@basou/cli 0.45.0 → 0.47.0

package/dist/index.js

@@ -1250,7 +1250,8 @@ Input format (a JSON array; one object per decision):
       "rationale": "Workspace protocol and a content-addressed store fit our layout.",
       "alternatives": ["npm workspaces", "yarn"],
       "rejected_reason": "npm hoisting caused phantom-dependency bugs",
-      "linked_files": ["pnpm-workspace.yaml"]
+      "linked_files": ["pnpm-workspace.yaml"],
+      "kind": "decision"
     },
     {
       "title": "Form-based admin editing is the next track (only 6/19 sections done)",
@@ -1259,10 +1260,14 @@ Input format (a JSON array; one object per decision):
     }
   ]
 
-Only "title" is required; every other field is optional. Set "kind": "track" to
-record a strategic, UNFINISHED direction (+ why): orientation/handoff resurface
-open tracks every session until you close one with 'basou decision void <id>'.
-Absent / "decision" is a point-in-time decision (surfaced only as the latest).
+"title" is required. "kind" names the vessel: "track" records a strategic,
+UNFINISHED direction (+ why) and orientation/handoff resurface it every session
+until you close it with 'basou decision void <id>', while "decision" records a
+point-in-time call (surfaced only as the latest). Every other field is optional.
+
+DEPRECATED: omitting "kind" still writes the item, as a decision, but warns --
+and becomes an ERROR in the next release. It has no default because getting it
+wrong fails silently: a track filed as a decision simply never comes back.
 All decisions are written into one ad-hoc session timestamped now, so
 orientation surfaces them as the latest decisions. Run from a workspace-view
 directory and it resolves to the planning repo, like 'basou orient' /
@@ -1270,7 +1275,7 @@ directory and it resolves to the planning repo, like 'basou orient' /
 
 Example (heredoc on stdin):
   basou decision capture <<'JSON'
-  [{ "title": "Ship the capture command", "rationale": "Close the why-capture gap" }]
+  [{ "title": "Ship the capture command", "rationale": "Close the why-capture gap", "kind": "decision" }]
   JSON
 `;
 async function runDecisionRecord(options, ctx = {}) {
@@ -1306,12 +1311,11 @@ async function warnLinkedFilesOutsideRoots(input) {
   } catch {
   }
 }
-var TRACK_MARKER_IN_TITLE = /^\s*track\s*[:\uff1a]|[[(\uff08\uff3b\u3010]\s*track\s*[\])\uff09\uff3d\u3011]/i;
-function warnTrackMarkerWithoutKind(decisions, markerWithoutKind) {
-  for (const index of markerWithoutKind) {
+function warnMissingKind(decisions, indices) {
+  for (const index of indices) {
     const title = (decisions[index]?.title ?? "").trim();
     console.error(
-      `basou: decision[${index}] title carries a track marker (${title.slice(0, 40)}) but "kind" is absent \u2014 it is recorded as a point-in-time decision and will NOT resurface in orient. Set "kind": "track" to open a track, or "kind": "decision" to say the marker is part of the title.`
+      `basou: decision[${index}] ("${title.slice(0, 40)}") declares no "kind" \u2014 it is recorded as a point-in-time decision and will NOT resurface in orient. Set "kind": "track" for an unfinished direction, or "kind": "decision" to say it is settled. Omitting it becomes an ERROR in the next release.`
     );
   }
 }
@@ -1412,8 +1416,8 @@ async function doRunDecisionCapture(options, ctx) {
   const paths = basouPaths4(repositoryRoot);
   await assertWorkspaceInitialized2(paths.root);
   const raw = await readCaptureInput(options, ctx);
-  const { decisions, markerWithoutKind } = parseCaptureInput(raw);
-  warnTrackMarkerWithoutKind(decisions, markerWithoutKind);
+  const { decisions, missingKind } = parseCaptureInput(raw);
+  warnMissingKind(decisions, missingKind);
   await warnLinkedFilesOutsideRoots({
     linkedFiles: decisions.flatMap((d) => d.linked_files ?? []),
     cwd,
@@ -1675,13 +1679,13 @@ function parseCaptureInput(raw) {
     throw new Error("Input array must contain at least one decision.");
   }
   const decisions = [];
-  const markerWithoutKind = [];
+  const missingKind = [];
   parsed.forEach((item, index) => {
-    const { input, kindWasPresent } = validateCaptureItem(item, index);
+    const input = validateCaptureItem(item, index);
     decisions.push(input);
-    if (!kindWasPresent && TRACK_MARKER_IN_TITLE.test(input.title)) markerWithoutKind.push(index);
+    if (input.kind === void 0) missingKind.push(index);
   });
-  return { decisions, markerWithoutKind };
+  return { decisions, missingKind };
 }
 function validateCaptureItem(item, index) {
   if (typeof item !== "object" || item === null || Array.isArray(item)) {
@@ -1703,7 +1707,7 @@ function validateCaptureItem(item, index) {
     if (obj.kind !== "decision" && obj.kind !== "track") {
       throw new Error(`decision[${index}].kind must be "decision" or "track", got '${obj.kind}'.`);
     }
-    if (obj.kind === "track") out.kind = "track";
+    out.kind = obj.kind;
   }
   if (obj.rationale !== void 0) {
     out.rationale = requireNonEmptyString(obj.rationale, index, "rationale");
@@ -1742,7 +1746,7 @@ function validateCaptureItem(item, index) {
       }
     });
   }
-  return { input: out, kindWasPresent: obj.kind !== void 0 };
+  return out;
 }
 function requireNonEmptyString(value, index, field) {
   if (typeof value !== "string" || isBlank(value)) {
@@ -1793,8 +1797,13 @@ function captureItemToPayload(item) {
   if (item.input.kind !== void 0) payload.kind = item.input.kind;
   return payload;
 }
-function kindMarker(kind) {
-  return kind === "track" ? " [TRACK]" : " [DECISION]";
+function previewKindMarker(kind) {
+  if (kind === "track") return " [TRACK]";
+  return kind === "decision" ? " [DECISION]" : " [NO KIND]";
+}
+function recordedKindMarker(kind) {
+  if (kind === "track") return " [TRACK]";
+  return kind === "decision" ? "" : " [NO KIND]";
 }
 function printCapturePreview(options, decisions) {
   if (options.json === true) {
@@ -1805,7 +1814,7 @@ function printCapturePreview(options, decisions) {
     `Would capture ${decisions.length} decision${decisions.length === 1 ? "" : "s"} (dry run; nothing written):`
   );
   for (const decision of decisions) {
-    console.log(`- ${decision.title}${kindMarker(decision.kind)}`);
+    console.log(`- ${decision.title}${previewKindMarker(decision.kind)}`);
   }
 }
 function printCaptureResult(options, result) {
@@ -1826,7 +1835,7 @@ function printCaptureResult(options, result) {
     `Captured ${result.items.length} decision${result.items.length === 1 ? "" : "s"} in ad-hoc session ${sid}:`
   );
   for (const item of result.items) {
-    console.log(`- ${item.decisionId}: ${item.input.title}${kindMarker(item.input.kind)}`);
+    console.log(`- ${item.decisionId}: ${item.input.title}${recordedKindMarker(item.input.kind)}`);
   }
 }
 function pickRichFields(options) {
@@ -2443,8 +2452,8 @@ async function assertWorkspaceInitialized4(basouRoot) {
 // src/commands/hook.ts
 import { execFile } from "child_process";
 import { open as open2, readFile as readFile3, realpath as realpath3, stat as stat4 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir8 } from "os";
+import { join as join10 } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
 import {
@@ -2454,12 +2463,20 @@ import {
   evaluateStopHook,
   findBasouSessionStartHook,
   findBasouStopHookCommand,
+  isProtocolUpdateDue,
   ORIENTATION_END as ORIENTATION_END2,
   ORIENTATION_START as ORIENTATION_START2,
+  PROTOCOL_END,
+  PROTOCOL_START,
   parseMarkers as parseMarkers2,
+  parseProtocolStamp,
+  protocolSectionsFrom,
+  protocolUpdateToken,
   readMarkdownFile as readMarkdownFile6,
   removeSessionStartHook,
   removeStopHook,
+  renderProtocolUpdate,
+  transcriptStartedAt,
   upsertSessionStartHook,
   upsertStopHook
 } from "@basou/core";
@@ -2714,6 +2731,83 @@ async function warnIfPositionNamesOtherWorkspaces(args) {
   }
 }
 
