mandrel 2.54.0 → 2.55.0

package/.agents/workflows/helpers/plan-reference.md

@@ -92,6 +92,13 @@ The marker keeps the operator's undelegated decisions findable after the
 fact: reviewing a `--yes` plan means scanning its decisions-made-by-default,
 not re-deriving which assumptions were really the agent's to make.
 
+## Gate #1 → the memory-pool advisory (`memoryPoolAdvisory`)
+
+On a truthy `memoryPoolAdvisory.recommend`, name
+[`/memory-consolidate`](../memory-consolidate.md) at Gate #1, quoting its
+`reasons[]`. Purely advisory: a stale pool degrades recall, it does not make
+the plan wrong, so it never blocks and never reroutes.
+
 ## Gate #1 → the light path (in-session handoff)
 
 On a confirmed `deliverLightSuggestion`, `/mandrel-plan` routes into

package/.agents/workflows/mandrel-plan.md

@@ -25,8 +25,7 @@ mode from what the operator typed, announce it, act**:
 
 **Resolving a bare id.** Read live state rather than asking: `agent::done` can
 only be amended, an open unplanned issue only planned. **Announce the
-derivation** — "4712 is `agent::done` → amending". Ask **only** for an open
-Story already at `agent::ready`.
+derivation**. Ask **only** for an open Story already at `agent::ready`.
 
 ## Saying what you want
 
@@ -73,10 +72,6 @@ in Key Assumptions, each a decision-made-by-default.
 **Gate #1** — STOP to confirm the sharpened plan intent and any
 duplicate-candidate review. Under `--yes`, auto-proceed.
 
-On a truthy `memoryPoolAdvisory.recommend`, name
-[`/memory-consolidate`](memory-consolidate.md) quoting its `reasons[]`;
-advisory.
-
 On a truthy `deliverLightSuggestion.suggested`, offer — advisory, never an
 automatic reroute — to deliver the seed instead; on confirm route **in this
 session** into [`helpers/deliver-light.md`](helpers/deliver-light.md), its gate
@@ -93,7 +88,9 @@ persist parses either, serializes canonical markdown and syncs top-level
 
 **Grounding = your reads + Phase 8.** Nothing inventories the repo: read each
 file you cite; persist hard-errors on any `{path, assumption}` absent from the
-tree. Fields: [ref](helpers/plan-reference.md).
+tree — a `refactors-existing` on a path the base branch **deleted or renamed**
+included. One rescue: a **never-tracked** one normalises to `creates`. Fields:
+[ref](helpers/plan-reference.md).
 
 Artifacts under `temp/plan-<slug>/`: `stories.json` (**length 1 by default**;
 over-budget Specs fail closed — split or tighten, never under `docs/`); optional

package/.agents/workflows/memory-consolidate.md

@@ -100,19 +100,24 @@ Then write the receipt to `.consolidation-stamp.json` in the pool root:
 count the directory, never the plan. It is the baseline the next run measures
 growth against, so a wrong number silently mis-arms the nudge.
 
-The `/mandrel-plan` Phase 0 advisory re-arms on exactly two conditions: the
-stamp aging past `planning.memoryPool.staleAfterDays` (30), or
-`planning.memoryPool.growthDelta` (25) entries written since that count. Pool
-size alone never triggers it — a pass that keeps every entry still quiets the
-nudge. A stamp with no `entryCount` leaves growth unmeasured, and only the age
-arm can speak until the next pass writes one.
+The `/mandrel-plan` Phase 0 advisory re-arms on exactly three conditions: the
+stamp aging past `planning.memoryPool.staleAfterDays` (30),
+`planning.memoryPool.growthDelta` (25) entries written since that count, or
+`MEMORY.md` exceeding `planning.memoryPool.indexByteCeiling` (24576) bytes.
+Pool size alone never triggers it — a pass that keeps every entry still quiets
+the first two arms. A stamp with no `entryCount` leaves growth unmeasured, and
+only the age and index arms can speak until the next pass writes one; a stamp
+dated in the future reads as no stamp at all.
 
 Write it **only** after Gate #2 — the stamp asserts an operator reviewed the
 pass, so writing it early makes it a lie.
 
