nccgs 2.1.0 → 2.1.1

package/tests/framework.test.mjs

@@ -1,740 +1,740 @@
-import assert from "node:assert/strict";
-import crypto from "node:crypto";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { compile, renderAgent } from "../.claude/nccgs/tools/compile-policy.mjs";
-import { assertRelativePath, containedPath } from "../.claude/nccgs/tools/paths.mjs";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const studio = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/studio.json"), "utf8"));
-const workflows = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/workflow-catalog.json"), "utf8"));
-const pipeline = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/pipeline.json"), "utf8"));
-function copyAgentFixture(temp) {
-  fs.cpSync(path.join(root, ".claude/nccgs"), path.join(temp, ".claude/nccgs"), { recursive: true });
-  fs.mkdirSync(path.join(temp, ".claude/agents"), { recursive: true });
-  for (const agent of studio.agents) {
-    const template = fs.readFileSync(path.join(root, ".claude/nccgs/agent-library", `${agent.name}.md`), "utf8");
-    fs.writeFileSync(path.join(temp, ".claude/agents", `${agent.name}.md`), renderAgent(template, pipeline.profiles[pipeline.defaultProfile].models[agent.modelClass]));
-  }
-}
-const frameworkVersion = fs.readFileSync(path.join(root, "VERSION"), "utf8").trim();
-const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
-const adaptiveRoutes = {
-  lightweight: { model: "sonnet", effort: "medium" },
-  standard: { model: "claude-opus-5-5", effort: "medium" },
-  deep: { model: "claude-opus-5-5", effort: "high" },
-  leadership: { model: "claude-opus-5-5", effort: "high" },
-  review: { model: "fable", effort: "high" }
-};
-const field = (text, name) => text.match(new RegExp(`^${name}:\\s*([^\\r\\n]+)`, "m"))?.[1]?.trim() ?? null;
-function assertAgentRoute(project, agentName, expected) {
-  const text = fs.readFileSync(path.join(project, ".claude/agents", `${agentName}.md`), "utf8");
-  assert.equal(field(text, "model"), expected.model, `${agentName} model`);
-  assert.equal(field(text, "effort"), expected.effort, `${agentName} effort`);
-  return text;
-}
-
-test("canonical policy changes invalidate generated routing until compilation", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-policy-test-"));
-  try {
-    copyAgentFixture(temp);
-    compile(temp, true);
-    assert.deepEqual(compile(temp), []);
-    const file = path.join(temp, ".claude/nccgs/pipeline.json");
-    const policy = JSON.parse(fs.readFileSync(file, "utf8"));
-    policy.profiles["claude-standalone"].models.review.effort = "medium";
-    fs.writeFileSync(file, JSON.stringify(policy));
-    const stale = compile(temp);
-    assert.ok(stale.includes(".claude/agents/nccgs-adversarial-reviewer.md"));
-    assert.ok(stale.includes(".claude/nccgs/workflow-catalog.json"));
-    compile(temp, true);
-    assert.deepEqual(compile(temp), []);
-    const catalog = JSON.parse(fs.readFileSync(path.join(temp, ".claude/nccgs/studio.json"), "utf8"));
-    assert.equal(catalog.effortProfiles["claude-standalone"].review, "medium");
-    const reviewerTemplate = path.join(temp, ".claude/nccgs/agent-library/nccgs-adversarial-reviewer.md");
-    fs.writeFileSync(reviewerTemplate, fs.readFileSync(reviewerTemplate, "utf8").replace(/^maxTurns: \d+/m, "maxTurns: 63"));
-    assert.ok(compile(temp).includes(".claude/nccgs/studio.json"));
-    compile(temp, true);
-    assert.equal(field(fs.readFileSync(path.join(temp, ".claude/agents/nccgs-adversarial-reviewer.md"), "utf8"), "maxTurns"), "63");
-    assert.equal(JSON.parse(fs.readFileSync(path.join(temp, ".claude/nccgs/studio.json"), "utf8")).agents.find(a => a.name === "nccgs-adversarial-reviewer").maxTurns, 63);
-  } finally {
-    assert.ok(path.resolve(temp).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-policy-test-"));
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("studio roles are unique and workflow references resolve", () => {
-  const roles = new Set(studio.agents.map((agent) => agent.name));
-  assert.equal(roles.size, studio.agents.length);
-  for (const workflow of workflows.workflows) {
-    for (const role of workflow.primaryRoles) assert.ok(roles.has(role), `${workflow.name}: ${role}`);
-  }
-});
-
-test("quality profile assigns all model classes", () => {
-  for (const agent of studio.agents) {
-    assert.ok(studio.modelProfiles.quality[agent.modelClass], agent.name);
-  }
-});
-
-test("optional specialists survive updates and can be disabled without changing core agents", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-optional-agents-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
-    const install = run("install");
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-    const role = "nccgs-network-programmer";
-    const file = path.join(temp, ".claude/agents", `${role}.md`);
-    assert.ok(!fs.existsSync(file));
-    assert.equal(run("agents", "--enable", role).status, 0);
-    assert.equal(field(fs.readFileSync(file, "utf8"), "model"), "opus");
-    const update = run("update");
-    assert.equal(update.status, 0, update.stderr || update.stdout);
-    assert.ok(fs.existsSync(file));
-    assert.equal(run("doctor").status, 0);
-    assert.equal(run("agents", "--disable", role).status, 0);
-    assert.ok(!fs.existsSync(file));
-    assert.notEqual(run("agents", "--disable", "nccgs-adversarial-reviewer").status, 0);
-    assert.equal(fs.readdirSync(path.join(temp, ".claude/agents")).length, pipeline.coreAgents.length);
-  } finally { fs.rmSync(temp, { recursive: true, force: true }); }
-});
-
-test("explicit Astra compatibility install retains Sonnet, pinned Opus and Fable routes without erasing settings", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-astra-install-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings", ".claude"]) fs.mkdirSync(path.join(temp, marker));
-    const settingsPath = path.join(temp, ".claude/settings.json");
-    fs.writeFileSync(settingsPath, JSON.stringify({ model: "sonnet", effortLevel: "medium", modelSettings: { "claude-opus-5-5": { effortLevel: "low" }, "claude-sonnet-4-6": { effortLevel: "medium" } }, permissions: { allow: ["Bash(git status*)"] }, env: { NCCGS_TEST: "preserved" } }));
-    const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
-    const dry = run("install", "--model-profile", "astra-claude", "--dry-run");
-    assert.equal(dry.status, 0, dry.stderr || dry.stdout);
-    assert.equal(JSON.parse(fs.readFileSync(settingsPath)).model, "sonnet");
-    assert.ok(!fs.existsSync(path.join(temp, ".claude/agents")));
-    const install = run("install", "--model-profile", "astra-claude");
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-    const settings = JSON.parse(fs.readFileSync(settingsPath));
-    assert.equal(settings.model, "claude-opus-5-5");
-    assert.equal(settings.effortLevel, "medium");
-    assert.equal(settings.modelSettings["claude-opus-5-5"].effortLevel, "medium");
-    assert.equal(settings.modelSettings["claude-sonnet-4-6"].effortLevel, "medium");
-    assert.equal(settings.env.NCCGS_TEST, "preserved");
-    assert.deepEqual(settings.permissions.allow, ["Bash(git status*)"]);
-    assert.deepEqual(pipeline.profiles["astra-claude"].models, adaptiveRoutes);
-    assert.equal(studio.agents.length, 47);
-    assert.equal(pipeline.coreAgents.length, 13);
-    assert.ok(pipeline.coreAgents.includes("nccgs-game-designer"), "Standalone design must be dispatchable on a default installation");
-    for (const agent of studio.agents) {
-      if (!pipeline.coreAgents.includes(agent.name)) {
-        assert.ok(!fs.existsSync(path.join(temp, ".claude/agents", `${agent.name}.md`)));
-        continue;
-      }
-      assertAgentRoute(temp, agent.name, adaptiveRoutes[agent.modelClass]);
-    }
-    const fast = assertAgentRoute(temp, "nccgs-fast-implementer", adaptiveRoutes.lightweight);
-    const scout = assertAgentRoute(temp, "nccgs-task-scout", adaptiveRoutes.lightweight);
-    assert.equal(field(fast, "maxTurns"), "12");
-    assert.equal(field(scout, "maxTurns"), "10");
-    assert.match(field(fast, "tools"), /\b(?:Write|Edit)\b/);
-    assert.doesNotMatch(field(scout, "tools"), /\b(?:Write|Edit|Bash|PowerShell|Agent|Task)\b/);
-    assert.match(field(scout, "tools"), /\bRead\b/);
-    assertAgentRoute(temp, "nccgs-unity-implementer", adaptiveRoutes.deep);
-    assertAgentRoute(temp, "nccgs-gameplay-programmer", adaptiveRoutes.standard);
-    assert.match(fs.readFileSync(path.join(temp, ".nccgs/project.yaml"), "utf8"), /profile: astra-claude/);
-    assert.ok(fs.existsSync(path.join(temp, ".nccgs/templates/implementation-report.md")));
-    const update = run("update");
-    assert.equal(update.status, 0, update.stderr || update.stdout);
-    assert.match(update.stdout, /0 preserved override/);
-    const doctor = run("doctor");
-    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("update migrates previous Opus xhigh routes while preserving customized agents", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-adaptive-upgrade-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
-    const install = run("install", "--model-profile", "astra-claude");
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-    const stateFile = path.join(temp, ".claude/nccgs/install-state.json");
-    const activationFile = path.join(temp, ".nccgs/agent-activation.json");
-    const state = JSON.parse(fs.readFileSync(stateFile, "utf8"));
-    const activation = JSON.parse(fs.readFileSync(activationFile, "utf8"));
-    const newAgents = ["nccgs-fast-implementer", "nccgs-task-scout"];
-    for (const name of pipeline.coreAgents) {
-      const relative = `.claude/agents/${name}.md`;
-      const file = path.join(temp, relative);
-      if (newAgents.includes(name)) {
-        // These roles were not present in the previous installed route set.
