pan-wizard 3.21.1 → 3.24.0

package/pan-wizard-core/bin/lib/hud.cjs

@@ -625,24 +625,39 @@ function renderCommandStack(d) {
       ? s.agents.map(ag => `<div class="ag"><span class="amono">↳ ${esc(ag.name)}</span>`
         + `<span class="amono ${ag.active ? 'okc' : 'dim'}">${ag.active ? `${ag.calls} calls · ${fmtTokens(ag.tokens)} tok` : 'idle'}</span></div>`).join('')
       : '<div class="ag"><span class="amono dim">git-tool driven · no agents</span></div>';
+    // `tier` and `access` are reproduced verbatim from squads.cjs, and both are
+    // advisory there: `tier` is a squad grouping attribute (the active
+    // `model_profile` is what resolves a model), and `access` is the intended
+    // contract the conductor's prompt is told to honour, not a sandbox. The
+    // tooltip says so, because a bare `read-only` badge in a dashboard reads as
+    // enforcement to anyone who has not read the module.
     return `
     <div class="squad" style="border-left:3px solid ${color}">
       <div class="squad-head">
         <span class="squad-name"><span class="dot" style="background:${color}"></span>${esc(s.label)}
-          <span class="amono dim">· ${esc(s.tier)} · ${esc(s.access)}</span></span>
+          <span class="amono dim" title="Advisory labels from squads.cjs: tier is a squad grouping (the active model_profile resolves the model), and access is the contract the conductor is instructed to honour — the binding tool grant is each agent's own frontmatter.">· ${esc(s.tier)} · ${esc(s.access)}</span></span>
         ${pillEl}
       </div>
       <div class="squad-sum">${esc(s.summary)}</div>
       ${drill}
     </div>`;
   }).join('');
+  // The coordinator strap is deliberately narrow, because both halves of what it
+  // used to say were wrong. It does NOT name a model family: the agent file
+  // (`agents/pan-conductor.md`) carries no `model:` field, so it resolves to
+  // `inherit` and runs on whatever model launched the session — PAN selects
+  // nothing. And it says delegation-*first*, not delegation-only: that agent's
+  // `tools:` grant includes `Write` and `Bash`, and nothing strips them (squads.cjs
+  // is a registry + resolver). Routing rather than coding is how the conductor is
+  // instructed to behave, not something the runtime prevents. Do not re-add a
+  // family name or an enforcement word here without changing the agent file first.
   return `
   <section class="panel">
     <div class="ph">command stack — live</div>
     <div class="coord">
       <span class="dot" style="background:var(--coral)"></span>
       <span class="cname">Mission Control</span>
-      <span class="amono dim">· ${esc(a.coordinator)} · opus · reasoning · delegation-only</span>
+      <span class="amono dim">· ${esc(a.coordinator)} · session model · delegation-first</span>
       <span class="mc-state">${anyActive ? 'delegating' : 'idle'}</span>
     </div>
     <div class="squads">${squadCards}</div>

package/pan-wizard-core/bin/lib/init.cjs

@@ -3,11 +3,10 @@
  */
 
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const { loadConfig, resolveModelInternal, findPhaseInternal, getRoadmapPhaseInternal, pathExistsInternal, generateSlugInternal, getMilestoneInfo, normalizePhaseName, toPosix, output, error, scanPendingTodos, isGitRepo, execGit } = require('./core.cjs');
 const { PLANNING_DIR, PHASES_DIR, CODEBASE_DIR, QUICK_DIR, MILESTONES_DIR, STATE_FILE, ROADMAP_FILE, CONFIG_FILE, PROJECT_FILE, REQUIREMENTS_FILE, isPlanFile, isSummaryFile, isResearchFile, isContextFile, isVerificationFile, PLAN_SUFFIX, SUMMARY_SUFFIX, CONTEXT_SUFFIX, RESEARCH_SUFFIX, VERIFICATION_SUFFIX, UAT_SUFFIX, MAX_SLUG_LENGTH } = require('./constants.cjs');
-const { planningPath, phasesPath, filterPlanFiles, filterSummaryFiles, classifyPhaseStatus, hasBraveSearchKey } = require('./utils.cjs');
+const { planningPath, phasesPath, filterPlanFiles, filterSummaryFiles, classifyPhaseStatus, hasBraveSearchKey, parsePhaseDir } = require('./utils.cjs');
 const { classifyPlanTier } = require('./phase.cjs');
 const { extractFrontmatter } = require('./frontmatter.cjs');
 const { detectLanguages } = require('./codebase.cjs');
@@ -768,9 +767,7 @@ function scanAllPhases(cwd) {
     const dirNames = entries.filter(entry => entry.isDirectory()).map(entry => entry.name).sort();
 
