session-orchestrator 5.2.0 → 5.4.0

package/scripts/lib/validate/check-test-git-config-target.mjs

@@ -111,6 +111,7 @@
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { isMainModule } from '../is-main-module.mjs';
+import { maskSource } from '../js-mask.mjs';
 
 /** Only this directory is scanned — a mutation in `scripts/` is production intent. */
 const SCAN_DIR = 'tests';
@@ -487,43 +488,24 @@ export function insideStringLiteral(body, index) {
  * "no cwd" measured as a cwd. `inCommentLine` cannot serve here: it answers a
  * question about a whole LINE, while this one runs inside a call expression.
  *
+ * Delegates to the shared lexer {@link maskSource} in `keepLiterals` mode
+ * (#1388). The hand-rolled walker this replaced had no REGEX-LITERAL branch,
+ * so a call tail carrying one — measured 2026-09-18:
+ * `wrapperHasCwd(", undefined, { env: /\/*$/.source, cwd: dir }")` — read the
+ * regex's `/*` as a block-comment opener, swallowed the rest of the tail and
+ * returned `false`: a false alarm from this check.
+ *
+ * One behavioural difference the callers must honour: `maskSource` blanks a
+ * comment to SPACES (length-preserving) where this function used to collapse
+ * it to a single space. {@link wrapperHasCwd} judges its second positional
+ * textually against `second !== ''`, so that difference was checked rather
+ * than assumed — see the measurement recorded at that test.
+ *
  * @param {string} text
- * @returns {string} same length semantics, comments blanked to one space
+ * @returns {string} same length, comment bytes blanked to spaces
  */
 export function stripComments(text) {
-  let out = '';
-  /** @type {string|null} */
-  let quote = null;
-  for (let i = 0; i < text.length; i += 1) {
-    const ch = text[i];
-    if (quote !== null) {
-      out += ch;
-      if (ch === '\\') {
-        out += text[i + 1] ?? '';
-        i += 1;
-      } else if (ch === quote) quote = null;
-      continue;
-    }
-    if (ch === "'" || ch === '"' || ch === '`') {
-      quote = ch;
-      out += ch;
-      continue;
-    }
-    if (ch === '/' && text[i + 1] === '*') {
-      const end = text.indexOf('*/', i + 2);
-      i = end === -1 ? text.length : end + 1;
-      out += ' ';
-      continue;
-    }
-    if (ch === '/' && text[i + 1] === '/') {
-      const end = text.indexOf('\n', i);
-      i = end === -1 ? text.length : end - 1;
-      out += ' ';
-      continue;
-    }
-    out += ch;
-  }
-  return out;
+  return maskSource(text, { keepLiterals: true });
 }
 
 /**
@@ -549,6 +531,14 @@ export function wrapperHasCwd(tail) {
   const clean = stripComments(tail);
   const m = /^\s*,\s*/.exec(clean);
   if (m) {
+    // NO `.trim()` here, and that is measured rather than assumed (#1388): the
+    // shared lexer blanks a comment to SPACES where the local stripper used to
+    // delete it, so a comment-only tail LOOKS like it would arrive as truthy
+    // whitespace. It cannot — the `\s*` above is greedy and consumes every
+    // blanked byte, leaving `second === ''`. Measured 2026-09-18 over
+    // `, /* no cwd */`, `, /* a */ /* b */`, `,\n // note\n`,
+    // `, /* x */ undefined`, `, undefined /* y */`: all `false`, `, /* c */ dir`
+    // → `true`. A `.trim()` would be dead code; the case is pinned by a test.
     const second = clean.slice(m[0].length);
     if (second !== '' && !/^(?:undefined|null)\b/.test(second) && !/^,/.test(second)) return true;
   }

