peaks-loop 4.0.48 → 4.0.50

package/dist/services/adapter/auto-adapter.d.ts

@@ -1,3 +1,16 @@
+/**
+ * ⚠ DEAD CODE — zero importers in `src/`, `tests/`, `packages/`, `scripts/`.
+ * See the block comment on `src/services/adapter/adapter.ts`.
+ *
+ * `detectAndPick()` picks the first adapter whose `detect()` returns true.
+ * It cannot pick anything today: its only candidate implementations are its
+ * three dead siblings, and the codex/copilot pair hardcode `detect()` to
+ * `false` while the claude one hardcodes `true` — so the "pick" is a
+ * constant that never varies with the environment. It is not wired to
+ * `peaks skill adapter set-active` either; that CLI verb
+ * (`src/cli/commands/adapter-commands.ts`) echoes back the name it was given
+ * and reads no adapter file.
+ */
 import { Adapter } from "./adapter.js";
 type Detectable = Pick<Adapter, "name" | "detect">;
 export declare class AutoAdapter {

package/dist/services/adapter/claude-adapter.js

@@ -1,3 +1,15 @@
+/**
+ * ⚠ DEAD CODE — not a live adapter. See the block comment on
+ * `src/services/adapter/adapter.ts` for the three same-named layers.
+ *
+ * This is the only file in the cluster with a real implementation, which is
+ * what makes it the most misleading one: it writes a real
+ * `~/.claude/skills/peaks-bee-<name>.peaks-generated/SKILL.md` scratch dir if
+ * you call it. Nothing calls it — zero importers in `src/`, `tests/`,
+ * `packages/` or `scripts/`. The live Claude Code knowledge lives in
+ * `src/services/ide/adapters/claude-code-adapter.ts` (IDE surface) and
+ * `src/services/runtime/vendors/claude-code.ts` (runtime compact).
+ */
 import { writeFileSync, mkdirSync, rmSync, existsSync } from "node:fs";
 import { join } from "node:path";
 export class ClaudeAdapter {

package/dist/services/adapter/codex-adapter.d.ts

@@ -1,3 +1,15 @@
+/**
+ * ⚠ DEAD CODE — not the live `CodexAdapter`. See the block comment on
+ * `src/services/adapter/adapter.ts` for the three same-named layers, and
+ * `tests/unit/runtime/vendor-adapter-layer.test.ts` for the guard.
+ *
+ * The class below has zero importers anywhere in this repo. The live codex
+ * adapter is `src/services/runtime/vendors/codex.ts` (runtime detect +
+ * compact, wired into `RuntimeService`) and
+ * `packages/peaks-loop-internal-runtime/src/vendor/codex-adapter.ts` (the
+ * dispatched-sub-agent runtime). `detect()` here returns a hardcoded
+ * `false`; every other method throws `ADAPTER_NOT_IMPLEMENTED`.
+ */
 import { Adapter } from "./adapter.js";
 export declare class CodexAdapter implements Pick<Adapter, "name"> {
     private readonly _o;

package/dist/services/adapter/codex-adapter.js

@@ -1,3 +1,15 @@
+/**
+ * ⚠ DEAD CODE — not the live `CodexAdapter`. See the block comment on
+ * `src/services/adapter/adapter.ts` for the three same-named layers, and
+ * `tests/unit/runtime/vendor-adapter-layer.test.ts` for the guard.
+ *
+ * The class below has zero importers anywhere in this repo. The live codex
+ * adapter is `src/services/runtime/vendors/codex.ts` (runtime detect +
+ * compact, wired into `RuntimeService`) and
+ * `packages/peaks-loop-internal-runtime/src/vendor/codex-adapter.ts` (the
+ * dispatched-sub-agent runtime). `detect()` here returns a hardcoded
+ * `false`; every other method throws `ADAPTER_NOT_IMPLEMENTED`.
+ */
 import { ADAPTER_NOT_IMPLEMENTED } from "./adapter.js";
 export class CodexAdapter {
     _o;