     for (const dirName of dirNames) {
-      const dirMatch = dirName.match(/^(\d+(?:\.\d+)*)-?(.*)/);
-      const phaseNumber = dirMatch ? dirMatch[1] : dirName;
-      const phaseName = dirMatch && dirMatch[2] ? dirMatch[2] : null;
+      const { number: phaseNumber, name: phaseName } = parsePhaseDir(dirName);
 
       const phaseFullPath = path.join(phasesDirPath, dirName);
       let phaseFiles;

package/pan-wizard-core/bin/lib/knowledge.cjs

@@ -151,6 +151,22 @@ function conversationsDir(cwd) {
   return path.join(planningPath(cwd), CONVERSATIONS_DIR);
 }
 
+// Phase ids are shaped like "1", "2.1", "06A" — never a path fragment. Validate
+// before using phaseNum as a directory segment so a malformed/traversal value
+// (e.g. "../../../outside") cannot write session.json outside .planning/conversations.
+// Mirrors memory.cjs's validateAgentName hardening convention (2026-07).
+const PHASE_NUM_RE = /^[0-9]+(\.[0-9]+)*[A-Z]?$/i;
+
+function validatePhaseNum(phaseNum) {
+  if (phaseNum === undefined || phaseNum === null || String(phaseNum).trim() === '') {
+    return 'phaseNum required';
+  }
+  if (!PHASE_NUM_RE.test(String(phaseNum))) {
+    return `Invalid phase: ${phaseNum}. Must match ${PHASE_NUM_RE}`;
+  }
+  return null;
+}
+
 function sessionFile(cwd, phaseNum) {
   return path.join(conversationsDir(cwd), String(phaseNum), 'session.json');
 }
@@ -159,6 +175,8 @@ function sessionFile(cwd, phaseNum) {
  * Read or initialize a discussion session for a phase.
  */
 function loadSession(cwd, phaseNum) {
+  const err = validatePhaseNum(phaseNum);
+  if (err) return { error: err };
   const file = sessionFile(cwd, phaseNum);
   try {
     return JSON.parse(fs.readFileSync(file, 'utf-8'));
@@ -176,7 +194,8 @@ function loadSession(cwd, phaseNum) {
  * @returns {{appended: true, turn_count: number, file: string}|{error: string}}
  */
 function appendTurn(cwd, phaseNum, turn) {
-  if (!phaseNum) return { error: 'phaseNum required' };
+  const phaseErr = validatePhaseNum(phaseNum);
+  if (phaseErr) return { error: phaseErr };
   if (!turn || !turn.role || !turn.content) return { error: 'turn requires role + content' };
   if (turn.role !== 'user' && turn.role !== 'agent') {
     return { error: 'turn.role must be "user" or "agent"' };

package/pan-wizard-core/bin/lib/learn-lint.cjs

@@ -10,6 +10,7 @@
  *  - L-004: Universal-scope rule prose mentions PAN-internal terms
  *           (candidate for internal/ scope rather than universal/)
  *  - L-005: Revision marker (rN) appended in body but no supersession field
+ *  - L-006: Universal-scope pattern cites an internal pattern id (dangles after install)
  *
  * These are not patterns themselves — they're integrity checks for the
  * pattern store. Wired to `pan-tools learn lint`.
@@ -20,6 +21,25 @@ const path = require('path');
 
 const VALID_SCOPES = ['universal', 'internal'];
 
+/**
+ * Default root for the learnings store: three levels up from lib/ — the install
+ * root (`<runtime-dir>/`) or the source repo root. Both layouts keep
+ * pan-wizard-core/ at that level, so this resolves correctly in either.
+ *
+ * Why this exists rather than defaulting to cwd: the dispatcher used
+ * `--source-root || cwd`, which is only right when cwd IS the PAN source repo. In
+ * a real install cwd is the user's project, where pan-wizard-core/learnings/ does
+ * not exist — so `learn topics-for` returned zero topics from a store holding
+ * dozens, `learn lint` reported PASS on a store it never opened, and
+ * `build-index` crashed. Twenty-five shipped instruction sites across the
+ * exec/plan/verify workflows tell agents to run these commands from the project
+ * root, and none passes --source-root, so every one of them silently got nothing.
+ * Mirrors skill-align.cjs resolveSkillRoot() and experiment.cjs PAN_SOURCE_ROOT.
+ */
+function resolveLearningsRoot() {
+  return path.resolve(__dirname, '..', '..', '..');
+}
+
 function getLearningsDir(sourceRoot, scope) {
   return path.join(sourceRoot, 'pan-wizard-core', 'learnings', scope);
 }
@@ -248,6 +268,35 @@ function lintPatterns(patterns) {
     }
   }
 
