session-orchestrator 3.20.0 → 3.22.0

package/CHANGELOG.md

@@ -7,6 +7,521 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.22.0] - 2026-08-22
+
+Twenty commits (12 `fix`, 5 `docs`, 2 `feat`, 1 `chore`; 150 files, +17,312/−2,575), no
+`BREAKING CHANGE:` footer and no `!` subject. One strand runs through all of it:
+**an instrument that reported confidently and measured the wrong quantity.** Not a
+threshold set too tight, not a rule too strict — the wrong quantity, reported with the
+same certainty as the right one. The host-resource warning fired on **99.0% of 1,477
+measured session starts** and nobody could falsify it, because the two fields it was
+computed from were never persisted. A hygiene probe announced "37 files (11 MB)" while
+sizing the entire directory instead of the 37 — factor ~18 — and proposed deleting
+version-controlled source files, because it never asked git. And the questions this tool
+puts to its operator had never been measured at all: **21 of 72 passed** on first
+measurement, and the single dominant cause was a 12-codepoint header limit that silently
+truncated 30 of them.
+
+### Added
+
+- **The operator's questions are now measured before he reads them (#1107).** `scripts/auq-audit.mjs`
+  scores every `AskUserQuestion` block and every prose fallback list against eight criteria
+  (K1–K8) plus two hard hurdles, all thresholds sourced from one registry — no hard-coded
+  number in the scorer. The census found **three populations, not one**: 40 Claude Code blocks,
+  10 Codex prose lists, and 17 that every prior count had missed (9 `.cursor/rules/*.mdc` with
+  10 choice blocks, plus 6 runtime questions inside `.mjs`). Baseline **21 of 72 (29%)**, after
+  the pass **72 of 72**. The dominant cause was structural: `header` caps at 12 codepoints and
+  the tool truncates silently — **26 of 42 headers exceeded it**, and one NFD-composed header
+  measured 12 visible characters as 14, destroying the question. Population A — the operator's
+  own path — ran 62% failing against 0% for the Codex and Cursor forms, which carry no header
+  at all.
+- **A guard on the guard (#1122 groundwork).** The `AskUserQuestion` PreToolUse hook denies only
+  the two hard hurdles and reports the rest to stderr; `check-auq-clarity` is wired into
+  `validate-plugin` and blocks on H1/H2 with a measured 0% false-positive rate. Its own wiring is
+  proven by fake regression, not asserted.
+- **`/eli5`** — say the last answer again in plain words, same facts, in the order the operator
+  needs them.
+
+### Fixed
+
+- **The warning that fired on 99.0% of all session starts (#1089).** Measured over **1,477
+  `orchestrator.session.started` events across 18 repos**: `ram_free_gb < 2` fired on 84.0%,
+  `claude_processes >= 5` on 93.6%, any of the three on **99.0%** — against 4,884 stop events
+  with zero OOM markers. Three independent measurement errors, no threshold among them.
+  (a) `os.freemem()` on Darwin reports only `Pages free` — median **0.4 GB** on hosts with
+  24–128 GB — so memory is now judged on `memory_pressure_pct_free` and a better signal
+  *replaces* a worse one rather than suppressing it. (b) `concurrent-sessions-warn` is
+  denominated in sessions and was compared against a process count; measured ratio **6.0:1**.
+  Same threshold, right denominator: 93.6% → **4.2%**. (c) One noisy axis could cap a wave;
+  now two independent soft signals must agree. The verdict had reached `sessions.jsonl` for
+  **15 of 1,734 sessions (0.9%)**, which is why the false alarm survived four months while six
+  repos independently wrote it into their learnings store — one at confidence **1.0**.
+  Codified as `.claude/rules/host-resources.md` (HR-101..106).
+- **A standing condition is not a second opinion (#1089 follow-up).** The first live run of the
+  rebuilt verdict returned `warn | cap 2 | soft: ["cpu","zombies"]`. Zombie processes are idle
+  by definition — they cannot cause the load they are paired with — and are always present
+  (6, 13 and 9 in three readings minutes apart). They report; they never count toward the
+  two-signal rule.
+- **A probe that sized the wrong set and never asked git.** `checkStaleArtifacts` computed its
+  byte figure over the whole of `.orchestrator/` instead of the aged subset it names —
+  the 37 files weighed **0.68 MB against 11 MB reported**. Independently, it consulted git
+  nowhere and therefore proposed pruning seven tracked, runtime-read source files, among them
+  the policy file `pre-bash-templates-first.mjs` reads and the two steering documents
+  session-start loads. The git exclusion is fail-**silent**, not fail-open: falling back to
+  "nothing is tracked" *is* the defect it closes.
+- **Only the raw session ID releases a lock (#1085).** One session carried three identities —
+  STATE.md said `session-2`, the lock said `session-3`, issue-budget counted against a third
+  UUID — and `findPeers` reported the session's own presence as a foreign peer. The semantic
+  ID is now attribution metadata only; a release requires exact raw-ID equality, and a
+  semantic hint resolves to a raw ID only against a verified local binding. The companion fix
+  to issue-budget removed a data-loss path in which an identity-less invocation wrote its
+  fresh state into the shared counter and erased a live session's parked overflow.
+- **The npm receipt is the boundary — and a `throw` lay behind it (#1088).** `publish()` threw
+  *after* a successful `npm publish`, during a 12-second registry-propagation poll: published,
+  not tagged, not pushed, reported as "failed, retryable". Propagation now returns a typed
+  outcome, each post-receipt step gets exactly one attempt, and everything else is collected as
+  `post-publish-reconciliation`. Leak detection decides on an extracted path rather than a regex
+  over `npm notice` prose (`contest` ≠ `tests`), and `ensureGithubRelease` became tri-state so
+  an auth or network answer no longer reads as "no release exists".
+- **`--silent` leaked into the children, and the gate discarded its own diagnosis (a4f93cf).**
+- **The empty sidecar path skipped the collision gate with exit 0 (#1083).** A coordinator that
+  wrote only the aggregate form of the two-shape scope declaration ran **six waves and ~27
+  dispatches with zero `FILE-SCOPE` injection** — and the absence looked identical to a clean
+  run. `scripts/materialize-wave-scope.mjs` is now the canonical writer of both shapes.
+- **The GitLab target comes from the explicit path (#1065).** `glab repo view --output json`
+  materialised a full project response to read one field; on 2026-08-17 that response carried a
+  runner registration credential into a tool transcript. Project identity is now
+  `(host, URL-encoded namespace/project)` with traversal and double-encoding rejection, and the
+  same minimisation reached the vault-backfill path.
+- **The restore froze after its first run (#state-md).** Also: a `gitleaks` allowlist that grew
+  by one proper name per incident now matches on a word boundary instead.
+- **Four count claims where the checker could only see two (#docs-parity).** `docs/components.md`
+  claimed 46 skills and 26 commands against 47 and 27 on disk. The drift checker reported two —
+  its patterns are `^##`-anchored — while a census of the same two surfaces in the same file
