@ionivetech/mugiwara 0.8.1 → 0.8.2

package/scripts/gate-selftest.ts

@@ -649,7 +649,7 @@ console.log('\nT3 — lane-aware gates');
       return s.length === 12 && s.includes('run-evals') && s.includes('retrieval-eval') && s.includes('conformance');
     });
     assert('budget direct → 0, full → 50000', true, () => budgetForLane('direct') === 0 && budgetForLane('full') === 50000);
-    assert('budget spike → 3000 (direct fixture 3k)', true, () => budgetForLane('spike') === 3000);
+    assert('budget spike → 9000 (direct fixture 9k)', true, () => budgetForLane('spike') === 9000);
     // mutation: break direct step count → should fail (file content shows not 3)
     const broken = originalPolicy.replace(
       "direct: ['build-hooks:check', 'typecheck', 'build']",
@@ -675,5 +675,160 @@ console.log('\nT3 — lane-aware gates');
   });
 }
 
+// --- B1: CLI availability — remove section → content validation fails ---
+console.log('\nB1 — CLI availability');
+{
+  const wf = join(root, 'content', 'skills', 'mugiwara-workflow', 'SKILL.md');
+  const original = readFileSync(wf, 'utf8');
+  try {
+    const b1Pattern = /## CLI availability[\s\S]*?## Artifact trust/;
+    const b1Broken = original.replace(b1Pattern, '## Artifact trust');
+    if (!b1Pattern.test(original) || b1Broken === original) {
+      console.error('✗ B1: mutation target not found — the gate it guards may be dead.');
+      failed++;
+    } else {
+      writeFileSync(wf, b1Broken);
+      assert('missing CLI availability → grep fails', false, () => run('B1-grep', 'grep -q "CLI availability" content/skills/mugiwara-workflow/SKILL.md'));
+    }
+  } finally {
+    writeFileSync(wf, original);
+    assert('restored → content validation passes', true, () => run('B1-restore', 'grep -q "CLI availability" content/skills/mugiwara-workflow/SKILL.md'));
+  }
+}
+
+// --- B2: team evidence gate — revert to single state.json → integrity gate fails on team ---
+console.log('\nB2 — team evidence gate');
+{
+  const integ = join(root, 'src', 'integrity.ts');
+  const original = readFileSync(integ, 'utf8');
+  try {
+    const fixedPattern = /const stateFiles = existsSync\(missionDir\)/;
+    const broken = original.replace(fixedPattern, "const evidenceFile = join(missionDir, 'state.json'); // B2 revert");
+    const fullPattern = /  \/\/ Solo layout writes state\.json; team layout writes <member>\.json per member\./;
+    let b2Broken = original;
+    if (fullPattern.test(original)) {
+      // remove the team-aware block header to make grep for stateFiles fail for the specific definition
+      b2Broken = original.replace(fixedPattern, "const evidenceFile = join(missionDir, 'state.json'); // B2 revert");
+      // also need to remove remaining stateFiles references to make grep fail - replace all stateFiles with evidenceFile
+      b2Broken = b2Broken.replace(/stateFiles/g, 'evidenceFile');
+    }
+    if (!fixedPattern.test(original) || broken === original) {
+      console.error('✗ B2: mutation target not found — the gate it guards may be dead.');
+      failed++;
+    } else {
+      writeFileSync(integ, b2Broken);
+      assert('single state.json → team evidence gate dead', false, () => run('B2', 'grep -q "const stateFiles = existsSync" src/integrity.ts'));
+    }
+  } finally {
+    writeFileSync(integ, original);
+    assert('restored → team gate present', true, () => run('B2-restore', 'grep -q "const stateFiles = existsSync" src/integrity.ts'));
+  }
+}
+
+// --- B3: task counter — restore unanchored grep → savepoint task test fails ---
+console.log('\nB3 — task counter');
+{
+  const sp = join(root, 'scripts', 'savepoint.sh');
+  const original = readFileSync(sp, 'utf8');
+  try {
+    const broken = original.replace('TASKS_TOTAL=$(count_boxes "$PLAN_FILE" \'[ xX]\')', 'TASKS_TOTAL=$(grep -cE \'^\\s*-\\s*\\[[ xX]\\]\' "$PLAN_FILE" 2>/dev/null || true)')
+      .replace('TASKS_DONE=$(count_boxes "$PLAN_FILE" \'[xX]\')', 'TASKS_DONE=$(grep -c \'\\[x\\]\' "$PLAN_FILE" 2>/dev/null || true)');
+    if (broken === original) {
+      console.error('✗ B3: mutation target not found — the gate it guards may be dead.');