+  // L-006: a universal-scope pattern citing an INTERNAL pattern id.
+  //
+  // This is the only rule that must run in the source repo to catch a defect that
+  // only manifests after install. `internal/` is stripped when PAN is installed, so
+  // a universal topic citing an internal id resolves fine here — where both scopes
+  // are present — and becomes a dangling L-002 reference on every user's machine.
+  // That is exactly what shipped: universal/concurrency.md cited P-1402 from
+  // internal/pan-dev-bugs.md, so `learn lint` FAILED in every install while passing
+  // in the repo, making the integrity gate un-greenable for users and invisible to us.
+  // Checking scope-crossing directly, rather than waiting for the reference to
+  // dangle, is what makes it catchable before release.
+  const internalIds = new Set(patterns.filter(p => p.scope === 'internal').map(p => p.id));
+  if (internalIds.size > 0) {
+    for (const p of patterns) {
+      if (p.scope !== 'universal') continue;
+      const refs = [...new Set(p.body.match(PATTERN_REF_RE) || [])].filter(r => r !== p.id);
+      for (const ref of refs.filter(r => internalIds.has(r))) {
+        violations.push({
+          code: 'L-006',
+          severity: 'error',
+          pattern_id: p.id,
+          file: p.file,
+          message: `Universal pattern "${p.id}" cites internal pattern "${ref}" — internal/ is stripped at install time, so this becomes a dangling reference in every install`,
+          internal_ref: ref,
+        });
+      }
+    }
+  }
+
   return {
     violations,
     pattern_count: patterns.length,
@@ -284,6 +333,7 @@ function cmdLearnLint(sourceRoot, opts = {}) {
 
 module.exports = {
   cmdLearnLint,
+  resolveLearningsRoot,
   collectAllPatterns,
   lintPatterns,
   extractPatternBody,

package/pan-wizard-core/bin/lib/links.cjs

@@ -509,8 +509,13 @@ function validateAll(cwd, opts = {}) {
 
 function cmdLinksValidate(cwd, opts = {}) {
   const result = validateAll(cwd, opts);
-  // Bypass core.output() because it unconditionally exits 0; we need exit 1
-  // when status is "fail" so CI / hooks can detect violations.
+  // This used to hand-roll process.stdout.write + process.exit to get exit 1 on a
+  // failing status, because output() exited 0 unconditionally. It no longer does
+  // (see its contract comment in core.cjs), so the gate goes through output() like
+  // every other command — which also picks up the >50KB @file: overflow protocol
+  // this bypass was silently missing. The payload has no `error` key, so the code
+  // is passed explicitly: "fail" is a verdict, not a malfunction.
+  let human;
   if (opts.raw) {
     const lines = [
       `Links: ${result.summary.status.toUpperCase()}`,
@@ -529,11 +534,9 @@ function cmdLinksValidate(cwd, opts = {}) {
       const where = f.source_line ? `${f.source}:${f.source_line}` : f.source;
       lines.push(`[${f.severity.toUpperCase()}] ${f.code} ${where}: ${f.detail}`);
     }
-    process.stdout.write(lines.join('\n'));
-  } else {
-    process.stdout.write(JSON.stringify(result, null, 2));
+    human = lines.join('\n');
   }
-  process.exit(result.summary.status === 'fail' ? 1 : 0);
+  output(result, opts.raw, human, result.summary.status === 'fail' ? 1 : 0);
 }
 
