@massu/core 2.5.2 → 2.5.3

package/dist/hooks/session-start.js

@@ -597,6 +597,40 @@ var init_memory_path = __esm({
   }
 });
 
+// src/lib/corrections-md.ts
+function parseCorrectionRules(content) {
+  const rules = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    const m = line.match(CORRECTION_RULE_BULLET);
+    if (m && m[1].trim()) {
+      rules.push(m[1].trim());
+      continue;
+    }
+    if (line.startsWith("|") && line.endsWith("|")) {
+      const cells = line.split("|").map((c) => c.trim()).filter((c) => c.length > 0);
+      if (cells.length < 4) continue;
+      if (cells[0] === "Date" || cells[0].startsWith("-")) continue;
+      const prevention = cells[3];
+      if (prevention && !prevention.startsWith("-") && !prevention.startsWith("<!--")) {
+        rules.push(prevention);
+      }
+    }
+  }
+  return rules;
+}
+function correctionsPath(memoryDir) {
+  return memoryDir.endsWith("/") ? `${memoryDir}${CORRECTIONS_FILENAME}` : `${memoryDir}/${CORRECTIONS_FILENAME}`;
+}
+var CORRECTION_RULE_BULLET, CORRECTIONS_FILENAME;
+var init_corrections_md = __esm({
+  "src/lib/corrections-md.ts"() {
+    "use strict";
+    CORRECTION_RULE_BULLET = /^-\s+\*\*Rule\*\*:\s*(.+)$/;
+    CORRECTIONS_FILENAME = "corrections.md";
+  }
+});
+
 // src/config-memory-schema.ts
 import { z } from "zod";
 var MemoryConfigSchema;
@@ -630,7 +664,7 @@ var init_config_memory_schema = __esm({
           message: "memory.recall.embedEndpoint must be an http(s) URL"
         }).optional(),
         embedModel: z.string().min(1).optional()
-      }).default({}),
+      }).prefault({}),
       // --- Contradiction / supersede gate (plan-living-memory-slice-2-temporal-model, P5-001) ---
       // When a new high-value memory (decision/correction) is written, find
       // semantically-related existing records and, if the new one contradicts an
@@ -659,7 +693,7 @@ var init_config_memory_schema = __esm({
         annotateSuperseded: z.boolean().default(false),
         // Time budget (ms) for the contradiction check; exceeded → fail-open (ADD).
         budgetMs: z.number().int().positive().default(800)
-      }).default({}),
+      }).prefault({}),
       // --- Background consolidation, the "sleep-time" pass
       //     (plan-living-memory-slice-3-consolidation) ---
       // Keeps memory sharp over years: dedupes, distills dying sessions into
@@ -705,7 +739,7 @@ var init_config_memory_schema = __esm({
         // Surface optional upgrades (e.g. "a local model was detected") in chat.
         suggestUpgrades: z.boolean().default(true),
         suggestIntervalDays: z.number().int().positive().default(30)
-      }).default({}),
+      }).prefault({}),
       // A-20 (Slice 4) — memory FILES: the mirror, and the one switch that decides whether
       // Massu may ever WRITE into the user's memory directory.
       //
@@ -730,7 +764,7 @@ var init_config_memory_schema = __esm({
         // turn of EVERY session, so an unbounded index is a permanent context tax — and the
         // per-session cap bounds only the RATE, never the total.
         indexMaxLines: z.number().int().min(1).default(50)
-      }).default({}),
+      }).prefault({}),
       // --- Cross-repo memory surfacing (plan-living-memory-slice-5-cross-repo-surfacing) ---
       // A decision made in one of your repos can surface in another — opt-in per
       // decision AND opt-in per repo, signed, verified, and materialized ONLY on
@@ -755,8 +789,8 @@ var init_config_memory_schema = __esm({
           enabled: z.boolean().default(true),
           maxCrossRepoItems: z.number().int().min(0).default(1),
           minScore: z.number().optional()
-        }).default({})
-      }).default({})
+        }).prefault({})
+      }).prefault({})
     }).optional();
   }
 });
@@ -936,13 +970,19 @@ function getResolvedPaths() {
     settingsLocalPath: resolve2(root, claudeDirName, "settings.local.json")
   };
 }
-var DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
+var DEFAULT_KNOWLEDGE_SOURCE_FILES, DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_memory_path();
+    init_corrections_md();
     init_credentials();
     init_config_memory_schema();
+    DEFAULT_KNOWLEDGE_SOURCE_FILES = [
+      "CLAUDE.md",
+      "MEMORY.md",
+      CORRECTIONS_FILENAME
+    ];
     DomainConfigSchema = z2.object({
