@mindrian_os/install 1.13.0-beta.17 → 1.13.0-beta.21

package/lib/core/stale-copy-scanner.cjs

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * lib/core/stale-copy-scanner.cjs
+ * -------------------------------
+ * Phase 121.5-05 Sub-plan F Task 2 (SEED-007 absorption).
+ *
+ * Pure CJS module that scans the first-touch surfaces declared in
+ * data/first-touch-surfaces.json for two regression patterns:
+ *
+ *   - stale_version_hardcode  a literal `vX.Y.Z` (or `X.Y.Z`) in greeting
+ *                             copy that is OLDER than the running plugin
+ *                             version (semver compare). Source finding
+ *                             (SEED-007, 2026-05-09): a v1.12.0 greeting
+ *                             was rendering on a stale Windows install that
+ *                             had been bumped to v1.13.0.
+ *   - em_dash_violation       any U+2014 EM DASH in a surface that has
+ *                             em_dash_check: true. Enforces the
+ *                             feedback_no_emdashes hard rule.
+ *
+ * Per-surface invariants come from data/first-touch-surfaces.json:
+ *   - version_stamp_required: false  ->  skip stale_version_hardcode
+ *   - em_dash_check: false           ->  skip em_dash_violation
+ *   - allowed_hardcoded_versions[]    ->  whitelist of strings exempt from
+ *                                        stale_version_hardcode (template
+ *                                        tokens, doc examples)
+ *
+ * Wired into scripts/doctor.cjs as class K (stale-first-touch-copy).
+ *
+ * Canon Part 7 (Reuse Before Build): consolidates the SEED-007 detection
+ * responsibility previously scattered across scripts/check-first-touch-drift.cjs
+ * (which exists but is partial / not exposed in /mos:doctor) and the manual
+ * audit pattern. ZERO new commands; class K extends the existing class A-J
+ * doctor pattern.
+ *
+ * Canon Part 8: local-only; no fetch, no Brain, no telemetry egress.
+ *
+ * Note: this plan was scoped against class H in 121.5-05-PLAN.md, but class
+ * H was already taken (install-incomplete: missing statusLine block + halted
+ * .install-receipt.json) at the time of execution. Renamed to class K (next
+ * available after I + J) per deviation Rule 3 (auto-fix blocking issue:
+ * naming collision). The behavior contract from the plan is preserved
+ * byte-identical; only the class letter changed.
+ *
+ * No emoji. No em-dashes. ASCII-clean source.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const {
+  readSurfaces,
+  resolveCurrentVersion,
+  hasEmDash,
+} = require('./first-touch-version-stamper.cjs');
+
+const REPO_ROOT = path.join(__dirname, '..', '..');
+
+// vX.Y.Z or X.Y.Z (optional -<prerelease> tail). Captures the X.Y.Z core in
+// group 1 (without the leading v) for semver compare. Matches:
+//   v1.13.0           -> 1.13.0
+//   1.13.0            -> 1.13.0
+//   v1.13.0-beta.15   -> 1.13.0-beta.15
+const VERSION_LITERAL_RE = /\bv?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)\b/g;
+
+// compareSemver(a, b) returns negative if a < b, positive if a > b, 0 if
+// equal. Loose splitter (numeric-aware for X.Y.Z core; lexical for the
+// prerelease tail). Sufficient for the SEED-007 detection pattern (older
+// X.Y.Z than current); does not aim to match the full semver 2.0 spec.
+function compareSemver(a, b) {
+  const parseLoose = (s) => String(s)
+    .replace(/^v/, '')
+    .split(/[.-]/)
+    .map((p) => (/^\d+$/.test(p) ? parseInt(p, 10) : p));
+  const A = parseLoose(a);
+  const B = parseLoose(b);
+  const len = Math.max(A.length, B.length);
+  for (let i = 0; i < len; i++) {
+    const x = A[i];
+    const y = B[i];
+    if (x === undefined) return -1;
+    if (y === undefined) return 1;
+    if (typeof x === 'number' && typeof y === 'number') {
+      if (x !== y) return x - y;
+      continue;
+    }
+    // Mixed-type or string compare: stringwise.