package/dist/services/adapter/copilot-adapter.d.ts

@@ -1,3 +1,15 @@
+/**
+ * ⚠ DEAD CODE — not the live `CopilotAdapter`. See the block comment on
+ * `src/services/adapter/adapter.ts` for the three same-named layers, and
+ * `tests/unit/runtime/vendor-adapter-layer.test.ts` for the guard.
+ *
+ * The class below has zero importers anywhere in this repo. The live copilot
+ * adapter is `src/services/runtime/vendors/copilot.ts` (runtime detect +
+ * compact, wired into `RuntimeService`) and
+ * `packages/peaks-loop-internal-runtime/src/vendor/copilot-adapter.ts` (the
+ * dispatched-sub-agent runtime). `detect()` here returns a hardcoded
+ * `false`; every other method throws `ADAPTER_NOT_IMPLEMENTED`.
+ */
 import { Adapter } from "./adapter.js";
 export declare class CopilotAdapter implements Pick<Adapter, "name"> {
     private readonly _o;

package/dist/services/adapter/copilot-adapter.js

@@ -1,3 +1,15 @@
+/**
+ * ⚠ DEAD CODE — not the live `CopilotAdapter`. See the block comment on
+ * `src/services/adapter/adapter.ts` for the three same-named layers, and
+ * `tests/unit/runtime/vendor-adapter-layer.test.ts` for the guard.
+ *
+ * The class below has zero importers anywhere in this repo. The live copilot
+ * adapter is `src/services/runtime/vendors/copilot.ts` (runtime detect +
+ * compact, wired into `RuntimeService`) and
+ * `packages/peaks-loop-internal-runtime/src/vendor/copilot-adapter.ts` (the
+ * dispatched-sub-agent runtime). `detect()` here returns a hardcoded
+ * `false`; every other method throws `ADAPTER_NOT_IMPLEMENTED`.
+ */
 import { ADAPTER_NOT_IMPLEMENTED } from "./adapter.js";
 export class CopilotAdapter {
     _o;

package/dist/services/artifacts/artifact-prerequisites.js

@@ -2,6 +2,7 @@ import { join, dirname, basename } from 'node:path';
 import { readFile, readdir } from 'node:fs/promises';
 import { pathExists } from 'peaks-loop-shared/fs';
 import { emitObservabilityEvent } from '../observability/observability-service.js';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 export const VALID_REQUEST_TYPES = [
     'feature',
     'bugfix',
@@ -426,6 +427,15 @@ export async function checkPrerequisites(options) {
     if (requirements.length === 0) {
         return { ok: true, missing: [], warnings: [] };
     }
+    // Repair R5. The session id is joined into BOTH roots below and then probed
+    // on disk. `transitionRequestArtifact` is the only caller and it passes
+    // `existing.sessionId`, which pre-R5 was the caller's raw `--session-id`: with
+    // `../../../PWNED-R34` the two joins resolved outside the project root and
+    // the prerequisite probes ran there. Guarded at the sink, not at the caller,
+    // for the same reason `requestArtifactRequestsDir` is.
+    if (options.sessionId !== undefined && isUnsafePathInput(options.sessionId)) {
+        throw new Error(`Invalid session id: ${options.sessionId} (must be a single path segment)`);
+    }
     // Slice 006 simplifies the resolution to a 2-tier fallback. The
     // per-change-id scope (`.peaks/_runtime/<sessionId>/<role>/`) is gone — new
     // artifacts go to the session dir directly. The 2 tiers are:

package/dist/services/artifacts/request-artifact-service.js

@@ -12,6 +12,7 @@ import { ensureSession, getSessionIdCanonical } from '../session/session-manager
 import { getNextNumber, buildNumberedFilename, slugifyDescription } from '../../shared/incrementing-number.js';
 import { lintRequestArtifact } from './artifact-lint-service.js';
 import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { guardRuntimeSegment, runtimeRoot } from '../../shared/runtime-root.js';
 import { checkTypeSanity } from '../scan/type-sanity-service.js';
 import { requireUserConfirmation } from '../mode/mode-enforcement.js';
 import { scanFileSize } from '../scan/file-size-scan.js';
@@ -46,6 +47,30 @@ function dateSlugFromIso(iso) {
 function defaultSessionId(iso) {
     return `${dateSlugFromIso(iso)}-session`;
 }
+/**
+ * The single place a request-artifact directory is built, and therefore the
+ * single place the ids that reach it are guarded.
+ *
+ * Repair R5. This join used to be written at four sites; `createRequestArtifact`
+ * guarded its session id and the other three did not. The two ids are the whole
+ * of the invariant — `role` is a path segment too, and the closed-set check its
+ * callers perform is not visible from here.
+ *
+ * The guard belongs HERE and not at the entry points because the invariant is
+ * the resolved path, not the flag. `transitionRequestArtifact` is the measured
+ * cost: it performs no join of its own (it delegates the path to
+ * `showRequestArtifact`), so it had no guard and no join to hang one on.
+ * `--session-id ../../../PWNED-R34` resolved `.peaks/_runtime/../../../PWNED-R34`,
+ * wrote `state: blocked` to a file outside the project root, and only then threw
+ * — from `emitObservabilityEvent`'s own session-id check, i.e. after the write.
+ */
+function requestArtifactRequestsDir(projectRoot, sessionId, role) {
+    // Slice 2026-09-15 (runtime-path-unrepresentable): the two ids are branded by
+    // `guardRuntimeSegment`, which performs the same `isUnsafePathInput` check
+    // this function used to spell inline. The join itself now *requires* the
+    // brand, so a caller that reaches this dir without a guard does not compile.
+    return runtimeRoot(projectRoot).join(guardRuntimeSegment(sessionId, 'session id'), guardRuntimeSegment(role, 'role'), guardRuntimeSegment('requests', 'leaf'));
+}
 export async function createRequestArtifact(options) {
     if (!VALID_ROLES.has(options.role)) {
         throw new Error(`Invalid role: ${String(options.role)} (expected prd, ui, rd, qa, or sc)`);
@@ -95,7 +120,7 @@ export async function createRequestArtifact(options) {
     // `mkdir(..., { recursive: true })`.
     const LOOKS_LIKE_SESSION_ID = /^\d{4}-\d{2}-\d{2}-session-/;
     if (LOOKS_LIKE_SESSION_ID.test(sessionId)) {
-        const sessionDir = join(options.projectRoot, '.peaks', '_runtime', sessionId);
+        const sessionDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'));
         if (!(await isDirectory(sessionDir))) {
             const canonicalSid = getSessionIdCanonical(options.projectRoot);
             const hint = canonicalSid !== null
@@ -105,7 +130,7 @@ export async function createRequestArtifact(options) {
         }
     }
     // Build numbered path under the session dir (canonical post-F3 home).
-    const requestsDir = join(options.projectRoot, '.peaks', '_runtime', sessionId, options.role, 'requests');
+    const requestsDir = requestArtifactRequestsDir(options.projectRoot, sessionId, options.role);
     // Check if a file with this requestId already exists (regardless of number prefix)
     if (await isDirectory(requestsDir)) {
         const existingFiles = await listMarkdownFiles(requestsDir);
@@ -133,7 +158,7 @@ export async function createRequestArtifact(options) {
         // Slice 2026-06-29-change-id-root-removal: scopeDir is the
         // session-axis dir (`.peaks/_runtime/<sid>/`). Pre-resolved here