-Close with counts: entries read, corrected, merged, pruned, and the new total.
-Then the forecast the operator would otherwise derive by hand: when the
-advisory next fires, and which arm reaches it first.
+Close with counts: entries read, corrected, merged, pruned, the new total, and
+**the rewritten `MEMORY.md`'s size in bytes beside that count** — the index is
+truncated at the byte ceiling, so a pass that pruned entries but left the
+index over the cap has not fixed the loss, and the number is the only way the
+operator can see that. Then the forecast the operator would otherwise derive
+by hand: when the advisory next fires, and which arm reaches it first.
 
 ## Constraints
 

package/docs/CHANGELOG.md

@@ -15,6 +15,33 @@ All notable changes to this project will be documented in this file.
 -->
 <!-- markdownlint-disable-file MD004 MD012 MD037 -->
 
+## [2.55.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.54.0...mandrel-v2.55.0) (2026-09-11)
+
+
+### Added
+
+* a backgrounded capture ends the worker's turn on an unpushed branch, and close's base-sync silently spends the credit that capture was earning ([#5267](https://github.com/dsj1984/mandrel/issues/5267)) ([#5273](https://github.com/dsj1984/mandrel/issues/5273)) ([8d2bed1](https://github.com/dsj1984/mandrel/commit/8d2bed1e2132bc8b8901b58a33231b2bda5fd61c))
+* epic rollup: every child state change is an edge, the parent is resolved in one call, and provider reads carry one declared shape ([#5280](https://github.com/dsj1984/mandrel/issues/5280)) ([#5294](https://github.com/dsj1984/mandrel/issues/5294)) ([c2c9b96](https://github.com/dsj1984/mandrel/commit/c2c9b9654497404c20105bc3b7edcdbd45fb307e))
+* full-suite credit: a deposit path exists, the lock is liveness-aware, and stamps and evidence are keyed on content ([#5278](https://github.com/dsj1984/mandrel/issues/5278)) ([#5296](https://github.com/dsj1984/mandrel/issues/5296)) ([96c3240](https://github.com/dsj1984/mandrel/commit/96c32405025768de96d2e12680a54ed326787345))
+* memory advisory: measure the index against the harness byte cap, reject future-dated stamps, tighten the skill-id schema, and correct the rename cutover text ([#5285](https://github.com/dsj1984/mandrel/issues/5285)) ([#5289](https://github.com/dsj1984/mandrel/issues/5289)) ([22389a1](https://github.com/dsj1984/mandrel/commit/22389a106cb8e3ce42b0fde288ee473b88e49b99))
+* tests: a portability lint catches the Windows-only shapes before they land, and a vanished temp root is recorded instead of healed ([#5284](https://github.com/dsj1984/mandrel/issues/5284)) ([#5295](https://github.com/dsj1984/mandrel/issues/5295)) ([3358eef](https://github.com/dsj1984/mandrel/commit/3358eefeb0e5f36446b84a4f995e4b90641f64dc))
+
+
+### Fixed
+
+* a test fixture that loses its temp root mid-run fails with an unreadable ENOENT, and every later makeTempDir in that process fails with it ([#5274](https://github.com/dsj1984/mandrel/issues/5274)) ([#5275](https://github.com/dsj1984/mandrel/issues/5275)) ([5ac8699](https://github.com/dsj1984/mandrel/commit/5ac86995b92537b33bb209492cf9c3d9a064f792))
+* audit sweep: empty groups parse, the ledger commit is re-runnable from the remote base, SCA attribution is per advisory, and label-less audit Stories cannot be dispatched ([#5281](https://github.com/dsj1984/mandrel/issues/5281)) ([#5290](https://github.com/dsj1984/mandrel/issues/5290)) ([e229b0f](https://github.com/dsj1984/mandrel/commit/e229b0fb07e37e251b713a35646105cc54e791c9))