+      failed++;
+    } else {
+      writeFileSync(sp, broken);
+      assert('unanchored grep → savepoint task test fails', false, () => run('B3', 'bun run test -- savepoint -t "B3: task counting"'));
+    }
+  } finally {
+    writeFileSync(sp, original);
+    assert('restored → savepoint task test passes', true, () => run('B3-restore', 'bun run test -- savepoint -t "B3: task counting"'));
+  }
+}
+
+// --- B4: repo root — restore [ -d .git ] → lane subdirectory test fails ---
+console.log('\nB4 — repo root');
+{
+  const lane = join(root, 'scripts', 'lane.sh');
+  const original = readFileSync(lane, 'utf8');
+  try {
+    const broken = original.replace(
+      /# Resolve the repo root: handles subdirectories and git worktrees[\s\S]*?cd "\$REPO_ROOT" \|\| \{ echo "lane: cannot enter repo root" >&2; exit 1; \}/,
+      '[ -d .git ] || { echo "lane: not a git repository" >&2; exit 1; }'
+    );
+    if (broken === original) {
+      console.error('✗ B4: mutation target not found — the gate it guards may be dead.');
+      failed++;
+    } else {
+      writeFileSync(lane, broken);
+      assert('[ -d .git ] → lane subdirectory gate dead', false, () => run('B4', 'grep -q "git rev-parse --show-toplevel" scripts/lane.sh'));
+    }
+  } finally {
+    writeFileSync(lane, original);
+    assert('restored → lane uses git rev-parse', true, () => run('B4-restore', 'grep -q "git rev-parse --show-toplevel" scripts/lane.sh'));
+  }
+}
+
+// --- B5: spike budget — set below base → lane-base fails ---
+console.log('\nB5 — spike budget');
+{
+  const baseFile = join(root, 'scripts', 'lib', 'lane-base.sh');
+  const original = readFileSync(baseFile, 'utf8');
+  try {
+    const broken = original.replace('BUDGET_spike=9000', 'BUDGET_spike=3000');
+    if (broken === original) {
+      console.error('✗ B5: mutation target not found — the gate it guards may be dead.');
+      failed++;
+    } else {
+      writeFileSync(baseFile, broken);
+      assert('BUDGET_spike 3000 < LANE_BASE 5411 → lane-base fails', false, () => run('B5', 'bun scripts/lane-base.ts'));
+    }
+  } finally {
+    writeFileSync(baseFile, original);
+    assert('restored → lane-base passes', true, () => run('B5-restore', 'bun scripts/lane-base.ts'));
+  }
+}
+
+// --- B6: corrupt state — swallow parse errors again → status test fails ---
+console.log('\nB6 — corrupt state');
+{
+  const cont = join(root, 'src', 'continue.ts');
+  const original = readFileSync(cont, 'utf8');
+  try {
+    const broken = original.replace('unreadable.push(join(mission, f));', '// corrupt savepoint — skip, never crash the listing');
+    if (broken === original) {
+      console.error('✗ B6: mutation target not found — the gate it guards may be dead.');
+      failed++;
+    } else {
+      writeFileSync(cont, broken);
+      assert('swallow parse errors → unreadable gate dead', false, () => run('B6', 'grep -q "unreadableStateFiles" src/continue.ts && grep -q "unreadable.push" src/continue.ts'));
+    }
+  } finally {
+    writeFileSync(cont, original);
+    assert('restored → corrupt state surfaced', true, () => run('B6-restore', 'grep -q "unreadable.push" src/continue.ts'));
+  }
+}
+
+// --- B7: zero evidence — remove check → integrity team test fails ---
+console.log('\nB7 — zero evidence');
+{
+  const integ = join(root, 'src', 'integrity.ts');
+  const original = readFileSync(integ, 'utf8');
+  try {
+    const b7Pattern = /mission declares no evidence/;
+    const broken = original.replace(b7Pattern, 'ZERO_EVIDENCE_REMOVED');
+    if (!b7Pattern.test(original) || broken === original) {
+      console.error('✗ B7: mutation target not found — the gate it guards may be dead.');
+      failed++;
+    } else {
+      writeFileSync(integ, broken);
+      assert('no zero-evidence check → integrity gate dead', false, () => run('B7', 'grep -q "mission declares no evidence" src/integrity.ts'));
+    }
+  } finally {
+    writeFileSync(integ, original);
+    assert('restored → zero-evidence warned', true, () => run('B7-restore', 'grep -q "mission declares no evidence" src/integrity.ts'));
+  }
+}
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);