package/scripts/lib/validate/check-test-value-bans.mjs

@@ -93,7 +93,8 @@
  *                     pure input→output date function is out of scope by
  *                     construction rather than by exception list.
  *
- *                     NOT flagged: blocks that control the clock (`now:` arg,
+ *                     NOT flagged: blocks that control the clock (`now:`, `{ now }`
+ *                     or a positional `now` — wider than the seam proof, #1478 —
  *                     `vi.useFakeTimers` / `vi.setSystemTime`); date literals in
  *                     INPUT position (only `.toBe`/`.toEqual`/`.toStrictEqual`
  *                     expected values are read), which leaves the passthrough
@@ -335,18 +336,68 @@ const keyLiteralRe = (key) => new RegExp(`["'\\\\]+${key}["'\\\\]+\\s*:`);
  * An absolute date pinned as the EXPECTED value of an equality assertion.
  * Input-position date literals (`created_at: '2026-06-21T…'`) do not match —
  * that is what keeps the passthrough class (input date === output date) out.
+ *
+ * CEILING (#1473): a fixed INPUT date that a production TTL ages out later is
+ * not flagged either, on purpose. Measured 2026-09-29 with a shim that moves
+ * `Date.now()` and `new Date()` forward in every vitest worker: the 34 test
+ * files (plus one fixture module) holding a fixed `created_at: '2026-05…09'`
+ * (1,211 tests) stayed green at +120, +365 and +3,650 days, so a rule keyed on
+ * fixed input dates would have reported false positives only. The one real
+ * bomb of that shape, the phase-skip fixture before 6670149c, was green at
+ * -60 days and red at +0 and +120 days under the same shim — and
+ * scanClockBombs() reaches that file since #1476 (alias imports are read) but
+ * stays silent on it: the file hands no clock argument to anything. REVISIT when a
+ * second fixed-input-date bomb lands on main: the class then recurs, and a
+ * clock-shift run of the suite is the check that finds it without guessing.
  */
 const DATE_EXPECTATION =
   /\.(?:toBe|toEqual|toStrictEqual)\(\s*(['"`])(\d{4}-\d{2}-\d{2}(?:[T ][^'"`]*)?)\1\s*\)/;
 
-/** An explicit clock handed to a callee — the seam this ban asks tests to use. */
-const CLOCK_ARG = /\b(?:now|nowMs|nowIso|clock|currentDate)\s*:/;
+/** A clock-named token not read off an object (`Date.now`, `opts.now`) — shared head of the two below. */
+const CLOCK_NAME = String.raw`(?<![.\w$])(?:now|nowMs|nowIso|clock|currentDate)\s*`;
+
+/**
+ * Pass 1, the seam PROOF: a NAMED clock key (`{ now: … }`) — only that shape says
+ * the callee's API takes a clock. Every line it matches also matches
+ * CONTROL_CLOCK_ARG, so a block that proves a seam is never flagged itself.
+ */
+const SEAM_CLOCK_ARG = new RegExp(`${CLOCK_NAME}:`);
+
+/**
+ * Pass 2, is this block clock-CONTROLLED: any clock handover. Property shorthand
+ * (`{ now }`, `{ repoRoot, now }`) and a positional `now` count too; `Date.now()`
+ * and `const now =` do not. Wider is the safe direction here — it can only
+ * remove findings.
+ *
+ * CEILING (#1478): pass 1 reads only the named form, because the wide form also
+ * turns helpers into seams — +20 seamed (file, id) pairs in 15 files
+ * (172 → 192, measured 2026-10-01 @ ffc5929f), e.g. `expectDeny` via a
+ * `{ manifestMtimeMs: now }` fixture. Cost: a file whose ONLY clock handover is
+ * `{ now }` or a positional `now` loses its seam proof and its bombs go unseen.
+ * REVISIT on the first B5 finding whose subject is a helper, or the first CI
+ * `test-value-bans` B5 finding the ±days clock-shift probe shows to be false.
+ */
+const CONTROL_CLOCK_ARG = new RegExp(String.raw`${CLOCK_NAME}(?::|,|\}|\))`);
 
 /** Freezing the global clock — equally valid control, but not a seam PROOF. */
 const FAKE_TIMER = /\b(?:useFakeTimers|setSystemTime|advanceTimersByTime|runAllTimers)\b/;
 