         // so dry-run output reports the canonical scope location.
-        const scopeDir = join(options.projectRoot, '.peaks', '_runtime', sessionId);
+        const scopeDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'));
         return {
             role: options.role,
             requestId: options.requestId,
@@ -150,7 +175,7 @@ export async function createRequestArtifact(options) {
     // Create QA initiated marker so rd:qa-handoff gate can verify QA was invoked.
     // The marker lives under the SESSION dir (canonical post-F3 home).
     if (options.role === 'qa') {
-        const qaDir = join(options.projectRoot, '.peaks', '_runtime', sessionId, 'qa');
+        const qaDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'), guardRuntimeSegment('qa', 'role'));
         const initiatedPath = join(qaDir, '.initiated');
         if (!existsSync(initiatedPath)) {
             await mkdir(qaDir, { recursive: true });
@@ -164,7 +189,7 @@ export async function createRequestArtifact(options) {
         path,
         content,
         applied: true,
-        scopeDir: join(options.projectRoot, '.peaks', '_runtime', sessionId),
+        scopeDir: runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id')),
         ...(options.callerId !== undefined ? { callerId: options.callerId } : {})
     };
 }
@@ -202,31 +227,27 @@ function extractMetadata(markdown) {
         base.sessionId = sessionId;
     return base;
 }
-async function readSummary(projectRoot, sessionId, role, fileName) {
-    const path = join(projectRoot, '.peaks', sessionId, role, 'requests', fileName);
+async function readSummary(dir, role, fileName, sessionId) {
+    const path = join(dir, fileName);
     const body = await readFile(path, 'utf8');
     const { state, createdAt, requestType, sessionId: bodySessionId } = extractMetadata(body);
     // Strip numbered prefix (e.g., "001-requestId.md" -> "requestId")
     // Only strip 3-digit zero-padded prefixes (our incrementing number format)
     const requestId = fileName.replace(/^0\d{2}-/, '').replace(/\.md$/, '');
-    // The `sessionId` parameter is the *scope* path fragment
-    // (`_runtime/<sid>`); consumers expect the bare session id. Strip
-    // the `_runtime/` prefix when recording the summary so downstream
-    // calls (observability emit, prereq check, lint gate) see just the
-    // session id. Pre-2.19.0 the field carried the scope verbatim, which
-    // caused the observability metrics file to land at
-    // `.peaks/_runtime/_runtime/<sid>/...` instead of the canonical
-    // `.peaks/_runtime/<sid>/metrics/...`. `writerSessionId` falls back
-    // to the parsed body session line (or the bare sid) — same intent.
-    const bareSessionId = sessionId.replace(/^_runtime[\\/]/, '');
+    // Repair R5: this used to take the *scope* path fragment (`_runtime/<sid>`)
+    // and re-join it onto the project root, then strip the prefix back off to
+    // recover the bare session id. The round-trip was the escape's carrier — an
+    // unsafe id rode it into `path` unguarded. The directory now arrives already
+    // resolved and already guarded (`requestArtifactRequestsDir`), and the bare
+    // session id arrives as itself, so neither is re-derived here.
     const summary = {
         role,
-        sessionId: bareSessionId,
+        sessionId,
         requestId,
         path,
         state,
         requestType,
-        writerSessionId: bodySessionId ?? bareSessionId
+        writerSessionId: bodySessionId ?? sessionId
     };
     if (createdAt !== undefined) {
         summary.createdAt = createdAt;
@@ -254,26 +275,28 @@ export async function listRequestArtifacts(options) {
     // scanned. The user has forbidden the `.peaks/_runtime/<id>/` root layout —
     // the CLI guarantees no such dirs are created. See
     // `.peaks/memory/2026-06-21-peaks-request-session-id-leaks-into-change-id.md`.
+    // Repair R5: `scopes` holds bare session ids. It used to hold the joined