+// src/lib/protocols-config.ts
+import { homedir as homedir5 } from "os";
+import { isAbsolute as isAbsolute2, join as join7, resolve as resolve4 } from "path";
+import { readYamlFile as readYamlFile4 } from "@basou/core";
+var DEFAULT_PROTOCOLS_CONFIG_PATH = join7(homedir5(), ".basou", "protocols.yaml");
+var DEFAULT_TARGET_PATH = join7(homedir5(), ".claude", "CLAUDE.md");
+var ALLOWED_TOP_KEYS = /* @__PURE__ */ new Set(["version", "protocols"]);
+var ALLOWED_ENTRY_KEYS = /* @__PURE__ */ new Set(["source", "title"]);
+function expandTilde2(p) {
+  if (p === "~") return homedir5();
+  if (p.startsWith("~/")) return join7(homedir5(), p.slice(2));
+  return p;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadProtocolsConfig(configPath = DEFAULT_PROTOCOLS_CONFIG_PATH) {
+  let raw;
+  try {
+    raw = await readYamlFile4(configPath);
+  } catch (error) {
+    if (error instanceof Error && error.message === "YAML file not found") {
+      throw new Error(
+        "No protocols config at ~/.basou/protocols.yaml. Create one (a 'protocols:' list of source markdown paths) before running 'basou protocol sync'."
+      );
+    }
+    if (error instanceof Error && error.message === "Failed to parse YAML content") {
+      throw new Error("~/.basou/protocols.yaml is not valid YAML.");
+    }
+    throw error;
+  }
+  if (!isRecord2(raw) || !Array.isArray(raw.protocols)) {
+    throw new Error("~/.basou/protocols.yaml must contain a 'protocols:' list.");
+  }
+  for (const key of Object.keys(raw)) {
+    if (!ALLOWED_TOP_KEYS.has(key)) {
+      throw new Error(
+        `~/.basou/protocols.yaml has an unknown key '${key}' (allowed: version, protocols).`
+      );
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const entry of raw.protocols) {
+    if (!isRecord2(entry)) {
+      throw new Error("Each protocol entry must be a mapping with a 'source' key.");
+    }
+    for (const key of Object.keys(entry)) {
+      if (!ALLOWED_ENTRY_KEYS.has(key)) {
+        throw new Error(`A protocol entry has an unknown key '${key}' (allowed: source, title).`);
+      }
+    }
+    if (typeof entry.source !== "string" || entry.source.trim().length === 0) {
+      throw new Error("Each protocol entry needs a non-empty string 'source'.");
+    }
+    if (entry.title !== void 0 && (typeof entry.title !== "string" || entry.title.trim().length === 0)) {
+      throw new Error("A protocol entry 'title' must be a non-empty string when present.");
+    }
+    const expanded = expandTilde2(entry.source.trim());
+    if (!isAbsolute2(expanded)) {
+      throw new Error("Protocol 'source' paths must be absolute (or start with '~').");
+    }
+    const abs = resolve4(expanded);
+    if (seen.has(abs)) {
+      throw new Error("Duplicate protocol source (each source path may appear only once).");
+    }
+    seen.add(abs);
+    result.push(
+      entry.title !== void 0 ? { source: abs, title: entry.title.trim() } : { source: abs }
+    );
+  }
+  if (result.length === 0) {
+    throw new Error("~/.basou/protocols.yaml has no protocols.");
+  }
+  return result;
+}
+
 // src/commands/orient.ts
 import {
   assertBasouRootSafe as assertBasouRootSafe7,
@@ -2724,22 +2818,22 @@ import {
 } from "@basou/core";
 
 // src/lib/hosts-config.ts
-import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute2, join as join7, resolve as resolve4 } from "path";
-import { readYamlFile as readYamlFile4 } from "@basou/core";
-var DEFAULT_HOSTS_CONFIG_PATH = join7(homedir5(), ".basou", "hosts.yaml");
-function expandTilde2(p) {
-  if (p === "~") return homedir5();
-  if (p.startsWith("~/")) return join7(homedir5(), p.slice(2));
+import { homedir as homedir6 } from "os";
+import { isAbsolute as isAbsolute3, join as join8, resolve as resolve5 } from "path";
+import { readYamlFile as readYamlFile5 } from "@basou/core";
+var DEFAULT_HOSTS_CONFIG_PATH = join8(homedir6(), ".basou", "hosts.yaml");
+function expandTilde3(p) {
+  if (p === "~") return homedir6();
+  if (p.startsWith("~/")) return join8(homedir6(), p.slice(2));
   return p;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function loadHostsConfig(configPath = DEFAULT_HOSTS_CONFIG_PATH) {
   let raw;
   try {
-    raw = await readYamlFile4(configPath);
+    raw = await readYamlFile5(configPath);
   } catch (error) {
     if (error instanceof Error && error.message === "YAML file not found") {
       return null;
@@ -2749,25 +2843,25 @@ async function loadHostsConfig(configPath = DEFAULT_HOSTS_CONFIG_PATH) {
     }
     throw error;
   }
-  if (!isRecord2(raw) || !Array.isArray(raw.hosts)) {
+  if (!isRecord3(raw) || !Array.isArray(raw.hosts)) {
     throw new Error("~/.basou/hosts.yaml must contain a 'hosts:' list.");
   }
   const seenPaths = /* @__PURE__ */ new Set();
   const seenLabels = /* @__PURE__ */ new Set();
   const result = [];
   for (const entry of raw.hosts) {
-    if (!isRecord2(entry) || typeof entry.label !== "string" || entry.label.trim().length === 0) {
+    if (!isRecord3(entry) || typeof entry.label !== "string" || entry.label.trim().length === 0) {
       throw new Error("Each host needs a non-empty string 'label'.");
     }
     const label = entry.label.trim();
     if (typeof entry.path !== "string" || entry.path.trim().length === 0) {
       throw new Error("Each host needs a non-empty string 'path'.");
     }
-    const expanded = expandTilde2(entry.path.trim());
-    if (!isAbsolute2(expanded)) {
+    const expanded = expandTilde3(entry.path.trim());
+    if (!isAbsolute3(expanded)) {
       throw new Error("Host paths must be absolute (or start with '~').");
     }
-    const abs = resolve4(expanded);
+    const abs = resolve5(expanded);
     if (seenPaths.has(abs)) continue;
     if (seenLabels.has(label)) {
       throw new Error(`Duplicate host label '${label}'; each host needs a distinct label.`);
@@ -2792,8 +2886,8 @@ import {
 // src/commands/import.ts
 import { createReadStream } from "fs";
 import { readdir, readFile as readFile2, rm, stat as stat3 } from "fs/promises";
-import { homedir as homedir6 } from "os";
-import { basename as basename4, dirname as dirname3, join as join8, resolve as resolve5 } from "path";
+import { homedir as homedir7 } from "os";
+import { basename as basename4, dirname as dirname3, join as join9, resolve as resolve6 } from "path";
 import { createInterface } from "readline";
 import {
   AGENT_INFRA_DIRS as AGENT_INFRA_DIRS2,
@@ -2864,10 +2958,10 @@ function resolveSourceRoots(args) {
   const { projectFlags, manifest, repoRoot, cwd } = args;
   let resolved;
   if (projectFlags.length > 0) {
-    resolved = projectFlags.map((p) => resolve5(cwd, p));
+    resolved = projectFlags.map((p) => resolve6(cwd, p));
   } else {
     const roots = manifest.import?.source_roots;
-    resolved = roots !== void 0 && roots.length > 0 ? roots.map((r) => resolve5(repoRoot, r)) : [repoRoot];
+    resolved = roots !== void 0 && roots.length > 0 ? roots.map((r) => resolve6(repoRoot, r)) : [repoRoot];
   }
   return [...new Set(resolved)];
 }
@@ -2880,7 +2974,7 @@ async function doRunImportClaudeCode(options, ctx) {
     repoRoot: repositoryRoot,
     cwd: ctx.cwd ?? process.cwd()
   });
-  const projectsRoot = ctx.claudeProjectsDir ?? join8(homedir6(), ".claude", "projects");
+  const projectsRoot = ctx.claudeProjectsDir ?? join9(homedir7(), ".claude", "projects");
   const files = await selectTranscriptFiles(projectsRoot, projectPaths, options);
   const projectSet = new Set(projectPaths);
   const candidates = files.map((file) => {
@@ -2919,7 +3013,7 @@ async function doRunImportCodex(options, ctx) {
     repoRoot: repositoryRoot,
     cwd: ctx.cwd ?? process.cwd()
   });
-  const sessionsRoot = ctx.codexSessionsDir ?? join8(homedir6(), ".codex", "sessions");
+  const sessionsRoot = ctx.codexSessionsDir ?? join9(homedir7(), ".codex", "sessions");
   const rollouts = await discoverCodexRollouts(sessionsRoot, projectPaths, options);
   const candidates = rollouts.map(({ file, externalId }) => ({
     externalId,
@@ -3050,7 +3144,7 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
     if (priors.length > 0 && options.force === true) {
       if (options.dryRun !== true) {
         for (const { sessionId } of priors) {
-          await rm(join8(paths.sessions, sessionId), { recursive: true, force: true });
+          await rm(join9(paths.sessions, sessionId), { recursive: true, force: true });
         }
       }
       counts.replaced++;
@@ -3161,7 +3255,7 @@ async function selectTranscriptFiles(projectsRoot, projectPaths, options) {
   if (options.session !== void 0) {
     const matches = [];
     for (const projectPath of projectPaths) {
-      const file = join8(projectsRoot, encodeProjectDir(projectPath), `${options.session}.jsonl`);
+      const file = join9(projectsRoot, encodeProjectDir(projectPath), `${options.session}.jsonl`);
       if (await pathExists(file)) matches.push(file);
     }
     if (matches.length === 0) {
@@ -3172,7 +3266,7 @@ async function selectTranscriptFiles(projectsRoot, projectPaths, options) {
   const files = [];
   let anyDirFound = false;
   for (const projectPath of projectPaths) {
-    const transcriptDir = join8(projectsRoot, encodeProjectDir(projectPath));
+    const transcriptDir = join9(projectsRoot, encodeProjectDir(projectPath));
     let entries;
     try {
       entries = await readdir(transcriptDir);
@@ -3182,7 +3276,7 @@ async function selectTranscriptFiles(projectsRoot, projectPaths, options) {
     }
     anyDirFound = true;
     for (const name of entries) {
-      if (name.endsWith(".jsonl")) files.push(join8(transcriptDir, name));
+      if (name.endsWith(".jsonl")) files.push(join9(transcriptDir, name));
     }
   }
   if (!anyDirFound) {
@@ -3239,7 +3333,7 @@ async function findRolloutFiles(sessionsRoot) {
       throw new Error("Failed to read Codex sessions directory", { cause: error });
     }
     for (const entry of entries) {
-      const full = join8(dir, entry.name);
+      const full = join9(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(full, false);
       } else if (entry.isFile() && entry.name.startsWith("rollout-") && entry.name.endsWith(".jsonl")) {
@@ -3696,6 +3790,8 @@ async function assertWorkspaceInitialized6(basouRoot) {
 
