-led; переключи framework
+//   reverse-engineering-unicorn/SKILL.md:94   MODULE 5: GROWTH ENGINE → …      (no condition)
+//
+// Three files disagreed about whether M5 runs, and the two that said "only for B2C" were the ones
+// that decided. For every B2B project the one output slot — product-discoverer.md "### Growth
+// Channels [From growth engine analysis — if applicable]" — arrived empty, not because there was
+// nothing to say but because the gate stopped the module that would have said it.
+//
+// NOT done, deliberately: editing the growth module. It exists in four byte-identical copies across
+// three published packages, kept in step by a --check gate that exits 1 on drift. A two-line fix in
+// two callers touches ONE package; touching the module is a three-package release. P5 pins that.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+const read = (rel) => fs.readFileSync(path.join(TPL, rel), 'utf-8');
+
+const CALLERS = [
+  { file: 'commands/replicate.md', produces: 'Channels, integrations' },
+  { file: 'agents/product-discoverer.md', produces: 'Channels, integrations, viral loops' },
+];
+const MODULE = 'skills/reverse-engineering-unicorn/modules/05-growth-engine.md';
+
+/** EVERY table row that decides whether M5 runs. Cross-family QE: taking the FIRST match let a gate
+ *  come back in a duplicate row further down, invisible to both helpers. */
+function m5Rows(file) {
+  const rows = read(file).split('\n').filter((l) => l.startsWith('| M5: Growth Engine |'));
+  assert.equal(rows.length, 1,
+    file + ' must have exactly one M5 row; found ' + rows.length + ': ' + JSON.stringify(rows));
+  return rows;
+}
+const cells = (row) => row.split('|').map((c) => c.trim());
+
+describe('the growth module is not gated off for the type it handles itself', () => {
+  test('P1 — neither caller conditions M5 on a product type', () => {
+    // Asserted on the ROW, not the file: the phrase "B2C" appears legitimately elsewhere (the
+    // sentence explaining WHY the gate went), and a whole-file check would forbid the explanation.
+    // The property is not "no condition" — cross-family QE was right that `Always` over-promises,
+    // because M5's outputs are CAC, channels and loops and an internal tool with no acquisition
+    // objective has nothing to put in them. The property is that the condition does not EXCLUDE a
+    // product type the module handles: if it names types at all, B2B must be among them.
+    for (const { file } of CALLERS) {
+      for (const row of m5Rows(file)) {
+        const condition = cells(row)[2];
+        assert.notEqual(condition, '', file + ': the M5 condition cell is empty');
+        const namesTypes = /B2C|B2B|PLG|product-led|sales-led/i.test(condition);
+        if (namesTypes) {
+          assert.match(condition, /B2B/i,
+            file + ' gates M5 on product type and leaves B2B out — the module handles B2B at '
+            + 'modules/05-growth-engine.md:62: ' + JSON.stringify(condition));
+        }
+        assert.ok(!/^If B2C/i.test(condition),
+          file + ' restored the original product-type gate: ' + JSON.stringify(condition));
+      }
+    }
+  });
+
+  test('P2 — the row keeps saying what M5 produces', () => {
+    // A removal that took the row with it would satisfy P1 and lose the module from the table.
+    // The OUTPUT COLUMN, not a substring of the row: cross-family QE noted a substring check passes
+    // if the text drifts into the condition cell.
+    for (const { file, produces } of CALLERS) {
+      for (const row of m5Rows(file)) {
+        assert.equal(cells(row)[3], produces,
+          file + ' lost or moved M5\'s output column: ' + row);
+      }
+    }
+  });
+
+  test('P3 — the orchestrator still runs M5 unconditionally: it is the fixed point', () => {
+    const skill = read('skills/reverse-engineering-unicorn/SKILL.md');
+    const line = skill.split('\n').find((l) => l.includes('MODULE 5: GROWTH ENGINE'));
+    assert.ok(line, 'SKILL.md must still list MODULE 5');
+    assert.ok(!/if |если |B2C|B2B|PLG/i.test(line),
+      'the orchestrator must stay unconditional — all three files agree with IT: ' + line);
+  });
+
+  test('P4 — the module\'s own B2B branch survives the removal that it justifies', () => {
+    // This is the load-bearing one. Removing the gate is safe BECAUSE the module decides per type.
+    // Without this assertion someone could delete the justification and keep the removal, and the
+    // module would then run for B2B with no B2B behaviour.
