create-claude-cabinet 0.52.0 → 0.53.0

package/templates/scripts/__tests__/routine-dispatch.test.mjs

@@ -241,7 +241,35 @@ test('pending item blocks refiring; stale pending item is superseded and redispa
   assert.equal(second.fired.length, 1);
   assert.notEqual(second.fired[0].item_id, firstId);
   assert.equal(q.getItem(firstId).status, 'superseded');
-  assert.match(q.getItem(firstId).resolution_notes, /newer firing/);
+  // PRECEDENCE (act:ea23b3a5): for a time-of-day routine the moment sweep runs
+  // at the top of the tick and reaches the stale item first, so it — not the
+  // next-firing path — is what supersedes. The stale_after_hours path still
+  // owns interval / path-nonempty / session-close triggers, which have no
+  // moment. Same outcome (superseded, refiled), different and more honest
+  // reason: the item died because its day ended, not because a newer firing
+  // happened to come along.
+  assert.match(q.getItem(firstId).resolution_notes, /moment window passed/);
+  q.resolveItem(second.fired[0].item_id, { resolution: 'ran', resolution_type: 'acted-on' });
+});
+
+test('the stale-after-hours supersede still owns INTERVAL routines (no moment to expire)', () => {
+  const rt = routine({ name: 'interval-digest', trigger: { type: 'interval', minutes: 60 } });
+  const t1 = at('2026-06-20T07:00:00');
+  const first = r.runRoutinePass({ config: configWith([rt]), event: tick, filedBy: 'ring1', now: t1 });
+  assert.equal(first.fired.length, 1);
+  const firstId = first.fired[0].item_id;
+
+  const t2 = at('2026-06-22T07:00:00');
+  const fp = join(root, 'queue', 'items', `${firstId}.json`);
+  const pendingItem = JSON.parse(readFileSync(fp, 'utf8'));
+  pendingItem.filed_at = new Date(t2.getTime() - 25 * 3_600_000).toISOString();
+  writeFileSync(fp, JSON.stringify(pendingItem, null, 2));
+
+  const second = r.runRoutinePass({ config: configWith([rt]), event: tick, filedBy: 'ring1', now: t2 });
+  assert.equal(second.fired.length, 1);
+  assert.equal(q.getItem(firstId).status, 'superseded');
+  assert.match(q.getItem(firstId).resolution_notes, /newer firing/,
+    'an interval routine has no moment — the unchanged stale path supersedes it');
   q.resolveItem(second.fired[0].item_id, { resolution: 'ran', resolution_type: 'acted-on' });
 });
 

