session-orchestrator 5.10.0 → 5.12.0

package/scripts/run-quality-gate.mjs

@@ -226,6 +226,49 @@ function failedFilesFromGateStdout(stdout) {
   return named.length > 0 ? named : null;
 }
 
+/**
+ * The reporting variants — they exit 0 even after a failing check, so their
+ * event NAME never carries the check verdict (#1459). `full-gate` exits non-zero
+ * on a failing check, so the name already says it there.
+ */
+const REPORTING_VARIANTS = new Set(['baseline', 'incremental', 'per-file']);
+
+/**
+ * Did any check of a reporting-variant envelope fail? (#1487 point 3)
+ *
+ * Three states, never two — the same absent-is-not-zero contract as `counts`:
+ *   - `true`  — `typecheck` or `test` carries `status: 'fail'` (a killed command
+ *               is published as `fail` too, see `runCheck`);
+ *   - `false` — both command objects are present, neither is stubbed, at least
+ *               one actually `pass`ed and none failed — the envelope MEASURED
+ *               that nothing failed;
+ *   - `null`  — the envelope is unparseable or a command object is missing or
+ *               carries an unknown status, a command is a stub (echo/noop
+ *               reports `pass` without running), or both were skipped. The
+ *               caller then OMITS the key: a
+ *               default `false` would read as "measured green" for a run that
+ *               measured nothing.
+ *
+ * Never throws.
+ *
+ * @param {string} stdout — the gate sub-script's captured stdout.
+ * @returns {boolean|null}
+ */
+function checkFailedFromGateStdout(stdout) {
+  if (typeof stdout !== 'string' || !stdout.trim()) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  const statuses = ['typecheck', 'test'].map((name) => parsed?.[name]?.status);
+  if (statuses.includes('fail')) return true;
+  if (parsed?.stubbed?.typecheck || parsed?.stubbed?.test) return null;
+  if (!statuses.every((st) => st === 'pass' || st === 'skip')) return null;
+  return statuses.includes('pass') ? false : null;
+}
+
 /**
  * Validate and resolve the `--ledger-root` flag (see the telemetry block below).
  *
@@ -570,12 +613,16 @@ async function main() {
     // record that run as `passed`. Their exit code stays 0 on purpose: it has
     // never carried the check verdict there (a failing check exits 0 too).
     const failed = exitCode !== 0 || killFields.timed_out === true;
+    // #1487 point 3 (owner decision, option a): the reporting variants keep
+    // `.passed` and their exit code, but carry the check verdict as a field.
+    const checkFailed = REPORTING_VARIANTS.has(variant) ? checkFailedFromGateStdout(gateStdout) : null;
     await emitEvent(
       `orchestrator.quality_gate.${failed ? 'failed' : 'passed'}`,
       {
         variant,
         exit_code: exitCode,
         ...killFields,
+        ...(checkFailed !== null ? { check_failed: checkFailed } : {}),
         ...(counts ? { counts } : {}),
         ...(failedFiles ? { failed_files: failedFiles } : {}),
         ...(waveNumber !== null ? { wave_number: waveNumber } : {}),

package/scripts/so-hud.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execFile } from 'node:child_process';
+import { promisify, parseArgs } from 'node:util';
+import { measure } from './lib/so-hud/runtime.mjs';
+import { isMainModule } from './lib/is-main-module.mjs';
+const exec = promisify(execFile);
+const SO_ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+export async function main(argv, deps = {}) {
+  const output = deps.output ?? (s => process.stdout.write(s));
+  const error = deps.error ?? (s => process.stderr.write(s));
+  let values;
+  try {
+    ({ values } = parseArgs({ args: argv, options: { json: { type: 'boolean' }, 'repo-root': { type: 'string' }, 'register-root': { type: 'boolean' }, help: { type: 'boolean' } }, allowPositionals: false }));
+    if (values.help) {
+      output('so-hud --json [--repo-root <path>] [--register-root]\nRead-only HUD JSON v1. --register-root registers this SO installation (0600).\nDefault repo: git toplevel of cwd. Exit 0: measured; 2: invocation/registration error; 6: repository unavailable.\n');
+      return 0;
+    }
+    if (!values.json && !values['register-root']) throw new Error('--json required');
+  } catch { error('so-hud: --json erforderlich; siehe --help\n'); return 2; }
+  if (values['register-root']) {
+    try {
+      const dir = path.join(deps.home ?? os.homedir(), '.config/session-orchestrator/hud');
+      await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+      await fs.chmod(dir, 0o700);
+      const target = path.join(dir, 'so-root');
+      const temp = `${target}.${process.pid}.tmp`;
+      try { await fs.writeFile(temp, `${SO_ROOT}\n`, { mode: 0o600, flag: 'wx' }); await fs.rename(temp, target); }
+      finally { await fs.unlink(temp).catch(() => {}); }
+    } catch { error('so-hud: Registrierung fehlgeschlagen\n'); return 2; }
+    if (!values.json) return 0;
+  }
+  let root;
+  try {
+    root = values['repo-root'] ? path.resolve(values['repo-root']) : (await (deps.exec ?? exec)('git', ['rev-parse', '--show-toplevel'], { timeout: 700 })).stdout.trim();
+    if (!root || !(await fs.stat(root)).isDirectory()) throw new Error('missing');
+  } catch { error('so-hud: Repo nicht ermittelbar\n'); return 6; }
+  try { output(`${JSON.stringify(await (deps.measure ?? measure)(root))}\n`); return 0; }
+  catch { error('so-hud: Messung fehlgeschlagen\n'); return 6; }
+}
+if (isMainModule(import.meta.url)) process.exitCode = await main(process.argv.slice(2));

