rcf-lite 0.27.0 → 0.28.0

package/src/cli/blueprint-library.js

@@ -266,6 +266,12 @@ async function handleAdd({ args, parsed, projectRoot, now, stdout, stderr, stdin
     reviewedBy: 'operator',
     provenance,
     cachePath: sourceKind === 'local' ? libraryRoot : cachePathRel,
+    // Feedback destination snapshot (design 3.3, AC-15801-1). Snapshotted
+    // so the resolver never re-reads the library's own library.json on
+    // every preview / submit; `library refresh` re-snapshots when the
+    // library owner changes the field.
+    ...(library.issues?.repo ? { issuesRepo: library.issues.repo } : {}),
+    ...(library.issues?.visibility ? { issuesVisibility: library.issues.visibility } : {}),
   };
 
   const nextRegistry = {
@@ -565,6 +571,11 @@ async function handleRefresh({ args, parsed, projectRoot, stdout, stderr }) {
     return 2;
   }
   const libraryPrefix = args[0];
+  // F-slice-3-02 regression fix: honour --dry-run on refresh. The
+  // re-snapshot writes below (local / git / tarball) previously ran
+  // unconditionally, so a dry-run mutated the registry even though
+  // the flag is documented as "print intended writes without executing".
+  const dryRun = parsed.values['dry-run'] === true;
   const registry = await readLibraryRegistry(projectRoot);
   if (isRcfError(registry)) {
     stderr.write(`[error] blueprint library refresh: ${registry.message}\n`);
@@ -588,8 +599,22 @@ async function handleRefresh({ args, parsed, projectRoot, stdout, stderr }) {
       stderr.write("re-run 'rcf define blueprint library add <ref>' to pick up the newer library (spec §10.1: freshness is advisory, adoption is an operator act).\n");
       return 3;
     }
+    // F-slice-3-02: re-snapshot the issues field so a library owner's
+    // later change to issues.repo / issues.visibility reaches
+    // consumers on refresh, without a re-add.
+    const snap = refreshRegistryIssues(registry, libraryPrefix, library);
+    if (snap.changed && !dryRun) {
+      const write = await writeLibraryRegistry(projectRoot, snap.registry, {});
+      if (isRcfError(write)) {
+        stderr.write(`[error] blueprint library refresh: ${write.message}\n`);
+        return 2;
+      }
+    }
     if (!parsed.values.quiet) {
       stdout.write(`[blueprint library] '${libraryPrefix}' refresh clean: on-disk library matches the registry snapshot.\n`);
+      if (snap.changed) {
+        stdout.write(`[blueprint library] '${libraryPrefix}' feedback destination ${dryRun ? 'would be re-snapshotted (dry-run)' : 're-snapshotted'}: ${describeIssuesTransition(snap.from, snap.to)}.\n`);
+      }
     }
     return 0;
   }
@@ -643,8 +668,26 @@ async function handleRefresh({ args, parsed, projectRoot, stdout, stderr }) {
     const finalAbs = resolveCachePath(projectRoot, entry.cachePath);
     const settleErr = await settleFinal(scratchAbs, finalAbs);
     if (settleErr) { stderr.write(`[error] blueprint library refresh: ${settleErr.message}\n`); return 2; }
+    // F-slice-3-02: re-snapshot the issues field on the registered
+    // entry now that the on-disk library has landed.
+    const registryReload = await readLibraryRegistry(projectRoot);
+    if (isRcfError(registryReload)) {
+      stderr.write(`[error] blueprint library refresh: ${registryReload.message}\n`);
+      return 2;
+    }
+    const snap = refreshRegistryIssues(registryReload, libraryPrefix, library);
+    if (snap.changed && !dryRun) {
+      const write = await writeLibraryRegistry(projectRoot, snap.registry, {});
+      if (isRcfError(write)) {
+        stderr.write(`[error] blueprint library refresh: ${write.message}\n`);
+        return 2;
+      }
+    }
     if (!parsed.values.quiet) {
       stdout.write(`[blueprint library] '${libraryPrefix}' refresh clean: git ref '${parsedGit.ref}' still resolves to ${upstream.resolvedSha.slice(0, 12)}.\n`);
+      if (snap.changed) {
+        stdout.write(`[blueprint library] '${libraryPrefix}' feedback destination ${dryRun ? 'would be re-snapshotted (dry-run)' : 're-snapshotted'}: ${describeIssuesTransition(snap.from, snap.to)}.\n`);
+      }
     }
     return 0;
   }
@@ -681,8 +724,26 @@ async function handleRefresh({ args, parsed, projectRoot, stdout, stderr }) {
     const finalAbs = resolveCachePath(projectRoot, entry.cachePath);
     const settleErr = await settleFinal(scratchAbs, finalAbs);
     if (settleErr) { stderr.write(`[error] blueprint library refresh: ${settleErr.message}\n`); return 2; }
+    // F-slice-3-02: re-snapshot the issues field on the registered
+    // entry now that the on-disk library has landed.
+    const registryReload = await readLibraryRegistry(projectRoot);
+    if (isRcfError(registryReload)) {
+      stderr.write(`[error] blueprint library refresh: ${registryReload.message}\n`);
+      return 2;
+    }
+    const snap = refreshRegistryIssues(registryReload, libraryPrefix, library);
+    if (snap.changed && !dryRun) {
+      const write = await writeLibraryRegistry(projectRoot, snap.registry, {});
+      if (isRcfError(write)) {
+        stderr.write(`[error] blueprint library refresh: ${write.message}\n`);
+        return 2;
+      }
+    }
     if (!parsed.values.quiet) {
       stdout.write(`[blueprint library] '${libraryPrefix}' refresh clean: tarball SHA-256 still matches ${expected.slice(0, 12)}.\n`);
+      if (snap.changed) {
+        stdout.write(`[blueprint library] '${libraryPrefix}' feedback destination ${dryRun ? 'would be re-snapshotted (dry-run)' : 're-snapshotted'}: ${describeIssuesTransition(snap.from, snap.to)}.\n`);
+      }
     }
     return 0;
   }
@@ -698,6 +759,86 @@ function compareLibrarySnapshot(entry, library) {
   return drifted;
 }
 
