create-claude-cabinet 0.45.0 → 0.47.0

package/lib/settings-merge.js

@@ -8,7 +8,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/git-guardrails.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/git-guardrails.sh',
         },
       ],
     },
@@ -17,7 +17,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/work-tracker-guard.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/work-tracker-guard.sh',
         },
       ],
     },
@@ -26,7 +26,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/cc-upstream-guard.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/cc-upstream-guard.sh',
         },
       ],
     },
@@ -35,7 +35,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/action-quality-gate.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/action-quality-gate.sh',
         },
       ],
     },
@@ -44,7 +44,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/action-completion-gate.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/action-completion-gate.sh',
         },
       ],
     },
@@ -55,7 +55,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/skill-telemetry.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/skill-telemetry.sh',
         },
       ],
     },
@@ -66,7 +66,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/skill-tool-telemetry.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/skill-tool-telemetry.sh',
         },
       ],
     },
@@ -75,7 +75,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/memory-index-guard.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/memory-index-guard.sh',
         },
       ],
     },
@@ -133,7 +133,7 @@ const BASH_COMPRESS_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/bash-output-compress.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/bash-output-compress.sh',
         },
       ],
     },
@@ -156,6 +156,38 @@ const LEGACY_HOOK_COMMANDS = [
   'domain-memories.sh',
 ];
 
+// CC-owned hook commands ship with a `$CLAUDE_PROJECT_DIR/` prefix so they
+// resolve regardless of the hook's working directory. Older installs wrote them
+// bare-relative (`.claude/hooks/X.sh`), which break ("No such file or
+// directory") whenever a hook fires from a non-root cwd. bareForm() derives that
+// legacy spelling so a reinstall can REPLACE it (drop old, add prefixed) rather
+// than leave a broken duplicate.
+function bareForm(command) {
+  return (command || '').replace(/^\$CLAUDE_PROJECT_DIR\//, '');
+}
+
+// Every CC-owned hook command in a hook set, in its current spelling.
+function ccHookCommands(hookSet) {
+  return Object.values(hookSet)
+    .flatMap(entries => entries.flatMap(e => (e.hooks || []).map(h => h.command)));
+}
+
+// Remove every sub-hook whose command exactly matches one of `commands`, and
+// prune entries left empty. Exact-match on CC-owned command strings only — a
+// consumer's own hooks (different paths) are never touched.
+function dropHookCommands(settings, commands) {
+  const drop = new Set(commands.filter(Boolean));
+  for (const [event, entries] of Object.entries(settings.hooks || {})) {
+    if (!Array.isArray(entries)) continue;
+    settings.hooks[event] = entries
+      .map(entry => (entry.hooks && Array.isArray(entry.hooks))
+        ? { ...entry, hooks: entry.hooks.filter(h => !drop.has(h.command)) }
+        : entry)
+      .filter(entry => !entry.hooks || !Array.isArray(entry.hooks) || entry.hooks.length > 0);
+    if (settings.hooks[event].length === 0) delete settings.hooks[event];
+  }
+}
+
 /**
  * Merge PIB hooks into the project's .claude/settings.json.
  * Creates the file if it doesn't exist. Preserves existing hooks.
@@ -199,6 +231,13 @@ function mergeSettings(projectDir, { includeDb = true } = {}) {
     if (!settings.hooks[event]) continue;
   }
 