-        fs.unlinkSync(file);
-        state.files = state.files.filter(item => item.relative !== relative);
-        delete activation.generated[relative];
-        delete activation.generatedCanonical[relative];
-      } else if (name !== "nccgs-adversarial-reviewer") {
-        const previous = renderAgent(fs.readFileSync(file, "utf8"), { model: "claude-opus-5-5", effort: "xhigh" });
-        fs.writeFileSync(file, previous);
-        const managed = state.files.find(item => item.relative === relative);
-        managed.sha256 = sha256(previous);
-        delete managed.canonicalSha256;
-        activation.generated[relative] = sha256(previous);
-        activation.generatedCanonical[relative] = sha256(previous);
-      }
-    }
-    fs.writeFileSync(stateFile, JSON.stringify(state));
-    fs.writeFileSync(activationFile, JSON.stringify(activation));
-    const settingsFile = path.join(temp, ".claude/settings.json");
-    const settings = JSON.parse(fs.readFileSync(settingsFile));
-    settings.effortLevel = "xhigh";
-    settings.modelSettings["claude-opus-5-5"].effortLevel = "xhigh";
-    fs.writeFileSync(settingsFile, JSON.stringify(settings));
-    const customName = "nccgs-gameplay-programmer";
-    const customPath = `.claude/agents/${customName}.md`;
-    const customFile = path.join(temp, customPath);
-    const custom = fs.readFileSync(customFile, "utf8") + "\nProject rule: keep the local combat acceptance checklist.\n";
-    fs.writeFileSync(customFile, custom);
-
-    const update = run("update");
-    assert.equal(update.status, 0, update.stderr || update.stdout);
-    assert.equal(fs.readFileSync(customFile, "utf8"), custom);
-    for (const agent of studio.agents.filter(agent => pipeline.coreAgents.includes(agent.name) && agent.name !== customName)) {
-      assertAgentRoute(temp, agent.name, adaptiveRoutes[agent.modelClass]);
-    }
-    const configured = JSON.parse(fs.readFileSync(settingsFile));
-    assert.equal(configured.effortLevel, "medium");
-    assert.equal(configured.modelSettings["claude-opus-5-5"].effortLevel, "medium");
-    const manifest = JSON.parse(fs.readFileSync(path.join(temp, ".nccgs/framework-overrides.json")));
-    assert.equal(manifest.overrides.find(item => item.path === customPath)?.status, "pending_review");
-    assert.equal(JSON.parse(fs.readFileSync(stateFile)).modelProfile, "astra-claude");
-    assert.match(update.stdout, /Project migration required/);
-  } finally {
-    assert.ok(path.resolve(temp).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-adaptive-upgrade-"));
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("updates retain quality, balanced and inherit profiles and custom agent instructions", () => {
-  const legacyModels = {
-    quality: { lightweight: "haiku", standard: "sonnet", deep: "opus", leadership: "opus", review: "opus" },
-    balanced: { lightweight: "haiku", standard: "sonnet", deep: "opus", leadership: "sonnet", review: "opus" },
-    inherit: { lightweight: null, standard: null, deep: null, leadership: null, review: null }
-  };
-  for (const [profile, models] of Object.entries(legacyModels)) {
-    const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-legacy-routing-"));
-    try {
-      for (const marker of ["Assets", "Packages", "ProjectSettings", ".claude"]) fs.mkdirSync(path.join(temp, marker));
-      const settingsFile = path.join(temp, ".claude/settings.json");
-      fs.writeFileSync(settingsFile, JSON.stringify({ model: "sonnet", effortLevel: "high" }));
-      const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
-      const install = run("install", "--model-profile", profile);
-      assert.equal(install.status, 0, `${profile}: ${install.stderr || install.stdout}`);
-      const customName = "nccgs-gameplay-programmer";
-      const customFile = path.join(temp, ".claude/agents", `${customName}.md`);
-      const custom = fs.readFileSync(customFile, "utf8") + "\nProject rule: retain existing gameplay interfaces.\n";
-      fs.writeFileSync(customFile, custom);
-      const update = run("update");
-      assert.equal(update.status, 0, `${profile}: ${update.stderr || update.stdout}`);
-      assert.equal(fs.readFileSync(customFile, "utf8"), custom, profile);
-      const policy = fs.readFileSync(path.join(temp, ".nccgs/project.yaml"), "utf8");
-      assert.match(policy, new RegExp(`profile: ${profile}\\b`));
-      const state = JSON.parse(fs.readFileSync(path.join(temp, ".claude/nccgs/install-state.json")));
-      assert.equal(state.modelProfile, profile);
-      assert.equal(fs.readdirSync(path.join(temp, ".claude/agents")).length, studio.agents.length);
-      for (const agent of studio.agents.filter(agent => agent.name !== customName)) {
-        assertAgentRoute(temp, agent.name, { model: models[agent.modelClass], effort: null });
-      }
-      const settings = JSON.parse(fs.readFileSync(settingsFile));
-      assert.equal(settings.model, "sonnet");
-      assert.equal(settings.effortLevel, "high");
-    } finally {
-      assert.ok(path.resolve(temp).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-legacy-routing-"));
-      fs.rmSync(temp, { recursive: true, force: true });
-    }
-  }
-});
-
-test("profile changes clear effort pins and preserve skipped custom agents", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-effort-profile-"));
-  try {
-    fs.mkdirSync(path.join(temp, ".claude/nccgs"), { recursive: true });
-    fs.mkdirSync(path.join(temp, ".claude/agents"));
-    fs.mkdirSync(path.join(temp, ".nccgs"));
-    fs.copyFileSync(path.join(root, ".claude/nccgs/studio.json"), path.join(temp, ".claude/nccgs/studio.json"));
-    fs.writeFileSync(path.join(temp, ".nccgs/project.yaml"), "models:\n  profile: astra-claude\n");
-    copyAgentFixture(temp);
-    const run = (profile, ...args) => spawnSync(process.execPath, [path.join(root, ".claude/nccgs/tools/configure-models.mjs"), "--project", temp, "--profile", profile, ...args], { encoding: "utf8" });
-    for (const profile of ["inherit", "quality", "balanced", "astra-claude"]) {
-      const result = run(profile);
-      assert.equal(result.status, 0, result.stderr || result.stdout);
-      for (const agent of studio.agents) {
-        if (profile === "astra-claude" && !pipeline.coreAgents.includes(agent.name)) {
-          assert.ok(!fs.existsSync(path.join(temp, ".claude/agents", `${agent.name}.md`)));
-          continue;
-        }
-        const text = fs.readFileSync(path.join(temp, ".claude/agents", `${agent.name}.md`), "utf8");
-        assert.equal(text.match(/^model:\s*(\S+)/m)?.[1] ?? null, studio.modelProfiles[profile][agent.modelClass], agent.name);
-        const expectedEffort = pipeline.profiles[profile].models[agent.modelClass].effort;
-        assert.equal(text.match(/^effort:\s*(\S+)/m)?.[1] ?? null, expectedEffort, agent.name);
-      }
-    }
-    const file = path.join(temp, ".claude/agents/nccgs-adversarial-reviewer.md");
-    const before = fs.readFileSync(file, "utf8");
-    assert.equal(run("inherit", "--skip-path", ".claude/agents/nccgs-adversarial-reviewer.md").status, 0);
-    assert.equal(fs.readFileSync(file, "utf8"), before);
-    const invalid = run("unknown");
-    assert.notEqual(invalid.status, 0);
-    assert.equal(fs.readFileSync(file, "utf8"), before);
-    fs.writeFileSync(path.join(temp, ".claude/settings.json"), "invalid JSON");
-    assert.notEqual(run("astra-claude").status, 0);
-    assert.equal(fs.readFileSync(file, "utf8"), before);
-    const other = fs.readFileSync(path.join(temp, ".claude/agents/nccgs-unity-implementer.md"), "utf8");
-    assert.ok(!/^model:/m.test(other), "invalid settings must fail before rewriting agents");
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("migrate-project defaults to a single full run", () => {
-  const skill = fs.readFileSync(path.join(root, ".claude/skills/migrate-project/references/legacy.md"), "utf8");
-  assert.match(skill, /Default to `full`/);
-  assert.match(skill, /review, plan, apply, and verify in one invocation/i);
-});
-
-test("model configurator can remove and restore model pins", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-model-test-"));
-  try {
-    fs.mkdirSync(path.join(temp, ".claude/nccgs/tools"), { recursive: true });
-    fs.mkdirSync(path.join(temp, ".claude/agents"), { recursive: true });
-    fs.mkdirSync(path.join(temp, ".nccgs"), { recursive: true });
-    fs.copyFileSync(path.join(root, ".claude/nccgs/studio.json"), path.join(temp, ".claude/nccgs/studio.json"));
-    fs.copyFileSync(path.join(root, ".claude/nccgs/tools/configure-models.mjs"), path.join(temp, ".claude/nccgs/tools/configure-models.mjs"));
-    fs.writeFileSync(path.join(temp, ".nccgs/project.yaml"), "models:\n  profile: quality\n", "utf8");
-    copyAgentFixture(temp);
-    const tool = path.join(temp, ".claude/nccgs/tools/configure-models.mjs");
-    assert.equal(spawnSync(process.execPath, [tool, "--project", temp, "--profile", "inherit"]).status, 0);
-    assert.ok(!/^model:/m.test(fs.readFileSync(path.join(temp, ".claude/agents", `${studio.agents[0].name}.md`), "utf8")));
-    assert.equal(spawnSync(process.execPath, [tool, "--project", temp, "--profile", "quality"]).status, 0);
-    assert.ok(/^model:\s*(opus|sonnet|haiku)$/m.test(fs.readFileSync(path.join(temp, ".claude/agents", `${studio.agents[0].name}.md`), "utf8")));
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("destructive git commands are blocked by the managed hook", () => {
-  const hook = path.join(root, ".claude/nccgs/hooks/protect-git.mjs");
-  const result = spawnSync(process.execPath, [hook], {
-    cwd: root,
-    input: JSON.stringify({ tool_input: { command: "git reset --hard" } }),
-    encoding: "utf8"
-  });
-  assert.equal(result.status, 2);
-});
-
-test("installer dry-run accepts an empty Unity-shaped project", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-install-test-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    const result = spawnSync(process.execPath, [path.join(root, "scripts/install.mjs"), "--project", temp, "--dry-run"], { cwd: root, encoding: "utf8" });
-    assert.equal(result.status, 0, result.stderr || result.stdout);
-    assert.match(result.stdout, /Dry run complete/);
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("CLI installs into the current directory by default", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-cli-test-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    const result = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install", "--dry-run"], { cwd: temp, encoding: "utf8" });
-    assert.equal(result.status, 0, result.stderr || result.stdout);
-    assert.match(result.stdout, new RegExp(`NCCGS installation target: ${temp.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`));
-    assert.match(result.stdout, /Dry run complete/);