+/**
+ * F-slice-3-02: re-snapshot the library's `issues` field onto the
+ * registry entry. Design 3.3 says `library refresh` re-snapshots the
+ * feedback destination so a library owner's later change to
+ * `issues.repo` or `issues.visibility` reaches consumers without a
+ * re-add. Returns `{ changed, next, from, to }` where `next` is the
+ * merged entry to write; `changed` is true when the on-disk library
+ * carries a different repo or visibility from the registered snapshot
+ * (including the case where the entry never had the fields).
+ *
+ * @param {object} entry
+ * @param {object} library
+ * @returns {{ changed: boolean, next: object, from: object, to: object }}
+ */
+export function reSnapshotIssues(entry, library) {
+  const nextRepo = typeof library?.issues?.repo === 'string' && library.issues.repo.length > 0
+    ? library.issues.repo
+    : undefined;
+  const nextVisibility = library?.issues?.visibility === 'private' ? 'private'
+    : library?.issues?.visibility === 'public' ? 'public'
+      : undefined;
+  const from = {
+    issuesRepo: entry.issuesRepo,
+    issuesVisibility: entry.issuesVisibility,
+  };
+  const to = { issuesRepo: nextRepo, issuesVisibility: nextVisibility };
+  const changed = from.issuesRepo !== to.issuesRepo || from.issuesVisibility !== to.issuesVisibility;
+  const next = { ...entry };
+  if (nextRepo === undefined) delete next.issuesRepo;
+  else next.issuesRepo = nextRepo;
+  if (nextVisibility === undefined) delete next.issuesVisibility;
+  else next.issuesVisibility = nextVisibility;
+  return { changed, next, from, to };
+}
+
+/**
+ * Apply reSnapshotIssues across a registry: given the current registry
+ * and the freshly-loaded library, return the registry object with the
+ * matched entry replaced by the re-snapshotted one. Callers write the
+ * returned registry back through `writeLibraryRegistry`.
+ *
+ * @param {object} registry
+ * @param {string} libraryPrefix
+ * @param {object} library
+ * @returns {{ registry: object, changed: boolean, from: object, to: object }}
+ */
+function describeIssuesTransition(from, to) {
+  const fromRepo = from.issuesRepo ?? '(none)';
+  const toRepo = to.issuesRepo ?? '(none)';
+  const fromVis = from.issuesVisibility ?? '-';
+  const toVis = to.issuesVisibility ?? '-';
+  return `${fromRepo} (${fromVis}) -> ${toRepo} (${toVis})`;
+}
+
+function refreshRegistryIssues(registry, libraryPrefix, library) {
+  const nextLibs = [];
+  let changed = false;
+  let from = { issuesRepo: undefined, issuesVisibility: undefined };
+  let to = from;
+  for (const l of registry.libraries) {
+    if (l.libraryPrefix !== libraryPrefix) {
+      nextLibs.push(l);
+      continue;
+    }
+    const snap = reSnapshotIssues(l, library);
+    if (snap.changed) {
+      changed = true;
+      from = snap.from;
+      to = snap.to;
+    }
+    nextLibs.push(snap.next);
+  }
+  return {
+    registry: { ...registry, libraries: nextLibs },
+    changed,
+    from,
+    to,
+  };
+}
+
 function classifySourceRef(ref) {
   // Tarball extension wins over the transport check because `https://.../foo.tar.gz`
   // is a valid tarball ref and would otherwise be misclassified as git.
@@ -750,6 +891,14 @@ function printReview({ stdout, ref, library, libraryPrefix, coreReservations, so
   stdout.write(`\n  Provenance   : ${sourceKind}${sourceKind === 'local' ? ' (dev use)' : ''}\n`);
   stdout.write(`  Band check   : cross-checked ${coreReservations.ac.length} core AC row(s), ${coreReservations.suffixBlocks.length} core suffix block(s); no overlap.\n`);
   stdout.write(`  Prefix check : '${libraryPrefix}' does not collide with any core slug.\n`);
+  // Feedback destination line (design 3.3, AC-15801-1). Prints only
+  // when the library declares an `issues` field; a library without one
+  // is surfaced by `rcf doctor feedback-destinations` on the consuming
+  // project rather than by a review-card warning here.
+  if (library.issues?.repo) {
+    const vis = library.issues.visibility === 'private' ? 'private' : 'public';
+    stdout.write(`  Feedback destination: ${library.issues.repo} (${vis})\n`);
+  }
   stdout.write(`\n`);
 }
 