+  // Retire superseded bare-relative CC hooks so the $CLAUDE_PROJECT_DIR-prefixed
+  // forms below REPLACE them rather than duplicate. A bare `.claude/hooks/X.sh`
+  // only resolves when the hook runs from the project root; it errors ("No such
+  // file or directory") from any other cwd. Exact-match drop on CC-owned
+  // commands — consumer-authored hooks are left intact.
+  dropHookCommands(settings, ccHookCommands(DEFAULT_HOOKS).map(bareForm));
+
   // Merge each hook event type from DEFAULT_HOOKS
   for (const [event, newHooks] of Object.entries(DEFAULT_HOOKS)) {
     if (!settings.hooks[event]) {
@@ -254,7 +293,7 @@ function healUserSettings() {
     const filtered = entries.filter(entry => {
       if (!entry.hooks || !Array.isArray(entry.hooks)) return true;
       const hasRelativeCcHook = entry.hooks.some(h =>
-        /^\.claude\/hooks\//.test(h.command || '')
+        /^(\$CLAUDE_PROJECT_DIR\/)?\.claude\/hooks\//.test(h.command || '')
       );
       if (hasRelativeCcHook) removed++;
       return !hasRelativeCcHook;
@@ -338,6 +377,9 @@ function mergeBashCompressHooks(settingsPath) {
   const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
   if (!settings.hooks) settings.hooks = {};
 
+  // Replace any superseded bare-relative form with the prefixed one (see mergeSettings).
+  dropHookCommands(settings, ccHookCommands(BASH_COMPRESS_HOOKS).map(bareForm));
+
   for (const [event, newHooks] of Object.entries(BASH_COMPRESS_HOOKS)) {
     if (!settings.hooks[event]) {
       settings.hooks[event] = newHooks;

