- slice-audits.md: append slice-11 audit (2 ports — backfill_dv2_frontmatter
  + audit-packages).
- RESUME.md: bump slice-9 → slice-10-merged (#883, commit 271bc38).
  Milestone 31 → 33. Bucket B 14 → 12.

…884)

* ts(slice-11, wip 1/N): port backfill_dv2_frontmatter (.sh→.ts)

First script of slice 11. Mechanical DV-2.0 frontmatter backfill
for SKILL.md files. Computes 5 missing fields from git history
(record_source / load_datetime / last_updated / status /
bp_rules_cited) and injects before closing frontmatter fence.

Byte-equivalent against bash original on --dry-run mode.

Mechanical changes:
- bash awk frontmatter parse → fieldPresent + dashCount helpers
- bash compute_record_source heuristic (round-N regex + author-
  date fallback) preserved as computeRecordSource
- bash mktemp + awk inject + mv rename → readFileSync +
  injectBeforeSecondFence + writeFileSync
- bash 'INJECT_BLOB env-passing' awk pattern → in-memory string
  array
- bash --all glob (find -maxdepth 2) → readdirSync filter
- All output strings preserved verbatim

Lint-clean (eslint + sonarjs + tsc).

* ts(slice-11, wip 2/N): port audit-packages (.sh→.ts)

Second script of slice 11. Network-dependent NuGet feed audit:
checks every Directory.Packages.props PackageVersion entry
against `dotnet package search --exact-match`.

Mechanical changes:
- bash grep+sed extraction → PACKAGE_RE.exec loop yielding
  PackageEntry tuples
- bash awk pipe-table parse → cols.split('|').map(trim) + col2
  match check; preserves 'last matching row' semantics
- bash printf '%-35s %-15s ...' → pad helper
- 3 statuses preserved: ✓ up-to-date / ? couldn't query /
  ⚠ bump available
- Exit-code semantics preserved: 0 = all queryable on latest,
  1 = one or more bumps available

Network-dependent so byte-equivalence requires offline-mode
testing (both bash + TS produce '?' for all packages when
`dotnet package search` fails — verified locally).

Lint-clean (eslint + sonarjs + tsc).

* trajectory(ts-bun): slice 11 audit substrate + RESUME tracker

- slice-audits.md: append slice-11 audit (2 ports — backfill_dv2_frontmatter
  + audit-packages).
- RESUME.md: bump slice-9 → slice-10-merged (#883, commit 271bc38).
  Milestone 31 → 33. Bucket B 14 → 12.

* review(slice-11): address PR #884 CodeQL TOCTOU findings

CodeQL flagged 2 file-system-race-condition findings on
backfill_dv2_frontmatter.ts where stat-then-read patterns
(statSync(path).isFile() followed by later readFileSync) could
race. Refactored to:

1. processOne: removed initial statSync gate; readFileSync
   directly with try/catch + ENOENT/EISDIR detection on the
   error.code property to map to warn/error outcomes. Preserves
   the original bash 'skip non-file' UX without the race window.
2. findAllSkillFiles: removed statSync probe of candidate paths;
   readdirSync only filters by directory entries; processOne
   handles missing/non-file paths gracefully via its try/catch.

Equivalence preserved: --dry-run output unchanged on a fresh
SKILL.md fixture.

Lint-clean (eslint + sonarjs + tsc).

* review(slice-11): restore atomic rewrite per Codex P2

Codex flagged backfill_dv2_frontmatter.ts losing the bash
original's atomic-rewrite invariant: bash used `mktemp` + `mv`
so a crash/kill/disk-full mid-write leaves the source file
intact. The TS port's writeFileSync truncates in place — a
real regression vs bash.

Restored: write to sibling tmp file (`<path>.tmp.<pid>.<ts>`)
then renameSync to target. Same-filesystem rename is atomic
on POSIX. Cleanup on failure: unlink the tmp + return structured
error outcome (exitCode 2).

* review(slice-11): address PR #884 round-3 threads

Three real fixes:
- backfill_dv2_frontmatter: chdir to repoRoot() before --all scan
  (was cwd-dependent; both bash + TS had the bug, TS fixes at the
  entry point) + restored full canonical script path in usage
  message to match emitHelp()
- slice-audits.md: corrected audit-packages.ts line count
  '51 → 154' to '51 → 143' (actual wc -l)

Three pushed back as intentional bash-equivalence:
- audit-packages stdout vs stderr — bash uses echo to stdout
- audit-packages exit-code 64 — bash uses 1
- backfill gitOutput silently returns empty — bash awk on empty
  input behaves identically (both produce empty injected values)

Atomic-rewrite duplicate finding (already addressed in 5baf773)
resolved as duplicate.

* review(slice-11): audit-packages repoRoot via import.meta.url per Codex P2

Codex flagged that the audit-packages.ts repoRoot using
`git rev-parse --show-toplevel` with cwd fallback regresses
invocation semantics from the bash original
(`cd "$(dirname "$0")/.." && pwd`). Bash resolves the script
location and walks up; TS+git-rev-parse fails outside a git
checkout (falls back to wrong cwd).

Fixed: switch to `fileURLToPath(import.meta.url)` + `resolve`
to match bash's script-relative resolution. Now works from any
caller directory and outside git checkouts.

* review(slice-11): defensive rename fallback per Codex P0

Codex flagged renameSync(tmpPath, file) as a potential Windows
data-loss issue (older Node fs.rename refused to overwrite on
Windows). Modern Node/Bun renameSync DOES overwrite atomically
on all platforms, but edge cases (Windows file locks from open
editors, permission-restricted network shares) can still fail.

Added defense-in-depth fallback: catch the renameSync failure,
unlink the destination, then retry rename. Loses atomicity for
the failure window but recovers correctness. Bash 'mv' has the
same fragility — same UX as bash, just more robust.

* review(slice-11): preserve-original-on-failure + fail-on-empty-parse per Codex P1+P2

P1 backfill_dv2_frontmatter (preserve-original-on-failure):
Removed the unlink-before-retry fallback that risked deleting the
original SKILL.md without successfully writing the new content.
On rename failure, return error with tmp-preserved message; do
NOT touch the original. Modern Node/Bun renameSync handles the
common case atomically; rare failures (Windows file lock, perms,
disk-full) leave the original intact + tmp recoverable.

P2 audit-packages (fail-on-empty-parse):
If PACKAGE_RE.exec yields 0 entries on a non-empty
Directory.Packages.props, the regex has likely drifted from the
file format. Silent success hides this. Now returns exit 1 with
clear error pointing at the regex-drift suspicion.

* review(slice-11): fix RESUME milestone math per Copilot

Headline said '33 hygiene/lint/audit scripts ported' but the
parenthesized addends summed to 32 (including the 2 in-flight).
Two issues conflated:

1. 'ported' implies merged but the count included in-flight.
2. Off-by-one — 11 merged-PR contributions sum to 30, not 31.

Fixed: '30 ported + 2 in-flight = 32 total' with explicit
delineation between merged and in-flight.