package/scripts/lane-base.ts

@@ -107,6 +107,22 @@ for (const lane of lanes) {
   }
 }
 
+// A lane whose base exceeds its budget is born in `warn` — the budget is then
+// noise rather than a signal. (B5)
+for (const lane of ['lean', 'standard', 'full', 'spike']) {
+  const base = constants[lane]?.base ?? 0;
+  const budget = constants[lane]?.budget ?? 0;
+  if (base >= budget) {
+    console.log(`  ✗ LANE_BASE_${lane} (${base}) >= BUDGET_${lane} (${budget}) — every mission starts over budget`);
+    failures++;
+  }
+  const pct = budget ? Math.round((base / budget) * 100) : 100;
+  if (pct > 80) {
+    console.log(`  ✗ LANE_BASE_${lane} is ${pct}% of BUDGET_${lane} — leaves no headroom (target ≤70%)`);
+    failures++;
+  }
+}
+
 if (failures > 0) {
   console.log(`\nlane-base: ${failures} constant(s) drifted from content load`);
   process.exit(1);

package/scripts/lane.sh

@@ -11,7 +11,11 @@ BASE="${1:-main}"
 JSON_OUT=0
 [ "${2:-}" = "--json" ] && JSON_OUT=1
 
-[ -d .git ] || { echo "lane: not a git repository" >&2; exit 1; }
+# Resolve the repo root: handles subdirectories and git worktrees, where .git
+# is a file rather than a directory. (B4)
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || {
+  echo "lane: not a git repository" >&2; exit 1; }
+cd "$REPO_ROOT" || { echo "lane: cannot enter repo root" >&2; exit 1; }
 
 # resolve base
 if ! git rev-parse "$BASE" >/dev/null 2>&1; then

package/scripts/lib/lane-base.sh

@@ -16,4 +16,4 @@ LANE_BASE_spike=5411
 BUDGET_lean=12000
 BUDGET_standard=25000
 BUDGET_full=50000
-BUDGET_spike=3000
+BUDGET_spike=9000

package/scripts/savepoint.sh

@@ -8,6 +8,18 @@ set -u
 
 die() { echo "savepoint: $*" >&2; exit 1; }
 
+# count_boxes <file> <char-class> — count markdown checkboxes.
+# Anchored so prose mentioning "- [x]" is not counted; skips fenced code blocks
+# so documentation examples are not counted; matches [x] and [X] alike. (B3)
+count_boxes() {
+  [ -f "$1" ] || { echo 0; return; }
+  awk -v pat="$2" '
+    /^[[:space:]]*```/ { inblock = !inblock; next }
+    !inblock && $0 ~ ("^[[:space:]]*-[[:space:]]*\\[" pat "\\]") { n++ }
+    END { print n+0 }
+  ' "$1"
+}
+
 MUGIWARA_DIR="${MUGIWARA_DIR:-.mugiwara}"
 