+* baselines: the merge driver is installed wherever base-sync runs, the refresh ack is scoped to the tagged commit's diff, and the land-time write-back cannot launder a regression ([#5277](https://github.com/dsj1984/mandrel/issues/5277)) ([#5292](https://github.com/dsj1984/mandrel/issues/5292)) ([9354e93](https://github.com/dsj1984/mandrel/commit/9354e93f7e74f263ffaf64c6e72056784a9b74d4))
+* close result: the merged flag is derived from what the run observed, failed closes report only registered gates, and advisory blocks carry their own remedy ([#5279](https://github.com/dsj1984/mandrel/issues/5279)) ([#5293](https://github.com/dsj1984/mandrel/issues/5293)) ([93414ac](https://github.com/dsj1984/mandrel/commit/93414ac756bd3f3300f869d46c28f680883edce4))
+* close's result note claims a merge it never confirmed, and a timed-out advisory scan blocks with the same class and remedies as a real violation ([#5266](https://github.com/dsj1984/mandrel/issues/5266)) ([#5271](https://github.com/dsj1984/mandrel/issues/5271)) ([585a2c3](https://github.com/dsj1984/mandrel/commit/585a2c340d96b972028d2d2f469e2f6b287f7ac2))
+* **deps:** override smol-toml past the GHSA-7w5x-hrqm-74c2 DoS advisory (refs [#5264](https://github.com/dsj1984/mandrel/issues/5264)) ([#5268](https://github.com/dsj1984/mandrel/issues/5268)) ([8db060c](https://github.com/dsj1984/mandrel/commit/8db060ca23a5242c1d13e4a049647be86e853504))
+* git-cleanup: weak-signal remote deletes need an explicit opt-in under --yes, and the bulk PR index short-circuits its per-branch fallback ([#5283](https://github.com/dsj1984/mandrel/issues/5283)) ([#5288](https://github.com/dsj1984/mandrel/issues/5288)) ([8346932](https://github.com/dsj1984/mandrel/commit/83469327b63488ea41a2bd9fb53a37bc2f57d1c0))
+* plan-persist reports two things the tree contradicts: a refactors-existing path deleted weeks ago, and a wave table promising parallelism the dispatch guard refuses ([#5265](https://github.com/dsj1984/mandrel/issues/5265)) ([#5270](https://github.com/dsj1984/mandrel/issues/5270)) ([1b5d1ff](https://github.com/dsj1984/mandrel/commit/1b5d1ffdd6e8821c833d320e93381f7804cb61c8))
+* scoped lint: a degraded surface no longer discards the other surface's findings ([#5282](https://github.com/dsj1984/mandrel/issues/5282)) ([#5287](https://github.com/dsj1984/mandrel/issues/5287)) ([75005ee](https://github.com/dsj1984/mandrel/commit/75005ee925d463d46f5cb24cb3788647e08a37b2))
+* **tests:** a RegExp built from a raw path can never match on Windows (refs [#5274](https://github.com/dsj1984/mandrel/issues/5274)) ([#5276](https://github.com/dsj1984/mandrel/issues/5276)) ([8d5efb2](https://github.com/dsj1984/mandrel/commit/8d5efb256d936f7dd955eff55c68d70d8abbfb9c))
+* **tests:** close the two Windows-only breaks Epic [#5286](https://github.com/dsj1984/mandrel/issues/5286) left on main, and the class behind them ([#5297](https://github.com/dsj1984/mandrel/issues/5297)) ([ec419c7](https://github.com/dsj1984/mandrel/commit/ec419c7b7462f4e6e0adf76805c22735ac2e9673))
+* **tests:** prove the workflows-doc drift gate on a fixture root, not the live checkout ([#5291](https://github.com/dsj1984/mandrel/issues/5291)) ([e44aa99](https://github.com/dsj1984/mandrel/commit/e44aa991027859c5d94d9dc875e80d41e1572c00))
+
 ## [2.54.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.53.0...mandrel-v2.54.0) (2026-09-09)
 