       name: z2.string().default("Unknown"),
       routers: z2.array(z2.string()).default([]),
@@ -1071,34 +1111,40 @@ var init_config = __esm({
       fixDetection: z2.object({
         enabled: z2.boolean().default(true),
         lookbackDays: z2.number().default(7),
-        signals: z2.array(z2.string()).default([
-          "removed_broken_code",
-          "added_error_handling",
-          "method_name_correction",
-          "auth_fix",
-          "nil_handling_fix",
-          "concurrency_fix",
-          "async_pattern_fix",
-          "added_missing_import"
-        ])
-      }).default({}),
+        // ⛔ NO DEFAULT LIST HERE, DELIBERATELY — the heuristics are the SSOT.
+        //
+        // This carried a hand-typed copy of all eight signal names while
+        // `fix-detector.ts` already read `config…signals ?? FIX_HEURISTICS.map(h => h.name)`.
+        // Because zod ALWAYS materialised the default, that fallback — the correct expression
+        // — was unreachable, and the duplicate was the only thing in effect. Two authoring
+        // sites for one vocabulary, and the drift is SILENT: a name listed here that no longer
+        // exists simply never matches `enabledSignals.has(...)`, so a retired heuristic lingers
+        // as a dead entry with no error. Retiring `method_name_correction` would have landed at
+        // one site of two (CR-74).
+        //
+        // Optional, so an ABSENT value reaches the `??` and the heuristic list defines itself
+        // (Rule 25). An explicit list in massu.config.yaml still overrides, which is the only
+        // behaviour anyone actually configured — measured: `fix-detector.ts:267` is the sole
+        // consumer and no config file in the repo sets it.
+        signals: z2.array(z2.string()).optional()
+      }).prefault({}),
       failureClassification: z2.object({
         enabled: z2.boolean().default(true),
         thresholds: z2.object({
           known: z2.number().default(5),
           similar: z2.number().default(3)
-        }).default({}),
+        }).prefault({}),
         scoring: z2.object({
           diffPatternWeight: z2.number().default(3),
           filePatternWeight: z2.number().default(2),
           promptKeywordWeight: z2.number().default(2)
-        }).default({})
-      }).default({}),
+        }).prefault({})
+      }).prefault({}),
       pipeline: z2.object({
         requireIncidentReport: z2.boolean().default(true),
         requirePreventionRule: z2.boolean().default(true),
         requireEnforcement: z2.boolean().default(true)
-      }).default({}),
+      }).prefault({}),
       // plan-v0.2-interactive-rule-approval P-D-008 / P-D-009: project-configured
       // custom destinations for the rule-candidate funnel. The classifier matches
       // a candidate to one of these entries when none of the framework
@@ -1131,7 +1177,7 @@ var init_config = __esm({
         memory: z2.boolean().default(true),
         analytics: z2.boolean().default(true),
         audit: z2.boolean().default(true)
-      }).default({ memory: true, analytics: true, audit: true })
+      }).prefault({ memory: true, analytics: true, audit: true })
     }).optional();
     ConventionsConfigSchema = z2.object({
       claudeDirName: z2.string().default(".claude").refine(
@@ -1162,7 +1208,7 @@ var init_config = __esm({
         "session-state",
         "agents"
       ]),
-      knowledgeSourceFiles: z2.array(z2.string()).default(["CLAUDE.md", "MEMORY.md", "corrections.md"]),
+      knowledgeSourceFiles: z2.array(z2.string()).default([...DEFAULT_KNOWLEDGE_SOURCE_FILES]),
       excludePatterns: z2.array(z2.string()).default(["/ARCHIVE/", "/SESSION-HISTORY/"])
     }).optional();
     PythonDomainConfigSchema = z2.object({
@@ -1178,6 +1224,23 @@ var init_config = __esm({
     }).optional();
     PathsConfigSchema = z2.object({
       source: z2.string().default("src"),
+      /**
+       * Where this stack's tests live, relative to the project root.
+       *
+       * Added 2026-09-20 for P4.3 of docs/plans/2026-09-20-stack-conformant-asset-rendering.md.
+       * ~25 shipped assets told every customer their tests belong in
+       * `packages/core/src/__tests__/` — massu's OWN layout — and no vocabulary could express
+       * the alternative because none existed. A test directory is a first-class property of
