pumuki 6.3.129 → 6.3.130

package/core/rules/presets/heuristics/typescript.ts

@@ -163,6 +163,476 @@ export const typescriptRules: RuleSet = [
       code: 'HEURISTICS_NEW_PROMISE_ASYNC_AST',
     },
   },
+  {
+    id: 'heuristics.ts.callback-hell.ast',
+    description: 'Detects callback hell patterns in TypeScript/TSX production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.callback-hell.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected callback hell / nested promise callback usage.',
+      code: 'HEURISTICS_CALLBACK_HELL_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.magic-numbers.ast',
+    description: 'Detects magic number literals in TypeScript/TSX production files.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.magic-numbers.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected magic number literal usage.',
+      code: 'HEURISTICS_MAGIC_NUMBERS_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.hardcoded-values.ast',
+    description: 'Detects hardcoded config values in TypeScript/TSX production files.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.hardcoded-values.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected hardcoded config value usage.',
+      code: 'HEURISTICS_HARDCODED_VALUES_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.env-default-fallback.ast',
+    description: 'Detects environment default fallbacks in TypeScript/TSX production files.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.env-default-fallback.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected environment default fallback usage.',
+      code: 'HEURISTICS_ENV_DEFAULT_FALLBACK_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.guards-useguards-jwtauthguard.ast',
+    description: 'Detects UseGuards(JwtAuthGuard) usage in TypeScript production files.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.guards-useguards-jwtauthguard.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected @UseGuards(JwtAuthGuard) usage.',
+      code: 'HEURISTICS_GUARDS_USEGUARDS_JWTAUTHGUARD_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.interceptors-useinterceptors-logging-transform.ast',
+    description: 'Detects UseInterceptors logging/transform usage in TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.interceptors-useinterceptors-logging-transform.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected @UseInterceptors logging/transform usage.',
+      code: 'HEURISTICS_INTERCEPTORS_USEINTERCEPTORS_LOGGING_TRANSFORM_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.no-sensitive-log.ast',
+    description: 'Detects sensitive data emitted to logs in TypeScript production files.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.no-sensitive-log.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected sensitive data emitted to logs.',
+      code: 'HEURISTICS_NO_SENSITIVE_LOG_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.rate-limiting-throttler.ast',
+    description:
+      'Detects NestJS throttler rate limiting configured for backend production files.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.rate-limiting-throttler.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected NestJS throttler rate limiting.',
+      code: 'HEURISTICS_RATE_LIMITING_THROTTLER_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.winston-structured-json-logger.ast',
+    description: 'Detects Winston structured JSON logger usage in TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.winston-structured-json-logger.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected Winston structured JSON logger usage.',
+      code: 'HEURISTICS_WINSTON_STRUCTURED_JSON_LOGGER_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.error-logging-full-context.ast',
+    description: 'Detects backend error logging without full context in TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.error-logging-full-context.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend error logging without full context.',
+      code: 'HEURISTICS_ERROR_LOGGING_FULL_CONTEXT_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.correlation-ids.ast',
+    description: 'Detects correlation IDs propagation in backend TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.correlation-ids.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected correlation IDs propagation in backend logs.',
+      code: 'HEURISTICS_CORRELATION_IDS_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.cors-configured.ast',
+    description: 'Detects backend CORS configuration with allowed origins.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.cors-configured.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend CORS configuration with allowed origins.',
+      code: 'HEURISTICS_CORS_CONFIGURED_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.validationpipe-global.ast',
+    description: 'Detects global ValidationPipe usage with whitelist enabled in backend TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.validationpipe-global.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected global ValidationPipe configuration with whitelist enabled.',
+      code: 'HEURISTICS_VALIDATIONPIPE_GLOBAL_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.versionado-api-v1-api-v2.ast',
+    description: 'Detects API versioned NestJS controllers.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.versionado-api-v1-api-v2.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend API versioning.',
+      code: 'HEURISTICS_VERSIONADO_API_V1_API_V2_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.validation-config.ast',
+    description: 'Detects backend config validation in ConfigModule for .env files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.validation-config.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend config validation in ConfigModule.',
+      code: 'HEURISTICS_VALIDATION_CONFIG_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.class-validator-decorators.ast',
+    description: 'Detects class-validator decorators in backend DTOs.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.class-validator-decorators.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected class-validator decorator usage.',
