@thebassclef/lite 1.1.1 → 1.2.0-alpha.1

package/dist/lite/lib/npm-version-check.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+# tier: lite
+#
+# npm-version-check.sh — detect when installed @thebassclef/lite drifts behind
+# npm-latest. Ships as part of the Fork 2 finding cure — no signal today
+# tells adopters when a newer lite version publishes.
+#
+# Contract: reads .bassclef/init.manifest.json for installed version;
+# reads/writes cache at DRIFT_CACHE_DIR/npm-drift-cache.json (default
+# $HOME/.claude/state); consults cache first (24h TTL); on cache miss
+# runs `npm view @thebassclef/lite version` with 2s timeout; compares
+# installed vs npm-latest via semver; emits banner + exit 1 when
+# installed < npm-latest; silent + exit 0 in every other case
+# (including all failure classes).
+#
+# Never crashes. Every failure returns silent-pass.
+#
+# Anchor luminaries:
+#   @luminary john-ousterhout — deep module (network + cache + semver behind narrow interface)
+#   @luminary michael-nygard  — silent-pass on every failure class; 2s timeout; 24h cache TTL
+#   @luminary alan-cooper     — adopter hears drift once per day, acts on `bassclef sync`
+
+_semver_cmp() {
+  # Compare two semver strings. Prints -1, 0, or 1 for A<B, A=B, A>B.
+  # Handles X.Y.Z form. Non-semver → treat as 0 (equal) — caller stays silent.
+  local a="$1" b="$2"
+  [ "$a" = "$b" ] && echo 0 && return 0
+  local -a pa pb
+  IFS='.' read -r -a pa <<< "$a"
+  IFS='.' read -r -a pb <<< "$b"
+  local i
+  for i in 0 1 2; do
+    local ai="${pa[i]:-0}" bi="${pb[i]:-0}"
+    # Ensure integer
+    [[ "$ai" =~ ^[0-9]+$ ]] || { echo 0; return 0; }
+    [[ "$bi" =~ ^[0-9]+$ ]] || { echo 0; return 0; }
+    if [ "$ai" -lt "$bi" ]; then echo -1; return 0; fi
+    if [ "$ai" -gt "$bi" ]; then echo 1; return 0; fi
+  done
+  echo 0
+}
+
+check_lite_version_drift() {
+  local pkg="@thebassclef/lite"
+  local cache_dir="${DRIFT_CACHE_DIR:-$HOME/.claude/state}"
+  local cache_file="$cache_dir/npm-drift-cache.json"
+  local manifest="${INIT_MANIFEST_OVERRIDE:-.bassclef/init.manifest.json}"
+  local ttl_seconds="${DRIFT_CACHE_TTL_SECONDS:-86400}"
+
+  # Precondition — init manifest present (adopter ran `bassclef init`).
+  [ -f "$manifest" ] || return 0
+
+  # Read installed version.
+  local installed
+  installed=$(jq -r '.version // ""' "$manifest" 2>/dev/null) || installed=""
+  [ -z "$installed" ] && return 0
+
+  # Try cache first.
+  local now npm_latest cache_age
+  now=$(date +%s)
+  npm_latest=""
+  if [ -f "$cache_file" ]; then
+    local cache_ts
+    cache_ts=$(jq -r '.last_checked_at // 0' "$cache_file" 2>/dev/null) || cache_ts=0
+    cache_age=$((now - cache_ts))
+    if [ "$cache_age" -ge 0 ] && [ "$cache_age" -lt "$ttl_seconds" ]; then
+      npm_latest=$(jq -r '.npm_latest // ""' "$cache_file" 2>/dev/null) || npm_latest=""
+    fi
+  fi
+
+  # Cache miss — fetch from npm.
+  if [ -z "$npm_latest" ]; then
+    command -v npm >/dev/null 2>&1 || return 0
+    # 2s timeout; silent on any failure.
+    local fetched
+    if command -v timeout >/dev/null 2>&1; then
+      fetched=$(timeout 2 npm view "$pkg" version 2>/dev/null | tail -n 1)
+    else
+      fetched=$(npm view "$pkg" version 2>/dev/null | tail -n 1)
+    fi
+    # Validate semver shape (X.Y.Z).
+    if ! [[ "$fetched" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+      return 0
+    fi
+    npm_latest="$fetched"
+
+    # Update cache — silent on write failure.
+    if mkdir -p "$cache_dir" 2>/dev/null; then
+      printf '{"last_checked_at": %d, "npm_latest": "%s", "package": "%s"}\n' \
+        "$now" "$npm_latest" "$pkg" > "$cache_file" 2>/dev/null || true
+    fi
+  fi
+
+  # Compare + banner on drift.
+  local cmp
+  cmp=$(_semver_cmp "$installed" "$npm_latest")
+  if [ "$cmp" = "-1" ]; then
+    cat <<BANNER
+### Bassclef lite update available
+Installed: ${installed}  →  npm-latest: ${npm_latest}
+
+Update:
+  npm install -g @thebassclef/lite@latest
+  bassclef sync
+BANNER
+    return 1
+  fi
+
+  return 0
+}
+
+export -f check_lite_version_drift 2>/dev/null || true