 // src/commands/hook.ts
 var MAX_TRANSCRIPT_BYTES = 8 * 1024 * 1024;
+var MAX_TRANSCRIPT_HEAD_BYTES = 256 * 1024;
+var TOKEN_SCAN_CHUNK_BYTES = 1024 * 1024;
 var execFileAsync = promisify(execFile);
 function registerHookCommand(program2) {
   const hook = program2.command("hook").description(
@@ -3707,13 +3803,13 @@ function registerHookCommand(program2) {
     await runHookSessionStart();
   });
   hook.command("stop").description(
-    "Stop-hook: when a substantive session recorded no decisions or next step, emit a non-blocking nudge to capture them. Reads the Stop hook JSON payload on stdin; never blocks and never fails the session."
+    "Stop-hook: when a substantive session recorded no decisions or next step, emit a non-blocking nudge to capture them. Also hands a running session the standing protocols when they changed after it started \u2014 the copy it read at start is stale, and only this hook reaches a session still running. Reads the Stop hook JSON payload on stdin; never blocks and never fails the session."
   ).option(
     "--min-edits <n>",
     `Minimum file edits before nudging on edits alone (default ${DEFAULT_STOP_HOOK_MIN_EDITS})`
   ).option(
     "--block",
-    "Opt-in enforcement: hold the agent in-turn (decision:block) instead of a non-blocking reminder"
+    "Opt-in enforcement: hold the agent in-turn (decision:block) instead of a non-blocking message"
   ).option(
     "--require-review",
     "Opt-in review gate: also remind when a session shipped substantive code (push / PR / merge) without recording a review"
@@ -3826,12 +3922,25 @@ gh pr create|merge) without recording a review ('basou review record'). This
 gate is off by default; when on, its reminder is composed into the same
 envelope as the capture reminder.
 
-By default the reminder is non-blocking: Claude sees it and may act on it or
-stop. With --block (opt-in enforcement, 'basou hook install --block') it instead
-returns decision:block, holding the agent in-turn to act on the reminder; the
-'stop_hook_active' flag and Claude Code's own loop prevention bound it to a
-single turn. Either way the hook fails open: a bad payload or unreadable
-transcript exits cleanly with no output.
+It also hands a RUNNING session the standing protocols when they changed after
+that session started. The protocol block in ~/.claude/CLAUDE.md is read at
+session start, so an update made mid-session never reaches the session it was
+meant to correct; this is the only channel that does. The complete current set
+is delivered, not a diff, so what it supersedes -- including a protocol that is
+no longer there -- is unambiguous. It reads the rendered block and nothing else,
+so an edit not yet published by 'basou protocol sync' cannot reach a session,
+and it delivers once per block state: a second update in the same session still
+lands, the same one twice does not. This part is always on, needs no flag, and
+says nothing at all unless the block actually changed.
+
+By default every message here is non-blocking: Claude sees it and may act on it
+or stop. With --block (opt-in enforcement, 'basou hook install --block') it
+instead returns decision:block, holding the agent in-turn; the 'stop_hook_active'
+flag and Claude Code's own loop prevention bound it to a single turn. Note that
+this covers the protocol delivery too, which carries no action to take -- with
+--block the turn is held so the new text lands before more work is done on the
+old. Either way the hook fails open: a bad payload or unreadable transcript
+exits cleanly with no output.
 `;
 async function runHookStop(options, ctx = {}) {
   try {
@@ -3869,7 +3978,12 @@ async function doRunHookStop(options, ctx) {
     stopHookActive: false,
     ...options.minEdits !== void 0 ? { minEdits: options.minEdits } : {}
   });
+  const protocolUpdate = await evaluateProtocolUpdateGate({
+    transcriptPath,
+    target: ctx.protocolTargetPath ?? DEFAULT_TARGET_PATH
+  });
   const parts = [];
+  if (protocolUpdate !== null) parts.push(protocolUpdate);
   if (evaluation.kind === "nudge") parts.push(evaluation.additionalContext);
   if (options.requireReview === true && evaluation.review.fires) {
     parts.push(evaluation.review.additionalContext);
@@ -3885,6 +3999,56 @@ async function doRunHookStop(options, ctx) {
   write(`${payloadJson}
 `);
 }
+async function evaluateProtocolUpdateGate(input) {
+  try {
+    const head = await readTranscriptHead(input.transcriptPath);
+    const sessionStartedAt = transcriptStartedAt(parseTranscript(head));
+    if (sessionStartedAt === void 0) return null;
+    const touchedAt = await targetModifiedAt(input.target);
+    if (touchedAt !== null && touchedAt <= Date.parse(sessionStartedAt)) return null;
+    const existing = await readMarkdownFile6(input.target);
+    if (existing === null) return null;
+    const section = parseMarkers2(existing, { start: PROTOCOL_START, end: PROTOCOL_END });
+    if (section.kind !== "ok") return null;
+    const stamp = parseProtocolStamp(section.generated);
+    if (stamp === null) return null;
+    if (!isProtocolUpdateDue({ stamp, sessionStartedAt })) return null;
+    const sections = protocolSectionsFrom(section.generated);
+    if (sections === null || sections.trim().length === 0) return null;
+    if (await transcriptCarries(input.transcriptPath, protocolUpdateToken(stamp.contentHash))) {
+      return null;
+    }
+    return renderProtocolUpdate(sections, stamp);
+  } catch {
+    return null;
+  }
+}
+async function targetModifiedAt(target) {
+  try {
+    return (await stat4(target)).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+async function transcriptCarries(path, token) {
+  const handle = await open2(path, "r");
+  try {
+    const overlap = Math.max(token.length - 1, 0);
+    const chunk = Buffer.alloc(TOKEN_SCAN_CHUNK_BYTES);
+    let carry = "";
+    let position = 0;
+    for (; ; ) {
+      const { bytesRead } = await handle.read(chunk, 0, TOKEN_SCAN_CHUNK_BYTES, position);
+      if (bytesRead === 0) return false;
+      position += bytesRead;
+      const text = carry + chunk.subarray(0, bytesRead).toString("utf8");
+      if (text.includes(token)) return true;
+      carry = overlap > 0 ? text.slice(-overlap) : "";
+    }
+  } finally {
+    await handle.close();
+  }
+}
 async function renderRegisteredWorkspacePosition(cwd, portfolioConfigPath = DEFAULT_PORTFOLIO_CONFIG_PATH) {
   const root = await resolveBasouRootForCommand(cwd, "hook session-start", {
     portfolioConfigPath
@@ -3984,11 +4148,25 @@ async function readTranscriptBounded(path, maxBytes = MAX_TRANSCRIPT_BYTES) {
     await handle.close();
   }
 }
+async function readTranscriptHead(path, maxBytes = MAX_TRANSCRIPT_HEAD_BYTES) {
+  const { size } = await stat4(path);
+  if (size <= maxBytes) return readFile3(path, "utf8");
+  const handle = await open2(path, "r");
+  try {
+    const buffer = Buffer.alloc(maxBytes);
+    const { bytesRead } = await handle.read(buffer, 0, maxBytes, 0);
+    const text = buffer.subarray(0, bytesRead).toString("utf8");
+    const lastNewline = text.lastIndexOf("\n");
+    return lastNewline >= 0 ? text.slice(0, lastNewline + 1) : text;
+  } finally {
+    await handle.close();
+  }
+}
 function parseMinEdits(raw) {
   if (raw === void 0 || !/^\d+$/.test(raw)) return void 0;
   return Number(raw);
 }
-var DEFAULT_CLAUDE_SETTINGS_PATH = join9(homedir7(), ".claude", "settings.json");
+var DEFAULT_CLAUDE_SETTINGS_PATH = join10(homedir8(), ".claude", "settings.json");
 function resolveCliEntry() {
   return fileURLToPath(import.meta.url);
 }
@@ -4236,7 +4414,7 @@ function describeHookMode(tiers) {
   const gates = tiers.review ? "capture + review" : "capture";
   return `${enforcement}, ${gates}`;
 }
-var DEFAULT_CODEX_FACE_PATH = join9(homedir7(), ".codex", "AGENTS.md");
+var DEFAULT_CODEX_FACE_PATH = join10(homedir8(), ".codex", "AGENTS.md");
 var LEFTOVER_FACE_NOTE = (label) => `${label} still carries an orientation block rendered by an earlier basou (0.39 or before); every Codex session on this machine reads it. \`basou channel clear codex\` removes it.`;
 async function faceHasLeftoverOrientationBlock(facePath) {
   try {
@@ -4248,8 +4426,8 @@ async function faceHasLeftoverOrientationBlock(facePath) {
     return false;
   }
 }
-var DEFAULT_CODEX_HOOKS_PATH = join9(homedir7(), ".codex", "hooks.json");
-var DEFAULT_CODEX_CONFIG_PATH = join9(homedir7(), ".codex", "config.toml");
+var DEFAULT_CODEX_HOOKS_PATH = join10(homedir8(), ".codex", "hooks.json");
+var DEFAULT_CODEX_CONFIG_PATH = join10(homedir8(), ".codex", "config.toml");
 async function readHooksFile(path) {
   let raw;
   try {
@@ -4421,7 +4599,7 @@ async function codexHookTrustFor(hooksPath, location, configPath) {
 }
 