package/scripts/state-md-idle-reset.mjs

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+/** session-start Phase 1.5 Idle Reset (#1560): rewrite a completed STATE.md to idle, under the STATE.md lock. */
+import { readFileSync, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parseArgs } from 'node:util';
+import { resetStateMdToIdleOnDisk } from './lib/state-md/idle-reset.mjs';
+
+const HELP = `Usage: node scripts/state-md-idle-reset.mjs [--repo-root <dir>] [--json]
+
+Reset the repo's STATE.md to idle when its status is completed (session-start
+Phase 1.5, Idle Reset rules 1-7): status idle, current-wave 0, Wave History
+demoted into Previous Session, Deviations emptied, scope-baseline-* keys
+deleted. The five recommendation keys stay in the frontmatter so the Phase 7.5
+Mode-Selector can read them. Any other status is a no-op; reasons:
+status-not-completed, unparseable, missing (no or empty STATE.md).
+
+  --repo-root <dir>  Repository root holding the state dir (default: cwd)
+  --json             Emit {"changed", "reason", "path"} instead of one line
+  --help             Show this help
+  --version          Show the plugin version
+
+Example: node scripts/state-md-idle-reset.mjs --json
+Exit codes: 0 reset or no-op, 1 bad CLI arguments,
+            2 I/O error, --repo-root not a directory, or a write the
+              STATE.md guards refused
+`;
+
+/** Reasons under which writeStateMd refused a wanted write. */
+const REFUSED = new Set(['size-ceiling', 'frontmatter-unsafe']);
+
+let options;
+try {
+  options = parseArgs({
+    options: {
+      'repo-root': { type: 'string' },
+      json: { type: 'boolean' },
+      help: { type: 'boolean' },
+      version: { type: 'boolean' },
+    },
+    allowPositionals: false,
+  }).values;
+} catch (error) {
+  process.stderr.write(`state-md-idle-reset: ${error.message}\n`);
+  process.exit(1);
+}
+
+if (options.help) {
+  process.stdout.write(HELP);
+} else if (options.version) {
+  process.stdout.write(
+    `${JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version}\n`,
+  );
+} else {
+  const repoRoot = resolve(options['repo-root'] ?? process.cwd());
+  // The STATE.md lock would otherwise create <repoRoot>/.orchestrator/ for a
+  // root that does not exist and report a harmless-looking `missing`.
+  let rootStat;
+  try {
+    rootStat = statSync(repoRoot, { throwIfNoEntry: false });
+  } catch {
+    rootStat = undefined; // EACCES / ELOOP: an I/O error, exit 2 below
+  }
+  if (!rootStat?.isDirectory()) {
+    process.stderr.write(`state-md-idle-reset: --repo-root is not a directory: ${repoRoot}\n`);
+    process.exit(2);
+  }
+  let result;
+  try {
+    result = await resetStateMdToIdleOnDisk(repoRoot);
+  } catch (error) {
+    process.stderr.write(`state-md-idle-reset: ${error.message}\n`);
+    process.exit(2);
+  }
+  const reason = result.reason ?? null;
+  process.stdout.write(
+    options.json
+      ? `${JSON.stringify({ changed: result.changed, reason, path: result.path })}\n`
+      : `${result.changed ? 'reset to idle' : `unchanged (${reason})`}: ${result.path}\n`,
+  );
+  if (REFUSED.has(reason)) process.exit(2);
+}

package/scripts/validate-wave-scope.mjs

@@ -92,6 +92,7 @@ import {
   assertFileScopeSubset,
   assertTestSiblingCoverage,
   testSiblingExpansionApplies,
+  testSiblingsFor,
   TEST_SIBLING_EXPANSION_ROLES,
   findScopeCollisions,
   unionFileScopes,
@@ -663,6 +664,44 @@ function knownRepoFiles() {
   }
 }
 
