@basou/cli 0.44.0 → 0.46.0

package/dist/program.js

@@ -1,5 +1,6 @@
 // src/program.ts
 import { createRequire } from "module";
+import * as basouCore from "@basou/core";
 import { Command } from "commander";
 
 // src/commands/approval.ts
@@ -16,6 +17,7 @@ import {
   enumerateApprovals,
   findErrorCode,
   isLazyExpired,
+  LOCAL_CLI_EVENT_SOURCE,
   linkYamlFile,
   loadApproval,
   prefixedUlid,
@@ -369,7 +371,7 @@ async function doRunApprovalResolve(idInput, options, ctx, decision) {
         id: eventId,
         session_id: approval.session_id,
         occurred_at: occurredAt,
-        source: "local-cli",
+        source: LOCAL_CLI_EVENT_SOURCE,
         type: "approval_approved",
         approval_id: approval.id,
         resolver: "local-cli",
@@ -382,7 +384,7 @@ async function doRunApprovalResolve(idInput, options, ctx, decision) {
         id: eventId,
         session_id: approval.session_id,
         occurred_at: occurredAt,
-        source: "local-cli",
+        source: LOCAL_CLI_EVENT_SOURCE,
         type: "approval_rejected",
         approval_id: approval.id,
         resolver: "local-cli",
@@ -861,12 +863,13 @@ import {
   acquireLock as acquireLock2,
   appendEventToExistingSession,
   assertBasouRootSafe as assertBasouRootSafe2,
-  basouPaths as basouPaths3,
+  basouPaths as basouPaths4,
   classifyFilesBySourceRoot,
   createAdHocSessionWithEvent,
   EVENT_SCHEMA_VERSION as EVENT_SCHEMA_VERSION2,
   findErrorCode as findErrorCode2,
   isValidPrefixedId,
+  LOCAL_CLI_EVENT_SOURCE as LOCAL_CLI_EVENT_SOURCE2,
   loadSessionEntries,
   prefixedUlid as prefixedUlid2,
   readManifest as readManifest2,
@@ -875,7 +878,7 @@ import {
   resolveSessionId,
   sanitizePath
 } from "@basou/core";
-import { InvalidArgumentError } from "commander";
+import { InvalidArgumentError as InvalidArgumentError2 } from "commander";
 
 // src/lib/repo-root.ts
 import { realpath, stat as stat2 } from "fs/promises";
@@ -1035,11 +1038,165 @@ async function realpathOrNull(p) {
   }
 }
 
+// src/commands/decision-gaps.ts
+import {
+  basouPaths as basouPaths3,
+  findDecisionGaps
+} from "@basou/core";
+import { InvalidArgumentError } from "commander";
+var DEFAULT_GAP_LIMIT = 20;
+function parseLimit(value) {
+  const n = /^\d+$/u.test(value.trim()) ? Number(value.trim()) : Number.NaN;
+  if (!Number.isInteger(n) || n < 0) {
+    throw new InvalidArgumentError("--limit must be a non-negative integer.");
+  }
+  return n;
+}
+function parseSince(value, now = /* @__PURE__ */ new Date()) {
+  const duration = /^(\d+)([dhm])$/u.exec(value.trim());
+  if (duration !== null) {
+    const n = Number(duration[1]);
+    const ms = { d: 864e5, h: 36e5, m: 6e4 }[duration[2]];
+    return new Date(now.getTime() - n * ms).toISOString();
+  }
+  if (/^\d+$/u.test(value.trim())) {
+    throw new InvalidArgumentError("--since needs a unit (7d, 36h, 90m) or a full ISO timestamp.");
+  }
+  const parsed = Date.parse(value);
+  if (Number.isNaN(parsed)) {
+    throw new InvalidArgumentError(
+      "--since must be an ISO timestamp or a duration (7d, 36h, 90m)."
+    );
+  }
+  return new Date(parsed).toISOString();
+}
+function registerDecisionGapsCommand(decision) {
+  decision.command("gaps").description("List recorded decisions that no task carries (read-only, advisory)").option(
+    "--since <when>",
+    "Only decisions recorded at or after this ISO instant or duration back (7d, 36h)"
+  ).option(
+    "--limit <n>",
+    `Maximum entries to list; the rest are counted (default ${DEFAULT_GAP_LIMIT}, 0 = no limit)`,
+    parseLimit
+  ).option("--json", "Output the result as JSON").option("-v, --verbose", "Show error causes").action(async (opts) => {
+    await runDecisionGaps(opts);
+  });
+}
+async function runDecisionGaps(options, ctx = {}) {
+  try {
+    await doRunDecisionGaps(options, ctx);
+  } catch (error) {
+    renderCliError(error, { verbose: isVerbose(options) });
+    process.exitCode = 1;
+  }
+}
+async function doRunDecisionGaps(options, ctx) {
+  const cwd = ctx.cwd ?? process.cwd();
+  const repositoryRoot = await resolveBasouRootForCommand(cwd, "decision gaps");
+  const paths = basouPaths3(repositoryRoot);
+  const now = ctx.nowProvider?.() ?? /* @__PURE__ */ new Date();
+  const limit = options.limit ?? DEFAULT_GAP_LIMIT;
+  const summary = await findDecisionGaps({
+    paths,
+    nowIso: now.toISOString(),
+    ...options.since !== void 0 ? { start: parseSince(options.since, now) } : {},
+    ...limit > 0 ? { limit } : {},
+    onWarning: (w, sid) => printReplayWarning(w, sid),
+    onSessionSkip: (sid, reason) => printSessionSkip(sid, reason)
+  });
+  if (options.json === true) {
+    console.log(JSON.stringify(summary));
+  } else {
+    console.log(renderDecisionGaps(summary));
+  }
+  return summary;
+}
+function relAge(iso, now) {
+  const ms = now.getTime() - Date.parse(iso);
+  if (!Number.isFinite(ms)) return "(unknown)";
+  if (ms < 0) return "clock ahead";
+  const days = Math.floor(ms / 864e5);
+  if (days >= 1) return `${days}d ago`;
+  const hours = Math.floor(ms / 36e5);
+  if (hours >= 1) return `${hours}h ago`;
+  return `${Math.max(1, Math.floor(ms / 6e4))}m ago`;
+}
+var GRAPHEMES = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+function oneLine(value, max) {
+  const flat = [...GRAPHEMES.segment(value.replace(/\s+/gu, " ").trim())].map((s) => s.segment);
+  return flat.length > max ? `${flat.slice(0, max - 1).join("")}\u2026` : flat.join("");
+}
+function gapLine(d, now) {
+  return `- ${oneLine(d.title, 100)}
+  ${relAge(d.recordedAt, now)} \xB7 ${d.decisionId}`;
+}
+function incompleteLine(summary) {
+  const { sessions, tasks, unknownReferences } = summary.incomplete;
+  const parts = [];
+  if (sessions > 0) {
+    parts.push(
+      `${sessions} session${sessions === 1 ? "" : "s"} could not be read in full, so a decision recorded there may be missing from these numbers, and a \`decision void\` recorded there may not have been applied`
+    );
+  }
+  if (tasks > 0) {
+    parts.push(
+      `${tasks} task file${tasks === 1 ? "" : "s"} could not be read, so a decision one of them carries is listed above as if nothing did`
+    );
+  }
+  if (unknownReferences > 0) {
+    parts.push(
+      `${unknownReferences} decision id${unknownReferences === 1 ? "" : "s"} named by a task ${unknownReferences === 1 ? "matches" : "match"} no decision in this store, and ${unknownReferences === 1 ? "was" : "were"} not counted as carrying anything`
+    );
+  }
+  return parts.length === 0 ? null : `\u26A0\uFE0F ${parts.join("; ")}.`;
+}
+function renderDecisionGaps(summary) {
+  const now = new Date(summary.generatedAt);
+  const { excluded, scope } = summary;
+  const lines = ["# Decision gaps", ""];
+  if (summary.populationCount === 0) {
+    lines.push(
+      `No decision recorded since ${scope.start} by \`basou decision capture\` or \`basou decision record\` is still open, so there is nothing to check yet. This list fills as decisions are recorded.`
+    );
+  } else if (summary.gaps.length === 0) {
+    lines.push(
+      `\u2705 Within what was checked, each of the ${summary.populationCount} open decision${summary.populationCount === 1 ? "" : "s"} in scope has a task carrying it.`
+    );
+  } else {
+    const total = summary.gaps.length + summary.truncated;
+    lines.push(`\u26A0\uFE0F Open decisions no task carries: ${total} of ${summary.populationCount} in scope`);
+    lines.push("");
+    for (const d of summary.gaps) lines.push(gapLine(d, now));
+    if (summary.truncated > 0) {
+      lines.push(`  ... +${summary.truncated} more (--limit 0 to list them all, or --json)`);
+    }
+  }
+  lines.push("");
+  lines.push("## Scope");
+  lines.push(
+    `- Checked: decisions recorded at or after ${scope.start} with source \`${scope.source}\` (i.e. recorded by running basou, not derived from a transcript by an importer), still open, and not a track.`
+  );
+  lines.push(
+    `- Not checked: ${excluded.byStart} recorded earlier, then ${excluded.bySource} recorded by something other than basou itself, then ${excluded.track} tracks (already shown every session by \`basou orient\` until closed), then ${excluded.voided} closed with \`basou decision void\`.`
+  );
+  lines.push(
+    `- Task files read: ${summary.tasksScanned} (live and archived); ${summary.carried} of the decisions in scope are carried by one.`
+  );
+  const incomplete = incompleteLine(summary);
+  if (incomplete !== null) lines.push(`- ${incomplete}`);
+  lines.push("");
+  lines.push(
+    "Note: read-only advisory. A task carries a decision when it names that decision's full id; an abbreviated id names no one decision, because a captured batch shares a millisecond and its ids differ only at the end. It does not read what a decision means, and it does not enforce."
+  );
+  return lines.join("\n");
+}
+
 // src/commands/decision.ts
 var LABEL_TITLE_MAX = 80;
 var LABEL_TRUNCATE_HEAD = LABEL_TITLE_MAX - 3;
 function registerDecisionCommand(program) {
   const decision = program.command("decision").description("Record human-authored decisions as events");
+  registerDecisionGapsCommand(decision);
   decision.command("record").description("Record a decision_recorded event").requiredOption("--title <text>", "Decision title", parseTitle).option("--rationale <text>", "Rationale for the decision", parseRationale).option(
     "--rejected-reason <text>",
     "Reason rejected alternatives were not chosen",
@@ -1161,7 +1318,7 @@ function warnTrackMarkerWithoutKind(decisions, markerWithoutKind) {
 async function doRunDecisionRecord(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForDecision(cwd);
-  const paths = basouPaths3(repositoryRoot);
+  const paths = basouPaths4(repositoryRoot);
   await assertWorkspaceInitialized2(paths.root);
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
   const occurredAt = now.toISOString();
@@ -1252,7 +1409,7 @@ async function runDecisionCapture(options, ctx = {}) {
 async function doRunDecisionCapture(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "decision capture");
-  const paths = basouPaths3(repositoryRoot);
+  const paths = basouPaths4(repositoryRoot);
   await assertWorkspaceInitialized2(paths.root);
   const raw = await readCaptureInput(options, ctx);
   const { decisions, markerWithoutKind } = parseCaptureInput(raw);
@@ -1334,7 +1491,7 @@ async function doRunDecisionVoid(decisionId, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "decision void");
-  const paths = basouPaths3(repositoryRoot);
+  const paths = basouPaths4(repositoryRoot);
   await assertWorkspaceInitialized2(paths.root);
   if (!await decisionExists(paths, decisionId)) {
     throw new Error(
@@ -1428,7 +1585,7 @@ function buildDecisionVoidedEvent(input) {
     id: input.eventId,
     session_id: input.sessionId,
     occurred_at: input.occurredAt,
-    source: "local-cli",
+    source: LOCAL_CLI_EVENT_SOURCE2,
     type: "decision_voided",
     decision_id: input.decisionId,
     ...input.reason !== void 0 ? { reason: input.reason } : {},
@@ -1460,7 +1617,7 @@ function printVoidResult(options, result) {
 }
 function parseReason(raw) {
   if (raw.trim().length === 0) {
-    throw new InvalidArgumentError("--reason must not be empty");
+    throw new InvalidArgumentError2("--reason must not be empty");
   }
   return raw;
 }
@@ -1694,7 +1851,7 @@ function buildDecisionEvent(input) {
     id: input.eventId,
     session_id: input.sessionId,
     occurred_at: input.occurredAt,
-    source: "local-cli",
+    source: LOCAL_CLI_EVENT_SOURCE2,
     type: "decision_recorded",
     decision_id: input.decisionId,
     title: input.title,
@@ -1712,25 +1869,25 @@ function buildAdHocLabel(title) {
 }
 function parseTitle(raw) {
   if (isBlank(raw)) {
-    throw new InvalidArgumentError("Title must not be empty");
+    throw new InvalidArgumentError2("Title must not be empty");
   }
   return raw;
 }
 function parseRationale(raw) {
   if (isBlank(raw)) {
-    throw new InvalidArgumentError("Rationale must not be empty");
+    throw new InvalidArgumentError2("Rationale must not be empty");
   }
   return raw;
 }
 function parseRejectedReason(raw) {
   if (isBlank(raw)) {
-    throw new InvalidArgumentError("Rejected reason must not be empty");
+    throw new InvalidArgumentError2("Rejected reason must not be empty");
   }
   return raw;
 }
 function collectAlternative(value, prev) {
   if (isBlank(value)) {
-    throw new InvalidArgumentError("Alternative must not be empty");
+    throw new InvalidArgumentError2("Alternative must not be empty");
   }
   return prev.concat(value);
 }
@@ -1739,16 +1896,16 @@ function isValidEventId(value) {
 }
 function collectLinkedEvent(value, prev) {
   if (!isValidEventId(value)) {
-    throw new InvalidArgumentError(`Linked event id must match evt_<ULID>, got '${value}'`);
+    throw new InvalidArgumentError2(`Linked event id must match evt_<ULID>, got '${value}'`);
   }
   return prev.concat(value);
 }
 function collectLinkedFile(value, prev) {
   if (isBlank(value)) {
-    throw new InvalidArgumentError("Linked file path must not be empty");
+    throw new InvalidArgumentError2("Linked file path must not be empty");
   }
   if (value.length > 4096) {
-    throw new InvalidArgumentError("Linked file path exceeds 4096 chars");
+    throw new InvalidArgumentError2("Linked file path exceeds 4096 chars");
   }
   return prev.concat(value);
 }
@@ -1813,7 +1970,7 @@ async function assertWorkspaceInitialized2(basouRoot) {
 // src/commands/decisions.ts
 import {
   assertBasouRootSafe as assertBasouRootSafe3,
-  basouPaths as basouPaths4,
+  basouPaths as basouPaths5,
   findErrorCode as findErrorCode3,
   readMarkdownFile as readMarkdownFile2,
   renderDecisions,
@@ -1839,7 +1996,7 @@ async function doRunDecisionsGenerate(options, ctx) {
   void options;
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForDecisions(cwd);
-  const paths = basouPaths4(repositoryRoot);
+  const paths = basouPaths5(repositoryRoot);
   await assertWorkspaceInitialized3(paths.root);
   const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const result = await renderDecisions({
@@ -1884,7 +2041,7 @@ import { join as join6 } from "path";
 import {
   acquireLock as acquireLock3,
   assertBasouRootSafe as assertBasouRootSafe4,
-  basouPaths as basouPaths5,
+  basouPaths as basouPaths6,
   ChildProcessRunner,
   appendChainedEvent as coreAppendChainedEvent,
   EVENT_SCHEMA_VERSION as EVENT_SCHEMA_VERSION3,
@@ -1896,6 +2053,7 @@ import {
   readManifest as readManifest3,
   readYamlFile as readYamlFile3,
   resolveRepositoryRoot as resolveRepositoryRoot4,
+  SESSION_SCHEMA_VERSION,
   SessionSchema,
   sanitizeWorkingDirectory,
   writeObservedDuration,
@@ -1918,7 +2076,7 @@ async function runExec(command, args, options, ctx = {}) {
   const cwd = options.cwd ?? process.cwd();
   const timeout_ms = options.timeout !== void 0 ? parseDuration(options.timeout) : void 0;
   const repoRoot = await resolveRepositoryRootForExec(cwd);
-  const paths = basouPaths5(repoRoot);
+  const paths = basouPaths6(repoRoot);
   await assertBasouRootSafe4(paths.root);
   const manifest = await readManifest3(paths);
   const sessionId = prefixedUlid3("ses");
@@ -2131,7 +2289,7 @@ function normalizeGitSnapshotSkipMessage(error) {
 function buildInitialSession(input) {
   const cmdline = [input.command, ...input.args].join(" ");
   return {
-    schema_version: "0.1.0",
+    schema_version: SESSION_SCHEMA_VERSION,
     session: {
       id: input.id,
       label: `basou exec ${cmdline} (${input.startedAt})`,
@@ -2216,12 +2374,11 @@ async function resolveRepositoryRootForExec(cwd) {
 // src/commands/handoff.ts
 import {
   assertBasouRootSafe as assertBasouRootSafe5,
-  basouPaths as basouPaths6,
+  basouPaths as basouPaths7,
   findErrorCode as findErrorCode4,
   readMarkdownFile as readMarkdownFile3,
   renderHandoff,
   renderWithMarkers as renderWithMarkers2,
-  resolveRepositoryRoot as resolveRepositoryRoot5,
   writeMarkdownFile as writeMarkdownFile2
 } from "@basou/core";
 function registerHandoffCommand(program) {
@@ -2242,7 +2399,7 @@ async function doRunHandoffGenerate(options, ctx) {
   void options;
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForHandoff(cwd);
-  const paths = basouPaths6(repositoryRoot);
+  const paths = basouPaths7(repositoryRoot);
   await assertWorkspaceInitialized4(paths.root);
   const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const result = await renderHandoff({
@@ -2261,7 +2418,7 @@ async function doRunHandoffGenerate(options, ctx) {
 }
 async function resolveRepositoryRootForHandoff(cwd) {
   try {
-    return await resolveRepositoryRoot5(cwd);
+    return await resolveBasouRootForCommand(cwd, "handoff generate");
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error(
@@ -2284,10 +2441,12 @@ async function assertWorkspaceInitialized4(basouRoot) {
 }
 
