yadflow 4.0.0-next.3 → 4.0.0

package/cli/doctor.mjs

@@ -5,15 +5,17 @@
 // `--json` emits the checks for CI / bug reports.
 import path from 'node:path';
 import fs from 'node:fs';
-import { c, log, ok, info, warn, fail, hand, run, has, exists, isPlainObject, readJSON, readJSONStrict, emitJSON } from './lib.mjs';
-import { VERSION, BACKUP_SUFFIX, MIRRORED_FILES, PROJECT_FILES, MODULE_CONFIG, epicFiles, DESIGN_TOOLS, TESTING_TOOLS, LEARNING_TOOLS, HOOK_ADAPTERS, CAPTURE_ADAPTERS, isVerifiedLedger , productConfigPath, ADVANCE_FROM_AUTOMATION, DRIVER_FROM_ASSISTANCE } from './manifest.mjs';
-import { mergeHookSettings, hookMatcherFires, ideTargetsFor, safeIdeTargetStateFor, hookScriptReady, miswiredGuardCommand } from './plan.mjs';
+import { c, log, ok, info, warn, fail, hand, run, has, exists, isPlainObject, readJSON, readJSONStrict, emitJSON, asArg } from './lib.mjs';
+import { VERSION, BACKUP_SUFFIX, MIRRORED_FILES, mirrorDrift, PROJECT_FILES, MODULE_CONFIG, epicFiles, DESIGN_TOOLS, TESTING_TOOLS, LEARNING_TOOLS, HOOK_ADAPTERS, CAPTURE_ADAPTERS, HOOK_WIRING, CAPTURE_WIRING, PROTECTION_GUIDE_URL, isVerifiedLedger , productConfigPath, settingsEditHint, PRODUCT_LINK, ADVANCE_FROM_AUTOMATION, DRIVER_FROM_ASSISTANCE } from './manifest.mjs';
+import { mergeHookSettings, hookMatcherFires, ideTargetsFor, safeIdeTargetStateFor, hookScriptReady, miswiredGuardCommand, gitHookState, legacyModuleActions, legacyProductActions, renamedNameHits, PRODUCT_CHECK_WORKFLOWS, productProfileEffect, workflowsPassingProduct, productGateBlockers, oldProfileAdvice, gateProfileFix } from './plan.mjs';
+import { hasSiblingRepo, workspaceFileState, WORKSPACE_FILE } from './find-product.mjs';
 import { planMigration } from './migrate.mjs';
-import { ADVANCE_VALUES, isGateStep, killSwitchOn, loadAutomation, stepDef as catalogueStep, loadLedger, owedSteps, epicIds, epicRel, epicRoot, FOUNDATION_DIR, FOUNDATION_EPIC, DISCOVERY_EPIC, staleFoundationGuards, unwrittenSections, artifactBase, artifactAgrees, epicStories, laneStarted, isValidEpicId, epicLineage, isGenesisType, readFrontmatter, resolveThread, stateInvariants, contractSurfaceHash, acceptedHashes, isStaleHash, workItemType, WORK_ITEM_TYPES, themeOf, themeKey, stepPhase, stepDef, matchLifecycleProfile, lifecycleProfile, LIFECYCLE_PROFILES, SENTINELS, normalizeBindings, optionalStepsFor, isSkippableStep, recordedRouteDisagrees, isPassed, stepStatus, claimsSkipped, STEP_STATES, isStepRecord, RECORDED_STEP_STATES } from './epic-state.mjs';
+import { ADVANCE_VALUES, isGateStep, killSwitchOn, loadAutomation, stepDef as catalogueStep, loadLedger, owedSteps, epicIds, epicRel, epicRoot, FOUNDATION_DIR, FOUNDATION_EPIC, DISCOVERY_EPIC, staleFoundationGuards, unwrittenSections, artifactBase, artifactAgrees, epicStories, laneStarted, isValidEpicId, epicLineage, isGenesisType, readFrontmatter, resolveThread, stateInvariants, contractSurfaceHash, acceptedHashes, isStaleHash, workItemType, WORK_ITEM_TYPES, themeOf, themeKey, stepPhase, stepDef, matchLifecycleProfile, lifecycleProfile, LIFECYCLE_PROFILES, SENTINELS, normalizeBindings, optionalStepsFor, isSkippableStep, recordedRouteDisagrees, isPassed, stepStatus, claimsSkipped, STEP_STATES, isStepRecord, RECORDED_STEP_STATES, productDriftPairs } from './epic-state.mjs';
 import { loadDebt } from './thread.mjs';
 import { readShips } from './ledger.mjs';
 import { gitHead, insideWorkspace } from './setup.mjs';
-import { cliFor, hostFromGitUrl, ambiguousLegacyNames } from './platform.mjs';
+import { judgeRepo, runnable, shown as forTerminal } from './workspace.mjs';
+import { cliFor, hostFromGitUrl, ambiguousLegacyNames, plainHost } from './platform.mjs';
 import { legacyLogins, stampLegacyLogins } from './gate.mjs';
 import { checkRepo } from './riskmap-command.mjs';
 import { checkCodeowners, codeownersFindings } from './codeowners-command.mjs';
@@ -21,14 +23,23 @@ import { RISK_MAP_FILE } from './riskmap.mjs';
 import { readProtection, protectionLine, protectionJSON, hideAddresses } from './protection.mjs';
 import { soloTeamHint, TEAM_CMD } from './people.mjs';
 import { indexFreshness, INDEX_FILE } from './product-index.mjs';
-import { productGit, resolveDefaultBranch } from './hubcommit.mjs';
+import { productGit, resolveDefaultBranch } from './productcommit.mjs';
 import { readOwners } from './owners.mjs';
 
+// A registered path doctor may run git in (E81): a checkout the judgement accepts — never a refused
+// entry (git run in a folder the Product shaped as a repo reads its `config`, which can run a command),
+// and never one reached through a link inside a repo's tree (`yad repo sync` and `refresh` skip it too).
+// The repos check reports every other entry.
+const isCheckout = (root, repo) => runnable(judgeRepo(root, repo));
+// The same for a registry `default_branch` inside a git command to copy: a valid branch name can hold
+// `;`, `|`, `$(` or start a path part with `-` (E81 review 11), so only a plain one is printed.
+const branchArg = (b) => (typeof b === 'string' && /^\w[\w./-]*$/.test(b) && !b.includes('..') ? b : '<default-branch>');
+
 const MIN_NODE = 18;
 
 // Solo mode (a lone developer): approval waived, merge + resolved threads still gate. Persisted in
 // hub.json. Mirrors gate.mjs / next.mjs.
-const isSolo = (hub) => !!(hub && (hub.solo === true || hub.review_gate?.solo === true));
+const isSolo = (productConfig) => !!(productConfig && (productConfig.solo === true || productConfig.review_gate?.solo === true));
 // Is an already-resolved path nested under the project root? Repo paths are contained to the WORKSPACE
 // (the root's parent, see setup.insideWorkspace), so a registered sibling resolves outside the root —
 // which is what distinguishes "absent because it lives elsewhere" from "absent because it is broken".
@@ -49,6 +60,26 @@ function check(checks, id, section, status, message, hint = '', extra = null) {
   checks.push({ id, section, status, message, ...(hint ? { hint } : {}), ...(extra || {}) });
 }
 
+// Where bash is missing, what that costs. The check gates are bash, but they run on the team's CI, not
+// here. On Windows it costs more (E113): Claude Code runs hook commands in Git Bash and falls back to
+// PowerShell without it, and the hook entries yad writes (`node "$CLAUDE_PROJECT_DIR/…"`) are bash
+// spelling — so there the agent hooks do not run at all.
+export const bashMissingHint = (platform = process.platform) => (platform === 'win32'
+  ? 'install Git for Windows with its Git Bash (or set CLAUDE_CODE_GIT_BASH_PATH) — Claude Code runs hook commands in Git Bash, and without it yad\'s hooks do not run under Claude Code; Cursor is not affected, and the check gates run on your CI'
+  : 'the check gates are bash scripts — needed only to run one here by hand; your CI runs them');
+
+// Is there a bash this machine's agent hooks can use? Elsewhere, bash on PATH. On Windows, Git Bash —
+// which the Git for Windows installer does NOT put on PATH (only `Git\cmd` is), and a `bash` that IS on
+// PATH may be WSL's launcher in System32. So look where Claude Code looks: `CLAUDE_CODE_GIT_BASH_PATH`,
+// then `bin\bash.exe` beside the `cmd\git.exe` on PATH.
+export function hasBash({ platform = process.platform, env = process.env, runner = run } = {}) {
+  if (platform !== 'win32') return has('bash');
+  if (env.CLAUDE_CODE_GIT_BASH_PATH && exists(env.CLAUDE_CODE_GIT_BASH_PATH)) return true;
+  const where = runner('where', ['git']);
+  if (!where.ok) return false;
+  return where.stdout.split(/\r?\n/).some((gitExe) => exists(path.join(path.dirname(path.dirname(gitExe.trim())), 'bin', 'bash.exe')));
+}
+
 export function envChecks(checks) {
   const major = Number(process.versions.node.split('.')[0]);
   if (major >= MIN_NODE) check(checks, 'node', 'environment', 'ok', `node ${process.versions.node}`);
@@ -58,14 +89,19 @@ export function envChecks(checks) {
   else check(checks, 'git', 'environment', 'fail', 'git not found on PATH [YAD-ENV-001]', 'install git — every yad command needs it');
 
   for (const tool of ['npx', 'bash']) {
-    if (has(tool)) check(checks, tool, 'environment', 'ok', `${tool} present`);
-    else check(checks, tool, 'environment', 'warn', `${tool} not found on PATH`, tool === 'npx' ? 'repomix packing will be skipped' : 'the check gates are bash scripts');
+    // On Windows the bash that matters is Git Bash, found beside git rather than on PATH — say so by name.
+    const name = tool === 'bash' && process.platform === 'win32' ? 'Git Bash' : tool;
+    if (tool === 'bash' ? hasBash() : has(tool)) check(checks, tool, 'environment', 'ok', `${name} present`);
+    else check(checks, tool, 'environment', 'warn', name === 'Git Bash' ? 'Git Bash not found' : `${tool} not found on PATH`, tool === 'npx' ? 'repomix packing will be skipped' : bashMissingHint());
   }
 }
 
 // `headCount` is a count of people the caller already read (E74); the CLI passes none, a test passes one.
 export function projectChecks(checks, root, { headCount = null } = {}) {
   const productPath = productConfigPath(root);
+  // The file actually read (E122: product.json when it exists), named in every message below — naming
+  // the old one would send a person to edit the file that is not read, which is a refused drift.
+  const settingsRel = path.relative(root, productPath).split(path.sep).join('/');
   const regPath = path.join(root, PROJECT_FILES.reposRegistry);
   const verPath = path.join(root, PROJECT_FILES.version);
   if (!exists(productPath) && !exists(regPath) && !exists(verPath)) {
@@ -84,27 +120,27 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
   else check(checks, 'cli-version', 'project', 'ok', `version stamp matches (v${VERSION})`);
 
