@tekyzinc/gsd-t 5.7.10 → 5.9.10

package/bin/gsd-t-install-check.cjs

@@ -0,0 +1,342 @@
+#!/usr/bin/env node
+/**
+ * gsd-t-install-check.cjs
+ *
+ * M108 — Install self-check and repair.
+ *
+ * [RULE] install-check-repairs-then-continues-never-routes-around
+ * [RULE] install-check-records-every-repair
+ * [RULE] install-check-halts-when-it-cannot-repair
+ *
+ * A project's `bin/` is supposed to hold every tool the installer ships. When
+ * one is missing, the tools that need it break — and until now nothing noticed.
+ * Binvoice ran for weeks with 21 of 38 tools.
+ *
+ * This is NOT a fallback. A fallback continues PAST a failure with a worse
+ * answer. This FIXES the failure — it copies the missing file from the
+ * installed package — and then the work continues with everything present. If
+ * it cannot fix it, it HALTS and says so; it never lets the work proceed on a
+ * broken install.
+ *
+ * Every repair is written to a shared log so a pattern across projects becomes
+ * visible: if the same tool keeps going missing everywhere, the installer
+ * itself is what needs fixing.
+ *
+ * ─── Usage ──────────────────────────────────────────────────────────────────
+ *   node gsd-t-install-check.cjs --project <dir>            # check + repair
+ *   node gsd-t-install-check.cjs --project <dir> --check    # report only
+ *   node gsd-t-install-check.cjs --report                   # read the shared log
+ *
+ * ─── Exit codes ─────────────────────────────────────────────────────────────
+ *   0  install is complete (possibly after a repair)
+ *   4  something is missing and could not be repaired — HALT
+ *   64 bad input
+ *
+ * Zero dependencies.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+const EXIT_OK = 0;
+const EXIT_UNREPAIRABLE = 4;
+const EXIT_BAD_INPUT = 64;
+
+const LOG_PATH = path.join(os.homedir(), ".claude", "gsd-t-install-repairs.jsonl");
+
+/**
+ * Where the installed package lives — the source every repair copies from.
+ *
+ * Two places, asked in order, because they answer DIFFERENT questions: "am I
+ * running from inside the package?" and "where does npm keep global installs?".
+ * That is not hunting for a file; it is two distinct facts about this machine.
+ *
+ * Throws with what went wrong. It never returns nothing as if that were an
+ * ordinary answer — without the package there is nothing to repair from, and
+ * the caller must stop.
+ */
+function findPackageRoot() {
+  const problems = [];
+
+  // 1. Running from inside the package itself.
+  const here = path.resolve(__dirname, "..");
+  const herePkg = path.join(here, "package.json");
+  if (fs.existsSync(herePkg)) {
+    let pkg;
+    try {
+      pkg = JSON.parse(fs.readFileSync(herePkg, "utf8"));
+    } catch (e) {
+      problems.push(`${herePkg} could not be read: ${e.message}`);
+    }
+    if (pkg && pkg.name === "@tekyzinc/gsd-t") return here;
+  }
+
+  // 2. Ask npm where global installs live.
+  let root;
+  try {
+    root = execFileSync("npm", ["root", "-g"], { encoding: "utf8", timeout: 10000 }).trim();
+  } catch (e) {
+    problems.push(`npm could not be asked where global packages live: ${e.message}`);
+  }
+  if (root) {
+    const p = path.join(root, "@tekyzinc", "gsd-t");
+    if (fs.existsSync(path.join(p, "package.json"))) return p;
+    problems.push(`GSD-T is not installed at ${p}`);
+  }
+
+  throw new Error(
+    "The installed GSD-T package could not be located, so nothing can be checked " +
+    "or repaired.\n  " + problems.join("\n  ")
+  );
+}
+
+/** The list of tools every project is supposed to have. Read from the installer. */
+function expectedTools(pkgRoot) {
+  const installer = path.join(pkgRoot, "bin", "gsd-t.js");
+  const src = fs.readFileSync(installer, "utf8");
+  const m = src.match(/const PROJECT_BIN_TOOLS = \[([^]*?)\n\];/);
+  if (!m) throw new Error(`could not read the tool list from ${installer}`);
+  return [...m[1].matchAll(/"([^"]+)"/g)].map((x) => x[1]);
+}
+
+function packageVersion(pkgRoot) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(pkgRoot, "package.json"), "utf8")).version || "unknown";
+  } catch (_) {
+    return "unknown";
+  }
+}
+
+/**