-/** `import { a, b as c } from './rel.mjs'` — SUT candidates live behind these. */
-const RELATIVE_IMPORT = /import\s+([^;]+?)\s+from\s+['"](\.[^'"]+)['"]/g;
+/**
+ * Vitest aliases that resolve to the repo's own modules — source of truth is
+ * `resolve.alias` in vitest.config.mjs (today only `@lib`). CEILING: one entry
+ * per alias, kept by hand; REVISIT when vitest.config.mjs gains an alias — the
+ * parametrised B5 test reads that config and goes red until the key is listed
+ * here. Dynamic imports (`await import('@lib/…')`) are not read in either form.
+ */
+const ALIAS_PREFIXES = ['@lib/'];
+
+/** `import { a, b as c } from './rel.mjs'` or `'@lib/x.mjs'` — SUT candidates live behind these. */
+const LOCAL_IMPORT = new RegExp(
+  String.raw`import\s+([^;]+?)\s+from\s+['"]((?:\.|` +
+    ALIAS_PREFIXES.map((p) => p.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')).join('|') +
+    String.raw`)[^'"]+)['"]`,
+  'g',
+);
 
 // ---------------------------------------------------------------------------
 // File enumeration
@@ -588,17 +639,17 @@ function testBlocks(lines) {
 }
 
 /**
- * Identifiers this test file imports from the repo's OWN modules (relative
- * specifiers). These are the subject-under-test candidates for B5; framework
- * (`vitest`) and stdlib (`node:*`) imports are structurally excluded because
- * their specifiers are not relative.
+ * Identifiers this test file imports from the repo's OWN modules (relative or
+ * vitest-alias specifiers). These are the subject-under-test candidates for B5;
+ * framework (`vitest`) and stdlib (`node:*`) imports are structurally excluded
+ * because their specifiers match neither form.
  * @param {string} content
  * @returns {string[]}
  */
 function importedLocalIdentifiers(content) {
   /** @type {Set<string>} */
   const ids = new Set();
-  for (const m of content.matchAll(RELATIVE_IMPORT)) {
+  for (const m of content.matchAll(LOCAL_IMPORT)) {
     const clause = m[1];
     // `{ a, b as c }` → c ; `x` / `* as ns` → x / ns
     for (const part of clause.replace(/[{}]/g, ',').split(',')) {
@@ -623,8 +674,9 @@ function callsIdentifier(lines, id) {
  *
  * Two passes over the file's `it`/`test` blocks:
  *   1. PROVE the seam — an imported id called from a block that also hands over
- *      an explicit clock argument is clock-seamed. A public API only grows a
- *      `now` parameter because the function reads the clock on its main path.
+ *      a NAMED clock key (SEAM_CLOCK_ARG) is clock-seamed. A public API only
+ *      grows a `now` parameter because the function reads the clock on its
+ *      main path.
  *   2. FLAG — in blocks with NO clock control at all, any equality assertion
  *      pinning an absolute date against such a subject is a time bomb.
  *
@@ -648,7 +700,8 @@ function scanClockBombs(relPath, content, lines) {
     return {
       start,
       body,
-      hasClockArg: live.some((l) => CLOCK_ARG.test(l)),
+      provesSeam: live.some((l) => SEAM_CLOCK_ARG.test(l)),
+      hasClockArg: live.some((l) => CONTROL_CLOCK_ARG.test(l)),
       hasFakeTimer: live.some((l) => FAKE_TIMER.test(l)),
     };
   });
@@ -656,19 +709,39 @@ function scanClockBombs(relPath, content, lines) {
   /** @type {Set<string>} */
   const seamed = new Set();
   for (const b of blocks) {
-    if (!b.hasClockArg) continue;
+    if (!b.provesSeam) continue;
     for (const id of sutIds) if (callsIdentifier(b.body, id)) seamed.add(id);
   }
   if (seamed.size === 0) return findings;
 