package/dist/lite/lib/preview-state.sh

@@ -0,0 +1,229 @@
+#!/usr/bin/env bash
+# tier: lite
+# lib/preview-state.sh — typed accessor for docs/preview-state/<slug>.yml
+#
+# Schema per docs/roadmaps/2026-04-25-doppelganger-fanout.md "Substrate
+# self-awareness — preview-state". Single source of truth for /preview
+# cycle state across sessions. Phase B (/preview composer) consumes this.
+#
+# Public API:
+#   ps_dir                                 → echo path to docs/preview-state/
+#   ps_path <slug>                         → echo full path for a slug
+#   ps_create <slug>                       → initialize new state file with defaults
+#   ps_exists <slug>                       → exit 0 if file exists, 1 if not
+#   ps_get <slug> <field>                  → read scalar field
+#   ps_set <slug> <field> <value>          → set scalar field
+#   ps_status <slug>                       → echo status field
+#   ps_list                                → list all known slugs
+#   ps_archive <slug>                      → mv to archive/ (for /preview reset)
+#
+# Schema (MVP scalar fields supported via ps_get/ps_set):
+#   slug, created, current_tier, status, selected_variant, identity_ref
+#
+# Multi-line / list fields (current_variants, luminaries_used,
+# escalation_history, rejection_history) are appended via dedicated
+# helpers in Phase B WS-4 — out of scope for WS-1 MVP. The schema
+# template file is the source of truth for those.
+
+set -uo pipefail
+
+ps_dir() {
+  if [[ -n "${PREVIEW_STATE_DIR:-}" ]]; then
+    echo "$PREVIEW_STATE_DIR"
+  elif [[ -n "${BASSCLEF_REPO_ROOT:-}" ]]; then
+    echo "$BASSCLEF_REPO_ROOT/docs/preview-state"
+  else
+    echo "docs/preview-state"
+  fi
+}
+
+ps_path() {
+  local slug="$1"
+  echo "$(ps_dir)/${slug}.yml"
+}
+
+ps_exists() {
+  local slug="$1"
+  [[ -f "$(ps_path "$slug")" ]]
+}
+
+ps_create() {
+  local slug="$1"
+  local path
+  path="$(ps_path "$slug")"
+  mkdir -p "$(dirname "$path")"
+  if [[ -f "$path" ]]; then
+    echo "ps_create: already exists: $path" >&2
+    return 1
+  fi
+  cat > "$path" <<EOF
+slug: ${slug}
+created: $(date -u +'%Y-%m-%dT%H:%M:%S+0000')
+current_tier: pending
+status: pending
+selected_variant: null
+current_variants: []
+luminaries_used: []
+identity_ref: null
+escalation_history: []
+rejection_history: []
+EOF
+}
+
+ps_get() {
+  local slug="$1"
+  local field="$2"
+  local path
+  path="$(ps_path "$slug")"
+  [[ -f "$path" ]] || { echo "ps_get: not-found: $path" >&2; return 1; }
+  awk -v f="$field" '
+    $0 ~ "^" f ":" {
+      sub("^" f ":[[:space:]]*", "")
+      print
+      exit
+    }
+  ' "$path"
+}
+
+ps_set() {
+  local slug="$1"
+  local field="$2"
+  shift 2
+  local value="$*"
+  local path
+  path="$(ps_path "$slug")"
+  [[ -f "$path" ]] || { echo "ps_set: not-found: $path" >&2; return 1; }
+  local tmp
+  tmp="$(mktemp)"
+  awk -v f="$field" -v v="$value" '
+    BEGIN { replaced = 0 }
+    !replaced && $0 ~ "^" f ":" {
+      print f ": " v
+      replaced = 1
+      next
+    }
+    { print }
+    END {
+      if (!replaced) {
+        print f ": " v
+      }
+    }
+  ' "$path" > "$tmp"
+  mv "$tmp" "$path"
+}
+
+ps_status() {
+  ps_get "$1" "status"
+}
+
+ps_list() {
+  local dir
+  dir="$(ps_dir)"
+  [[ -d "$dir" ]] || return 0