+    // REWORDED 2026-08-27 by growth-list-and-compliance. The old wording said "sales-led growth,
+    // не product-led", treating MOTION and LOOP as one exclusive choice — which the axis split had
+    // just refuted, so a B2B company with a sales-led motion and a product-led loop was told to
+    // reject the latter. Cross-family review caught the contradiction. The INTENT this test defends
+    // is unchanged and still asserted below: the module branches on type, which is what makes the
+    // ungated call correct. Only the wording moved, and it now says which axis it speaks about.
+    assert.match(read(MODULE), /Если B2B → мотион почти всегда sales-led или partnership-led/,
+      'the branch that makes the ungated call correct must still be there');
+    assert.match(read(MODULE), /ТОЛЬКО про ось 1: петля выбирается отдельно/,
+      'and it must scope itself to one axis, or it re-asserts the exclusivity the split removed');
+  });
+
+  test('P5 — the growth module is byte-identical: this feature touches two callers only', () => {
+    // Four byte-identical copies across three published packages hang off this file. Pinning its
+    // hash is what keeps a two-line fix from becoming a three-package release by accident.
+    //
+    // MOVED ONCE, deliberately, 2026-08-27 by growth-requirements-bridge, which added the
+    // `Growth Requirements Seed` section and IS the three-package release this message demands.
+    // MOVED A THIRD TIME by prebake-skill-paths: the module's own /mnt/ references became
+    // .claude/skills/ paths. Pins: 98e8577a… → bd9cfcb8… → 6657dbe2… → this.
+    // MOVED AGAIN, same day, by growth-list-and-compliance (two axes + the compliance
+    // checklist) — also a three-package release. Pins so far: 98e8577a… → bd9cfcb8… → this.
+    // Previous pin: 98e8577a… The tripwire is not weakened by the move — re-pinning is the
+    // conscious decision it exists to force, and the accompanying module-copy-identity.test.js now
+    // also proves all four copies still agree, which a single hash never could.
+    const sha = crypto.createHash('sha256')
+      .update(fs.readFileSync(path.join(TPL, MODULE))).digest('hex');
+    assert.equal(sha, '84658390dc7beb590f70164b391ace915e42926660bc1015e4be300752b74a37',
+      'the growth module changed; that is a three-package release, not this feature');
+  });
+});

package/tests/unit/growth-requirements-bridge.test.js

@@ -0,0 +1,127 @@
+'use strict';
+
+// The M5 growth analysis reached Phase 1 as an in-conversation --product-brief value and was never
+// written to disk (sparc-prd-mini/SKILL.md:993-999). MEASURED before this feature:
+// `grep -rn 'growth' sparc-prd-mini/ requirements-validator/` returned 0 hits in these templates.
+//
+// So the filed diagnosis — "no downstream step is obliged to read the analysis" — was one layer off.
+// There was nothing to read. A seed section alone would have written obligations into an artifact
+// that evaporates, which is why P1 assertions here are paired with the persistence ones.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+const REPLICATE = path.join(TPL, 'commands', 'replicate.md');
+const MODULE = path.join(TPL, 'skills', 'reverse-engineering-unicorn', 'modules', '05-growth-engine.md');
+
+const read = (f) => fs.readFileSync(f, 'utf-8');
+
+/** The seed section, from its heading to the next top-level one. */
+function seedSection() {
+  const src = read(MODULE);
+  const start = src.indexOf('## 🌱 Growth Requirements Seed');
+  assert.ok(start > 0, '05-growth-engine.md must carry the seed section');
+  const end = src.indexOf('\n## ', start + 1);
+  assert.ok(end > start, 'the seed section must be followed by another section');
+  return src.slice(start, end);
+}
+
+describe('the growth analysis becomes a written, traceable obligation', () => {
+  test('P1 - Phase 0 names and writes the brief path', () => {
+    const src = read(REPLICATE);
+    assert.match(src, /docs\/product-discovery-brief\.md/,
+      'Phase 0 must name the exact path it writes, or no consumer can find it');
+
+    // ORDER is the property, not mere presence: writing after the hand-off would leave Phase 1
+    // running against a brief the file does not yet contain.
+    const write = src.indexOf('**Write** the full Product Discovery Brief');
+    const hand = src.indexOf('pass it to Phase 1 as pre-filled context');
+    assert.ok(write > 0 && hand > write,
+      'the write must be instructed BEFORE the hand-off: write=' + write + ' handoff=' + hand);
+  });
+
+  test('P2 - the in-context hand-off is preserved, not replaced', () => {
+    // FR-A2. Replacing the hand-off with a file read would change what Phase 1 receives and silently
+    // break the documented pre-filled-context contract in sparc-prd-mini.
