boost-skill-cli 1.2.121__tar.gz → 1.2.123__tar.gz

{boost_skill_cli-1.2.121/boost_skill_cli.egg-info → boost_skill_cli-1.2.123}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.121
+Version: 1.2.123
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.2.121'
-__version_tuple__ = version_tuple = (1, 2, 121)
+__version__ = version = '1.2.123'
+__version_tuple__ = version_tuple = (1, 2, 123)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/boost_cli/commands/pkg.py

@@ -619,6 +619,7 @@ _PLAN_LABELS = [
     ("blocked_links", "agent links blocked by a foreign file"),
     ("stale_links", "stale links"),
     ("orphaned_store", "orphaned store dirs"),
+    ("unrecorded_store", "store dirs the lock file has lost"),
     ("missing_materializations", "missing rule/workflow files"),
     ("out_of_scope_links", "linked outside declared scope"),
 ]
@@ -711,17 +712,26 @@ def cmd_sync(argv: list[str]) -> int:
                 journal.log("prune", name)
                 pruned.append(name)
     left = [n for n in orphans if n not in pruned]
+    # Re-recorded by sync_apply when the lock was merely missing; still here
+    # only when it is corrupt or in another schema, which sync never overwrites.
+    unrecorded = [n for n in plan["unrecorded_store"]
+                  if lockfile.get_skill(n) is None]
     blocked = plan["blocked_links"]
     if args.json:
         # `sync --diff --json` above is indent=2; this printed one unindented
         # line, so the two `--json` shapes of the same command disagreed on
         # style for no reason tied to their content.
         print(json.dumps({"actions": actions, "pruned": pruned,
-                          "orphaned_store": left, "out_of_scope_links": oos,
+                          "orphaned_store": left, "unrecorded_store": unrecorded,
+                          "out_of_scope_links": oos,
                           "blocked_links": blocked}, indent=2))
         return 0
     for a in actions:
         out.ok(a)
+    if unrecorded:
+        out.warn("%s the lock file cannot record, left as they are: %s — "
+                 "restore the lock with `boost replay`"
+                 % (_plural(len(unrecorded), "store dir"), ", ".join(unrecorded)))
     for name in pruned:
         out.ok("pruned %s" % _tilde(store.skill_store_dir(name)))
     if left:

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/boost_cli/commands/quality.py

@@ -447,8 +447,8 @@ def cmd_doctor(argv):
         if store.has_content():
             n = sum(1 for c in paths.store_dir().iterdir()
                     if c.is_dir() and not c.name.startswith("."))
-            bad("lockfile", "lock file missing — %d store dir%s unrecorded, run `boost sync`"
-                % (n, _s(n)))
+            bad("lockfile", "lock file missing — %d store dir%s unrecorded, "
+                "run `boost sync` to re-record %s" % (n, _s(n), "it" if n == 1 else "them"))
             lock_ok = False
         else:
             rep.note("lockfile", "no lock file yet — nothing installed")
@@ -613,7 +613,10 @@ def cmd_doctor(argv):
     orphans = [c.name for c in sorted(root.iterdir())
                if c.is_dir() and not c.name.startswith(".") and c.name not in skills
                ] if root.is_dir() else []
-    if orphans:
+    # Only while the lock can vouch. Without one every store dir reads as an
+    # orphan, the lock line above already names the state and its remedy, and
+    # a second "run `boost sync`" line counted the same fault twice.
+    if orphans and store.lock_vouches():
         bad("orphans", "%d orphaned store dir%s (%s) — run `boost sync`"
             % (len(orphans), _s(len(orphans)), ", ".join(orphans[:5])))
 
@@ -1104,6 +1107,9 @@ def cmd_heal(argv):
         for name in plan["missing_store"]:
             out.info("would restore %s from its tap (or drop it from the lock)" % name)
             actions.append("restore %s" % name)
+        for name in plan["unrecorded_store"]:
+            out.info("would re-record %s, which the lock file has lost" % name)
+            actions.append("re-record %s" % name)
     else:
         for msg in store.sync_apply(plan):
             out.ok(msg.replace(str(paths.home()), "~"))

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/boost_cli/core/store.py

@@ -1680,6 +1680,21 @@ def restore_preserve_newer_lock_sections(
     return kept
 