+    const sx = String(x);
+    const sy = String(y);
+    if (sx !== sy) return sx < sy ? -1 : 1;
+  }
+  return 0;
+}
+
+// scanSurface(surface, currentVersion, opts?) -> violations[]
+// opts.repoRoot can override the file root for tests / fixtures.
+function scanSurface(surface, currentVersion, opts) {
+  const violations = [];
+  const repoRoot = (opts && opts.repoRoot) || REPO_ROOT;
+  const filePath = path.isAbsolute(surface.file)
+    ? surface.file
+    : path.join(repoRoot, surface.file);
+  let content;
+  try {
+    content = fs.readFileSync(filePath, 'utf8');
+  } catch (_e) {
+    // Missing surface file is NOT a violation (per scripts/check-first-touch-
+    // drift.cjs convention -- missing is warn-only, not hard fail). Tests
+    // explicitly cover the present-but-stale + present-but-em-dashed paths.
+    return violations;
+  }
+  if (surface.em_dash_check && hasEmDash(content)) {
+    violations.push({
+      surface: surface.id,
+      file: surface.file,
+      kind: 'em_dash_violation',
+    });
+  }
+  if (surface.version_stamp_required !== false) {
+    const allowed = new Set(surface.allowed_hardcoded_versions || []);
+    VERSION_LITERAL_RE.lastIndex = 0;
+    let m;
+    while ((m = VERSION_LITERAL_RE.exec(content)) !== null) {
+      const found = m[1];
+      // Allowlist check: exact match against the captured X.Y.Z(-prerelease)
+      // core OR against the original literal token (with optional 'v' prefix).
+      if (allowed.has(found) || allowed.has('v' + found) || allowed.has(m[0])) continue;
+      // Anything OLDER than the running plugin version is stale -- that is
+      // the SEED-007 trigger. Equal or newer is fine.
+      if (compareSemver(found, currentVersion) < 0) {
+        violations.push({
+          surface: surface.id,
+          file: surface.file,
+          kind: 'stale_version_hardcode',
+          found,
+          current: currentVersion,
+        });
+      }
+    }
+  }
+  return violations;
+}
+
+// scanForStaleCopy(opts?) -> {valid, violations, scanned_count, current_version}
+// opts.surfaces overrides the default surfaces[] from data/first-touch-surfaces.json.
+// opts.currentVersion overrides the auto-resolved plugin.json version.
+// opts.repoRoot routes relative paths against an override (for tests).
+function scanForStaleCopy(opts) {
+  opts = opts || {};
+  const surfaces = opts.surfaces ? opts.surfaces : readSurfaces().surfaces;
+  const currentVersion = opts.currentVersion || resolveCurrentVersion();
+  const violations = [];
+  for (const s of surfaces) {
+    violations.push(...scanSurface(s, currentVersion, { repoRoot: opts.repoRoot }));
+  }
+  return {
+    valid: violations.length === 0,
+    violations,
+    scanned_count: surfaces.length,
+    current_version: currentVersion,
+  };
+}
+
+module.exports = {
+  scanForStaleCopy,
+  scanSurface,
+  compareSemver,
+  VERSION_LITERAL_RE,
+};
+
+// CLI invocation: `node lib/core/stale-copy-scanner.cjs` runs the scanner
+// against the live repo and prints a summary. Exit 0 clean / Exit 1 violations.
+if (require.main === module) {
+  const result = scanForStaleCopy();
+  if (result.valid) {
+    process.stdout.write('stale-copy-scanner: clean (' + result.scanned_count + ' surfaces scanned, current v' + result.current_version + ')\n');
+    process.exit(0);
+  }
+  process.stdout.write('stale-copy-scanner: ' + result.violations.length + ' violation(s) (current v' + result.current_version + ')\n');
+  for (const v of result.violations) {
+    if (v.kind === 'stale_version_hardcode') {
+      process.stdout.write('  ' + v.surface + ' (' + v.file + ') -- stale version literal "' + v.found + '" (current ' + v.current + ')\n');
+    } else if (v.kind === 'em_dash_violation') {
+      process.stdout.write('  ' + v.surface + ' (' + v.file + ') -- em-dash (U+2014) in greeting surface\n');
+    }
+  }
+  process.exit(1);
+}

package/lib/core/state-aware-router.cjs

@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ * Phase 121.5-08 (Sub-plan J) -- /mos:mos state-aware router.