 // src/commands/hook.ts
+import { execFile } from "child_process";
 import { open as open2, readFile as readFile3, realpath as realpath3, stat as stat4 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join10 } from "path";
 import { fileURLToPath } from "url";
+import { promisify } from "util";
 import {
   buildSessionStartHookCommand,
   buildStopHookCommand,
@@ -2295,12 +2454,20 @@ import {
   evaluateStopHook,
   findBasouSessionStartHook,
   findBasouStopHookCommand,
+  isProtocolUpdateDue,
   ORIENTATION_END as ORIENTATION_END2,
   ORIENTATION_START as ORIENTATION_START2,
+  PROTOCOL_END,
+  PROTOCOL_START,
   parseMarkers as parseMarkers2,
+  parseProtocolStamp,
+  protocolSectionsFrom,
+  protocolUpdateToken,
   readMarkdownFile as readMarkdownFile6,
   removeSessionStartHook,
   removeStopHook,
+  renderProtocolUpdate,
+  transcriptStartedAt,
   upsertSessionStartHook,
   upsertStopHook
 } from "@basou/core";
@@ -2555,32 +2722,109 @@ async function warnIfPositionNamesOtherWorkspaces(args) {
   }
 }
 
+// src/lib/protocols-config.ts
+import { homedir as homedir5 } from "os";
+import { isAbsolute as isAbsolute2, join as join7, resolve as resolve4 } from "path";
+import { readYamlFile as readYamlFile4 } from "@basou/core";
+var DEFAULT_PROTOCOLS_CONFIG_PATH = join7(homedir5(), ".basou", "protocols.yaml");
+var DEFAULT_TARGET_PATH = join7(homedir5(), ".claude", "CLAUDE.md");
+var ALLOWED_TOP_KEYS = /* @__PURE__ */ new Set(["version", "protocols"]);
+var ALLOWED_ENTRY_KEYS = /* @__PURE__ */ new Set(["source", "title"]);
+function expandTilde2(p) {
+  if (p === "~") return homedir5();
+  if (p.startsWith("~/")) return join7(homedir5(), p.slice(2));
+  return p;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadProtocolsConfig(configPath = DEFAULT_PROTOCOLS_CONFIG_PATH) {
+  let raw;
+  try {
+    raw = await readYamlFile4(configPath);
+  } catch (error) {
+    if (error instanceof Error && error.message === "YAML file not found") {
+      throw new Error(
+        "No protocols config at ~/.basou/protocols.yaml. Create one (a 'protocols:' list of source markdown paths) before running 'basou protocol sync'."
+      );
+    }
+    if (error instanceof Error && error.message === "Failed to parse YAML content") {
+      throw new Error("~/.basou/protocols.yaml is not valid YAML.");
+    }
+    throw error;
+  }
+  if (!isRecord2(raw) || !Array.isArray(raw.protocols)) {
+    throw new Error("~/.basou/protocols.yaml must contain a 'protocols:' list.");
+  }
+  for (const key of Object.keys(raw)) {
+    if (!ALLOWED_TOP_KEYS.has(key)) {
+      throw new Error(
+        `~/.basou/protocols.yaml has an unknown key '${key}' (allowed: version, protocols).`
+      );
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const entry of raw.protocols) {
+    if (!isRecord2(entry)) {
+      throw new Error("Each protocol entry must be a mapping with a 'source' key.");
+    }
+    for (const key of Object.keys(entry)) {
+      if (!ALLOWED_ENTRY_KEYS.has(key)) {
+        throw new Error(`A protocol entry has an unknown key '${key}' (allowed: source, title).`);
+      }
+    }
+    if (typeof entry.source !== "string" || entry.source.trim().length === 0) {
+      throw new Error("Each protocol entry needs a non-empty string 'source'.");
+    }
+    if (entry.title !== void 0 && (typeof entry.title !== "string" || entry.title.trim().length === 0)) {
+      throw new Error("A protocol entry 'title' must be a non-empty string when present.");
+    }
+    const expanded = expandTilde2(entry.source.trim());
+    if (!isAbsolute2(expanded)) {
+      throw new Error("Protocol 'source' paths must be absolute (or start with '~').");
+    }
+    const abs = resolve4(expanded);
+    if (seen.has(abs)) {
+      throw new Error("Duplicate protocol source (each source path may appear only once).");
+    }
+    seen.add(abs);
+    result.push(
+      entry.title !== void 0 ? { source: abs, title: entry.title.trim() } : { source: abs }
+    );
+  }
+  if (result.length === 0) {
+    throw new Error("~/.basou/protocols.yaml has no protocols.");
+  }
+  return result;
+}
+
 // src/commands/orient.ts
 import {
   assertBasouRootSafe as assertBasouRootSafe7,
-  basouPaths as basouPaths8,
+  basouPaths as basouPaths9,
   findErrorCode as findErrorCode6,
   renderOrientation as renderOrientation2,
   writeMarkdownFile as writeMarkdownFile4
 } from "@basou/core";
 
 // src/lib/hosts-config.ts
-import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute2, join as join7, resolve as resolve4 } from "path";
-import { readYamlFile as readYamlFile4 } from "@basou/core";
-var DEFAULT_HOSTS_CONFIG_PATH = join7(homedir5(), ".basou", "hosts.yaml");
-function expandTilde2(p) {
-  if (p === "~") return homedir5();
-  if (p.startsWith("~/")) return join7(homedir5(), p.slice(2));
+import { homedir as homedir6 } from "os";
+import { isAbsolute as isAbsolute3, join as join8, resolve as resolve5 } from "path";
+import { readYamlFile as readYamlFile5 } from "@basou/core";
+var DEFAULT_HOSTS_CONFIG_PATH = join8(homedir6(), ".basou", "hosts.yaml");
+function expandTilde3(p) {
+  if (p === "~") return homedir6();
+  if (p.startsWith("~/")) return join8(homedir6(), p.slice(2));
   return p;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function loadHostsConfig(configPath = DEFAULT_HOSTS_CONFIG_PATH) {
   let raw;
   try {
-    raw = await readYamlFile4(configPath);
+    raw = await readYamlFile5(configPath);
   } catch (error) {
     if (error instanceof Error && error.message === "YAML file not found") {
       return null;
@@ -2590,25 +2834,25 @@ async function loadHostsConfig(configPath = DEFAULT_HOSTS_CONFIG_PATH) {
     }
     throw error;
   }
-  if (!isRecord2(raw) || !Array.isArray(raw.hosts)) {
+  if (!isRecord3(raw) || !Array.isArray(raw.hosts)) {
     throw new Error("~/.basou/hosts.yaml must contain a 'hosts:' list.");
   }
   const seenPaths = /* @__PURE__ */ new Set();
   const seenLabels = /* @__PURE__ */ new Set();
   const result = [];
   for (const entry of raw.hosts) {
-    if (!isRecord2(entry) || typeof entry.label !== "string" || entry.label.trim().length === 0) {
+    if (!isRecord3(entry) || typeof entry.label !== "string" || entry.label.trim().length === 0) {
       throw new Error("Each host needs a non-empty string 'label'.");
     }
     const label = entry.label.trim();
     if (typeof entry.path !== "string" || entry.path.trim().length === 0) {
       throw new Error("Each host needs a non-empty string 'path'.");
     }
-    const expanded = expandTilde2(entry.path.trim());
-    if (!isAbsolute2(expanded)) {
+    const expanded = expandTilde3(entry.path.trim());
+    if (!isAbsolute3(expanded)) {
       throw new Error("Host paths must be absolute (or start with '~').");
     }
-    const abs = resolve4(expanded);
+    const abs = resolve5(expanded);
     if (seenPaths.has(abs)) continue;
     if (seenLabels.has(label)) {
       throw new Error(`Duplicate host label '${label}'; each host needs a distinct label.`);
@@ -2633,13 +2877,13 @@ import {
 // src/commands/import.ts
 import { createReadStream } from "fs";
 import { readdir, readFile as readFile2, rm, stat as stat3 } from "fs/promises";
-import { homedir as homedir6 } from "os";
-import { basename as basename4, dirname as dirname3, join as join8, resolve as resolve5 } from "path";
+import { homedir as homedir7 } from "os";
+import { basename as basename4, dirname as dirname3, join as join9, resolve as resolve6 } from "path";
 import { createInterface } from "readline";
 import {
   AGENT_INFRA_DIRS as AGENT_INFRA_DIRS2,
   assertBasouRootSafe as assertBasouRootSafe6,
-  basouPaths as basouPaths7,
+  basouPaths as basouPaths8,
   CLAUDE_IMPORT_SOURCE,
   CODEX_IMPORT_SOURCE,
   classifyFilesBySourceRoot as classifyFilesBySourceRoot2,
@@ -2651,7 +2895,7 @@ import {
   readManifest as readManifest4,
   readSessionYaml as readSessionYaml2,
   reimportPreservingId,
-  resolveRepositoryRoot as resolveRepositoryRoot6,
+  resolveRepositoryRoot as resolveRepositoryRoot5,
   SESSION_IMPORT_SCHEMA_VERSION,
   SessionImportPayloadSchema
 } from "@basou/core";
@@ -2705,10 +2949,10 @@ function resolveSourceRoots(args) {
   const { projectFlags, manifest, repoRoot, cwd } = args;
   let resolved;
   if (projectFlags.length > 0) {
-    resolved = projectFlags.map((p) => resolve5(cwd, p));
+    resolved = projectFlags.map((p) => resolve6(cwd, p));
   } else {
     const roots = manifest.import?.source_roots;
-    resolved = roots !== void 0 && roots.length > 0 ? roots.map((r) => resolve5(repoRoot, r)) : [repoRoot];
+    resolved = roots !== void 0 && roots.length > 0 ? roots.map((r) => resolve6(repoRoot, r)) : [repoRoot];
   }
   return [...new Set(resolved)];
 }
@@ -2721,7 +2965,7 @@ async function doRunImportClaudeCode(options, ctx) {
     repoRoot: repositoryRoot,
     cwd: ctx.cwd ?? process.cwd()
   });
-  const projectsRoot = ctx.claudeProjectsDir ?? join8(homedir6(), ".claude", "projects");
+  const projectsRoot = ctx.claudeProjectsDir ?? join9(homedir7(), ".claude", "projects");
   const files = await selectTranscriptFiles(projectsRoot, projectPaths, options);
   const projectSet = new Set(projectPaths);
   const candidates = files.map((file) => {
@@ -2760,7 +3004,7 @@ async function doRunImportCodex(options, ctx) {
     repoRoot: repositoryRoot,
     cwd: ctx.cwd ?? process.cwd()
   });
-  const sessionsRoot = ctx.codexSessionsDir ?? join8(homedir6(), ".codex", "sessions");
+  const sessionsRoot = ctx.codexSessionsDir ?? join9(homedir7(), ".codex", "sessions");
   const rollouts = await discoverCodexRollouts(sessionsRoot, projectPaths, options);
   const candidates = rollouts.map(({ file, externalId }) => ({
     externalId,
@@ -2798,7 +3042,7 @@ function assertSelector(options) {
 async function resolveImportTarget(ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForImport(cwd);
-  const paths = basouPaths7(repositoryRoot);
+  const paths = basouPaths8(repositoryRoot);
   await assertWorkspaceInitialized5(paths.root);
   const manifest = await readManifest4(paths);
   return { repositoryRoot, paths, manifest };
@@ -2841,7 +3085,9 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
       throw new Error("Invalid import payload", { cause: parsed.error });
     }
     if (parsed.data.schema_version !== SESSION_IMPORT_SCHEMA_VERSION) {
-      throw new Error(`Unsupported import schema_version: ${parsed.data.schema_version}`);
+      throw new Error(
+        `Unsupported import schema_version: ${parsed.data.schema_version} (expected ${SESSION_IMPORT_SCHEMA_VERSION}). The envelope's shape is published as @basou/core/schemas/session-import.schema.json; this version may move at a minor release, so a producer should read it from the installed @basou/core rather than pinning it.`
+      );
     }
     return parsed.data;
   };
@@ -2889,7 +3135,7 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
     if (priors.length > 0 && options.force === true) {
       if (options.dryRun !== true) {
         for (const { sessionId } of priors) {
-          await rm(join8(paths.sessions, sessionId), { recursive: true, force: true });
+          await rm(join9(paths.sessions, sessionId), { recursive: true, force: true });
         }
       }
       counts.replaced++;
@@ -3000,7 +3246,7 @@ async function selectTranscriptFiles(projectsRoot, projectPaths, options) {
   if (options.session !== void 0) {
     const matches = [];
     for (const projectPath of projectPaths) {
-      const file = join8(projectsRoot, encodeProjectDir(projectPath), `${options.session}.jsonl`);
+      const file = join9(projectsRoot, encodeProjectDir(projectPath), `${options.session}.jsonl`);
       if (await pathExists(file)) matches.push(file);
     }
     if (matches.length === 0) {
@@ -3011,7 +3257,7 @@ async function selectTranscriptFiles(projectsRoot, projectPaths, options) {
   const files = [];
   let anyDirFound = false;
   for (const projectPath of projectPaths) {
-    const transcriptDir = join8(projectsRoot, encodeProjectDir(projectPath));
+    const transcriptDir = join9(projectsRoot, encodeProjectDir(projectPath));
     let entries;
     try {
       entries = await readdir(transcriptDir);
@@ -3021,7 +3267,7 @@ async function selectTranscriptFiles(projectsRoot, projectPaths, options) {
     }
     anyDirFound = true;
     for (const name of entries) {
-      if (name.endsWith(".jsonl")) files.push(join8(transcriptDir, name));
+      if (name.endsWith(".jsonl")) files.push(join9(transcriptDir, name));
     }
   }
   if (!anyDirFound) {
@@ -3078,7 +3324,7 @@ async function findRolloutFiles(sessionsRoot) {
       throw new Error("Failed to read Codex sessions directory", { cause: error });
     }
     for (const entry of entries) {
-      const full = join8(dir, entry.name);
+      const full = join9(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full, false);
       } else if (entry.isFile() && entry.name.startsWith("rollout-") && entry.name.endsWith(".jsonl")) {
@@ -3234,7 +3480,7 @@ function shortId2(id) {
 }
 async function resolveRepositoryRootForImport(cwd) {
   try {
-    return await resolveRepositoryRoot6(cwd);
+    return await resolveRepositoryRoot5(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou import'.", {
@@ -3467,7 +3713,7 @@ async function warnIfPositionNamesOtherWorkspaces2(result, ctx) {
   });
   if (report !== null) {
     console.error(
-      positionForeignWorkspaceWarning(report, basouPaths8(result.workspaceRoot).files.orientation)
+      positionForeignWorkspaceWarning(report, basouPaths9(result.workspaceRoot).files.orientation)
     );
   }
 }
@@ -3477,7 +3723,7 @@ async function renderOrientationForCwd(options, ctx) {
   return renderOrientationForRoot(repositoryRoot, options, ctx, { write: true });
 }
 async function renderOrientationForRoot(repositoryRoot, options, ctx, behaviour) {
-  const paths = basouPaths8(repositoryRoot);
+  const paths = basouPaths9(repositoryRoot);
   await assertWorkspaceInitialized6(paths.root);
   const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const probeCtx = { cwd: repositoryRoot };
@@ -3491,7 +3737,7 @@ async function renderOrientationForRoot(repositoryRoot, options, ctx, behaviour)
   try {
     const hosts = await loadHostsConfig(ctx.hostsConfigPath);
     if (hosts !== null) {
-      federatedRoots = hosts.map((h) => ({ paths: basouPaths8(h.path), host: h.label }));
+      federatedRoots = hosts.map((h) => ({ paths: basouPaths9(h.path), host: h.label }));
     }
   } catch (error) {
     console.error(
@@ -3535,6 +3781,9 @@ async function assertWorkspaceInitialized6(basouRoot) {
 