   // hub.json: parse + shape
-  let hub = null;
+  let productConfig = null;
   if (!exists(productPath)) {
-    check(checks, 'hub', 'project', 'warn', `${PROJECT_FILES.hubConfig} absent — local gate`, 'run `yad setup` to configure a platform');
+    check(checks, 'product', 'project', 'warn', `${settingsRel} absent — local gate`, 'run `yad setup` to configure a platform');
   } else {
-    let hubBroken = false;
+    let productConfigBroken = false;
     try {
-      hub = readJSONStrict(productPath, null);
+      productConfig = readJSONStrict(productPath, null);
     } catch (e) {
-      hubBroken = true;
-      check(checks, 'hub', 'project', 'fail', `${PROJECT_FILES.hubConfig} does not parse [${e.code || 'YAD-STATE-001'}]`, e.hint || 'fix the JSON or restore it from git');
+      productConfigBroken = true;
+      check(checks, 'product', 'project', 'fail', `${settingsRel} does not parse [${e.code || 'YAD-STATE-001'}]`, e.hint || 'fix the JSON or restore it from git');
     }
-    if (hubBroken) { /* reported above */ }
-    else if (typeof hub !== 'object' || Array.isArray(hub) || hub === null) check(checks, 'hub', 'project', 'fail', `${PROJECT_FILES.hubConfig} has the wrong shape [YAD-STATE-002]`, 'expected a JSON object');
-    else if (![null, undefined, 'github', 'gitlab'].includes(hub.platform)) check(checks, 'hub', 'project', 'fail', `${PROJECT_FILES.hubConfig}: unknown platform '${hub.platform}' [YAD-CFG-001]`, 'expected github, gitlab, or null');
+    if (productConfigBroken) { /* reported above */ }
+    else if (typeof productConfig !== 'object' || Array.isArray(productConfig) || productConfig === null) check(checks, 'product', 'project', 'fail', `${settingsRel} has the wrong shape [YAD-STATE-002]`, 'expected a JSON object');
+    else if (![null, undefined, 'github', 'gitlab'].includes(productConfig.platform)) check(checks, 'product', 'project', 'fail', `${settingsRel}: unknown platform '${forTerminal(productConfig.platform)}' [YAD-CFG-001]`, 'expected github, gitlab, or null');
     else {
-      check(checks, 'hub', 'project', 'ok', `hub: ${hub.platform || 'local'}`);
+      check(checks, 'product', 'project', 'ok', `product: ${productConfig.platform || 'local'}`);
       // E62 removed the roster. A list an older release wrote is kept on disk and decides nothing — its
       // name → login pairs only let the first sync recognise older approvals (`legacyLogins`) — so say so
       // — a team that still edits it would otherwise believe it decides something. An empty list (what a
       // solo setup used to write) says nothing about people and is left quiet.
-      const r = hub.roster;
+      const r = productConfig.roster;
       const listed = Array.isArray(r) ? r.length > 0 : (r && typeof r === 'object' ? Object.keys(r).length > 0 : !!r);
       if (listed) {
         // When it can go (E64): once every older record it can place names the login. Counted with the same
@@ -112,8 +148,8 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
         let waiting = 0;
         let unplaced = 0;
         const waitingIn = [];
-        const aliases = legacyLogins(hub);
-        const clashed = ambiguousLegacyNames(hub);
+        const aliases = legacyLogins(productConfig);
+        const clashed = ambiguousLegacyNames(productConfig);
         for (const e of epicIds(root)) {
           try {
             const led = loadLedger(epicRoot(root, e));
@@ -122,15 +158,15 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
             unplaced += st.unplaced;
           } catch { /* an unreadable ledger is reported by its own check */ }
         }
-        const when = !hub.platform
-          ? 'nothing reads it on a Product with no platform — delete the `roster` key'
+        const when = !productConfig.platform
+          ? `nothing reads it on a Product with no platform — delete the \`roster\` key from ${settingsEditHint(root)}`
           : waiting
-            ? `keep it for now: ${waiting} older approval/comment record(s) in ${waitingIn.join(', ')} still name people by roster name. The next gate write records their logins — ${isVerifiedLedger(hub) ? 'CI\'s run on the next merged review' : '`yad gate sync <epic>`'} — then delete the \`roster\` key`
+            ? `keep it for now: ${waiting} older approval/comment record(s) in ${waitingIn.join(', ')} still name people by roster name. The next gate write records their logins — ${isVerifiedLedger(productConfig) ? 'CI\'s run on the next merged review' : '`yad gate sync <epic>`'} — then delete the \`roster\` key from ${settingsEditHint(root)}`
             : unplaced
-              ? `every older record it can place names its login now; ${unplaced} it cannot place (a name two logins share, or records that disagree about which review they are) are matched by submission time or given again on a new review — delete the \`roster\` key once those reviews are closed`
-              : 'no older record needs it any more — delete the `roster` key';
+              ? `every older record it can place names its login now; ${unplaced} it cannot place (a name two logins share, or records that disagree about which review they are) are matched by submission time or given again on a new review — delete the \`roster\` key from ${settingsEditHint(root)} once those reviews are closed`
+              : `no older record needs it any more — delete the \`roster\` key from ${settingsEditHint(root)}`;
         check(checks, 'people:roster-unused', 'project', 'warn',
-          `${PROJECT_FILES.hubConfig} has a \`roster\` that no longer decides who approves — a gate needs one approval (not the author's own) from anyone with access`,
+          `${settingsRel} has a \`roster\` that no longer decides who approves — a gate needs one approval (not the author's own) from anyone with access`,
           when);
         // Those pairs are exact only when the roster is: a name two logins share cannot say which person an
         // older record means. Named here, because on an open review that approval may then have to be given
@@ -138,21 +174,21 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
         // that entry, and an unlisted login was written `unverified` — so it is not warned about.) The hint
         // does NOT say "rename it": renaming one entry hands every older record under the name to whoever
         // keeps it, which can put someone's approval of old content on a person who never gave it.
-        const unclear = [...ambiguousLegacyNames(hub).keys()];
+        const unclear = [...ambiguousLegacyNames(productConfig).keys()];
         if (unclear.length) {
           check(checks, 'people:roster-ambiguous', 'project', 'warn',
-            `${PROJECT_FILES.hubConfig} roster name(s) ${unclear.join(', ')} are given to more than one login — an older approval under that name cannot be recognised by name`,
+            `${settingsRel} roster name(s) ${unclear.map(forTerminal).join(', ')} are given to more than one login — an older approval under that name cannot be recognised by name`,
             'leave the roster as it is: an older approval under that name is matched only when its submission time says whose it is, and otherwise may need to be given again on a new PR. Renaming an entry hands those records to whoever keeps the name — only do it if you know whose approval each one was');
         }
       }
-      if (isSolo(hub)) {
+      if (isSolo(productConfig)) {
         check(checks, 'solo', 'project', 'ok', 'mode: solo — approval waived; the PR merge + resolved threads gate the step');
         // E74: suggest team mode when the count shows more than one person may work here. Counted ONLY
         // in solo mode, because the count walks the git history of every connected repo; team mode
         // pays nothing. A suggestion, never a switch — so a warning, never a failure. An unknown count
         // is a warning too (the user's choice, 2026-09-22): doctor is where a count that cannot be read
         // is fixed, and a ✓ beside "could not be counted" would read as healthy.
-        const hint = soloTeamHint(root, hub, { solo: true, headCount });
+        const hint = soloTeamHint(root, productConfig, { solo: true, headCount });
         if (hint.line && hint.known) {
           check(checks, 'mode:suggest-team', 'project', 'warn', hint.line,
             `run \`${TEAM_CMD}\` if more than one person works here; if it is only you (for example two accounts, two spellings of your name, a robot committing or auto-approving, or your own approval on a local ledger), leave solo mode on`);
@@ -164,44 +200,48 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
       // E10 writes `mode: solo|team` beside `solo`, and `solo` is still the one read. A hand edit can leave
       // the two saying different things; name that, and say which one the gates follow. Silent on a file
       // with no `mode`, which is every Product set up before E10 (the frozen golden one included).
-      if (hub.mode !== undefined) {
-        const acting = isSolo(hub) ? 'solo' : 'team';
-        if (hub.mode !== acting) {
+      if (productConfig.mode !== undefined) {
+        const acting = isSolo(productConfig) ? 'solo' : 'team';
+        if (productConfig.mode !== acting) {
           check(checks, 'mode:disagree', 'project', 'warn',
-            `${PROJECT_FILES.hubConfig} says mode: ${JSON.stringify(hub.mode)}, but solo mode is ${acting === 'solo' ? 'on' : 'off'} — the old \`solo\` flag is the one the gates read`,
-            ['solo', 'team'].includes(hub.mode)
-              ? `\`yad mode ${acting}\` keeps what the gates do now; \`yad mode ${hub.mode === 'solo' ? 'solo --reason "<why>"' : 'team'}\` makes the gates follow \`mode\``
+            `${settingsRel} says mode: ${JSON.stringify(forTerminal(productConfig.mode))}, but solo mode is ${acting === 'solo' ? 'on' : 'off'} — the old \`solo\` flag is the one the gates read`,
+            ['solo', 'team'].includes(productConfig.mode)
+              ? `\`yad mode ${acting}\` keeps what the gates do now; \`yad mode ${productConfig.mode === 'solo' ? 'solo --reason "<why>"' : 'team'}\` makes the gates follow \`mode\``
               : `\`yad mode ${acting}\` writes a mode the gates recognise`);
         }
       }
       // platform CLI + auth (best-effort; auth probing is the user's own session)
-      const cli = cliFor(hub.platform);
+      const cli = cliFor(productConfig.platform);
       if (cli) {
         // git_url is required whenever a platform is set — doctor needs it to scope the auth probe
         // and the verified ledger/PR flow needs it to open PRs. Warn on its absence directly (not on the
         // resolved host), so it fires even when an origin remote can substitute: the field itself
         // is required regardless.
-        if (!hostFromGitUrl(hub.git_url)) {
-          check(checks, 'hub-git-url', 'project', 'warn',
-            `${PROJECT_FILES.hubConfig} sets platform '${hub.platform}' but has no git_url [YAD-CFG-005]`,
-            'add git_url to hub.json (or re-run `yad setup`) — auth/PR checks need the Product host');
+        if (!hostFromGitUrl(productConfig.git_url)) {
+          check(checks, 'product-git-url', 'project', 'warn',
+            `${settingsRel} sets platform '${productConfig.platform}' but has no git_url [YAD-CFG-005]`,
+            `add git_url to ${settingsEditHint(root)} (or re-run \`yad setup\`) — auth/PR checks need the Product host`);
         }
         // Scope the auth probe to the Product's own host (derived from git_url, falling back to the
         // origin remote). `${cli} auth status` without --hostname exits non-zero when ANY configured
         // instance fails, so an unrelated stale login (e.g. a dead gitlab.com token) would falsely
         // flag a working self-hosted Product — so we SKIP the probe entirely when no host resolves
         // rather than run the flaky unscoped form.
-        const host = hostFromGitUrl(hub.git_url)
+        const rawHost = hostFromGitUrl(productConfig.git_url)
           || hostFromGitUrl(run('git', ['remote', 'get-url', 'origin'], { cwd: root }).stdout);
+        // Never asked about or repeated unless it is a plain host name (E81 review 14): it is printed
+        // inside `gh auth login --hostname …` for the person to run.
+        const host = plainHost(rawHost);
         if (!has(cli)) check(checks, 'platform-cli', 'project', 'warn', `${cli} not found on PATH [YAD-ENV-002]`, `install ${cli} — the gate degrades to local without it`);
-        else if (!host) check(checks, 'platform-cli', 'project', 'warn', 'auth check skipped — hub host unknown (no git_url / origin)', 'add git_url to hub.json so the auth probe can target the right host');
+        else if (rawHost && !host) check(checks, 'platform-cli', 'project', 'warn', 'auth check skipped — the Product\'s git remote URL names a host that is not a plain host name', `fix git_url in ${settingsEditHint(root)} (or fix the origin remote) to name a plain host`);
+        else if (!host) check(checks, 'platform-cli', 'project', 'warn', 'auth check skipped — the Product\'s host is unknown (no git_url / origin)', `add git_url to ${settingsEditHint(root)}, so the auth probe can target the right host`);
         else if (!run(cli, ['auth', 'status', '--hostname', host]).ok) check(checks, 'platform-cli', 'project', 'warn', `${cli} present but not authenticated for ${host} [YAD-ENV-002]`, `run \`${cli} auth login --hostname ${host}\``);
         else {
           check(checks, 'platform-cli', 'project', 'ok', `${cli} present and authenticated`);
           // GitLab API reachability: the gate reads MR state via `glab api …` (approvals, discussions).
           // A present+authenticated glab whose token lacks api scope would still break readPrGitLab, so
           // probe a cheap api call (warn-only) to surface it before a sync silently holds the gate.
-          if (hub.platform === 'gitlab') {
+          if (productConfig.platform === 'gitlab') {
             // Scope the probe to the Product's own host (like the auth check above) so a multi-instance
             // setup doesn't hit the wrong GitLab. `host` is guaranteed truthy here (we skip the whole
             // auth branch when it cannot be resolved), so the probe is always host-scoped.
@@ -221,15 +261,12 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
   // an agent's hand-edit is always rejected later by `ledger-guard`, so the local hook that refuses it
   // up front should be installed. With a local ledger nothing guards it, and the hand-edit the
   // authoring skills describe is correct — nothing to report, so the check is silent rather than `ok`.
-  const hubForHooks = readJSON(productPath, null);
-  if (isVerifiedLedger(hubForHooks)) {
+  const productConfigForHooks = readJSON(productPath, null);
+  if (isVerifiedLedger(productConfigForHooks)) {
     const unwired = [];
     const broken = [];
-    // PRESENT AND EXECUTABLE. A script at mode 644 has the right bytes and cannot run: the harness
-    // entry pointing at it fails, fails OPEN, and every ledger edit is permitted while this check and
-    // `yad check` both call the guard healthy. Reachable from a zip download, `cp` without `-p`, or a
-    // restrictive umask, with nobody having done anything unusual.
-    if (!hookScriptReady(root, 'hooks/ledger-guard.sh')) unwired.push('hooks/ledger-guard.sh');
+    // PRESENT. The entry runs it as `node <file>` (E113), so no execute bit is involved.
+    for (const w of HOOK_WIRING) if (!hookScriptReady(root, w.dest)) unwired.push(w.dest);
     // The SAME target list `hookActions` wires — the persisted `ideTargets`, not "does the directory
     // exist". Keyed on the directory, a project whose targets are `['.agents']` but which also has a
     // stray `.claude/` would be told to run `yad check --fix` forever, while that command builds no
@@ -255,7 +292,7 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
       const adapter = HOOK_ADAPTERS[ide];
       if (!adapter) { noProtocol.push(ide); continue; }
       // The SCRIPT THE ENTRY POINTS AT, which is not always the shared one. `.cursor`'s entry names
-      // `hooks/ledger-guard-cursor.sh`, and only the shared `hooks/ledger-guard.sh` was checked above
+      // `hooks/ledger-guard-cursor.mjs`, and only the shared `hooks/ledger-guard.mjs` was checked above
       // — so a project whose wrapper was deleted, gitignored or lost in a partial checkout had
       // `yad check` calling it `new` while `yad doctor` printed a green "guard wired". The two
       // commands disagreeing about one project is the worst version of this: whichever the human
@@ -314,7 +351,7 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
       // `yad check --fix` would add our entry BESIDE theirs, leaving the one that refuses everything
       // still in place, while the report said the guard was simply missing.
       check(checks, 'hooks', 'project', 'warn', `agent ledger guard wired with a command that will refuse every write: ${miswired.join('; ')}`,
-        'this harness answers with a JSON verdict and reads an empty answer as a deny; replace that command with `hooks/ledger-guard-cursor.sh`, which `yad check --fix` installs, or have your own wrapper run `yad hook ledger-guard --format cursor` and pass its stdout through');
+        'this harness answers with a JSON verdict and reads an empty answer as a deny; replace that command with `node hooks/ledger-guard-cursor.mjs`, which `yad check --fix` installs, or have your own wrapper run `yad hook ledger-guard --format cursor` and pass its stdout through');
     } else if (unwired.length) {
       check(checks, 'hooks', 'project', 'warn', `agent ledger guard not wired: ${unwired.join(', ')}${alsoUnguarded}`,
         'run `yad check --fix` — until then an agent can hand-edit the CI-owned ledger and only find out when the review PR/MR fails');
@@ -328,15 +365,19 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
       // Name every script that is actually wired, not just the shared one — on a `.cursor` project the
       // file Cursor invokes is the wrapper, and a health line that never mentions it is a health line
       // about something else.
-      const wiredScripts = ['hooks/ledger-guard.sh',
+      const wiredScripts = [...HOOK_WIRING.map((w) => w.dest),
         ...targets.flatMap((ide) => (HOOK_ADAPTERS[ide]?.wiring || []).map((w) => w.dest))];
       check(checks, 'hooks', 'project', 'ok', `agent ledger guard wired (${[...new Set(wiredScripts)].join(', ')})${alsoUnguarded}`);
     }
+    gitHookCheck(root, checks);
   }
+  // E80: any Product whose repos live beside it.
+  workspaceFileCheck(root, checks);
 
