@ainova-systems/intelligence 0.17.1 → 0.17.3

package/cli/commands/adapter.sh

@@ -118,6 +118,8 @@ adapter_remove() {
         read -r answer
         case "$answer" in y|Y|yes|YES) ;; *) echo "removal cancelled"; exit 0 ;; esac
     fi
+    # A render sources project adapters: never remove one under it.
+    project_lock_hold "$IP_ROOT"
     rm -f "$file"
     echo "removed: $content_dir/adapters/$name.sh"
     echo "  generated output was kept"
@@ -136,6 +138,8 @@ case "$action" in
         [ -n "$name" ] && [ $# -eq 2 ] || die "usage: intelligence adapter <enable|disable> <name>"
         assert_valid_target_name "$name"
         require_cli_project
+        # Held through the final render: target-state and sync join it.
+        project_lock_hold "$IP_ROOT"
         ensure_project_current "$IP_ROOT"
         if [ "$action" = "enable" ]; then
             state_stage="$(mktemp -d -t intelligence-adapter-state-XXXXXX)"

package/cli/commands/sync.sh

@@ -29,6 +29,9 @@ run_sync() {
     detect_project || return $?
     case "$IP_MODE" in
         cli)
+            # One writer per project at a time: the store restore and the
+            # render below both rewrite shared state (sync-lock.sh).
+            project_lock_hold "$IP_ROOT"
             # `sync` is the normal fresh-clone command. A newer globally installed
             # CLI aligns the current Intelligence project first (except in CI, where a
             # tracked migration must be reviewed and committed locally), and a

package/cli/commands/update.sh

@@ -105,6 +105,9 @@ if [ "$mode" = "ask" ]; then
     esac
 fi
 
+# Held from alignment through the final render: the package pass and the sync
+# it execs join this lock instead of taking their own.
+project_lock_hold "$IP_ROOT"
 ensure_project_current "$IP_ROOT"
 apply_args=(--no-sync)
 [ -z "$only" ] || apply_args+=("$only")

package/cli/intelligence

@@ -7,15 +7,21 @@
 
 set -euo pipefail
 
-CLI_DIR="$(cd "$(dirname "$0")" && pwd)"
+case "$0" in
+    */*) CLI_DIR="${0%/*}"; [ -n "$CLI_DIR" ] || CLI_DIR="/" ;;
+    *) CLI_DIR="." ;;
+esac
+CLI_DIR="$(cd "$CLI_DIR" && pwd)"
 export CLI_DIR
 
 # Engine discovery, by role (sync.sh + VERSION). The repo and the npm package
 # ship one layout — <root>/{cli,engine,packages/sync} — so there is a single
-# candidate rather than a per-distribution list.
+# candidate rather than a per-distribution list. CLI_DIR is already the logical
+# `pwd` spelling, so its textual parent is what `cd "$CLI_DIR/.."` would print.
+CLI_ROOT="${CLI_DIR%/*}"
 IS_ENGINE_DIR=""
 if [ -f "$CLI_DIR/../engine/sync.sh" ] && [ -f "$CLI_DIR/../engine/VERSION" ]; then
-    IS_ENGINE_DIR="$(cd "$CLI_DIR/../engine" && pwd)"
+    IS_ENGINE_DIR="$CLI_ROOT/engine"
 fi
 if [ -z "$IS_ENGINE_DIR" ]; then
     echo "ERROR: bundled sync engine not found next to the CLI ($CLI_DIR)." >&2
@@ -29,7 +35,7 @@ export IS_ENGINE_DIR
 # engine dir: the store must receive rules/agents/skills, never engine scripts.
 IS_BUNDLED_PKG_DIR=""
 if [ -d "$CLI_DIR/../packages/sync" ]; then
-    IS_BUNDLED_PKG_DIR="$(cd "$CLI_DIR/../packages/sync" && pwd)"
+    IS_BUNDLED_PKG_DIR="$CLI_ROOT/packages/sync"
 fi
 export IS_BUNDLED_PKG_DIR
 

package/cli/internal/align-project.sh

@@ -15,6 +15,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 
 stamp="$(read_schema_version "$manifest")"