+  find "$dir" -maxdepth 1 -type f -name '*.yml' 2>/dev/null \
+    | sed -e 's|.*/||' -e 's|\.yml$||' | sort
+}
+
+ps_archive() {
+  local slug="$1"
+  local src dst archive_dir
+  src="$(ps_path "$slug")"
+  [[ -f "$src" ]] || { echo "ps_archive: not-found: $src" >&2; return 1; }
+  archive_dir="$(ps_dir)/archive"
+  mkdir -p "$archive_dir"
+  dst="$archive_dir/${slug}-$(date -u +'%Y%m%dT%H%M%S').yml"
+  mv "$src" "$dst"
+  echo "$dst"
+}
+
+# Reset: archive variants + record rejection rationale + reset to pending.
+# Reads current_variants and current_tier from the YAML, appends a
+# rejection_history entry, archives the variants block, sets status=reset.
+# After reset, status:reset signals next /preview <tier> to read
+# rejection_history as input ("what didn't work").
+#
+# Per standards/preview-state-schema.md "Reset is not erasure".
+ps_reset() {
+  local slug="$1"
+  local reason="${2:-no reason given}"
+  local path
+  path="$(ps_path "$slug")"
+  [[ -f "$path" ]] || { echo "ps_reset: not-found: $path" >&2; return 1; }
+
+  local now
+  now="$(date -u +'%Y-%m-%dT%H:%M:%S+0000')"
+  local current_tier current_variants
+  current_tier="$(ps_get "$slug" current_tier 2>/dev/null || echo "unknown")"
+  # Read current_variants — single-line YAML list e.g. "[a, b, c]"
+  current_variants="$(ps_get "$slug" current_variants 2>/dev/null || echo "[]")"
+
+  # Build rejection_history entry as YAML block in a tempfile
+  # (awk -v doesn't accept multi-line values).
+  local entry_file
+  entry_file="$(mktemp)"
+  cat > "$entry_file" <<EOF
+  - tier_when_rejected: ${current_tier}
+    variants_archived: ${current_variants}
+    rejection_reason: "${reason}"
+    at: ${now}
+EOF
+
+  # Append entry under rejection_history: line. If the line is "[]",
+  # replace with the first entry; if it has the bare line, just append.
+  local tmp
+  tmp="$(mktemp)"
+  awk -v entry_file="$entry_file" '
+    function emit_entry() {
+      while ((getline line < entry_file) > 0) print line
+      close(entry_file)
+    }
+    /^rejection_history:[[:space:]]*\[\][[:space:]]*$/ {
+      print "rejection_history:"
+      emit_entry()
+      next
+    }
+    /^rejection_history:[[:space:]]*$/ {
+      print
+      emit_entry()
+      next
+    }
+    { print }
+  ' "$path" > "$tmp"
+  mv "$tmp" "$path"
+  rm -f "$entry_file"
+
+  # Reset cycle-state fields
+  ps_set "$slug" status "reset"
+  ps_set "$slug" current_tier "pending"
+  ps_set "$slug" selected_variant "null"
+  ps_set "$slug" current_variants "[]"
+}
+
+# Kill: hard-archive the entire state file. Caller (typically /preview kill)
+# is responsible for any --confirm gating. ps_kill is unconditional.
+ps_kill() {
+  local slug="$1"
+  ps_archive "$slug"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  cmd="${1:-}"
+  shift || true
+  case "$cmd" in
+    dir)        ps_dir ;;
+    path)       ps_path "$@" ;;
+    create)     ps_create "$@" ;;
+    exists)     ps_exists "$@" ;;
+    get)        ps_get "$@" ;;
+    set)        ps_set "$@" ;;
+    status)     ps_status "$@" ;;
+    list)       ps_list ;;
+    archive)    ps_archive "$@" ;;
+    reset)      ps_reset "$@" ;;
+    kill)       ps_kill "$@" ;;
+    *)
+      echo "usage: $0 {dir|path|create|exists|get|set|status|list|archive|reset|kill} [args]" >&2
+      exit 2
+      ;;
+  esac
+fi