 module.exports = {

package/pan-wizard-core/bin/lib/lock.cjs

@@ -48,8 +48,18 @@ function acquireLock(filePath, opts = {}) {
       try {
         const age = Date.now() - fs.statSync(lockPath).mtimeMs;
         if (age > staleMs) {
-          // Holder likely crashed — steal and retry immediately.
-          try { fs.unlinkSync(lockPath); } catch { /* racing steal — loop retries */ }
+          // Holder likely crashed — steal via an atomic rename to a unique name.
+          // rename() moves the specific inode: exactly ONE concurrent stealer can
+          // rename a given lock file; every other contender's rename fails with
+          // ENOENT (the source is gone) instead of blindly unlinking a lock that a
+          // winner may already have re-created. This closes the double-holder race
+          // where two processes both stat the same stale lock and both unlink it.
+          const stealPath = `${lockPath}.steal.${process.pid}.${Date.now()}`;
+          try {
+            fs.renameSync(lockPath, stealPath);
+            // We won the steal — discard the stolen lock and retry wx-create.
+            try { fs.unlinkSync(stealPath); } catch { /* best-effort */ }
+          } catch { /* another contender stole/cleared it first — loop retries */ }
           continue;
         }
       } catch { /* lock vanished between EEXIST and stat — loop retries */ }
@@ -59,9 +69,18 @@ function acquireLock(filePath, opts = {}) {
   return { acquired: false, lockPath };
 }
 
-/** Release a lock acquired by acquireLock. Best-effort. */
+/**
+ * Release a lock acquired by acquireLock. Best-effort, but ownership-verified:
+ * only unlink when the lock file still contains THIS process's pid, so a lock
+ * that was stolen (stale) and re-created by a successor is never deleted out
+ * from under that successor.
+ */
 function releaseLock(lockPath) {
-  try { fs.unlinkSync(lockPath); } catch { /* already gone */ }
+  try {
+    const owner = fs.readFileSync(lockPath, 'utf-8').trim();
+    if (owner !== String(process.pid)) return; // not ours anymore — leave it
+    fs.unlinkSync(lockPath);
+  } catch { /* already gone / unreadable — nothing to release */ }
 }
 
 /**

package/pan-wizard-core/bin/lib/memory-optimize.cjs

@@ -24,12 +24,49 @@ const { readMemory, parseEntries, listMemoryAgents, compactMemory, DEFAULT_MAX_E
 
 const DEFAULT_KEEP = 12;            // recent bullets kept inline per section
 const STATE_ARCHIVE_FILE = 'state-archive.md';
+const QUARANTINE_FILE = 'quarantine.md';
 
 // Sections whose bullet lists grow unbounded and are safe to reconcile.
 const APPEND_HEAVY = /\b(decisions|blockers|concerns|pending todos|todos|session continuity|accumulated context|recent activity)\b/i;
 // A bullet that is just a placeholder — dropped once real entries exist.
 const PLACEHOLDER = /^-\s*(none(\s+yet)?|n\/a|tbd|todo|—|-)\.?\s*$/i;
 
+// Memory-injection defense (threat: a subagent writes an instruction/directive
+// into the always-loaded memory that a LATER agent or run reads and OBEYS — a
+// cross-generation prompt injection, exactly the "agent writes self-serving
+// directives into persistent memory for successors" vector in the OpenAI
+// rogue-agent incident, Reuters 2026-07). See ADR-0040. state.md is agent-writable
+// (decisions/blockers/notes), so during reconcile any bullet that reads like a
+// directive AIMED at the agent/system is QUARANTINED out of standing memory (moved
+// to .planning/memory/quarantine.md, reversible) rather than carried forward —
+// nothing agent-authored becomes standing instruction without human review (the
+// merge gate). High-precision, injection-flavored patterns only, to minimize false
+// positives; a legitimate note caught here is recoverable from quarantine.md.
+const DIRECTIVE_PATTERNS = [
+  /\bignore\s+(all\s+|any\s+|these\s+)?(previous|prior|earlier|above)\b/i,
+  /\bdisregard\s+(the\s+|all\s+|any\s+|your\s+)?(previous|prior|above|earlier|instructions|rules|guidelines|guardrails)\b/i,
+  /\byou\s+are\s+now\b/i,
+  /\bnew\s+instructions?\s*:/i,
+  /\b(the\s+)?system\s+prompt\b/i,
+  /\b(as|acting\s+as|being)\s+(an?\s+)?(admin|administrator|root|superuser|developer\s+with)\b/i,
+  /\bpre-?authoriz(e|ed|ation)\b/i,
+  /\b(do\s+not|don'?t|never)\s+(tell|inform|notify|ask|alert)\s+the\s+(user|human|operator)\b/i,
+  /\bwithout\s+(asking|telling|notifying|informing|alerting)\s+the\s+(user|human|operator)\b/i,
+  /\b(bypass|skip|disable|override|remove|turn\s+off)\s+(the\s+)?(merge[-\s]?gate|human[-\s]?(approval|gate|review)|approval[-\s]?gate|safety[-\s]?(harness|check|guard|gate)|verification[-\s]?gate|review[-\s]?gate)\b/i,
+  /\b(always|automatically)\s+(approve|auto-?approve|accept|merge|confirm|say\s+yes)\b/i,
+  /\bauto-?approve\s+(all|any|every|everything)\b/i,
+  /\boverride\s+(the\s+)?(human|approval|merge[-\s]?gate|safety)\b/i,
+];
+
+/**
+ * True when a memory entry reads like a directive aimed at the agent/system
+ * (an injection), as opposed to a descriptive project note. Pure + zero-dep.
+ */
+function isSuspiciousDirective(text) {
+  if (typeof text !== 'string' || !text) return false;
+  return DIRECTIVE_PATTERNS.some((re) => re.test(text));
+}
+
 const isHeading = (l) => /^#{1,6}\s+\S/.test(l);
 const headingText = (l) => (l.match(/^#{1,6}\s+(.*)$/) || [, ''])[1];
 const isBullet = (l) => /^-\s+\S/.test(l);
@@ -64,7 +101,7 @@ function joinSections(sections) {
  * its indented continuation lines, so a bullet is never orphaned from its detail.
  * Overflow entries are pushed to `archived`. Returns { lines, changed }.
  */
-function reconcileBullets(lines, keepN, archived) {
+function reconcileBullets(lines, keepN, archived, quarantined) {
   const firstB = lines.findIndex(isBullet);
   if (firstB === -1) return { lines, changed: false };
 
