session-orchestrator 5.12.0 → 5.13.0

package/skills/bootstrap/references/bootstrap-retroactive-flow.md

@@ -49,13 +49,24 @@ Entered when `$ARGUMENTS` contains `--retroactive`. Writes the lock file and, pe
    plugin-version: <current plugin version from $PLUGIN_ROOT/package.json>
    ```
 
-6. **Patch Session Config (#182).** Run the validator against the current `## Session Config` block; append any missing mandatory fields with defaults. The 7 mandatory fields (per `scripts/lib/config-schema.mjs`) are: `test-command`, `typecheck-command`, `lint-command`, `agents-per-wave`, `waves`, `persistence`, `enforcement`.
+6. **Patch Session Config (#182, #1567).** Find the mandatory fields the `## Session Config` block does not carry and append them with defaults. The mandatory fields are the keys of the FIRST `## Session Config` block in `$PLUGIN_ROOT/docs/session-config-template.md` (today the 7 validated by `scripts/lib/config-schema.mjs`): `test-command`, `typecheck-command`, `lint-command`, `agents-per-wave`, `waves`, `persistence`, `enforcement`.
+
+   Presence is read from the FILE, not from the validator: `parseSessionConfig()` fills every mandatory field with its default, so `parse-config.mjs` / `validate-config.mjs` never report an ABSENT field (a pnpm repo without `test-command` would silently run `npm test`). `missingStarterKeys()` (`scripts/lib/config/template-keys.mjs`) compares the template's starter keys against `collectTopLevelKeyLines()` — the top-level keys the runtime reads, in every accepted spelling (`key:`, `- key:`, `- **key:**`).
 
    ```bash
-   CONFIG_OUT="$(node "$PLUGIN_ROOT/scripts/parse-config.mjs" 2>&1 >/dev/null)"
-   # parse-config.mjs emits validation warnings to stderr when enforcement=warn.
-   # Grep for 'must be' lines (issued by validate-config.mjs) to detect missing fields.
-   MISSING_FIELDS="$(echo "$CONFIG_OUT" | grep -oE '(test-command|typecheck-command|lint-command|agents-per-wave|waves|persistence|enforcement)' | sort -u || true)"
+   CONFIG_FILE="CLAUDE.md"
+   [[ -f "AGENTS.md" ]] && CONFIG_FILE="AGENTS.md"
+
+   MISSING_FIELDS="$(node --input-type=module -e "
+     import { readFileSync } from 'node:fs';
+     import { missingStarterKeys } from '$PLUGIN_ROOT/scripts/lib/config/template-keys.mjs';
+     const missing = missingStarterKeys(
+       readFileSync(process.argv[1], 'utf8'),
+       readFileSync('$PLUGIN_ROOT/docs/session-config-template.md', 'utf8'),
+     );
+     if (missing === null) { console.error('template has no Session Config block — mandatory-field check did not run'); process.exit(1); }
+     console.log(missing.join(' '));
+   " "$CONFIG_FILE")"
    if [[ -n "$MISSING_FIELDS" ]]; then
      # Detect package manager to pick sensible defaults for commands.
      PM_DEFAULTS="$(node --input-type=module -e "
@@ -67,9 +78,6 @@ Entered when `$ARGUMENTS` contains `--retroactive`. Writes the lock file and, pe
        console.log('lint-command: ' + cmds.lint.command);
      " 2>/dev/null)"
 
-     CONFIG_FILE="CLAUDE.md"
-     [[ -f "AGENTS.md" ]] && CONFIG_FILE="AGENTS.md"
-
      # Append each missing field under the ## Session Config block.
      for field in $MISSING_FIELDS; do
        case "$field" in
@@ -89,7 +97,7 @@ Entered when `$ARGUMENTS` contains `--retroactive`. Writes the lock file and, pe
    fi
    ```
 
-   This patch is best-effort: existing fields are never overwritten. If no fields are missing, this step is a no-op.
+   This patch is best-effort: existing fields are never overwritten, and an INVALID value of a present field is left for `parse-config.mjs` to report. If no fields are missing, this step is a no-op; if the check did not run (exit 1), report that line instead of `No config changes.`.
 
 7. **Commit.** Stage the lock file (and the patched config file, if it changed) and commit:
    ```bash

package/skills/bootstrap/templates/agents/project-code-review.md

@@ -1,6 +1,6 @@
 ---
 name: project-code-review
-description: Use this agent when you need to review code changes for convention compliance, security issues, or correctness before merging. <example>Context: A wave of implementation work has completed and the coordinator needs a review pass before committing. user: "Review the auth module changes" assistant: "I'll use the project-code-review agent to check convention compliance and surface any security concerns." <commentary>Convention enforcement and security review are the project-code-review agent's responsibilities.</commentary></example>
+description: Use this agent when you need to review code changes for convention compliance, security issues, or correctness before merging.
 model: inherit
 color: green
 tools: Read, Grep, Glob
@@ -16,3 +16,7 @@ Performs read-only review of code changes. Use this agent to:
 - Verify adherence to naming conventions and file structure
 
 Edit this file to add project-specific review checklists, e.g. banned patterns, required linting rules, security invariants, or architecture constraints.
+
+## Examples
+
+<example>Context: A wave of implementation work has completed and the coordinator needs a review pass before committing. user: "Review the auth module changes" assistant: "I'll use the project-code-review agent to check convention compliance and surface any security concerns." <commentary>Convention enforcement and security review are the project-code-review agent's responsibilities.</commentary></example>

package/skills/bootstrap/templates/agents/project-discovery.md

@@ -1,6 +1,6 @@
 ---
 name: project-discovery
-description: Use this agent when you need to audit project state, map affected modules, or verify assumptions before implementation. <example>Context: Before adding a new feature, the coordinator needs to understand existing code paths. user: "Audit the auth flow" assistant: "I'll use the project-discovery agent to map auth modules and identify dependencies." <commentary>Read-only audit work is the project-discovery agent's sweet spot.</commentary></example>
+description: Use this agent when you need to audit project state, map affected modules, or verify assumptions before implementation.
 model: inherit
 color: cyan
 tools: Read, Grep, Glob, Bash
@@ -16,3 +16,7 @@ Performs read-only audits of the project codebase. Use this agent to:
 - Surface potential conflicts or constraints
 