package/src/cli/coverage.js

@@ -1,10 +1,15 @@
 // `rcf coverage` subcommand handler. Reports structural coverage over
 // the REQ chain (PRD -> REQ -> US -> AC -> TS -> TC). Phase 5 §D2 / §D10.
 //
-// Shallow-any default (any AC covered by any TC = REQ covered);
-// --strict opts into per-AC-strict. --strict on a tree with uncovered
-// ACs exits 4 (CI-gate friendly). Otherwise coverage always exits 0 -
-// the gap count is data, not a refusal.
+// Referee-guarantees train (REQ-164 / US-16401, docs claims C-11 /
+// C-14): strict-by-default. The default mode is per-AC-strict; a
+// stub or stale pointer fails the gate exactly as a missing test does
+// when the plain `rcf audit coverage` command is run. The explicit
+// opt-out is `--mode shallow-any` (any AC covered by any resolving
+// TC = REQ covered), which prints the gaps and exits 0 as before. The
+// legacy `--strict` flag remains a no-op alias for the new default so
+// existing CI invocations, blueprints and dogfood scripts stay green;
+// `--mode shallow-any --strict` (or the inverse) is a usage refusal.
 //
 // Phase-boundary reminder (§D2, §1.4): this verb is a MECHANICAL /
 // DETERMINISTIC structural check. It does NOT answer "does the AC
@@ -32,24 +37,29 @@ import {
 
 const OPTION_SPEC = {
   strict: { type: 'boolean' },
+  // Referee-guarantee train (REQ-164 / US-16401): explicit --mode
+  // selector. Values: strict | shallow-any. Default: strict.
+  mode: { type: 'string' },
   format: { type: 'string' },
   help: { type: 'boolean' },
   // Phase 10 (X2 CodeNode bridge, D11): layer the code axis onto coverage.
   'with-code': { type: 'boolean' },
-  // 0.7.0 verification-integrity: opt-in extra gate on --strict that
+  // 0.7.0 verification-integrity: opt-in extra gate on strict mode that
   // refuses any TS still `draft` after Stage 4 (spec §7.2).
   'require-approved': { type: 'boolean' },
 };
 