+  // Where an echo may come from: the finding's own block, or the setup every
+  // block shares (helpers, constants, beforeEach). Never a sibling test — its
+  // assertions, titles and clock literals say nothing about this block's inputs.
+  // A block without its own `});` (a one-line it) runs on to the next sibling
+  // and takes the setup lines in between out of sharedSetup — that direction can
+  // only add a finding, never hide one (1.4% of blocks, measured 2026-09-30).
+  /** @type {Set<number>} */
+  const inBlock = new Set();
+  for (const b of blocks) for (let q = b.start; q < b.start + b.body.length; q++) inBlock.add(q);
+  const sharedSetup = lines.filter((_, q) => !inBlock.has(q));
+
   for (const b of blocks) {
     if (b.hasClockArg || b.hasFakeTimer) continue;
     const subject = [...seamed].find((id) => callsIdentifier(b.body, id));
     if (!subject) continue;
+    const echoSources = [...b.body, ...sharedSetup].filter(
+      (l) => !isCommentLine(l) && !DATE_EXPECTATION.test(l),
+    );
     b.body.forEach((line, k) => {
       if (isCommentLine(line)) return;
       const m = DATE_EXPECTATION.exec(line);
       if (!m) return;
+      // Echo: the pinned value is also an input of this block or its shared setup,
+      // not a clock reading (the CEILING above keeps fixed INPUT dates unflagged on
+      // purpose). CEILING: a real bomb whose date also stands in its own block or
+      // the shared setup (its title, a trailing comment, a helper fixture) is
+      // swallowed; REVISIT when a clock-shift run finds a bomb this scan missed.
+      if (echoSources.some((l) => l.includes(m[2]))) return;
       findings.push({
         file: relPath,
         line: b.start + k + 1,

package/scripts/lib/validate/check-unicode-safety.mjs

@@ -204,6 +204,7 @@ const ALLOWED_EMOJI_CODEPOINTS = new Set([
   0x1f5a5, // 🖥
   0x1f6a6, // 🚦
   0x1f6a8, // 🚨
+  0x1f9ed, // 🧭 (navigator banner line in hooks/on-session-start.mjs — #1462)
   0x2139, //  ℹ
   0x2194, //  ↔
   0x26a0, //  ⚠

package/scripts/lib/validate/check-untracked-test-deps.mjs

@@ -108,6 +108,13 @@ import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { isMainModule } from '../is-main-module.mjs';
+import { maskSource } from '../js-mask.mjs';
+
+// `maskSource` moved to `scripts/lib/js-mask.mjs` (#1388 — three other modules
+// needed the same lexer). `package.json` carries no `exports` map, so every
+// `scripts/lib/**` path is public API: this re-export keeps the OLD import path
+// working for any consumer that already reaches in here.
+export { maskSource } from '../js-mask.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -167,108 +174,6 @@ const NON_CALLEES = new Set([
   'await', 'new', 'do', 'else', 'in', 'of', 'delete', 'void', 'yield', 'import',
 ]);
 