package/dist/lite/lib/session-rescue.sh

@@ -6,7 +6,6 @@
 # the tracked-only check, soft cap, git-mv preference, banner emission, and
 # silent-fail behavior.
 #
-# tier: upstream
 # install-class: dual
 #
 # Interface (what callers know):

package/dist/lite/scripts/generate-lite-manifest.sh

@@ -20,20 +20,23 @@
 #   scripts/generate-lite-manifest.sh --dry-run          # prints JSON to stdout; no file write
 #   scripts/generate-lite-manifest.sh --output PATH      # writes to specified path (test harness)
 #   scripts/generate-lite-manifest.sh --root PATH        # override repo root (test harness)
+#   scripts/generate-lite-manifest.sh --no-closure-check # skip reachability gate (logged)
 #
 # Exit codes:
 #   0 — manifest written or dry-run printed
 #   1 — invalid arg or missing dependency (jq, git, shasum/sha256sum)
 #   2 — no lite entries found (schema requires minItems: 1)
+#   3 — closure gate: files reachable from manifest entries lack the tier tag (goal 2026-09-16a)
 
 set -euo pipefail
 
-MANIFEST_VERSION="1.6.1"
+MANIFEST_VERSION="1.8.2"
 
 # --- arg parse ---
 DRY_RUN=0
 OUTPUT_PATH=""
 REPO_ROOT_OVERRIDE=""
+NO_CLOSURE_CHECK=0
 TARGET_TIER="lite"  # per #1295 — script now tier-parameterizable; default preserves prior API
 
 while [[ $# -gt 0 ]]; do
@@ -42,6 +45,7 @@ while [[ $# -gt 0 ]]; do
     --output) OUTPUT_PATH="${2:-}"; shift 2 ;;
     --root) REPO_ROOT_OVERRIDE="${2:-}"; shift 2 ;;
     --tier) TARGET_TIER="${2:-}"; shift 2 ;;
+    --no-closure-check) NO_CLOSURE_CHECK=1; shift ;;
     -h|--help)
       grep -E '^# ' "$0" | sed 's/^# \?//'
       exit 0
@@ -117,6 +121,25 @@ extract_hook_tier() {
     || true
 }
 
+# Count tier DECLARATIONS in a bash file header.
+#
+# A declaration is "# tier: <word>" and nothing else on the line. A line like
+# "# tier: upstream because this script audits orphans" explains the tier; it
+# is prose, not a second declaration, and three legitimate files carry one.
+#
+# #1724: apply-lite-widen.sh used to insert a tag above an existing one rather
+# than replacing it, leaving 26 files with two tier lines that disagreed.
+# Every reader takes the first match, so nothing shipped wrong and nothing
+# warned. This is the check that would have caught it. It lives here because
+# the generator already visits every substrate file and runs on every PR via
+# the drift check; the write-time hook fires on the Write tool only, and the
+# widen edits through a shell redirect.
+count_hook_tier_declarations() {
+  head -10 "$1" 2>/dev/null \
+    | grep -cE '^#[[:space:]]*tier:[[:space:]]*[a-z]+[[:space:]]*$' \
+    || true
+}
+
 # Normalize `—` YAML escape to literal em-dash character. Closes
 # bassclef-upstream#1548 — YAML frontmatter with double-quoted strings can
 # carry `—` as a 6-char literal; jq preserves it as `\\u2014` in JSON
@@ -392,6 +415,21 @@ while IFS= read -r f; do
   SCRIPT_FILES+=("$f")
 done < <(find "$REPO_ROOT/scripts" -maxdepth 1 -type f -name '*.sh' 2>/dev/null | sort)
 