+    // fragment `_runtime/<sid>` so that `readSummary` could re-join it to the
+    // project root; the directory is built once, below, by the guard.
     const scopes = [];
     if (options.sessionId !== undefined) {
-        scopes.push(join('_runtime', options.sessionId));
+        scopes.push(options.sessionId);
     }
     else {
-        const runtimeRoot = join(peaksRoot, '_runtime');
-        if (await isDirectory(runtimeRoot)) {
-            for (const sid of await listDirectories(runtimeRoot)) {
-                scopes.push(join('_runtime', sid));
-            }
+        // Read-only enumeration of the root itself, so `dir()` and not `join()`.
+        const runtimeDir = runtimeRoot(options.projectRoot).dir();
+        if (await isDirectory(runtimeDir)) {
+            scopes.push(...(await listDirectories(runtimeDir)));
         }
     }
     const roles = options.role !== undefined ? [options.role] : Array.from(VALID_ROLES);
     const summaries = [];
     for (const scope of scopes) {
         for (const role of roles) {
-            const dir = join(peaksRoot, scope, role, 'requests');
+            const dir = requestArtifactRequestsDir(options.projectRoot, scope, role);
             const fileNames = await listMarkdownFiles(dir);
             for (const fileName of fileNames) {
-                summaries.push(await readSummary(options.projectRoot, scope, role, fileName));
+                summaries.push(await readSummary(dir, role, fileName, scope));
             }
         }
     }
@@ -311,24 +334,22 @@ export async function showRequestArtifact(options) {
     // `.peaks/_runtime/<sid>/<role>/requests/` legacy home is no longer
     // scanned. The user has forbidden the `.peaks/_runtime/<id>/` root layout.
     if (options.sessionId !== undefined) {
-        const dir = join(options.projectRoot, '.peaks', '_runtime', options.sessionId, options.role, 'requests');
-        const scope = join('_runtime', options.sessionId);
+        const dir = requestArtifactRequestsDir(options.projectRoot, options.sessionId, options.role);
         const found = await findFileInDir(dir);
         if (found === null) {
             return null;
         }
-        return await readRequestArtifact(options.projectRoot, scope, options.role, found);
+        return await readRequestArtifact(dir, options.role, found, options.sessionId);
     }
-    const peaksRoot = join(options.projectRoot, '.peaks');
-    const runtimeRoot = join(peaksRoot, '_runtime');
-    if (!(await isDirectory(runtimeRoot))) {
+    const runtimeDir = runtimeRoot(options.projectRoot).dir();
+    if (!(await isDirectory(runtimeDir))) {
         return null;
     }
-    for (const sid of await listDirectories(runtimeRoot)) {
-        const dir = join(runtimeRoot, sid, options.role, 'requests');
+    for (const sid of await listDirectories(runtimeDir)) {
+        const dir = requestArtifactRequestsDir(options.projectRoot, sid, options.role);
         const found = await findFileInDir(dir);
         if (found !== null) {
-            return await readRequestArtifact(options.projectRoot, join('_runtime', sid), options.role, found);
+            return await readRequestArtifact(dir, options.role, found, sid);
         }
     }
     return null;
@@ -336,8 +357,8 @@ export async function showRequestArtifact(options) {
 /** Read the summary + content for a found request file; treat a read
  * error on the content as "not found" so the caller can fall through
  * to the next candidate (the on-disk file may be partially written). */
-async function readRequestArtifact(projectRoot, scope, role, found) {
-    const summary = await readSummary(projectRoot, scope, role, found.fileName);
+async function readRequestArtifact(dir, role, found, sessionId) {
+    const summary = await readSummary(dir, role, found.fileName, sessionId);
     try {
         const content = await readFile(found.path, 'utf8');
         return { ...summary, content };