+    const src = read(REPLICATE);
+    assert.match(src, /pre-filled context/,
+      'the hand-off must survive — the file is an ADDITION');
+    assert.match(src, /the file is an ADDITION/i,
+      'and the artifact must say so, so a later editor does not "simplify" one of the two away');
+  });
+
+  test('P3 - an absent brief means Phase 0 did not run, and the artifact says so', () => {
+    // FR-A3. The --from-docs entry skips Phase 0 entirely. Absence read as "no growth requirements"
+    // would penalise every --from-docs project forever.
+    const src = read(REPLICATE);
+    assert.match(src, /absent it means Phase 0 did not run/i,
+      'absence must be given its meaning where the path is defined');
+    assert.match(src, /NOT evidence that the\s+project has no growth requirements/i,
+      'and the wrong reading must be refused explicitly');
+  });
+
+  test('P4 - the seed emits ids with a defined form', () => {
+    const s = seedSection();
+    assert.match(s, /FR-GROWTH-<nnn>/, 'the id form must be stated');
+    assert.match(s, /три цифры, по порядку, номер не переиспользуется/,
+      'an id without a uniqueness rule is an intention, not an identifier');
+    assert.match(s, /FR-GROWTH-001/, 'and the table must show a concrete row');
+  });
+
+  test('P5 - every row must name its source block', () => {
+    const s = seedSection();
+    assert.match(s, /Блок-источник/, 'the table needs a source column');
+    assert.match(s, /Требование без источника непрослеживаемо/,
+      'and the rule must say a sourceless row is not a seed at all');
+  });
+
+  test('P6 - confidence is carried verbatim, never recomputed', () => {
+    // The module declares NO numeric threshold and confidence is not one scale across modes
+    // (SKILL.md:60-64 — QUICK is a manual X/5, DEEP is a formula). Normalising would invent a number
+    // nobody measured, so the rule is verbatim carry plus the SHIPPED [H] convention for doubt.
+    const s = seedSection();
+    assert.match(s, /Confidence переносится ДОСЛОВНО/, 'verbatim carry must be the rule');
+    assert.match(s, /Не пересчитывайте/, 'and recomputation must be refused');
+    assert.match(s, /\[H\]/, 'SPECULATIVE must hang on the shipped [H] convention');
+    assert.match(s, /НЕ НАЙДЕНО/, 'and on the shipped not-found convention');
+    assert.ok(!/confidence\s*[<>]\s*0\.\d/i.test(s),
+      'a numeric threshold would be a convention invented here: ' + s.slice(0, 80));
+  });
+
+  test('P7 - the section states BOTH limits in the shipped artifact', () => {
+    // A seed table looks like proof of work planned. It is neither proof of building nor of legality.
+    const s = seedSection();
+    assert.match(s, /Черновик ≠ построено/, 'draft-is-not-built must be written where a reader sees it');
+    // RECONCILED 2026-08-27. The first version said flatly "Законность НЕ проверена" — true then,
+    // and false the moment the same feature-day added the ⚖️ compliance checklist, which DOES ask.
+    // Cross-family review found the contradiction: the seed disclaimed a question the module now
+    // puts to the user. The replacement is narrower AND stronger — asked, recorded, not established
+    // — and the distinction it draws is the load-bearing half.
+    assert.match(s, /Допустимость СПРОШЕНА, но не установлена/,
+      'the seed must say the question is asked, since the checklist asks it');
+    assert.match(s, /Это не юридическое заключение/,
+      'and must refuse to be read as a legal opinion');
+    assert.match(s, /не «это законно»/,
+      'the difference between "seven questions cleared" and "lawful" is the whole point');
+    assert.ok(!/Законность НЕ проверена/.test(s),
+      'the old flat disclaimer now contradicts the checklist and must not survive beside it');
+  });
+
+  test('P8 - an empty seed must be written, not omitted', () => {
+    // An absent table and a table saying "nothing to seed" are indistinguishable to the next reader,
+    // and the checker depends on being able to tell them apart.