   // Background capture (E43), on any Product in either ledger mode: is the post-edit hook wired, and will
   // a push to the `yad/wip/*` branches start the team's own CI?
   if (exists(productPath)) captureChecks(root, checks, readJSON(productPath, null));
+  if (exists(productPath)) lineEndingChecks(root, checks);
 
   // design.json: parse + shape + tool + MCP confirmation (absent is the normal markdown-only default —
   // pre-feature projects have none, so silence rather than warn when the file does not exist).
@@ -418,33 +459,49 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
   if (regBroken) { /* reported above */ }
   else if (!Array.isArray(registry?.repos)) check(checks, 'repos', 'project', 'fail', `${PROJECT_FILES.reposRegistry} has the wrong shape [YAD-STATE-002]`, 'expected a `repos` array');
   else {
-    for (const repo of registry.repos) {
+    // An entry that is not an object (`null`, `5`) is named, never dereferenced (E81).
+    const repoEntries = registry.repos.filter((r) => isPlainObject(r));
+    const odd = registry.repos.length - repoEntries.length;
+    if (odd) check(checks, 'repos:not-an-entry', 'project', 'fail', `${odd} entr${odd > 1 ? 'ies' : 'y'} in ${PROJECT_FILES.reposRegistry} ${odd > 1 ? 'are' : 'is'} not an object [YAD-STATE-002]`, 'fix or remove it in repos.json');
+    for (const repo of repoEntries) {
       // A missing/empty path must NOT fall back to the project root (which is itself a git repo and
       // would read as "healthy") — an entry with no path is malformed.
-      if (!repo.path) { check(checks, `repo:${repo.name || '(unnamed)'}`, 'project', 'fail', `${repo.name || '(unnamed)'}: no \`path\` in repos.json [YAD-STATE-003]`, 're-connect the repo (`yad setup`)'); continue; }
+      if (typeof repo.path !== 'string' || !repo.path) { check(checks, `repo:${repo.name || '(unnamed)'}`, 'project', 'fail', `${forTerminal(repo.name || '(unnamed)')}: no \`path\` in repos.json [YAD-STATE-003]`, 're-connect the repo (`yad setup`)'); continue; }
       const repoRoot = path.resolve(root, repo.path);
+      // Judged before git runs (E81) — the same judgement `yad repo clone` makes, so the hint names that
+      // command only for a repo it would clone, and git never runs in a folder with no `.git` (a
+      // committed folder shaped like a bare repo would have git read its `config`).
+      const judged = judgeRepo(root, repo);
+      const { name: nm, path: pth } = judged;   // shown in the terminal: control characters made spaces
+      const cloneHint = judged.state === 'missing' ? 'run `yad repo clone` to clone it here' : null;
       // A registered repo may be a SIBLING of the Product (`../backend`, the standard multi-repo layout).
       // Such a checkout is legitimately absent wherever only the Product is checked out — Product CI, a fresh
       // clone — so its absence is a warn, not corruption. A missing path INSIDE the project root is
       // still a hard fail: nothing but damage explains it.
       if (!exists(repoRoot)) {
-        if (underProjectRoot(root, repoRoot) || !isRegistrableSibling(root, repo.path)) check(checks, `repo:${repo.name}`, 'project', 'fail', `${repo.name}: path ${repo.path} does not exist [YAD-STATE-003]`, 'fix the path in repos.json or re-connect the repo');
-        else check(checks, `repo:${repo.name}`, 'project', 'warn', `${repo.name}: ${repo.path} is not present in this checkout (sibling repo, outside the Product)`, 'expected when only the Product is checked out; clone it alongside the Product to work on it here');
+        if (underProjectRoot(root, repoRoot) || !isRegistrableSibling(root, repo.path)) check(checks, `repo:${repo.name}`, 'project', 'fail', `${nm}: path ${pth} does not exist [YAD-STATE-003]`, cloneHint || 'fix the path in repos.json or re-connect the repo');
+        else check(checks, `repo:${repo.name}`, 'project', 'warn', `${nm}: ${pth} is not present in this checkout (sibling repo, outside the Product)`, cloneHint ? `expected when only the Product is checked out; ${cloneHint}` : `expected when only the Product is checked out; \`yad repo clone\` will not clone it (${judged.reason}) — clone it alongside the Product by hand to work on it here`);
         continue;
       }
-      const head = gitHead(repoRoot);
-      if (!head) { check(checks, `repo:${repo.name}`, 'project', 'fail', `${repo.name}: ${repo.path} is not a git repository (or has no commits) [YAD-STATE-003]`, 'init/clone the repo, then re-connect it'); continue; }
-      if (!repo.syncedHead) check(checks, `repo:${repo.name}`, 'project', 'warn', `${repo.name}: registered without a code-context pack (greenfield)`, 'run `yad repo refresh ' + repo.name + '` once it has code');
-      else if (head !== repo.syncedHead) check(checks, `repo:${repo.name}`, 'project', 'warn', `${repo.name}: code-context is stale (HEAD moved since last pack)`, 'run `yad repo refresh ' + repo.name + '`');
-      else check(checks, `repo:${repo.name}`, 'project', 'ok', `${repo.name}: git repo, context fresh`);
+      // There, but refused (outside the workspace, through `.git` or a link, or a folder with no `.git`):
+      // said with the reason, and git is not run in it.
+      if (judged.state === 'refused') { check(checks, `repo:${repo.name}`, 'project', 'fail', `${nm}: ${pth} — ${judged.reason} [YAD-STATE-003]`, 'fix the path in repos.json or re-connect the repo'); continue; }
+      // Reached through a link inside a repo's tree (a link the Product commits): `yad repo sync` and
+      // `refresh` skip it, and so do doctor's other checks — said, not read.
+      if (judged.linked) { check(checks, `repo:${repo.name}`, 'project', 'warn', `${nm}: ${pth} is reached through a link inside a repo's tree, so the checkout is not where the path says — yad skips it`, 'register the checkout at its own path'); continue; }
+      const head = judged.state === 'present' || judged.state === 'product' ? gitHead(repoRoot) : null;
+      if (!head) { check(checks, `repo:${repo.name}`, 'project', 'fail', `${nm}: ${pth} is not a git repository (or has no commits) [YAD-STATE-003]`, cloneHint || 'init/clone the repo, then re-connect it'); continue; }
+      if (!repo.syncedHead) check(checks, `repo:${repo.name}`, 'project', 'warn', `${nm}: registered without a code-context pack (greenfield)`, 'run `yad repo refresh ' + asArg(repo.name) + '` once it has code');
+      else if (head !== repo.syncedHead) check(checks, `repo:${repo.name}`, 'project', 'warn', `${nm}: code-context is stale (HEAD moved since last pack)`, 'run `yad repo refresh ' + asArg(repo.name) + '`');
+      else check(checks, `repo:${repo.name}`, 'project', 'ok', `${nm}: git repo, context fresh`);
     }
     if (!registry.repos.length) check(checks, 'repos', 'project', 'warn', 'no code repos registered', 'run `yad setup` to connect one');
     // Per-repo owners went with the roster (E62). Named only where a repo actually lists someone: every
     // repo an older setup connected carries an EMPTY `domain_owner`, which says nothing.
-    const owned = registry.repos.filter((r) => (Array.isArray(r.domain_owners) && r.domain_owners.length) || (typeof r.domain_owner === 'string' && r.domain_owner));
+    const owned = repoEntries.filter((r) => (Array.isArray(r.domain_owners) && r.domain_owners.length) || (typeof r.domain_owner === 'string' && r.domain_owner));
     if (owned.length) {
       check(checks, 'people:domain-owners-unused', 'project', 'warn',
-        `${PROJECT_FILES.reposRegistry} names domain owners that nothing reads any more: ${owned.map((r) => r.name).join(', ')}`,
+        `${PROJECT_FILES.reposRegistry} names domain owners that nothing reads any more: ${owned.map((r) => forTerminal(r.name)).join(', ')}`,
         'delete `domain_owner` / `domain_owners` when convenient; request reviewers on the PR itself');
     }
     // The verified-commits author allowlist went with the roster too (E62): the gate checks signatures
@@ -452,21 +509,21 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
     // list in hub.json and every generated file — so nobody maintains a list that no longer protects.
     const allowFiles = [
       { where: 'the Product', file: path.join(root, '.sdlc', 'verified-authors') },
-      ...registry.repos.filter((r) => r.path).map((r) => ({ where: r.name, file: path.join(path.resolve(root, r.path), '.sdlc', 'verified-authors') })),
+      ...repoEntries.filter((r) => typeof r.path === 'string' && r.path).map((r) => ({ where: forTerminal(r.name), file: path.join(path.resolve(root, r.path), '.sdlc', 'verified-authors') })),
     ].filter((x) => exists(x.file)).map((x) => x.where);
-    const listedAuthors = hub && typeof hub === 'object' && Array.isArray(hub.verified_authors) && hub.verified_authors.length > 0;
+    const listedAuthors = productConfig && typeof productConfig === 'object' && Array.isArray(productConfig.verified_authors) && productConfig.verified_authors.length > 0;
     if (allowFiles.length || listedAuthors) {
-      const what = [listedAuthors ? `\`verified_authors\` in ${PROJECT_FILES.hubConfig}` : null, allowFiles.length ? `.sdlc/verified-authors in ${allowFiles.join(', ')}` : null].filter(Boolean).join(' and ');
+      const what = [listedAuthors ? `\`verified_authors\` in ${settingsRel}` : null, allowFiles.length ? `.sdlc/verified-authors in ${allowFiles.join(', ')}` : null].filter(Boolean).join(' and ');
       check(checks, 'people:verified-authors-unused', 'project', 'warn',
         `${what} — the verified-commits gate no longer reads an author list; it checks signatures only`,
-        'delete them when convenient; write access to the repo decides who can author a commit');
+        `delete them when convenient${listedAuthors ? ` (\`verified_authors\` from ${settingsEditHint(root)})` : ''}; write access to the repo decides who can author a commit`);
     }
     // A wired `verified-commits.sh` from before E62 still ENFORCES the author list. On a verified ledger
     // `yad check --fix` refreshes it; on a local ledger the Product's CI files are not managed, so an older
     // copy stays and keeps failing commits from unlisted authors (E62 upgrade simulation). Named, not fixed.
     const oldGates = [
       { where: 'the Product', file: path.join(root, 'checks', 'verified-commits.sh') },
-      ...registry.repos.filter((r) => r.path).map((r) => ({ where: r.name, file: path.join(path.resolve(root, r.path), 'checks', 'verified-commits.sh') })),
+      ...repoEntries.filter((r) => typeof r.path === 'string' && r.path).map((r) => ({ where: forTerminal(r.name), file: path.join(path.resolve(root, r.path), 'checks', 'verified-commits.sh') })),
     ].filter((x) => exists(x.file) && /SDLC_VERIFIED_AUTHORS|ALLOWLIST=/.test(fs.readFileSync(x.file, 'utf8'))).map((x) => x.where);
     if (oldGates.length) {
       check(checks, 'people:allowlist-gate-stale', 'project', 'warn',
@@ -477,7 +534,7 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
     // slice out of specs/<story>/contracts/ (or a file out of src/<feature>/) passes the gate. `yad check
     // --fix` refreshes a wired contract-check nobody changed; one changed by hand is kept, and
     // backfill-check is never wired at all — every copy is placed by hand. Named, not fixed.
-    const gateRoots = [{ where: 'the Product', root }, ...registry.repos.filter((r) => r.path).map((r) => ({ where: r.name, root: path.resolve(root, r.path) }))];
+    const gateRoots = [{ where: 'the Product', root }, ...repoEntries.filter((r) => typeof r.path === 'string' && r.path).map((r) => ({ where: forTerminal(r.name), root: path.resolve(root, r.path) }))];
     const renameBlind = gateRoots
       .flatMap((x) => RENAME_BLIND_GATES.map((rel) => ({ ...x, rel })))
       .filter((x) => renameBlindGate(path.join(x.root, x.rel)))
@@ -496,10 +553,189 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
         `checks/contract-check.sh in ${symlinkBlind.join(', ')} ${symlinkBlind.length > 1 ? 'are older copies that do' : 'is an older copy that does'} not refuse a symlink or submodule under specs/ — a link there hides the contract slice, and every later edit to its target passes`,
         'run `yad check --fix` (it refreshes a wired contract-check nobody changed by hand); otherwise copy skills/yad-checks/templates/checks/contract-check.sh over it');
     }
+    // E116. An older backfill-check reads the spec (and its `verified: true`) from the PR itself, so a PR
+    // can approve itself or delete the spec; and it reads paths only, so a symlink or submodule at `src`,
+    // `src/<feature>` or inside the feature hides every later edit to its target. Never wired: named, not fixed.
+    const backfillBlind = gateRoots.filter((x) => backfillBlindGate(path.join(x.root, 'checks/backfill-check.sh'))).map((x) => x.where);
+    if (backfillBlind.length) {
+      check(checks, 'checks:backfill-blind', 'project', 'warn',
+        `checks/backfill-check.sh in ${backfillBlind.join(', ')} ${backfillBlind.length > 1 ? 'are older copies that read' : 'is an older copy that reads'} the approval from the PR itself and does not refuse a symlink under src/ — a PR can approve its own change, and an edit behind a link passes`,
+        'copy skills/yad-backfill/templates/checks/backfill-check.sh over it — backfill-check is never wired, so `yad check --fix` does not refresh it');
+    }
+    // E117. An older Product-reading gate takes link.md's `product-repo` as the PR leaves it, so a PR can
+    // point it at nothing (a deferral, a PASS) or at a Product it commits itself. The current four read
+    // `product-repo` from the base and a tracked Product from the base commit. Named, not fixed.
+    const pathBlind = gateRoots
+      .flatMap((x) => PRODUCT_PATH_GATES.map((rel) => ({ ...x, rel })))
+      .filter((x) => productPathBlindGate(path.join(x.root, x.rel)))
+      .map((x) => `${x.rel} in ${x.where}`);
+    if (pathBlind.length) {
+      check(checks, 'checks:product-path-blind', 'project', 'warn',