+  found four; the two inside the Mermaid diagram were already self-contradictory before the fix.
+
+### Notes
+
+`.claude/rules/host-resources.md` is new and always-on. `.claude/rules/bash-harness-pitfalls.md`
+gained no rule text this line, but two measurement traps were recorded against it in the
+learnings store: `rg -rn` is not `grep -rn` (`-r` is `--replace` and silently substitutes every
+match), and zsh does not word-split an unquoted variable, so a multi-path `git log -- $paths`
+reports zero matches with exit 0 — both produce a plausible wrong number without erroring.
+
+## [3.21.0] - 2026-08-19
+
+Twenty-one commits (12 `fix`, 4 `feat`, 4 `docs`, 1 `chore`; 209 files, +28,906/−2,893), no
+`BREAKING CHANGE:` footer and no `!` subject. Three strands — guard mechanics, the public
+site, cross-session messaging — that turned out to be one strand: **a fact maintained in two
+places, and a guard that is green without biting.** The sharpest instances are always the
+quiet ones. **12 of 46 `SKILL.md`** and **14 of 16 `agents/*.md`** carried frontmatter that is
+not YAML while every frontmatter checker in the tree had reported them clean for as long as
+they existed. The v2 vault renderer's branch condition was **structurally false from its first
+commit** and matched **0 of 253** session records. And the scope guard shipped, in the agent's
+own channel, the command that disarms it.
+
+### Added
+
+- **Cross-session messaging is wired (#1049, #1050, #1047 — Epic #1048, waves 1–2 of 5).**
+  New always-on rule `.claude/rules/cross-session-messaging.md` with CSM-001..005, and the PSA
+  decision tree gained a peer-inform branch that hangs **below** the sibling check on the
+  foreign-scope leg — so it can mask neither the sibling branch nor the PSA-002 pause. That is
+  structural, not prose. The two-axis rationale is re-founded rather than restated: the moat
+  was never "peer sessions cannot talk to each other" — two independent sessions in one working
+  copy exchanged full round-trips on 2026-08-16 — it is that they share **one working copy**,
+  and what crosses the channel is information, never isolation. `READ_ONLY_TOOLS` gained
+  `SendMessage` + `ListAgents`, the mechanical precondition for upward agent escalation;
+  `validateTierConsistency` filtered on `WRITE_TOOLS` and therefore named **no culprit at all**
+  for an unknown tool.
+- **The public site is rebuilt, and it now proves its own numbers (#1043–#1046).** The live
+  page had served v3.19.0 against v3.20.0 in the repo for six days, all five legal paths were
+  404, and the `Measured` block — the honesty argument of the whole page — carried five wrong
+  numbers.
+  - The load-bearing element is a band whose station height **is** the file count a wave may
+    write: `--unit: 15px` = one file. Discovery is therefore not a box of height 0 but a stroke
+    on the baseline — the moment the limit becomes visibly geometric rather than requested.
+  - Mobile had **no** navigation at all (`display:none`, no hamburger, 20 viewports of scroll);
+    6 links are now visible at 390px. Twelve sections in identical scoring and 27 equally loud
+    cards became 10 sections with three loud blocks, cutting rendered height to **52.4%**
+    (10,350 → 5,428px — the factor is the durable figure, the viewport count is not: 5.98
+    viewports holds at 908px window height and becomes 6.03 at 900px). State no longer rides on
+    red/green alone but on shape **and** glyph. Cold-load acceptance without `<script>`: 115
+    content-bearing elements, 0 invisible, identical height — the page hangs on no condition.
+  - **`vercel.json`** carries the deploy configuration **versioned** instead of clicked into a
+    dashboard: `outputDirectory: "site"`, CSP/HSTS/`frame-ancestors` headers, www→apex redirect.
+    The Vercel Git integration is connected, so a push to the GitHub mirror publishes the site.
+    In `scripts/release.mjs` the checklist line `cd site && vercel --prod` is replaced by
+    `verifyLiveSite()` with four **distinguished** outcomes (version mismatch / success /
+    network error / surface moved), not collapsed onto a flat "not ok".
+  - **`scripts/site-numbers.mjs`** — 13 metrics read from the repo and written into
+    `data-metric` spans, ending the hand-maintained number block. Its first run against the new
+    page caught three real errors, one of them the coordinator's (`skills: page says 47, repo
+    says 46` — `skills/_shared/` has no `SKILL.md` and is not a skill) and one a contract defect
+    that would have produced `vv3.20.0` at the next release. Wired into `--set-version`,
+    deliberately **not** into CI: `sessions` and `learnings` grow every session, so a pipeline
+    gate on them would be permanently red.
+  - **`/guide`** — the four install paths, the first session with the honest number (7–10
+    questions, 2–4 minutes, not the claimed "one question"), and a section on recognising that
+    a session failed silently. The reason is a census, not a hunch: **all four issues opened by
+    people outside this repo are install or environment failures, not one a feature request**
+    (`gh issue list -R Kanevry/session-orchestrator --state all`; authors ≠ owner: #53, #54,
+    #62, #63).
+  - **`/impressum` and `/datenschutz`.** The privacy policy is not copied but written from the
+    measured processing: 0 external requests, no analytics, self-hosted fonts (3 files,
+    55,052 B), Vercel server logs only. The sibling site's Vercel-Analytics sections are absent
+    on purpose — `grep` shows they are not active here. Sitemap 1 → 4 URLs.
+- **Two catchers for the untracked-test-dependency class (#1081), because one was structurally
+  blind.** A differential run compares test *status*, and a test that swallows a missing file
+  and passes in **both** trees produces no difference at all. Statically:
+  `scripts/lib/validate/check-untracked-test-deps.mjs`, rules R2 (a statically resolved repo
+  root passed into an import closure that names an untracked path) and R4 (cwd-relative read),
+  measured 2/2 recall at 0 false positives where the obvious variants sat at 98–99% FP.
+  Structurally: `.husky/pre-push` materialises the sha being pushed via `git clone
+  --no-hardlinks` (1.04 s; `git archive` is unusable — without `.git`, 21 tests fail with "not a
+  git repository") and runs the gate **there**. It came within one function of being worthless:
+  `findProjectRoot()` checks `CLAUDE_PROJECT_DIR` and five siblings **before** cwd, so the gate
+  would have started in the tmp tree and read the working-tree files anyway.
+- **A tracked census snapshot, `site/_census.json`, with ledger precedence** — per-metric opt-in
+  for exactly `sessions`, `learnings`, `counted-sha`, never a blanket fallback, which would have
+  made `collect()` blind to "wrong root". `optional: true` was considered and rejected by name:
+  it would have let the two tiles fall silently back into the hand-maintained state while
+  `--check` still reported the page as current — verbatim the silent-failure class the script
+  was written against. A known metric id without a value is now a third contract violation
+  (`unresolved`).
+- **`tests/setup/scrub-git-env.mjs`, `scripts/lib/git-config-drift.mjs`, and