package/templates/scripts/__tests__/routine-moment-expiry.test.mjs

@@ -0,0 +1,192 @@
+// Routine moment expiry (act:ea23b3a5).
+//
+// A time-of-day routine only self-superseded at its NEXT firing — 24 hours
+// later for a daily one — so a morning briefing nobody ran held a queue slot
+// and a lit desk badge all day. Six such firings were dismissed in the
+// 2026-07-26 triage.
+//
+// The window is END OF THE FILING DAY, and that is a measured choice. Across
+// six weeks the portfolio's one time-of-day routine (flow/morning-briefing at
+// 08:00) had ten real pickups: eight inside four hours and two after, at 4.4h
+// and 8.6h. A four-hour window would have destroyed two genuine pickups to
+// clear one stale item — negative expected value. End-of-day preserves all ten.
+//
+// Hermetic: every queue dependency is injected.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const root = mkdtempSync(join(tmpdir(), 'routine-moment-'));
+process.env.WATCHTOWER_DIR = root;
+mkdirSync(join(root, 'queue', 'items'), { recursive: true });
+process.env.WATCHTOWER_MUX_BIN = join(root, 'no-such-mux');
+
+const r = await import('../watchtower-routines.mjs');
+
+test.after(() => rmSync(root, { recursive: true, force: true }));
+
+function item(id, triggerType, filed_at, extra = {}) {
+  return {
+    id, status: 'pending', category: 'routine', project: 'p', filed_at,
+    evidence: { routine_key: `p/${id}`, trigger: { type: triggerType } },
+    ...extra,
+  };
+}
+
+function harness(items) {
+  const superseded = [];
+  return {
+    superseded,
+    deps: {
+      listPending: () => items,
+      supersedeItem: (id, { reason }) => { superseded.push({ id, reason }); return { id }; },
+    },
+  };
+}
+
+const at = (s) => new Date(s);
+
+// ---------------------------------------------------------------------------
+// The window
+// ---------------------------------------------------------------------------
+
+test('a time-of-day item filed YESTERDAY is swept', () => {
+  const h = harness([item('dec-a', 'time-of-day', '2026-07-25T08:00:00')]);
+  const out = r.sweepExpiredMoments({ now: at('2026-07-26T09:00:00'), deps: h.deps });
+  assert.deepEqual(out.swept, ['dec-a']);
+  assert.match(h.superseded[0].reason, /moment window passed/);
+  assert.match(h.superseded[0].reason, /2026-07-25/);
+});
+
+test('the SAME day is never swept, however late — 4.4h and 8.6h pickups are real', () => {
+  const filed = '2026-07-26T08:00:00';
+  for (const hour of ['12:24', '16:36', '23:00', '23:59']) {
+    const h = harness([item('dec-b', 'time-of-day', filed)]);
+    const out = r.sweepExpiredMoments({ now: at(`2026-07-26T${hour}:00`), deps: h.deps });
+    assert.deepEqual(out.swept, [], `${hour} is still the routine's own day`);
+  }
+});
+
+test('one minute past midnight sweeps it', () => {
+  const h = harness([item('dec-c', 'time-of-day', '2026-07-26T08:00:00')]);
+  const out = r.sweepExpiredMoments({ now: at('2026-07-27T00:01:00'), deps: h.deps });
+  assert.deepEqual(out.swept, ['dec-c']);
+});
+
+test('a 23:30 routine gets its full day — the window needs no midnight special case', () => {
+  // The window is derived from the item's filing DAY, not from clock arithmetic
+  // on the declared time, so a late-evening routine cannot wrap.
+  const h = harness([item('dec-d', 'time-of-day', '2026-07-26T23:30:00')]);
+  assert.deepEqual(
+    r.sweepExpiredMoments({ now: at('2026-07-26T23:45:00'), deps: h.deps }).swept, []);
+  assert.deepEqual(
+    r.sweepExpiredMoments({ now: at('2026-07-27T00:05:00'), deps: h.deps }).swept, ['dec-d']);
+});
+
+// ---------------------------------------------------------------------------
+// Scope
+// ---------------------------------------------------------------------------
+
+test('interval, path-nonempty, and session-close routines are never swept', () => {
+  const old = '2026-07-01T08:00:00';
+  for (const type of ['interval', 'path-nonempty', 'session-close']) {
+    const h = harness([item('dec-x', type, old)]);
+    assert.deepEqual(