+ * Compare a project's bin/ against the expected list.
+ * Returns { missing, stale, present } — stale means the file exists but its
+ * content differs from the package's copy.
+ */
+function inspect(projectDir, pkgRoot, tools) {
+  const binDir = path.join(projectDir, "bin");
+  const missing = [];
+  const stale = [];
+  let present = 0;
+
+  for (const tool of tools) {
+    const src = path.join(pkgRoot, "bin", tool);
+    const dest = path.join(binDir, tool);
+    if (!fs.existsSync(src)) {
+      // The package itself is missing a tool it promises. That is an installer
+      // defect, not a project one — recorded separately, never skipped quietly.
+      missing.push({ tool, reason: "absent from the installed package" });
+      continue;
+    }
+    if (!fs.existsSync(dest)) {
+      missing.push({ tool, reason: "absent from the project" });
+      continue;
+    }
+    try {
+      if (fs.readFileSync(src, "utf8") !== fs.readFileSync(dest, "utf8")) {
+        stale.push({ tool, reason: "differs from the installed package" });
+      } else {
+        present++;
+      }
+    } catch (e) {
+      missing.push({ tool, reason: `could not be compared: ${e.message}` });
+    }
+  }
+  return { missing, stale, present };
+}
+
+/** Copy one tool from the package into the project. Throws if it cannot. */
+function repairOne(projectDir, pkgRoot, tool) {
+  const src = path.join(pkgRoot, "bin", tool);
+  const dest = path.join(projectDir, "bin", tool);
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.copyFileSync(src, dest);
+  try { fs.chmodSync(dest, 0o755); } catch (_) { /* permissions are advisory here */ }
+  if (!fs.existsSync(dest)) throw new Error(`copy reported success but ${dest} is not there`);
+}
+
+/** Append a record of what was repaired, so a cross-project pattern is visible. */
+function recordRepair(entry) {
+  try {
+    fs.mkdirSync(path.dirname(LOG_PATH), { recursive: true });
+    fs.appendFileSync(LOG_PATH, JSON.stringify(entry) + "\n");
+    return true;
+  } catch (e) {
+    // The log could not be written. Say so out loud — a repair nobody can see
+    // is how this problem stayed invisible for weeks in the first place.
+    process.stderr.write(`[gsd-t] could not record the repair in ${LOG_PATH}: ${e.message}\n`);
+    return false;
+  }
+}
+
+/** Read the shared log and summarise which tools keep going missing. */
+function readLog() {
+  if (!fs.existsSync(LOG_PATH)) return { entries: [], byTool: {}, byProject: {} };
+  const entries = [];
+  for (const line of fs.readFileSync(LOG_PATH, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try { entries.push(JSON.parse(line)); } catch (_) { /* one bad line does not hide the rest */ }
+  }
+  const byTool = {};
+  const byProject = {};
+  for (const e of entries) {
+    for (const t of e.repaired || []) byTool[t] = (byTool[t] || 0) + 1;
+    byProject[e.project] = (byProject[e.project] || 0) + 1;
+  }
+  return { entries, byTool, byProject };
+}
+
+/**
+ * Which tools have gone missing in MORE THAN ONE project? That points at the
+ * installer, not at any single project.
+ */
+function installerSuspects(byTool, entries) {
+  const projectsPerTool = {};
+  for (const e of entries) {
+    for (const t of e.repaired || []) {
+      (projectsPerTool[t] = projectsPerTool[t] || new Set()).add(e.project);
+    }
+  }
+  return Object.entries(projectsPerTool)
+    .filter(([, set]) => set.size > 1)
+    .map(([tool, set]) => ({ tool, projects: [...set] }))
+    .sort((a, b) => b.projects.length - a.projects.length);
+}
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--check") args.checkOnly = true;
+    else if (a === "--report") args.report = true;
+    else if (a === "--json") args.json = true;
+    else if (a === "--project") args.project = argv[++i];
+  }
+  return args;
+}
+
+function main() {
+  const args = parseArgs(process.argv);
+
+  if (args.report) {
+    const { entries, byTool, byProject } = readLog();
+    const suspects = installerSuspects(byTool, entries);
+    const out = { ok: true, exitCode: EXIT_OK, repairs: entries.length, byTool, byProject, installerSuspects: suspects };