package/lib/watchtower-setup.js

@@ -0,0 +1,230 @@
+/**
+ * watchtower-setup.js — keep the GLOBAL watchtower runtime fresh on reinstall.
+ *
+ * The watchtower module copies its files into the PROJECT (the normal module
+ * copy in lib/cli.js). But the GLOBAL runtime at ~/.claude-cabinet/watchtower/
+ * is only ever set up by the manual `/watchtower install` SKILL.md one-time
+ * step. So `npx create-claude-cabinet` (reinstall) refreshed the project files
+ * but NOT the global runtime scripts/docs/hooks — they went stale, and a
+ * brand-new runtime script (e.g. watchtower-advisories.mjs) never appeared
+ * until a hand-copy.
+ *
+ * This installer mirrors lib/mux-setup.js's content-aware refresh: a global
+ * SHA256 manifest at ~/.claude-cabinet/global-manifest.json records each
+ * dest's last-written hash, and only changed-or-new files are copied. Reusing
+ * mux's manifest is safe — entries are keyed by absolute dest path, so the
+ * watchtower dests (~/.claude-cabinet/watchtower/...) never collide with mux's
+ * (~/.config/mux/..., ~/.local/bin/...).
+ *
+ * REFRESH-ONLY semantics (critical): if the runtime directory does NOT already
+ * exist, this returns immediately with status 'absent' and writes nothing.
+ * Fresh runtime setup — launchd plist / cron, config.json, migrate-keys, the
+ * coherence assertion — is the `/watchtower install` SKILL.md step's job and is
+ * NOT replicated here. This function only keeps the code/docs/hooks of an
+ * EXISTING runtime current.
+ *
+ * The .mjs script set is globbed from templates/scripts/watchtower-*.mjs at
+ * load time (single source of truth — a newly shipped runtime script is picked
+ * up automatically; that "new file appears" case was the watchtower-advisories
+ * failure). The shell runners, session hooks, and cabinet docs are mapped
+ * explicitly since they live in different template subtrees and land in
+ * different runtime subdirs.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const crypto = require('crypto');
+
+const CC_HOME = path.join(os.homedir(), '.claude-cabinet');
+const GLOBAL_MANIFEST_PATH = path.join(CC_HOME, 'global-manifest.json');
+const RUNTIME_DIR = path.join(CC_HOME, 'watchtower');
+const RUNTIME_SCRIPTS_DIR = path.join(RUNTIME_DIR, 'scripts');
+const RUNTIME_HOOKS_DIR = path.join(RUNTIME_DIR, 'hooks');
+const RUNTIME_CABINET_DIR = path.join(RUNTIME_DIR, 'cabinet');
+const TEMPLATE_DIR = path.resolve(__dirname, '..', 'templates');
+
+/**
+ * Build the MANAGED_FILES list: { src (absolute), dest (absolute), mode? }.
+ *
+ *   - ALL templates/scripts/watchtower-*.mjs       → runtime scripts/
+ *   - the watchtower shell runners under scripts/   → runtime scripts/ (0o755)
+ *   - templates/hooks/watchtower-session-*.sh       → runtime hooks/   (0o755)
+ *   - the two cabinet docs                          → runtime cabinet/
+ *
+ * Globbing the .mjs set keeps it the single source of truth — no hand-picked
+ * subset that can drift as new runtime scripts ship.
+ */
+function buildManagedFiles() {
+  const files = [];
+  const scriptsDir = path.join(TEMPLATE_DIR, 'scripts');
+
+  // All watchtower runtime .mjs scripts (globbed — complete set, no drift).
+  if (fs.existsSync(scriptsDir)) {
+    for (const name of fs.readdirSync(scriptsDir)) {
+      if (/^watchtower-.*\.mjs$/.test(name)) {
+        files.push({
+          src: path.join(scriptsDir, name),
+          dest: path.join(RUNTIME_SCRIPTS_DIR, name),
+        });
+      }
+    }
+  }
+
+  // Shell runners the runtime executes (cron/launchd target these). They live
+  // in templates/scripts/ and land beside the .mjs in the runtime scripts/ dir.
+  const shellRunners = [
+    'watchtower-ring1-runner.sh',
+    'watchtower-ring2-runner.sh',
+    'watchtower-ring4-runner.sh',
+    'watchtower-status.sh',
+  ];
+  for (const name of shellRunners) {
+    files.push({
+      src: path.join(scriptsDir, name),
+      dest: path.join(RUNTIME_SCRIPTS_DIR, name),
+      mode: 0o755,
+    });
+  }
+
+  // Session hooks → runtime hooks/.
+  const hooksDir = path.join(TEMPLATE_DIR, 'hooks');
+  for (const name of ['watchtower-session-start.sh', 'watchtower-session-end.sh']) {
+    files.push({
+      src: path.join(hooksDir, name),
+      dest: path.join(RUNTIME_HOOKS_DIR, name),
+      mode: 0o755,
+    });
+  }
+
+  // Cabinet docs the runtime / advisory pass reads → runtime cabinet/.
+  const cabinetDir = path.join(TEMPLATE_DIR, 'cabinet');
+  for (const name of ['advisories-state-schema.md', 'watchtower-contracts.md']) {
+    files.push({
+      src: path.join(cabinetDir, name),
+      dest: path.join(RUNTIME_CABINET_DIR, name),
+    });
+  }
+
+  return files;
+}
+
+const MANAGED_FILES = buildManagedFiles();
+