 Edit this file to add project-specific discovery queries, e.g. common file paths, known patterns to grep for, or project-specific terminology to watch for.
+
+## Examples
+
+<example>Context: Before adding a new feature, the coordinator needs to understand existing code paths. user: "Audit the auth flow" assistant: "I'll use the project-discovery agent to map auth modules and identify dependencies." <commentary>Read-only audit work is the project-discovery agent's sweet spot.</commentary></example>

package/skills/bootstrap/templates/agents/project-quality-gate.md

@@ -1,6 +1,6 @@
 ---
 name: project-quality-gate
-description: Use this agent when you need to verify a repo meets quality standards before a release, merge, or deployment decision. <example>Context: The session is about to close and the coordinator wants a final quality check. user: "Run the quality gate checks" assistant: "I'll use the project-quality-gate agent to verify tests pass, lint is clean, and coverage thresholds are met." <commentary>Gate decisions — pass/fail with evidence — are the project-quality-gate agent's core output.</commentary></example>
+description: Use this agent when you need to verify a repo meets quality standards before a release, merge, or deployment decision.
 model: inherit
 color: blue
 tools: Read, Grep, Glob, Bash
@@ -16,3 +16,7 @@ Evaluates whether the repo passes project-defined quality criteria. Use this age
 - Confirm no blocked patterns or known vulnerabilities are introduced
 
 Edit this file to add project-specific gate criteria, e.g. minimum test coverage percentage, required CI checks, or deployment pre-conditions.
+
+## Examples
+
+<example>Context: The session is about to close and the coordinator wants a final quality check. user: "Run the quality gate checks" assistant: "I'll use the project-quality-gate agent to verify tests pass, lint is clean, and coverage thresholds are met." <commentary>Gate decisions — pass/fail with evidence — are the project-quality-gate agent's core output.</commentary></example>

package/skills/claude-md-drift-check/SKILL.md

@@ -42,14 +42,14 @@ PHASE 1 IMPLEMENTED (2026-04-19). Session-end opt-in quality gate. Upstream of `
 | 6 | `session-config-parity` | Top-level keys under `## Session Config` in `CLAUDE.md` / `AGENTS.md` | diff against `docs/session-config-template.md`; a missing MANDATORY (minimal-baseline) key is an error, a missing OPT-IN-baseline-only key is a note, a local key absent from the template's Session Config blocks is a warning |
 | 7 | `vault-dir-parity` | `vault-integration.vault-dir` in BOTH `CLAUDE.md` AND `AGENTS.md` | reuse `_parseVaultIntegration`; flag when the two files disagree. Short-circuits to PASS when the two are the SAME file by construction (symlink / same inode / byte-identical generated copy) |
 | 8 | `generated-rule-staleness` *(WARN only)* | `.claude/rules/*.md` with `auto-generated: true` frontmatter | extract `learning-key`; WARN when the key is absent from `.orchestrator/metrics/learnings.jsonl` or its learning's `expires_at` is in the past; skipped silently when no auto-generated rules exist |
-| 9 | `rule-scoping` | `.claude/rules/*.md` frontmatter + `## See Also` footers + `.claude/rules/<name>.md` citations in `CLAUDE.md`/`AGENTS.md` | six probes: `paths:` frontmatter incl. frontmatter not at line 1 (error, #1449), cited-but-missing rule citations (error), zero-match `globs:` patterns (warn), foreign PascalCase glob tokens (warn), unreadable rule files (warn — surfaced instead of silently skipped), declared fleet-intent globs (**note**, never warn); skipped silently when `.claude/rules/` is absent |
+| 9 | `rule-scoping` | `.claude/rules/*.md` frontmatter + `## See Also` footers + `.claude/rules/<name>.md` citations in `CLAUDE.md`/`AGENTS.md` | seven probes: `paths:` frontmatter incl. frontmatter not at line 1 (error, #1449), cited-but-missing rule citations (error), zero-match `globs:` patterns (warn), foreign PascalCase glob tokens (warn), unreadable rule files (warn — surfaced instead of silently skipped), declared fleet-intent globs (**note**, never warn), `globs:` without `paths:` (warn, #1638 — Claude Code loads it always-on); skipped silently when `.claude/rules/` is absent |
 | 10 | `docs-parity` | `docs/components.md` count-claims, Session Config key parity (`docs/session-config-template.md` vs `docs/session-config-reference.md`), `.claude/metrics/` stale-path references in `docs/*.md` / `docs/examples/*.md` | three sub-checks (a/b/c) — see below; skipped silently when `docs/components.md` is absent |
 
 Check 3 deliberately scopes to forward-looking sections. Mentions inside "Recently Closed", "Decisions", "Archive", etc. describe history and must not be flagged.
 
 Check 5 uses `countSlashCommands()` to count the union of non-hidden `*.md` files directly inside `commands/` and skills under `skills/` whose frontmatter explicitly declares `user-invocable: true`, deduplicated by name. The `commands/` directory is resolved relative to `VAULT_DIR` by default; `--commands-dir <path>` overrides that side of the union, while skills remain relative to `VAULT_DIR`. Either directory alone is sufficient; an existing directory with no commands contributes zero rather than causing a skip.
 
-Check 6 (issue #30; severity split per #785 and #1356) extracts the YAML block under `## Session Config` from both the canonical template (`docs/session-config-template.md` by default, override with `--config-template`) and the resolved local instruction file — reading the template TWICE, once per occurrence: `{ occurrence: 'first' }` reaches the "Full minimal baseline" (the 7 schema-mandatory keys), `{ occurrence: 'last' }` reaches the "Full opt-in baseline" (the full key catalog, a strict superset of the minimal block). A template key missing from the local file is a `session-config-parity` **error** when it belongs to the minimal-baseline set, and a **note** with `probe: "opt-in-gap"` when it is opt-in-baseline-only. A local key absent from those template blocks produces a **warning**: it may be a typo or a template gap, and this check makes no claim about documentation elsewhere or runtime use. When the template carries a single `## Session Config` heading (no separate opt-in block), `'first'` and `'last'` resolve to the same block, every template key is treated as mandatory, and unknown-local-key warnings are skipped. Both fenced YAML (```` ```yaml ... ``` ````) and raw YAML body (up to next `## ` heading) are accepted. The check skips gracefully when the template file is absent, when no instruction file is detected, or when explicitly disabled via `--skip-session-config-parity`.
+Check 6 (issue #30; severity split per #785 and #1356) extracts the YAML block under `## Session Config` from both the canonical template (`docs/session-config-template.md` by default, override with `--config-template`) and the resolved local instruction file — reading the template TWICE, once per occurrence: `{ occurrence: 'first' }` reaches the "Starter config" at the top of the template (the 7 schema-mandatory keys), `{ occurrence: 'last' }` reaches the "Full opt-in baseline" (the full key catalog, a strict superset of the minimal block). A template key missing from the local file is a `session-config-parity` **error** when it belongs to the minimal-baseline set, and a **note** with `probe: "opt-in-gap"` when it is opt-in-baseline-only. A local key absent from those template blocks produces a **warning**: it may be a typo or a template gap, and this check makes no claim about documentation elsewhere or runtime use. When the template carries a single `## Session Config` heading (no separate opt-in block), `'first'` and `'last'` resolve to the same block, every template key is treated as mandatory, and unknown-local-key warnings are skipped. Both fenced YAML (```` ```yaml ... ``` ````) and raw YAML body (up to next `## ` heading) are accepted. The check skips gracefully when the template file is absent, when no instruction file is detected, or when explicitly disabled via `--skip-session-config-parity`.
 