+    if (args.json) process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+    else if (!entries.length) process.stdout.write("No installs have needed repair.\n");
+    else {
+      process.stdout.write(`${entries.length} repair(s) recorded.\n\n`);
+      for (const [p, n] of Object.entries(byProject)) process.stdout.write(`  ${p}: ${n}\n`);
+      if (suspects.length) {
+        process.stdout.write("\nThese tools went missing in more than one project — the installer is the likely cause:\n");
+        for (const s of suspects) process.stdout.write(`  ${s.tool} (${s.projects.length} projects)\n`);
+      }
+    }
+    process.exit(EXIT_OK);
+  }
+
+  const projectDir = path.resolve(args.project || process.cwd());
+  if (!fs.existsSync(path.join(projectDir, ".gsd-t"))) {
+    // Not a GSD-T project. Nothing to check — this is "not applicable", which
+    // is a different thing from "checked and fine".
+    process.exit(EXIT_OK);
+  }
+
+  let pkgRoot;
+  try {
+    pkgRoot = findPackageRoot();
+  } catch (e) {
+    if (args.json) process.stdout.write(JSON.stringify({ ok: false, exitCode: EXIT_UNREPAIRABLE, halt: e.message }, null, 2) + "\n");
+    else process.stderr.write(`[gsd-t] ${e.message}\n`);
+    process.exit(EXIT_UNREPAIRABLE);
+  }
+
+  let tools;
+  try {
+    tools = expectedTools(pkgRoot);
+  } catch (e) {
+    const msg = `Cannot read the list of tools a project should have: ${e.message}`;
+    if (args.json) process.stdout.write(JSON.stringify({ ok: false, exitCode: EXIT_UNREPAIRABLE, halt: msg }, null, 2) + "\n");
+    else process.stderr.write(`[gsd-t] ${msg}\n`);
+    process.exit(EXIT_UNREPAIRABLE);
+  }
+
+  const found = inspect(projectDir, pkgRoot, tools);
+  const needsWork = [...found.missing, ...found.stale];
+
+  if (!needsWork.length) {
+    const out = { ok: true, exitCode: EXIT_OK, expected: tools.length, present: found.present, repaired: [] };
+    if (args.json) process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+    process.exit(EXIT_OK);
+  }
+
+  if (args.checkOnly) {
+    const out = {
+      ok: false, exitCode: EXIT_UNREPAIRABLE, expected: tools.length,
+      present: found.present, missing: found.missing, stale: found.stale,
+    };
+    if (args.json) process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+    else process.stdout.write(`${needsWork.length} of ${tools.length} tools need attention in ${projectDir}\n`);
+    process.exit(EXIT_UNREPAIRABLE);
+  }
+
+  // Repair.
+  const repaired = [];
+  const unrepairable = [];
+  for (const item of needsWork) {
+    if (item.reason === "absent from the installed package") {
+      unrepairable.push(item);
+      continue;
+    }
+    try {
+      repairOne(projectDir, pkgRoot, item.tool);
+      repaired.push(item.tool);
+    } catch (e) {
+      unrepairable.push({ tool: item.tool, reason: e.message });
+    }
+  }
+
+  const projectName = path.basename(projectDir);
+  if (repaired.length) {
+    recordRepair({
+      at: new Date().toISOString(),
+      project: projectName,
+      projectDir,
+      packageVersion: packageVersion(pkgRoot),
+      expected: tools.length,
+      wasPresent: found.present,
+      repaired,
+      unrepairable: unrepairable.map((u) => u.tool),
+    });
+  }
+
+  const out = {
+    ok: unrepairable.length === 0,
+    exitCode: unrepairable.length === 0 ? EXIT_OK : EXIT_UNREPAIRABLE,
+    project: projectName,
+    expected: tools.length,
+    repaired,
+    unrepairable,
+  };
+
+  if (args.json) {
+    process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+  } else {
+    if (repaired.length) {
+      process.stdout.write(`[gsd-t] Repaired this project's install: restored ${repaired.length} missing tool(s).\n`);
+    }
+    if (unrepairable.length) {
+      process.stdout.write(`[gsd-t] ${unrepairable.length} tool(s) could NOT be restored:\n`);
+      for (const u of unrepairable) process.stdout.write(`   ${u.tool} — ${u.reason}\n`);
+      process.stdout.write(`Work should not continue on a broken install. Reinstall GSD-T.\n`);
+    }
+  }
+  process.exit(out.exitCode);
+}
+
+if (require.main === module) main();
+
+module.exports = { inspect, expectedTools, findPackageRoot, readLog, installerSuspects, LOG_PATH };