+function sha256(content) {
+  return crypto.createHash('sha256').update(content).digest('hex');
+}
+
+function readGlobalManifest() {
+  if (!fs.existsSync(GLOBAL_MANIFEST_PATH)) return { files: {} };
+  try {
+    const m = JSON.parse(fs.readFileSync(GLOBAL_MANIFEST_PATH, 'utf8'));
+    // Guard shape drift: manifest.files is indexed unconditionally below.
+    if (typeof m !== 'object' || m === null || Array.isArray(m)) return { files: {} };
+    if (typeof m.files !== 'object' || m.files === null || Array.isArray(m.files)) m.files = {};
+    return m;
+  } catch {
+    return { files: {} };
+  }
+}
+
+function writeGlobalManifest(manifest) {
+  fs.mkdirSync(path.dirname(GLOBAL_MANIFEST_PATH), { recursive: true });
+  const tmp = GLOBAL_MANIFEST_PATH + '.tmp';
+  fs.writeFileSync(tmp, JSON.stringify(manifest, null, 2));
+  fs.renameSync(tmp, GLOBAL_MANIFEST_PATH);
+}
+
+/**
+ * Refresh the code/docs/hooks of an EXISTING watchtower runtime, content-aware.
+ *
+ * @param {Object} opts
+ * @param {boolean} [opts.dryRun]
+ * @param {string[]} [opts.results] — human-readable lines are pushed here; a
+ *   fresh array is created and returned when not supplied.
+ * @returns {{ results: string[], status: 'absent'|'unchanged'|'refreshed' }}
+ */
+function refreshWatchtowerRuntime(opts = {}) {
+  const dryRun = !!opts.dryRun;
+  const results = opts.results || [];
+
+  // Refresh-only: never bootstrap a fresh runtime here. Fresh setup (launchd,
+  // cron, config.json, migrate-keys, coherence assertion) is the
+  // `/watchtower install` SKILL.md step's job. No runtime dir ⇒ no-op.
+  if (!fs.existsSync(RUNTIME_DIR)) {
+    return { results, status: 'absent' };
+  }
+
+  results.push('Refreshing watchtower runtime (content-aware)');
+
+  const manifest = readGlobalManifest();
+  let copiedCount = 0;
+
+  for (const file of MANAGED_FILES) {
+    if (!fs.existsSync(file.src)) {
+      results.push(`  ⚠ Template missing: ${file.src}`);
+      continue;
+    }
+
+    const content = fs.readFileSync(file.src);
+    const hash = sha256(content);
+
+    // Content-aware skip: compare the template hash to the runtime file's
+    // ACTUAL on-disk bytes, NOT the cached manifest. The manifest can lie — a
+    // hand-edited or externally-replaced runtime file still carries the hash
+    // the manifest recorded at last write, so a manifest-only check would skip
+    // it and leave the divergence running. Reading the real file makes the
+    // refresh self-healing: any runtime file that differs from the template
+    // (or is missing) is rewritten, so a reinstall reliably reconverges the
+    // runtime onto the template instead of silently leaving it stale.
+    let runtimeHash = null;
+    if (fs.existsSync(file.dest)) {
+      try {
+        runtimeHash = sha256(fs.readFileSync(file.dest));
+      } catch {
+        runtimeHash = null; // unreadable runtime file → treat as divergent
+      }
+    }
+
+    if (runtimeHash === hash) {
+      // Already in sync on disk. Keep the manifest honest as bookkeeping.
+      if (!dryRun) manifest.files[file.dest] = hash;
+      continue;
+    }
+
+    if (dryRun) {
+      results.push(`  [dry-run] ${path.relative(TEMPLATE_DIR, file.src)} → ${file.dest}`);
+    } else {
+      fs.mkdirSync(path.dirname(file.dest), { recursive: true });
+      fs.writeFileSync(file.dest, content);
+      if (file.mode) {
+        fs.chmodSync(file.dest, file.mode);
+      }
+      manifest.files[file.dest] = hash;
+    }
+    copiedCount++;
+  }
+
+  if (!dryRun && copiedCount > 0) {
+    manifest.installedAt = new Date().toISOString();
+    writeGlobalManifest(manifest);
+  }
+
+  if (copiedCount > 0) {
+    results.push(`  ${copiedCount} runtime file${copiedCount !== 1 ? 's' : ''} refreshed under ${RUNTIME_DIR}`);
+    return { results, status: 'refreshed' };
+  }
+
+  results.push('  watchtower runtime already current');
+  return { results, status: 'unchanged' };
+}
+
+// MANAGED_FILES, RUNTIME_DIR, and TEMPLATE_DIR are exported for the
+// runtime-refresh test so it can seed a faithful, complete global manifest
+// (single source of truth — the test never re-derives the file list).
+module.exports = {
+  refreshWatchtowerRuntime,
+  MANAGED_FILES,
+  RUNTIME_DIR,
+  TEMPLATE_DIR,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-claude-cabinet",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "description": "Claude Cabinet — opinionated process scaffolding for Claude Code projects",
   "bin": {
     "create-claude-cabinet": "bin/create-claude-cabinet.js"
@@ -22,6 +22,10 @@
   ],
   "author": "Oren Magid",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/orenmagid/claude-cabinet.git"
+  },
   "engines": {
     "node": ">=18"
   },