+       * every stack (`tests/` on FastAPI, `test/` on Rails, `src/test/java` on Spring,
+       * `Tests/` on SwiftPM, and Go keeps `_test.go` beside the source), so it belongs here
+       * rather than in prose.
+       *
+       * OPTIONAL, so every config written before this key existed keeps loading unchanged; an
+       * asset that needs it uses `{{paths.tests | default("...")}}`. All 13 shipped templates
+       * declare it, each with the convention it follows recorded at the site (G32 option 2),
+       * and `stack-template-conformance.test.ts` asserts that.
+       */
+      tests: z2.string().optional(),
       aliases: z2.record(z2.string(), z2.string()).default({ "@": "src" }),
       monorepo_roots: z2.array(z2.string()).optional(),
       routers: z2.string().optional(),
@@ -1287,14 +1350,14 @@ var init_config = __esm({
       project: z2.object({
         name: z2.string().default("my-project"),
         root: z2.string().default("auto")
-      }).default({ name: "my-project", root: "auto" }),
-      framework: FrameworkConfigSchema.default({
+      }).prefault({ name: "my-project", root: "auto" }),
+      framework: FrameworkConfigSchema.prefault({
         type: "typescript",
         router: "none",
         orm: "none",
         ui: "none"
       }),
-      paths: PathsConfigSchema.default({ source: "src", aliases: { "@": "src" } }),
+      paths: PathsConfigSchema.prefault({ source: "src", aliases: { "@": "src" } }),
       toolPrefix: z2.string().default("massu"),
       dbAccessPattern: z2.string().optional(),
       knownMismatches: z2.record(z2.string(), z2.record(z2.string(), z2.string())).optional(),
@@ -12522,7 +12585,11 @@ function defaultsFor(language, fw, dir) {
         test: testFw === "unittest" ? prefix(dir, "python3 -m unittest") : prefix(dir, "python3 -m pytest -q"),
         type: prefix(dir, "python3 -m mypy ."),
         build: null,
-        syntax: prefix(dir, "python3 -m py_compile"),
+        // `python3 -m py_compile` with NO filenames exits 2 ('the following arguments are
+        // required: filenames') — a check that can never pass, i.e. a brick, and a brick
+        // gets bypassed. `compileall -q .` measured exit 1 on a tree with a syntax error
+        // and exit 0 on a clean tree (2026-09-20).
+        syntax: prefix(dir, "python3 -m compileall -q ."),
         lint: prefix(dir, "python3 -m ruff check .")
       };
     }
@@ -12560,7 +12627,12 @@ function defaultsFor(language, fw, dir) {
       return {
         test: prefix(dir, "swift test"),
         type: prefix(dir, "swift build"),
-        build: prefix(dir, "xcodebuild build"),
+        // `xcodebuild build` requires an .xcodeproj/.xcworkspace, but this block's other
+        // commands (`swift test`, `swift build`) and the swift-ios template's declared
+        // layout (Sources/) are SwiftPM. One stack cannot be SwiftPM for two keys and
+        // Xcode for a third. Operator-approved 2026-09-20; the three anti-vacuity plants
+        // that target this literal were re-pointed in the same change.
+        build: prefix(dir, "swift build -c release"),
         syntax: null,
         lint: prefix(dir, "swiftlint")
       };
@@ -12585,10 +12657,17 @@ function defaultsFor(language, fw, dir) {
     }
     case "ruby": {
       return {
-        test: prefix(dir, "bundle exec rspec"),
+        // Minitest is Rails' default; `bin/rails test` works on a fresh `rails new`.
+        // `bundle exec rspec` requires adding rspec-rails to the Gemfile first.
+        // https://guides.rubyonrails.org/testing.html
+        test: prefix(dir, "bin/rails test"),
         type: null,
         build: null,
-        syntax: prefix(dir, "ruby -c"),
+        // `ruby -c` with NO file argument reads STDIN: on empty stdin it prints
+        // 'Syntax OK' and exits 0 without inspecting one project file, and it BLOCKS on a
+        // TTY. A check that cannot fail is a blind gate. Measured 2026-09-20; the
+        // replacement exits 1 on a tree with a syntax error and 0 on a clean one.
+        syntax: prefix(dir, "find app lib -name '*.rb' -print0 | xargs -0 -n1 ruby -c > /dev/null"),
         lint: prefix(dir, "bundle exec rubocop")
       };
     }
@@ -13580,32 +13659,7 @@ function verifyPromotionEnvelope(payload) {
 