 # optional provider-reported tokens file (T4): --tokens-file <path> JSON {input_tokens, output_tokens}
@@ -154,6 +166,11 @@ esac
 # (BSD/macOS-safe: no \+ BRE).
 BRANCH_SLUG=$(echo "$BRANCH" | tr '/' '-' | tr -cd 'A-Za-z0-9._-' | sed 's/^\.\{1,\}$//' )
 
+# Resolve the repo root: handles subdirectories and git worktrees, where .git
+# is a file rather than a directory. (B4)
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || die "not a git repository"
+cd "$REPO_ROOT" || die "cannot enter repo root"
+
 # state + continue live in the mission dir. Solo (member empty) → state.json
 # + continue.json; team writes <member>.json + continue-<member>.json so
 # parallel members never clobber each other.
@@ -167,7 +184,6 @@ else
 fi
 
 [ -z "$MISSION" ] && die "usage: savepoint.sh <mission> [member] [wave] [mode] [lane]"
-[ -d .git ] || die "not a git repository"
 
 # --- computed fields ---
 BASE_SHA=$(git merge-base HEAD main 2>/dev/null || git merge-base HEAD master 2>/dev/null || git merge-base HEAD "$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||')" 2>/dev/null || git rev-parse HEAD~1 2>/dev/null || echo "unknown")
@@ -328,16 +344,23 @@ if [ -n "$PLAN_FILE" ] && [ -f "$PLAN_FILE" ]; then
   # total counts ALL task lines (checked + unchecked); done counts checked only.
   # A fully-completed plan must read total=N done=N, never total=0 (the old
   # unchecked-only grep degenerated a done plan to tasks.total=0).
-  TASKS_TOTAL=$(grep -cE '^\s*-\s*\[[ xX]\]' "$PLAN_FILE" 2>/dev/null || true)
-  TASKS_DONE=$(grep -c '\[x\]' "$PLAN_FILE" 2>/dev/null || true)
+  TASKS_TOTAL=$(count_boxes "$PLAN_FILE" '[ xX]')
+  TASKS_DONE=$(count_boxes "$PLAN_FILE" '[xX]')
 fi
 # Fallback for large campaigns (>3 phases, >1500 lines) where master plan.md is an index
 # and tasks live in sub-plan/*.md — only when plan.md has zero checkbox tasks to
 # keep simple missions unchanged.
 if [ "${TASKS_TOTAL:-0}" -eq 0 ] 2>/dev/null && [ -d "$MISSION_DIR/sub-plan" ]; then
-  TASKS_TOTAL=$(grep -rcE '^\s*-\s*\[[ xX]\]' "$MISSION_DIR/sub-plan" 2>/dev/null | awk -F: '{s+=$2} END {print s+0}' || true)
-  TASKS_DONE=$(grep -rc '\[x\]' "$MISSION_DIR/sub-plan" 2>/dev/null | awk -F: '{s+=$2} END {print s+0}' || true)
+  TASKS_TOTAL=0; TASKS_DONE=0
+  for _sp in "$MISSION_DIR"/sub-plan/*.md; do
+    [ -f "$_sp" ] || continue
+    TASKS_TOTAL=$(( TASKS_TOTAL + $(count_boxes "$_sp" '[ xX]') ))
+    TASKS_DONE=$(( TASKS_DONE + $(count_boxes "$_sp" '[xX]') ))
+  done
 fi
+# done ≤ total is an invariant of the audit trail — never let a report show
+# progress above 100%, whatever the plan file contains. (B3)
+[ "${TASKS_DONE:-0}" -gt "${TASKS_TOTAL:-0}" ] 2>/dev/null && TASKS_DONE="$TASKS_TOTAL"
 