+/**
+ * WARN — never fail — when two agents' RAW scopes are disjoint but test-sibling
+ * expansion hands both the same synthesized glob (#1026 point 2, owner decision
+ * option a). `scripts/lib/foo.mjs` and `hooks/foo.mjs` share no file, yet both
+ * expand to `tests/**\/foo*.test.mjs`, so the union grants each agent the
+ * other's tests. Exit code is unchanged: the glob is a GRANT that may match no
+ * file at all, so failing the wave on it would block plans that never collide.
+ *
+ * `role` gates expansion exactly as `--union` does; `undefined` (sidecar-only
+ * `--no-manifest`, or a manifest without a role) checks anyway, because there
+ * the expansion that will run later is unknown and silence would hide it.
+ * Compares synthesized siblings only, by exact string — a sibling glob one agent
+ * DECLARED by hand is not matched (named ceiling; revisit if a wave plan is seen
+ * declaring sibling globs explicitly). Overlapping globs of DIFFERENT basenames
+ * (`foo*` also covers `foo-bar.test.mjs`) are not matched either.
+ *
+ * @param {Array<{id?: string, files: string[]}>} agentScopes
+ * @param {string|undefined} role
+ */
+function warnSiblingGlobCollisions(agentScopes, role) {
+  if (role !== undefined && !testSiblingExpansionApplies({ role })) return;
+  const owners = new Map(); // sibling glob -> agent ids, first-seen order
+  agentScopes.forEach((rec, i) => {
+    const id = typeof rec.id === 'string' && rec.id.length > 0 ? rec.id : `<unnamed#${i}>`;
+    for (const glob of testSiblingsFor(rec.files)) {
+      const ids = owners.get(glob) ?? [];
+      if (!ids.includes(id)) ids.push(id);
+      owners.set(glob, ids);
+    }
+  });
+  for (const [glob, ids] of owners) {
+    if (ids.length < 2) continue;
+    warn(
+      `sibling-glob: agents ${ids.map((id) => `"${id}"`).join(', ')} are disjoint as declared but test-sibling expansion grants each of them ${glob} — split the same-basename files across waves or name the tests explicitly (#1026)`,
+    );
+  }
+}
+
 /**
  * Assert that no file is claimed by two agents of the SAME wave (#1020).
  * Exits 1 with one message per collision (plus one per duplicate agent id);
@@ -670,8 +709,8 @@ function knownRepoFiles() {
  *
  * @param {string} sidecarPath
  */
-function assertDisjointOrDie(sidecarPath) {
-  if (!reportScopeCollisions(sidecarPath)) process.exit(1);
+function assertDisjointOrDie(sidecarPath, role) {
+  if (!reportScopeCollisions(sidecarPath, role)) process.exit(1);
 }
 
 /**
@@ -683,12 +722,17 @@ function assertDisjointOrDie(sidecarPath) {
  * @param {string} sidecarPath
  * @returns {boolean} true when the wave is disjoint
  */
-function reportScopeCollisions(sidecarPath) {
+function reportScopeCollisions(sidecarPath, role) {
   const agentScopes = readAgentScopesOrDie(sidecarPath, '--assert-disjoint');
   const { ok, collisions, duplicateIds } = findScopeCollisions(agentScopes, {
     knownFiles: knownRepoFiles(),
   });
-  if (ok) return true;
+  // Only a raw-disjoint wave gets the sibling hint: its text says the scopes
+  // are disjoint as declared, which is false once a real collision exists.
+  if (ok) {
+    warnSiblingGlobCollisions(agentScopes, role);
+    return true;
+  }
 
   // Duplicate ids FIRST: they are a malformed plan, and a reader who fixes them
   // may well change which collisions remain.
@@ -708,6 +752,15 @@ function reportScopeCollisions(sidecarPath) {
   return false;
 }
 
+/**
+ * The manifest's `role` when it is a string, else `undefined` (unknown).
+ * @param {unknown} obj
+ * @returns {string|undefined}
+ */
+function roleOf(obj) {
+  return obj !== null && typeof obj === 'object' && typeof obj.role === 'string' ? obj.role : undefined;
+}
+
 /**
  * QUERY MODE (#1020): print `expandTestSiblings(unionFileScopes(scopes), {role})`
  * as JSON on stdout, using the MANIFEST'S own role. Replaces the manifest echo —
@@ -757,7 +810,7 @@ function validate(
     }
     // #1026.4 — the collision check reads only the sidecar, so a schema error
     // must not hide its findings: report both, exit 1 either way.
-    if (assertDisjointPath) reportScopeCollisions(assertDisjointPath);
+    if (assertDisjointPath) reportScopeCollisions(assertDisjointPath, roleOf(obj));
     process.exit(1);
   }
 