 // src/rule-candidate-applier.ts
 init_safe_write();
-
-// src/lib/corrections-md.ts
-var CORRECTION_RULE_BULLET = /^-\s+\*\*Rule\*\*:\s*(.+)$/;
-function parseCorrectionRules(content) {
-  const rules = [];
-  for (const raw of content.split("\n")) {
-    const line = raw.trim();
-    const m = line.match(CORRECTION_RULE_BULLET);
-    if (m && m[1].trim()) {
-      rules.push(m[1].trim());
-      continue;
-    }
-    if (line.startsWith("|") && line.endsWith("|")) {
-      const cells = line.split("|").map((c) => c.trim()).filter((c) => c.length > 0);
-      if (cells.length < 4) continue;
-      if (cells[0] === "Date" || cells[0].startsWith("-")) continue;
-      const prevention = cells[3];
-      if (prevention && !prevention.startsWith("-") && !prevention.startsWith("<!--")) {
-        rules.push(prevention);
-      }
-    }
-  }
-  return rules;
-}
-
-// src/rule-candidate-applier.ts
+init_corrections_md();
 init_memory_authorship();
 init_memory_index_region();
 init_config();
@@ -13903,9 +13957,10 @@ function failSync(db, reason) {
 // src/hooks/session-start.ts
 init_memory_file_ingest();
 init_config();
+init_corrections_md();
 init_db_driver();
 import { readFileSync as readFileSync19, existsSync as existsSync24 } from "fs";
-import { join as join18, resolve as resolve9 } from "path";
+import { resolve as resolve9 } from "path";
 import { parse as parseYaml4 } from "yaml";
 
