@ainova-systems/intelligence 0.20.0 → 0.22.0

package/cli/commands/init.sh

@@ -356,7 +356,8 @@ manifest="$root/intelligence.yaml"
 } > "$manifest"
 
 # The package store is restorable state, never committed — the npm model.
-ensure_base_gitignore "$root"
+# Local rules, agents and skills stay on this machine (decision 0021).
+ensure_base_gitignore "$root" "$content_dir"
 for target in $targets; do
     ensure_target_gitignore "$root" "$manifest" "$target"
 done

package/cli/commands/sync.sh

@@ -106,6 +106,10 @@ run_check() {
             die "no intelligence project found here - run 'intelligence init'"
             ;;
     esac
+    # A check marks the lock it holds, so a sync started meanwhile waits for
+    # it instead of refusing (sync-lock.sh).
+    # shellcheck disable=SC2034  # read by sync-lock.sh when the lock is taken
+    SYNC_LOCK_KIND=check
     hold_project
     project_preflight "$IP_ROOT" || return $?
     if project_needs_upgrade "$IP_ROOT"; then
@@ -144,6 +148,11 @@ fi
 compact_output="$(mktemp -t intelligence-sync-XXXXXX)"
 trap 'rm -f "$compact_output"' EXIT
 rc=0
+# The one line that must not wait for the buffer: a wait for a check holding
+# the lock can last minutes (sync-lock.sh). Descriptor 9 keeps the real stderr.
+exec 9>&2
+# shellcheck disable=SC2034  # read by sync-lock.sh while the lock is taken
+IS_LOCK_NOTICE_FD=9
 (run_sync) > "$compact_output" 2>&1 || rc=$?
 if [ "$rc" -ne 0 ]; then
     cat "$compact_output" >&2

package/cli/internal/check.sh

@@ -198,6 +198,14 @@ while IFS= read -r target; do
     ok "adapter $target contract v1"
 done < <(target_names "$manifest")
 
+# A local rule, agent or skill is one these patterns name (decision 0021): the
+# engine keeps it out of every committed output, and without the pattern Git
+# would still offer to commit the file itself.
+while IFS= read -r pattern; do
+    ignore_file_has_line "$IP_ROOT/.gitignore" "$pattern" \
+        || warn "local artifact Git policy is missing '$pattern' — run 'intelligence init'"
+done < <(local_artifact_ignore_patterns "$content_dir")
+
 # Lock orphans.
 if [ "$lock_valid" -eq 1 ] && [ -f "$lock" ]; then
     while IFS= read -r name; do
@@ -214,6 +222,7 @@ fi
 # is exactly why doctor names it). Each entry is judged by the directory the
 # engine renders it as, read through the same parser: a package reference by
 # its store path, one that resolves to nothing by why.
+local_specs=()
 for section in rules agents skills; do
     seen=$'\n'
     while IFS=$'\037' read -r src state dir alias holders; do
@@ -269,10 +278,40 @@ for section in rules agents skills; do
                 # authoring later needs no config edit.
                 *) ok "sources.$section '$src' — not created yet (optional)" ;;
             esac
+            continue
         fi
+        # A project-owned source is where a tracked file can carry a local
+        # name; store content is restorable state Git never tracks.
+        case "$dir" in
+            .intelligence/*) ;;
+            *)
+                if [ "$section" = skills ]; then
+                    local_specs+=(":(glob)${dir%/}/*.local/SKILL.md")
+                else
+                    local_specs+=(":(glob)${dir%/}/*.local.md")
+                fi
+                ;;
+        esac
     done < <(read_source_entries "$manifest" "$section")
 done
 
+# A name makes an artifact local (decision 0021), and .gitignore never applies
+# to a file Git already tracks: one committed before its name meant anything,
+# or added by hand, renders only into ignored output while every clone holds
+# it. Git and the engine would disagree about it, so it is named here.
+if [ "${#local_specs[@]}" -gt 0 ] \
+    && git -C "$IP_ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    if tracked_local="$(git -C "$IP_ROOT" -c core.quotePath=false ls-files -- "${local_specs[@]}")"; then
+        while IFS= read -r path; do
+            [ -n "$path" ] || continue
+            case "$path" in */SKILL.md) path="${path%/SKILL.md}/" ;; esac
+            warn "$path is tracked by Git, but its name makes it local: sync renders it only into ignored output — rename it to share it, or 'git rm --cached' it to keep it on this machine"
+        done <<< "$tracked_local"
+    else
+        warn "tracked local artifacts could not be listed — 'git ls-files' failed"
+    fi
+fi
+
 if [ "$problems" -eq 0 ]; then
     echo "all good."
 else