+    const s = seedSection();
+    assert.match(s, /Пустая таблица — тоже ответ/, 'the empty case must be given a shape');
+    assert.match(s, /написана словом `нет`/, 'and a concrete token to write');
+  });
+
+  test('P9 - the seed says where it goes, closing the loop it was built to close', () => {
+    const s = seedSection();
+    assert.match(s, /docs\/product-discovery-brief\.md/, 'the seed must name its carrier file');
+    assert.match(s, /docs\/Specification\.md/, 'and its destination');
+    assert.match(s, /Фаза 2 проверяет/, 'and name the phase that checks the promotion happened');
+  });
+});

package/tests/unit/hooks-project-anchored.test.js

@@ -0,0 +1,223 @@
+'use strict';
+
+// The six shipped hooks resolved BOTH their own file and their own data against a directory that
+// drifts. One `cd` inside a Bash tool call broke all six for the rest of the session, silently,
+// because hooks are non-blocking.
+//
+// Two independent resolutions, failing differently:
+//   - the HOST resolves the command string  -> wrong: MODULE_NOT_FOUND, loud;
+//   - the SCRIPT resolves its own data      -> wrong: exit 0 having done nothing, silent.
+//
+// This suite is deliberately BEHAVIOURAL where it can be. The field report's own verification
+// looped the hooks from a subdirectory and checked the exit code: all four returned 0 while
+// committing nothing and injecting nothing. An exit code proves the module LOADED. P4/P5/P6 assert
+// an EFFECT, and P5 is the one that fails if either half of the fix is missing.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { execFileSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const PKG_DIR = path.resolve(__dirname, '..', '..');
+const TPL = path.join(PKG_DIR, 'templates', '.claude');
+const HOOKS = ['autocommit-roadmap', 'autocommit-insights', 'autocommit-plans',
+  'session-insights', 'statusline', 'state-update'];
+
+const readTpl = (rel) => fs.readFileSync(path.join(TPL, rel), 'utf-8');
+
+/** Source with comments removed. Cross-family QE: the first version of P3 was satisfied by the
+ *  explanatory comment that NAMES both CLAUDE_PROJECT_DIR and __dirname, while the executable code
+ *  could still anchor anywhere. A mention is not a use. */
+function code(src) {
+  return src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|[^:])\/\/[^\n]*/g, '$1');
+}
+const settings = () => JSON.parse(readTpl('settings.json'));
+
+/** Every command string the host will spawn: the four hooks plus the status line. */
+function allCommands() {
+  const s = settings();
+  const out = [];
+  if (s.statusLine && s.statusLine.command) out.push(s.statusLine.command);
+  for (const entries of Object.values(s.hooks || {})) {
+    for (const entry of entries) for (const h of entry.hooks || []) out.push(h.command);
+  }
+  assert.ok(out.length >= 5, 'expected at least the 4 hooks + statusLine, got ' + out.length);
+  return out;
+}
+
+/** A throwaway git project with the shipped hooks installed and a subdirectory to run them from. */
+function project() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-anchor-'));
+  const real = fs.realpathSync(dir);            // macOS /var -> /private/var, else git paths differ
+  fs.mkdirSync(path.join(real, '.claude', 'hooks'), { recursive: true });
+  for (const h of HOOKS) {
+    fs.copyFileSync(path.join(TPL, 'hooks', h + '.cjs'),
+      path.join(real, '.claude', 'hooks', h + '.cjs'));
+  }
+  fs.mkdirSync(path.join(real, 'projects', '01-sub'), { recursive: true });
+  const git = (args) => execFileSync('git', args, { cwd: real, stdio: 'ignore' });
+  git(['init', '-q']);
+  git(['config', 'user.email', 'test@example.invalid']);
+  git(['config', 'user.name', 'test']);
+  return { root: real, sub: path.join(real, 'projects', '01-sub'), git };
+}
+
+/** Run one hook FROM THE SUBDIRECTORY — the only place this defect is visible. */
+function runFromSub(p, hook, { withEnv = true, args = [] } = {}) {
+  const env = { ...process.env };
+  if (withEnv) env.CLAUDE_PROJECT_DIR = p.root;
+  else delete env.CLAUDE_PROJECT_DIR;
+  try {
+    const stdout = execFileSync(process.execPath,
+      [path.join(p.root, '.claude', 'hooks', hook + '.cjs'), ...args],
+      { cwd: p.sub, env, encoding: 'utf8', stdio: 'pipe' });
+    return { code: 0, stdout: stdout || '' };
+  } catch (err) {
+    return { code: err.status ?? 1, stdout: err.stdout?.toString() ?? '' };
+  }
+}
+
+describe('hooks resolve against the project, not the drifting cwd (PR-013)', () => {
+  test('P1 — no command the host spawns resolves relatively', () => {
+    for (const cmd of allCommands()) {
+      assert.doesNotMatch(cmd, /node\s+["']?\.claude[/\\]/,
+        'a relative script path resolves against the drifting cwd, not settings.json: ' + cmd);
+      assert.match(cmd, /CLAUDE_PROJECT_DIR/,
+        'every command must be anchored at the project root: ' + cmd);
+      // A correctly-spelled anchor in front of a script that does not exist is still a dead hook.