+ *
+ * D-10 LOCKED: /mos:mos picks the right surface based on the navigator's
+ * current room state. The user types /mos:mos and the router meets them
+ * where they are.
+ *
+ *   No room exists                           -> /mos:onboard
+ *   Room exists but mostly empty             -> /mos:status (+ suggest next move)
+ *     ("mostly empty" = sectionsCount == 0 OR stage matches /Pre-Opportunity/i)
+ *   Room populated (sections >= 1, stage past Pre-Opportunity)
+ *                                            -> /mos:suggest-next
+ *
+ * The router is a PURE function. Reading STATE.md / the registry is done
+ * upstream by commands/mos.md; the router operates on the resolved
+ * roomState object only. This keeps the routing logic hermetic and
+ * unit-testable without any fs / spawn.
+ *
+ * Canon Part 3: /mos:mos is itself a Decision Gate at the meta level --
+ * the router writes a typed (navigator) -[ROUTED_VIA {target, reason}]->
+ * (next-surface) edge upstream when the routing decision is committed
+ * by commands/mos.md. The router function here only RESOLVES the target;
+ * edge emission is the caller's responsibility.
+ *
+ * Canon Part 7: ONE function replaces the prior "pick the right /mos:*
+ * surface for me" mental load on the user. NO new command behaviors
+ * are added -- /mos:mos delegates to /mos:onboard / /mos:status /
+ * /mos:suggest-next which already exist.
+ *
+ * Canon Part 8: zero Brain calls, zero network, zero side-channel writes.
+ */
+'use strict';
+
+/**
+ * Resolve which canonical surface to route to given the current room state.
+ *
+ * @param {{
+ *   roomState?: {
+ *     exists?: boolean,            // does the room directory exist?
+ *     sectionsCount?: number,      // how many section folders are populated?
+ *     stage?: string,              // venture stage from STATE.md (or empty)
+ *   }
+ * }} opts
+ * @returns {{
+ *   route: string,                 // '/mos:onboard' | '/mos:status' | '/mos:suggest-next'
+ *   reason: string,                // 'no_room' | 'mostly_empty' | 'populated'
+ *   addendum: string | null,       // optional follow-on hint (e.g. 'suggest next move')
+ * }}
+ */
+function resolveNextSurface(opts) {
+  const rs = (opts && opts.roomState) || {};
+
+  // Branch 1: no room exists at all -- the new navigator path.
+  if (!rs.exists) {
+    return { route: '/mos:onboard', reason: 'no_room', addendum: null };
+  }
+
+  // Branch 2: room exists but is mostly empty. Two signals:
+  //   (a) sectionsCount == 0 -- the navigator has not populated any section.
+  //   (b) stage matches Pre-Opportunity (case-insensitive) -- the venture
+  //       has not even crossed the Opportunity threshold yet.
+  // Either signal routes to /mos:status with a next-move addendum.
+  const sections = typeof rs.sectionsCount === 'number' ? rs.sectionsCount : 0;
+  const stage = typeof rs.stage === 'string' ? rs.stage : '';
+  if (sections === 0 || /Pre-Opportunity/i.test(stage)) {
+    return {
+      route: '/mos:status',
+      reason: 'mostly_empty',
+      addendum: 'suggest next move',
+    };
+  }
+
+  // Branch 3: room is populated -- the navigator wants the next move.
+  return { route: '/mos:suggest-next', reason: 'populated', addendum: null };
+}
+
+module.exports = { resolveNextSurface };

package/lib/core/telemetry/schema.cjs

@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 121-00 -- frozen v1 telemetry schema.