+        `${pathBlind.join(', ')} ${pathBlind.length > 1 ? 'are older copies that read' : 'is an older copy that reads'} the Product from wherever the PR's link.md points — a PR can point it at nothing, or at a Product it commits itself, and pass`,
+        'run `yad check --fix` (it refreshes a wired gate nobody changed by hand); otherwise copy the shipped one over it from skills/yad-checks/templates/checks/');
+    }
+    // E120. An older Product-reading gate never reads `.sdlc/product-link.json`, so it still takes where
+    // the Product lives from link.md; and a checks workflow the team changed by hand (which `yad update`
+    // keeps) may not run checks/product-checkout.sh, so CI never checks the Product out. Named, not fixed.
+    const blindGates = gateRoots.flatMap((x) => PRODUCT_PATH_GATES.map((rel) => ({ ...x, rel })))
+      .filter((x) => productRecordBlindGate(path.join(x.root, x.rel)))
+      .map((x) => `${x.rel} in ${x.where}`);
+    // A `#` line naming the script is prose, not a step that runs it (review 1).
+    const blindFlows = gateRoots.filter((x) => x.where !== 'the Product').flatMap((x) => CHECK_WORKFLOWS.map((rel) => ({ ...x, rel })))
+      .filter((x) => {
+        let src;
+        try { src = fs.readFileSync(path.join(x.root, x.rel), 'utf8'); } catch { return false; }
+        return !src.split('\n').some((l) => !/^\s*#/.test(l) && /checks\/product-checkout\.sh/.test(l));
+      })
+      .map((x) => `${x.rel} in ${x.where}`);
+    const said = [
+      ...(blindGates.length ? [`${blindGates.join(', ')} ${blindGates.length > 1 ? 'never read' : 'never reads'} .sdlc/product-link.json, so where the Product lives is taken from link.md`] : []),
+      ...(blindFlows.length ? [`${blindFlows.join(', ')} ${blindFlows.length > 1 ? 'do' : 'does'} not run checks/product-checkout.sh, so CI never checks the Product out`] : []),
+    ];
+    if (said.length) {
+      check(checks, 'checks:product-record-blind', 'project', 'warn', said.join('; '),
+        'run `yad check --fix` (it refreshes wired files nobody changed by hand); otherwise copy the shipped gate or workflow over it from skills/yad-checks/templates/');
+    }
+    // E120. A wired code repo (not the Product's own git repo) whose record is not COMMITTED: its gates
+    // fall back to link.md, and CI has nothing to check the Product out from. Committed, not on disk
+    // (review 1): the gates read it from the default branch, and one that setup wrote and nobody
+    // committed looked fine here. Wired only: a repo with no gates has nothing to read it, and the
+    // hint would install its whole wiring.
+    const top = (d) => { const x = run('git', ['rev-parse', '--show-toplevel'], { cwd: d }); return x.ok ? path.resolve(x.stdout.trim()) : ''; };
+    const rootTop = top(root);
+    const unlinked = repoEntries.filter((r) => typeof r.path === 'string' && r.path).map((r) => ({ r, dir: path.resolve(root, r.path) }))
+      .filter(({ r, dir }) => isCheckout(root, r) && (exists(path.join(dir, '.sdlc/managed.json')) || exists(path.join(dir, 'checks/contract-check.sh'))))
+      .filter(({ dir }) => { const t = top(dir); return t && t !== rootTop; })
+      .map(({ r, dir }) => {
+        const branch = r.default_branch || 'main';
+        const onRemote = run('git', ['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${branch}`], { cwd: dir }).ok;
+        const ref = onRemote ? `origin/${branch}` : 'HEAD';
+        const shown = run('git', ['show', `${ref}:${PRODUCT_LINK}`], { cwd: dir });
+        // What is on disk (what yad last wrote) against what the default branch holds (what CI reads):
+        // a record updated on disk and never committed is as stale as a missing one (review 2).
+        let disk = null;
+        try { disk = JSON.parse(fs.readFileSync(path.join(dir, PRODUCT_LINK), 'utf8')); } catch { /* none, or not JSON */ }
+        let there;
+        try { there = shown.ok ? JSON.parse(shown.stdout) : null; } catch { there = null; }
+        const ignored = run('git', ['check-ignore', '-q', '--', PRODUCT_LINK], { cwd: dir }).ok;
+        const same = (a, b) => ['git_url', 'path', 'default_branch'].every((k) => (a?.[k] ?? null) === (b?.[k] ?? null));
+        const behind = !there || (disk && !same(disk, there));
+        if (!behind) return null;
+        if (ignored) return { name: r.name, branch, why: 'ignored' };
+        // Committed here and never pushed (review 3): a --push whose push was refused (a protected
+        // branch) leaves the record `ok` for the writer, so `--fix --push` stages nothing — the fix is to
+        // push the commit, not to run it again.
+        // The disk copy IS this clone's committed one (HEAD), and origin's differs: which side is ahead is
+        // git's to say, not the copies' (reviews 4–5). One table, every case:
+        //   no commit to the record in origin/<b>..HEAD  → this clone is only behind: on <b>, pull;
+        //                                                  elsewhere, nothing — CI's copy is the newer one
+        //   such a commit, on <b>, origin not ahead      → not pushed: push it
+        //   such a commit, on <b>, origin also ahead     → diverged: pull, settle the record, push
+        //   such a commit, on a detached HEAD            → check out <b> first
+        //   such a commit, on another branch             → merge it into <b> (a PR)
+        // The branch this clone is on: a hint that ends in `--push` only works on <b> (review 6).
+        const cur = run('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: dir });
+        const onBranch = cur.ok ? cur.stdout.trim() : 'HEAD';
+        const offBranch = onBranch !== branch ? onBranch : null;
+        if (onRemote && disk) {
+          let head;
+          try { const h = run('git', ['show', `HEAD:${PRODUCT_LINK}`], { cwd: dir }); head = h.ok ? JSON.parse(h.stdout) : null; } catch { head = null; }
+          if (head && same(head, disk)) {
+            const count = (range, ...only) => {
+              const x = run('git', ['rev-list', '--count', range, ...(only.length ? ['--', ...only] : [])], { cwd: dir });
+              return x.ok ? Number(x.stdout.trim()) || 0 : 0;
+            };
+            const ahead = count(`origin/${branch}..HEAD`, PRODUCT_LINK) > 0;
+            // Not ahead and off <b>: nothing to say only while <b> still holds a readable record, which is
+            // then the newer one (review 6: one deleted or broken on <b> was passed over in silence).
+            if (!ahead && onBranch === branch) return { name: r.name, branch, why: 'behind' };
+            if (!ahead && there) return null;
+            if (ahead && onBranch === branch) return { name: r.name, branch, why: count(`HEAD..origin/${branch}`) > 0 ? 'diverged' : 'unpushed' };
+            if (ahead && onBranch === 'HEAD') return { name: r.name, branch, why: 'detached' };
+            if (ahead) return { name: r.name, branch, onBranch, why: 'elsewhere' };
+          }
+        }
+        // A copy ON DISK that is not JSON is what a plain --fix leaves alone (review 8) — not the default
+        // branch's copy, which a clone off that branch only picks up once it switches and pulls.
+        const diskBad = !disk && exists(path.join(dir, PRODUCT_LINK));
+        // Off the default branch, the hint's first step is a switch, and a switch REPLACES a record this
+        // branch tracks with the default branch's (review 9) — so judge the copy it will have then.
+        const trackedHere = !!offBranch && run('git', ['cat-file', '-e', `HEAD:${PRODUCT_LINK}`], { cwd: dir }).ok;
+        if (!there) return { name: r.name, branch, offBranch, diskBad, trackedHere, why: shown.ok ? 'unreadable' : 'missing' };
+        return { name: r.name, branch, offBranch, why: 'stale' };
+      })
+      .filter(Boolean)
+      // Everything below prints these (E81 review 11): the registry's name and branch, and the clone's own
+      // branch names, made safe once here — names for prose, the branch for the git commands to copy.
+      .map((u) => ({ ...u, name: forTerminal(u.name), branch: branchArg(u.branch),
+        ...(u.onBranch ? { onBranch: forTerminal(u.onBranch) } : {}), ...(u.offBranch ? { offBranch: forTerminal(u.offBranch) } : {}) }));
+    const named = (why) => unlinked.filter((u) => u.why === why).map((u) => u.name);
+    const missing = named('missing');
+    const unreadable = named('unreadable');
+    const stale = named('stale');
+    const ignoredRepos = named('ignored');
+    const unpushed = unlinked.filter((u) => u.why === 'unpushed');
+    if (missing.length || unreadable.length || stale.length) {
+      check(checks, 'repos:product-link-missing', 'project', 'warn', [
+        ...(missing.length ? [`${missing.join(', ')} ${missing.length > 1 ? 'have' : 'has'} no ${PRODUCT_LINK} on the default branch — the gates there take where the Product lives from link.md, and CI cannot check the Product out`] : []),
+        ...(unreadable.length ? [`${unreadable.join(', ')} ${unreadable.length > 1 ? 'have' : 'has'} no readable ${PRODUCT_LINK} on the default branch (it is not JSON) — CI cannot read it`] : []),
+        ...(stale.length ? [`${stale.join(', ')} ${stale.length > 1 ? 'hold' : 'holds'} a ${PRODUCT_LINK} on disk that differs from the one on the default branch — CI reads the default branch's`] : []),
+      ].join('; '),
+        // One step per repo that needs more than the plain command (review 7): which branch it is on, and
+        // --overwrite-local where the copy is not JSON (a plain --fix leaves such a copy alone).
+        (() => {
+          const listed = unlinked.filter((u) => ['missing', 'unreadable', 'stale'].includes(u.why));
+          const where = (u) => (u.offBranch === 'HEAD' ? 'a detached HEAD' : u.offBranch);
+          const off = listed.filter((u) => u.offBranch);
+          // --overwrite-local only where a plain --fix would leave the copy alone: it is not JSON on disk
+          // now, or will not be once an off-branch clone pulls the default branch's unreadable one.
+          const bad = listed.filter((u) => (!u.offBranch ? u.diskBad
+            : u.trackedHere ? u.why === 'unreadable' : u.diskBad || u.why === 'unreadable'));
+          return [
+            ...(off.length ? [`first bring ${off.length > 1 ? 'each clone' : 'the clone'} to its default branch — ${off.map((u) => `${u.name} (on ${where(u)}): \`git checkout ${u.branch} && git pull origin ${u.branch}\``).join('; ')} — or commit the record on the branch ${off.length > 1 ? 'each is' : 'it is'} on and merge it with a PR`] : []),
+            `${off.length ? 'then ' : ''}from the Product run \`yad check --fix --push\`: it writes the record into each connected repo and commits it to the default branch`,
+            ...(bad.length ? [`add \`--overwrite-local\` for ${bad.map((u) => u.name).join(', ')}, whose copy is not JSON and is otherwise left alone — the flag applies to the whole run: it also replaces files changed by hand in the Product and in every connected repo, after saving each`] : []),
+          ].join('; ');
+        })());
+    }
+    const elsewhere = unlinked.filter((u) => u.why === 'elsewhere');
+    if (elsewhere.length) {
+      check(checks, 'repos:product-link-missing', 'project', 'warn',
+        elsewhere.map((u) => `${u.name} has ${PRODUCT_LINK} committed on branch ${u.onBranch}, not on ${u.branch} — CI reads ${u.branch}`).join('; '),
+        `merge it into the default branch (${elsewhere.map((u) => `a PR from ${u.onBranch} into ${u.branch} in ${u.name}`).join(', ')})`);
+    }
+    const behind = unlinked.filter((u) => u.why === 'behind');
+    if (behind.length) {
+      check(checks, 'repos:product-link-missing', 'project', 'warn',
+        `${behind.map((u) => u.name).join(', ')} ${behind.length > 1 ? 'are' : 'is'} behind the default branch for ${PRODUCT_LINK} — someone changed it there since this clone last pulled`,
+        `pull (${behind.map((u) => `\`git pull origin ${u.branch}\` in ${u.name}`).join(', ')}); the default branch's record is the one CI reads`);
+    }
+    const diverged = unlinked.filter((u) => u.why === 'diverged');
+    if (diverged.length) {
+      check(checks, 'repos:product-link-missing', 'project', 'warn',
+        `${diverged.map((u) => u.name).join(', ')} ${diverged.length > 1 ? 'have' : 'has'} a ${PRODUCT_LINK} commit the default branch lacks, and the default branch has moved on too — a push would be refused`,
+        `pull (rebase or merge) in ${diverged.map((u) => u.name).join(', ')}, settle the record, then push — or open a PR`);
+    }
+    const detached = unlinked.filter((u) => u.why === 'detached');
+    if (detached.length) {
+      check(checks, 'repos:product-link-missing', 'project', 'warn',
+        `${detached.map((u) => u.name).join(', ')} ${detached.length > 1 ? 'have' : 'has'} a ${PRODUCT_LINK} commit the default branch lacks, on a detached HEAD`,
+        `check out the default branch (${detached.map((u) => `\`git checkout ${u.branch}\` in ${u.name}`).join(', ')}), bring the commit onto it, then push`);
+    }
+    if (unpushed.length) {
+      check(checks, 'repos:product-link-missing', 'project', 'warn',
+        `${unpushed.map((u) => u.name).join(', ')} ${unpushed.length > 1 ? 'have' : 'has'} ${PRODUCT_LINK} committed but not pushed — CI reads the default branch, which does not have it yet`,
+        `push that commit (${unpushed.map((u) => `\`git push origin ${u.branch}\` in ${u.name}`).join(', ')}), or open a PR with it if the branch is protected — \`yad check --fix --push\` has nothing left to commit`);
+    }
+    if (ignoredRepos.length) {
+      check(checks, 'repos:product-link-missing', 'project', 'warn',
+        `${ignoredRepos.join(', ')} ${ignoredRepos.length > 1 ? 'ignore' : 'ignores'} ${PRODUCT_LINK} (.gitignore), so \`yad check --fix --push\` cannot commit it — CI cannot read it`,
+        `un-ignore ${PRODUCT_LINK} in that repo's .gitignore (or \`git add -f\` it), and commit it to the default branch`);
+    }
   }
 