@@ -771,7 +824,7 @@ function validate(
   // violates BOTH the subset relation and disjointness must keep the older,
   // byte-pinned subset message. Only ever ADDS a failure mode.
   if (assertDisjointPath) {
-    assertDisjointOrDie(assertDisjointPath);
+    assertDisjointOrDie(assertDisjointPath, roleOf(obj));
   }
 
   // #1020 QUERY MODE — replaces the echo below; see the STDOUT CONTRACT note in

package/scripts/vault-orphans.mjs

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+/**
+ * vault-orphans.mjs - CLI for `findVaultOrphans` (#1563, session-end Phase 3.7e).
+ *
+ * Names the untracked files in the Meta-Vault modified since a given instant
+ * (the session's start). Read-only: it never commits, moves or deletes anything
+ * in the vault. See scripts/lib/session-end/vault-orphans.mjs for the design.
+ *
+ * USAGE
+ *   node scripts/vault-orphans.mjs --since <ISO> [--vault-dir <dir>] [--json]
+ *
+ * EXIT CODES
+ *   0  measured (including zero candidates)
+ *   1  bad arguments
+ *   2  could not measure (no vault dir resolvable, not a git repo, git failed)
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseArgs } from 'node:util';
+
+import { findVaultOrphans } from './lib/session-end/vault-orphans.mjs';
+import { _parseVaultIntegration } from './lib/config/vault-integration.mjs';
+import { loadHostPaths } from './lib/config/host-paths.mjs';
+import { resolveVaultDir } from './lib/config.mjs';
+import { expandTilde } from './lib/common.mjs';
+import { isMainModule } from './lib/is-main-module.mjs';
+
+const HELP = `vault-orphans.mjs - name untracked vault files written since a session started (#1563)
+
+USAGE
+  node scripts/vault-orphans.mjs --since <ISO> [--vault-dir <dir>] [--json]
+
+DESCRIPTION
+  Runs the read-only \`git -C <vault-dir> ls-files --others --exclude-standard\`
+  and lists every untracked file whose mtime is at or after --since. Files whose
+  frontmatter names one of this plugin's generators (\`_generator:
+  session-orchestrator-...\`) are left out: their writer owns them.
+
+  The results are CANDIDATES: mtime is a hint, not proof that this session
+  wrote the file. Nothing is committed, moved or deleted.
+
+OPTIONS
+  --since <ISO>       Required. ISO 8601 instant with Z or an offset, e.g. the
+                      STATE.md \`started_at\` (2026-10-11T08:00:00.000Z).
+  --vault-dir <dir>   Vault working tree. Default: the host-local resolution
+                      SO_VAULT_DIR > owner.yaml > committed
+                      vault-integration.vault-dir in ./CLAUDE.md or ./AGENTS.md.
+  --json              Print the result object as JSON on stdout.
+  --help              Show this help.
+  --version           Print the plugin version.
+
+EXIT CODES
+  0  measured, including zero candidates
+  1  bad arguments
+  2  could not measure (no vault dir, not a git repo, git failed)
+
+EXAMPLE
+  node scripts/vault-orphans.mjs --since 2026-10-11T08:00:00.000Z --json
+`;
+
+/** ISO 8601 with an explicit zone - a zone-less value would be read as local time. */
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/;
+
+/**
+ * Resolve the vault dir like the other vault writers: SO_VAULT_DIR > owner.yaml
+ * `vault-dirs:` cwd match > owner.yaml `paths.vault-dir` > committed value.
+ *
+ * @returns {string|null}
+ */
+function resolveDefaultVaultDir() {
+  let content = '';
+  for (const name of ['CLAUDE.md', 'AGENTS.md']) {
+    const p = join(process.cwd(), name);
+    if (existsSync(p)) {
+      try {
+        content = readFileSync(p, 'utf8');
+        break;
+      } catch {
+        /* try the next file */
+      }
+    }
+  }
+  const vi = _parseVaultIntegration(content);
+  const value = resolveVaultDir(vi['vault-dir'], loadHostPaths()).value;
+  return typeof value === 'string' && value.trim() !== '' ? expandTilde(value) : null;
+}
+
+/** @param {{status: 'ok', candidates: Array<{path: string}>, total: number, truncated: boolean, untracked: number}} r */
+function renderHuman(r, since) {
+  const lines = [];
+  if (r.total === 0) {
+    lines.push(`vault-orphans: no untracked vault file modified since ${since} (${r.untracked} untracked in total)`);
+  } else {
+    lines.push(
+      `vault-orphans: ${r.total} untracked vault file(s) modified since ${since} - candidates only, ` +
+        `mtime does not prove this session wrote them (${r.untracked} untracked in total)`,
+    );
+    for (const c of r.candidates) lines.push(`  ${c.path}`);
+    if (r.truncated) lines.push(`  ... showing ${r.candidates.length} of ${r.total}`);
+  }
+  return `${lines.join('\n')}\n`;
+}
+
+/**
+ * CLI entry.
+ *
+ * @param {string[]} [argv]
+ * @param {{stdout: {write: Function}, stderr: {write: Function}}} [io]
+ * @returns {number} exit code
+ */
+export function main(argv = process.argv.slice(2), io = { stdout: process.stdout, stderr: process.stderr }) {
+  let values;
+  try {
+    ({ values } = parseArgs({
+      args: argv,
+      options: {
+        since: { type: 'string' },
+        'vault-dir': { type: 'string' },
+        json: { type: 'boolean', default: false },
+        help: { type: 'boolean', default: false },
+        version: { type: 'boolean', default: false },
+      },
+      strict: true,
+      allowPositionals: false,
+    }));
+  } catch (err) {
+    io.stderr.write(`vault-orphans: ${err.message}\nRun with --help for usage.\n`);
+    return 1;
+  }
+
+  if (values.help) {
+    io.stdout.write(HELP);
+    return 0;
+  }
+  if (values.version) {
+    const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+    io.stdout.write(`${pkg.version}\n`);
+    return 0;
+  }
+
+  const since = values.since;
+  const sinceMs = typeof since === 'string' && ISO_RE.test(since) ? Date.parse(since) : NaN;
+  if (!Number.isFinite(sinceMs)) {
+    io.stderr.write('vault-orphans: --since <ISO> is required, e.g. 2026-10-11T08:00:00.000Z\n');
+    return 1;
+  }
+  if (values['vault-dir'] !== undefined && values['vault-dir'].trim() === '') {
+    io.stderr.write('vault-orphans: --vault-dir must not be empty\n');
+    return 1;
+  }
+
+  const vaultDir =
+    values['vault-dir'] !== undefined ? expandTilde(values['vault-dir']) : resolveDefaultVaultDir();
+  const result = findVaultOrphans({ vaultDir, sinceMs });
+
+  if (result.status !== 'ok') {
+    io.stderr.write(
+      `vault-orphans: could not measure (${result.reason}${result.detail ? `: ${result.detail}` : ''})\n`,
+    );
+    if (values.json) io.stdout.write(`${JSON.stringify(result)}\n`);
+    return 2;
+  }
+
+  io.stdout.write(values.json ? `${JSON.stringify(result)}\n` : renderHuman(result, since));
+  return 0;
+}
+
+if (isMainModule(import.meta.url)) {
+  process.exitCode = main();
+}