 // src/commands/init.ts
-import { basename as basename5, relative, resolve as resolve6 } from "path";
+import { basename as basename5, relative, resolve as resolve7 } from "path";
 import {
   appendBasouGitignore,
   createManifest,
@@ -4466,7 +4644,7 @@ async function doRunInit(options, ctx) {
     );
   }
   const sourceRoots = (options.sourceRoot ?? []).map((p) => {
-    const rel = relative(repositoryRoot, resolve6(cwd, p));
+    const rel = relative(repositoryRoot, resolve7(cwd, p));
     return rel === "" ? "." : rel;
   });
   const paths = await ensureBasouDirectory(repositoryRoot);
@@ -4676,7 +4854,7 @@ async function assertWorkspaceInitialized7(basouRoot) {
 
 // src/commands/portfolio.ts
 import { existsSync, statSync } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function registerPortfolioCommand(program2) {
   program2.command("portfolio").description(
     "List the workspaces you orient across (read-only): every planning master registered in ~/.basou/portfolio.yaml, with its path and whether it exists / is initialized. The headless text/JSON counterpart to the `basou view --portfolio` GUI \u2014 for discovering where a sibling project lives without opening a browser"
@@ -4722,7 +4900,7 @@ async function runPortfolioList(options, ctx = {}) {
 async function doRunPortfolioList(options, ctx) {
   const configPath = ctx.configPath ?? DEFAULT_PORTFOLIO_CONFIG_PATH;
   const pathExists2 = ctx.pathExists ?? ((p) => existsSync(p));
-  const isInitialized = ctx.isInitialized ?? ((p) => isDirectory(join10(p, ".basou")));
+  const isInitialized = ctx.isInitialized ?? ((p) => isDirectory(join11(p, ".basou")));
   const workspaces = await loadPortfolioConfig(configPath);
   const result = {
     configPath,
@@ -4787,7 +4965,7 @@ import {
   writeFileSync,
   writeSync
 } from "fs";
-import { basename as basename6, dirname as dirname4, isAbsolute as isAbsolute3, join as join11, relative as relative2, resolve as resolve7 } from "path";
+import { basename as basename6, dirname as dirname4, isAbsolute as isAbsolute4, join as join12, relative as relative2, resolve as resolve8 } from "path";
 import {
   appendBasouGitignore as appendBasouGitignore2,
   basouPaths as basouPaths11,
@@ -5162,14 +5340,14 @@ async function runProjectAdopt(options, ctx = {}) {
   }
 }
 function classifySourceRoot(repositoryRoot, declaredPath) {
-  const absolute = resolve7(repositoryRoot, declaredPath);
+  const absolute = resolve8(repositoryRoot, declaredPath);
   let real;
   try {
     real = realpathSync(absolute);
   } catch {
     return { path: declaredPath, kind: "unresolved" };
   }
-  return { path: declaredPath, kind: existsSync2(join11(real, ".git")) ? "repo" : "non-repo" };
+  return { path: declaredPath, kind: existsSync2(join12(real, ".git")) ? "repo" : "non-repo" };
 }
 async function doRunProjectAdopt(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
@@ -5269,11 +5447,11 @@ async function gatherRepoWiring(repositoryRoot, entry) {
   };
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, entry.path));
+    real = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { ...base, reachable: false, instructionFiles: [] };
   }
-  if (!existsSync2(join11(real, ".git"))) {
+  if (!existsSync2(join12(real, ".git"))) {
     return { ...base, reachable: false, instructionFiles: [] };
   }
   try {
@@ -5281,7 +5459,7 @@ async function gatherRepoWiring(repositoryRoot, entry) {
     for (const name of INSTRUCTION_FILES) {
       let present = true;
       try {
-        lstatSync(join11(real, name));
+        lstatSync(join12(real, name));
       } catch {
         present = false;
       }
@@ -5388,14 +5566,14 @@ function gatherRepoGitignore(repositoryRoot, entry) {
   };
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, entry.path));
+    real = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { ...base, reachable: false, currentLines: [] };
   }
-  if (!existsSync2(join11(real, ".git"))) {
+  if (!existsSync2(join12(real, ".git"))) {
     return { ...base, reachable: false, currentLines: [] };
   }
-  return { ...base, reachable: true, currentLines: readGitignoreLines(join11(real, ".gitignore")) };
+  return { ...base, reachable: true, currentLines: readGitignoreLines(join12(real, ".gitignore")) };
 }
 function hasErrorCode(error) {
   return error instanceof Error && typeof error.code === "string";
@@ -5409,7 +5587,7 @@ function readGitignoreLines(file) {
   }
 }
 function applyGitignorePlan(repositoryRoot, plan) {
-  const file = join11(realpathSync(resolve7(repositoryRoot, plan.path)), ".gitignore");
+  const file = join12(realpathSync(resolve8(repositoryRoot, plan.path)), ".gitignore");
   let existing = "";
   try {
     existing = readFileSync(file, "utf8");
@@ -5544,12 +5722,12 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
   const base = { path: entry.path, ...isSelf ? { self: true } : {} };
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, entry.path));
+    real = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { ...base, isAnchor: false, reachable: false, canonicalPresent: false, files: [] };
   }
   if (real === anchorReal) {
-    const anchorCanonical = join11(real, CANONICAL_FILE);
+    const anchorCanonical = join12(real, CANONICAL_FILE);
     const anchorState = anchorCanonicalState(anchorCanonical);
     if (anchorState === "absent") {
       return { ...base, isAnchor: true, reachable: true, canonicalPresent: false, files: [] };
@@ -5569,7 +5747,7 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
       anchorCanonical,
       "self"
     ).map((spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(real, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(real, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -5586,16 +5764,16 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
       files: anchorFiles
     };
   }
-  if (!existsSync2(join11(real, ".git"))) {
+  if (!existsSync2(join12(real, ".git"))) {
     return { ...base, isAnchor: false, reachable: false, canonicalPresent: false, files: [] };
   }
-  const canonicalFile = isSelf ? join11(real, CANONICAL_FILE) : join11(anchorReal, "agents", basename6(real), CANONICAL_FILE);
+  const canonicalFile = isSelf ? join12(real, CANONICAL_FILE) : join12(anchorReal, "agents", basename6(real), CANONICAL_FILE);
   if (!existsSync2(canonicalFile)) {
     return { ...base, isAnchor: false, reachable: true, canonicalPresent: false, files: [] };
   }
   const files = expectedSymlinkTargets(real, canonicalFile, mode).map(
     (spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(real, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(real, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -5616,7 +5794,7 @@ function gatherRepoSymlinks(repositoryRoot, anchorReal, entry) {
 function applySymlinkPlan(repositoryRoot, plan) {
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, plan.path));
+    real = realpathSync(resolve8(repositoryRoot, plan.path));
   } catch (error) {
     const message = failureReason(error);
     return { created: [], failed: plan.toCreate.map((c) => ({ file: c.name, message })) };
@@ -5624,7 +5802,7 @@ function applySymlinkPlan(repositoryRoot, plan) {
   const created = [];
   const failed = [];
   for (const { name, target } of plan.toCreate) {
-    const filePath = join11(real, name);
+    const filePath = join12(real, name);
     try {
       mkdirSync(dirname4(filePath), { recursive: true });
       symlinkSync(target, filePath);
@@ -5642,9 +5820,9 @@ function viewCanonicalCollision(repositoryRoot, roster, viewName) {
   for (const entry of roster) {
     let name;
     try {
-      name = basename6(realpathSync(resolve7(repositoryRoot, entry.path)));
+      name = basename6(realpathSync(resolve8(repositoryRoot, entry.path)));
     } catch {
-      name = basename6(resolve7(repositoryRoot, entry.path));
+      name = basename6(resolve8(repositoryRoot, entry.path));
     }
     if (name === viewName) return entry.path;
   }
@@ -5658,7 +5836,7 @@ function gatherViewSymlinks(repositoryRoot, anchorReal, roster, viewDir) {
   if (!existsSync2(canonicalFile)) return { kind: "missing-canonical", viewName };
   const files = expectedSymlinkTargets(viewDir, canonicalFile, "hub").map(
     (spec) => {
-      const { state, actualTarget } = inspectSymlink(join11(viewDir, spec.name), spec.target);
+      const { state, actualTarget } = inspectSymlink(join12(viewDir, spec.name), spec.target);
       return {
         name: spec.name,
         expectedTarget: spec.target,
@@ -5674,7 +5852,7 @@ function applyViewSymlinks(viewDir, files) {
   const failed = [];
   for (const f of files) {
     if (f.state !== "missing") continue;
-    const filePath = join11(viewDir, f.name);
+    const filePath = join12(viewDir, f.name);
     try {
       mkdirSync(dirname4(filePath), { recursive: true });
       symlinkSync(f.expectedTarget, filePath);
@@ -5891,12 +6069,12 @@ async function runProjectWorkspace(options, ctx = {}) {
   }
 }
 function resolveViewDir(repositoryRoot, viewPath) {
-  const abs = resolve7(repositoryRoot, viewPath);
+  const abs = resolve8(repositoryRoot, viewPath);
   try {
     return realpathSync(abs);
   } catch {
     try {
-      return join11(realpathSync(dirname4(abs)), basename6(abs));
+      return join12(realpathSync(dirname4(abs)), basename6(abs));
     } catch {
       return abs;
     }
@@ -5905,7 +6083,7 @@ function resolveViewDir(repositoryRoot, viewPath) {
 function gatherViewRepo(repositoryRoot, viewDir, entry) {
   let repoReal;
   try {