 // src/capability-advisor.ts
@@ -14513,9 +14568,9 @@ function getMemoryDir() {
 }
 function loadCorrectionsPreventionRules() {
   try {
-    const correctionsPath = join18(getResolvedPaths().memoryDir, "corrections.md");
-    if (!existsSync24(correctionsPath)) return [];
-    return parseCorrectionRules(readFileSync19(correctionsPath, "utf-8"));
+    const correctionsFile = correctionsPath(getResolvedPaths().memoryDir);
+    if (!existsSync24(correctionsFile)) return [];
+    return parseCorrectionRules(readFileSync19(correctionsFile, "utf-8"));
   } catch (_e) {
     return [];
   }

package/dist/hooks/user-prompt.js

@@ -574,6 +574,15 @@ var init_memory_path = __esm({
   }
 });
 
+// src/lib/corrections-md.ts
+var CORRECTIONS_FILENAME;
+var init_corrections_md = __esm({
+  "src/lib/corrections-md.ts"() {
+    "use strict";
+    CORRECTIONS_FILENAME = "corrections.md";
+  }
+});
+
 // src/config-memory-schema.ts
 import { z } from "zod";
 var MemoryConfigSchema;
@@ -607,7 +616,7 @@ var init_config_memory_schema = __esm({
           message: "memory.recall.embedEndpoint must be an http(s) URL"
         }).optional(),
         embedModel: z.string().min(1).optional()
-      }).default({}),
+      }).prefault({}),
       // --- Contradiction / supersede gate (plan-living-memory-slice-2-temporal-model, P5-001) ---
       // When a new high-value memory (decision/correction) is written, find
       // semantically-related existing records and, if the new one contradicts an
@@ -636,7 +645,7 @@ var init_config_memory_schema = __esm({
         annotateSuperseded: z.boolean().default(false),
         // Time budget (ms) for the contradiction check; exceeded → fail-open (ADD).
         budgetMs: z.number().int().positive().default(800)
-      }).default({}),
+      }).prefault({}),
       // --- Background consolidation, the "sleep-time" pass
       //     (plan-living-memory-slice-3-consolidation) ---
       // Keeps memory sharp over years: dedupes, distills dying sessions into
@@ -682,7 +691,7 @@ var init_config_memory_schema = __esm({
         // Surface optional upgrades (e.g. "a local model was detected") in chat.
         suggestUpgrades: z.boolean().default(true),
         suggestIntervalDays: z.number().int().positive().default(30)
-      }).default({}),
+      }).prefault({}),
       // A-20 (Slice 4) — memory FILES: the mirror, and the one switch that decides whether
       // Massu may ever WRITE into the user's memory directory.
       //
@@ -707,7 +716,7 @@ var init_config_memory_schema = __esm({
         // turn of EVERY session, so an unbounded index is a permanent context tax — and the
         // per-session cap bounds only the RATE, never the total.
         indexMaxLines: z.number().int().min(1).default(50)
-      }).default({}),
+      }).prefault({}),
       // --- Cross-repo memory surfacing (plan-living-memory-slice-5-cross-repo-surfacing) ---
       // A decision made in one of your repos can surface in another — opt-in per
       // decision AND opt-in per repo, signed, verified, and materialized ONLY on
@@ -732,8 +741,8 @@ var init_config_memory_schema = __esm({
           enabled: z.boolean().default(true),
           maxCrossRepoItems: z.number().int().min(0).default(1),
           minScore: z.number().optional()
-        }).default({})
-      }).default({})
+        }).prefault({})
+      }).prefault({})
     }).optional();
   }
 });
@@ -913,13 +922,19 @@ function getResolvedPaths() {
     settingsLocalPath: resolve2(root, claudeDirName, "settings.local.json")
   };
 }
-var DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
+var DEFAULT_KNOWLEDGE_SOURCE_FILES, DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_memory_path();
+    init_corrections_md();
     init_credentials();
     init_config_memory_schema();
+    DEFAULT_KNOWLEDGE_SOURCE_FILES = [
+      "CLAUDE.md",
+      "MEMORY.md",
+      CORRECTIONS_FILENAME
+    ];
     DomainConfigSchema = z2.object({
       name: z2.string().default("Unknown"),
       routers: z2.array(z2.string()).default([]),
@@ -1048,34 +1063,40 @@ var init_config = __esm({
       fixDetection: z2.object({
         enabled: z2.boolean().default(true),
         lookbackDays: z2.number().default(7),
-        signals: z2.array(z2.string()).default([
-          "removed_broken_code",
-          "added_error_handling",
-          "method_name_correction",
-          "auth_fix",
-          "nil_handling_fix",
-          "concurrency_fix",
-          "async_pattern_fix",
-          "added_missing_import"
-        ])
-      }).default({}),
+        // ⛔ NO DEFAULT LIST HERE, DELIBERATELY — the heuristics are the SSOT.
+        //
+        // This carried a hand-typed copy of all eight signal names while
+        // `fix-detector.ts` already read `config…signals ?? FIX_HEURISTICS.map(h => h.name)`.
+        // Because zod ALWAYS materialised the default, that fallback — the correct expression
+        // — was unreachable, and the duplicate was the only thing in effect. Two authoring