 

package/lib/cli/registry.js

@@ -28,7 +28,8 @@ import { fileURLToPath } from 'node:url';
 import {
   BASELINE_MERGE_DRIVER_CONFIG_KEY,
   BASELINE_MERGE_DRIVER_REMEDY,
-  declaresBaselineMergeDriver,
+  parseBaselineMergeDriverCommand,
+  probeBaselineMergeDriver,
 } from '../../.agents/scripts/lib/bootstrap/baseline-merge-driver.js';
 import {
   REQUIRED_NODE_CEILING_MAJOR,
@@ -59,8 +60,8 @@ import {
  * @param {string[]} args
  * @returns {{ status: number|null, stdout: string, stderr: string, error?: NodeJS.ErrnoException }}
  */
-function spawn(cmd, args) {
-  const r = spawnSync(cmd, args, { encoding: 'utf8' });
+function spawn(cmd, args, opts = {}) {
+  const r = spawnSync(cmd, args, { encoding: 'utf8', ...opts });
   return {
     status: r.status,
     stdout: typeof r.stdout === 'string' ? r.stdout : '',
@@ -1101,34 +1102,76 @@ function runVersionCurrent({ cachePath, installedVersion, fsImpl = fs } = {}) {
  */
 export function runMergeDriver({ cwd, fsImpl = fs, runner = spawn } = {}) {
   const projectRoot = (cwd ?? (() => process.cwd()))();
-  const attributesPath = path.join(projectRoot, '.gitattributes');
-
-  let attributes = '';
-  try {
-    attributes = fsImpl.readFileSync(attributesPath, 'utf8');
-  } catch {
-    attributes = '';
-  }
-  if (!declaresBaselineMergeDriver(attributes)) {
+  // Both git calls run from `projectRoot`: the config key is per-clone, and
+  // reading it from wherever `mandrel doctor` was typed answers about a
+  // different repository (or none).
+  const { declared, command } = probeBaselineMergeDriver({
+    projectRoot,
+    fsImpl,
+    runGit: (args) => runner('git', args, { cwd: projectRoot }),
+  });
+  if (!declared) {
     return {
       ok: true,
       detail:
         'skipped — .gitattributes does not route baselines/*.json through the mandrel merge driver',
     };
   }
-
-  const configured = runner('git', [
-    'config',
-    '--get',
-    BASELINE_MERGE_DRIVER_CONFIG_KEY,
-  ]);
-  if (configured.status === 0 && configured.stdout.trim() !== '') {
-    return { ok: true, detail: configured.stdout.trim() };
+  if (command === '') {
+    return {
+      ok: false,
+      detail: `${BASELINE_MERGE_DRIVER_CONFIG_KEY} is unset — baselines/*.json will fall back to git's text merge, which conflicts on the generatedAt stamp and can splice rows neither branch scored`,
+      remedy: BASELINE_MERGE_DRIVER_REMEDY,
+    };
   }
+  return probeConfiguredDriver(command, runner, projectRoot);
+}
 
+/**
+ * Does the configured driver command actually RUN? (Story #5277)
+ *
+ * A set-but-broken key is the failure mode a presence check cannot see, and it
+ * is the common one: the command names an absolute node binary, and an nvm or
+ * volta version bump moves that binary out from under it months after the
+ * driver was installed. Git's behaviour then is the same silence a missing key
+ * produces — the driver exits non-zero, git leaves the file conflicted, and the
+ * operator reads it as "baselines conflict again" rather than as a broken
+ * registration. So the check executes what git would execute.
+ *
+ * `--help` is the probe because the driver's real invocation mutates `%A` in
+ * place; the shipped CLI answers `--help` with exit 0 and touches nothing.
+ *
+ * The command is tokenised, never handed to a shell
+ * ({@link parseBaselineMergeDriverCommand}) — it is a config value, and running
+ * it through `shell: true` would make any write to that key arbitrary command
+ * execution (security-baseline § Output & Rendering).
+ *
+ * The probe runs from `projectRoot`, because the command's script path is
+ * relative to the worktree root — which is where git invokes a merge driver
+ * from, and is not necessarily where `mandrel doctor` was typed.
+ *
+ * @param {string} command
+ * @param {typeof spawn} runner
+ * @param {string} projectRoot
+ * @returns {{ ok: boolean, detail: string, remedy?: string }}
+ */
+function probeConfiguredDriver(command, runner, projectRoot) {
+  const parsed = parseBaselineMergeDriverCommand(command);
+  if (!parsed) {
+    return {
+      ok: false,
+      detail: `${BASELINE_MERGE_DRIVER_CONFIG_KEY} is set to ${JSON.stringify(command)}, which has no runnable command in it`,
+      remedy: BASELINE_MERGE_DRIVER_REMEDY,
+    };
+  }
+  const probe = runner(parsed.file, [...parsed.args, '--help'], {
+    cwd: projectRoot,
+  });
+  if (probe.status === 0) return { ok: true, detail: command };
+  const why = probe.error?.message ?? `exit ${probe.status}`;
   return {
     ok: false,
-    detail: `${BASELINE_MERGE_DRIVER_CONFIG_KEY} is unset — baselines/*.json will fall back to git's text merge, which conflicts on the generatedAt stamp and can splice rows neither branch scored`,
+    detail: `${BASELINE_MERGE_DRIVER_CONFIG_KEY} is set to ${JSON.stringify(command)} but running it failed (${why}) — git would fall back to text-merging baselines/*.json exactly as if the key were unset`,
     remedy: BASELINE_MERGE_DRIVER_REMEDY,
   };
 }