 
+def lock_vouches() -> bool:
+    """Whether the lock file can say which store dirs and links are boost's.
+
+    It can when it parses, and when it is missing over an empty store — that
+    is a fresh install with nothing to disown. It cannot when it is missing
+    over a populated store, corrupt, or written in another schema:
+    :func:`lockfile.installed` collapses all three into an empty record, and
+    reading that as "nothing is installed" turned `boost sync` — the command
+    `boost doctor` prescribes for exactly this state — into an uninstaller that
+    removed every live link of an intact install with green ticks and exit 0.
+    """
+    integ = lockfile.check()
+    return integ.ok or (integ.problem == "missing" and not has_content())
+
+
 def sync_plan() -> dict[str, list]:
     """Compare lock file <-> store <-> agent symlinks.
 
@@ -1691,6 +1706,9 @@ def sync_plan() -> dict[str, list]:
                       symlink occupies the link path — sync will not clobber it
       stale_links:    paths in agent dirs that are broken/unmanaged symlinks
       orphaned_store: store dirs not present in the lock file
+      unrecorded_store: the same, while the lock cannot vouch for anything
+                      (:func:`lock_vouches`) — never pruned, re-recorded by
+                      :func:`sync_apply` when the lock is merely missing
       out_of_scope_links: (skill, agent) pairs linked outside a declared
                       ``--agent`` narrowing — reported, never auto-removed
 
@@ -1704,9 +1722,11 @@ def sync_plan() -> dict[str, list]:
     as a directory: a closed loop with no exit.
     """
     lock = lockfile.installed()
+    vouches = lock_vouches()
     plan: dict[str, list] = {"missing_store": [], "missing_links": [],
             "blocked_links": [], "stale_links": [], "orphaned_store": [],
-            "missing_materializations": [], "out_of_scope_links": []}
+            "unrecorded_store": [], "missing_materializations": [],
+            "out_of_scope_links": []}
     for name, entry in lock.items():
         sdir = skill_store_dir(name)
         # A directory with no SKILL.md counts as missing, not as healthy. The
@@ -1780,9 +1800,11 @@ def sync_plan() -> dict[str, list]:
                     plan["out_of_scope_links"].append((name, agent))
     store_root = paths.store_dir()
     if store_root.is_dir():
-        for child in store_root.iterdir():
-            if child.is_dir() and child.name not in lock:
-                plan["orphaned_store"].append(child.name)
+        for child in sorted(store_root.iterdir()):
+            if (child.is_dir() and not child.name.startswith(".")
+                    and child.name not in lock):
+                plan["orphaned_store" if vouches else "unrecorded_store"].append(
+                    child.name)
     for adir in agents.enabled_agents().values():
         if not adir.is_dir():
             continue
@@ -1790,8 +1812,13 @@ def sync_plan() -> dict[str, list]:
             # Ownership first, for broken links too: the old test short-circuited
             # on `not link.exists()`, so any dangling symlink a user happened to
             # keep in ~/.claude/skills was swept up by `boost sync`.
+            #
+            # "Not in the lock" means "not installed" only while the lock can
+            # vouch. Without that guard a missing lock made every live link
+            # into an intact store look stale, and sync removed them all.
             if (link.is_symlink() and points_into_store(link)
-                    and (not link.exists() or link.name not in lock)):
+                    and (not link.exists()
+                         or (vouches and link.name not in lock))):
                 plan["stale_links"].append(str(link))
     # Rules/workflows don't live in the store — they materialize into agent dirs.
     # A materialization whose file (or CLAUDE.md block) is gone can be repaired
@@ -1893,9 +1920,71 @@ def _pinned_repair_blocked(entry: dict, source_sha: str | None) -> bool:
     return source_sha is None or source_sha != entry.get("sha256")
 