 # blocker count
 BLOCKERS_FILE="$MISSION_DIR/blockers.md"

package/src/cli.ts

@@ -12,7 +12,7 @@ import { installTo, removeInstalled, VERSION, ensureProjectGitignore, removeProj
 import { manifestPath, readManifest, writeManifest, type Scope } from './manifest.ts';
 import { resetMission, archiveMission } from './mission.ts';
 import { runScript, RUNNABLE } from './run.ts';
-import { readContinue, readState, resolveContinue, formatTable, formatResume, gitActor, hasLegacyLayout, CURRENT_SCHEMA_VERSION } from './continue.ts';
+import { readContinue, readState, resolveContinue, formatTable, formatResume, gitActor, hasLegacyLayout, CURRENT_SCHEMA_VERSION, unreadableStateFiles } from './continue.ts';
 import { blamePath } from './provenance.ts';
 import { signReport, verifyReport, ensurePureKey, hasMinisign } from './sign.ts';
 import { ensureConfig } from './config.ts';
@@ -25,6 +25,17 @@ import { enforceHarnessPolicy } from './policy.ts';
 const str = (v: FlagValue): string | undefined => (typeof v === 'string' ? v : undefined);
 const flag = (v: FlagValue): boolean => v === true;
 
+// Anchor to the repo root so running from a package subdirectory does not
+// create a shadow .mugiwara/ there. (B4)
+function resolveProjectDir(explicit?: string): string {
+  if (explicit) return resolve(explicit);
+  try {
+    const root = execFileSync('git', ['rev-parse', '--show-toplevel'], { encoding: 'utf8' }).trim();
+    if (root) return root;
+  } catch { /* not a git repo — fall through */ }
+  return process.cwd();
+}
+
 export async function run(argv: string[]): Promise<void> {
   const { command, flags, _ } = parseArgs(argv);
   if (flag(flags.help) || command === 'help') return help();
@@ -35,7 +46,7 @@ export async function run(argv: string[]): Promise<void> {
   {
     const bypass = new Set(['install', 'update', 'uninstall', 'list']);
     if (!bypass.has(command)) {
-      const projectDirForHarness = resolve(str(flags.project) ?? process.cwd());
+      const projectDirForHarness = resolveProjectDir(str(flags.project));
       enforceHarnessPolicy(projectDirForHarness);
     }
   }
@@ -45,7 +56,7 @@ export async function run(argv: string[]): Promise<void> {
   // Skipped for install/update --dry-run: a dry run must not mutate the project.
   const isDryRunInstall = (command === 'install' || command === 'update') && flag(flags.dryRun);
   if (!isDryRunInstall) {
-    const projectDir = resolve(str(flags.project) ?? process.cwd());
+    const projectDir = resolveProjectDir(str(flags.project));
     if (ensureConfig(projectDir)) {
       console.log(`default .mugiwara/config written at ${join(projectDir, '.mugiwara', 'config')} (edit it to customise)`);
     }
@@ -75,7 +86,7 @@ export async function run(argv: string[]): Promise<void> {
 }
 
 function resetCmd(flags: Args['flags']): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const force = flag(flags.force);
   const result = resetMission(projectDir, flag(flags.keepLogs), force);
   if (result.blocked) {
@@ -88,7 +99,7 @@ function resetCmd(flags: Args['flags']): void {
 }
 
 function archive(flags: Args['flags'], positionals: string[]): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const mission = positionals[1];
   if (!mission) { console.error('usage: mugiwara archive <mission> [--project <dir>] [--dry-run]'); process.exit(1); }
   const result = archiveMission(projectDir, mission, { dryRun: flag(flags.dryRun) });
@@ -107,7 +118,7 @@ function archive(flags: Args['flags'], positionals: string[]): void {
  * touched before that date.
  */
 function cleanCmd(flags: Args['flags']): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const dryRun = flag(flags.dryRun);
   const root = join(projectDir, '.mugiwara', 'missions');
   if (!existsSync(root)) { console.log('nothing to clean (.mugiwara/missions/ does not exist).'); return; }
@@ -173,7 +184,7 @@ async function resolveOptions(flags: Args['flags']): Promise<{ scope: Scope; pro
       if (!interactive) { scope = 'project'; }
       else scope = (await choose(rl!, 'Install scope?', ['global (user-wide)', 'project (this repo)'])) === 0 ? 'global' : 'project';
     }
-    const projectDir = resolve(str(flags.project) ?? process.cwd());
+    const projectDir = resolveProjectDir(str(flags.project));
     if (scope === 'project' && !existsSync(projectDir)) throw new Error(`Project dir not found: ${projectDir}`);
 