-    repoReal = realpathSync(resolve7(repositoryRoot, entry.path));
+    repoReal = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { path: entry.path, reachable: false };
   }
@@ -5914,7 +6092,7 @@ function gatherViewRepo(repositoryRoot, viewDir, entry) {
     return { path: entry.path, reachable: false };
   }
   const linkName = basename6(repoReal);
-  const { state, actualTarget } = inspectSymlink(join11(viewDir, linkName), expectedTarget);
+  const { state, actualTarget } = inspectSymlink(join12(viewDir, linkName), expectedTarget);
   return {
     path: entry.path,
     reachable: true,
@@ -5928,7 +6106,7 @@ function applyViewPlan(viewDir, toCreate) {
   const created = [];
   const failed = [];
   for (const { name, target } of toCreate) {
-    const filePath = join11(viewDir, name);
+    const filePath = join12(viewDir, name);
     try {
       mkdirSync(dirname4(filePath), { recursive: true });
       symlinkSync(target, filePath);
@@ -5943,7 +6121,7 @@ var TOP_LEVEL_INSTRUCTION_FILES_LOWER = new Set(
   INSTRUCTION_FILES.filter((f) => !f.includes("/")).map((f) => f.toLowerCase())
 );
 function classifyViewLink(viewDir, name, rosterRealpaths) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   let isLink;
   try {
     isLink = lstatSync(filePath).isSymbolicLink();
@@ -5957,12 +6135,12 @@ function classifyViewLink(viewDir, name, rosterRealpaths) {
   } catch {
     return null;
   }
-  const resolved = isAbsolute3(target) ? target : resolve7(viewDir, target);
+  const resolved = isAbsolute4(target) ? target : resolve8(viewDir, target);
   try {
     if (rosterRealpaths.has(realpathSync(resolved))) return null;
   } catch {
   }
-  if (isAbsolute3(target)) return { target, kind: "absolute" };
+  if (isAbsolute4(target)) return { target, kind: "absolute" };
   let isDir = false;
   try {
     isDir = statSync2(resolved).isDirectory();
@@ -5972,7 +6150,7 @@ function classifyViewLink(viewDir, name, rosterRealpaths) {
   if (!isDir) {
     return { target, kind: existsSync2(resolved) ? "non-repo" : "broken" };
   }
-  return { target, kind: existsSync2(join11(resolved, ".git")) ? "repo" : "non-repo" };
+  return { target, kind: existsSync2(join12(resolved, ".git")) ? "repo" : "non-repo" };
 }
 function gatherExistingViewLinks(viewDir, rosterRealpaths) {
   let names;
@@ -5997,7 +6175,7 @@ function pruneViewLinks(viewDir, toPrune, rosterRealpaths) {
   const pruned = [];
   const failed = [];
   for (const { name } of toPrune) {
-    const filePath = join11(viewDir, name);
+    const filePath = join12(viewDir, name);
     const c = classifyViewLink(viewDir, name, rosterRealpaths);
     if (c === null || c.kind !== "repo") {
       failed.push({
@@ -6043,11 +6221,11 @@ async function doRunProjectWorkspace(options, ctx) {
   } else {
     const viewDir = resolveViewDir(repositoryRoot, viewPath);
     const facts = roster.map((entry) => gatherViewRepo(repositoryRoot, viewDir, entry));
-    const rosterNames = roster.map((entry) => basename6(resolve7(repositoryRoot, entry.path)));
+    const rosterNames = roster.map((entry) => basename6(resolve8(repositoryRoot, entry.path)));
     const rosterRealpaths = /* @__PURE__ */ new Set();
     for (const entry of roster) {
       try {
-        rosterRealpaths.add(realpathSync(resolve7(repositoryRoot, entry.path)));
+        rosterRealpaths.add(realpathSync(resolve8(repositoryRoot, entry.path)));
       } catch {
       }
     }
@@ -6210,10 +6388,10 @@ async function runProjectPreset(options, ctx = {}) {
   }
 }
 function canonicalFileFor(anchorReal, canonicalName) {
-  return join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  return join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
 }
 function canonicalLabelFor(canonicalName) {
-  return join11("agents", canonicalName, CANONICAL_FILE);
+  return join12("agents", canonicalName, CANONICAL_FILE);
 }
 async function gatherRepoPreset(repositoryRoot, anchorReal, entry) {
   const declared = {
@@ -6227,14 +6405,14 @@ async function gatherRepoPreset(repositoryRoot, anchorReal, entry) {
   }
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, entry.path));
+    real = realpathSync(resolve8(repositoryRoot, entry.path));
   } catch {
     return { ...declared, isAnchor: false, reachable: false, canonicalPresent: false };
   }
   if (real === anchorReal) {
     return { ...declared, isAnchor: true, reachable: true, canonicalPresent: false };
   }
-  if (!existsSync2(join11(real, ".git"))) {
+  if (!existsSync2(join12(real, ".git"))) {
     return { ...declared, isAnchor: false, reachable: false, canonicalPresent: false };
   }
   const canonicalName = basename6(real);
@@ -6283,7 +6461,7 @@ function viewPresetReposFor(repositoryRoot, roster) {
     anchorReal = void 0;
   }
   return roster.map((entry) => {
-    const abs = resolve7(repositoryRoot, entry.path);
+    const abs = resolve8(repositoryRoot, entry.path);
     let real;
     try {
       real = realpathSync(abs);
@@ -6607,7 +6785,7 @@ function gatherArchiveTeardown(repositoryRoot, manifest, target) {
   };
   let real;
   try {
-    real = realpathSync(resolve7(repositoryRoot, target));
+    real = realpathSync(resolve8(repositoryRoot, target));
   } catch {
     return empty;
   }
@@ -6616,24 +6794,24 @@ function gatherArchiveTeardown(repositoryRoot, manifest, target) {
   const instructionFiles = [];
   for (const name of INSTRUCTION_FILES) {
     try {
-      lstatSync(join11(real, name));
+      lstatSync(join12(real, name));
       instructionFiles.push(name);
     } catch {
     }
   }
   let ignored;
   try {
-    ignored = new Set(readGitignoreLines(join11(real, ".gitignore")).map((l) => l.trim()));
+    ignored = new Set(readGitignoreLines(join12(real, ".gitignore")).map((l) => l.trim()));
   } catch {
     ignored = /* @__PURE__ */ new Set();
   }
   const gitignorePatterns = INSTRUCTION_FILES.filter((p) => ignored.has(p) || ignored.has(`/${p}`));
-  const canonical2 = existsSync2(join11(anchorReal, "agents", canonicalName, CANONICAL_FILE));
+  const canonical2 = existsSync2(join12(anchorReal, "agents", canonicalName, CANONICAL_FILE));
   let viewLink = false;
   const viewPath = manifest.workspace.view;
   if (viewPath !== void 0) {
     try {
-      lstatSync(join11(resolveViewDir(repositoryRoot, viewPath), canonicalName));
+      lstatSync(join12(resolveViewDir(repositoryRoot, viewPath), canonicalName));
       viewLink = true;
     } catch {
     }
@@ -6647,27 +6825,27 @@ function gatherArchiveTeardown(repositoryRoot, manifest, target) {
   };
 }
 function teardownExpectedTargets(repoReal, anchorReal, canonicalName) {
-  const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
   return expectedSymlinkTargets(repoReal, canonicalFile);
 }
 function viewLinkPointsAt(viewDir, name, repoReal) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   try {
     if (!lstatSync(filePath).isSymbolicLink()) return false;
     const target = readlinkSync(filePath);
-    if (isAbsolute3(target)) return false;
-    return realpathSync(resolve7(viewDir, target)) === repoReal;
+    if (isAbsolute4(target)) return false;
+    return realpathSync(resolve8(viewDir, target)) === repoReal;
   } catch {
     return false;
   }
 }
 function viewLinkPointsAtPath(viewDir, name, expectedRepoPath) {
-  const filePath = join11(viewDir, name);
+  const filePath = join12(viewDir, name);
   try {
     if (!lstatSync(filePath).isSymbolicLink()) return false;
     const target = readlinkSync(filePath);
-    if (isAbsolute3(target)) return false;
-    return resolve7(viewDir, target) === expectedRepoPath;
+    if (isAbsolute4(target)) return false;
+    return resolve8(viewDir, target) === expectedRepoPath;
   } catch {
     return false;
   }
@@ -6676,19 +6854,19 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
   const anchorReal = realpathSync(repositoryRoot);
   let repoReal;
   try {
-    repoReal = realpathSync(resolve7(repositoryRoot, target));
+    repoReal = realpathSync(resolve8(repositoryRoot, target));
   } catch {
     repoReal = void 0;
   }
   const isAnchor = repoReal !== void 0 && repoReal === anchorReal;
-  const targetAbs = resolve7(repositoryRoot, target);
+  const targetAbs = resolve8(repositoryRoot, target);
   const canonicalName = basename6(repoReal ?? targetAbs);
   const roster = manifest.repos ?? [];
   const declaredEntry = roster.find((r) => {
     try {
-      return realpathSync(resolve7(repositoryRoot, r.path)) === (repoReal ?? "\0");
+      return realpathSync(resolve8(repositoryRoot, r.path)) === (repoReal ?? "\0");
     } catch {
-      return resolve7(repositoryRoot, r.path) === targetAbs;
+      return resolve8(repositoryRoot, r.path) === targetAbs;
     }
   });
   const inRoster = declaredEntry !== void 0;
@@ -6697,7 +6875,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
   const canonicalShared = roster.some((r) => {
     let rReal = null;
     try {
-      rReal = realpathSync(resolve7(repositoryRoot, r.path));
+      rReal = realpathSync(resolve8(repositoryRoot, r.path));
     } catch {
       rReal = null;
     }
@@ -6705,15 +6883,15 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
       if (repoReal !== void 0 && rReal === repoReal) return false;
       return basename6(rReal).toLowerCase() === cnFold;
     }
-    if (resolve7(repositoryRoot, r.path) === targetAbs) return false;
-    return basename6(resolve7(repositoryRoot, r.path)).toLowerCase() === cnFold;
+    if (resolve8(repositoryRoot, r.path) === targetAbs) return false;
+    return basename6(resolve8(repositoryRoot, r.path)).toLowerCase() === cnFold;