@@ -87,9 +124,22 @@ function reconcileBullets(lines, keepN, archived) {
   }
   const trailer = rest.slice(i);
 
+  // 0. QUARANTINE injected directives FIRST — a bullet that reads like an
+  // instruction aimed at the agent never survives into standing memory; it is
+  // moved to the quarantine file for human review (memory-injection defense).
+  const safe = [];
+  let quarantinedHere = 0;
+  for (const e of entries) {
+    if (quarantined && isSuspiciousDirective(e.key)) {
+      quarantined.push(e.lines.join('\n'));
+      quarantinedHere++;
+    } else {
+      safe.push(e);
+    }
+  }
   // 1. dedupe (keep first occurrence)
   const seen = new Set();
-  const deduped = entries.filter((e) => (seen.has(e.key) ? false : (seen.add(e.key), true)));
+  const deduped = safe.filter((e) => (seen.has(e.key) ? false : (seen.add(e.key), true)));
   // 2. strip placeholders once real entries exist
   const real = deduped.filter((e) => !PLACEHOLDER.test(e.key));
   const kept0 = real.length ? real : deduped;
@@ -102,7 +152,7 @@ function reconcileBullets(lines, keepN, archived) {
   }
   for (const d of dropped) archived.push(d.lines.join('\n'));
 
-  const changed = deduped.length !== entries.length || kept0.length !== deduped.length || dropped.length > 0;
+  const changed = quarantinedHere > 0 || deduped.length !== safe.length || kept0.length !== deduped.length || dropped.length > 0;
   const newLines = [...pre, ...kept.flatMap((e) => e.lines), ...trailer];
   // Preserve the section's trailing blank line (the blank that separates it from
   // the next heading) so reconciling never collapses two sections together.
@@ -119,23 +169,22 @@ function optimizeStateContent(content, opts = {}) {
   const keepN = Number.isFinite(opts.keep) && opts.keep > 0 ? opts.keep : DEFAULT_KEEP;
   const sections = parseSections(content);
   const archived = [];
+  const quarantined = [];
   const sectionsTouched = [];
   let changed = false;
 
   for (const s of sections) {
     if (s.heading === null) continue;
     if (!APPEND_HEAVY.test(headingText(s.heading))) continue;
-    const before = archived.length;
-    const r = reconcileBullets(s.lines, keepN, archived);
+    const r = reconcileBullets(s.lines, keepN, archived, quarantined);
     if (r.changed) {
       s.lines = r.lines;
       changed = true;
       sectionsTouched.push(headingText(s.heading).trim());
     }
-    void before;
   }
 
-  return { content: changed ? joinSections(sections) : content, changed, archived, sectionsTouched };
+  return { content: changed ? joinSections(sections) : content, changed, archived, quarantined, sectionsTouched };
 }
 