package/cli/internal/check.sh

@@ -102,7 +102,20 @@ while IFS= read -r name; do
             warn "$name is locked but not installed — run 'intelligence sync'"
             continue
         fi
-        ok "$name @ $(pin_label "$m_ref" "$l_res" "$(qmap_field "$lock" "packages" "$name" "sha")")"
+        # Report what the store holds, never what the lock pins: they differ
+        # after a pull that moved the lock and left the ignored store behind.
+        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
+        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
+        l_sha="$(qmap_field "$lock" "packages" "$name" "sha")"
+        if ! store_record_get "$IP_ROOT" "$name"; then
+            warn "$name is installed, but the store does not record which commit it holds; the lock pins $(pin_label "$m_ref" "$l_res" "$l_sha") — run 'intelligence sync'"
+        elif [ "$IS_REC_URL" != "$l_url" ] || [ "$IS_REC_PATH" != "$l_path" ]; then
+            warn "$name was installed from ${IS_REC_URL}${IS_REC_PATH:+ (path $IS_REC_PATH)} but the lock names ${l_url}${l_path:+ (path $l_path)} — run 'intelligence sync'"
+        elif [ "$IS_REC_RESOLVED" != "$l_res" ] || [ "$IS_REC_SHA" != "$l_sha" ]; then
+            warn "$name holds $IS_REC_RESOLVED@$(short_sha "$IS_REC_SHA") but the lock pins $l_res@$(short_sha "$l_sha") — run 'intelligence sync'"
+        else
+            ok "$name @ $(pin_label "$m_ref" "$IS_REC_RESOLVED" "$IS_REC_SHA")"
+        fi
     fi
 done < <(qmap_keys "$manifest" "packages")
 

package/cli/internal/convert-legacy.sh

@@ -227,7 +227,38 @@ rewrite_source_value() {
     esac
     printf '%s' "$v"
 }
-in_packs=0 in_sources=0
+# The project's own content stays where the legacy layout kept it. When that
+# directory is not `intelligence/`, the manifest names it: the content directory
+# is where project adapters live, what no output may overwrite, and the source of
+# truth AGENTS.md points readers at. Left at the default, all three name a
+# directory that only a case-insensitive filesystem confuses with the real one.
+legacy_content_dir=""
+case "$umbrella_rel" in
+    "$umbrella"|intelligence|*/*|.intelligence*|*[\"\'\\]*|*[[:cntrl:]]*) ;;
+    *)
+        # Only content that stays counts: the vendored module and pack mirrors
+        # move into the store and leave, so a config-only umbrella is not one.
+        if [ -z "$(get_yaml_field "$config" "project" "intelligence_dir")" ]; then
+            for section in rules agents skills; do
+                while IFS= read -r src; do
+                    case "$src" in ""|git+*|@*) continue ;; esac
+                    src_canon="$(normalize_path "$root/$src")"
+                    case "$src_canon" in "$root"/*) src_rel="${src_canon#"$root"/}" ;; *) continue ;; esac
+                    case "$src_rel" in "$module_rel"|"$module_rel"/*) continue ;; esac
+                    leaving=0
+                    while IFS="$LOCK_SEP" read -r _ _ _ _ mirror; do
+                        [ -n "$mirror" ] || continue
+                        mirror="$(normalize_path "$root/$mirror")"
+                        case "$src_canon" in "$mirror"|"$mirror"/*) leaving=1 ;; esac
+                    done < "$pack_rows"
+                    [ "$leaving" -eq 0 ] || continue
+                    case "$src_rel" in "$umbrella_rel"|"$umbrella_rel"/*) legacy_content_dir="$umbrella_rel" ;; esac
+                done < <(read_yaml_list "$config" "$section")
+            done
+        fi
+        ;;
+esac
+in_packs=0 in_sources=0 project_key=0 content_dir_written=0
 while IFS= read -r line || [ -n "$line" ]; do
     line="${line%$'\r'}"
     case "$line" in
@@ -236,6 +267,18 @@ while IFS= read -r line || [ -n "$line" ]; do
         sources:*) in_sources=1; in_packs=0; echo "$line"; continue ;;
         [!\ \#]*) in_packs=0; in_sources=0 ;;
     esac
+    case "$line" in project:*) project_key=1 ;; esac
+    if [ -n "$legacy_content_dir" ] && [ "$content_dir_written" -eq 0 ]; then
+        # Only the block form takes a child line; `project: {...}` does not.
+        key_part="${line%%#*}"
+        key_part="${key_part%"${key_part##*[![:space:]]}"}"
+        if [ "$key_part" = "project:" ]; then
+            echo "$line"
+            echo "  intelligence_dir: \"$legacy_content_dir\""
+            content_dir_written=1
+            continue
+        fi
+    fi
     [ "$in_packs" -eq 1 ] && continue
     if [ "$in_sources" -eq 1 ]; then
         case "$line" in
@@ -261,6 +304,9 @@ while IFS= read -r line || [ -n "$line" ]; do
     fi
     echo "$line"
 done < "$config" > "$manifest_stage"
+if [ -n "$legacy_content_dir" ] && [ "$content_dir_written" -eq 0 ] && [ "$project_key" -eq 0 ]; then
+    printf 'project:\n  intelligence_dir: "%s"\n' "$legacy_content_dir" >> "$manifest_stage"
+fi
 stamp_schema_version "$manifest_stage" "$eng"
 