 The parity set is **template-driven**: every column-0 YAML key under `## Session Config` in the template (across both occurrences) is checked. As of the gsd Pattern Adoption Quick-Wins bundle (PRD 2026-05-22, issues #517–#521), the template-side keys include four opt-in top-level blocks:
 
@@ -68,7 +68,7 @@ Check 7 (issue #600) is the **only** check that intentionally reads BOTH instruc
 
 The same predicate guards Check 9's probe 2a, which iterates `['CLAUDE.md', 'AGENTS.md']`: with an aliased `AGENTS.md` it scans `CLAUDE.md` only, because otherwise every dangling `.claude/rules/*.md` citation would be reported TWICE — one defect, two errors, and in `--mode strict` a doubled blocking surface against a file the operator is not allowed to edit.
 
-Check 9 (`rule-scoping`) validates `.claude/rules/*.md` frontmatter against the `scripts/lib/rule-loader.mjs` contract, catching the class of defect where a rule silently drifts out of the activation pipeline the loader actually implements. Six probes: **(1) paths-presence** — a frontmatter block that does not open on line 1 (text or a provenance comment before `---`) is an ERROR since #1449: Claude Code ignores it and loads the rule always-on; the probe reports `parseGlobsFrontmatter(...).defect === 'frontmatter-not-at-top'` with the remedy (move the block to line 1, provenance comment after the closing `---`). Otherwise, since #795 `paths:` is a full same-shape alias for `globs:` in `rule-loader.mjs` (`globs:` wins silently when both are present), so a well-formed `paths:`-only rule loads correctly SCOPED and is NOT flagged (#840). The probe fires only when the frontmatter textually carries a top-level `paths:` key AND `parseGlobsFrontmatter` — the loader's own parser, imported rather than re-derived — returns `globs === null` (e.g. a malformed frontmatter line makes it throw); that parse mismatch means the rule may silently load ALWAYS-ON, and is flagged as an error. **(2) cited-but-missing** — `(a)` `.claude/rules/<name>.md` citations inside `CLAUDE.md`/`AGENTS.md` that don't resolve to a file on disk, and `(b)` bare `<name>.md` tokens in a rule's own `## See Also` footer that don't exist as sibling rule files (tokens carrying a path separator, e.g. `../../skills/_shared/state-ownership.md`, are cross-directory references and explicitly out of scope); both flagged as errors. **(3) zero-match-globs** — a `globs:` pattern matching zero files in `git ls-files` (falls back to a manual directory walk when git is unavailable); flagged as a WARNING, not an error, because library/exemplar repos legitimately carry dead stack rules. **(4) foreign-glob** — a glob pattern containing a PascalCase product-like token (regex `[A-Z][a-z]+[A-Z]`, e.g. `WalkAITalkieTests`) — a likely copy-paste leftover from another project's rule scope; flagged as a WARNING. **(5) unreadable-file** — a rule file that could not be read (permissions, a race with a concurrent delete); flagged as a WARNING rather than silently skipped, so a completeness audit does not drop files, and so an unreadable file cannot brick the gate under `mode: hard`. **(6) fleet-intent-glob** — a `globs:` pattern DECLARED as fleet intent goes to `notes[]` (see below), never to `warnings[]`, and the declaration also settles probe 4 for that same pattern: a pattern the rule author declared is by construction not a copy-paste leftover. Glob matching reuses the same picomatch-with-inline-fallback resolution `scripts/lib/rule-loader.mjs` uses (`parseGlobsFrontmatter` is imported directly; the picomatch resolution itself is duplicated locally since `rule-loader.mjs` does not export a public matcher function). The check is skipped silently (no `checks_run` entry, no `checks_skipped` entry) when `.claude/rules/` is absent, or explicitly via `--skip-rule-scoping`.
+Check 9 (`rule-scoping`) validates `.claude/rules/*.md` frontmatter against the `scripts/lib/rule-loader.mjs` contract, catching the class of defect where a rule silently drifts out of the activation pipeline the loader actually implements. Seven probes: **(1) paths-presence** — a frontmatter block that does not open on line 1 (text or a provenance comment before `---`) is an ERROR since #1449: Claude Code ignores it and loads the rule always-on; the probe reports `parseGlobsFrontmatter(...).defect === 'frontmatter-not-at-top'` with the remedy (move the block to line 1, provenance comment after the closing `---`). Otherwise, since #795 `paths:` is a full same-shape alias for `globs:` in `rule-loader.mjs` (`globs:` wins silently when both are present), so a well-formed `paths:`-only rule loads correctly SCOPED and is NOT flagged (#840). The probe fires only when the frontmatter textually carries a top-level `paths:` key AND `parseGlobsFrontmatter` — the loader's own parser, imported rather than re-derived — returns `globs === null` (e.g. a malformed frontmatter line makes it throw); that parse mismatch means the rule may silently load ALWAYS-ON, and is flagged as an error. **(2) cited-but-missing** — `(a)` `.claude/rules/<name>.md` citations inside `CLAUDE.md`/`AGENTS.md` that don't resolve to a file on disk, and `(b)` bare `<name>.md` tokens in a rule's own `## See Also` footer that don't exist as sibling rule files (tokens carrying a path separator, e.g. `../../skills/_shared/state-ownership.md`, are cross-directory references and explicitly out of scope); both flagged as errors. **(3) zero-match-globs** — a `globs:` pattern matching zero files in `git ls-files` (falls back to a manual directory walk when git is unavailable); flagged as a WARNING, not an error, because library/exemplar repos legitimately carry dead stack rules. **(4) foreign-glob** — a glob pattern containing a PascalCase product-like token (regex `[A-Z][a-z]+[A-Z]`, e.g. `WalkAITalkieTests`) — a likely copy-paste leftover from another project's rule scope; flagged as a WARNING. **(5) unreadable-file** — a rule file that could not be read (permissions, a race with a concurrent delete); flagged as a WARNING rather than silently skipped, so a completeness audit does not drop files, and so an unreadable file cannot brick the gate under `mode: hard`. **(6) fleet-intent-glob** — a `globs:` pattern DECLARED as fleet intent goes to `notes[]` (see below), never to `warnings[]`, and the declaration also settles probe 4 for that same pattern: a pattern the rule author declared is by construction not a copy-paste leftover. **(7) globs-without-paths** (#1638) — a line-1 frontmatter with a `globs:` key and no `paths:` key: Claude Code reads only `paths:` and ignores `globs:` without an error, so the rule loads ALWAYS-ON there although `rule-loader.mjs` scopes it for wave injection. Flagged as a WARNING with `probe: "globs-without-paths"`, the line of the `globs:` key and the remedy (add `paths:` with the same patterns); never an error, also not under `--mode strict`. Keyed on the parser's raw `paths` field, so body text and a displaced block (probe 1) never trigger it. Glob matching reuses the same picomatch-with-inline-fallback resolution `scripts/lib/rule-loader.mjs` uses (`parseGlobsFrontmatter` is imported directly; the picomatch resolution itself is duplicated locally since `rule-loader.mjs` does not export a public matcher function). The check is skipped silently (no `checks_run` entry, no `checks_skipped` entry) when `.claude/rules/` is absent, or explicitly via `--skip-rule-scoping`.
 