-  ciTagsChecks(checks, root, hub, registry);
-  return { hub, registry };
+  ciTagsChecks(checks, root, productConfig, registry);
+  return { productConfig, registry };
 }
 
 // GitLab CI runner tags: the wired fragments run docker-image jobs. On instances whose runners are
@@ -507,7 +743,7 @@ export function projectChecks(checks, root, { headCount = null } = {}) {
 // forever — silently blocking the gates (issue #50). A current fragment carries
 // `tags: [$YAD_RUNNER_TAGS]`; warn on any wired GitLab fragment that sets an `image:` but has no
 // `tags:` (an old install, or one hand-reverted by a sync). Pure local read — no API calls.
-export function ciTagsChecks(checks, root, hub, registry) {
+export function ciTagsChecks(checks, root, productConfig, registry) {
   const untagged = (p) => {
     try {
       const txt = fs.readFileSync(p, 'utf8');
@@ -515,22 +751,26 @@ export function ciTagsChecks(checks, root, hub, registry) {
     } catch { return false; } // absent fragment is not this check's concern
   };
   const fragments = [];
-  if (hub?.platform === 'gitlab' && isVerifiedLedger(hub)) {
+  if (productConfig?.platform === 'gitlab' && isVerifiedLedger(productConfig)) {
     fragments.push(
-      { scope: 'hub', file: '.gitlab/ci/yad-gate-sync.yml', path: path.join(root, '.gitlab/ci/yad-gate-sync.yml') },
-      { scope: 'hub', file: '.gitlab/ci/yad-verified-commits.yml', path: path.join(root, '.gitlab/ci/yad-verified-commits.yml') },
-      { scope: 'hub', file: '.gitlab/ci/yad-hub-checks.yml', path: path.join(root, '.gitlab/ci/yad-hub-checks.yml') },
+      { scope: 'product', file: '.gitlab/ci/yad-gate-sync.yml', path: path.join(root, '.gitlab/ci/yad-gate-sync.yml') },
+      { scope: 'product', file: '.gitlab/ci/yad-verified-commits.yml', path: path.join(root, '.gitlab/ci/yad-verified-commits.yml') },
+      { scope: 'product', file: '.gitlab/ci/yad-product-checks.yml', path: path.join(root, '.gitlab/ci/yad-product-checks.yml') },
+      // Its old name (E123), while it is still there — `renamed:` says to run `yad update`.
+      { scope: 'product', file: '.gitlab/ci/yad-hub-checks.yml', path: path.join(root, '.gitlab/ci/yad-hub-checks.yml') },
     );
   }
-  for (const repo of registry?.repos || []) {
-    if (repo.platform !== 'gitlab' || !repo.path) continue;
-    fragments.push({ scope: repo.name, file: '.gitlab/ci/yad-checks.yml', path: path.join(path.resolve(root, repo.path), '.gitlab/ci/yad-checks.yml') });
+  for (const repo of Array.isArray(registry?.repos) ? registry.repos : []) {
+    if (!isPlainObject(repo) || repo.platform !== 'gitlab' || !repo.path) continue;
+    fragments.push({ scope: forTerminal(repo.name), repo: true, file: '.gitlab/ci/yad-checks.yml', path: path.join(path.resolve(root, repo.path), '.gitlab/ci/yad-checks.yml') });
   }
   for (const f of fragments) {
     if (untagged(f.path)) {
       check(checks, `ci-tags:${f.scope}`, 'project', 'warn',
         `${f.scope}: ${f.file} runs a docker job with no \`tags:\` [YAD-CI-001]`,
-        'tag-locked runners (run_untagged: false) will strand it at `pending` — run `yad update`, then set the `YAD_RUNNER_TAGS` CI/CD variable');
+        'tag-locked runners (run_untagged: false) will strand it at `pending` — run `yad update`, then set the `YAD_RUNNER_TAGS` CI/CD variable',
+        // The id cannot tell the Product from a repo named `product`; this key can (E124 review 1).
+        { product: f.scope === 'product' && !f.repo });
     }
   }
 }
@@ -706,13 +946,15 @@ export function epicChecks(checks, root) {
         for (const v of stateInvariants(ledger.state)) {
           check(checks, `epic:${e}:${v.authorStep}`, 'epics', 'fail',
             `${e}: ${v.message} [${v.code}]`,
-            `run \`yad gate repair ${e}\` to close it`);
+            // On a verified Product the repair's hand commit is refused by the git pre-commit guard (E48);
+            // `--push` makes the commit yad owns, so that is the command named there.
+            `run \`yad gate repair ${e}${isVerifiedLedger(readJSON(productConfigPath(root), null)) ? ' --push' : ''}\` to close it`);
         }
         // Migration guard (pre-3.0 model): under the current model CI records the ledger on the
         // default branch only at merge (when the step is already done), and writes nothing during
         // review — so an OPEN (non-done) review PR recorded here means it was opened under an older
         // model. Merge/close it under the version that opened it before relying on the CI flow.
-        const openPr = (ledger.hubPrs || []).find((p) => {
+        const openPr = (ledger.productPrs || []).find((p) => {
           const step = ledger.state.steps.find((s) => s.id === p.step);
           return !!step && !isPassed(step);
         });
@@ -754,7 +996,7 @@ export function epicChecks(checks, root) {
 //                      ledger — so it is reported as fine, because a warning nobody can clear teaches
 //                      people to stop reading warnings.
 export function foundationChecks(checks, root) {
-  const hub = readJSON(productConfigPath(root), null);
+  const productConfig = readJSON(productConfigPath(root), null);
   const hasFoundation = exists(path.join(epicRoot(root, FOUNDATION_EPIC), '.sdlc', 'state.json'));
   const hasLegacy = exists(path.join(epicRoot(root, DISCOVERY_EPIC), '.sdlc', 'state.json'));
   if (hasFoundation && hasLegacy) {
@@ -762,7 +1004,7 @@ export function foundationChecks(checks, root) {
       `two product levels: ${FOUNDATION_DIR}/ and epics/${DISCOVERY_EPIC}/ — a product has one Foundation`,
       `decide which one is real. \`yad next\` uses ${FOUNDATION_DIR}/; to keep the old one instead, move ${FOUNDATION_DIR}/ aside and run \`yad migrate --apply\``);
   } else if (hasLegacy) {
-    if (isVerifiedLedger(hub)) {
+    if (isVerifiedLedger(productConfig)) {
       // CI moves it (cli/gate.mjs `convertProductLevel`), but only once the committed checks know the
       // Foundation — so the stale case is the one with something for a person to do.
       const stale = staleFoundationGuards(root);
@@ -785,7 +1027,7 @@ export function foundationChecks(checks, root) {
       `epics/${FOUNDATION_EPIC}/ exists, but that id's folder is ${FOUNDATION_DIR}/ — nothing ever reads this one`,
       `move anything real into ${FOUNDATION_DIR}/, then delete epics/${FOUNDATION_EPIC}/`);
   }
-  foundationGuardChecks(checks, root, hub);
+  foundationGuardChecks(checks, root, productConfig);
   if (hasFoundation) foundationSectionChecks(checks, root);
 }
 