package/cli/lib/gitignore.sh

@@ -312,10 +312,26 @@ ensure_gitignore_header() {
     fi
 }
 
+# local_artifact_ignore_patterns <content-dir> — the patterns that make a rule,
+# agent or skill local (decision 0021): a file or skill directory with one of
+# these names never reaches committed output, and Git never commits it. The
+# engine recognizes the same names, so the two cannot disagree; `init` writes
+# them and `status --check` reports one missing.
+local_artifact_ignore_patterns() {
+    local dir="${1#./}"
+    while [ "${dir%/}" != "$dir" ]; do dir="${dir%/}"; done
+    printf '%s\n' "$dir/rules/*.local.md" "$dir/agents/*.local.md" "$dir/skills/*.local/"
+}
+
+# ensure_base_gitignore <root> <content-dir> — the package store and the local
+# artifact patterns of the project's content directory.
 ensure_base_gitignore() {
-    local root="$1"
+    local root="$1" content_dir="$2" line
     ensure_gitignore_header "$root"
     gitignore_add_line "$root" '.intelligence/'
+    while IFS= read -r line; do
+        gitignore_add_line "$root" "$line"
+    done < <(local_artifact_ignore_patterns "$content_dir")
 }
 
 ensure_target_gitignore() {
@@ -343,7 +359,7 @@ ensure_target_gitignore() {
 
 ensure_manifest_gitignore() {
     local root="$1" manifest="$2" target
-    ensure_base_gitignore "$root"
+    ensure_base_gitignore "$root" "$(manifest_intelligence_dir "$manifest")"
     while IFS= read -r target; do
         [ -n "$target" ] || continue
         if [ "$(is_target_enabled "$manifest" "$target")" = "1" ]; then
@@ -420,6 +436,7 @@ managed_gitignore_patterns() {
     local root="$1" manifest="$2" content_dir target output records kind value
     content_dir="$(manifest_intelligence_dir "$manifest")"
     printf '%s\n' '.intelligence/' "$content_dir/_backup/"
+    local_artifact_ignore_patterns "$content_dir"
     while IFS= read -r target; do
         [ -n "$target" ] || continue
         [ "$(is_target_enabled "$manifest" "$target")" = "1" ] || continue

package/cli/lib/sync-lock.sh

@@ -12,9 +12,25 @@
 # join instead of refusing, and a holder that died can be told from one whose
 # writers still run. Taking over a dead holder's lock happens under a second
 # lock, so two runs that judged the same lock stale cannot both take it.
+#
+# `sync --check` holds the lock too, because it may restore the package store
+# and compares a copy of the live outputs. It writes nothing a person keeps, so
+# a holder that is a check marks its lock with a `kind` file, and a writing
+# command that finds such a holder waits for it instead of refusing (decision
+# 0022): a status check that runs every few minutes must never make the
+# person's own sync fail. A check never waits in line — it refuses any holder
+# at once — so it is never queued behind a writer; one that arrives as a lock is
+# released can still take it first, and the waiting writer's bound then starts
+# again for that check. A writing holder is refused at once, as before.
 
 SYNC_LOCK_HELD=""
 SYNC_LOCK_TOKEN=""
+# What this process takes the lock for: "check" for `sync --check`, empty for
+# every writer. Set before the lock is taken.
+SYNC_LOCK_KIND=""
+# How long a writer waits for each check that holds the lock, in seconds. Kept
+# in the environment only so the lock suite can exercise the bound quickly.
+SYNC_LOCK_CHECK_WAIT="${INTELLIGENCE_SYNC_LOCK_CHECK_WAIT:-300}"
 
 sync_lock_now() {
     if [ -n "${EPOCHSECONDS:-}" ]; then
@@ -47,6 +63,9 @@ sync_lock_pgid() {
 }
 
 sync_lock_write_owner() {
+    # The kind goes first, before anything that costs time: whoever can read
+    # the owner can read the kind too.
+    [ -z "$SYNC_LOCK_KIND" ] || printf '%s\n' "$SYNC_LOCK_KIND" > "$1/kind"
     sync_lock_now
     sync_lock_pgid
     SYNC_LOCK_TOKEN="$$.$IS_NOW.$RANDOM$RANDOM"
@@ -88,31 +107,89 @@ sync_lock_is_stale() {
     [ -d "$1" ] && [ -n "$(find "$1" -maxdepth 0 -mmin +1 2>/dev/null)" ]
 }
 