package/templates/cabinet/_cabinet-member-template.md

@@ -27,7 +27,10 @@ briefing:
   # Common: .claude/cabinet/_briefing-architecture.md, _briefing-jurisdictions.md, _briefing-api.md
 standing-mandate: audit
   # Add plan, execute, orient, debrief if this member should activate
-  # in those contexts. Most members are audit-only.
+  # in those contexts. Most members are audit-only. Two session-boundary
+  # contexts exist for standing advisors (watchtower installs):
+  # session-close (Ring 3's automatic transcript-fed advisor pass) and
+  # briefing (/briefing's live advisor panel).
 tools:
   # List every external tool/command this member uses.
   # Format: "tool-name (scope -- what it does)"
@@ -37,8 +40,10 @@ tools:
   #   - grep patterns (all projects -- dead code detection)
   # Use "tools: []" for pure-reasoning members with no tool stage.
 directives:
-  # Only if standing-mandate includes plan, execute, orient, or debrief.
-  # Each directive is a one-sentence focused task for that context.
+  # Only if standing-mandate includes plan, execute, orient, debrief,
+  # session-close, or briefing. Each directive is a one-sentence focused
+  # task for that context. A mandate without a matching directive is a
+  # data error — consumers skip the member and say so.
   # plan: >
   #   What to evaluate when reviewing a plan.
   # execute: >

package/templates/cabinet/advisories-state-schema.md

@@ -1,12 +1,18 @@
 # Advisory dismissal state — schema and rules
 
-Orient surfaces stack-aware advisories (install the Ruby language server, register the Railway MCP, install `hookify`, …). Without memory, every advisory re-nags every session — the same attention-fatigue pattern the watchtower rings were built to eliminate. This file defines the per-project state that gives advisories a memory, and the exact rules orient follows so an advisory is never *permanently* silenced by accident.
+The watchtower **SessionStart context builder** surfaces stack-aware advisories (install the Ruby language server, register the Railway MCP, install `hookify`, …) via `scripts/watchtower-advisories.mjs` (act:f9ea075d). Without memory, every advisory re-nags every session — the same attention-fatigue pattern the watchtower rings were built to eliminate. This file defines the per-project state that gives advisories a memory, and the exact rules the advisory pass follows so an advisory is never *permanently* silenced by accident.
+
+> **Actor.** The owner of these rules is `watchtower-advisories.mjs` (`runAdvisoryPass`), called by the context builder when watchtower is installed. On a project WITHOUT watchtower, orient runs a thin one-shot fallback (it may shell the same module via `node scripts/watchtower-advisories.mjs` when present, else surface basic install hints with no persistent dismissal state). The module is the single implementation of the rules below; do not re-encode them anywhere else.
 
 ## Where it lives
 
-`.claude/cabinet/advisories-state.json` — **per project, generated at runtime**, NOT shipped as a template. Orient creates it on first write. It must never be added to a module's template array: a shipped stub would overwrite a project's real dismissal history on reinstall (the `.ccrc.json` clobber class of bug). If the file is absent, every advisory is treated as never-seen.
+`.claude/cabinet/advisories-state.json` — **per project, generated at runtime**, NOT shipped as a template. The advisory pass creates it on first write. It must never be added to a module's template array: a shipped stub would overwrite a project's real dismissal history on reinstall (the `.ccrc.json` clobber class of bug). If the file is absent OR malformed JSON, every advisory is treated as never-seen (the reader degrades to `{}`, never throws).
+
+> Worktree note: `.claude/cabinet/` is copied per worktree, so dismissal state can diverge between a worktree and its main checkout. That is acceptable — advisories are advisory — and is the reason this is project-local, not user-global. **Path-consistency rule:** the pass reads AND writes the state at the SAME path (the session's `--project-path` cwd). Never read from one path and write to another, or a decline recorded in one place is invisible from the other and the advisory re-nags forever.
+
+## Reserved `_meta` key
 
-> Worktree note: `.claude/cabinet/` is copied per worktree, so dismissal state can diverge between a worktree and its main checkout. That is acceptable — advisories are advisory — and is the reason this is project-local, not user-global.
+`_meta` is a **reserved top-level key**, NOT an advisory entry. It holds pass-level bookkeeping — currently `{ "last_probe": "<UTC YYYY-MM-DD>" }`, the throttle stamp for the `claude plugin list` install-probe (run at most once/day/checkout; UTC to match `last_shown` and sqlite `date('now')`). Any consumer iterating advisory entries (e.g. `Object.entries(state)`) MUST skip `_meta`. No advisory id may be named `_meta`.
 