-// ---------------------------------------------------------------------------
-// Source masking — string/template/comment/regex interiors become spaces
-// ---------------------------------------------------------------------------
-
-/**
- * Blank out the INTERIOR of every string literal, template literal, comment and
- * regex literal, preserving byte offsets and newlines. Delimiters are kept so
- * paren/comma balance and identifier boundaries survive.
- *
- * This is what separates CODE from DATA. A test that embeds fixture source in a
- * template literal (this check's own test file does) must not be scanned as
- * though that fixture were its own body — masking makes that structural instead
- * of relying on a self-exemption marker.
- *
- * @param {string} text
- * @returns {string} same-length masked source
- */
-export function maskSource(text) {
-  const out = text.split('');
-  const n = out.length;
-  let i = 0;
-  // Last significant (non-space) char before `i`, used for the regex/division
-  // disambiguation below.
-  let prev = '';
-
-  const blank = (from, to) => {
-    for (let k = from; k < to && k < n; k++) if (out[k] !== '\n') out[k] = ' ';
-  };
-
-  while (i < n) {
-    const c = text[i];
-    const next = text[i + 1];
-
-    // Line comment.
-    if (c === '/' && next === '/') {
-      let j = i;
-      while (j < n && text[j] !== '\n') j++;
-      blank(i, j);
-      i = j;
-      continue;
-    }
-    // Block comment.
-    if (c === '/' && next === '*') {
-      let j = i + 2;
-      while (j < n && !(text[j] === '*' && text[j + 1] === '/')) j++;
-      blank(i, Math.min(j + 2, n));
-      i = Math.min(j + 2, n);
-      continue;
-    }
-    // Single/double-quoted string — keep the quotes, blank the interior.
-    if (c === "'" || c === '"') {
-      let j = i + 1;
-      while (j < n && text[j] !== c) {
-        if (text[j] === '\\') j++;
-        if (text[j] === '\n') break; // unterminated — bail at EOL
-        j++;
-      }
-      blank(i + 1, j);
-      i = Math.min(j + 1, n);
-      prev = c;
-      continue;
-    }
-    // Template literal — blank everything including `${…}` substitutions.
-    if (c === '`') {
-      let j = i + 1;
-      while (j < n && text[j] !== '`') {
-        if (text[j] === '\\') j++;
-        j++;
-      }
-      blank(i + 1, j);
-      i = Math.min(j + 1, n);
-      prev = c;
-      continue;
-    }
-    // Regex literal — only when the previous significant char cannot end an
-    // expression, AND a closing unescaped `/` exists on the SAME line. The
-    // same-line bound keeps a misread division from swallowing the file.
-    if (c === '/' && (prev === '' || '(,=:[!&|?{};+-*%~^<>'.includes(prev))) {
-      let j = i + 1;
-      let inClass = false;
-      let closed = -1;
-      while (j < n && text[j] !== '\n') {
-        if (text[j] === '\\') { j += 2; continue; }
-        if (text[j] === '[') inClass = true;
-        else if (text[j] === ']') inClass = false;
-        else if (text[j] === '/' && !inClass) { closed = j; break; }
-        j++;
-      }
-      if (closed > i) {
-        blank(i + 1, closed);
-        i = closed + 1;
-        prev = '/';
-        continue;
-      }
-    }
-
-    if (!/\s/.test(c)) prev = c;
-    i++;
-  }
-  return out.join('');
-}
-
 // ---------------------------------------------------------------------------
 // Tiny source scanners (offset-aligned against the masked text)
 // ---------------------------------------------------------------------------

package/scripts/lib/validate/check-unwired-features.mjs

@@ -53,6 +53,30 @@
  * a rule that only cites live instances loses its explanation the moment it works.
  * If you need a CURRENT S2 hit, run the checker; do not assume this one.
  *
+ *   S6 `parser-only-config-key`  — the key IS read, but the ONLY file that
+ *                                   reads it is its own block parser
+ *                                   `scripts/lib/config/<root>.mjs`.
+ *
+ * S6 is the mirror image of S2, and it exists because S1 counts the PARSER as a
+ * consumer: `CONSUMER_DIRS` is `scripts/` + `hooks/`, and every block parser
+ * lives under `scripts/lib/config/`. A key its parser resolves and nothing else
+ * reads is `compact-nudge` wearing a value object. Measured 2026-09-22 on this
+ * tree: `reaper.max-hook-latency-ms` and `reaper.false-alarm-window` both passed
+ * S1 on `scripts/lib/config/reaper.mjs` alone while `scripts/lib/orphan-reaper.mjs`
+ * used same-named HARDCODED defaults and never saw the parsed value.
+ *
+ * Why the signal is this narrow — one read file, and it is the key's OWN parser.
+ * The blunt rule ("the parser layer never counts") was measured first and
+ * REJECTED: it flips 102 of 263 declared keys to unwired, because the ordinary
+ * shape here is a consumer that reads the camelCase FIELD (`cfg.driftCheck.mode`)
+ * while this census matches the kebab TOKEN. 102 of 263 is the broken instrument
+ * `.claude/rules/host-resources.md` HR-101 forbids. The narrow rule reports 32 —
+ * a backlog, printed as an aggregate like S4 and enumerated under `--list`.
+ *
+ * S6 carries no camelCase fallback ON PURPOSE: adding one re-hides both reaper
+ * keys, whose camelCase names exist in `orphan-reaper/defaults.mjs` as that module's own
+ * defaults. A name is not a read.
+ *
  * S2 applies to TOP-LEVEL keys only — a nested key reaches code through its
  * parent — and its premise is structural: every Session Config key has to pass
  * through the parser layer to become a value. Measured 2026-08-08: 84 of 89
@@ -393,6 +417,29 @@ const PARSER_PATHS = Object.freeze([
   path.join('scripts', 'parse-config.mjs'),
 ]);
 