-# sync_lock_acquire <root> — take <root>/.intelligence/sync.lock or refuse.
+# sync_lock_held_by_check <lock> — true when the holder marked its lock as a
+# `sync --check`. A lock without the mark is a writer's, or an older CLI's.
+sync_lock_held_by_check() {
+    local kind=""
+    # The group silences the redirection too: a kind released between the
+    # test and the read must not print a stray error a caller would show.
+    [ -f "$1/kind" ] && { IFS= read -r kind < "$1/kind"; } 2>/dev/null
+    [ "$kind" = check ]
+}
+
+# sync_lock_acquire <root> — take <root>/.intelligence/sync.lock, or refuse.
+# A writer waits for each check that holds it for up to SYNC_LOCK_CHECK_WAIT
+# seconds; a check refuses at once.
 sync_lock_acquire() {
-    local root="$1" lock="$1/.intelligence/sync.lock" took=0 age=""
+    local root="$1" lock="$1/.intelligence/sync.lock" took age="" started="$SECONDS" told=0 ownerless=""
+    local holder="" seen
     # A process start costs tens of milliseconds on Git Bash: skip the usual case.
     [ -d "$root/.intelligence" ] || mkdir -p "$root/.intelligence" || die "cannot create $root/.intelligence"
-    if mkdir "$lock" 2>/dev/null; then
-        took=1
-    elif mkdir "$lock.takeover" 2>/dev/null; then
-        # Judge again under the takeover lock: another run may have taken
-        # it over since this one looked.
-        if sync_lock_is_stale "$lock"; then
-            rm -rf "$lock"
-            mkdir "$lock" 2>/dev/null && took=1
+    while :; do
+        took=0
+        if mkdir "$lock" 2>/dev/null; then
+            took=1
+        elif sync_lock_is_stale "$lock" && mkdir "$lock.takeover" 2>/dev/null; then
+            # The takeover lock is taken only for a lock that already looks
+            # stale: a command waiting for a live check must never hold it,
+            # since one interrupted mid-wait would leave it behind for good.
+            # Judge again under it: another run may have taken the lock over
+            # since this one looked.
+            if sync_lock_is_stale "$lock"; then
+                rm -rf "$lock"
+                mkdir "$lock" 2>/dev/null && took=1
+            fi
+            rmdir "$lock.takeover"
+        elif [ -d "$lock.takeover" ] && [ -n "$(find "$lock.takeover" -maxdepth 0 -mmin +1 2>/dev/null)" ]; then
+            # A takeover runs for milliseconds. Removing an abandoned one is itself
+            # a check-then-delete race, so it is left to a person.
+            die "a takeover of $lock was abandoned; if no intelligence command is running in this project, remove $lock.takeover"
         fi
-        rmdir "$lock.takeover"
-    elif [ -n "$(find "$lock.takeover" -maxdepth 0 -mmin +1 2>/dev/null)" ]; then
-        # A takeover runs for milliseconds. Removing an abandoned one is itself
-        # a check-then-delete race, so it is left to a person.
-        die "a takeover of $lock was abandoned; if no intelligence command is running in this project, remove $lock.takeover"
-    fi
-    if [ "$took" = 1 ]; then
-        sync_lock_write_owner "$lock" || { rm -rf "$lock"; die "cannot write $lock/owner"; }
-        SYNC_LOCK_HELD="$lock"
-        return 0
-    fi
+        if [ "$took" = 1 ]; then
+            sync_lock_write_owner "$lock" || { rm -rf "$lock"; die "cannot write $lock/owner"; }
+            SYNC_LOCK_HELD="$lock"
+            return 0
+        fi
+        if [ "$SYNC_LOCK_KIND" != check ] && sync_lock_held_by_check "$lock"; then
+            # A later ownerless moment belongs to another holder's start or
+            # release, and gets its own few seconds.
+            ownerless=""
+            # The bound is per check: one that took the lock while this
+            # command waited starts its own count.
+            if sync_lock_read_owner "$lock"; then
+                seen="$IS_LOCK_PID $IS_LOCK_SINCE $IS_LOCK_TOKEN"
+                if [ "$seen" != "$holder" ]; then
+                    holder="$seen"
+                    started="$SECONDS"
+                fi
+            fi
+            [ $((SECONDS - started)) -lt "$SYNC_LOCK_CHECK_WAIT" ] || break
+            if [ "$told" = 0 ]; then
+                # A caller that buffers this command's output (sync --compact)
+                # names a descriptor for the terminal, so a wait of minutes
+                # is never silent.
+                # Not one `>&"${fd:-2}"`: the group's 2>/dev/null, which keeps
+                # a closed descriptor quiet, would swallow the default too.
+                if [ -n "${IS_LOCK_NOTICE_FD:-}" ]; then
+                    { echo "waiting for intelligence sync --check to release $lock" >&"$IS_LOCK_NOTICE_FD"; } 2>/dev/null \
+                        || echo "waiting for intelligence sync --check to release $lock" >&2
+                else
+                    echo "waiting for intelligence sync --check to release $lock" >&2
+                fi
+                told=1
+            fi
+        elif ! sync_lock_read_owner "$lock"; then
+            # No owner: a holder between its mkdir and its owner file, or one
+            # being released. Both last moments, so look again for a few
+            # seconds from the first sight before calling it a run that is
+            # still starting.
+            [ -n "$ownerless" ] || ownerless="$SECONDS"
+            [ $((SECONDS - ownerless)) -lt 3 ] || break
+        else
+            break
+        fi
+        sleep 1
+    done
     if sync_lock_read_owner "$lock"; then
         sync_lock_now
         case "$IS_LOCK_SINCE" in ''|*[!0-9]*) ;; *) age=", for $((IS_NOW - IS_LOCK_SINCE))s" ;; esac
@@ -147,6 +224,11 @@ project_lock_hold() {
 sync_lock_release() {
     [ -n "$SYNC_LOCK_HELD" ] || return 0
     if sync_lock_read_owner "$SYNC_LOCK_HELD" && [ "$IS_LOCK_TOKEN" = "$SYNC_LOCK_TOKEN" ]; then
+        # A check's owner goes first: `rm -rf` alone could expose a moment with
+        # the owner still there and the kind gone, and a command waiting for
+        # the check would be refused in it. Without the owner, a waiter sees a
+        # check or a lock still starting, and waits either way.
+        [ ! -f "$SYNC_LOCK_HELD/kind" ] || rm -f "$SYNC_LOCK_HELD/owner"
         rm -rf "$SYNC_LOCK_HELD"
     fi
     SYNC_LOCK_HELD=""