 # packages: requested pins only; resolved source details live in the lock.
@@ -360,6 +406,11 @@ trap 'rollback; exit 130' INT TERM
 mv "$stage/.intelligence" "$root/.intelligence"
 cp "$manifest_stage" "$root/intelligence.yaml"
 lock_write_from_tsv "$root/intelligence.lock" "$lock_rows"
+# The staged store holds exactly these rows; record them so sync trusts it.
+while IFS="$LOCK_SEP" read -r rec_name _ rec_url rec_path rec_resolved rec_sha; do
+    [ -n "$rec_name" ] || continue
+    store_record_set "$root" "$rec_name" "$rec_url" "$rec_path" "$rec_resolved" "$rec_sha"
+done < "$lock_rows"
 ensure_manifest_gitignore "$root" "$root/intelligence.yaml"
 ensure_manifest_publisher_ignores "$root" "$root/intelligence.yaml"
 

package/cli/internal/package-add.sh

@@ -24,6 +24,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
@@ -122,6 +123,10 @@ if [ -z "$ref" ]; then
 fi
 
 rel=".intelligence/packages/$name"
+# Forget what the directory held before replacing it: an interruption then
+# leaves the package unrecorded, which the next sync repairs, never a stale
+# record vouching for new bytes.
+store_record_remove "$IP_ROOT" "$name"
 sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
 
 wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
@@ -139,6 +144,7 @@ else
 fi
 
 lock_upsert "$lock" "$name" "$requested" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
+store_record_set "$IP_ROOT" "$name" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
 
 sections=""
 for s in rules agents skills; do

package/cli/internal/package-remove.sh

@@ -16,6 +16,7 @@ for a in "$@"; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 
 # Removing the engine-content package guts the outputs (meta-skills, the
 # authoring rule, both engine agents disappear) while everything still
@@ -42,6 +43,7 @@ unwire_package_sources "$manifest" "$rel"
 qmap_delete_key "$manifest" "packages" "$name"
 lock_remove "$lock" "$name"
 rm -rf "${IP_ROOT:?}/$rel"
+store_record_remove "$IP_ROOT" "$name"
 # Drop the now-empty scope dir so the store stays tidy.
 rmdir "$IP_ROOT/.intelligence/packages/${name%%/*}" 2>/dev/null || true
 echo "- $name"

package/cli/internal/package-update.sh

@@ -25,6 +25,7 @@ done
     || die "--latest needs the package to move: intelligence update @scope/name --latest"
 
 require_cli_project
+[ "$preview" -eq 1 ] || project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
@@ -173,11 +174,13 @@ while IFS= read -r name; do
     rm -rf "$staging"
     sha="$(fetch_package "$url" "$tag" "$path" "$staging")"
     unwire_package_sources "$manifest" "$rel"
+    store_record_remove "$IP_ROOT" "$name"
     rm -rf "${IP_ROOT:?}/$rel"
     mkdir -p "$(dirname "$IP_ROOT/$rel")"
     mv "$staging" "$IP_ROOT/$rel"
     wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
     lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$tag" "$sha"
+    store_record_set "$IP_ROOT" "$name" "$url" "$path" "$tag" "$sha"
     # The widened intent is recorded only once its content is installed and
     # wired: a manifest saying ^0.6.1 over a failed fetch would describe a
     # state the project never reached.

package/cli/internal/restore.sh

@@ -19,6 +19,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 validate_project_lock "$IP_ROOT" --restore
@@ -81,14 +82,16 @@ if [ -n "$missing" ]; then
             read -r resolved_tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
         fi
         rel=".intelligence/packages/$name"
+        store_record_remove "$IP_ROOT" "$name"
         sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
         wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
         lock_upsert "$lock" "$name" "$range" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
+        store_record_set "$IP_ROOT" "$name" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
         echo "+ $name@${resolved_tag:-${ref:-HEAD}} (resolved)"
     done
 fi
 