package/bin/gsd-t-verify-gate.cjs

@@ -311,6 +311,8 @@ function _detectDefaultTrack2(projectDir, notes) {
 
   plan.push({ id: 'schema-id', cmd: 'node', args: [path.join(__dirname, 'gsd-t-schema-id-check.cjs'), '--project', projectDir], timeoutMs: 30000 }); // integer-identity PK on every NEW relational table, FAIL-CLOSED (no-op PASS when no new schema files)
 
+  plan.push({ id: 'fallbacks', cmd: 'node', args: [path.join(__dirname, 'gsd-t-fallback-detect.cjs'), '--scan', '--project', projectDir, '--json'], timeoutMs: 120000 }); // M106: no unapproved continue-after-failure branch, FAIL-CLOSED (pre-existing ones excluded via .gsd-t/fallbacks-baseline.json)
+
   // secrets — gitleaks (PATH detection deferred to runtime)
   if (_hasOnPath('gitleaks')) {
     plan.push({

package/bin/gsd-t.js

@@ -505,6 +505,31 @@ const WORKTREE_HOOK_MARKER = "gsd-t-worktree-guard";
 const WORKTREE_HOOK_COMMAND =
   'bash -c \'[ -f "$(npm root -g)/@tekyzinc/gsd-t/scripts/gsd-t-worktree-guard.js" ] && node "$(npm root -g)/@tekyzinc/gsd-t/scripts/gsd-t-worktree-guard.js" || true\'';
 
+// ─── M106 Fallback guard (PreToolUse Write|Edit) ────────────────────────────
+// Denies a write that introduces a fallback the user never approved. NO `|| true`
+// here, unlike the worktree guard: if this script is missing, the shell must fail
+// loudly rather than let unchecked writes through. Swallowing its absence is the
+// exact pattern the guard exists to stop.
+const FALLBACK_HOOK_MARKER = "gsd-t-fallback-guard";
+const FALLBACK_HOOK_COMMAND =
+  'node "$(npm root -g)/@tekyzinc/gsd-t/scripts/gsd-t-fallback-guard.js"';
+
+// ─── M108 Install self-heal (SessionStart) ──────────────────────────────────
+// Checks the project's tools before any work starts, restores what is missing,
+// and reports what it could not fix. Not a fallback — it repairs the failure
+// and then the session runs correctly, rather than routing around it.
+const INSTALL_HEAL_MARKER = "gsd-t-install-heal";
+const INSTALL_HEAL_COMMAND =
+  'bash -c \'[ -f "$(npm root -g)/@tekyzinc/gsd-t/scripts/gsd-t-install-heal.js" ] && node "$(npm root -g)/@tekyzinc/gsd-t/scripts/gsd-t-install-heal.js" || true\'';
+
+// ─── M107 Concise hook (Stop) ───────────────────────────────────────────────
+// Sends a long reply to a fresh Claude for a shorter rewrite. Fail-open by
+// design (`|| true`): it governs how a reply READS, never whether it is true,
+// so a broken rewriter must never gag a correct answer.
+const CONCISE_HOOK_MARKER = "gsd-t-concise-hook";
+const CONCISE_HOOK_COMMAND =
+  'bash -c \'[ -f "$(npm root -g)/@tekyzinc/gsd-t/scripts/gsd-t-concise-hook.js" ] && node "$(npm root -g)/@tekyzinc/gsd-t/scripts/gsd-t-concise-hook.js" || true\'';
+
 // Append entries to {projectDir}/.gitignore. Each entry added only if absent.
 // Idempotent. Returns true if any entries were added, false otherwise.
 function ensureGitignoreEntries(projectDir, entries) {
@@ -963,6 +988,76 @@ function configureWorktreeGuardHook(settingsPath) {
   return configureWriteEditHook(settingsPath, WORKTREE_HOOK_MARKER, WORKTREE_HOOK_COMMAND, "worktree guard");
 }
 