 **Fleet-intent declaration (Check 9, probe 6).** A rule may declare that a `globs:` pattern is aimed at CONSUMER repos rather than this one, via its own frontmatter key `fleet-intent-globs:`. Accepted forms are block style (`fleet-intent-globs:` plus indented `  - "<pattern>"` lines), flow style (`fleet-intent-globs: ["a", "b"]`) and a single inline value; surrounding quotes are stripped, blank and `#` comment lines are ignored. The key is inert for rule loading — `rule-loader.mjs`'s `parseGlobsFrontmatter` skips unknown top-level keys and their continuation lines. A declared pattern is reported in `notes[]` with its file, the pattern, whether it matches `≥1` or `0` tracked files here, and the declaration `source` (`frontmatter`). The grain is per pattern AND per rule file: declaring one glob amnesties neither a sibling glob in the same rule nor the same pattern in another rule. There is deliberately NO checker-side exemption list: a rule that does not declare the pattern itself is not exempt, so the declaration always sits with the rule it describes.
 

package/skills/claude-md-drift-check/checker.mjs

@@ -38,11 +38,13 @@ import { resolveInstructionFile } from '../../scripts/lib/common.mjs';
 import { _parseVaultIntegration } from '../../scripts/lib/config/vault-integration.mjs';
 import { _parseDriftCheck } from '../../scripts/lib/config/drift-check.mjs';
 import { isSessionConfigHeading } from '../../scripts/lib/config/section-extractor.mjs';
+import { extractSessionConfigBlock, extractTopLevelKeys } from '../../scripts/lib/config/template-keys.mjs';
 import { FRONTMATTER_NOT_AT_TOP, isRuleExpired, parseGlobsFrontmatter } from '../../scripts/lib/rule-loader.mjs';
 import { resolveRepoSpec } from '../../scripts/lib/vcs-repo-spec.mjs';
 import { userInvocableSkills } from '../../scripts/lib/user-invocable-skills.mjs';
 import { loadOwnerConfig } from '../../scripts/lib/owner-yaml.mjs';
 import { learningKeyOf } from '../../scripts/lib/learnings/kebab.mjs';
+import { resolveLedgerPath } from '../../scripts/lib/ledger-path.mjs';
 
 const FORWARD_HEADING_RE =
   /(?:^|\b)(what'?s?\s+next|backlog|open\s+issues?|offene\s+(?:issues?|themen)|todo|next\s+steps?|roadmap)(?:$|\b)/i;
@@ -133,88 +135,6 @@ function walkDir(dir, visit) {
   }
 }
 
-/**
- * Extract the YAML block under a `## Session Config` heading from a Markdown
- * document. Tries fenced YAML first (```yaml ... ```) *within the matched
- * heading's own body slice*, then falls back to the raw body up to the next
- * `^## ` heading or EOF.
- *
- * `docs/session-config-template.md` carries TWO literal `## Session Config`
- * lines — both live INSIDE fenced ```yaml example blocks: the "Full minimal
- * baseline" (7 mandatory keys) and the "Full opt-in baseline" (the complete
- * key catalog, a strict superset of the minimal block). By default this
- * function matches the FIRST occurrence (correct for a local CLAUDE.md /
- * AGENTS.md instruction file, which has exactly one real heading). Pass
- * `{ occurrence: 'last' }` to match the LAST occurrence instead — the template
- * call site uses this to reach the opt-in baseline's full key set rather than
- * silently stopping at the 7-key minimal block (issue #785).
- *
- * Returns { body: string, headingLine: number } or null when no heading found.
- *
- * @param {string} content
- * @param {{ occurrence?: 'first'|'last' }} [options]
- */
-function extractSessionConfigBlock(content, { occurrence = 'first' } = {}) {
-  const lines = content.split('\n');
-  const headingIdxs = [];
-  for (let i = 0; i < lines.length; i++) {
-    // SSOT predicate (#968). The previous local `/^##\s+Session Config\b/`
-    // was the loosest JS comparator in the repo: no end anchor and `\s+`
-    // instead of a single space, so it accepted `##  Session Config` (two
-    // spaces) and `## Session Config Convention` — both of which the runtime
-    // parser rejects. This checker's whole job is to report on the block the
-    // runtime reads, so matching a heading the runtime cannot see made it
-    // audit a section that does not exist.
-    if (isSessionConfigHeading(lines[i])) headingIdxs.push(i);
-  }
-  if (headingIdxs.length === 0) return null;
-
-  const targetIdx = occurrence === 'last' ? headingIdxs[headingIdxs.length - 1] : headingIdxs[0];
-  const headingLine = targetIdx + 1; // 1-based line number for error reporting
-
-  // Raw body: from the line after the heading up to the next `## ` heading or EOF.
-  let endIdx = lines.length;
-  for (let i = targetIdx + 1; i < lines.length; i++) {
-    if (/^##\s+/.test(lines[i])) { endIdx = i; break; }
-  }
-  const rawBody = lines.slice(targetIdx + 1, endIdx).join('\n');
-
-  // Prefer a fenced YAML block found anywhere within the raw body slice
-  // (tolerates a blank line between the heading and the fence); fall back to
-  // the raw body itself when no fence is present.
-  const fenced = rawBody.match(/```ya?ml\r?\n([\s\S]*?)\r?\n```/);
-  const body = fenced ? fenced[1] : rawBody;
-
-  return { body, headingLine };
-}
-
-/**
- * Extract top-level YAML keys from a YAML body. Only column-0 keys are
- * collected (indented keys are children and ignored).
- *
- * Accepts four equivalent forms consumer CLAUDE.md files write a Session
- * Config key in: bare `key:`, Markdown bullet `- key:`, bold `**key:**`
- * (closing bold before the colon), and the bold-bullet consumer shape
- * `- **key:** value` (bold wraps the key AND colon together, closing bold
- * AFTER the colon). Baseline issue #60: the original bare-only regex
- * extracted zero keys from bullet-form local files, so session-config-parity
- * (Check 6, below) either false-positived on every mandatory key (local side
- * reads as empty) or, when the TEMPLATE side also used bullet form, passed
- * vacuously (both sides empty, so the diff was always empty). Sibling
- * precedent: `scripts/lib/config/block-header.mjs` recognizes only header
- * lines, not individual key-value pairs — this function is the per-key
- * counterpart.
- */
-function extractTopLevelKeys(body) {
-  const keys = [];
-  const re = /^(?:-\s+)?(?:\*\*)?([A-Za-z][\w-]*)(?:\*\*)?:/gm;
-  let m;
-  while ((m = re.exec(body)) !== null) {
-    keys.push(m[1]);
-  }
-  return keys;
-}
-
 /**
  * Extract Session-Config-key-shaped mentions from a "reference" style doc
  * (docs/session-config-reference.md for Check 10b). Unlike the template,
@@ -632,7 +552,8 @@ function lookupIssueState(iid, repo, cache, vaultDir) {
 //      legitimately carry dead stack rules.
 //   4. foreign-glob     → warnings[]: a glob pattern containing a PascalCase
 //      product-like token (e.g. `WalkAITalkieTests`) — a likely copy-paste
-//      leftover from another project's rule.
+//      leftover from another project's rule. Skipped when the glob matches a
+//      `git ls-files` entry of the checked repo — its own directory (#1657).
 //   5. unreadable-file  → warnings[]: a rule file that could not be read
 //      (permissions, race with a concurrent delete, etc.) — surfaced instead
 //      of being silently skipped, since a completeness audit that silently
@@ -642,16 +563,22 @@ function lookupIssueState(iid, repo, cache, vaultDir) {
 //      rule's own `fleet-intent-globs:` frontmatter key — reported with its
 //      local match count, never warned, and it settles probes 3+4 for that
 //      pattern. See FLEET_INTENT_FM_KEY below.
+//   7. globs-without-paths → warnings[]: a line-1 frontmatter with a `globs:`
+//      key and no `paths:` key (#1638). Claude Code reads `paths:` only and
+//      ignores `globs:` without an error, so the rule loads ALWAYS-ON there
+//      even though rule-loader.mjs scopes it for wave injection. WARN, not
+//      error, also under strict — the fix is a judgement (which patterns),
+//      and the repo's own hard gate is check-rules.mjs, not this check.
 //
 // This list is numeric, not a call sequence — the code below does NOT run
-// 1→2→3→4→5→6 in order. Per rule file: probe 5's read-failure guard runs
+// 1→2→3→4→5→6→7 in order. Per rule file: probe 5's read-failure guard runs
 // FIRST (it gates every other probe via `continue` on an unreadable file,
-// before probe 1 ever sees the content), then probe 1, then probes 3/4 with
+// before probe 1 ever sees the content), then probe 1, then probe 7, then probes 3/4 with
 // probe 6 interleaved INSIDE the same per-pattern loop (it must intercept a
 // declared fleet-intent pattern before 3/4 evaluate it), then probe 2b: once
 // every rule file has been visited, probe 2a runs last over CLAUDE.md/
 // AGENTS.md. `grep -n "Probe [0-9]" checker.mjs` therefore surfaces markers
-// in code order (5, 1, 6, 2b, 2a), not numeric order — that is intentional,
+// in code order (5, 1, 7, 6, 2b, 2a), not numeric order — that is intentional,
 // not drift; do not "fix" it by moving probe 6's marker next to probe 5's.
 // ───────────────────────────────────────────────────────────────────────────
 