-# Restore every locked package that is not already in the store.
+# Restore every locked package the store does not hold at its locked commit.
 if [ -f "$lock" ]; then
     while IFS="$LOCK_SEP" read -r name _requested url path resolved sha; do
         [ -n "$name" ] || continue
@@ -96,10 +99,11 @@ if [ -f "$lock" ]; then
         # on their way into rm -rf paths, and its urls into git argv.
         assert_valid_pkg_name "$name"
         rel=".intelligence/packages/$name"
-        # --frozen never trusts what is already on disk: a pre-existing
-        # (possibly substituted) store dir would otherwise be synced with no
-        # sha verification at all.
-        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ] && [ "$frozen" -eq 0 ]; then
+        # A directory counts only with a record of the lock row it satisfies:
+        # one present without it may hold any commit. --frozen never trusts
+        # what is already on disk: a pre-existing (possibly substituted) store
+        # dir would otherwise be synced with no sha verification at all.
+        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ] && [ "$frozen" -eq 0 ]             && store_record_matches "$IP_ROOT" "$name" "$url" "$path" "$resolved" "$sha"; then
             continue
         fi
         # Fetch into staging and commit to the store only after the integrity
@@ -108,9 +112,11 @@ if [ -f "$lock" ]; then
         staging="$IP_ROOT/.intelligence/.staging-$$"
         rm -rf "$staging"
         fetch_package "$url" "$resolved" "$path" "$staging" "$sha" >/dev/null
+        store_record_remove "$IP_ROOT" "$name"
         rm -rf "${IP_ROOT:?}/$rel"
         mkdir -p "$(dirname "$IP_ROOT/$rel")"
         mv "$staging" "$IP_ROOT/$rel"
+        store_record_set "$IP_ROOT" "$name" "$url" "$path" "$resolved" "$sha"
         wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
         echo "= $name@${resolved:-HEAD}"
     done < <(lock_to_tsv "$lock")

package/cli/internal/target-state.sh

@@ -15,6 +15,7 @@ case "$action" in enable|disable) ;; *) die "internal target state: expected <en
 assert_valid_target_name "$name"
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 content_dir="$(manifest_intelligence_dir "$manifest")"
 

package/cli/lib/cli-common.sh

@@ -87,6 +87,7 @@ source "$CLI_DIR/lib/adapter-lifecycle.sh"
 source "$CLI_DIR/lib/gitignore.sh"
 source "$CLI_DIR/lib/onboarding.sh"
 source "$CLI_DIR/lib/sync-cache.sh"
+source "$CLI_DIR/lib/sync-lock.sh"
 
 # The engine-content package: OPTIONAL but auto-selected at init. Package by
 # UX (manifest entry, lockfile row, list/search/remove), bundle by mechanics —
@@ -97,12 +98,21 @@ source "$CLI_DIR/lib/sync-cache.sh"
 # Its identity is DATA shipped with the distribution (cli/engine-package.yaml),
 # never a name compiled into cli code — a fork edits the file.
 _EPKG="$CLI_DIR/engine-package.yaml"
-SYNC_PKG_NAME="$(top_scalar "$_EPKG" "name")"
-SYNC_PKG_URL="$(top_scalar "$_EPKG" "url")"
-SYNC_PKG_PATH="$(top_scalar "$_EPKG" "path")"
+SYNC_PKG_NAME="" SYNC_PKG_URL="" SYNC_PKG_PATH=""
 # Read by commands (init seeds it) — per-file shellcheck cannot see that.
 # shellcheck disable=SC2034
-DEFAULT_REGISTRY_URL="$(top_scalar "$_EPKG" "default_registry")"
+DEFAULT_REGISTRY_URL=""
+# Every command loads this file first: read the four fields in one pass.
+# shellcheck disable=SC2034  # DEFAULT_REGISTRY_URL is read by commands, as above
+while IFS="$LOCK_SEP" read -r _epkg_key _epkg_value; do
+    case "$_epkg_key" in
+        name) SYNC_PKG_NAME="$_epkg_value" ;;
+        url) SYNC_PKG_URL="$_epkg_value" ;;
+        path) SYNC_PKG_PATH="$_epkg_value" ;;
+        default_registry) DEFAULT_REGISTRY_URL="$_epkg_value" ;;
+    esac
+done <<< "$(_qmap_read tops "$_EPKG" '' 'name url path default_registry')"
+unset _epkg_key _epkg_value
 [ -n "$SYNC_PKG_NAME" ] || die "corrupt CLI installation: $_EPKG is missing or has no 'name'"
 SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 
@@ -116,15 +126,18 @@ SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 # by role — scripts/sync.sh + scripts/VERSION — never by name.
 detect_project() {
     IP_MODE="none"; IP_ROOT=""; IP_UMBRELLA=""; IP_MODULE_DIR=""
-    local dir="$PWD"
+    # PWD is already the logical `pwd` spelling, and so is each textual parent.
+    local dir="$PWD" parent
     while :; do
         if [ -f "$dir/intelligence.yaml" ]; then
             IP_MODE="cli"
-            IP_ROOT="$(cd "$dir" && pwd)"
+            IP_ROOT="$dir"
             return 0
         fi
-        [ "$dir" = "$(dirname "$dir")" ] && break
-        dir="$(dirname "$dir")"
+        parent="${dir%/*}"
+        [ -n "$parent" ] || parent="/"
+        [ "$dir" = "$parent" ] && break
+        dir="$parent"
     done
     local root
     root="$(git rev-parse --show-toplevel 2>/dev/null || true)"
@@ -257,10 +270,23 @@ default_target_output() {
     esac
 }
 