+      const named = cmd.match(/hooks\/([A-Za-z0-9._-]+\.cjs)/);
+      assert.ok(named, 'the command must name a .cjs script: ' + cmd);
+      assert.ok(fs.existsSync(path.join(TPL, 'hooks', named[1])),
+        'settings.json points at a script this package does not ship: ' + named[1]);
+    }
+  });
+
+  test('P2 — the anchor is the PowerShell-safe braced form, and the rejected spellings stay rejected', () => {
+    for (const cmd of allCommands()) {
+      // MEASURED from the Claude Code binary: it rewrites the exact token ${CLAUDE_PROJECT_DIR}
+      // to ${env:CLAUDE_PROJECT_DIR} for PowerShell, and warns that the UNBRACED $CLAUDE_PROJECT_DIR
+      // "PowerShell reads as an undefined variable ($null)".
+      assert.match(cmd, /\$\{CLAUDE_PROJECT_DIR\}/,
+        'must use the braced form the host rewrites for PowerShell: ' + cmd);
+      // ${CLAUDE_PROJECT_DIR:-.} is what this repo's own config uses and is REJECTED here: the
+      // rewrite is a literal replaceAll of "${CLAUDE_PROJECT_DIR}", so the :- form never matches
+      // and stays a POSIX-only construct — against the template's own cross-platform promise.
+      assert.doesNotMatch(cmd, /\$\{CLAUDE_PROJECT_DIR:-/,
+        'the POSIX default-expansion form is not cross-platform: ' + cmd);
+      assert.doesNotMatch(cmd, /\$CLAUDE_PROJECT_DIR[^{]/,
+        'the unbraced form is null on PowerShell: ' + cmd);
+      assert.match(cmd, /"\$\{CLAUDE_PROJECT_DIR\}[^"]*"/,
+        'the path must be double-quoted — a project path may contain spaces: ' + cmd);
+    }
+  });
+
+  test('P3 — no hook reads process.cwd(); all six are anchored', () => {
+    for (const h of HOOKS) {
+      const src = code(readTpl(path.join('hooks', h + '.cjs')));
+      assert.doesNotMatch(src, /process\.cwd\(\)/,
+        h + '.cjs still anchors on the drifting cwd — settings.json alone only makes it RUN');
+      assert.match(src, /process\.env\.CLAUDE_PROJECT_DIR/,
+        h + '.cjs must consult the host first — it is authoritative about the project');
+      assert.match(src, /__dirname/,
+        h + '.cjs must fall back to its own location, so it works with the variable absent');
+      // A truthy but RELATIVE host value would still resolve against the drifting cwd — the very
+      // bug this anchor removes. Truthiness is not enough; absoluteness is the property.
+      assert.match(src, /path\.isAbsolute\(/,
+        h + '.cjs must require the host value to be ABSOLUTE, not merely non-empty');
+    }
+  });
+
+  test('P4 — with CLAUDE_PROJECT_DIR UNSET, a hook still finds the project', () => {
+    // This is what makes the settings fix non-load-bearing for correctness: an older host, a
+    // hand-run, a CI shell. It also pins the || ordering: remove the __dirname fallback and this
+    // is the assertion that goes red.
+    const p = project();
+    try {
+      fs.mkdirSync(path.join(p.root, '.claude', 'insights'), { recursive: true });
+      fs.writeFileSync(path.join(p.root, '.claude', 'insights', 'index.md'),
+        '## Insight one\n\nbody one\n');
+      const r = runFromSub(p, 'session-insights', { withEnv: false });
+      assert.equal(r.code, 0, 'the hook must stay non-blocking');
+      assert.match(r.stdout, /Insight one/,
+        'with no env var and cwd in a subdirectory, the hook must still read the ROOT index');
+    } finally { fs.rmSync(p.root, { recursive: true, force: true }); }
+  });
+
+  test('P5 — EFFECT from a subdirectory: the roadmap is actually committed', () => {
+    // The property the whole feature exists for. An exit-code check passes on the broken hook;
+    // this does not. Fails if EITHER half of the fix is missing.