 ## Schema
 
@@ -30,9 +36,26 @@ Orient surfaces stack-aware advisories (install the Ruby language server, regist
 - **`last_shown`** — ISO date of the most recent surfacing.
 - **`signal`** — *the key field that makes "resurface if the stack changed" actually work.* A short, deterministic fingerprint of the stack indicators present when the advisory was last shown/declined. For a multi-indicator advisory like Ruby (`Gemfile` OR `*.rb`), the fingerprint records *which* indicators were present (e.g. `gemfile` vs `gemfile+rb`), so a later change is detectable. Without this stored snapshot, orient has only the *current* indicators and no baseline to diff against — which is the gap this schema closes.
 
-## The rules orient follows
+## Computing the signal (the indicator fingerprint)
+
+A signal is a deterministic fingerprint of the stack indicators present now. Two rules keep it stable:
+
+- **Sorted tokens.** A multi-indicator advisory joins its present indicators (e.g. Ruby = `gemfile`, `rb`, or `gemfile+rb`) **after sorting** them. Readdir order is not stable; without the sort, `gemfile+rb` and `rb+gemfile` would alternate and spuriously re-arm a declined advisory every session.
+- **Bounded stack scan.** Source-file indicators (`*.ts`, `*.py`, `*.rb`) are detected by a **depth-limited (≤3) walk** with a denylist (`node_modules`, `dist`, `build`, `vendor`, `coverage`, `target`, `out`, plus all dot-dirs) and **early-exit on first match** (existence only). A recursive walk would be pathological on the session-start critical path; a root-only scan would silently miss the common `src/**/*.ts` layout (a TS project with no root `tsconfig.json`).
+
+## The probe is tri-state (the fourth input state)
 
-Before surfacing any advisory, orient computes the advisory's **current signal** (fingerprint of the indicators present now) and reads the stored entry:
+The install-probe (`claude plugin list`) answers "is this plugin installed?" — but it can fail to answer (claude not on PATH, nonzero exit, timeout). Its result is therefore **`true | false | null`**, never a boolean. `null` ("unknown") is a distinct input state and is handled per advisory **kind**:
+
+- **probe-suppressed** (the LSP advisories): the signal is on disk (stack files); the probe only *suppresses* (confirms installed → terminal). `installed===null` → **still surface** from the signal/state rules; freeze only the `installed` transition.
+- **probe-gated** (`plugin:hookify`): the surfacing predicate *is* the probe ("hookify not installed"). `installed===null` → predicate unknowable → **suppress this session, do NOT increment count, do NOT write state** (freeze the entry untouched).
+- **no-probe** (`mcp:railway`, `briefing-file`, `registry-orphan`): pure filesystem/config signal; the probe is irrelevant.
+
+In all kinds, `installed===true` flips the entry to terminal `installed`.
+
+## The rules the advisory pass follows
+
+Before surfacing any advisory, the pass computes the advisory's **current signal** (fingerprint of the indicators present now) and reads the stored entry:
 