+      r.sweepExpiredMoments({ now: at('2026-07-26T09:00:00'), deps: h.deps }).swept, [],
+      `${type} has no moment — stale_after_hours still owns it`);
+  }
+});
+
+test('an item with no persisted trigger is left alone', () => {
+  const h = harness([{ id: 'dec-y', status: 'pending', category: 'routine', filed_at: '2026-07-01T08:00:00', evidence: {} }]);
+  assert.deepEqual(r.sweepExpiredMoments({ now: at('2026-07-26T09:00:00'), deps: h.deps }).swept, []);
+});
+
+test('the trigger is read from the ITEM, so a de-registered routine still classifies', () => {
+  // dispatchRoutine persists evidence.trigger at filing. A config lookup would
+  // find nothing for a routine the operator has since removed and leave the
+  // item pending forever.
+  const h = harness([item('dec-z', 'time-of-day', '2026-07-20T08:00:00')]);
+  const out = r.sweepExpiredMoments({ now: at('2026-07-26T09:00:00'), deps: h.deps });
+  assert.deepEqual(out.swept, ['dec-z'], 'no config was consulted at all');
+});
+
+// ---------------------------------------------------------------------------
+// Failure direction
+// ---------------------------------------------------------------------------
+
+test('an unparseable filed_at abstains loudly instead of sweeping', () => {
+  const h = harness([item('dec-bad', 'time-of-day', 'not-a-date')]);
+  const out = r.sweepExpiredMoments({ now: at('2026-07-26T09:00:00'), deps: h.deps });
+  assert.deepEqual(out.swept, []);
+  assert.equal(out.skipped, 1);
+  assert.equal(h.superseded.length, 0,
+    'the existing stale path treats the same input as stale — one mechanism abstaining loudly beats two disagreeing silently');
+});
+
+test('a throwing supersede does not abort the rest of the sweep', () => {
+  const items = [
+    item('dec-1', 'time-of-day', '2026-07-20T08:00:00'),
+    item('dec-2', 'time-of-day', '2026-07-20T08:00:00'),
+  ];
+  let calls = 0;
+  const out = r.sweepExpiredMoments({
+    now: at('2026-07-26T09:00:00'),
+    deps: {
+      listPending: () => items,
+      supersedeItem: (id) => { calls++; if (id === 'dec-1') throw new Error('locked'); return { id }; },
+    },
+  });
+  assert.equal(calls, 2);
+  assert.deepEqual(out.swept, ['dec-2']);
+});
+
+test('a throwing listPending returns an empty sweep rather than propagating', () => {
+  const out = r.sweepExpiredMoments({
+    now: at('2026-07-26T09:00:00'),
+    deps: { listPending: () => { throw new Error('queue unreadable'); } },
+  });
+  assert.deepEqual(out, { swept: [], skipped: 0 });
+});
+
+test('endOfFilingDay returns null for garbage and a day-end for a real date', () => {
+  assert.equal(r.endOfFilingDay('nonsense'), null);
+  assert.equal(r.endOfFilingDay(undefined), null);
+  const d = r.endOfFilingDay('2026-07-26T08:00:00');
+  assert.equal(d.getHours(), 23);
+  assert.equal(d.getMinutes(), 59);
+});
+
+// ---------------------------------------------------------------------------
+// Pass scoping — the blast-radius rule
+// ---------------------------------------------------------------------------
+
+test('a session-close event sweeps NOTHING; only Ring 1 ticks sweep', () => {
+  // runRoutinePass is called by Ring 3 with a single-project session-close
+  // event. An unscoped sweep there would have every session close in any
+  // project superseding every OTHER project's routine items — and during a
+  // --reprocess-failed drain, one portfolio sweep per replayed session.
+  const stale = [item('dec-other-project', 'time-of-day', '2026-07-01T08:00:00')];
+  const h = harness(stale);
+  r.runRoutinePass({
+    config: { projects: {} },
+    event: { type: 'session-close', project: 'someone-else' },
+    filedBy: 'ring3-close',
+    now: at('2026-07-26T09:00:00'),
+    deps: h.deps,
+  });
+  assert.deepEqual(h.superseded, []);
+
+  const h2 = harness(stale);
+  r.runRoutinePass({
+    config: { projects: {} },
+    event: { type: 'tick' },
+    filedBy: 'ring1',
+    now: at('2026-07-26T09:00:00'),
+    deps: h2.deps,
+  });
+  assert.deepEqual(h2.superseded.map((s) => s.id), ['dec-other-project']);
+});