+      code: 'HEURISTICS_CLASS_VALIDATOR_DECORATORS_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.class-transformer-decorators.ast',
+    description: 'Detects class-transformer decorators in backend DTOs.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.class-transformer-decorators.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected class-transformer decorator usage.',
+      code: 'HEURISTICS_CLASS_TRANSFORMER_DECORATORS_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.input-validation-siempre-validar-con-dtos.ast',
+    description: 'Detects backend controller input validated through DTOs.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.input-validation-siempre-validar-con-dtos.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend controller input DTO validation.',
+      code: 'HEURISTICS_INPUT_VALIDATION_SIEMPRE_VALIDAR_CON_DTOS_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.nested-validation-validatenested-type.ast',
+    description: 'Detects nested validation through ValidateNested and Type decorators.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.nested-validation-validatenested-type.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected nested DTO validation.',
+      code: 'HEURISTICS_NESTED_VALIDATION_VALIDATENESTED_TYPE_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.dtos-en-boundaries-validacio-n-en-entrada-salida.ast',
+    description: 'Detects backend DTO classes that preserve explicit input/output boundaries.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.dtos-en-boundaries-validacio-n-en-entrada-salida.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend DTO boundary classes.',
+      code: 'HEURISTICS_DTOS_EN_BOUNDARIES_VALIDACIO_N_EN_ENTRADA_SALIDA_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.dtos-separados-createorderdto-updateorderdto-orderresponsedto.ast',
+    description: 'Detects separated create, update and response DTO contracts in backend code.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.dtos-separados-createorderdto-updateorderdto-orderresponsedto.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected separated backend DTO contracts.',
+      code: 'HEURISTICS_DTOS_SEPARADOS_CREATEORDERDTO_UPDATEORDERDTO_ORDERRESPONSEDTO_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.return-dtos-no-exponer-entidades-directamente.ast',
+    description: 'Detects backend code returning entities directly instead of DTOs.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.return-dtos-no-exponer-entidades-directamente.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend code returning entities directly instead of DTOs.',
+      code: 'HEURISTICS_TS_RETURN_DTOS_NO_EXPONER_ENTIDADES_DIRECTAMENTE_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.transacciones-para-operaciones-cri-ticas.ast',
+    description: 'Detects backend critical transaction usage in TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.transacciones-para-operaciones-cri-ticas.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend transaction usage for critical operations.',
+      code: 'HEURISTICS_TS_TRANSACCIONES_PARA_OPERACIONES_CRI_TICAS_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.transacciones-para-operaciones-multi-tabla.ast',
+    description: 'Detects backend multi-table transaction usage in TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.transacciones-para-operaciones-multi-tabla.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected backend transaction usage for multi-table operations.',
+      code: 'HEURISTICS_TS_TRANSACCIONES_PARA_OPERACIONES_MULTI_TABLA_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.prometheus-prom-client.ast',
+    description: 'Detects Prometheus metrics instrumentation via prom-client in backend TypeScript production files.',
+    severity: 'WARN',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.prometheus-prom-client.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected Prometheus metrics instrumentation via prom-client.',
+      code: 'HEURISTICS_PROMETHEUS_PROM_CLIENT_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.password-hashing-bcrypt-salt-rounds-10.ast',
+    description:
+      'Detects bcrypt password hashing configured with salt rounds below the recommended minimum in TypeScript production files.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.password-hashing-bcrypt-salt-rounds-10.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected bcrypt salt rounds below the recommended minimum.',
+      code: 'HEURISTICS_PASSWORD_HASHING_BCRYPT_SALT_ROUNDS_10_AST',
+    },
+  },
   {
     id: 'heuristics.ts.with-statement.ast',
     description: 'Detects with-statement usage in TypeScript/TSX production files.',
@@ -330,6 +800,44 @@ export const typescriptRules: RuleSet = [
       code: 'HEURISTICS_SOLID_DIP_CONCRETE_INSTANTIATION_AST',
     },
   },
+  {
+    id: 'heuristics.ts.clean-architecture.ast',
+    description:
+      'Detects clean architecture dependency direction risks in domain/application TypeScript code.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.clean-architecture.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message:
+        'AST heuristic detected clean architecture dependency direction risk in domain/application code.',
+      code: 'HEURISTICS_CLEAN_ARCHITECTURE_AST',
+    },
+  },
+  {
+    id: 'heuristics.ts.react-class-component.ast',
+    description: 'Detects React class components in frontend TypeScript/TSX code.',
+    severity: 'ERROR',
+    platform: 'generic',
+    locked: true,
+    when: {
+      kind: 'Heuristic',
+      where: {
+        ruleId: 'heuristics.ts.react-class-component.ast',
+      },
+    },
+    then: {
+      kind: 'Finding',
+      message: 'AST heuristic detected React class component usage.',
+      code: 'HEURISTICS_TS_REACT_CLASS_COMPONENT_AST',
+    },
+  },
   {
     id: 'heuristics.ts.god-class-large-class.ast',
     description: 'Detects God Class candidates when one class mixes multiple responsibility nodes.',