package/engine/ENGINE_SHA

@@ -1 +1 @@
-c8058f91133b86479a03d7ae950191e2d21b68a6
+ee05b0f09bc74b1914e04c067cce1e87a75bd18a

package/engine/VERSION

@@ -1 +1 @@
-0.20.0
+0.22.0

package/engine/adapters/_template.sh

@@ -30,9 +30,17 @@
 #   map_effort(tool, effort)            — the tool's level for a neutral effort; "" when none
 #   map_access_to_claude_tools(access)  — full->"" (no tools list; inherits all), readonly->restricted
 #   map_access_to_claude_disallowed(access) — readonly->"Write, Edit", full->""
-#   read_yaml_list(manifest, section)   — read a source list from intelligence.yaml,
-#                                         package references as their store paths
+#   source_artifacts_var(root, config, section, adapter, output)
+#                                       — the sources this adapter renders (below)
+#   finalize_copy_named(dir, map, file...) — copy and finalize files under their rendered names
+#   copy_skill_bundle_dirs_named(tool, dir, map, skill_dir...) — copy skills under their rendered names
 #   get_target_field(config, target, field) — read a target's config field
+#
+# Read sources through source_artifacts_var, never with a glob of your own: it
+# names each artifact (`.draft.md` is `draft`, `me.local.md` is `me`), renders
+# only the later of two same-named artifacts, and leaves a local artifact out of
+# every output path Git tracks (decision 0021). An adapter that globs sources
+# itself can write a teammate's local file into a committed output.
 