+        // sites for one vocabulary, and the drift is SILENT: a name listed here that no longer
+        // exists simply never matches `enabledSignals.has(...)`, so a retired heuristic lingers
+        // as a dead entry with no error. Retiring `method_name_correction` would have landed at
+        // one site of two (CR-74).
+        //
+        // Optional, so an ABSENT value reaches the `??` and the heuristic list defines itself
+        // (Rule 25). An explicit list in massu.config.yaml still overrides, which is the only
+        // behaviour anyone actually configured — measured: `fix-detector.ts:267` is the sole
+        // consumer and no config file in the repo sets it.
+        signals: z2.array(z2.string()).optional()
+      }).prefault({}),
       failureClassification: z2.object({
         enabled: z2.boolean().default(true),
         thresholds: z2.object({
           known: z2.number().default(5),
           similar: z2.number().default(3)
-        }).default({}),
+        }).prefault({}),
         scoring: z2.object({
           diffPatternWeight: z2.number().default(3),
           filePatternWeight: z2.number().default(2),
           promptKeywordWeight: z2.number().default(2)
-        }).default({})
-      }).default({}),
+        }).prefault({})
+      }).prefault({}),
       pipeline: z2.object({
         requireIncidentReport: z2.boolean().default(true),
         requirePreventionRule: z2.boolean().default(true),
         requireEnforcement: z2.boolean().default(true)
-      }).default({}),
+      }).prefault({}),
       // plan-v0.2-interactive-rule-approval P-D-008 / P-D-009: project-configured
       // custom destinations for the rule-candidate funnel. The classifier matches
       // a candidate to one of these entries when none of the framework
@@ -1108,7 +1129,7 @@ var init_config = __esm({
         memory: z2.boolean().default(true),
         analytics: z2.boolean().default(true),
         audit: z2.boolean().default(true)
-      }).default({ memory: true, analytics: true, audit: true })
+      }).prefault({ memory: true, analytics: true, audit: true })
     }).optional();
     ConventionsConfigSchema = z2.object({
       claudeDirName: z2.string().default(".claude").refine(
@@ -1139,7 +1160,7 @@ var init_config = __esm({
         "session-state",
         "agents"
       ]),
-      knowledgeSourceFiles: z2.array(z2.string()).default(["CLAUDE.md", "MEMORY.md", "corrections.md"]),
+      knowledgeSourceFiles: z2.array(z2.string()).default([...DEFAULT_KNOWLEDGE_SOURCE_FILES]),
       excludePatterns: z2.array(z2.string()).default(["/ARCHIVE/", "/SESSION-HISTORY/"])
     }).optional();
     PythonDomainConfigSchema = z2.object({
@@ -1155,6 +1176,23 @@ var init_config = __esm({
     }).optional();
     PathsConfigSchema = z2.object({
       source: z2.string().default("src"),
+      /**
+       * Where this stack's tests live, relative to the project root.
+       *
+       * Added 2026-09-20 for P4.3 of docs/plans/2026-09-20-stack-conformant-asset-rendering.md.
+       * ~25 shipped assets told every customer their tests belong in
+       * `packages/core/src/__tests__/` — massu's OWN layout — and no vocabulary could express
+       * the alternative because none existed. A test directory is a first-class property of
+       * every stack (`tests/` on FastAPI, `test/` on Rails, `src/test/java` on Spring,
+       * `Tests/` on SwiftPM, and Go keeps `_test.go` beside the source), so it belongs here
+       * rather than in prose.
+       *
+       * OPTIONAL, so every config written before this key existed keeps loading unchanged; an
+       * asset that needs it uses `{{paths.tests | default("...")}}`. All 13 shipped templates
+       * declare it, each with the convention it follows recorded at the site (G32 option 2),
+       * and `stack-template-conformance.test.ts` asserts that.
+       */
+      tests: z2.string().optional(),
       aliases: z2.record(z2.string(), z2.string()).default({ "@": "src" }),
       monorepo_roots: z2.array(z2.string()).optional(),
       routers: z2.string().optional(),
@@ -1264,14 +1302,14 @@ var init_config = __esm({
       project: z2.object({
         name: z2.string().default("my-project"),
         root: z2.string().default("auto")
-      }).default({ name: "my-project", root: "auto" }),
-      framework: FrameworkConfigSchema.default({
+      }).prefault({ name: "my-project", root: "auto" }),
+      framework: FrameworkConfigSchema.prefault({
         type: "typescript",
         router: "none",
         orm: "none",
         ui: "none"
       }),
-      paths: PathsConfigSchema.default({ source: "src", aliases: { "@": "src" } }),
+      paths: PathsConfigSchema.prefault({ source: "src", aliases: { "@": "src" } }),
       toolPrefix: z2.string().default("massu"),
       dbAccessPattern: z2.string().optional(),
       knownMismatches: z2.record(z2.string(), z2.record(z2.string(), z2.string())).optional(),