+// M106 — register the fallback guard on Write|Edit. Same registrar again.
+function configureFallbackGuardHook(settingsPath) {
+  return configureWriteEditHook(settingsPath, FALLBACK_HOOK_MARKER, FALLBACK_HOOK_COMMAND, "fallback guard");
+}
+
+// M107 — register the concise rewriter on Stop. Not a Write|Edit hook, so it
+// uses the Stop registrar below rather than configureWriteEditHook.
+function configureConciseHook(settingsPath) {
+  return configureStopHook(settingsPath, CONCISE_HOOK_MARKER, CONCISE_HOOK_COMMAND, "concise rewrite");
+}
+
+// M108 — register the install self-heal on SessionStart, so a broken install is
+// repaired before any work begins.
+function configureInstallHealHook(settingsPath) {
+  return configureEventHook(settingsPath, "SessionStart", INSTALL_HEAL_MARKER, INSTALL_HEAL_COMMAND, "install self-heal");
+}
+
+// Register a Stop hook by marker. Mirrors configureWriteEditHook exactly, on the
+// Stop event instead of PreToolUse.
+function configureStopHook(settingsPath, marker, command, label) {
+  return configureEventHook(settingsPath, "Stop", marker, command, label);
+}
+
+// Register a hook on any event by marker. One registrar for every event, so a
+// new hook needs no new copy of this logic.
+function configureEventHook(settingsPath, event, marker, command, label) {
+  const targetPath = settingsPath || SETTINGS_JSON;
+  let settings = {};
+  if (fs.existsSync(targetPath)) {
+    try {
+      settings = JSON.parse(fs.readFileSync(targetPath, "utf8"));
+      if (!settings || typeof settings !== "object") settings = {};
+    } catch {
+      warn(`settings.json has invalid JSON — cannot configure ${label} hook`);
+      return { installed: false, action: "noop" };
+    }
+  }
+  if (!settings.hooks) settings.hooks = {};
+  if (!Array.isArray(settings.hooks[event])) settings.hooks[event] = [];
+
+  let action = "noop";
+  let found = false;
+  for (const entry of settings.hooks[event]) {
+    if (!entry || !Array.isArray(entry.hooks)) continue;
+    for (const h of entry.hooks) {
+      if (h && typeof h.command === "string" && h.command.includes(marker)) {
+        found = true;
+        if (h.command !== command) { h.command = command; action = "refreshed"; }
+      }
+    }
+  }
+  if (!found) {
+    // The install check goes FIRST on SessionStart, so a broken install is
+    // repaired before anything else tries to use the missing tools.
+    const entry = { matcher: "", hooks: [{ type: "command", command }] };
+    if (event === "SessionStart") settings.hooks[event].unshift(entry);
+    else settings.hooks[event].push(entry);
+    action = "added";
+  }
+  if (action === "noop") return { installed: true, action };
+
+  try {
+    fs.writeFileSync(targetPath, JSON.stringify(settings, null, 2));
+  } catch (e) {
+    warn(`Failed to write settings.json: ${e.message}`);
+    return { installed: false, action: "noop" };
+  }
+  return { installed: true, action };
+}
+
 function configureWriteEditHook(settingsPath, marker, command, label) {
   const targetPath = settingsPath || SETTINGS_JSON;
   let settings = {};
@@ -1533,10 +1628,16 @@ const UTILITY_SCRIPTS = ["gsd-t-tools.js", "gsd-t-statusline.js", "gsd-t-event-w
 
 function installUtilityScripts() {
   ensureDir(SCRIPTS_DIR);
+  const notDelivered = [];
   for (const script of UTILITY_SCRIPTS) {
     const src = path.join(PKG_SCRIPTS, script);
     const dest = path.join(SCRIPTS_DIR, script);
-    if (!fs.existsSync(src)) continue;
+    if (!fs.existsSync(src)) {
+      // Promised but absent from the package. Reported, never skipped quietly —
+      // the same silence let projects run for weeks on a half install.
+      notDelivered.push(script);
+      continue;
+    }
     const srcContent = fs.readFileSync(src, "utf8");
     const destContent = fs.existsSync(dest) ? fs.readFileSync(dest, "utf8") : "";
     if (normalizeEol(srcContent) !== normalizeEol(destContent)) {
@@ -1545,6 +1646,11 @@ function installUtilityScripts() {
       info(`${script} unchanged`);
     }
   }
+  if (notDelivered.length) {
+    warn(`${notDelivered.length} script(s) are named by the installer but absent from the package:`);
+    for (const s of notDelivered) warn(`    ${s}`);
+    warn(`  Anything depending on these will fail. This is a packaging defect.`);
+  }
 }
 