+const VALID_MODES = new Set(['strict', 'shallow-any']);
+
 export const HELP = `Usage: rcf audit coverage [scope-id] [options]
 
 Report structural coverage over the REQ chain (PRD -> REQ -> US -> AC
 -> TS -> TC). A TC counts as covering its AC only when its testPointer
 (filePath::testName) resolves to a real test in the working tree; a TC
 whose pointer does not resolve is reported as covered-unresolved, never
-counted as coverage. Default is shallow-any (any AC covered by any
-resolving TC = REQ covered); --strict flips to per-AC-strict (every AC
-has resolving TC coverage).
+counted as coverage. Strict-by-default (per-AC: every AC has resolving
+TC coverage); --mode shallow-any is the explicit opt-out (any AC
+covered by any resolving TC = REQ covered) and always exits 0.
 
 This is a mechanical / deterministic structural check. It does NOT
 answer 'does the AC set adequately capture the REQ's intent?' - that
@@ -63,14 +73,16 @@ Positional:
                             TAD) are refused with exit 2.
 
 Options:
-  --strict                  Per-AC-strict mode; exits 4 on any gap. Also
-                            runs the attestation × profile matrix over
-                            every AC that binds a dependsOnServices
-                            entry (verification-integrity 0.7.0 §5.2):
-                            attestation drift, missing provenance, and
-                            missing FBS-level attestation all exit 4.
-  --require-approved        Extra --strict gate: refuse any TS still at
-                            authoringStatus 'draft' after Stage 4
+  --mode <mode>             strict (default) | shallow-any. Strict is
+                            per-AC and exits 4 on any gap; shallow-any
+                            prints gaps and exits 0.
+  --strict                  Legacy alias for --mode strict; kept for
+                            backward compatibility with existing CI,
+                            blueprints and dogfood invocations. A no-op
+                            under the new default; conflict with an
+                            explicit --mode shallow-any exits 2.
+  --require-approved        Extra strict-mode gate: refuse any TS still
+                            at authoringStatus 'draft' after Stage 4
                             (verification-integrity 0.7.0 §7.2). Off
                             by default; opt-in via CI.
   --with-code               Layer the code axis onto every AC: one of
@@ -117,6 +129,19 @@ export async function main(argv, deps = {}) {
     stderr.write('[error] usage coverage: multiple positional ids are not supported\n');
     return 2;
   }
+  // Referee-guarantee train (REQ-164): resolve strict-vs-shallow.
+  // Default is strict. --mode wins if set; --strict is a legacy alias
+  // for --mode strict; --mode shallow-any --strict is a usage refusal
+  // so a scripted invocation cannot silently disagree with itself.
+  if (flags.mode !== undefined && !VALID_MODES.has(flags.mode)) {
+    stderr.write(`[error] usage coverage: unknown --mode ${flags.mode} (expected strict | shallow-any)\n`);
+    return 2;
+  }
+  if (flags.mode === 'shallow-any' && flags.strict === true) {
+    stderr.write('[error] usage coverage: --mode shallow-any conflicts with --strict; pick one\n');
+    return 2;
+  }
+  const strict = flags.mode === 'shallow-any' ? false : true;
 
   const projectRoot = await findProjectRoot(cwd);
   if (!projectRoot) {
@@ -156,7 +181,7 @@ export async function main(argv, deps = {}) {
   // and a TC that fails resolution surfaces as covered-unresolved.
   const testPointers = await resolveTestPointers({ projectRoot, tree });
   const result = computeCoverage(tree, {
-    strict: Boolean(flags.strict), scopeId, withCode: Boolean(flags['with-code']), testPointers,
+    strict, scopeId, withCode: Boolean(flags['with-code']), testPointers,
   });
 
   let output;
@@ -165,16 +190,16 @@ export async function main(argv, deps = {}) {
   else output = formatTable(result, 'coverage');
   stdout.write(output);
 