+/**
+ * The per-block parser directory: `scripts/lib/config/<block>.mjs` turns ONE
+ * Session Config block's YAML into a value object and does nothing else.
+ *
+ * Signal S6 below is about this directory specifically, which is why it is not
+ * folded into {@link PARSER_PATHS}.
+ */
+const BLOCK_PARSER_DIR = path.join('scripts', 'lib', 'config');
+
+/**
+ * The key's OWN block parser, by convention `scripts/lib/config/<root>.mjs`.
+ *
+ * Deliberately an exact name match and not "anything under the parser dir": a
+ * sibling block's parser reading the key is still a second file, and S6 only
+ * fires when there is exactly ONE reader and it is the key's own.
+ *
+ * @param {string} root top-level key of the block
+ * @returns {string} plugin-root-relative path
+ */
+function ownBlockParserPath(root) {
+  return path.join(BLOCK_PARSER_DIR, `${root}.mjs`);
+}
+
 /**
  * Declared-but-unread keys accepted on purpose. Key = full dotted path (S1/S2)
  * or module path relative to the plugin root (S4), value = REASON naming the
@@ -420,7 +467,8 @@ const ALLOWLIST = Object.freeze({
 
 /**
  * @typedef {{
- *   kind: 'unwired-config-key' | 'parser-orphan-config-key' | 'allowlist-missing-reason'
+ *   kind: 'unwired-config-key' | 'parser-orphan-config-key' | 'parser-only-config-key'
+ *       | 'allowlist-missing-reason'
  *       | 'allowlist-stale' | 'orphaned-prose-module' | 'unreachable-library-module'
  *       | 'coordinator-invoked-module' | 'hand-keyed-learning-subject'
  *       | 'tool-error',
@@ -883,7 +931,9 @@ function mentionedModuleTokens(lines) {
  *    switched off. Revisit if a real module-resolver (import-specifier resolution
  *    relative to the importing file) becomes cheap, or if a collided basename is
  *    ever confirmed to mask a true positive. The `coordinator-invoked-module`
- *    DOWNGRADE is exempt, and since #1293 so is the CLUSTER-ROOT filter: in both
+ *    DOWNGRADE is exempt, and since #1293 so is the CLUSTER-ROOT filter (since
+ *    #1298 its predicate also drives the "drags N" count, which had collapsed
+ *    two dragged `index.mjs` into one): in both
  *    a colliding basename must be named with its `dirname/base` suffix, because
  *    those matches move a module OUT of the reportable class and would otherwise
  *    hide a true unreachable sibling. Measured cost of leaving the root filter
@@ -1014,24 +1064,41 @@ export function collectUnreachableLibraryModules(pluginRoot) {
   const basenameCount = new Map();
   for (const module of modules) basenameCount.set(module.base, (basenameCount.get(module.base) ?? 0) + 1);
 