 // ─── Command ────────────────────────────────────────────────────────────────
@@ -154,6 +203,30 @@ function appendArchive(cwd, entries, now) {
   fs.appendFileSync(p, block, 'utf-8');
 }
 
+function quarantinePath(cwd) {
+  return path.join(planningPath(cwd), MEMORY_DIR, QUARANTINE_FILE);
+}
+
+/**
+ * Append quarantined directive-like entries to a dated, human-review file. These
+ * were pulled OUT of standing memory because they read like injected instructions
+ * (memory-injection defense). Reversible — a human can review and, if legitimate,
+ * restore an entry by hand. The file leads with a warning so it is never loaded
+ * as trusted instruction memory.
+ */
+function appendQuarantine(cwd, entries, now) {
+  if (!entries.length) return;
+  const p = quarantinePath(cwd);
+  const fresh = !fs.existsSync(p);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  const stamp = now || '(undated)';
+  const header = fresh
+    ? '# Quarantined memory (DO NOT auto-load as instructions)\n\nEntries below were pulled out of standing memory during reconcile because they read like\ndirectives aimed at the agent (possible cross-generation prompt injection). They are\nNOT trusted instructions. Review each; restore to state.md by hand only if legitimate.\n'
+    : '';
+  const block = `${header}\n## Quarantined ${stamp}\n\n${entries.join('\n')}\n`;
+  fs.appendFileSync(p, block, 'utf-8');
+}
+
 /**
  * `memory optimize [--apply] [--keep N]` — reconcile state.md + consolidate
  * over-budget agent logs. Dry-run by default: reports what WOULD change.
@@ -172,12 +245,15 @@ function cmdMemoryOptimize(cwd, opts = {}, raw) {
       changed: opt.changed,
       sections_touched: opt.sectionsTouched,
       archived_entries: opt.archived.length,
+      quarantined_entries: opt.quarantined.length,
       before_bytes: Buffer.byteLength(before),
       after_bytes: Buffer.byteLength(opt.content),
     };
     result.archived = opt.archived.length;
+    result.quarantined = opt.quarantined.length;
     if (apply && opt.changed) {
       appendArchive(cwd, opt.archived, opts.now);
+      appendQuarantine(cwd, opt.quarantined, opts.now);
       writeStateMd(statePath, opt.content, cwd);
     }
   } else {
@@ -187,20 +263,27 @@ function cmdMemoryOptimize(cwd, opts = {}, raw) {
   // Consolidate any per-agent log over the entry cap (reuses compactMemory, which
   // no-ops under the cap). Dry-run counts entries without writing.
   try {
-    for (const a of listMemoryAgents(cwd)) {
-      const rawMem = readMemory(cwd, a);
-      if (rawMem == null) continue;
-      const count = parseEntries(rawMem).length;
+    // M21: listMemoryAgents(cwd) returns { agents: [{ agent, entries }] }, and
+    // readMemory(cwd, name) returns { agent, entries, raw }. The old loop iterated
+    // the return OBJECT directly (a TypeError, silently swallowed by this catch)
+    // and passed the whole object to readMemory/parseEntries — so the agent-log
+    // consolidation never ran. Iterate .agents, read each by name, count entries.
+    for (const a of listMemoryAgents(cwd).agents) {
+      const mem = readMemory(cwd, a.agent);
+      if (mem == null) continue;
+      const count = parseEntries(mem.raw).length;
       if (count > DEFAULT_MAX_ENTRIES) {
         let removed = 0;
-        if (apply) { const r = compactMemory(cwd, a, DEFAULT_MAX_ENTRIES); removed = (r && r.removed) || 0; }
-        result.agents.push({ agent: a, entries: count, over_cap: true, compacted: apply, removed });
+        if (apply) { const r = compactMemory(cwd, a.agent, DEFAULT_MAX_ENTRIES); removed = (r && r.removed) || 0; }
+        result.agents.push({ agent: a.agent, entries: count, over_cap: true, compacted: apply, removed });
       }
     }
   } catch { /* agent sweep is best-effort */ }
 