package/docs/README.md

@@ -42,7 +42,7 @@ Mapa corto y humano de la documentación oficial de Pumuki.
   - Barra local sin Actions: `npm run -s validation:local-merge-bar` (ver `docs/validation/README.md` § GitHub Actions y cuota)
 
 - Quiero saber en qué estamos ahora:
-  - `docs/tracking/plan-activo-de-trabajo.md`
+  - `../PUMUKI-RESET-MASTER-PLAN.md`
 - Quiero el seguimiento del curso Stack My Architecture (Pumuki), iniciativa formativa aparte del espejo operativo:
   - `docs/tracking/plan-curso-pumuki-stack-my-architecture.md`
 
@@ -71,8 +71,8 @@ Mapa corto y humano de la documentación oficial de Pumuki.
   - Skills vendorizadas que el repo usa como contrato local.
 
 - `docs/tracking/`
-  - Seguimiento permitido y solo el imprescindible.
-  - Espejo operativo de producto y consumidores: `docs/tracking/plan-activo-de-trabajo.md` (unica fuente de verdad para ese ambito).
+  - Material histórico o auxiliar de seguimiento; no actúa como backlog operativo ni fuente canónica del repo.
+  - El seguimiento operativo vivo de producto y consumidores está en `PUMUKI-RESET-MASTER-PLAN.md`.
   - Curso Pumuki (Stack My Architecture): diseño pedagógico + seguimiento de entrega en `docs/tracking/plan-curso-pumuki-stack-my-architecture.md` (no sustituye al plan activo).
   - Regla hard: solo puede existir una tarea `🚧` en cada documento de seguimiento que lo use.
 

package/docs/operations/RELEASE_NOTES.md

@@ -4,6 +4,12 @@ This file tracks the active deterministic framework line used in this repository
 Canonical release chronology lives in `CHANGELOG.md`.
 This file keeps only the operational highlights and rollout notes that matter while running the framework.
 
+### 2026-05-03 (v6.3.130)
+
+- **Menú consumer legacy recuperado:** `pumuki-framework` vuelve a mostrar la portada plana de 9 opciones y la salida clásica de auditoría.
+- **Auditoría repo completo con cobertura real:** la opción `1) Full audit (repo analysis)` muestra iOS/Android/Backend/Frontend con `rules evaluated=x/y` y explica `Other`.
+- **Rollout recomendado:** publicar `pumuki@6.3.130`, repin inmediato en consumers activos y revalidar `node bin/pumuki-framework.js` opción `1`, `status` y `doctor`.
+
 ### 2026-04-29 (v6.3.129)
 
 - **Singletons Android con detector AST real:** `skills.android.no-singleton-usar-inyeccio-n-de-dependencias-hilt-dagger` queda vinculada a un detector que distingue singleton real de `@Module` / `@InstallIn` / `@EntryPoint`.
@@ -496,7 +502,7 @@ This file keeps only the operational highlights and rollout notes that matter wh
 
 - Blocked notification UX hardening for macOS:
   - short, human-readable Spanish banner (`🔴 Pumuki bloqueado`) with stage + summarized cause.
-  - remediation-first body (`Solución: ...`) to maximize visibility in truncated notification banners.
+  - actionable body (`Causa / Impacto / Comando / Siguiente acción`) to maximize visibility in truncated notification banners.
 - Optional blocked-dialog workflow (`PUMUKI_MACOS_BLOCKED_DIALOG=1`):
   - full cause/remediation modal for critical blocks.
   - anti-spam controls in dialog:

package/docs/operations/framework-menu-consumer-walkthrough.md

@@ -1,20 +1,23 @@
-# README Menu Walkthrough (Option 1)
+# README Menu Walkthrough (Consumer Legacy)
 
-This walkthrough documents **Option 1: Full audit (repo analysis · PRE_COMMIT)** with real execution captures.
+This walkthrough documents the consumer legacy menu contract restored from tag `v0-legacy-last`, specifically `scripts/hooks-system/infrastructure/shell/orchestrators/audit-orchestrator.sh`.
 
-## Capture 1 — Consumer Menu (v2)
+## Capture 1 — Consumer Menu (legacy)
 
-![Consumer Menu v2](../assets/readme/menu-option1/01-menu-consumer-v2.png)
+![Consumer Menu legacy](../assets/readme/menu-option1/01-menu-consumer-v2.png)
 
 What this shows:
 
-- Consumer menu grouped by operational flows.
-- Option `1` is the full repo audit path for `PRE_COMMIT` policy.
-- Current menu status reflects latest evidence context.
+- The consumer menu is a flat legacy surface with 9 options.
+- Option `1` is `Full audit (repo analysis)`.
+- Options `2-4` are the strict/staged/standard audit flows.
+- Options `5-8` keep the legacy diagnostics/export actions.
+- Option `9` is `Exit`.
+- The audit output follows the legacy `summarize_all` sections and severity counts.
 