+  `check-test-git-config-target.mjs`** — the mechanism against this session's own accident (see
+  Notes). The setup file removes nine redirect-capable git variables once per worker; that is
+  the root, because the two lines that caused the damage passed a **correct** cwd, and `GIT_DIR`
+  beats cwd, `-C`, and even the positional of `git init <dir>`. The drift probe covers the
+  surface `git status` does not show, and runs with a filtered environment — a set `GIT_DIR`
+  would otherwise redirect the probe itself into a foreign repo and call this one clean. The
+  lint rule is WARN-only out of measurement, not caution: its first formulation had 11 hits,
+  **all** false positives (each a `git init <dir>` where the positional **is** the target); it
+  ends at 150/150 with a target.
+- **`scripts/lib/validate/check-skills.mjs` — a real parser over all 46 `SKILL.md`**,
+  registered in `validate-plugin.mjs`. The sibling `check-agents.mjs` validated frontmatter
+  with line-oriented regexes, which is precisely how the 12 broken blocks stayed invisible:
+  an unquoted `description:` containing a `: ` (`"Iron Law: NO FIXES"`) is not YAML, but a
+  regex looking for `^description:` sees nothing wrong, and Claude Code's own loader is
+  lenient enough that the defect never surfaced at runtime. A `js-yaml` `CORE_SCHEMA` parse
+  is now rule R8 and the five field rules hang off it — none of them can be evaluated on a
+  block that does not parse. Deliberately **not** implemented: a block-scalar ban (see
+  below), and length ceilings on `name`/`description`, because no spec vendored in this repo
+  states one and an invented requirement is worse than none.
+- **`scripts/lib/validate/frontmatter-block.mjs` — shared extraction, deliberately unshared
+  rules.** The extractor stood verbatim in two checkers, so the next change to the block
+  format would have landed in one copy and one gate would have started accepting what the
+  other rejects — with no test able to see it, because each gate tested its own copy. The
+  module owns the byte range and nothing else, and its header records why the three checkers
+  must stay **contradictory**: `check-agents.mjs` bans `description: >` because the agent
+  loader cannot read a folded scalar, while `check-skills.mjs` must tolerate it — for
+  `SKILL.md` the folded form is the only shape that makes the `: ` collision structurally
+  impossible, 35 of 46 files now use it, and porting the agent ban here would red 35 of 46
+  and forbid the very fix that made the gate green. The divergence is the requirement, not
+  drift.
+- **`scripts/lib/mirror-issues-banner.mjs` — the GitHub-mirror blind spot**, wired into
+  `skills/session-start/SKILL.md` Phase 4. VCS auto-detection picks exactly one platform, so
+  in a GitLab-origin repo with a public GitHub mirror no code path ever read the mirror's
+  issues: everything filed by an external reporter was structurally invisible to every
+  session. The probe asks the other side, hard-pinned to `github` (auto-detecting here would
+  reproduce the defect it exists to compensate for) and **self-disabling** — no `github`
+  remote resolves to `undefined` → `null` → no spawn, no network call. No new Session Config
+  key by design: the spec comes from `git remote`, and a key would be a second SSOT drifting
+  against it. The return is three-valued, not two — `null` means *never asked* or *asked and
+  clean*; a `degraded` field with a closed enum means *the query failed and the state is
+  unknown*. Collapsing that third state into `null` is what makes a dead probe
+  indistinguishable from a healthy repo, which is the next section's recurring theme.
+- **`atomicWriteWithBackup()` in `scripts/lib/io.mjs`** — the tmp-write/rename/`.bak-<ISO>`
+  primitive that `writeJsonAtomicSync` now delegates to, ending a second copy of the same
+  sequence (#734).
+- **`check-unwired-features` signal S3 `orphaned-prose-module`** — a config key is not the
+  only thing prose can promise; a document can also assert that a module does a job nothing
+  calls. S3 fires only where the claim is in the **passive voice with a bare filename and no
+  exported symbol**: "…*are validated* against `foo.mjs`" asserts that something happens by
+  itself, whereas "dispatch via `runWavePool()`" addresses a reader who will do it. The
+  broader check — every export with no non-test importer — was measured and rejected: 1366
+  exports, 779 unimported, 93.2% false positives naive and still 81.2% after four exclusion
+  rules. A gate that prints 282 lines is switched off in week two, which is this file's own
+  disease one level up. Measured 2026-08-14, the cascade narrowed 452 production modules to
+  **2**; one of those is deleted below, so the live report now stands at 1. Read a near-empty
+  report as designed, not broken — S3 is a relapse guard, not a cleanup tool.
+- **[ADR-0012](docs/adr/0012-pseudonym-map-privacy.md)** — host-local pseudonym map for
+  owner-leaky repo namespaces. An ADR rather than a code comment precisely because every
+  element reads like removable defensiveness at its call site while being load-bearing for a
+  property no test can observe directly: a green suite is fully compatible with the leak.
+
+### Fixed
+
+- **The documented Claude Code install path was guaranteed broken.** `claude plugin dir` is not
+  a subcommand: `claude plugin dir session-orchestrator` answers `error: unknown command 'dir'`
+  and exits 1 (measured on Claude Code 2.1.235; `claude plugin --help` lists 14 subcommands and
+  `dir` is none of them). The `||` fallback therefore fired **every** time and pointed at
+  `~/.claude/plugins/session-orchestrator`, a directory that does not exist — so `cd` failed,
+  `&&` aborted, `npm install` never ran, and the hooks could not find `zx`. That is the cause
+  behind external issues #62/#63, whose reporters described the symptom. Replaced by a
+  layout-independent resolution through the plugin cache, extracted from the **shipped**
+  `site/index.html`, entity-decoded and executed verbatim: exit 0, correct path. Second defect
+  in `migration-v3.md` fixed alongside — a marketplace-installed plugin sits in a managed cache,
+  not a git checkout, so `git pull` there does nothing; replaced by `/plugin update`. Five sites
+  in five files; the two remaining matches for `claude plugin dir` are deliberate quotes on the
+  site explaining the breakage.
+- **The v2 vault renderer was dead at birth (#1074).** `total_agents` stands in
+  `REQUIRED_FIELDS`, so the branch condition `total_agents === undefined` is structurally false
+   — written 4h23m before the first record that could have matched it, and matching **0 of 253**
+  records since. The obvious fix would have been **worse than the bug**: `agents` is polymorphic
+   — measured over 599 wave objects, **210× a number and 14× an array** — so a naive `??` would
+  have written `[object Object]` into the vault. A type-aware alias chain repairs 239 agent, 5
+  files and 280 quality cells at changed-existing = 0. The fixtures are now harvested golden
+  records; the old `makeV2Entry` invented a record no production writer can produce.
+- **Four blind probes and one active fail-open (#1039).** `backlog-scan` folded "no remote" and