 // ─── Global Bin Tools (~/.claude/bin/) ───────────────────────────────────────
@@ -1591,6 +1697,18 @@ const GLOBAL_BIN_TOOLS = [
   // caller but absent from BOTH lists is dead in every project
   // ([[project_global_bin_propagation_gap]], 4 prior occurrences).
   "gsd-t-pseudocode-style.cjs",
+  // M106 — Fallback detector. scripts/gsd-t-fallback-guard.js (a PreToolUse hook)
+  // shells out to this by absolute path; if it is missing the guard DENIES the
+  // write rather than allowing it unchecked, so an omission here breaks every
+  // Write/Edit rather than failing silently. Also in PROJECT_BIN_TOOLS below.
+  "gsd-t-fallback-detect.cjs",
+  // M107 — Concise rewriter. scripts/gsd-t-concise-hook.js (a Stop hook) shells
+  // out to this; absent, the hook allows the long reply through (fail-open by
+  // design — it governs readability, never truth).
+  "gsd-t-concise-rewrite.cjs",
+  // M108 — Install self-check, run by the SessionStart hook and by
+  // `gsd-t install-check`.
+  "gsd-t-install-check.cjs",
 ];
 
 function installGlobalBinTools() {
@@ -1838,10 +1956,14 @@ const SHARED_TEMPLATES = [
 function installSharedTemplates() {
   ensureDir(CLAUDE_TEMPLATES_DIR);
   let installed = 0, skipped = 0;
+  const notDelivered = [];
   for (const file of SHARED_TEMPLATES) {
     const src = path.join(PKG_TEMPLATES, file);
     const dest = path.join(CLAUDE_TEMPLATES_DIR, file);
-    if (!fs.existsSync(src)) continue;
+    if (!fs.existsSync(src)) {
+      notDelivered.push(file); // promised but absent — reported, never silent
+      continue;
+    }
     if (fs.existsSync(dest) &&
         normalizeEol(fs.readFileSync(src, "utf8")) === normalizeEol(fs.readFileSync(dest, "utf8"))) {
       skipped++;
@@ -1852,6 +1974,10 @@ function installSharedTemplates() {
   }
   if (skipped > 0) info(`${skipped} templates unchanged`);
   success(`${installed + skipped} shared templates → ~/.claude/templates/`);
+  if (notDelivered.length) {
+    warn(`${notDelivered.length} template(s) are named by the installer but absent from the package:`);
+    for (const f of notDelivered) warn(`    ${f}`);
+  }
 }
 
 function installCommands(isUpdate) {
@@ -2035,6 +2161,27 @@ async function doInstall(opts = {}) {
     else info("Worktree-collision guard already configured");
   }
 
+  const fbHook = configureFallbackGuardHook(SETTINGS_JSON);
+  if (fbHook.installed) {
+    if (fbHook.action === "added") success("Fallback guard added (denies a write that adds an unapproved fallback — M106)");
+    else if (fbHook.action === "refreshed") success("Fallback guard refreshed");
+    else info("Fallback guard already configured");
+  }
+
+  const ccHook = configureConciseHook(SETTINGS_JSON);
+  if (ccHook.installed) {
+    if (ccHook.action === "added") success("Concise-rewrite hook added (shortens a long reply before you read it — M107)");
+    else if (ccHook.action === "refreshed") success("Concise-rewrite hook refreshed");
+    else info("Concise-rewrite hook already configured");
+  }
+
+  const healHook = configureInstallHealHook(SETTINGS_JSON);
+  if (healHook.installed) {
+    if (healHook.action === "added") success("Install self-heal added (restores missing tools before work starts — M108)");
+    else if (healHook.action === "refreshed") success("Install self-heal refreshed");
+    else info("Install self-heal already configured");
+  }
+
   heading("Graph Engine (CGC)");
   installCgc();
 