-  const roots = unreachable.filter((module) => {
-    // A bare-basename mention only suppresses when the basename is UNIQUE
-    // (see the census above). When it collides, the mentioning module must name
-    // the `dirname/base` form in its body — otherwise ONE unreachable module
-    // mentioning bare `index.mjs` masks EVERY differently-pathed `index.mjs`
-    // root at once (#1293: `locks/index.mjs` + `worktree/index.mjs` were masked
-    // by a third unreachable module until that module was deleted for an
-    // unrelated reason).
-    const ambiguous = (basenameCount.get(module.base) ?? 0) > 1;
-    const qualified = module.relative.split(path.sep).slice(-2).join('/');
-    const qualifiedRe = ambiguous ? tokenMatcher(qualified) : null;
-    return !unreachable.some(
-      (other) =>
-        other.relative !== module.relative &&
-        other.mentions.has(module.base) &&
-        (qualifiedRe === null || qualifiedRe.test(other.rawBody)),
-    );
-  });
+  // One `dirname/base` matcher per unreachable module whose basename collides,
+  // built once: `references` below runs per (mentioner, target) pair.
+  /** @type {Map<string, RegExp>} */
+  const qualifiedMatchers = new Map();
+  for (const module of unreachable) {
+    if ((basenameCount.get(module.base) ?? 0) < 2) continue;
+    qualifiedMatchers.set(module.relative, tokenMatcher(module.relative.split(path.sep).slice(-2).join('/')));
+  }
+  /**
+   * Does `mentioner` reference the unreachable module `target`? A bare-basename
+   * mention only counts when the basename is UNIQUE (see the census above).
+   * When it collides, the mentioning module must name the `dirname/base` form
+   * in its body — otherwise ONE unreachable module mentioning bare `index.mjs`
+   * references EVERY differently-pathed `index.mjs` at once (#1293:
+   * `locks/index.mjs` + `worktree/index.mjs` were masked as roots by a third
+   * unreachable module until that module was deleted for an unrelated reason).
+   *
+   * The ONE predicate for both consumers — the cluster-root filter and the drag
+   * count of the finding message — so the two cannot disagree about who
+   * references whom. They did (#1298): the drag count compared bare basenames,
+   * so a root importing `a/index.mjs` AND `b/index.mjs` read "drags 1".
+   *
+   * @param {(typeof modules)[number]} mentioner
+   * @param {(typeof modules)[number]} target an `unreachable` module
+   * @returns {boolean}
+   */
+  const references = (mentioner, target) => {
+    if (!mentioner.mentions.has(target.base)) return false;
+    const qualifiedRe = qualifiedMatchers.get(target.relative);
+    return qualifiedRe === undefined || qualifiedRe.test(mentioner.rawBody);
+  };
+
+  const roots = unreachable.filter(
+    (module) => !unreachable.some((other) => other.relative !== module.relative && references(other, module)),
+  );
 
   // A pure `export *` barrel enters the population above so it can HEAD its own
   // cluster, but reporting it needs one more condition. S3 already exempts this
@@ -1106,9 +1173,10 @@ export function collectUnreachableLibraryModules(pluginRoot) {
           'architecture. Re-check only if that instruction is ever removed',
       });
     }
-    const dragged = [...module.mentions].filter(
-      (token) => token !== module.base && [...unreachableSet].some((rel) => path.basename(rel) === token),
-    );
+    // Counted per MODULE through the root filter's own predicate, never per
+    // basename token: `mentions` is a Set of basenames, so two dragged
+    // `index.mjs` files would collapse into one (#1298).
+    const dragged = unreachable.filter((other) => other.relative !== module.relative && references(module, other));
     const tail = dragged.length > 0 ? `, and drags ${dragged.length} further unreachable module(s)` : '';
     // A pure barrel reports its re-export surface; naming "0 symbol(s)" there
     // would read as a checker bug rather than as the barrel it is.
@@ -1259,6 +1327,7 @@ export function inspectUnwiredFeatures(pluginRoot) {
       orphanedModules: 0,
       unreachableModules: 0,
       coordinatorInvokedModules: 0,
+      parserOnly: 0,
       handKeyedSubjects: 0,
       judgedSubjects: 0,
     },
@@ -1318,7 +1387,7 @@ export function inspectUnwiredFeatures(pluginRoot) {
 
   for (const key of [...declared.keys.keys()].sort()) {
     const meta = /** @type {DeclaredKey} */ (declared.keys.get(key));
-    const { code, comment } = countReadSites(meta, corpus);
+    const { code, comment, files: readFiles } = countReadSites(meta, corpus);
 
