@chrisdudek/yg 5.0.0-alpha.1 → 5.0.0-alpha.3

package/dist/bin.js

@@ -172,14 +172,14 @@ var init_mapping_path = __esm({
 });
 
 // src/io/paths.ts
-import path8 from "path";
+import path9 from "path";
 import { fileURLToPath } from "url";
 import { stat as stat2 } from "fs/promises";
 async function findYggRoot(projectRoot) {
-  let current = path8.resolve(projectRoot);
-  const root = path8.parse(current).root;
+  let current = path9.resolve(projectRoot);
+  const root = path9.parse(current).root;
   while (true) {
-    const yggPath = path8.join(current, ".yggdrasil");
+    const yggPath = path9.join(current, ".yggdrasil");
     try {
       const st = await stat2(yggPath);
       if (!st.isDirectory()) {
@@ -193,7 +193,7 @@ async function findYggRoot(projectRoot) {
         if (current === root) {
           throw new Error(`No .yggdrasil/ directory found. Run 'yg init' first.`, { cause: err });
         }
-        current = path8.dirname(current);
+        current = path9.dirname(current);
         continue;
       }
       throw err;
@@ -218,20 +218,20 @@ function normalizeProjectRelativePath(projectRoot, rawPath) {
   if (normalizedInput.length === 0) {
     throw new Error("Path cannot be empty");
   }
-  const absolute = path8.resolve(projectRoot, normalizedInput);
-  const relative4 = path8.relative(projectRoot, absolute);
-  const isOutside = relative4.startsWith("..") || path8.isAbsolute(relative4);
+  const absolute = path9.resolve(projectRoot, normalizedInput);
+  const relative3 = path9.relative(projectRoot, absolute);
+  const isOutside = relative3.startsWith("..") || path9.isAbsolute(relative3);
   if (isOutside) {
     throw new Error(`Path is outside project root: ${rawPath}`);
   }
-  return toPosixPath(relative4);
+  return toPosixPath(relative3);
 }
 function projectRootFromGraph(yggRootPath) {
-  return path8.dirname(yggRootPath);
+  return path9.dirname(yggRootPath);
 }
 function resolveFileArg(repoRoot, rawPath) {
-  const absolute = path8.resolve(repoRoot, rawPath.trim());
-  return toPosixPath(path8.relative(repoRoot, absolute));
+  const absolute = path9.resolve(repoRoot, rawPath.trim());
+  return toPosixPath(path9.relative(repoRoot, absolute));
 }
 var init_paths = __esm({
   "src/io/paths.ts"() {
@@ -252,9 +252,9 @@ var init_drift = __esm({
 
 // src/io/atomic-write.ts
 import { writeFile as writeFile3, rename, mkdir as mkdir2, rm } from "fs/promises";
-import path10 from "path";
+import path11 from "path";
 async function atomicWriteFile(filePath, content14) {
-  const dir = path10.dirname(filePath);
+  const dir = path11.dirname(filePath);
   await mkdir2(dir, { recursive: true });
   const tmpPath = `${filePath}.tmp`;
   await rm(tmpPath, { force: true });
@@ -269,7 +269,7 @@ var init_atomic_write = __esm({
 