-  // --strict on any gap = exit 4 (CI-gate friendly). Otherwise 0.
-  if (flags.strict && !result.ok) return 4;
+  // Strict mode on any gap = exit 4 (CI-gate friendly). Otherwise 0.
+  if (strict && !result.ok) return 4;
 
-  // 0.7.0 verification-integrity extension: --strict also runs the
+  // 0.7.0 verification-integrity extension: strict mode also runs the
   // attestation × profile matrix (spec §5.2). Three refusal classes:
   // (1) attestation missing, (2) provenance missing, (3) attestation
   // drift. All are additive — they never turn a passing coverage into
   // a passing --strict run; they only add exit-4 refusals on new
   // failure modes that the matrix now polices.
-  if (flags.strict) {
+  if (strict) {
     // Review N-3 (non-blocking): surface preFlightConfig services with
     // empty affectedFbsIds so the operator knows findAttestationMissing
     // is skipping them on purpose (honest-but-invisible without this
@@ -182,7 +207,7 @@ export async function main(argv, deps = {}) {
     // into a failing one.
     const emptyAffected = findServicesWithEmptyAffectedFbsIds(tree);
     for (const s of emptyAffected) {
-      stderr.write(`[warn] coverage --strict: preFlightConfig service '${s.serviceId}' (${s.preFlightConfigId}) has empty affectedFbsIds; the attestation-missing detector cannot cross-check it until the back-reference is populated.\n`);
+      stderr.write(`[warn] coverage strict: preFlightConfig service '${s.serviceId}' (${s.preFlightConfigId}) has empty affectedFbsIds; the attestation-missing detector cannot cross-check it until the back-reference is populated.\n`);
     }
 
     const missing = findAttestationMissing(tree);
@@ -203,14 +228,14 @@ export async function main(argv, deps = {}) {
       for (const d of drifts) refusals.push(`  - ${d.tsId}/${d.tcId} on ${d.acId} (service ${d.serviceId}): ${d.reason}`);
     }
     if (refusals.length > 0) {
-      stderr.write(`[error] coverage --strict: refused - the verification-integrity matrix caught the following:\n${refusals.join('\n')}\n`);
+      stderr.write(`[error] coverage strict: refused - the verification-integrity matrix caught the following:\n${refusals.join('\n')}\n`);
       return 4;
     }
 
     if (flags['require-approved']) {
       const draftTsIds = (tree.testSuites ?? []).filter((ts) => ts.status !== 'approved').map((ts) => ts.id);
       if (draftTsIds.length > 0) {
-        stderr.write(`[error] coverage --strict --require-approved: refused - ${draftTsIds.length} test suite(s) still not approved: ${draftTsIds.join(', ')}\n`);
+        stderr.write(`[error] coverage strict --require-approved: refused - ${draftTsIds.length} test suite(s) still not approved: ${draftTsIds.join(', ')}\n`);
         return 4;
       }
     }

package/src/cli/doctor.js

@@ -47,6 +47,14 @@ import {
 } from '../setup/managed-gitignore.js';
 import { identityProfilePath } from '../setup/identity-seed.js';
 import { knowledgePaths } from '../setup/knowledge-seed.js';
+import { readLibraryRegistry } from '../blueprint/library-registry.js';
+import { listUnresolvedLibraries } from '../feedback/destination.js';
+import {
+  diagnoseClaudeFeedbackHooks,
+  diagnoseCodexFeedbackHooks,
+  writeClaudeFeedbackHooks,
+  writeCodexFeedbackHooks,
+} from '../setup/feedback-hooks.js';
 import {
   checkBrowserPresent,
   checkPlaywrightMcpReachable,
@@ -77,6 +85,8 @@ const KNOWN_CHECKS = /** @type {const} */ ([
   'playwright-mcp-reachable',
   'playwright-mcp-redundant',
   'probe-path-owner',
+  'feedback-destinations',
+  'feedback-hooks',
 ]);
 