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("installer preserves project truth, merges settings, and applies inherit profile", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-upgrade-test-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    fs.mkdirSync(path.join(temp, ".nccgs"));
-    fs.mkdirSync(path.join(temp, ".claude"));
-    const legacyPolicy = "schema_version: 1\nownership:\n  protected_paths:\n    - Assets/HandTuned/**\n";
-    fs.writeFileSync(path.join(temp, ".nccgs/project.yaml"), legacyPolicy, "utf8");
-    fs.writeFileSync(path.join(temp, "CLAUDE.md"), "# Existing project instructions\n", "utf8");
-    fs.writeFileSync(path.join(temp, ".claude/settings.json"), JSON.stringify({ permissions: { allow: ["Bash(git status*)"] }, hooks: { Notification: [{ matcher: "", hooks: [{ type: "command", command: "custom-notify" }] }] } }, null, 2), "utf8");
-
-    const result = spawnSync(process.execPath, [path.join(root, "scripts/install.mjs"), "--project", temp, "--force", "--model-profile", "inherit"], { cwd: root, encoding: "utf8" });
-    assert.equal(result.status, 0, result.stderr || result.stdout);
-    assert.equal(fs.readFileSync(path.join(temp, ".nccgs/project.yaml"), "utf8"), legacyPolicy);
-    assert.ok(fs.existsSync(path.join(temp, ".nccgs/templates/repair-packet.json")));
-    assert.match(fs.readFileSync(path.join(temp, ".claude/nccgs/protocols/bounded-repair.md"), "utf8"), /task\.mjs dispatch-prompt/);
-    assert.match(fs.readFileSync(path.join(temp, ".claude/nccgs/protocols/standalone.md"), "utf8"), /\[bounded repair\]\(bounded-repair\.md\)/);
-    const settings = JSON.parse(fs.readFileSync(path.join(temp, ".claude/settings.json"), "utf8"));
-    assert.deepEqual(settings.permissions.allow, ["Bash(git status*)"]);
-    assert.ok(settings.permissions.deny.includes("Bash(git reset --hard*)"));
-    assert.ok(JSON.stringify(settings.hooks.Notification).includes("custom-notify"));
-    assert.ok(JSON.stringify(settings.hooks).includes(".claude/nccgs/hooks/session-start.mjs"));
-    assert.match(fs.readFileSync(path.join(temp, "CLAUDE.md"), "utf8"), /@\.claude\/nccgs\/constitution\.md/);
-    const firstAgent = path.join(temp, ".claude/agents", `${studio.agents[0].name}.md`);
-    assert.ok(!/^model:/m.test(fs.readFileSync(firstAgent, "utf8")));
-    assert.ok(fs.existsSync(path.join(temp, ".nccgs/backups")));
-    const installStatePath = path.join(temp, ".claude/nccgs/install-state.json");
-    const installState = JSON.parse(fs.readFileSync(installStatePath, "utf8"));
-    assert.equal(installState.frameworkVersion, frameworkVersion);
-    assert.equal(installState.modelProfile, "inherit");
-
-    const obsoleteRelative = ".claude/agents/nccgs-obsolete.md";
-    const obsoletePath = path.join(temp, ...obsoleteRelative.split("/"));
-    fs.writeFileSync(obsoletePath, "obsolete framework file\n", "utf8");
-    installState.files.push({ relative: obsoleteRelative, sha256: "recorded-by-previous-installer" });
-    fs.writeFileSync(installStatePath, `${JSON.stringify(installState, null, 2)}\n`, "utf8");
-    const upgrade = spawnSync(process.execPath, [path.join(root, "scripts/install.mjs"), "--project", temp, "--force", "--model-profile", "inherit"], { cwd: root, encoding: "utf8" });
-    assert.equal(upgrade.status, 0, upgrade.stderr || upgrade.stdout);
-    assert.ok(!fs.existsSync(obsoletePath));
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("update replaces untouched files, preserves local overrides, and doctor gates review", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-idempotent-update-test-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    const install = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install", "--model-profile", "quality"], { cwd: temp, encoding: "utf8" });
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-
-    const managedRelative = ".claude/nccgs/constitution.md";
-    const managedPath = path.join(temp, ...managedRelative.split("/"));
-    const statePath = path.join(temp, ".claude/nccgs/install-state.json");
-    const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
-    const oldManagedContent = "managed by NCCGS 1.0.0\n";
-    fs.writeFileSync(managedPath, oldManagedContent, "utf8");
-    state.frameworkVersion = "1.0.0";
-    state.files.find((item) => item.relative === managedRelative).sha256 = sha256(oldManagedContent);
-    fs.writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
-
-    const update = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
-    assert.equal(update.status, 0, update.stderr || update.stdout);
-    assert.match(update.stdout, new RegExp(`1\\.0\\.0 -> ${frameworkVersion.replace(/\./g, "\\.")}`));
-    assert.match(update.stdout, /automatic update/);
-    assert.match(update.stdout, /No project migration required/);
-    assert.equal(fs.readFileSync(managedPath, "utf8"), fs.readFileSync(path.join(root, managedRelative), "utf8"));
-
-    let doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
-    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
-    assert.match(doctor.stdout, /NCCGS doctor passed/);
-
-    fs.writeFileSync(managedPath, "project-local override\n", "utf8");
-    const preserved = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
-    assert.equal(preserved.status, 0, preserved.stderr || preserved.stdout);
-    assert.match(preserved.stdout, /preserved override/);
-    assert.match(preserved.stdout, /Project migration required/);
-    assert.equal(fs.readFileSync(managedPath, "utf8"), "project-local override\n");
-
-    const overridePath = path.join(temp, ".nccgs/framework-overrides.json");
-    const overrides = JSON.parse(fs.readFileSync(overridePath, "utf8"));
-    const override = overrides.overrides.find((item) => item.path === managedRelative);
-    assert.equal(override.status, "pending_review");
-    assert.equal(override.disposition, "preserve");
-
-    doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
-    assert.equal(doctor.status, 1);
-    assert.match(doctor.stderr, /awaits \/migrate-project review/);
-
-    const approve = spawnSync(process.execPath, [path.join(temp, ".claude/nccgs/tools/approve-overrides.mjs"), "--project", temp, "--approve-pending"], { cwd: temp, encoding: "utf8" });
-    assert.equal(approve.status, 0, approve.stderr || approve.stdout);
-    doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
-    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("update adopts unchanged generated agents newly tracked by the package, preserving real edits", () => {
-  const f = safetyFixture("nccgs-generated-adoption-");
-  try {
-    const installed = f.run("install", "--model-profile", "quality");
-    assert.equal(installed.status, 0, installed.stderr || installed.stdout);
-    const relative = ".claude/agents/nccgs-game-designer.md";
-    const file = path.join(f.project, relative);
-    const stateFile = path.join(f.project, ".claude/nccgs/install-state.json");
-    const generatedFile = path.join(f.project, ".nccgs/agent-activation.json");
-    const original = fs.readFileSync(file, "utf8");
-    // Older packages can generate a profile's optional agent without listing it
-    // in install-state.files. A later package can make that agent a core file.
-    const state = JSON.parse(fs.readFileSync(stateFile, "utf8"));
-    state.files = state.files.filter(item => item.relative !== relative);
-    fs.writeFileSync(stateFile, JSON.stringify(state));
-    const update = f.run("update");
-    assert.equal(update.status, 0, update.stderr || update.stdout);
-    const doctor = f.run("doctor");
-    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
-    assert.equal(fs.readFileSync(file, "utf8"), original);
-    assert.ok(JSON.parse(fs.readFileSync(stateFile)).files.some(item => item.relative === relative));
-
-    // A stored generated hash alone must never authorize replacing later edits.
-    const nextState = JSON.parse(fs.readFileSync(stateFile, "utf8"));
-    nextState.files = nextState.files.filter(item => item.relative !== relative);
-    fs.writeFileSync(stateFile, JSON.stringify(nextState));
-    assert.ok(JSON.parse(fs.readFileSync(generatedFile)).generated[relative]);
-    const customized = original + "\nOwner instruction: keep the custom design rule.\n";
-    fs.writeFileSync(file, customized);
-    const preserved = f.run("update");
-    assert.equal(preserved.status, 0, preserved.stderr || preserved.stdout);
-    assert.equal(fs.readFileSync(file, "utf8"), customized);
-    const manifest = JSON.parse(fs.readFileSync(path.join(f.project, ".nccgs/framework-overrides.json")));
-    assert.equal(manifest.overrides.find(item => item.path === relative).status, "pending_review");
-    assert.equal(f.run("doctor").status, 1);
-  } finally { f.dispose(); }
-});
-
-test("doctor accepts a legacy CRLF raw hash after Git normalizes the file to LF", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-eol-test-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    const install = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install"], { cwd: temp, encoding: "utf8" });
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-
-    const relative = ".claude/nccgs/constitution.md";
-    const file = path.join(temp, ...relative.split("/"));
-    const lf = fs.readFileSync(file, "utf8").replace(/\r\n?/g, "\n");
-    fs.writeFileSync(file, lf, "utf8");
-    const statePath = path.join(temp, ".claude/nccgs/install-state.json");
-    const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
-    const record = state.files.find((item) => item.relative === relative);
-    record.sha256 = sha256(lf.replace(/\n/g, "\r\n"));
-    delete record.canonicalSha256;
-    state.schemaVersion = 2;
-    fs.writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
-
-    const doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
-    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("update preserves an intentionally missing managed file until migration review", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-absent-override-test-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    const install = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install"], { cwd: temp, encoding: "utf8" });
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-
-    const relative = ".claude/skills/status/SKILL.md";
-    const file = path.join(temp, ...relative.split("/"));
-    fs.unlinkSync(file);
-    const update = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
-    assert.equal(update.status, 0, update.stderr || update.stdout);
-    assert.ok(!fs.existsSync(file));
-    const manifest = JSON.parse(fs.readFileSync(path.join(temp, ".nccgs/framework-overrides.json"), "utf8"));
-    const override = manifest.overrides.find((item) => item.path === relative);
-    assert.equal(override.disposition, "absent");
-    assert.equal(override.status, "pending_review");
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-test("update refuses a project without an NCCGS install state", () => {