   });
   const collisionNote = "shared with another repo of the same basename, so it cannot be removed (check manually)";
   const items = [];
   if (!isAnchor) {
     if (repoReal !== void 0) {
       for (const spec of teardownExpectedTargets(repoReal, anchorReal, canonicalName)) {
-        const { state, actualTarget } = inspectSymlink(join11(repoReal, spec.name), spec.target);
+        const { state, actualTarget } = inspectSymlink(join12(repoReal, spec.name), spec.target);
         if (isSelf) {
           if (state !== "missing")
             items.push({
@@ -6750,7 +6928,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
       }
       let ignored;
       try {
-        ignored = new Set(readGitignoreLines(join11(repoReal, ".gitignore")).map((l) => l.trim()));
+        ignored = new Set(readGitignoreLines(join12(repoReal, ".gitignore")).map((l) => l.trim()));
         for (const p of INSTRUCTION_FILES) {
           if (ignored.has(p) || ignored.has(`/${p}`)) {
             items.push({
@@ -6773,7 +6951,7 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
     const viewPath = manifest.workspace.view;
     if (viewPath !== void 0) {
       const viewDir = resolveViewDir(repositoryRoot, viewPath);
-      const linkPath = join11(viewDir, canonicalName);
+      const linkPath = join12(viewDir, canonicalName);
       let isLink = false;
       try {
         isLink = lstatSync(linkPath).isSymbolicLink();
@@ -6799,8 +6977,8 @@ function gatherRepoTeardown(repositoryRoot, manifest, target) {
         else items.push({ kind: "view-symlink", label: canonicalName, state: "removable" });
       }
     }
-    const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
-    const canonicalLabel = join11("agents", canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+    const canonicalLabel = join12("agents", canonicalName, CANONICAL_FILE);
     let canonicalIsLink = false;
     try {
       canonicalIsLink = lstatSync(canonicalFile).isSymbolicLink();
@@ -6887,7 +7065,7 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
   const changed = (label) => failed.push({ label, message: "the state changed since the scan (re-run)" });
   let currentRepoReal = null;
   try {
-    currentRepoReal = realpathSync(resolve7(repositoryRoot, plan.target));
+    currentRepoReal = realpathSync(resolve8(repositoryRoot, plan.target));
   } catch {
     currentRepoReal = null;
   }
@@ -6904,12 +7082,12 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
   );
   for (const item of removable.filter((i) => i.kind === "instruction-symlink")) {
     const expected = expectedByName.get(item.label);
-    if (repoReal === null || expected === void 0 || inspectSymlink(join11(repoReal, item.label), expected).state !== "correct") {
+    if (repoReal === null || expected === void 0 || inspectSymlink(join12(repoReal, item.label), expected).state !== "correct") {
       changed(item.label);
       continue;
     }
     try {
-      unlinkSync(join11(repoReal, item.label));
+      unlinkSync(join12(repoReal, item.label));
       removed.push(item.label);
     } catch (error) {
       failed.push({ label: item.label, message: failureReason(error) });
@@ -6922,13 +7100,13 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
       continue;
     }
     const viewDir = resolveViewDir(repositoryRoot, viewPath);
-    const owned = repoReal !== null ? viewLinkPointsAt(viewDir, item.label, repoReal) : viewLinkPointsAtPath(viewDir, item.label, resolve7(repositoryRoot, plan.target));
+    const owned = repoReal !== null ? viewLinkPointsAt(viewDir, item.label, repoReal) : viewLinkPointsAtPath(viewDir, item.label, resolve8(repositoryRoot, plan.target));
     if (!owned) {
       changed(item.label);
       continue;
     }
     try {
-      unlinkSync(join11(viewDir, item.label));
+      unlinkSync(join12(viewDir, item.label));
       removed.push(`view/${item.label}`);
     } catch (error) {
       failed.push({ label: `view/${item.label}`, message: failureReason(error) });
@@ -6936,7 +7114,7 @@ function applyRepoTeardown(repositoryRoot, manifest, plan) {
   }
   const NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
   for (const item of removable.filter((i) => i.kind === "canonical-block")) {
-    const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
     try {
       if (lstatSync(canonicalFile).isSymbolicLink()) {
         changed(item.label);
@@ -7084,7 +7262,7 @@ async function doRunProjectArchive(target, options, ctx) {
   const roster = manifest.repos ?? [];
   let targetIsAnchor = false;
   try {
-    targetIsAnchor = realpathSync(resolve7(repositoryRoot, target)) === realpathSync(repositoryRoot);
+    targetIsAnchor = realpathSync(resolve8(repositoryRoot, target)) === realpathSync(repositoryRoot);
   } catch {
     targetIsAnchor = false;
   }
@@ -7210,12 +7388,12 @@ function gatherRenameWiring(repositoryRoot, manifest, oldBasename) {
   } catch {
     return { canonicalDirOld: false, viewLinkOld: false };
   }
-  const canonicalDirOld = existsSync2(join11(anchorReal, "agents", oldBasename));
+  const canonicalDirOld = existsSync2(join12(anchorReal, "agents", oldBasename));
   let viewLinkOld = false;
   const viewPath = manifest.workspace.view;
   if (viewPath !== void 0) {
     try {
-      lstatSync(join11(resolveViewDir(repositoryRoot, viewPath), oldBasename));
+      lstatSync(join12(resolveViewDir(repositoryRoot, viewPath), oldBasename));
       viewLinkOld = true;
     } catch {
     }
@@ -7241,7 +7419,7 @@ async function doRunProjectRename(oldPath, newPath, options, ctx) {
   const roster = manifest.repos ?? [];
   let oldIsAnchor = false;
   try {
-    oldIsAnchor = realpathSync(resolve7(repositoryRoot, oldPath)) === realpathSync(repositoryRoot);
+    oldIsAnchor = realpathSync(resolve8(repositoryRoot, oldPath)) === realpathSync(repositoryRoot);
   } catch {
     oldIsAnchor = false;
   }
@@ -7387,7 +7565,7 @@ async function doRunProjectNew(repos, options, ctx) {
   const viewStem = productName ?? workspaceName;
   const viewOverridesProjectName = productName !== void 0 && typeof options.view === "string";
   const declared = repos.map((p) => {
-    const abs = resolve7(cwd, p);
+    const abs = resolve8(cwd, p);
     let real;
     try {
       real = realpathSync(abs);
@@ -7573,7 +7751,7 @@ async function doRunProjectSeedAnchor(options, ctx) {
     console.log("\u2139\uFE0F No repo roster declared \u2014 nothing to seed.");
     return;
   }
-  const anchorDoc = join11(repositoryRoot, CANONICAL_FILE);
+  const anchorDoc = join12(repositoryRoot, CANONICAL_FILE);
   if (pathPresent(anchorDoc)) {
     console.log(
       `\u2705 The anchor's own \`${CANONICAL_FILE}\` already exists \u2014 hand-maintained, left untouched.`
@@ -7635,7 +7813,7 @@ function regularFileSpokes(repoReal) {
   const out = [];
   for (const spoke of ["CLAUDE.md", ".github/copilot-instructions.md"]) {
     try {
-      const st = lstatSync(join11(repoReal, spoke));
+      const st = lstatSync(join12(repoReal, spoke));
       if (!st.isSymbolicLink() && st.isFile()) out.push(spoke);
     } catch {
     }
@@ -7652,7 +7830,7 @@ function pathPresent(p) {
 }
 function gatherRetrofit(repositoryRoot, anchorReal, roster, argAbs, argReal, viewCanonicalName) {
   const declaredEntry = roster.find((entry) => {
-    const entryAbs = resolve7(repositoryRoot, entry.path);
+    const entryAbs = resolve8(repositoryRoot, entry.path);
     if (argReal !== void 0) {
       try {
         if (realpathSync(entryAbs) === argReal) return true;
@@ -7681,8 +7859,8 @@ function gatherRetrofit(repositoryRoot, anchorReal, roster, argAbs, argReal, vie
     };
   }
   const isAnchor = argReal === anchorReal;
-  const reachable = existsSync2(join11(argReal, ".git"));
-  const canonicalFile = join11(anchorReal, "agents", canonicalName, CANONICAL_FILE);
+  const reachable = existsSync2(join12(argReal, ".git"));
+  const canonicalFile = join12(anchorReal, "agents", canonicalName, CANONICAL_FILE);
   return {
     path,
     declared,
@@ -7691,13 +7869,13 @@ function gatherRetrofit(repositoryRoot, anchorReal, roster, argAbs, argReal, vie
     reachable,
     canonicalName,
     ...viewCanonicalName !== void 0 ? { viewCanonicalName } : {},
-    agentsState: inspectAgentsState(join11(argReal, CANONICAL_FILE)),
+    agentsState: inspectAgentsState(join12(argReal, CANONICAL_FILE)),
     canonicalExists: pathPresent(canonicalFile),
     regularSpokes: regularFileSpokes(argReal)
   };
 }
 function relocateAgentsFile(repoReal, canonicalFile) {
-  const agentsFile = join11(repoReal, CANONICAL_FILE);
+  const agentsFile = join12(repoReal, CANONICAL_FILE);
   try {
     mkdirSync(dirname4(canonicalFile), { recursive: true });
   } catch (error) {
@@ -7792,7 +7970,7 @@ async function doRunProjectRetrofit(repo, options, ctx) {
     }
     return result2;
   }
-  const argAbs = resolve7(repositoryRoot, repo);
+  const argAbs = resolve8(repositoryRoot, repo);
   let argReal;
   try {
     argReal = realpathSync(argAbs);
@@ -7813,7 +7991,7 @@ async function doRunProjectRetrofit(repo, options, ctx) {
   let failure;
   let partial = false;
   if (options.apply === true && plan.action === "relocate" && argReal !== void 0) {
-    const canonicalFile = join11(anchorReal, "agents", plan.canonicalName, CANONICAL_FILE);
+    const canonicalFile = join12(anchorReal, "agents", plan.canonicalName, CANONICAL_FILE);
     const res = relocateAgentsFile(argReal, canonicalFile);
     if (res.ok) {
       applied = true;
@@ -8013,88 +8191,19 @@ function renderProjectRetrofit(result) {
 }
 