package/skills/_shared/fleet-protocol.md

@@ -75,7 +75,14 @@ die vom Lease-Validator akzeptierte `adresse` einer aktiven Lease, sonst `null`
 Lease, kein Eintrag oder ein abgelehnter Wert — nie ein ungeprüfter String). `fallback_due_at` ist
 der Zeitpunkt, ab dem die Standard-Auflagen (unten) gelten, in der Form von `zeit` (Code:
 `fallbackDueAt()`); er steht nur auf stdout, die Check-in-Datei behält ihr Schema. Exit 0
-geschrieben, 2 ungültige Eingabe (Fehlerliste auf stderr, keine Datei), 1 Schreibfehler.
+geschrieben, 2 ungültige Eingabe (Fehlerliste auf stderr, keine Datei) oder semantische Session-ID
+von einem anderen Repo belegt (eine Zeile auf stderr mit JSON-escaped Repo-Namen, fremde Datei unverändert,
+tmp entfernt, kein Event), 1 Schreibfehler.
+Vor dem `rename` lehnt der Schreiber ein vorhandenes String-`repo` ungleich dem eigenen ab;
+gleiches `repo`, unlesbare Dateien und ungültiges JSON dürfen überschrieben werden.
+Die Prüfung folgt keinen Symlinks, öffnet nichtblockierend und liest nur reguläre Dateien
+bis 64 KiB. Symlinks, andere Dateitypen, größere Dateien oder fehlende sichere Open-Flags
+gelten für diese Prüfung als unlesbar (fail-open zum `rename`).
 
 | Feld | Inhalt |
 |---|---|
@@ -130,9 +137,24 @@ aktiven Navigator ist `fallback_due_at` gleich `zeit`, die Auflagen gelten also
 Lesende Arbeit und Schreiben im eigenen Worktree laufen währenddessen weiter; der Rückfall ist ein
 Dateistand mit Frist, kein Warten auf eine Antwort.
 