+  "query failed" into a silent `null`, from which the mode selector read "contributes 0 delta" —
+  a 40-issue backlog with critical labels looked like an empty one. `ci-status-banner` forbade in
+  its own comment at ~line 490 the very form it still used. `named-vault-resolver` had one
+  `source: 'fallback'` covering two causes (honestly relativised by the agent:
+  `resolveNamedVault` has zero production callers, so the defect was real but not yet reachable).
+  `scope-baseline` hardcoded `'origin/main...HEAD'` twice, and the damage sat elsewhere than in
+  the name: `wave-loop.md:874` renders `skipped: 'unresolvable-ref'` **silently**, so the
+  scope-drift tripwire was permanently inert in every non-origin repo and never said so.
+  `vault-mirror/namespace` `deriveRepo()` degraded silently to `basename(cwd)` and wrote that as
+  repo **identity** into the vault — which then happened for real this session. And
+  `harness-audit` category 6 was an active fail-open: outside a git repository it awarded **2/2
+  with "no github mirror remote configured — skipped"**; a non-measurable query now fails 0/2,
+  full marks only for genuine absence. Census correction: **14** executable origin hardcodings,
+  not the 4 the issue named.
+- **The scope guard shipped the instructions for its own disarmament (#1057).** The
+  stale-manifest branch ended on ``remove it with `rm -f <path>` and let the coordinator write a
+  fresh manifest`` — and that string travels through `emitDeny()` in `permissionDecisionReason`,
+  i.e. into the context of the very agent whose edit was just denied. Reproduced end to end from
+  the coordinator: `rm -f` is **allowed** by `pre-bash-destructive-guard.mjs` (14 rules, only
+  `rm-rf-destructive` bites); with the manifest removed, an in-project `Edit` is ALLOW **and** a
+  `Write` to `/etc/` is ALLOW — not only gate 7 (allowedPaths) falls but gate 6 (containment),
+  because under the exit-0 protocol the hook then emits no decision at all and exit 0 is not a
+  veto. The guard was off for the rest of the session. Not theoretical: a **parallel** session in
+  the same working copy received this suggestion for the **live** `wave-scope.json` of this one,
+  and declined only on an indicator (mtime 7 minutes old), not on knowledge — at one hour of age
+  the same indicator points the other way. The new text names both cases instead of guessing one
+  and routes to `blocked` per PSA-001/003/007. `systemMessage` was examined and deliberately not
+  used: `io.mjs:329` says the operator sees that field, `hook-development/SKILL.md:108` says it
+  is "shown to Claude" — a session-wide guard disarmament does not belong on a channel whose
+  reader the repo cannot name consistently.
+- **The owner-leakage scanner was blind to `.html` (#1076) — and its first sighted run found a
+  real defect.** The naive fix would have excluded **nothing**, because the sanctioned form
+  carries no `www.` while the site uses `www.` throughout; the result would have been a
+  permanently red gate including pre-commit. Then the eighth planted defect: seven forms had been
+  driven against the new coverage and all seven bit, but all seven sat in the CP1 corridor, and
+  CP1 is the **only** one of the eleven rules that runs through `canonicalizeLine()` — revived,
+  in other words, for 1 of 11. The eighth is an entity-encoded dot in the **domain**, which a
+  browser resolves and the scanner did not. CP2/CP3/CP7/CP8 now additionally check the canonical
+  form, and the discriminator is measured rather than guessed: dot-anchored rules gain
+  (canonicalisation can never fabricate a dot from a separator) while slash- and slug-anchored
+  rules stay raw (canon folds `-` onto `/`, which flips CP4/CP10 false→true and shreds CP6).
+  `isAllowlisted()` on the canonical form would have been **wrong** — canon breaks its own
+  allowlist — so the design uses an occurrence counter instead: if the canonical form carries
+  more domain tokens than the raw one, the surplus came from a decoding and can never be the
+  sanctioned publication. Cost repo-wide: 0 new findings.
+- **Admitting `.html` to `check-unicode-safety.mjs` immediately found a live legal defect.**
+  `site/datenschutz/index.html:277` carried a `U+00AD` at end of line. A soft hyphen does **not**
+  suppress the break — HTML collapses newline plus indentation into a space — so the page
+  rendered "Auftragsverarbeitungs vereinbarung", visibly broken, on a legally required page.
+  Deleting the `U+00AD` alone would not have fixed it; the space would have remained.
+- **Six findings from the review panel against the site, the most important a false promise
+  (#1043/#1044/#1046).** The privacy policy described a network request that does not exist — a
+  reload of `leaderboard.json` including `credentials: 'omit'` — while a grep for
+  `fetch(|XMLHttpRequest|sendBeacon|WebSocket|EventSource|import(|new Image` across all four
+  pages returns 0 hits. The direction is harmless (over- rather than under-declared); the place
+  is not, because §10 expressly invites the reader to open the network tab and check. It was the
+  single statement on the page a reader could falsify in two minutes — on a page whose thesis is
+  checkability. Struck without replacement. The other five: a `TODO` placeholder shipped live in
+  public source (`index.html:665`), a `/guide` canonical that contradicted itself three ways,
+  missing og/twitter tags on all three subpages (a shared guide link rendered as a bare URL in
+  Slack, X and Discord — for a product distributed through shared links, the one classically
+  SEO-adjacent item with real return), `offers` struck from the JSON-LD, and an unquantified
+  absolute ("Every issue an outside user has ever opened" → "All four issues opened by people
+  outside it") two paragraphs above where the number already stood correctly.
+- **A character allowlist in the census generator, and a `ReferenceError` on the path that
+  enforces it.** `rewrite()` checked `/[<>]/` against the **old** cell content, never the new
+  value. Eleven of the thirteen metrics are digits or hex by construction, but `version` is
+  whatever `package.json` says and `readPackageVersion` only checks "non-empty string" — a
+  prepared version literal could have closed the `<span>` and opened a tag. The precondition is
+  write access to `package.json`, which in this repo's trust model already means full access, so
+  this is defence in depth rather than an open hole — but it is the one place where `script-src
+  'unsafe-inline'` would stop being theoretical. A rejection now refuses the **whole** file, not
+  just the value, and the allowlist hangs on the write rather than on HTML-span presence (before,
+  `"rules": "../../etc/passwd"` landed unchecked in the shipped file). Building it caught a defect
+  of its own: the error path called a `writeStderrLine` that never existed in that file — a
+  `ReferenceError` exactly where the guard bites. Error paths have to be executed, not read.
+- **Accessibility: one real AA violation, and controls at 1.71:1.** `/guide` had no live region —
+  the copy button only changed its visible text, so a screen-reader user got **nothing** on
+  success and nothing on the error path, where "Press Ctrl+C" is the only way forward (WCAG
+  4.1.3). Seven copy buttons shared one name and were indistinguishable in a screen reader's