+# bundled_engine_version_var sets IS_BUNDLED_ENGINE_VERSION, reading VERSION
+# once per process; lifecycle preflight compares against it several times.
+bundled_engine_version_var() {
+    [ -z "${IS_BUNDLED_ENGINE_VERSION_READ:-}" ] || return 0
+    local version=""
+    [ -r "$IS_ENGINE_DIR/VERSION" ] || {
+        echo "ERROR: cannot read $IS_ENGINE_DIR/VERSION" >&2
+        return 1
+    }
+    IFS= read -r -d '' version < "$IS_ENGINE_DIR/VERSION" || true
+    IS_BUNDLED_ENGINE_VERSION="${version//[$' \t\r\n']/}"
+    IS_BUNDLED_ENGINE_VERSION_READ=1
+}
+
 bundled_engine_version() {
-    local version
-    version="$(< "$IS_ENGINE_DIR/VERSION")"
-    printf '%s' "${version//[$' \t\r\n']/}"
+    bundled_engine_version_var
+    printf '%s' "$IS_BUNDLED_ENGINE_VERSION"
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------
@@ -277,9 +303,11 @@ sync_pkg_entry() {
 sync_pkg_install() {
     local root="$1" ver sha
     ver="$(bundled_engine_version)"
+    store_record_remove "$root" "$SYNC_PKG_NAME"
     sha="$(fetch_package "$SYNC_PKG_URL" "v$ver" "$SYNC_PKG_PATH" "$root/$SYNC_PKG_STORE")"
     wire_package_sources "$root/intelligence.yaml" "$SYNC_PKG_NAME" "$SYNC_PKG_STORE" "$root"
     lock_upsert "$root/intelligence.lock" "$SYNC_PKG_NAME" "$ver" "$SYNC_PKG_URL" "$SYNC_PKG_PATH" "v$ver" "$sha"
+    store_record_set "$root" "$SYNC_PKG_NAME" "$SYNC_PKG_URL" "$SYNC_PKG_PATH" "v$ver" "$sha"
     echo "  engine content installed: $SYNC_PKG_STORE (v$ver)"
 }
 
@@ -345,15 +373,19 @@ assert_safe_content_dir() {
 # the admitted minor/patch gap; the predicate itself does not re-judge the gap.
 project_stamped_ahead() {
     local stamp
-    stamp="$(read_schema_version "$1/intelligence.yaml")"
-    [ -n "$stamp" ] && _ver_gt "$stamp" "$(bundled_engine_version)"
+    read_schema_version_var "$1/intelligence.yaml"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    [ -n "$stamp" ] && _ver_gt "$stamp" "$IS_BUNDLED_ENGINE_VERSION"
 }
 
 project_needs_upgrade() {
-    local root="$1" manifest="$1/intelligence.yaml" stamp eng pinned locked name
+    local root="$1" manifest="$1/intelligence.yaml" stamp eng pinned locked name url path rows
     [ -f "$manifest" ] || return 1
-    stamp="$(read_schema_version "$manifest")"
-    eng="$(bundled_engine_version)"
+    read_schema_version_var "$manifest"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    eng="$IS_BUNDLED_ENGINE_VERSION"
     [ -z "$stamp" ] && return 0
     # A project stamped ahead belongs to a newer CLI. Aligning it here would
     # restamp the schema and re-pin the engine content DOWNWARD, and the next
@@ -363,14 +395,15 @@ project_needs_upgrade() {
     _ver_gt "$eng" "$stamp" && return 0
     [ -d "$root/.intelligence/engine" ] && return 0
 