+## Verhalten ohne Flotte
+
+Flottenintegration liegt vor, wenn `NAVIGATOR_CONFIG_DIR` gesetzt und nicht leer ist (ausdrückliches
+Opt-in, auch vor dem ersten Anlegen) oder `~/.config/navigator/` als Verzeichnis existiert (Code:
+`fleetIntegrationEnabled()`, #1559). Ein Flottenhost hat das Verzeichnis, weil der Koordinator dort
+die Lease schreibt. Ohne Flottenintegration validiert `fleet-checkin.mjs` die Eingabe wie immer
+(ungültig → Exit 2), schreibt dann aber nichts, legt kein Verzeichnis an, emittiert kein Event und
+meldet `{"ok":true,"skipped":"no-fleet",…}`. Es gelten keine Auflagen, auch keine Standard-Auflagen:
+ohne Flotte gibt es nichts zu koordinieren. Die Navigator-Zeile im Sessionstart-Banner entfällt
+ebenso. Das gilt auch für `plattform: kopflos`: der Datensatz beweist keinen Koordinator, und ein
+Schreiben legte das Verzeichnis an, das danach jede Solo-Session zur Flotte macht. Ein kopfloser
+Lauf ohne Flottenintegration wendet stattdessen die Standard-Auflagen sofort an — er kann niemanden
+fragen. Ein Flotten-Starter, der auf einem frischen Remote-Host startet, setzt deshalb
+`NAVIGATOR_CONFIG_DIR` oder legt das Verzeichnis vorher an.
+
 ## Verhalten ohne Navigator
 
-Lease `none` oder `unreadable`: die Check-in-Datei wird **trotzdem** geschrieben (sie ist der
+Flottenintegration vorhanden, Lease `none` oder `unreadable`: die Check-in-Datei wird **trotzdem** geschrieben (sie ist der
 zählbare Beleg), die Standard-Auflagen gelten sofort, es geht keine Nachricht ab. Kopflose Läufe
 sind per Nachricht nicht erreichbar und nutzen dieselben Dateien: vor jeder Welle `auflagen/` lesen.
 

package/skills/_shared/state-ownership.md

@@ -40,7 +40,7 @@ The `session-type: none` + `status: idle` combination is used only for bootstrap
 | `## Wave History` | Completed wave records | wave-executor (post-wave) |
 | `## Deviations` | Plan adaptation log | wave-executor (step 3) |
 | `## What Not To Retry` | Failed/abandoned approaches not to repeat (#623) | session-end (Phase 1.6) |
-| `## Open Questions` | Unresolved user-facing questions (agent → gate → next session) | wave-executor (inter-wave) + session-end (marks answered) |
+| `## Open Questions` | Unresolved user-facing questions (agent → gate → next session) | wave-executor (inter-wave) + session-end (marks answered; appends one vault-orphan entry at Phase 3.7e, #1563) |
 
 Wave History lines MAY include a `→ issue #NNN` suffix (or `→ existing #NNN` when a duplicate was detected) for SPIRAL/FAILED agents, linking to the auto-created carryover issue (#261). This is optional and backward-compatible; readers that do not recognize the notation can skip it. Session-end Phase 1.6 uses the presence of this suffix to decide whether to retro-file a carryover as a fallback safety net.
 
@@ -139,8 +139,8 @@ growing across sessions is the CCU-009 anti-pattern.
 | Skill | Access | Operations |
 |-------|--------|------------|
 | **wave-executor** | Read + Write (owner) | Creates STATE.md (Pre-Wave 1b), updates after each wave (current-wave, Wave History, Deviations); appends deduped `## Open Questions` at inter-wave checkpoints via `appendOpenQuestionOnDisk` (see `wave-loop.md` § 3e + Post-Wave step 6). |
-| **session-end** | Read + Status-only write | Reads for metrics extraction (Phase 1.7), sets `status: completed` (Phase 3.4). Exception: only fields modified are `status` in frontmatter and marking entries answered in `## Open Questions` via `markOpenQuestionAnsweredOnDisk` (Close Handover-Alignment-Gate). |
-| **session-start** | Read + conditional reset | Reads for continuity checks (Phase 1.5): inspects `status` field to detect crashed/paused sessions. Surfaces `## What Not To Retry` as a forced-read HISTORICAL block (Phase 6.5.1). May reset STATE.md to idle at the boundary between a completed session and a new session — only when prior `status: completed`. The reset clears `current-wave` (→ 0), sets `status: idle`, demotes `## Wave History` into `## Previous Session`, and empties `## Deviations` — but PRESERVES `## What Not To Retry` (cross-session continuity, #623) and `## Open Questions` (Close Handover-Alignment-Gate, PRD 2026-07-07). Never resets on `active` or `paused` (those paths are user-interactive). |
+| **session-end** | Read + Status-only write | Reads for metrics extraction (Phase 1.7), sets `status: completed` (Phase 3.4). Exception: only fields modified are `status` in frontmatter and marking entries answered in `## Open Questions` via `markOpenQuestionAnsweredOnDisk` (Close Handover-Alignment-Gate), plus at most one appended `## Open Questions` entry naming vault-orphan candidates via `appendOpenQuestionOnDisk` (Phase 3.7e, #1563). |
+| **session-start** | Read + conditional reset | Reads for continuity checks (Phase 1.5): inspects `status` field to detect crashed/paused sessions. Surfaces `## What Not To Retry` as a forced-read HISTORICAL block (Phase 6.5.1). May reset STATE.md to idle at the boundary between a completed session and a new session — only when prior `status: completed`, via `scripts/state-md-idle-reset.mjs` (#1560). The reset keeps the five recommendation keys in the frontmatter for the Phase 7.5 Mode-Selector, clears `current-wave` (→ 0), sets `status: idle`, demotes `## Wave History` into `## Previous Session`, and empties `## Deviations` — but PRESERVES `## What Not To Retry` (cross-session continuity, #623) and `## Open Questions` (Close Handover-Alignment-Gate, PRD 2026-07-07). Never resets on `active` or `paused` (those paths are user-interactive). |
 | **evolve** | Read-only | Reads `## Deviations` section for deviation pattern extraction (Step 2.2, pattern 5) |
 