package/templates/scripts/skill-validator.sh

@@ -72,9 +72,9 @@ field_value() {
   printf '%s\n' "$fm" | awk -v f="$field" '
     $0 ~ "^" f ":" {
       sub("^" f ": *", "")
-      # If the value is a block scalar indicator, return empty so the
-      # caller falls through to field_block_scalar.
-      if ($0 == ">" || $0 == "|" || $0 == ">-" || $0 == "|-") { print ""; exit }
+      # If the value is a block scalar indicator (any of > | >- |- >+ |+),
+      # return empty so the caller falls through to field_block_scalar.
+      if ($0 ~ /^[>|][-+]?$/) { print ""; exit }
       gsub(/^["'\'']|["'\'']$/, "")
       print
       exit
@@ -91,7 +91,10 @@ field_block_scalar() {
     $0 ~ "^" f ":" {
       line = $0
       sub("^" f ": *", "", line)
-      if (line == ">" || line == "|") {
+      # Any block-scalar indicator (> | >- |- >+ |+) starts a block; the
+      # old bare-marker test returned ">-" itself as the field value, so
+      # every folded description counted 0 sentences (feedback 2026-07-26).
+      if (line ~ /^[>|][-+]?$/) {
         in_block = 1
         next
       }

package/templates/scripts/watchtower-lib.mjs

@@ -104,8 +104,20 @@ export const INBOX_DETECTOR_REGISTRY = {
   'completion-review': {
     reconciler: 'autoReconcileCompletionReviews (ring1): resolves when the referenced '
       + 'action (plan_fid || evidence.fid) is verifiably closed in its OWN project db; '
-      + 'fid-not-found keeps (flow vestigial-db + misattribution protection); filing '
-      + 'exclusion: ring3 Phase 2c create-vs-complete guard (act:9eebbac4)',
+      + 'fid-not-found keeps (flow vestigial-db + misattribution protection). Filing '
+      + 'exclusions (act:ea23b3a5, all at ring3 Phase 2c): (a) confidence \'high\' is '
+      + 'SUPPRESSED — measured anti-predictive over all 223 items ever filed (high 30% '
+      + 'precision, medium+low 60%); (b) act:9eebbac4\'s create-vs-complete day-window '
+      + 'filter is DELETED — it exempted \'high\' from the born-this-session skip, so it '
+      + 'suppressed the best cohort (same-day + medium/low, 74%) and passed the worst, '
+      + 'and the category filed 0 true positives in the 23 items after it shipped; (c) '
+      + 'per-fid dedup across pending + resolved/dismissed/EXPIRED/SUPERSEDED. Category '
+      + 'expiry is 14d (expiryDaysFor), which is why the last two statuses are '
+      + 'load-bearing: the expiry equals COMPLETION_REVIEW_DEDUP_DAYS, so without them a '
+      + 'fid leaves every corpus exactly when its item expires and refiles forever. A '
+      + 'quoted-completion-evidence check runs as INSTRUMENTATION ONLY (evidence.'
+      + 'quote_verified) and gates nothing — the transcript haystack is JSON-serialized, '
+      + 'so a substring gate rejects real prose and accepts serialized tool arguments.',
   },
   // ring3-filed
   'coverage-warning': {
@@ -133,7 +145,12 @@ export const INBOX_DETECTOR_REGISTRY = {
   'advisor-finding': {
     exempt: 'advisory observation from the session advisor pass (ring2 briefing panel + '
       + 'ring3 Phase 2m); capped per member per session and deduped vs pending + '
-      + 'resolution corpora at filing; no mechanical truth condition.',
+      + 'resolution corpora at filing; no mechanical truth condition. The ring2 '
+      + 'cabinet-roster review files only ONE kind here now (act:ea23b3a5): '
+      + 'uncovered-tech, which proposes a cabinet seat and is therefore a decision. Its '
+      + 'siblings dormant-skill and stale-briefing were pure measurements and moved to '
+      + 'ambient state (state/roster-review.json → Ring 1 Standing Issues, rendered on '