-    while IFS= read -r name; do
+    # One manifest pass for every package's fields, not a reader per field.
+    rows="$(_qmap_read fieldrows "$manifest" packages '' 'url path version')"
+    while IFS="$LOCK_SEP" read -r name url path pinned; do
         [ -n "$name" ] || continue
         # Early RC manifests mixed requested intent with resolved source
         # details. Source URL/path now live only in the required lockfile.
-        [ -n "$(qmap_field "$manifest" "packages" "$name" "url")" ] && return 0
-        [ -n "$(qmap_field "$manifest" "packages" "$name" "path")" ] && return 0
+        [ -n "$url" ] && return 0
+        [ -n "$path" ] && return 0
         if [ "$name" = "$SYNC_PKG_NAME" ]; then
-            pinned="$(qmap_field "$manifest" "packages" "$name" "version")"
             locked="$(qmap_field "$root/intelligence.lock" "packages" "$name" "resolved")"
             [ "$pinned" = "$eng" ] || return 0
             if [ -f "$root/intelligence.lock" ]; then
@@ -378,7 +411,7 @@ project_needs_upgrade() {
                 [ "${locked#v}" = "$eng" ] || return 0
             fi
         fi
-    done < <(qmap_keys "$manifest" "packages")
+    done <<< "$rows"
     return 1
 }
 
@@ -402,8 +435,10 @@ ensure_project_current() {
         die "manifest declares packages but intelligence.lock is absent — restore the committed lock before running project lifecycle commands"
     fi
     project_needs_upgrade "$root" || return 0
-    stamp="$(read_schema_version "$manifest")"
-    eng="$(bundled_engine_version)"
+    read_schema_version_var "$manifest"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    eng="$IS_BUNDLED_ENGINE_VERSION"
     if is_ci_environment && [ "$explicit" != "--explicit" ]; then
         die "project lifecycle requires alignment (stamp ${stamp:-unstamped}, engine $eng) — run 'intelligence init --apply' locally, review and commit the diff"
     fi
@@ -444,6 +479,65 @@ check_project_lock() {
     validate_project_lock "$1" "$mode"
 }
 