 ### Shared-File Single-Writer Rule (`isolation: none` waves)

package/skills/autopilot/SKILL.md

@@ -249,8 +249,9 @@ import { detectPeers } from '$PLUGIN_ROOT/scripts/lib/session-registry.mjs';
 const flags = parseFlags(process.argv.slice(2));
 
 const modeSelector = async () => {
-  // Each iteration rebuilds signals from current disk state. STATE.md will be
-  // freshly idle-reset by the previous /close, sessions.jsonl will have the
+  // Each iteration rebuilds signals from current disk state. STATE.md will
+  // carry the recommendation the previous /close wrote (the idle reset at the
+  // next session-start keeps those keys, #1560), sessions.jsonl will have the
   // new tail entry, etc. This is the contract: live signals every iteration.
   // `repoRoot` is passed explicitly (#1071) rather than left to the helper's
   // cwd default. Do NOT hand-write a `backlogLimit` here — the window default

package/skills/claude-md-drift-check/checker.mjs

@@ -555,10 +555,11 @@ function buildSurfaceDescriptors(vaultDir, commandsDir) {
       id: 'test-count',
       noun: 'test files',
       actual: countTestFiles(vaultDir),
-      // "N test files" — the README badge claims a runtime PASS count
+      // "N test files" or "N+ test files" (an explicit lower bound).
+      // The README badge claims a runtime PASS count
       // ("9303 tests"), which a static checker cannot derive, so we match only
-      // the explicit file-count phrasing. No doc claims this today → skipped.
-      claimRe: /\b(\d+)\s+test\s+files?\b/gi,
+      // the explicit file-count phrasing.
+      claimRe: /\b(\d+)(\+)?\s+test\s+files?\b/gi,
       skipMsg: 'test-count: no tests/ directory found',
     },
   ];
@@ -1831,7 +1832,7 @@ function main() {
         }
       }
 
-      // Surface-count family: one EXACT-count drift check per active surface.
+      // Surface counts are exact, except explicit "N+ test files" lower bounds.
       // A surface only fires when the doc makes an explicit numeric claim that
       // its regex matches; an unclaimed surface produces no errors (skip).
       for (const surface of activeSurfaces) {
@@ -1840,10 +1841,11 @@ function main() {
         let m;
         while ((m = re.exec(line)) !== null) {
           const claimed = parseInt(m[1], 10);
-          if (claimed !== surface.actual) {
+          const lowerBound = surface.id === 'test-count' && m[2] === '+';
+          if (lowerBound ? surface.actual < claimed : claimed !== surface.actual) {
             const err = {
               check: surface.id, file: rel, line: lineNum,
-              message: `Narrative claims ${claimed} ${surface.noun} but actual on-disk count is ${surface.actual}`,
+              message: `Narrative claims ${claimed}${lowerBound ? '+' : ''} ${surface.noun} but actual on-disk count is ${surface.actual}`,
               extracted: m[0],
               count: { surface: surface.id, actual: surface.actual, claimed },
             };

package/skills/npm-publish/SKILL.md

@@ -39,7 +39,7 @@ The script gates mechanics. These three are yours, and it will not make them for
 
 **2. What a leak means when one is found.** A hit from the leakage gate is not a pattern to silence. Decide which of two it is: a real leak (fix `package.json` `files`, re-pack, re-check) or genuine over-matching (fix `LEAKAGE_PATTERNS` in `scripts/release.mjs` **with a test**). There is no third option, and neither is "publish anyway and clean it up in the next version" — an npm publish is not revocable, and unpublishing burns the version number permanently. Operator handling detail: `docs/distribution/npm-publish-checklist.md` § 3.
 