-  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-update-missing-test-"));
-  try {
-    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
-    const result = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
-    assert.equal(result.status, 2);
-    assert.match(result.stderr, /not installed/);
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-});
-
-function safetyFixture(prefix) {
-  const container = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-  const project = path.join(container, "project");
-  fs.mkdirSync(project);
-  for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(project, marker));
-  const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: project, encoding: "utf8" });
-  return { container, project, run, dispose() {
-    const resolved = path.resolve(container);
-    assert.ok(resolved.startsWith(path.resolve(os.tmpdir()) + path.sep + prefix));
-    fs.rmSync(resolved, { recursive: true, force: true });
-  } };
-}
-
-test("portable managed paths reject Windows traversal, streams and device aliases", () => {
-  for (const relative of [".claude/..\\..\\sentinel.txt", ".claude/../sentinel.txt", ".claude//file", ".claude/./file", "C:/outside.txt", "//server/share/file",
-    ".claude/agents/file:stream", ".claude/agents/CON.md", ".claude/agents/NUL", ".claude/agents/COM1.log", ".claude/agents/LPT².txt", ".claude/agents/CONIN$", ".claude/agents/CONOUT$", ".claude/agents/CLOCK$", ".claude/agents/file.", ".claude/agents/file ", ".claude/agents/.. /file"]) {
-    assert.throws(() => assertRelativePath(relative), /Unsafe/, relative);
-  }
-  assert.equal(assertRelativePath(".claude/agents/nccgs-ui-programmer.md"), ".claude/agents/nccgs-ui-programmer.md");
-});
-
-test("installer rejects unsafe stale and override manifest paths before touching files", () => {
-  const f = safetyFixture("nccgs-path-state-");
-  try {
-    const install = f.run("install");
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-    const sentinel = path.join(f.container, "sentinel.txt");
-    fs.writeFileSync(sentinel, "outside remains untouched");
-    const settingsFile = path.join(f.project, ".claude/settings.json");
-    const settingsBefore = fs.readFileSync(settingsFile, "utf8");
-    const stateFile = path.join(f.project, ".claude/nccgs/install-state.json");
-    const original = JSON.parse(fs.readFileSync(stateFile));
-    for (const relative of [".claude/..\\..\\sentinel.txt", ".claude/../../sentinel.txt", ".claude/agents/file:stream", ".claude/agents/CON.txt", ".claude/agents/trailing."]) {
-      const malicious = { ...original, files: [...original.files, { relative, sha256: sha256("outside remains untouched") }] };
-      const before = JSON.stringify(malicious);
-      fs.writeFileSync(stateFile, before);
-      const update = f.run("update", "--force");
-      assert.equal(update.status, 2, `${relative}: ${update.stderr || update.stdout}`);
-      assert.match(update.stderr, /Unsafe/);
-      assert.equal(fs.readFileSync(sentinel, "utf8"), "outside remains untouched");
-      assert.equal(fs.readFileSync(stateFile, "utf8"), before, "rejection must happen before installer writes");
-      assert.equal(fs.readFileSync(settingsFile, "utf8"), settingsBefore);
-      assert.notEqual(f.run("doctor").status, 0);
-    }
-    fs.writeFileSync(stateFile, JSON.stringify(original));
-    fs.writeFileSync(path.join(f.project, ".nccgs/framework-overrides.json"), JSON.stringify({ schemaVersion: 1, overrides: [{ path: ".claude/..\\..\\sentinel.txt", disposition: "preserve", status: "approved" }] }));
-    const update = f.run("update", "--force");
-    assert.equal(update.status, 2, update.stderr || update.stdout);
-    assert.equal(fs.readFileSync(sentinel, "utf8"), "outside remains untouched");
-  } finally { f.dispose(); }
-});
-
-test("installer rejects directory junctions and dangling links across managed destinations", async t => {
-  for (const relative of [".claude", ".nccgs", ".claude/agents", ".nccgs/backups", ".nccgs/templates", ".claude/skills"]) {
-    await t.test(relative, child => {
-      const f = safetyFixture("nccgs-path-link-");
-      try {
-        const outside = path.join(f.container, "outside");
-        fs.mkdirSync(outside);
-        fs.writeFileSync(path.join(outside, "sentinel.txt"), "untouched");
-        const link = path.join(f.project, ...relative.split("/"));
-        fs.mkdirSync(path.dirname(link), { recursive: true });
-        // The skills case deliberately targets a path that does not exist.
-        const linkTarget = relative === ".claude/skills" ? path.join(outside, "missing") : outside;
-        try { fs.symlinkSync(linkTarget, link, process.platform === "win32" ? "junction" : "dir"); }
-        catch (error) { if (["EPERM", "EACCES", "ENOSYS"].includes(error.code)) { child.skip(`Links unavailable: ${error.code}`); return; } throw error; }
-        assert.throws(() => containedPath(f.project, `${relative}/target.txt`), /Symlink|junction|reparse/);
-        const install = f.run("install", "--force");
-        assert.equal(install.status, 2, install.stderr || install.stdout);
-        assert.match(install.stderr, /Symlink|junction|reparse/);
-        assert.deepEqual(fs.readdirSync(outside), ["sentinel.txt"]);
-        assert.equal(fs.readFileSync(path.join(outside, "sentinel.txt"), "utf8"), "untouched");
-      } finally { f.dispose(); }
-    });
-  }
-});
-
-test("installer rejects file links for shared settings, state, scaffold and CLAUDE targets", async t => {
-  for (const relative of ["CLAUDE.md", ".claude/settings.json", ".claude/nccgs/install-state.json", ".nccgs/project.yaml", ".nccgs/requirements.yaml", ".nccgs/agent-activation.json"]) {
-    await t.test(relative, child => {
-      const f = safetyFixture("nccgs-file-link-");
-      try {
-        const sentinel = path.join(f.container, "sentinel.txt");
-        fs.writeFileSync(sentinel, "outside remains untouched");
-        const link = path.join(f.project, ...relative.split("/"));
-        fs.mkdirSync(path.dirname(link), { recursive: true });
-        try { fs.symlinkSync(sentinel, link, "file"); }
-        catch (error) { if (["EPERM", "EACCES", "ENOSYS"].includes(error.code)) { child.skip(`File links unavailable: ${error.code}`); return; } throw error; }
-        const install = f.run("install", "--force");
-        assert.equal(install.status, 2, install.stderr || install.stdout);
-        assert.match(install.stderr, /Symlink|junction|reparse/);
-        assert.equal(fs.readFileSync(sentinel, "utf8"), "outside remains untouched");
-      } finally { f.dispose(); }
-    });
-  }
-});
-
-test("doctor checks managed hooks and session settings while preserving custom hooks", () => {
-  const f = safetyFixture("nccgs-settings-health-");
-  try {
-    const settingsFile = path.join(f.project, ".claude/settings.json");
-    fs.mkdirSync(path.dirname(settingsFile));
-    const customHook = { type: "command", command: "node custom-project-check.mjs" };
-    fs.writeFileSync(settingsFile, JSON.stringify({ hooks: { SessionStart: [{ matcher: "", hooks: [customHook, { type: "command", command: "node .claude/nccgs/hooks/session-start.mjs", timeout: 10 }] }] } }));
-    const install = f.run("install");
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-    const correct = JSON.parse(fs.readFileSync(settingsFile));
-    assert.ok(correct.hooks.SessionStart.some(group => group.hooks.some(hook => hook.command === customHook.command)), "custom hook sharing a managed group must survive");
-    assert.equal(f.run("doctor").status, 0);
-    const variations = [
-      [{}, /Required NCCGS hook|session model/],
-      [{ ...correct, hooks: { ...correct.hooks, PreToolUse: [] } }, /Required NCCGS hook/],
-      [{ ...correct, hooks: { ...correct.hooks, PreToolUse: [{ hooks: {} }] } }, /Required NCCGS hook/],
-      [{ ...correct, disableAllHooks: true }, /disable all hooks/],
-      [{ ...correct, model: "sonnet" }, /session model/],
-      [{ ...correct, effortLevel: "low" }, /session effort/],
-      [{ ...correct, modelSettings: {} }, /per-model effort/]
-    ];
-    for (const [settings, pattern] of variations) {
-      fs.writeFileSync(settingsFile, JSON.stringify(settings));
-      const doctor = f.run("doctor");
-      assert.equal(doctor.status, 1, doctor.stderr || doctor.stdout);
-      assert.match(doctor.stderr, pattern);
-    }
-    fs.writeFileSync(settingsFile, JSON.stringify(correct));
-    const localFile = path.join(f.project, ".claude/settings.local.json");
-    fs.writeFileSync(localFile, JSON.stringify({ hooks: { Notification: [{ hooks: [customHook] }] }, env: { PROJECT_TEST: "kept" } }));
-    const validLocal = f.run("doctor");
-    assert.equal(validLocal.status, 0, validLocal.stderr || validLocal.stdout);
-    assert.match(validLocal.stdout, /Settings scope: project settings/);
-    assert.match(validLocal.stderr, /Local Claude settings are present/);
-    fs.writeFileSync(localFile, JSON.stringify({ model: "sonnet" }));
-    const conflict = f.run("doctor");
-    assert.equal(conflict.status, 1);
-    assert.match(conflict.stderr, /Local settings override/);
-    const update = f.run("update");
-    assert.notEqual(update.status, 0, "a preserved conflicting local setting must not be declared healthy");
-    assert.equal(JSON.parse(fs.readFileSync(localFile)).model, "sonnet", "installer must preserve local settings");
-    assert.ok(JSON.parse(fs.readFileSync(settingsFile)).hooks.SessionStart.some(group => group.hooks.some(hook => hook.command === customHook.command)));
-    fs.unlinkSync(localFile);
-    const inputsFile = path.join(f.project, ".nccgs/inputs.json");
-    for (const inputs of [{ schemaVersion: 999 }, { schemaVersion: 1, canonicalInputs: [], outputDirectories: ["Assets"], checks: {} }]) {
-      fs.writeFileSync(inputsFile, JSON.stringify(inputs));
-      const doctor = f.run("doctor");
-      assert.equal(doctor.status, 1);
-      assert.match(doctor.stderr, /Invalid canonical input\/output policy/);
-    }
-  } finally { f.dispose(); }
-});
-
-test("doctor checks historical closure evidence without treating old approvals as current", () => {
-  const f = safetyFixture("nccgs-doctor-history-");
-  try {
-    const install = f.run("install");
-    assert.equal(install.status, 0, install.stderr || install.stdout);
-    const write = (relative, value) => {
-      const file = containedPath(f.project, relative);
-      fs.mkdirSync(path.dirname(file), { recursive: true });
-      const text = typeof value === "string" ? value : JSON.stringify(value);
-      fs.writeFileSync(file, text);
-      return { path: relative, sha256: sha256(text) };
-    };
-    const raw = write(".nccgs/evidence/runtime/sources/history.json", { fixture: "Synthetic historical evidence only" });
-    const runtime = write(".nccgs/evidence/runtime/observations/history.json", { observationSource: raw });