 /** The four Playwright-related checks doctor runs conditionally for
@@ -103,7 +113,8 @@ Options:
                             Values: agent-instructions, gitignore,
                                     knowledge, identity, playwright-present,
                                     browser-present, playwright-mcp-reachable,
-                                    playwright-mcp-redundant, probe-path-owner.
+                                    playwright-mcp-redundant, probe-path-owner,
+                                    feedback-destinations, feedback-hooks.
   --json                    Emit machine-readable envelope: { ok, drift, writes, notices }.
   --quiet                   Only summary line + first 3 drift items.
   --force                   Accept a legacy-markers --fix on hand-edited
@@ -253,6 +264,21 @@ export async function main(argv, deps = {}) {
       // Runs on every project (not gated on browser-facing). Spec:
       // projects/rcf-lite-wsd/specs/rcf-lite-probe-path-alignment-spec-2026-09-04.md section 9.
       result = await runProbePathOwnerCheck(ctx);
+    } else if (check === 'feedback-destinations') {
+      // Feedback destination coverage across the library registry
+      // (design 3.3, AC-15801-3). Warn-only: --fix does not touch
+      // destinations. The fix is for the library owner (add the
+      // `issues` field to library.json) or the consuming operator
+      // (contact the library owner).
+      result = await runFeedbackDestinationsCheck(ctx);
+    } else if (check === 'feedback-hooks') {
+      // Feedback hook install coverage across .claude/settings.json
+      // and .codex/hooks.json (ADR-4108, AC-16104-3). Missing
+      // entries are fixable; foreign entries (a rcf feedback hook
+      // command under our marker but with different flags) are
+      // refused and named in the drift row so the operator can
+      // repair by hand.
+      result = await runFeedbackHooksCheck(ctx);
     } else continue;
     for (const d of result.drift) drift.push({ check, ...d });
     for (const w of result.writes) writes.push(w);
@@ -262,8 +288,12 @@ export async function main(argv, deps = {}) {
   // fixable drift item exits 0 even though drift WAS reported at scan
   // time. Exit 3 only when at least one drift item remains unrepaired
   // (either --fix was not passed, or the item was refused by --fix).
-  const refusedCount = drift.filter((d) => d.refusedByFix).length;
-  const unrepairedCount = ctx.fix ? refusedCount : drift.length;
+  // Rows flagged `warnOnly: true` are surfaced in output but never
+  // ratchet the exit code up (design 3.3 feedback-destinations); they
+  // still appear in --json for tooling.
+  const gatingDrift = drift.filter((d) => d.warnOnly !== true);
+  const refusedCount = gatingDrift.filter((d) => d.refusedByFix).length;
+  const unrepairedCount = ctx.fix ? refusedCount : gatingDrift.length;
   const ok = unrepairedCount === 0;
   const exitCode = ok ? 0 : 3;
 