     /** @type {Finding | null} */
     let issue = null;
@@ -1331,6 +1400,21 @@ export function inspectUnwiredFeatures(pluginRoot) {
           `declared in ${meta.sources.join(' + ')} but no .mjs under ${CONSUMER_DIRS.join('/ or ')}/ ` +
           `reads it${commentNote} — wire it, delete it, or allowlist it with a reason`,
       };
+    } else if (readFiles.length === 1 && readFiles[0] === ownBlockParserPath(meta.root)) {
+      // S6 — the ONLY file that reads this key is the parser that produced it.
+      // A parser is not a consumer: it turns YAML into a field nobody then
+      // reads, which is `compact-nudge` wearing a value object. Measured
+      // 2026-09-22: `reaper.max-hook-latency-ms` and `reaper.false-alarm-window`
+      // both passed S1 on the strength of `scripts/lib/config/reaper.mjs`
+      // alone, while `orphan-reaper.mjs` used its OWN hardcoded defaults of the
+      // same name and never received the parsed value.
+      issue = {
+        kind: 'parser-only-config-key',
+        key,
+        message:
+          `read only by its own block parser (${readFiles[0]}) — a parser is not a consumer; ` +
+          'nothing outside the config layer reads the parsed value',
+      };
     } else if (key === meta.root && !tokenMatcher(key).test(parserBody)) {
       issue = {
         kind: 'parser-orphan-config-key',
@@ -1356,7 +1440,8 @@ export function inspectUnwiredFeatures(pluginRoot) {
       continue;
     }
 
-    result.summary.unwired += 1;
+    if (issue.kind === 'parser-only-config-key') result.summary.parserOnly += 1;
+    else result.summary.unwired += 1;
     findings.push(issue);
   }
 
@@ -1426,6 +1511,7 @@ export function runCheckUnwiredFeatures(pluginRoot, { list = false } = {}) {
     consumerFiles,
     unwired,
     allowlisted,
+    parserOnly,
     orphanedModules,
     unreachableModules,
     coordinatorInvokedModules,
@@ -1445,8 +1531,16 @@ export function runCheckUnwiredFeatures(pluginRoot, { list = false } = {}) {
   // architecture — an instruction surface tells an LLM to call the module.
   // Measured 2026-09-07: 46 of the 52 findings the single S4 class carried.
   // Printing 46 WARN lines for the design is the broken instrument HR-101 forbids.
-  const DEFERRED = Object.freeze(['unreachable-library-module', 'coordinator-invoked-module']);
+  //
+  // `parser-only-config-key` (S6) is deferred on the S4 terms too: 32 findings
+  // on the live tree is a backlog to work down, not a per-run alarm.
+  const DEFERRED = Object.freeze([
+    'unreachable-library-module',
+    'coordinator-invoked-module',
+    'parser-only-config-key',
+  ]);
   const s4 = inspection.findings.filter((item) => item.kind === 'unreachable-library-module');
+  const s6 = inspection.findings.filter((item) => item.kind === 'parser-only-config-key');
   for (const item of inspection.findings) {
     if (!list && DEFERRED.includes(item.kind)) continue;
     console.log(`  WARN: [${item.kind}] ${item.key} — ${item.message}`);
@@ -1465,10 +1559,19 @@ export function runCheckUnwiredFeatures(pluginRoot, { list = false } = {}) {
     );
   }
 
+  if (!list && s6.length > 0) {
+    console.log(
+      `  WARN: [parser-only-config-key] ${s6.length} declared key(s) whose only reader is their own ` +
+        `block parser — e.g. ${s6.slice(0, 3).map((item) => item.key).join(', ')}. ` +
+        'Re-run with --list for the full census.',
+    );
+  }
+
   console.log(
     `  PASS: censused ${declaredKeys} declared key(s) from ${inspection.sourcesScanned.join(' + ') || '(no source)'} ` +
       `against ${consumerFiles} consumer file(s) — ${unwired} unwired, ${allowlisted} allowlisted, ` +
-      `${orphanedModules} prose-orphaned module(s), ${unreachableModules} unreachable module(s), ` +
+      `${parserOnly} parser-only, ${orphanedModules} prose-orphaned module(s), ` +
+      `${unreachableModules} unreachable module(s), ` +
       `${coordinatorInvokedModules} coordinator-invoked module(s), ${handKeyedSubjects} hand-keyed ` +
       `learning subject(s) of ${judgedSubjects} judged`,
   );