-    const log = write(".nccgs/evidence/history.log", "Synthetic historical check");
-    const execution = write(".nccgs/evidence/history-check.json", { origin: "verification-command", log });
-    const report = write(".nccgs/evidence/history-report.md", "Synthetic historical report");
-    write(".nccgs/tasks/history.json", { schemaVersion: 1, id: "history", closed: { snapshot: "historical-source" }, stages: {
-      implementation: { runtime, checks: [{ evidence: execution }] }, review: { runtime, evidence: report },
-      report: { evidence: report }, astra: { evidence: report }, acceptance: { snapshot: "historical-source", evidence: report }
-    } });
-    const historical = f.run("doctor");
-    assert.equal(historical.status, 0, historical.stderr || historical.stdout);
-    assert.match(historical.stderr, /predates canonical input pins/);
-    assert.match(historical.stderr, /cannot approve current work/);
-    write(raw.path, { fixture: "Changed raw evidence" });
-    const stale = f.run("doctor");
-    assert.equal(stale.status, 1);
-    assert.match(stale.stderr, /Invalid closed task history.json: Missing or stale artifact/);
-  } finally { f.dispose(); }
-});
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { compile, renderAgent } from "../.claude/nccgs/tools/compile-policy.mjs";
+import { assertRelativePath, containedPath } from "../.claude/nccgs/tools/paths.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const studio = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/studio.json"), "utf8"));
+const workflows = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/workflow-catalog.json"), "utf8"));
+const pipeline = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/pipeline.json"), "utf8"));
+function copyAgentFixture(temp) {
+  fs.cpSync(path.join(root, ".claude/nccgs"), path.join(temp, ".claude/nccgs"), { recursive: true });
+  fs.mkdirSync(path.join(temp, ".claude/agents"), { recursive: true });
+  for (const agent of studio.agents) {
+    const template = fs.readFileSync(path.join(root, ".claude/nccgs/agent-library", `${agent.name}.md`), "utf8");
+    fs.writeFileSync(path.join(temp, ".claude/agents", `${agent.name}.md`), renderAgent(template, pipeline.profiles[pipeline.defaultProfile].models[agent.modelClass]));
+  }
+}
+const frameworkVersion = fs.readFileSync(path.join(root, "VERSION"), "utf8").trim();
+const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const adaptiveRoutes = {
+  lightweight: { model: "sonnet", effort: "medium" },
+  standard: { model: "claude-opus-5-5", effort: "medium" },
+  deep: { model: "claude-opus-5-5", effort: "high" },
+  leadership: { model: "claude-opus-5-5", effort: "high" },
+  review: { model: "fable", effort: "high" }
+};
+const field = (text, name) => text.match(new RegExp(`^${name}:\\s*([^\\r\\n]+)`, "m"))?.[1]?.trim() ?? null;
+function assertAgentRoute(project, agentName, expected) {
+  const text = fs.readFileSync(path.join(project, ".claude/agents", `${agentName}.md`), "utf8");
+  assert.equal(field(text, "model"), expected.model, `${agentName} model`);
+  assert.equal(field(text, "effort"), expected.effort, `${agentName} effort`);
+  return text;
+}
+
+test("canonical policy changes invalidate generated routing until compilation", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-policy-test-"));
+  try {
+    copyAgentFixture(temp);
+    compile(temp, true);
+    assert.deepEqual(compile(temp), []);
+    const file = path.join(temp, ".claude/nccgs/pipeline.json");
+    const policy = JSON.parse(fs.readFileSync(file, "utf8"));
+    policy.profiles["claude-standalone"].models.review.effort = "medium";
+    fs.writeFileSync(file, JSON.stringify(policy));
+    const stale = compile(temp);
+    assert.ok(stale.includes(".claude/agents/nccgs-adversarial-reviewer.md"));
+    assert.ok(stale.includes(".claude/nccgs/workflow-catalog.json"));
+    compile(temp, true);
+    assert.deepEqual(compile(temp), []);
+    const catalog = JSON.parse(fs.readFileSync(path.join(temp, ".claude/nccgs/studio.json"), "utf8"));
+    assert.equal(catalog.effortProfiles["claude-standalone"].review, "medium");
+    const reviewerTemplate = path.join(temp, ".claude/nccgs/agent-library/nccgs-adversarial-reviewer.md");
+    fs.writeFileSync(reviewerTemplate, fs.readFileSync(reviewerTemplate, "utf8").replace(/^maxTurns: \d+/m, "maxTurns: 63"));
+    assert.ok(compile(temp).includes(".claude/nccgs/studio.json"));
+    compile(temp, true);
+    assert.equal(field(fs.readFileSync(path.join(temp, ".claude/agents/nccgs-adversarial-reviewer.md"), "utf8"), "maxTurns"), "63");
+    assert.equal(JSON.parse(fs.readFileSync(path.join(temp, ".claude/nccgs/studio.json"), "utf8")).agents.find(a => a.name === "nccgs-adversarial-reviewer").maxTurns, 63);
+  } finally {
+    assert.ok(path.resolve(temp).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-policy-test-"));
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("studio roles are unique and workflow references resolve", () => {
+  const roles = new Set(studio.agents.map((agent) => agent.name));
+  assert.equal(roles.size, studio.agents.length);
+  for (const workflow of workflows.workflows) {
+    for (const role of workflow.primaryRoles) assert.ok(roles.has(role), `${workflow.name}: ${role}`);
+  }
+});
+
+test("quality profile assigns all model classes", () => {
+  for (const agent of studio.agents) {
+    assert.ok(studio.modelProfiles.quality[agent.modelClass], agent.name);
+  }
+});
+
+test("optional specialists survive updates and can be disabled without changing core agents", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-optional-agents-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
+    const install = run("install");
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+    const role = "nccgs-network-programmer";
+    const file = path.join(temp, ".claude/agents", `${role}.md`);
+    assert.ok(!fs.existsSync(file));
+    assert.equal(run("agents", "--enable", role).status, 0);
+    assert.equal(field(fs.readFileSync(file, "utf8"), "model"), "opus");
+    const update = run("update");
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    assert.ok(fs.existsSync(file));
+    assert.equal(run("doctor").status, 0);
+    assert.equal(run("agents", "--disable", role).status, 0);
+    assert.ok(!fs.existsSync(file));
+    assert.notEqual(run("agents", "--disable", "nccgs-adversarial-reviewer").status, 0);
+    assert.equal(fs.readdirSync(path.join(temp, ".claude/agents")).length, pipeline.coreAgents.length);
+  } finally { fs.rmSync(temp, { recursive: true, force: true }); }
+});
+
+test("explicit Astra compatibility install retains Sonnet, pinned Opus and Fable routes without erasing settings", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-astra-install-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings", ".claude"]) fs.mkdirSync(path.join(temp, marker));
+    const settingsPath = path.join(temp, ".claude/settings.json");
+    fs.writeFileSync(settingsPath, JSON.stringify({ model: "sonnet", effortLevel: "medium", modelSettings: { "claude-opus-5-5": { effortLevel: "low" }, "claude-sonnet-4-6": { effortLevel: "medium" } }, permissions: { allow: ["Bash(git status*)"] }, env: { NCCGS_TEST: "preserved" } }));
+    const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
+    const dry = run("install", "--model-profile", "astra-claude", "--dry-run");
+    assert.equal(dry.status, 0, dry.stderr || dry.stdout);
+    assert.equal(JSON.parse(fs.readFileSync(settingsPath)).model, "sonnet");
+    assert.ok(!fs.existsSync(path.join(temp, ".claude/agents")));
+    const install = run("install", "--model-profile", "astra-claude");
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+    const settings = JSON.parse(fs.readFileSync(settingsPath));
+    assert.equal(settings.model, "claude-opus-5-5");
+    assert.equal(settings.effortLevel, "medium");
+    assert.equal(settings.modelSettings["claude-opus-5-5"].effortLevel, "medium");
+    assert.equal(settings.modelSettings["claude-sonnet-4-6"].effortLevel, "medium");
+    assert.equal(settings.env.NCCGS_TEST, "preserved");
+    assert.deepEqual(settings.permissions.allow, ["Bash(git status*)"]);
+    assert.deepEqual(pipeline.profiles["astra-claude"].models, adaptiveRoutes);
+    assert.equal(studio.agents.length, 47);
+    assert.equal(pipeline.coreAgents.length, 13);
+    assert.ok(pipeline.coreAgents.includes("nccgs-game-designer"), "Standalone design must be dispatchable on a default installation");
+    for (const agent of studio.agents) {
+      if (!pipeline.coreAgents.includes(agent.name)) {
+        assert.ok(!fs.existsSync(path.join(temp, ".claude/agents", `${agent.name}.md`)));
+        continue;
+      }
+      assertAgentRoute(temp, agent.name, adaptiveRoutes[agent.modelClass]);
+    }
+    const fast = assertAgentRoute(temp, "nccgs-fast-implementer", adaptiveRoutes.lightweight);
+    const scout = assertAgentRoute(temp, "nccgs-task-scout", adaptiveRoutes.lightweight);
+    assert.equal(field(fast, "maxTurns"), "12");
+    assert.equal(field(scout, "maxTurns"), "10");
+    assert.match(field(fast, "tools"), /\b(?:Write|Edit)\b/);
+    assert.doesNotMatch(field(scout, "tools"), /\b(?:Write|Edit|Bash|PowerShell|Agent|Task)\b/);
+    assert.match(field(scout, "tools"), /\bRead\b/);
+    assertAgentRoute(temp, "nccgs-unity-implementer", adaptiveRoutes.deep);
+    assertAgentRoute(temp, "nccgs-gameplay-programmer", adaptiveRoutes.standard);
+    assert.match(fs.readFileSync(path.join(temp, ".nccgs/project.yaml"), "utf8"), /profile: astra-claude/);
+    assert.ok(fs.existsSync(path.join(temp, ".nccgs/templates/implementation-report.md")));
+    const update = run("update");
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    assert.match(update.stdout, /0 preserved override/);
+    const doctor = run("doctor");
+    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("update migrates previous Opus xhigh routes while preserving customized agents", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-adaptive-upgrade-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
+    const install = run("install", "--model-profile", "astra-claude");
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+    const stateFile = path.join(temp, ".claude/nccgs/install-state.json");
+    const activationFile = path.join(temp, ".nccgs/agent-activation.json");
+    const state = JSON.parse(fs.readFileSync(stateFile, "utf8"));
+    const activation = JSON.parse(fs.readFileSync(activationFile, "utf8"));
+    const newAgents = ["nccgs-fast-implementer", "nccgs-task-scout"];
+    for (const name of pipeline.coreAgents) {
+      const relative = `.claude/agents/${name}.md`;
+      const file = path.join(temp, relative);
+      if (newAgents.includes(name)) {
+        // These roles were not present in the previous installed route set.