     let targetIds = str(flags.target)?.split(',').map(s => s.trim()) ?? null;
@@ -231,13 +242,15 @@ async function install(flags: Args['flags']): Promise<void> {
   });
   console.log(`\nOK mugiwara ${VERSION} installed (manifest: ${file})`);
   if (allNotes.length) console.log(`${allNotes.length} note(s) above may need attention.`);
+  console.log('CLI: run `npm i -g @ionivetech/mugiwara` so the crew can call `mugiwara savepoint/archive/continue`.');
+  console.log('     Without it the crew degrades to inline-only — no state, no resume, no closure gate.');
   // A fresh install writes a default .mugiwara/config — point at it directly.
   console.log('\nNext: edit .mugiwara/config to customise (mode, branch, coverage, depths).');
 }
 
 async function uninstall(flags: Args['flags']): Promise<void> {
   const scope: Scope = flag(flags.global) ? 'global' : 'project';
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const home = homedir();
   const file = manifestPath({ scope, projectDir, home });
   const manifest = readManifest(file);
@@ -310,7 +323,7 @@ function schemaWarnings(projectDir: string): void {
 
 function list(flags: Args['flags']): void {
   const home = homedir();
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   legacyWarning(projectDir);
   let found = false;
   for (const [label, file] of [
@@ -342,12 +355,28 @@ function list(flags: Args['flags']): void {
  * the caller must stop and let the user pick.
  */
 function continueCmd(flags: Args['flags'], positionals: string[]): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   legacyWarning(projectDir);
   schemaWarnings(projectDir);
   const [mission, member] = positionals.slice(1);
   let entries = readContinue(projectDir);
 
+  // If the requested member's state file is unreadable, refuse rather than
+  // resuming from continue-<member>.json alone. A resume point without its
+  // state is a guess. (B6)
+  if (mission) {
+    // readState populates unreadableStateFiles for state files; entries already captured
+    readState(projectDir);
+    const badState = unreadableStateFiles();
+    const target = member ? `${mission}/${member}.json` : `${mission}/state.json`;
+    if (badState.includes(target)) {
+      console.error(`✗ mission "${mission}"${member ? ` member "${member}"` : ''} has unreadable state: ${target}`);
+      process.exit(1);
+    }
+    // re-read continue entries after the state scan cleared unreadable (preserve original entries)
+    // entries already holds the correct continue data, no need to re-read
+  }
+
   // default to this actor's work; --all crosses actors on a shared checkout
   if (!flag(flags.all)) {
     const actor = gitActor(projectDir);
@@ -386,11 +415,19 @@ function continueCmd(flags: Args['flags'], positionals: string[]): void {
 
 /** `mugiwara status` — one screen of computed mission state, no model needed. */
 function statusCmd(flags: Args['flags']): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   legacyWarning(projectDir);
   schemaWarnings(projectDir);
   const states = readState(projectDir);
-  if (!states.length) { console.log('No mission state on disk.'); return; }
+  const bad = unreadableStateFiles();
+  if (bad.length) {
+    console.error(`⚠ ${bad.length} unreadable state file(s): ${bad.join(', ')}`);
+    console.error('  These are not "no mission" — they are corrupt. Inspect or delete them.');
+  }
+  if (!states.length) {
+    console.log(bad.length ? 'No readable mission state on disk.' : 'No mission state on disk.');
+    return;
+  }
   const actor = flag(flags.all) ? null : gitActor(projectDir);
   const rows = actor ? (states.filter((s) => s.actor === actor).length ? states.filter((s) => s.actor === actor) : states) : states;
   for (const s of rows) {
@@ -406,7 +443,7 @@ function statusCmd(flags: Args['flags']): void {
 