package/dist/services/audit/backing-detector.d.ts

@@ -2,23 +2,41 @@
  * Backing detector — classifies each red line as `cli-backed`, `partial`,
  * or `prose-only`. The classifier already sets the backing for catalog hits
  * (cli-backed when an enforcer file path is present). This module exists to
- * handle the post-classification nuance: heuristics for the "partial" tier
- * (a gate exists but the LLM can bypass it) and verification that the
- * enforcer file actually exists on disk.
+ * handle the post-classification nuances: heuristics for the "partial" tier
+ * (a gate exists but the LLM can bypass it), verification that the enforcer
+ * file exists on disk, and — since A9 of the 2026-09-15 diagnosis —
+ * verification that the enforcer is actually reachable from a call site.
+ *
+ * `cli-backed` means "a CLI surface runs this rule". A file that exists but
+ * that nothing imports runs nothing, so it is `prose-only` with the same
+ * weight as an unwritten rule. Callers pass the live set from
+ * `enforcer-liveness.ts`; `null` means "liveness undecidable for this
+ * project" (no `src/` tree), in which case the existing file is trusted.
  */
 import type { RedLineEntry } from './types.js';
+/**
+ * `liveEnforcers` is the set of enforcerRefs with a call site (see
+ * `enforcer-liveness.ts`), or `null` when the project has no `src/` tree to
+ * scan and liveness therefore cannot be decided.
+ */
+export type LiveEnforcerSet = ReadonlySet<string> | null;
 export interface BackingResult {
     readonly entry: RedLineEntry;
     readonly enforcerExists: boolean;
+    /** True when the enforcer file exists but no call site imports it. */
+    readonly enforcerDead: boolean;
 }
 /**
  * Re-classify a single RedLineEntry. Returns a new entry with the
- * `backing` field updated and `enforcerRef` possibly nulled if the
- * referenced file does not exist on disk.
+ * `backing` field updated; `enforcerRef` is preserved even when the
+ * backing is downgraded, because the dead reference is the triage
+ * information the report needs.
  */
-export declare function classifyBacking(entry: RedLineEntry, projectRoot: string): BackingResult;
+export declare function classifyBacking(entry: RedLineEntry, projectRoot: string, liveEnforcers: LiveEnforcerSet): BackingResult;
 export interface BackingBatchResult {
     readonly entries: readonly RedLineEntry[];
     readonly warnings: readonly string[];
+    /** Sorted, deduplicated enforcerRefs downgraded for having no call site. */
+    readonly deadEnforcers: readonly string[];
 }
-export declare function classifyBackingBatch(entries: readonly RedLineEntry[], projectRoot: string): BackingBatchResult;
+export declare function classifyBackingBatch(entries: readonly RedLineEntry[], projectRoot: string, liveEnforcers: LiveEnforcerSet): BackingBatchResult;

package/dist/services/audit/backing-detector.js

@@ -2,9 +2,16 @@
  * Backing detector — classifies each red line as `cli-backed`, `partial`,
  * or `prose-only`. The classifier already sets the backing for catalog hits
  * (cli-backed when an enforcer file path is present). This module exists to
- * handle the post-classification nuance: heuristics for the "partial" tier
- * (a gate exists but the LLM can bypass it) and verification that the
- * enforcer file actually exists on disk.
+ * handle the post-classification nuances: heuristics for the "partial" tier
+ * (a gate exists but the LLM can bypass it), verification that the enforcer
+ * file exists on disk, and — since A9 of the 2026-09-15 diagnosis —