+        fs.unlinkSync(file);
+        state.files = state.files.filter(item => item.relative !== relative);
+        delete activation.generated[relative];
+        delete activation.generatedCanonical[relative];
+      } else if (name !== "nccgs-adversarial-reviewer") {
+        const previous = renderAgent(fs.readFileSync(file, "utf8"), { model: "claude-opus-5-5", effort: "xhigh" });
+        fs.writeFileSync(file, previous);
+        const managed = state.files.find(item => item.relative === relative);
+        managed.sha256 = sha256(previous);
+        delete managed.canonicalSha256;
+        activation.generated[relative] = sha256(previous);
+        activation.generatedCanonical[relative] = sha256(previous);
+      }
+    }
+    fs.writeFileSync(stateFile, JSON.stringify(state));
+    fs.writeFileSync(activationFile, JSON.stringify(activation));
+    const settingsFile = path.join(temp, ".claude/settings.json");
+    const settings = JSON.parse(fs.readFileSync(settingsFile));
+    settings.effortLevel = "xhigh";
+    settings.modelSettings["claude-opus-5-5"].effortLevel = "xhigh";
+    fs.writeFileSync(settingsFile, JSON.stringify(settings));
+    const customName = "nccgs-gameplay-programmer";
+    const customPath = `.claude/agents/${customName}.md`;
+    const customFile = path.join(temp, customPath);
+    const custom = fs.readFileSync(customFile, "utf8") + "\nProject rule: keep the local combat acceptance checklist.\n";
+    fs.writeFileSync(customFile, custom);
+
+    const update = run("update");
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    assert.equal(fs.readFileSync(customFile, "utf8"), custom);
+    for (const agent of studio.agents.filter(agent => pipeline.coreAgents.includes(agent.name) && agent.name !== customName)) {
+      assertAgentRoute(temp, agent.name, adaptiveRoutes[agent.modelClass]);
+    }
+    const configured = JSON.parse(fs.readFileSync(settingsFile));
+    assert.equal(configured.effortLevel, "medium");
+    assert.equal(configured.modelSettings["claude-opus-5-5"].effortLevel, "medium");
+    const manifest = JSON.parse(fs.readFileSync(path.join(temp, ".nccgs/framework-overrides.json")));
+    assert.equal(manifest.overrides.find(item => item.path === customPath)?.status, "pending_review");
+    assert.equal(JSON.parse(fs.readFileSync(stateFile)).modelProfile, "astra-claude");
+    assert.match(update.stdout, /Project migration required/);
+  } finally {
+    assert.ok(path.resolve(temp).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-adaptive-upgrade-"));
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("updates retain quality, balanced and inherit profiles and custom agent instructions", () => {
+  const legacyModels = {
+    quality: { lightweight: "haiku", standard: "sonnet", deep: "opus", leadership: "opus", review: "opus" },
+    balanced: { lightweight: "haiku", standard: "sonnet", deep: "opus", leadership: "sonnet", review: "opus" },
+    inherit: { lightweight: null, standard: null, deep: null, leadership: null, review: null }
+  };
+  for (const [profile, models] of Object.entries(legacyModels)) {
+    const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-legacy-routing-"));
+    try {
+      for (const marker of ["Assets", "Packages", "ProjectSettings", ".claude"]) fs.mkdirSync(path.join(temp, marker));
+      const settingsFile = path.join(temp, ".claude/settings.json");
+      fs.writeFileSync(settingsFile, JSON.stringify({ model: "sonnet", effortLevel: "high" }));
+      const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
+      const install = run("install", "--model-profile", profile);
+      assert.equal(install.status, 0, `${profile}: ${install.stderr || install.stdout}`);
+      const customName = "nccgs-gameplay-programmer";
+      const customFile = path.join(temp, ".claude/agents", `${customName}.md`);
+      const custom = fs.readFileSync(customFile, "utf8") + "\nProject rule: retain existing gameplay interfaces.\n";
+      fs.writeFileSync(customFile, custom);
+      const update = run("update");
+      assert.equal(update.status, 0, `${profile}: ${update.stderr || update.stdout}`);
+      assert.equal(fs.readFileSync(customFile, "utf8"), custom, profile);
+      const policy = fs.readFileSync(path.join(temp, ".nccgs/project.yaml"), "utf8");
+      assert.match(policy, new RegExp(`profile: ${profile}\\b`));
+      const state = JSON.parse(fs.readFileSync(path.join(temp, ".claude/nccgs/install-state.json")));
+      assert.equal(state.modelProfile, profile);
+      assert.equal(fs.readdirSync(path.join(temp, ".claude/agents")).length, studio.agents.length);
+      for (const agent of studio.agents.filter(agent => agent.name !== customName)) {
+        assertAgentRoute(temp, agent.name, { model: models[agent.modelClass], effort: null });
+      }
+      const settings = JSON.parse(fs.readFileSync(settingsFile));
+      assert.equal(settings.model, "sonnet");
+      assert.equal(settings.effortLevel, "high");
+    } finally {
+      assert.ok(path.resolve(temp).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-legacy-routing-"));
+      fs.rmSync(temp, { recursive: true, force: true });
+    }
+  }
+});
+
+test("profile changes clear effort pins and preserve skipped custom agents", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-effort-profile-"));
+  try {
+    fs.mkdirSync(path.join(temp, ".claude/nccgs"), { recursive: true });
+    fs.mkdirSync(path.join(temp, ".claude/agents"));
+    fs.mkdirSync(path.join(temp, ".nccgs"));
+    fs.copyFileSync(path.join(root, ".claude/nccgs/studio.json"), path.join(temp, ".claude/nccgs/studio.json"));
+    fs.writeFileSync(path.join(temp, ".nccgs/project.yaml"), "models:\n  profile: astra-claude\n");
+    copyAgentFixture(temp);
+    const run = (profile, ...args) => spawnSync(process.execPath, [path.join(root, ".claude/nccgs/tools/configure-models.mjs"), "--project", temp, "--profile", profile, ...args], { encoding: "utf8" });
+    for (const profile of ["inherit", "quality", "balanced", "astra-claude"]) {
+      const result = run(profile);
+      assert.equal(result.status, 0, result.stderr || result.stdout);
+      for (const agent of studio.agents) {
+        if (profile === "astra-claude" && !pipeline.coreAgents.includes(agent.name)) {
+          assert.ok(!fs.existsSync(path.join(temp, ".claude/agents", `${agent.name}.md`)));
+          continue;
+        }
+        const text = fs.readFileSync(path.join(temp, ".claude/agents", `${agent.name}.md`), "utf8");
+        assert.equal(text.match(/^model:\s*(\S+)/m)?.[1] ?? null, studio.modelProfiles[profile][agent.modelClass], agent.name);
+        const expectedEffort = pipeline.profiles[profile].models[agent.modelClass].effort;
+        assert.equal(text.match(/^effort:\s*(\S+)/m)?.[1] ?? null, expectedEffort, agent.name);
+      }
+    }
+    const file = path.join(temp, ".claude/agents/nccgs-adversarial-reviewer.md");
+    const before = fs.readFileSync(file, "utf8");
+    assert.equal(run("inherit", "--skip-path", ".claude/agents/nccgs-adversarial-reviewer.md").status, 0);
+    assert.equal(fs.readFileSync(file, "utf8"), before);
+    const invalid = run("unknown");
+    assert.notEqual(invalid.status, 0);
+    assert.equal(fs.readFileSync(file, "utf8"), before);
+    fs.writeFileSync(path.join(temp, ".claude/settings.json"), "invalid JSON");
+    assert.notEqual(run("astra-claude").status, 0);
+    assert.equal(fs.readFileSync(file, "utf8"), before);
+    const other = fs.readFileSync(path.join(temp, ".claude/agents/nccgs-unity-implementer.md"), "utf8");
+    assert.ok(!/^model:/m.test(other), "invalid settings must fail before rewriting agents");
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("migrate-project defaults to a single full run", () => {
+  const skill = fs.readFileSync(path.join(root, ".claude/skills/migrate-project/references/legacy.md"), "utf8");
+  assert.match(skill, /Default to `full`/);
+  assert.match(skill, /review, plan, apply, and verify in one invocation/i);
+});
+
+test("model configurator can remove and restore model pins", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-model-test-"));
+  try {
+    fs.mkdirSync(path.join(temp, ".claude/nccgs/tools"), { recursive: true });
+    fs.mkdirSync(path.join(temp, ".claude/agents"), { recursive: true });
+    fs.mkdirSync(path.join(temp, ".nccgs"), { recursive: true });
+    fs.copyFileSync(path.join(root, ".claude/nccgs/studio.json"), path.join(temp, ".claude/nccgs/studio.json"));
+    fs.copyFileSync(path.join(root, ".claude/nccgs/tools/configure-models.mjs"), path.join(temp, ".claude/nccgs/tools/configure-models.mjs"));
+    fs.writeFileSync(path.join(temp, ".nccgs/project.yaml"), "models:\n  profile: quality\n", "utf8");
+    copyAgentFixture(temp);
+    const tool = path.join(temp, ".claude/nccgs/tools/configure-models.mjs");
+    assert.equal(spawnSync(process.execPath, [tool, "--project", temp, "--profile", "inherit"]).status, 0);
+    assert.ok(!/^model:/m.test(fs.readFileSync(path.join(temp, ".claude/agents", `${studio.agents[0].name}.md`), "utf8")));
+    assert.equal(spawnSync(process.execPath, [tool, "--project", temp, "--profile", "quality"]).status, 0);
+    assert.ok(/^model:\s*(opus|sonnet|haiku)$/m.test(fs.readFileSync(path.join(temp, ".claude/agents", `${studio.agents[0].name}.md`), "utf8")));
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("destructive git commands are blocked by the managed hook", () => {
+  const hook = path.join(root, ".claude/nccgs/hooks/protect-git.mjs");
+  const result = spawnSync(process.execPath, [hook], {
+    cwd: root,
+    input: JSON.stringify({ tool_input: { command: "git reset --hard" } }),
+    encoding: "utf8"
+  });
+  assert.equal(result.status, 2);
+});
+
+test("installer dry-run accepts an empty Unity-shaped project", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-install-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const result = spawnSync(process.execPath, [path.join(root, "scripts/install.mjs"), "--project", temp, "--dry-run"], { cwd: root, encoding: "utf8" });
+    assert.equal(result.status, 0, result.stderr || result.stdout);
+    assert.match(result.stdout, /Dry run complete/);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("CLI installs into the current directory by default", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-cli-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const result = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install", "--dry-run"], { cwd: temp, encoding: "utf8" });
+    assert.equal(result.status, 0, result.stderr || result.stdout);
+    assert.match(result.stdout, new RegExp(`NCCGS installation target: ${temp.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`));
+    assert.match(result.stdout, /Dry run complete/);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("installer preserves project truth, merges settings, and applies inherit profile", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-upgrade-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    fs.mkdirSync(path.join(temp, ".nccgs"));
+    fs.mkdirSync(path.join(temp, ".claude"));
+    const legacyPolicy = "schema_version: 1\nownership:\n  protected_paths:\n    - Assets/HandTuned/**\n";
+    fs.writeFileSync(path.join(temp, ".nccgs/project.yaml"), legacyPolicy, "utf8");
+    fs.writeFileSync(path.join(temp, "CLAUDE.md"), "# Existing project instructions\n", "utf8");
+    fs.writeFileSync(path.join(temp, ".claude/settings.json"), JSON.stringify({ permissions: { allow: ["Bash(git status*)"] }, hooks: { Notification: [{ matcher: "", hooks: [{ type: "command", command: "custom-notify" }] }] } }, null, 2), "utf8");
+
+    const result = spawnSync(process.execPath, [path.join(root, "scripts/install.mjs"), "--project", temp, "--force", "--model-profile", "inherit"], { cwd: root, encoding: "utf8" });
+    assert.equal(result.status, 0, result.stderr || result.stdout);
+    assert.equal(fs.readFileSync(path.join(temp, ".nccgs/project.yaml"), "utf8"), legacyPolicy);
+    assert.ok(fs.existsSync(path.join(temp, ".nccgs/templates/repair-packet.json")));
+    assert.match(fs.readFileSync(path.join(temp, ".claude/nccgs/protocols/bounded-repair.md"), "utf8"), /task\.mjs dispatch-prompt/);
+    assert.match(fs.readFileSync(path.join(temp, ".claude/nccgs/protocols/standalone.md"), "utf8"), /\[bounded repair\]\(bounded-repair\.md\)/);
+    const settings = JSON.parse(fs.readFileSync(path.join(temp, ".claude/settings.json"), "utf8"));
+    assert.deepEqual(settings.permissions.allow, ["Bash(git status*)"]);
+    assert.ok(settings.permissions.deny.includes("Bash(git reset --hard*)"));
+    assert.ok(JSON.stringify(settings.hooks.Notification).includes("custom-notify"));
+    assert.ok(JSON.stringify(settings.hooks).includes(".claude/nccgs/hooks/session-start.mjs"));
+    assert.match(fs.readFileSync(path.join(temp, "CLAUDE.md"), "utf8"), /@\.claude\/nccgs\/constitution\.md/);
+    const firstAgent = path.join(temp, ".claude/agents", `${studio.agents[0].name}.md`);