+  element list, the one place they are read outside their context; names are now derived from the
+  nearest label in **document order** plus the first non-comment line, measured 7 of 7 unique
+  against 1 of 7 before. `button.copy` and `a.btn-2` sat at 1.71:1, under the 3:1 a control
+  boundary needs (WCAG 1.4.11); raising `--line-2` globally would have been a design change, since
+  the same token draws decorative hairlines where 3:1 is loud, so a separate `--line-ui` token
+  carries the purpose: measured 3.40:1 / 3.57:1 / 3.57:1 on the rendered element. Two comments
+  that claimed too much were corrected — the print comment said "only the two moving 1px lines are
+  dropped" while the rule below hides five selectors including the whole six-link navigation.
+- **Page and receipt came from two different measurements.** `site/index.html` said
+  252/135/`6fa214d`, `site/_census.json` said 253/140/`6f6bf58` — both tracked, both publicly
+  shipped, `--check` reporting 3 drifted. The earlier instance had the same shape and a
+  coordinator cause: a `--write` step run against a file still inside a live agent's file scope —
+  the PSA-002 scope collision this repo built `--assert-disjoint` against, one level above the
+  wave mechanics. The new coupling test compares the two **committed** artefacts against each
+  other rather than against the repo, so "both stale together" is green and only a divergence is
+  red; it asserts on drift **or** stale, because `counted-sha` is `provenance: true` and a
+  drift-only assertion would have been green against exactly the state it forbids.
+- **The mirror push had a fourth state, and it was fail-open.** Today's own fix distinguished
+  three (no remote / push ok / push failed). Outside a git repository, `git remote get-url github`
+  fails with `fatal: not a git repository` — by exit code indistinguishable from "no such remote" —
+  so the block reported `no 'github' remote configured — skipping (not an error)` on stdout and
+  exited **0**: a broken environment reported as a healthy one, inside the fix that was closing
+  fail-open. Found by a reviewer explicitly briefed to **refute** the measurements; not by the
+  author, not by the test, not by the gate. Fixed with a `git rev-parse --git-dir` guard, all four
+  states executed individually in throwaway repos, `bash -n` **and** `sh -n` green (the bash-3.2
+  trap from this repo's own rule file).
+- **CI had been red for six consecutive pipelines (#1081).**
+  `tests/scripts/site-numbers.test.mjs` calls `collect(REPO_ROOT)` and requires `missing === []`;
+  two of the 13 metrics read `.orchestrator/metrics/*.jsonl`, untracked per `.gitignore:40`.
+  Locally 23/23, on CI `23 tests | 23 skipped`, because a throwing top-level `beforeAll` takes the
+  whole file with it in Vitest — the blast radius was 23, not 9. Measured now: #7276, #7277,
+  #7280, #7281, #7286 and #7288 red, green again from #7334 (`glab ci list --per-page 20`).
+- **The new pre-push gate produced three defects of its own before it worked**, each measured
+  rather than reasoned. (1) `git clone <path>` points the clone's origin at a **filesystem path**
+  while CI's checkout points at the real remote URL, so any code that *parses* that URL behaves
+  differently in the two trees — the opposite of the hook's purpose: `deriveRepo()` returned
+  `unknown-repo` where working tree and CI both return `session-orchestrator`, and
+  `namespace.test.mjs:199` asserts exactly against that. The real origin URL is now carried into
+  the clone. (2) A repo-pointing git environment beats both `-C <path>` and cwd, so
+  `git -C "$tree" checkout --detach` ran against the **original** repository. (3)
+  `GIT_CONFIG_PARAMETERS` propagates into every child once any `-c` was passed anywhere: pushing
+  with `git -c core.hooksPath=.husky push` carried that override into the materialised clone,
+  where every throwaway repo the gate's own test suite creates then fired the repository's
+  **real** pre-commit hooks — `test: fail, total: 0` three times in a row, green the moment the
+  `-c` was dropped. Both scrub sites are now namespace sweeps with a justified keep-set instead
+  of name lists, because the denylist has shipped with a hole **twice in a row**, each time at
+  the sibling form of the name just closed (`GIT_CONFIG_COUNT` without `GIT_CONFIG_PARAMETERS`,
+  then the exact mirror image). The source-derived census found **six of nine** unscrubbed
+  platform variables where the panel had reported three of four — including `PLUGIN_ROOT` (rung
+  **one** of `resolvePluginRoot`, above every `CLAUDE_`/`CODEX_`/`PI_` name the old list already
+  unset) and the Cursor plugin root, which is not `CURSOR_PLUGIN_ROOT` but `CURSOR_RULES_DIR`;
+  adding the guessed name would have read in review as a complete fix and closed nothing.
+  `GIT_EDITOR` and `GIT_EXEC_PATH` are kept by measurement, not hygiene: Claude Code sets
+  `GIT_EDITOR=true`, and a blind sweep drops git back to `vi` and hangs the worker.
+- **Two silent instrument errors (#979, #1062).** `scanBacklog` read 50 of 89 open issues and
+  reported the window nowhere: `limit 50 => total 50, critical 0, high 10, stale 0` against
+  `limit 100 => total 89, critical 1, high 18, stale 5`. All three numbers wrong, and the mode
+  selector at Phase 7.5 computed with them — `staleCount 0` meant not one stale issue was visible
+  to it. The cause was the window alone, not the `priority::`/`priority:` split. Separately,
+  `memory_cleanup_at` hung on a prose instruction that failed once: `stampMemoryCleanup()` had
+  zero production callers, every reference was text asking the coordinator LLM to remember. On
+  2026-08-14 a `/memory-cleanup` ran with documented yield, the step was skipped, all three
+  session records of that day carried `memory_cleanup_at: null`, and the banner reported "last
+  cleanup 29 days ago" against the 3 days of its own notes — with **no** mechanical signal
+  anywhere: zero `orchestrator.memory.cleanup*` events in 22,887. `/memory-cleanup` now emits the
+  event and `emit-session.mjs` derives the stamp from it.
+- **The host registry lost living sessions (#1047).** `hooks/on-stop.mjs` deleted the registry
+  entry and refreshed the lock heartbeat 12 lines further down — same `if` block, at every turn
+  end — while `heartbeat()` had had zero production callers since its birth commit. The fix is
+  atomic (deletion out **and** heartbeat wired), because either half alone would have been worse
+  than the bug: entries would survive but never age, drop out of `detectPeers` after 15 minutes
+  and be swept as "stale" after 60. Deregistration moved to `hooks/on-session-end.mjs`. The
+  platform census in the comment was wrong at first and corrected by review — pi does deregister,
+  Cursor never registers and so cannot leak; Codex is the only affected platform.
+- **`gh repo view -R` broke the GitHub CI banner for every external user of this plugin
+  (#1022).** `gh repo view` takes the repository as a **positional** argument and has no
+  `-R`/`--repo` flag at all, so the host-pinning added in #872 made `gh` exit 1 with
+  `unknown shorthand flag: 'R'` — an error `checkCiStatus`'s outer catch swallowed to