package/fragments/feature-components.md

@@ -0,0 +1,15 @@
+#### Components Needed
+- [ ] The module that implements the feature, under `{{paths.source}}`
+- [ ] Its public entry point, exported where this project's other modules are
+- [ ] Registration with whatever dispatches to it (router, CLI, event handler, DI container)
+- [ ] Input validation at the boundary
+- [ ] Configuration, if the feature needs any
+- [ ] Tests under `{{paths.tests | default("tests")}}`
+- [ ] Documentation
+
+#### Patterns to Apply (MANDATORY)
+- [ ] Follow the registration pattern this project already uses — find the nearest
+      existing feature and mirror it rather than inventing a second shape
+- [ ] Resolve configuration through this project's config loader, not by reading files ad hoc
+- [ ] Release every resource you acquire (connections, handles, locks)
+- [ ] Every error path either handles the error or propagates it — never swallows it

package/fragments/feature-components.python.md

@@ -0,0 +1,15 @@
+#### Components Needed
+- [ ] The module that implements the feature, under `{{paths.source}}`
+- [ ] Its public names exported in the package `__init__.py`
+- [ ] Registration with the application (router include, CLI entry point, task registry)
+- [ ] Request/response models for the boundary
+- [ ] Settings, if the feature needs configuration
+- [ ] Tests under `{{paths.tests | default("tests")}}`
+- [ ] Docstrings on every public function
+
+#### Patterns to Apply (MANDATORY)
+- [ ] Follow the registration pattern this project already uses — mirror the nearest
+      existing feature rather than inventing a second shape
+- [ ] Type hints on every public signature; `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}` must pass
+- [ ] Context managers for anything that must be closed
+- [ ] Never bare `except:` — catch the exception you mean

package/fragments/feature-components.typescript.md

@@ -0,0 +1,15 @@
+#### Components Needed
+- [ ] The module that implements the feature, under `{{paths.source}}`
+- [ ] Its exported surface (types and functions) declared explicitly
+- [ ] Registration with whatever dispatches to it (router, command table, DI container)
+- [ ] Input schemas at the boundary
+- [ ] Configuration, if the feature needs any
+- [ ] Tests under `{{paths.tests | default("tests")}}`
+- [ ] Documentation
+
+#### Patterns to Apply (MANDATORY)
+- [ ] Follow the registration pattern this project already uses — mirror the nearest
+      existing feature rather than inventing a second shape
+- [ ] Resolve configuration through this project's config loader
+- [ ] `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}` must pass with no new errors
+- [ ] Release every resource you acquire — close what you open, in a `finally`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massu/core",
-  "version": "2.5.2",
+  "version": "2.5.3",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns",
   "main": "./dist/cli.js",
@@ -44,23 +44,23 @@
     "fast-glob": "^3.3.0",
     "onnxruntime-web": "^1.27.0",
     "proper-lockfile": "^4.1.2",
-    "smol-toml": "^1.3.0",
+    "smol-toml": "^1.8.0",
     "tar": "^7.4.3",
     "tweetnacl": "^1.0.3",
     "vscode-languageserver-protocol": "^3.17.5",
     "web-tree-sitter": "~0.25.10",
     "yaml": "^2.4.0",
-    "zod": "^3.23.0"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
     "@types/proper-lockfile": "^4.1.4",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.12",
     "esbuild": "^0.28.1",
     "semver": "^7.5.0",
     "tsx": "^4.23.0",
     "typescript": "^5.4.0",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.12"
   },
   "files": [
     "dist/**/*",
@@ -71,6 +71,7 @@
     "patterns/**/*",
     "protocols/**/*",
     "reference/**/*",
+    "fragments/**/*",
     "templates/**/*",
     "LICENSE",
     "CHANGELOG.md"