 
+def recover_unrecorded(name: str) -> str | None:
+    """Re-record one store dir the lock has lost; return how, or None.
+
+    Only ever called while the lock file is missing over a populated store, so
+    writing a record cannot overwrite a newer or merely unreadable lock. The
+    store copy is authoritative and is never replaced: re-installing would
+    have been the obvious repair, and it silently discards any edits made to
+    the store copy.
+
+    A dir whose content is byte-identical to exactly one tapped source is
+    recorded as installed from that tap, the record a fresh install would have
+    written. Anything else — edited, or from a tap no longer tapped — is
+    recorded as a local skill whose source is the store dir itself, so nothing
+    is lost and nothing is left unrecorded: a dir left out would read as an
+    orphan the moment this pass creates a lock, and the next sync would remove
+    its links, the defect this function exists to close.
+    """
+    sdir = skill_store_dir(name)
+    if not (sdir / "SKILL.md").is_file():
+        return None
+    from . import catalog, gitutil
+    have = util.sha256_dir(sdir)
+    matches = [e for e in catalog.find(name)
+               if e.get("kind", "skill") == "skill"
+               and _skill_source_sha(e) == have]
+    linked = linked_agents(name)
+    linking = list(agents.linking_agents())
+    # Record what is on disk: a skill linked into fewer agents than are enabled
+    # was narrowed, and recording no narrowing would have the next sync link it
+    # everywhere behind the user's back.
+    narrowed = sorted(linked) if linked and set(linked) != set(linking) else None
+    now = util.now_iso()
+    record: dict[str, object]
+    if len(matches) == 1:
+        cat = matches[0]
+        tap = registry.get(cat["tap"])
+        record = {"version": cat.get("version", "0.0.0"), "tap": cat["tap"],
+                  "source_dir": cat.get("rel_dir", "."),
+                  "commit": gitutil.head_commit(tap.path)}
+        how = "from %s" % cat["tap"]
+    else:
+        # The shape `import_local` writes for a skill with no tap behind it.
+        record = {"version": "0.0.0", "tap": "local", "source_dir": str(sdir),
+                  "commit": ""}
+        how = ("as a local skill (its content matches %s tapped source; "
+               "`boost reinstall %s` replaces it with a tap's copy)"
+               % ("no" if not matches else "more than one", name))
+    record.update({"sha256": have, "installed_at": now, "updated_at": now,
+                   "pinned": False, "quarantined": False, "agents": linked,
+                   "only_agents": narrowed, "tags": []})
+    lockfile.set_skill(name, record)
+    journal.log("recover", name, how=record["tap"])
+    return "re-recorded %s %s" % (name, how)
+
+
 def sync_apply(plan: dict[str, list]) -> list[str]:
     """Fix what sync_plan found. Returns human-readable actions taken."""
     actions = []
+    # First, so every re-recorded skill is in the lock before anything else
+    # runs; and only when the lock is *missing* — a corrupt or other-schema
+    # lock is left for `boost replay`, never overwritten.
+    if plan.get("unrecorded_store") and lockfile.check().problem == "missing":
+        for name in plan["unrecorded_store"]:
+            how = recover_unrecorded(name)
+            actions.append(how or "left %s unrecorded (no SKILL.md to record)" % name)
     for name, agent in plan["missing_links"]:
         res = link_agents(name, only=[agent])
         if agent in res.linked:

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.2.121
+Version: 1.2.123
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License-Expression: Apache-2.0

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/boost_skill_cli.egg-info/SOURCES.txt

@@ -1018,6 +1018,7 @@ tests/unit/test_staleness.py
 tests/unit/test_store.py
 tests/unit/test_store_materialize.py
 tests/unit/test_sync_blocked_links.py
+tests/unit/test_sync_lost_lock.py
 tests/unit/test_sync_repairs_gutted_skill.py
 tests/unit/test_tap_pins.py
 tests/unit/test_token_parity.py

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/docs/roadmap/items/bmad-personas-delegate-outside-the-router.md

@@ -79,3 +79,5 @@ description lacks <code>proactively</code> in any case and contains its persona'
 and no unit test can observe delegation, so the headless run is the acceptance check. Only re-running
 <code>boost bmad on</code> rewrites unedited persona files (<code>boost_cli/core/bmad.py:672</code>), so the
 release note must tell users to re-run it.
+
+<b>Measured after #865 shipped, and it does not show the defect.</b> The headless run above, 12 router-trivial prompts per arm (the 3 fixtures plus 9 trivial prompts from one real history), counted <code>bmad-*</code> spawns by the main agent: <b>0/12 with no personas, 0/12 with the shipped <code>Use PROACTIVELY</code> descriptions, 0/12 with the fixed ones</b>. At 0/12 the 95% Wilson upper bound is 24%, so this rules out a common spawn, not a rare one. The shipped arm spawned no more than the no-persona arm, which is this card's own stop condition: the fix is harmless, and there was no delegation for it to remove. Two limits. Each run stopped after 4 main-agent tool calls, and 7 of the 12 shipped-arm runs hit that cap, so a spawn later in a long session would not be counted. And the fourth arm, routed prompts with the real hook, measured nothing: in the nested sandboxed session the hooks failed with <code>EPERM</code>, all 6 runs ended in about a second, and no banner reached the context. So whether the fixed wording still delegates when a banner names the persona is <b>not established</b>; re-run that arm outside a sandbox. Cost: $6.20 over the runs that reported one, a floor, since runs stopped early report none.