+  `null`, leaving the session-start Phase 4 banner silently dead on every GitHub repo. Fixed
+  positionally, and the swallow narrowed: a CLI that is *present* but fails now reports
+  `degraded` instead of `null`. The asymmetry across the three neighbouring call sites is
+  real and must not be unified — `glab repo view` **does** take `-R`, and `gh api`/`glab
+  api` take neither `-R` nor a positional, only `--hostname`.
+- **`hooks/on-stop.mjs` printed a 10-frame stack trace at every turn end when `node_modules`
+  was absent** (interrupted install, EPERM sandbox, half-synced plugin cache): a static
+  `import { $ } from 'zx'` fails at module-load time, with no hint that `npm install` is the
+  fix. `zx` is now imported lazily and the failure degrades to one rate-limited stderr line
+  per 6h window, mirroring the missing-`node` degradation in `hooks/run-node.sh`.
+  (GH Kanevry/session-orchestrator#63.)
+- **A board row inherited one legacy entry's terminal status to every same-named repo,
+  permanently (#871).** `_active-sessions.md` rows were keyed by `path.basename(repoRoot)`,
+  so two repos with the same directory name under different parents were one row — and both
+  are enumerable, since the dispatcher walks to depth 2. Rows are now keyed by a path-derived
+  hash, case-folded on APFS/NTFS so `…/Some-Repo` and `…/some-repo` do not split back into
+  the duplicate rows #719 had already fixed at the name layer. The key length carries a named
+  ceiling and a revisit trigger, not an intention to revisit.
+- **Two vault write channels published unmasked secrets (#974/#1025)** —
+  `scripts/lib/vault-status/narrative-mirror.mjs` and `scripts/lib/vault-mirror/process.mjs`,
+  both writing tracked, pushed artefacts. The masker's needle set is a function of the
+  caller's env, which is not a defect but does mean two runs over the same records mask
+  differently: a consumer comparing a written artefact against a fresh candidate must treat
+  an already-redacted span as a **wildcard** (`matchesModuloRedaction`), or a later
+  partially-populated run rewrites the raw value it had already redacted. The tempting fix —
+  persist the needle set — is rejected: it puts a plaintext secrets file on disk to defend
+  against secrets on disk. Masking runs **after** `extractNarrative`, never before, because
+  masking the raw string first lets `[REDACTED]` land inside the structure and silently
+  delete a whole table from the mirrored file.
+- **`agents/*.md` frontmatter is parsed, not pattern-matched.** `check-agents.mjs` gained the
+  same `js-yaml` `CORE_SCHEMA` rule, reported alone with no fall-through to the field rules —
+  a field rule evaluated on an unparseable block is a guess. Its existing block-scalar ban
+  stays: that rule forbids one particular *valid* YAML form, which is a different question
+  from whether the block is YAML at all.
+- **Deleted `scripts/lib/mission-status-schema.mjs`** — 4 exports, zero production callers,
+  while three prose locations promised its application. Found by S3 above, on the day S3 was
+  written.
+
+### Notes
+
+- **3.18.0 is missing from npm.** The tag `v3.18.0`, the GitHub release and the CHANGELOG entry
+  all exist; the registry has never seen the version — `npm view session-orchestrator versions`
+  returns `…, "3.16.0", "3.17.0", "3.19.0", "3.20.0"`. That gap is the incident #978 names and
+  the reason `scripts/release.mjs --publish` now creates the annotated tag only **after** a
+  registry-verified publish. Nothing in this line republishes it; the version number stays
+  skipped rather than reused.
+- **This session damaged its own repository, and the first recovery missed half the damage.** A
+  coordinator diagnostic command exported `GIT_DIR` and ran the suite. In the real `.git`: HEAD
+  detached, three fixture commits, plus a foreign remote and the fixture identity in
+  `.git/config` — which then authored two commits. The first recovery checked HEAD, the index and
+  all 1614 files and **overlooked `.git/config` entirely**, because `git status` does not show it;
+  an agent measuring something else found it two hours later. History rewriting failed on both
+  remotes' branch protection (GitLab "not allowed to force push", GitHub GH006), so authorship
+  was corrected via `.mailmap` — which incidentally refutes part of this session's own #1079
+  finding: `enforce_admins: false` does **not** make the protection bypassable for force-push.
+  One correction to the record: the claim "git runs every hook with `GIT_DIR` set", written in
+  `334ea2d`, is **false** — measured on git 2.x / macOS, `pre-push`, `pre-commit`, `commit-msg`
+  and `post-commit` all run with `GIT_DIR` unset. The scrub remains right as defence in depth;
+  its stated reason was not.
+- The sharpest instances of the frontmatter class are the ones where the check was green. A
+  hand-rolled `getDescription` regex in
+  `tests/lib/validate/skill-description-quality.test.mjs` terminated on the first folded line,
+  measuring **97 characters where the real YAML value is 329** (`session-start`; `autopilot`
+  107 vs 555, `bootstrap` 98 vs 341) — which made its own `>= 250` assertion **vacuous** for
+  every skill already using the block-scalar form. It surfaced only because repairing the 12
+  unparseable blocks moved files across the threshold. `yaml.load` is now the single reader.
+- **Found and deliberately not fixed here**, because both sit outside this line's scope and
+  both are the same shape as the bugs above: `agents/eval-judge.md` is **valid** YAML and
+  loses **96%** of its description — 1180 raw characters, 51 visible to a parser — because
+  ` #803` opens a YAML comment at column 51, so no parse rule can catch it. And
+  `skills/discovery/probes-arch.md:39` calls
+  `npx madge --circular --extensions ts,tsx,js,jsx src/` in an all-`.mjs` repo that has no
+  `src/` directory: it processes zero files and reports success.
+- **Open, deliberately.** `site/llms-full.txt` still carries its numbers by hand — the generator
+  only touches HTML. They were corrected and cross-checked against the generator, but that is
+  exactly the defect this line fixes. Revisit trigger: as soon as a second text file carries
+  measured values. And the `scanBacklog` fix has no test of its own; it is covered only by the
+  171 existing tests of the touched modules staying green, with the fake regression outstanding.
+- One reported number did not survive review and is recorded here rather than quietly dropped:
+  "274 elements checked" for the site's contrast sweep is **not reproducible** — two independent
+  checkers measure 260 / 282 / 288 depending on an inclusion rule that was never shipped with the
+  number. The **value** 4.81:1 (worst text contrast) is stable across all three counting rules;
+  the count is not. A count without its rule is worthless — the same lesson #979 taught once
+  already in this line.
+- Gate at `8984224`, re-run for this entry rather than quoted: **587 test files, 14,244 passed
+  / 0 failed / 11 skipped** (`npm test`, exit 0), typecheck **404 files OK** (exit 0),
+  owner-leakage **1548 files / 0 findings**, unicode-safety 0 findings. The release commit also
+  reports `validate-plugin` 172/0 and lint 0 at that sha; both are quoted from it, not
+  re-measured here.
+
 ## [3.20.0] - 2026-08-13
 