@@ -817,9 +1059,9 @@ export function foundationSectionChecks(checks, root) {
       : 'write the section before the review is approved — the yad-discovery skill says what each section needs');
 }
 
-function foundationGuardChecks(checks, root, hub) {
+function foundationGuardChecks(checks, root, productConfig) {
   if (!exists(path.join(root, FOUNDATION_DIR, '.sdlc'))) return;
-  if (!isVerifiedLedger(hub)) return;
+  if (!isVerifiedLedger(productConfig)) return;
   const stale = staleFoundationGuards(root);
   if (!stale.length) return;
   check(checks, 'foundation:guard', 'project', 'warn',
@@ -907,20 +1149,21 @@ function shapeCheckFor(checks, id, label, rows, engine) {
 // reaches it, which is how the drift report is proven before there is any drift to report.
 // A file that lives under two names must say the same thing under both. The engine writes them
 // together, so they only drift when something outside the engine touched one — a person editing the
-// name they happen to know, a script, a half-finished merge. The older name is the authoritative one
-// this major, so a silent drift means the OTHER copy is being ignored, which is the kind of thing
-// people lose an afternoon to. Say it out loud instead.
+// name they happen to know, a script, a half-finished merge. Since E122 no command reads a drifted
+// pair (every one refuses, YAD-STATE-008), so this is a failure, with the one command that ends it.
+// When the pair agrees, one plain line says why the old name is still there and when it goes.
 export function mirrorChecks(checks, root) {
-  const pairs = [...MIRRORED_FILES.map(({ canonical, legacy }) => ({ canonical, legacy }))];
+  const pairs = MIRRORED_FILES.map(({ canonical, legacy }) => ({ canonical, legacy, epic: null }));
   // The per-epic PR ledger is renamed the same way, so it drifts the same way. It is not in
   // MIRRORED_FILES because that list is project-relative and this one exists once per epic.
   // `epicIds` reads with `withFileTypes`, so a dangling symlink is simply not a directory — it cannot
   // throw here and take the whole health check down, which is what the old `statSync` guard was for.
   for (const e of epicIds(root)) {
     const f = epicFiles(epicRel(e));
-    pairs.push({ canonical: f.productPrs, legacy: f.hubPrs });
+    pairs.push({ canonical: f.productPrs, legacy: f.productPrsLegacy, epic: e });
   }
-  for (const { canonical, legacy } of pairs) {
+  let kept = false;
+  for (const { canonical, legacy, epic } of pairs) {
     const a = path.join(root, canonical);
     const b = path.join(root, legacy);
     // Only the settings file reaches this branch in practice: the per-epic PR ledgers are top-level
@@ -946,13 +1189,20 @@ export function mirrorChecks(checks, root) {
       continue;
     }
     if (!exists(a)) continue;
-    let same;
-    try { same = fs.readFileSync(a, 'utf8') === fs.readFileSync(b, 'utf8'); } catch { continue; }
-    if (same) continue;
+    if (!mirrorDrift(a, b)) { if (!epic) kept = true; continue; }
+    // An epic's drifted pair is already a failure of that epic's own check (`loadLedger` refuses it,
+    // with the same code and hint), so it is not said twice.
+    if (epic) continue;
     check(
-      checks, `mirror:${canonical}`, 'shape', 'warn',
-      `${canonical} and ${legacy} do not match — ${legacy} is the one being read`,
-      'they are two names for one file while the rename settles. Copy the one you meant to keep over the other, then re-run the command that writes it',
+      checks, `mirror:${canonical}`, 'shape', 'fail',
+      `${canonical} and ${legacy} say different things — every command refuses until one is chosen [YAD-STATE-008]`,
+      'run `yad migrate` to see the difference, then `yad migrate --apply` to choose the copy to keep (or `--apply --keep product` / `--keep hub`)',
+    );
+  }
+  if (kept) {
+    check(
+      checks, 'mirror:legacy-names', 'shape', 'ok',
+      `${PROJECT_FILES.productConfigLegacy} (and each epic's hub-prs.json) is kept beside the new name for check gates an older yadflow installed — ${PROJECT_FILES.productConfig} is the one read, and v5 deletes the old name`,
     );
   }
 }
@@ -1643,7 +1893,7 @@ export function ownerChecks(checks, root) {
 // `\` goes on to the next, as a hand-edited copy may split `git … \ diff --name-only`; then each line is
 // cut at `&&`, `||`, `;` and `|`, so `fixed && \ blind` is two commands, not one.
 export const RENAME_BLIND_GATES = ['checks/contract-check.sh', 'checks/backfill-check.sh'];
-const renameBlindCommand = (c) => /\bgit\b.*\bdiff\b.*--name-only/.test(c) && !/--no-renames/.test(c);
+const renameBlindCommand = (c) => /\bgit\b.*\bdiff\b.*(--name-only|--raw)/.test(c) && !/--no-renames/.test(c);
 export const renameBlindText = (src) => src.split('\n').map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n')
   .replace(/\\\r?\n/g, ' ').split('\n').some((l) => l.split(/&&|\|\||;|\|/).some(renameBlindCommand));
 export function renameBlindGate(file) {
@@ -1652,34 +1902,138 @@ export function renameBlindGate(file) {
   return renameBlindText(src);
 }
 // E115: a contract-check that never reads the tree for links under specs/. Read like the one above — a
-// `#` line is prose, a line ending in `\` goes on — and it is enough that ONE command runs `git ls-tree`:
-// no older copy ever did, and the current one reads the whole tree (the name `specs` is in its awk).
+// `#` line is prose, a line ending in `\` goes on — and it is enough that ONE command runs `git ls-tree`
+// on HEAD: no older copy ever did, and the current one reads the whole tree (the name `specs` is in its
+// awk). HEAD, because E117 added a second `git ls-tree`, of the BASE, that finds sibling link.md files.
 export const symlinkBlindText = (src) => !src.split('\n').map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n')
-  .replace(/\\\r?\n/g, ' ').split('\n').some((l) => /\bgit\b.*\bls-tree\b/.test(l));
+  .replace(/\\\r?\n/g, ' ').split('\n').some((l) => /\bgit\b.*\bls-tree\b.*\bHEAD\b/.test(l));
 export function symlinkBlindGate(file) {
   let src;
   try { src = fs.readFileSync(file, 'utf8'); } catch { return false; }
   return symlinkBlindText(src);
 }
+// E116: a backfill-check that reads the spec from the PR's working tree, or never reads the tree at HEAD
+// for links under src/, or splits its --raw list with `tr`. Read like the ones above; no older copy ran
+// `git ls-tree` or `git cat-file`.
+export const backfillBlindText = (src) => {
+  const lines = src.split('\n').map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n').replace(/\\\r?\n/g, ' ').split('\n');
+  return !lines.some((l) => /\bgit\b.*\bls-tree\b.*\bHEAD\b/.test(l)) || !lines.some((l) => /\bgit\s+cat-file\s/.test(l))
+    // The first E116 copy split its --raw list into lines with `tr`, so one path with a newline hid every
+    // feature after it (review 1). The current one pairs the records NUL by NUL.
+    || lines.some((l) => /\bgit\b.*\bdiff\b.*--raw\b.*\|\s*tr\b/.test(l));
+};
+export function backfillBlindGate(file) {
+  let src;
+  try { src = fs.readFileSync(file, 'utf8'); } catch { return false; }
+  return backfillBlindText(src);
+}
+// E120: a Product-reading gate that never reads `.sdlc/product-link.json` (no non-comment command naming
+// it). Read like the ones above.
+export const productRecordBlindText = (src) => !src.split('\n').map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n')
+  .replace(/\\\r?\n/g, ' ').split('\n').some((l) => /\bgit\b.*product-link\.json/.test(l));
+export function productRecordBlindGate(file) {
+  let src;
+  try { src = fs.readFileSync(file, 'utf8'); } catch { return false; }
+  return productRecordBlindText(src);
+}
+// The checks workflows a connected repo may carry (one per platform).
+export const CHECK_WORKFLOWS = ['.github/workflows/yad-checks.yml', '.gitlab/ci/yad-checks.yml'];
+// E117: a Product-reading gate that does not read link.md from the base (`git show`) or a tracked Product
+// from the base commit (`git checkout-index`, from a throwaway index). Read like the two above; no older
+// copy ran either command.
+export const PRODUCT_PATH_GATES = ['checks/contract-check.sh', 'checks/lineage-check.sh', 'checks/epic-open.sh', 'checks/reconcile-debt-check.sh'];
+export const productPathBlindText = (src) => {
+  const lines = src.split('\n').map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n').replace(/\\\r?\n/g, ' ').split('\n');
+  return !lines.some((l) => /\bgit\s+show\s/.test(l)) || !lines.some((l) => /\bgit\s+checkout-index\s/.test(l));
+};
+export function productPathBlindGate(file) {
+  let src;
+  try { src = fs.readFileSync(file, 'utf8'); } catch { return false; }
+  return productPathBlindText(src);
+}
 