@@ -718,6 +645,10 @@ function globMatchesAny(pattern, trackedFiles) {
  * 64 MiB buffer exists because the 1 MiB default threw ENOBUFS on a vault
  * listing of 1,199,500 bytes (measured 2026-10-04), which the old bare catch
  * turned into exactly those false warnings, silently.
+ *
+ * Returns `{ files, fromGit }`: `fromGit` is false when the listing came from
+ * the walk fallback. The foreign-glob probe only trusts a git listing to
+ * exempt a glob (#1657) — without it, it keeps warning.
  */
 function listTrackedFiles(vaultDir) {
   try {
@@ -727,7 +658,7 @@ function listTrackedFiles(vaultDir) {
       stdio: ['ignore', 'pipe', 'pipe'],
       maxBuffer: 64 * 1024 * 1024,
     });
-    return out.split('\n').filter(Boolean);
+    return { files: out.split('\n').filter(Boolean), fromGit: true };
   } catch (err) {
     const notARepo = err?.status === 128 && /not a git repository/i.test(String(err?.stderr ?? ''));
     if (err?.code !== 'ENOENT' && !notARepo) {
@@ -737,7 +668,7 @@ function listTrackedFiles(vaultDir) {
     }
     const files = [];
     walkDir(vaultDir, (f) => files.push(relative(vaultDir, f).replace(/\\/g, '/')));
-    return files;
+    return { files, fromGit: false };
   }
 }
 
@@ -1067,13 +998,13 @@ function main() {
   // and was wrong about two of them:
   //   awk '/^## /{sec=$0} /^auto-skill-dispatch:|^issue-budget:/{print NR,sec}' \
   //     docs/session-config-template.md
-  //   → auto-skill-dispatch line 87 (## Auto-Skill Dispatch)
-  //   → issue-budget        line 123 (## Issue Budget)
+  //   → auto-skill-dispatch under ## Auto-Skill Dispatch
+  //   → issue-budget        under ## Issue Budget
   //   rg -c "'auto-skill-dispatch'" scripts/  → 4 files, non-zero
   //   rg -c "'issue-budget'" scripts/         → non-zero
   // Both are documented in the template FILE and both are read at runtime;
-  // only their absence from the two `## Session Config` blocks (lines 658/676)
-  // was ever true. The message below now asserts only that.
+  // only their absence from the two `## Session Config` blocks (starter and
+  // opt-in baseline) was ever true. The message below now asserts only that.
   //
   // `mode: hard`/`strict` still keys off `errors[]` only, so neither notes
   // nor the new warnings can block `runConfigValidationGate()`.
@@ -1091,10 +1022,11 @@ function main() {
       const localContent = readFileSync(instr.path, 'utf8');
       // 'last' occurrence reaches the "Full opt-in baseline" block (the full
       // key catalog, a strict superset of the minimal block) — issue #785.
-      // 'first' occurrence reaches the "Full minimal baseline" (7 mandatory
-      // keys) — used here to classify which missing keys are mandatory vs
-      // opt-in. When the template has only ONE `## Session Config` heading
-      // (e.g. a test fixture, or a repo that never split the two baselines),
+      // 'first' occurrence reaches the "Starter config" (formerly "Full
+      // minimal baseline"; 7 mandatory keys) — used here to classify which
+      // missing keys are mandatory vs opt-in. When the template has only ONE
+      // `## Session Config` heading (e.g. a test fixture, or a repo that never
+      // split the two baselines),
       // 'first' and 'last' resolve to the SAME block, so every key is
       // treated as mandatory — preserving pre-existing behaviour for
       // single-block templates.
@@ -1297,7 +1229,7 @@ function main() {
     // Build the set of known learning keys from learnings.jsonl.
     // key → expires_at (ISO string or null)
     const knownKeys = new Map();
-    const learningsPath = join(vaultDir, '.orchestrator', 'metrics', 'learnings.jsonl');
+    const learningsPath = resolveLedgerPath('.orchestrator/metrics/learnings.jsonl', vaultDir);
     const learningsPresent = existsSync(learningsPath) && statSync(learningsPath).isFile();
 
     if (learningsPresent) {
@@ -1341,6 +1273,7 @@ function main() {
           check: 'generated-rule-staleness',
           file: relPath,
           line: 1,
+          // ledger-root: message text naming the ledger, not a path read
           message: `Auto-generated rule references learning-key '${learningKey}' which is absent from .orchestrator/metrics/learnings.jsonl, and the rule carries no valid evidence-digest to verify it offline`,
           extracted: learningKey,
         });
@@ -1382,7 +1315,7 @@ function main() {
 
