fix(commands): stop answering questions the caller did not ask

Dogfooding `campaign` + `knowledge-refresh` against a throwaway ledger. Seven
defects, all found by running the commands as written and measuring, not by
reading them.

The headline pair only existed together. `knowledge-refresh` built
`STALE_AFTER="--stale-after 30"` and expanded it unquoted, trusting the shell to
split it in two. bash does; zsh — the macOS default, and what the Bash tool runs
here — does not. The CLI got one argv entry, matched no flag, and because it had
no unknown-flag branch, silently kept the 90-day default and reported "✓ All 14
register entries were re-verified within the last 90 days": a true-sounding
sentence about a threshold the user had just overridden. Fixing either half alone
leaves a silent wrong answer or a loud one; both are fixed, and a guard now
rejects any template that packs a flag and its value into one variable.

`knowledge-refresh` also read one register and wrote another: step 6 named an
unanchored `knowledge/best-practices.json` while the CLI reads
`${CLAUDE_PLUGIN_ROOT}/…`, which for an installed plugin is the cache. The
validation gate then ran the cached test against the cached register — green no
matter what was written. The two copies were byte-identical that day, which is
exactly why it was invisible.

`campaign` vouched for repos it could not read. `add /finnes/ikke` returned
`added` + exit 0; `refresh-tokens` then put the phantom in `swept[]` with a
0-token delta and left `skipped[]` empty, so the machine-wide bill claimed
coverage of three repos on a machine with two. Paths stay tracked — an unmounted
volume is a legitimate absence — but are reported as `addedUnverified`, and the
command names them.

Two class sweeps, both measured rather than assumed. `posture` was the single
scanner (1 of 14) whose fatal catch exited 1, which ux-rules defines as a normal
WARNING grade — a crash indistinguishable from a result. And all 13 payload
writers failed on a `--output-file` whose parent did not exist, which on a fresh
machine turned `campaign`'s first run into "the ledger may be corrupt"; they now
share `scanners/lib/write-output.mjs`.

Predicted breadth was too wide for the first time in five sessions: 6 of 8 CLIs
predicted to lack unknown-flag rejection, 4 measured. `drift` and `fix` already
reject them, via a construct the grep did not recognise — a grep matches an
implementation, the invariant is a behaviour. The sweep was rewritten to run each
CLI with a bogus flag and read the exit code.

Suite 1453 → 1469/0. Frozen snapshots untouched. `optimize-lens-cli` and
`token-hotspots-cli` share the unknown-flag defect and are deferred to the v5.14
argument-handling chunk with their positional-swallow arm; the count is recorded
in the guard rather than rounded down to zero.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012NHWjN8EnoxSqRvMTLK2NE

commands/knowledge-refresh.md

@@ -44,14 +44,21 @@ re-verification) and polling for new Claude Code practices...
 ### Step 2: Run the stale-check CLI
 
 ```bash
+# Pass the threshold as its OWN quoted argument. Building "--stale-after 30" into
+# one variable and expanding it unquoted only works if the shell word-splits —
+# bash does, zsh (the macOS default) does not, and there the flag silently
+# reverted to the 90-day default while the command reported success.
 TODAY=$(date +%F)
-STALE_AFTER=""
-if echo "$ARGUMENTS" | grep -qE -- '--stale-after'; then
-  STALE_AFTER="--stale-after $(echo "$ARGUMENTS" | sed -nE 's/.*--stale-after[ =]+([0-9]+).*/\1/p')"
+STALE_AFTER_DAYS=$(echo "$ARGUMENTS" | sed -nE 's/.*--stale-after[ =]+([0-9]+).*/\1/p')
+if [ -n "$STALE_AFTER_DAYS" ]; then
+  node ${CLAUDE_PLUGIN_ROOT}/scanners/knowledge-refresh-cli.mjs \
+    --reference-date "$TODAY" --stale-after "$STALE_AFTER_DAYS" \
+    --output-file ~/.claude/config-audit/sessions/knowledge-refresh.json 2>/dev/null; echo $?
+else
+  node ${CLAUDE_PLUGIN_ROOT}/scanners/knowledge-refresh-cli.mjs \
+    --reference-date "$TODAY" \
+    --output-file ~/.claude/config-audit/sessions/knowledge-refresh.json 2>/dev/null; echo $?
 fi
-node ${CLAUDE_PLUGIN_ROOT}/scanners/knowledge-refresh-cli.mjs \
-  --reference-date "$TODAY" $STALE_AFTER \
-  --output-file ~/.claude/config-audit/sessions/knowledge-refresh.json 2>/dev/null; echo $?
 ```
 
 Exit code **0** = all fresh, **1** = some stale (advisory, normal), **3** = real error →
@@ -100,16 +107,27 @@ Be explicit: **"I will not change any file until you approve specific items."**
 
 ### Step 6: Apply approved writes (only the approved ones)
 
+**Where the register lives — say this before writing.** The register is part of the plugin,
+and the stale check above read it from `${CLAUDE_PLUGIN_ROOT}/knowledge/best-practices.json`
+(the `registerPath` field in the payload names the exact file). For a marketplace install that
+is the plugin cache, so **an edit there is discarded by the next plugin upgrade** — the durable
+home for an approved change is the plugin's own checkout. Tell the user which of the two they
+are about to write to, using the `registerPath` they can see, before asking for approval.
+
 For each approved item:
-1. Edit `knowledge/best-practices.json` — bump `source.verified`, update the `claim`/
-   `recommendation`, or append the new entry. Keep the file's 2-space JSON formatting.
-2. If a `knowledge/*.md` mirror states the same fact, update it too so the human-readable
-   mirror doesn't drift from the register.
+1. Edit `${CLAUDE_PLUGIN_ROOT}/knowledge/best-practices.json` — bump `source.verified`, update
+   the `claim`/`recommendation`, or append the new entry. Keep the file's 2-space JSON
+   formatting. Use the anchored path, never a bare `knowledge/…` — a relative path resolves
+   against the user's current repo, which is not the file the CLI read.
+2. If a `${CLAUDE_PLUGIN_ROOT}/knowledge/*.md` mirror states the same fact, update it too so
+   the human-readable mirror doesn't drift from the register.
 3. **Validate before declaring done** — re-run the register schema check and confirm zero errors:
    ```bash
    node --test ${CLAUDE_PLUGIN_ROOT}/tests/lib/best-practices-register.test.mjs 2>&1 | tail -5
    ```
-   If validation fails, revert that edit and report it — never leave the register invalid.
+   This test loads the register through the same anchored path, so it validates the file you
+   just edited — that only holds while step 1 uses the anchored path too. If validation fails,
+   revert that edit and report it — never leave the register invalid.
 
 Report exactly what changed (ids + fields), and what was deferred to manual review.