 // src/io/drift-state-store.ts
 import { readFile as readFile10, stat as stat3, readdir as readdir3, rm as rm2 } from "fs/promises";
-import path11 from "path";
+import path12 from "path";
 function validateBaselineShape(nodePath, parsed) {
   if (parsed === null || typeof parsed !== "object") {
     throw new OutdatedDriftBaselineError(nodePath, void 0);
@@ -285,7 +285,7 @@ function validateBaselineShape(nodePath, parsed) {
   return parsed;
 }
 function nodeStatePath(yggRoot, nodePath) {
-  return path11.join(yggRoot, DRIFT_STATE_DIR, `${nodePath}.json`);
+  return path12.join(yggRoot, DRIFT_STATE_DIR, `${nodePath}.json`);
 }
 async function scanJsonFiles(dir, baseDir) {
   const results = [];
@@ -297,12 +297,12 @@ async function scanJsonFiles(dir, baseDir) {
     return results;
   }
   for (const entry of entries) {
-    const fullPath = path11.join(dir, entry.name);
+    const fullPath = path12.join(dir, entry.name);
     if (entry.isDirectory()) {
       const nested = await scanJsonFiles(fullPath, baseDir);
       results.push(...nested);
     } else if (entry.isFile() && entry.name.endsWith(".json")) {
-      const relPath = path11.relative(baseDir, fullPath);
+      const relPath = path12.relative(baseDir, fullPath);
       const nodePath = toPosix(relPath).replace(/\.json$/, "");
       results.push(nodePath);
     }
@@ -310,13 +310,13 @@ async function scanJsonFiles(dir, baseDir) {
   return results;
 }
 async function removeEmptyParents(filePath, stopDir) {
-  let dir = path11.dirname(filePath);
+  let dir = path12.dirname(filePath);
   while (dir !== stopDir && dir.startsWith(stopDir)) {
     try {
       const entries = await readdir3(dir);
       if (entries.length === 0) {
         await rm2(dir, { recursive: true });
-        dir = path11.dirname(dir);
+        dir = path12.dirname(dir);
       } else {
         break;
       }
@@ -358,7 +358,7 @@ async function clearDraftAspectsFromDriftState(yggRoot, nodePath, aspectIdsToCle
   await writeNodeDriftState(yggRoot, nodePath, state);
 }
 async function garbageCollectDriftState(yggRoot, validNodePaths, shouldKeep) {
-  const driftDir = path11.join(yggRoot, DRIFT_STATE_DIR);
+  const driftDir = path12.join(yggRoot, DRIFT_STATE_DIR);
   const allNodePaths = await scanJsonFiles(driftDir, driftDir);
   const removed = [];
   for (const nodePath of allNodePaths) {
@@ -374,7 +374,7 @@ async function garbageCollectDriftState(yggRoot, validNodePaths, shouldKeep) {
   return removed.sort();
 }
 async function readDriftState(yggRoot) {
-  const driftPath = path11.join(yggRoot, DRIFT_STATE_DIR);
+  const driftPath = path12.join(yggRoot, DRIFT_STATE_DIR);
   let driftStat;
   try {
     driftStat = await stat3(driftPath);
@@ -570,9 +570,25 @@ async function collectFiles(dir, projectRoot, stack) {
   }
   return results;
 }
+function excludeNestedGraphSubtrees(relPaths) {
+  const seg = `/${YGGDRASIL_DIRNAME}/`;
+  const nestedRoots = /* @__PURE__ */ new Set();
+  for (const p2 of relPaths) {
+    const idx = p2.indexOf(seg);
+    if (idx > 0) nestedRoots.add(p2.slice(0, idx));
+  }
+  if (nestedRoots.size === 0) return relPaths;
+  return relPaths.filter((p2) => {
+    for (const root of nestedRoots) {
+      if (p2 === root || p2.startsWith(root + "/")) return false;
+    }
+    return true;
+  });
+}
 async function walkRepoFiles(projectRoot) {
   const stack = await loadRootGitignoreStack(projectRoot);
-  return collectFiles(projectRoot, projectRoot, stack);
+  const files = await collectFiles(projectRoot, projectRoot, stack);
+  return excludeNestedGraphSubtrees(files);
 }
 var require2, ignoreFactory, YGGDRASIL_DIRNAME;
 var init_repo_scanner = __esm({
@@ -587,7 +603,7 @@ var init_repo_scanner = __esm({
 
 // src/io/hash.ts
 import { readFile as readFile16, readdir as readdir7, stat as stat5 } from "fs/promises";
-import path15 from "path";
+import path16 from "path";
 import { createHash } from "crypto";
 import { createRequire as createRequire2 } from "module";
 async function hashFile(filePath) {
@@ -597,7 +613,7 @@ async function hashFile(filePath) {
 async function loadRootGitignoreStack2(projectRoot) {
   if (!projectRoot) return [];
   try {
-    const content14 = await readFile16(path15.join(projectRoot, ".gitignore"), "utf-8");
+    const content14 = await readFile16(path16.join(projectRoot, ".gitignore"), "utf-8");
     const matcher = ignoreFactory2();
     matcher.add(content14);
     return [{ basePath: projectRoot, matcher }];
@@ -607,7 +623,7 @@ async function loadRootGitignoreStack2(projectRoot) {
 }
 function isIgnoredByStack2(candidatePath, stack) {
   for (const { basePath, matcher } of stack) {
-    const relativePath = toPosix(path15.relative(basePath, candidatePath));
+    const relativePath = toPosix(path16.relative(basePath, candidatePath));
     if (relativePath === "" || relativePath.startsWith("..")) continue;
     if (matcher.ignores(relativePath) || matcher.ignores(relativePath + "/")) return true;
   }
@@ -636,20 +652,30 @@ function serializeIdentity(identity) {
     `aspects={${aspectLines}}`
   ].join("\n");
 }
-function computeCanonicalHash(fileHashes, identity) {
+function serializeVerdicts(verdicts) {
+  return Object.keys(verdicts).sort().map((id) => {
+    const v = verdicts[id];
+    return `id=${id}|verdict=${v.verdict}|errorSource=${v.errorSource ?? ""}`;
+  }).join("\n");
+}
+function computeCanonicalHash(fileHashes, identity, verdicts = {}) {
   const filesDigest = Object.entries(fileHashes).map(([p2, h]) => `${p2}:${h}`).sort().join("\n");
-  return hashString(`files:
+  return hashString(
+    `files:
 ${filesDigest}
 identity:
-${serializeIdentity(identity)}`);
+${serializeIdentity(identity)}
+verdicts:
+${serializeVerdicts(verdicts)}`
+  );
 }
-async function hashTrackedFiles(projectRoot, trackedFiles, storedFileData, excludePrefixes, identity) {
+async function hashTrackedFiles(projectRoot, trackedFiles, storedFileData, excludePrefixes, identity, verdicts, reuseByMtime = true) {
   const fileHashes = {};
   const fileMtimes = {};
   const gitignoreStack = await loadRootGitignoreStack2(projectRoot);
   const allFiles = [];
   for (const tf of trackedFiles) {
-    const absPath = path15.join(projectRoot, tf.path);
+    const absPath = path16.join(projectRoot, tf.path);
     try {
       const st = await stat5(absPath);
       if (st.isDirectory()) {
@@ -659,7 +685,7 @@ async function hashTrackedFiles(projectRoot, trackedFiles, storedFileData, exclu
         });
         for (const entry of dirEntries) {
           allFiles.push({
-            relPath: toPosixPath(path15.join(tf.path, entry.relPath)),
+            relPath: toPosixPath(path16.join(tf.path, entry.relPath)),
             absPath: entry.absPath,
             mtimeMs: entry.mtimeMs
           });
@@ -676,7 +702,7 @@ async function hashTrackedFiles(projectRoot, trackedFiles, storedFileData, exclu
   for (const entry of filtered) {
     const storedMtime = storedFileData?.mtimes[entry.relPath];
     const storedHash = storedFileData?.hashes[entry.relPath];
-    if (storedMtime !== void 0 && storedHash !== void 0 && entry.mtimeMs === storedMtime) {
