fix(install): consumer-install-hardening S1 — make claimed shields live in consumers (F6/F1/F12/F2/F11/F13)

[artyhoo]

consumer-install-hardening — Stage S1 (install-side) · rebased onto staging

Fixes the framework install defects the timeliner consumer audit found (F1–F13): makes every shield the framework claims actually live in a fresh consumer — hooks fire, the TS pre-push core is reachable, the R4 probe resolves, R11's claim matches shipped CI, stryker/doc-URL artefacts are correct.

Rebased onto current staging after FQA #470 squash-merged (ebda0cc) and guard-liveness #475 landed (cf32245). Supersedes #474 (which was stacked on the now-merged FQA branch). The F12 R11 manifest edit was re-applied onto staging's manifest (preserving #475's fixture/liveness-mode additions) — verified principle 05 green against staging's schema. Landed via the Git Data API (git transport tunnel-blocked).

Findings — status + acceptance (evidenced on a fresh install)

F#	Fix	Acceptance
F6	ship audit-r4.ts → scripts/ (FQA-drop correction)	R4 probe in audit-ai-docs.sh resolves+skips gracefully
F1	ship pre-push.ts + 5-file bounded static closure	closure present; TS-arm reachable; guard-liveness stays dynamic-import
F12	workflow-integrity.yml + R11 claim via manifest SSOT	R11 names only shipped artefacts; principle 05 green; no actionlint/zizmor/audit-self over-claim
F2	activate hooks (core.hooksPath=.husky) + husky/lint-staged/sort-package-json devDeps	hooksPath set; 3 devDeps merged; idempotent
F11	— (already satisfied by FQA W6) + regression test locks CI-reads-.nvmrc	f11-ci-node-version.test.sh 6/0 both stacks
F13	repoint 3 RuleCreator doc-URLs → canonical RULES.md + stryker PM from lockfile	factory/RULES.md gone from eslint-rules; pnpm/npm detected
CI	wire 6 install-sh acceptance tests into audit-self.yml (preserves #464 consumer-mode step)	actionlint clean; all green standalone

Own-QA (T19): full principle suite 170 passed; all install-sh tests green; commit-trailer + §1.7 gates pass locally.

Verify-trace

• bash -n install.sh exit 0; fresh ts-server install ships every artefact; sets core.hooksPath; detects stryker PM
• render-rules.ts --check up-to-date; principle 05 green (vs staging schema)
• Full principle suite green (170 passed); all install-sh tests green
• Diff vs staging = exactly the 14 intended files (no FQA bloat; manifest = R11 line only, feat(guard-liveness): cmd/script rule liveness gate (v1.5) #475 preserved)
• S4 live-consumer (deferred): flat-Hono AND monorepo consumers; npm install then commit-with-lint-error → pre-commit fails (F2); TS-hook loads on pinned Node 20.19.0 (F1 runtime checked under Node 24 here)

§1.7 Forward-check applied

Checked against existing disciplines: build-first-reuse / capability-commit — no new capability (ships/aligns existing artefacts; no new packages/ file ≥80 LOC, no new root dep) → Prior-art: skipped trailers. no-paid-llm-in-ci — acceptance is bash/node/vitest, zero API calls. doc-authority / principle 05 — F12 edits the manifest SSOT and regenerates RULES.md (not a hand-edit of generated output). dual-implementation — install-side single channel. Serves the README goal: makes claimed rules executable+live at the earliest channel in the consumer. Evidence: install.sh copy/activation blocks, rules-manifest.json R11 check.command, packages/core/eslint-rules/*.ts URLs.

§1.7 Backward-check applied

Swept existing artefacts under scope. Extends FQA without redo (F4 barrel already generated; W1/W2/W4/W6 untouched); corrects FQA's F6-drop + F12 SSOT-direction. Re-applied F12's R11 edit onto staging's post-#475 manifest, preserving all guard-liveness fixture/liveness-mode additions (verified: manifest diff vs staging = R11 check.command line only). No artefact silently superseded. Same-defect-class residue outside S1 scope surfaced for S2 (below), not swept.

Folded into S2 (maintainer-approved) — NOT fixed here

1. Same F13 defect on react-next: 3 preset eslint RuleCreator URLs → absent factory/RULES.react-next.md.
2. install.sh "Next steps" echo still says npx husky init (now redundant + would clobber shipped hooks).
3. rules-manifest.json R11 policy + framework's own workflow-integrity.yml comment still ref factory/RULES.md.

🤖 Generated with Claude Code

[artyhoo]

Closing as redundant. Verified staging (tip 9d72647) already carries the complete S1 with identical content — #474 was retargeted to staging and merged (b6d3be6), and the F11 test/step + staging-rebased manifest (R11=ci.yml claim, #475 fixture/liveness-mode preserved) all landed there in parallel with this rebase. All 14 files present with matching blob SHAs (f11 b41b0bae, f2 e0dc68e1, f13 85736728, workflow-integrity c15cbc26). This branch is now behind staging (#476) and merging it would only risk reverting guard-liveness v3 — nothing to add.