+ * verification that the enforcer is actually reachable from a call site.
+ *
+ * `cli-backed` means "a CLI surface runs this rule". A file that exists but
+ * that nothing imports runs nothing, so it is `prose-only` with the same
+ * weight as an unwritten rule. Callers pass the live set from
+ * `enforcer-liveness.ts`; `null` means "liveness undecidable for this
+ * project" (no `src/` tree), in which case the existing file is trusted.
  */
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
@@ -23,37 +30,46 @@ function detectPartial(context) {
 }
 /**
  * Re-classify a single RedLineEntry. Returns a new entry with the
- * `backing` field updated and `enforcerRef` possibly nulled if the
- * referenced file does not exist on disk.
+ * `backing` field updated; `enforcerRef` is preserved even when the
+ * backing is downgraded, because the dead reference is the triage
+ * information the report needs.
  */
-export function classifyBacking(entry, projectRoot) {
+export function classifyBacking(entry, projectRoot, liveEnforcers) {
+    const enforcerPath = entry.enforcerRef === null ? null : resolve(projectRoot, entry.enforcerRef);
+    const exists = enforcerPath !== null && existsSync(enforcerPath);
+    const dead = entry.enforcerRef !== null && exists && liveEnforcers !== null && !liveEnforcers.has(entry.enforcerRef);
     if (detectPartial(entry.source.context)) {
         return {
             entry: { ...entry, backing: 'partial' },
-            enforcerExists: entry.enforcerRef !== null && existsSync(resolve(projectRoot, entry.enforcerRef)),
+            enforcerExists: exists,
+            enforcerDead: dead,
         };
     }
     if (entry.enforcerRef === null) {
-        return { entry, enforcerExists: false };
+        return { entry, enforcerExists: false, enforcerDead: false };
     }
-    const enforcerPath = resolve(projectRoot, entry.enforcerRef);
-    const exists = existsSync(enforcerPath);
+    const backed = exists && !dead;
     return {
-        entry: { ...entry, backing: exists ? 'cli-backed' : 'prose-only' },
+        entry: { ...entry, backing: backed ? 'cli-backed' : 'prose-only' },
         enforcerExists: exists,
+        enforcerDead: dead,
     };
 }
-export function classifyBackingBatch(entries, projectRoot) {
+export function classifyBackingBatch(entries, projectRoot, liveEnforcers) {
     const updated = [];
     const warnings = [];
+    const dead = new Set();
     for (const entry of entries) {
-        const { entry: reclassified, enforcerExists } = classifyBacking(entry, projectRoot);
-        updated.push(reclassified);
-        if (reclassified.backing === 'cli-backed' && !enforcerExists) {
+        const result = classifyBacking(entry, projectRoot, liveEnforcers);
+        updated.push(result.entry);
+        if (result.enforcerDead && result.entry.enforcerRef !== null) {
+            dead.add(result.entry.enforcerRef);
+        }
+        if (result.entry.backing === 'cli-backed' && !result.enforcerExists) {
             // Defensive: should not happen because classifyBacking downgrades to
             // prose-only, but keep the assertion in case of future drift.
-            warnings.push(`enforcer ref "${reclassified.enforcerRef}" missing on disk for ${reclassified.id}`);
+            warnings.push(`enforcer ref "${result.entry.enforcerRef}" missing on disk for ${result.entry.id}`);
         }
     }
-    return { entries: updated, warnings };
+    return { entries: updated, warnings, deadEnforcers: [...dead].sort() };
 }