+ *
+ * Source of truth for the unified trajectory-telemetry stream at
+ *   ~/.mindrian/telemetry/v1.13/events-YYYY-WNN.jsonl
+ *
+ * Per Canon D-10 (frozen v1 schema with per-row schema_version):
+ *   - EVENT_TYPES is Object.frozen and locked at 15 entries for v1.
+ *   - ALLOWED_FIELDS is a frozen, per-event whitelist of scalar field names.
+ *   - SCHEMA_VERSION is a literal Number (not String) so consumers can
+ *     dispatch on version with a strict-equal check.
+ *   - Future structural changes ship as SCHEMA_VERSION 2 events that
+ *     coexist in the same JSONL stream; v1 stays additive-only.
+ *
+ * Per Canon Part 8 (Graph Boundary):
+ *   - String-length caps prevent raw artifact bytes from sneaking through
+ *     allowed fields. emit() applies them; this module declares them.
+ *   - The 9 net-new event types (D-04..D-09) only allow scalar fields:
+ *     hashes (sha256), enum strings, counts, scores, timestamps.
+ *     There is no field on any event that intentionally carries free-text.
+ *
+ * Inheritance: the 6 mva.* event types mirror lib/core/mva-telemetry.cjs
+ * ALLOWED_FIELDS verbatim. Per D-08, mva-telemetry.cjs becomes a thin shim
+ * delegating to the unified writer in a downstream plan; v1 keeps both
+ * call paths byte-identical on the wire so the shim is a no-op cut-over.
+ *
+ * Pure CJS, node built-ins only. Zero runtime deps. Zero network surface.
+ */
+'use strict';
+
+// ---------- Frozen v1 schema version ----------
+
+const SCHEMA_VERSION = 1;
+
+// ---------- Frozen invariants (15 event types) ----------
+
+const EVENT_TYPES = Object.freeze([
+  // 6 inherited from lib/core/mva-telemetry.cjs (Phase 118):
+  'mva_pipeline_started',
+  'mva_agent_returned',
+  'mva_brief_rendered',
+  'mva_option_selected',
+  'mva_brief_deployed',
+  'mva_pipeline_failed',
+  // 9 net-new for the unified Phase 121 surface (D-04..D-09):
+  'selector_pick',         // D-04: F-shape selector picks (88.2 + 125 ranker)
+  'tension_engagement',    // D-05: tension hook user response (116)
+  'auto_explore_decision', // D-06: auto-explore acceptance (117)
+  'breakthrough_dismissed',// D-07: F.7 + ethics-tier dismissal (120)
+  'hooked_axis_score',     // D-08: Hooked axis re-score (117 scripts)
+  'empathy_observation',   // D-09: empathy audit harness observation
+  'room_receipt_written',  // D-09: room-as-receipt write (119)
+  'command_invocation',    // D-09: PostToolUse /mos:* sweep
+  'nav_bypass',            // D-09: navigation.cjs bypass migration source
+]);
+
+// ---------- Per-event ALLOWED_FIELDS (frozen arrays) ----------
+//
+// Every entry is a closed whitelist. emit() rejects any payload key that is
+// not in this list. Adding a field to v1 requires:
+//   1. amending this list (additive only)
+//   2. a Canon Part 8 review of the new field
+//   3. matching frontmatter update in the consuming plan's CONTEXT.md
+// Structural changes (renaming, removing, re-typing a field) require a
+// SCHEMA_VERSION bump to 2 + a separate plan that introduces the v2 event.