 # Project adapters are sourced by engine/sync.sh after the shared library is
 # loaded. Keep this template position-independent: after scaffolding it lives
@@ -61,13 +69,24 @@ adapter_contract_<name>() {
 #   - Copy as-is (like Claude)
 #   - Convert paths: to globs: (like Cursor)
 #   - Merge into single file (like Copilot)
+#
+# source_artifacts_var takes the repo-relative path an artifact lands at, `{}`
+# standing for its name, and fills IS_SOURCE_FILES (the source file, or a
+# skill's SKILL.md), IS_SOURCE_NAMES, IS_SOURCE_SCOPED (1 for a rule with
+# `paths:`), IS_SOURCE_IN_AGENTS (1 when AGENTS.md carries the artifact too)
+# and IS_SOURCE_NAME_MAP, the names finalize_copy_named and
+# copy_skill_bundle_dirs_named write under. It lists only the artifacts whose
+# `targets:` / `exclude_targets:` select this adapter; the shared helpers drop
+# both fields from every copy, and a frontmatter copied by hand must too.
 sync_<name>_rules() {
     local repo_root="$1"
     local config_file="$2"
     local output_dir="$3"
 
-    # TODO: Implement rule sync logic
-    echo "  rules: not implemented"
+    output_rel_var "$repo_root" "$output_dir"
+    source_artifacts_var "$repo_root" "$config_file" rules <name> "$IS_OUTPUT_REL/rules/{}.md"
+    # TODO: Render each of IS_SOURCE_FILES into $output_dir/rules/ under its IS_SOURCE_NAMES entry
+    echo "  rules: ${#IS_SOURCE_FILES[@]} found, not rendered"
 }
 
 # Sync skills for <agent-name>
@@ -76,8 +95,11 @@ sync_<name>_skills() {
     local config_file="$2"
     local output_dir="$3"
 
-    # TODO: Implement skill sync logic
-    echo "  skills: not implemented"
+    output_rel_var "$repo_root" "$output_dir"
+    source_artifacts_var "$repo_root" "$config_file" skills <name> "$IS_OUTPUT_REL/skills/{}"
+    # TODO: Copy each skill directory ("${IS_SOURCE_FILES[i]%/SKILL.md}") with
+    # copy_skill_bundle_dirs_named <name> "$output_dir/skills" "$IS_SOURCE_NAME_MAP" <dir>...
+    echo "  skills: ${#IS_SOURCE_FILES[@]} found, not rendered"
 }
 
 # Sync agents for <agent-name>
@@ -86,8 +108,10 @@ sync_<name>_agents() {
     local config_file="$2"
     local output_dir="$3"
 
-    # TODO: Implement agent sync logic
-    echo "  agents: not implemented"
+    output_rel_var "$repo_root" "$output_dir"
+    source_artifacts_var "$repo_root" "$config_file" agents <name> "$IS_OUTPUT_REL/agents/{}.md"
+    # TODO: Render each of IS_SOURCE_FILES into $output_dir/agents/ under its IS_SOURCE_NAMES entry
+    echo "  agents: ${#IS_SOURCE_FILES[@]} found, not rendered"
 }
 
 # Main entry point

package/engine/adapters/agents.sh

@@ -60,15 +60,19 @@ agents_md_append_agents_table() {
     local rows=""
     local count=0
 
-    local -a files=()
-    read_source_artifact_files "$repo_root" "$config_file" "agents"
-    [ "${#IS_SOURCE_FILES[@]}" -eq 0 ] || files=("${IS_SOURCE_FILES[@]}")
+    local -a files=() names=()
+    source_artifacts_var "$repo_root" "$config_file" agents agents "${output#"$repo_root"/}"
+    if [ "${#IS_SOURCE_FILES[@]}" -gt 0 ]; then
+        files=("${IS_SOURCE_FILES[@]}")
+        names=("${IS_SOURCE_NAMES[@]}")
+    fi
 
     if [ "${#files[@]}" -gt 0 ]; then
-        local path tier access desc name
+        local path tier access desc name i=0
+        # frontmatter_index prints one row per file, in argument order.
         while IFS=$'\x1f' read -r path tier access desc; do
-            [ -n "$path" ] || continue
-            name="${path##*/}"; name="${name%.md}"
+            name="${names[i]}"
+            i=$((i + 1))
             repo_rel_link_var "$repo_root" "$path"
             if [ -n "$IS_REPO_REL" ]; then
                 rows+="| [$name]($IS_REPO_REL) | ${tier:--} | ${access:--} | ${desc:--} |"$'\n'
@@ -101,21 +105,24 @@ agents_md_append_skills_table() {
     local rows=""
     local count=0
 