+    assert.ok(!/^model:/m.test(fs.readFileSync(firstAgent, "utf8")));
+    assert.ok(fs.existsSync(path.join(temp, ".nccgs/backups")));
+    const installStatePath = path.join(temp, ".claude/nccgs/install-state.json");
+    const installState = JSON.parse(fs.readFileSync(installStatePath, "utf8"));
+    assert.equal(installState.frameworkVersion, frameworkVersion);
+    assert.equal(installState.modelProfile, "inherit");
+
+    const obsoleteRelative = ".claude/agents/nccgs-obsolete.md";
+    const obsoletePath = path.join(temp, ...obsoleteRelative.split("/"));
+    fs.writeFileSync(obsoletePath, "obsolete framework file\n", "utf8");
+    installState.files.push({ relative: obsoleteRelative, sha256: "recorded-by-previous-installer" });
+    fs.writeFileSync(installStatePath, `${JSON.stringify(installState, null, 2)}\n`, "utf8");
+    const upgrade = spawnSync(process.execPath, [path.join(root, "scripts/install.mjs"), "--project", temp, "--force", "--model-profile", "inherit"], { cwd: root, encoding: "utf8" });
+    assert.equal(upgrade.status, 0, upgrade.stderr || upgrade.stdout);
+    assert.ok(!fs.existsSync(obsoletePath));
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("update replaces untouched files, preserves local overrides, and doctor gates review", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-idempotent-update-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const install = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install", "--model-profile", "quality"], { cwd: temp, encoding: "utf8" });
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+
+    const managedRelative = ".claude/nccgs/constitution.md";
+    const managedPath = path.join(temp, ...managedRelative.split("/"));
+    const statePath = path.join(temp, ".claude/nccgs/install-state.json");
+    const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+    const oldManagedContent = "managed by NCCGS 1.0.0\n";
+    fs.writeFileSync(managedPath, oldManagedContent, "utf8");
+    state.frameworkVersion = "1.0.0";
+    state.files.find((item) => item.relative === managedRelative).sha256 = sha256(oldManagedContent);
+    fs.writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+
+    const update = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    assert.match(update.stdout, new RegExp(`1\\.0\\.0 -> ${frameworkVersion.replace(/\./g, "\\.")}`));
+    assert.match(update.stdout, /automatic update/);
+    assert.match(update.stdout, /No project migration required/);
+    assert.equal(fs.readFileSync(managedPath, "utf8"), fs.readFileSync(path.join(root, managedRelative), "utf8"));
+
+    let doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
+    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
+    assert.match(doctor.stdout, /NCCGS doctor passed/);
+
+    fs.writeFileSync(managedPath, "project-local override\n", "utf8");
+    const preserved = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
+    assert.equal(preserved.status, 0, preserved.stderr || preserved.stdout);
+    assert.match(preserved.stdout, /preserved override/);
+    assert.match(preserved.stdout, /Project migration required/);
+    assert.equal(fs.readFileSync(managedPath, "utf8"), "project-local override\n");
+
+    const overridePath = path.join(temp, ".nccgs/framework-overrides.json");
+    const overrides = JSON.parse(fs.readFileSync(overridePath, "utf8"));
+    const override = overrides.overrides.find((item) => item.path === managedRelative);
+    assert.equal(override.status, "pending_review");
+    assert.equal(override.disposition, "preserve");
+
+    doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
+    assert.equal(doctor.status, 1);
+    assert.match(doctor.stderr, /awaits \/migrate-project review/);
+
+    const approve = spawnSync(process.execPath, [path.join(temp, ".claude/nccgs/tools/approve-overrides.mjs"), "--project", temp, "--approve-pending"], { cwd: temp, encoding: "utf8" });
+    assert.equal(approve.status, 0, approve.stderr || approve.stdout);
+    doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
+    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("update adopts unchanged generated agents newly tracked by the package, preserving real edits", () => {
+  const f = safetyFixture("nccgs-generated-adoption-");
+  try {
+    const installed = f.run("install", "--model-profile", "quality");
+    assert.equal(installed.status, 0, installed.stderr || installed.stdout);
+    const relative = ".claude/agents/nccgs-game-designer.md";
+    const file = path.join(f.project, relative);
+    const stateFile = path.join(f.project, ".claude/nccgs/install-state.json");
+    const generatedFile = path.join(f.project, ".nccgs/agent-activation.json");
+    const original = fs.readFileSync(file, "utf8");
+    // Older packages can generate a profile's optional agent without listing it
+    // in install-state.files. A later package can make that agent a core file.
+    const state = JSON.parse(fs.readFileSync(stateFile, "utf8"));
+    state.files = state.files.filter(item => item.relative !== relative);
+    fs.writeFileSync(stateFile, JSON.stringify(state));
+    const update = f.run("update");
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    const doctor = f.run("doctor");
+    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
+    assert.equal(fs.readFileSync(file, "utf8"), original);
+    assert.ok(JSON.parse(fs.readFileSync(stateFile)).files.some(item => item.relative === relative));
+
+    // A stored generated hash alone must never authorize replacing later edits.
+    const nextState = JSON.parse(fs.readFileSync(stateFile, "utf8"));
+    nextState.files = nextState.files.filter(item => item.relative !== relative);
+    fs.writeFileSync(stateFile, JSON.stringify(nextState));
+    assert.ok(JSON.parse(fs.readFileSync(generatedFile)).generated[relative]);
+    const customized = original + "\nOwner instruction: keep the custom design rule.\n";
+    fs.writeFileSync(file, customized);
+    const preserved = f.run("update");
+    assert.equal(preserved.status, 0, preserved.stderr || preserved.stdout);
+    assert.equal(fs.readFileSync(file, "utf8"), customized);
+    const manifest = JSON.parse(fs.readFileSync(path.join(f.project, ".nccgs/framework-overrides.json")));
+    assert.equal(manifest.overrides.find(item => item.path === relative).status, "pending_review");
+    assert.equal(f.run("doctor").status, 1);
+  } finally { f.dispose(); }
+});
+
+test("doctor accepts a legacy CRLF raw hash after Git normalizes the file to LF", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-eol-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const install = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install"], { cwd: temp, encoding: "utf8" });
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+
+    const relative = ".claude/nccgs/constitution.md";
+    const file = path.join(temp, ...relative.split("/"));
+    const lf = fs.readFileSync(file, "utf8").replace(/\r\n?/g, "\n");
+    fs.writeFileSync(file, lf, "utf8");
+    const statePath = path.join(temp, ".claude/nccgs/install-state.json");
+    const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+    const record = state.files.find((item) => item.relative === relative);
+    record.sha256 = sha256(lf.replace(/\n/g, "\r\n"));
+    delete record.canonicalSha256;
+    state.schemaVersion = 2;
+    fs.writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+
+    const doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
+    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("update preserves an intentionally missing managed file until migration review", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-absent-override-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const install = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install"], { cwd: temp, encoding: "utf8" });
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+
+    const relative = ".claude/skills/status/SKILL.md";
+    const file = path.join(temp, ...relative.split("/"));
+    fs.unlinkSync(file);
+    const update = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    assert.ok(!fs.existsSync(file));
+    const manifest = JSON.parse(fs.readFileSync(path.join(temp, ".nccgs/framework-overrides.json"), "utf8"));
+    const override = manifest.overrides.find((item) => item.path === relative);
+    assert.equal(override.disposition, "absent");
+    assert.equal(override.status, "pending_review");
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("update refuses a project without an NCCGS install state", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-update-missing-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const result = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
+    assert.equal(result.status, 2);
+    assert.match(result.stderr, /not installed/);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+function safetyFixture(prefix) {
+  const container = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  const project = path.join(container, "project");
+  fs.mkdirSync(project);
+  for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(project, marker));
+  const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: project, encoding: "utf8" });
+  return { container, project, run, dispose() {
+    const resolved = path.resolve(container);
+    assert.ok(resolved.startsWith(path.resolve(os.tmpdir()) + path.sep + prefix));
+    fs.rmSync(resolved, { recursive: true, force: true });
+  } };
+}
+
+test("portable managed paths reject Windows traversal, streams and device aliases", () => {
+  for (const relative of [".claude/..\\..\\sentinel.txt", ".claude/../sentinel.txt", ".claude//file", ".claude/./file", "C:/outside.txt", "//server/share/file",
+    ".claude/agents/file:stream", ".claude/agents/CON.md", ".claude/agents/NUL", ".claude/agents/COM1.log", ".claude/agents/LPT².txt", ".claude/agents/CONIN$", ".claude/agents/CONOUT$", ".claude/agents/CLOCK$", ".claude/agents/file.", ".claude/agents/file ", ".claude/agents/.. /file"]) {
+    assert.throws(() => assertRelativePath(relative), /Unsafe/, relative);
+  }
+  assert.equal(assertRelativePath(".claude/agents/nccgs-ui-programmer.md"), ".claude/agents/nccgs-ui-programmer.md");
+});
+
+test("installer rejects unsafe stale and override manifest paths before touching files", () => {
+  const f = safetyFixture("nccgs-path-state-");
+  try {
+    const install = f.run("install");
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+    const sentinel = path.join(f.container, "sentinel.txt");
+    fs.writeFileSync(sentinel, "outside remains untouched");
+    const settingsFile = path.join(f.project, ".claude/settings.json");
+    const settingsBefore = fs.readFileSync(settingsFile, "utf8");
+    const stateFile = path.join(f.project, ".claude/nccgs/install-state.json");
+    const original = JSON.parse(fs.readFileSync(stateFile));
+    for (const relative of [".claude/..\\..\\sentinel.txt", ".claude/../../sentinel.txt", ".claude/agents/file:stream", ".claude/agents/CON.txt", ".claude/agents/trailing."]) {
+      const malicious = { ...original, files: [...original.files, { relative, sha256: sha256("outside remains untouched") }] };
+      const before = JSON.stringify(malicious);
+      fs.writeFileSync(stateFile, before);
+      const update = f.run("update", "--force");
+      assert.equal(update.status, 2, `${relative}: ${update.stderr || update.stdout}`);
+      assert.match(update.stderr, /Unsafe/);
+      assert.equal(fs.readFileSync(sentinel, "utf8"), "outside remains untouched");
+      assert.equal(fs.readFileSync(stateFile, "utf8"), before, "rejection must happen before installer writes");
+      assert.equal(fs.readFileSync(settingsFile, "utf8"), settingsBefore);
+      assert.notEqual(f.run("doctor").status, 0);
+    }
+    fs.writeFileSync(stateFile, JSON.stringify(original));
+    fs.writeFileSync(path.join(f.project, ".nccgs/framework-overrides.json"), JSON.stringify({ schemaVersion: 1, overrides: [{ path: ".claude/..\\..\\sentinel.txt", disposition: "preserve", status: "approved" }] }));
+    const update = f.run("update", "--force");
+    assert.equal(update.status, 2, update.stderr || update.stdout);
+    assert.equal(fs.readFileSync(sentinel, "utf8"), "outside remains untouched");
+  } finally { f.dispose(); }
+});
+
+test("installer rejects directory junctions and dangling links across managed destinations", async t => {
+  for (const relative of [".claude", ".nccgs", ".claude/agents", ".nccgs/backups", ".nccgs/templates", ".claude/skills"]) {
+    await t.test(relative, child => {
+      const f = safetyFixture("nccgs-path-link-");
+      try {
+        const outside = path.join(f.container, "outside");
+        fs.mkdirSync(outside);
+        fs.writeFileSync(path.join(outside, "sentinel.txt"), "untouched");
+        const link = path.join(f.project, ...relative.split("/"));
+        fs.mkdirSync(path.dirname(link), { recursive: true });
+        // The skills case deliberately targets a path that does not exist.