+# Hook fragments (bash) — per goal 2026-09-16a (bassclef-upstream#1690): session-reflection.sh
+# iterates session-reflection.d/*.sh at SessionStart; fragments ship as type=hook.
+FRAGMENT_FILES=()
+while IFS= read -r f; do
+  FRAGMENT_FILES+=("$f")
+done < <(find "$REPO_ROOT/.claude/hooks" -mindepth 2 -type f -name '*.sh' \
+           -not -path '*/tests/*' -not -path '*/fixtures/*' 2>/dev/null | sort)
+
+# Top-level .claude/*.md (bassclef-orientation.md) — vendored via @import from adopter
+# CLAUDE.md; ships as root-doc. Per goal 2026-09-16a.
+CLAUDE_DOC_FILES=()
+while IFS= read -r f; do
+  CLAUDE_DOC_FILES+=("$f")
+done < <(find "$REPO_ROOT/.claude" -maxdepth 1 -type f -name '*.md' 2>/dev/null | sort)
+
 # Presence templates (bash + md) — per #1392 Shape 3; adopter install dispatches through these
 PRESENCE_TEMPLATE_SH_FILES=()
 while IFS= read -r f; do
@@ -437,14 +475,70 @@ extract_json_description() {
   echo ""
 }
 
+# ---------------------------------------------------------------------------
+# Tier-declaration uniqueness (#1724)
+#
+# One file, one tier declaration. Every reader takes the first match, so a
+# second line changes nothing at runtime and warns nobody — which is how 26
+# files carried two disagreeing tiers for a day without any check noticing.
+#
+# Runs over tracked .sh files rather than the per-category arrays below, so a
+# new emit surface inherits the check without a second edit.
+#
+# Bypass: SKIP_TIER_DECL_CHECK=1
+# ---------------------------------------------------------------------------
+if [[ "${SKIP_TIER_DECL_CHECK:-}" != "1" ]]; then
+  _dupe_count=0
+  _dupe_report=""
+  while IFS= read -r _f; do
+    [[ -f "$REPO_ROOT/$_f" ]] || continue
+    _n=$(count_hook_tier_declarations "$REPO_ROOT/$_f")
+    if [[ "${_n:-0}" -gt 1 ]]; then
+      _dupe_count=$((_dupe_count + 1))
+      _vals=$(head -10 "$REPO_ROOT/$_f" \
+        | grep -E '^#[[:space:]]*tier:[[:space:]]*[a-z]+[[:space:]]*$' \
+        | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//' | tr '\n' '/')
+      _dupe_report+="  $_f — $_n declarations [$_vals]"$'\n'
+    fi
+  done < <(cd "$REPO_ROOT" && git ls-files '*.sh' 2>/dev/null)
+  if [[ "$_dupe_count" -gt 0 ]]; then
+    {
+      echo ""
+      echo "============================================================"
+      echo "TIER DECLARED MORE THAN ONCE in $_dupe_count file(s)"
+      echo "============================================================"
+      echo ""
+      printf '%s' "$_dupe_report"
+      echo ""
+      echo "----- Cure -----"
+      echo "  Keep the first declaration. Delete the rest."
+      echo "  The first is what every reader already uses, so deleting the"
+      echo "  others changes no behavior."
+      echo ""
+      echo "  If the value itself is wrong, fix it with:"
+      echo "    bash scripts/apply-lite-widen.sh --apply"
+      echo "  which retags from reachability per ADR-056 D7."
+      echo ""
+      echo "  Bypass: SKIP_TIER_DECL_CHECK=1"
+      echo ""
+    } >&2
+    exit 5
+  fi
+fi
+
 ENTRIES_JSON=$(
   {
     emit_entries "skill"     extract_yaml_tier extract_yaml_description dirname  "$REPO_ROOT/.claude/skills/"*/SKILL.md
     emit_entries "rule"      extract_yaml_tier extract_yaml_description basename "$REPO_ROOT/.claude/rules/"*.md
     emit_entries "hook"      extract_hook_tier extract_hook_description basename "$REPO_ROOT/.claude/hooks/"*.sh
+    if [[ ${#FRAGMENT_FILES[@]} -gt 0 ]]; then
+      emit_entries "hook"    extract_hook_tier extract_hook_description basename "${FRAGMENT_FILES[@]}"
+    fi
     emit_entries "luminary"  extract_yaml_tier extract_yaml_description basename "$REPO_ROOT/.claude/luminaries/"*.md
     emit_entries "agent"     extract_yaml_tier extract_yaml_description basename "$REPO_ROOT/.claude/agents/"*.md
-    emit_entries "standard"  extract_yaml_tier extract_yaml_description basename "${STANDARDS_FILES[@]}"
+    if [[ ${#STANDARDS_FILES[@]} -gt 0 ]]; then
+      emit_entries "standard"  extract_yaml_tier extract_yaml_description basename "${STANDARDS_FILES[@]}"
+    fi
     emit_entries "adr"       extract_yaml_tier extract_yaml_description adr      "$REPO_ROOT/architecture/decisions/"ADR-*.md
     if [[ ${#EMBEDDING_FILES[@]} -gt 0 ]]; then
       emit_entries "embedding" extract_json_tier extract_json_description basename "${EMBEDDING_FILES[@]}"
@@ -468,9 +562,23 @@ ENTRIES_JSON=$(
     if [[ ${#ROOT_DOC_FILES[@]} -gt 0 ]]; then
       emit_entries "root-doc" extract_yaml_tier extract_yaml_description basename "${ROOT_DOC_FILES[@]}"
     fi
+    if [[ ${#CLAUDE_DOC_FILES[@]} -gt 0 ]]; then
+      emit_entries "root-doc" extract_yaml_tier extract_yaml_description basename "${CLAUDE_DOC_FILES[@]}"
+    fi
   } | jq -s 'sort_by(.type, .slug)'
 )
 