-    local dirname
-    local -a skill_files=()
-    read_source_artifact_files "$repo_root" "$config_file" "skills"
-    [ "${#IS_SOURCE_FILES[@]}" -eq 0 ] || skill_files=("${IS_SOURCE_FILES[@]}")
+    local name
+    local -a skill_files=() names=()
+    source_artifacts_var "$repo_root" "$config_file" skills agents "${output#"$repo_root"/}"
+    if [ "${#IS_SOURCE_FILES[@]}" -gt 0 ]; then
+        skill_files=("${IS_SOURCE_FILES[@]}")
+        names=("${IS_SOURCE_NAMES[@]}")
+    fi
 
     if [ "${#skill_files[@]}" -gt 0 ]; then
-        local path desc
+        local path desc i=0
         while IFS=$'\x1f' read -r path desc; do
-            [ -n "$path" ] || continue
-            dirname="${path%/SKILL.md}"; dirname="${dirname##*/}"
+            name="${names[i]}"
+            i=$((i + 1))
             repo_rel_link_var "$repo_root" "$path"
             if [ -n "$IS_REPO_REL" ]; then
-                rows+="| [$dirname]($IS_REPO_REL) | ${desc:--} |"$'\n'
+                rows+="| [$name]($IS_REPO_REL) | ${desc:--} |"$'\n'
             else
-                rows+="| $dirname | ${desc:--} |"$'\n'
+                rows+="| $name | ${desc:--} |"$'\n'
             fi
             count=$((count + 1))
         done < <(frontmatter_index "description" "${skill_files[@]}")
@@ -144,30 +151,25 @@ agents_md_append_rules_list() {
     local count=0
     local global_rule_files=()
 
-    local -a files=()
-    read_source_artifact_files "$repo_root" "$config_file" "rules"
-    [ "${#IS_SOURCE_FILES[@]}" -eq 0 ] || files=("${IS_SOURCE_FILES[@]}")
-
-    if [ "${#files[@]}" -gt 0 ]; then
-        local path hp name scope
-        while IFS=$'\x1f' read -r path hp; do
-            [ -n "$path" ] || continue
-            name="${path##*/}"; name="${name%.md}"
-            scope="global"
-            if [ "$hp" != "0" ]; then
-                scope="scoped"
-            else
-                global_rule_files+=("$path")
-            fi
-            repo_rel_link_var "$repo_root" "$path"
-            if [ -n "$IS_REPO_REL" ]; then
-                lines+="- [$name]($IS_REPO_REL) ($scope)"$'\n'
-            else
-                lines+="- $name ($scope)"$'\n'
-            fi
-            count=$((count + 1))
-        done < <(frontmatter_index "paths#" "${files[@]}")
-    fi
+    local i path name scope
+    source_artifacts_var "$repo_root" "$config_file" rules agents "${output#"$repo_root"/}"
+    for ((i = 0; i < ${#IS_SOURCE_FILES[@]}; i++)); do
+        path="${IS_SOURCE_FILES[i]}"
+        name="${IS_SOURCE_NAMES[i]}"
+        scope="global"
+        if [ "${IS_SOURCE_SCOPED[i]}" = 1 ]; then
+            scope="scoped"
+        else
+            global_rule_files+=("$path")
+        fi
+        repo_rel_link_var "$repo_root" "$path"
+        if [ -n "$IS_REPO_REL" ]; then
+            lines+="- [$name]($IS_REPO_REL) ($scope)"$'\n'
+        else
+            lines+="- $name ($scope)"$'\n'
+        fi
+        count=$((count + 1))
+    done
 
     [ "$count" -eq 0 ] && return 0
 
@@ -196,17 +198,7 @@ agents_md_append_rules_list() {
             echo "<!-- Inlined from always-on rules in $content_rel/rules/ -->"
             echo ""
         } >> "$output"
-        # One awk inlines every global rule body, with a blank line after
-        # each — the same output the per-file passes produced.
-        awk '
-            FNR == 1 { if (NR != 1) print ""; in_fm = 0; past_fm = 0 }
-            { sub(/\r$/, "") }
-            /^---$/ {
-                if (!past_fm) { in_fm = !in_fm; if (!in_fm) { past_fm = 1 }; next }
-            }
-            past_fm || !in_fm { print }
-            END { print "" }
-        ' "${global_rule_files[@]}" >> "$output"
+        emit_rule_bodies "${global_rule_files[@]}" >> "$output"
         echo "  rules: ${#global_rule_files[@]} global rule(s) inlined"
     fi
 }