+# --- What the store holds (decision 0012) ---------------------------------
+# The store keeps plain files only, so which commit a package directory holds is
+# recorded beside the packages, never inside one (the engine would render it):
+# .intelligence/packages/.installed, one row per package — name, url, path,
+# resolved, sha, separated like the lock's rows — written whenever a package is
+# installed from the lock row it now satisfies. A directory without a row, or
+# with one that differs from the lock, is not what the lock pins.
+STORE_RECORD=".intelligence/packages/.installed"
+
+# store_record_get <root> <name> — set IS_REC_URL / _PATH / _RESOLVED / _SHA;
+# returns 1 when the store records nothing for <name>.
+store_record_get() {
+    local file="$1/$STORE_RECORD" name url path resolved sha
+    IS_REC_URL="" IS_REC_PATH="" IS_REC_RESOLVED="" IS_REC_SHA=""
+    [ -f "$file" ] || return 1
+    while IFS="$LOCK_SEP" read -r name url path resolved sha; do
+        [ "$name" = "$2" ] || continue
+        IS_REC_URL="$url" IS_REC_PATH="$path" IS_REC_RESOLVED="$resolved" IS_REC_SHA="$sha"
+        return 0
+    done < "$file"
+    return 1
+}
+
+# store_record_matches <root> <name> <url> <path> <resolved> <sha>
+store_record_matches() {
+    store_record_get "$1" "$2" || return 1
+    [ "$IS_REC_URL" = "$3" ] && [ "$IS_REC_PATH" = "$4" ] \
+        && [ "$IS_REC_RESOLVED" = "$5" ] && [ "$IS_REC_SHA" = "$6" ]
+}
+
+# store_record_set <root> <name> <url> <path> <resolved> <sha> — record what
+# <name> now holds; store_record_remove <root> <name> forgets it. Both rewrite
+# the file through a temp file, so a reader never sees half a row.
+store_record_set() {
+    _store_record_write "$@"
+}
+
+store_record_remove() {
+    _store_record_write "$1" "$2"
+}
+
+_store_record_write() {
+    local root="$1" target="$2" file="$1/$STORE_RECORD" tmp name rest
+    mkdir -p "$root/.intelligence/packages" || die "cannot create $root/.intelligence/packages"
+    tmp="$file.tmp.$$"
+    {
+        if [ -f "$file" ]; then
+            while IFS="$LOCK_SEP" read -r name rest; do
+                [ -n "$name" ] && [ "$name" != "$target" ] || continue
+                printf '%s%s%s\n' "$name" "$LOCK_SEP" "$rest"
+            done < "$file"
+        fi
+        [ "$#" -lt 6 ] || printf '%s%s%s%s%s%s%s%s%s\n' "$target" "$LOCK_SEP" "$3" "$LOCK_SEP" "$4" "$LOCK_SEP" "$5" "$LOCK_SEP" "$6"
+    } > "$tmp" || { rm -f "$tmp"; die "cannot write $file"; }
+    mv -f "$tmp" "$file" || { rm -f "$tmp"; die "cannot write $file"; }
+}
+
+# project_store_missing <root> — a package the manifest or lock names is absent
+# from the store, or holds something other than its lock row pins.
 project_store_missing() {
     local root="$1" manifest="$1/intelligence.yaml" name src
     while IFS= read -r name; do
@@ -460,6 +554,17 @@ project_store_missing() {
             esac
         done < <(read_yaml_list "$manifest" "$section")
     done
+    # Present is not enough: a `git pull` moves the lock and leaves the ignored
+    # store on the commit it held before.
+    local rows _requested url path resolved sha
+    [ -f "$root/intelligence.lock" ] || return 1
+    rows="$(lock_to_tsv "$root/intelligence.lock")"
+    while IFS="$LOCK_SEP" read -r name _requested url path resolved sha; do
+        [ -n "$name" ] || continue
+        assert_valid_pkg_name "$name"
+        [ -d "$root/.intelligence/packages/$name" ] || return 0
+        store_record_matches "$root" "$name" "$url" "$path" "$resolved" "$sha" || return 0
+    done <<< "$rows"
     return 1
 }
 

package/cli/lib/lockfile.sh

@@ -24,7 +24,8 @@ lock_validate() (
     # The same tokenizer supplies ordinary lock rows and strict metadata. Buffer
     # before consumption: a failed parser must never yield a partial package set.
     rows="$(_qmap_read lock "$lock" packages '' '' "$LOCKFILE_VERSION")" || return $?
-    current="$(bundled_engine_version)"
+    bundled_engine_version_var
+    current="$IS_BUNDLED_ENGINE_VERSION"
     while IFS="$LOCK_SEP" read -r kind name requested url path resolved sha line; do
         case "$kind" in
             V)

package/cli/lib/qmap.awk

@@ -177,7 +177,17 @@ END {
         exit 1
     }
     if (mode == "lock") print "V" sep top_value["lockfile_version"] sep top_value["engine_version"]
-    if (mode == "rows" || mode == "lock" || mode == "keys") {
+    if (mode == "fieldrows") {
+        # One row per package key, as `keys` lists them: the name, then each
+        # field QMAP_FIELD names (space separated), as qmap_field decodes it.
+        count = split(wanted_field, fields, " ")
+        for (i = 1; i <= row_count; i++) {
+            name = row_name[i]
+            row = name
+            for (f = 1; f <= count; f++) row = row sep field_value[name SUBSEP fields[f]]
+            print row
+        }
+    } else if (mode == "rows" || mode == "lock" || mode == "keys") {
         for (i = 1; i <= row_count; i++) {
             name = row_name[i]
             if (mode == "keys") print name
@@ -187,5 +197,10 @@ END {
                 else print row
             }
         }
+    } else if (mode == "tops") {
+        # Several top-level scalars in one pass: QMAP_KEY lists them, space
+        # separated; each present one prints as key<US>value.
+        count = split(wanted_key, tops, " ")
+        for (i = 1; i <= count; i++) if (tops[i] in top_value) print tops[i] sep top_value[tops[i]]
     } else if (found) print result
 }