@@ -284,10 +314,21 @@ export async function main(argv, deps = {}) {
 /** Render a human-readable summary. */
 function writeHumanSummary({ stdout, ok, drift, writes, fixed, quiet }) {
   const repaired = writes.length;
-  if (ok && repaired === 0) {
+  const warnOnlyRows = drift.filter((d) => d.warnOnly === true);
+  const gatingRows = drift.filter((d) => d.warnOnly !== true);
+  if (ok && repaired === 0 && warnOnlyRows.length === 0) {
     stdout.write('rcf doctor: clean.\n');
     return;
   }
+  if (ok && repaired === 0 && warnOnlyRows.length > 0) {
+    stdout.write(`rcf doctor: clean (${warnOnlyRows.length} warning${warnOnlyRows.length === 1 ? '' : 's'}).\n`);
+    const limit = quiet ? 3 : warnOnlyRows.length;
+    for (const d of warnOnlyRows.slice(0, limit)) {
+      stdout.write(`  [${d.check}] ${d.item} ${d.file} [warn]\n`);
+      if (!quiet) stdout.write(`      ${d.message}\n`);
+    }
+    return;
+  }
   if (ok && repaired > 0) {
     // Every drift item was repaired successfully. Report the repair
     // count so the operator sees what the run did.
@@ -295,13 +336,14 @@ function writeHumanSummary({ stdout, ok, drift, writes, fixed, quiet }) {
     for (const w of writes) stdout.write(`  fixed: ${w.file} (${w.action}).\n`);
     return;
   }
-  const refused = drift.filter((d) => d.refusedByFix);
-  stdout.write(`rcf doctor: ${drift.length} drift item${drift.length === 1 ? '' : 's'}`);
+  const refused = gatingRows.filter((d) => d.refusedByFix);
+  stdout.write(`rcf doctor: ${gatingRows.length} drift item${gatingRows.length === 1 ? '' : 's'}`);
+  if (warnOnlyRows.length > 0) stdout.write(`, ${warnOnlyRows.length} warning${warnOnlyRows.length === 1 ? '' : 's'}`);
   if (fixed) stdout.write(` (${repaired} repaired, ${refused.length} refused)`);
   stdout.write('.\n');
   const limit = quiet ? 3 : drift.length;
   for (const d of drift.slice(0, limit)) {
-    const tag = d.refusedByFix ? ' [refused]' : '';
+    const tag = d.warnOnly ? ' [warn]' : d.refusedByFix ? ' [refused]' : '';
     stdout.write(`  [${d.check}] ${d.item} ${d.file}${tag}\n`);
     if (!quiet) stdout.write(`      ${d.message}\n`);
   }
@@ -780,6 +822,152 @@ async function runProbePathOwnerCheck(ctx) {
 }
 