+      + 'change); retireRosterFindingItems supersedes any that were still pending.',
   },
   'raised-unhandled': {
     exempt: 'session-historical fact — a loose end the session raised but neither did '
@@ -150,8 +167,44 @@ export const INBOX_DETECTOR_REGISTRY = {
       + 'reconciler: the referenced deferred action closed.',
   },
   'watchtower-health': {
-    exempt: 'notification of a stale/failing ring window; recovery is visible in the '
-      + 'ring health sidecars. Candidate future reconciler: health recovered ⇒ retract.',
+    reconciler: 'retractClearedMemoryBudgetItems (ring2 slow, act:ea23b3a5): the '
+      + 'memory-budget alarm retracts on the SAME pass that measures it — '
+      + 'runMemoryHygiene already shells every project\'s validate-memory (exit 0 = '
+      + 'pass) and already computes passProjects, so the retraction condition is in '
+      + 'hand. Deliberately NOT in Ring 1: a second memory-health producer is forbidden '
+      + 'by name in this doc, and at a 30-minute throttle against ring2\'s 30-minute '
+      + 'cadence it would buy zero freshness. Fails toward KEEPING — only a project '
+      + 'positively classified `pass` retracts; any nonzero exit maps to `violations`. '
+      + 'The selector matches BOTH the new evidence.debt_class and the legacy '
+      + '{violations, streak} title shape, because every item on disk when this shipped '
+      + 'carried the latter. Filing side: ONE accumulating item per project, keyed by '
+      + 'CALENDAR DAY (a per-run key would count ~48 cron ticks a day), appended via '
+      + 'annotateItemEvidence so filed_at is never bumped. Other watchtower-health '
+      + 'filings (stale/failing ring windows) remain exempt — recovery is visible in the '
+      + 'ring health sidecars.',
+  },
+  // ring4-filed (in the census since act:ea23b3a5; ring4 was outside it before)
+  'doc-drift': {
+    exempt: 'a documentary claim that no longer matches the tree, filed one item per '
+      + '(project, drift_key). Deliberately NOT aggregated into a per-project standing '
+      + 'debt: each item carries its own mutually-exclusive fix-doc / fix-code decision, '
+      + 'so one accumulated item would pose a question the operator cannot answer. No '
+      + 'mechanical retraction yet either — the weekly pass covers only 3 of 7 projects '
+      + 'per run, so "not reproduced this run" is not evidence a claim cleared, and a '
+      + 'reconciler built on it would mass-retract every item in the unscanned projects. '
+      + 'Candidate future reconciler: re-verify on the next pass that ACTUALLY scanned '
+      + 'that project, scoped to items with filed_by ring4. NOTE a second producer '
+      + 'exists outside the census — a consumer Plan-9 hook files doc-drift with no '
+      + 'drift_key at all (live: flow ring2-slow-post/10-pulse-mechanical.mjs).',
+  },
+  // routines-filed (in the census since act:ea23b3a5)
+  'routine': {
+    exempt: 'a declared interactive routine that fired. The dispatch engine owns the '
+      + 'whole lifecycle, so there is nothing for a Ring 1 reconciler to re-check: a '
+      + 'pending item blocks refiring, a stale one is superseded at the next due firing, '
+      + 'and since act:ea23b3a5 a time-of-day routine self-supersedes at END OF ITS '
+      + 'FILING DAY on Ring 1\'s tick — its moment is over. Terminal exits clear the mux '
+      + 'dispatch descriptor via DISPATCHED_CATEGORIES, so the desk badge follows.',
   },
   'stale-project': {
     exempt: 'staleness notification. Candidate future reconciler: project activity '

