@attalabs/vinaya 0.20.1 → 0.21.0

package/dist/index.js

@@ -6,7 +6,7 @@ import { dirname as dirname9, join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/archive.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 // ../../packages/aeg-forge-state/src/strip-code.ts
 function maskCode(body) {
   const fill = (line) => " ".repeat(line.length);
@@ -164,6 +164,16 @@ function maskIndentedCode(body, fill) {
 
 // ../../packages/aeg-forge-state/src/parse-rationale-deps.ts
 var SECTION_HEADER = /\*\*Dependency rationale\*\*/i;
+// ../../packages/aeg-forge-state/src/check-milestone-attachment.ts
+function checkMilestoneAttachment(labeledIssueNumbers, attachedIssueNumbers) {
+  const attachedSet = new Set(attachedIssueNumbers);
+  const labeledSet = new Set(labeledIssueNumbers);
+  const unattached = labeledIssueNumbers.filter((n) => !attachedSet.has(n));
+  const foreign = attachedIssueNumbers.filter((n) => !labeledSet.has(n));
+  if (unattached.length === 0 && foreign.length === 0)
+    return { status: "clean" };
+  return { status: "mismatch", unattached, foreign };
+}
 // ../../packages/aeg-forge-state/src/gh.ts
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
@@ -172,6 +182,12 @@ var systemEnv = {
   ...process.env,
   PATH: [process.env.PATH, "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"].filter(Boolean).join(":")
 };
+function run(args) {
+  return execFileSync("gh", args, { encoding: "utf8", env: systemEnv });
+}
+function ghApiGet(path) {
+  return JSON.parse(run(["api", path]));
+}
 
 // ../../packages/aeg-forge-state/src/labels.ts
 var LABELS = [
@@ -435,6 +451,47 @@ function parseFieldValue(value) {
 function projectsFromBody(body) {
   return projectFieldFromBody(body).names;
 }
+
+// ../../packages/aeg-forge-state/src/fetch-milestone.ts
+var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
+var NEXT_HEADING = /^#{1,6}\s+\S/m;
+var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
+function intentGoalForSlug(description, slug) {
+  const text = stripCode(description, { inlineSpans: "keep" });
+  const start = text.match(INTENTS_HEADING);
+  if (!start || start.index === undefined)
+    return "";
+  const rest = text.slice(start.index + start[0].length);
+  const next = rest.match(NEXT_HEADING);
+  const section = rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+  for (const line of section.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+      continue;
+    const m = trimmed.match(INTENT_BULLET);
+    if (m && (m[1] ?? "").toLowerCase() === slug.toLowerCase())
+      return (m[2] ?? "").trim();
+  }
+  return "";
+}
+function matchesLegacyMilestone(milestones, slug) {
+  return milestones.find((m) => m.title === slug) ?? null;
+}
+function resolveMilestoneAttachTarget(milestones, slug) {
+  const legacy = matchesLegacyMilestone(milestones, slug);
+  if (legacy?.state === "open")
+    return { number: legacy.number, title: legacy.title };
+  const intentMatch = milestones.find((m) => m.state === "open" && intentGoalForSlug(m.description ?? "", slug) !== "");
+  return intentMatch ? { number: intentMatch.number, title: intentMatch.title } : null;
+}
+function findMilestoneAttachTargetForSlug(owner, repo, slug) {
+  const milestones = ghApiGet(`repos/${owner}/${repo}/milestones?state=all&per_page=100`);
+  return resolveMilestoneAttachTarget(milestones, slug);
+}
+function hasExplicitMilestoneFlag(args) {
+  return args.some((a) => a === "--milestone" || a === "-m" || a.startsWith("--milestone="));
+}
 // ../../packages/aeg-forge-state/src/github-token.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
@@ -732,14 +789,60 @@ var DERIVED_STATUSES = [
 ];
 var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
 // ../../packages/aeg-core/src/report-tokens.ts
-function formatTokensLine(input) {
-  const model = input.modelOverride ?? input.summary?.model ?? "—";
-  if (!input.summary) {
-    return `Tokens: ${input.phase} — ${input.role} — ${model} — —`;
+function stripNewlines(value) {
+  return value.replace(/\r?\n/g, " ");
+}
+function sanitizeForTableCell(value) {
+  return stripNewlines(value).replace(/\|/g, "\\|");
+}
+var DASH_LOOKALIKES = {
+  "-": "‑",
+  "–": "‒",
+  "—": "―"
+};
+var DASH_CHARS = new Set(Object.keys(DASH_LOOKALIKES));
+function sanitizeForTokensLine(value) {
+  const stripped = stripNewlines(value);
+  let result = "";
+  for (let i = 0;i < stripped.length; i++) {
+    const ch = stripped[i];
+    if (DASH_CHARS.has(ch)) {
+      const leftReachable = i === 0 || /\s/.test(stripped[i - 1]);
+      const rightReachable = i === stripped.length - 1 || /\s/.test(stripped[i + 1]);
+      if (leftReachable && rightReachable) {
+        result += DASH_LOOKALIKES[ch];
+        continue;
+      }
+    }
+    result += ch;
   }
+  return result;
+}
+function renderCells(input) {
+  const model = input.modelOverride ?? input.summary?.model ?? null;
+  if (!input.summary)
+    return { model, tokensIn: "—", tokensOut: "—" };
   const { inputTokens, cacheCreationInputTokens, cacheReadInputTokens, outputTokens } = input.summary.components;
   const tokensIn = inputTokens + cacheCreationInputTokens + cacheReadInputTokens;
-  return `Tokens: ${input.phase} — ${input.role} — ${model} — ${tokensIn}/${outputTokens}/—`;
+  return { model, tokensIn: String(tokensIn), tokensOut: String(outputTokens) };
+}
+function formatTokensLine(input) {
+  const { model, tokensIn, tokensOut } = renderCells(input);
+  const phase = sanitizeForTokensLine(input.phase);
+  const role = sanitizeForTokensLine(input.role);
+  const safeModel = model === null ? "—" : sanitizeForTokensLine(model);
+  if (!input.summary) {
+    return `Tokens: ${phase} — ${role} — ${safeModel} — —`;
+  }
+  return `Tokens: ${phase} — ${role} — ${safeModel} — ${tokensIn}/${tokensOut}/—`;
+}
+function formatTokenReportRow(input) {
+  const { model, tokensIn, tokensOut } = renderCells(input);
+  const phase = sanitizeForTableCell(input.phase);
+  const role = sanitizeForTableCell(input.role);
+  const safeModel = model === null ? "—" : sanitizeForTableCell(model);
+  const date = sanitizeForTableCell(input.date);
+  return `| ${phase} | ${role} | ${safeModel} | ${tokensIn} | ${tokensOut} | — | ${date} |`;
 }
 function formatBreakdown(summary) {
   const { inputTokens, cacheCreationInputTokens, cacheReadInputTokens, outputTokens } = summary.components;
@@ -807,43 +910,65 @@ function transcriptPointerPath(projectDir, tmpDir) {
 }
 function resolvePointer(explicitTranscriptPath, deps) {
   if (explicitTranscriptPath)
-    return { path: explicitTranscriptPath };
+    return { path: explicitTranscriptPath, corroborated: true };
   const projectDir = deps.env.CLAUDE_PROJECT_DIR ?? deps.cwd;
   const tmpDir = deps.env.TMPDIR ?? "/tmp";
   const pointerPath = transcriptPointerPath(projectDir, tmpDir);
+  const currentSessionId = deps.env.CLAUDE_CODE_SESSION_ID;
   if (!deps.exists(pointerPath)) {
     return {
+      pointerExisted: false,
+      corroborated: false,
       error: `No transcript pointer at ${pointerPath} and no --transcript given. ` + "Either this repo installs no track-transcript.sh Stop hook (lacking one is not a defect — " + "name the transcript directly instead), or no session has completed a turn yet."
     };
   }
   let contents;
   try {
-    contents = deps.readFile(pointerPath).trim();
+    contents = deps.readFile(pointerPath).replace(/\r?\n+$/, "");
   } catch (err) {
-    return { error: `Transcript pointer at ${pointerPath} could not be read: ${err.message}` };
+    return {
+      pointerExisted: true,
+      oursByLocation: true,
+      error: `Transcript pointer at ${pointerPath} could not be read: ${err.message}. ` + "Remove that file to clear this — the Stop hook rewrites it on the next turn."
+    };
   }
   const [pointerSessionId, transcriptPath] = contents.split("\t");
   if (!transcriptPath) {
-    return { error: `Transcript pointer file ${pointerPath} is malformed: "${contents}"` };
+    return {
+      pointerExisted: true,
+      oursByLocation: true,
+      error: `Transcript pointer file ${pointerPath} is malformed: "${contents.slice(0, 120)}${contents.length > 120 ? "…" : ""}". ` + "Remove that file to clear this — the Stop hook rewrites it on the next turn."
+    };
   }
-  const currentSessionId = deps.env.CLAUDE_CODE_SESSION_ID;
   if (currentSessionId && pointerSessionId && currentSessionId !== pointerSessionId) {
     return {
+      pointerExisted: true,
+      corroborated: false,
       error: `Transcript pointer at ${pointerPath} is stale: written for session ${pointerSessionId}, ` + `but this session is ${currentSessionId}. Name your own transcript with --transcript instead of ` + "reporting another session's figures as yours."
     };
   }
-  return { path: transcriptPath };
+  return { path: transcriptPath, corroborated: Boolean(currentSessionId && pointerSessionId) };
 }
 function resolveMeteringCapability(deps, explicitTranscriptPath) {
   const resolved = resolvePointer(explicitTranscriptPath, deps);
   if ("error" in resolved) {
-    return { capable: false, reason: "no-transcript-resolved", detail: resolved.error };
+    const ours = resolved.pointerExisted && (resolved.corroborated || resolved.oursByLocation);
+    if (ours)
+      return { capable: false, reason: "pointer-unusable", detail: resolved.error };
+    return {
+      capable: false,
+      reason: "no-transcript-resolved",
+      detail: resolved.pointerExisted ? `A transcript pointer exists but belongs to another session, so this session has no wiring of its own to use. (Underlying condition, for diagnosis only: ${resolved.error})` : resolved.error
+    };
   }
+  const downstream = (r, detail) => resolved.corroborated ? { reason: r, detail } : {
+    reason: "no-transcript-resolved",
+    detail: `A transcript pointer was found but could not be shown to belong to this session, so it is not treated as this session's wiring. (Underlying condition, for diagnosis only: ${detail})`
+  };
   if (!deps.exists(resolved.path)) {
     return {
       capable: false,
-      reason: "transcript-unreadable",
-      detail: `Resolved transcript path ${resolved.path} does not exist.`
+      ...downstream("transcript-unreadable", `Resolved transcript path ${resolved.path} is not readable as a regular file owned by this user.`)
     };
   }
   let jsonl;
@@ -852,16 +977,14 @@ function resolveMeteringCapability(deps, explicitTranscriptPath) {
   } catch (err) {
     return {
       capable: false,
-      reason: "transcript-unreadable",
-      detail: `Transcript at ${resolved.path} could not be read: ${err.message}`
+      ...downstream("transcript-unreadable", `Transcript at ${resolved.path} could not be read: ${err.message}`)
     };
   }
   const summary = summarizeTranscript(jsonl);
   if (summary.messageCount === 0) {
     return {
       capable: false,
-      reason: "transcript-empty",
-      detail: `Transcript at ${resolved.path} yielded zero assistant messages with usage data — ` + "it's empty, unparseable, or not yet flushed to disk."
+      ...downstream("transcript-empty", `Transcript at ${resolved.path} yielded zero assistant messages with usage data — ` + "it's empty, unparseable, or not yet flushed to disk.")
     };
   }
   return { capable: true, transcriptPath: resolved.path, summary };
@@ -1453,6 +1576,8 @@ var EXEMPT_LITERALS = new Set([
 var NON_PATH_TOP_SEGMENTS = new Set(["origin", "refs", "HEAD", "vinaya", "fix"]);
 // ../../packages/aeg-core/src/reader-resolvable-prose.ts
 var SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
+// ../../packages/aeg-core/src/quoted-command.ts
+var QUOTED_COMMAND_SWEPT_CLASSES = new Set(["ships", "reader-facing"]);
 // ../../packages/aeg-core/src/retired-vocabulary.ts
 var RETIRED_PATTERNS = [
   String.raw`\bD-[0-9]{3}\b`,
@@ -1545,15 +1670,15 @@ function releaseFieldFromText(text) {
   const raw = unwrapValue2(m[1] ?? "");
   return { declared: true, value: RELEASE_VALUE.test(raw) ? raw : null };
 }
-var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
-var NEXT_HEADING = /^#{1,6}\s+\S/m;
-var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
+var INTENTS_HEADING2 = /^#{1,6}\s*Tranche intents\s*$/im;
+var NEXT_HEADING2 = /^#{1,6}\s+\S/m;
+var INTENT_BULLET2 = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
 function intentsBlock(text) {
-  const start = text.match(INTENTS_HEADING);
+  const start = text.match(INTENTS_HEADING2);
   if (!start || start.index === undefined)
     return null;
   const rest = text.slice(start.index + start[0].length);
-  const next = rest.match(NEXT_HEADING);
+  const next = rest.match(NEXT_HEADING2);
   const sectionEnd = next && next.index !== undefined ? next.index : rest.length;
   return { start: start.index, end: start.index + start[0].length + sectionEnd, section: rest.slice(0, sectionEnd) };
 }
@@ -1570,7 +1695,7 @@ function parseIntents(text) {
     const trimmed = line.trim();
     if (trimmed.length === 0)
       continue;
-    const m = trimmed.match(INTENT_BULLET);
+    const m = trimmed.match(INTENT_BULLET2);
     if (!m)
       return { intents: [], malformed: true };
     intents.push({ slug: (m[1] ?? "").toLowerCase(), goal: (m[2] ?? "").trim() });
@@ -2838,13 +2963,14 @@ function buildInitOps(ctx) {
 // src/lib/ops.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, isAbsolute, join as join6, resolve, sep as sep2 } from "node:path";
+import { dirname as dirname4, isAbsolute, join as join6, resolve as resolve2, sep as sep2 } from "node:path";
 
 // src/lib/config.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { dirname as dirname3, join as join5, resolve } from "node:path";
 import { z } from "zod";
 
 // src/lib/agent-vendors.ts
@@ -2995,6 +3121,20 @@ function resolveAgentVendors(manifest) {
     return new Set(AGENT_VENDORS);
   return new Set(manifest.agents);
 }
+var ProjectEntrySchema = z.object({
+  name: z.string().min(1),
+  description: z.string().min(1).optional(),
+  path: z.string().min(1).optional()
+});
+function parseTokensCollectDeclaration(value) {
+  const m = value.trim().match(/^(\S+)\s+(\S+)$/);
+  if (!m)
+    return null;
+  const [, interpreter, script] = m;
+  if (!isSafeRepoRelPath(script))
+    return null;
+  return { interpreter, script };
+}
 var VinayaConfigSchema = z.object({
   rings: z.object({
     ring1_forgeWriteInterception: z.boolean(),
@@ -3007,13 +3147,19 @@ var VinayaConfigSchema = z.object({
   principals: z.array(z.string()).min(1).optional(),
   releaseActor: z.string().min(1).optional(),
   ci: z.object({ setup: z.string().min(1) }).optional(),
+  tokens: z.object({
+    collect: z.string().min(1).refine((v) => parseTokensCollectDeclaration(v) !== null, {
+      message: 'tokens.collect must be exactly "<interpreter> <repo-relative-script-path>" — two whitespace-separated tokens, no flags, no shell syntax, no quoting'
+    })
+  }).optional(),
   blastRadius: z.object({ extraDomains: z.array(z.string()).optional() }).optional(),
   proseGates: z.object({
     doctrineRoot: z.string().min(1).optional(),
     readerFacingPrefix: z.string().min(1).optional(),
     readerFacingSuffix: z.string().min(1).optional(),
     legacySlugDir: z.string().min(1).optional()
-  }).optional()
+  }).optional(),
+  projects: z.array(ProjectEntrySchema).optional()
 });
 var GLOBAL_VINAYA_HOME = join5(homedir(), ".vinaya");
 var GLOBAL_CONFIG_PATH = join5(GLOBAL_VINAYA_HOME, "config.json");
@@ -3052,6 +3198,9 @@ function globalRolesIgnoredWarning(path) {
 function globalReleaseActorIgnoredWarning(path) {
   return `${path}: "releaseActor" in the global config is ignored — releaseActor may only be declared from a repo-local vinaya.config.json.`;
 }
+function globalTokensCollectIgnoredWarning(path) {
+  return `${path}: "tokens" in the global config is ignored — tokens.collect may only be declared from a repo-local vinaya.config.json.`;
+}
 function stripGlobalOnlyKeys(config, path) {
   if (path !== GLOBAL_CONFIG_PATH)
     return config;
@@ -3072,6 +3221,10 @@ function stripGlobalOnlyKeys(config, path) {
     console.error(`⚠ ${globalReleaseActorIgnoredWarning(path)}`);
     result = { ...result, releaseActor: undefined };
   }
+  if (result.tokens) {
+    console.error(`⚠ ${globalTokensCollectIgnoredWarning(path)}`);
+    result = { ...result, tokens: undefined };
+  }
   return result;
 }
 function resolvePrincipalAllowlist(config) {
@@ -3181,6 +3334,69 @@ function loadConfigChecked() {
   }
   return { ok: true, config: stripGlobalOnlyKeys(parsed.data, path) };
 }
+var TOKENS_COLLECT_TRUST_PATH = join5(GLOBAL_VINAYA_HOME, "tokens-collect-trust.json");
+function readTokensCollectTrustStore(storePath) {
+  try {
+    if (!existsSync4(storePath))
+      return {};
+    const raw = JSON.parse(readFileSync4(storePath, "utf-8"));
+    return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+  } catch {
+    return {};
+  }
+}
+function writeTokensCollectTrustStore(storePath, store) {
+  const dir = dirname3(storePath);
+  if (!existsSync4(dir))
+    mkdirSync(dir, { recursive: true });
+  writeFileSync(storePath, JSON.stringify(store, null, 2), "utf-8");
+}
+var GIT_IDENTITY_TIMEOUT_MS = 5000;
+function gitCommonDir(cwd = process.cwd()) {
+  try {
+    const raw = execFileSync2("git", ["rev-parse", "--git-common-dir"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: GIT_IDENTITY_TIMEOUT_MS
+    }).trim();
+    if (!raw)
+      return null;
+    return realpathSync(resolve(cwd, raw));
+  } catch {
+    return null;
+  }
+}
+function repoLocalConfigDir() {
+  const local = findLocalConfig();
+  return local ? dirname3(local) : null;
+}
+function gitBlobHash(absolutePath, cwd) {
+  try {
+    const raw = execFileSync2("git", ["hash-object", absolutePath], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: GIT_IDENTITY_TIMEOUT_MS
+    }).trim();
+    return raw || null;
+  } catch {
+    return null;
+  }
+}
+function tokensCollectTrustKey(repoGitCommonDir, interpreter, script) {
+  return createHash("sha256").update(JSON.stringify([repoGitCommonDir, interpreter, script])).digest("hex");
+}
+function getTokensCollectTrust(repoGitCommonDir, interpreter, script, storePath = TOKENS_COLLECT_TRUST_PATH) {
+  const key = tokensCollectTrustKey(repoGitCommonDir, interpreter, script);
+  return readTokensCollectTrustStore(storePath)[key] ?? null;
+}
+function trustTokensCollectCommand(repoGitCommonDir, interpreter, script, scriptBlobHash, storePath = TOKENS_COLLECT_TRUST_PATH) {
+  const store = readTokensCollectTrustStore(storePath);
+  const key = tokensCollectTrustKey(repoGitCommonDir, interpreter, script);
+  store[key] = { interpreter, script, scriptBlobHash, trustedAt: new Date().toISOString() };
+  writeTokensCollectTrustStore(storePath, store);
+}
 
 // src/lib/ops.ts
 var MARKER_NS = "vinaya:managed";
@@ -3204,9 +3420,9 @@ var GIT_DIR_PREFIX = ".git/";
 function resolveManagedBlockPath(repoRoot, opPath) {
   if (!opPath.startsWith(GIT_DIR_PREFIX))
     return join6(repoRoot, opPath);
-  return join6(gitCommonDir(repoRoot), opPath.slice(GIT_DIR_PREFIX.length));
+  return join6(gitCommonDir2(repoRoot), opPath.slice(GIT_DIR_PREFIX.length));
 }
-function gitCommonDir(repoRoot) {
+function gitCommonDir2(repoRoot) {
   try {
     const commonDir = execFileSync3("git", ["-C", repoRoot, "rev-parse", "--git-common-dir"], {
       encoding: "utf8"
@@ -3219,8 +3435,8 @@ function gitCommonDir(repoRoot) {
   }
 }
 function containedAbs(repoRoot, relPath) {
-  const root = resolve(repoRoot);
-  const target = resolve(root, relPath);
+  const root = resolve2(repoRoot);
+  const target = resolve2(root, relPath);
   if (target === root)
     return null;
   return target === root || target.startsWith(root + sep2) ? target : null;
@@ -3228,9 +3444,9 @@ function containedAbs(repoRoot, relPath) {
 function containedManagedBlockAbs(repoRoot, relPath) {
   if (!relPath.startsWith(GIT_DIR_PREFIX))
     return containedAbs(repoRoot, relPath);
-  const commonDir = gitCommonDir(repoRoot);
-  const hooksRoot = resolve(join6(commonDir, "hooks"));
-  const target = resolve(join6(commonDir, relPath.slice(GIT_DIR_PREFIX.length)));
+  const commonDir = gitCommonDir2(repoRoot);
+  const hooksRoot = resolve2(join6(commonDir, "hooks"));
+  const target = resolve2(join6(commonDir, relPath.slice(GIT_DIR_PREFIX.length)));
   if (target === hooksRoot)
     return null;
   return target.startsWith(hooksRoot + sep2) ? target : null;
@@ -3766,8 +3982,8 @@ function prompt(question) {
   setupStdinReader();
   if (stdinEnded && pendingResolvers.length === 0)
     return Promise.resolve("");
-  return new Promise((resolve2) => {
-    pendingResolvers.push(resolve2);
+  return new Promise((resolve3) => {
+    pendingResolvers.push(resolve3);
     if (stdinEnded)
       flushLines();
   });
@@ -3786,112 +4002,397 @@ function closeStdin() {
   }
 }
 
-// src/commands/archive.ts
-function ring2Accelerated() {
-  return loadConfig()?.rings?.ring2_asyncAudits === true;
-}
-function realDeps() {
-  return { detectRepo: detectGitRepo };
+// src/commands/tokens.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
+import { resolve as resolvePath } from "node:path";
+var USAGE = [
+  'Usage: vinaya tokens --phase "<task-id>: develop" --role Developer',
+  "  [--model <id>] [--transcript <path>] [--in <tokens-in> --out <tokens-out>]",
+  "",
+  "  --transcript   Read this transcript directly. Supported primary route — use it whenever you know",
+  "                 which transcript is yours, and always in a repo with no track-transcript.sh hook.",
+  "  (omitted)      Resolve via the Stop-hook pointer file, if this repo installs that hook.",
+  "  --in/--out     Manual entry: the exact token figures, for a host whose usage arrives by some other",
+  "                 means than a Claude Code transcript. Both required together; skips transcript",
+  "                 resolution entirely.",
+  "",
+  "Usage: vinaya tokens --trust-collect",
+  "  Approves this repo's declared tokens.collect command, pinned to the script's exact current",
+  "  content, on this machine. Run this once before tokens.collect will ever execute — a changed",
+  "  interpreter, script path, or script CONTENT needs its own fresh approval. Does not take",
+  "  --phase/--role and never emits a Tokens: line."
+].join(`
+`);
+function parseArgs(argv) {
+  let phase;
+  let role;
+  let model;
+  let transcriptPath;
+  let tokensInRaw;
+  let tokensOutRaw;
+  for (let i = 0;i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--phase")
+      phase = argv[++i];
+    else if (arg === "--role")
+      role = argv[++i];
+    else if (arg === "--model")
+      model = argv[++i];
+    else if (arg === "--transcript")
+      transcriptPath = argv[++i];
+    else if (arg === "--in")
+      tokensInRaw = argv[++i];
+    else if (arg === "--out")
+      tokensOutRaw = argv[++i];
+  }
+  if (!phase || !role) {
+    throw new Error(USAGE);
+  }
+  if (tokensInRaw === undefined !== (tokensOutRaw === undefined)) {
+    throw new Error("vinaya tokens: --in and --out must be given together, or not at all.");
+  }
+  const tokensIn = tokensInRaw === undefined ? undefined : Number(tokensInRaw);
+  const tokensOut = tokensOutRaw === undefined ? undefined : Number(tokensOutRaw);
+  if (tokensIn !== undefined && (!Number.isFinite(tokensIn) || tokensIn < 0)) {
+    throw new Error(`vinaya tokens: --in must be a non-negative integer, got "${tokensInRaw}".`);
+  }
+  if (tokensOut !== undefined && (!Number.isFinite(tokensOut) || tokensOut < 0)) {
+    throw new Error(`vinaya tokens: --out must be a non-negative integer, got "${tokensOutRaw}".`);
+  }
+  return { phase, role, model, transcriptPath, tokensIn, tokensOut };
 }
-function sh(args, input) {
-  return execFileSync4(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+function manualSummary(tokensIn, tokensOut) {
+  return {
+    components: {
+      inputTokens: tokensIn,
+      outputTokens: tokensOut,
+      cacheCreationInputTokens: 0,
+      cacheReadInputTokens: 0
+    },
+    model: null,
+    messageCount: 1
+  };
 }
-function shJson(args) {
-  return JSON.parse(sh(args));
+function declaredSummary(components, model) {
+  return { components, model, messageCount: 1 };
 }
-function parseMergeSha(args) {
-  for (const a of args) {
-    const m = a.match(/^--merge-sha=(.+)$/);
-    if (m)
-      return m[1];
+var COLLECT_FIELDS = ["inputTokens", "outputTokens", "cacheCreationInputTokens", "cacheReadInputTokens"];
+function parseDeclaredCollectOutput(raw, command) {
+  const trimmed = raw.trim();
+  const fail = (why) => {
+    throw new Error(`vinaya tokens: declared tokens.collect command "${command}" ${why}
+` + "Expected stdout to be a JSON object: " + `{"inputTokens":N,"outputTokens":N,"cacheCreationInputTokens":N,"cacheReadInputTokens":N,"model":"…"|null}
+` + `Got: ${trimmed.slice(0, 500)}`);
+  };
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch (err) {
+    fail(`did not print valid JSON on stdout (${err.message}).`);
   }
-  return null;
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    fail("printed JSON that is not an object.");
+  }
+  const obj = parsed;
+  const components = {};
+  for (const field of COLLECT_FIELDS) {
+    const value = obj[field];
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+      fail(`printed an invalid "${field}" (must be a non-negative number), got ${JSON.stringify(value)}.`);
+    }
+    components[field] = value;
+  }
+  const model = obj.model;
+  if (model !== undefined && model !== null && typeof model !== "string") {
+    fail(`printed a non-string "model" field: ${JSON.stringify(model)}.`);
+  }
+  return declaredSummary(components, typeof model === "string" ? model : null);
 }
-async function runArchive(args, deps) {
-  if (ring2Accelerated()) {
-    process.stdout.write("[vinaya archive] rings.ring2_asyncAudits is `true` (opt-in accelerator) — skipping, nothing changed.\n");
-    return 0;
+function resolveDeclaredCollect(command, deps) {
+  const parsed = parseTokensCollectDeclaration(command);
+  if (!parsed) {
+    throw new Error(`vinaya tokens: declared tokens.collect "${command}" is not shaped "<interpreter> <script-path>" — ` + "this should have been rejected at config-load time; the config may have been edited after loading.");
   }
-  const repo = await deps.detectRepo();
-  if (!repo) {
-    console.error("Error: not a git repository. Run `vinaya archive` from inside your repo.");
-    return 1;
+  const repoConfigDir = deps.repoConfigDir();
+  if (repoConfigDir === null) {
+    throw new Error("vinaya tokens: declared tokens.collect command could not be resolved — this repo's local " + "vinaya.config.json directory could not be found. Refusing to run an unresolvable command.");
   }
-  if (!repo.owner || !repo.repo) {
-    console.error("Error: could not resolve a GitHub owner/repo from the `origin` remote.");
-    return 1;
+  const repoGitCommonDir = deps.gitCommonDir();
+  if (repoGitCommonDir === null) {
+    throw new Error("vinaya tokens: declared tokens.collect command could not be verified — this repo's git common " + "directory could not be resolved. Refusing to run an unverifiable command.");
   }
-  const repoFlag = `${repo.owner}/${repo.repo}`;
-  const mergeSha = parseMergeSha(args) ?? sh(["git", "rev-parse", "HEAD"]);
-  const associated = shJson(["gh", "api", `repos/${repoFlag}/commits/${mergeSha}/pulls`]);
-  if (associated.length === 0) {
-    process.stdout.write(`[vinaya archive] no associated PR for merge ${mergeSha} — skip.
-`);
-    return 0;
+  const scriptAbsolutePath = resolvePath(repoConfigDir, parsed.script);
+  if (!deps.exists(scriptAbsolutePath)) {
+    throw new Error(`vinaya tokens: declared tokens.collect script "${parsed.script}" does not exist at ${scriptAbsolutePath}.`);
   }
-  const prNumber = associated[0].number;
-  const pr = shJson([
-    "gh",
-    "pr",
-    "view",
-    String(prNumber),
-    "-R",
-    repoFlag,
-    "--json",
-    "number,headRefName,body,mergedAt,comments"
-  ]);
-  const ref = taskRefFromBranch(pr.headRefName);
-  let issueLabels = [];
-  if (ref === null) {
-    const { issue: candidateIssue } = extractIssue(pr.body);
-    if (candidateIssue !== null) {
-      issueLabels = shJson([
-        "gh",
-        "issue",
-        "view",
-        String(candidateIssue),
-        "-R",
-        repoFlag,
-        "--json",
-        "labels"
-      ]).labels.map((l) => l.name);
-    }
+  return { interpreter: parsed.interpreter, script: parsed.script, scriptAbsolutePath, repoGitCommonDir };
+}
+function runDeclaredCollect(command, deps) {
+  const { interpreter, script, scriptAbsolutePath, repoGitCommonDir } = resolveDeclaredCollect(command, deps);
+  const currentHash = deps.scriptContentHash(scriptAbsolutePath, deps.cwd);
+  if (currentHash === null) {
+    throw new Error(`vinaya tokens: declared tokens.collect script "${script}" could not be hashed for verification ` + "(git unavailable, or the file could not be read). Refusing to run an unverifiable script.");
   }
-  if (!isEligibleForProvenance(ref, issueLabels)) {
-    process.stdout.write(`[vinaya archive] non-task branch (${pr.headRefName}) and closing Issue carries no vinaya/tranche:* label — skip.
-`);
-    return 0;
+  const trust = deps.getTrust(repoGitCommonDir, interpreter, script);
+  if (trust === null) {
+    throw new Error(`vinaya tokens: declared tokens.collect is not yet trusted on this machine:
+` + `  ${interpreter} ${script}
+` + "Run `vinaya tokens --trust-collect` once to approve it. Refusing — no `Tokens:` line emitted, no zeros.");
   }
-  const comments = pr.comments.map((c) => c.body);
-  if (hasProvenance(comments)) {
-    process.stdout.write(`[vinaya archive] provenance already present on PR #${pr.number} — skip (idempotent).
-`);
-    return 0;
+  if (trust.scriptBlobHash !== currentHash) {
+    throw new Error(`vinaya tokens: declared tokens.collect script "${script}" no longer matches its trusted content ` + `(approved at ${trust.scriptBlobHash}, now ${currentHash}).
+` + "Run `vinaya tokens --trust-collect` again to approve the new content. Refusing — no `Tokens:` line emitted, no zeros.");
   }
-  const facts = {
-    number: pr.number,
-    headRefName: pr.headRefName,
-    body: pr.body,
-    mergedAt: pr.mergedAt,
-    mergeSha,
-    comments
-  };
-  const { block, issue, dangling } = buildProvenanceBlock(facts);
-  process.stdout.write(`[vinaya archive] posting provenance block to PR #${pr.number}...
-`);
-  sh(["gh", "pr", "comment", String(pr.number), "-R", repoFlag, "--body-file", "-"], block);
-  process.stdout.write(`[vinaya archive] provenance block posted to PR #${pr.number}.
-`);
-  if (dangling.length > 0) {
-    process.stdout.write(`[vinaya archive] DANGLING (${dangling.length}): ${dangling.join("; ")}
-`);
+  deps.warn(`⚠ vinaya tokens: running declared tokens.collect: ${interpreter} ${script}`);
+  let raw;
+  try {
+    raw = deps.runScript(interpreter, scriptAbsolutePath, deps.cwd);
+  } catch (err) {
+    throw new Error(`vinaya tokens: declared tokens.collect "${interpreter} ${script}" failed: ${err.message}`);
   }
-  if (issue !== null) {
-    process.stdout.write(`[vinaya archive] closing Issue #${issue}...
-`);
-    sh(["gh", "issue", "close", String(issue), "-R", repoFlag]);
-    const state = shJson([
-      "gh",
+  return parseDeclaredCollectOutput(raw, command);
+}
+var COLLECT_COMMAND_TIMEOUT_MS = 30000;
+function realDeps() {
+  return {
+    env: process.env,
+    cwd: process.cwd(),
+    exists: existsSync7,
+    readFile: (path) => readFileSync7(path, "utf8"),
+    loadConfig,
+    repoConfigDir: repoLocalConfigDir,
+    runScript: (interpreter, scriptAbsolutePath, cwd) => execFileSync4(interpreter, [scriptAbsolutePath], { cwd, encoding: "utf-8", timeout: COLLECT_COMMAND_TIMEOUT_MS }),
+    warn: (message) => console.error(message),
+    gitCommonDir,
+    scriptContentHash: gitBlobHash,
+    getTrust: getTokensCollectTrust,
+    trustCollect: trustTokensCollectCommand
+  };
+}
+function buildTokensResult(parsed, deps) {
+  if (parsed.tokensIn !== undefined && parsed.tokensOut !== undefined) {
+    const summary = manualSummary(parsed.tokensIn, parsed.tokensOut);
+    return {
+      line: formatTokensLine({ phase: parsed.phase, role: parsed.role, summary, modelOverride: parsed.model }),
+      breakdown: undefined
+    };
+  }
+  const declaredCommand = deps.loadConfig()?.tokens?.collect;
+  if (declaredCommand) {
+    const summary = runDeclaredCollect(declaredCommand, deps);
+    return {
+      line: formatTokensLine({ phase: parsed.phase, role: parsed.role, summary, modelOverride: parsed.model }),
+      breakdown: formatBreakdown(summary)
+    };
+  }
+  const capability = resolveMeteringCapability(deps, parsed.transcriptPath);
+  if (!capability.capable) {
+    throw new Error(`vinaya tokens: refused — could not resolve real usage figures (${capability.reason}).
+${capability.detail}
+
+${USAGE}`);
+  }
+  return {
+    line: formatTokensLine({
+      phase: parsed.phase,
+      role: parsed.role,
+      summary: capability.summary,
+      modelOverride: parsed.model
+    }),
+    breakdown: formatBreakdown(capability.summary)
+  };
+}
+function runTrustCollect(deps) {
+  const declaredCommand = deps.loadConfig()?.tokens?.collect;
+  if (!declaredCommand) {
+    return {
+      ok: false,
+      message: "vinaya tokens --trust-collect: no tokens.collect declared in this repo's vinaya.config.json — nothing to trust."
+    };
+  }
+  let resolved;
+  try {
+    resolved = resolveDeclaredCollect(declaredCommand, deps);
+  } catch (err) {
+    return { ok: false, message: err.message };
+  }
+  const { interpreter, script, scriptAbsolutePath, repoGitCommonDir } = resolved;
+  const scriptBlobHash = deps.scriptContentHash(scriptAbsolutePath, deps.cwd);
+  if (scriptBlobHash === null) {
+    return {
+      ok: false,
+      message: `vinaya tokens --trust-collect: script "${script}" could not be hashed (git unavailable, or the file could not be read) — refusing to trust blindly.`
+    };
+  }
+  deps.trustCollect(repoGitCommonDir, interpreter, script, scriptBlobHash);
+  return { ok: true, interpreter, script, scriptBlobHash };
+}
+function tokensCommand(argv) {
+  if (argv.includes("--trust-collect")) {
+    const outcome = runTrustCollect(realDeps());
+    if (!outcome.ok) {
+      console.error(outcome.message);
+      process.exit(1);
+    }
+    process.stdout.write("Trusted. Future `vinaya tokens` runs on this machine execute it without asking again until the " + `interpreter, script path, or script content changes.
+${outcome.interpreter} ${outcome.script}
+` + `  content hash: ${outcome.scriptBlobHash}
+`);
+    return;
+  }
+  let parsed;
+  try {
+    parsed = parseArgs(argv);
+  } catch (err) {
+    console.error(err.message);
+    process.exit(2);
+  }
+  let result;
+  try {
+    result = buildTokensResult(parsed, realDeps());
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+  if (result.breakdown)
+    console.error(result.breakdown);
+  process.stdout.write(`${result.line}
+`);
+}
+
+// src/commands/archive.ts
+function ring2Accelerated() {
+  return loadConfig()?.rings?.ring2_asyncAudits === true;
+}
+function realDeps2() {
+  return { detectRepo: detectGitRepo, meteringCapability: () => resolveMeteringCapability(realDeps()) };
+}
+function isEmptySummary(summary) {
+  const { inputTokens, outputTokens, cacheCreationInputTokens, cacheReadInputTokens } = summary.components;
+  return inputTokens === 0 && outputTokens === 0 && cacheCreationInputTokens === 0 && cacheReadInputTokens === 0;
+}
+function renderArchiveTokensLine(capability, phase, role) {
+  if (!capability.capable) {
+    return { line: formatTokensLine({ phase, role, summary: null }), dangling: null };
+  }
+  if (isEmptySummary(capability.summary)) {
+    return {
+      line: null,
+      dangling: `Archivist Tokens: line omitted — metering probe reports capable (transcript ${capability.transcriptPath}) ` + `but summarized to zero tokens across ${capability.summary.messageCount} message(s); posting a real zero ` + "would misrepresent the turn, and `—` is sanctioned only for a genuinely incapable host."
+    };
+  }
+  return { line: formatTokensLine({ phase, role, summary: capability.summary }), dangling: null };
+}
+function sh(args, input) {
+  return execFileSync5(args[0], args.slice(1), { encoding: "utf8", input, env: process.env }).trim();
+}
+function shJson(args) {
+  return JSON.parse(sh(args));
+}
+function parseMergeSha(args) {
+  for (const a of args) {
+    const m = a.match(/^--merge-sha=(.+)$/);
+    if (m)
+      return m[1];
+  }
+  return null;
+}
+async function runArchive(args, deps) {
+  if (ring2Accelerated()) {
+    process.stdout.write("[vinaya archive] rings.ring2_asyncAudits is `true` (opt-in accelerator) — skipping, nothing changed.\n");
+    return 0;
+  }
+  const repo = await deps.detectRepo();
+  if (!repo) {
+    console.error("Error: not a git repository. Run `vinaya archive` from inside your repo.");
+    return 1;
+  }
+  if (!repo.owner || !repo.repo) {
+    console.error("Error: could not resolve a GitHub owner/repo from the `origin` remote.");
+    return 1;
+  }
+  const repoFlag = `${repo.owner}/${repo.repo}`;
+  const mergeSha = parseMergeSha(args) ?? sh(["git", "rev-parse", "HEAD"]);
+  const associated = shJson(["gh", "api", `repos/${repoFlag}/commits/${mergeSha}/pulls`]);
+  if (associated.length === 0) {
+    process.stdout.write(`[vinaya archive] no associated PR for merge ${mergeSha} — skip.
+`);
+    return 0;
+  }
+  const prNumber = associated[0].number;
+  const pr = shJson([
+    "gh",
+    "pr",
+    "view",
+    String(prNumber),
+    "-R",
+    repoFlag,
+    "--json",
+    "number,headRefName,body,mergedAt,comments"
+  ]);
+  const ref = taskRefFromBranch(pr.headRefName);
+  let issueLabels = [];
+  if (ref === null) {
+    const { issue: candidateIssue } = extractIssue(pr.body);
+    if (candidateIssue !== null) {
+      issueLabels = shJson([
+        "gh",
+        "issue",
+        "view",
+        String(candidateIssue),
+        "-R",
+        repoFlag,
+        "--json",
+        "labels"
+      ]).labels.map((l) => l.name);
+    }
+  }
+  if (!isEligibleForProvenance(ref, issueLabels)) {
+    process.stdout.write(`[vinaya archive] non-task branch (${pr.headRefName}) and closing Issue carries no vinaya/tranche:* label — skip.
+`);
+    return 0;
+  }
+  const comments = pr.comments.map((c) => c.body);
+  if (hasProvenance(comments)) {
+    process.stdout.write(`[vinaya archive] provenance already present on PR #${pr.number} — skip (idempotent).
+`);
+    return 0;
+  }
+  const facts = {
+    number: pr.number,
+    headRefName: pr.headRefName,
+    body: pr.body,
+    mergedAt: pr.mergedAt,
+    mergeSha,
+    comments
+  };
+  const { block, issue, dangling } = buildProvenanceBlock(facts);
+  const phase = `${ref ? ref.taskId : pr.headRefName}: archive`;
+  const tokensResult = renderArchiveTokensLine(deps.meteringCapability(), phase, "Archivist");
+  const tokensAddition = tokensResult.line !== null ? tokensResult.line : `DANGLING (tokens): ${tokensResult.dangling}`;
+  const blockWithTokens = `${block}
+
+${tokensAddition}`;
+  process.stdout.write(`[vinaya archive] posting provenance block to PR #${pr.number}...
+`);
+  sh(["gh", "pr", "comment", String(pr.number), "-R", repoFlag, "--body-file", "-"], blockWithTokens);
+  process.stdout.write(`[vinaya archive] provenance block posted to PR #${pr.number}.
+`);
+  if (dangling.length > 0) {
+    process.stdout.write(`[vinaya archive] DANGLING (${dangling.length}): ${dangling.join("; ")}
+`);
+  }
+  if (tokensResult.dangling !== null) {
+    process.stdout.write(`[vinaya archive] DANGLING (tokens): ${tokensResult.dangling}
+`);
+  }
+  if (issue !== null) {
+    process.stdout.write(`[vinaya archive] closing Issue #${issue}...
+`);
+    sh(["gh", "issue", "close", String(issue), "-R", repoFlag]);
+    const state = shJson([
+      "gh",
       "issue",
       "view",
       String(issue),
@@ -3915,7 +4416,7 @@ async function runArchive(args, deps) {
   return 0;
 }
 async function archiveCommand(args) {
-  process.exit(await runArchive(args, realDeps()));
+  process.exit(await runArchive(args, realDeps2()));
 }
 function parseTrancheArgs(args) {
   const yes = args.includes("--yes");
@@ -3994,19 +4495,19 @@ async function runArchiveTranche(args, deps) {
   return 0;
 }
 async function archiveTrancheCommand(args) {
-  process.exit(await runArchiveTranche(args, realDeps()));
+  process.exit(await runArchiveTranche(args, realDeps2()));
 }
 
 // src/commands/audit.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 function ring2Accelerated2() {
   return loadConfig()?.rings?.ring2_asyncAudits === true;
 }
-function realDeps2() {
+function realDeps3() {
   return { detectRepo: detectGitRepo };
 }
 function defaultSleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 var COMMAND_TIMEOUT_MS = 20000;
 var DEAD_BRANCH_LABEL = label("dead-branch-push");
@@ -4017,7 +4518,7 @@ var DIRECT_PUSH_MARKER = `<!-- ${DIRECT_PUSH_LABEL} -->`;
 var DIRECT_PUSH_LABEL_DESCRIPTION = "A commit landed on main with no associated merged PR (ring-2 detection)";
 function shSoft(args, input) {
   try {
-    return execFileSync5(args[0], args.slice(1), {
+    return execFileSync6(args[0], args.slice(1), {
       encoding: "utf8",
       input,
       timeout: COMMAND_TIMEOUT_MS
@@ -4041,7 +4542,7 @@ function shSoftJson(args) {
   }
 }
 function sh2(args, input) {
-  return execFileSync5(args[0], args.slice(1), { encoding: "utf8", input }).trim();
+  return execFileSync6(args[0], args.slice(1), { encoding: "utf8", input }).trim();
 }
 function listTaskBranches() {
   const out = shSoft(["git", "ls-remote", "--heads", "origin", "task/*"]);
@@ -4297,11 +4798,11 @@ async function runAudit(args, deps) {
   return failed ? 1 : 0;
 }
 async function auditCommand(args) {
-  process.exit(await runAudit(args, realDeps2()));
+  process.exit(await runAudit(args, realDeps3()));
 }
 
 // src/commands/check.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 import { dirname as dirname5 } from "node:path";
 
 // src/checks/contract.ts
@@ -4312,11 +4813,11 @@ function emitCheckError(error) {
 }
 
 // src/checks/registry.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { join as join8 } from "node:path";
 var DIST_BIN_DIR = join8(packageRoot(import.meta.url), "dist", "checks", "bin");
 var SRC_BIN_DIR = join8(packageRoot(import.meta.url), "src", "checks", "bin");
-var BIN_DIR = existsSync7(DIST_BIN_DIR) ? DIST_BIN_DIR : SRC_BIN_DIR;
+var BIN_DIR = existsSync8(DIST_BIN_DIR) ? DIST_BIN_DIR : SRC_BIN_DIR;
 var BIN_EXT = BIN_DIR === DIST_BIN_DIR ? ".js" : ".ts";
 function bin(name) {
   return join8(BIN_DIR, `${name}${BIN_EXT}`);
@@ -4627,6 +5128,26 @@ var REGISTRY = [
     },
     0
   ],
+  [
+    {
+      name: "changeset-coverage",
+      run: bin("check-changeset-coverage"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
+  [
+    {
+      name: "quoted-command",
+      run: bin("check-quoted-command"),
+      scope: "diff",
+      timeoutMs: 15000,
+      env: {}
+    },
+    0
+  ],
   [
     {
       name: "main-branch-refusal",
@@ -4636,6 +5157,19 @@ var REGISTRY = [
       env: {}
     },
     0
+  ],
+  [
+    {
+      name: "token-collection-wired",
+      run: bin("check-token-collection-wired"),
+      scope: "full",
+      timeoutMs: 15000,
+      env: {
+        CLAUDE_PROJECT_DIR: { optional: true },
+        CLAUDE_CODE_SESSION_ID: { optional: true }
+      }
+    },
+    0
   ]
 ];
 function coreCheckRegistry() {
@@ -4843,16 +5377,16 @@ async function runOne(spec, timeoutMs, callerEnv) {
   const timer = setTimeout(() => {
     timedOut = true;
     killTree("SIGTERM");
-    escalationDone = new Promise((resolve2) => {
+    escalationDone = new Promise((resolve3) => {
       const graceTimer = setTimeout(() => {
         const pid = proc.pid;
         if (pid !== undefined && groupStillAlive(pid))
           killTree("SIGKILL");
-        resolve2();
+        resolve3();
       }, KILL_GRACE_MS);
       cancelEscalation = () => {
         clearTimeout(graceTimer);
-        resolve2();
+        resolve3();
       };
     });
   }, timeoutMs);
@@ -4863,11 +5397,11 @@ async function runOne(spec, timeoutMs, callerEnv) {
   });
   proc.stdout.resume();
   let spawnError;
-  const exitCode = await new Promise((resolve2) => {
-    proc.on("close", (code) => resolve2(code));
+  const exitCode = await new Promise((resolve3) => {
+    proc.on("close", (code) => resolve3(code));
     proc.on("error", (err) => {
       spawnError = err;
-      resolve2(null);
+      resolve3(null);
     });
   });
   clearTimeout(timer);
@@ -4955,7 +5489,7 @@ async function runChecks(specs, opts) {
 }
 
 // src/roles/plan.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "node:fs";
 import { join as join10 } from "node:path";
 
 // ../../packages/sources/src/commands.ts
@@ -5110,6 +5644,18 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "pr verify-evidence",
+    description: "Prove a pull request's AEG:EVIDENCE region was machine-generated — regenerate it and compare",
+    flags: [],
+    details: [
+      "Deliberately a command, not a check: `evidence-fresh` runs inside `vinaya check --all`, and `pr report` runs `vinaya check --all --diff-only`, so a check that regenerated the block would run the suite containing itself. That recursion is why `evidence-fresh` verifies Group A only and leaves Group B attested.",
+      "Must be run from the repository ROOT of a CLEAN checkout at the pull request's head, and refuses otherwise. The regeneration inherits the working directory and several gates resolve their scan root from it, so a subdirectory silently narrows what the fresh run inspects. On cleanliness: Group B is regenerated by diff-scoped checks, so uncommitted or untracked files change which files are scanned and can produce a MATCH a clean checkout would not. Ignored paths are deliberately NOT inspected — `git diff` never reports one, so they cannot change the scope, and including them would refuse in every real checkout since `node_modules` is ignored and always present. The head is read from the forge and both a mismatch AND an unreadable head refuse — the verdict is bound to a commit, never merely attested. `BASE_SHA` is refused as well, since it steers the regeneration's merge-base.",
+      "Exits 0 on MATCH; 1 on DIFFERS, HIDDEN, or no block; 2 on a refusal (dirty worktree, wrong head, usage error). HIDDEN means the anchor pair sits inside a collapsed `<details>` block, where `body-bare-digits` blanks every digit and nothing can verify what it claims.",
+      "Comparison is a multiset of repo-relative, control-stripped lines: absolute paths (local AND foreign, so a block generated in CI compares against one generated on a laptop) and line order are ignored — a reorder is not a fabrication. Only the AEG:EVIDENCE region is read, since AEG:TOKENS appends by design. A moved merge-base is reported ALONGSIDE the differing lines, never instead of them."
+    ],
+    status: "shipped"
+  },
   {
     name: "issue create",
     description: "Open an issue after full brief-schema validation",
@@ -5186,6 +5732,19 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "milestone close",
+    description: "Close a tranche's Milestone after verifying every labeled Issue is actually attached",
+    flags: [
+      { flag: "--slug", description: "The tranche whose Milestone is being closed" },
+      { flag: "--validate-only", description: "Run every gate and report PASS without closing the Milestone" },
+      { flag: "--json", description: "Enveloped JSON output (schema: 1)" }
+    ],
+    details: [
+      "Resolves the target Milestone the same legacy-or-intent-declared way Issue create auto-attach does, then refuses to close on any mismatch between the label's Issues and the Milestone's natively attached Issues — naming each unattached or foreign Issue and its repair path (`gh issue edit <n> --milestone <title>`, or `vinaya milestone adopt`) — before the PATCH ever reaches the forge."
+    ],
+    status: "shipped"
+  },
   {
     name: "review post",
     description: "Render, post, and self-verify a code-reviewer or security-review verdict comment on a PR",
@@ -5373,7 +5932,7 @@ var COMMANDS = [
   }
 ];
 // ../../packages/sources/src/doctrine-file-adapter.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync7 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync8 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // ../../packages/sources/src/file-adapter.ts
@@ -5384,14 +5943,14 @@ function readMarkdownDir(root, dir) {
   const dirPath = join9(root, dir);
   return readdirSync4(dirPath).filter((f) => f.endsWith(".md")).sort().map((file) => {
     const path = join9(dir, file);
-    return { path, content: readFileSync7(join9(root, path), "utf-8") };
+    return { path, content: readFileSync8(join9(root, path), "utf-8") };
   });
 }
 function createFileDoctrineSource(config = {}) {
   const root = config.root ?? DEFAULT_GOVERNANCE_ROOT;
   return {
     async getDoctrine() {
-      const enforcement = readFileSync7(join9(root, "enforcement.md"), "utf-8");
+      const enforcement = readFileSync8(join9(root, "enforcement.md"), "utf-8");
       const roles = readMarkdownDir(root, "roles");
       const contracts = readMarkdownDir(root, "contracts");
       return { enforcement, roles, contracts };
@@ -5566,11 +6125,11 @@ function resolveRoles(core, configRoles) {
 var NO_DOCTRINE_REASON = "no bundled doctrine found next to this CLI install — the doctrine ships inside the @attalabs/vinaya npm package. Reinstall it, or, in a repo that vendors the CLI, run the package's bundle-doctrine script first.";
 function readContract(configDir, contractPath) {
   const absolute = join10(configDir, contractPath);
-  if (!existsSync8(absolute)) {
+  if (!existsSync9(absolute)) {
     return { ok: false, errors: [`contract file "${contractPath}" does not exist (resolved to "${absolute}")`] };
   }
   try {
-    return validateRoleContract(readFileSync8(absolute, "utf-8"));
+    return validateRoleContract(readFileSync9(absolute, "utf-8"));
   } catch (err) {
     return { ok: false, errors: [`could not read "${contractPath}": ${err.message}`] };
   }
@@ -5603,7 +6162,7 @@ async function buildRolePlan(configDir, configRoles) {
 // src/commands/check.ts
 function git(args) {
   try {
-    return execFileSync6("git", args, { encoding: "utf8" }).trim();
+    return execFileSync7("git", args, { encoding: "utf8" }).trim();
   } catch {
     return "";
   }
@@ -5841,7 +6400,7 @@ ${renderRolesTable(rolePlan)}
 }
 
 // src/commands/commit-msg.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 function commitMsgCommand(args) {
   const [messageFile, source] = args;
   if (!messageFile) {
@@ -5852,7 +6411,7 @@ function commitMsgCommand(args) {
   }
   if (source === "merge")
     return;
-  const firstLine2 = readFileSync9(messageFile, "utf-8").split(`
+  const firstLine2 = readFileSync10(messageFile, "utf-8").split(`
 `, 1)[0] ?? "";
   if (COMMIT_TYPE_STYLE.test(firstLine2))
     return;
@@ -5864,14 +6423,14 @@ function commitMsgCommand(args) {
 }
 
 // src/commands/demo.ts
-import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync10, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync11, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join11 } from "node:path";
 var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
 var FIXTURE_PATH = ".vinaya-demo-brief.md";
 var STATE_FILENAME = "vinaya-demo-state.json";
 function gitCapture(repoRoot, args) {
-  return execFileSync7("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync8("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function currentBranchName(repoRoot) {
   try {
@@ -5882,7 +6441,7 @@ function currentBranchName(repoRoot) {
 }
 function branchExists(repoRoot, name) {
   try {
-    execFileSync7("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
+    execFileSync8("git", ["rev-parse", "--verify", "--quiet", `refs/heads/${name}`], {
       cwd: repoRoot,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -5908,9 +6467,9 @@ function gitDirAbs(repoRoot) {
 function recoverFromCrash(repoRoot, statePath) {
   const currentBranch = currentBranchName(repoRoot);
   let state = null;
-  if (existsSync9(statePath)) {
+  if (existsSync10(statePath)) {
     try {
-      state = JSON.parse(readFileSync10(statePath, "utf-8"));
+      state = JSON.parse(readFileSync11(statePath, "utf-8"));
     } catch {
       state = null;
     }
@@ -5980,14 +6539,14 @@ function cleanup(repoRoot, originalBranch, demoBranch, statePath) {
   gitCapture(repoRoot, ["clean", "-fd"]);
   gitCapture(repoRoot, ["checkout", originalBranch]);
   gitCapture(repoRoot, ["branch", "-D", demoBranch]);
-  if (existsSync9(statePath))
+  if (existsSync10(statePath))
     rmSync2(statePath, { force: true });
 }
 async function runDemoBreak(repoRoot, args) {
   const keep = args.includes("--keep");
   const hookDir = resolveHookDir(repoRoot);
   const hookPath = resolveManagedBlockPath(repoRoot, `${hookDir}/pre-commit`);
-  if (!existsSync9(hookPath)) {
+  if (!existsSync10(hookPath)) {
     console.error("Vinaya hooks are not installed in this repo. Run `vinaya init` first.");
     return 1;
   }
@@ -6057,7 +6616,7 @@ Attempting to commit…
   process.stdout.write(`✓ Commit passed — the fix worked.
 `);
   if (keep) {
-    if (existsSync9(statePath))
+    if (existsSync10(statePath))
       unlinkSync(statePath);
     process.stdout.write(`
 --keep: leaving \`${demoBranch}\` checked out for you to inspect. Clean up with:
@@ -6084,12 +6643,12 @@ async function demoBreakCommand(args) {
 }
 
 // src/commands/doctor.ts
-import { execFileSync as execFileSync8 } from "node:child_process";
-import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync13, statSync as statSync2 } from "node:fs";
-import { delimiter, join as join13 } from "node:path";
+import { execFileSync as execFileSync9 } from "node:child_process";
+import { existsSync as existsSync13, readdirSync as readdirSync6, readFileSync as readFileSync15, statSync as statSync2 } from "node:fs";
+import { delimiter, join as join14 } from "node:path";
 
 // src/lib/self-host.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync11, realpathSync } from "node:fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync12, realpathSync as realpathSync2 } from "node:fs";
 import { join as join12, sep as sep3 } from "node:path";
 var VINAYA_PACKAGE_NAME = "@attalabs/vinaya";
 var DEFAULT_BIN = "dist/index.js";
@@ -6108,7 +6667,7 @@ function isSafeRelPath(p) {
 }
 function readPackageJson(path) {
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -6162,8 +6721,8 @@ function expandPattern(repoRoot, pattern) {
 }
 function resolvesInsideRepo(repoRoot, rel) {
   try {
-    const root = realpathSync(repoRoot);
-    const target = realpathSync(join12(repoRoot, rel));
+    const root = realpathSync2(repoRoot);
+    const target = realpathSync2(join12(repoRoot, rel));
     return target === root || target.startsWith(`${root}${sep3}`);
   } catch {
     return false;
@@ -6203,18 +6762,18 @@ function detectVendoredVinaya(repoRoot) {
 }
 
 // src/lib/env-lint.ts
-import { existsSync as existsSync10, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
 var ENV_READ_PATTERN = /\b(?:process\.env|Bun\.env|Deno\.env)\b/;
 function checksMissingEnvDeclaration(specs) {
   const names = [];
   for (const spec of specs) {
     if (spec.env)
       continue;
-    if (!existsSync10(spec.run))
+    if (!existsSync11(spec.run))
       continue;
     let source;
     try {
-      source = readFileSync12(spec.run, "utf8");
+      source = readFileSync13(spec.run, "utf8");
     } catch {
       continue;
     }
@@ -6227,40 +6786,171 @@ function envDeclarationWarning(name) {
   return `check "${name}" reads environment variables directly but declares no \`env\` — it will lose environment access at the next minor. Declare \`env\` for it (CheckSpec['env'] in src/checks/contract.ts, or vinaya.config.json's checks.<name>.env).`;
 }
 
-// src/commands/doctor.ts
-function readVersion() {
-  const pkg = JSON.parse(readFileSync13(join13(packageRoot(import.meta.url), "package.json"), "utf-8"));
-  return pkg.version;
-}
-function realDeps3() {
-  return {
-    detectRepo: detectGitRepo,
-    ghAuthStatus,
-    branchProtectionConfigured,
-    hookDirFor: resolveHookDir,
-    readHooksPath: readCoreHooksPath,
-    nodeVersion: () => process.version,
-    bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
-    packageVersion: readVersion,
-    meteringCapability: () => resolveMeteringCapability({
-      env: process.env,
-      cwd: process.cwd(),
-      exists: existsSync11,
-      readFile: (path) => readFileSync13(path, "utf8")
-    })
-  };
+// src/lib/registry-write.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname6, join as join13 } from "node:path";
+var PROJECTS_REGISTRY_PATH = ".vinaya/projects.md";
+var CONFIG_FILE_PATH = "vinaya.config.json";
+function rowLine(name, path, specsPath) {
+  return `| ${name} | \`${path}\` | \`${specsPath}\` | (state tracked globally) |`;
 }
-var ok = (check, message) => ({ check, severity: "ok", message });
-var info = (check, message) => ({ check, severity: "info", message });
-var warn = (check, message) => ({ check, severity: "warn", message });
-var error = (check, message) => ({ check, severity: "error", message });
+function freshProjectsRegistry(name, path, specsPath) {
+  return `---
+sidebar_title: Projects
+---
+# Projects in this repo
+
+**The project registry.** Declares the projects in this repo and where each
+one's specs and per-project state live. The \`Project\` field on a task (a
+forge Issue) resolves against this file.
+
+**Presence of this file means this is a multi-project repo** — the
+\`Project\` field is required on task Issues/PRs that touch a registered
+project's path. A project is a \`(name, path)\` pair you declared — nothing
+is derived from the folder tree.
+
+## Registry
+
+| Project | Path | Specs | Per-project state |
+|---------|------|-------|---------------------|
+${rowLine(name, path, specsPath)}
+`;
+}
+var REGISTRY_HEADING_RE = /^##\s+Registry\b/i;
+function appendRegistryRow(content, name, path, specsPath) {
+  const lines = content.split(/\r?\n/);
+  const headingIdx = lines.findIndex((l) => REGISTRY_HEADING_RE.test(l));
+  const newRow = rowLine(name, path, specsPath);
+  if (headingIdx === -1) {
+    const sep4 = content.endsWith(`
+`) ? "" : `
+`;
+    return `${content}${sep4}
+## Registry
+
+| Project | Path | Specs | Per-project state |
+|---------|------|-------|---------------------|
+${newRow}
+`;
+  }
+  let i = headingIdx + 1;
+  for (;i < lines.length; i++) {
+    if ((lines[i] ?? "").trim().startsWith("|"))
+      break;
+  }
+  if (i >= lines.length) {
+    lines.splice(headingIdx + 1, 0, "", "| Project | Path | Specs | Per-project state |", "|---------|------|-------|---------------------|", newRow);
+    return lines.join(`
+`);
+  }
+  let last = i + 1;
+  for (let j = i + 2;j < lines.length; j++) {
+    if (!(lines[j] ?? "").trim().startsWith("|"))
+      break;
+    last = j;
+  }
+  lines.splice(last + 1, 0, newRow);
+  return lines.join(`
+`);
+}
+function planRegistryRow(repoRoot, name, path, specsPath) {
+  const abs2 = join13(repoRoot, PROJECTS_REGISTRY_PATH);
+  const line = rowLine(name, path, specsPath);
+  if (!existsSync12(abs2)) {
+    return { action: "create-host", rowLine: line, path: PROJECTS_REGISTRY_PATH };
+  }
+  const existing = readFileSync14(abs2, "utf-8");
+  const already = parseRegistry(existing).some((p) => p.name === name);
+  return { action: already ? "skip-present" : "append-row", rowLine: line, path: PROJECTS_REGISTRY_PATH };
+}
+function applyRegistryRow(repoRoot, plan, name, path, specsPath) {
+  const abs2 = join13(repoRoot, PROJECTS_REGISTRY_PATH);
+  if (plan.action === "create-host") {
+    mkdirSync3(dirname6(abs2), { recursive: true });
+    writeFileSync4(abs2, freshProjectsRegistry(name, path, specsPath), "utf-8");
+  } else if (plan.action === "append-row") {
+    const existing = readFileSync14(abs2, "utf-8");
+    writeFileSync4(abs2, appendRegistryRow(existing, name, path, specsPath), "utf-8");
+  }
+}
+function renderRegistryRowDiffLine(plan) {
+  if (plan.action === "skip-present")
+    return `  = keep   ${plan.path} (project already registered)`;
+  if (plan.action === "append-row")
+    return `  ~ append row to ${plan.path}
+    ${plan.rowLine}`;
+  return `  + create ${plan.path} (with registry row)
+    ${plan.rowLine}`;
+}
+function readProjectEntries(repoRoot) {
+  const abs2 = join13(repoRoot, CONFIG_FILE_PATH);
+  if (!existsSync12(abs2))
+    return [];
+  try {
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync14(abs2, "utf-8"))).projects ?? [];
+  } catch {
+    return [];
+  }
+}
+function planConfigProjectEntry(repoRoot, entry2) {
+  const already = readProjectEntries(repoRoot).some((p) => p.name === entry2.name);
+  return { action: already ? "skip-present" : "add-entry", entry: entry2 };
+}
+function applyConfigProjectEntry(repoRoot, plan) {
+  if (plan.action === "skip-present")
+    return;
+  const abs2 = join13(repoRoot, CONFIG_FILE_PATH);
+  const seed = JSON.parse(readFileSync14(abs2, "utf-8"));
+  const projects = Array.isArray(seed.projects) ? seed.projects : [];
+  writeFileSync4(abs2, `${JSON.stringify({ ...seed, projects: [...projects, plan.entry] }, null, 2)}
+`, "utf-8");
+}
+function renderConfigProjectEntryDiffLine(plan) {
+  if (plan.action === "skip-present")
+    return `  = keep   ${CONFIG_FILE_PATH} (project already declared under "projects")`;
+  const bits = [`"name": ${JSON.stringify(plan.entry.name)}`];
+  if (plan.entry.path)
+    bits.push(`"path": ${JSON.stringify(plan.entry.path)}`);
+  if (plan.entry.description)
+    bits.push(`"description": ${JSON.stringify(plan.entry.description)}`);
+  return `  ~ append entry to ${CONFIG_FILE_PATH}'s "projects"
+    { ${bits.join(", ")} }`;
+}
+
+// src/commands/doctor.ts
+function readVersion() {
+  const pkg = JSON.parse(readFileSync15(join14(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  return pkg.version;
+}
+function realDeps4() {
+  return {
+    detectRepo: detectGitRepo,
+    ghAuthStatus,
+    branchProtectionConfigured,
+    hookDirFor: resolveHookDir,
+    readHooksPath: readCoreHooksPath,
+    nodeVersion: () => process.version,
+    bunVersion: () => typeof Bun === "undefined" ? null : Bun.version,
+    packageVersion: readVersion,
+    meteringCapability: () => resolveMeteringCapability({
+      env: process.env,
+      cwd: process.cwd(),
+      exists: existsSync13,
+      readFile: (path) => readFileSync15(path, "utf8")
+    })
+  };
+}
+var ok = (check, message) => ({ check, severity: "ok", message });
+var info = (check, message) => ({ check, severity: "info", message });
+var warn = (check, message) => ({ check, severity: "warn", message });
+var error = (check, message) => ({ check, severity: "error", message });
 function readConfig(repoRoot) {
-  const p = join13(repoRoot, CONFIG_PATH);
-  if (!existsSync11(p))
+  const p = join14(repoRoot, CONFIG_PATH);
+  if (!existsSync13(p))
     return { kind: "missing" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync13(p, "utf-8"));
+    raw = JSON.parse(readFileSync15(p, "utf-8"));
   } catch (err) {
     return { kind: "invalid", error: `invalid JSON: ${err.message}` };
   }
@@ -6299,14 +6989,14 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
   for (const op of buildInitOps(ctx)) {
     if (op.kind === "create-file") {
       const check = labelForPath(op.path);
-      const abs2 = join13(repoRoot, op.path);
-      const exists = existsSync11(abs2);
+      const abs2 = join14(repoRoot, op.path);
+      const exists = existsSync13(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       if (!exists) {
         findings.push(owned ? error(check, `${op.path} is recorded as vinaya-managed but missing on disk — run \`vinaya upgrade\`.`) : error(check, `${op.path} is not installed — run \`vinaya init\`.`));
         continue;
       }
-      const content = readFileSync13(abs2, "utf-8");
+      const content = readFileSync15(abs2, "utf-8");
       if (!owned) {
         findings.push(content === op.content ? warn(check, `${op.path} has vinaya's own content but isn't recorded in the manifest.`) : info(check, `${op.path} exists but is foreign content — not vinaya-managed, left untouched.`));
         continue;
@@ -6325,11 +7015,11 @@ function diagnoseInstall(repoRoot, ctx, manifest) {
       const check = "hooks";
       const abs2 = resolveManagedBlockPath(repoRoot, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
-      if (!existsSync11(abs2)) {
+      if (!existsSync13(abs2)) {
         findings.push(owned ? error(check, `${op.path} is missing — likely a fresh clone (raw git hooks aren't tracked by git). Run \`vinaya upgrade\` to restore it.`) : info(check, `${op.path} is not installed.`));
         continue;
       }
-      const content = readFileSync13(abs2, "utf-8");
+      const content = readFileSync15(abs2, "utf-8");
       const { begin, end } = markerLines(op.marker, op.comment);
       const hasMarkers = content.includes(begin) && content.includes(end);
       if (!hasMarkers) {
@@ -6377,22 +7067,22 @@ async function diagnoseHookRouting(repoRoot, hookDir, readHooksPath) {
 function diagnoseCustomChecks(repoRoot, config) {
   const findings = [];
   for (const [name, entry2] of Object.entries(config.checks ?? {})) {
-    const scriptAbs = join13(repoRoot, entry2.run);
-    findings.push(existsSync11(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
+    const scriptAbs = join14(repoRoot, entry2.run);
+    findings.push(existsSync13(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
   }
   return findings;
 }
 function listTrackedFiles(repoRoot) {
   try {
-    return execFileSync8("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
+    return execFileSync9("git", ["ls-files"], { cwd: repoRoot, encoding: "utf-8" }).split(`
 `).map((s) => s.trim()).filter(Boolean);
   } catch {
     return [];
   }
 }
 function diagnoseDocOwnersHealth(repoRoot) {
-  const path = join13(repoRoot, DOC_OWNERS_PATH);
-  const content = existsSync11(path) ? readFileSync13(path, "utf-8") : null;
+  const path = join14(repoRoot, DOC_OWNERS_PATH);
+  const content = existsSync13(path) ? readFileSync15(path, "utf-8") : null;
   const state = classifyDocOwnersManifest(content);
   if (state === "absent" || state === "empty")
     return [];
@@ -6409,8 +7099,8 @@ function diagnoseDocOwnersHealth(repoRoot) {
       findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} binds glob '${b.glob}', which matches none of the ${codeFiles.length} ` + "tracked code file(s) in this repo — the code it names may have been deleted, renamed, or never " + "existed. Repoint the binding to the code's new location, or remove it."));
     }
     if (!isUrlPointer(b.pointer)) {
-      const pointerPath = join13(repoRoot, pointerToPath(b.pointer));
-      if (!existsSync11(pointerPath)) {
+      const pointerPath = join14(repoRoot, pointerToPath(b.pointer));
+      if (!existsSync13(pointerPath)) {
         flagged = true;
         findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Repoint the ` + "binding, or add the missing doc."));
       }
@@ -6425,7 +7115,7 @@ var LEGACY_AEG_PACKAGES_PATH = ".aeg/packages";
 function readWorkspacesForDoctor(repoRoot) {
   const fromPackageJson = () => {
     try {
-      const pkg = JSON.parse(readFileSync13(join13(repoRoot, "package.json"), "utf-8"));
+      const pkg = JSON.parse(readFileSync15(join14(repoRoot, "package.json"), "utf-8"));
       return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
     } catch {
       return [];
@@ -6433,7 +7123,7 @@ function readWorkspacesForDoctor(repoRoot) {
   };
   const fromPnpmWorkspaceYaml = () => {
     try {
-      return parsePnpmWorkspaceYaml(readFileSync13(join13(repoRoot, "pnpm-workspace.yaml"), "utf-8"));
+      return parsePnpmWorkspaceYaml(readFileSync15(join14(repoRoot, "pnpm-workspace.yaml"), "utf-8"));
     } catch {
       return [];
     }
@@ -6442,23 +7132,23 @@ function readWorkspacesForDoctor(repoRoot) {
 }
 function listChildDirsForDoctor(dir, repoRoot) {
   try {
-    return readdirSync6(join13(repoRoot, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    return readdirSync6(join14(repoRoot, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
 }
 function diagnoseBlastRadiusDeprecation(repoRoot, config) {
   const derived = deriveWorkspacePackageDomains(readWorkspacesForDoctor(repoRoot), (dir) => listChildDirsForDoctor(dir, repoRoot));
-  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync11(join13(repoRoot, p)));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync13(join14(repoRoot, p)));
   const covered = new Set([...derived, ...defaults]);
   const configExtra = new Set(config?.blastRadius?.extraDomains ?? []);
-  const legacyPath = join13(repoRoot, LEGACY_AEG_PACKAGES_PATH);
-  if (!existsSync11(legacyPath)) {
+  const legacyPath = join14(repoRoot, LEGACY_AEG_PACKAGES_PATH);
+  if (!existsSync13(legacyPath)) {
     return [
       info("blast-radius", `checkBlastRadiusScope is active via live derivation (${derived.length} packages/* domain(s)) + built-in defaults (${defaults.length} present) — no ${LEGACY_AEG_PACKAGES_PATH}, and the check is not dormant.`)
     ];
   }
-  const legacyEntries = readFileSync13(legacyPath, "utf-8").split(`
+  const legacyEntries = readFileSync15(legacyPath, "utf-8").split(`
 `).map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
   const uncovered = legacyEntries.filter((e) => !covered.has(e) && !configExtra.has(e));
   const migrationNote = uncovered.length === 0 ? "every entry is already covered by live derivation, the built-in defaults, or vinaya.config.json blastRadius.extraDomains — the file can be deleted." : `migrate ${uncovered.length} entr${uncovered.length === 1 ? "y" : "ies"} not yet covered before deleting it: ${uncovered.join(", ")}.`;
@@ -6493,7 +7183,7 @@ function diagnoseBriefSchemaDrift(config) {
 }
 function diagnoseEnvDeclarations(repoRoot, config) {
   const resolved = resolveChecks(coreCheckRegistry(), config?.checks).resolved;
-  const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join13(repoRoot, entry2.spec.run) } : entry2.spec);
+  const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join14(repoRoot, entry2.spec.run) } : entry2.spec);
   const missing = checksMissingEnvDeclaration(specs);
   const findings = missing.map((name) => info("env", envDeclarationWarning(name)));
   for (const message of lintEnvDeclarations(config?.checks)) {
@@ -6514,11 +7204,11 @@ function diagnoseCheckClassification(config) {
   return findings;
 }
 function diagnoseGlobalConfigChecks() {
-  if (!existsSync11(GLOBAL_CONFIG_PATH))
+  if (!existsSync13(GLOBAL_CONFIG_PATH))
     return [];
   let raw;
   try {
-    raw = JSON.parse(readFileSync13(GLOBAL_CONFIG_PATH, "utf-8"));
+    raw = JSON.parse(readFileSync15(GLOBAL_CONFIG_PATH, "utf-8"));
   } catch (err) {
     return [info("checks", `${GLOBAL_CONFIG_PATH} is invalid JSON — ${err.message}`)];
   }
@@ -6567,13 +7257,13 @@ function coversWorkflowsDir(pattern) {
   return bare === ".github/workflows" || bare === "/.github/workflows";
 }
 function diagnoseCodeowners(repoRoot) {
-  const path = join13(repoRoot, ".github", "CODEOWNERS");
-  if (!existsSync11(path)) {
+  const path = join14(repoRoot, ".github", "CODEOWNERS");
+  if (!existsSync13(path)) {
     return info("codeowners", "no .github/CODEOWNERS — vinaya's workflow files have no required-review protection; see `vinaya init`'s printed recommendation.");
   }
   let body;
   try {
-    body = readFileSync13(path, "utf-8");
+    body = readFileSync15(path, "utf-8");
   } catch (err) {
     return warn("codeowners", `.github/CODEOWNERS exists but could not be read: ${err.message}`);
   }
@@ -6586,7 +7276,7 @@ function diagnoseVinayaOnPath(agents) {
     return [];
   const names = process.platform === "win32" ? ["vinaya.cmd", "vinaya.exe", "vinaya.bat"] : ["vinaya"];
   const dirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
-  const onPath = dirs.some((dir) => names.some((name) => existsSync11(join13(dir, name))));
+  const onPath = dirs.some((dir) => names.some((name) => existsSync13(join14(dir, name))));
   return [
     onPath ? ok("vinaya-on-path", "`vinaya` resolves on PATH — agent-native commands will work.") : info("vinaya-on-path", "`vinaya` is not resolvable on PATH — `/vinaya <role>` and the .agents/skills/vinaya-*/SKILL.md files " + 'installed here will fail "command not found" on first use. Run `npm install -g @attalabs/vinaya`.')
   ];
@@ -6597,21 +7287,38 @@ function diagnosePrincipals(config) {
   }
   return info("principals", 'vinaya.config.json has no "principals" — review-gate and the waiver-label actor check both fall back to a ' + "hardcoded placeholder allowlist that will not include anyone on this repo. Every reviewer's verdict is " + 'silently ignored (DANGLING) until you add `"principals": ["<your-github-login>", ...]` to vinaya.config.json.');
 }
+function diagnoseProjectsCoherence(repoRoot, config) {
+  const registryAbs = join14(repoRoot, PROJECTS_REGISTRY_PATH);
+  const registryNames = existsSync13(registryAbs) ? new Set(parseRegistry(readFileSync15(registryAbs, "utf-8")).map((p) => p.name)) : new Set;
+  const configNames = new Set((config?.projects ?? []).map((p) => p.name));
+  if (registryNames.size === 0 && configNames.size === 0)
+    return [];
+  const registryOnly = [...registryNames].filter((n) => !configNames.has(n)).sort();
+  const configOnly = [...configNames].filter((n) => !registryNames.has(n)).sort();
+  const findings = [];
+  if (registryOnly.length > 0) {
+    findings.push(info("projects", `${PROJECTS_REGISTRY_PATH} declares ${registryOnly.join(", ")} with no matching vinaya.config.json "projects" entry.`));
+  }
+  if (configOnly.length > 0) {
+    findings.push(info("projects", `vinaya.config.json "projects" declares ${configOnly.join(", ")} with no matching ${PROJECTS_REGISTRY_PATH} row.`));
+  }
+  return findings;
+}
 var TEST_INVOCATION_SUBSTRINGS = ["npm test", "npm run test", "bun test", "bunx turbo test"];
 function diagnoseTestCi(repoRoot) {
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync13(join13(repoRoot, "package.json"), "utf-8"));
+    pkg = JSON.parse(readFileSync15(join14(repoRoot, "package.json"), "utf-8"));
   } catch {
     return [];
   }
   const testScript = pkg?.scripts?.test;
   if (typeof testScript !== "string" || testScript.trim() === "")
     return [];
-  const workflowsDir = join13(repoRoot, ".github/workflows");
-  const files = existsSync11(workflowsDir) ? readdirSync6(workflowsDir).filter((name) => statSync2(join13(workflowsDir, name)).isFile()) : [];
+  const workflowsDir = join14(repoRoot, ".github/workflows");
+  const files = existsSync13(workflowsDir) ? readdirSync6(workflowsDir).filter((name) => statSync2(join14(workflowsDir, name)).isFile()) : [];
   const invoked = files.some((name) => {
-    const content = readFileSync13(join13(workflowsDir, name), "utf-8");
+    const content = readFileSync15(join14(workflowsDir, name), "utf-8");
     return TEST_INVOCATION_SUBSTRINGS.some((s) => content.includes(s));
   });
   if (invoked)
@@ -6678,6 +7385,7 @@ async function runDoctor(args, deps) {
     findings.push(diagnosePrincipals(configRead.config));
     findings.push(...diagnoseVinayaOnPath(ctx.agents));
   }
+  findings.push(...diagnoseProjectsCoherence(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseBlastRadiusDeprecation(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseBriefSchemaDrift(configRead.kind === "ok" ? configRead.config : null));
   findings.push(...diagnoseEnvDeclarations(repo.repoRoot, configRead.kind === "ok" ? configRead.config : null));
@@ -6697,13 +7405,13 @@ async function runDoctor(args, deps) {
   return healthy ? 0 : 1;
 }
 async function doctorCommand(args) {
-  process.exit(await runDoctor(args, realDeps3()));
+  process.exit(await runDoctor(args, realDeps4()));
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "node:fs";
-import { join as join14 } from "node:path";
-function realDeps4() {
+import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
+import { join as join15 } from "node:path";
+function realDeps5() {
   return {
     detectRepo: detectGitRepo,
     readHooksPath: readCoreHooksPath,
@@ -6719,12 +7427,12 @@ function parse(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
 function readManifest(repoRoot) {
-  const p = join14(repoRoot, CONFIG_PATH);
-  if (!existsSync12(p))
+  const p = join15(repoRoot, CONFIG_PATH);
+  if (!existsSync14(p))
     return { kind: "none" };
   let raw;
   try {
-    raw = JSON.parse(readFileSync14(p, "utf-8"));
+    raw = JSON.parse(readFileSync16(p, "utf-8"));
   } catch (err) {
     return { kind: "orphan", reason: `vinaya.config.json is not valid JSON: ${err.message}` };
   }
@@ -6809,112 +7517,14 @@ Vinaya ejected.
   return 0;
 }
 async function ejectCommand(args) {
-  const code = await runEject(args, realDeps4());
+  const code = await runEject(args, realDeps5());
   process.exit(code);
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join16 } from "node:path";
-
-// src/lib/registry-write.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname6, join as join15 } from "node:path";
-var PROJECTS_REGISTRY_PATH = ".vinaya/projects.md";
-function rowLine(name, path, specsPath) {
-  return `| ${name} | \`${path}\` | \`${specsPath}\` | (state tracked globally) |`;
-}
-function freshProjectsRegistry(name, path, specsPath) {
-  return `---
-sidebar_title: Projects
----
-# Projects in this repo
-
-**The project registry.** Declares the projects in this repo and where each
-one's specs and per-project state live. The \`Project\` field on a task (a
-forge Issue) resolves against this file.
-
-**Presence of this file means this is a multi-project repo** — the
-\`Project\` field is required on task Issues/PRs that touch a registered
-project's path. A project is a \`(name, path)\` pair you declared — nothing
-is derived from the folder tree.
-
-## Registry
-
-| Project | Path | Specs | Per-project state |
-|---------|------|-------|---------------------|
-${rowLine(name, path, specsPath)}
-`;
-}
-var REGISTRY_HEADING_RE = /^##\s+Registry\b/i;
-function appendRegistryRow(content, name, path, specsPath) {
-  const lines = content.split(/\r?\n/);
-  const headingIdx = lines.findIndex((l) => REGISTRY_HEADING_RE.test(l));
-  const newRow = rowLine(name, path, specsPath);
-  if (headingIdx === -1) {
-    const sep4 = content.endsWith(`
-`) ? "" : `
-`;
-    return `${content}${sep4}
-## Registry
-
-| Project | Path | Specs | Per-project state |
-|---------|------|-------|---------------------|
-${newRow}
-`;
-  }
-  let i = headingIdx + 1;
-  for (;i < lines.length; i++) {
-    if ((lines[i] ?? "").trim().startsWith("|"))
-      break;
-  }
-  if (i >= lines.length) {
-    lines.splice(headingIdx + 1, 0, "", "| Project | Path | Specs | Per-project state |", "|---------|------|-------|---------------------|", newRow);
-    return lines.join(`
-`);
-  }
-  let last = i + 1;
-  for (let j = i + 2;j < lines.length; j++) {
-    if (!(lines[j] ?? "").trim().startsWith("|"))
-      break;
-    last = j;
-  }
-  lines.splice(last + 1, 0, newRow);
-  return lines.join(`
-`);
-}
-function planRegistryRow(repoRoot, name, path, specsPath) {
-  const abs2 = join15(repoRoot, PROJECTS_REGISTRY_PATH);
-  const line = rowLine(name, path, specsPath);
-  if (!existsSync13(abs2)) {
-    return { action: "create-host", rowLine: line, path: PROJECTS_REGISTRY_PATH };
-  }
-  const existing = readFileSync15(abs2, "utf-8");
-  const already = parseRegistry(existing).some((p) => p.name === name);
-  return { action: already ? "skip-present" : "append-row", rowLine: line, path: PROJECTS_REGISTRY_PATH };
-}
-function applyRegistryRow(repoRoot, plan, name, path, specsPath) {
-  const abs2 = join15(repoRoot, PROJECTS_REGISTRY_PATH);
-  if (plan.action === "create-host") {
-    mkdirSync3(dirname6(abs2), { recursive: true });
-    writeFileSync4(abs2, freshProjectsRegistry(name, path, specsPath), "utf-8");
-  } else if (plan.action === "append-row") {
-    const existing = readFileSync15(abs2, "utf-8");
-    writeFileSync4(abs2, appendRegistryRow(existing, name, path, specsPath), "utf-8");
-  }
-}
-function renderRegistryRowDiffLine(plan) {
-  if (plan.action === "skip-present")
-    return `  = keep   ${plan.path} (project already registered)`;
-  if (plan.action === "append-row")
-    return `  ~ append row to ${plan.path}
-    ${plan.rowLine}`;
-  return `  + create ${plan.path} (with registry row)
-    ${plan.rowLine}`;
-}
-
-// src/commands/init.ts
-function realDeps5() {
+function realDeps6() {
   return {
     detectRepo: detectGitRepo,
     checkGhAuth,
@@ -6954,17 +7564,17 @@ function parseAgentsFlag(args) {
 var PRODUCT_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function readManifest2(repoRoot) {
   const p = join16(repoRoot, CONFIG_PATH);
-  if (!existsSync14(p))
+  if (!existsSync15(p))
     return null;
   try {
-    return VinayaConfigSchema.parse(JSON.parse(readFileSync16(p, "utf-8"))).managed ?? null;
+    return VinayaConfigSchema.parse(JSON.parse(readFileSync17(p, "utf-8"))).managed ?? null;
   } catch {
     return null;
   }
 }
 function writeManifest(repoRoot, manifest) {
   const configAbs = join16(repoRoot, CONFIG_PATH);
-  const seed = JSON.parse(readFileSync16(configAbs, "utf-8"));
+  const seed = JSON.parse(readFileSync17(configAbs, "utf-8"));
   writeFileSync5(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
 `, "utf-8");
 }
@@ -7072,6 +7682,7 @@ async function runInitProduct(args, deps) {
     return 1;
   }
   const registryPlan = planRegistryRow(repo.repoRoot, name, productPath, specsPath);
+  const configPlan = planConfigProjectEntry(repo.repoRoot, { name, path: productPath });
   process.stdout.write(`vinaya init product ${name} — the full diff:
 
 `);
@@ -7079,6 +7690,11 @@ async function runInitProduct(args, deps) {
 `);
   process.stdout.write(`${renderRegistryRowDiffLine(registryPlan)}
 
+`);
+  process.stdout.write(`── Config ────────────────────────────────────────
+`);
+  process.stdout.write(`${renderConfigProjectEntryDiffLine(configPlan)}
+
 `);
   if (dryRun) {
     process.stdout.write(`--dry-run: nothing was written.
@@ -7094,25 +7710,26 @@ async function runInitProduct(args, deps) {
     }
   }
   applyRegistryRow(repo.repoRoot, registryPlan, name, productPath, specsPath);
+  applyConfigProjectEntry(repo.repoRoot, configPlan);
   process.stdout.write(`
 Governed product area '${name}' scaffolded.
 `);
   return 0;
 }
 async function initCommand(args) {
-  process.exit(await runInit(args, realDeps5()));
+  process.exit(await runInit(args, realDeps6()));
 }
 async function initProductCommand(args) {
-  process.exit(await runInitProduct(args, realDeps5()));
+  process.exit(await runInitProduct(args, realDeps6()));
 }
 
 // src/commands/issue.ts
-import { execFileSync as execFileSync10 } from "node:child_process";
+import { execFileSync as execFileSync11 } from "node:child_process";
 
 // src/lib/forge-write.ts
-import { execFileSync as execFileSync9 } from "node:child_process";
-import { existsSync as existsSync15, mkdtempSync, readdirSync as readdirSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { readFileSync as readFileSync17 } from "node:fs";
+import { execFileSync as execFileSync10 } from "node:child_process";
+import { existsSync as existsSync16, mkdtempSync, readdirSync as readdirSync7, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join17 } from "node:path";
 class ForgeArgError extends Error {
@@ -7124,13 +7741,13 @@ function locateBody(args) {
       const p = args[i + 1];
       if (!p)
         throw new ForgeArgError("`--body-file` was given with no path.");
-      return { body: readFileSync17(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
+      return { body: readFileSync18(p, "utf8"), source: { kind: "file", argIndex: i + 1, inlineForm: false } };
     }
     if (a.startsWith("--body-file=")) {
       const p = a.slice("--body-file=".length);
       if (!p)
         throw new ForgeArgError("`--body-file=` was given with no path.");
-      return { body: readFileSync17(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
+      return { body: readFileSync18(p, "utf8"), source: { kind: "file", argIndex: i, inlineForm: true } };
     }
     if (a === "--body" || a === "-b") {
       const v = args[i + 1];
@@ -7204,7 +7821,7 @@ function ensureTrancheLabelExists(slug) {
   const name = trancheLabel(slug);
   let existing;
   try {
-    const out = execFileSync9("gh", ["label", "list", "--json", "name", "--limit", "200"], {
+    const out = execFileSync10("gh", ["label", "list", "--json", "name", "--limit", "200"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7217,7 +7834,7 @@ function ensureTrancheLabelExists(slug) {
   if (existing.some((l) => l.name === name))
     return;
   try {
-    execFileSync9("gh", ["label", "create", name, "--color", TRANCHE_LABEL_COLOR, "--description", `Tranche: ${slug}`], {
+    execFileSync10("gh", ["label", "create", name, "--color", TRANCHE_LABEL_COLOR, "--description", `Tranche: ${slug}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7227,6 +7844,24 @@ function ensureTrancheLabelExists(slug) {
     ]);
   }
 }
+function resolveMilestoneAttachArgs(ghArgs, labels) {
+  if (!isTaskIssueLabelSet(labels))
+    return ghArgs;
+  if (hasExplicitMilestoneFlag(ghArgs))
+    return ghArgs;
+  const slug = findTrancheSlug(labels);
+  if (!slug)
+    return ghArgs;
+  let target;
+  try {
+    target = findMilestoneAttachTargetForSlug("{owner}", "{repo}", slug);
+  } catch {
+    process.stderr.write(`vinaya: milestone lookup for '${slug}' failed (\`gh api\`) — creating without --milestone.
+`);
+    return ghArgs;
+  }
+  return target ? [...ghArgs, "--milestone", target.title] : ghArgs;
+}
 function resolveSections(kind, retryCommand) {
   const result = loadConfigChecked();
   if (!result.ok) {
@@ -7351,7 +7986,7 @@ function validateForgeWrite(input) {
 }
 function git2(args) {
   try {
-    return execFileSync9("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync10("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -7362,7 +7997,7 @@ function repoRoot() {
 function readWorkspaceGlobs(root) {
   const fromPackageJson = () => {
     try {
-      const pkg = JSON.parse(readFileSync17(join17(root, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync18(join17(root, "package.json"), "utf8"));
       return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
     } catch {
       return [];
@@ -7370,7 +8005,7 @@ function readWorkspaceGlobs(root) {
   };
   const fromPnpmWorkspaceYaml = () => {
     try {
-      return parsePnpmWorkspaceYaml(readFileSync17(join17(root, "pnpm-workspace.yaml"), "utf8"));
+      return parsePnpmWorkspaceYaml(readFileSync18(join17(root, "pnpm-workspace.yaml"), "utf8"));
     } catch {
       return [];
     }
@@ -7386,7 +8021,7 @@ function listWorkspaceChildDirs(dir, root) {
 }
 function readConfigExtraDomains(root) {
   try {
-    const parsed = VinayaConfigSchema.safeParse(JSON.parse(readFileSync17(join17(root, "vinaya.config.json"), "utf8")));
+    const parsed = VinayaConfigSchema.safeParse(JSON.parse(readFileSync18(join17(root, "vinaya.config.json"), "utf8")));
     return parsed.success ? parsed.data.blastRadius?.extraDomains ?? [] : [];
   } catch {
     return [];
@@ -7396,7 +8031,7 @@ function readSharedPackages(root = repoRoot()) {
   if (!root)
     return [];
   const derived = deriveWorkspacePackageDomains(readWorkspaceGlobs(root), (dir) => listWorkspaceChildDirs(dir, root));
-  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync15(join17(root, p)));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync16(join17(root, p)));
   const configExtra = readConfigExtraDomains(root);
   return [...new Set([...derived, ...defaults, ...configExtra])];
 }
@@ -7404,7 +8039,7 @@ function readProjectPaths(root = repoRoot()) {
   if (!root)
     return [];
   try {
-    return parseRegistry(readFileSync17(join17(root, ".vinaya/projects.md"), "utf8"));
+    return parseRegistry(readFileSync18(join17(root, ".vinaya/projects.md"), "utf8"));
   } catch {
     return [];
   }
@@ -7446,7 +8081,7 @@ function locateBodyOrRefuse(ghArgs, retryCommand) {
 function fetchForgeLabels(issueRef) {
   let out;
   try {
-    out = execFileSync10("gh", ["issue", "view", issueRef, "--json", "labels"], {
+    out = execFileSync11("gh", ["issue", "view", issueRef, "--json", "labels"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7474,7 +8109,7 @@ function reportPass(json, command) {
 function runGhWrite(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync10("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync11("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -7529,7 +8164,7 @@ function issueCreateCommand(args) {
   const slugToEnsure = findTrancheSlug(labels);
   if (slugToEnsure)
     ensureTrancheLabelExists(slugToEnsure);
-  runGhWrite(["issue", "create"], ghArgs, bodyResult, json);
+  runGhWrite(["issue", "create"], resolveMilestoneAttachArgs(ghArgs, labels), bodyResult, json);
 }
 function issueEditCommand(args) {
   const json = args.includes("--json");
@@ -7560,12 +8195,13 @@ function issueEditCommand(args) {
 }
 
 // src/commands/milestone.ts
-import { execFileSync as execFileSync11 } from "node:child_process";
+import { execFileSync as execFileSync12 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya milestone create --title <title> --body-file <path>";
 var RETRY_ADOPT = "vinaya milestone adopt --target <title> --slug <slug> [--slug <slug> ...]";
 var RETRY_EDIT2 = "vinaya milestone edit <n> --body-file <path>";
+var RETRY_CLOSE = "vinaya milestone close --slug <slug>";
 function sh3(args, input) {
-  return execFileSync11(args[0], args.slice(1), {
+  return execFileSync12(args[0], args.slice(1), {
     encoding: "utf8",
     input,
     env: process.env,
@@ -7723,18 +8359,18 @@ function extractSlugs(args) {
   }
   return slugs;
 }
-function ghJsonOrRefuse(args, what) {
+function ghJsonOrRefuse(args, what, retryCommand) {
   try {
     return shJson2(args);
   } catch (e) {
     refuse([
-      makeCheckError("forge-fetch", `could not fetch ${what} from the forge: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_ADOPT}\`.`)
+      makeCheckError("forge-fetch", `could not fetch ${what} from the forge: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${retryCommand}\`.`)
     ]);
   }
 }
 function fetchAdoptFacts(repoFlag, target, slugs) {
-  const labels = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/labels?per_page=100`], "this repo's labels");
-  const milestones = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/milestones?state=all&per_page=100`], "this repo's Milestones");
+  const labels = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/labels?per_page=100`], "this repo's labels", RETRY_ADOPT);
+  const milestones = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/milestones?state=all&per_page=100`], "this repo's Milestones", RETRY_ADOPT);
   const targetMilestone = milestones.find((m) => m.title === target);
   const targetFacts = {
     title: target,
@@ -7757,7 +8393,7 @@ function fetchAdoptFacts(repoFlag, target, slugs) {
       "number,state,milestone",
       "--limit",
       "200"
-    ], `Issues for \`${trancheLabel(slug)}\``) : [];
+    ], `Issues for \`${trancheLabel(slug)}\``, RETRY_ADOPT) : [];
     const elsewhere = new Set;
     for (const issue of issues) {
       const title = issue.milestone?.title;
@@ -7818,41 +8454,134 @@ async function milestoneAdoptCommand(args) {
         failMidWrite(`failed to attach Issue #${issueNumber} (tranche \`${slugFact.slug}\`) to Milestone "${target}": ` + `${ghErrorDetail(e)}. Slugs already adopted this run: ${adopted.map((a) => a.slug).join(", ") || "(none)"}.`);
       }
     }
-    const legacy = milestones.find((m) => m.title === slugFact.slug && m.title !== target);
-    let closedMilestone = null;
-    if (legacy) {
-      closedMilestone = legacy.number;
-      if (legacy.state !== "closed") {
-        try {
-          sh3(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${legacy.number}`, "-f", "state=closed"]);
-        } catch (e) {
-          failMidWrite(`attached tranche \`${slugFact.slug}\`'s Issue(s) to Milestone "${target}", but failed to close its old ` + `Milestone #${legacy.number}: ${ghErrorDetail(e)}. Slugs already adopted this run: ` + `${adopted.map((a) => a.slug).join(", ") || "(none)"}.`);
-        }
-      }
+    const legacy = milestones.find((m) => m.title === slugFact.slug && m.title !== target);
+    let closedMilestone = null;
+    if (legacy) {
+      closedMilestone = legacy.number;
+      if (legacy.state !== "closed") {
+        try {
+          sh3(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${legacy.number}`, "-f", "state=closed"]);
+        } catch (e) {
+          failMidWrite(`attached tranche \`${slugFact.slug}\`'s Issue(s) to Milestone "${target}", but failed to close its old ` + `Milestone #${legacy.number}: ${ghErrorDetail(e)}. Slugs already adopted this run: ` + `${adopted.map((a) => a.slug).join(", ") || "(none)"}.`);
+        }
+      }
+    }
+    adopted.push({ slug: slugFact.slug, issueCount: slugFact.issueNumbers.length, closedMilestone });
+  }
+  if (json)
+    printJson({ validated: true, written: true, target, adopted });
+  else {
+    for (const a of adopted) {
+      const closedNote = a.closedMilestone ? ` (old Milestone #${a.closedMilestone} closed)` : "";
+      process.stdout.write(`${a.slug}: ${a.issueCount} Issue(s) → "${target}"${closedNote}
+`);
+    }
+  }
+}
+function extractSlug(args) {
+  for (let i = 0;i < args.length; i++) {
+    const a = args[i];
+    if (a === "--slug")
+      return args[i + 1] ?? null;
+    if (a.startsWith("--slug="))
+      return a.slice("--slug=".length);
+  }
+  return null;
+}
+async function milestoneCloseCommand(args) {
+  const json = args.includes("--json");
+  const validateOnly = args.includes("--validate-only");
+  const rest = args.filter((a) => a !== "--json" && a !== "--validate-only");
+  const slug = extractSlug(rest);
+  if (!slug) {
+    refuse([
+      makeCheckError("forge-args", "`vinaya milestone close` requires a `--slug <slug>` — the tranche whose Milestone is being closed.", `Add \`--slug <slug>\`, then re-run \`${RETRY_CLOSE}\`.`)
+    ]);
+  }
+  const repoFlag = await resolveRepoFlagOrRefuse(RETRY_CLOSE);
+  const milestones = ghJsonOrRefuse(["gh", "api", `repos/${repoFlag}/milestones?state=all&per_page=100`], "this repo's Milestones", RETRY_CLOSE);
+  const target = resolveMilestoneAttachTarget(milestones, slug);
+  if (!target) {
+    refuse([
+      makeCheckError("milestone-close", `No OPEN Milestone resolves for tranche \`${slug}\` — it may already be closed, or never had one attached.`, `Confirm with \`gh issue list --label ${trancheLabel(slug)} --json milestone\`, or run \`vinaya milestone ` + `create\`/\`${RETRY_ADOPT}\` if a Milestone is genuinely still owed, then re-run \`${RETRY_CLOSE}\`.`)
+    ]);
+  }
+  const labeledIssues = ghJsonOrRefuse([
+    "gh",
+    "issue",
+    "list",
+    "-R",
+    repoFlag,
+    "--label",
+    trancheLabel(slug),
+    "--state",
+    "all",
+    "--json",
+    "number,state,milestone",
+    "--limit",
+    "200"
+  ], `Issues for \`${trancheLabel(slug)}\``, RETRY_CLOSE);
+  const attachedIssues = ghJsonOrRefuse([
+    "gh",
+    "issue",
+    "list",
+    "-R",
+    repoFlag,
+    "--milestone",
+    target.title,
+    "--state",
+    "all",
+    "--json",
+    "number,state,milestone",
+    "--limit",
+    "200"
+  ], `Issues attached to Milestone "${target.title}"`, RETRY_CLOSE);
+  const report = checkMilestoneAttachment(labeledIssues.map((i) => i.number), attachedIssues.map((i) => i.number));
+  if (report.status === "mismatch") {
+    const errors = [];
+    if (report.unattached.length > 0) {
+      errors.push(makeCheckError("milestone-close", `Issue(s) ${report.unattached.map((n) => `#${n}`).join(", ")} carry \`${trancheLabel(slug)}\` but ` + `are not attached to Milestone "${target.title}".`, `Attach each with \`gh issue edit <n> --milestone "${target.title}"\`, then re-run \`${RETRY_CLOSE}\`.`));
+    }
+    if (report.foreign.length > 0) {
+      errors.push(makeCheckError("milestone-close", `Issue(s) ${report.foreign.map((n) => `#${n}`).join(", ")} are attached to Milestone "${target.title}" ` + `but do not carry \`${trancheLabel(slug)}\` — closing would end tracking for whatever they belong to as well.`, `Move them with \`${RETRY_ADOPT}\` if they belong to a different tranche, or \`gh issue edit <n> ` + `--milestone <title>\` to relocate them, then re-run \`${RETRY_CLOSE}\`.`));
     }
-    adopted.push({ slug: slugFact.slug, issueCount: slugFact.issueNumbers.length, closedMilestone });
+    refuse(errors);
   }
-  if (json)
-    printJson({ validated: true, written: true, target, adopted });
-  else {
-    for (const a of adopted) {
-      const closedNote = a.closedMilestone ? ` (old Milestone #${a.closedMilestone} closed)` : "";
-      process.stdout.write(`${a.slug}: ${a.issueCount} Issue(s) → "${target}"${closedNote}
+  if (validateOnly) {
+    if (json)
+      printJson({ validated: true, written: false, command: "milestone close", number: target.number });
+    else {
+      process.stdout.write(`✓ Milestone "${target.title}" (#${target.number}) attachment verified — nothing written (--validate-only).
 `);
     }
+    return;
+  }
+  let out;
+  try {
+    out = sh3(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${target.number}`, "-f", "state=closed"]);
+  } catch (e) {
+    refuse([
+      makeCheckError("forge-fetch", `\`gh api repos/${repoFlag}/milestones/${target.number}\` failed: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_CLOSE}\`.`)
+    ]);
   }
+  const closed = JSON.parse(out);
+  if (json)
+    printJson({ validated: true, written: true, number: closed.number, url: closed.html_url });
+  else
+    process.stdout.write(`${closed.html_url}
+`);
 }
 
 // src/commands/new-check.ts
-import { chmodSync as chmodSync2, existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync17, mkdirSync as mkdirSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join18 } from "node:path";
 var TEMPLATE_PATH = join18(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
 var CHECKS_DIR = join18("scripts", "vinaya-checks");
-var USAGE = "Usage: vinaya new check <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. myteam/vocab-check)";
+var USAGE2 = "Usage: vinaya new check <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. myteam/vocab-check)";
 function newCheckCommand(args) {
   const name = args[0];
   if (!name) {
-    console.error(USAGE);
+    console.error(USAGE2);
     process.exit(2);
   }
   if (coreCheckRegistry().some((spec) => spec.name === name)) {
@@ -7860,20 +8589,20 @@ function newCheckCommand(args) {
     process.exit(2);
   }
   if (!isValidNamespacedKey(name)) {
-    console.error(`Refusing: "${name}" is not a valid check id. ${USAGE.slice("Usage: ".length)}
+    console.error(`Refusing: "${name}" is not a valid check id. ${USAGE2.slice("Usage: ".length)}
 \`vinaya check\` refuses the entire run over a key it cannot resolve, so a bare, un-namespaced name would brick every check invocation in this repo.`);
     process.exit(2);
   }
   const scriptsDir = join18(process.cwd(), CHECKS_DIR);
-  if (!existsSync16(scriptsDir))
+  if (!existsSync17(scriptsDir))
     mkdirSync4(scriptsDir, { recursive: true });
   const fileStem = name.slice(name.indexOf("/") + 1);
   const targetPath = join18(scriptsDir, `${fileStem}.ts`);
-  if (existsSync16(targetPath)) {
+  if (existsSync17(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync18(TEMPLATE_PATH, "utf-8");
+  const template = readFileSync19(TEMPLATE_PATH, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
   writeFileSync7(targetPath, contents, "utf-8");
   chmodSync2(targetPath, 493);
@@ -7887,32 +8616,32 @@ ${registration}
 }
 
 // src/commands/new-noop-check.ts
-import { chmodSync as chmodSync3, existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync19, writeFileSync as writeFileSync8 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync20, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join19 } from "node:path";
 var TEMPLATE_PATH2 = join19(packageRoot(import.meta.url), "templates", "noop-check.template.ts");
 var CHECKS_DIR2 = join19("vinaya", "checks");
-var USAGE2 = "Usage: vinaya new noop-check <core-check-id>  (the exact id of a core check — run `vinaya check --plan` to list them)";
+var USAGE3 = "Usage: vinaya new noop-check <core-check-id>  (the exact id of a core check — run `vinaya check --plan` to list them)";
 function newNoopCheckCommand(args) {
   const name = args[0];
   if (!name) {
-    console.error(USAGE2);
+    console.error(USAGE3);
     process.exit(2);
   }
   const coreSpec = coreCheckRegistry().find((spec) => spec.name === name);
   if (!coreSpec) {
-    console.error(`Refusing: "${name}" is not a core check id. ${USAGE2}
+    console.error(`Refusing: "${name}" is not a core check id. ${USAGE3}
 \`new noop-check\` only silences a CORE check — a \`checks\` key that exactly matches a core check id REPLACES it. A namespaced or unknown name has nothing to replace; use \`vinaya new check\` to scaffold a new, additive check instead.`);
     process.exit(2);
   }
   const checksDir = join19(process.cwd(), CHECKS_DIR2);
-  if (!existsSync17(checksDir))
+  if (!existsSync18(checksDir))
     mkdirSync5(checksDir, { recursive: true });
   const targetPath = join19(checksDir, `${name}.ts`);
-  if (existsSync17(targetPath)) {
+  if (existsSync18(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync19(TEMPLATE_PATH2, "utf-8");
+  const template = readFileSync20(TEMPLATE_PATH2, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
   writeFileSync8(targetPath, contents, "utf-8");
   chmodSync3(targetPath, 493);
@@ -7934,32 +8663,32 @@ ${registration}
 }
 
 // src/commands/new-role.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync21, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join20 } from "node:path";
 var TEMPLATE_PATH3 = join20(packageRoot(import.meta.url), "templates", "role.template.md");
 var ROLES_DIR = join20("vinaya", "roles");
-var USAGE3 = "Usage: vinaya new role <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. acme/qa-lead)";
+var USAGE4 = "Usage: vinaya new role <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. acme/qa-lead)";
 function newRoleCommand(args) {
   const name = args[0];
   if (!name) {
-    console.error(USAGE3);
+    console.error(USAGE4);
     process.exit(2);
   }
   if (!isValidNamespacedKey(name)) {
-    console.error(`Refusing: "${name}" is not a valid role key. ${USAGE3.slice("Usage: ".length)}
+    console.error(`Refusing: "${name}" is not a valid role key. ${USAGE4.slice("Usage: ".length)}
 A bare, un-namespaced key resolves as an OVERRIDE of a core role — a complete replacement of that role's contract, and a real governance decision this scaffolder does not make for you. Pick a namespaced name, or write the override entry by hand if you really mean to replace a core role's contract.`);
     process.exit(2);
   }
   const rolesDir = join20(process.cwd(), ROLES_DIR);
-  if (!existsSync18(rolesDir))
+  if (!existsSync19(rolesDir))
     mkdirSync6(rolesDir, { recursive: true });
   const roleId = name.slice(name.indexOf("/") + 1);
   const targetPath = join20(rolesDir, `${roleId}.md`);
-  if (existsSync18(targetPath)) {
+  if (existsSync19(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
-  const template = readFileSync20(TEMPLATE_PATH3, "utf-8");
+  const template = readFileSync21(TEMPLATE_PATH3, "utf-8");
   const contents = template.split("{{ROLE_ID}}").join(roleId);
   writeFileSync9(targetPath, contents, "utf-8");
   const relPath = join20(ROLES_DIR, `${roleId}.md`);
@@ -7972,7 +8701,7 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync12 } from "node:child_process";
+import { execFileSync as execFileSync13 } from "node:child_process";
 
 // src/lib/numstat.ts
 function summariseNumstat(numstat) {
@@ -8033,6 +8762,16 @@ class ScanContext {
     return rawHasPair === (anchoredRegionBounds(this.masked, field) !== null);
   }
 }
+function resolveAnchoredRegion(ctx, field) {
+  const bounds = anchoredRegionBounds(ctx.masked, field);
+  if (bounds === null) {
+    return anchoredRegionBounds(ctx.normalised, field) !== null ? "hidden" : null;
+  }
+  return {
+    region: ctx.normalised.slice(bounds.innerStart, bounds.innerEnd),
+    maskedRegion: ctx.masked.slice(bounds.innerStart, bounds.innerEnd)
+  };
+}
 
 // src/checks/body-bare-digits-logic.ts
 function blankRange(text, start, end) {
@@ -8254,7 +8993,7 @@ var RETRY_CREATE3 = "vinaya pr create --validate-only …";
 var RETRY_EDIT3 = "vinaya pr edit <n> --validate-only …";
 function git3(args) {
   try {
-    return execFileSync12("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -8288,7 +9027,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync12("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync13("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -8302,7 +9041,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync12("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync13("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -8413,14 +9152,14 @@ function prEditCommand(args) {
 }
 
 // src/commands/pr-report.ts
-import { execFileSync as execFileSync13, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "node:fs";
+import { execFileSync as execFileSync14, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync20, readFileSync as readFileSync22, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join21 } from "node:path";
 var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
 function git4(args) {
   try {
-    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync14("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -8438,7 +9177,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync13("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync14("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -8474,7 +9213,7 @@ function computeGroupA() {
 function resolveSelfEntry() {
   const root = packageRoot(import.meta.url);
   const dist = join21(root, "dist", "index.js");
-  return existsSync19(dist) ? dist : join21(root, "src", "index.ts");
+  return existsSync20(dist) ? dist : join21(root, "src", "index.ts");
 }
 var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
 function anyGateFailed(outcomes) {
@@ -8567,6 +9306,84 @@ ${EVIDENCE_END}`;
 ${full}
 `;
 }
+var TOKENS_START = "<!-- AEG:TOKENS:START -->";
+var TOKENS_END = "<!-- AEG:TOKENS:END -->";
+var TOKEN_REPORT_HEADING = /^#{1,6}\s*token report\s*$/i;
+var HEADING_LINE = /^#{1,6}\s/;
+var TOKEN_TABLE_HEADER = "| Phase | Role | Agent/Model | Tokens in | Tokens out | Cost | Date |";
+var TOKEN_TABLE_SEPARATOR = "|---|---|---|---|---|---|---|";
+function tokensBlockLineBounds(maskedLines) {
+  const startIdx = maskedLines.findIndex((l) => l.trim() === TOKENS_START);
+  if (startIdx === -1)
+    return null;
+  for (let i = startIdx + 1;i < maskedLines.length; i++) {
+    if (maskedLines[i].trim() === TOKENS_END)
+      return { startIdx, endIdx: i };
+  }
+  return null;
+}
+function writeTokensBlock(body, addition) {
+  const rawLines = body.split(`
+`);
+  const maskedLines = maskCode(body).split(`
+`);
+  const additionLines = addition.split(`
+`);
+  const existing = tokensBlockLineBounds(maskedLines);
+  if (existing) {
+    const before = rawLines.slice(0, existing.endIdx);
+    const after = rawLines.slice(existing.endIdx);
+    return [...before, ...additionLines, ...after].join(`
+`);
+  }
+  const freshBlock = [TOKENS_START, TOKEN_TABLE_HEADER, TOKEN_TABLE_SEPARATOR, ...additionLines, TOKENS_END];
+  const headingIdx = rawLines.findIndex((l) => TOKEN_REPORT_HEADING.test(l));
+  if (headingIdx !== -1) {
+    let sectionEnd = rawLines.length;
+    for (let i = headingIdx + 1;i < rawLines.length; i++) {
+      if (HEADING_LINE.test(rawLines[i])) {
+        sectionEnd = i;
+        break;
+      }
+    }
+    const before = rawLines.slice(0, headingIdx + 1);
+    const after = rawLines.slice(sectionEnd);
+    return [...before, "", ...freshBlock, "", ...after].join(`
+`);
+  }
+  const sep4 = body.length === 0 || body.endsWith(`
+`) ? [] : [""];
+  return [...rawLines, ...sep4, "", "## Token report", "", ...freshBlock, ""].join(`
+`);
+}
+function derivePhase() {
+  const branch = git4(["rev-parse", "--abbrev-ref", "HEAD"]);
+  const m = /^task\/[^/]+\/(.+)$/.exec(branch);
+  const taskId = m ? m[1] : branch || "unknown";
+  return `${taskId}: develop`;
+}
+function isoToday() {
+  return new Date().toISOString().slice(0, 10);
+}
+function collectTokensAddition(opts) {
+  const capability = resolveMeteringCapability(realDeps(), opts.transcriptPath);
+  if (!capability.capable) {
+    return formatTokenReportRow({
+      phase: opts.phase,
+      role: opts.role,
+      summary: null,
+      modelOverride: `— (${capability.reason})`,
+      date: opts.date
+    });
+  }
+  return formatTokenReportRow({
+    phase: opts.phase,
+    role: opts.role,
+    summary: capability.summary,
+    modelOverride: opts.modelOverride,
+    date: opts.date
+  });
+}
 async function buildReport(opts = {}) {
   const groupA = opts.groupA ?? computeGroupA();
   const gateRunner = opts.gateRunner ?? runRealGates;
@@ -8580,8 +9397,16 @@ ${EVIDENCE_END}`;
 async function prReportCommand(args) {
   const writeIdx = args.indexOf("--write");
   const writePath = writeIdx !== -1 ? args[writeIdx + 1] : undefined;
+  const transcriptIdx = args.indexOf("--transcript");
+  const transcriptPath = transcriptIdx !== -1 ? args[transcriptIdx + 1] : undefined;
+  const phaseIdx = args.indexOf("--phase");
+  const phaseOverride = phaseIdx !== -1 ? args[phaseIdx + 1] : undefined;
+  const roleIdx = args.indexOf("--role");
+  const roleOverride = roleIdx !== -1 ? args[roleIdx + 1] : undefined;
+  const modelIdx = args.indexOf("--model");
+  const modelOverride = modelIdx !== -1 ? args[modelIdx + 1] : undefined;
   if (writeIdx !== -1 && !writePath) {
-    console.error("Usage: vinaya pr report [--write <body-file>]");
+    console.error("Usage: vinaya pr report [--write <body-file>] [--phase <phase>] [--role <role>] " + "[--model <id>] [--transcript <path>]");
     process.exit(2);
   }
   let result;
@@ -8595,10 +9420,18 @@ async function prReportCommand(args) {
     throw err;
   }
   if (writePath) {
-    const existing = existsSync19(writePath) ? readFileSync21(writePath, "utf8") : "";
-    const updated = replaceEvidenceBlock(existing, result.blockInner);
+    const existing = existsSync20(writePath) ? readFileSync22(writePath, "utf8") : "";
+    const withEvidence = replaceEvidenceBlock(existing, result.blockInner);
+    const tokensAddition = collectTokensAddition({
+      phase: phaseOverride ?? derivePhase(),
+      role: roleOverride ?? "Developer",
+      date: isoToday(),
+      transcriptPath,
+      modelOverride
+    });
+    const updated = writeTokensBlock(withEvidence, tokensAddition);
     writeFileSync10(writePath, updated);
-    process.stdout.write(`Wrote AEG:EVIDENCE block to ${writePath}
+    process.stdout.write(`Wrote AEG:EVIDENCE and AEG:TOKENS blocks to ${writePath}
 `);
   } else {
     process.stdout.write(`${result.block}
@@ -8607,13 +9440,187 @@ async function prReportCommand(args) {
   process.exit(result.gatesFailed ? 1 : 0);
 }
 
+// src/commands/pr-verify-evidence.ts
+import { execFileSync as execFileSync15 } from "node:child_process";
+
+// src/commands/pr-verify-evidence-logic.ts
+function publishedMergeBase(region) {
+  const m = region.match(/^[ \t]*`git diff ([0-9a-f]{7,40})\.\.\.[0-9a-f]{7,40} --numstat`[ \t]*$/m);
+  return m ? m[1] : null;
+}
+function normaliseLines(region, repoRoot2) {
+  const root = repoRoot2.replace(/\/+$/, "");
+  const out = [];
+  for (const raw of region.split(`
+`)) {
+    const localStripped = root ? raw.split(`${root}/`).join("").split(root).join("") : raw;
+    const stripped = localStripped.replace(/(^|\s)\/\S*?\/(?=(?:apps|packages|aeg-root|scripts|\.changeset|\.vinaya|\.github)\/)/g, "$1");
+    const line = stripped.replace(/[\u0000-\u001F\u007F-\u009F\u2028\u2029\u202A-\u202E\u2066-\u2069]/g, " ").trim();
+    if (line)
+      out.push(line);
+  }
+  return out;
+}
+function compareEvidence(published, freshRegion, repoRoot2) {
+  if (published === null)
+    return { status: "no-block" };
+  if (published === "hidden")
+    return { status: "hidden" };
+  const publishedLines = normaliseLines(published.region, repoRoot2);
+  const freshLines = normaliseLines(freshRegion, repoRoot2);
+  const missing = subtractOnce(freshLines, publishedLines);
+  const unexpected = subtractOnce(publishedLines, freshLines);
+  if (missing.length === 0 && unexpected.length === 0)
+    return { status: "match" };
+  const publishedBase = publishedMergeBase(published.region);
+  const currentBase = publishedMergeBase(freshRegion);
+  const baseDrift = publishedBase && currentBase && publishedBase !== currentBase ? { publishedBase, currentBase } : undefined;
+  return baseDrift ? { status: "differs", missing, unexpected, baseDrift } : { status: "differs", missing, unexpected };
+}
+function subtractOnce(a, b) {
+  const counts = new Map;
+  for (const line of b)
+    counts.set(line, (counts.get(line) ?? 0) + 1);
+  const out = [];
+  for (const line of a) {
+    const n = counts.get(line) ?? 0;
+    if (n > 0)
+      counts.set(line, n - 1);
+    else
+      out.push(line);
+  }
+  return out;
+}
+function renderVerdict(verdict) {
+  if (verdict.status === "match") {
+    return "pr verify-evidence: MATCH — every line of the published AEG:EVIDENCE region is reproduced by a fresh run at this head, and vice versa (compared as a multiset of repo-relative, control-stripped lines: order and whitespace are not compared).";
+  }
+  if (verdict.status === "no-block") {
+    return "pr verify-evidence: NO BLOCK — this pull request body carries no AEG:EVIDENCE anchors. Run `vinaya pr report --write <body-file>` to generate one.";
+  }
+  if (verdict.status === "hidden") {
+    return [
+      "pr verify-evidence: HIDDEN — the AEG:EVIDENCE pair sits inside a collapsed `<details>` block.",
+      "`body-bare-digits` blanks every digit in there, so nothing can verify what it claims. Move the block out of `<details>` and regenerate it with `vinaya pr report --write <body-file>`."
+    ].join(`
+`);
+  }
+  const lines = ["pr verify-evidence: DIFFERS — the published AEG:EVIDENCE region does not reproduce at this head."];
+  if (verdict.baseDrift) {
+    lines.push("", `The published block also records a different merge-base (${verdict.baseDrift.publishedBase}) than the one resolving now (${verdict.baseDrift.currentBase}).`, "That explains SOME differences — the gates ran over a different diff — but it is not on its own evidence the content was honest, and the differing lines are still listed below. Rebase or regenerate, then re-run this command to compare at a shared base.");
+  } else {
+    lines.push("No merge-base difference was detected — either the base is unchanged, or one side carries no readable Group A command line to compare. Drift therefore does not account for this difference.");
+  }
+  lines.push("", "Regenerate with `vinaya pr report --write <body-file>` and push.");
+  if (verdict.missing.length > 0) {
+    lines.push("", `Present in a fresh run, absent from the published block (${verdict.missing.length}):`);
+    for (const line of verdict.missing)
+      lines.push(`  + ${line}`);
+  }
+  if (verdict.unexpected.length > 0) {
+    lines.push("", `Published but not reproducible (${verdict.unexpected.length}):`);
+    for (const line of verdict.unexpected)
+      lines.push(`  - ${line}`);
+  }
+  return lines.join(`
+`);
+}
+
+// src/commands/pr-verify-evidence.ts
+function gh(args) {
+  return execFileSync15("gh", args, { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+function assertCleanWorktree() {
+  const dirty = execFileSync15("git", ["status", "--porcelain"], {
+    encoding: "utf8",
+    cwd: repoRoot2()
+  }).trim();
+  if (!dirty)
+    return;
+  process.stderr.write(`pr verify-evidence: REFUSED — the worktree has uncommitted or untracked changes.
+` + `Group B is regenerated by diff-scoped checks, so local changes alter which files are scanned and can
+` + `produce a MATCH that a clean checkout would not. Verify from a clean checkout at this head instead.
+
+` + `${dirty}
+`);
+  process.exit(2);
+}
+function assertNoBaseOverride() {
+  const override = process.env.BASE_SHA;
+  if (!override)
+    return;
+  process.stderr.write(`pr verify-evidence: REFUSED — BASE_SHA is set (${override}).
+` + `The regeneration resolves its merge-base from that variable, so an override changes what a "fresh run"
+` + `means and can turn a drifted comparison into an apparently shared-base one. Unset it and re-run.
+`);
+  process.exit(2);
+}
+function assertRepoRootCwd() {
+  const root = repoRoot2();
+  const cwd = process.cwd();
+  if (cwd === root)
+    return;
+  process.stderr.write(`pr verify-evidence: REFUSED — run this from the repository root (${root}), not ${cwd}.
+` + `The regeneration inherits this working directory, and several gates resolve their scan root from it,
+` + `so a subdirectory silently narrows what the fresh run inspects and can report MATCH on a block that
+` + `omits real findings.
+`);
+  process.exit(2);
+}
+function repoRoot2() {
+  return execFileSync15("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+}
+async function prVerifyEvidenceCommand(args) {
+  const prRef = args[0] && !args[0].startsWith("-") ? args[0] : undefined;
+  if (!prRef) {
+    process.stderr.write(`Usage: vinaya pr verify-evidence <pr-number>
+`);
+    process.exit(2);
+  }
+  assertRepoRootCwd();
+  assertCleanWorktree();
+  assertNoBaseOverride();
+  let body;
+  let forgeHead;
+  try {
+    const view = JSON.parse(gh(["pr", "view", prRef, "--json", "body,headRefOid"]));
+    body = view.body ?? "";
+    forgeHead = view.headRefOid ?? "";
+  } catch (err) {
+    process.stderr.write(`pr verify-evidence: could not read pull request #${prRef} — ${err.message}
+`);
+    process.exit(1);
+    return;
+  }
+  const localHead = execFileSync15("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+  if (!forgeHead) {
+    process.stderr.write(`pr verify-evidence: REFUSED — could not read #${prRef}'s head from the forge, so the verdict cannot be bound to a commit.
+`);
+    process.exit(2);
+  }
+  if (forgeHead !== localHead) {
+    process.stderr.write(`pr verify-evidence: REFUSED — this checkout is at ${localHead}, but #${prRef}'s head is ${forgeHead}.
+` + `Comparing against a different tree produces a difference that is real and uninteresting. Check out the head first.
+`);
+    process.exit(2);
+  }
+  const fresh = await buildReport();
+  const resolved = resolveAnchoredRegion(ScanContext.from(body), "EVIDENCE");
+  const verdict = compareEvidence(resolved === null || resolved === "hidden" ? resolved : { region: resolved.region }, fresh.blockInner, repoRoot2());
+  process.stdout.write(`${renderVerdict(verdict)}
+`);
+  process.stdout.write(`  compared at head ${localHead}
+`);
+  process.exit(verdict.status === "match" ? 0 : 1);
+}
+
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync14 } from "node:child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync23 } from "node:fs";
+import { execFileSync as execFileSync16 } from "node:child_process";
+import { existsSync as existsSync22, readFileSync as readFileSync24 } from "node:fs";
 import { join as join23 } from "node:path";
 
 // src/lib/doc-owners-write.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync7, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync7, readFileSync as readFileSync23, writeFileSync as writeFileSync11 } from "node:fs";
 import { dirname as dirname7, join as join22 } from "node:path";
 function bindingLine(glob, pointer) {
   return `${glob}  ${pointer}`;
@@ -8629,23 +9636,23 @@ function appendDocOwnersBinding(content, glob, pointer) {
   return `${content}${sep4}${bindingLine(glob, pointer)}
 `;
 }
-function planDocOwnersBinding(repoRoot2, glob, pointer) {
-  const abs2 = join22(repoRoot2, DOC_OWNERS_PATH);
+function planDocOwnersBinding(repoRoot3, glob, pointer) {
+  const abs2 = join22(repoRoot3, DOC_OWNERS_PATH);
   const line = bindingLine(glob, pointer);
-  if (!existsSync20(abs2)) {
+  if (!existsSync21(abs2)) {
     return { action: "create-host", line, path: DOC_OWNERS_PATH };
   }
-  const existing = readFileSync22(abs2, "utf-8");
+  const existing = readFileSync23(abs2, "utf-8");
   const already = parseDocOwners(existing).bindings.some((b) => b.glob === glob);
   return { action: already ? "skip-present" : "append-row", line, path: DOC_OWNERS_PATH };
 }
-function applyDocOwnersBinding(repoRoot2, plan, glob, pointer) {
-  const abs2 = join22(repoRoot2, DOC_OWNERS_PATH);
+function applyDocOwnersBinding(repoRoot3, plan, glob, pointer) {
+  const abs2 = join22(repoRoot3, DOC_OWNERS_PATH);
   if (plan.action === "create-host") {
     mkdirSync7(dirname7(abs2), { recursive: true });
     writeFileSync11(abs2, freshDocOwners(glob, pointer), "utf-8");
   } else if (plan.action === "append-row") {
-    const existing = readFileSync22(abs2, "utf-8");
+    const existing = readFileSync23(abs2, "utf-8");
     writeFileSync11(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
   }
 }
@@ -8705,13 +9712,13 @@ var GLOB_INJECTION_RE = /[\s\r\n]/;
 var POINTER_INJECTION_RE = /[\r\n]/;
 var NAME_INJECTION_RE = /[\s|\r\n]/;
 var PATH_INJECTION_RE2 = /[|\r\n]/;
-function pointerIsMissingLocalFile(repoRoot2, pointer) {
+function pointerIsMissingLocalFile(repoRoot3, pointer) {
   if (/^https?:\/\//i.test(pointer))
     return false;
   const path = pointer.split("#")[0] ?? pointer;
-  return !existsSync21(join23(repoRoot2, path));
+  return !existsSync22(join23(repoRoot3, path));
 }
-async function bindDocOwnerLoop(deps, repoRoot2) {
+async function bindDocOwnerLoop(deps, repoRoot3) {
   let any = false;
   for (;; ) {
     if (any && !await deps.confirm("Bind another doc→code pair?", false))
@@ -8726,11 +9733,11 @@ async function bindDocOwnerLoop(deps, repoRoot2) {
     }
     if (GLOB_INJECTION_RE.test(glob) || POINTER_INJECTION_RE.test(pointer)) {
       console.error(red("Error: glob must not contain whitespace, and the pointer must not contain a newline."));
-    } else if (pointerIsMissingLocalFile(repoRoot2, pointer)) {
+    } else if (pointerIsMissingLocalFile(repoRoot3, pointer)) {
       console.error(red(`✗ "${pointer}" does not exist in this repo (and isn't a URL).`));
     } else {
-      const plan = planDocOwnersBinding(repoRoot2, glob, pointer);
-      applyDocOwnersBinding(repoRoot2, plan, glob, pointer);
+      const plan = planDocOwnersBinding(repoRoot3, glob, pointer);
+      applyDocOwnersBinding(repoRoot3, plan, glob, pointer);
       process.stdout.write(`${green(renderDocOwnersBindingDiffLine(plan))}
 `);
       any = true;
@@ -8776,10 +9783,10 @@ async function registerProjectLoop(deps) {
   }
 }
 function readPackageVersion() {
-  const pkg = JSON.parse(readFileSync23(join23(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync24(join23(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
-function realDeps6() {
+function realDeps7() {
   return {
     detectRepo: detectGitRepo,
     initDeps: {
@@ -8803,8 +9810,8 @@ function realDeps6() {
       meteringCapability: () => resolveMeteringCapability({
         env: process.env,
         cwd: process.cwd(),
-        exists: existsSync21,
-        readFile: (path) => readFileSync23(path, "utf8")
+        exists: existsSync22,
+        readFile: (path) => readFileSync24(path, "utf8")
       })
     },
     confirm: async (q, defaultYes) => promptYesNo(q, defaultYes),
@@ -8812,8 +9819,8 @@ function realDeps6() {
     closeStdin
   };
 }
-function execGit(repoRoot2, args) {
-  return execFileSync14("git", args, { cwd: repoRoot2, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+function execGit(repoRoot3, args) {
+  return execFileSync16("git", args, { cwd: repoRoot3, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -8821,37 +9828,37 @@ function errorDetail(err) {
     return stderr.toString().trim();
   return err instanceof Error ? err.message : String(err);
 }
-function gitStatusShort(repoRoot2) {
-  return execGit(repoRoot2, ["status", "--short"]);
+function gitStatusShort(repoRoot3) {
+  return execGit(repoRoot3, ["status", "--short"]);
 }
-function commitInstall(repoRoot2) {
-  execGit(repoRoot2, ["add", "-A"]);
-  const staged = execGit(repoRoot2, ["diff", "--cached", "--stat"]);
+function commitInstall(repoRoot3) {
+  execGit(repoRoot3, ["add", "-A"]);
+  const staged = execGit(repoRoot3, ["diff", "--cached", "--stat"]);
   if (!staged)
     return { committed: false, message: "Nothing to commit — working tree already clean." };
   try {
-    execGit(repoRoot2, ["commit", "-m", "Chore: install Vinaya"]);
+    execGit(repoRoot3, ["commit", "-m", "Chore: install Vinaya"]);
     return { committed: true, message: "✓ Committed `Chore: install Vinaya`." };
   } catch (err) {
     return { committed: false, message: `git commit failed: ${errorDetail(err)}` };
   }
 }
-function pushInstall(repoRoot2) {
+function pushInstall(repoRoot3) {
   try {
-    const branch = execGit(repoRoot2, ["symbolic-ref", "--short", "HEAD"]);
+    const branch = execGit(repoRoot3, ["symbolic-ref", "--short", "HEAD"]);
     let hasUpstream = true;
     try {
-      execGit(repoRoot2, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
+      execGit(repoRoot3, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
     } catch {
       hasUpstream = false;
     }
     if (hasUpstream) {
-      const ahead = execGit(repoRoot2, ["rev-list", "--count", "@{u}..HEAD"]);
+      const ahead = execGit(repoRoot3, ["rev-list", "--count", "@{u}..HEAD"]);
       if (ahead === "0") {
         return { status: "up-to-date", message: "Nothing to push — already up to date with the remote." };
       }
     }
-    execGit(repoRoot2, hasUpstream ? ["push"] : ["push", "-u", "origin", branch]);
+    execGit(repoRoot3, hasUpstream ? ["push"] : ["push", "-u", "origin", branch]);
     return { status: "pushed", message: "✓ Pushed." };
   } catch (err) {
     return { status: "failed", message: `git push failed: ${errorDetail(err)}` };
@@ -8943,12 +9950,12 @@ ${bold("Next steps:")}
   }
 }
 async function quickstartCommand(args) {
-  process.exit(await runQuickstart(args, realDeps6()));
+  process.exit(await runQuickstart(args, realDeps7()));
 }
 
 // src/commands/review-post.ts
-import { execFileSync as execFileSync15 } from "node:child_process";
-import { readFileSync as readFileSync24, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "node:fs";
+import { execFileSync as execFileSync17 } from "node:child_process";
+import { readFileSync as readFileSync25, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join24 } from "node:path";
 class FindingsParseError extends Error {
@@ -9130,7 +10137,7 @@ function readFindingsFile(path, allowedSeverities) {
     return [];
   let content;
   try {
-    content = readFileSync24(path, "utf8");
+    content = readFileSync25(path, "utf8");
   } catch {
     refuseCmd(`Could not read findings file at ${path}.`, "Check the path and re-run.");
   }
@@ -9159,9 +10166,9 @@ function normalizeSecurityVerdict(raw) {
     return "FAIL";
   refuseCmd(`\`--verdict ${raw}\` is not PASS or FAIL.`, "Pass `--verdict PASS` or `--verdict FAIL`.");
 }
-function gh(args) {
+function gh2(args) {
   try {
-    return execFileSync15("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync17("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
@@ -9170,7 +10177,7 @@ function gh(args) {
 function resolveHeadSha(pr) {
   let out;
   try {
-    out = gh(["pr", "view", pr, "--json", "headRefOid", "-q", ".headRefOid"]);
+    out = gh2(["pr", "view", pr, "--json", "headRefOid", "-q", ".headRefOid"]);
   } catch (err) {
     refuseCmd(`Could not resolve PR ${pr}'s head via \`gh pr view --json headRefOid\`: ${err instanceof Error ? err.message : String(err)}`, "Confirm `gh auth status` passes and the PR number is correct, then re-run.");
   }
@@ -9183,7 +10190,7 @@ function postComment(pr, body) {
   const tmp = join24(tmpdir2(), `vinaya-review-post-${process.pid}-${Date.now()}.md`);
   writeFileSync12(tmp, body);
   try {
-    return gh(["pr", "comment", pr, "--body-file", tmp]).trim();
+    return gh2(["pr", "comment", pr, "--body-file", tmp]).trim();
   } catch (err) {
     refuseCmd(`Rendered comment failed to post via \`gh pr comment\`: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network, then re-run — nothing was posted.");
   } finally {
@@ -9191,7 +10198,7 @@ function postComment(pr, body) {
   }
 }
 function fetchComments(pr) {
-  const out = gh(["pr", "view", pr, "--json", "comments"]);
+  const out = gh2(["pr", "view", pr, "--json", "comments"]);
   const parsed = JSON.parse(out);
   return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
 }
@@ -9299,7 +10306,7 @@ async function reviewPostCommand(args) {
     let secretsEvidence = null;
     if (secretsEvidenceFile) {
       try {
-        secretsEvidence = readFileSync24(secretsEvidenceFile, "utf8");
+        secretsEvidence = readFileSync25(secretsEvidenceFile, "utf8");
       } catch {
         refuseCmd(`Could not read secrets evidence file at ${secretsEvidenceFile}.`, "Check the path and re-run.");
       }
@@ -9340,7 +10347,7 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
 
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync25, renameSync } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync26, renameSync } from "node:fs";
 import net from "node:net";
 import { dirname as dirname8, join as join25 } from "node:path";
 import { promisify as promisify5 } from "node:util";
@@ -9397,15 +10404,15 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   for (;; ) {
     const webDir = join25(dir, "apps", "vinaya-studio", "web");
     const pkgPath = join25(webDir, "package.json");
-    if (existsSync22(pkgPath)) {
+    if (existsSync23(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync25(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync26(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
           return { kind: "workspace", webDir };
         }
       } catch {}
     }
-    if (existsSync22(join25(dir, ".git")))
+    if (existsSync23(join25(dir, ".git")))
       break;
     const parent = dirname8(dir);
     if (parent === dir)
@@ -9413,29 +10420,29 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
     dir = parent;
   }
   const standaloneWebDir = join25(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync22(join25(standaloneWebDir, "server.js"))) {
+  if (existsSync23(join25(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
 }
 function spawnDev(webDir, args) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawn2("bun", ["run", "dev", ...args], { cwd: webDir, stdio: "inherit" });
-    child.on("exit", (code) => resolve2(code ?? 0));
+    child.on("exit", (code) => resolve3(code ?? 0));
   });
 }
 function isPortFree(port) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const tester = net.createServer();
-    tester.once("error", () => resolve2(false));
-    tester.once("listening", () => tester.close(() => resolve2(true)));
+    tester.once("error", () => resolve3(false));
+    tester.once("listening", () => tester.close(() => resolve3(true)));
     tester.listen(port, "127.0.0.1");
   });
 }
 function ensureStudioNodeModules(bundleRoot) {
   const real = join25(bundleRoot, "node_modules");
   const packed = join25(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
-  if (!existsSync22(real) && existsSync22(packed)) {
+  if (!existsSync23(real) && existsSync23(packed)) {
     renameSync(packed, real);
   }
 }
@@ -9459,9 +10466,9 @@ async function spawnStandalone(cwd, serverPath, bundleRoot, explicitPort) {
   const env = { HOSTNAME: "127.0.0.1", ...process.env, PORT: String(port), VINAYA_REPO_ROOT: cwd };
   if (repo)
     env.AEG_REPO = `${repo.owner}/${repo.repo}`;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const child = spawn2("node", [serverPath], { cwd, stdio: "inherit", env });
-    child.on("exit", (code) => resolve2(code ?? 0));
+    child.on("exit", (code) => resolve3(code ?? 0));
   });
 }
 async function runStudio(cwd, args, moduleUrl = import.meta.url) {
@@ -9493,124 +10500,6 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
   }
 }
 
-// src/commands/tokens.ts
-import { existsSync as existsSync23, readFileSync as readFileSync26 } from "node:fs";
-var USAGE4 = [
-  'Usage: vinaya tokens --phase "<task-id>: develop" --role Developer',
-  "  [--model <id>] [--transcript <path>] [--in <tokens-in> --out <tokens-out>]",
-  "",
-  "  --transcript   Read this transcript directly. Supported primary route — use it whenever you know",
-  "                 which transcript is yours, and always in a repo with no track-transcript.sh hook.",
-  "  (omitted)      Resolve via the Stop-hook pointer file, if this repo installs that hook.",
-  "  --in/--out     Manual entry: the exact token figures, for a host whose usage arrives by some other",
-  "                 means than a Claude Code transcript. Both required together; skips transcript",
-  "                 resolution entirely."
-].join(`
-`);
-function parseArgs(argv) {
-  let phase;
-  let role;
-  let model;
-  let transcriptPath;
-  let tokensInRaw;
-  let tokensOutRaw;
-  for (let i = 0;i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--phase")
-      phase = argv[++i];
-    else if (arg === "--role")
-      role = argv[++i];
-    else if (arg === "--model")
-      model = argv[++i];
-    else if (arg === "--transcript")
-      transcriptPath = argv[++i];
-    else if (arg === "--in")
-      tokensInRaw = argv[++i];
-    else if (arg === "--out")
-      tokensOutRaw = argv[++i];
-  }
-  if (!phase || !role) {
-    throw new Error(USAGE4);
-  }
-  if (tokensInRaw === undefined !== (tokensOutRaw === undefined)) {
-    throw new Error("vinaya tokens: --in and --out must be given together, or not at all.");
-  }
-  const tokensIn = tokensInRaw === undefined ? undefined : Number(tokensInRaw);
-  const tokensOut = tokensOutRaw === undefined ? undefined : Number(tokensOutRaw);
-  if (tokensIn !== undefined && (!Number.isFinite(tokensIn) || tokensIn < 0)) {
-    throw new Error(`vinaya tokens: --in must be a non-negative integer, got "${tokensInRaw}".`);
-  }
-  if (tokensOut !== undefined && (!Number.isFinite(tokensOut) || tokensOut < 0)) {
-    throw new Error(`vinaya tokens: --out must be a non-negative integer, got "${tokensOutRaw}".`);
-  }
-  return { phase, role, model, transcriptPath, tokensIn, tokensOut };
-}
-function manualSummary(tokensIn, tokensOut) {
-  return {
-    components: {
-      inputTokens: tokensIn,
-      outputTokens: tokensOut,
-      cacheCreationInputTokens: 0,
-      cacheReadInputTokens: 0
-    },
-    model: null,
-    messageCount: 1
-  };
-}
-function realDeps7() {
-  return {
-    env: process.env,
-    cwd: process.cwd(),
-    exists: existsSync23,
-    readFile: (path) => readFileSync26(path, "utf8")
-  };
-}
-function buildTokensResult(parsed, deps) {
-  if (parsed.tokensIn !== undefined && parsed.tokensOut !== undefined) {
-    const summary = manualSummary(parsed.tokensIn, parsed.tokensOut);
-    return {
-      line: formatTokensLine({ phase: parsed.phase, role: parsed.role, summary, modelOverride: parsed.model }),
-      breakdown: undefined
-    };
-  }
-  const capability = resolveMeteringCapability(deps, parsed.transcriptPath);
-  if (!capability.capable) {
-    throw new Error(`vinaya tokens: refused — could not resolve real usage figures (${capability.reason}).
-${capability.detail}
-
-${USAGE4}`);
-  }
-  return {
-    line: formatTokensLine({
-      phase: parsed.phase,
-      role: parsed.role,
-      summary: capability.summary,
-      modelOverride: parsed.model
-    }),
-    breakdown: formatBreakdown(capability.summary)
-  };
-}
-function tokensCommand(argv) {
-  let parsed;
-  try {
-    parsed = parseArgs(argv);
-  } catch (err) {
-    console.error(err.message);
-    process.exit(2);
-  }
-  let result;
-  try {
-    result = buildTokensResult(parsed, realDeps7());
-  } catch (err) {
-    console.error(err.message);
-    process.exit(1);
-  }
-  if (result.breakdown)
-    console.error(result.breakdown);
-  process.stdout.write(`${result.line}
-`);
-}
-
 // src/commands/upgrade.ts
 import { existsSync as existsSync24, readFileSync as readFileSync27, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join26 } from "node:path";
@@ -9630,8 +10519,8 @@ function realDeps8() {
 function flags2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
-function readManifest3(repoRoot2) {
-  const p = join26(repoRoot2, CONFIG_PATH);
+function readManifest3(repoRoot3) {
+  const p = join26(repoRoot3, CONFIG_PATH);
   if (!existsSync24(p))
     return { kind: "missing" };
   let raw;
@@ -9651,15 +10540,15 @@ function readManifest3(repoRoot2) {
     return { kind: "not-initialized" };
   return { kind: "ok", manifest: parsed.data.managed };
 }
-function writeManifestVersion(repoRoot2, manifest) {
-  const configAbs = join26(repoRoot2, CONFIG_PATH);
+function writeManifestVersion(repoRoot3, manifest) {
+  const configAbs = join26(repoRoot3, CONFIG_PATH);
   const seed = JSON.parse(readFileSync27(configAbs, "utf-8"));
   const updated = { ...manifest, version: MANAGED_MANIFEST_VERSION };
   writeFileSync13(configAbs, `${JSON.stringify({ ...seed, managed: updated }, null, 2)}
 `, "utf-8");
 }
-function stripFor(repoRoot2, path, marker, comment) {
-  const abs2 = resolveManagedBlockPath(repoRoot2, path);
+function stripFor(repoRoot3, path, marker, comment) {
+  const abs2 = resolveManagedBlockPath(repoRoot3, path);
   if (!existsSync24(abs2))
     return { path, marker, comment, present: false, removesHost: false };
   const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), marker, comment);
@@ -9667,15 +10556,15 @@ function stripFor(repoRoot2, path, marker, comment) {
     return { path, marker, comment, present: false, removesHost: false };
   return { path, marker, comment, present: true, removesHost: blockStripLeavesEmpty(stripped) };
 }
-function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
+function planHookRouting(repoRoot3, manifest, recorded, hooksPathValue) {
   const none = { target: recorded, strips: [], arm: false, migratesManifest: false, blockedReason: null };
   if (recorded === ".husky")
     return none;
   if (recorded === TRACKED_HOOK_DIR) {
-    const strips = manifest.blocks.filter((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)).map((b) => stripFor(repoRoot2, `.git/hooks/${b.marker}`, b.marker, b.comment)).filter((s) => s.present);
+    const strips = manifest.blocks.filter((b) => b.path.startsWith(`${TRACKED_HOOK_DIR}/`)).map((b) => stripFor(repoRoot3, `.git/hooks/${b.marker}`, b.marker, b.comment)).filter((s) => s.present);
     if (hooksPathValue === TRACKED_HOOK_DIR)
       return { ...none, strips };
-    const foreign = foreignRawHooks(repoRoot2);
+    const foreign = foreignRawHooks(repoRoot3);
     if (foreign.length > 0) {
       return {
         ...none,
@@ -9688,7 +10577,7 @@ function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
   const legacy = manifest.blocks.filter((b) => b.path.startsWith(".git/hooks/"));
   const blocked = [];
   for (const b of legacy) {
-    const abs2 = resolveManagedBlockPath(repoRoot2, b.path);
+    const abs2 = resolveManagedBlockPath(repoRoot3, b.path);
     if (!existsSync24(abs2))
       continue;
     const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), b.marker, b.comment);
@@ -9698,7 +10587,7 @@ function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
       blocked.push(`${b.path} carries your own lines alongside the managed block`);
   }
   const legacyNames = new Set(legacy.map((b) => b.path.slice(".git/hooks/".length)));
-  for (const f of activeRawHooks(repoRoot2)) {
+  for (const f of activeRawHooks(repoRoot3)) {
     if (!legacyNames.has(f))
       blocked.push(`.git/hooks/${f} is an active raw hook vinaya does not manage`);
   }
@@ -9706,7 +10595,7 @@ function planHookRouting(repoRoot2, manifest, recorded, hooksPathValue) {
     return { ...none, blockedReason: blocked.join("; ") };
   return {
     target: TRACKED_HOOK_DIR,
-    strips: legacy.map((b) => stripFor(repoRoot2, b.path, b.marker, b.comment)).filter((s) => s.present),
+    strips: legacy.map((b) => stripFor(repoRoot3, b.path, b.marker, b.comment)).filter((s) => s.present),
     arm: hooksPathValue !== TRACKED_HOOK_DIR,
     migratesManifest: true,
     blockedReason: null
@@ -9722,7 +10611,7 @@ function extractWorkflowTrigger(content) {
   const match = content.match(/^on:\r?\n {2}([A-Za-z0-9_]+):/m);
   return match?.[1] ?? null;
 }
-function planUpgrade(ops, repoRoot2, manifest, routing) {
+function planUpgrade(ops, repoRoot3, manifest, routing) {
   const entries = [];
   let hasChanges = routing.arm || routing.migratesManifest || routing.strips.some((s) => s.present);
   const ownedFiles = new Set(manifest.files);
@@ -9730,7 +10619,7 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
   const ownedBlocks = new Set(manifest.blocks.map((b) => blockKey(b.path, b.marker)));
   for (const op of ops) {
     if (op.kind === "create-file") {
-      const abs2 = join26(repoRoot2, op.path);
+      const abs2 = join26(repoRoot3, op.path);
       const exists = existsSync24(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       let action;
@@ -9759,7 +10648,7 @@ function planUpgrade(ops, repoRoot2, manifest, routing) {
       }
       entries.push({ kind: "create-file", op, action, ...triggerChange ? { triggerChange } : {} });
     } else if (op.kind === "managed-block") {
-      const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
+      const abs2 = resolveManagedBlockPath(repoRoot3, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
       let action;
       if (!owned) {
@@ -9872,8 +10761,8 @@ function renderUpgradeDiff(plan) {
   return lines.join(`
 `);
 }
-function regenerateBlock(repoRoot2, op) {
-  const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
+function regenerateBlock(repoRoot3, op) {
+  const abs2 = resolveManagedBlockPath(repoRoot3, op.path);
   const content = readFileSync27(abs2, "utf-8");
   const stripped = stripBlockFromContent(content, op.marker, op.comment);
   if (stripped !== null) {
@@ -9881,27 +10770,27 @@ function regenerateBlock(repoRoot2, op) {
 `) ? stripped : `${stripped}
 `, "utf-8");
   }
-  appendBlock(repoRoot2, op);
+  appendBlock(repoRoot3, op);
 }
-function applyUpgrade(plan, repoRoot2) {
+function applyUpgrade(plan, repoRoot3) {
   for (const e of plan.entries) {
     if (e.kind === "create-file") {
       if (e.action === "regenerate" || e.action === "recreate") {
-        writeFileWithDirs(join26(repoRoot2, e.op.path), e.op.content, e.op.mode);
+        writeFileWithDirs(join26(repoRoot3, e.op.path), e.op.content, e.op.mode);
       }
     } else {
       if (e.action === "recreate-host")
-        createHost(repoRoot2, e.op);
+        createHost(repoRoot3, e.op);
       else if (e.action === "recreate-append")
-        appendBlock(repoRoot2, e.op);
+        appendBlock(repoRoot3, e.op);
       else if (e.action === "regenerate-block")
-        regenerateBlock(repoRoot2, e.op);
+        regenerateBlock(repoRoot3, e.op);
     }
   }
   for (const s of plan.routing.strips) {
     if (!s.present)
       continue;
-    const abs2 = resolveManagedBlockPath(repoRoot2, s.path);
+    const abs2 = resolveManagedBlockPath(repoRoot3, s.path);
     if (!existsSync24(abs2))
       continue;
     const stripped = stripBlockFromContent(readFileSync27(abs2, "utf-8"), s.marker, s.comment);
@@ -9993,16 +10882,16 @@ async function upgradeCommand(args) {
 }
 
 // src/commands/waiver.ts
-import { execFileSync as execFileSync16 } from "node:child_process";
+import { execFileSync as execFileSync18 } from "node:child_process";
 function labelFor(kind) {
   return kind === "docs" ? WAIVER_LABEL : WAIVER_LABEL_REVIEW;
 }
-function gh2(args) {
-  return execFileSync16("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
+function gh3(args) {
+  return execFileSync18("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: process.env }).trim();
 }
 function detectPrNumber() {
   try {
-    const out = gh2(["pr", "view", "--json", "number", "-q", ".number"]);
+    const out = gh3(["pr", "view", "--json", "number", "-q", ".number"]);
     return /^\d+$/.test(out) ? out : null;
   } catch {
     return null;
@@ -10098,8 +10987,8 @@ Reason: ${reason}`];
   }
   process.stdout.write(`Applying \`${label2}\` to PR #${prNumber} under your authenticated \`gh\` identity — vinaya never fabricates an actor.
 `);
-  execFileSync16("gh", editArgs, { stdio: "inherit", env: process.env });
-  execFileSync16("gh", commentArgs, { stdio: "inherit", env: process.env });
+  execFileSync18("gh", editArgs, { stdio: "inherit", env: process.env });
+  execFileSync18("gh", commentArgs, { stdio: "inherit", env: process.env });
   process.stdout.write(`
 ✓ Label applied and reason posted as a PR comment.
 `);
@@ -10223,8 +11112,10 @@ try {
         prEditCommand(rest);
       } else if (subcommand === "report") {
         await prReportCommand(rest);
+      } else if (subcommand === "verify-evidence") {
+        await prVerifyEvidenceCommand(rest);
       } else {
-        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create', 'edit', or 'report')`);
+        console.error(`Unknown 'pr' subcommand: ${subcommand ?? "(none)"} (expected 'create', 'edit', 'report', or 'verify-evidence')`);
         process.exit(2);
       }
       break;
@@ -10249,8 +11140,10 @@ try {
         await milestoneAdoptCommand(rest);
       } else if (subcommand === "edit") {
         await milestoneEditCommand(rest);
+      } else if (subcommand === "close") {
+        await milestoneCloseCommand(rest);
       } else {
-        console.error(`Unknown 'milestone' subcommand: ${subcommand ?? "(none)"} (expected create/adopt/edit)`);
+        console.error(`Unknown 'milestone' subcommand: ${subcommand ?? "(none)"} (expected create/adopt/edit/close)`);
         process.exit(2);
       }
       break;