 // `owners:rename-blind` (E47). The wired `pr-title` / `pr-template` checks let a PR of step owner files alone
-// through; that is safe only while the hub-checks workflow lists renames by BOTH paths (`--no-renames`).
+// through; that is safe only while the product-checks workflow lists renames by BOTH paths (`--no-renames`).
 // `yad update` keeps a workflow the team changed by hand, so a Product can hold the new checks and the old
 // workflow — and then `git mv epic.md .sdlc/owners/epic.json` on a non-review branch passes. Say so.
-export const HUB_CHECK_WORKFLOWS = ['.github/workflows/yad-hub-checks.yml', '.gitlab/ci/yad-hub-checks.yml'];
+// The old names too (E123): an edited `yad-hub-checks.yml` is kept by `yad update`, and still runs.
 export function ownerGuardChecks(checks, root) {
   const read = (rel) => { try { return fs.readFileSync(path.join(root, rel), 'utf8'); } catch { return null; } };
   // The exemption's own pattern, not any mention of the folder: a comment is not a rule.
   const exempting = ['checks/pr-title.sh', 'checks/pr-template.sh'].filter((rel) => read(rel)?.includes('\\.sdlc/owners/[^/]+\\.json$'));
   if (!exempting.length) return;
   // Line by line: one fixed diff line must not hide its blind twin in the other job.
-  const blind = HUB_CHECK_WORKFLOWS.filter((rel) => renameBlindText(read(rel) || ''));
+  const blind = PRODUCT_CHECK_WORKFLOWS.filter((rel) => renameBlindText(read(rel) || ''));
   if (!blind.length) return;
   check(checks, 'owners:rename-blind', 'project', 'warn',
     `${blind.join(', ')} lists a PR's changes without \`--no-renames\`, while ${exempting.join(' and ')} let a PR of step owner files alone through — so moving an artifact into .sdlc/owners/ on a non-review branch passes both`,
     'add `--no-renames` (and `-c core.quotePath=false`) to that workflow\'s `git diff --name-only` lines, as the shipped one has — `yad update` did not replace it because it was changed by hand');
 }
 
+// Names the `hub` -> Product rename moved (E123), on the Product. Two kinds, both warnings:
+//   renamed:<old path>   something yad installed is still under its old name — a skill folder, or a CI
+//                        file. `yad update` renames it; an edited CI file it keeps, and says how to finish.
+//   renamed-ref:<file>   a file of the team's own names one of our old CI names, by file and line. yad
+//                        never edits those files; the one exception is the include line in the root
+//                        .gitlab-ci.yml, which `yad update` rewrites when it replaces the old fragment.
+// Silent when nothing old is left, so a project that never had the old names sees no line at all.
+export function renamedChecks(checks, root) {
+  if (!exists(productConfigPath(root))) return;
+  let installed = [];
+  // An unreadable provenance record or IDE target is named by its own check; this one then says nothing.
+  try { installed = [...legacyModuleActions(root), ...legacyProductActions(root)]; } catch { /* named elsewhere */ }
+  for (const a of installed) {
+    const { from, to } = a.rename;
+    check(checks, `renamed:${from}`, 'project', 'warn',
+      `${from} is an old name — renamed ${to}`,
+      a.status === 'modified'
+        ? `it was edited, so \`yad update\` keeps it: \`yad update --overwrite-local\` replaces it with ${to} (your copy is saved as ${path.basename(from)}${BACKUP_SUFFIX}); then copy your edits into ${to}`
+        : 'run `yad update` — it installs the new name and removes the old one');
+  }
+  const byFile = new Map();
+  // The same pairs every other command refuses on (`productDriftError`): then only `yad migrate` comes first.
+  const profileFirst = oldProfileAdvice(productGateBlockers(root, { drift: productDriftPairs(root) }));
+  for (const h of renamedNameHits(root)) {
+    if (!byFile.has(h.file)) byFile.set(h.file, []);
+    byFile.get(h.file).push(h);
+  }
+  for (const [file, hits] of byFile) {
+    const listed = hits.map((h) => `line ${h.line} \`${h.old}\` → \`${h.new}\``).join(', ');
+    const theirs = hits.filter((h) => !h.rewrittenBy);
+    // The include line is rewritten by yad — by a plain `yad update`, or, when the old fragment was edited,
+    // only by `--overwrite-local`. Until then the new fragment is not installed, so a hand edit of that line
+    // would include a file that is not there and fail every pipeline (review 1): say to leave it.
+    const late = hits.some((h) => h.rewrittenBy === 'overwrite-local');
+    const by = late ? '`yad update --overwrite-local`' : '`yad update`';
+    const all = theirs.length === hits.length;
+    // One mention per line, though a line may hold two old names (review 3).
+    const what = all ? (hits.length > 1 ? 'each' : 'it') : [...new Set(theirs.map((h) => h.line))].map((l) => `line ${l}`).join(', ');
+    const hint = theirs.length === 0
+      ? `${by} rewrites it when it replaces the old fragment${late ? ' — leave it until then: the new fragment is not installed before that' : ''}`
+      : `yad does not edit this file — change ${what} to ${!all && theirs.length > 1 ? 'their new names' : 'its new name'}${all ? '' : ` (${by} rewrites the include line itself${late ? ' — leave that one until then' : ''})`}${
+        // E124 reviews 2–3: a gate that would mishandle `product` must be fixed, or replaced, before the change.
+        hits.some((h) => h.profile && !h.rewrittenBy) && profileFirst ? `; ${profileFirst}` : ''}`;
+    check(checks, `renamed-ref:${file}`, 'project', 'warn',
+      `${file} names what 4.0 renamed: ${listed}`, hint);
+  }
+}
+
+// `profile:<gate>` (E123). A Product workflow passes `--profile product` to the pattern gates, and a gate the
+// team edited before 4.0 — which `yad update` keeps — accepts only `code|hub`, so every Product PR fails it.
+// A warning, like E123's other lines. Only when a workflow on disk passes that profile; an old workflow still
+// passing `hub` breaks nothing.
+export function productProfileChecks(checks, root) {
+  if (!exists(productConfigPath(root))) return;
+  const passing = workflowsPassingProduct(root);
+  if (!passing.length) return;
+  // What to do depends on the gate's state in the provenance record, as in `renamed-ref:` (E124 review 4).
+  for (const b of productGateBlockers(root, { drift: productDriftPairs(root) })) {
+    check(checks, `profile:${b.gate}`, 'project', 'warn',
+      productProfileEffect(b.gap, b.gate, `${passing.join(' and ')} ${passing.length > 1 ? 'pass' : 'passes'}`),
+      gateProfileFix(b));
+  }
+}
+
 // `.sdlc/skills.json`: which skill runs which step, when the project does not want the engine's
 // default (E6). Absent is the normal case and says nothing — most projects run the shipped skills.
 //
@@ -1910,27 +2264,30 @@ export function riskMapChecks(checks, root) {
   for (const repo of repos) {
     if (!repo || typeof repo.name !== 'string' || typeof repo.path !== 'string' || !repo.path) continue;
     const repoRoot = path.resolve(root, repo.path);
-    if (!exists(repoRoot) || !gitHead(repoRoot)) continue;
+    if (!isCheckout(root, repo) || !gitHead(repoRoot)) continue;
     const r = checkRepo(repoRoot);
     if (!r.git) continue;
     const id = `risk-map:${repo.name}`;
+    // Printed (E81 review 11): the name in prose through `shown`, and in a command to copy only as a plain word.
+    const nm = forTerminal(repo.name);
+    const arg = asArg(repo.name);
     if (!r.map) {
-      check(checks, id, 'risk-map', 'ok', `${repo.name}: no ${RISK_MAP_FILE} yet — no directory has a risk level (\`yad risk-map draft ${repo.name}\` starts one)`);
+      check(checks, id, 'risk-map', 'ok', `${nm}: no ${RISK_MAP_FILE} yet — no directory has a risk level (\`yad risk-map draft ${arg}\` starts one)`);
       continue;
     }
-    if (!r.findings.length) { check(checks, id, 'risk-map', 'ok', `${repo.name}: every directory has a confirmed level`); continue; }
+    if (!r.findings.length) { check(checks, id, 'risk-map', 'ok', `${nm}: every directory has a confirmed level`); continue; }
     const groups = [];
     for (const f of r.findings) {
       let g = groups.find((x) => x.code === f.code);
       if (!g) { g = { code: f.code, targets: [] }; groups.push(g); }
-      if (f.target) g.targets.push(f.target);
+      if (f.target) g.targets.push(forTerminal(f.target));   // a folder name from the repo's own tree (E81 review 13)
     }
     const said = groups.map((g) => {
       const shown = g.targets.slice(0, 3).join(', ') + (g.targets.length > 3 ? ` +${g.targets.length - 3} more` : '');
       return `${g.code}${shown ? ` (${shown})` : ''}`;
     }).join('; ');
-    check(checks, id, 'risk-map', 'warn', `${repo.name}: ${RISK_MAP_FILE} is out of date — ${said}`,
-      `\`yad risk-map check ${repo.name}\` lists each one; fix the map in ${repo.name} through a PR (advisory — it blocks nothing)`,
+    check(checks, id, 'risk-map', 'warn', `${nm}: ${RISK_MAP_FILE} is out of date — ${said}`,
+      `\`yad risk-map check ${arg}\` lists each one; fix the map in ${nm} through a PR (advisory — it blocks nothing)`,
       { findings: r.findings });
   }
 }
@@ -1946,15 +2303,16 @@ export function codeownersChecks(checks, root) {
   for (const repo of repos) {
     if (!repo || typeof repo.name !== 'string' || typeof repo.path !== 'string' || !repo.path) continue;
     const repoRoot = path.resolve(root, repo.path);
-    if (!exists(repoRoot) || !gitHead(repoRoot)) continue;
+    if (!isCheckout(root, repo) || !gitHead(repoRoot)) continue;
     const r = checkCodeowners(repoRoot, { platform: repo.platform || null });
     if (!r.git) continue;
     const id = `codeowners:${repo.name}`;
-    const more = `\`yad codeowners check ${repo.name}\``;
-    if (r.unknown) { check(checks, id, 'codeowners', 'warn', `${repo.name}: CODEOWNERS could not be checked — ${r.unknown}`, more); continue; }
-    if (r.none) { check(checks, id, 'codeowners', 'ok', `${repo.name}: no CODEOWNERS — nothing to check`); continue; }
+    const nm = forTerminal(repo.name);   // printed as in riskMapChecks (E81 review 11)
+    const more = `\`yad codeowners check ${asArg(repo.name)}\``;
+    if (r.unknown) { check(checks, id, 'codeowners', 'warn', `${nm}: CODEOWNERS could not be checked — ${forTerminal(r.unknown)}`, more); continue; }
+    if (r.none) { check(checks, id, 'codeowners', 'ok', `${nm}: no CODEOWNERS — nothing to check`); continue; }
     const findings = codeownersFindings(r);
-    if (!findings.length) { check(checks, id, 'codeowners', 'ok', `${repo.name}: every ${r.path} line yad can read matches a file`); continue; }
+    if (!findings.length) { check(checks, id, 'codeowners', 'ok', `${nm}: every ${r.path} line yad can read matches a file`); continue; }
     const lines = (code) => findings.filter((f) => f.code === code).map((f) => f.line);
     const listed = (ns) => ns.slice(0, 3).join(', ') + (ns.length > 3 ? ` +${ns.length - 3} more` : '');
     const said = [];
@@ -1964,13 +2322,13 @@ export function codeownersChecks(checks, root) {
     if (dead.length) said.push(`in ${r.path}, ${dead.length === 1 ? '1 line matches' : `${dead.length} lines match`} no file (line${dead.length === 1 ? '' : 's'} ${listed(dead)})`);
     const unread = lines('not-read');
     if (unread.length) said.push(`in ${r.path}, ${unread.length === 1 ? '1 line' : `${unread.length} lines`} yad could not read (line${unread.length === 1 ? '' : 's'} ${listed(unread)})`);
-    check(checks, id, 'codeowners', 'warn', `${repo.name}: CODEOWNERS may be out of date — ${said.join('; ')}`,
-      `${more} lists each one; fix it in ${repo.name} through a PR (advisory — CODEOWNERS is a hint, and yad never enforces it)`,
+    check(checks, id, 'codeowners', 'warn', `${nm}: CODEOWNERS may be out of date — ${said.join('; ')}`,
+      `${more} lists each one; fix it in ${nm} through a PR (advisory — CODEOWNERS is a hint, and yad never enforces it)`,
       { findings });
   }
 }
 