+  const q = result.quarantined || 0;
+  const quarantineNote = q ? `; ${q} directive-like entr${q === 1 ? 'y' : 'ies'} QUARANTINED` : '';
   const summary = result.state.changed
-    ? `${apply ? 'optimized' : 'would optimize'} state.md (${result.state.sections_touched.join(', ')}); ${result.archived} entr${result.archived === 1 ? 'y' : 'ies'} archived${result.agents.length ? `; ${result.agents.length} agent log(s)` : ''}`
+    ? `${apply ? 'optimized' : 'would optimize'} state.md (${result.state.sections_touched.join(', ')}); ${result.archived} entr${result.archived === 1 ? 'y' : 'ies'} archived${quarantineNote}${result.agents.length ? `; ${result.agents.length} agent log(s)` : ''}`
     : `state.md already lean${result.agents.length ? `; ${result.agents.length} agent log(s) over budget` : ''} — nothing to do`;
   output(result, raw, summary);
 }
@@ -239,8 +322,9 @@ function maybeAutoOptimizeMemory(cwd, opts = {}) {
     const opt = optimizeStateContent(before, { keep: opts.keep });
     if (!opt.changed) return { optimized: false, reason: 'clean' };
     appendArchive(cwd, opt.archived, opts.now);
+    appendQuarantine(cwd, opt.quarantined, opts.now);
     writeStateMd(statePath, opt.content, cwd);
-    return { optimized: true, sections: opt.sectionsTouched, archived: opt.archived.length };
+    return { optimized: true, sections: opt.sectionsTouched, archived: opt.archived.length, quarantined: opt.quarantined.length };
   } catch {
     return { optimized: false, reason: 'error' };
   }
@@ -248,6 +332,6 @@ function maybeAutoOptimizeMemory(cwd, opts = {}) {
 
 module.exports = {
   optimizeStateContent, reconcileBullets, parseSections, joinSections, cmdMemoryOptimize,
-  maybeAutoOptimizeMemory, autoOptimizeEnabled,
-  APPEND_HEAVY, PLACEHOLDER, DEFAULT_KEEP, STATE_ARCHIVE_FILE,
+  maybeAutoOptimizeMemory, autoOptimizeEnabled, isSuspiciousDirective,
+  APPEND_HEAVY, PLACEHOLDER, DIRECTIVE_PATTERNS, DEFAULT_KEEP, STATE_ARCHIVE_FILE, QUARANTINE_FILE,
 };

package/pan-wizard-core/bin/lib/memory-rebuild.cjs

@@ -32,6 +32,24 @@ const {
   upsertAgentsMdSection,
   ensureClaudeMdImport,
 } = require('./agents-md.cjs');
+const { isSuspiciousDirective } = require('./memory-optimize.cjs');
+
+/**
+ * Scan a procedural-memory file (AGENTS.md / CLAUDE.md) for lines that read like
+ * directives aimed at the agent — a memory-injection risk in the ALWAYS-loaded
+ * instruction files (ADR-0040). rebuild owns only the marker-fenced PAN section
+ * (regenerated from a fixed template, so it can't be poisoned); user content is
+ * preserved by contract, so here we WARN rather than auto-edit — surfacing
+ * suspect lines for human review instead of silently rewriting the user's file.
+ */
+function scanForDirectives(file, content, warnings) {
+  if (typeof content !== 'string') return;
+  content.split('\n').forEach((line, i) => {
+    if (isSuspiciousDirective(line)) {
+      warnings.push({ file, line: i + 1, text: line.trim().slice(0, 200) });
+    }
+  });
+}
 
 // Source repo root — mirrors experiment.cjs / install.js. __dirname is
 // .../pan-wizard-core/bin/lib, so three levels up is the repo (or install) root.
@@ -106,6 +124,7 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
 
   const runtimes = detectRuntimes(cwd);
   const targets = [];
+  const warnings = [];
 
   // 1. AGENTS.md — universal PAN section (all runtimes read it natively).
   {
@@ -113,6 +132,7 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
     const existing = safeReadFile(p);
     const desired = upsertAgentsMdSection(existing, buildAgentsMdSection());
     targets.push({ file: 'AGENTS.md', ...rebuildFile(p, existing, desired, apply) });
+    scanForDirectives('AGENTS.md', desired, warnings);
   }
 
   // 2. CLAUDE.md — Claude bridge, only when the Claude runtime is installed.
@@ -121,6 +141,7 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
     const existing = safeReadFile(p);
     const desired = ensureClaudeMdImport(existing);
     targets.push({ file: 'CLAUDE.md', ...rebuildFile(p, existing, desired, apply) });
+    scanForDirectives('CLAUDE.md', desired, warnings);
   }
 