package/templates/scripts/watchtower-queue.mjs

@@ -149,7 +149,7 @@ const KNOWLEDGE_CATEGORY = 'knowledge-extraction';
 // is ALWAYS filed (never dropped) — home becomes the recomputation itself,
 // not a written record.
 export const KNOWLEDGE_EXTRACTION_TYPES = ['decision', 'constraint', 'lesson', 'preference', 'unclassifiable'];
-export const KNOWLEDGE_EXTRACTION_HOMES = ['memory', 'claude-md', 'pib-db-trigger', 'upstream-feedback', 'derivation'];
+export const KNOWLEDGE_EXTRACTION_HOMES = ['memory', 'claude-md', 'pib-db-trigger', 'upstream-feedback', 'derivation', 'session-record'];
 
 // Categories whose items carry a structural recipient gate: they may never be
 // included in a batch disposition — each leaves the queue only through its own
@@ -917,6 +917,13 @@ export function createItem({
     if (evidence.derivable === true && (typeof evidence.derivation !== 'string' || !evidence.derivation.trim())) {
       throw new Error('createItem: derivable:true requires evidence.derivation naming how to recompute it — a derivable fact is routed to its derivation, never filed as an opaque flag');
     }
+    // The perishable twin (act:a69c21f8): a fact that is true at a moment and
+    // will become false, with no live source to recompute it from. perishes_when
+    // is to perishable what derivation is to derivable — the flag is never
+    // filed opaque.
+    if (evidence.perishable === true && (typeof evidence.perishes_when !== 'string' || !evidence.perishes_when.trim())) {
+      throw new Error('createItem: perishable:true requires evidence.perishes_when naming what event or time makes it false — a perishable fact is filed as a dated snapshot, never as an opaque flag');
+    }
   }
   // A 'merged' handoff must reference work actually on main. merge_state
   // replaced the old hand-flagged `merged_into: "PENDING — not yet merged"`
@@ -1161,11 +1168,46 @@ export function releaseHold(id) {
  * @param {string} id
  * @returns {object} The updated item
  */
+// ---------------------------------------------------------------------------
+// Category expiry — the ONE age policy (act:ea23b3a5)
+// ---------------------------------------------------------------------------
+//
+// There are TWO expiry engines: Ring 2's `escalateQueueItems` (the 5-minute
+// cron) and `runExpiry` below (called by /inbox and /briefing). Before this,
+// each hardcoded 30 days and each inlined its own qa-handoff carve-out — so a
+// per-category policy set in one would be silently violated by whichever engine
+// reached the item first. Both now delegate here.
+//
+// `categoryNeverExpires` lives beside `expireItem`'s throw deliberately: the
+// carve-out is STRUCTURAL, not a preference. `expireItem` throws on a
+// qa-handoff, so returning anything but null for it would crash the caller's
+// loop. One fact, one place, no drift.
+export const DEFAULT_EXPIRE_DAYS = 30;
+
+// Per-category overrides. completion-review at 14d: the category's whole value
+// is time-bound — a completion candidate nobody confirmed in two weeks is not
+// going to be confirmed, and a real completion re-detects when the action is
+// next touched. NOTE the coupling to COMPLETION_REVIEW_DEDUP_DAYS (also 14) in
+// ring3-close: because the two are equal, that phase's dedup corpus MUST
+// include `expired` and `superseded`, or a fid leaves every corpus at exactly
+// the moment its item expires and refiles forever.
+export const CATEGORY_EXPIRE_DAYS = { 'completion-review': 14 };
+
+export function categoryNeverExpires(category) {
+  return category === QA_CATEGORY;
+}
+
+/** Days before an item of this category expires; null = never. */
+export function expiryDaysFor(category) {
+  if (categoryNeverExpires(category)) return null;
+  return CATEGORY_EXPIRE_DAYS[category] ?? DEFAULT_EXPIRE_DAYS;
+}
+
 export function expireItem(id) {
   const fp = itemPath(id);
   const item = readItem(fp);
   if (item.status !== 'pending') return null;
-  if (item.category === QA_CATEGORY) {
+  if (categoryNeverExpires(item.category)) {
     throw gateError(item, 'qa-handoff items never expire — QA debt stays surfaced until a stamped verdict resolves it (or a typed dismissal waives it)');
   }
   item.status = 'expired';
@@ -1359,10 +1401,12 @@ export function getEnrichment(id) {
  * @param {object} params
  * @returns {object} { warned: [], expired: [] }
  */
-export function runExpiry({ warnDays = 14, expireDays = 30 } = {}) {
+// `expireDays` is the DEFAULT, not a blanket: per-category overrides come from
+// expiryDaysFor (act:ea23b3a5), so this engine and Ring 2's cron cannot give
+// two different answers for the same item.
+export function runExpiry({ warnDays = 14, expireDays = DEFAULT_EXPIRE_DAYS } = {}) {
   const now = Date.now();
   const warnMs = warnDays * 24 * 60 * 60 * 1000;
-  const expireMs = expireDays * 24 * 60 * 60 * 1000;
   const pending = listPending();
   const warned = [];
   const expired = [];
@@ -1371,13 +1415,16 @@ export function runExpiry({ warnDays = 14, expireDays = 30 } = {}) {
     const age = now - new Date(item.filed_at).getTime();
     // qa-handoff items never auto-expire: an expired handoff is exactly the
     // silent QA gap the recipient gate forbids. They warn (by item) instead.
-    if (item.category === QA_CATEGORY) {
+    const days = categoryNeverExpires(item.category)
+      ? null
+      : (CATEGORY_EXPIRE_DAYS[item.category] ?? expireDays);
+    if (days === null) {
       if (age >= warnMs) warned.push(item);
       continue;
     }
-    if (age >= expireMs) {
+    if (age >= days * 24 * 60 * 60 * 1000) {
       item.status = 'expired';
-      item.resolution_notes = `Auto-expired after ${expireDays} days. If still relevant, re-file with updated context.`;
+      item.resolution_notes = `Auto-expired after ${days} days. If still relevant, re-file with updated context.`;
       atomicWrite(itemPath(item.id), item);
       if (DISPATCHED_CATEGORIES.has(item.category)) clearDispatchEntries(item);
       expired.push(item);

package/templates/scripts/watchtower-ring1.mjs

@@ -1645,6 +1645,72 @@ function readRecallCanary() {
   } catch { return {}; }
 }
 