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/docs/roadmap/items/doctor-prescribes-sync-that-deletes-live-links.md

@@ -1,16 +1,16 @@
 ---
 id: doctor-prescribes-sync-that-deletes-live-links
 board: code
-section: planned
-status: planned
+section: health
+status: shipped
 category: Onboarding · Bug
 complexity: L
 impact: High
 wow: 4
 note: store.sync_plan decides staleness with link.name not in lock where lock = lockfile.in…
 order: 206
-owner:
-pr:
+owner: loop/sync-keeps-live-links
+pr: 869
 title: A missing or corrupt lock file makes doctor prescribe <code>boost sync</code>/<code>boost heal</code>, and both delete every live agent symlink of an intact install
 ---
 <b>Measured.</b> With the lock file deleted from an otherwise intact install, <code>boost doctor</code> exits 1 and prescribes <code>boost sync</code> on two separate lines; running that prescription removes 4 of 4 live, boost-owned, store-resolving agent symlinks (claude-code, windsurf, cursor, antigravity) with four green ✓ marks, no confirmation prompt of any kind, and exit code 0 — because <code>store.sync_plan</code> (store.py:1785-1787) tests <code>link.name not in lock</code> against <code>lockfile.installed()</code>, which collapses a missing lock into an empty skeleton (lockfile.py:44-45), and <code>sync_apply</code>'s unlink loop (store.py:1895) has no confirm while cmd_sync's only two confirms (pkg.py:694, 704) are both <code>--prune</code>-gated.
@@ -46,3 +46,5 @@ NOT A DUPLICATE — I re-checked all 432 items independently rather than trustin
 <b>Why it is worth doing.</b> This is the recovery surface behaving as a destroyer at the exact moment a user reaches for it. The lock file is the one file with no atomic-write protection story a new user knows about (an interrupted install, a full disk, a bad restore), the skill on disk and its four agent links are all still correct, and the single command doctor prints — twice — silently uninstalls it from Claude Code, Cursor, Windsurf and Antigravity, exits 0, and calls the result healthy two commands later. The one command that actually recovers (<code>boost install &lt;name&gt;</code>) is never mentioned, and the corrupt-lock alternative (<code>boost replay</code>) is empty on any machine with a single install — i.e.
 
 <em>Found by an automated audit of retrieval/eval quality, the search &amp; browse surfaces, and first-run onboarding; every finding was then re-measured from scratch by an independent adversarial verifier whose instruction was to refute it. Verdict: <b>CORRECTED</b>. No fix is prescribed here — the measurement is the contribution.</em>
+
+<b>Fixed.</b> The lock is authoritative only while it can vouch (<code>store.lock_vouches</code>): a missing lock over a populated store, a corrupt one or one in another schema cannot, and then nothing it lacks is a stale link or an orphan — the store dirs are reported as <code>unrecorded_store</code>, which <code>--prune</code> never touches. A merely <em>missing</em> lock is rebuilt by <code>boost sync</code> from what is on disk: a dir byte-identical to exactly one tapped source is re-recorded from that tap, anything else as a local skill whose source is the store copy (reinstalling was the obvious repair, and it silently discards edits), and a narrowed install keeps its narrowing. A corrupt lock is never overwritten; sync leaves the links alone and points at <code>boost replay</code>. Re-running the reproduction above: sync prints <code>re-recorded brainstorming from …</code> and all four links survive.