 /** `mugiwara cost [--mission <id>] [--json] [--ledger]` — show cost ledger, avoided work, efficiency, trail. */
 function costCmd(flags: Args['flags'], positionals: string[]): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const mission = str(flags.mission) ?? positionals[1] ?? (() => {
     const states = readState(projectDir);
     if (states.length === 1) return states[0].mission;
@@ -461,7 +498,7 @@ function costCmd(flags: Args['flags'], positionals: string[]): void {
 
 /** `mugiwara run <script.sh> [args]` — run a bundled harness script here. */
 function runCmd(flags: Args['flags'], positionals: string[]): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const name = positionals[1];
   if (!name) {
     console.error(`usage: mugiwara run <script> [args...]\n  scripts: ${RUNNABLE.join(', ')}`);
@@ -473,7 +510,7 @@ function runCmd(flags: Args['flags'], positionals: string[]): void {
 
 /** `mugiwara blame <path>` — provenance note on the last commit touching path. */
 function blameCmd(flags: Args['flags'], positionals: string[]): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const path = positionals[1];
   if (!path) { console.error('usage: mugiwara blame <file-path>'); process.exit(1); }
   console.log(blamePath(projectDir, path));
@@ -506,10 +543,15 @@ export function stalenessLine(projectDir: string, baseSha: string): string | nul
 
 /** `mugiwara handoff <mission>` — a report the next engineer can act on. */
 function handoffCmd(flags: Args['flags'], positionals: string[]): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const mission = positionals[1];
   if (!mission) { console.error('usage: mugiwara handoff <mission> [--project <dir>]'); process.exit(1); }
   const states = readState(projectDir).filter((s) => s.mission === mission);
+  const bad = unreadableStateFiles().filter((p) => p.startsWith(`${mission}/`));
+  if (bad.length) {
+    console.error(`✗ mission "${mission}" has unreadable state: ${bad.join(', ')}`);
+    process.exit(1);
+  }
   if (!states.length) { console.error(`no in-flight mission "${mission}"`); process.exit(1); }
   const lines = [
     `# Handoff: ${mission}`,
@@ -540,7 +582,7 @@ function handoffCmd(flags: Args['flags'], positionals: string[]): void {
 }
 
 export function migrateCmd(flags: Args['flags']): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   const dryRun = flag(flags.dryRun);
   const legacyState = join(projectDir, '.mugiwara', 'state');
   const legacyContinue = join(projectDir, '.mugiwara', 'continue');
@@ -623,7 +665,7 @@ export function migrateCmd(flags: Args['flags']): void {
 
 /** `mugiwara sign <mission>` / `--verify` / `--gen-key` — optional attestation. */
 function signCmd(flags: Args['flags'], _: string[]): void {
-  const projectDir = resolve(str(flags.project) ?? process.cwd());
+  const projectDir = resolveProjectDir(str(flags.project));
   if (flag(flags.genKey)) {
     const backend = str(flags.backend) ?? 'auto';
     const home = homedir();

package/src/continue.ts

@@ -111,6 +111,11 @@ export function gitActor(cwd: string): string {
   return name || process.env.USER || process.env.USERNAME || '';
 }
 
+const unreadable: string[] = [];
+
+/** State files that exist but could not be parsed. Cleared by each scan. (B6) */
+export function unreadableStateFiles(): string[] { return [...unreadable]; }
+
 /**
  * Read every mission dir under `.mugiwara/missions/<mission>/`, picking the
  * files this reader owns: state readers take `state.json` / `<member>.json`,
@@ -118,6 +123,7 @@ export function gitActor(cwd: string): string {
  * files are skipped.
  */
 function scan<T>(projectDir: string, kind: 'state' | 'continue', map: (raw: Record<string, unknown>, member: string | null) => T): T[] {
+  unreadable.length = 0;
   const base = join(projectDir, '.mugiwara', 'missions');
   if (!existsSync(base)) return [];
   const out: T[] = [];
@@ -148,7 +154,7 @@ function scan<T>(projectDir: string, kind: 'state' | 'continue', map: (raw: Reco
         if (text(raw.mission) !== mission) continue;
         out.push(map(raw, member));
       } catch {
-        // corrupt savepoint — skip, never crash the listing
+        unreadable.push(join(mission, f));
       }
     }
   }