+//
+// Field-naming convention:
+//   *_sha256        -- 64-char hex hash, exempt from raw-hex detector
+//   *_hash          -- shorter hash (8-32 chars), also hash-class
+//   *_score         -- numeric, no length cap concern
+//   ttr_seconds     -- numeric (time-to-response in seconds)
+//   ranker_*        -- 125-ranker outputs (numeric)
+//   *_response      -- enum string (kept / redid / ignored / resolve / defer / ignore)
+//   *_count         -- non-negative integer
+
+const ALLOWED_FIELDS = Object.freeze({
+  // ----- 6 inherited mva.* (must mirror lib/core/mva-telemetry.cjs verbatim) -----
+  mva_pipeline_started: Object.freeze(['sentence_sha256']),
+  mva_agent_returned:   Object.freeze(['sentence_sha256', 'agent_id', 'duration_ms', 'status', 'error_short']),
+  mva_brief_rendered:   Object.freeze(['sentence_sha256', 'total_duration_ms', 'agent_count_ok', 'agent_count_failed']),
+  mva_option_selected:  Object.freeze(['sentence_sha256', 'option_id', 'time_to_click_ms']),
+  mva_brief_deployed:   Object.freeze(['sentence_sha256', 'vercel_subdomain_hash', 'deploy_duration_ms', 'status', 'error_short']),
+  mva_pipeline_failed:  Object.freeze(['sentence_sha256', 'total_duration_ms', 'error_short']),
+
+  // ----- 9 net-new (D-04..D-09) -----
+  selector_pick: Object.freeze([
+    'sub_shape',             // enum: 'F.0' | 'F.1' | 'F.2' | 'F.3' | 'F.4' | 'F.5' | 'F.6' | 'F.7'
+    'mode',                  // enum: 'A' (Brain reachable) | 'B' (Local Only) | 'Tier 0'
+    'ranker_confidence',     // number 0..1 (125-ranker confidence for picked option)
+    'recommended_rendered',  // boolean (RECOMMENDED marker was shown)
+    'options_count',         // integer
+    'room_slug_sha256',      // 64-char sha256
+    'verb_chosen',           // enum (closed verb vocab, one of the 10 canonical verbs)
+  ]),
+  tension_engagement: Object.freeze([
+    'tension_type',          // enum: 'contradicts' | 'converges' | 'invalidates'
+    'user_response',         // enum: 'resolve' | 'defer' | 'ignore'
+    'ttr_seconds',           // number (time-to-response)
+    'room_slug_sha256',      // 64-char sha256
+    'context_hash',          // shorter hash (16 chars) tying back to surfaced context
+  ]),
+  auto_explore_decision: Object.freeze([
+    'finding_type',          // enum: 'whitespace' | 'reverse_salient' | 'cross_domain_match'
+    'user_response',         // enum: 'kept' | 'redid' | 'ignored'
+    'domain_match_score',    // number 0..1
+    'room_slug_sha256',
+  ]),
+  breakthrough_dismissed: Object.freeze([
+    'detector_type',         // enum (per Phase 120 D-19 detector taxonomy)
+    'verb_chosen',           // enum (F.7 verb pick or Free-Text)
+    'ethics_tier',           // enum: 'HARD_FLOOR' | 'SOFT_BAND' | 'NEUTRAL' | 'GREEN'
+    'voice_audit_pass',      // boolean
+    'room_slug_sha256',
+  ]),
+  hooked_axis_score: Object.freeze([
+    'axis_name',             // enum: 'investment' | 'reward' | 'trigger' | 'action'
+    'score_value',           // number
+    'room_slug_sha256',
+    'window_iso_week',       // string 'YYYY-WNN' (ISO week the score window covers)
+  ]),
+  empathy_observation: Object.freeze([
+    'engaged_past_15m',      // boolean
+    'handed_back_material',  // boolean
+    'returned_within_48h',   // boolean
+    'ttr_seconds',           // number
+    'tester_id_hash',        // hash (NOT the tester's real ID; per Canon Part 8)
+  ]),
+  room_receipt_written: Object.freeze([
+    'room_slug_sha256',
+    'conversation_id_hash',  // hash
+    'generated_at_ts',       // number (epoch ms) or ISO string
+  ]),
+  command_invocation: Object.freeze([
+    'command',               // enum string (e.g. '/mos:whitespace', '/mos:think-hats')
+    'outcome',               // enum: 'success' | 'error' | 'aborted'
+    'duration_ms',           // number
+    'context_hash',          // hash
+  ]),
+  nav_bypass: Object.freeze([
+    'op',                    // enum: 'read' | 'write' | 'query'
+    'reason',                // enum: 'legacy_path' | 'startup_bootstrap' | 'tooling_only'
+    'caller_hash',           // hash (stack-frame-derived identifier; NOT a file path)
+    'room_slug_sha256',
+  ]),
+});
+
+// ---------- String-length caps ----------
+//
+// MAX_STRING_LEN is the default cap on any string payload value. The two
+// other constants are special-cased: sha256 fields must be exactly 64 hex
+// characters; error_short is a short error description with its own cap.