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/docs/roadmap.html

@@ -132,7 +132,7 @@
       <!-- ROADMAP:stats -->
       <div class="stat"><b>20</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
-      <div class="stat"><b>54</b><span>Planned</span></div>
+      <div class="stat"><b>53</b><span>Planned</span></div>
       <div class="stat"><b>468</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
@@ -1293,50 +1293,6 @@ PRIOR DISCLOSURE (the finder declared it, and I confirmed it): docs/roadmap/item
         </div>
       </article>
 
-      <article class="cap rcard" id="doctor-prescribes-sync-that-deletes-live-links">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Onboarding · Bug</span></div>
-        <h3>A missing or corrupt lock file makes doctor prescribe <code>boost sync</code>/<code>boost heal</code>, and both delete every live agent symlink of an intact install</h3>
-        <p><b>Measured.</b> With the lock file deleted from an otherwise intact install, <code>boost doctor</code> exits 1 and prescribes <code>boost sync</code> on two separate lines; running that prescription removes 4 of 4 live, boost-owned, store-resolving agent symlinks (claude-code, windsurf, cursor, antigravity) with four green ✓ marks, no confirmation prompt of any kind, and exit code 0 — because <code>store.sync_plan</code> (store.py:1785-1787) tests <code>link.name not in lock</code> against <code>lockfile.installed()</code>, which collapses a missing lock into an empty skeleton (lockfile.py:44-45), and <code>sync_apply</code>'s unlink loop (store.py:1895) has no confirm while cmd_sync's only two confirms (pkg.py:694, 704) are both <code>--prune</code>-gated.
-
-<b>Reproduce it.</b>
-
-<code>cd &lt;repo&gt; || exit 1</code><br>
-<code>export HOME=$TMPDIR/audit-doctor-verify1; export BOOST_HOME=$HOME/.boost; mkdir -p "$HOME"</code><br>
-<code>python3 tests/make_fixture.py $TMPDIR/audit-doctor-fix1 &gt;/dev/null</code><br>
-<code>./boost tap $TMPDIR/audit-doctor-fix1 &gt;/dev/null 2&gt;&amp;1</code><br>
-<code>BOOST_ASSUME_YES=1 ./boost install brainstorming &gt;/dev/null 2&gt;&amp;1</code><br>
-<code>ls -l $HOME/.claude/skills/          # link present and resolving</code><br>
-<code>rm $HOME/.agents/skills/.skill-lock.json</code><br>
-<code>./boost doctor; echo "DOCTOR_EXIT=$?"  # prescribes `boost sync` twice</code><br>
-<code>./boost sync; echo "SYNC_EXIT=$?"      # removes all 4 live links, exit 0, no prompt</code><br>
-<code>ls -A $HOME/.claude/skills/ $HOME/.cursor/skills/ $HOME/.windsurf/skills/ $HOME/.gemini/antigravity-cli/skills/</code><br>
-…
-
-<b>What adversarial verification corrected.</b> This card's numbers are the re-measured ones, not the ones first reported.
-
-The defect is real and the mechanism is exactly as described. Five corrections, two of them citation drift and three substantive enough that a card must not inherit them:
-
-1. CITATION (minor). <code>store.py:1784-1787</code> — line 1784 is a comment (<code># keep in ~/.claude/skills was swept up by \</code>boost sync\<code>.</code>). The predicate is at <b>1785-1786</b> and <code>plan["stale_links"].append(str(link))</code> at <b>1787</b>. Cite <b>store.py:1785-1787</b>. (store.py:1684 docstring, store.py:1895, lockfile.py:44-45, lockfile.py:226-228, pkg.py:694 and pkg.py:704 are all EXACT as stated.)
-
-2. CITATION (minor). <code>read()</code> returns the skeleton for corrupt at <b>lockfile.py:54</b>, not 53. Line 52 is a comment, line 53 is <code>_preserve_corrupt(p)</code>, line 54 is <code>return _skeleton()</code>. Cite <b>lockfile.py:53-54</b> (or 50-54 for the whole except block).
-