+# --- spill entries to a file (#1709 sister) ---
+# Linux caps a SINGLE argv entry at MAX_ARG_STRLEN = 131072 bytes; macOS has
+# no per-argument cap. Passing the whole payload as `--argjson entries "$X"`
+# worked at 292 entries (107383 bytes) and died on the runner at 417 entries
+# (159457 bytes) with "jq: Argument list too long". Every jq call that needs
+# the payload now reads this file, so the size stops mattering.
+ENTRIES_TMP=$(mktemp -t bassclef-manifest-entries.XXXXXX)
+trap 'rm -f "$ENTRIES_TMP"' EXIT
+printf '%s' "$ENTRIES_JSON" > "$ENTRIES_TMP"
+
+
 ENTRY_COUNT=$(echo "$ENTRIES_JSON" | jq 'length')
 
 if [[ "$ENTRY_COUNT" -lt 1 ]]; then
@@ -478,6 +586,39 @@ if [[ "$ENTRY_COUNT" -lt 1 ]]; then
   exit 2
 fi
 
+# --- closure gate (goal 2026-09-16a, bassclef-upstream#1690; extends ADR-056 D1) ---
+# Tags stay the source of what ships. Reachability is the validator: every
+# file reachable from a manifest entry (source, glob-source dir, composes_with,
+# settings.json wire, @luminary, path citation, /skill dispatch) must itself be
+# tagged for this tier. Fails loud so the cure is a retag, never a silent drop.
+# Excluded categories (adrs) are bassclef-internal governance: cited by rules
+# as footnotes, not needed at adopter runtime.
+CLOSURE_EXCLUDE_CATEGORIES="${CLOSURE_EXCLUDE_CATEGORIES:-adrs}"
+if [[ "${SKIP_LITE_CLOSURE_CHECK:-0}" == "1" ]]; then
+  echo "SKIP: closure gate bypassed via SKIP_LITE_CLOSURE_CHECK=1" >&2
+elif [[ "$NO_CLOSURE_CHECK" == "1" ]]; then
+  echo "SKIP: closure gate bypassed via --no-closure-check" >&2
+elif ! command -v python3 >/dev/null 2>&1; then
+  echo "SKIP: closure gate needs python3 (not found)" >&2
+else
+  WALKER="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/walk-substrate-graph.py"
+  CANDIDATE_TMP=$(mktemp -t bassclef-manifest-candidate.XXXXXX)
+  jq -n --arg mv "$MANIFEST_VERSION" --slurpfile entries "$ENTRIES_TMP" '{manifest_version:$mv, entries:$entries[0]}' > "$CANDIDATE_TMP"
+  EXCL_ARGS=()
+  IFS=',' read -ra _excl <<< "$CLOSURE_EXCLUDE_CATEGORIES"
+  for c in "${_excl[@]}"; do [[ -n "$c" ]] && EXCL_ARGS+=(--exclude-category "$c"); done
+  CLOSURE_JSON=$(python3 "$WALKER" --root "$REPO_ROOT" --tier "$TARGET_TIER" --closure-vs-manifest "$CANDIDATE_TMP" "${EXCL_ARGS[@]}" 2>/dev/null || echo '{}')