-// E70 — what the platform holds on the Product hub's branch and on each connected repo's: branch
+// E70 — what the platform holds on the Product's branch and on each connected repo's: branch
 // protection, and whether a rule requires an approval before a merge (cli/protection.mjs). Never quiet
 // (rule 6): every repo gets a line, and a read that failed says "not known" and why — never "fine", never
 // "unprotected". Advisory, like E69: a warning at most, never a failure — the platform holds a merge, not
@@ -1979,8 +2337,8 @@ export function codeownersChecks(checks, root) {
 // the branch gates merge into; with none, the platform's own default is read and the line says so.
 export function protectionChecks(checks, root, { runner, env } = {}) {
   const productPath = productConfigPath(root);
-  const hub = readJSON(productPath, null);
-  const solo = isSolo(hub);
+  const productConfig = readJSON(productPath, null);
+  const solo = isSolo(productConfig);
   // One login check per host for this run, and never longer: a login can change between runs.
   const opts = { ...(runner ? { runner } : {}), ...(env ? { env } : {}), authCache: new Map() };
   const origin = (cwd) => run('git', ['remote', 'get-url', 'origin'], { cwd }).stdout || null;
@@ -1989,12 +2347,12 @@ export function protectionChecks(checks, root, { runner, env } = {}) {
     const line = protectionLine(r, { name, solo });
     check(checks, id, 'protection', line.status, line.message, line.hint || '', { protection: protectionJSON(r), alwaysHint: true });
   };
-  if (isPlainObject(hub)) {
-    // `protection` alone, never `protection:hub`: a connected repo may be named `hub`.
-    emit('protection', 'Product hub', {
-      platform: hub.platform || null,
-      gitUrl: hub.git_url || origin(root),
-      branch: typeof hub.default_branch === 'string' && hub.default_branch ? hub.default_branch : null,
+  if (isPlainObject(productConfig)) {
+    // `protection` alone, never `protection:product`: a connected repo may be named `product`.
+    emit('protection', 'Product', {
+      platform: productConfig.platform || null,
+      gitUrl: productConfig.git_url || origin(root),
+      branch: typeof productConfig.default_branch === 'string' && productConfig.default_branch ? productConfig.default_branch : null,
     });
   }
   const registry = readJSON(path.join(root, PROJECT_FILES.reposRegistry), { repos: [] });
@@ -2002,10 +2360,10 @@ export function protectionChecks(checks, root, { runner, env } = {}) {
   for (const [i, repo] of repos.entries()) {
     if (!repo || typeof repo.name !== 'string' || !repo.name) continue;
     const repoRoot = typeof repo.path === 'string' && repo.path ? path.resolve(root, repo.path) : null;
-    const onDisk = repoRoot && exists(repoRoot) && gitHead(repoRoot);
+    const onDisk = repoRoot && isCheckout(root, repo) && gitHead(repoRoot);
     // A name with an `@` is hidden in the id too; its place in repos.json keeps the id one word. Nothing
     // validates a repo's name, so a repo literally named `#1` could take the same id — it only labels a line.
-    emit(hideAddresses(repo.name) === repo.name ? `protection:${repo.name}` : `protection:#${i + 1}`, repo.name, {
+    emit(hideAddresses(repo.name) === repo.name ? `protection:${repo.name}` : `protection:#${i + 1}`, forTerminal(repo.name), {
       platform: repo.platform || null,
       gitUrl: (typeof repo.git_url === 'string' && repo.git_url) || (onDisk ? origin(repoRoot) : null),
       branch: typeof repo.default_branch === 'string' && repo.default_branch ? repo.default_branch : null,
@@ -2052,8 +2410,8 @@ export function indexChecks(checks, root) {
   if (!exists(productConfigPath(root))) return;
   const fresh = indexFreshness(root);
   if (fresh.state === 'none') return; // no work items and no index: nothing to be behind
-  const hubNow = readJSON(productConfigPath(root), null);
-  const verified = isVerifiedLedger(hubNow);
+  const productConfigNow = readJSON(productConfigPath(root), null);
+  const verified = isVerifiedLedger(productConfigNow);
   const hint = verified
     ? 'CI rebuilds it when it records the next merged review; on a verified Product a local write could not be committed'
     : 'run `yad index` on the default branch, then commit it';
@@ -2067,9 +2425,9 @@ export function indexChecks(checks, root) {
   if (fresh.state !== 'unreadable' && exists(path.join(root, '.git'))) {
     const git = productGit(root);
     const head = git('rev-parse', '--abbrev-ref', 'HEAD');
-    const main = resolveDefaultBranch(git, hubNow);
+    const main = resolveDefaultBranch(git, productConfigNow);
     if (head.ok && head.stdout && head.stdout !== main) {
-      check(checks, 'index', 'index', 'ok', `${INDEX_FILE} ${fresh.state === 'missing' ? 'is not built yet' : 'is not what this yadflow builds from the work items on this branch'} — expected on '${head.stdout}': it is written on '${main}' only, once this work merges`);
+      check(checks, 'index', 'index', 'ok', `${INDEX_FILE} ${fresh.state === 'missing' ? 'is not built yet' : 'is not what this yadflow builds from the work items on this branch'} — expected on '${head.stdout}': it is written on '${forTerminal(main)}' only, once this work merges`);
       return;
     }
   }
@@ -2110,6 +2468,8 @@ export function collectDoctor(root, { headCount = null } = {}) {
   stepStateChecks(checks, root);
   ownerChecks(checks, root);
   ownerGuardChecks(checks, root);
+  renamedChecks(checks, root);
+  productProfileChecks(checks, root);
   phaseChecks(checks, root);
   laneChecks(checks, root);
   epicChecks(checks, root);
@@ -2130,13 +2490,18 @@ export async function runDoctor(root, { json = false, headCount = null } = {}) {
   } else {
     log(c.bold(`\nyad doctor  ${c.dim('v' + VERSION)}`));
     let section = '';
+    // E48: the `protection` section ends with where to read how to set protection up, once, when any of
+    // its lines warns. Text only — `--json` keeps its shape.
+    const protectionWarns = checks.some((x) => x.section === 'protection' && x.status === 'warn');
+    const guide = () => { if (section === 'protection' && protectionWarns) hand(`how to set branch protection up for yad: ${PROTECTION_GUIDE_URL}`); };
     for (const x of checks) {
-      if (x.section !== section) { section = x.section; log(`\n  ${c.bold(section)}`); }
+      if (x.section !== section) { guide(); section = x.section; log(`\n  ${c.bold(section)}`); }
       ({ ok, warn, fail })[x.status](x.message);
       // A check may ask for its hint whatever its level (`alwaysHint`): an E70 `protection` line is `ok` in
       // solo mode even when the platform could not be read, and its hint is the fix ("run `gh auth login` …").
       if (x.hint && (x.status !== 'ok' || x.alwaysHint)) hand(x.hint);
     }
+    guide();
     log('');
     if (failed.length) fail(`${failed.length} problem(s) found`);
     else if (warned.length) info(`healthy with ${warned.length} warning(s)`);
@@ -2146,6 +2511,20 @@ export async function runDoctor(root, { json = false, headCount = null } = {}) {
   return { ok: failed.length === 0, failed: failed.length, warned: warned.length, checks };
 }
 
+// Line endings on Windows (E113). With `core.autocrlf=true` — the Git for Windows default — git checks
+// every text file out with CRLF. The managed files cope (they are compared line endings aside), but an
+// artifact's approval is bound to its exact bytes: a review approved on LF bytes reads as stale in a CRLF
+// checkout, and an approval recorded there binds bytes CI never sees. So on Windows it is named, with the
+// one setting that avoids it. Silent everywhere else, and when git cannot be asked.
+export function lineEndingChecks(root, checks, { platform = process.platform, runner = run } = {}) {
+  if (platform !== 'win32') return;
+  const r = runner('git', ['-C', root, 'config', '--get', 'core.autocrlf']);
+  if (!r.ok || r.stdout.trim().toLowerCase() !== 'true') return;
+  check(checks, 'line-endings', 'project', 'warn', 'git checks text out here with CRLF line endings (core.autocrlf=true) — an approval is bound to an artifact\'s exact bytes, so reviews approved elsewhere read as stale here',
+    // Three separate commands, not joined with `&&`: Windows PowerShell 5.1, the default shell there, has no `&&`.
+    'commit or stash your work first, then run `git config core.autocrlf input`, then `git rm --cached -r . -q`, then `git reset --hard` — the files come back with LF. `git config --global core.autocrlf input` does the same for every future clone');
+}
+
 // The capture half of `yad doctor` (E43). Three facts: whether capture is on, whether every IDE target with
 // a post-edit protocol runs it, and which of the team's OWN GitHub workflows start on a push to any branch —
 // those run on every `yad/wip/*` push. yadflow's own templates exclude the branches; a team's file is theirs,
@@ -2156,7 +2535,7 @@ export function captureChecks(root, checks, cfg) {
     return;
   }
   const unwired = [];
-  if (!hookScriptReady(root, 'hooks/yad-capture.sh')) unwired.push('hooks/yad-capture.sh');
+  for (const w of CAPTURE_WIRING) if (!hookScriptReady(root, w.dest)) unwired.push(w.dest);
   const targets = ideTargetsFor(root);
   const safe = new Set(safeIdeTargetStateFor(root, targets).targets);
   const noProtocol = [];
@@ -2180,7 +2559,7 @@ export function captureChecks(root, checks, cfg) {
     // could never be cleared by doing what it asks, so it is said as a fact.
     check(checks, 'capture', 'project', 'ok', `wip capture is by hand here — no IDE target (${noProtocol.join(', ')}) has a post-edit hook yad wires; run \`yad capture\` after editing`);
   } else {
-    check(checks, 'capture', 'project', 'ok', `wip capture wired (hooks/yad-capture.sh)${byHand}`);
+    check(checks, 'capture', 'project', 'ok', `wip capture wired (${CAPTURE_WIRING.map((w) => w.dest).join(', ')})${byHand}`);
   }
   const noisy = pushOnEveryBranch(root);
   if (noisy.length) {
@@ -2274,3 +2653,40 @@ export function pushOnEveryBranch(root) {
   }
   return out;
 }
+
+// The workspace file (E80): lets yad find this Product from its code repos. Only for a Product whose
+// registered repos live beside it — per machine, so a teammate who cloned by hand has none.
+function workspaceFileCheck(root, checks) {
+  if (!hasSiblingRepo(root)) return;
+  const st = workspaceFileState(root);
+  if (st === 'ok') check(checks, 'workspace-file', 'project', 'ok', `${WORKSPACE_FILE} beside the Product — yad finds it from the code repos`);
+  else if (st === 'missing') check(checks, 'workspace-file', 'project', 'warn', `no ${WORKSPACE_FILE} beside the Product — run from a code repo, yad does not find the Product`, 'run `yad check --fix` (it writes the file on this machine only)');
+  else check(checks, 'workspace-file', 'project', 'warn', `${WORKSPACE_FILE} not usable: ${st.replace(/^other: /, '')}`, 'run yad from the Product, or pass --dir <the Product>');
+}
+
+// The person's half of the ledger guard (E48): this clone's git pre-commit hook. Per clone, because git
+// never commits `.git/hooks` — so a teammate who pulled a verified Product has none until their own
+// `yad check --fix`, and this line is how they find out.
+function gitHookCheck(root, checks) {
+  const st = gitHookState(root);
+  if (!st.applies) return;
+  const where = path.relative(root, st.file).split(path.sep).join('/');
+  if (st.state === 'hooks-path' || st.state === 'foreign') {
+    // yad writes neither: a folder core.hooksPath names is usually committed and owned by a tool, and a
+    // hook without yad's marker line is the team's. The person adds one line instead.
+    const why = st.state === 'hooks-path' ? `core.hooksPath is set (${st.hooksPath}), so hooks are run from there` : `${where} is not yad's, so yad left it alone`;
+    const into = st.state === 'hooks-path' ? st.editFile : `${where} (and again if a tool rewrites it)`;
+    check(checks, 'git-hook', 'project', 'warn', `git pre-commit ledger guard not installed: ${why}`, `add this line to ${into}: ${st.line}`);
+  } else if (st.state === 'missing') {
+    check(checks, 'git-hook', 'project', 'warn', 'git pre-commit ledger guard not installed in this clone',
+      'run `yad check --fix` — until then a hand `git commit` that changes the CI-owned ledger is refused only by CI, after the push');
+  } else if (st.state === 'outdated' && st.why === 'not-executable') {
+    check(checks, 'git-hook', 'project', 'warn', `git pre-commit ledger guard installed but not executable (${where}) — git skips it`,
+      'run `yad check --fix`, which restores the execute bit');
+  } else if (st.state === 'outdated') {
+    check(checks, 'git-hook', 'project', 'warn', `git pre-commit ledger guard out of date (${where})`,
+      'run `yad check --fix` — it saves the current file beside it before replacing it');
+  } else {
+    check(checks, 'git-hook', 'project', 'ok', `git pre-commit ledger guard installed in this clone (${where})`);
+  }
+}