-3. SUBSTANTIVE — the root-cause story in <code>why_it_matters</code> is wrong. It claims the lock file is "the one file with no atomic-write protection story ... (an interrupted install, a full disk, a bad restore)". The lock file <b>is</b> written atomically: <code>lockfile.write</code> ends at <code>lockfile.py:160</code> with <code>util.atomic_write_text(...)</code>, which writes to a same-directory temp file, flushes, fsyncs and <code>os.replace</code>s (util.py:123-135, docstring names the lock file explicitly), and the roadmap card <code>docs/roadmap/items/atomic-corruption-safe-lock-file-writes.md</code> is <code>status: shipped</code>, <code>pr: 65</code>.
-
-<b>What is NOT established.</b> Recorded because a card that overstates its own evidence is worse than no card.
-
-NOT A DUPLICATE — I re-checked all 432 items independently rather than trusting the finder's list. - <code>audit-verify-drift-say-nothing-installed-exit-0-and-doctor-says-lo.md</code> (shipped, PR #674) is the closest and is the direct predecessor, not a duplicate: read in full, it is explicitly scoped to REPORTING in <code>cmd_verify</code>/<code>cmd_drift</code>/<code>cmd_doctor</code>, and it is the card that INTRODUCED the exact wording measured here ("! lock file missing — N store dirs unrecorded, run <code>boost sync</code>"). Grep confirms <code>lockfile.check()</code>/<code>store.has_content()</code> appear ONLY in <code>quality.py:442,447</code> and <code>_common.py:57,61</code> — never in <code>store.py</code>. The repair engine was never converted. - <code>sync-deletes-unowned-broken-symlinks.md</code> (PR #273) and <code>heal-deleted-links-it-never-made.md</code> (PR #459) both concern ownership of BROKEN/foreign links; the links here are live, owned, and resolve. Sharpest near-miss evidence: the heal card's own body says ownership must be read from the link "because the two moments a dangling link is most likely to exist — a skill uninstalled mid-sweep, <b>a lock file that has gone missing</b> — are exactly the moments the lock cannot answer", then applies that reasoning only to the <code>points_into_store</code> half of the predicate, leaving <code>link.name not in lock</code> still consulting the lock. - <code>audit-focus-profile-sideline-...md</code> (PR #741) is the inverse direction — sync RELINKS via <code>missing_links</code>, undoing a sideline.
-
-<b>Why it is worth doing.</b> This is the recovery surface behaving as a destroyer at the exact moment a user reaches for it. The lock file is the one file with no atomic-write protection story a new user knows about (an interrupted install, a full disk, a bad restore), the skill on disk and its four agent links are all still correct, and the single command doctor prints — twice — silently uninstalls it from Claude Code, Cursor, Windsurf and Antigravity, exits 0, and calls the result healthy two commands later. The one command that actually recovers (<code>boost install &lt;name&gt;</code>) is never mentioned, and the corrupt-lock alternative (<code>boost replay</code>) is empty on any machine with a single install — i.e.
-
-<em>Found by an automated audit of retrieval/eval quality, the search &amp; browse surfaces, and first-run onboarding; every finding was then re-measured from scratch by an independent adversarial verifier whose instruction was to refute it. Verdict: <b>CORRECTED</b>. No fix is prescribed here — the measurement is the contribution.</em></p>
-        <div class="meta">
-          <span class="m">Complexity <b>L</b></span>
-          <span class="m hi">Impact <b>High</b></span>
-          <span class="m">Wow <b class="wow">★★★★</b></span>
-          <span class="m">store.sync_plan decides staleness with link.name not in lock where lock = lockfile.in…</span>
-        </div>
-      </article>
-
       <article class="cap rcard" id="err-multiline-hint-colours-across-the-newline">
         <div class="head"><span class="pill planned">Planned</span><span class="cat">UX · Bug</span></div>
         <h3><code>out.err</code>'s multi-line hint is coloured as one span, so line 1 ends with no RESET and lines 2+ carry no start code</h3>
@@ -4545,6 +4501,18 @@ rather than leaving <code>doctor</code> as the only command that knows.</p>
         </div>
       </article>
 