+
+const MAX_STRING_LEN = 64;
+const MAX_ERROR_SHORT_LEN = 60;
+const SHA256_LEN = 64;
+const MAX_CONTEXT_HASH_LEN = 16;
+
+module.exports = {
+  EVENT_TYPES,
+  ALLOWED_FIELDS,
+  SCHEMA_VERSION,
+  MAX_STRING_LEN,
+  MAX_ERROR_SHORT_LEN,
+  SHA256_LEN,
+  MAX_CONTEXT_HASH_LEN,
+};

package/lib/core/telemetry/schema.test.cjs

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 121-00 -- frozen v1 telemetry schema acceptance tests.
+ *
+ * Verifies EVENT_TYPES + ALLOWED_FIELDS contracts from
+ * lib/core/telemetry/schema.cjs. The schema is the source of truth that
+ * lib/core/telemetry/validator.cjs and lib/core/telemetry/writer.cjs
+ * consume. Per Canon Part 8 + D-10 (frozen v1 schema), this contract is
+ * locked for the v1 wire forever; future evolution lives in v2 events
+ * that coexist in the same JSONL stream (per-row schema_version).
+ *
+ * Test map (2 cases, one-to-one with the PLAN <behavior> block for Task 1):
+ *   1.  EVENT_TYPES is Object.freeze'd array of exactly 15 strings
+ *       (6 inherited mva.* + 9 net-new; superset of mva-telemetry.cjs).
+ *   2.  ALLOWED_FIELDS keys === EVENT_TYPES set; every value is frozen array.
+ *
+ * Registered in lib/memory/run-feynman-tests.cjs.
+ */
+
+const assert = require('node:assert/strict');
+const path = require('node:path');
+
+const REPO = path.resolve(__dirname, '..', '..', '..');
+const SCHEMA_PATH = path.join(REPO, 'lib/core/telemetry/schema.cjs');
+
+try { delete require.cache[require.resolve(SCHEMA_PATH)]; } catch (_) {}
+const schema = require(SCHEMA_PATH);
+
+assert.equal(typeof schema, 'object', 'schema module must export an object');
+assert.ok(Array.isArray(schema.EVENT_TYPES), 'schema must export EVENT_TYPES array');
+assert.equal(typeof schema.ALLOWED_FIELDS, 'object', 'schema must export ALLOWED_FIELDS object');
+assert.equal(typeof schema.SCHEMA_VERSION, 'number', 'schema must export numeric SCHEMA_VERSION');
+
+// ---------- Test 1: EVENT_TYPES frozen + exactly 15 entries ----------
+
+(function test1EventTypesFrozen() {
+  const expected = [
+    'mva_pipeline_started',
+    'mva_agent_returned',
+    'mva_brief_rendered',
+    'mva_option_selected',
+    'mva_brief_deployed',
+    'mva_pipeline_failed',
+    'selector_pick',
+    'tension_engagement',
+    'auto_explore_decision',
+    'breakthrough_dismissed',
+    'hooked_axis_score',
+    'empathy_observation',
+    'room_receipt_written',
+    'command_invocation',
+    'nav_bypass',
+  ];
+
+  assert.equal(schema.EVENT_TYPES.length, 15,
+    'EVENT_TYPES must contain exactly 15 entries (6 mva.* + 9 net-new), got ' + schema.EVENT_TYPES.length);
+  assert.equal(Object.isFrozen(schema.EVENT_TYPES), true,
+    'EVENT_TYPES must be Object.freeze\'d');
+
+  for (const name of expected) {
+    assert.ok(schema.EVENT_TYPES.includes(name),
+      'EVENT_TYPES missing required event: ' + name);
+  }
+
+  // SCHEMA_VERSION must be the literal Number 1 (Canon D-10).