 // src/commands/hook.ts
 var MAX_TRANSCRIPT_BYTES = 8 * 1024 * 1024;
+var MAX_TRANSCRIPT_HEAD_BYTES = 256 * 1024;
+var TOKEN_SCAN_CHUNK_BYTES = 1024 * 1024;
+var execFileAsync = promisify(execFile);
 function registerHookCommand(program) {
   const hook = program.command("hook").description(
     "Hook handlers for AI coding tools (Claude Code, Codex): read a hook payload on stdin, emit the tool's hook output on stdout"
@@ -3545,13 +3794,13 @@ function registerHookCommand(program) {
     await runHookSessionStart();
   });
   hook.command("stop").description(
-    "Stop-hook: when a substantive session recorded no decisions or next step, emit a non-blocking nudge to capture them. Reads the Stop hook JSON payload on stdin; never blocks and never fails the session."
+    "Stop-hook: when a substantive session recorded no decisions or next step, emit a non-blocking nudge to capture them. Also hands a running session the standing protocols when they changed after it started \u2014 the copy it read at start is stale, and only this hook reaches a session still running. Reads the Stop hook JSON payload on stdin; never blocks and never fails the session."
   ).option(
     "--min-edits <n>",
     `Minimum file edits before nudging on edits alone (default ${DEFAULT_STOP_HOOK_MIN_EDITS})`
   ).option(
     "--block",
-    "Opt-in enforcement: hold the agent in-turn (decision:block) instead of a non-blocking reminder"
+    "Opt-in enforcement: hold the agent in-turn (decision:block) instead of a non-blocking message"
   ).option(
     "--require-review",
     "Opt-in review gate: also remind when a session shipped substantive code (push / PR / merge) without recording a review"
@@ -3664,12 +3913,25 @@ gh pr create|merge) without recording a review ('basou review record'). This
 gate is off by default; when on, its reminder is composed into the same
 envelope as the capture reminder.
 
-By default the reminder is non-blocking: Claude sees it and may act on it or
-stop. With --block (opt-in enforcement, 'basou hook install --block') it instead
-returns decision:block, holding the agent in-turn to act on the reminder; the
-'stop_hook_active' flag and Claude Code's own loop prevention bound it to a
-single turn. Either way the hook fails open: a bad payload or unreadable
-transcript exits cleanly with no output.
+It also hands a RUNNING session the standing protocols when they changed after
+that session started. The protocol block in ~/.claude/CLAUDE.md is read at
+session start, so an update made mid-session never reaches the session it was
+meant to correct; this is the only channel that does. The complete current set
+is delivered, not a diff, so what it supersedes -- including a protocol that is
+no longer there -- is unambiguous. It reads the rendered block and nothing else,
+so an edit not yet published by 'basou protocol sync' cannot reach a session,
+and it delivers once per block state: a second update in the same session still
+lands, the same one twice does not. This part is always on, needs no flag, and
+says nothing at all unless the block actually changed.
+
+By default every message here is non-blocking: Claude sees it and may act on it
+or stop. With --block (opt-in enforcement, 'basou hook install --block') it
+instead returns decision:block, holding the agent in-turn; the 'stop_hook_active'
+flag and Claude Code's own loop prevention bound it to a single turn. Note that
+this covers the protocol delivery too, which carries no action to take -- with
+--block the turn is held so the new text lands before more work is done on the
+old. Either way the hook fails open: a bad payload or unreadable transcript
+exits cleanly with no output.
 `;
 async function runHookStop(options, ctx = {}) {
   try {
@@ -3707,7 +3969,12 @@ async function doRunHookStop(options, ctx) {
     stopHookActive: false,
     ...options.minEdits !== void 0 ? { minEdits: options.minEdits } : {}
   });
+  const protocolUpdate = await evaluateProtocolUpdateGate({
+    transcriptPath,
+    target: ctx.protocolTargetPath ?? DEFAULT_TARGET_PATH
+  });
   const parts = [];
+  if (protocolUpdate !== null) parts.push(protocolUpdate);
   if (evaluation.kind === "nudge") parts.push(evaluation.additionalContext);
   if (options.requireReview === true && evaluation.review.fires) {
     parts.push(evaluation.review.additionalContext);
@@ -3723,6 +3990,56 @@ async function doRunHookStop(options, ctx) {
   write(`${payloadJson}
 `);
 }
+async function evaluateProtocolUpdateGate(input) {
+  try {
+    const head = await readTranscriptHead(input.transcriptPath);
+    const sessionStartedAt = transcriptStartedAt(parseTranscript(head));
+    if (sessionStartedAt === void 0) return null;
+    const touchedAt = await targetModifiedAt(input.target);
+    if (touchedAt !== null && touchedAt <= Date.parse(sessionStartedAt)) return null;
+    const existing = await readMarkdownFile6(input.target);
+    if (existing === null) return null;
+    const section = parseMarkers2(existing, { start: PROTOCOL_START, end: PROTOCOL_END });
+    if (section.kind !== "ok") return null;
+    const stamp = parseProtocolStamp(section.generated);
+    if (stamp === null) return null;
+    if (!isProtocolUpdateDue({ stamp, sessionStartedAt })) return null;
+    const sections = protocolSectionsFrom(section.generated);
+    if (sections === null || sections.trim().length === 0) return null;
+    if (await transcriptCarries(input.transcriptPath, protocolUpdateToken(stamp.contentHash))) {
+      return null;
+    }
+    return renderProtocolUpdate(sections, stamp);
+  } catch {
+    return null;
+  }
+}
+async function targetModifiedAt(target) {
+  try {
+    return (await stat4(target)).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+async function transcriptCarries(path, token) {
+  const handle = await open2(path, "r");
+  try {
+    const overlap = Math.max(token.length - 1, 0);
+    const chunk = Buffer.alloc(TOKEN_SCAN_CHUNK_BYTES);
+    let carry = "";
+    let position = 0;
+    for (; ; ) {
+      const { bytesRead } = await handle.read(chunk, 0, TOKEN_SCAN_CHUNK_BYTES, position);
+      if (bytesRead === 0) return false;
+      position += bytesRead;
+      const text = carry + chunk.subarray(0, bytesRead).toString("utf8");
+      if (text.includes(token)) return true;
+      carry = overlap > 0 ? text.slice(-overlap) : "";
+    }
+  } finally {
+    await handle.close();
+  }
+}
 async function renderRegisteredWorkspacePosition(cwd, portfolioConfigPath = DEFAULT_PORTFOLIO_CONFIG_PATH) {
   const root = await resolveBasouRootForCommand(cwd, "hook session-start", {
     portfolioConfigPath
@@ -3822,11 +4139,25 @@ async function readTranscriptBounded(path, maxBytes = MAX_TRANSCRIPT_BYTES) {
     await handle.close();
   }
 }
+async function readTranscriptHead(path, maxBytes = MAX_TRANSCRIPT_HEAD_BYTES) {
+  const { size } = await stat4(path);
+  if (size <= maxBytes) return readFile3(path, "utf8");
+  const handle = await open2(path, "r");
+  try {
+    const buffer = Buffer.alloc(maxBytes);
+    const { bytesRead } = await handle.read(buffer, 0, maxBytes, 0);
+    const text = buffer.subarray(0, bytesRead).toString("utf8");
+    const lastNewline = text.lastIndexOf("\n");
+    return lastNewline >= 0 ? text.slice(0, lastNewline + 1) : text;
+  } finally {
+    await handle.close();
+  }
+}
 function parseMinEdits(raw) {
   if (raw === void 0 || !/^\d+$/.test(raw)) return void 0;
   return Number(raw);
 }
-var DEFAULT_CLAUDE_SETTINGS_PATH = join9(homedir7(), ".claude", "settings.json");
+var DEFAULT_CLAUDE_SETTINGS_PATH = join10(homedir8(), ".claude", "settings.json");
 function resolveCliEntry() {
   return fileURLToPath(import.meta.url);
 }
@@ -3984,13 +4315,97 @@ async function doRunHookStatus(options) {
     review: / --require-review\b/.test(command)
   });
   console.log(`basou Stop hook: registered, ${mode}.`);
+  await reportHookEntryBuild(command);
+}
+async function reportHookEntryBuild(command) {
+  console.log(`  this basou is: ${BASOU_VERSION_LINE}`);
+  const entry = extractHookEntryPath(command);
+  if (entry === void 0) {
+    console.log(
+      "  runs: (registered by alias, not by path) \u2014 which build that resolves to depends on the hook's PATH, so this cannot tell you."
+    );
+    return;
+  }
+  try {
+    const { stdout } = await execFileAsync(process.execPath, [entry, "--version"], {
+      timeout: 1e4
+    });
+    const reported = stdout.trim();
+    console.log(`  the hook runs: ${entry}`);
+    console.log(`  that build is: ${reported}`);
+    if (!reported.includes("(build ")) {
+      console.log(
+        "  note: that build predates build stamping, so what it reports is its package.json rather than itself \u2014 it cannot tell you which build it is. Update it (rebuild a source checkout, or reinstall the package) to find out."
+      );
+    }
+  } catch {
+    console.log(`  the hook runs: ${entry}`);
+    console.log(
+      "  that build is: could not be executed \u2014 the hook's wrapper fails open, so it is silently doing nothing."
+    );
+  }
+}
+function tokenizeShellCommand(command) {
+  const tokens = [];
+  let current = "";
+  let started = false;
+  let quote;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote === "'") {
+      if (ch === "'") quote = void 0;
+      else current += ch;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"') quote = void 0;
+      else if (ch === "\\" && i + 1 < command.length) current += command[++i];
+      else current += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      started = true;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < command.length) {
+      current += command[++i];
+      started = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (started) tokens.push(current);
+      current = "";
+      started = false;
+      continue;
+    }
+    current += ch;
+    started = true;
+  }
+  if (quote !== void 0) return void 0;
+  if (started) tokens.push(current);
+  return tokens;
+}
+function extractHookEntryPath(command) {
+  const tokens = tokenizeShellCommand(command);
+  if (tokens === void 0) return void 0;
+  let index = 0;
+  while (index < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[index])) index++;
+  const interpreter = tokens[index];
+  if (interpreter === void 0) return void 0;
+  const base = interpreter.replace(/\\/g, "/").split("/").pop() ?? "";
+  if (base !== "node" && base !== "node.exe") return void 0;
+  index++;
+  while (index < tokens.length && tokens[index].startsWith("-")) index++;
+  const entry = tokens[index];
+  return entry === void 0 || entry === "" ? void 0 : entry;
 }
 function describeHookMode(tiers) {
   const enforcement = tiers.block ? "blocking (opt-in enforcement)" : "advisory (non-blocking)";
   const gates = tiers.review ? "capture + review" : "capture";
   return `${enforcement}, ${gates}`;
 }
-var DEFAULT_CODEX_FACE_PATH = join9(homedir7(), ".codex", "AGENTS.md");
+var DEFAULT_CODEX_FACE_PATH = join10(homedir8(), ".codex", "AGENTS.md");
 var LEFTOVER_FACE_NOTE = (label) => `${label} still carries an orientation block rendered by an earlier basou (0.39 or before); every Codex session on this machine reads it. \`basou channel clear codex\` removes it.`;
 async function faceHasLeftoverOrientationBlock(facePath) {
   try {
@@ -4002,8 +4417,8 @@ async function faceHasLeftoverOrientationBlock(facePath) {
     return false;
   }
 }
-var DEFAULT_CODEX_HOOKS_PATH = join9(homedir7(), ".codex", "hooks.json");
-var DEFAULT_CODEX_CONFIG_PATH = join9(homedir7(), ".codex", "config.toml");
+var DEFAULT_CODEX_HOOKS_PATH = join10(homedir8(), ".codex", "hooks.json");
+var DEFAULT_CODEX_CONFIG_PATH = join10(homedir8(), ".codex", "config.toml");
 async function readHooksFile(path) {
   let raw;
   try {
@@ -4140,6 +4555,7 @@ async function doRunCodexHookStatus(options) {
   console.log(
     `basou Codex SessionStart hook: registered in ${hooksPath} (matcher: ${matcher}); speaks only for workspaces registered in ~/.basou/portfolio.yaml.`
   );
+  await reportHookEntryBuild(location.command);
   await reportCodexHookState(hooksPath, parsed, options);
 }
 async function codexHookTrustFor(hooksPath, location, configPath) {
@@ -4174,12 +4590,12 @@ async function codexHookTrustFor(hooksPath, location, configPath) {
 }
 
 // src/commands/init.ts
-import { basename as basename5, relative, resolve as resolve6 } from "path";
+import { basename as basename5, relative, resolve as resolve7 } from "path";
 import {
   appendBasouGitignore,
   createManifest,
   ensureBasouDirectory,
-  resolveRepositoryRoot as resolveRepositoryRoot7,
+  resolveRepositoryRoot as resolveRepositoryRoot6,
   writeManifest
 } from "@basou/core";
 function collectValue(value, previous) {
@@ -4219,7 +4635,7 @@ async function doRunInit(options, ctx) {
     );
   }
   const sourceRoots = (options.sourceRoot ?? []).map((p) => {
-    const rel = relative(repositoryRoot, resolve6(cwd, p));
+    const rel = relative(repositoryRoot, resolve7(cwd, p));
     return rel === "" ? "." : rel;
   });
   const paths = await ensureBasouDirectory(repositoryRoot);
@@ -4249,7 +4665,7 @@ function renderGitignoreWarning(error, verbose) {
 }
 async function resolveRepositoryRootForInit(cwd) {
   try {
-    return await resolveRepositoryRoot7(cwd);
+    return await resolveRepositoryRoot6(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou init'.", {
@@ -4265,14 +4681,15 @@ import {
   acquireLock as acquireLock4,
   appendEventToExistingSession as appendEventToExistingSession2,
   assertBasouRootSafe as assertBasouRootSafe8,
-  basouPaths as basouPaths9,
+  basouPaths as basouPaths10,
   createAdHocSessionWithEvent as createAdHocSessionWithEvent2,
   EVENT_SCHEMA_VERSION as EVENT_SCHEMA_VERSION4,
   findErrorCode as findErrorCode7,
+  LOCAL_CLI_EVENT_SOURCE as LOCAL_CLI_EVENT_SOURCE3,
   readManifest as readManifest5,
   resolveSessionId as resolveSessionId2
 } from "@basou/core";
-import { InvalidArgumentError as InvalidArgumentError2 } from "commander";
+import { InvalidArgumentError as InvalidArgumentError3 } from "commander";
 var NOTE_SUBCOMMAND_LOOKALIKES = /* @__PURE__ */ new Set([
   "list",
   "ls",
@@ -4319,7 +4736,7 @@ async function doRunNote(body, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "note");
-  const paths = basouPaths9(repositoryRoot);
+  const paths = basouPaths10(repositoryRoot);
   await assertWorkspaceInitialized7(paths.root);
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
   const occurredAt = now.toISOString();
@@ -4376,7 +4793,7 @@ function buildNoteEvent(input) {
     id: input.eventId,
     session_id: input.sessionId,
     occurred_at: input.occurredAt,
-    source: "local-cli",
+    source: LOCAL_CLI_EVENT_SOURCE3,
     type: "note_added",
     body: input.body,
     // `basou note` is the resume-hint command; mark it so orientation surfaces
@@ -4385,13 +4802,13 @@ function buildNoteEvent(input) {
   };
 }
 function buildAdHocLabel2(body) {
-  const oneLine2 = body.replace(/\s+/g, " ").trim();
-  const truncated = oneLine2.length > LABEL_BODY_MAX ? `${oneLine2.slice(0, LABEL_TRUNCATE_HEAD2)}...` : oneLine2;
+  const oneLine3 = body.replace(/\s+/g, " ").trim();
+  const truncated = oneLine3.length > LABEL_BODY_MAX ? `${oneLine3.slice(0, LABEL_TRUNCATE_HEAD2)}...` : oneLine3;
   return `Ad-hoc note: ${truncated}`;
 }
 function parseBody(raw) {
   if (raw.trim().length === 0) {
-    throw new InvalidArgumentError2("Note body must not be empty");
+    throw new InvalidArgumentError3("Note body must not be empty");
   }
   return raw;
 }
@@ -4428,7 +4845,7 @@ async function assertWorkspaceInitialized7(basouRoot) {
 
 // src/commands/portfolio.ts
 import { existsSync, statSync } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function registerPortfolioCommand(program) {
   program.command("portfolio").description(
     "List the workspaces you orient across (read-only): every planning master registered in ~/.basou/portfolio.yaml, with its path and whether it exists / is initialized. The headless text/JSON counterpart to the `basou view --portfolio` GUI \u2014 for discovering where a sibling project lives without opening a browser"
@@ -4474,7 +4891,7 @@ async function runPortfolioList(options, ctx = {}) {
 async function doRunPortfolioList(options, ctx) {
   const configPath = ctx.configPath ?? DEFAULT_PORTFOLIO_CONFIG_PATH;
   const pathExists2 = ctx.pathExists ?? ((p) => existsSync(p));
-  const isInitialized = ctx.isInitialized ?? ((p) => isDirectory(join10(p, ".basou")));
+  const isInitialized = ctx.isInitialized ?? ((p) => isDirectory(join11(p, ".basou")));
   const workspaces = await loadPortfolioConfig(configPath);
   const result = {
     configPath,
@@ -4539,10 +4956,10 @@ import {
   writeFileSync,
   writeSync
 } from "fs";
-import { basename as basename6, dirname as dirname4, isAbsolute as isAbsolute3, join as join11, relative as relative2, resolve as resolve7 } from "path";
+import { basename as basename6, dirname as dirname4, isAbsolute as isAbsolute4, join as join12, relative as relative2, resolve as resolve8 } from "path";
 import {
   appendBasouGitignore as appendBasouGitignore2,
-  basouPaths as basouPaths10,
+  basouPaths as basouPaths11,
   classifyRetrofit,
   createManifest as createManifest2,
   ensureBasouDirectory as ensureBasouDirectory2,
@@ -4564,7 +4981,7 @@ import {
   renderAnchorStarter,
   renderViewPresetBlock,
   renderWithMarkers as renderWithMarkers4,
-  resolveRepositoryRoot as resolveRepositoryRoot8,
+  resolveRepositoryRoot as resolveRepositoryRoot7,
   safeSimpleGit,
   seedMarkers,
   summarizePresetPlan,
@@ -4705,7 +5122,7 @@ function preservedUnknownLines(fields) {
 async function doRunProjectCheck(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project check");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = summarizeRosterDrift({
     ...manifest.repos !== void 0 ? { repos: manifest.repos } : {},
@@ -4840,7 +5257,7 @@ async function runProjectSync(options, ctx = {}) {
 async function doRunProjectSync(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project sync");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const hasRoster = manifest.repos !== void 0 && manifest.repos.length > 0;
   const reconcile = reconcileSourceRoots({
@@ -4914,19 +5331,19 @@ async function runProjectAdopt(options, ctx = {}) {
   }
 }
 function classifySourceRoot(repositoryRoot, declaredPath) {
-  const absolute = resolve7(repositoryRoot, declaredPath);
+  const absolute = resolve8(repositoryRoot, declaredPath);
   let real;
   try {
     real = realpathSync(absolute);
   } catch {
     return { path: declaredPath, kind: "unresolved" };
   }
-  return { path: declaredPath, kind: existsSync2(join11(real, ".git")) ? "repo" : "non-repo" };
+  return { path: declaredPath, kind: existsSync2(join12(real, ".git")) ? "repo" : "non-repo" };
 }
 async function doRunProjectAdopt(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project adopt");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const alreadyDeclared = manifest.repos !== void 0 && manifest.repos.length > 0;
   const candidates = effectiveSourceRoots(manifest).map(
@@ -5021,11 +5438,11 @@ async function gatherRepoWiring(repositoryRoot, entry) {
   };
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, entry.path));
+    real = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { ...base, reachable: false, instructionFiles: [] };
   }
-  if (!existsSync2(join11(real, ".git"))) {
+  if (!existsSync2(join12(real, ".git"))) {
     return { ...base, reachable: false, instructionFiles: [] };
   }
   try {
@@ -5033,7 +5450,7 @@ async function gatherRepoWiring(repositoryRoot, entry) {
     for (const name of INSTRUCTION_FILES) {
       let present = true;
       try {
-        lstatSync(join11(real, name));
+        lstatSync(join12(real, name));
       } catch {
         present = false;
       }
@@ -5048,7 +5465,7 @@ async function gatherRepoWiring(repositoryRoot, entry) {
 async function doRunProjectWiring(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project wiring");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = manifest.repos ?? [];
   const facts = [];
@@ -5140,14 +5557,14 @@ function gatherRepoGitignore(repositoryRoot, entry) {
   };
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, entry.path));
+    real = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { ...base, reachable: false, currentLines: [] };
   }
-  if (!existsSync2(join11(real, ".git"))) {
+  if (!existsSync2(join12(real, ".git"))) {
     return { ...base, reachable: false, currentLines: [] };
   }
-  return { ...base, reachable: true, currentLines: readGitignoreLines(join11(real, ".gitignore")) };
+  return { ...base, reachable: true, currentLines: readGitignoreLines(join12(real, ".gitignore")) };
 }
 function hasErrorCode(error) {
   return error instanceof Error && typeof error.code === "string";
@@ -5161,7 +5578,7 @@ function readGitignoreLines(file) {
   }
 }
 function applyGitignorePlan(repositoryRoot, plan) {
-  const file = join11(realpathSync(resolve7(repositoryRoot, plan.path)), ".gitignore");
+  const file = join12(realpathSync(resolve8(repositoryRoot, plan.path)), ".gitignore");
   let existing = "";
   try {
     existing = readFileSync(file, "utf8");
@@ -5181,7 +5598,7 @@ function applyGitignorePlan(repositoryRoot, plan) {
 async function doRunProjectGitignore(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project gitignore");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = manifest.repos ?? [];
   const facts = roster.map((entry) => gatherRepoGitignore(repositoryRoot, entry));
@@ -5296,12 +5713,12 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
   const base = { path: entry.path, ...isSelf ? { self: true } : {} };
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, entry.path));
+    real = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { ...base, isAnchor: false, reachable: false, canonicalPresent: false, files: [] };
   }
   if (real === anchorReal) {
-    const anchorCanonical = join11(real, CANONICAL_FILE);
+    const anchorCanonical = join12(real, CANONICAL_FILE);
     const anchorState = anchorCanonicalState(anchorCanonical);
     if (anchorState === "absent") {
       return { ...base, isAnchor: true, reachable: true, canonicalPresent: false, files: [] };
@@ -5321,7 +5738,7 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
       anchorCanonical,
       "self"
     ).map((spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(real, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(real, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -5338,16 +5755,16 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
       files: anchorFiles
     };
   }
-  if (!existsSync2(join11(real, ".git"))) {
+  if (!existsSync2(join12(real, ".git"))) {
     return { ...base, isAnchor: false, reachable: false, canonicalPresent: false, files: [] };
   }
-  const canonicalFile = isSelf ? join11(real, CANONICAL_FILE) : join11(anchorReal, "agents", basename6(real), CANONICAL_FILE);
+  const canonicalFile = isSelf ? join12(real, CANONICAL_FILE) : join12(anchorReal, "agents", basename6(real), CANONICAL_FILE);
   if (!existsSync2(canonicalFile)) {
     return { ...base, isAnchor: false, reachable: true, canonicalPresent: false, files: [] };
   }
   const files = expectedSymlinkTargets(real, canonicalFile, mode).map(
     (spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(real, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(real, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -5368,7 +5785,7 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
 function applySymlinkPlan(repositoryRoot, plan) {
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, plan.path));
+    real = realpathSync(resolve8(repositoryRoot, plan.path));
   } catch (error) {
     const message = failureReason(error);
     return { created: [], failed: plan.toCreate.map((c) => ({ file: c.name, message })) };
@@ -5376,7 +5793,7 @@ function applySymlinkPlan(repositoryRoot, plan) {
   const created = [];
   const failed = [];
   for (const { name, target } of plan.toCreate) {
-    const filePath = join11(real, name);
+    const filePath = join12(real, name);
     try {
       mkdirSync(dirname4(filePath), { recursive: true });
       symlinkSync(target, filePath);
@@ -5394,9 +5811,9 @@ function viewCanonicalCollision(repositoryRoot, roster, viewName) {
   for (const entry of roster) {
     let name;
     try {
-      name = basename6(realpathSync(resolve7(repositoryRoot, entry.path)));
+      name = basename6(realpathSync(resolve8(repositoryRoot, entry.path)));
     } catch {
-      name = basename6(resolve7(repositoryRoot, entry.path));
+      name = basename6(resolve8(repositoryRoot, entry.path));
     }
     if (name === viewName) return entry.path;
   }
@@ -5410,7 +5827,7 @@ function gatherViewSymlinks(repositoryRoot, anchorReal, roster, viewDir) {
   if (!existsSync2(canonicalFile)) return { kind: "missing-canonical", viewName };
   const files = expectedSymlinkTargets(viewDir, canonicalFile, "hub").map(
     (spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(viewDir, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(viewDir, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -5426,7 +5843,7 @@ function applyViewSymlinks(viewDir, files) {
   const failed = [];
   for (const f of files) {
     if (f.state !== "missing") continue;
-    const filePath = join11(viewDir, f.name);
+    const filePath = join12(viewDir, f.name);
     try {
       mkdirSync(dirname4(filePath), { recursive: true });
       symlinkSync(f.expectedTarget, filePath);
@@ -5440,7 +5857,7 @@ function applyViewSymlinks(viewDir, files) {
 async function doRunProjectSymlinks(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project symlinks");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = manifest.repos ?? [];
   const anchorReal = realpathSync(repositoryRoot);
@@ -5643,12 +6060,12 @@ async function runProjectWorkspace(options, ctx = {}) {
   }
 }
 function resolveViewDir(repositoryRoot, viewPath) {
-  const abs = resolve7(repositoryRoot, viewPath);
+  const abs = resolve8(repositoryRoot, viewPath);
   try {
     return realpathSync(abs);
   } catch {
     try {
-      return join11(realpathSync(dirname4(abs)), basename6(abs));
+      return join12(realpathSync(dirname4(abs)), basename6(abs));
     } catch {
       return abs;
     }
@@ -5657,7 +6074,7 @@ function resolveViewDir(repositoryRoot, viewPath) {
 function gatherViewRepo(repositoryRoot, viewDir, entry) {
   let repoReal;
   try {
-    repoReal = realpathSync(resolve7(repositoryRoot, entry.path));
+    repoReal = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { path: entry.path, reachable: false };
   }
@@ -5666,7 +6083,7 @@ function gatherViewRepo(repositoryRoot, viewDir, entry) {
     return { path: entry.path, reachable: false };
   }
   const linkName = basename6(repoReal);
-  const { state, actualTarget } = inspectSymlink(join11(viewDir, linkName), expectedTarget);
+  const { state, actualTarget } = inspectSymlink(join12(viewDir, linkName), expectedTarget);
   return {
     path: entry.path,
     reachable: true,
@@ -5680,7 +6097,7 @@ function applyViewPlan(viewDir, toCreate) {
   const created = [];
   const failed = [];
   for (const { name, target } of toCreate) {
-    const filePath = join11(viewDir, name);
+    const filePath = join12(viewDir, name);
     try {
       mkdirSync(dirname4(filePath), { recursive: true });
       symlinkSync(target, filePath);
@@ -5695,7 +6112,7 @@ var TOP_LEVEL_INSTRUCTION_FILES_LOWER = new Set(
   INSTRUCTION_FILES.filter((f) => !f.includes("/")).map((f) => f.toLowerCase())
 );
 function classifyViewLink(viewDir, name, rosterRealpaths) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   let isLink;
   try {
     isLink = lstatSync(filePath).isSymbolicLink();
@@ -5709,12 +6126,12 @@ function classifyViewLink(viewDir, name, rosterRealpaths) {
   } catch {
     return null;
   }
-  const resolved = isAbsolute3(target) ? target : resolve7(viewDir, target);
+  const resolved = isAbsolute4(target) ? target : resolve8(viewDir, target);
   try {
     if (rosterRealpaths.has(realpathSync(resolved))) return null;
   } catch {
   }
-  if (isAbsolute3(target)) return { target, kind: "absolute" };
+  if (isAbsolute4(target)) return { target, kind: "absolute" };
   let isDir = false;
   try {
     isDir = statSync2(resolved).isDirectory();
@@ -5724,7 +6141,7 @@ function classifyViewLink(viewDir, name, rosterRealpaths) {
   if (!isDir) {
     return { target, kind: existsSync2(resolved) ? "non-repo" : "broken" };
   }
-  return { target, kind: existsSync2(join11(resolved, ".git")) ? "repo" : "non-repo" };
+  return { target, kind: existsSync2(join12(resolved, ".git")) ? "repo" : "non-repo" };
 }
 function gatherExistingViewLinks(viewDir, rosterRealpaths) {
   let names;
@@ -5749,7 +6166,7 @@ function pruneViewLinks(viewDir, toPrune, rosterRealpaths) {
   const pruned = [];
   const failed = [];
   for (const { name } of toPrune) {
-    const filePath = join11(viewDir, name);
+    const filePath = join12(viewDir, name);
     const c = classifyViewLink(viewDir, name, rosterRealpaths);
     if (c === null || c.kind !== "repo") {
       failed.push({
@@ -5770,7 +6187,7 @@ function pruneViewLinks(viewDir, toPrune, rosterRealpaths) {
 async function doRunProjectWorkspace(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project workspace");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const viewPath = manifest.workspace.view;
   const roster = manifest.repos ?? [];
@@ -5795,11 +6212,11 @@ async function doRunProjectWorkspace(options, ctx) {
   } else {
     const viewDir = resolveViewDir(repositoryRoot, viewPath);
     const facts = roster.map((entry) => gatherViewRepo(repositoryRoot, viewDir, entry));
-    const rosterNames = roster.map((entry) => basename6(resolve7(repositoryRoot, entry.path)));
+    const rosterNames = roster.map((entry) => basename6(resolve8(repositoryRoot, entry.path)));
     const rosterRealpaths = /* @__PURE__ */ new Set();
     for (const entry of roster) {
       try {
-        rosterRealpaths.add(realpathSync(resolve7(repositoryRoot, entry.path)));
+        rosterRealpaths.add(realpathSync(resolve8(repositoryRoot, entry.path)));
       } catch {
       }
     }
@@ -5962,10 +6379,10 @@ async function runProjectPreset(options, ctx = {}) {
   }
 }
 function canonicalFileFor(anchorReal, canonicalName) {
-  return join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  return join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
 }
 function canonicalLabelFor(canonicalName) {
-  return join11("agents", canonicalName, CANONICAL_FILE);
+  return join12("agents", canonicalName, CANONICAL_FILE);
 }
 async function gatherRepoPreset(repositoryRoot, anchorReal, entry) {
   const declared = {
@@ -5979,14 +6396,14 @@ async function gatherRepoPreset(repositoryRoot, anchorReal, entry) {
   }
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, entry.path));
+    real = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { ...declared, isAnchor: false, reachable: false, canonicalPresent: false };
   }
   if (real === anchorReal) {
     return { ...declared, isAnchor: true, reachable: true, canonicalPresent: false };
   }
-  if (!existsSync2(join11(real, ".git"))) {
+  if (!existsSync2(join12(real, ".git"))) {
     return { ...declared, isAnchor: false, reachable: false, canonicalPresent: false };
   }
   const canonicalName = basename6(real);
@@ -6035,7 +6452,7 @@ function viewPresetReposFor(repositoryRoot, roster) {
     anchorReal = void 0;
   }
   return roster.map((entry) => {
-    const abs = resolve7(repositoryRoot, entry.path);
+    const abs = resolve8(repositoryRoot, entry.path);
     let real;
     try {
       real = realpathSync(abs);
@@ -6130,7 +6547,7 @@ function presetFailureReason(error) {
 async function doRunProjectPreset(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project preset");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = manifest.repos ?? [];
   const anchorReal = realpathSync(repositoryRoot);
@@ -6359,7 +6776,7 @@ function gatherArchiveTeardown(repositoryRoot, manifest, target) {
   };
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, target));
+    real = realpathSync(resolve8(repositoryRoot, target));
   } catch {
     return empty;
   }
@@ -6368,24 +6785,24 @@ function gatherArchiveTeardown(repositoryRoot, manifest, target) {
   const instructionFiles = [];
   for (const name of INSTRUCTION_FILES) {
     try {
-      lstatSync(join11(real, name));
+      lstatSync(join12(real, name));
       instructionFiles.push(name);
     } catch {
     }
   }
   let ignored;
   try {
-    ignored = new Set(readGitignoreLines(join11(real, ".gitignore")).map((l) => l.trim()));
+    ignored = new Set(readGitignoreLines(join12(real, ".gitignore")).map((l) => l.trim()));
   } catch {
     ignored = /* @__PURE__ */ new Set();
   }
   const gitignorePatterns = INSTRUCTION_FILES.filter((p) => ignored.has(p) || ignored.has(`/${p}`));
-  const canonical2 = existsSync2(join11(anchorReal, "agents", canonicalName, CANONICAL_FILE));
+  const canonical2 = existsSync2(join12(anchorReal, "agents", canonicalName, CANONICAL_FILE));
   let viewLink = false;
   const viewPath = manifest.workspace.view;
   if (viewPath !== void 0) {
     try {
-      lstatSync(join11(resolveViewDir(repositoryRoot, viewPath), canonicalName));
+      lstatSync(join12(resolveViewDir(repositoryRoot, viewPath), canonicalName));
       viewLink = true;
     } catch {
     }
@@ -6399,27 +6816,27 @@ function gatherArchiveTeardown(repositoryRoot, manifest, target) {
   };
 }
 function teardownExpectedTargets(repoReal, anchorReal, canonicalName) {
-  const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
   return expectedSymlinkTargets(repoReal, canonicalFile);
 }
 function viewLinkPointsAt(viewDir, name, repoReal) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   try {
     if (!lstatSync(filePath).isSymbolicLink()) return false;
     const target = readlinkSync(filePath);
-    if (isAbsolute3(target)) return false;
-    return realpathSync(resolve7(viewDir, target)) === repoReal;
+    if (isAbsolute4(target)) return false;
+    return realpathSync(resolve8(viewDir, target)) === repoReal;
   } catch {
     return false;
   }
 }
 function viewLinkPointsAtPath(viewDir, name, expectedRepoPath) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   try {
     if (!lstatSync(filePath).isSymbolicLink()) return false;
     const target = readlinkSync(filePath);
-    if (isAbsolute3(target)) return false;
-    return resolve7(viewDir, target) === expectedRepoPath;
+    if (isAbsolute4(target)) return false;
+    return resolve8(viewDir, target) === expectedRepoPath;
   } catch {
     return false;
   }
@@ -6428,19 +6845,19 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
   const anchorReal = realpathSync(repositoryRoot);
   let repoReal;
   try {
-    repoReal = realpathSync(resolve7(repositoryRoot, target));
+    repoReal = realpathSync(resolve8(repositoryRoot, target));
   } catch {
     repoReal = void 0;
   }
   const isAnchor = repoReal !== void 0 && repoReal === anchorReal;
-  const targetAbs = resolve7(repositoryRoot, target);
+  const targetAbs = resolve8(repositoryRoot, target);
   const canonicalName = basename6(repoReal ?? targetAbs);
   const roster = manifest.repos ?? [];
   const declaredEntry = roster.find((r) => {
     try {
-      return realpathSync(resolve7(repositoryRoot, r.path)) === (repoReal ?? "\0");
+      return realpathSync(resolve8(repositoryRoot, r.path)) === (repoReal ?? "\0");
     } catch {
-      return resolve7(repositoryRoot, r.path) === targetAbs;
+      return resolve8(repositoryRoot, r.path) === targetAbs;
     }
   });
   const inRoster = declaredEntry !== void 0;
@@ -6449,7 +6866,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
   const canonicalShared = roster.some((r) => {
     let rReal = null;
     try {
-      rReal = realpathSync(resolve7(repositoryRoot, r.path));
+      rReal = realpathSync(resolve8(repositoryRoot, r.path));
     } catch {
       rReal = null;
     }
@@ -6457,15 +6874,15 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
       if (repoReal !== void 0 && rReal === repoReal) return false;
       return basename6(rReal).toLowerCase() === cnFold;
     }
-    if (resolve7(repositoryRoot, r.path) === targetAbs) return false;
-    return basename6(resolve7(repositoryRoot, r.path)).toLowerCase() === cnFold;
+    if (resolve8(repositoryRoot, r.path) === targetAbs) return false;
+    return basename6(resolve8(repositoryRoot, r.path)).toLowerCase() === cnFold;
   });
   const collisionNote = "shared with another repo of the same basename, so it cannot be removed (check manually)";
   const items = [];
   if (!isAnchor) {
     if (repoReal !== void 0) {
       for (const spec of teardownExpectedTargets(repoReal, anchorReal, canonicalName)) {
-        const { state, actualTarget } = inspectSymlink(join11(repoReal, spec.name), spec.target);
+        const { state, actualTarget } = inspectSymlink(join12(repoReal, spec.name), spec.target);
         if (isSelf) {
           if (state !== "missing")
             items.push({
@@ -6502,7 +6919,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
       }
       let ignored;
       try {
-        ignored = new Set(readGitignoreLines(join11(repoReal, ".gitignore")).map((l) => l.trim()));
+        ignored = new Set(readGitignoreLines(join12(repoReal, ".gitignore")).map((l) => l.trim()));
         for (const p of INSTRUCTION_FILES) {
           if (ignored.has(p) || ignored.has(`/${p}`)) {
             items.push({
@@ -6525,7 +6942,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
     const viewPath = manifest.workspace.view;
     if (viewPath !== void 0) {
       const viewDir = resolveViewDir(repositoryRoot, viewPath);
-      const linkPath = join11(viewDir, canonicalName);
+      const linkPath = join12(viewDir, canonicalName);
       let isLink = false;
       try {
         isLink = lstatSync(linkPath).isSymbolicLink();
@@ -6551,8 +6968,8 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
         else items.push({ kind: "view-symlink", label: canonicalName, state: "removable" });
       }
     }
-    const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
-    const canonicalLabel = join11("agents", canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+    const canonicalLabel = join12("agents", canonicalName, CANONICAL_FILE);
     let canonicalIsLink = false;
     try {
       canonicalIsLink = lstatSync(canonicalFile).isSymbolicLink();
@@ -6639,7 +7056,7 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
   const changed = (label) => failed.push({ label, message: "the state changed since the scan (re-run)" });
   let currentRepoReal = null;
   try {
-    currentRepoReal = realpathSync(resolve7(repositoryRoot, plan.target));
+    currentRepoReal = realpathSync(resolve8(repositoryRoot, plan.target));
   } catch {
     currentRepoReal = null;
   }
@@ -6656,12 +7073,12 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
   );
   for (const item of removable.filter((i) => i.kind === "instruction-symlink")) {
     const expected = expectedByName.get(item.label);
-    if (repoReal === null || expected === void 0 || inspectSymlink(join11(repoReal, item.label), expected).state !== "correct") {
+    if (repoReal === null || expected === void 0 || inspectSymlink(join12(repoReal, item.label), expected).state !== "correct") {
       changed(item.label);
       continue;
     }
     try {
-      unlinkSync(join11(repoReal, item.label));
+      unlinkSync(join12(repoReal, item.label));
       removed.push(item.label);
     } catch (error) {
       failed.push({ label: item.label, message: failureReason(error) });
@@ -6674,13 +7091,13 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
       continue;
     }
     const viewDir = resolveViewDir(repositoryRoot, viewPath);
-    const owned = repoReal !== null ? viewLinkPointsAt(viewDir, item.label, repoReal) : viewLinkPointsAtPath(viewDir, item.label, resolve7(repositoryRoot, plan.target));
+    const owned = repoReal !== null ? viewLinkPointsAt(viewDir, item.label, repoReal) : viewLinkPointsAtPath(viewDir, item.label, resolve8(repositoryRoot, plan.target));
     if (!owned) {
       changed(item.label);
       continue;
     }
     try {
-      unlinkSync(join11(viewDir, item.label));
+      unlinkSync(join12(viewDir, item.label));
       removed.push(`view/${item.label}`);
     } catch (error) {
       failed.push({ label: `view/${item.label}`, message: failureReason(error) });
@@ -6688,7 +7105,7 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
   }
   const NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
   for (const item of removable.filter((i) => i.kind === "canonical-block")) {
-    const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
     try {
       if (lstatSync(canonicalFile).isSymbolicLink()) {
         changed(item.label);
@@ -6789,7 +7206,7 @@ function renderProjectTeardown(result) {
 async function doRunProjectTeardown(target, options, ctx = {}) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project teardown");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const plan = gatherRepoTeardown(repositoryRoot, manifest, target);
   const willApply = options.apply === true && !plan.isAnchor && plan.removableCount > 0;
@@ -6831,12 +7248,12 @@ function buildArchivedManifest(manifest, plan, updatedAt) {
 async function doRunProjectArchive(target, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project archive");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = manifest.repos ?? [];
   let targetIsAnchor = false;
   try {
-    targetIsAnchor = realpathSync(resolve7(repositoryRoot, target)) === realpathSync(repositoryRoot);
+    targetIsAnchor = realpathSync(resolve8(repositoryRoot, target)) === realpathSync(repositoryRoot);
   } catch {
     targetIsAnchor = false;
   }
@@ -6962,12 +7379,12 @@ function gatherRenameWiring(repositoryRoot, manifest, oldBasename) {
   } catch {
     return { canonicalDirOld: false, viewLinkOld: false };
   }
-  const canonicalDirOld = existsSync2(join11(anchorReal, "agents", oldBasename));
+  const canonicalDirOld = existsSync2(join12(anchorReal, "agents", oldBasename));
   let viewLinkOld = false;
   const viewPath = manifest.workspace.view;
   if (viewPath !== void 0) {
     try {
-      lstatSync(join11(resolveViewDir(repositoryRoot, viewPath), oldBasename));
+      lstatSync(join12(resolveViewDir(repositoryRoot, viewPath), oldBasename));
       viewLinkOld = true;
     } catch {
     }
@@ -6988,12 +7405,12 @@ function buildRenamedManifest(manifest, plan, updatedAt) {
 async function doRunProjectRename(oldPath, newPath, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project rename");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = manifest.repos ?? [];
   let oldIsAnchor = false;
   try {
-    oldIsAnchor = realpathSync(resolve7(repositoryRoot, oldPath)) === realpathSync(repositoryRoot);
+    oldIsAnchor = realpathSync(resolve8(repositoryRoot, oldPath)) === realpathSync(repositoryRoot);
   } catch {
     oldIsAnchor = false;
   }
@@ -7112,7 +7529,7 @@ async function runProjectNew(repos, options, ctx = {}) {
 }
 async function resolveRepositoryRootForNew(cwd) {
   try {
-    return await resolveRepositoryRoot8(cwd);
+    return await resolveRepositoryRoot7(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error(
@@ -7139,7 +7556,7 @@ async function doRunProjectNew(repos, options, ctx) {
   const viewStem = productName ?? workspaceName;
   const viewOverridesProjectName = productName !== void 0 && typeof options.view === "string";
   const declared = repos.map((p) => {
-    const abs = resolve7(cwd, p);
+    const abs = resolve8(cwd, p);
     let real;
     try {
       real = realpathSync(abs);
@@ -7164,7 +7581,7 @@ async function doRunProjectNew(repos, options, ctx) {
   const roster = rosterPaths.map((path) => ({ path }));
   const viewPath = options.view === false ? null : options.view ?? `../${viewStem}-workspace`;
   const sourceRoots = [...rosterPaths, ...viewPath !== null ? [viewPath] : []];
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const existed = existsSync2(paths.files.manifest);
   const manifest = createManifest2({
     workspaceName,
@@ -7275,7 +7692,7 @@ async function runProjectDerive(options, ctx = {}) {
 async function doRunProjectDerive(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project derive");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   if (manifest.repos === void 0 || manifest.repos.length === 0) {
     console.log(
@@ -7316,7 +7733,7 @@ async function doRunProjectDerive(options, ctx) {
 async function doRunProjectSeedAnchor(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project derive");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = manifest.repos ?? [];
   console.log("# Anchor instruction-file seed (the planning master's own AGENTS.md)");
@@ -7325,7 +7742,7 @@ async function doRunProjectSeedAnchor(options, ctx) {
     console.log("\u2139\uFE0F No repo roster declared \u2014 nothing to seed.");
     return;
   }
-  const anchorDoc = join11(repositoryRoot, CANONICAL_FILE);
+  const anchorDoc = join12(repositoryRoot, CANONICAL_FILE);
   if (pathPresent(anchorDoc)) {
     console.log(
       `\u2705 The anchor's own \`${CANONICAL_FILE}\` already exists \u2014 hand-maintained, left untouched.`
@@ -7387,7 +7804,7 @@ function regularFileSpokes(repoReal) {
   const out = [];
   for (const spoke of ["CLAUDE.md", ".github/copilot-instructions.md"]) {
     try {
-      const st = lstatSync(join11(repoReal, spoke));
+      const st = lstatSync(join12(repoReal, spoke));
       if (!st.isSymbolicLink() && st.isFile()) out.push(spoke);
     } catch {
     }
@@ -7402,9 +7819,9 @@ function pathPresent(p) {
     return false;
   }
 }
-function gatherRetrofit(repositoryRoot, anchorReal, roster, argPath, argAbs, argReal, viewCanonicalName) {
+function gatherRetrofit(repositoryRoot, anchorReal, roster, argAbs, argReal, viewCanonicalName) {
   const declaredEntry = roster.find((entry) => {
-    const entryAbs = resolve7(repositoryRoot, entry.path);
+    const entryAbs = resolve8(repositoryRoot, entry.path);
     if (argReal !== void 0) {
       try {
         if (realpathSync(entryAbs) === argReal) return true;
@@ -7433,8 +7850,8 @@ function gatherRetrofit(repositoryRoot, anchorReal, roster, argPath, argAbs, arg
     };
   }
   const isAnchor = argReal === anchorReal;
-  const reachable = existsSync2(join11(argReal, ".git"));
-  const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  const reachable = existsSync2(join12(argReal, ".git"));
+  const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
   return {
     path,
     declared,
@@ -7443,13 +7860,13 @@ function gatherRetrofit(repositoryRoot, anchorReal, roster, argPath, argAbs, arg
     reachable,
     canonicalName,
     ...viewCanonicalName !== void 0 ? { viewCanonicalName } : {},
-    agentsState: inspectAgentsState(join11(argReal, CANONICAL_FILE)),
+    agentsState: inspectAgentsState(join12(argReal, CANONICAL_FILE)),
     canonicalExists: pathPresent(canonicalFile),
     regularSpokes: regularFileSpokes(argReal)
   };
 }
 function relocateAgentsFile(repoReal, canonicalFile) {
-  const agentsFile = join11(repoReal, CANONICAL_FILE);
+  const agentsFile = join12(repoReal, CANONICAL_FILE);
   try {
     mkdirSync(dirname4(canonicalFile), { recursive: true });
   } catch (error) {
@@ -7510,7 +7927,7 @@ async function applyViewRetrofit(anchorReal, outcome) {
 async function doRunProjectRetrofit(repo, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "project retrofit");
-  const paths = basouPaths10(repositoryRoot);
+  const paths = basouPaths11(repositoryRoot);
   const manifest = await readManifest6(paths);
   const roster = manifest.repos ?? [];
   const anchorReal = realpathSync(repositoryRoot);
@@ -7544,7 +7961,7 @@ async function doRunProjectRetrofit(repo, options, ctx) {
     }
     return result2;
   }
-  const argAbs = resolve7(repositoryRoot, repo);
+  const argAbs = resolve8(repositoryRoot, repo);
   let argReal;
   try {
     argReal = realpathSync(argAbs);
@@ -7556,7 +7973,6 @@ async function doRunProjectRetrofit(repo, options, ctx) {
     repositoryRoot,
     anchorReal,
     roster,
-    repo,
     argAbs,
     argReal,
     viewCanonicalName
@@ -7566,7 +7982,7 @@ async function doRunProjectRetrofit(repo, options, ctx) {
   let failure;
   let partial = false;
   if (options.apply === true && plan.action === "relocate" && argReal !== void 0) {
-    const canonicalFile = join11(anchorReal, "agents", plan.canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", plan.canonicalName, CANONICAL_FILE);
     const res = relocateAgentsFile(argReal, canonicalFile);
     if (res.ok) {
       applied = true;
@@ -7766,88 +8182,19 @@ function renderProjectRetrofit(result) {
 }
 
 // src/commands/protocol.ts
-import { readFile as readFile4 } from "fs/promises";
-import { PROTOCOL_END, PROTOCOL_START, parseMarkers as parseMarkers4, readMarkdownFile as readMarkdownFile8 } from "@basou/core";
-
-// src/lib/protocols-config.ts
-import { homedir as homedir8 } from "os";
-import { isAbsolute as isAbsolute4, join as join12, resolve as resolve8 } from "path";
-import { readYamlFile as readYamlFile5 } from "@basou/core";
-var DEFAULT_PROTOCOLS_CONFIG_PATH = join12(homedir8(), ".basou", "protocols.yaml");
-var DEFAULT_TARGET_PATH = join12(homedir8(), ".claude", "CLAUDE.md");
-var ALLOWED_TOP_KEYS = /* @__PURE__ */ new Set(["version", "protocols"]);
-var ALLOWED_ENTRY_KEYS = /* @__PURE__ */ new Set(["source", "title"]);
-function expandTilde3(p) {
-  if (p === "~") return homedir8();
-  if (p.startsWith("~/")) return join12(homedir8(), p.slice(2));
-  return p;
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function loadProtocolsConfig(configPath = DEFAULT_PROTOCOLS_CONFIG_PATH) {
-  let raw;
-  try {
-    raw = await readYamlFile5(configPath);
-  } catch (error) {
-    if (error instanceof Error && error.message === "YAML file not found") {
-      throw new Error(
-        "No protocols config at ~/.basou/protocols.yaml. Create one (a 'protocols:' list of source markdown paths) before running 'basou protocol sync'."
-      );
-    }
-    if (error instanceof Error && error.message === "Failed to parse YAML content") {
-      throw new Error("~/.basou/protocols.yaml is not valid YAML.");
-    }
-    throw error;
-  }
-  if (!isRecord3(raw) || !Array.isArray(raw.protocols)) {
-    throw new Error("~/.basou/protocols.yaml must contain a 'protocols:' list.");
-  }
-  for (const key of Object.keys(raw)) {
-    if (!ALLOWED_TOP_KEYS.has(key)) {
-      throw new Error(
-        `~/.basou/protocols.yaml has an unknown key '${key}' (allowed: version, protocols).`
-      );
-    }
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const result = [];
-  for (const entry of raw.protocols) {
-    if (!isRecord3(entry)) {
-      throw new Error("Each protocol entry must be a mapping with a 'source' key.");
-    }
-    for (const key of Object.keys(entry)) {
-      if (!ALLOWED_ENTRY_KEYS.has(key)) {
-        throw new Error(`A protocol entry has an unknown key '${key}' (allowed: source, title).`);
-      }
-    }
-    if (typeof entry.source !== "string" || entry.source.trim().length === 0) {
-      throw new Error("Each protocol entry needs a non-empty string 'source'.");
-    }
-    if (entry.title !== void 0 && (typeof entry.title !== "string" || entry.title.trim().length === 0)) {
-      throw new Error("A protocol entry 'title' must be a non-empty string when present.");
-    }
-    const expanded = expandTilde3(entry.source.trim());
-    if (!isAbsolute4(expanded)) {
-      throw new Error("Protocol 'source' paths must be absolute (or start with '~').");
-    }
-    const abs = resolve8(expanded);
-    if (seen.has(abs)) {
-      throw new Error("Duplicate protocol source (each source path may appear only once).");
-    }
-    seen.add(abs);
-    result.push(
-      entry.title !== void 0 ? { source: abs, title: entry.title.trim() } : { source: abs }
-    );
-  }
-  if (result.length === 0) {
-    throw new Error("~/.basou/protocols.yaml has no protocols.");
-  }
-  return result;
-}
-
-// src/commands/protocol.ts
-var PROTOCOL_MARKERS = { start: PROTOCOL_START, end: PROTOCOL_END };
+import { readFile as readFile4, stat as stat5 } from "fs/promises";
+import {
+  carryForwardProtocolStamp,
+  PROTOCOL_END as PROTOCOL_END2,
+  PROTOCOL_START as PROTOCOL_START2,
+  parseMarkers as parseMarkers4,
+  parseProtocolStamp as parseProtocolStamp2,
+  protocolBlockHash,
+  readMarkdownFile as readMarkdownFile8,
+  renderProtocolStamp,
+  unstampedProtocolSectionsFrom
+} from "@basou/core";
+var PROTOCOL_MARKERS = { start: PROTOCOL_START2, end: PROTOCOL_END2 };
 var MANAGED_NOTE = "<!-- Managed by basou: 'basou protocol sync' regenerates everything between the BASOU:PROTOCOLS markers from ~/.basou/protocols.yaml. Manual edits inside the block are overwritten; edit the source files instead. -->";
 function registerProtocolCommand(program) {
   const protocol = program.command("protocol").description("Manage the basou-managed standing-protocol block in the global CLAUDE.md");
@@ -7907,24 +8254,54 @@ async function readProtocolSources(entries) {
   }
   return out;
 }
-function buildBlock(sources) {
-  const sections = sources.map(({ entry, content }) => {
+function buildSections(sources) {
+  return sources.map(({ entry, content }) => {
     const body = content.replace(/\s+$/, "");
     return entry.title !== void 0 ? `## ${entry.title}
 
 ${body}` : body;
-  });
+  }).join("\n\n");
+}
+function buildBlock(sections, stamp) {
   return `${MANAGED_NOTE}
+${renderProtocolStamp(stamp)}
 
-${sections.join("\n\n")}
+${sections}
 `;
 }
+async function readPreviousStamp(target) {
+  const existing = await readMarkdownFile8(target);
+  if (existing === null) return null;
+  const section = parseMarkers4(existing, PROTOCOL_MARKERS);
+  if (section.kind !== "ok") return null;
+  const stamp = parseProtocolStamp2(section.generated);
+  if (stamp !== null) return stamp;
+  const writtenAt = await lastWrittenAt(target);
+  if (writtenAt === null) return null;
+  return {
+    changedAt: writtenAt,
+    contentHash: protocolBlockHash(unstampedProtocolSectionsFrom(section.generated))
+  };
+}
+async function lastWrittenAt(target) {
+  try {
+    return new Date((await stat5(target)).mtimeMs).toISOString();
+  } catch {
+    return null;
+  }
+}
 async function doRunProtocolSync(options, ctx = {}) {
   const configPath = options.config ?? DEFAULT_PROTOCOLS_CONFIG_PATH;
   const target = options.target ?? DEFAULT_TARGET_PATH;
   const entries = await loadProtocolsConfig(configPath);
   const sources = await readProtocolSources(entries);
-  const block = buildBlock(sources);
+  const sections = buildSections(sources);
+  const stamp = carryForwardProtocolStamp({
+    sections,
+    previous: await readPreviousStamp(target),
+    now: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  const block = buildBlock(sections, stamp);
   const foreign = await findForeignWorkspaceNames({
     text: block,
     configPath: ctx.portfolioConfigPath
@@ -7987,14 +8364,14 @@ async function doRunProtocolUnsync(options) {
 // src/commands/refresh.ts
 import {
   assertBasouRootSafe as assertBasouRootSafe9,
-  basouPaths as basouPaths11,
+  basouPaths as basouPaths12,
   findErrorCode as findErrorCode9,
   readManifest as readManifest7
 } from "@basou/core";
-import { InvalidArgumentError as InvalidArgumentError3 } from "commander";
+import { InvalidArgumentError as InvalidArgumentError4 } from "commander";
 
 // src/commands/refresh-watch.ts
-import { readdir as readdir2, stat as stat5 } from "fs/promises";
+import { readdir as readdir2, stat as stat6 } from "fs/promises";
 import { homedir as homedir9 } from "os";
 import { join as join13 } from "path";
 import { findErrorCode as findErrorCode8 } from "@basou/core";
@@ -8023,7 +8400,7 @@ async function scanSourceLogs(roots) {
         await walk(full);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         try {
-          const info = await stat5(full);
+          const info = await stat6(full);
           out.set(full, { mtimeMs: info.mtimeMs, size: info.size });
         } catch (error) {
           if (findErrorCode8(error, "ENOENT")) continue;
@@ -8118,7 +8495,7 @@ function collectPath2(value, previous) {
 function parseInterval(value) {
   const seconds = Number(value);
   if (!Number.isInteger(seconds) || seconds < MIN_WATCH_INTERVAL_SEC || seconds > MAX_WATCH_INTERVAL_SEC) {
-    throw new InvalidArgumentError3(
+    throw new InvalidArgumentError4(
       `--interval must be an integer between ${MIN_WATCH_INTERVAL_SEC} and ${MAX_WATCH_INTERVAL_SEC} (seconds).`
     );
   }
@@ -8229,7 +8606,7 @@ async function doRunRefreshWatch(options, ctx) {
   if (options.force === true) throw new Error("--watch cannot be combined with --force.");
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "refresh");
-  const paths = basouPaths11(repositoryRoot);
+  const paths = basouPaths12(repositoryRoot);
   await assertWorkspaceInitialized8(paths.root);
   const intervalMs = (options.interval ?? DEFAULT_WATCH_INTERVAL_SEC) * 1e3;
   const controller = new AbortController();
@@ -8257,7 +8634,7 @@ async function doRunRefreshWatch(options, ctx) {
 async function computeRefresh(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "refresh");
-  const paths = basouPaths11(repositoryRoot);
+  const paths = basouPaths12(repositoryRoot);
   await assertWorkspaceInitialized8(paths.root);
   const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const result = await refreshAll({
@@ -8366,10 +8743,10 @@ async function assertWorkspaceInitialized8(basouRoot) {
 import { isAbsolute as isAbsolute5, resolve as resolve9 } from "path";
 import {
   assertBasouRootSafe as assertBasouRootSafe10,
-  basouPaths as basouPaths12,
+  basouPaths as basouPaths13,
   findErrorCode as findErrorCode10,
   renderReport,
-  resolveRepositoryRoot as resolveRepositoryRoot9,
+  resolveRepositoryRoot as resolveRepositoryRoot8,
   writeMarkdownFile as writeMarkdownFile6
 } from "@basou/core";
 function registerReportCommand(program) {
@@ -8391,7 +8768,7 @@ async function runReportGenerate(options, ctx = {}) {
 async function doRunReportGenerate(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForReport(cwd);
-  const paths = basouPaths12(repositoryRoot);
+  const paths = basouPaths13(repositoryRoot);
   await assertWorkspaceInitialized9(paths.root);
   const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const result = await renderReport({
@@ -8418,7 +8795,7 @@ async function doRunReportGenerate(options, ctx) {
 }
 async function resolveRepositoryRootForReport(cwd) {
   try {
-    return await resolveRepositoryRoot9(cwd);
+    return await resolveRepositoryRoot8(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error(
@@ -8446,7 +8823,7 @@ import { homedir as homedir10 } from "os";
 import { resolve as resolve10 } from "path";
 import {
   assertBasouRootSafe as assertBasouRootSafe11,
-  basouPaths as basouPaths13,
+  basouPaths as basouPaths14,
   buildReviewRecordedEvent,
   buildReviewRecordLabel,
   createAdHocSessionWithEvent as createAdHocSessionWithEvent3,
@@ -8528,7 +8905,7 @@ async function runReviewRecord(options, ctx = {}) {
 async function doRunReviewRecord(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "review record");
-  const paths = basouPaths13(repositoryRoot);
+  const paths = basouPaths14(repositoryRoot);
   await assertWorkspaceInitialized10(paths.root);
   const raw = await readReviewInput(options, ctx);
   const review = parseReviewRecordInput(raw);
@@ -8675,17 +9052,17 @@ async function assertWorkspaceInitialized10(basouRoot) {
 
 // src/commands/review-gaps.ts
 import {
-  basouPaths as basouPaths14,
+  basouPaths as basouPaths15,
   findReviewGaps
 } from "@basou/core";
-import { InvalidArgumentError as InvalidArgumentError4 } from "commander";
+import { InvalidArgumentError as InvalidArgumentError5 } from "commander";
 function collectRepo(value, previous) {
   return [...previous, value];
 }
 function parseWindow(value) {
   const hours = Number(value);
   if (!Number.isInteger(hours) || hours <= 0) {
-    throw new InvalidArgumentError4("--window must be a positive integer (hours).");
+    throw new InvalidArgumentError5("--window must be a positive integer (hours).");
   }
   return hours;
 }
@@ -8716,7 +9093,7 @@ async function runReviewGaps(options, ctx = {}) {
 async function doRunReviewGaps(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveBasouRootForCommand(cwd, "review-gaps");
-  const paths = basouPaths14(repositoryRoot);
+  const paths = basouPaths15(repositoryRoot);
   const nowIso = (ctx.nowProvider?.() ?? /* @__PURE__ */ new Date()).toISOString();
   const summary = await findReviewGaps({
     paths,
@@ -8733,7 +9110,7 @@ async function doRunReviewGaps(options, ctx) {
   }
   return summary;
 }
-function relAge(iso, now) {
+function relAge2(iso, now) {
   if (iso === null) return "(unknown)";
   const ms = now.getTime() - Date.parse(iso);
   if (!Number.isFinite(ms) || ms < 0) return "just now";
@@ -8746,11 +9123,11 @@ function relAge(iso, now) {
 function flatten(value) {
   return value.replace(/\s+/gu, " ").trim();
 }
-var GRAPHEMES = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+var GRAPHEMES2 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
 function graphemes(value) {
-  return [...GRAPHEMES.segment(value)].map((s) => s.segment);
+  return [...GRAPHEMES2.segment(value)].map((s) => s.segment);
 }
-function oneLine(value, max) {
+function oneLine2(value, max) {
   const flat = graphemes(flatten(value));
   return flat.length > max ? `${flat.slice(0, max - 1).join("")}\u2026` : flat.join("");
 }
@@ -8763,7 +9140,7 @@ var SELF_REPORTS_SHOWN = 3;
 function selfReportSuffix(u, stillCounted) {
   if (u.selfReports.length === 0) return "";
   const parts = u.selfReports.slice(0, SELF_REPORTS_SHOWN).map(
-    (r) => `${oneLine(r.reviewer, 40)}${claimedCommits(r.commits)}${r.recordedAfterCommit ? " (recorded after the commit)" : ""}`
+    (r) => `${oneLine2(r.reviewer, 40)}${claimedCommits(r.commits)}${r.recordedAfterCommit ? " (recorded after the commit)" : ""}`
   );
   const rest = u.selfReports.length - parts.length;
   if (rest > 0) parts.push(`+${rest} more`);
@@ -8776,7 +9153,7 @@ function unobservedOutcomeSuffix(u) {
   return ` \xB7 ${scope}exited with no recorded status \u2014 landing assumed, not observed`;
 }
 function unitLine(u, now) {
-  const when = relAge(u.lastCommitAt, now);
+  const when = relAge2(u.lastCommitAt, now);
   const head = `- ${u.repo} ${when} (${u.commitCount} commit${u.commitCount === 1 ? "" : "s"})`;
   if (u.verdict === "near_unbound") {
     const ids = u.reviews.map((r) => r.sessionId.slice(0, 14)).join(", ");
@@ -8785,7 +9162,7 @@ function unitLine(u, now) {
   return `${head} \u2014 no bound cross-model review${selfReportSuffix(u, true)}${unobservedOutcomeSuffix(u)}`;
 }
 function candidateLine(u, now) {
-  const when = relAge(u.lastCommitAt, now);
+  const when = relAge2(u.lastCommitAt, now);
   const cite = u.reviews.map((r) => `${r.sessionId.slice(0, 14)}${r.examinedDiff ? "(diff)" : ""}`).join(", ");
   return `- ${u.repo} ${when} (${u.commitCount} commit${u.commitCount === 1 ? "" : "s"}) \u2014 review trace: ${cite}${selfReportSuffix(u, false)}${unobservedOutcomeSuffix(u)}`;
 }
@@ -8821,7 +9198,7 @@ function renderReviewGaps(summary) {
     );
     for (const u of summary.unknowns) {
       lines.push(
-        `- ${relAge(u.lastCommitAt, now)} (${u.commitCount} commit${u.commitCount === 1 ? "" : "s"}) [${u.sessionId}]`
+        `- ${relAge2(u.lastCommitAt, now)} (${u.commitCount} commit${u.commitCount === 1 ? "" : "s"}) [${u.sessionId}]`
       );
     }
     lines.push("");
@@ -8834,7 +9211,7 @@ function renderReviewGaps(summary) {
   }
   lines.push("");
   lines.push(
-    `Note: read-only advisory. Only captured commits are in scope (newest captured commit: ${summary.newestCommitAt === null ? "none" : relAge(summary.newestCommitAt, now)}). It never auto-judges that a review "happened", and temporal proximity alone is not a pass. It does not enforce.`
+    `Note: read-only advisory. Only captured commits are in scope (newest captured commit: ${summary.newestCommitAt === null ? "none" : relAge2(summary.newestCommitAt, now)}). It never auto-judges that a review "happened", and temporal proximity alone is not a pass. It does not enforce.`
   );
   if (summary.gaps.some((u) => u.selfReports.length > 0)) {
     lines.push(
@@ -8884,7 +9261,7 @@ import { join as join14 } from "path";
 import {
   acquireLock as acquireLock5,
   assertBasouRootSafe as assertBasouRootSafe12,
-  basouPaths as basouPaths15,
+  basouPaths as basouPaths16,
   ChildProcessRunner as ChildProcessRunner2,
   claudeCodeAdapterMetadata,
   codexAdapterMetadata,
@@ -8900,7 +9277,8 @@ import {
   readYamlFile as readYamlFile6,
   resolveClaudeCodeCommand,
   resolveCodexCommand,
-  resolveRepositoryRoot as resolveRepositoryRoot10,
+  resolveRepositoryRoot as resolveRepositoryRoot9,
+  SESSION_SCHEMA_VERSION as SESSION_SCHEMA_VERSION2,
   SessionSchema as SessionSchema2,
   sanitizeRelatedFiles,
   sanitizeWorkingDirectory as sanitizeWorkingDirectory2,
@@ -8955,7 +9333,7 @@ async function runTrackedTool(args, options, ctx, adapter) {
   const childArgs = adapter.transformArgs ? adapter.transformArgs(args) : args;
   const cwd = options.cwd ?? process.cwd();
   const repoRoot = await resolveRepositoryRootForRun(cwd);
-  const paths = basouPaths15(repoRoot);
+  const paths = basouPaths16(repoRoot);
   await assertBasouRootSafe12(paths.root);
   const manifest = await readManifest9(paths);
   const sessionId = prefixedUlid4("ses");
@@ -9239,7 +9617,7 @@ function normalizeFileChangedSkipMessage(error) {
 function buildInitialSession2(input) {
   const cmdline = [input.command, ...input.args].join(" ");
   return {
-    schema_version: "0.1.0",
+    schema_version: SESSION_SCHEMA_VERSION2,
     session: {
       id: input.id,
       label: `basou run ${cmdline} (${input.startedAt})`,
@@ -9310,7 +9688,7 @@ async function finalizeSessionAsFailed2(paths, sessionDir, sessionId, appendEven
 }
 async function resolveRepositoryRootForRun(cwd) {
   try {
-    return await resolveRepositoryRoot10(cwd);
+    return await resolveRepositoryRoot9(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou run'.", {
@@ -9344,11 +9722,12 @@ import {
   acquireLock as acquireLock6,
   appendEventToExistingSession as appendEventToExistingSession3,
   assertBasouRootSafe as assertBasouRootSafe13,
-  basouPaths as basouPaths16,
+  basouPaths as basouPaths17,
   EVENT_SCHEMA_VERSION as EVENT_SCHEMA_VERSION6,
   enumerateSessionDirs as enumerateSessionDirs2,
   findErrorCode as findErrorCode12,
   importSessionFromJson as importSessionFromJson2,
+  LOCAL_CLI_EVENT_SOURCE as LOCAL_CLI_EVENT_SOURCE4,
   loadSessionEntries as loadSessionEntries2,
   readAllEvents,
   readManifest as readManifest10,
@@ -9363,7 +9742,7 @@ import {
   SessionStatusSchema,
   sessionWorkStatsFromEvents
 } from "@basou/core";
-import { InvalidArgumentError as InvalidArgumentError5 } from "commander";
+import { InvalidArgumentError as InvalidArgumentError6 } from "commander";
 