+      <article class="cap rcard" id="doctor-prescribes-sync-that-deletes-live-links">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Onboarding · Bug</span></div>
+        <h3>A missing or corrupt lock file makes doctor prescribe <code>boost sync</code>/<code>boost heal</code>, and both delete every live agent symlink of an intact install</h3>
+        <p class="cardbody"><a class="writeup" href="https://github.com/jonnyeclectic/boost/blob/main/docs/roadmap/items/doctor-prescribes-sync-that-deletes-live-links.md">Write-up &middot; doctor-prescribes-sync-that-deletes-live-links.md</a></p>
+        <div class="meta">
+          <span class="m">Complexity <b>L</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">store.sync_plan decides staleness with link.name not in lock where lock = lockfile.in…</span>
+        </div>
+      </article>
+
       <article class="cap rcard" id="audit-import-all-skips-the-injection-secret-scans-and-the-per-skil">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Safety · Bug</span></div>
         <h3>import <code>--all</code> skips the injection/secret scans and the per-skill report single import runs</h3>

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/tests/functional/test_cli_pkg.py

@@ -1609,12 +1609,13 @@ class TestSyncJson:
         plan = json.loads(boost("sync", "--diff", "--json").out)
         assert plan == {"missing_store": [], "missing_links": [],
                         "blocked_links": [], "stale_links": [],
-                        "orphaned_store": [],
+                        "orphaned_store": [], "unrecorded_store": [],
                         "missing_materializations": [], "out_of_scope_links": [],
                         "project": {"missing": [], "orphaned": []}}
         data = json.loads(boost("sync", "--json").out)
         assert data == {"actions": [], "pruned": [], "orphaned_store": [],
-                        "out_of_scope_links": [], "blocked_links": []}
+                        "unrecorded_store": [], "out_of_scope_links": [],
+                        "blocked_links": []}
 
     def test_a_narrowing_reinstall_is_reported_and_pruned_only_on_request(
             self, boost, installed):

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/tests/functional/test_cli_quality.py

@@ -181,6 +181,42 @@ class TestDoctor:
         assert "lock file missing — 1 store dir unrecorded, run `boost sync`" in r.out
         assert "lock file integrity OK" not in r.out
 
+    def test_following_the_missing_lock_prescription_repairs_not_uninstalls(
+            self, boost, installed):
+        """The prescription used to be an uninstaller: `boost sync` removed
+        every live agent link with green ticks and exit 0. It must now be the
+        repair doctor promises, and doctor must say so once, not twice."""
+        links = [p for p in (paths.home() / d / "brainstorming" for d in (
+            ".claude/skills", ".cursor/skills", ".windsurf/skills",
+            ".gemini/antigravity-cli/skills")) if p.is_symlink()]
+        assert len(links) == 4
+        paths.lockfile_path().unlink()
+        r = boost("doctor", expect=1)
+        assert "run `boost sync` to re-record it" in r.out
+        assert "orphaned store dir" not in r.out
+        r = boost("sync")
+        assert "re-recorded brainstorming from" in r.out
+        assert "removed stale link" not in r.out
+        assert all(p.is_symlink() and p.exists() for p in links)
+        r = boost("doctor")
+        assert "lock file parses (v3)" in r.out
+
+    def test_a_corrupt_lock_leaves_sync_non_destructive(self, boost, installed):
+        link = paths.home() / ".claude/skills" / "brainstorming"
+        paths.lockfile_path().write_text("{oops", encoding="utf-8")
+        r = boost("sync")
+        assert "removed stale link" not in r.out
+        assert "restore the lock with `boost replay`" in r.out + r.err
+        assert link.is_symlink() and link.exists()
+        r = boost("doctor", expect=1)
+        assert "orphaned store dir" not in r.out
+
+    def test_heal_previews_the_re_record(self, boost, installed):
+        paths.lockfile_path().unlink()
+        r = boost("heal", "--dry-run")
+        assert "would re-record brainstorming" in r.out
+        assert "would remove stale link" not in r.out
+
     def test_missing_lock_with_empty_store_is_not_an_issue(self, boost, sandbox):
         # No lock file and nothing in the store either: a fresh install, not
         # a fault. Must not claim "parses" for a file that isn't there.

{boost_skill_cli-1.2.121 → boost_skill_cli-1.2.123}/tests/unit/test_store.py

@@ -912,7 +912,8 @@ class TestUninstall:
 class TestSyncPlan:
     EMPTY: ClassVar[dict] = {"missing_store": [], "missing_links": [],
              "blocked_links": [], "stale_links": [], "orphaned_store": [],
-             "missing_materializations": [], "out_of_scope_links": []}
+             "unrecorded_store": [], "missing_materializations": [],
+             "out_of_scope_links": []}
 
     def test_clean_state_empty_plan(self, brainstorming):
         assert store.sync_plan() == self.EMPTY