fix(install): wave-5 follow-up — SHIPPED_DOCS sync + N3 stat-fallback comment

[artyhoo]

Summary

Post-merge follow-up to PR #35 (Wave 5.2+5.3 merged 2026-05-11). Addresses reviewer findings S1 (install.sh SHIPPED_DOCS stale vs principle 09 after Wave 5.1 added two skills/tool-bootstrapping/ paths to REQUIRED_HEADER_DOCS) and N3 (asymmetric stat-failure fallbacks in audit-ai-docs.sh D4 probe — logically correct, opaque on first read).

Changes

• install.sh:50: pre-install header comment Wave 2 entries — 11 → Wave 2 + Wave 5.1 entries — 13.
• install.sh:67-68: add skills/tool-bootstrapping/SKILL.md and skills/tool-bootstrapping/references/decision-format.md to SHIPPED_DOCS.
• packages/core/principles/09-doc-authority-hierarchy.test.ts:131-164: rename WAVE_2_PREFIXES → SHIPPED_DOC_PREFIXES, add skills/tool-bootstrapping/ prefix, update length expectation 11 → 13, refresh leading comment + it() title to reflect that the subset now covers Wave 2 + Wave 5.1.
• packages/core/audit-self/audit-ai-docs.sh:204-206: N3 — two-line comment explaining why the stat-failure fallbacks are asymmetric (PKG=0 vs DEC=1 ensures PKG_MTIME ≤ DEC_MTIME on stat error, so a stat failure never produces a false stale-WARN).

Prior-art consult

• No new capability surface: not a new dep, not a new file ≥80 LOC under packages/, not a new dir under packages/core/. Commit carries Prior-art: skipped — follow-up fix syncing install.sh SHIPPED_DOCS with already-decided Wave 5.1 SSOT additions, no new capability (rationale ≥20 chars, specific to the change).
• No new prior-art entry needed: the underlying capability (Wave 5.1 tool-bootstrapping skill) was already evaluated and recorded in SSOT fix: wave-5 readiness — AIF Handoff overlap analysis + scope annotations (SSOT #27-#29) #31-chore(wave-5-trio-followup): §13.25 closure + D-3 test + MD040 fix #37 during PR feat(skills): wave-5.1 — tool-bootstrapping skill + SSOT #31-#37 atomic landing #34.
• No Last reviewed date update required (no existing SSOT entry was the basis for this commit).
• No new capability area → context7 queries not required.

Test plan

• npx vitest run packages/core/principles/09-doc-authority-hierarchy.test.ts → 17/17 passed.
• npm test --workspaces --if-present → 329 / 329 tests across 47 files passed (@rules-as-tests/core 291, @rules-as-tests/preset-next-15-canonical 38).
• npm run typecheck --workspaces --if-present → clean across all 3 workspaces.
• install.sh --dry-run from a fresh temp project with stub package.json → ✓ all 13 shipped artefacts carry valid headers.
• Pre-push hook (10 files / 56 tests) → green.

§1.7 Forward-check applied

PR adds + relaxes a drift-detection meta-test (principle 09 covers a wider shipped-doc subset). Disciplines re-checked against this change before merge: (1) doc-authority-hierarchy — verified the two newly-listed paths (skills/tool-bootstrapping/SKILL.md, …/references/decision-format.md) both already carry > **Authoritative for:** headers (grep -c returned 1 each); (2) build-vs-reuse — confirmed this commit does not match any of the three capability-commit triggers in CLAUDE.md (no new dep, no new file ≥50 LOC under a new packages/core/<dir>/, no new file ≥80 LOC under packages/), so the Prior-art: skipped escape hatch with ≥20-char rationale is the correct trailer; (3) self-reflection — this §1.7 block is itself the recursive application; the rule about widening a meta-test is being applied to widening the meta-test.

§1.7 Backward-check applied

Sweep across already-shipped surfaces to confirm no other Wave 2 / 5.1 drift is being left on the floor: (1) install.sh:164-192 ships both skills/rules-as-tests/ and skills/tool-bootstrapping/ to .claude/skills/, but only the tool-bootstrapping skill files are in REQUIRED_HEADER_DOCS-shipped-subset — skills/rules-as-tests/SKILL.md + its 5 references are in REQUIRED_HEADER_DOCS but not in SHIPPED_DOCS, a pre-existing gap (not Wave 5.1 regression). Deliberately deferred: reviewer scoped S1 to Wave 5.1 drift; expanding to rules-as-tests would also require either (a) adding the 6 rules-as-tests doc paths to SHIPPED_DOCS and the skills/rules-as-tests/ prefix to the test, or (b) widening to skills/ prefix wholesale. Logged for next follow-up. (2) .claude/skills/tool-bootstrapping/{SKILL.md, references/decision-format.md} are in REQUIRED_HEADER_DOCS but intentionally not in SHIPPED_DOCS — they are project-internal copies of the skill, not consumer-shipped. (3) Reviewer findings N1 (Last reviewed: 2026-05-10 vs commit 2026-05-11) and N2 (grep -q "context7" substring match in setup.sh:291) — N1 is convention-not-bug per reviewer verdict; N2 has no concrete failure mode in the current .mcp.json shape — both captured here for future hardening if scenarios materialise, not blocking.