 1. **No entry / file absent** → surface it. Write `{status:"suggested", count:1, last_shown:today, signal:current}`.
 2. **`installed`** → never surface (terminal). (Re-probe may flip a `suggested`/`declined` entry to `installed`; never the reverse automatically.)
@@ -64,5 +87,9 @@ Document any new advisory's signal source here when you add it, and call out exp
 | `lsp:rust` | `Cargo.toml` | `/plugin install rust-analyzer-lsp` |
 | `lsp:go` | `go.mod` | `/plugin install gopls-lsp` |
 | `lsp:ruby` | `Gemfile` or `*.rb` | `/plugin install ruby-lsp@claude-plugins-official` (also needs `gem install ruby-lsp` AND `ENABLE_LSP_TOOL=1`) |
-| `mcp:railway` | `railway.toml` and no railway key in `~/.claude.json` | local: `railway setup agent -y` · remote: register `mcp.railway.com` (OAuth) |
-| `plugin:hookify` | `.claude/rules/enforcement-pipeline.md` exists and hookify not in `claude plugin list` (signal is **static**) | `/plugin install hookify` |
+| `mcp:railway` | `railway.toml` and no railway key in `~/.claude.json` (no-probe) | local: `railway setup agent -y` · remote: register `mcp.railway.com` (OAuth) |
+| `plugin:hookify` | `.claude/rules/enforcement-pipeline.md` exists and hookify not in `claude plugin list` (signal is **static**; probe-gated) | `/plugin install hookify` |
+| `briefing-file` | `.claude/cabinet/_briefing.md` is **absent** (canonical location — where cabinet members read; `.claude/briefing/` holds only installer-seeded templates) (signal `missing`, **static**; no-probe) | run `/onboard` to create one |
+| `registry-orphan` | `~/.claude/cc-registry.json` lists project path(s) that no longer exist (signal = sorted orphan-name set, so it re-arms when the registry changes; no-probe) | remove the dead entr(y/ies) from `~/.claude/cc-registry.json` |
+
+> Note: `mcp:railway` keys on `railway.toml`, which Ring 1 also marker-checks for deploy detection — these are independent reads of the same file for different purposes; do not consolidate them (the advisory adds the `~/.claude.json` registration predicate Ring 1 lacks).

package/templates/cabinet/checklist-stats-schema.md

@@ -19,9 +19,23 @@ state.
 | Writer | When | What |
 |--------|------|------|
 | `/execute` `post-impl-checklist` phase | every run past its no-op guard | increments `runs`; per triggered dimension increments `fires`, sets `last_fired` |
-| `/debrief` `checklist-feedback` phase | when a session bug WAS caught via a surfaced check | appends to that dimension's `catches` |
+| Ring 3 close `checklist-catch` lens (Phase 2p) | session close, when the transcript shows a surfaced check that caught a real bug | appends to that dimension's `catches` |
+| `/debrief` `checklist-feedback` phase (pre-watchtower; retiring) | when a session bug WAS caught via a surfaced check | appends to that dimension's `catches` |
 | `/audit` `checklist-pruning` phase | every pruning verdict (including "keep") | appends to `pruning_reviews` |
 
+The **catch side is recorded automatically at session close** by the
+Ring 3 `checklist-catch` lens (`watchtower-ring3-close.mjs`, Phase 2p)
+for watchtower-installed projects — it reads the transcript, attributes
+catches to a named dimension, and writes them via the protocol below.
+`/debrief`'s `checklist-feedback` phase did this interactively and is
+retired by the watchtower burn-in (its sharpening side — proposing new
+checks for bugs that *slipped through* — needs operator approval and
+cannot move to a background ring; only the catch tally moved). The two
+writers are mutually exclusive in practice: a watchtower project closes
+through Ring 3, a non-watchtower project through debrief, and both
+follow the same atomic, fail-open write protocol — so the catches a
+later audit prunes against are recorded the same way regardless.
+
 ## Schema (`schema_version: 1`)
 
 ```json

package/templates/cabinet/composition-patterns.md

@@ -107,9 +107,10 @@ to do its own work. One cabinet member consults another mid-evaluation.
 needs full conversation history) references another cabinet member's known
 findings — from memory, from audit history, or from prior session output.
 
-**Example:** During debrief, a historian cabinet member is activated to check:
-"Has this kind of change been done before? What happened? Are there
-lessons from prior sessions relevant to what was just completed?"
+**Example:** At session close (Ring 3's advisor pass), the historian is
+activated to check: "Has this kind of change been done before? What
+happened? Are there lessons from prior sessions relevant to what was
+just completed?"
 
 **Example:** During planning, the organized-mind cabinet member might need
 the historian's input: "Has this kind of information architecture been