fix/review 2026 11

.github/PULL_REQUEST_TEMPLATE.md

@@ -41,14 +41,6 @@ before opening a substantial change. Especially:
 - [ ] No new runtime dependency added (bash cma: bash + python3 stdlib only; cma-mcp: Python stdlib only)
 - [ ] `bash scripts/canon_audit.sh` passes locally
 
-## Related-project impact
-
-<!--
-Does this change affect references to Touchstone, frame-check,
-Lodestone, or any related project? If yes, name what coordinates with
-each. If no, write "none".
--->
-
 ## DECISIONS
 
 <!--

CHANGELOG.md

@@ -8,8 +8,23 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ## [Unreleased]
 
+### Fixed
+
+- The Claude Code `PreToolUse` hook now prints its captures as `{"hookSpecificOutput": {"hookEventName": "PreToolUse", "additionalContext": ...}}`. Claude Code adds plain stdout to the model's context only for events such as `SessionStart` and `UserPromptSubmit`; for `PreToolUse` it went to the debug log, so the per-action captures never reached the assistant. The hook also logs a surface event only when it actually emitted captures.
+- `cma stats --rejections` and `--preventions` no longer log surface events. They are read-only views, and the `SessionStart` hook calls `--rejections` every session, which inflated the event log with entries that were never action-time warnings.
+- `cma stats --evidence` now uses the same leak rule as `cma stats --leaks`: surface and fm both present and equal. Previously an absent fm on both sides matched (`"" == ""`), so the two views disagreed on the same corpus.
+- `cma stats --evidence` prints the counts behind the closure rate and marks it self-attested; `--json` adds `loop_closure_evidenced`, `loop_closure_denominator`, and `loop_closure_basis`.
+- The fm classifier, `hooks/cma-pre`, and the `SessionStart` hook no longer require GNU `timeout`. On stock macOS it is absent, so the hooks printed nothing and the classifier never ran. They now fall back to `gtimeout`, then to a python3 time limit that kills the whole process group.
+- A flag given without its value (`cma miss "x" --surface`) now exits 1 with "`--surface requires a value`" instead of a bash `unbound variable` error.
+- `cma surface --limit` now requires a positive integer. `abc` raised a Python traceback and `-1` silently dropped the oldest result.
+- `cma install-hook` shell-quotes the hook paths it writes, so a checkout path containing a space works, and refuses a `settings.json` whose `hooks`, `hooks.SessionStart`, or `hooks.PreToolUse` has the wrong JSON type with a clear message instead of a traceback.
+- `cma miss`, `decision`, `reject`, and `prevented` reject an empty description, matching cma-mcp.
+- A new data directory is created with mode 0700 and new data files with mode 0600, since captures can hold conversation excerpts. Existing installs keep their modes (see `docs/DATA.md`).
+- Captured text is stripped of ANSI/OSC escape sequences and other control characters (newlines and tabs kept) before cma prints it to the terminal, so it also reaches the `SessionStart` and `PreToolUse` hook context clean.
+
 ### Changed
 
+- The README and `docs/` now state that the prevention, leak, and closure-rate numbers are self-reported counts, and that whether surfaced warnings reduce repeat failures is not yet measured. `docs/EVALUATION.md` proposes how to measure it.
 - Repository home moved to a personal account (`lluvr/cma`). Self-references, badges, and issue/security links updated; author and publisher framing is now personal (organization publisher attribution dropped).
 - Zenodo DOI references removed from `CITATION.cff` pending re-issuance under the new account; `SECURITY.md`'s publisher-identity claim softened accordingly.
 - Repository layout: the deep-dive docs (`DESIGN`, `ARCHITECTURE`, `DATA`, `DECISIONS`, `GOVERNANCE`) moved under `docs/`, and `test.sh` / `bench.sh` moved under `scripts/`. All internal references updated.