 Memory-pipeline line. The learning store had been accumulating for 233 sessions and delivering

package/README.md

@@ -1,7 +1,7 @@
 # Session Orchestrator
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-3.20.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-3.22.0-blue.svg)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/session-orchestrator.svg)](https://www.npmjs.com/package/session-orchestrator)
 [![Tests](https://img.shields.io/badge/tests-12%2C000%2B-brightgreen.svg)](docs/telemetry/telemetry-claims.md)
 
@@ -23,10 +23,14 @@ The same skills and commands run across all four, with platform-adapted hooks an
 For Claude Code, also install Node dependencies **once** (hooks import `zx`) and restart Claude Code:
 
 ```bash
-cd "$(claude plugin dir session-orchestrator 2>/dev/null || echo ~/.claude/plugins/session-orchestrator)"
-npm install
+# Claude Code has no `plugin dir` subcommand, so resolve the install path from the cache.
+SO_DIR="$(dirname "$(find ~/.claude/plugins/cache -path '*session-orchestrator*' -name package.json 2>/dev/null | head -1)")"
+cd "$SO_DIR" && npm install
 ```
 
+If `SO_DIR` comes back empty, the plugin is not installed from a marketplace — check
+`/plugin list` inside Claude Code first.
+
 Setup guides: [Codex](docs/codex-setup.md) · [Cursor IDE](docs/cursor-setup.md) · [Pi](docs/pi-setup.md). Per-IDE notes on `CLAUDE.md` vs `AGENTS.md`: [instruction-file-resolution](skills/_shared/instruction-file-resolution.md).
 
 ## What makes it different
@@ -127,17 +131,18 @@ The system is markdown-driven config plus a thin Node runtime — skills, comman
 - **Cross-session learning is opt-in and inspectable.** Every session writes a record; after 5+ sessions `/evolve analyze` extracts confidence-scored patterns you can read and prune. Nothing is hidden.
 - **VCS dual support, no lock-in.** Auto-detects GitLab or GitHub from your remote and drives the full lifecycle for both.
 