+        const linkTarget = relative === ".claude/skills" ? path.join(outside, "missing") : outside;
+        try { fs.symlinkSync(linkTarget, link, process.platform === "win32" ? "junction" : "dir"); }
+        catch (error) { if (["EPERM", "EACCES", "ENOSYS"].includes(error.code) || (process.platform === "win32" && relative === ".claude/skills" && error.code === "ENOENT" && !fs.existsSync(linkTarget))) { child.skip(`Link fixture unavailable on this host: ${error.code}`); return; } throw error; }
+        assert.throws(() => containedPath(f.project, `${relative}/target.txt`), /Symlink|junction|reparse/);
+        const install = f.run("install", "--force");
+        assert.equal(install.status, 2, install.stderr || install.stdout);
+        assert.match(install.stderr, /Symlink|junction|reparse/);
+        assert.deepEqual(fs.readdirSync(outside), ["sentinel.txt"]);
+        assert.equal(fs.readFileSync(path.join(outside, "sentinel.txt"), "utf8"), "untouched");
+      } finally { f.dispose(); }
+    });
+  }
+});
+
+test("installer rejects file links for shared settings, state, scaffold and CLAUDE targets", async t => {
+  for (const relative of ["CLAUDE.md", ".claude/settings.json", ".claude/nccgs/install-state.json", ".nccgs/project.yaml", ".nccgs/requirements.yaml", ".nccgs/agent-activation.json"]) {
+    await t.test(relative, child => {
+      const f = safetyFixture("nccgs-file-link-");
+      try {
+        const sentinel = path.join(f.container, "sentinel.txt");
+        fs.writeFileSync(sentinel, "outside remains untouched");
+        const link = path.join(f.project, ...relative.split("/"));
+        fs.mkdirSync(path.dirname(link), { recursive: true });
+        try { fs.symlinkSync(sentinel, link, "file"); }
+        catch (error) { if (["EPERM", "EACCES", "ENOSYS"].includes(error.code)) { child.skip(`File links unavailable: ${error.code}`); return; } throw error; }
+        const install = f.run("install", "--force");
+        assert.equal(install.status, 2, install.stderr || install.stdout);
+        assert.match(install.stderr, /Symlink|junction|reparse/);
+        assert.equal(fs.readFileSync(sentinel, "utf8"), "outside remains untouched");
+      } finally { f.dispose(); }
+    });
+  }
+});
+
+test("doctor checks managed hooks and session settings while preserving custom hooks", () => {
+  const f = safetyFixture("nccgs-settings-health-");
+  try {
+    const settingsFile = path.join(f.project, ".claude/settings.json");
+    fs.mkdirSync(path.dirname(settingsFile));
+    const customHook = { type: "command", command: "node custom-project-check.mjs" };
+    fs.writeFileSync(settingsFile, JSON.stringify({ hooks: { SessionStart: [{ matcher: "", hooks: [customHook, { type: "command", command: "node .claude/nccgs/hooks/session-start.mjs", timeout: 10 }] }] } }));
+    const install = f.run("install");
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+    const correct = JSON.parse(fs.readFileSync(settingsFile));
+    assert.ok(correct.hooks.SessionStart.some(group => group.hooks.some(hook => hook.command === customHook.command)), "custom hook sharing a managed group must survive");
+    assert.equal(f.run("doctor").status, 0);
+    const variations = [
+      [{}, /Required NCCGS hook|session model/],
+      [{ ...correct, hooks: { ...correct.hooks, PreToolUse: [] } }, /Required NCCGS hook/],
+      [{ ...correct, hooks: { ...correct.hooks, PreToolUse: [{ hooks: {} }] } }, /Required NCCGS hook/],
+      [{ ...correct, disableAllHooks: true }, /disable all hooks/],
+      [{ ...correct, model: "sonnet" }, /session model/],
+      [{ ...correct, effortLevel: "low" }, /session effort/],
+      [{ ...correct, modelSettings: {} }, /per-model effort/]
+    ];
+    for (const [settings, pattern] of variations) {
+      fs.writeFileSync(settingsFile, JSON.stringify(settings));
+      const doctor = f.run("doctor");
+      assert.equal(doctor.status, 1, doctor.stderr || doctor.stdout);
+      assert.match(doctor.stderr, pattern);
+    }
+    fs.writeFileSync(settingsFile, JSON.stringify(correct));
+    const localFile = path.join(f.project, ".claude/settings.local.json");
+    fs.writeFileSync(localFile, JSON.stringify({ hooks: { Notification: [{ hooks: [customHook] }] }, env: { PROJECT_TEST: "kept" } }));
+    const validLocal = f.run("doctor");
+    assert.equal(validLocal.status, 0, validLocal.stderr || validLocal.stdout);
+    assert.match(validLocal.stdout, /Settings scope: project settings/);
+    assert.match(validLocal.stderr, /Local Claude settings are present/);
+    fs.writeFileSync(localFile, JSON.stringify({ model: "sonnet" }));
+    const conflict = f.run("doctor");
+    assert.equal(conflict.status, 1);
+    assert.match(conflict.stderr, /Local settings override/);
+    const update = f.run("update");
+    assert.notEqual(update.status, 0, "a preserved conflicting local setting must not be declared healthy");
+    assert.equal(JSON.parse(fs.readFileSync(localFile)).model, "sonnet", "installer must preserve local settings");
+    assert.ok(JSON.parse(fs.readFileSync(settingsFile)).hooks.SessionStart.some(group => group.hooks.some(hook => hook.command === customHook.command)));
+    fs.unlinkSync(localFile);
+    const inputsFile = path.join(f.project, ".nccgs/inputs.json");
+    for (const inputs of [{ schemaVersion: 999 }, { schemaVersion: 1, canonicalInputs: [], outputDirectories: ["Assets"], checks: {} }]) {
+      fs.writeFileSync(inputsFile, JSON.stringify(inputs));
+      const doctor = f.run("doctor");
+      assert.equal(doctor.status, 1);
+      assert.match(doctor.stderr, /Invalid canonical input\/output policy/);
+    }
+  } finally { f.dispose(); }
+});
+
+test("doctor checks historical closure evidence without treating old approvals as current", () => {
+  const f = safetyFixture("nccgs-doctor-history-");
+  try {
+    const install = f.run("install");
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+    const write = (relative, value) => {
+      const file = containedPath(f.project, relative);
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      const text = typeof value === "string" ? value : JSON.stringify(value);
+      fs.writeFileSync(file, text);
+      return { path: relative, sha256: sha256(text) };
+    };
+    const raw = write(".nccgs/evidence/runtime/sources/history.json", { fixture: "Synthetic historical evidence only" });
+    const runtime = write(".nccgs/evidence/runtime/observations/history.json", { observationSource: raw });
+    const log = write(".nccgs/evidence/history.log", "Synthetic historical check");
+    const execution = write(".nccgs/evidence/history-check.json", { origin: "verification-command", log });
+    const report = write(".nccgs/evidence/history-report.md", "Synthetic historical report");
+    write(".nccgs/tasks/history.json", { schemaVersion: 1, id: "history", closed: { snapshot: "historical-source" }, stages: {
+      implementation: { runtime, checks: [{ evidence: execution }] }, review: { runtime, evidence: report },
+      report: { evidence: report }, astra: { evidence: report }, acceptance: { snapshot: "historical-source", evidence: report }
+    } });
+    const historical = f.run("doctor");
+    assert.equal(historical.status, 0, historical.stderr || historical.stdout);
+    assert.match(historical.stderr, /predates canonical input pins/);
+    assert.match(historical.stderr, /cannot approve current work/);
+    write(raw.path, { fixture: "Changed raw evidence" });
+    const stale = f.run("doctor");
+    assert.equal(stale.status, 1);
+    assert.match(stale.stderr, /Invalid closed task history.json: Missing or stale artifact/);
+  } finally { f.dispose(); }
+});