@@ -2993,6 +3140,16 @@ const PROJECT_BIN_TOOLS = [
   "gsd-t-model-tier-policy.cjs",
   // M86 — Model-profile config + resolver CLI (standard/pro/premium tier-spend switch).
   "gsd-t-model-profile.cjs",
+  // M106 — Fallback detector. The PreToolUse guard prefers the project-local
+  // copy; the verify gate dispatches to it by absolute path. Missing here means
+  // every Write/Edit is DENIED (the guard halts rather than allowing unchecked),
+  // so this entry is load-bearing — [[project_global_bin_propagation_gap]].
+  "gsd-t-fallback-detect.cjs",
+  // M107 — Concise rewriter, invoked by the Stop hook.
+  "gsd-t-concise-rewrite.cjs",
+  // M108 — Install self-check. Every project carries its own copy so it can
+  // verify and repair itself even when the global install is what broke.
+  "gsd-t-install-check.cjs",
   // M89 — Auto-research gate classifier (classify a guessed claim as internal vs external;
   // propagated to each registered project's bin/ so the workflow runCli fallback resolves
   // downstream — per [[project_global_bin_propagation_gap]]).
@@ -3157,10 +3314,20 @@ function copyBinToolsToProject(projectDir, projectName) {
     }
   }
   let copied = 0;
+  // Tools this pass could NOT deliver. Every one is reported. A silent skip
+  // here is how binvoice ran for weeks with 20 of 38 tools while every update
+  // reported success — the missing files were never counted, so nothing looked
+  // wrong. ([[project_global_bin_propagation_gap]], now 5 occurrences.)
+  const notDelivered = [];
   for (const tool of PROJECT_BIN_TOOLS) {
     const src = path.join(PKG_ROOT, "bin", tool);
     const dest = path.join(projectBinDir, tool);
-    if (!fs.existsSync(src)) continue;
+    if (!fs.existsSync(src)) {
+      // The package promises a tool it does not contain. That is a packaging
+      // defect and it affects EVERY project — it must never pass unremarked.
+      notDelivered.push({ tool, why: "absent from the package being installed" });
+      continue;
+    }
     let needsCopy = true;
     if (fs.existsSync(dest)) {
       try {
@@ -3168,7 +3335,7 @@ function copyBinToolsToProject(projectDir, projectName) {
         const destContent = fs.readFileSync(dest, "utf8");
         if (srcContent === destContent) needsCopy = false;
       } catch {
-        // fall through, will copy
+        // could not compare — copy, which is the safe direction
       }
     }
     if (needsCopy) {
@@ -3177,10 +3344,17 @@ function copyBinToolsToProject(projectDir, projectName) {
         try { fs.chmodSync(dest, 0o755); } catch {}
         copied++;
       } catch (e) {
-        warn(`${projectName} — failed to copy ${tool}: ${e.message}`);
+        notDelivered.push({ tool, why: e.message });
       }
     }
   }
+  if (notDelivered.length) {
+    warn(`${projectName} — ${notDelivered.length} of ${PROJECT_BIN_TOOLS.length} tools were NOT delivered:`);
+    for (const n of notDelivered) warn(`    ${n.tool} — ${n.why}`);
+    warn(`  This project's install is incomplete. Tools that depend on the missing`);
+    warn(`  files will fail. Run 'gsd-t install-check --project ${projectDir}' after`);
+    warn(`  fixing the package.`);
+  }
   let cleaned = 0;
   if (!_isGsdTSourcePackage(projectDir)) {
     for (const stray of DEPRECATED_BIN_STRAYS) {
@@ -5369,6 +5543,20 @@ if (require.main === module) {
       });
       process.exit(res.status == null ? 1 : res.status);
     }
+    case "install-check": {
+      // M108 — check this project's tools against the installed package, and
+      // restore anything missing. `--check` reports without changing anything;
+      // `--report` reads the shared log of every repair across all projects.
+      const { spawnSync } = require("child_process");
+      const js = path.join(__dirname, "gsd-t-install-check.cjs");
+      if (!require("node:fs").existsSync(js)) {
+        error(`gsd-t-install-check.cjs not found at ${js} — reinstall GSD-T`);
+        process.exit(1);
+      }
+      const res = spawnSync(process.execPath, [js, ...args.slice(1)], { stdio: "inherit" });
+      process.exit(res.status == null ? 1 : res.status);
+    }
+
     case "pseudocode-style": {
       // Contract v1.2.0 §1.1 — `gsd-t pseudocode-style (--doc <f> | --dir <d>)` thin
       // dispatcher to the PseudoCode flow-line STYLE gate. Sibling of `guard-map`: