@attalabs/vinaya 0.19.3 → 0.21.0

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync27 } from "node:fs";
+import { readFileSync as readFileSync28 } from "node:fs";
 import { dirname as dirname9, join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/archive.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
@@ -164,6 +164,16 @@ function maskIndentedCode(body, fill) {
 
 // ../../packages/aeg-forge-state/src/parse-rationale-deps.ts
 var SECTION_HEADER = /\*\*Dependency rationale\*\*/i;
+// ../../packages/aeg-forge-state/src/check-milestone-attachment.ts
+function checkMilestoneAttachment(labeledIssueNumbers, attachedIssueNumbers) {
+  const attachedSet = new Set(attachedIssueNumbers);
+  const labeledSet = new Set(labeledIssueNumbers);
+  const unattached = labeledIssueNumbers.filter((n) => !attachedSet.has(n));
+  const foreign = attachedIssueNumbers.filter((n) => !labeledSet.has(n));
+  if (unattached.length === 0 && foreign.length === 0)
+    return { status: "clean" };
+  return { status: "mismatch", unattached, foreign };
+}
 // ../../packages/aeg-forge-state/src/gh.ts
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
@@ -172,6 +182,12 @@ var systemEnv = {
   ...process.env,
   PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
 };
+function run(args) {
+  return execFileSync("gh", args, { encoding: "utf8", env: systemEnv });
+}
+function ghApiGet(path) {
+  return JSON.parse(run(["api", path]));
+}
 
 // ../../packages/aeg-forge-state/src/labels.ts
 var LABELS = [
@@ -182,6 +198,13 @@ var LABELS = [
     form: "literal",
     carries: "Execution is halted pending an external unblock; wins over every other derived status."
   },
+  {
+    key: "backlog",
+    id: "vinaya/backlog",
+    category: "state",
+    form: "literal",
+    carries: "The Issue is deliberately unplanned — belongs to no tranche and is excluded from dispatch, until a Planner promotes it."
+  },
   {
     key: "tier-0",
     id: "vinaya/tier:0",
@@ -428,6 +451,47 @@ function parseFieldValue(value) {
 function projectsFromBody(body) {
   return projectFieldFromBody(body).names;
 }
+
+// ../../packages/aeg-forge-state/src/fetch-milestone.ts
+var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
+var NEXT_HEADING = /^#{1,6}\s+\S/m;
+var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
+function intentGoalForSlug(description, slug) {
+  const text = stripCode(description, { inlineSpans: "keep" });
+  const start = text.match(INTENTS_HEADING);
+  if (!start || start.index === undefined)
+    return "";
+  const rest = text.slice(start.index + start[0].length);
+  const next = rest.match(NEXT_HEADING);
+  const section = rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+  for (const line of section.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+      continue;
+    const m = trimmed.match(INTENT_BULLET);
+    if (m && (m[1] ?? "").toLowerCase() === slug.toLowerCase())
+      return (m[2] ?? "").trim();
+  }
+  return "";
+}
+function matchesLegacyMilestone(milestones, slug) {
+  return milestones.find((m) => m.title === slug) ?? null;
+}
+function resolveMilestoneAttachTarget(milestones, slug) {
+  const legacy = matchesLegacyMilestone(milestones, slug);
+  if (legacy?.state === "open")
+    return { number: legacy.number, title: legacy.title };
+  const intentMatch = milestones.find((m) => m.state === "open" && intentGoalForSlug(m.description ?? "", slug) !== "");
+  return intentMatch ? { number: intentMatch.number, title: intentMatch.title } : null;
+}
+function findMilestoneAttachTargetForSlug(owner, repo, slug) {
+  const milestones = ghApiGet(`repos/${owner}/${repo}/milestones?state=all&per_page=100`);
+  return resolveMilestoneAttachTarget(milestones, slug);
+}
+function hasExplicitMilestoneFlag(args) {
+  return args.some((a) => a === "--milestone" || a === "-m" || a.startsWith("--milestone="));
+}
 // ../../packages/aeg-forge-state/src/github-token.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
@@ -724,6 +788,207 @@ var DERIVED_STATUSES = [
   "incoherent"
 ];
 var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../packages/aeg-core/src/report-tokens.ts
+function stripNewlines(value) {
+  return value.replace(/\r?\n/g, " ");
+}
+function sanitizeForTableCell(value) {
+  return stripNewlines(value).replace(/\|/g, "\\|");
+}
+var DASH_LOOKALIKES = {
+  "-": "‑",
+  "–": "‒",
+  "—": "―"
+};
+var DASH_CHARS = new Set(Object.keys(DASH_LOOKALIKES));
+function sanitizeForTokensLine(value) {
+  const stripped = stripNewlines(value);
+  let result = "";
+  for (let i = 0;i < stripped.length; i++) {
+    const ch = stripped[i];
+    if (DASH_CHARS.has(ch)) {
+      const leftReachable = i === 0 || /\s/.test(stripped[i - 1]);
+      const rightReachable = i === stripped.length - 1 || /\s/.test(stripped[i + 1]);
+      if (leftReachable && rightReachable) {
+        result += DASH_LOOKALIKES[ch];
+        continue;
+      }
+    }
+    result += ch;
+  }
+  return result;
+}
+function renderCells(input) {
+  const model = input.modelOverride ?? input.summary?.model ?? null;
+  if (!input.summary)
+    return { model, tokensIn: "—", tokensOut: "—" };
+  const { inputTokens, cacheCreationInputTokens, cacheReadInputTokens, outputTokens } = input.summary.components;
+  const tokensIn = inputTokens + cacheCreationInputTokens + cacheReadInputTokens;
+  return { model, tokensIn: String(tokensIn), tokensOut: String(outputTokens) };
+}
+function formatTokensLine(input) {
+  const { model, tokensIn, tokensOut } = renderCells(input);
+  const phase = sanitizeForTokensLine(input.phase);
+  const role = sanitizeForTokensLine(input.role);
+  const safeModel = model === null ? "—" : sanitizeForTokensLine(model);
+  if (!input.summary) {
+    return `Tokens: ${phase} — ${role} — ${safeModel} — —`;
+  }
+  return `Tokens: ${phase} — ${role} — ${safeModel} — ${tokensIn}/${tokensOut}/—`;
+}
+function formatTokenReportRow(input) {
+  const { model, tokensIn, tokensOut } = renderCells(input);
+  const phase = sanitizeForTableCell(input.phase);
+  const role = sanitizeForTableCell(input.role);
+  const safeModel = model === null ? "—" : sanitizeForTableCell(model);
+  const date = sanitizeForTableCell(input.date);
+  return `| ${phase} | ${role} | ${safeModel} | ${tokensIn} | ${tokensOut} | — | ${date} |`;
+}
+function formatBreakdown(summary) {
+  const { inputTokens, cacheCreationInputTokens, cacheReadInputTokens, outputTokens } = summary.components;
+  return [
+    `  fresh input tokens:    ${inputTokens}`,
+    `  cache creation tokens: ${cacheCreationInputTokens}`,
+    `  cache read tokens:     ${cacheReadInputTokens}`,
+    `  output tokens:         ${outputTokens}`,
+    `  model:                 ${summary.model ?? "—"}`,
+    `  messages summed:       ${summary.messageCount}`
+  ].join(`
+`);
+}
+// ../../packages/aeg-core/src/claude-code-transcript.ts
+function summarizeTranscript(jsonl) {
+  const seen = new Set;
+  const components = {
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheCreationInputTokens: 0,
+    cacheReadInputTokens: 0
+  };
+  let model = null;
+  let messageCount = 0;
+  for (const rawLine of jsonl.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line)
+      continue;
+    let entry2;
+    try {
+      entry2 = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!entry2 || typeof entry2 !== "object")
+      continue;
+    const obj = entry2;
+    if (obj.type !== "assistant")
+      continue;
+    const message = obj.message;
+    const id = message?.id;
+    const usage = message?.usage;
+    if (typeof id !== "string" || !id || !usage || seen.has(id))
+      continue;
+    seen.add(id);
+    messageCount++;
+    components.inputTokens += numberOr(usage.input_tokens, 0);
+    components.outputTokens += numberOr(usage.output_tokens, 0);
+    components.cacheCreationInputTokens += numberOr(usage.cache_creation_input_tokens, 0);
+    components.cacheReadInputTokens += numberOr(usage.cache_read_input_tokens, 0);
+    const messageModel = message?.model;
+    if (typeof messageModel === "string" && messageModel)
+      model = messageModel;
+  }
+  return { components, model, messageCount };
+}
+function numberOr(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+}
+function sanitizeKey(value) {
+  return value.replace(/[^A-Za-z0-9]+/g, "-");
+}
+function transcriptPointerPath(projectDir, tmpDir) {
+  return `${tmpDir}/claude-transcript-${sanitizeKey(projectDir)}.txt`;
+}
+function resolvePointer(explicitTranscriptPath, deps) {
+  if (explicitTranscriptPath)
+    return { path: explicitTranscriptPath, corroborated: true };
+  const projectDir = deps.env.CLAUDE_PROJECT_DIR ?? deps.cwd;
+  const tmpDir = deps.env.TMPDIR ?? "/tmp";
+  const pointerPath = transcriptPointerPath(projectDir, tmpDir);
+  const currentSessionId = deps.env.CLAUDE_CODE_SESSION_ID;
+  if (!deps.exists(pointerPath)) {
+    return {
+      pointerExisted: false,
+      corroborated: false,
+      error: `No transcript pointer at ${pointerPath} and no --transcript given. ` + "Either this repo installs no track-transcript.sh Stop hook (lacking one is not a defect — " + "name the transcript directly instead), or no session has completed a turn yet."
+    };
+  }
+  let contents;
+  try {
+    contents = deps.readFile(pointerPath).replace(/\r?\n+$/, "");
+  } catch (err) {
+    return {
+      pointerExisted: true,
+      oursByLocation: true,
+      error: `Transcript pointer at ${pointerPath} could not be read: ${err.message}. ` + "Remove that file to clear this — the Stop hook rewrites it on the next turn."
+    };
+  }
+  const [pointerSessionId, transcriptPath] = contents.split("\t");
+  if (!transcriptPath) {
+    return {
+      pointerExisted: true,
+      oursByLocation: true,
+      error: `Transcript pointer file ${pointerPath} is malformed: "${contents.slice(0, 120)}${contents.length > 120 ? "…" : ""}". ` + "Remove that file to clear this — the Stop hook rewrites it on the next turn."
+    };
+  }
+  if (currentSessionId && pointerSessionId && currentSessionId !== pointerSessionId) {
+    return {
+      pointerExisted: true,
+      corroborated: false,
+      error: `Transcript pointer at ${pointerPath} is stale: written for session ${pointerSessionId}, ` + `but this session is ${currentSessionId}. Name your own transcript with --transcript instead of ` + "reporting another session's figures as yours."
+    };
+  }
+  return { path: transcriptPath, corroborated: Boolean(currentSessionId && pointerSessionId) };
+}
+function resolveMeteringCapability(deps, explicitTranscriptPath) {
+  const resolved = resolvePointer(explicitTranscriptPath, deps);
+  if ("error" in resolved) {
+    const ours = resolved.pointerExisted && (resolved.corroborated || resolved.oursByLocation);
+    if (ours)
+      return { capable: false, reason: "pointer-unusable", detail: resolved.error };
+    return {
+      capable: false,
+      reason: "no-transcript-resolved",
+      detail: resolved.pointerExisted ? `A transcript pointer exists but belongs to another session, so this session has no wiring of its own to use. (Underlying condition, for diagnosis only: ${resolved.error})` : resolved.error
+    };
+  }
+  const downstream = (r, detail) => resolved.corroborated ? { reason: r, detail } : {
+    reason: "no-transcript-resolved",
+    detail: `A transcript pointer was found but could not be shown to belong to this session, so it is not treated as this session's wiring. (Underlying condition, for diagnosis only: ${detail})`
+  };
+  if (!deps.exists(resolved.path)) {
+    return {
+      capable: false,
+      ...downstream("transcript-unreadable", `Resolved transcript path ${resolved.path} is not readable as a regular file owned by this user.`)
+    };
+  }
+  let jsonl;
+  try {
+    jsonl = deps.readFile(resolved.path);
+  } catch (err) {
+    return {
+      capable: false,
+      ...downstream("transcript-unreadable", `Transcript at ${resolved.path} could not be read: ${err.message}`)
+    };
+  }
+  const summary = summarizeTranscript(jsonl);
+  if (summary.messageCount === 0) {
+    return {
+      capable: false,
+      ...downstream("transcript-empty", `Transcript at ${resolved.path} yielded zero assistant messages with usage data — ` + "it's empty, unparseable, or not yet flushed to disk.")
+    };
+  }
+  return { capable: true, transcriptPath: resolved.path, summary };
+}
 // ../../packages/aeg-core/src/file-classify.ts
 function isCodeFile(p) {
   if (p.endsWith(".md"))
@@ -1311,6 +1576,8 @@ var EXEMPT_LITERALS = new Set([
 var NON_PATH_TOP_SEGMENTS = new Set(["origin", "refs", "HEAD", "vinaya", "fix"]);
 // ../../packages/aeg-core/src/reader-resolvable-prose.ts
 var SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
+// ../../packages/aeg-core/src/quoted-command.ts
+var QUOTED_COMMAND_SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
 // ../../packages/aeg-core/src/retired-vocabulary.ts
 var RETIRED_PATTERNS = [
   String.raw`\bD-[0-9]{3}\b`,
@@ -1368,6 +1635,14 @@ function checkDirectMainPush(fact) {
     return { verdict: "legitimate", mergedPrNumber: first };
   return { verdict: "direct-push", sha: fact.sha };
 }
+// ../../packages/aeg-core/src/ensure-label.ts
+var LABEL_COLOR = "B60205";
+function ensureLabelExists(repoFlag, name, description, io) {
+  const existing = io.listLabelNames(repoFlag);
+  if (existing.includes(name))
+    return;
+  io.createLabel(repoFlag, name, description, LABEL_COLOR);
+}
 // ../../packages/aeg-core/src/dead-branch-push-audit.ts
 function findDeadBranchPushes(facts) {
   return facts.filter((f) => new Date(f.latestCommitAt).getTime() > new Date(f.resolvedAt).getTime()).map(({ branch, prNumber, prState, resolvedAt, latestCommitAt }) => ({
@@ -1395,15 +1670,15 @@ function releaseFieldFromText(text) {
   const raw = unwrapValue2(m[1] ?? "");
   return { declared: true, value: RELEASE_VALUE.test(raw) ? raw : null };
 }
-var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
-var NEXT_HEADING = /^#{1,6}\s+\S/m;
-var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
+var INTENTS_HEADING2 = /^#{1,6}\s*Tranche intents\s*$/im;
+var NEXT_HEADING2 = /^#{1,6}\s+\S/m;
+var INTENT_BULLET2 = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
 function intentsBlock(text) {
-  const start = text.match(INTENTS_HEADING);
+  const start = text.match(INTENTS_HEADING2);
   if (!start || start.index === undefined)
     return null;
   const rest = text.slice(start.index + start[0].length);
-  const next = rest.match(NEXT_HEADING);
+  const next = rest.match(NEXT_HEADING2);
   const sectionEnd = next && next.index !== undefined ? next.index : rest.length;
   return { start: start.index, end: start.index + start[0].length + sectionEnd, section: rest.slice(0, sectionEnd) };
 }
@@ -1420,7 +1695,7 @@ function parseIntents(text) {
     const trimmed = line.trim();
     if (trimmed.length === 0)
       continue;
-    const m = trimmed.match(INTENT_BULLET);
+    const m = trimmed.match(INTENT_BULLET2);
     if (!m)
       return { intents: [], malformed: true };
     intents.push({ slug: (m[1] ?? "").toLowerCase(), goal: (m[2] ?? "").trim() });
@@ -1634,6 +1909,91 @@ function buildClaudeCommandOps() {
   ];
 }
 
+// src/lib/claude-stop-hook-emitter.ts
+var CLAUDE_STOP_HOOK_GROUP = "Claude Code Stop hook (transcript pointer)";
+var CLAUDE_STOP_HOOK_MARKER = "track-transcript";
+var CLAUDE_STOP_HOOK_SCRIPT_PATH = ".claude/hooks/track-transcript.sh";
+var CLAUDE_SETTINGS_PATH = ".claude/settings.json";
+var SH_PREAMBLE = `#!/usr/bin/env sh
+`;
+function renderTrackTranscriptScriptBody() {
+  return `# Vinaya-managed Stop hook. Records this session's transcript_path (and
+# session_id) so the token-report adapter can resolve it without scanning
+# ~/.claude/projects/ for the newest file, which silently grabs another
+# concurrent session's transcript when two worktrees are active at once.
+node -e '
+const fs = require("fs")
+let data = ""
+process.stdin.on("data", (c) => { data += c })
+process.stdin.on("end", () => {
+  let hook
+  try {
+    hook = JSON.parse(data)
+  } catch {
+    return
+  }
+  if (!hook.transcript_path) return
+  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd()
+  const tmpDir = process.env.TMPDIR || "/tmp"
+  const key = projectDir.replace(/[^A-Za-z0-9]+/g, "-")
+  const pointerPath = tmpDir + "/claude-transcript-" + key + ".txt"
+  const content = (hook.session_id || "") + "\\t" + hook.transcript_path + "\\n"
+  const scratchPath = pointerPath + "." + process.pid + "." + Math.random().toString(36).slice(2) + ".tmp"
+  try {
+    fs.writeFileSync(scratchPath, content, { mode: 0o600, flag: "wx" })
+  } catch {
+    return
+  }
+  try {
+    fs.renameSync(scratchPath, pointerPath)
+  } catch {
+    try { fs.unlinkSync(scratchPath) } catch {}
+  }
+})
+'
+exit 0`;
+}
+function renderClaudeSettingsWithStopHook() {
+  const settings = {
+    $schema: "https://json.schemastore.org/claude-code-settings.json",
+    hooks: {
+      Stop: [
+        {
+          hooks: [
+            {
+              type: "command",
+              command: `$CLAUDE_PROJECT_DIR/${CLAUDE_STOP_HOOK_SCRIPT_PATH}`,
+              timeout: 5
+            }
+          ]
+        }
+      ]
+    }
+  };
+  return `${JSON.stringify(settings, null, 2)}
+`;
+}
+function buildClaudeStopHookOps() {
+  return [
+    {
+      kind: "managed-block",
+      path: CLAUDE_STOP_HOOK_SCRIPT_PATH,
+      marker: CLAUDE_STOP_HOOK_MARKER,
+      body: renderTrackTranscriptScriptBody(),
+      comment: "hash",
+      hostPreamble: SH_PREAMBLE,
+      mode: 493,
+      group: CLAUDE_STOP_HOOK_GROUP
+    },
+    {
+      kind: "create-file",
+      path: CLAUDE_SETTINGS_PATH,
+      content: renderClaudeSettingsWithStopHook(),
+      group: CLAUDE_STOP_HOOK_GROUP
+    }
+  ];
+}
+
 // src/lib/gemini-command-emitter.ts
 var GEMINI_COMMAND_GROUP = "Gemini CLI command (.gemini/commands/)";
 var GEMINI_COMMAND_PATH = ".gemini/commands/vinaya.toml";
@@ -2396,6 +2756,7 @@ function starterDocOwners() {
 }
 var FIXED_LABEL_METADATA = {
   blocked: { color: "e11d21", description: "Execution halted pending an external unblock" },
+  backlog: { color: "ededed", description: "Deliberately unplanned — belongs to no tranche until promoted" },
   "tier-0": { color: "ededed", description: "Trivial / mechanical change" },
   "tier-1": { color: "c5def5", description: "Standard task — code + tests + docs" },
   "tier-3": { color: "d93f0b", description: "Records a decision; ratification-gated" },
@@ -2451,6 +2812,14 @@ var CODEOWNERS_NOTE = `Recommended: require review on vinaya's own workflow file
 Then add this flag to the branch-protection command above:
 
   -F required_pull_request_reviews.require_code_owner_reviews=true`;
+var PRINCIPALS_NOTE = `Recommended: without this, review-gate trusts nobody's verdicts on this repo.
+
+  Add to vinaya.config.json:
+    "principals": ["<your-github-login>"]
+
+Anyone reviewing a PR here (code-reviewer/security verdicts, the
+vinaya/waiver:review label) must be listed, or their comments are ignored
+and every PR reads as unreviewed. \`vinaya doctor\` reports when this is unset.`;
 function buildInitOps(ctx) {
   const ops = [];
   const hookMode = 493;
@@ -2563,26 +2932,45 @@ function buildInitOps(ctx) {
   }
   if (ctx.agents.has("claude")) {
     ops.push(...buildClaudeCommandOps());
+    ops.push(...buildClaudeStopHookOps());
   }
   if (ctx.agents.has("gemini")) {
     ops.push(buildGeminiCommandOp());
   }
+  if (ctx.agents.size > 0) {
+    const affected = [];
+    if (ctx.agents.has("claude"))
+      affected.push("the `/vinaya <role>` command (.claude/commands/vinaya.md)");
+    if (ctx.agents.has("gemini"))
+      affected.push("the `/vinaya` command (.gemini/commands/vinaya.toml)");
+    if (ctx.agents.has("skills"))
+      affected.push("every .agents/skills/vinaya-*/SKILL.md file");
+    ops.push({
+      kind: "print",
+      message: "The agent-native commands above (`vinaya doctrine`) need `vinaya` resolvable on PATH:\n\n" + `  npm install -g @attalabs/vinaya
+
+` + `Without a global install, ${affected.join(" and ")} fail "command not found" the first time an agent ` + "tries to use them.",
+      group: "Agent-native commands (printed, never applied)"
+    });
+  }
   ops.push(...labelOps());
   ops.push({ kind: "print", message: BRANCH_PROTECTION_NOTE, group: "Branch protection (printed, never applied)" });
   ops.push({ kind: "print", message: CODEOWNERS_NOTE, group: "Branch protection (printed, never applied)" });
+  ops.push({ kind: "print", message: PRINCIPALS_NOTE, group: "Review trust (printed, never applied)" });
   return ops;
 }
 
 // src/lib/ops.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, isAbsolute, join as join6, resolve, sep as sep2 } from "node:path";
+import { dirname as dirname4, isAbsolute, join as join6, resolve as resolve2, sep as sep2 } from "node:path";
 
 // src/lib/config.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { dirname as dirname3, join as join5, resolve } from "node:path";
 import { z } from "zod";
 
 // src/lib/agent-vendors.ts
@@ -2703,8 +3091,15 @@ function isSafeRepoRelPath(p) {
 var SafeRepoRelPath = z.string().refine(isSafeRepoRelPath, {
   message: "must be a repo-root-relative path with no `..` segment or absolute root"
 });
+var CANONICAL_HOOK_BLOCK_PREFIXES = [".git/", ".husky/", ".vinaya/hooks/", ".claude/hooks/"];
+function isCanonicalHookBlockPath(p) {
+  return CANONICAL_HOOK_BLOCK_PREFIXES.some((prefix) => p.startsWith(prefix) && p.length > prefix.length);
+}
+var ManagedHookBlockPath = SafeRepoRelPath.refine(isCanonicalHookBlockPath, {
+  message: `must start with one of ${CANONICAL_HOOK_BLOCK_PREFIXES.join(", ")} (byte-exact, case-sensitive)`
+});
 var ManagedBlockRecordSchema = z.object({
-  path: SafeRepoRelPath,
+  path: ManagedHookBlockPath,
   marker: z.string(),
   comment: z.enum(["hash", "html"])
 });
@@ -2726,6 +3121,20 @@ function resolveAgentVendors(manifest) {
     return new Set(AGENT_VENDORS);
   return new Set(manifest.agents);
 }
+var ProjectEntrySchema = z.object({
+  name: z.string().min(1),
+  description: z.string().min(1).optional(),
+  path: z.string().min(1).optional()
+});
+function parseTokensCollectDeclaration(value) {
+  const m = value.trim().match(/^(\S+)\s+(\S+)$/);
+  if (!m)
+    return null;
+  const [, interpreter, script] = m;
+  if (!isSafeRepoRelPath(script))
+    return null;
+  return { interpreter, script };
+}
 var VinayaConfigSchema = z.object({
   rings: z.object({
     ring1_forgeWriteInterception: z.boolean(),
@@ -2738,13 +3147,19 @@ var VinayaConfigSchema = z.object({
   principals: z.array(z.string()).min(1).optional(),
   releaseActor: z.string().min(1).optional(),
   ci: z.object({ setup: z.string().min(1) }).optional(),
+  tokens: z.object({
+    collect: z.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
+      message: 'tokens.collect must be exactly "<interpreter> <repo-relative-script-path>" — two whitespace-separated tokens, no flags, no shell syntax, no quoting'
+    })
+  }).optional(),
   blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional(),
   proseGates: z.object({
     doctrineRoot: z.string().min(1).optional(),
     readerFacingPrefix: z.string().min(1).optional(),
     readerFacingSuffix: z.string().min(1).optional(),
     legacySlugDir: z.string().min(1).optional()
-  }).optional()
+  }).optional(),
+  projects: z.array(ProjectEntrySchema).optional()
 });
 var GLOBAL_VINAYA_HOME = join5(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join5(GLOBAL_VINAYA_HOME, "config.json");
@@ -2783,6 +3198,9 @@ function globalRolesIgnoredWarning(path) {
 function globalReleaseActorIgnoredWarning(path) {
   return `${path}: "releaseActor" in the global config is ignored — releaseActor may only be declared from a repo-local vinaya.config.json.`;
 }
+function globalTokensCollectIgnoredWarning(path) {
+  return `${path}: "tokens" in the global config is ignored — tokens.collect may only be declared from a repo-local vinaya.config.json.`;
+}
 function stripGlobalOnlyKeys(config, path) {
   if (path !== GLOBAL_CONFIG_PATH)
     return config;
@@ -2803,6 +3221,10 @@ function stripGlobalOnlyKeys(config, path) {
     console.error(`⚠ ${globalReleaseActorIgnoredWarning(path)}`);
     result = { ...result, releaseActor: undefined };
   }
+  if (result.tokens) {
+    console.error(`⚠ ${globalTokensCollectIgnoredWarning(path)}`);
+    result = { ...result, tokens: undefined };
+  }
   return result;
 }
 function resolvePrincipalAllowlist(config) {
@@ -2912,6 +3334,69 @@ function loadConfigChecked() {
   }
   return { ok: true, config: stripGlobalOnlyKeys(parsed.data, path) };
 }
+var TOKENS_COLLECT_TRUST_PATH = join5(GLOBAL_VINAYA_HOME, "tokens-collect-trust.json");
+function readTokensCollectTrustStore(storePath) {
+  try {
+    if (!existsSync4(storePath))
+      return {};
+    const raw = JSON.parse(readFileSync4(storePath, "utf-8"));
+    return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  } catch {
+    return {};
+  }
+}
+function writeTokensCollectTrustStore(storePath, store) {
+  const dir = dirname3(storePath);
+  if (!existsSync4(dir))
+    mkdirSync(dir, { recursive: true });
+  writeFileSync(storePath, JSON.stringify(store, null, 2), "utf-8");
+}
+var GIT_IDENTITY_TIMEOUT_MS = 5000;
+function gitCommonDir(cwd = process.cwd()) {
+  try {
+    const raw = execFileSync2("git", ["rev-parse", "--git-common-dir"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: GIT_IDENTITY_TIMEOUT_MS
+    }).trim();
+    if (!raw)
+      return null;
+    return realpathSync(resolve(cwd, raw));
+  } catch {
+    return null;
+  }
+}
+function repoLocalConfigDir() {
+  const local = findLocalConfig();
+  return local ? dirname3(local) : null;
+}
+function gitBlobHash(absolutePath, cwd) {
+  try {
+    const raw = execFileSync2("git", ["hash-object", absolutePath], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: GIT_IDENTITY_TIMEOUT_MS
+    }).trim();
+    return raw || null;
+  } catch {
+    return null;
+  }
+}
+function tokensCollectTrustKey(repoGitCommonDir, interpreter, script) {
+  return createHash("sha256").update(JSON.stringify([repoGitCommonDir, interpreter, script])).digest("hex");
+}
+function getTokensCollectTrust(repoGitCommonDir, interpreter, script, storePath = TOKENS_COLLECT_TRUST_PATH) {
+  const key = tokensCollectTrustKey(repoGitCommonDir, interpreter, script);
+  return readTokensCollectTrustStore(storePath)[key] ?? null;
+}
+function trustTokensCollectCommand(repoGitCommonDir, interpreter, script, scriptBlobHash, storePath = TOKENS_COLLECT_TRUST_PATH) {
+  const store = readTokensCollectTrustStore(storePath);
+  const key = tokensCollectTrustKey(repoGitCommonDir, interpreter, script);
+  store[key] = { interpreter, script, scriptBlobHash, trustedAt: new Date().toISOString() };
+  writeTokensCollectTrustStore(storePath, store);
+}
 
 // src/lib/ops.ts
 var MARKER_NS = "vinaya:managed";
@@ -2935,9 +3420,9 @@ var GIT_DIR_PREFIX = ".git/";
 function resolveManagedBlockPath(repoRoot, opPath) {
   if (!opPath.startsWith(GIT_DIR_PREFIX))
     return join6(repoRoot, opPath);
-  return join6(gitCommonDir(repoRoot), opPath.slice(GIT_DIR_PREFIX.length));
+  return join6(gitCommonDir2(repoRoot), opPath.slice(GIT_DIR_PREFIX.length));
 }
-function gitCommonDir(repoRoot) {
+function gitCommonDir2(repoRoot) {
   try {
     const commonDir = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
       encoding: "utf8"
@@ -2950,8 +3435,8 @@ function gitCommonDir(repoRoot) {
   }
 }
 function containedAbs(repoRoot, relPath) {
-  const root = resolve(repoRoot);
-  const target = resolve(root, relPath);
+  const root = resolve2(repoRoot);
+  const target = resolve2(root, relPath);
   if (target === root)
     return null;
   return target === root || target.startsWith(root + sep2) ? target : null;
@@ -2959,9 +3444,9 @@ function containedAbs(repoRoot, relPath) {
 function containedManagedBlockAbs(repoRoot, relPath) {
   if (!relPath.startsWith(GIT_DIR_PREFIX))
     return containedAbs(repoRoot, relPath);
-  const commonDir = gitCommonDir(repoRoot);
-  const hooksRoot = resolve(join6(commonDir, "hooks"));
-  const target = resolve(join6(commonDir, relPath.slice(GIT_DIR_PREFIX.length)));
+  const commonDir = gitCommonDir2(repoRoot);
+  const hooksRoot = resolve2(join6(commonDir, "hooks"));
+  const target = resolve2(join6(commonDir, relPath.slice(GIT_DIR_PREFIX.length)));
   if (target === hooksRoot)
     return null;
   return target.startsWith(hooksRoot + sep2) ? target : null;
@@ -3497,8 +3982,8 @@ function prompt(question) {
   setupStdinReader();
   if (stdinEnded && pendingResolvers.length === 0)
     return Promise.resolve("");
-  return new Promise((resolve2) => {
-    pendingResolvers.push(resolve2);
+  return new Promise((resolve3) => {
+    pendingResolvers.push(resolve3);
     if (stdinEnded)
       flushLines();
   });
@@ -3517,15 +4002,290 @@ function closeStdin() {
   }
 }
 
+// src/commands/tokens.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
+import { resolve as resolvePath } from "node:path";
+var USAGE = [
+  'Usage: vinaya tokens --phase "<task-id>: develop" --role Developer',
+  "  [--model <id>] [--transcript <path>] [--in <tokens-in> --out <tokens-out>]",
+  "",
+  "  --transcript   Read this transcript directly. Supported primary route — use it whenever you know",
+  "                 which transcript is yours, and always in a repo with no track-transcript.sh hook.",
+  "  (omitted)      Resolve via the Stop-hook pointer file, if this repo installs that hook.",
+  "  --in/--out     Manual entry: the exact token figures, for a host whose usage arrives by some other",
+  "                 means than a Claude Code transcript. Both required together; skips transcript",
+  "                 resolution entirely.",
+  "",
+  "Usage: vinaya tokens --trust-collect",
+  "  Approves this repo's declared tokens.collect command, pinned to the script's exact current",
+  "  content, on this machine. Run this once before tokens.collect will ever execute — a changed",
+  "  interpreter, script path, or script CONTENT needs its own fresh approval. Does not take",
+  "  --phase/--role and never emits a Tokens: line."
+].join(`
+`);
+function parseArgs(argv) {
+  let phase;
+  let role;
+  let model;
+  let transcriptPath;
+  let tokensInRaw;
+  let tokensOutRaw;
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--phase")
+      phase = argv[++i];
+    else if (arg === "--role")
+      role = argv[++i];
+    else if (arg === "--model")
+      model = argv[++i];
+    else if (arg === "--transcript")
+      transcriptPath = argv[++i];
+    else if (arg === "--in")
+      tokensInRaw = argv[++i];
+    else if (arg === "--out")
+      tokensOutRaw = argv[++i];
+  }
+  if (!phase || !role) {
+    throw new Error(USAGE);
+  }
+  if (tokensInRaw === undefined !== (tokensOutRaw === undefined)) {
+    throw new Error("vinaya tokens: --in and --out must be given together, or not at all.");
+  }
+  const tokensIn = tokensInRaw === undefined ? undefined : Number(tokensInRaw);
+  const tokensOut = tokensOutRaw === undefined ? undefined : Number(tokensOutRaw);
+  if (tokensIn !== undefined && (!Number.isFinite(tokensIn) || tokensIn < 0)) {
+    throw new Error(`vinaya tokens: --in must be a non-negative integer, got "${tokensInRaw}".`);
+  }
+  if (tokensOut !== undefined && (!Number.isFinite(tokensOut) || tokensOut < 0)) {
+    throw new Error(`vinaya tokens: --out must be a non-negative integer, got "${tokensOutRaw}".`);
+  }
+  return { phase, role, model, transcriptPath, tokensIn, tokensOut };
+}
+function manualSummary(tokensIn, tokensOut) {
+  return {
+    components: {
+      inputTokens: tokensIn,
+      outputTokens: tokensOut,
+      cacheCreationInputTokens: 0,
+      cacheReadInputTokens: 0
+    },
+    model: null,
+    messageCount: 1
+  };
+}
+function declaredSummary(components, model) {
+  return { components, model, messageCount: 1 };
+}
+var COLLECT_FIELDS = ["inputTokens", "outputTokens", "cacheCreationInputTokens", "cacheReadInputTokens"];
+function parseDeclaredCollectOutput(raw, command) {
+  const trimmed = raw.trim();
+  const fail = (why) => {
+    throw new Error(`vinaya tokens: declared tokens.collect command "${command}" ${why}
+` + "Expected stdout to be a JSON object: " + `{"inputTokens":N,"outputTokens":N,"cacheCreationInputTokens":N,"cacheReadInputTokens":N,"model":"…"|null}
+` + `Got: ${trimmed.slice(0, 500)}`);
+  };
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch (err) {
+    fail(`did not print valid JSON on stdout (${err.message}).`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    fail("printed JSON that is not an object.");
+  }
+  const obj = parsed;
+  const components = {};
+  for (const field of COLLECT_FIELDS) {
+    const value = obj[field];
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+      fail(`printed an invalid "${field}" (must be a non-negative number), got ${JSON.stringify(value)}.`);
+    }
+    components[field] = value;
+  }
+  const model = obj.model;
+  if (model !== undefined && model !== null && typeof model !== "string") {
+    fail(`printed a non-string "model" field: ${JSON.stringify(model)}.`);
+  }
+  return declaredSummary(components, typeof model === "string" ? model : null);
+}
+function resolveDeclaredCollect(command, deps) {
+  const parsed = parseTokensCollectDeclaration(command);
+  if (!parsed) {
+    throw new Error(`vinaya tokens: declared tokens.collect "${command}" is not shaped "<interpreter> <script-path>" — ` + "this should have been rejected at config-load time; the config may have been edited after loading.");
+  }
+  const repoConfigDir = deps.repoConfigDir();
+  if (repoConfigDir === null) {
+    throw new Error("vinaya tokens: declared tokens.collect command could not be resolved — this repo's local " + "vinaya.config.json directory could not be found. Refusing to run an unresolvable command.");
+  }
+  const repoGitCommonDir = deps.gitCommonDir();
+  if (repoGitCommonDir === null) {
+    throw new Error("vinaya tokens: declared tokens.collect command could not be verified — this repo's git common " + "directory could not be resolved. Refusing to run an unverifiable command.");
+  }
+  const scriptAbsolutePath = resolvePath(repoConfigDir, parsed.script);
+  if (!deps.exists(scriptAbsolutePath)) {
+    throw new Error(`vinaya tokens: declared tokens.collect script "${parsed.script}" does not exist at ${scriptAbsolutePath}.`);
+  }
+  return { interpreter: parsed.interpreter, script: parsed.script, scriptAbsolutePath, repoGitCommonDir };
+}
+function runDeclaredCollect(command, deps) {
+  const { interpreter, script, scriptAbsolutePath, repoGitCommonDir } = resolveDeclaredCollect(command, deps);
+  const currentHash = deps.scriptContentHash(scriptAbsolutePath, deps.cwd);
+  if (currentHash === null) {
+    throw new Error(`vinaya tokens: declared tokens.collect script "${script}" could not be hashed for verification ` + "(git unavailable, or the file could not be read). Refusing to run an unverifiable script.");
+  }
+  const trust = deps.getTrust(repoGitCommonDir, interpreter, script);
+  if (trust === null) {
+    throw new Error(`vinaya tokens: declared tokens.collect is not yet trusted on this machine:
+` + `  ${interpreter} ${script}
+` + "Run `vinaya tokens --trust-collect` once to approve it. Refusing — no `Tokens:` line emitted, no zeros.");
+  }
+  if (trust.scriptBlobHash !== currentHash) {
+    throw new Error(`vinaya tokens: declared tokens.collect script "${script}" no longer matches its trusted content ` + `(approved at ${trust.scriptBlobHash}, now ${currentHash}).
+` + "Run `vinaya tokens --trust-collect` again to approve the new content. Refusing — no `Tokens:` line emitted, no zeros.");
+  }
+  deps.warn(`⚠ vinaya tokens: running declared tokens.collect: ${interpreter} ${script}`);
+  let raw;
+  try {
+    raw = deps.runScript(interpreter, scriptAbsolutePath, deps.cwd);
+  } catch (err) {
+    throw new Error(`vinaya tokens: declared tokens.collect "${interpreter} ${script}" failed: ${err.message}`);
+  }
+  return parseDeclaredCollectOutput(raw, command);
+}
+var COLLECT_COMMAND_TIMEOUT_MS = 30000;
+function realDeps() {
+  return {
+    env: process.env,
+    cwd: process.cwd(),
+    exists: existsSync7,
+    readFile: (path) => readFileSync7(path, "utf8"),
+    loadConfig,
+    repoConfigDir: repoLocalConfigDir,
+    runScript: (interpreter, scriptAbsolutePath, cwd) => execFileSync4(interpreter, [scriptAbsolutePath], { cwd, encoding: "utf-8", timeout: COLLECT_COMMAND_TIMEOUT_MS }),
+    warn: (message) => console.error(message),
+    gitCommonDir,
+    scriptContentHash: gitBlobHash,
+    getTrust: getTokensCollectTrust,
+    trustCollect: trustTokensCollectCommand
+  };
+}
+function buildTokensResult(parsed, deps) {
+  if (parsed.tokensIn !== undefined && parsed.tokensOut !== undefined) {
+    const summary = manualSummary(parsed.tokensIn, parsed.tokensOut);
+    return {
+      line: formatTokensLine({ phase: parsed.phase, role: parsed.role, summary, modelOverride: parsed.model }),
+      breakdown: undefined
+    };
+  }
+  const declaredCommand = deps.loadConfig()?.tokens?.collect;
+  if (declaredCommand) {
+    const summary = runDeclaredCollect(declaredCommand, deps);
+    return {
+      line: formatTokensLine({ phase: parsed.phase, role: parsed.role, summary, modelOverride: parsed.model }),
+      breakdown: formatBreakdown(summary)
+    };
+  }
+  const capability = resolveMeteringCapability(deps, parsed.transcriptPath);
+  if (!capability.capable) {
+    throw new Error(`vinaya tokens: refused — could not resolve real usage figures (${capability.reason}).
+${capability.detail}
+
+${USAGE}`);
+  }
+  return {
+    line: formatTokensLine({
+      phase: parsed.phase,
+      role: parsed.role,
+      summary: capability.summary,
+      modelOverride: parsed.model
+    }),
+    breakdown: formatBreakdown(capability.summary)
+  };
+}
+function runTrustCollect(deps) {
+  const declaredCommand = deps.loadConfig()?.tokens?.collect;
+  if (!declaredCommand) {
+    return {
+      ok: false,
+      message: "vinaya tokens --trust-collect: no tokens.collect declared in this repo's vinaya.config.json — nothing to trust."
+    };
+  }
+  let resolved;
+  try {
+    resolved = resolveDeclaredCollect(declaredCommand, deps);
+  } catch (err) {
+    return { ok: false, message: err.message };
+  }
+  const { interpreter, script, scriptAbsolutePath, repoGitCommonDir } = resolved;
+  const scriptBlobHash = deps.scriptContentHash(scriptAbsolutePath, deps.cwd);
+  if (scriptBlobHash === null) {
+    return {
+      ok: false,
+      message: `vinaya tokens --trust-collect: script "${script}" could not be hashed (git unavailable, or the file could not be read) — refusing to trust blindly.`
+    };
+  }
+  deps.trustCollect(repoGitCommonDir, interpreter, script, scriptBlobHash);
+  return { ok: true, interpreter, script, scriptBlobHash };
+}
+function tokensCommand(argv) {
+  if (argv.includes("--trust-collect")) {
+    const outcome = runTrustCollect(realDeps());
+    if (!outcome.ok) {
+      console.error(outcome.message);
+      process.exit(1);
+    }
+    process.stdout.write("Trusted. Future `vinaya tokens` runs on this machine execute it without asking again until the " + `interpreter, script path, or script content changes.
+${outcome.interpreter} ${outcome.script}
+` + `  content hash: ${outcome.scriptBlobHash}
+`);
+    return;
+  }
+  let parsed;
+  try {
+    parsed = parseArgs(argv);
+  } catch (err) {
+    console.error(err.message);
+    process.exit(2);
+  }
+  let result;
+  try {
+    result = buildTokensResult(parsed, realDeps());
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+  if (result.breakdown)
+    console.error(result.breakdown);
+  process.stdout.write(`${result.line}
+`);
+}
+
 // src/commands/archive.ts
 function ring2Accelerated() {
   return loadConfig()?.rings?.ring2_asyncAudits === true;
 }
-function realDeps() {
-  return { detectRepo: detectGitRepo };
+function realDeps2() {
+  return { detectRepo: detectGitRepo, meteringCapability: () => resolveMeteringCapability(realDeps()) };
+}
+function isEmptySummary(summary) {
+  const { inputTokens, outputTokens, cacheCreationInputTokens, cacheReadInputTokens } = summary.components;
+  return inputTokens === 0 && outputTokens === 0 && cacheCreationInputTokens === 0 && cacheReadInputTokens === 0;
+}
+function renderArchiveTokensLine(capability, phase, role) {
+  if (!capability.capable) {
+    return { line: formatTokensLine({ phase, role, summary: null }), dangling: null };
+  }
+  if (isEmptySummary(capability.summary)) {
+    return {
+      line: null,
+      dangling: `Archivist Tokens: line omitted — metering probe reports capable (transcript ${capability.transcriptPath}) ` + `but summarized to zero tokens across ${capability.summary.messageCount} message(s); posting a real zero ` + "would misrepresent the turn, and `—` is sanctioned only for a genuinely incapable host."
+    };
+  }
+  return { line: formatTokensLine({ phase, role, summary: capability.summary }), dangling: null };
 }
 function sh(args, input) {
-  return execFileSync4(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync5(args[0], args.slice(1), { encoding: "utf8", input, env: process.env }).trim();
 }
 function shJson(args) {
   return JSON.parse(sh(args));
@@ -3608,13 +4368,23 @@ async function runArchive(args, deps) {
     comments
   };
   const { block, issue, dangling } = buildProvenanceBlock(facts);
+  const phase = `${ref ? ref.taskId : pr.headRefName}: archive`;
+  const tokensResult = renderArchiveTokensLine(deps.meteringCapability(), phase, "Archivist");
+  const tokensAddition = tokensResult.line !== null ? tokensResult.line : `DANGLING (tokens): ${tokensResult.dangling}`;
+  const blockWithTokens = `${block}
+
+${tokensAddition}`;
   process.stdout.write(`[vinaya archive] posting provenance block to PR #${pr.number}...
 `);
-  sh(["gh", "pr", "comment", String(pr.number), "-R", repoFlag, "--body-file", "-"], block);
+  sh(["gh", "pr", "comment", String(pr.number), "-R", repoFlag, "--body-file", "-"], blockWithTokens);
   process.stdout.write(`[vinaya archive] provenance block posted to PR #${pr.number}.
 `);
   if (dangling.length > 0) {
     process.stdout.write(`[vinaya archive] DANGLING (${dangling.length}): ${dangling.join("; ")}
+`);
+  }
+  if (tokensResult.dangling !== null) {
+    process.stdout.write(`[vinaya archive] DANGLING (tokens): ${tokensResult.dangling}
 `);
   }
   if (issue !== null) {
@@ -3646,7 +4416,7 @@ async function runArchive(args, deps) {
   return 0;
 }
 async function archiveCommand(args) {
-  process.exit(await runArchive(args, realDeps()));
+  process.exit(await runArchive(args, realDeps2()));
 }
 function parseTrancheArgs(args) {
   const yes = args.includes("--yes");
@@ -3725,19 +4495,19 @@ async function runArchiveTranche(args, deps) {
   return 0;
 }
 async function archiveTrancheCommand(args) {
-  process.exit(await runArchiveTranche(args, realDeps()));
+  process.exit(await runArchiveTranche(args, realDeps2()));
 }
 
 // src/commands/audit.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 function ring2Accelerated2() {
   return loadConfig()?.rings?.ring2_asyncAudits === true;
 }
-function realDeps2() {
+function realDeps3() {
   return { detectRepo: detectGitRepo };
 }
 function defaultSleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 var COMMAND_TIMEOUT_MS = 20000;
 var DEAD_BRANCH_LABEL = label("dead-branch-push");
@@ -3748,7 +4518,7 @@ var DIRECT_PUSH_MARKER = `<!-- ${DIRECT_PUSH_LABEL} -->`;
 var DIRECT_PUSH_LABEL_DESCRIPTION = "A commit landed on main with no associated merged PR (ring-2 detection)";
 function shSoft(args, input) {
   try {
-    return execFileSync5(args[0], args.slice(1), {
+    return execFileSync6(args[0], args.slice(1), {
       encoding: "utf8",
       input,
       timeout: COMMAND_TIMEOUT_MS
@@ -3772,7 +4542,7 @@ function shSoftJson(args) {
   }
 }
 function sh2(args, input) {
-  return execFileSync5(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync6(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function listTaskBranches() {
   const out = shSoft(["git", "ls-remote", "--heads", "origin", "task/*"]);
@@ -3828,11 +4598,15 @@ function gatherDeadBranchFacts(repoFlag) {
   }
   return facts;
 }
-function ensureLabelExists(repoFlag, name, description) {
+function listLabelNames(repoFlag) {
   const existing = shSoftJson(["gh", "label", "list", "-R", repoFlag, "--json", "name", "--limit", "200"]) ?? [];
-  if (existing.some((l) => l.name === name))
-    return;
-  shSoft(["gh", "label", "create", name, "-R", repoFlag, "--color", "B60205", "--description", description]);
+  return existing.map((l) => l.name);
+}
+function createLabel(repoFlag, name, description, color) {
+  shSoft(["gh", "label", "create", name, "-R", repoFlag, "--color", color, "--description", description]);
+}
+function ensureLabelExists2(repoFlag, name, description) {
+  ensureLabelExists(repoFlag, name, description, { listLabelNames, createLabel });
 }
 function commentIdFromUrl(url) {
   const match = url.match(/issuecomment-(\d+)/);
@@ -3870,7 +4644,7 @@ function runDeadBranchAudit(repoFlag) {
     const facts = gatherDeadBranchFacts(repoFlag);
     const findings = findDeadBranchPushes(facts);
     if (findings.length > 0) {
-      ensureLabelExists(repoFlag, DEAD_BRANCH_LABEL, DEAD_BRANCH_LABEL_DESCRIPTION);
+      ensureLabelExists2(repoFlag, DEAD_BRANCH_LABEL, DEAD_BRANCH_LABEL_DESCRIPTION);
       for (const finding of findings)
         flagDeadBranchPush(finding, repoFlag);
     }
@@ -3918,7 +4692,7 @@ function incidentAlreadyOpen(sha, repoFlag) {
   return issues.length > 0;
 }
 function openDirectPushIncident(sha, repoFlag) {
-  ensureLabelExists(repoFlag, DIRECT_PUSH_LABEL, DIRECT_PUSH_LABEL_DESCRIPTION);
+  ensureLabelExists2(repoFlag, DIRECT_PUSH_LABEL, DIRECT_PUSH_LABEL_DESCRIPTION);
   if (incidentAlreadyOpen(sha, repoFlag)) {
     console.error(`[vinaya audit] incident already open for ${sha} — not duplicating.`);
     return;
@@ -4024,11 +4798,11 @@ async function runAudit(args, deps) {
   return failed ? 1 : 0;
 }
 async function auditCommand(args) {
-  process.exit(await runAudit(args, realDeps2()));
+  process.exit(await runAudit(args, realDeps3()));
 }
 
 // src/commands/check.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 import { dirname as dirname5 } from "node:path";
 
 // src/checks/contract.ts
@@ -4039,11 +4813,11 @@ function emitCheckError(error) {
 }
 
 // src/checks/registry.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { join as join8 } from "node:path";
 var DIST_BIN_DIR = join8(packageRoot(import.meta.url), "dist", "checks", "bin");
 var SRC_BIN_DIR = join8(packageRoot(import.meta.url), "src", "checks", "bin");
-var BIN_DIR = existsSync7(DIST_BIN_DIR) ? DIST_BIN_DIR : SRC_BIN_DIR;
+var BIN_DIR = existsSync8(DIST_BIN_DIR) ? DIST_BIN_DIR : SRC_BIN_DIR;
 var BIN_EXT = BIN_DIR === DIST_BIN_DIR ? ".js" : ".ts";
 function bin(name) {
   return join8(BIN_DIR, `${name}${BIN_EXT}`);
@@ -4051,8 +4825,8 @@ function bin(name) {
 function runsUnderAll(spec) {
   return !spec.ownWorkflow;
 }
-function coreCheckRegistry() {
-  return [
+var REGISTRY = [
+  [
     {
       name: "brief-shape",
       run: bin("check-brief-shape"),
@@ -4063,6 +4837,9 @@ function coreCheckRegistry() {
         BRANCH: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "doc-coverage",
       run: bin("check-doc-coverage"),
@@ -4078,6 +4855,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "coherence",
       run: bin("check-coherence"),
@@ -4090,6 +4870,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "dispatch-readiness",
       run: bin("check-dispatch-readiness"),
@@ -4099,9 +4882,13 @@ function coreCheckRegistry() {
         AEG_REPO: { optional: true },
         BRANCH: { optional: true },
         GITHUB_TOKEN: { optional: true },
-        GH_TOKEN: { optional: true }
+        GH_TOKEN: { optional: true },
+        PREMISE_FILE: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "closes-n",
       run: bin("check-closes-n"),
@@ -4116,6 +4903,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "single-plan-pr",
       run: bin("check-single-plan-pr"),
@@ -4128,6 +4918,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "test-plan",
       run: bin("check-test-plan"),
@@ -4139,6 +4932,9 @@ function coreCheckRegistry() {
         BRANCH: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "body-bare-digits",
       run: bin("check-body-bare-digits"),
@@ -4154,6 +4950,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "no-disk-state",
       run: bin("check-no-disk-state"),
@@ -4161,6 +4960,9 @@ function coreCheckRegistry() {
       timeoutMs: 15000,
       env: { BASE_SHA: { optional: true } }
     },
+    0
+  ],
+  [
     {
       name: "registry-gates",
       run: bin("check-registry-gates"),
@@ -4172,6 +4974,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "review-gate",
       run: bin("check-review-gate"),
@@ -4185,6 +4990,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "branch-topology",
       run: bin("check-branch-topology"),
@@ -4197,6 +5005,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "dead-branch-push",
       run: bin("check-dead-branch-push"),
@@ -4208,6 +5019,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "first-push-dispatch",
       run: bin("check-first-push-dispatch"),
@@ -4220,6 +5034,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "doc-coverage-push",
       run: bin("check-doc-coverage-push"),
@@ -4237,6 +5054,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "issue-assignment",
       run: bin("check-issue-assignment"),
@@ -4249,6 +5069,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    0
+  ],
+  [
     {
       name: "evidence-fresh",
       run: bin("check-evidence-fresh"),
@@ -4263,6 +5086,9 @@ function coreCheckRegistry() {
         GH_TOKEN: { optional: true }
       }
     },
+    1
+  ],
+  [
     {
       name: "reader-resolvable-prose",
       run: bin("check-reader-resolvable-prose"),
@@ -4270,6 +5096,9 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: {}
     },
+    0
+  ],
+  [
     {
       name: "retired-vocabulary",
       run: bin("check-retired-vocabulary"),
@@ -4277,6 +5106,9 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: {}
     },
+    0
+  ],
+  [
     {
       name: "doctrine-portability",
       run: bin("check-doctrine-portability"),
@@ -4284,15 +5116,66 @@ function coreCheckRegistry() {
       timeoutMs: 30000,
       env: { BASE_SHA: { optional: true } }
     },
+    0
+  ],
+  [
     {
       name: "workspace-escape",
       run: bin("check-workspace-escape"),
       scope: "full",
       timeoutMs: 30000,
       env: {}
-    }
-  ];
+    },
+    0
+  ],
+  [
+    {
+      name: "changeset-coverage",
+      run: bin("check-changeset-coverage"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "quoted-command",
+      run: bin("check-quoted-command"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "main-branch-refusal",
+      run: bin("check-main-branch-refusal"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "token-collection-wired",
+      run: bin("check-token-collection-wired"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: {
+        CLAUDE_PROJECT_DIR: { optional: true },
+        CLAUDE_CODE_SESSION_ID: { optional: true }
+      }
+    },
+    0
+  ]
+];
+function coreCheckRegistry() {
+  return REGISTRY.map(([spec]) => spec);
 }
+var CORE_CHECK_RING = Object.fromEntries(REGISTRY.map(([spec, ring]) => [spec.name, ring]));
 
 // src/checks/resolver.ts
 var NAMESPACE_SEGMENT = /^[a-z0-9][a-z0-9-]*$/;
@@ -4494,16 +5377,16 @@ async function runOne(spec, timeoutMs, callerEnv) {
   const timer = setTimeout(() => {
     timedOut = true;
     killTree("SIGTERM");
-    escalationDone = new Promise((resolve2) => {
+    escalationDone = new Promise((resolve3) => {
       const graceTimer = setTimeout(() => {
         const pid = proc.pid;
         if (pid !== undefined && groupStillAlive(pid))
           killTree("SIGKILL");
-        resolve2();
+        resolve3();
       }, KILL_GRACE_MS);
       cancelEscalation = () => {
         clearTimeout(graceTimer);
-        resolve2();
+        resolve3();
       };
     });
   }, timeoutMs);
@@ -4514,11 +5397,11 @@ async function runOne(spec, timeoutMs, callerEnv) {
   });
   proc.stdout.resume();
   let spawnError;
-  const exitCode = await new Promise((resolve2) => {
-    proc.on("close", (code) => resolve2(code));
+  const exitCode = await new Promise((resolve3) => {
+    proc.on("close", (code) => resolve3(code));
     proc.on("error", (err) => {
       spawnError = err;
-      resolve2(null);
+      resolve3(null);
     });
   });
   clearTimeout(timer);
@@ -4606,7 +5489,7 @@ async function runChecks(specs, opts) {
 }
 
 // src/roles/plan.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
 import { join as join10 } from "node:path";
 
 // ../../packages/sources/src/commands.ts
@@ -4761,6 +5644,18 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "pr verify-evidence",
+    description: "Prove a pull request's AEG:EVIDENCE region was machine-generated — regenerate it and compare",
+    flags: [],
+    details: [
+      "Deliberately a command, not a check: `evidence-fresh` runs inside `vinaya check --all`, and `pr report` runs `vinaya check --all --diff-only`, so a check that regenerated the block would run the suite containing itself. That recursion is why `evidence-fresh` verifies Group A only and leaves Group B attested.",
+      "Must be run from the repository ROOT of a CLEAN checkout at the pull request's head, and refuses otherwise. The regeneration inherits the working directory and several gates resolve their scan root from it, so a subdirectory silently narrows what the fresh run inspects. On cleanliness: Group B is regenerated by diff-scoped checks, so uncommitted or untracked files change which files are scanned and can produce a MATCH a clean checkout would not. Ignored paths are deliberately NOT inspected — `git diff` never reports one, so they cannot change the scope, and including them would refuse in every real checkout since `node_modules` is ignored and always present. The head is read from the forge and both a mismatch AND an unreadable head refuse — the verdict is bound to a commit, never merely attested. `BASE_SHA` is refused as well, since it steers the regeneration's merge-base.",
+      "Exits 0 on MATCH; 1 on DIFFERS, HIDDEN, or no block; 2 on a refusal (dirty worktree, wrong head, usage error). HIDDEN means the anchor pair sits inside a collapsed `<details>` block, where `body-bare-digits` blanks every digit and nothing can verify what it claims.",
+      "Comparison is a multiset of repo-relative, control-stripped lines: absolute paths (local AND foreign, so a block generated in CI compares against one generated on a laptop) and line order are ignored — a reorder is not a fabrication. Only the AEG:EVIDENCE region is read, since AEG:TOKENS appends by design. A moved merge-base is reported ALONGSIDE the differing lines, never instead of them."
+    ],
+    status: "shipped"
+  },
   {
     name: "issue create",
     description: "Open an issue after full brief-schema validation",
@@ -4837,6 +5732,19 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "milestone close",
+    description: "Close a tranche's Milestone after verifying every labeled Issue is actually attached",
+    flags: [
+      { flag: "--slug", description: "The tranche whose Milestone is being closed" },
+      { flag: "--validate-only", description: "Run every gate and report PASS without closing the Milestone" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "Resolves the target Milestone the same legacy-or-intent-declared way Issue create auto-attach does, then refuses to close on any mismatch between the label's Issues and the Milestone's natively attached Issues — naming each unattached or foreign Issue and its repair path (`gh issue edit <n> --milestone <title>`, or `vinaya milestone adopt`) — before the PATCH ever reaches the forge."
+    ],
+    status: "shipped"
+  },
   {
     name: "review post",
     description: "Render, post, and self-verify a code-reviewer or security-review verdict comment on a PR",
@@ -4889,6 +5797,28 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "tokens",
+    description: "Print a role's `Tokens: …` report line — the portable front door over the collection adapter",
+    flags: [
+      { flag: "--phase", description: 'e.g. `"<task-id>: develop"` — required' },
+      { flag: "--role", description: "e.g. `Developer` — required" },
+      { flag: "--model", description: "Overrides the model id the adapter derived, if given" },
+      {
+        flag: "--transcript",
+        description: "Read this transcript directly. Supported primary route — use it whenever you know which transcript " + "is yours, and always in a repo with no track-transcript.sh hook. Omitted resolves via the Stop-hook " + "pointer file, if this repo installs that hook."
+      },
+      {
+        flag: "--in / --out",
+        description: "Manual entry: the exact token figures, for a host whose usage arrives by some other means than a " + "Claude Code transcript. Both required together; skips transcript resolution entirely."
+      }
+    ],
+    details: [
+      "Resolves the Claude Code collection adapter (`resolveMeteringCapability`, `summarizeTranscript`, `formatTokensLine`) from the INSTALLED `@attalabs/aeg-core` package, never by a repo-relative path — the fix for `packages/aeg-core/bin/report-tokens.ts` not existing in an adopter repo with no local `packages/`.",
+      "Refuses — never emits a `0/0/—` line — when no transcript resolves, a resolved transcript can't be read, or it summarizes to zero usage records (empty, unparseable, or not yet flushed to disk). Capability is probed by actually attempting resolution, never declared from the host being Claude Code."
+    ],
+    status: "shipped"
+  },
   {
     name: "doctrine",
     description: "Print the absolute path of the bundled doctrine's front door (aeg-root/skills/aeg/SKILL.md) on this machine",
@@ -5002,7 +5932,7 @@ var COMMANDS = [
   }
 ];
 // ../../packages/sources/src/doctrine-file-adapter.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync7 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // ../../packages/sources/src/file-adapter.ts
@@ -5013,14 +5943,14 @@ function readMarkdownDir(root, dir) {
   const dirPath = join9(root, dir);
   return readdirSync4(dirPath).filter((f) => f.endsWith(".md")).sort().map((file) => {
     const path = join9(dir, file);
-    return { path, content: readFileSync7(join9(root, path), "utf-8") };
+    return { path, content: readFileSync8(join9(root, path), "utf-8") };
   });
 }
 function createFileDoctrineSource(config = {}) {
   const root = config.root ?? DEFAULT_GOVERNANCE_ROOT;
   return {
     async getDoctrine() {
-      const enforcement = readFileSync7(join9(root, "enforcement.md"), "utf-8");
+      const enforcement = readFileSync8(join9(root, "enforcement.md"), "utf-8");
       const roles = readMarkdownDir(root, "roles");
       const contracts = readMarkdownDir(root, "contracts");
       return { enforcement, roles, contracts };
@@ -5195,11 +6125,11 @@ function resolveRoles(core, configRoles) {
 var NO_DOCTRINE_REASON = "no bundled doctrine found next to this CLI install — the doctrine ships inside the @attalabs/vinaya npm package. Reinstall it, or, in a repo that vendors the CLI, run the package's bundle-doctrine script first.";
 function readContract(configDir, contractPath) {
   const absolute = join10(configDir, contractPath);
-  if (!existsSync8(absolute)) {
+  if (!existsSync9(absolute)) {
     return { ok: false, errors: [`contract file "${contractPath}" does not exist (resolved to "${absolute}")`] };
   }
   try {
-    return validateRoleContract(readFileSync8(absolute, "utf-8"));
+    return validateRoleContract(readFileSync9(absolute, "utf-8"));
   } catch (err) {
     return { ok: false, errors: [`could not read "${contractPath}": ${err.message}`] };
   }
@@ -5232,7 +6162,7 @@ async function buildRolePlan(configDir, configRoles) {
 // src/commands/check.ts
 function git(args) {
   try {
-    return execFileSync6("git", args, { encoding: "utf8" }).trim();
+    return execFileSync7("git", args, { encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -5470,7 +6400,7 @@ ${renderRolesTable(rolePlan)}
 }
 
 // src/commands/commit-msg.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 function commitMsgCommand(args) {
   const [messageFile, source] = args;
   if (!messageFile) {
@@ -5481,7 +6411,7 @@ function commitMsgCommand(args) {
   }
   if (source === "merge")
     return;
-  const firstLine2 = readFileSync9(messageFile, "utf-8").split(`
+  const firstLine2 = readFileSync10(messageFile, "utf-8").split(`
 `, 1)[0] ?? "";
   if (COMMIT_TYPE_STYLE.test(firstLine2))
     return;
@@ -5493,14 +6423,14 @@ function commitMsgCommand(args) {
 }
 
 // src/commands/demo.ts
-import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync10, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync11, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join11 } from "node:path";
 var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
 var FIXTURE_PATH = ".vinaya-demo-brief.md";
 var STATE_FILENAME = "vinaya-demo-state.json";
 function gitCapture(repoRoot, args) {
-  return execFileSync7("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync8("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function currentBranchName(repoRoot) {
   try {
@@ -5511,7 +6441,7 @@ function currentBranchName(repoRoot) {
 }
 function branchExists(repoRoot, name) {
   try {
-    execFileSync7("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
+    execFileSync8("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
       cwd: repoRoot,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5537,9 +6467,9 @@ function gitDirAbs(repoRoot) {
 function recoverFromCrash(repoRoot, statePath) {
   const currentBranch = currentBranchName(repoRoot);
   let state = null;
-  if (existsSync9(statePath)) {
+  if (existsSync10(statePath)) {
     try {
-      state = JSON.parse(readFileSync10(statePath, "utf-8"));
+      state = JSON.parse(readFileSync11(statePath, "utf-8"));
     } catch {
       state = null;
     }
@@ -5609,14 +6539,14 @@ function cleanup(repoRoot, originalBranch, demoBranch, statePath) {
   gitCapture(repoRoot, ["clean", "-fd"]);
   gitCapture(repoRoot, ["checkout", originalBranch]);
   gitCapture(repoRoot, ["branch", "-D", demoBranch]);
-  if (existsSync9(statePath))
+  if (existsSync10(statePath))
     rmSync2(statePath, { force: true });
 }
 async function runDemoBreak(repoRoot, args) {
   const keep = args.includes("--keep");
   const hookDir = resolveHookDir(repoRoot);
   const hookPath = resolveManagedBlockPath(repoRoot, `${hookDir}/pre-commit`);
-  if (!existsSync9(hookPath)) {
+  if (!existsSync10(hookPath)) {
     console.error("Vinaya hooks are not installed in this repo. Run `vinaya init` first.");
     return 1;
   }
@@ -5686,7 +6616,7 @@ Attempting to commit…
   process.stdout.write(`✓ Commit passed — the fix worked.
 `);
   if (keep) {
-    if (existsSync9(statePath))
+    if (existsSync10(statePath))
       unlinkSync(statePath);
     process.stdout.write(`
 --keep: leaving \`${demoBranch}\` checked out for you to inspect. Clean up with:
@@ -5713,12 +6643,12 @@ async function demoBreakCommand(args) {
 }
 
 // src/commands/doctor.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
-import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync13, statSync as statSync2 } from "node:fs";
-import { join as join13 } from "node:path";
+import { execFileSync as execFileSync9 } from "node:child_process";
+import { existsSync as existsSync13, readdirSync as readdirSync6, readFileSync as readFileSync15, statSync as statSync2 } from "node:fs";
+import { delimiter, join as join14 } from "node:path";
 
 // src/lib/self-host.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync11, realpathSync } from "node:fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync12, realpathSync as realpathSync2 } from "node:fs";
 import { join as join12, sep as sep3 } from "node:path";
 var VINAYA_PACKAGE_NAME = "@attalabs/vinaya";
 var DEFAULT_BIN = "dist/index.js";
@@ -5737,7 +6667,7 @@ function isSafeRelPath(p) {
 }
 function readPackageJson(path) {
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -5791,8 +6721,8 @@ function expandPattern(repoRoot, pattern) {
 }
 function resolvesInsideRepo(repoRoot, rel) {
   try {
-    const root = realpathSync(repoRoot);
-    const target = realpathSync(join12(repoRoot, rel));
+    const root = realpathSync2(repoRoot);
+    const target = realpathSync2(join12(repoRoot, rel));
     return target === root || target.startsWith(`${root}${sep3}`);
   } catch {
     return false;
@@ -5832,18 +6762,18 @@ function detectVendoredVinaya(repoRoot) {
 }
 
 // src/lib/env-lint.ts
-import { existsSync as existsSync10, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
 var ENV_READ_PATTERN = /\b(?:process\.env|Bun\.env|Deno\.env)\b/;
 function checksMissingEnvDeclaration(specs) {
   const names = [];
   for (const spec of specs) {
     if (spec.env)
       continue;
-    if (!existsSync10(spec.run))
+    if (!existsSync11(spec.run))
       continue;
     let source;
     try {
-      source = readFileSync12(spec.run, "utf8");
+      source = readFileSync13(spec.run, "utf8");
     } catch {
       continue;
     }
@@ -5856,12 +6786,143 @@ function envDeclarationWarning(name) {
   return `check "${name}" reads environment variables directly but declares no \`env\` — it will lose environment access at the next minor. Declare \`env\` for it (CheckSpec['env'] in src/checks/contract.ts, or vinaya.config.json's checks.<name>.env).`;
 }
 
+// src/lib/registry-write.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname6, join as join13 } from "node:path";
+var PROJECTS_REGISTRY_PATH = ".vinaya/projects.md";
+var CONFIG_FILE_PATH = "vinaya.config.json";
+function rowLine(name, path, specsPath) {
+  return `| ${name} | \`${path}\` | \`${specsPath}\` | (state tracked globally) |`;
+}
+function freshProjectsRegistry(name, path, specsPath) {
+  return `---
+sidebar_title: Projects
+---
+# Projects in this repo
+
+**The project registry.** Declares the projects in this repo and where each
+one's specs and per-project state live. The \`Project\` field on a task (a
+forge Issue) resolves against this file.
+
+**Presence of this file means this is a multi-project repo** — the
+\`Project\` field is required on task Issues/PRs that touch a registered
+project's path. A project is a \`(name, path)\` pair you declared — nothing
+is derived from the folder tree.
+
+## Registry
+
+| Project | Path | Specs | Per-project state |
+|---------|------|-------|---------------------|
+${rowLine(name, path, specsPath)}
+`;
+}
+var REGISTRY_HEADING_RE = /^##\s+Registry\b/i;
+function appendRegistryRow(content, name, path, specsPath) {
+  const lines = content.split(/\r?\n/);
+  const headingIdx = lines.findIndex((l) => REGISTRY_HEADING_RE.test(l));
+  const newRow = rowLine(name, path, specsPath);
+  if (headingIdx === -1) {
+    const sep4 = content.endsWith(`
+`) ? "" : `
+`;
+    return `${content}${sep4}
+## Registry
+
+| Project | Path | Specs | Per-project state |
+|---------|------|-------|---------------------|
+${newRow}
+`;
+  }
+  let i = headingIdx + 1;
+  for (;i < lines.length; i++) {
+    if ((lines[i] ?? "").trim().startsWith("|"))
+      break;
+  }
+  if (i >= lines.length) {
+    lines.splice(headingIdx + 1, 0, "", "| Project | Path | Specs | Per-project state |", "|---------|------|-------|---------------------|", newRow);
+    return lines.join(`
+`);
+  }
+  let last = i + 1;
+  for (let j = i + 2;j < lines.length; j++) {
+    if (!(lines[j] ?? "").trim().startsWith("|"))
+      break;
+    last = j;
+  }
+  lines.splice(last + 1, 0, newRow);
+  return lines.join(`
+`);
+}
+function planRegistryRow(repoRoot, name, path, specsPath) {
+  const abs2 = join13(repoRoot, PROJECTS_REGISTRY_PATH);
+  const line = rowLine(name, path, specsPath);
+  if (!existsSync12(abs2)) {
+    return { action: "create-host", rowLine: line, path: PROJECTS_REGISTRY_PATH };
+  }
+  const existing = readFileSync14(abs2, "utf-8");
+  const already = parseRegistry(existing).some((p) => p.name === name);
+  return { action: already ? "skip-present" : "append-row", rowLine: line, path: PROJECTS_REGISTRY_PATH };
+}
+function applyRegistryRow(repoRoot, plan, name, path, specsPath) {
+  const abs2 = join13(repoRoot, PROJECTS_REGISTRY_PATH);
+  if (plan.action === "create-host") {
+    mkdirSync3(dirname6(abs2), { recursive: true });
+    writeFileSync4(abs2, freshProjectsRegistry(name, path, specsPath), "utf-8");
+  } else if (plan.action === "append-row") {
+    const existing = readFileSync14(abs2, "utf-8");
+    writeFileSync4(abs2, appendRegistryRow(existing, name, path, specsPath), "utf-8");
+  }
+}
+function renderRegistryRowDiffLine(plan) {
+  if (plan.action === "skip-present")
+    return `  = keep   ${plan.path} (project already registered)`;
+  if (plan.action === "append-row")
+    return `  ~ append row to ${plan.path}
+    ${plan.rowLine}`;
+  return `  + create ${plan.path} (with registry row)
+    ${plan.rowLine}`;
+}
+function readProjectEntries(repoRoot) {
+  const abs2 = join13(repoRoot, CONFIG_FILE_PATH);
+  if (!existsSync12(abs2))
+    return [];
+  try {
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync14(abs2, "utf-8"))).projects ?? [];
+  } catch {
+    return [];
+  }
+}
+function planConfigProjectEntry(repoRoot, entry2) {
+  const already = readProjectEntries(repoRoot).some((p) => p.name === entry2.name);
+  return { action: already ? "skip-present" : "add-entry", entry: entry2 };
+}
+function applyConfigProjectEntry(repoRoot, plan) {
+  if (plan.action === "skip-present")
+    return;
+  const abs2 = join13(repoRoot, CONFIG_FILE_PATH);
+  const seed = JSON.parse(readFileSync14(abs2, "utf-8"));
+  const projects = Array.isArray(seed.projects) ? seed.projects : [];
+  writeFileSync4(abs2, `${JSON.stringify({ ...seed, projects: [...projects, plan.entry] }, null, 2)}
+`, "utf-8");
+}
+function renderConfigProjectEntryDiffLine(plan) {
+  if (plan.action === "skip-present")
+    return `  = keep   ${CONFIG_FILE_PATH} (project already declared under "projects")`;
+  const bits = [`"name": ${JSON.stringify(plan.entry.name)}`];
+  if (plan.entry.path)
+    bits.push(`"path": ${JSON.stringify(plan.entry.path)}`);
+  if (plan.entry.description)
+    bits.push(`"description": ${JSON.stringify(plan.entry.description)}`);
+  return `  ~ append entry to ${CONFIG_FILE_PATH}'s "projects"
+    { ${bits.join(", ")} }`;
+}
+
 // src/commands/doctor.ts
 function readVersion() {
-  const pkg = JSON.parse(readFileSync13(join13(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync15(join14(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
-function realDeps3() {
+function realDeps4() {
   return {
     detectRepo: detectGitRepo,
     ghAuthStatus,
@@ -5870,7 +6931,13 @@ function realDeps3() {
     readHooksPath: readCoreHooksPath,
     nodeVersion: () => process.version,
     bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
-    packageVersion: readVersion
+    packageVersion: readVersion,
+    meteringCapability: () => resolveMeteringCapability({
+      env: process.env,
+      cwd: process.cwd(),
+      exists: existsSync13,
+      readFile: (path) => readFileSync15(path, "utf8")
+    })
   };
 }
 var ok = (check, message) => ({ check, severity: "ok", message });
@@ -5878,12 +6945,12 @@ var info = (check, message) => ({ check, severity: "info", message });
 var warn = (check, message) => ({ check, severity: "warn", message });
 var error = (check, message) => ({ check, severity: "error", message });
 function readConfig(repoRoot) {
-  const p = join13(repoRoot, CONFIG_PATH);
-  if (!existsSync11(p))
+  const p = join14(repoRoot, CONFIG_PATH);
+  if (!existsSync13(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync13(p, "utf-8"));
+    raw = JSON.parse(readFileSync15(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -5905,6 +6972,8 @@ function labelForPath(path) {
     return "agent-skills";
   if (path === CLAUDE_COMMAND_PATH)
     return "claude-command";
+  if (path === CLAUDE_SETTINGS_PATH)
+    return "claude-stop-hook";
   if (path === GEMINI_COMMAND_PATH)
     return "gemini-command";
   if (path === CHECKS_FOLDER_PLACEHOLDER_PATH || path === ROLES_FOLDER_PLACEHOLDER_PATH)
@@ -5920,14 +6989,14 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
   for (const op of buildInitOps(ctx)) {
     if (op.kind === "create-file") {
       const check = labelForPath(op.path);
-      const abs2 = join13(repoRoot, op.path);
-      const exists = existsSync11(abs2);
+      const abs2 = join14(repoRoot, op.path);
+      const exists = existsSync13(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       if (!exists) {
         findings.push(owned ? error(check, `${op.path} is recorded as vinaya-managed but missing on disk — run \`vinaya upgrade\`.`) : error(check, `${op.path} is not installed — run \`vinaya init\`.`));
         continue;
       }
-      const content = readFileSync13(abs2, "utf-8");
+      const content = readFileSync15(abs2, "utf-8");
       if (!owned) {
         findings.push(content === op.content ? warn(check, `${op.path} has vinaya's own content but isn't recorded in the manifest.`) : info(check, `${op.path} exists but is foreign content — not vinaya-managed, left untouched.`));
         continue;
@@ -5946,11 +7015,11 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
       const check = "hooks";
       const abs2 = resolveManagedBlockPath(repoRoot, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
-      if (!existsSync11(abs2)) {
+      if (!existsSync13(abs2)) {
         findings.push(owned ? error(check, `${op.path} is missing — likely a fresh clone (raw git hooks aren't tracked by git). Run \`vinaya upgrade\` to restore it.`) : info(check, `${op.path} is not installed.`));
         continue;
       }
-      const content = readFileSync13(abs2, "utf-8");
+      const content = readFileSync15(abs2, "utf-8");
       const { begin, end } = markerLines(op.marker, op.comment);
       const hasMarkers = content.includes(begin) && content.includes(end);
       if (!hasMarkers) {
@@ -5998,22 +7067,22 @@ async function diagnoseHookRouting(repoRoot, hookDir, readHooksPath) {
 function diagnoseCustomChecks(repoRoot, config) {
   const findings = [];
   for (const [name, entry2] of Object.entries(config.checks ?? {})) {
-    const scriptAbs = join13(repoRoot, entry2.run);
-    findings.push(existsSync11(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
+    const scriptAbs = join14(repoRoot, entry2.run);
+    findings.push(existsSync13(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
   }
   return findings;
 }
 function listTrackedFiles(repoRoot) {
   try {
-    return execFileSync8("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
+    return execFileSync9("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
 `).map((s) => s.trim()).filter(Boolean);
   } catch {
     return [];
   }
 }
 function diagnoseDocOwnersHealth(repoRoot) {
-  const path = join13(repoRoot, DOC_OWNERS_PATH);
-  const content = existsSync11(path) ? readFileSync13(path, "utf-8") : null;
+  const path = join14(repoRoot, DOC_OWNERS_PATH);
+  const content = existsSync13(path) ? readFileSync15(path, "utf-8") : null;
   const state = classifyDocOwnersManifest(content);
   if (state === "absent" || state === "empty")
     return [];
@@ -6030,8 +7099,8 @@ function diagnoseDocOwnersHealth(repoRoot) {
       findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} binds glob '${b.glob}', which matches none of the ${codeFiles.length} ` + "tracked code file(s) in this repo — the code it names may have been deleted, renamed, or never " + "existed. Repoint the binding to the code's new location, or remove it."));
     }
     if (!isUrlPointer(b.pointer)) {
-      const pointerPath = join13(repoRoot, pointerToPath(b.pointer));
-      if (!existsSync11(pointerPath)) {
+      const pointerPath = join14(repoRoot, pointerToPath(b.pointer));
+      if (!existsSync13(pointerPath)) {
         flagged = true;
         findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Repoint the ` + "binding, or add the missing doc."));
       }
@@ -6046,7 +7115,7 @@ var LEGACY_AEG_PACKAGES_PATH = ".aeg/packages";
 function readWorkspacesForDoctor(repoRoot) {
   const fromPackageJson = () => {
     try {
-      const pkg = JSON.parse(readFileSync13(join13(repoRoot, "package.json"), "utf-8"));
+      const pkg = JSON.parse(readFileSync15(join14(repoRoot, "package.json"), "utf-8"));
       return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
     } catch {
       return [];
@@ -6054,7 +7123,7 @@ function readWorkspacesForDoctor(repoRoot) {
   };
   const fromPnpmWorkspaceYaml = () => {
     try {
-      return parsePnpmWorkspaceYaml(readFileSync13(join13(repoRoot, "pnpm-workspace.yaml"), "utf-8"));
+      return parsePnpmWorkspaceYaml(readFileSync15(join14(repoRoot, "pnpm-workspace.yaml"), "utf-8"));
     } catch {
       return [];
     }
@@ -6063,23 +7132,23 @@ function readWorkspacesForDoctor(repoRoot) {
 }
 function listChildDirsForDoctor(dir, repoRoot) {
   try {
-    return readdirSync6(join13(repoRoot, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    return readdirSync6(join14(repoRoot, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
 }
 function diagnoseBlastRadiusDeprecation(repoRoot, config) {
   const derived = deriveWorkspacePackageDomains(readWorkspacesForDoctor(repoRoot), (dir) => listChildDirsForDoctor(dir, repoRoot));
-  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync11(join13(repoRoot, p)));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync13(join14(repoRoot, p)));
   const covered = new Set([...derived, ...defaults]);
   const configExtra = new Set(config?.blastRadius?.extraDomains ?? []);
-  const legacyPath = join13(repoRoot, LEGACY_AEG_PACKAGES_PATH);
-  if (!existsSync11(legacyPath)) {
+  const legacyPath = join14(repoRoot, LEGACY_AEG_PACKAGES_PATH);
+  if (!existsSync13(legacyPath)) {
     return [
       info("blast-radius", `checkBlastRadiusScope is active via live derivation (${derived.length} packages/* domain(s)) + built-in defaults (${defaults.length} present) — no ${LEGACY_AEG_PACKAGES_PATH}, and the check is not dormant.`)
     ];
   }
-  const legacyEntries = readFileSync13(legacyPath, "utf-8").split(`
+  const legacyEntries = readFileSync15(legacyPath, "utf-8").split(`
 `).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
   const uncovered = legacyEntries.filter((e) => !covered.has(e) && !configExtra.has(e));
   const migrationNote = uncovered.length === 0 ? "every entry is already covered by live derivation, the built-in defaults, or vinaya.config.json blastRadius.extraDomains — the file can be deleted." : `migrate ${uncovered.length} entr${uncovered.length === 1 ? "y" : "ies"} not yet covered before deleting it: ${uncovered.join(", ")}.`;
@@ -6114,7 +7183,7 @@ function diagnoseBriefSchemaDrift(config) {
 }
 function diagnoseEnvDeclarations(repoRoot, config) {
   const resolved = resolveChecks(coreCheckRegistry(), config?.checks).resolved;
-  const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join13(repoRoot, entry2.spec.run) } : entry2.spec);
+  const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join14(repoRoot, entry2.spec.run) } : entry2.spec);
   const missing = checksMissingEnvDeclaration(specs);
   const findings = missing.map((name) => info("env", envDeclarationWarning(name)));
   for (const message of lintEnvDeclarations(config?.checks)) {
@@ -6135,11 +7204,11 @@ function diagnoseCheckClassification(config) {
   return findings;
 }
 function diagnoseGlobalConfigChecks() {
-  if (!existsSync11(GLOBAL_CONFIG_PATH))
+  if (!existsSync13(GLOBAL_CONFIG_PATH))
     return [];
   let raw;
   try {
-    raw = JSON.parse(readFileSync13(GLOBAL_CONFIG_PATH, "utf-8"));
+    raw = JSON.parse(readFileSync15(GLOBAL_CONFIG_PATH, "utf-8"));
   } catch (err) {
     return [info("checks", `${GLOBAL_CONFIG_PATH} is invalid JSON — ${err.message}`)];
   }
@@ -6150,6 +7219,14 @@ function diagnoseGlobalConfigChecks() {
     return [];
   return [warn("checks", globalChecksIgnoredWarning(GLOBAL_CONFIG_PATH))];
 }
+function diagnoseTokenMetering(deps) {
+  const capability = deps.meteringCapability();
+  if (capability.capable)
+    return [];
+  return [
+    info("tokens", `Token-metering capability probe: incapable (${capability.reason}) — ${capability.detail} Real per-turn ` + "token figures cannot currently be collected via `vinaya tokens`. Report them by whatever means your " + "host offers, or supply them directly with `vinaya tokens --in <n> --out <n>`.")
+  ];
+}
 async function diagnoseEnvironment(deps, hasDrift) {
   const findings = [];
   const auth = await deps.ghAuthStatus();
@@ -6180,13 +7257,13 @@ function coversWorkflowsDir(pattern) {
   return bare === ".github/workflows" || bare === "/.github/workflows";
 }
 function diagnoseCodeowners(repoRoot) {
-  const path = join13(repoRoot, ".github", "CODEOWNERS");
-  if (!existsSync11(path)) {
+  const path = join14(repoRoot, ".github", "CODEOWNERS");
+  if (!existsSync13(path)) {
     return info("codeowners", "no .github/CODEOWNERS — vinaya's workflow files have no required-review protection; see `vinaya init`'s printed recommendation.");
   }
   let body;
   try {
-    body = readFileSync13(path, "utf-8");
+    body = readFileSync15(path, "utf-8");
   } catch (err) {
     return warn("codeowners", `.github/CODEOWNERS exists but could not be read: ${err.message}`);
   }
@@ -6194,21 +7271,54 @@ function diagnoseCodeowners(repoRoot) {
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).some((line) => coversWorkflowsDir(line.split(/\s+/)[0] ?? ""));
   return covered ? info("codeowners", ".github/CODEOWNERS covers .github/workflows/**.") : warn("codeowners", ".github/CODEOWNERS exists but has no entry covering .github/workflows/** — workflow file edits can merge unreviewed.");
 }
+function diagnoseVinayaOnPath(agents) {
+  if (agents.size === 0)
+    return [];
+  const names = process.platform === "win32" ? ["vinaya.cmd", "vinaya.exe", "vinaya.bat"] : ["vinaya"];
+  const dirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+  const onPath = dirs.some((dir) => names.some((name) => existsSync13(join14(dir, name))));
+  return [
+    onPath ? ok("vinaya-on-path", "`vinaya` resolves on PATH — agent-native commands will work.") : info("vinaya-on-path", "`vinaya` is not resolvable on PATH — `/vinaya <role>` and the .agents/skills/vinaya-*/SKILL.md files " + 'installed here will fail "command not found" on first use. Run `npm install -g @attalabs/vinaya`.')
+  ];
+}
+function diagnosePrincipals(config) {
+  if (config.principals && config.principals.length > 0) {
+    return info("principals", `review-gate trusts ${config.principals.length} declared principal(s).`);
+  }
+  return info("principals", 'vinaya.config.json has no "principals" — review-gate and the waiver-label actor check both fall back to a ' + "hardcoded placeholder allowlist that will not include anyone on this repo. Every reviewer's verdict is " + 'silently ignored (DANGLING) until you add `"principals": ["<your-github-login>", ...]` to vinaya.config.json.');
+}
+function diagnoseProjectsCoherence(repoRoot, config) {
+  const registryAbs = join14(repoRoot, PROJECTS_REGISTRY_PATH);
+  const registryNames = existsSync13(registryAbs) ? new Set(parseRegistry(readFileSync15(registryAbs, "utf-8")).map((p) => p.name)) : new Set;
+  const configNames = new Set((config?.projects ?? []).map((p) => p.name));
+  if (registryNames.size === 0 && configNames.size === 0)
+    return [];
+  const registryOnly = [...registryNames].filter((n) => !configNames.has(n)).sort();
+  const configOnly = [...configNames].filter((n) => !registryNames.has(n)).sort();
+  const findings = [];
+  if (registryOnly.length > 0) {
+    findings.push(info("projects", `${PROJECTS_REGISTRY_PATH} declares ${registryOnly.join(", ")} with no matching vinaya.config.json "projects" entry.`));
+  }
+  if (configOnly.length > 0) {
+    findings.push(info("projects", `vinaya.config.json "projects" declares ${configOnly.join(", ")} with no matching ${PROJECTS_REGISTRY_PATH} row.`));
+  }
+  return findings;
+}
 var TEST_INVOCATION_SUBSTRINGS = ["npm test", "npm run test", "bun test", "bunx turbo test"];
 function diagnoseTestCi(repoRoot) {
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync13(join13(repoRoot, "package.json"), "utf-8"));
+    pkg = JSON.parse(readFileSync15(join14(repoRoot, "package.json"), "utf-8"));
   } catch {
     return [];
   }
   const testScript = pkg?.scripts?.test;
   if (typeof testScript !== "string" || testScript.trim() === "")
     return [];
-  const workflowsDir = join13(repoRoot, ".github/workflows");
-  const files = existsSync11(workflowsDir) ? readdirSync6(workflowsDir).filter((name) => statSync2(join13(workflowsDir, name)).isFile()) : [];
+  const workflowsDir = join14(repoRoot, ".github/workflows");
+  const files = existsSync13(workflowsDir) ? readdirSync6(workflowsDir).filter((name) => statSync2(join14(workflowsDir, name)).isFile()) : [];
   const invoked = files.some((name) => {
-    const content = readFileSync13(join13(workflowsDir, name), "utf-8");
+    const content = readFileSync15(join14(workflowsDir, name), "utf-8");
     return TEST_INVOCATION_SUBSTRINGS.some((s) => content.includes(s));
   });
   if (invoked)
@@ -6272,12 +7382,16 @@ async function runDoctor(args, deps) {
     findings.push(...await diagnoseHookRouting(repo.repoRoot, hookDir, deps.readHooksPath));
     findings.push(...diagnoseCustomChecks(repo.repoRoot, configRead.config));
     findings.push(...diagnoseDocOwnersHealth(repo.repoRoot));
+    findings.push(diagnosePrincipals(configRead.config));
+    findings.push(...diagnoseVinayaOnPath(ctx.agents));
   }
+  findings.push(...diagnoseProjectsCoherence(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseBlastRadiusDeprecation(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseBriefSchemaDrift(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseEnvDeclarations(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseCheckClassification(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseGlobalConfigChecks());
+  findings.push(...diagnoseTokenMetering(deps));
   findings.push(...await diagnoseEnvironment(deps, hasDrift));
   findings.push(await diagnoseBranchProtection(deps, repo.owner, repo.repo));
   findings.push(diagnoseCodeowners(repo.repoRoot));
@@ -6291,13 +7405,13 @@ async function runDoctor(args, deps) {
   return healthy ? 0 : 1;
 }
 async function doctorCommand(args) {
-  process.exit(await runDoctor(args, realDeps3()));
+  process.exit(await runDoctor(args, realDeps4()));
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "node:fs";
-import { join as join14 } from "node:path";
-function realDeps4() {
+import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
+import { join as join15 } from "node:path";
+function realDeps5() {
   return {
     detectRepo: detectGitRepo,
     readHooksPath: readCoreHooksPath,
@@ -6313,12 +7427,12 @@ function parse(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
 function readManifest(repoRoot) {
-  const p = join14(repoRoot, CONFIG_PATH);
-  if (!existsSync12(p))
+  const p = join15(repoRoot, CONFIG_PATH);
+  if (!existsSync14(p))
     return { kind: "none" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync14(p, "utf-8"));
+    raw = JSON.parse(readFileSync16(p, "utf-8"));
   } catch (err) {
     return { kind: "orphan", reason: `vinaya.config.json is not valid JSON: ${err.message}` };
   }
@@ -6397,118 +7511,20 @@ Vinaya ejected.
     process.stdout.write(`These labels were created by vinaya and left in place — remove them manually if unused:
 `);
     for (const name of removedLabelsToReport)
-      process.stdout.write(`  gh label delete ${name}
-`);
-  }
-  return 0;
-}
-async function ejectCommand(args) {
-  const code = await runEject(args, realDeps4());
-  process.exit(code);
-}
-
-// src/commands/init.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join16 } from "node:path";
-
-// src/lib/registry-write.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname6, join as join15 } from "node:path";
-var PROJECTS_REGISTRY_PATH = ".vinaya/projects.md";
-function rowLine(name, path, specsPath) {
-  return `| ${name} | \`${path}\` | \`${specsPath}\` | (state tracked globally) |`;
-}
-function freshProjectsRegistry(name, path, specsPath) {
-  return `---
-sidebar_title: Projects
----
-# Projects in this repo
-
-**The project registry.** Declares the projects in this repo and where each
-one's specs and per-project state live. The \`Project\` field on a task (a
-forge Issue) resolves against this file.
-
-**Presence of this file means this is a multi-project repo** — the
-\`Project\` field is required on task Issues/PRs that touch a registered
-project's path. A project is a \`(name, path)\` pair you declared — nothing
-is derived from the folder tree.
-
-## Registry
-
-| Project | Path | Specs | Per-project state |
-|---------|------|-------|---------------------|
-${rowLine(name, path, specsPath)}
-`;
-}
-var REGISTRY_HEADING_RE = /^##\s+Registry\b/i;
-function appendRegistryRow(content, name, path, specsPath) {
-  const lines = content.split(/\r?\n/);
-  const headingIdx = lines.findIndex((l) => REGISTRY_HEADING_RE.test(l));
-  const newRow = rowLine(name, path, specsPath);
-  if (headingIdx === -1) {
-    const sep4 = content.endsWith(`
-`) ? "" : `
-`;
-    return `${content}${sep4}
-## Registry
-
-| Project | Path | Specs | Per-project state |
-|---------|------|-------|---------------------|
-${newRow}
-`;
-  }
-  let i = headingIdx + 1;
-  for (;i < lines.length; i++) {
-    if ((lines[i] ?? "").trim().startsWith("|"))
-      break;
-  }
-  if (i >= lines.length) {
-    lines.splice(headingIdx + 1, 0, "", "| Project | Path | Specs | Per-project state |", "|---------|------|-------|---------------------|", newRow);
-    return lines.join(`
-`);
-  }
-  let last = i + 1;
-  for (let j = i + 2;j < lines.length; j++) {
-    if (!(lines[j] ?? "").trim().startsWith("|"))
-      break;
-    last = j;
-  }
-  lines.splice(last + 1, 0, newRow);
-  return lines.join(`
+      process.stdout.write(`  gh label delete ${name}
 `);
-}
-function planRegistryRow(repoRoot, name, path, specsPath) {
-  const abs2 = join15(repoRoot, PROJECTS_REGISTRY_PATH);
-  const line = rowLine(name, path, specsPath);
-  if (!existsSync13(abs2)) {
-    return { action: "create-host", rowLine: line, path: PROJECTS_REGISTRY_PATH };
-  }
-  const existing = readFileSync15(abs2, "utf-8");
-  const already = parseRegistry(existing).some((p) => p.name === name);
-  return { action: already ? "skip-present" : "append-row", rowLine: line, path: PROJECTS_REGISTRY_PATH };
-}
-function applyRegistryRow(repoRoot, plan, name, path, specsPath) {
-  const abs2 = join15(repoRoot, PROJECTS_REGISTRY_PATH);
-  if (plan.action === "create-host") {
-    mkdirSync3(dirname6(abs2), { recursive: true });
-    writeFileSync4(abs2, freshProjectsRegistry(name, path, specsPath), "utf-8");
-  } else if (plan.action === "append-row") {
-    const existing = readFileSync15(abs2, "utf-8");
-    writeFileSync4(abs2, appendRegistryRow(existing, name, path, specsPath), "utf-8");
   }
+  return 0;
 }
-function renderRegistryRowDiffLine(plan) {
-  if (plan.action === "skip-present")
-    return `  = keep   ${plan.path} (project already registered)`;
-  if (plan.action === "append-row")
-    return `  ~ append row to ${plan.path}
-    ${plan.rowLine}`;
-  return `  + create ${plan.path} (with registry row)
-    ${plan.rowLine}`;
+async function ejectCommand(args) {
+  const code = await runEject(args, realDeps5());
+  process.exit(code);
 }
 
 // src/commands/init.ts
-function realDeps5() {
+import { existsSync as existsSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join16 } from "node:path";
+function realDeps6() {
   return {
     detectRepo: detectGitRepo,
     checkGhAuth,
@@ -6548,17 +7564,17 @@ function parseAgentsFlag(args) {
 var PRODUCT_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function readManifest2(repoRoot) {
   const p = join16(repoRoot, CONFIG_PATH);
-  if (!existsSync14(p))
+  if (!existsSync15(p))
     return null;
   try {
-    return VinayaConfigSchema.parse(JSON.parse(readFileSync16(p, "utf-8"))).managed ?? null;
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync17(p, "utf-8"))).managed ?? null;
   } catch {
     return null;
   }
 }
 function writeManifest(repoRoot, manifest) {
   const configAbs = join16(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync16(configAbs, "utf-8"));
+  const seed = JSON.parse(readFileSync17(configAbs, "utf-8"));
   writeFileSync5(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
 `, "utf-8");
 }
@@ -6634,7 +7650,7 @@ function pathFlag(args) {
   const i = args.indexOf("--path");
   return i !== -1 && args[i + 1] ? args[i + 1] : ".";
 }
-var PATH_INJECTION_RE = /[|\r\n]/;
+var PATH_INJECTION_RE = /[|`\r\n]/;
 function validPathFlag(path) {
   return !PATH_INJECTION_RE.test(path);
 }
@@ -6647,7 +7663,7 @@ async function runInitProduct(args, deps) {
   }
   const productPath = pathFlag(args);
   if (!validPathFlag(productPath)) {
-    console.error("Error: --path must not contain '|' or a newline (it is written into a markdown table row).");
+    console.error("Error: --path must not contain '|', a backtick, or a newline (it is written into a markdown table row and must round-trip verbatim).");
     return 2;
   }
   const specsPath = productPath === "." ? "specs/" : `${productPath}/specs/`;
@@ -6666,6 +7682,7 @@ async function runInitProduct(args, deps) {
     return 1;
   }
   const registryPlan = planRegistryRow(repo.repoRoot, name, productPath, specsPath);
+  const configPlan = planConfigProjectEntry(repo.repoRoot, { name, path: productPath });
   process.stdout.write(`vinaya init product ${name} — the full diff:
 
 `);
@@ -6673,6 +7690,11 @@ async function runInitProduct(args, deps) {
 `);
   process.stdout.write(`${renderRegistryRowDiffLine(registryPlan)}
 
+`);
+  process.stdout.write(`── Config ────────────────────────────────────────
+`);
+  process.stdout.write(`${renderConfigProjectEntryDiffLine(configPlan)}
+
 `);
   if (dryRun) {
     process.stdout.write(`--dry-run: nothing was written.
@@ -6688,25 +7710,26 @@ async function runInitProduct(args, deps) {
     }
   }
   applyRegistryRow(repo.repoRoot, registryPlan, name, productPath, specsPath);
+  applyConfigProjectEntry(repo.repoRoot, configPlan);
   process.stdout.write(`
 Governed product area '${name}' scaffolded.
 `);
   return 0;
 }
 async function initCommand(args) {
-  process.exit(await runInit(args, realDeps5()));
+  process.exit(await runInit(args, realDeps6()));
 }
 async function initProductCommand(args) {
-  process.exit(await runInitProduct(args, realDeps5()));
+  process.exit(await runInitProduct(args, realDeps6()));
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 
 // src/lib/forge-write.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync15, mkdtempSync, readdirSync as readdirSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { readFileSync as readFileSync17 } from "node:fs";
+import { execFileSync as execFileSync10 } from "node:child_process";
+import { existsSync as existsSync16, mkdtempSync, readdirSync as readdirSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join17 } from "node:path";
 class ForgeArgError extends Error {
@@ -6718,13 +7741,13 @@ function locateBody(args) {
       const p = args[i + 1];
       if (!p)
         throw new ForgeArgError("`--body-file` was given with no path.");
-      return { body: readFileSync17(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
+      return { body: readFileSync18(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
     }
     if (a.startsWith("--body-file=")) {
       const p = a.slice("--body-file=".length);
       if (!p)
         throw new ForgeArgError("`--body-file=` was given with no path.");
-      return { body: readFileSync17(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
+      return { body: readFileSync18(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
     }
     if (a === "--body" || a === "-b") {
       const v = args[i + 1];
@@ -6798,7 +7821,7 @@ function ensureTrancheLabelExists(slug) {
   const name = trancheLabel(slug);
   let existing;
   try {
-    const out = execFileSync9("gh", ["label", "list", "--json", "name", "--limit", "200"], {
+    const out = execFileSync10("gh", ["label", "list", "--json", "name", "--limit", "200"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -6811,7 +7834,7 @@ function ensureTrancheLabelExists(slug) {
   if (existing.some((l) => l.name === name))
     return;
   try {
-    execFileSync9("gh", ["label", "create", name, "--color", TRANCHE_LABEL_COLOR, "--description", `Tranche: ${slug}`], {
+    execFileSync10("gh", ["label", "create", name, "--color", TRANCHE_LABEL_COLOR, "--description", `Tranche: ${slug}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -6821,6 +7844,24 @@ function ensureTrancheLabelExists(slug) {
     ]);
   }
 }
+function resolveMilestoneAttachArgs(ghArgs, labels) {
+  if (!isTaskIssueLabelSet(labels))
+    return ghArgs;
+  if (hasExplicitMilestoneFlag(ghArgs))
+    return ghArgs;
+  const slug = findTrancheSlug(labels);
+  if (!slug)
+    return ghArgs;
+  let target;
+  try {
+    target = findMilestoneAttachTargetForSlug("{owner}", "{repo}", slug);
+  } catch {
+    process.stderr.write(`vinaya: milestone lookup for '${slug}' failed (\`gh api\`) — creating without --milestone.
+`);
+    return ghArgs;
+  }
+  return target ? [...ghArgs, "--milestone", target.title] : ghArgs;
+}
 function resolveSections(kind, retryCommand) {
   const result = loadConfigChecked();
   if (!result.ok) {
@@ -6945,7 +7986,7 @@ function validateForgeWrite(input) {
 }
 function git2(args) {
   try {
-    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync10("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -6956,7 +7997,7 @@ function repoRoot() {
 function readWorkspaceGlobs(root) {
   const fromPackageJson = () => {
     try {
-      const pkg = JSON.parse(readFileSync17(join17(root, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync18(join17(root, "package.json"), "utf8"));
       return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
     } catch {
       return [];
@@ -6964,7 +8005,7 @@ function readWorkspaceGlobs(root) {
   };
   const fromPnpmWorkspaceYaml = () => {
     try {
-      return parsePnpmWorkspaceYaml(readFileSync17(join17(root, "pnpm-workspace.yaml"), "utf8"));
+      return parsePnpmWorkspaceYaml(readFileSync18(join17(root, "pnpm-workspace.yaml"), "utf8"));
     } catch {
       return [];
     }
@@ -6980,7 +8021,7 @@ function listWorkspaceChildDirs(dir, root) {
 }
 function readConfigExtraDomains(root) {
   try {
-    const parsed = VinayaConfigSchema.safeParse(JSON.parse(readFileSync17(join17(root, "vinaya.config.json"), "utf8")));
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(readFileSync18(join17(root, "vinaya.config.json"), "utf8")));
     return parsed.success ? parsed.data.blastRadius?.extraDomains ?? [] : [];
   } catch {
     return [];
@@ -6990,7 +8031,7 @@ function readSharedPackages(root = repoRoot()) {
   if (!root)
     return [];
   const derived = deriveWorkspacePackageDomains(readWorkspaceGlobs(root), (dir) => listWorkspaceChildDirs(dir, root));
-  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync15(join17(root, p)));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync16(join17(root, p)));
   const configExtra = readConfigExtraDomains(root);
   return [...new Set([...derived, ...defaults, ...configExtra])];
 }
@@ -6998,7 +8039,7 @@ function readProjectPaths(root = repoRoot()) {
   if (!root)
     return [];
   try {
-    return parseRegistry(readFileSync17(join17(root, ".vinaya/projects.md"), "utf8"));
+    return parseRegistry(readFileSync18(join17(root, ".vinaya/projects.md"), "utf8"));
   } catch {
     return [];
   }
@@ -7040,7 +8081,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync10("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync11("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7068,7 +8109,7 @@ function reportPass(json, command) {
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync10("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync11("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -7123,7 +8164,7 @@ function issueCreateCommand(args) {
   const slugToEnsure = findTrancheSlug(labels);
   if (slugToEnsure)
     ensureTrancheLabelExists(slugToEnsure);
-  runGhWrite(["issue", "create"], ghArgs, bodyResult, json);
+  runGhWrite(["issue", "create"], resolveMilestoneAttachArgs(ghArgs, labels), bodyResult, json);
 }
 function issueEditCommand(args) {
   const json = args.includes("--json");
@@ -7154,12 +8195,13 @@ function issueEditCommand(args) {
 }
 
 // src/commands/milestone.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya milestone create --title <title> --body-file <path>";
 var RETRY_ADOPT = "vinaya milestone adopt --target <title> --slug <slug> [--slug <slug> ...]";
 var RETRY_EDIT2 = "vinaya milestone edit <n> --body-file <path>";
+var RETRY_CLOSE = "vinaya milestone close --slug <slug>";
 function sh3(args, input) {
-  return execFileSync11(args[0], args.slice(1), {
+  return execFileSync12(args[0], args.slice(1), {
     encoding: "utf8",
     input,
     env: process.env,
@@ -7317,18 +8359,18 @@ function extractSlugs(args) {
   }
   return slugs;
 }
-function ghJsonOrRefuse(args, what) {
+function ghJsonOrRefuse(args, what, retryCommand) {
   try {
     return shJson2(args);
   } catch (e) {
     refuse([
-      makeCheckError("forge-fetch", `could not fetch ${what} from the forge: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_ADOPT}\`.`)
+      makeCheckError("forge-fetch", `could not fetch ${what} from the forge: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${retryCommand}\`.`)
     ]);
   }
 }
 function fetchAdoptFacts(repoFlag, target, slugs) {
-  const labels = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/labels?per_page=100`], "this repo's labels");
-  const milestones = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/milestones?state=all&per_page=100`], "this repo's Milestones");
+  const labels = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/labels?per_page=100`], "this repo's labels", RETRY_ADOPT);
+  const milestones = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/milestones?state=all&per_page=100`], "this repo's Milestones", RETRY_ADOPT);
   const targetMilestone = milestones.find((m) => m.title === target);
   const targetFacts = {
     title: target,
@@ -7351,7 +8393,7 @@ function fetchAdoptFacts(repoFlag, target, slugs) {
       "number,state,milestone",
       "--limit",
       "200"
-    ], `Issues for \`${trancheLabel(slug)}\``) : [];
+    ], `Issues for \`${trancheLabel(slug)}\``, RETRY_ADOPT) : [];
     const elsewhere = new Set;
     for (const issue of issues) {
       const title = issue.milestone?.title;
@@ -7436,17 +8478,110 @@ async function milestoneAdoptCommand(args) {
     }
   }
 }
+function extractSlug(args) {
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a === "--slug")
+      return args[i + 1] ?? null;
+    if (a.startsWith("--slug="))
+      return a.slice("--slug=".length);
+  }
+  return null;
+}
+async function milestoneCloseCommand(args) {
+  const json = args.includes("--json");
+  const validateOnly = args.includes("--validate-only");
+  const rest = args.filter((a) => a !== "--json" && a !== "--validate-only");
+  const slug = extractSlug(rest);
+  if (!slug) {
+    refuse([
+      makeCheckError("forge-args", "`vinaya milestone close` requires a `--slug <slug>` — the tranche whose Milestone is being closed.", `Add \`--slug <slug>\`, then re-run \`${RETRY_CLOSE}\`.`)
+    ]);
+  }
+  const repoFlag = await resolveRepoFlagOrRefuse(RETRY_CLOSE);
+  const milestones = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/milestones?state=all&per_page=100`], "this repo's Milestones", RETRY_CLOSE);
+  const target = resolveMilestoneAttachTarget(milestones, slug);
+  if (!target) {
+    refuse([
+      makeCheckError("milestone-close", `No OPEN Milestone resolves for tranche \`${slug}\` — it may already be closed, or never had one attached.`, `Confirm with \`gh issue list --label ${trancheLabel(slug)} --json milestone\`, or run \`vinaya milestone ` + `create\`/\`${RETRY_ADOPT}\` if a Milestone is genuinely still owed, then re-run \`${RETRY_CLOSE}\`.`)
+    ]);
+  }
+  const labeledIssues = ghJsonOrRefuse([
+    "gh",
+    "issue",
+    "list",
+    "-R",
+    repoFlag,
+    "--label",
+    trancheLabel(slug),
+    "--state",
+    "all",
+    "--json",
+    "number,state,milestone",
+    "--limit",
+    "200"
+  ], `Issues for \`${trancheLabel(slug)}\``, RETRY_CLOSE);
+  const attachedIssues = ghJsonOrRefuse([
+    "gh",
+    "issue",
+    "list",
+    "-R",
+    repoFlag,
+    "--milestone",
+    target.title,
+    "--state",
+    "all",
+    "--json",
+    "number,state,milestone",
+    "--limit",
+    "200"
+  ], `Issues attached to Milestone "${target.title}"`, RETRY_CLOSE);
+  const report = checkMilestoneAttachment(labeledIssues.map((i) => i.number), attachedIssues.map((i) => i.number));
+  if (report.status === "mismatch") {
+    const errors = [];
+    if (report.unattached.length > 0) {
+      errors.push(makeCheckError("milestone-close", `Issue(s) ${report.unattached.map((n) => `#${n}`).join(", ")} carry \`${trancheLabel(slug)}\` but ` + `are not attached to Milestone "${target.title}".`, `Attach each with \`gh issue edit <n> --milestone "${target.title}"\`, then re-run \`${RETRY_CLOSE}\`.`));
+    }
+    if (report.foreign.length > 0) {
+      errors.push(makeCheckError("milestone-close", `Issue(s) ${report.foreign.map((n) => `#${n}`).join(", ")} are attached to Milestone "${target.title}" ` + `but do not carry \`${trancheLabel(slug)}\` — closing would end tracking for whatever they belong to as well.`, `Move them with \`${RETRY_ADOPT}\` if they belong to a different tranche, or \`gh issue edit <n> ` + `--milestone <title>\` to relocate them, then re-run \`${RETRY_CLOSE}\`.`));
+    }
+    refuse(errors);
+  }
+  if (validateOnly) {
+    if (json)
+      printJson({ validated: true, written: false, command: "milestone close", number: target.number });
+    else {
+      process.stdout.write(`✓ Milestone "${target.title}" (#${target.number}) attachment verified — nothing written (--validate-only).
+`);
+    }
+    return;
+  }
+  let out;
+  try {
+    out = sh3(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${target.number}`, "-f", "state=closed"]);
+  } catch (e) {
+    refuse([
+      makeCheckError("forge-fetch", `\`gh api repos/${repoFlag}/milestones/${target.number}\` failed: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_CLOSE}\`.`)
+    ]);
+  }
+  const closed = JSON.parse(out);
+  if (json)
+    printJson({ validated: true, written: true, number: closed.number, url: closed.html_url });
+  else
+    process.stdout.write(`${closed.html_url}
+`);
+}
 
 // src/commands/new-check.ts
-import { chmodSync as chmodSync2, existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync17, mkdirSync as mkdirSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join18 } from "node:path";
 var TEMPLATE_PATH = join18(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
 var CHECKS_DIR = join18("scripts", "vinaya-checks");
-var USAGE = "Usage: vinaya new check <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. myteam/vocab-check)";
+var USAGE2 = "Usage: vinaya new check <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. myteam/vocab-check)";
 function newCheckCommand(args) {
   const name = args[0];
   if (!name) {
-    console.error(USAGE);
+    console.error(USAGE2);
     process.exit(2);
   }
   if (coreCheckRegistry().some((spec) => spec.name === name)) {
@@ -7454,20 +8589,20 @@ function newCheckCommand(args) {
     process.exit(2);
   }
   if (!isValidNamespacedKey(name)) {
-    console.error(`Refusing: "${name}" is not a valid check id. ${USAGE.slice("Usage: ".length)}
+    console.error(`Refusing: "${name}" is not a valid check id. ${USAGE2.slice("Usage: ".length)}
 \`vinaya check\` refuses the entire run over a key it cannot resolve, so a bare, un-namespaced name would brick every check invocation in this repo.`);
     process.exit(2);
   }
   const scriptsDir = join18(process.cwd(), CHECKS_DIR);
-  if (!existsSync16(scriptsDir))
+  if (!existsSync17(scriptsDir))
     mkdirSync4(scriptsDir, { recursive: true });
   const fileStem = name.slice(name.indexOf("/") + 1);
   const targetPath = join18(scriptsDir, `${fileStem}.ts`);
-  if (existsSync16(targetPath)) {
+  if (existsSync17(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync18(TEMPLATE_PATH, "utf-8");
+  const template = readFileSync19(TEMPLATE_PATH, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
   writeFileSync7(targetPath, contents, "utf-8");
   chmodSync2(targetPath, 493);
@@ -7481,32 +8616,32 @@ ${registration}
 }
 
 // src/commands/new-noop-check.ts
-import { chmodSync as chmodSync3, existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync19, writeFileSync as writeFileSync8 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync20, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join19 } from "node:path";
 var TEMPLATE_PATH2 = join19(packageRoot(import.meta.url), "templates", "noop-check.template.ts");
 var CHECKS_DIR2 = join19("vinaya", "checks");
-var USAGE2 = "Usage: vinaya new noop-check <core-check-id>  (the exact id of a core check — run `vinaya check --plan` to list them)";
+var USAGE3 = "Usage: vinaya new noop-check <core-check-id>  (the exact id of a core check — run `vinaya check --plan` to list them)";
 function newNoopCheckCommand(args) {
   const name = args[0];
   if (!name) {
-    console.error(USAGE2);
+    console.error(USAGE3);
     process.exit(2);
   }
   const coreSpec = coreCheckRegistry().find((spec) => spec.name === name);
   if (!coreSpec) {
-    console.error(`Refusing: "${name}" is not a core check id. ${USAGE2}
+    console.error(`Refusing: "${name}" is not a core check id. ${USAGE3}
 \`new noop-check\` only silences a CORE check — a \`checks\` key that exactly matches a core check id REPLACES it. A namespaced or unknown name has nothing to replace; use \`vinaya new check\` to scaffold a new, additive check instead.`);
     process.exit(2);
   }
   const checksDir = join19(process.cwd(), CHECKS_DIR2);
-  if (!existsSync17(checksDir))
+  if (!existsSync18(checksDir))
     mkdirSync5(checksDir, { recursive: true });
   const targetPath = join19(checksDir, `${name}.ts`);
-  if (existsSync17(targetPath)) {
+  if (existsSync18(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync19(TEMPLATE_PATH2, "utf-8");
+  const template = readFileSync20(TEMPLATE_PATH2, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
   writeFileSync8(targetPath, contents, "utf-8");
   chmodSync3(targetPath, 493);
@@ -7528,32 +8663,32 @@ ${registration}
 }
 
 // src/commands/new-role.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync21, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join20 } from "node:path";
 var TEMPLATE_PATH3 = join20(packageRoot(import.meta.url), "templates", "role.template.md");
 var ROLES_DIR = join20("vinaya", "roles");
-var USAGE3 = "Usage: vinaya new role <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. acme/qa-lead)";
+var USAGE4 = "Usage: vinaya new role <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. acme/qa-lead)";
 function newRoleCommand(args) {
   const name = args[0];
   if (!name) {
-    console.error(USAGE3);
+    console.error(USAGE4);
     process.exit(2);
   }
   if (!isValidNamespacedKey(name)) {
-    console.error(`Refusing: "${name}" is not a valid role key. ${USAGE3.slice("Usage: ".length)}
+    console.error(`Refusing: "${name}" is not a valid role key. ${USAGE4.slice("Usage: ".length)}
 A bare, un-namespaced key resolves as an OVERRIDE of a core role — a complete replacement of that role's contract, and a real governance decision this scaffolder does not make for you. Pick a namespaced name, or write the override entry by hand if you really mean to replace a core role's contract.`);
     process.exit(2);
   }
   const rolesDir = join20(process.cwd(), ROLES_DIR);
-  if (!existsSync18(rolesDir))
+  if (!existsSync19(rolesDir))
     mkdirSync6(rolesDir, { recursive: true });
   const roleId = name.slice(name.indexOf("/") + 1);
   const targetPath = join20(rolesDir, `${roleId}.md`);
-  if (existsSync18(targetPath)) {
+  if (existsSync19(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync20(TEMPLATE_PATH3, "utf-8");
+  const template = readFileSync21(TEMPLATE_PATH3, "utf-8");
   const contents = template.split("{{ROLE_ID}}").join(roleId);
   writeFileSync9(targetPath, contents, "utf-8");
   const relPath = join20(ROLES_DIR, `${roleId}.md`);
@@ -7566,7 +8701,77 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync12 } from "node:child_process";
+import { execFileSync as execFileSync13 } from "node:child_process";
+
+// src/lib/numstat.ts
+function summariseNumstat(numstat) {
+  const rows = numstat.split(`
+`).filter((l) => l.trim() !== "");
+  let added = 0;
+  let deleted = 0;
+  let binary = 0;
+  for (const row of rows) {
+    const [a, d] = row.split("\t");
+    if (a === "-" || d === "-") {
+      binary++;
+      continue;
+    }
+    added += Number(a) || 0;
+    deleted += Number(d) || 0;
+  }
+  const files = `${rows.length} file${rows.length === 1 ? "" : "s"} changed`;
+  const bin2 = binary > 0 ? `, ${binary} binary` : "";
+  return `${files}, ${added} insertion${added === 1 ? "" : "s"}(+), ${deleted} deletion${deleted === 1 ? "" : "s"}(-)${bin2}`;
+}
+var EVIDENCE_SUMMARY_PREFIX = "Summary: ";
+
+// src/checks/scan-context.ts
+var ZERO_WIDTH = /[\u200B-\u200D\u2060\uFEFF]/g;
+var HTML_ENTITIES = {
+  "&quot;": '"',
+  "&apos;": "'",
+  "&lt;": "<",
+  "&gt;": ">",
+  "&amp;": "&"
+};
+function decodeNamedEntities(body) {
+  return body.replace(/&(?:quot|apos|lt|gt|amp);/g, (m) => HTML_ENTITIES[m] ?? m);
+}
+function normalizeBody(rawBody) {
+  return decodeNamedEntities(rawBody.replace(ZERO_WIDTH, ""));
+}
+function buildAnchorLookupMask(body) {
+  return maskDetailsBlocks(maskCode(body));
+}
+
+class ScanContext {
+  raw;
+  normalised;
+  masked;
+  constructor(raw, normalised, masked) {
+    this.raw = raw;
+    this.normalised = normalised;
+    this.masked = masked;
+  }
+  static from(rawBody) {
+    const normalised = normalizeBody(rawBody);
+    return new ScanContext(rawBody, normalised, buildAnchorLookupMask(normalised));
+  }
+  rawResolutionAgrees(field) {
+    const rawHasPair = anchoredRegionBounds(this.raw, field) !== null;
+    return rawHasPair === (anchoredRegionBounds(this.masked, field) !== null);
+  }
+}
+function resolveAnchoredRegion(ctx, field) {
+  const bounds = anchoredRegionBounds(ctx.masked, field);
+  if (bounds === null) {
+    return anchoredRegionBounds(ctx.normalised, field) !== null ? "hidden" : null;
+  }
+  return {
+    region: ctx.normalised.slice(bounds.innerStart, bounds.innerEnd),
+    maskedRegion: ctx.masked.slice(bounds.innerStart, bounds.innerEnd)
+  };
+}
 
 // src/checks/body-bare-digits-logic.ts
 function blankRange(text, start, end) {
@@ -7743,8 +8948,8 @@ var BOUNDED_ANCHOR_BLANK = {
   PROJECT: blankProjectField,
   EVIDENCE: blankEvidenceField
 };
-function buildScanMask(body) {
-  let masked = maskDetailsBlocks(maskCode(body));
+function buildScanMask(ctx) {
+  let masked = ctx.masked;
   masked = blankAnchoredRegions(masked);
   masked = blankPremiseValues(masked);
   masked = blankTokenReportSection(masked);
@@ -7753,17 +8958,6 @@ function buildScanMask(body) {
 }
 var TOKEN_WITH_DIGIT = /\S*\p{Nd}\S*/gu;
 var LIST_MARKER_TOKEN = /^\p{Nd}{1,9}[.)]$/u;
-var ZERO_WIDTH = /[\u200B-\u200D\u2060\uFEFF]/g;
-var HTML_ENTITIES = {
-  "&quot;": '"',
-  "&apos;": "'",
-  "&lt;": "<",
-  "&gt;": ">",
-  "&amp;": "&"
-};
-function decodeNamedEntities(body) {
-  return body.replace(/&(?:quot|apos|lt|gt|amp);/g, (m) => HTML_ENTITIES[m] ?? m);
-}
 function isLineLeadingListMarker(line, matchStart, rawToken) {
   if (!LIST_MARKER_TOKEN.test(rawToken))
     return false;
@@ -7771,8 +8965,9 @@ function isLineLeadingListMarker(line, matchStart, rawToken) {
   return /^ {0,3}$/.test(before);
 }
 function checkBareDigits(rawBody) {
-  const body = decodeNamedEntities(rawBody.replace(ZERO_WIDTH, ""));
-  const masked = buildScanMask(body);
+  const ctx = ScanContext.from(rawBody);
+  const body = ctx.normalised;
+  const masked = buildScanMask(ctx);
   const maskedLines = masked.split(`
 `);
   const origLines = body.split(`
@@ -7798,7 +8993,7 @@ var RETRY_CREATE3 = "vinaya pr create --validate-only …";
 var RETRY_EDIT3 = "vinaya pr edit <n> --validate-only …";
 function git3(args) {
   try {
-    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -7832,7 +9027,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync12("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync13("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -7846,7 +9041,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync12("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync13("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7957,14 +9152,14 @@ function prEditCommand(args) {
 }
 
 // src/commands/pr-report.ts
-import { execFileSync as execFileSync13, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "node:fs";
+import { execFileSync as execFileSync14, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync20, readFileSync as readFileSync22, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join21 } from "node:path";
 var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
 function git4(args) {
   try {
-    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync14("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -7982,7 +9177,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync14("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -8018,7 +9213,7 @@ function computeGroupA() {
 function resolveSelfEntry() {
   const root = packageRoot(import.meta.url);
   const dist = join21(root, "dist", "index.js");
-  return existsSync19(dist) ? dist : join21(root, "src", "index.ts");
+  return existsSync20(dist) ? dist : join21(root, "src", "index.ts");
 }
 var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
 function anyGateFailed(outcomes) {
@@ -8077,10 +9272,26 @@ function renderGroupB(outcomes) {
 `);
 }
 function buildBlockInner(groupA, gateOutcomes) {
-  return [`Head: ${groupA.head}`, "", renderGroupA(groupA), "", renderGroupB(gateOutcomes)].join(`
+  return [
+    `Head: ${groupA.head}`,
+    `${EVIDENCE_SUMMARY_PREFIX}\`${summariseNumstat(groupA.numstat)}\``,
+    "",
+    renderGroupA(groupA),
+    "",
+    renderGroupB(gateOutcomes)
+  ].join(`
 `);
 }
+
+class DivergentEvidenceAnchorError extends Error {
+  constructor() {
+    super("the AEG:EVIDENCE anchor resolves differently before and after normalisation — a zero-width character or an HTML entity inside a marker makes this writer and the checks that read the block disagree about which pair is real. Remove it and re-run.");
+    this.name = "DivergentEvidenceAnchorError";
+  }
+}
 function replaceEvidenceBlock(body, blockInner) {
+  if (!ScanContext.from(body).rawResolutionAgrees("EVIDENCE"))
+    throw new DivergentEvidenceAnchorError;
   const full = `${EVIDENCE_START}
 ${blockInner}
 ${EVIDENCE_END}`;
@@ -8095,6 +9306,84 @@ ${EVIDENCE_END}`;
 ${full}
 `;
 }
+var TOKENS_START = "<!-- AEG:TOKENS:START -->";
+var TOKENS_END = "<!-- AEG:TOKENS:END -->";
+var TOKEN_REPORT_HEADING = /^#{1,6}\s*token report\s*$/i;
+var HEADING_LINE = /^#{1,6}\s/;
+var TOKEN_TABLE_HEADER = "| Phase | Role | Agent/Model | Tokens in | Tokens out | Cost | Date |";
+var TOKEN_TABLE_SEPARATOR = "|---|---|---|---|---|---|---|";
+function tokensBlockLineBounds(maskedLines) {
+  const startIdx = maskedLines.findIndex((l) => l.trim() === TOKENS_START);
+  if (startIdx === -1)
+    return null;
+  for (let i = startIdx + 1;i < maskedLines.length; i++) {
+    if (maskedLines[i].trim() === TOKENS_END)
+      return { startIdx, endIdx: i };
+  }
+  return null;
+}
+function writeTokensBlock(body, addition) {
+  const rawLines = body.split(`
+`);
+  const maskedLines = maskCode(body).split(`
+`);
+  const additionLines = addition.split(`
+`);
+  const existing = tokensBlockLineBounds(maskedLines);
+  if (existing) {
+    const before = rawLines.slice(0, existing.endIdx);
+    const after = rawLines.slice(existing.endIdx);
+    return [...before, ...additionLines, ...after].join(`
+`);
+  }
+  const freshBlock = [TOKENS_START, TOKEN_TABLE_HEADER, TOKEN_TABLE_SEPARATOR, ...additionLines, TOKENS_END];
+  const headingIdx = rawLines.findIndex((l) => TOKEN_REPORT_HEADING.test(l));
+  if (headingIdx !== -1) {
+    let sectionEnd = rawLines.length;
+    for (let i = headingIdx + 1;i < rawLines.length; i++) {
+      if (HEADING_LINE.test(rawLines[i])) {
+        sectionEnd = i;
+        break;
+      }
+    }
+    const before = rawLines.slice(0, headingIdx + 1);
+    const after = rawLines.slice(sectionEnd);
+    return [...before, "", ...freshBlock, "", ...after].join(`
+`);
+  }
+  const sep4 = body.length === 0 || body.endsWith(`
+`) ? [] : [""];
+  return [...rawLines, ...sep4, "", "## Token report", "", ...freshBlock, ""].join(`
+`);
+}
+function derivePhase() {
+  const branch = git4(["rev-parse", "--abbrev-ref", "HEAD"]);
+  const m = /^task\/[^/]+\/(.+)$/.exec(branch);
+  const taskId = m ? m[1] : branch || "unknown";
+  return `${taskId}: develop`;
+}
+function isoToday() {
+  return new Date().toISOString().slice(0, 10);
+}
+function collectTokensAddition(opts) {
+  const capability = resolveMeteringCapability(realDeps(), opts.transcriptPath);
+  if (!capability.capable) {
+    return formatTokenReportRow({
+      phase: opts.phase,
+      role: opts.role,
+      summary: null,
+      modelOverride: `— (${capability.reason})`,
+      date: opts.date
+    });
+  }
+  return formatTokenReportRow({
+    phase: opts.phase,
+    role: opts.role,
+    summary: capability.summary,
+    modelOverride: opts.modelOverride,
+    date: opts.date
+  });
+}
 async function buildReport(opts = {}) {
   const groupA = opts.groupA ?? computeGroupA();
   const gateRunner = opts.gateRunner ?? runRealGates;
@@ -8108,8 +9397,16 @@ ${EVIDENCE_END}`;
 async function prReportCommand(args) {
   const writeIdx = args.indexOf("--write");
   const writePath = writeIdx !== -1 ? args[writeIdx + 1] : undefined;
+  const transcriptIdx = args.indexOf("--transcript");
+  const transcriptPath = transcriptIdx !== -1 ? args[transcriptIdx + 1] : undefined;
+  const phaseIdx = args.indexOf("--phase");
+  const phaseOverride = phaseIdx !== -1 ? args[phaseIdx + 1] : undefined;
+  const roleIdx = args.indexOf("--role");
+  const roleOverride = roleIdx !== -1 ? args[roleIdx + 1] : undefined;
+  const modelIdx = args.indexOf("--model");
+  const modelOverride = modelIdx !== -1 ? args[modelIdx + 1] : undefined;
   if (writeIdx !== -1 && !writePath) {
-    console.error("Usage: vinaya pr report [--write <body-file>]");
+    console.error("Usage: vinaya pr report [--write <body-file>] [--phase <phase>] [--role <role>] " + "[--model <id>] [--transcript <path>]");
     process.exit(2);
   }
   let result;
@@ -8123,10 +9420,18 @@ async function prReportCommand(args) {
     throw err;
   }
   if (writePath) {
-    const existing = existsSync19(writePath) ? readFileSync21(writePath, "utf8") : "";
-    const updated = replaceEvidenceBlock(existing, result.blockInner);
+    const existing = existsSync20(writePath) ? readFileSync22(writePath, "utf8") : "";
+    const withEvidence = replaceEvidenceBlock(existing, result.blockInner);
+    const tokensAddition = collectTokensAddition({
+      phase: phaseOverride ?? derivePhase(),
+      role: roleOverride ?? "Developer",
+      date: isoToday(),
+      transcriptPath,
+      modelOverride
+    });
+    const updated = writeTokensBlock(withEvidence, tokensAddition);
     writeFileSync10(writePath, updated);
-    process.stdout.write(`Wrote AEG:EVIDENCE block to ${writePath}
+    process.stdout.write(`Wrote AEG:EVIDENCE and AEG:TOKENS blocks to ${writePath}
 `);
   } else {
     process.stdout.write(`${result.block}
@@ -8135,13 +9440,187 @@ async function prReportCommand(args) {
   process.exit(result.gatesFailed ? 1 : 0);
 }
 
+// src/commands/pr-verify-evidence.ts
+import { execFileSync as execFileSync15 } from "node:child_process";
+
+// src/commands/pr-verify-evidence-logic.ts
+function publishedMergeBase(region) {
+  const m = region.match(/^[ \t]*`git diff ([0-9a-f]{7,40})\.\.\.[0-9a-f]{7,40} --numstat`[ \t]*$/m);
+  return m ? m[1] : null;
+}
+function normaliseLines(region, repoRoot2) {
+  const root = repoRoot2.replace(/\/+$/, "");
+  const out = [];
+  for (const raw of region.split(`
+`)) {
+    const localStripped = root ? raw.split(`${root}/`).join("").split(root).join("") : raw;
+    const stripped = localStripped.replace(/(^|\s)\/\S*?\/(?=(?:apps|packages|aeg-root|scripts|\.changeset|\.vinaya|\.github)\/)/g, "$1");
+    const line = stripped.replace(/[\u0000-\u001F\u007F-\u009F\u2028\u2029\u202A-\u202E\u2066-\u2069]/g, " ").trim();
+    if (line)
+      out.push(line);
+  }
+  return out;
+}
+function compareEvidence(published, freshRegion, repoRoot2) {
+  if (published === null)
+    return { status: "no-block" };
+  if (published === "hidden")
+    return { status: "hidden" };
+  const publishedLines = normaliseLines(published.region, repoRoot2);
+  const freshLines = normaliseLines(freshRegion, repoRoot2);
+  const missing = subtractOnce(freshLines, publishedLines);
+  const unexpected = subtractOnce(publishedLines, freshLines);
+  if (missing.length === 0 && unexpected.length === 0)
+    return { status: "match" };
+  const publishedBase = publishedMergeBase(published.region);
+  const currentBase = publishedMergeBase(freshRegion);
+  const baseDrift = publishedBase && currentBase && publishedBase !== currentBase ? { publishedBase, currentBase } : undefined;
+  return baseDrift ? { status: "differs", missing, unexpected, baseDrift } : { status: "differs", missing, unexpected };
+}
+function subtractOnce(a, b) {
+  const counts = new Map;
+  for (const line of b)
+    counts.set(line, (counts.get(line) ?? 0) + 1);
+  const out = [];
+  for (const line of a) {
+    const n = counts.get(line) ?? 0;
+    if (n > 0)
+      counts.set(line, n - 1);
+    else
+      out.push(line);
+  }
+  return out;
+}
+function renderVerdict(verdict) {
+  if (verdict.status === "match") {
+    return "pr verify-evidence: MATCH — every line of the published AEG:EVIDENCE region is reproduced by a fresh run at this head, and vice versa (compared as a multiset of repo-relative, control-stripped lines: order and whitespace are not compared).";
+  }
+  if (verdict.status === "no-block") {
+    return "pr verify-evidence: NO BLOCK — this pull request body carries no AEG:EVIDENCE anchors. Run `vinaya pr report --write <body-file>` to generate one.";
+  }
+  if (verdict.status === "hidden") {
+    return [
+      "pr verify-evidence: HIDDEN — the AEG:EVIDENCE pair sits inside a collapsed `<details>` block.",
+      "`body-bare-digits` blanks every digit in there, so nothing can verify what it claims. Move the block out of `<details>` and regenerate it with `vinaya pr report --write <body-file>`."
+    ].join(`
+`);
+  }
+  const lines = ["pr verify-evidence: DIFFERS — the published AEG:EVIDENCE region does not reproduce at this head."];
+  if (verdict.baseDrift) {
+    lines.push("", `The published block also records a different merge-base (${verdict.baseDrift.publishedBase}) than the one resolving now (${verdict.baseDrift.currentBase}).`, "That explains SOME differences — the gates ran over a different diff — but it is not on its own evidence the content was honest, and the differing lines are still listed below. Rebase or regenerate, then re-run this command to compare at a shared base.");
+  } else {
+    lines.push("No merge-base difference was detected — either the base is unchanged, or one side carries no readable Group A command line to compare. Drift therefore does not account for this difference.");
+  }
+  lines.push("", "Regenerate with `vinaya pr report --write <body-file>` and push.");
+  if (verdict.missing.length > 0) {
+    lines.push("", `Present in a fresh run, absent from the published block (${verdict.missing.length}):`);
+    for (const line of verdict.missing)
+      lines.push(`  + ${line}`);
+  }
+  if (verdict.unexpected.length > 0) {
+    lines.push("", `Published but not reproducible (${verdict.unexpected.length}):`);
+    for (const line of verdict.unexpected)
+      lines.push(`  - ${line}`);
+  }
+  return lines.join(`
+`);
+}
+
+// src/commands/pr-verify-evidence.ts
+function gh(args) {
+  return execFileSync15("gh", args, { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+function assertCleanWorktree() {
+  const dirty = execFileSync15("git", ["status", "--porcelain"], {
+    encoding: "utf8",
+    cwd: repoRoot2()
+  }).trim();
+  if (!dirty)
+    return;
+  process.stderr.write(`pr verify-evidence: REFUSED — the worktree has uncommitted or untracked changes.
+` + `Group B is regenerated by diff-scoped checks, so local changes alter which files are scanned and can
+` + `produce a MATCH that a clean checkout would not. Verify from a clean checkout at this head instead.
+
+` + `${dirty}
+`);
+  process.exit(2);
+}
+function assertNoBaseOverride() {
+  const override = process.env.BASE_SHA;
+  if (!override)
+    return;
+  process.stderr.write(`pr verify-evidence: REFUSED — BASE_SHA is set (${override}).
+` + `The regeneration resolves its merge-base from that variable, so an override changes what a "fresh run"
+` + `means and can turn a drifted comparison into an apparently shared-base one. Unset it and re-run.
+`);
+  process.exit(2);
+}
+function assertRepoRootCwd() {
+  const root = repoRoot2();
+  const cwd = process.cwd();
+  if (cwd === root)
+    return;
+  process.stderr.write(`pr verify-evidence: REFUSED — run this from the repository root (${root}), not ${cwd}.
+` + `The regeneration inherits this working directory, and several gates resolve their scan root from it,
+` + `so a subdirectory silently narrows what the fresh run inspects and can report MATCH on a block that
+` + `omits real findings.
+`);
+  process.exit(2);
+}
+function repoRoot2() {
+  return execFileSync15("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+}
+async function prVerifyEvidenceCommand(args) {
+  const prRef = args[0] && !args[0].startsWith("-") ? args[0] : undefined;
+  if (!prRef) {
+    process.stderr.write(`Usage: vinaya pr verify-evidence <pr-number>
+`);
+    process.exit(2);
+  }
+  assertRepoRootCwd();
+  assertCleanWorktree();
+  assertNoBaseOverride();
+  let body;
+  let forgeHead;
+  try {
+    const view = JSON.parse(gh(["pr", "view", prRef, "--json", "body,headRefOid"]));
+    body = view.body ?? "";
+    forgeHead = view.headRefOid ?? "";
+  } catch (err) {
+    process.stderr.write(`pr verify-evidence: could not read pull request #${prRef} — ${err.message}
+`);
+    process.exit(1);
+    return;
+  }
+  const localHead = execFileSync15("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+  if (!forgeHead) {
+    process.stderr.write(`pr verify-evidence: REFUSED — could not read #${prRef}'s head from the forge, so the verdict cannot be bound to a commit.
+`);
+    process.exit(2);
+  }
+  if (forgeHead !== localHead) {
+    process.stderr.write(`pr verify-evidence: REFUSED — this checkout is at ${localHead}, but #${prRef}'s head is ${forgeHead}.
+` + `Comparing against a different tree produces a difference that is real and uninteresting. Check out the head first.
+`);
+    process.exit(2);
+  }
+  const fresh = await buildReport();
+  const resolved = resolveAnchoredRegion(ScanContext.from(body), "EVIDENCE");
+  const verdict = compareEvidence(resolved === null || resolved === "hidden" ? resolved : { region: resolved.region }, fresh.blockInner, repoRoot2());
+  process.stdout.write(`${renderVerdict(verdict)}
+`);
+  process.stdout.write(`  compared at head ${localHead}
+`);
+  process.exit(verdict.status === "match" ? 0 : 1);
+}
+
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync14 } from "node:child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync23 } from "node:fs";
+import { execFileSync as execFileSync16 } from "node:child_process";
+import { existsSync as existsSync22, readFileSync as readFileSync24 } from "node:fs";
 import { join as join23 } from "node:path";
 
 // src/lib/doc-owners-write.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync7, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync23, writeFileSync as writeFileSync11 } from "node:fs";
 import { dirname as dirname7, join as join22 } from "node:path";
 function bindingLine(glob, pointer) {
   return `${glob}  ${pointer}`;
@@ -8157,23 +9636,23 @@ function appendDocOwnersBinding(content, glob, pointer) {
   return `${content}${sep4}${bindingLine(glob, pointer)}
 `;
 }
-function planDocOwnersBinding(repoRoot2, glob, pointer) {
-  const abs2 = join22(repoRoot2, DOC_OWNERS_PATH);
+function planDocOwnersBinding(repoRoot3, glob, pointer) {
+  const abs2 = join22(repoRoot3, DOC_OWNERS_PATH);
   const line = bindingLine(glob, pointer);
-  if (!existsSync20(abs2)) {
+  if (!existsSync21(abs2)) {
     return { action: "create-host", line, path: DOC_OWNERS_PATH };
   }
-  const existing = readFileSync22(abs2, "utf-8");
+  const existing = readFileSync23(abs2, "utf-8");
   const already = parseDocOwners(existing).bindings.some((b) => b.glob === glob);
   return { action: already ? "skip-present" : "append-row", line, path: DOC_OWNERS_PATH };
 }
-function applyDocOwnersBinding(repoRoot2, plan, glob, pointer) {
-  const abs2 = join22(repoRoot2, DOC_OWNERS_PATH);
+function applyDocOwnersBinding(repoRoot3, plan, glob, pointer) {
+  const abs2 = join22(repoRoot3, DOC_OWNERS_PATH);
   if (plan.action === "create-host") {
     mkdirSync7(dirname7(abs2), { recursive: true });
     writeFileSync11(abs2, freshDocOwners(glob, pointer), "utf-8");
   } else if (plan.action === "append-row") {
-    const existing = readFileSync22(abs2, "utf-8");
+    const existing = readFileSync23(abs2, "utf-8");
     writeFileSync11(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
   }
 }
@@ -8233,13 +9712,13 @@ var GLOB_INJECTION_RE = /[\s\r\n]/;
 var POINTER_INJECTION_RE = /[\r\n]/;
 var NAME_INJECTION_RE = /[\s|\r\n]/;
 var PATH_INJECTION_RE2 = /[|\r\n]/;
-function pointerIsMissingLocalFile(repoRoot2, pointer) {
+function pointerIsMissingLocalFile(repoRoot3, pointer) {
   if (/^https?:\/\//i.test(pointer))
     return false;
   const path = pointer.split("#")[0] ?? pointer;
-  return !existsSync21(join23(repoRoot2, path));
+  return !existsSync22(join23(repoRoot3, path));
 }
-async function bindDocOwnerLoop(deps, repoRoot2) {
+async function bindDocOwnerLoop(deps, repoRoot3) {
   let any = false;
   for (;; ) {
     if (any && !await deps.confirm("Bind another doc→code pair?", false))
@@ -8254,11 +9733,11 @@ async function bindDocOwnerLoop(deps, repoRoot2) {
     }
     if (GLOB_INJECTION_RE.test(glob) || POINTER_INJECTION_RE.test(pointer)) {
       console.error(red("Error: glob must not contain whitespace, and the pointer must not contain a newline."));
-    } else if (pointerIsMissingLocalFile(repoRoot2, pointer)) {
+    } else if (pointerIsMissingLocalFile(repoRoot3, pointer)) {
       console.error(red(`✗ "${pointer}" does not exist in this repo (and isn't a URL).`));
     } else {
-      const plan = planDocOwnersBinding(repoRoot2, glob, pointer);
-      applyDocOwnersBinding(repoRoot2, plan, glob, pointer);
+      const plan = planDocOwnersBinding(repoRoot3, glob, pointer);
+      applyDocOwnersBinding(repoRoot3, plan, glob, pointer);
       process.stdout.write(`${green(renderDocOwnersBindingDiffLine(plan))}
 `);
       any = true;
@@ -8304,10 +9783,10 @@ async function registerProjectLoop(deps) {
   }
 }
 function readPackageVersion() {
-  const pkg = JSON.parse(readFileSync23(join23(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync24(join23(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
-function realDeps6() {
+function realDeps7() {
   return {
     detectRepo: detectGitRepo,
     initDeps: {
@@ -8327,15 +9806,21 @@ function realDeps6() {
       readHooksPath: readCoreHooksPath,
       nodeVersion: () => process.version,
       bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
-      packageVersion: readPackageVersion
+      packageVersion: readPackageVersion,
+      meteringCapability: () => resolveMeteringCapability({
+        env: process.env,
+        cwd: process.cwd(),
+        exists: existsSync22,
+        readFile: (path) => readFileSync24(path, "utf8")
+      })
     },
     confirm: async (q, defaultYes) => promptYesNo(q, defaultYes),
     ask: async (q) => prompt(q),
     closeStdin
   };
 }
-function execGit(repoRoot2, args) {
-  return execFileSync14("git", args, { cwd: repoRoot2, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+function execGit(repoRoot3, args) {
+  return execFileSync16("git", args, { cwd: repoRoot3, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -8343,37 +9828,37 @@ function errorDetail(err) {
     return stderr.toString().trim();
   return err instanceof Error ? err.message : String(err);
 }
-function gitStatusShort(repoRoot2) {
-  return execGit(repoRoot2, ["status", "--short"]);
+function gitStatusShort(repoRoot3) {
+  return execGit(repoRoot3, ["status", "--short"]);
 }
-function commitInstall(repoRoot2) {
-  execGit(repoRoot2, ["add", "-A"]);
-  const staged = execGit(repoRoot2, ["diff", "--cached", "--stat"]);
+function commitInstall(repoRoot3) {
+  execGit(repoRoot3, ["add", "-A"]);
+  const staged = execGit(repoRoot3, ["diff", "--cached", "--stat"]);
   if (!staged)
     return { committed: false, message: "Nothing to commit — working tree already clean." };
   try {
-    execGit(repoRoot2, ["commit", "-m", "Chore: install Vinaya"]);
+    execGit(repoRoot3, ["commit", "-m", "Chore: install Vinaya"]);
     return { committed: true, message: "✓ Committed `Chore: install Vinaya`." };
   } catch (err) {
     return { committed: false, message: `git commit failed: ${errorDetail(err)}` };
   }
 }
-function pushInstall(repoRoot2) {
+function pushInstall(repoRoot3) {
   try {
-    const branch = execGit(repoRoot2, ["symbolic-ref", "--short", "HEAD"]);
+    const branch = execGit(repoRoot3, ["symbolic-ref", "--short", "HEAD"]);
     let hasUpstream = true;
     try {
-      execGit(repoRoot2, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
+      execGit(repoRoot3, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
     } catch {
       hasUpstream = false;
     }
     if (hasUpstream) {
-      const ahead = execGit(repoRoot2, ["rev-list", "--count", "@{u}..HEAD"]);
+      const ahead = execGit(repoRoot3, ["rev-list", "--count", "@{u}..HEAD"]);
       if (ahead === "0") {
         return { status: "up-to-date", message: "Nothing to push — already up to date with the remote." };
       }
     }
-    execGit(repoRoot2, hasUpstream ? ["push"] : ["push", "-u", "origin", branch]);
+    execGit(repoRoot3, hasUpstream ? ["push"] : ["push", "-u", "origin", branch]);
     return { status: "pushed", message: "✓ Pushed." };
   } catch (err) {
     return { status: "failed", message: `git push failed: ${errorDetail(err)}` };
@@ -8465,12 +9950,12 @@ ${bold("Next steps:")}
   }
 }
 async function quickstartCommand(args) {
-  process.exit(await runQuickstart(args, realDeps6()));
+  process.exit(await runQuickstart(args, realDeps7()));
 }
 
 // src/commands/review-post.ts
-import { execFileSync as execFileSync15 } from "node:child_process";
-import { readFileSync as readFileSync24, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "node:fs";
+import { execFileSync as execFileSync17 } from "node:child_process";
+import { readFileSync as readFileSync25, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join24 } from "node:path";
 class FindingsParseError extends Error {
@@ -8509,6 +9994,12 @@ function renderFindingsSection(findings) {
 function renderTokensLine(role, roleLabel, input) {
   return `Tokens: ${input.taskId}: ${role} — ${roleLabel} — ${input.model} — ${input.tokensIn}/${input.tokensOut}/${input.cost}`;
 }
+function renderCastByLine(roleLabel, sessionId) {
+  return `Cast by: ${roleLabel} (session ${sessionId})`;
+}
+function resolveSessionId(env) {
+  return env.CLAUDE_CODE_SESSION_ID ?? "(unknown)";
+}
 var CODE_REVIEW_VERDICT_TEXT = {
   APPROVE: "APPROVE",
   REQUEST_CHANGES: "REQUEST CHANGES"
@@ -8530,7 +10021,8 @@ function renderCodeReviewComment(input) {
     `TESTS: ${input.tests}`,
     `DOCS: ${input.docs}`,
     "",
-    renderTokensLine("review", "Reviewer", input)
+    renderTokensLine("review", "Reviewer", input),
+    renderCastByLine("Reviewer", input.sessionId)
   ].join(`
 `);
 }
@@ -8553,7 +10045,7 @@ function renderSecurityComment(input) {
   if (input.secretsEvidence !== null) {
     lines.push("```", input.secretsEvidence, "```", "");
   }
-  lines.push(`SECRETS: ${input.secrets}`, "", renderTokensLine("security", "Security", input));
+  lines.push(`SECRETS: ${input.secrets}`, "", renderTokensLine("security", "Security", input), renderCastByLine("Security", input.sessionId));
   return lines.join(`
 `);
 }
@@ -8645,7 +10137,7 @@ function readFindingsFile(path, allowedSeverities) {
     return [];
   let content;
   try {
-    content = readFileSync24(path, "utf8");
+    content = readFileSync25(path, "utf8");
   } catch {
     refuseCmd(`Could not read findings file at ${path}.`, "Check the path and re-run.");
   }
@@ -8674,9 +10166,9 @@ function normalizeSecurityVerdict(raw) {
     return "FAIL";
   refuseCmd(`\`--verdict ${raw}\` is not PASS or FAIL.`, "Pass `--verdict PASS` or `--verdict FAIL`.");
 }
-function gh(args) {
+function gh2(args) {
   try {
-    return execFileSync15("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync17("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
@@ -8685,7 +10177,7 @@ function gh(args) {
 function resolveHeadSha(pr) {
   let out;
   try {
-    out = gh(["pr", "view", pr, "--json", "headRefOid", "-q", ".headRefOid"]);
+    out = gh2(["pr", "view", pr, "--json", "headRefOid", "-q", ".headRefOid"]);
   } catch (err) {
     refuseCmd(`Could not resolve PR ${pr}'s head via \`gh pr view --json headRefOid\`: ${err instanceof Error ? err.message : String(err)}`, "Confirm `gh auth status` passes and the PR number is correct, then re-run.");
   }
@@ -8698,7 +10190,7 @@ function postComment(pr, body) {
   const tmp = join24(tmpdir2(), `vinaya-review-post-${process.pid}-${Date.now()}.md`);
   writeFileSync12(tmp, body);
   try {
-    return gh(["pr", "comment", pr, "--body-file", tmp]).trim();
+    return gh2(["pr", "comment", pr, "--body-file", tmp]).trim();
   } catch (err) {
     refuseCmd(`Rendered comment failed to post via \`gh pr comment\`: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network, then re-run — nothing was posted.");
   } finally {
@@ -8706,7 +10198,7 @@ function postComment(pr, body) {
   }
 }
 function fetchComments(pr) {
-  const out = gh(["pr", "view", pr, "--json", "comments"]);
+  const out = gh2(["pr", "view", pr, "--json", "comments"]);
   const parsed = JSON.parse(out);
   return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
 }
@@ -8775,7 +10267,8 @@ async function reviewPostCommand(args) {
   const tokensIn = requireTokenField(flags2, "--tokens-in");
   const tokensOut = requireTokenField(flags2, "--tokens-out");
   const cost = requireFlag(flags2, "--cost");
-  const tokens = { taskId, model, tokensIn, tokensOut, cost };
+  const sessionId = resolveSessionId(process.env);
+  const tokens = { taskId, model, tokensIn, tokensOut, cost, sessionId };
   const headSha = resolveHeadSha(pr);
   const principalAllowlist = resolvePrincipalAllowlist(loadTrustAnchorConfig());
   let body;
@@ -8813,7 +10306,7 @@ async function reviewPostCommand(args) {
     let secretsEvidence = null;
     if (secretsEvidenceFile) {
       try {
-        secretsEvidence = readFileSync24(secretsEvidenceFile, "utf8");
+        secretsEvidence = readFileSync25(secretsEvidenceFile, "utf8");
       } catch {
         refuseCmd(`Could not read secrets evidence file at ${secretsEvidenceFile}.`, "Check the path and re-run.");
       }
@@ -8854,7 +10347,7 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
 
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync25, renameSync } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync26, renameSync } from "node:fs";
 import net from "node:net";
 import { dirname as dirname8, join as join25 } from "node:path";
 import { promisify as promisify5 } from "node:util";
@@ -8911,15 +10404,15 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   for (;; ) {
     const webDir = join25(dir, "apps", "vinaya-studio", "web");
     const pkgPath = join25(webDir, "package.json");
-    if (existsSync22(pkgPath)) {
+    if (existsSync23(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync25(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync26(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
           return { kind: "workspace", webDir };
         }
       } catch {}
     }
-    if (existsSync22(join25(dir, ".git")))
+    if (existsSync23(join25(dir, ".git")))
       break;
     const parent = dirname8(dir);
     if (parent === dir)
@@ -8927,29 +10420,29 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
     dir = parent;
   }
   const standaloneWebDir = join25(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync22(join25(standaloneWebDir, "server.js"))) {
+  if (existsSync23(join25(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
 }
 function spawnDev(webDir, args) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawn2("bun", ["run", "dev", ...args], { cwd: webDir, stdio: "inherit" });
-    child.on("exit", (code) => resolve2(code ?? 0));
+    child.on("exit", (code) => resolve3(code ?? 0));
   });
 }
 function isPortFree(port) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const tester = net.createServer();
-    tester.once("error", () => resolve2(false));
-    tester.once("listening", () => tester.close(() => resolve2(true)));
+    tester.once("error", () => resolve3(false));
+    tester.once("listening", () => tester.close(() => resolve3(true)));
     tester.listen(port, "127.0.0.1");
   });
 }
 function ensureStudioNodeModules(bundleRoot) {
   const real = join25(bundleRoot, "node_modules");
   const packed = join25(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
-  if (!existsSync22(real) && existsSync22(packed)) {
+  if (!existsSync23(real) && existsSync23(packed)) {
     renameSync(packed, real);
   }
 }
@@ -8973,9 +10466,9 @@ async function spawnStandalone(cwd, serverPath, bundleRoot, explicitPort) {
   const env = { HOSTNAME: "127.0.0.1", ...process.env, PORT: String(port), VINAYA_REPO_ROOT: cwd };
   if (repo)
     env.AEG_REPO = `${repo.owner}/${repo.repo}`;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawn2("node", [serverPath], { cwd, stdio: "inherit", env });
-    child.on("exit", (code) => resolve2(code ?? 0));
+    child.on("exit", (code) => resolve3(code ?? 0));
   });
 }
 async function runStudio(cwd, args, moduleUrl = import.meta.url) {
@@ -9008,9 +10501,9 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
 }
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync23, readFileSync as readFileSync26, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync27, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join26 } from "node:path";
-function realDeps7() {
+function realDeps8() {
   return {
     detectRepo: detectGitRepo,
     hookDirFor: resolveHookDir,
@@ -9026,13 +10519,13 @@ function realDeps7() {
 function flags2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
-function readManifest3(repoRoot2) {
-  const p = join26(repoRoot2, CONFIG_PATH);
-  if (!existsSync23(p))
+function readManifest3(repoRoot3) {
+  const p = join26(repoRoot3, CONFIG_PATH);
+  if (!existsSync24(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync26(p, "utf-8"));
+    raw = JSON.parse(readFileSync27(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -9047,31 +10540,31 @@ function readManifest3(repoRoot2) {
     return { kind: "not-initialized" };
   return { kind: "ok", manifest: parsed.data.managed };
 }
-function writeManifestVersion(repoRoot2, manifest) {
-  const configAbs = join26(repoRoot2, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync26(configAbs, "utf-8"));
+function writeManifestVersion(repoRoot3, manifest) {
+  const configAbs = join26(repoRoot3, CONFIG_PATH);
+  const seed = JSON.parse(readFileSync27(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
   writeFileSync13(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
-function stripFor(repoRoot2, path, marker, comment) {
-  const abs2 = resolveManagedBlockPath(repoRoot2, path);
-  if (!existsSync23(abs2))
+function stripFor(repoRoot3, path, marker, comment) {
+  const abs2 = resolveManagedBlockPath(repoRoot3, path);
+  if (!existsSync24(abs2))
     return { path, marker, comment, present: false, removesHost: false };
-  const stripped = stripBlockFromContent(readFileSync26(abs2, "utf-8"), marker, comment);
+  const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), marker, comment);
   if (stripped === null)
     return { path, marker, comment, present: false, removesHost: false };
   return { path, marker, comment, present: true, removesHost: blockStripLeavesEmpty(stripped) };
 }
-function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
+function planHookRouting(repoRoot3, manifest, recorded, hooksPathValue) {
   const none = { target: recorded, strips: [], arm: false, migratesManifest: false, blockedReason: null };
   if (recorded === ".husky")
     return none;
   if (recorded === TRACKED_HOOK_DIR) {
-    const strips = manifest.blocks.filter((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)).map((b) => stripFor(repoRoot2, `.git/hooks/${b.marker}`, b.marker, b.comment)).filter((s) => s.present);
+    const strips = manifest.blocks.filter((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)).map((b) => stripFor(repoRoot3, `.git/hooks/${b.marker}`, b.marker, b.comment)).filter((s) => s.present);
     if (hooksPathValue === TRACKED_HOOK_DIR)
       return { ...none, strips };
-    const foreign = foreignRawHooks(repoRoot2);
+    const foreign = foreignRawHooks(repoRoot3);
     if (foreign.length > 0) {
       return {
         ...none,
@@ -9084,17 +10577,17 @@ function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
   const legacy = manifest.blocks.filter((b) => b.path.startsWith(".git/hooks/"));
   const blocked = [];
   for (const b of legacy) {
-    const abs2 = resolveManagedBlockPath(repoRoot2, b.path);
-    if (!existsSync23(abs2))
+    const abs2 = resolveManagedBlockPath(repoRoot3, b.path);
+    if (!existsSync24(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync26(abs2, "utf-8"), b.marker, b.comment);
+    const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
       blocked.push(`${b.path} exists without vinaya's managed block`);
     else if (!blockStripLeavesEmpty(stripped))
       blocked.push(`${b.path} carries your own lines alongside the managed block`);
   }
   const legacyNames = new Set(legacy.map((b) => b.path.slice(".git/hooks/".length)));
-  for (const f of activeRawHooks(repoRoot2)) {
+  for (const f of activeRawHooks(repoRoot3)) {
     if (!legacyNames.has(f))
       blocked.push(`.git/hooks/${f} is an active raw hook vinaya does not manage`);
   }
@@ -9102,7 +10595,7 @@ function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
     return { ...none, blockedReason: blocked.join("; ") };
   return {
     target: TRACKED_HOOK_DIR,
-    strips: legacy.map((b) => stripFor(repoRoot2, b.path, b.marker, b.comment)).filter((s) => s.present),
+    strips: legacy.map((b) => stripFor(repoRoot3, b.path, b.marker, b.comment)).filter((s) => s.present),
     arm: hooksPathValue !== TRACKED_HOOK_DIR,
     migratesManifest: true,
     blockedReason: null
@@ -9118,7 +10611,7 @@ function extractWorkflowTrigger(content) {
   const match = content.match(/^on:\r?\n {2}([A-Za-z0-9_]+):/m);
   return match?.[1] ?? null;
 }
-function planUpgrade(ops, repoRoot2, manifest, routing) {
+function planUpgrade(ops, repoRoot3, manifest, routing) {
   const entries = [];
   let hasChanges = routing.arm || routing.migratesManifest || routing.strips.some((s) => s.present);
   const ownedFiles = new Set(manifest.files);
@@ -9126,12 +10619,12 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
   const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
   for (const op of ops) {
     if (op.kind === "create-file") {
-      const abs2 = join26(repoRoot2, op.path);
-      const exists = existsSync23(abs2);
+      const abs2 = join26(repoRoot3, op.path);
+      const exists = existsSync24(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       let action;
       let triggerChange;
-      if (op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) {
+      if ((op.path === CONFIG_PATH || op.path === DOC_OWNERS_PATH) && exists) {
         action = "keep";
       } else if (!owned) {
         action = exists ? "refuse-foreign" : "not-installed";
@@ -9139,7 +10632,7 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
         action = "recreate";
         hasChanges = true;
       } else {
-        const diskContent = readFileSync26(abs2, "utf-8");
+        const diskContent = readFileSync27(abs2, "utf-8");
         if (diskContent !== op.content) {
           action = "regenerate";
           hasChanges = true;
@@ -9155,16 +10648,16 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
       }
       entries.push({ kind: "create-file", op, action, ...triggerChange ? { triggerChange } : {} });
     } else if (op.kind === "managed-block") {
-      const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
+      const abs2 = resolveManagedBlockPath(repoRoot3, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync23(abs2)) {
+      } else if (!existsSync24(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
-        const content = readFileSync26(abs2, "utf-8");
+        const content = readFileSync27(abs2, "utf-8");
         const { begin, end } = markerLines(op.marker, op.comment);
         if (!(content.includes(begin) && content.includes(end))) {
           action = "recreate-append";
@@ -9268,39 +10761,39 @@ function renderUpgradeDiff(plan) {
   return lines.join(`
 `);
 }
-function regenerateBlock(repoRoot2, op) {
-  const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
-  const content = readFileSync26(abs2, "utf-8");
+function regenerateBlock(repoRoot3, op) {
+  const abs2 = resolveManagedBlockPath(repoRoot3, op.path);
+  const content = readFileSync27(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
     writeFileSync13(abs2, stripped.endsWith(`
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
-  appendBlock(repoRoot2, op);
+  appendBlock(repoRoot3, op);
 }
-function applyUpgrade(plan, repoRoot2) {
+function applyUpgrade(plan, repoRoot3) {
   for (const e of plan.entries) {
     if (e.kind === "create-file") {
       if (e.action === "regenerate" || e.action === "recreate") {
-        writeFileWithDirs(join26(repoRoot2, e.op.path), e.op.content, e.op.mode);
+        writeFileWithDirs(join26(repoRoot3, e.op.path), e.op.content, e.op.mode);
       }
     } else {
       if (e.action === "recreate-host")
-        createHost(repoRoot2, e.op);
+        createHost(repoRoot3, e.op);
       else if (e.action === "recreate-append")
-        appendBlock(repoRoot2, e.op);
+        appendBlock(repoRoot3, e.op);
       else if (e.action === "regenerate-block")
-        regenerateBlock(repoRoot2, e.op);
+        regenerateBlock(repoRoot3, e.op);
     }
   }
   for (const s of plan.routing.strips) {
     if (!s.present)
       continue;
-    const abs2 = resolveManagedBlockPath(repoRoot2, s.path);
-    if (!existsSync23(abs2))
+    const abs2 = resolveManagedBlockPath(repoRoot3, s.path);
+    if (!existsSync24(abs2))
       continue;
-    const stripped = stripBlockFromContent(readFileSync26(abs2, "utf-8"), s.marker, s.comment);
+    const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)
       continue;
     if (blockStripLeavesEmpty(stripped))
@@ -9385,20 +10878,20 @@ Vinaya upgraded.
   return 0;
 }
 async function upgradeCommand(args) {
-  process.exit(await runUpgrade(args, realDeps7()));
+  process.exit(await runUpgrade(args, realDeps8()));
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync16 } from "node:child_process";
+import { execFileSync as execFileSync18 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
-function gh2(args) {
-  return execFileSync16("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+function gh3(args) {
+  return execFileSync18("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
-    const out = gh2(["pr", "view", "--json", "number", "-q", ".number"]);
+    const out = gh3(["pr", "view", "--json", "number", "-q", ".number"]);
     return /^\d+$/.test(out) ? out : null;
   } catch {
     return null;
@@ -9494,8 +10987,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync16("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync16("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync18("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync18("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -9526,7 +11019,7 @@ function printHelp() {
 // src/index.ts
 var PACKAGE_ROOT = join27(dirname9(fileURLToPath2(import.meta.url)), "..");
 function readVersion2() {
-  const pkg = JSON.parse(readFileSync27(join27(PACKAGE_ROOT, "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync28(join27(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
 }
 var [, , command, ...args] = process.argv;
@@ -9619,8 +11112,10 @@ try {
         prEditCommand(rest);
       } else if (subcommand === "report") {
         await prReportCommand(rest);
+      } else if (subcommand === "verify-evidence") {
+        await prVerifyEvidenceCommand(rest);
       } else {
-        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create', 'edit', or 'report')`);
+        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create', 'edit', 'report', or 'verify-evidence')`);
         process.exit(2);
       }
       break;
@@ -9645,8 +11140,10 @@ try {
         await milestoneAdoptCommand(rest);
       } else if (subcommand === "edit") {
         await milestoneEditCommand(rest);
+      } else if (subcommand === "close") {
+        await milestoneCloseCommand(rest);
       } else {
-        console.error(`Unknown 'milestone' subcommand: ${subcommand ?? "(none)"} (expected create/adopt/edit)`);
+        console.error(`Unknown 'milestone' subcommand: ${subcommand ?? "(none)"} (expected create/adopt/edit/close)`);
         process.exit(2);
       }
       break;
@@ -9679,6 +11176,10 @@ try {
       await quickstartCommand(args);
       break;
     }
+    case "tokens": {
+      tokensCommand(args);
+      break;
+    }
     default:
       console.error(`Unknown command: ${command}`);
       printHelp();