package/lib/cli/sync.js

@@ -38,14 +38,24 @@
  *     {@link readVersionMarker} for how callers consume it.
  *
  * Security (Tech Spec #3459 "Postinstall safety"):
- *   - Does nothing beyond a local file copy: no network, no shell, no writes
- *     outside `./.agents/`.
+ *   - No network, and no shell: every child process is spawned with argv
+ *     tokens and `shell: false`.
  *   - Logs only paths and counts, never file contents or environment values.
+ *   - One write outside `./.agents/` (Story #5277): the per-clone
+ *     `merge.mandrel-baseline.driver` git config, and only when the project's
+ *     own tracked `.gitattributes` already declares the attribute that needs
+ *     it. That half of the registration cannot ship with the repository — git
+ *     will not execute a command chosen by whoever wrote it — so every fresh
+ *     clone silently text-merges generated baselines until something installs
+ *     it locally, and `sync` is the one command every consumer runs. It never
+ *     creates or edits `.gitattributes`; a project that has not opted into the
+ *     quality surface is left untouched.
  *
  * Injectable seams (used by lib/cli/__tests__/sync.test.js):
  *   - `resolvePackageRoot` — replaces real `mandrel` resolution
  *   - `fs`                 — replaces the node:fs surface used here
  *   - `cwd`                — replaces process.cwd()
+ *   - `ensureMergeDriver`  — replaces the git-config merge-driver install
  *   - `write`              — replaces process.stdout.write
  *   - `writeErr`           — replaces process.stderr.write
  *   - `exit`               — replaces process.exit
@@ -55,6 +65,7 @@ import nodeFs from 'node:fs';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 
+import { ensureBaselineMergeDriver } from '../../.agents/scripts/lib/bootstrap/baseline-merge-driver.js';
 import { LEDGER_RELATIVE_PATH } from '../../.agents/scripts/lib/bootstrap/install-ledger.js';
 
 export const PACKAGE_NAME = 'mandrel';
@@ -337,6 +348,7 @@ function listDestFiles(dir, fsImpl, prefix = '') {
  *   write?: (s: string) => void,
  *   writeErr?: (s: string) => void,
  *   exit?: (code: number) => void,
+ *   ensureMergeDriver?: typeof ensureBaselineMergeDriver,
  * }} [opts]
  * @returns {{ copied: number, planned: number, pruned: number, dryRun: boolean }}
  *   Summary (also returned in dry-run / error paths for testability).
@@ -344,6 +356,7 @@ function listDestFiles(dir, fsImpl, prefix = '') {
 export function runSync({
   argv = [],
   resolvePackageRoot = defaultResolvePackageRoot,
+  ensureMergeDriver = ensureBaselineMergeDriver,
   fs = nodeFs,
   cwd = () => process.cwd(),
   write = (s) => process.stdout.write(s),
@@ -435,6 +448,18 @@ export function runSync({
     `${packageVersion}\n`,
   );
 