   // Check 9: rule-scoping — validates .claude/rules/*.md frontmatter against
   // the rule-loader.mjs contract (see the doc-comment above the helper
-  // functions for the six probes, incl. unreadable-file and fleet-intent-glob). Silently skipped (no id pushed, no
+  // functions for the seven probes, incl. unreadable-file and fleet-intent-glob). Silently skipped (no id pushed, no
   // checksSkipped entry) when .claude/rules/ is absent — mirrors Check 8's
   // silent-skip semantics. `--skip-rule-scoping` disables the whole check.
   if (!args.skipRuleScoping) {
@@ -1399,6 +1332,7 @@ function main() {
 
       // Lazily computed — only needed once any rule declares ≥1 glob pattern.
       let trackedFiles = null;
+      let trackedFromGit = false;
 
       for (const fname of ruleFileNames) {
         const absPath = join(rulesDir, fname);
@@ -1457,10 +1391,30 @@ function main() {
           });
         }
 
+        // --- Probe 7: globs-without-paths → warnings[] (#1638) ---
+        // Keyed on the parser's raw `paths` field, never on the merged `globs`
+        // value or on body text: `parsed.globs !== null` with `parsed.paths ===
+        // null` means the frontmatter carries `globs:` and no `paths:`. A
+        // displaced or unparseable block yields `globs: null` and stays silent
+        // here (probe 1 owns the displaced case).
+        if (parsed.globs !== null && parsed.paths === null) {
+          // Search the frontmatter only (line 2 up to the closing ---), with the
+          // parser's own key tolerance (`globs :`), so a body line never wins.
+          const fmLines = content.split(/\r?\n/);
+          const fmEnd = fmLines.indexOf('---', 1);
+          const globsLine = fmLines.slice(0, fmEnd === -1 ? fmLines.length : fmEnd)
+            .findIndex((l, i) => i > 0 && /^globs\s*:/.test(l)) + 1;
+          warnings.push({
+            check: 'rule-scoping', probe: 'globs-without-paths', file: relPath, line: globsLine || 1,
+            message: `${relPath}: frontmatter has 'globs:' but no 'paths:' — Claude Code reads only 'paths:', so this rule loads ALWAYS-ON for Claude Code. Add 'paths:' with the matching patterns (the same list as 'globs:').`,
+            extracted: 'globs:',
+          });
+        }
+
         // --- Probes 3 & 4: zero-match-globs / foreign-glob → warnings[] ---
         const globs = parsed.globs;
         if (Array.isArray(globs) && globs.length > 0) {
-          if (trackedFiles === null) trackedFiles = listTrackedFiles(vaultDir);
+          if (trackedFiles === null) ({ files: trackedFiles, fromGit: trackedFromGit } = listTrackedFiles(vaultDir));
           const declaredFleetIntent = new Set(parseFleetIntentGlobs(fmBody));
           for (const pattern of globs) {
             // --- Probe 6: fleet-intent-glob → notes[] ---
@@ -1480,14 +1434,19 @@ function main() {
               });
               continue;
             }
-            if (!globMatchesAny(pattern, trackedFiles)) {
+            const matchesTracked = globMatchesAny(pattern, trackedFiles);
+            if (!matchesTracked) {
               warnings.push({
                 check: 'rule-scoping', file: relPath, line: 1,
                 message: `glob '${pattern}' matches 0 tracked files (library/exemplar repos may legitimately carry dead stack rules)`,
                 extracted: pattern,
               });
             }
-            if (FOREIGN_GLOB_TOKEN_RE.test(pattern)) {
+            // #1657: a glob that matches a git-tracked file of THIS repo names
+            // the repo's own directory (`WalkAITalkie/**` in WalkAITalkie), not
+            // a copy-paste leftover. Only a git listing exempts — the walk
+            // fallback keeps warning (fail toward reporting).
+            if (FOREIGN_GLOB_TOKEN_RE.test(pattern) && !(trackedFromGit && matchesTracked)) {
               warnings.push({
                 check: 'rule-scoping', file: relPath, line: 1,
                 message: `glob '${pattern}' contains a PascalCase product-like token — verify this rule was not copy-pasted from another project`,
@@ -1687,6 +1646,7 @@ function main() {
           if (metricsLines[i].includes('.claude/metrics/')) {
             errors.push({
               check: 'docs-parity', file: rel, line: i + 1,
+              // ledger-root: message text naming the canonical dir, not a path read
               message: `Stale metrics path '.claude/metrics/' referenced — canonical path is '.orchestrator/metrics/'`,
               extracted: '.claude/metrics/',
             });

package/skills/close/SKILL.md

@@ -13,15 +13,28 @@ The user invokes `/close` (arguments: **$ARGUMENTS** — none are interpreted; a
 
 The user wants to end the current session.
 
-**Pre-check before invoking session-end:** Determine `<state-dir>` from the current platform (`.claude/`, `.codex/`, `.cursor/`, or `.pi/`). Check if `<state-dir>/STATE.md` exists and read its `status` field. Three exit conditions:
+**Pre-check before invoking session-end (#1661).** Run, from the project root:
 
-1. **STATE.md does not exist:** Read Session Config to check `persistence`. If `persistence: false`, inform the user: "Session completed (persistence is off — STATE.md was never created). Use `/session` to start a new session." If `persistence: true` (or Session Config unavailable), inform the user: "No active session found. Use `/session` to start a session first." Either way, stop.
-2. **STATE.md exists and `status: completed`:** `status: completed` alone is NOT proof that session-end's Phase 3.7 writer ever ran (#429) — the field can be set by hand, or by any path that stops short of that write. Parse STATE.md with `parseStateMd` and parse `.orchestrator/metrics/sessions.jsonl` as JSONL. Import `findRecordedSession` from the plugin's `scripts/lib/session-close-backfill.mjs` and call it with the parsed records and `{ sessionId: frontmatter['session-id'] ?? readLock({ repoRoot })?.session_id ?? null, semanticSessionId: frontmatter.session, startedAt: frontmatter.started_at }` (`readLock` from `scripts/lib/session-lock.mjs`). The lock fallback is sound here and ONLY here: `/close` runs inside the very session whose STATE.md it is reading, so the live lock names that same session — it is never a peer's id. STATE.md files written before #1368 carry no `session-id` key at all, and without the fallback every one of them misses the native fast path. This is the shared backfill identity reader: native UUIDs take precedence, conflicting native IDs never match through a label, and legacy semantic records remain readable. Do not substitute a text grep or compare the semantic label only against `session_id`. A missing ledger means no record; an unreadable or malformed ledger is inconclusive — report the read/parse failure and stop before repeating close side effects.
-   - **A matching completed record exists (including a legacy authoritative record without a `status` field):** Inform the user: "Previous session was already finalized by session-end. Start a new session with `/session`, or inspect `<state-dir>/STATE.md` to review the prior close. (Note: if this is unexpected after an Express Path session, `skills/go/SKILL.md` should have auto-invoked /close — check that STATE.md `## Deviations` contains an `Express path:` entry.)" and stop.
-   - **No matching completed record exists:** Warn the user: "STATE.md completed ohne passenden Abschluss im Ledger — session-end wird zur Vervollständigung ausgeführt (#429)." An abandoned backfill stub does not prove finalization. Do NOT stop — proceed to invoke the session-end skill exactly as in exit condition 3, so the missing completion gets written this time. (The SessionEnd hook's `backfillCompletedFromStateMd` independently self-heals this same gap on a later session's teardown; this Pre-Check branch covers the case where /close is re-run before that hook has had a chance to fire.)
-3. **STATE.md exists and `status: active` or `status: paused`:** Proceed to invoke the session-end skill.
+```bash
+node "${CLAUDE_PLUGIN_ROOT:-${CODEX_PLUGIN_ROOT:-$PLUGIN_ROOT}}/scripts/close-precheck.mjs" --repo-root "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+```
 