+// readRosterMetrics — the Ring 2 cabinet-roster measurement sidecar
+// (act:ea23b3a5). Same shape of relationship as the recall canary: the
+// measurement is Ring 2's, the render is Ring 1's, because Ring 1 owns the
+// per-project state file. Absent or corrupt yields {} — a project with no
+// entry renders nothing at all.
+function readRosterMetrics() {
+  const path = join(WATCHTOWER_DIR, 'state', 'roster-review.json');
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, 'utf8')).metrics || {};
+  } catch { return {}; }
+}
+
+// Cap on skill names listed inline, matching FLAGGED_RENDER_CAP's discipline:
+// the COUNT is always true, only the enumeration is bounded.
+export const ROSTER_NAME_RENDER_CAP = 4;
+
+// renderRosterEntries — the ambient Standing Issues lines for a project's
+// roster measurement. Returns [] when there is nothing worth a line.
+//
+// RENDERS ON CHANGE ONLY. An unchanging number in a file the operator reads at
+// every briefing is furniture by the third read — the recall canary set this
+// precedent by rendering only on alert. The count still lives in
+// state/roster-review.json for anyone who goes looking; what earns a line here
+// is movement. (First measurement counts as movement: `previous` is null.)
+//
+// Pure (no I/O) for hermetic testing.
+export function renderRosterEntries(metrics, cap = ROSTER_NAME_RENDER_CAP) {
+  const lines = [];
+  if (!metrics || typeof metrics !== 'object') return lines;
+  const asOf = String(metrics.measured_at || '').slice(0, 10);
+  const stamp = asOf ? ` (measured ${asOf})` : '';
+
+  const d = metrics.dormant;
+  if (d && (d.dead_count > 0 || d.stale_count > 0)) {
+    const prev = metrics.previous;
+    const changed = !prev
+      || prev.dead_count !== d.dead_count
+      || prev.stale_count !== d.stale_count;
+    if (changed) {
+      const names = (Array.isArray(d.dead) ? d.dead : []).slice(0, cap);
+      const more = (d.dead_count || 0) - names.length;
+      const nameList = names.length
+        ? ` — ${names.join(', ')}${more > 0 ? `, +${more} more` : ''}`
+        : '';
+      const wasNote = prev ? ` (was ${prev.dead_count})` : '';
+      lines.push(
+        `dormant skills: ${d.dead_count} never invoked${wasNote}, `
+        + `${d.stale_count} stale >${d.days || 30}d${nameList}${stamp}`
+      );
+    }
+  }
+
+  const briefings = metrics.stale_briefings;
+  if (Array.isArray(briefings) && briefings.length > 0) {
+    const oldest = briefings.reduce((a, b) =>
+      (b.ageDaysBehind || 0) > (a.ageDaysBehind || 0) ? b : a);
+    lines.push(
+      `stale cabinet briefings: ${briefings.length}, `
+      + `oldest ~${oldest.ageDaysBehind}d behind the project${stamp}`
+    );
+  }
+
+  return lines;
+}
+
 function assembleProjectState(ps) {
   const now = new Date().toISOString();
   const lines = [];
@@ -1727,6 +1793,10 @@ function assembleProjectState(ps) {
       `sample (over-suppression only; recall-canary.json / see /briefing)`
     );
   }
+  // Cabinet-roster measurements (act:ea23b3a5) — ambient state, not queue
+  // items: a count describes a condition, it doesn't ask the operator to
+  // decide anything. Rendered on CHANGE only; see renderRosterEntries.
+  for (const line of renderRosterEntries(ps.roster)) issues.push(line);
   if (ps.divergedBranches && ps.divergedBranches.length > 0) {
     issues.push(`Diverged branches: ${ps.divergedBranches.join(', ')}`);
   }
@@ -1815,6 +1885,9 @@ function main() {
     // Ring 2 slow writes the recall-canary sidecar; Ring 1 renders an alerting
     // project's entry into its Standing Issues (the canary's named reader).
     const recallCanaryProjects = readRecallCanary();
+    // Ring 2's weekly cabinet-roster measurement, rendered by Ring 1 (which
+    // owns the per-project state file) — the recall-canary relationship.
+    const rosterMetrics = readRosterMetrics();
 
     // Branch-diverged reconciliation inputs, resolved ONCE per tick: the
     // exclusion matcher (config-driven) and one pending-items snapshot —
@@ -1845,6 +1918,7 @@ function main() {
         ccFeedbackArrival: checkCcFeedbackArrival(projectPath),
         memoryIntegrity: checkMemoryIntegrity(projectPath),
         recall: recallCanaryProjects[name] || null,
+        roster: rosterMetrics[name] || null,
         divergedBranches: [],
         hookResults: [],
       };