-## Capture 2 — Option 1 Pre-flight (BLOCK context)
+## Capture 2 — Archived v2 Full-Audit Pre-flight (BLOCK context)
 
-![Option 1 Pre-flight Block](../assets/readme/menu-option1/02-option1-preflight-block.png)
+![Archived v2 Full-Audit Pre-flight Block](../assets/readme/menu-option1/02-option1-preflight-block.png)
 
 What this shows:
 
@@ -22,9 +25,9 @@ What this shows:
 - Runtime context includes branch/upstream/worktree/evidence freshness.
 - Operational hints explain why governance is currently blocked.
 
-## Capture 3 — Option 1 Final Summary (BLOCK)
+## Capture 3 — Archived v2 Full-Audit Final Summary (BLOCK)
 
-![Option 1 Final Summary Block](../assets/readme/menu-option1/03-option1-final-summary-block.png)
+![Archived v2 Full-Audit Final Summary Block](../assets/readme/menu-option1/03-option1-final-summary-block.png)
 
 What this shows:
 
@@ -34,18 +37,18 @@ What this shows:
   - `Outcome: BLOCK`
 - Actionable remediation next step.
 
-## Capture 4 — Option 1 Pre-flight (PASS scenario)
+## Capture 4 — Archived v2 Full-Audit Pre-flight (PASS scenario)
 
-![Option 1 Pre-flight Pass Scenario](../assets/readme/menu-option1/04-option1-preflight-pass.png)
+![Archived v2 Full-Audit Pre-flight Pass Scenario](../assets/readme/menu-option1/04-option1-preflight-pass.png)
 
 What this shows:
 
 - A clean fixture scenario where the run can complete without findings.
 - Pre-flight can still surface policy warnings while run execution proceeds.
 
-## Capture 5 — Option 1 Final Summary (PASS)
+## Capture 5 — Archived v2 Full-Audit Final Summary (PASS)
 
-![Option 1 Final Summary Pass](../assets/readme/menu-option1/05-option1-final-summary-pass.png)
+![Archived v2 Full-Audit Final Summary Pass](../assets/readme/menu-option1/05-option1-final-summary-pass.png)
 
 What this shows:
 

package/docs/product/API_REFERENCE.md

@@ -174,7 +174,7 @@ Interpretation contract:
 - `consumerInstalled`: version installed in the consumer repository.
 - `lifecycleInstalled`: version recorded in managed lifecycle metadata.
 - `driftWarning`: compact human-readable explanation when those values diverge.
-- `alignmentCommand`: exact remediation command to align dependency and lifecycle state with the current runtime version.
+- `alignmentCommand`: exact remediation command to align dependency and lifecycle state with the current runtime version. When the consumer repo declares a Node runtime via `volta`, `.nvmrc`, or `package.json.engines.node`, this command prepends the matching runtime switch before the Pumuki install step.
 - `pathExecutionHazard`: boolean flag raised when the repo root contains the platform `PATH` delimiter and `npx/npm exec` can fail to resolve `pumuki`.
 - `pathExecutionWarning`: compact warning explaining why `PATH` resolution is unsafe in that repo.
 - `pathExecutionWorkaroundCommand`: safe local-node entrypoint to use when `pathExecutionHazard=true`.

package/docs/product/USAGE.md

@@ -439,7 +439,7 @@ How to read it:
 - `lifecycleInstalled`: version persisted in managed lifecycle state.
 - `source`: source chosen to compute `effective`.
 - `driftWarning`: compact explanation when those values diverge.
-- `alignmentCommand`: exact command to align consumer dependency and lifecycle state with the current runtime.
+- `alignmentCommand`: exact command to align consumer dependency and lifecycle state with the current runtime. If the consumer declares Node via `volta`, `.nvmrc`, or `package.json.engines.node`, the command prepends the matching runtime switch before the Pumuki install step.
 - `pathExecutionHazard`: tells you whether the repo root itself can break `PATH`-based execution.
 - `pathExecutionWarning`: compact explanation of that hazard.
 - `pathExecutionWorkaroundCommand`: safe local-node entrypoint to use when `PATH` execution is unsafe.

package/docs/validation/README.md

@@ -14,7 +14,9 @@ Este directorio contiene solo documentación estable de validación y runbooks o
 
 ## Estado de seguimiento
 
-- Única fuente de seguimiento: `docs/tracking/plan-activo-de-trabajo.md`
+- `docs/validation/` no gobierna backlog.
+- La única fuente viva del tracking interno es `PUMUKI-RESET-MASTER-PLAN.md` en la raíz del repo.
+- `docs/tracking/plan-activo-de-trabajo.md` queda retirado como espejo operativo y solo conserva valor histórico.
 
 ## GitHub Actions y cuota