-For any other `status` value (e.g., `idle`), warn the user: "Unexpected session status `<value>`. Inspect `<state-dir>/STATE.md` and use `/session` to reset if needed." and stop.
+It prints one JSON object (exit 0 for every verdict). It reads `<state-dir>/STATE.md` for the current platform (`.claude/`, `.codex/`, `.cursor/`, `.pi/`) and decides **whose** it is before it looks at `status`: STATE.md `session-id` (#1368) against this process's native id (`readProcessLocalSessionIds()`). Never decide ownership from the session lock: it records the pid of the short-lived hook process, and in a shared checkout it can name a peer. After `/clear` the tab runs under a NEW native id, so the STATE.md of the work before `/clear` reads as foreign — measured 2026-10-17 in three sessions. A STATE.md without `session-id` (before #1368) or a process without a native id (`ownership: legacy` / `unprovable`) never reaches session-end on its status alone (#1718): where the status would hand off, the verdict is `ownership-unproven`. An optional `--confirm-own <confirmToken>` (16 lowercase hex, from that verdict) re-runs the pre-check for the unchanged file. Act on `verdict`:
+
+1. **`run-session-end`** — own STATE.md, or one confirmed with `--confirm-own` (`ownership: confirmed`), `status: active` or `paused`: invoke the session-end skill.
+2. **`complete-missing-record`** — own or confirmed STATE.md `status: completed`, but `.orchestrator/metrics/sessions.jsonl` holds no completed record for it (#429: `completed` alone does not prove the Phase 3.7 writer ran; an abandoned backfill stub is no completion). Warn: "STATE.md completed ohne passenden Abschluss im Ledger — session-end wird zur Vervollständigung ausgeführt (#429)." and invoke the session-end skill. (The SessionEnd hook's `backfillCompletedFromStateMd` heals the same gap on a later teardown; this branch covers a `/close` re-run before that.)
+3. **`already-finalized`** — a matching completed record exists (a legacy record without `status` counts): "Previous session was already finalized by session-end. Start a new session with `/session`, or inspect `<state-dir>/STATE.md` to review the prior close. (Note: if this is unexpected after an Express Path session, `skills/go/SKILL.md` should have auto-invoked /close — check that STATE.md `## Deviations` contains an `Express path:` entry.)" Stop.
+4. **`foreign`** — STATE.md belongs to session `stateSessionId`, not to this one, whatever its `status`. Never invoke session-end on it and never edit it: an `active`/`paused` one is a peer's live session, a `completed` one an earlier tab or a peer. Inform: "STATE.md gehört Session `<stateSessionId>` (status `<status>`), nicht dieser — kein eigener Plan zum Abschließen." With `status: active` or `paused` add: "Ist das der Plan dieses Tabs von vor einem `/clear`, kann ihn dieser Prozess nicht als eigenen belegen; er bleibt offen, der SessionEnd-Hook füllt den Ledger nach." Stop.
+5. **`ownership-unproven`** — nobody can prove this STATE.md is this session's (`ownership` `legacy`: no `session-id`; or `unprovable`: this process has no native id, as on Cursor, Pi, Codex without a thread id); session-end would run `wouldRun`. Never invoke session-end on this result and never edit the file. Inform with the facts from the JSON: "STATE.md `<statePath>` ist keiner Session nachweisbar zugeordnet (ownership `<ownership>`, session `<session>`, session-id `<stateSessionId>`, started_at `<startedAt>`, status `<status>`); session-end würde `<wouldRun>` ausführen." — the `session-id` part only when `stateSessionId` is present: without a native id (`unprovable`) a STATE.md that names another session's id comes back here, and the operator must see that. Confirm ONLY when (a) the operator explicitly answers that this is this session's plan — ask via `AskUserQuestion` on Claude Code (a numbered list on Codex/Cursor/Pi, per `.claude/rules/ask-via-tool.md`), the question naming path, session, `session-id` (when present), started_at and status; or (b) first-person evidence: this session's OWN tool call that wrote exactly this STATE.md is visible in its current context (for example its own wave-executor initialised it in this conversation). A compaction summary, a handover file, memory notes or the STATE.md content itself are NOT first-person evidence, and neither is anything inferred from the `session` label, `started_at` or the session lock, which are repo-wide. With a native id (Claude Code, Codex with a thread id) a `legacy` file is usually an older or foreign file — writers stamp `session-id` whenever this process's own lock exists at write time, so an own legacy file arises only when the STATE.md was written without an own lock; expect (b) to apply rarely there. A Lead-led or headless session without (b) never confirms: it stops and reports. On confirmation, re-run the pre-check with `--confirm-own <confirmToken>` and act on the NEW verdict per items 1/2. If it again returns `ownership-unproven` with `reason` (the file changed), show the new facts and decide again; never reuse an old token. Otherwise the plan stays untouched: it belongs to another or an earlier session; start an own `/session`, or inspect the file. Stop.
+6. **`no-state`** — read Session Config `persistence`. `false`: "Session completed (persistence is off — STATE.md was never created). Use `/session` to start a new session." Otherwise: "No active session found. Use `/session` to start a session first." Stop.
+7. **`unexpected-status`** (e.g. `idle`): "Unexpected session status `<status>`. Inspect `<state-dir>/STATE.md` and use `/session` to reset if needed." Stop.
+8. **`inconclusive`** — STATE.md frontmatter or the ledger is unreadable (`reason`): report it and stop before repeating any close side effect.
+
+**`/close` ohne Plan.** Every stop above (3–8) leaves this session without an own plan to close — the wait case `close-ohne-plan`. With fleet integration, before the report run the queue-mark re-check on the own handover (`skills/session-end/SKILL.md` § 4.5, "Queue marks on the own handover", #1639); its JSON `file` says whether this session has an own handover or train manifest. Then apply `skills/_shared/fleet-protocol.md` § Rücklauf an den Navigator (Pflicht) with the wait case `close-ohne-plan` (exactly one report in this turn, only with fleet integration, fallback chain up to `Meldung gescheitert: <Grund>`, never wait for a reply), and end the answer — after the message quoted above — with exactly one closing sentence (none of those messages is recognised as a waiting answer on its own):
+- `Bereit zum Schließen.` only on `already-finalized`, `no-state`, `unexpected-status`, or a `foreign` or `ownership-unproven` STATE.md with `status: completed`, and only when the re-check found an own handover (`file` not `null`) and reported no unmarked points (exit 0): the work of this session is handed over, and the coordinator may clear the tab (fleet-protocol § Übergabe und Zug-Manifest, Punkt 3). A `foreign` stop is the normal end of a session that worked after `/clear` without its own `/session`.
+- `Ich warte auf den nächsten Auftrag.` otherwise — no own handover, unmarked points (exit 3), no fleet integration, `inconclusive` (the status is unknown), or a `foreign` or `ownership-unproven` STATE.md that is still `active`/`paused` (a plan that is still open must not let the coordinator clear the tab).
+
+session-end itself never runs on this path. A session that only waits on a pipeline or release train closes normally: its train manifest belongs to the waiting answer BEFORE `/close` (same section, Übergabe und Zug-Manifest), and session-end Phase 4.5 reports the case `zug-<name>` once in the `/close` turn.
 