 // src/lib/format-duration.ts
 import { formatDurationMs } from "@basou/core";
@@ -9412,7 +9791,7 @@ async function runSessionList(options, ctx = {}) {
 async function doRunSessionList(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "list");
-  const paths = basouPaths16(repositoryRoot);
+  const paths = basouPaths17(repositoryRoot);
   await assertWorkspaceInitialized11(paths.root);
   const now = /* @__PURE__ */ new Date();
   const records = (await loadSessionEntries2(paths, {
@@ -9464,7 +9843,7 @@ async function runSessionShow(idInput, options, ctx = {}) {
 async function doRunSessionShow(idInput, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "show");
-  const paths = basouPaths16(repositoryRoot);
+  const paths = basouPaths17(repositoryRoot);
   await assertWorkspaceInitialized11(paths.root);
   const sessionId = await resolveSessionId3(paths, idInput);
   const sessionDir = join15(paths.sessions, sessionId);
@@ -9776,7 +10155,7 @@ async function runSessionImport(options, ctx = {}) {
 async function doRunSessionImport(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "import");
-  const paths = basouPaths16(repositoryRoot);
+  const paths = basouPaths17(repositoryRoot);
   await assertWorkspaceInitialized11(paths.root);
   const manifest = await readManifest10(paths);
   const rawBody = await readInputFile(options.from);
@@ -9786,7 +10165,9 @@ async function doRunSessionImport(options, ctx) {
     throw new Error("Invalid import payload", { cause: parsed.error });
   }
   if (parsed.data.schema_version !== SESSION_IMPORT_SCHEMA_VERSION2) {
-    throw new Error(`Unsupported import schema_version: ${parsed.data.schema_version}`);
+    throw new Error(
+      `Unsupported import schema_version: ${parsed.data.schema_version} (expected ${SESSION_IMPORT_SCHEMA_VERSION2}). The envelope's shape is published as @basou/core/schemas/session-import.schema.json; this version may move at a minor release, so a producer should read it from the installed @basou/core rather than pinning it.`
+    );
   }
   const importOptions2 = { dryRun: options.dryRun === true };
   if (options.label !== void 0) importOptions2.labelOverride = options.label;
@@ -9825,19 +10206,19 @@ function parseJsonStrict(body) {
 }
 function parseImportFormat(raw) {
   if (raw !== "json") {
-    throw new InvalidArgumentError5(`Unsupported format: ${raw}. Valid values: json`);
+    throw new InvalidArgumentError6(`Unsupported format: ${raw}. Valid values: json`);
   }
   return "json";
 }
 function parseLabelOverride(raw) {
   if (raw.length === 0) {
-    throw new InvalidArgumentError5("Label must not be empty");
+    throw new InvalidArgumentError6("Label must not be empty");
   }
   return raw;
 }
 function parseTaskIdOverride(raw) {
   if (raw.length === 0) {
-    throw new InvalidArgumentError5("Task id is empty");
+    throw new InvalidArgumentError6("Task id is empty");
   }
   return raw;
 }
@@ -9890,7 +10271,7 @@ async function doRunSessionNote(sessionIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "note");
-  const paths = basouPaths16(repositoryRoot);
+  const paths = basouPaths17(repositoryRoot);
   await assertWorkspaceInitialized11(paths.root);
   const sessionId = await resolveSessionId3(paths, sessionIdInput);
   const body = hasBody ? options.body : await readNoteFile(options.fromFile);
@@ -9910,7 +10291,7 @@ async function doRunSessionNote(sessionIdInput, options, ctx) {
         id: eventId,
         session_id: sesId,
         occurred_at: occurredAt,
-        source: "local-cli",
+        source: LOCAL_CLI_EVENT_SOURCE4,
         type: "note_added",
         body
       })
@@ -9935,7 +10316,7 @@ async function readNoteFile(path) {
 }
 function parseNoteBodyOption(raw) {
   if (raw.length === 0) {
-    throw new InvalidArgumentError5("--body must not be empty");
+    throw new InvalidArgumentError6("--body must not be empty");
   }
   return raw;
 }
@@ -9972,7 +10353,7 @@ async function doRunSessionRechain(options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForSession(cwd, "rechain");
-  const paths = basouPaths16(repositoryRoot);
+  const paths = basouPaths17(repositoryRoot);
   await assertWorkspaceInitialized11(paths.root);
   const sessionIds = options.session !== void 0 ? [await resolveSessionId3(paths, options.session)] : await enumerateSessionDirs2(paths);
   const dryRun = options.dryRun === true;
@@ -10027,10 +10408,10 @@ function renderRechainRow(row, dryRun) {
 // src/commands/stats.ts
 import {
   assertBasouRootSafe as assertBasouRootSafe14,
-  basouPaths as basouPaths17,
+  basouPaths as basouPaths18,
   computeWorkStats,
   findErrorCode as findErrorCode13,
-  resolveRepositoryRoot as resolveRepositoryRoot11
+  resolveRepositoryRoot as resolveRepositoryRoot10
 } from "@basou/core";
 function registerStatsCommand(program) {
   program.command("stats").description("Report how much the AI worked (output volume + time proxies) across sessions").option("--by-source", "Break the totals down by session source kind").option("--by-day", "Break billable time and volume down by calendar day").option("--json", "Output the full stats as JSON").option("-v, --verbose", "Show error causes").action(async (options) => {
@@ -10048,7 +10429,7 @@ async function runStats(options, ctx = {}) {
 async function doRunStats(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForStats(cwd);
-  const paths = basouPaths17(repositoryRoot);
+  const paths = basouPaths18(repositoryRoot);
   await assertWorkspaceInitialized12(paths.root);
   const now = ctx.nowProvider?.() ?? /* @__PURE__ */ new Date();
   const result = await computeWorkStats({
@@ -10137,7 +10518,7 @@ function formatInt(n) {
 }
 async function resolveRepositoryRootForStats(cwd) {
   try {
-    return await resolveRepositoryRoot11(cwd);
+    return await resolveRepositoryRoot10(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou stats'.", {
@@ -10161,11 +10542,11 @@ async function assertWorkspaceInitialized12(basouRoot) {
 // src/commands/status.ts
 import {
   assertBasouRootSafe as assertBasouRootSafe15,
-  basouPaths as basouPaths18,
+  basouPaths as basouPaths19,
   buildStatusSnapshot,
   findErrorCode as findErrorCode14,
   readManifest as readManifest11,
-  resolveRepositoryRoot as resolveRepositoryRoot12,
+  resolveRepositoryRoot as resolveRepositoryRoot11,
   writeStatus
 } from "@basou/core";
 function registerStatusCommand(program) {
@@ -10184,7 +10565,7 @@ async function runStatus(options, ctx = {}) {
 async function doRunStatus(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForStatus(cwd);
-  const paths = basouPaths18(repositoryRoot);
+  const paths = basouPaths19(repositoryRoot);
   try {
     await assertBasouRootSafe15(paths.root);
   } catch (error) {
@@ -10223,7 +10604,7 @@ function renderTextStatus(s) {
 }
 async function resolveRepositoryRootForStatus(cwd) {
   try {
-    return await resolveRepositoryRoot12(cwd);
+    return await resolveRepositoryRoot11(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou status'.", {
@@ -10252,7 +10633,7 @@ import { join as join16 } from "path";
 import {
   archiveTask,
   assertBasouRootSafe as assertBasouRootSafe16,
-  basouPaths as basouPaths19,
+  basouPaths as basouPaths20,
   createTaskWithEvent,
   deleteTask,
   editTask,
@@ -10274,7 +10655,7 @@ import {
   TaskWriteAfterEventError,
   updateTaskStatusWithEvent
 } from "@basou/core";
-import { InvalidArgumentError as InvalidArgumentError6 } from "commander";
+import { InvalidArgumentError as InvalidArgumentError7 } from "commander";
 var STATUS_VALUES3 = TaskStatusSchema.options;
 function registerTaskCommand(program) {
   const task = program.command("task").description("Manage Basou tasks (purpose units that span sessions)");
@@ -10353,7 +10734,7 @@ async function doRunTaskNew(options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "new");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const description = options.description !== void 0 ? options.description : options.fromFile !== void 0 ? await readDescriptionFile(options.fromFile) : "";
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
@@ -10462,7 +10843,7 @@ async function runTaskList(options, ctx = {}) {
 async function doRunTaskList(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "list");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const entries = await loadTaskEntries(paths, {
     onSkip: (id, reason) => printTaskSkip(id, reason)
@@ -10566,7 +10947,7 @@ async function runTaskShow(idInput, options, ctx = {}) {
 async function doRunTaskShow(idInput, options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "show");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const taskId = await resolveTaskId2(paths, idInput, { includeArchived: true });
   const { doc, archived } = await readTaskFileWithArchiveFallback(paths, taskId);
@@ -10710,7 +11091,7 @@ async function doRunTaskStatus(taskIdInput, newStatusInput, options, ctx) {
   const newStatus = parseTaskStatusPositional(newStatusInput);
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "status");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const taskId = await resolveTaskId2(paths, taskIdInput);
   const now = ctx.nowProvider !== void 0 ? ctx.nowProvider() : /* @__PURE__ */ new Date();
@@ -10787,7 +11168,7 @@ async function runTaskReconcile(options, ctx = {}) {
 async function doRunTaskReconcile(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "reconcile");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const manifest = await readManifest12(paths);
   const nowProvider = ctx.nowProvider ?? (() => /* @__PURE__ */ new Date());
@@ -10967,7 +11348,7 @@ async function doRunTaskRefreshLinkage(taskIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "refresh-linkage");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const manifest = await readManifest12(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
@@ -11047,7 +11428,7 @@ async function doRunTaskEdit(taskIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "edit");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const manifest = await readManifest12(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
@@ -11103,7 +11484,7 @@ async function doRunTaskDelete(taskIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "delete");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const manifest = await readManifest12(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
@@ -11148,7 +11529,7 @@ async function doRunTaskArchive(taskIdInput, options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForTask(cwd, "archive");
-  const paths = basouPaths19(repositoryRoot);
+  const paths = basouPaths20(repositoryRoot);
   await assertWorkspaceInitialized13(paths.root);
   const manifest = await readManifest12(paths);
   const taskId = await resolveTaskId2(paths, taskIdInput);
@@ -11203,20 +11584,20 @@ async function readSingleLineFromStdin() {
 }
 function parseTitle2(raw) {
   if (raw.length === 0) {
-    throw new InvalidArgumentError6("Title must not be empty");
+    throw new InvalidArgumentError7("Title must not be empty");
   }
   return raw;
 }
 function parseLabel(raw) {
   if (raw.length === 0) {
-    throw new InvalidArgumentError6("Label must not be empty");
+    throw new InvalidArgumentError7("Label must not be empty");
   }
   return raw;
 }
 function parseInitialTaskStatus(raw) {
   const result = TaskStatusSchema.safeParse(raw);
   if (!result.success) {
-    throw new InvalidArgumentError6(
+    throw new InvalidArgumentError7(
       `Initial task status must be one of: ${STATUS_VALUES3.join(", ")}`
     );
   }
@@ -11225,7 +11606,7 @@ function parseInitialTaskStatus(raw) {
 var ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
 function parseIsoTimestampOption(raw) {
   if (!ISO_DATE_RE.test(raw) || Number.isNaN(Date.parse(raw))) {
-    throw new InvalidArgumentError6(
+    throw new InvalidArgumentError7(
       "Invalid --completed-at value; expected ISO-8601 timestamp like 2026-05-10T12:34:56+09:00"
     );
   }
@@ -11234,7 +11615,7 @@ function parseIsoTimestampOption(raw) {
 function parseTaskStatusFilter(raw) {
   const result = TaskStatusSchema.safeParse(raw);
   if (!result.success) {
-    throw new InvalidArgumentError6(
+    throw new InvalidArgumentError7(
       `Invalid task status: ${raw}. Valid values: ${STATUS_VALUES3.join(", ")}`
     );
   }
@@ -11249,14 +11630,14 @@ function parseTaskStatusPositional(raw) {
 }
 function parseDescriptionOption(raw) {
   if (raw.length === 0) {
-    throw new InvalidArgumentError6("Description must not be empty");
+    throw new InvalidArgumentError7("Description must not be empty");
   }
   return raw;
 }
 function parsePositiveInt2(raw) {
   const n = Number.parseInt(raw, 10);
   if (!Number.isInteger(n) || n < 1 || raw.trim() !== String(n)) {
-    throw new InvalidArgumentError6(`Invalid number: ${raw}`);
+    throw new InvalidArgumentError7(`Invalid number: ${raw}`);
   }
   return n;
 }
@@ -11369,10 +11750,10 @@ function maxLen3(values, floor) {
 // src/commands/verify.ts
 import {
   assertBasouRootSafe as assertBasouRootSafe17,
-  basouPaths as basouPaths20,
+  basouPaths as basouPaths21,
   enumerateSessionDirs as enumerateSessionDirs3,
   findErrorCode as findErrorCode16,
-  resolveRepositoryRoot as resolveRepositoryRoot13,
+  resolveRepositoryRoot as resolveRepositoryRoot12,
   resolveSessionId as resolveSessionId5,
   verifyEventsChain
 } from "@basou/core";
@@ -11395,7 +11776,7 @@ async function doRunVerify(options, ctx) {
   }
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForVerify(cwd);
-  const paths = basouPaths20(repositoryRoot);
+  const paths = basouPaths21(repositoryRoot);
   await assertWorkspaceInitialized14(paths.root);
   const sessionIds = options.session !== void 0 ? [await resolveSessionId5(paths, options.session)] : await enumerateSessionDirs3(paths);
   const rows = [];
@@ -11443,7 +11824,7 @@ function renderVerdict(row) {
 }
 async function resolveRepositoryRootForVerify(cwd) {
   try {
-    return await resolveRepositoryRoot13(cwd);
+    return await resolveRepositoryRoot12(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou verify'.", {
@@ -11470,20 +11851,20 @@ import { createHash as createHash2 } from "crypto";
 import { basename as basename10, resolve as resolve13 } from "path";
 import {
   assertBasouRootSafe as assertBasouRootSafe18,
-  basouPaths as basouPaths22,
+  basouPaths as basouPaths23,
   findErrorCode as findErrorCode18,
   readManifest as readManifest16,
-  resolveRepositoryRoot as resolveRepositoryRoot15
+  resolveRepositoryRoot as resolveRepositoryRoot14
 } from "@basou/core";
-import { InvalidArgumentError as InvalidArgumentError7 } from "commander";
+import { InvalidArgumentError as InvalidArgumentError8 } from "commander";
 
 // src/lib/portfolio-coverage.ts
 import { createReadStream as createReadStream2 } from "fs";
-import { readdir as readdir3, stat as stat6 } from "fs/promises";
+import { readdir as readdir3, stat as stat7 } from "fs/promises";
 import { homedir as homedir12 } from "os";
 import { basename as basename8, dirname as dirname5, join as join17 } from "path";
 import { createInterface as createInterface2 } from "readline";
-import { basouPaths as basouPaths21, readManifest as readManifest13, resolveRepositoryRoot as resolveRepositoryRoot14 } from "@basou/core";
+import { basouPaths as basouPaths22, readManifest as readManifest13, resolveRepositoryRoot as resolveRepositoryRoot13 } from "@basou/core";
 function uncapturedTotal(result) {
   return result.groups.reduce((sum, g) => sum + g.logs, 0) + result.unplaceable;
 }
@@ -11519,14 +11900,14 @@ async function collectDeclaredRoots(workspaces) {
   for (const ws of workspaces) {
     let importRoot;
     try {
-      importRoot = await resolveRepositoryRoot14(ws.repoRoot);
+      importRoot = await resolveRepositoryRoot13(ws.repoRoot);
     } catch {
       inertWorkspaces.push({ path: ws.repoRoot, reason: "not_a_git_repo" });
       continue;
     }
     let resolved;
     try {
-      const manifest = await readManifest13(basouPaths21(importRoot));
+      const manifest = await readManifest13(basouPaths22(importRoot));
       resolved = resolveSourceRoots({
         projectFlags: [],
         manifest,
@@ -11626,7 +12007,7 @@ async function isDirEntry(parent, entry) {
   if (entry.isDirectory()) return true;
   if (!entry.isSymbolicLink()) return false;
   try {
-    return (await stat6(join17(parent, entry.name))).isDirectory();
+    return (await stat7(join17(parent, entry.name))).isDirectory();
   } catch {
     return false;
   }
@@ -11793,12 +12174,12 @@ function inertLines(result) {
 }
 
 // src/lib/portfolio-safety.ts
-import { execFile } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { lstat as lstat2, realpath as realpath4 } from "fs/promises";
 import { isAbsolute as isAbsolute7, join as join18, relative as relative4, resolve as resolve11 } from "path";
-import { promisify } from "util";
+import { promisify as promisify2 } from "util";
 import { readManifest as readManifest14 } from "@basou/core";
-var execFileAsync = promisify(execFile);
+var execFileAsync2 = promisify2(execFile2);
 function errorCode(error) {
   return error instanceof Error ? error.code : void 0;
 }
@@ -11830,7 +12211,7 @@ async function inspectRepo(repoPath) {
     }
   }
   try {
-    const { stdout } = await execFileAsync("git", ["-C", repoPath, "ls-files", "-z"]);
+    const { stdout } = await execFileAsync2("git", ["-C", repoPath, "ls-files", "-z"]);
     const tracked = stdout.split("\0").some((f) => f.length > 0 && isBasouPath(f));
     if (tracked) {
       return {
@@ -13163,7 +13544,7 @@ var DEFAULT_PORT = 4319;
 function parsePort(value) {
   const port = Number.parseInt(value, 10);
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new InvalidArgumentError7("Port must be an integer between 1 and 65535.");
+    throw new InvalidArgumentError8("Port must be an integer between 1 and 65535.");
   }
   return port;
 }
@@ -13249,7 +13630,7 @@ async function doRunView(options, ctx) {
 }
 async function buildSingleDeps(ctx, cwd) {
   const repositoryRoot = await resolveRepositoryRootForView(cwd);
-  const paths = basouPaths22(repositoryRoot);
+  const paths = basouPaths23(repositoryRoot);
   await assertWorkspaceInitialized15(paths.root);
   const entry = await buildWorkspaceEntry(repositoryRoot, ctx);
   return {
@@ -13283,7 +13664,7 @@ async function buildPortfolioDeps(workspaceFlags, ctx, cwd) {
   };
 }
 async function buildWorkspaceEntry(repoRoot, ctx, labelOverride) {
-  const paths = basouPaths22(repoRoot);
+  const paths = basouPaths23(repoRoot);
   const importCtx = {
     cwd: repoRoot,
     ...ctx.claudeProjectsDir !== void 0 ? { claudeProjectsDir: ctx.claudeProjectsDir } : {},
@@ -13370,7 +13751,7 @@ function waitForShutdown(signal) {
 }
 async function resolveRepositoryRootForView(cwd) {
   try {
-    return await resolveRepositoryRoot15(cwd);
+    return await resolveRepositoryRoot14(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou view'.", {
@@ -13392,12 +13773,30 @@ async function assertWorkspaceInitialized15(basouRoot) {
 }
 
 // src/program.ts
+function readBuildStamp() {
+  if (false) return void 0;
+  try {
+    return JSON.parse('{"version":"0.46.0","commit":"dbc9c57","committedAt":"2026-09-19T15:43:35+09:00"}');
+  } catch {
+    return void 0;
+  }
+}
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
-var BASOU_CLI_VERSION = pkg.version;
+var BASOU_BUILD = readBuildStamp();
+var BASOU_CLI_VERSION = BASOU_BUILD?.version ?? pkg.version;
+var BASOU_VERSION_LINE = buildVersionLine();
+function buildVersionLine() {
+  if (BASOU_BUILD === void 0) return `${pkg.version} (source)`;
+  const coreBuild = basouCore.BASOU_CORE_BUILD;
+  const self = `${BASOU_BUILD.version} (build ${BASOU_BUILD.commit}, ${BASOU_BUILD.committedAt})`;
+  if (coreBuild === void 0) return `${self}; core build unknown (not stamped)`;
+  if (coreBuild.commit === BASOU_BUILD.commit) return self;
+  return `${self}; core build ${coreBuild.commit}, ${coreBuild.committedAt}`;
+}
 function buildProgram() {
   const program = new Command();
-  program.name("basou").description("A harness for steering AI coding agents").version(BASOU_CLI_VERSION).enablePositionalOptions();
+  program.name("basou").description("A harness for steering AI coding agents").version(BASOU_VERSION_LINE).enablePositionalOptions();
   registerInitCommand(program);
   registerStatusCommand(program);
   registerStatsCommand(program);
@@ -13426,7 +13825,9 @@ function buildProgram() {
   return program;
 }
 export {
+  BASOU_BUILD,
   BASOU_CLI_VERSION,
+  BASOU_VERSION_LINE,
   buildProgram
 };
 //# sourceMappingURL=program.js.map