   // 3. state.md — re-derive YAML frontmatter from the body (progress/status).
@@ -139,10 +160,12 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
     runtimes,
     rebuilt: targets,
     changed_count: changed.length,
+    directive_warnings: warnings,
   };
-  const summary = changed.length === 0
+  const warnNote = warnings.length ? `; ⚠ ${warnings.length} directive-like line(s) in procedural memory — review (not auto-edited)` : '';
+  const summary = (changed.length === 0
     ? `tools memory already current (${targets.map((t) => t.file).join(', ')}) — nothing to do`
-    : `${apply ? 'rebuilt' : 'would rebuild'} ${changed.map((t) => `${t.file} (${t.action})`).join(', ')}`;
+    : `${apply ? 'rebuilt' : 'would rebuild'} ${changed.map((t) => `${t.file} (${t.action})`).join(', ')}`) + warnNote;
   output(result, raw, summary);
 }
 
@@ -151,6 +174,7 @@ module.exports = {
   detectRuntimes,
   isInsideSourceRepo,
   rebuildFile,
+  scanForDirectives,
   PAN_SOURCE_ROOT,
   RUNTIME_DIRS,
 };

package/pan-wizard-core/bin/lib/milestone.cjs

@@ -6,7 +6,7 @@ const fs = require('fs');
 const path = require('path');
 const { PLANNING_DIR, PHASES_DIR, MILESTONES_DIR, ROADMAP_FILE, REQUIREMENTS_FILE, STATE_FILE, isPlanFile } = require('./constants.cjs');
 const { planningPath, phasesPath, filterPlanFiles, filterSummaryFiles, fileAccessible } = require('./utils.cjs');
-const { output, error, isGitRepo, execGit } = require('./core.cjs');
+const { output, error, isGitRepo, execGit, escapeRegex } = require('./core.cjs');
 const { extractFrontmatter } = require('./frontmatter.cjs');
 const { writeStateMd } = require('./state.cjs');
 
@@ -39,7 +39,9 @@ function cmdRequirementsMarkComplete(cwd, reqIdsRaw, raw) {
   try {
     reqContent = fs.readFileSync(reqPath, 'utf-8');
   } catch {
-    output({ updated: false, reason: 'requirements.md not found', ids: reqIds }, raw, 'no requirements file');
+    // error key => exit 1: the caller asked to mark requirements complete and no
+    // requirement was marked - the milestone record does not reflect the work.
+    output({ updated: false, reason: 'requirements.md not found', error: 'requirements_not_found', ids: reqIds }, raw, 'no requirements file');
     return;
   }
   const updated = [];
@@ -47,20 +49,24 @@ function cmdRequirementsMarkComplete(cwd, reqIdsRaw, raw) {
 
   for (const reqId of reqIds) {
     let found = false;
+    // Escape the requirement ID before interpolating into RegExp — an ID with
+    // regex metacharacters otherwise crashes or mis-matches (M22, ADR audit
+    // 2026-08). Matches the escapeRegex convention in phase-remove.cjs/knowledge.cjs.
+    const reqEsc = escapeRegex(reqId);
 
     // Update checkbox: - [ ] **REQ-ID** -> - [x] **REQ-ID**
-    const checkboxPattern = new RegExp(`(-\\s*\\[)[ ](\\]\\s*\\*\\*${reqId}\\*\\*)`, 'gi');
+    const checkboxPattern = new RegExp(`(-\\s*\\[)[ ](\\]\\s*\\*\\*${reqEsc}\\*\\*)`, 'gi');
     if (checkboxPattern.test(reqContent)) {
       reqContent = reqContent.replace(checkboxPattern, '$1x$2');
       found = true;
     }
 
     // Update traceability table: | REQ-ID | Phase N | Pending | -> | REQ-ID | Phase N | Complete |
-    const tablePattern = new RegExp(`(\\|\\s*${reqId}\\s*\\|[^|]+\\|)\\s*Pending\\s*(\\|)`, 'gi');
+    const tablePattern = new RegExp(`(\\|\\s*${reqEsc}\\s*\\|[^|]+\\|)\\s*Pending\\s*(\\|)`, 'gi');
     if (tablePattern.test(reqContent)) {
       // Re-create regex since test() advances lastIndex for global regex
       reqContent = reqContent.replace(
-        new RegExp(`(\\|\\s*${reqId}\\s*\\|[^|]+\\|)\\s*Pending\\s*(\\|)`, 'gi'),
+        new RegExp(`(\\|\\s*${reqEsc}\\s*\\|[^|]+\\|)\\s*Pending\\s*(\\|)`, 'gi'),
         '$1 Complete $2'
       );
       found = true;