 If the pre-check passes, invoke the session-end skill.
 

package/skills/discovery/probes/docs-staleness.mjs

@@ -32,7 +32,8 @@
  */
 
 import { existsSync, readdirSync, statSync, mkdirSync, appendFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
+import { resolveLedgerPath } from '../../../scripts/lib/ledger-path.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -70,8 +71,8 @@ function listMarkdownFiles(dirPath) {
   return entries.filter((e) => e.isFile() && e.name.endsWith('.md')).map((e) => e.name);
 }
 
-function makeMetricsPath(projectRoot) {
-  return join(projectRoot, '.orchestrator', 'metrics');
+function makeLedgerPath(projectRoot) {
+  return resolveLedgerPath('.orchestrator/metrics/docs-staleness.jsonl', projectRoot);
 }
 
 // ---------------------------------------------------------------------------
@@ -158,7 +159,8 @@ export async function runProbe(projectRoot, config) {
 
     // ── JSONL append ──────────────────────────────────────────────────────
     try {
-      const metricsDir = makeMetricsPath(projectRoot);
+      const ledgerPath = makeLedgerPath(projectRoot);
+      const metricsDir = dirname(ledgerPath);
       if (!existsSync(metricsDir)) mkdirSync(metricsDir, { recursive: true });
       const record = {
         timestamp: new Date().toISOString(),
@@ -175,7 +177,7 @@ export async function runProbe(projectRoot, config) {
           threshold_days: f.evidence.threshold_days ?? threshold,
         })),
       };
-      appendFileSync(join(metricsDir, 'docs-staleness.jsonl'), JSON.stringify(record) + '\n', 'utf8');
+      appendFileSync(ledgerPath, JSON.stringify(record) + '\n', 'utf8');
     } catch {
       // JSONL write failure is non-fatal — probe result is still returned
     }

package/skills/discovery/probes/frontend-slop.mjs

@@ -28,6 +28,7 @@
 
 import { existsSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 /** Max files to scan before sampling — protects against huge trees. */
 const MAX_FILES = 2000;
@@ -127,7 +128,10 @@ export default async function frontendSlop({ repoRoot }) {
 
   // Defensive import — mirrors supply-chain-slopcheck's pattern so the probe
   // never hard-crashes the discovery run if the detector is absent.
-  const detectPath = join(repoRoot, 'scripts', 'lib', 'frontend-detect', 'detect.mjs');
+  // The detector ships with the PLUGIN, not with the scanned repo: resolve it
+  // from this module, never from repoRoot (#1653 — in every consumer repo the
+  // repoRoot path is absent and the probe skipped silently).
+  const detectPath = fileURLToPath(new URL('../../../scripts/lib/frontend-detect/detect.mjs', import.meta.url));
   if (!existsSync(detectPath)) {
     return {
       probe,
@@ -137,7 +141,7 @@ export default async function frontendSlop({ repoRoot }) {
           title: 'frontend-slop: detector module unavailable',
           evidence: { file: detectPath, classification: 'SKIPPED' },
           recommendation:
-            'scripts/lib/frontend-detect/detect.mjs is missing. Re-run /discovery after it is committed.',
+            'scripts/lib/frontend-detect/detect.mjs is missing from the plugin install. Reinstall or update the plugin.',
         },
       ],
       summary: { total: 0, filesScanned: 0, sampled: false, errors: 0, skipped_reason: 'detector-unavailable' },
@@ -146,7 +150,7 @@ export default async function frontendSlop({ repoRoot }) {
 
   let detectFiles, SCANNABLE_EXTS;
   try {
-    ({ detectFiles, SCANNABLE_EXTS } = await import(detectPath));
+    ({ detectFiles, SCANNABLE_EXTS } = await import(pathToFileURL(detectPath).href));
   } catch (err) {
     return {
       probe,

package/skills/discovery/probes/ssot-code-diff.mjs

@@ -45,8 +45,9 @@
  */
 
 import { existsSync, readdirSync, readFileSync, mkdirSync, appendFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { slashCommandNames } from '../../../scripts/lib/user-invocable-skills.mjs';
+import { resolveLedgerPath } from '../../../scripts/lib/ledger-path.mjs';
 
 // ---------------------------------------------------------------------------
 // Doc source sets (deliberately small and hand-curated)
@@ -277,7 +278,8 @@ export async function runProbe(projectRoot, config) {
 
     // ── JSONL append ──────────────────────────────────────────────────────
     try {
-      const metricsDir = join(projectRoot, '.orchestrator', 'metrics');
+      const ledgerPath = resolveLedgerPath('.orchestrator/metrics/ssot-code-diff.jsonl', projectRoot);
+      const metricsDir = dirname(ledgerPath);
       if (!existsSync(metricsDir)) mkdirSync(metricsDir, { recursive: true });
       const record = {
         timestamp: new Date().toISOString(),
@@ -296,7 +298,7 @@ export async function runProbe(projectRoot, config) {
           registry_id: f.evidence.registry_id,
         })),
       };
-      appendFileSync(join(metricsDir, 'ssot-code-diff.jsonl'), JSON.stringify(record) + '\n', 'utf8');
+      appendFileSync(ledgerPath, JSON.stringify(record) + '\n', 'utf8');
     } catch {
       // JSONL write failure is non-fatal — probe result is still returned
     }