feat(rul,cml): durability findings — config lost after compaction (v5.5.0 / A)

Per the official "what survives compaction" model (context-window.md):
only the project-root CLAUDE.md (+ unscoped rules) is re-injected after a
context compaction. Two additive, structural findings (low severity):

- RUL: a large (>50-line) PATH-SCOPED rule — reloads only on a matching
  file read, and is not re-injected after compaction, so must-hold rules
  can silently drop mid-session.
- CML: a NESTED (subdirectory) CLAUDE.md — not re-injected after
  compaction (only the project root is).

Additive (no new scanner, count stays 13); one humanizer entry each;
hermetic temp-fixture tests (positive + negative). Suite 957 -> 961,
SC-5 byte-stable, self-audit A/A.

Known limitation (pre-existing, broader than A): the lightweight
frontmatter parser reads inline `paths:` but not YAML block sequences,
so block-sequence-scoped rules are still seen as unscoped. Deferred.

Part of v5.5.0 "steering-model I". Foundation (active-config-reader
enumeration) deferred to v5.6 with B.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

tests/scanners/claude-md-linter.test.mjs

@@ -1,7 +1,9 @@
-import { describe, it, beforeEach } from 'node:test';
+import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { resolve } from 'node:path';
+import { resolve, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import { resetCounter } from '../../scanners/lib/output.mjs';
 import { discoverConfigFiles } from '../../scanners/lib/file-discovery.mjs';
 import { scan } from '../../scanners/claude-md-linter.mjs';
@@ -219,3 +221,43 @@ describe('CML scanner — minimal project', () => {
     assert.ok(found, 'Should detect nearly empty CLAUDE.md');
   });
 });
+
+describe('CML — nested CLAUDE.md not re-injected after compaction (A)', () => {
+  // Only the project-root CLAUDE.md is re-injected after a compaction; a nested
+  // (subdirectory) CLAUDE.md is lost until a file in that dir is read again
+  // (V3, context-window.md). Hermetic temp fixture.
+  let tmpRoot;
+  let result;
+
+  beforeEach(async () => {
+    resetCounter();
+    tmpRoot = await mkdtemp(join(tmpdir(), 'ca-cml-nested-'));
+    await mkdir(join(tmpRoot, 'src'), { recursive: true });
+    await writeFile(join(tmpRoot, 'CLAUDE.md'), '# Root\n\nProject overview goes here.\n', 'utf8');
+    await writeFile(
+      join(tmpRoot, 'src', 'CLAUDE.md'),
+      '# Src rules\n\n' + Array.from({ length: 10 }, (_, i) => `- nested rule ${i + 1}`).join('\n') + '\n',
+      'utf8',
+    );
+    const discovery = await discoverConfigFiles(tmpRoot);
+    result = await scan(tmpRoot, discovery);
+  });
+
+  afterEach(async () => {
+    if (tmpRoot) await rm(tmpRoot, { recursive: true, force: true });
+  });
+
+  it('flags the nested CLAUDE.md as low (compaction durability)', () => {
+    const f = result.findings.find(x =>
+      x.scanner === 'CML' && /compaction/i.test(x.title || '') &&
+      /src/.test(`${x.file || ''}${x.evidence || ''}${x.description || ''}`));
+    assert.ok(f, `expected nested durability finding; got: ${result.findings.map(x => x.title).join(' | ')}`);
+    assert.equal(f.severity, 'low');
+  });
+
+  it('does NOT flag the project-root CLAUDE.md', () => {
+    const rootFinding = result.findings.find(x =>
+      x.scanner === 'CML' && /compaction/i.test(x.title || '') && !/src/.test(x.file || ''));
+    assert.equal(rootFinding, undefined, 'project-root CLAUDE.md must not get the compaction finding');
+  });
+});

tests/scanners/rules-validator.test.mjs

@@ -1,7 +1,9 @@
-import { describe, it, beforeEach } from 'node:test';
+import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { resolve } from 'node:path';
+import { resolve, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import { resetCounter } from '../../scanners/lib/output.mjs';
 import { discoverConfigFiles } from '../../scanners/lib/file-discovery.mjs';
 import { scan } from '../../scanners/rules-validator.mjs';
@@ -94,3 +96,58 @@ describe('RUL scanner — empty project', () => {
     assert.strictEqual(result.findings.length, 0);
   });
 });
+
+describe('RUL — large path-scoped rule lost after compaction (A)', () => {
+  // Path-scoped rules are NOT re-injected after a context compaction (V2,
+  // context-window.md) — a large one carrying must-hold rules silently drops.
+  let tmpRoot;
+  let result;
+
+  async function writeProject(root, ruleBodyLines) {
+    await mkdir(join(root, '.claude', 'rules'), { recursive: true });
+    await mkdir(join(root, 'src'), { recursive: true });
+    // A matching file so the path glob is not flagged as "matches no files".
+    await writeFile(join(root, 'src', 'foo.ts'), 'export {};\n', 'utf8');
+    const body = Array.from({ length: ruleBodyLines }, (_, i) => `- rule ${i + 1}`).join('\n');
+    // Inline paths form: config-audit's lightweight frontmatter parser reads
+    // `paths: <inline>` (comma-normalized), not YAML block sequences. The RUL
+    // scoped-detection (existing + this check) keys on that parsed value.
+    await writeFile(
+      join(root, '.claude', 'rules', 'scoped.md'),
+      `---\npaths: "src/**/*.ts"\n---\n\n# Scoped rule\n${body}\n`,
+      'utf8',
+    );
+  }
+
+  beforeEach(async () => {
+    resetCounter();
+    tmpRoot = await mkdtemp(join(tmpdir(), 'ca-rul-durability-'));
+    await writeProject(tmpRoot, 60);
+    const discovery = await discoverConfigFiles(tmpRoot);
+    result = await scan(tmpRoot, discovery);
+  });
+
+  afterEach(async () => {
+    if (tmpRoot) await rm(tmpRoot, { recursive: true, force: true });
+  });
+
+  it('flags a large path-scoped rule as low (compaction durability)', () => {
+    const f = result.findings.find(x => x.scanner === 'RUL' && /compaction/i.test(x.title || ''));
+    assert.ok(f, `expected durability finding; got: ${result.findings.map(x => x.title).join(' | ')}`);
+    assert.equal(f.severity, 'low');
+  });
+
+  it('does NOT flag a small path-scoped rule', async () => {
+    resetCounter();
+    const small = await mkdtemp(join(tmpdir(), 'ca-rul-small-'));
+    try {
+      await writeProject(small, 3);
+      const d = await discoverConfigFiles(small);
+      const r = await scan(small, d);
+      const f = r.findings.find(x => x.scanner === 'RUL' && /compaction/i.test(x.title || ''));
+      assert.equal(f, undefined, 'a small scoped rule should not be flagged');
+    } finally {
+      await rm(small, { recursive: true, force: true });
+    }
+  });
+});