+  assert.equal(schema.SCHEMA_VERSION, 1,
+    'SCHEMA_VERSION must be Number 1, got ' + schema.SCHEMA_VERSION + ' (typeof=' + typeof schema.SCHEMA_VERSION + ')');
+
+  console.log('PASS test 1: EVENT_TYPES frozen array of 15 strings + SCHEMA_VERSION === 1');
+})();
+
+// ---------- Test 2: ALLOWED_FIELDS shape ----------
+
+(function test2AllowedFieldsShape() {
+  const keys = Object.keys(schema.ALLOWED_FIELDS);
+
+  // Key parity with EVENT_TYPES.
+  assert.equal(keys.length, schema.EVENT_TYPES.length,
+    'ALLOWED_FIELDS key count must equal EVENT_TYPES length');
+  for (const evt of schema.EVENT_TYPES) {
+    assert.ok(keys.includes(evt),
+      'ALLOWED_FIELDS missing key for event type: ' + evt);
+  }
+
+  // Every value must be a frozen array.
+  for (const evt of schema.EVENT_TYPES) {
+    const allowed = schema.ALLOWED_FIELDS[evt];
+    assert.ok(Array.isArray(allowed),
+      'ALLOWED_FIELDS[' + evt + '] must be an array');
+    assert.equal(Object.isFrozen(allowed), true,
+      'ALLOWED_FIELDS[' + evt + '] must be frozen');
+    assert.ok(allowed.length >= 1,
+      'ALLOWED_FIELDS[' + evt + '] must have at least 1 allowed field');
+  }
+
+  // Spot-check the 9 net-new event types per the plan (D-04 through D-09).
+  assert.ok(schema.ALLOWED_FIELDS.selector_pick.includes('sub_shape'));
+  assert.ok(schema.ALLOWED_FIELDS.selector_pick.includes('ranker_confidence'));
+  assert.ok(schema.ALLOWED_FIELDS.selector_pick.includes('room_slug_sha256'));
+  assert.ok(schema.ALLOWED_FIELDS.tension_engagement.includes('ttr_seconds'));
+  assert.ok(schema.ALLOWED_FIELDS.auto_explore_decision.includes('domain_match_score'));
+  assert.ok(schema.ALLOWED_FIELDS.breakthrough_dismissed.includes('ethics_tier'));
+  assert.ok(schema.ALLOWED_FIELDS.hooked_axis_score.includes('axis_name'));
+  assert.ok(schema.ALLOWED_FIELDS.empathy_observation.includes('engaged_past_15m'));
+  assert.ok(schema.ALLOWED_FIELDS.room_receipt_written.includes('conversation_id_hash'));
+  assert.ok(schema.ALLOWED_FIELDS.command_invocation.includes('command'));
+  assert.ok(schema.ALLOWED_FIELDS.nav_bypass.includes('caller_hash'));
+
+  // 6 inherited mva.* event types (must mirror lib/core/mva-telemetry.cjs ALLOWED_FIELDS).
+  assert.ok(schema.ALLOWED_FIELDS.mva_pipeline_started.includes('sentence_sha256'));
+  assert.ok(schema.ALLOWED_FIELDS.mva_agent_returned.includes('duration_ms'));
+  assert.ok(schema.ALLOWED_FIELDS.mva_brief_rendered.includes('total_duration_ms'));
+  assert.ok(schema.ALLOWED_FIELDS.mva_option_selected.includes('option_id'));
+  assert.ok(schema.ALLOWED_FIELDS.mva_brief_deployed.includes('vercel_subdomain_hash'));
+  assert.ok(schema.ALLOWED_FIELDS.mva_pipeline_failed.includes('error_short'));
+
+  console.log('PASS test 2: ALLOWED_FIELDS shape (15 frozen arrays; mva.* + 9 net-new spot-checks pass)');
+})();
+
+console.log('\nschema.test.cjs: 2/2 tests passed');