 // src/commands/protocol.ts
-import { readFile as readFile4 } from "fs/promises";
-import { PROTOCOL_END, PROTOCOL_START, parseMarkers as parseMarkers4, readMarkdownFile as readMarkdownFile8 } from "@basou/core";
-
-// src/lib/protocols-config.ts
-import { homedir as homedir8 } from "os";
-import { isAbsolute as isAbsolute4, join as join12, resolve as resolve8 } from "path";
-import { readYamlFile as readYamlFile5 } from "@basou/core";
-var DEFAULT_PROTOCOLS_CONFIG_PATH = join12(homedir8(), ".basou", "protocols.yaml");
-var DEFAULT_TARGET_PATH = join12(homedir8(), ".claude", "CLAUDE.md");
-var ALLOWED_TOP_KEYS = /* @__PURE__ */ new Set(["version", "protocols"]);
-var ALLOWED_ENTRY_KEYS = /* @__PURE__ */ new Set(["source", "title"]);
-function expandTilde3(p) {
-  if (p === "~") return homedir8();
-  if (p.startsWith("~/")) return join12(homedir8(), p.slice(2));
-  return p;
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function loadProtocolsConfig(configPath = DEFAULT_PROTOCOLS_CONFIG_PATH) {
-  let raw;
-  try {
-    raw = await readYamlFile5(configPath);
-  } catch (error) {
-    if (error instanceof Error && error.message === "YAML file not found") {
-      throw new Error(
-        "No protocols config at ~/.basou/protocols.yaml. Create one (a 'protocols:' list of source markdown paths) before running 'basou protocol sync'."
-      );
-    }
-    if (error instanceof Error && error.message === "Failed to parse YAML content") {
-      throw new Error("~/.basou/protocols.yaml is not valid YAML.");
-    }
-    throw error;
-  }
-  if (!isRecord3(raw) || !Array.isArray(raw.protocols)) {
-    throw new Error("~/.basou/protocols.yaml must contain a 'protocols:' list.");
-  }
-  for (const key of Object.keys(raw)) {
-    if (!ALLOWED_TOP_KEYS.has(key)) {
-      throw new Error(
-        `~/.basou/protocols.yaml has an unknown key '${key}' (allowed: version, protocols).`
-      );
-    }
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const result = [];
-  for (const entry of raw.protocols) {
-    if (!isRecord3(entry)) {
-      throw new Error("Each protocol entry must be a mapping with a 'source' key.");
-    }
-    for (const key of Object.keys(entry)) {
-      if (!ALLOWED_ENTRY_KEYS.has(key)) {
-        throw new Error(`A protocol entry has an unknown key '${key}' (allowed: source, title).`);
-      }
-    }
-    if (typeof entry.source !== "string" || entry.source.trim().length === 0) {
-      throw new Error("Each protocol entry needs a non-empty string 'source'.");
-    }
-    if (entry.title !== void 0 && (typeof entry.title !== "string" || entry.title.trim().length === 0)) {
-      throw new Error("A protocol entry 'title' must be a non-empty string when present.");
-    }
-    const expanded = expandTilde3(entry.source.trim());
-    if (!isAbsolute4(expanded)) {
-      throw new Error("Protocol 'source' paths must be absolute (or start with '~').");
-    }
-    const abs = resolve8(expanded);
-    if (seen.has(abs)) {
-      throw new Error("Duplicate protocol source (each source path may appear only once).");
-    }
-    seen.add(abs);
-    result.push(
-      entry.title !== void 0 ? { source: abs, title: entry.title.trim() } : { source: abs }
-    );
-  }
-  if (result.length === 0) {
-    throw new Error("~/.basou/protocols.yaml has no protocols.");
-  }
-  return result;
-}
-
-// src/commands/protocol.ts
-var PROTOCOL_MARKERS = { start: PROTOCOL_START, end: PROTOCOL_END };
+import { readFile as readFile4, stat as stat5 } from "fs/promises";
+import {
+  carryForwardProtocolStamp,
+  PROTOCOL_END as PROTOCOL_END2,
+  PROTOCOL_START as PROTOCOL_START2,
+  parseMarkers as parseMarkers4,
+  parseProtocolStamp as parseProtocolStamp2,
+  protocolBlockHash,
+  readMarkdownFile as readMarkdownFile8,
+  renderProtocolStamp,
+  unstampedProtocolSectionsFrom
+} from "@basou/core";
+var PROTOCOL_MARKERS = { start: PROTOCOL_START2, end: PROTOCOL_END2 };
 var MANAGED_NOTE = "<!-- Managed by basou: 'basou protocol sync' regenerates everything between the BASOU:PROTOCOLS markers from ~/.basou/protocols.yaml. Manual edits inside the block are overwritten; edit the source files instead. -->";
 function registerProtocolCommand(program2) {
   const protocol = program2.command("protocol").description("Manage the basou-managed standing-protocol block in the global CLAUDE.md");
@@ -8154,24 +8263,54 @@ async function readProtocolSources(entries) {
   }
   return out;
 }
-function buildBlock(sources) {
-  const sections = sources.map(({ entry, content }) => {
+function buildSections(sources) {
+  return sources.map(({ entry, content }) => {
     const body = content.replace(/\s+$/, "");
     return entry.title !== void 0 ? `## ${entry.title}
 