+    if (reuseByMtime && storedMtime !== void 0 && storedHash !== void 0 && entry.mtimeMs === storedMtime) {
       fileHashes[entry.relPath] = storedHash;
     } else {
       dirty.push(entry);
@@ -691,13 +717,13 @@ async function hashTrackedFiles(projectRoot, trackedFiles, storedFileData, exclu
       fileHashes[batch[j].relPath] = hashes[j];
     }
   }
-  const canonicalHash = computeCanonicalHash(fileHashes, identity ?? EMPTY_IDENTITY);
+  const canonicalHash = computeCanonicalHash(fileHashes, identity ?? EMPTY_IDENTITY, verdicts ?? {});
   return { canonicalHash, fileHashes, fileMtimes };
 }
 async function collectDirectoryFilePaths(directoryPath, rootDirectoryPath, options) {
   let stack = options.gitignoreStack ?? [];
   try {
-    const localContent = await readFile16(path15.join(directoryPath, ".gitignore"), "utf-8");
+    const localContent = await readFile16(path16.join(directoryPath, ".gitignore"), "utf-8");
     const localMatcher = ignoreFactory2();
     localMatcher.add(localContent);
     stack = [...stack, { basePath: directoryPath, matcher: localMatcher }];
@@ -707,7 +733,7 @@ async function collectDirectoryFilePaths(directoryPath, rootDirectoryPath, optio
   const dirs = [];
   const files = [];
   for (const entry of entries) {
-    const absoluteChildPath = path15.join(directoryPath, entry.name);
+    const absoluteChildPath = path16.join(directoryPath, entry.name);
     if (isIgnoredByStack2(absoluteChildPath, stack)) continue;
     if (entry.isDirectory()) dirs.push(absoluteChildPath);
     else if (entry.isFile()) files.push(absoluteChildPath);
@@ -720,7 +746,7 @@ async function collectDirectoryFilePaths(directoryPath, rootDirectoryPath, optio
     Promise.all(files.map(async (f) => {
       const fileStat = await stat5(f);
       return {
-        relPath: toPosixPath(path15.relative(rootDirectoryPath, f)),
+        relPath: toPosixPath(path16.relative(rootDirectoryPath, f)),
         absPath: f,
         mtimeMs: fileStat.mtimeMs
       };
@@ -735,7 +761,7 @@ async function expandMappingPaths(projectRoot, mappingPaths) {
   const gitignoreStack = await loadRootGitignoreStack2(projectRoot);
   const result = [];
   for (const mp of mappingPaths) {
-    const absPath = path15.join(projectRoot, mp);
+    const absPath = path16.join(projectRoot, mp);
     try {
       const st = await stat5(absPath);
       if (st.isDirectory()) {
@@ -744,7 +770,7 @@ async function expandMappingPaths(projectRoot, mappingPaths) {
           gitignoreStack
         });
         for (const entry of dirEntries) {
-          result.push(toPosixPath(path15.join(mp, entry.relPath)));
+          result.push(toPosixPath(path16.join(mp, entry.relPath)));
         }
       } else {
         result.push(toPosixPath(mp));
@@ -1081,11 +1107,16 @@ function attachmentMachineOrigin(att, node) {
 }
 function hasNonDraftEffectiveAspects(node, graph) {
   const statuses = computeEffectiveAspectStatuses(node, graph);
-  for (const s of statuses.values()) {
-    if (s !== "draft") return true;
+  for (const [aspectId, s] of statuses) {
+    if (s === "draft") continue;
+    if (isAggregateAspect(graph, aspectId)) continue;
+    return true;
   }
   return false;
 }
+function isAggregateAspect(graph, aspectId) {
+  return graph.aspects.find((a) => a.id === aspectId)?.reviewer.type === "aggregate";
+}
 var ImpliesCycleError;
 var init_aspects = __esm({
   "src/core/graph/aspects.ts"() {
@@ -1191,19 +1222,19 @@ var init_tier_identity = __esm({
 });
 