 
+/* ------------------------------------------------------------------ */
+/* Check: feedback-destinations                                       */
+/* ------------------------------------------------------------------ */
+
+/**
+ * List every registered library whose feedback destination the resolver
+ * cannot produce (no `issues.repo` on the library manifest and no
+ * derivable github source on the registered `sourceRef`). Warn-only:
+ * --fix does not touch destinations; the fix is on the library owner
+ * to publish an updated library with `issues` or on the consuming
+ * operator to contact them.
+ *
+ * A project that has never added a library returns no drift (the empty
+ * registry is not itself a defect). An unparseable registry surfaces as
+ * one refused drift row so a broken projection is not silently ignored.
+ *
+ * @param {object} ctx
+ * @returns {Promise<{ drift: Array<{item: string, file: string, message: string, refusedByFix: boolean}>, writes: Array<{file: string, action: string}> }>}
+ */
+async function runFeedbackDestinationsCheck(ctx) {
+  const drift = [];
+  const registry = await readLibraryRegistry(ctx.projectRoot);
+  if (registry && typeof registry === 'object' && 'kind' in registry) {
+    // rcfError: the registry file is present but unparseable. Report
+    // as one refused row so doctor never claims clean on a broken file.
+    drift.push({
+      item: 'registry-unreadable',
+      file: 'rcf/blueprint-libraries.json',
+      message: `library registry could not be read: ${registry.message}. Repair the file by hand or re-run 'rcf define blueprint library add' to rebuild the entry.`,
+      refusedByFix: true,
+    });
+    return { drift, writes: [] };
+  }
+  const unresolved = listUnresolvedLibraries(registry);
+  for (const row of unresolved) {
+    const contactSuffix = row.publisherContact ? ` Contact: ${row.publisherContact}.` : '';
+    const reasonSummary = row.reason === 'no-issues-field'
+      ? 'the library declares no issues field on library.json'
+      : 'the registered sourceRef is not a github.com URL the resolver can derive from';
+    drift.push({
+      item: 'unresolved-library',
+      file: 'rcf/blueprint-libraries.json',
+      message: `library '${row.libraryPrefix}' has no resolvable feedback destination: ${reasonSummary}. Feedback entries on its blueprints route to a bundle at .rcf/feedback/outbox/ instead of a github issue.${contactSuffix} Fix in the library's own library.json (add an issues object per design 3.3); doctor --fix cannot repair this.`,
+      refusedByFix: true,
+      warnOnly: true,
+    });
+  }
+  return { drift, writes: [] };
+}
+
+
+/* ------------------------------------------------------------------ */
+/* Check: feedback-hooks                                              */
+/* ------------------------------------------------------------------ */
+
+/**
+ * Diagnose both harness config files and report:
+ *   - missing-hook (per event per file): fixable with --fix; the
+ *     installer merges the entry in without touching neighbours;
+ *   - foreign-hook (per file): an entry whose command names our
+ *     marker but whose flags/timeout/matcher differ from the current
+ *     install shape. Refused: the operator repairs by hand so a
+ *     bespoke variant is not silently overwritten;
+ *   - parse-error (per file): a settings file that exists but is not
+ *     valid JSON. Refused; the operator repairs by hand.
+ *
+ * With --fix, only missing-hook rows are repaired; the writer never
+ * touches a file when the merge would produce a foreign row.
+ *
+ * @param {object} ctx
+ * @returns {Promise<{ drift: Array<{item: string, file: string, message: string, refusedByFix: boolean}>, writes: Array<{file: string, action: string}> }>}
+ */
+async function runFeedbackHooksCheck(ctx) {
+  const drift = [];
+  const writes = [];
+
+  const claudeDiag = await diagnoseClaudeFeedbackHooks({ projectRoot: ctx.projectRoot });
+  if (claudeDiag.parseError) {
+    drift.push({
+      item: 'parse-error',
+      file: '.claude/settings.json',
+      message: `.claude/settings.json is present but not valid JSON (${claudeDiag.parseError}). Repair by hand.`,
+      refusedByFix: true,
+    });
+  } else {
+    for (const event of claudeDiag.missing) {
+      drift.push({
+        item: 'missing-hook',
+        file: '.claude/settings.json',
+        message: `.claude/settings.json is missing the feedback ${event} hook; \`rcf doctor --fix\` merges it in.`,
+        refusedByFix: false,
+      });
+    }
+    for (const f of claudeDiag.foreign) {
+      drift.push({
+        item: 'foreign-hook',
+        file: '.claude/settings.json',
+        message: `.claude/settings.json ${f.event} hook has a foreign command shape (${f.command}); refused. Repair by hand or remove the entry and re-run \`rcf init\`.`,
+        refusedByFix: true,
+      });
+    }
+    if (ctx.fix && claudeDiag.missing.length > 0 && claudeDiag.foreign.length === 0) {
+      const w = await writeClaudeFeedbackHooks({ projectRoot: ctx.projectRoot });
+      if (!('kind' in w)) {
+        writes.push({ file: '.claude/settings.json', action: w.action });
+      }
+    }
+  }
+
+  const codexDiag = await diagnoseCodexFeedbackHooks({ projectRoot: ctx.projectRoot });
+  if (codexDiag.parseError) {
+    drift.push({
+      item: 'parse-error',
+      file: '.codex/hooks.json',
+      message: `.codex/hooks.json is present but not valid JSON (${codexDiag.parseError}). Repair by hand.`,
+      refusedByFix: true,
+    });
+  } else {
+    for (const event of codexDiag.missing) {
+      drift.push({
+        item: 'missing-hook',
+        file: '.codex/hooks.json',
+        message: `.codex/hooks.json is missing the feedback ${event} hook; \`rcf doctor --fix\` merges it in.`,
+        refusedByFix: false,
+      });
+    }
+    for (const f of codexDiag.foreign) {
+      drift.push({
+        item: 'foreign-hook',
+        file: '.codex/hooks.json',
+        message: `.codex/hooks.json ${f.event} hook has a foreign command shape (${f.command}); refused. Repair by hand or remove the entry and re-run \`rcf init\`.`,
+        refusedByFix: true,
+      });
+    }
+    if (ctx.fix && codexDiag.missing.length > 0 && codexDiag.foreign.length === 0) {
+      const w = await writeCodexFeedbackHooks({ projectRoot: ctx.projectRoot });
+      if (!('kind' in w)) {
+        writes.push({ file: '.codex/hooks.json', action: w.action });
+      }
+    }
+  }
+
+  return { drift, writes };
+}
+
+
 /**
  * Default reader for the project-root .mcp.json body. Returns the parsed
  * object, or null on missing / unparseable (doctor treats an unparseable