package/src/cost.ts

@@ -33,7 +33,7 @@ export const LANE_BUDGET: Record<string, number> = {
   lean: 12000,
   standard: 25000,
   full: 50000,
-  spike: 3000,
+  spike: 9000,
 };
 
 /** Token estimate for skills/agents loaded in this lane (0 for unknown/direct). */

package/src/installer.ts

@@ -1,5 +1,5 @@
 // src/installer.ts
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, copyFileSync, rmSync, lstatSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, copyFileSync, rmSync, lstatSync, chmodSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -57,6 +57,7 @@ export interface Target {
 }
 
 export const CONTENT_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'content');
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8')) as { version: string };
 export const VERSION = pkg.version;
 
@@ -99,9 +100,13 @@ export function installTo(target: Target, opts: InstallOptions): InstallResult {
   const backupRoot = join(scope === 'global' ? home : projectDir, '.mugiwara');
   const result: InstallResult = { written: [], skipped: [], backedUp: [], notes: [] };
 
-  const writeOne = (absPath: string, text: string) => {
+  const writeOne = (absPath: string, text: string, mode?: number) => {
     if (existsSync(absPath)) {
-      if (readFileSync(absPath, 'utf8') === text) { result.skipped.push(absPath); return; }
+      if (readFileSync(absPath, 'utf8') === text) {
+        // ensure mode even when content unchanged
+        if (!dryRun && mode !== undefined) { try { chmodSync(absPath, mode); } catch { /* ignore */ } }
+        result.skipped.push(absPath); return;
+      }
       if (!force) {
         result.skipped.push(absPath);
         result.notes.push(`conflict (not overwritten; run update to replace with backup): ${absPath}`);
@@ -114,7 +119,11 @@ export function installTo(target: Target, opts: InstallOptions): InstallResult {
       if (!dryRun) { mkdirSync(backupDir, { recursive: true }); copyFileSync(absPath, backupFile); }
       result.backedUp.push(absPath);
     }
-    if (!dryRun) { mkdirSync(dirname(absPath), { recursive: true }); writeFileSync(absPath, text); }
+    if (!dryRun) {
+      mkdirSync(dirname(absPath), { recursive: true });
+      writeFileSync(absPath, text);
+      if (mode !== undefined) { try { chmodSync(absPath, mode); } catch { /* ignore */ } }
+    }
     result.written.push(absPath);
   };
 
@@ -156,6 +165,20 @@ export function installTo(target: Target, opts: InstallOptions): InstallResult {
     for (const r of sharedRefs) writeOne(join(sharedRoot, r.relPath), r.text);
   }
 
+  // Shell fallbacks: pure sh, no Node. The critical path (lane sizing + state)
+  // must survive on a harness where the CLI cannot run. See plan.md B1.
+  {
+    const SHELL_FALLBACKS = ['lane.sh', 'savepoint.sh', 'lib/patterns.sh', 'lib/lane-base.sh'];
+    const mugiwaraDir = join(scope === 'global' ? home : projectDir, '.mugiwara');
+    for (const rel of SHELL_FALLBACKS) {
+      const src = join(REPO_ROOT, 'scripts', rel);
+      if (!existsSync(src)) continue;
+      const text = readFileSync(src, 'utf8');
+      const dest = join(mugiwaraDir, 'bin', rel);
+      writeOne(dest, text, 0o755);
+    }
+  }
+
   if (target.postInstall) {
     const post = target.postInstall({ scope, projectDir, home, dryRun, files: result.written });
     result.written.push(...post.written);