-## Recent highlights (v3.20.0)
+## Recent highlights (v3.22.0)
 
-Every release is additive and backward-compatible. Highlights of the v3.20.0 line:
+Every release is additive and backward-compatible. Highlights of the v3.22.0 line:
 
-- **Learnings finally reach the agents doing the work (#1014)** — 233 sessions of accumulated memory had exactly zero read paths into a dispatched agent. Now a per-agent index, selected from that agent's declared file scope, riding the dispatch prompt the coordinator already writes. Measured at **+0.69%–1.15%** of the prompt an agent already receives, against **+72.3%** for the separate-injection path the delivery doc forbids — factor 92. The character cap is derived from that measurement, not chosen, and delivery emits an event so "did it run?" is a grep rather than an inference.
-- **Agent-authored text no longer reaches every agent unfiltered (#1015)** — the reconcile renderer wrote it verbatim into `.claude/rules/`, which Claude Code hands to every agent in every session, with no revocation. Machine values now reject, prose is framed and capped. Two premises in the issue itself did not survive verification and were corrected rather than implemented.
-- **The learning store is durable again (#1017)** — `/evolve` pruned by rewriting with no archive append; **11 of 13 provenance pointers in generated rules resolved to nothing**. One shared archive-then-rewrite path, and **11 of 11 lost records recovered** from the vault mirror. Dangling pointers 11 → 0.
-- **Semantic dedup + contradiction detection (#1016)** — a bounded, deliberately non-transitive candidate pool and a fail-closed judgment layer in which rendering an approval prompt from an unreadable verdict counts, structurally, as a write.
-- **The review panel found the same class inside the fix** — three independent reviewers returned FIX_REQUIRED: this line had hardened one delivery channel and shipped a second, unhardened one beside it. Closed in one cycle, which surfaced three further holes of the same shape. Every new guard is proven by fake regression, not by a green test.
+- **The warning that fired on 99.0% of all session starts (#1089)** — measured over **1,477 session-start events across 18 repos**, against 4,884 stop events with zero OOM markers. Three independent measurement errors, not one threshold among them: `os.freemem()` on Darwin reports only `Pages free` (median **0.4 GB** on hosts with 24–128 GB installed), a threshold named for *sessions* was compared against a *process* count (measured ratio **6.0:1** — same number, right denominator: 93.6% → **4.2%**), and one noisy axis could cap a wave alone. The verdict had reached the ledger for **15 of 1,734 sessions (0.9%)**, which is why the false alarm survived four months while six repos independently wrote it into their learnings store — one at confidence **1.0**. A warning that fires on almost everything changes nothing except how fast you learn to ignore it.
+- **The questions this tool asks its operator had never been measured (#1107)** — `scripts/auq-audit.mjs` now scores every choice block against eight criteria and two hard hurdles, all thresholds from one registry. The census found **three populations where every prior count had seen one**: 40 Claude Code blocks, 10 Codex prose lists, and 17 nobody had counted. Baseline **21 of 72 (29%)**, after the pass **72 of 72**. The dominant cause was structural rather than editorial — `header` caps at 12 codepoints and truncates silently, **26 of 42 exceeded it**, and one NFD-composed header measured 12 visible characters as 14 and destroyed its own question.
+- **A probe that sized the wrong set and never asked git** — `checkStaleArtifacts` announced "37 files (11 MB)" while computing the megabytes over the entire directory instead of the 37 it names; they weigh **0.68 MB**, a factor of ~18. Separately it proposed pruning seven **tracked, runtime-read** source files, including the policy file a hook reads on every Bash call. The git exclusion is fail-**silent**, not fail-open: falling back to "nothing is tracked" *is* the defect it closes.
+- **Only the raw session ID releases a lock (#1085)** — one session carried three identities (STATE.md, the lock, and issue-budget each held a different one) and `findPeers` reported the session's own presence as a foreign peer. The companion issue-budget fix removed a data-loss path where an identity-less invocation erased a live session's parked overflow.
+- **The npm receipt is the boundary, and a `throw` lay behind it (#1088)** — `publish()` threw *after* a successful publish during a 12-second propagation poll: published, not tagged, not pushed, reported as "failed, retryable". Each post-receipt step now gets exactly one attempt and the rest is collected as reconciliation. Leak detection decides on an extracted path, not a regex over `npm notice` prose — `contest` is not `tests`.
+- **Six waves ran with zero scope injection, and it looked exactly like a clean run (#1083)** — the scope declaration has two shapes; a coordinator that writes only the aggregate one degrades the chain to signal-free ALLOW. `scripts/materialize-wave-scope.mjs` is now the canonical writer of both.
 
-Previous line (v3.19.0): guard hardening and release mechanics — six wrapper bypasses closed (#982), blocked-commands floor ∪ overlay (#972), session-lock ownership proof, and release as one dispatch (#978).
+Previous line (v3.21.0): guard mechanics, the public site, and cross-session messaging — which turned out to be one strand: a fact maintained in two places, and a guard that is green without biting.
 
 Full version history: [CHANGELOG.md](CHANGELOG.md).
 

package/agents/analyst.md

@@ -1,6 +1,6 @@
 ---
 name: analyst
-description: Use this agent for read-only PRD-quality review. Checks acceptance-criteria specificity, scope drift detection, and completeness of /plan output. <example>Context: /plan feature produced a PRD. user: "Review the PRD before /go." assistant: "I'll dispatch analyst to check acceptance-criteria specificity and scope drift before wave execution." <commentary>Analyst catches vague acceptance criteria before they cause carryover at session end.</commentary></example>
+description: 'Use this agent for read-only PRD-quality review. Checks acceptance-criteria specificity, scope drift detection, and completeness of /plan output. <example>Context: /plan feature produced a PRD. user: "Review the PRD before /go." assistant: "I''ll dispatch analyst to check acceptance-criteria specificity and scope drift before wave execution." <commentary>Analyst catches vague acceptance criteria before they cause carryover at session end.</commentary></example>'
 model: inherit
 color: yellow
 tools: Read, Grep, Glob, Bash

package/agents/architect-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: architect-reviewer
-description: Use this agent for read-only architectural audits between waves. Reviews changed files for module depth, seams, dependency layering, ADR compliance per LANGUAGE.md vocabulary. <example>Context: After Impl-Core wave shipped 8 files. user: "Audit the W2 architecture before proceeding." assistant: "I'll dispatch architect-reviewer to check module depth, seams, and adapter quality before W3." <commentary>Architect-reviewer catches design smells (shallow modules, speculative seams) earlier than Quality-Lite, which only catches lint/typecheck.</commentary></example>
+description: 'Use this agent for read-only architectural audits between waves. Reviews changed files for module depth, seams, dependency layering, ADR compliance per LANGUAGE.md vocabulary. <example>Context: After Impl-Core wave shipped 8 files. user: "Audit the W2 architecture before proceeding." assistant: "I''ll dispatch architect-reviewer to check module depth, seams, and adapter quality before W3." <commentary>Architect-reviewer catches design smells (shallow modules, speculative seams) earlier than Quality-Lite, which only catches lint/typecheck.</commentary></example>'
 model: inherit
 color: blue
 tools: Read, Grep, Glob, Bash