chore(sync): cascade fleet template@9444dfe

Auto-applied by socket-wheelhouse sync-scaffolding.
- New hook: .claude/hooks/dont-blame-user-reminder.
- New doc: docs/claude.md/fleet/pull-request-target.md.
- CLAUDE.md fleet block: condensed Public-surface hygiene, added the
  dont-blame-user rule under 'Fix it, don't defer'.
- oxlint-plugin: new no-cached-for-on-iterable rule + tests, plus a
  refreshed excuse-detector + check-paths/allowlist + prefer-static-
  type-import.
- scripts/check-paths/allowlist.mts: '!' on bounded indexed access.
- scripts/validate-bundle-deps.mts (where present): same '!' pattern.

Author: jdalton

.claude/hooks/dont-blame-user-reminder/index.mts

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// Claude Code Stop hook — dont-blame-user-reminder.
+//
+// Scans the assistant's most recent turn for phrases that blame the
+// user (or "the linter") for state that was actually produced by the
+// assistant's own scripts: pre-commit autofix, sync-scaffolding
+// cascades, lint --fix passes, format-on-save.
+//
+// Why this exists: jdalton repeatedly saw the assistant claim "the
+// user reverted my edits" / "the linter stripped my !s" / "user's
+// preferred state has no assertions" when in fact the strips were
+// produced by the assistant's own template canonical sources +
+// sync-cascade scripts. Blaming the user instead of investigating
+// the assistant's own scripts is a deferral pattern: it lets the
+// assistant stop debugging without finding the actual cause.
+//
+// Runs in BLOCKING mode so the assistant must continue the turn and
+// either (a) prove the blame is correct with evidence (a commit
+// hash, a hook output, etc.) or (b) keep investigating the actual
+// script that produced the reverted state. The block is suppressed
+// when stop_hook_active is set, so it can fire at most once per
+// stop chain.
+//
+// Disabled via SOCKET_DONT_BLAME_USER_DISABLED env var.
+
+import { runStopReminder } from '../_shared/stop-reminder.mts'
+
+await runStopReminder({
+  name: 'dont-blame-user-reminder',
+  disabledEnvVar: 'SOCKET_DONT_BLAME_USER_DISABLED',
+  blocking: true,
+  // Strip quoted spans so the hook doesn't self-fire when the
+  // assistant *describes* the phrases it detects (e.g. when this
+  // doc-comment is itself paraphrased in a turn summary).
+  stripQuotedSpans: true,
+  patterns: [
+    {
+      label: 'blaming user/linter for revert without evidence',
+      // Matches phrases that attribute state to the user / linter
+      // *as the cause*, with no investigation attached. The shape:
+      // "user reverted X" / "linter stripped Y" / "user prefers Z".
+      // These are deferral phrases when said about state produced
+      // by the assistant's own scripts (sync-cascade, pre-commit
+      // autofix, oxlint --fix, oxfmt).
+      regex:
+        /\b(?:the\s+)?(?:user|linter|formatter)\s+(?:reverted|stripped|removed|undid|reformatted|rewrote|preserves?|prefers?|keeps?)\b|\buser['']s\s+(?:preferred|intentional|preserved)\s+state\b|\b(?:reverted|stripped|removed)\s+by\s+(?:the\s+)?(?:user|linter|formatter)\b|\b(?:the\s+)?(?:user|linter)\s+(?:wants|chose|picked)\s+(?:to\s+keep|to\s+strip|to\s+remove)\b/i,
+      why: 'Don\'t blame the user or "the linter" for state that may have been produced by your own scripts (sync-cascade, pre-commit autofix, oxlint --fix, oxfmt, template canonical sources). Investigate WHICH script produced the state — `git log -S` the change, run pre-commit phases in isolation, check `template/` canonical sources. Only attribute the change to the user with direct evidence (a quoted user message, a `git reflog` entry).',
+    },
+  ],
+  closingHint:
+    'If you have hard evidence the user reverted the change (a quoted user message, a manual `git reflog` entry), restate the evidence inline. Otherwise resume the investigation into the actual script that produced the state.',
+})

.claude/hooks/excuse-detector/index.mts

@@ -131,6 +131,10 @@ const rule = {
     messages: {
       noCachedForOnIterable:
         '`{{name}}` is a {{kind}} — cached-length `for` is a silent no-op (no `.length`, not integer-indexable). Use `for (const item of {{name}}) { … }` instead. (Do NOT materialize with `Array.from({{name}})` just to keep the cached-length shape — that adds a wasted allocation. `for...of` is the canonical fix for sets / maps / iterables.)',
+      lengthOnIterable:
+        '`{{name}}.length` reads `undefined` — {{kind}} has `.size`, not `.length`. Either rename to `.size`, or convert `{{name}}` to an array first if the semantics demand `.length`.',
+      indexedAccessOnIterable:
+        '`{{name}}[…]` returns `undefined` — {{kind}} isn\'t integer-indexable. Use `for (const item of {{name}})` (or one of the entries / keys / values iterators) to read elements.',
     },
     schema: [],
   },
@@ -158,6 +162,70 @@ const rule = {
           data: { name: iterName, kind },
         })
       },
+      MemberExpression(node: AstNode) {
+        // Only flag when the object is a bare Identifier resolving
+        // to a known Set/Map/Iterable. Anything else (member chain,
+        // call result) is too noisy without type info.
+        if (!node.object || node.object.type !== 'Identifier') {
+          return
+        }
+        const name = node.object.name as string
+        const kind = kinds.get(name) ?? 'unknown'
+        if (!FLAGGED_KINDS.has(kind)) {
+          return
+        }
+        // `setVar.length` — direct property read; always undefined.
+        // Skip when used as the LHS of an assignment (extremely
+        // unlikely on a Set but cheap to be safe) or when used
+        // inside a member chain we can't reason about.
+        if (
+          !node.computed &&
+          node.property &&
+          node.property.type === 'Identifier' &&
+          node.property.name === 'length'
+        ) {
+          // Skip the destructure shape `{ length } = setVar` — that's
+          // the for-loop init the ForStatement visitor already
+          // reports on, so we'd double-fire here. The destructure's
+          // member access doesn't go through MemberExpression in any
+          // oxlint version we've seen, but cover it defensively.
+          if (
+            node.parent &&
+            node.parent.type === 'AssignmentPattern' &&
+            node.parent.left === node
+          ) {
+            return
+          }
+          context.report({
+            node,
+            messageId: 'lengthOnIterable',
+            data: { name, kind },
+          })
+          return
+        }
+        // `setVar[<idx>]` — computed property access. Restrict to
+        // shapes where the index looks numeric (number literal,
+        // Identifier counter — `i` / `j` / `index`). A bare
+        // `setVar[someKey]` could be a Map-key lookup misshaping a
+        // get(), so be conservative: only flag when the surface
+        // strongly suggests array-style indexed read.
+        if (node.computed && node.property) {
+          const p = node.property
+          const looksNumeric =
+            (p.type === 'Literal' && typeof p.value === 'number') ||
+            (p.type === 'NumericLiteral' && typeof p.value === 'number') ||
+            (p.type === 'Identifier' &&
+              typeof p.name === 'string' &&
+              /^(i|j|k|n|idx|index|cur|cursor|pos)$/.test(p.name))
+          if (looksNumeric) {
+            context.report({
+              node,
+              messageId: 'indexedAccessOnIterable',
+              data: { name, kind },
+            })
+          }
+        }
+      },
     }
   },
 }