+  rm -f "$CANDIDATE_TMP"
+  WIDEN_N=$(echo "$CLOSURE_JSON" | jq -r '.counts.widen // 0')
+  if [[ "$WIDEN_N" -gt 0 ]]; then
+    echo "generate-${TARGET_TIER}-manifest: CLOSURE GATE — $WIDEN_N file(s) reachable from ${TARGET_TIER} entries but not tagged tier: ${TARGET_TIER}" >&2
+    echo "$CLOSURE_JSON" | jq -r '.widen_by_category | to_entries[] | .key as $c | .value[] | "CLOSURE: \(.path) (category=\($c) tier=\(.tier) reached_from=\(.reached_from))"' >&2
+    echo "Cure: bash scripts/apply-lite-widen.sh --apply   (retags to fixed point, then re-run this generator)" >&2
+    echo "Override (logged): SKIP_LITE_CLOSURE_CHECK=1 or --no-closure-check" >&2
+    exit 3
+  fi
+fi
+
 # --- assemble manifest ---
 # Includes tier root-key per #1295 — the manifest itself carries its own tier tag
 # so tier-tag-required-at-write.sh recognizes it. Per Saltzer-Schroeder complete
@@ -486,8 +627,8 @@ MANIFEST_JSON=$(jq -n \
   --arg tier "$TARGET_TIER" \
   --arg mv "$MANIFEST_VERSION" \
   --arg ga "$GENERATED_AT" \
-  --argjson entries "$ENTRIES_JSON" \
-  '{tier:$tier, manifest_version:$mv, generated_at:$ga, entries:$entries}')
+  --slurpfile entries "$ENTRIES_TMP" \
+  '{tier:$tier, manifest_version:$mv, generated_at:$ga, entries:$entries[0]}')
 
 # Per bassclef-upstream#1508 Cure a: upstream_commit dropped from manifest
 # content. Every rebase over a merged sibling PR guaranteed a conflict

package/dist/lite/scripts/lite-manifest-drift-check.sh

@@ -80,7 +80,11 @@ done
 TMP_CANDIDATE=$(mktemp)
 trap 'rm -f "$TMP_CANDIDATE"' EXIT
 
-bash "${REPO_ROOT}/scripts/generate-lite-manifest.sh" --tier "$TARGET_TIER" --root "$REPO_ROOT" --output "$TMP_CANDIDATE" 2>/dev/null
+# stderr surfaces so the closure gate's CLOSURE: lines reach the operator (goal 2026-09-16a)
+if ! bash "${REPO_ROOT}/scripts/generate-lite-manifest.sh" --tier "$TARGET_TIER" --root "$REPO_ROOT" --output "$TMP_CANDIDATE"; then
+  echo "${TARGET_TIER}-manifest drift check: generator failed (see lines above)" >&2
+  exit 1
+fi
 
 # Compare entries[] arrays (sorted; ignoring generated_at + upstream_commit)
 COMMITTED_ENTRIES=$(jq -S '.entries' "$MANIFEST_FILE")