+    const p = project();
+    try {
+      fs.writeFileSync(path.join(p.root, '.claude', 'feature-roadmap.json'), '{"v":1}\n');
+      p.git(['add', '-A']);
+      p.git(['commit', '-q', '-m', 'base']);
+      fs.writeFileSync(path.join(p.root, '.claude', 'feature-roadmap.json'), '{"v":2}\n');
+
+      const before = execFileSync('git', ['rev-list', '--count', 'HEAD'],
+        { cwd: p.root, encoding: 'utf8' }).trim();
+      const r = runFromSub(p, 'autocommit-roadmap');
+      assert.equal(r.code, 0, 'the hook must stay non-blocking');
+      const after = execFileSync('git', ['rev-list', '--count', 'HEAD'],
+        { cwd: p.root, encoding: 'utf8' }).trim();
+
+      assert.equal(Number(after), Number(before) + 1,
+        'a changed roadmap must be COMMITTED when the hook runs from a subdirectory — '
+        + 'this is the assertion the report\'s exit-code check could not make');
+      const clean = execFileSync('git', ['status', '--porcelain', '--', '.claude/feature-roadmap.json'],
+        { cwd: p.root, encoding: 'utf8' });
+      assert.equal(clean.trim(), '', 'and the file must be left clean, not merely staged');
+    } finally { fs.rmSync(p.root, { recursive: true, force: true }); }
+  });
+
+  test('P7 — every autocommit hook puts -m BEFORE the `--`, or it commits nothing', () => {
+    // Found BY P5, not by review: everything after `--` is a pathspec, so
+    // ['commit','--only','--',RELATIVE,'-m',MSG] made git look for files literally named '-m' and
+    // 'docs(roadmap): auto-update'. It failed from EVERY directory, and the hook exits 0 on failure,
+    // so three autocommit hooks had never committed anything and nothing said so. P5 proves the
+    // behaviour for one of the three; this pins the shape for all three, since the other two have
+    // no git fixture of their own.
+    for (const h of ['autocommit-roadmap', 'autocommit-insights', 'autocommit-plans']) {
+      const src = readTpl(path.join('hooks', h + '.cjs'));
+      const m = src.match(/git\(\[('commit'[^\]]*)\]\)/);
+      assert.ok(m, h + '.cjs must invoke git commit');
+      const args = m[1];
+      // Cross-family QE: comparing indexOf directly made a MISSING -m pass, since -1 is less than
+      // any real index. Presence first, then order.
+      const mi = args.indexOf("'-m'");
+      const dd = args.indexOf("'--'");
+      assert.ok(mi >= 0, h + ".cjs: git commit must carry -m at all: " + args);
+      assert.ok(dd >= 0, h + ".cjs: git commit must carry the `--` pathspec separator: " + args);
+      assert.ok(mi < dd,
+        h + ".cjs: -m must precede `--`, else the message is parsed as a pathspec: " + args);
+    }
+  });
+
+  test('P6 — writer and reader agree on ONE path, from any cwd', () => {
+    // state-update.cjs writes the state, statusline.cjs reads it. Two drifting anchors can
+    // disagree, and a status line reading a file nobody wrote is worse than none.
+    const p = project();
+    try {
+      // A DISTINCTIVE value: cross-family QE noted that matching /replicate|VALIDATE/ would pass on
+      // any static status output that happens to contain those words, without reading the file at
+      // all. A token that appears nowhere else can only have come through the state file.
+      const TOKEN = 'ZQPHASE7X';
+      const w = runFromSub(p, 'state-update',
+        { args: ['--command', '/replicate', '--phase', TOKEN, '--index', '2', '--total', '4'] });
+      assert.equal(w.code, 0, 'the writer must stay non-blocking');
+      const stateFile = path.join(p.root, '.claude', '.p-replicator-state.json');
+      assert.ok(fs.existsSync(stateFile),
+        'the writer must publish state at the PROJECT root, not under the subdirectory it ran from');
+      assert.doesNotMatch(
+        fs.existsSync(path.join(p.sub, '.claude')) ? 'stray' : 'clean', /stray/,
+        'and must not have created a second .claude tree under the subdirectory');
+
+      const r = runFromSub(p, 'statusline');
+      assert.equal(r.code, 0, 'the reader must stay non-blocking');
+      assert.match(r.stdout, new RegExp(TOKEN),
+        'the reader must echo the DISTINCTIVE token the writer just published — a token that '
+        + 'appears nowhere else can only have arrived through the state file');
+    } finally { fs.rmSync(p.root, { recursive: true, force: true }); }
+  });
+});