 ${body}` : body;
-  });
+  }).join("\n\n");
+}
+function buildBlock(sections, stamp) {
   return `${MANAGED_NOTE}
+${renderProtocolStamp(stamp)}
 
-${sections.join("\n\n")}
+${sections}
 `;
 }
+async function readPreviousStamp(target) {
+  const existing = await readMarkdownFile8(target);
+  if (existing === null) return null;
+  const section = parseMarkers4(existing, PROTOCOL_MARKERS);
+  if (section.kind !== "ok") return null;
+  const stamp = parseProtocolStamp2(section.generated);
+  if (stamp !== null) return stamp;
+  const writtenAt = await lastWrittenAt(target);
+  if (writtenAt === null) return null;
+  return {
+    changedAt: writtenAt,
+    contentHash: protocolBlockHash(unstampedProtocolSectionsFrom(section.generated))
+  };
+}
+async function lastWrittenAt(target) {
+  try {
+    return new Date((await stat5(target)).mtimeMs).toISOString();
+  } catch {
+    return null;
+  }
+}
 async function doRunProtocolSync(options, ctx = {}) {
   const configPath = options.config ?? DEFAULT_PROTOCOLS_CONFIG_PATH;
   const target = options.target ?? DEFAULT_TARGET_PATH;
   const entries = await loadProtocolsConfig(configPath);
   const sources = await readProtocolSources(entries);
-  const block = buildBlock(sources);
+  const sections = buildSections(sources);
+  const stamp = carryForwardProtocolStamp({
+    sections,
+    previous: await readPreviousStamp(target),
+    now: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  const block = buildBlock(sections, stamp);
   const foreign = await findForeignWorkspaceNames({
     text: block,
     configPath: ctx.portfolioConfigPath
@@ -8241,7 +8380,7 @@ import {
 import { InvalidArgumentError as InvalidArgumentError4 } from "commander";
 
 // src/commands/refresh-watch.ts
-import { readdir as readdir2, stat as stat5 } from "fs/promises";
+import { readdir as readdir2, stat as stat6 } from "fs/promises";
 import { homedir as homedir9 } from "os";
 import { join as join13 } from "path";
 import { findErrorCode as findErrorCode8 } from "@basou/core";
@@ -8270,7 +8409,7 @@ async function scanSourceLogs(roots) {
         await walk(full);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         try {
-          const info = await stat5(full);
+          const info = await stat6(full);
           out.set(full, { mtimeMs: info.mtimeMs, size: info.size });
         } catch (error) {
           if (findErrorCode8(error, "ENOENT")) continue;
@@ -11730,7 +11869,7 @@ import { InvalidArgumentError as InvalidArgumentError8 } from "commander";
 
 // src/lib/portfolio-coverage.ts
 import { createReadStream as createReadStream2 } from "fs";
-import { readdir as readdir3, stat as stat6 } from "fs/promises";
+import { readdir as readdir3, stat as stat7 } from "fs/promises";
 import { homedir as homedir12 } from "os";
 import { basename as basename8, dirname as dirname5, join as join17 } from "path";
 import { createInterface as createInterface2 } from "readline";
@@ -11877,7 +12016,7 @@ async function isDirEntry(parent, entry) {
   if (entry.isDirectory()) return true;
   if (!entry.isSymbolicLink()) return false;
   try {
-    return (await stat6(join17(parent, entry.name))).isDirectory();
+    return (await stat7(join17(parent, entry.name))).isDirectory();
   } catch {
     return false;
   }
@@ -12575,6 +12714,18 @@ var VIEW_HTML = `<!doctype html>
     return el('span', { class: 'badge ok', text: 'up to date' });
   }
 
+  // Three states hide behind a bare 'in-flight 0': nothing ever recorded,
+  // everything finished, and a task store that cannot be read -- where the
+  // count is not zero but UNKNOWN. Say which one it is, as orient does.
+  // Kept as a named top-level function with no free variables so the test suite
+  // can lift it out of this template and run it; inlined in the card it was
+  // unreachable from any test.
+  function taskFlightLabel(w) {
+    if (w.unreadableTaskCount > 0) return 'in-flight unknown (' + w.unreadableTaskCount + ' unreadable)';
+    if (w.anyTaskEverRecorded === false) return 'no tasks recorded';
+    return 'in-flight ' + w.inFlightCount;
+  }
+
   function portfolioCard(w, generatedAt) {
     if (!w.initialized) {
       return el('div', { class: 'card pcard muted' }, [
@@ -12590,6 +12741,7 @@ var VIEW_HTML = `<!doctype html>
     }
     var pend = w.pendingApprovals || [];
     var pendText = 'pending ' + pend.length + (pend.length ? ' (' + highestRisk(pend) + ')' : '');
+    var flightText = taskFlightLabel(w);
     var now = w.latestSession ? ((w.latestSession.label || '(session)') + ' [' + w.latestSession.status + ']') : '(no live sessions)';
     var dec = w.latestDecision ? w.latestDecision.title : '(no decisions yet)';
     var newest = (w.freshness && w.freshness.newestStartedAt) ? w.freshness.newestStartedAt : null;
@@ -12602,7 +12754,7 @@ var VIEW_HTML = `<!doctype html>
       ]),
       el('div', { class: 'f', text: 'now: ' + now }),
       el('div', { class: 'f', text: 'latest: ' + dec }),
-      el('div', { class: 'f', text: 'in-flight ' + w.inFlightCount + '  |  ' + pendText + '  |  suspect ' + w.suspectCount }),
+      el('div', { class: 'f', text: flightText + '  |  ' + pendText + '  |  suspect ' + w.suspectCount }),
       el('div', { class: 'f muted', text: 'sessions ' + w.sessionCount + '  |  newest ' + relAge(newest, generatedAt) })
     ]);
   }
@@ -13179,6 +13331,13 @@ async function portfolioCard(ws, nowIso) {
       sessionCount: s.sessionCount,
       suspectCount: s.suspects.length,
       inFlightCount: s.inFlightTasks.length,
+      // Three states hide behind `inFlightCount: 0`: nothing ever recorded,
+      // everything finished, and a store whose task files cannot be read (where
+      // the count is not 0 but UNKNOWN). `orient` branches all three ways; the
+      // card carries the two extra facts so it can too, instead of reporting a
+      // loader blind spot as an empty record.
+      anyTaskEverRecorded: s.anyTaskEverRecorded,
+      unreadableTaskCount: s.unreadableTaskCount,
       pendingApprovals: s.pendingApprovals.map((a) => ({
         risk: a.risk,
         kind: a.kind,
@@ -13646,7 +13805,7 @@ async function assertWorkspaceInitialized15(basouRoot) {
 function readBuildStamp() {
   if (false) return void 0;
   try {
-    return JSON.parse('{"version":"0.45.0","commit":"6b04208","committedAt":"2026-09-19T01:07:28+09:00"}');
+    return JSON.parse('{"version":"0.47.0","commit":"831e0cb","committedAt":"2026-09-20T22:28:13+09:00"}');
   } catch {
     return void 0;
   }