-**3. When to abort instead of repair.** Abort — do not patch forward — when the failure is upstream of the target-confirmed npm receipt: a red preflight row, a lagging `github` mirror, CI not green on the exact commit **on either platform** (`--check` carries both `ci-green-on-head` for GitLab and `ci-green-on-head-github` for the mirror, whose macOS matrix leg has no GitLab equivalent), a dead token, or a publish that did not issue the target receipt. These are cheap to fix and re-run from the top. Repair-in-place is only appropriate *after* that receipt, where the version is already immutable: registry propagation, a missing GitHub release, or a lagging site deploy can be reconciled because npm already has the correct artifact. When `--publish` reports **Post-publish reconciliation required**, **do not rerun `--publish`**; repair the listed state directly. `skills/release/SKILL.md` § Abort criteria is the operative list.
+**3. When to abort instead of repair.** Abort — do not patch forward — when the failure is upstream of the target-confirmed npm receipt: a red preflight row, a lagging `github` mirror, CI not green on the exact commit **on either platform** (`--check` carries both `ci-green-on-head` for GitLab and `ci-green-on-head-github` for the mirror, whose macOS matrix leg has no GitLab equivalent), a dead token, or a publish that did not issue the target receipt. These are cheap to fix and re-run from the top. Repair-in-place is only appropriate *after* that receipt, where the version is already immutable: registry availability (`--reconcile`), a missing GitHub release, or a lagging site deploy can be reconciled because npm already has the correct artifact. When `--publish` reports **Post-publish reconciliation required**, **do not rerun `--publish`**; repair the listed state directly. `skills/release/SKILL.md` § Abort criteria is the operative list.
 
 ## Failure-mode table
 
@@ -48,13 +48,13 @@ The script gates mechanics. These three are yours, and it will not make them for
 | `E403 ... Two-factor authentication or granular access token with bypass 2fa enabled is required` — no OTP prompt | Account has no 2FA enrolled AND token (if any) lacks Bypass-2FA | Create granular token with all four requirements above, or enroll 2FA |
 | Same E403 despite a fresh token | Token created without the Bypass-2FA checkbox, or Read-only, or package-scoped on a first publish | Re-create: RW + All packages + Bypass-2FA |
 | `npm whoami` silent or non-zero | Token expired, or `.env.local` missing | Re-create the token; do not proceed — the preflight fails this row on purpose |
-| `E404` on `npm view` after a target-confirmed publish receipt | Registry propagation (rare, seconds) | Let the script finish its tag/push/GitHub/site tail, then reconcile the registry result; do **not** rerun `--publish` |
+| `E404` on `npm view <pkg>@<target>` after a target-confirmed publish receipt (npm answered HTTP 202) | The upload is **accepted, not yet available**. npm scans every new publish before it becomes installable: "typically around five minutes", "up to 15 minutes or more" at peak or depending on content/size, no service guarantee; the outcome may be published, **held for manual review**, or **blocked** (GitHub changelog 2026-07-28, read 2026-10-08, npm CLI 11.19.0). 5.10.0 stayed 404 for more than 25 minutes. A 404 alone does **not** tell you which of these applies — the package token cannot see the scan state | Let the script finish its tag/push/GitHub/site tail, then run `node scripts/release.mjs --reconcile --target <target>` (read-only, resumable; exit 0 only once installable). While still `pending`, check the owner-visible side: npm says a blocked package's publisher "may receive a notification with the option to appeal" — look at the npm account notifications/e-mail of the publishing account and the package page on npmjs.com. Do **not** rerun `--publish` and do not declare it blocked from the 404 |
 | `ENEEDAUTH` | No login/token at all | Token flow above, or `npm login` |
 | OTP prompt appears but flow is non-interactive (`!`-prefix, script) | No TTY for the prompt | Use the token flow, or a real terminal |
 
 ## Post-publish — the human half
 
-`--publish` attempts registry verification and polls the live site itself. A target-confirmed receipt plus a delayed registry result is a reconciliation outcome, not a failed publish or a retry instruction. What still needs a person:
+`--publish` attempts registry verification and polls the live site itself. A target-confirmed receipt plus a delayed registry result is a reconciliation outcome, not a failed publish or a retry instruction: the receipt is persisted as `.orchestrator/runtime/release-<target>.json`, and `--reconcile` resumes from it. The proof lives in the gitignored runtime dir of the checkout or worktree that ran `--publish`: run `--reconcile` from that same checkout, because any other checkout reports `proof-missing`. What still needs a person:
 
 1. **Rotate/delete the token** at https://www.npmjs.com/settings/<user>/tokens. A token that ever transited a conversation, a screenshot, or any log is burned — rotate immediately.
 2. **pi.dev gallery**: indexing is asynchronous — check https://pi.dev/packages later; do not block on it.