package/dist/services/audit/enforcer-liveness.d.ts

@@ -0,0 +1,12 @@
+export interface LiveEnforcerScan {
+    /** Refs proven imported from a call site. Empty when `unknown` is true. */
+    readonly live: ReadonlySet<string>;
+    /** True when the project has no `src/` tree, so liveness is undecidable. */
+    readonly unknown: boolean;
+    readonly warnings: readonly string[];
+}
+/**
+ * Scan `projectRoot/src` for relative imports that name one of `enforcerRefs`.
+ * Returns the subset of refs with a call site outside the enforcers directory.
+ */
+export declare function computeLiveEnforcers(projectRoot: string, enforcerRefs: readonly string[]): LiveEnforcerScan;

package/dist/services/audit/enforcer-liveness.js

@@ -0,0 +1,100 @@
+/**
+ * Enforcer liveness — A9 of `docs/diagnosis-2026-09-15-peaks-loop-state.md`.
+ *
+ * `cli-backed` used to mean "the `enforcerRef` path exists on disk"
+ * (`backing-detector.ts`). It did not mean "the enforcer runs". Ten catalog
+ * enforcerRefs name a file no module imports — `lint-rd-handoff-coverage.ts`
+ * among them — so the audit reported 108/152 red lines as CLI-enforced while
+ * a quarter of those had no caller at all.
+ *
+ * This module answers the narrower, checkable question: is the enforcer
+ * module imported by some file OUTSIDE the enforcers directory? A relative
+ * import is cheap proof that a call site exists — production code cannot
+ * invoke the module without one.
+ *
+ * Deliberate limits, stated rather than hidden:
+ *   - An import is not a call. A module can be imported and never invoked.
+ *     This check is necessary, not sufficient: it eliminates the "no caller
+ *     exists at all" class and nothing beyond it.
+ *   - Imports written inside `src/…/audit/enforcers/` do not count. A dead
+ *     enforcer that imports another dead enforcer must not resurrect it.
+ *   - A project with no `src/` tree yields `unknown: true`, never an empty
+ *     live-set: peaks-loop audits consumer projects, and "cannot tell" must
+ *     not read as "dead".
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+const SOURCE_FILE = /\.(ts|tsx|mts|cts)$/;
+const ENFORCER_DIR_FRAGMENT = '/services/audit/enforcers/';
+/** Matches `from './x.js'`, `import('./x.js')` and `export … from './x.js'`. */
+const RELATIVE_JS_IMPORT = /(?:from|import)\s*\(?\s*['"](\.\.?\/[^'"]+\.js)['"]/g;
+function toPosix(value) {
+    return value.split('\\').join('/');
+}
+function* walkSourceFiles(root, warnings) {
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        if (dir === undefined)
+            continue;
+        let dirents;
+        try {
+            dirents = readdirSync(dir, { withFileTypes: true });
+        }
+        catch (error) {
+            warnings.push(`enforcer-liveness: cannot read ${toPosix(dir)} (${String(error)})`);
+            continue;
+        }
+        for (const dirent of dirents) {
+            const full = join(dir, dirent.name);
+            if (dirent.isDirectory()) {
+                if (dirent.name === 'node_modules' || dirent.name === 'dist' || dirent.name.startsWith('.'))
+                    continue;
+                stack.push(full);
+            }
+            else if (dirent.isFile() && SOURCE_FILE.test(dirent.name)) {
+                yield full;
+            }
+        }
+    }
+}
+/**
+ * Scan `projectRoot/src` for relative imports that name one of `enforcerRefs`.
+ * Returns the subset of refs with a call site outside the enforcers directory.
+ */
+export function computeLiveEnforcers(projectRoot, enforcerRefs) {
+    const srcRoot = join(projectRoot, 'src');
+    const warnings = [];
+    const live = new Set();
+    const wanted = new Set(enforcerRefs);
+    let sawAnySource = false;
+    for (const absFile of walkSourceFiles(srcRoot, warnings)) {
+        sawAnySource = true;
+        const relFile = toPosix(relative(projectRoot, absFile));
+        // An import written inside the enforcers directory proves nothing.
+        if (relFile.includes(ENFORCER_DIR_FRAGMENT))
+            continue;
+        let source;
+        try {
+            source = readFileSync(absFile, 'utf8');
+        }
+        catch (error) {
+            warnings.push(`enforcer-liveness: cannot read ${relFile} (${String(error)})`);
+            continue;
+        }
+        RELATIVE_JS_IMPORT.lastIndex = 0;
+        let match = RELATIVE_JS_IMPORT.exec(source);
+        while (match !== null) {
+            const specifier = match[1] ?? '';
+            const resolved = toPosix(relative(projectRoot, resolve(dirname(absFile), specifier)));
+            const asTs = resolved.replace(/\.js$/, '.ts');
+            if (wanted.has(asTs))
+                live.add(asTs);
+            match = RELATIVE_JS_IMPORT.exec(source);
+        }
+    }
+    if (!sawAnySource) {
+        return { live, unknown: true, warnings };
+    }
+    return { live, unknown: false, warnings };
+}

package/dist/services/audit/enforcers/active-skill-resolver.js

@@ -64,7 +64,20 @@ export function resolveActiveSkillForCaller(projectRoot, opts) {
     // single skill per resolution. When the lease dir is empty (e.g.
     // ad-hoc / pre-migration projects) we fall through to the legacy
     // walk below.
-    const sessionDir = getSessionDir(projectRoot, sessionId);
+    // `getSessionDir` refuses an unsafe session id by throwing (slice
+    // 2026-09-14-getsessiondir-guard). This function's contract is the
+    // resolution order's "graceful degradation — never throws", so an unsafe
+    // id degrades to the same `source: 'none'` shape an absent session dir
+    // produces, exactly as it did before that guard existed. Without this,
+    // the throw escapes to the nearest caller `catch` — for `hook handle`
+    // that catch is a fail-open that skips the SOP gate.
+    let sessionDir;
+    try {
+        sessionDir = getSessionDir(projectRoot, sessionId);
+    }
+    catch {
+        return { skill: null, callerId: null, sessionId: null, mode: null, source: 'none' };
+    }
     if (!existsSync(sessionDir)) {
         return { skill: null, callerId: null, sessionId, mode: null, source: 'none' };
     }