+  // Baseline merge driver (Story #5277) — config half only; see the module
+  // preamble's security note. Never allowed to fail the sync: a consumer
+  // without git, or with a read-only config, still gets their `.agents/` tree.
+  const driver = ensureMergeDriver({
+    projectRoot,
+    configOnly: true,
+    fsImpl: fs,
+  });
+  if (driver?.action === 'updated') {
+    write('✅  Registered the baselines/*.json merge driver for this clone\n');
+  }
+
   if (staleFiles.length > 0) {
     write(
       `✅  Installed ${payloadFiles.length} file(s) into ./.agents/ (pruned ${staleFiles.length} stale file(s))\n`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel",
-  "version": "2.54.0",
+  "version": "2.55.0",
   "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.",
   "files": [
     ".agents/",
@@ -32,6 +32,7 @@
     "baseline:agents-loc": "node baselines/agents-loc-baseline.mjs",
     "baselines:scope": "node .agents/scripts/check-baseline-scope.js",
     "baselines:prune": "node .agents/scripts/prune-baseline-orphans.js",
+    "baselines:merge-driver": "node .agents/scripts/merge-baseline.js --install",
     "lint:md": "markdownlint-cli2 \".agents/**/*.md\" \"*.md\" \"!node_modules/**\" \"!.worktrees/**\"",
     "lint": "node .agents/scripts/run-lint.js && node .agents/scripts/check-generated-validator.js --check && node .agents/scripts/check-pinned-override-notes.js && npm run docs:check",
     "docs:gen": "node .agents/scripts/generate-config-docs.js && node .agents/scripts/generate-workflows-doc.js && node .agents/scripts/generate-lens-checklists.js",
@@ -63,7 +64,7 @@
     "quality:watch": "node .agents/scripts/quality-watch.js",
     "sync:commands": "node bin/mandrel.js sync-commands",
     "sync:agents": "node .agents/scripts/sync-claude-agents.js",
-    "prepare": "husky && npm run sync:commands && npm run sync:agents",
+    "prepare": "husky && npm run sync:commands && npm run sync:agents && npm run baselines:merge-driver",
     "postinstall": "node bin/postinstall.js mandrel sync"
   },
   "repository": {
@@ -130,10 +131,12 @@
   "//": {
     "peerDependencies.@cucumber/gherkin": "OPTIONAL peer, mirroring the `typescript` precedent, and deliberately NOT a runtime dependency. `check-gherkin-corpus.js` is the only consumer and it is opt-in behind `qa.gherkinLint`, so a consumer with no BDD tier must gain nothing from an upgrade. The devDependency alongside it is what lets this repository's own suite drive the real parser. The gate resolves it through a require path anchored at the consumer project — `.agents/` reaches a consumer by plain file copy, so a bare specifier would resolve against the consumer's module chain, which under a non-hoisting linker need not hold it.",
     "overrides.js-yaml": "COUPLED to devDependencies.markdownlint-cli2 — do not bump either alone, and do NOT drop this override. It is load-bearing: markdownlint-cli2 0.22.x pulls js-yaml 4.1.1, which carries GHSA-52cp-r559-cp3m (high) and GHSA-h67p-54hq-rp68 (moderate); removing the override was measured to reintroduce both (1 high + 1 moderate), while with it in place `npm audit` is clean. An npm override also wins over a transitive package's own pin, so this tree-wide ^4.3.2 is imposed on every js-yaml consumer regardless of what they declare — and markdownlint-cli2 0.23.x declares an exact js-yaml 5.2.1. A dry-run bump confirmed the trap: markdownlint-cli2 0.23.1 resolves against js-yaml 4.3.0, two majors off what it declares, silently. The only safe move is to raise this override and bump markdownlint-cli2 in ONE reviewed commit (first confirming cosmiconfig, under @commitlint/cli, tolerates the same major). renovate.json excludes markdownlint-cli2 from devDependency auto-merge so that pair cannot drift apart unattended. The floor has since been raised twice for advisories against the pinned range itself (most recently to ^4.3.2 for GHSA-2883-xcg3-v3hh, whose fix is 4.3.2) — raising it is safe and does NOT touch the coupling above; check-pinned-override-notes.js now fails the build if this sentence and the pin disagree.",
-    "dependencies.js-yaml": "States the SAME range as overrides.js-yaml above. The two are deliberate duplicates — npm has no way to reference the direct range from the overrides block — so they MUST move in lockstep; changing one without the other silently splits the direct and transitive resolutions."
+    "dependencies.js-yaml": "States the SAME range as overrides.js-yaml above. The two are deliberate duplicates — npm has no way to reference the direct range from the overrides block — so they MUST move in lockstep; changing one without the other silently splits the direct and transitive resolutions.",
+    "overrides.smol-toml": "Load-bearing: markdownlint-cli2 0.22.1 declares an EXACT smol-toml 1.6.1, which carries GHSA-7w5x-hrqm-74c2 (high — denial of service via malformed TOML). The advisory’s vulnerable range is everything <= 1.7.0, so no lockfile-only resolution reaches a patched version and this tree-wide ^1.7.1 pin is what clears it. npm’s own `audit fix --force` instead proposes markdownlint-cli2 0.21.0 — a DOWNGRADE presented as a breaking change; do not take it. An npm override wins over a transitive package’s own exact pin, so markdownlint-cli2 runs against a minor it never declared: `npm run lint` was confirmed green under the forced version and is what must be re-run if this pin moves. knip declares ^1.6.1 and is satisfied natively. smol-toml is NOT a direct dependency, so unlike overrides.js-yaml there is no lockstep duplicate range to keep in sync."
   },
   "overrides": {
     "js-yaml": "^4.3.2",
-    "markdown-it": "^14.2.0"
+    "markdown-it": "^14.2.0",
+    "smol-toml": "^1.7.1"
   }
 }