CITATION.cff

@@ -10,7 +10,6 @@ authors:
   - family-names: Lucic
     given-names: Lovro
     orcid: "https://orcid.org/0009-0008-9976-6933"
-    website: "https://blog.clarethium.com"
 repository-code: "https://github.com/lluvr/cma"
 url: "https://github.com/lluvr/cma"
 abstract: >-
@@ -27,7 +26,6 @@ keywords:
   - failure-capture
   - decision-tracking
   - prevention
-  - lodestone
 license: Apache-2.0
 version: "1.1.0"
 date-released: "2026-05-25"

CODE_OF_CONDUCT.md

@@ -59,8 +59,11 @@ or acting as an appointed representative at an online or offline event.
 ## Reporting
 
 Instances of behavior that violate this Code of Conduct may be reported
-to the curator at `hello@clarethium.com`. All complaints will be
-reviewed and investigated promptly and fairly.
+to the curator, the repository maintainer, through GitHub
+(<https://github.com/lluvr>). If the report should stay private, open
+an issue that asks for a private channel and leaves out the details;
+the curator will follow up away from the public thread. All
+complaints will be reviewed and investigated promptly and fairly.
 
 The curator is obligated to respect the privacy and security of the
 reporter of any incident.

CONTRIBUTING.md

@@ -26,7 +26,7 @@ cma/
 ├── cma                          bash CLI (the seven primitives)
 ├── hooks/                       Claude Code + shell preexec integrations
 ├── scripts/                     test.sh, bench.sh, canon_audit.sh
-├── docs/                        DESIGN.md ARCHITECTURE.md DATA.md DECISIONS.md GOVERNANCE.md
+├── docs/                        DESIGN.md ARCHITECTURE.md DATA.md DECISIONS.md GOVERNANCE.md EVALUATION.md
 ├── CHANGELOG.md                 cma's release history
 ├── README.md                    cma overview
 ├── cma-mcp/                     Python MCP distribution wrapper
@@ -68,8 +68,9 @@ prefixed accordingly (`cma-1.1`, `cma-mcp-0.2`).
    ```bash
    cma --help
    ```
-   If cma is missing, build it from this repository: `ln -s
-   "$(pwd)/cma" ~/.local/bin/cma` (per cma's README quickstart).
+   If cma is missing, build it from this repository: `mkdir -p
+   ~/.local/bin && ln -s "$(pwd)/cma" ~/.local/bin/cma` (per cma's
+   README quickstart).
 4. **Run the full test suite for the component you touched.**
    ```bash
    ./scripts/test.sh                   # bash cma tests

NOTICE

@@ -28,32 +28,9 @@ Licensing
 Code in this repository is licensed under Apache 2.0; see LICENSE
 at repository root.
 
-External works referenced
--------------------------
-
-cma is methodology-agnostic and bundles no methodology content.
-If you tag captures with a methodology's failure-mode vocabulary
-(such as Lodestone's FM-1..10), you are responsible for citing that
-methodology in your own work.
-
-Verification substrate referenced in design documents is Touchstone
-(https://github.com/Clarethium/touchstone), Apache 2.0 (library)
-and CC-BY 4.0 (Standard).
-
-Related projects
-----------------
-
-- Lodestone: canonical methodology (CC-BY 4.0)
-- Touchstone: model-independent measurement substrate
-- frame-check: applied vehicle, sibling MCP using Touchstone
-  (https://github.com/Clarethium/frame-check)
-
-Sibling-MCP pattern conformance
--------------------------------
-
-cma-mcp's three-section payload discipline, governance scaffolding,
-and adversarial test architecture follow the conventions established
-by frame-check. Where this project diverges (e.g., bundling the
-MCP wrapper alongside the wrapped binary in one repository rather
-than as a separate sibling repo), the divergence is named in
-docs/DECISIONS.md.
+Methodology
+-----------
+
+cma is methodology-agnostic and bundles no methodology content. If
+you tag captures with a methodology's failure-mode vocabulary, you
+are responsible for citing that methodology in your own work.