 // src/core/graph/files.ts
-import path18 from "path";
+import path19 from "path";
 import { createHash as createHash2 } from "crypto";
 function emptyIdentity() {
   return { ownSubset: sha256Hex(""), ports: {}, aspects: {} };
 }
 function yggPrefixOf(graph) {
-  return path18.relative(path18.dirname(graph.rootPath), graph.rootPath).split(/[\\/]/).join("/");
+  return path19.relative(path19.dirname(graph.rootPath), graph.rootPath).split(/[\\/]/).join("/");
 }
 function collectTrackedFiles(node, graph, baseline) {
   const seen = /* @__PURE__ */ new Set();
   const result = [];
-  const projectRoot = path18.dirname(graph.rootPath);
-  const yggPrefix = path18.relative(projectRoot, graph.rootPath);
+  const projectRoot = path19.dirname(graph.rootPath);
+  const yggPrefix = path19.relative(projectRoot, graph.rootPath);
   const yggPrefixNormalized = toPosixPath(yggPrefix);
   const identityAspects = {};
   const identityPorts = {};
@@ -1559,7 +1590,7 @@ var init_language_registry = __esm({
 });
 
 // src/core/drift-cause.ts
-import path24 from "path";
+import path25 from "path";
 function serializeCheckTouched(ct) {
   if (!ct) return "";
   return Object.keys(ct).sort().map((k) => `${k}=${ct[k]}`).join(",");
@@ -1616,13 +1647,13 @@ function diffIdentity(nodePath, stored, current) {
   return causes;
 }
 function categorizeFile(filePath, rootPath, projectRoot) {
-  const yggPrefix = toPosixPath(path24.relative(projectRoot, rootPath));
+  const yggPrefix = toPosixPath(path25.relative(projectRoot, rootPath));
   const normalized = toPosixPath(filePath);
   return normalized.startsWith(yggPrefix) ? "graph" : "source";
 }
 function describeCascadeCause(filePath, layer, graph) {
   const normalized = toPosixPath(filePath);
-  const yggPrefix = toPosixPath(path24.relative(path24.dirname(graph.rootPath), graph.rootPath));
+  const yggPrefix = toPosixPath(path25.relative(path25.dirname(graph.rootPath), graph.rootPath));
   const escPrefix = yggPrefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   if (layer === "aspects") {
     const match = normalized.match(new RegExp(`${escPrefix}/aspects/([^/]+(?:/[^/]+)*)/`));
@@ -1879,7 +1910,7 @@ var init_log_integrity = __esm({
 
 // src/core/approve.ts
 import { createHash as createHash4 } from "crypto";
-import path25 from "path";
+import path26 from "path";
 async function approveNode(graph, nodePath, _options = {}) {
   const node = graph.nodes.get(nodePath);
   if (!node) throw new Error(`Node '${nodePath}' does not exist.`);
@@ -1973,7 +2004,7 @@ ${violations.map((v) => `  line ${v.line}: ${v.reason} \u2014 ${v.detail}`).join
     const pendingDriftState = baseline && action2 !== "no-change" ? { nodePath, state: { schemaVersion: DRIFT_STATE_SCHEMA_VERSION, hash: "", files: {}, identity: emptyIdentity(), aspectVerdicts: {}, log: baseline } } : void 0;
     return { action: action2, currentHash: "", previousHash: storedEntry?.hash, gcPaths: gcPaths2, pendingDriftState };
   }
-  const projectRoot = path25.dirname(graph.rootPath);
+  const projectRoot = path26.dirname(graph.rootPath);
   if (!hasNonDraftEffectiveAspects(node, graph)) {
     const sourceChangedDraft = await sourceFilesChanged(node, graph, projectRoot, storedEntry);
     if (logRequired && sourceChangedDraft.length > 0 && !hasFreshLogEntry(logSnapshot.content, storedEntry?.log)) {
@@ -2085,6 +2116,7 @@ ${violations.map((v) => `  line ${v.line}: ${v.reason} \u2014 ${v.detail}`).join
     const statuses = computeEffectiveAspectStatuses(node, graph);
     for (const [aspectId, status] of statuses) {
       if (status === "draft") continue;
+      if (isAggregateAspect(graph, aspectId)) continue;
       if (!storedEntry.aspectVerdicts[aspectId]) newlyActiveAspects.push(aspectId);
     }
   }
@@ -2146,7 +2178,7 @@ async function evaluateAllDraftLogGate(graph, nodePath) {
   if (!logRequiredFor(node, graph)) return null;
   const storedEntry = await readNodeDriftState(graph.rootPath, nodePath);
   const logSnapshot = await snapshotLog(graph.rootPath, nodePath);
-  const projectRoot = path25.dirname(graph.rootPath);
+  const projectRoot = path26.dirname(graph.rootPath);
   const changed = await sourceFilesChanged(node, graph, projectRoot, storedEntry);
   if (changed.length > 0 && !hasFreshLogEntry(logSnapshot.content, storedEntry?.log)) {
     return mandatoryLogRefusal(node, nodePath, changed);
@@ -2201,7 +2233,7 @@ async function sourceFilesChanged(node, graph, projectRoot, storedEntry) {
   return changed;
 }
 async function snapshotLog(yggRoot, nodePath) {
-  const logPath2 = path25.join(yggRoot, "model", nodePath, "log.md");
+  const logPath2 = path26.join(yggRoot, "model", nodePath, "log.md");
   try {
     const st = await lstatFile(logPath2);
     if (st.isSymbolicLink()) {
@@ -2297,7 +2329,7 @@ async function loadSourceFiles(filePaths, projectRoot) {
   for (const filePath of filePaths) {
     const posixPath4 = toPosixPath(filePath);
     try {
-      const content14 = await readTextFile(path25.join(projectRoot, filePath));
+      const content14 = await readTextFile(path26.join(projectRoot, filePath));
       results.push({ path: posixPath4, content: content14 });
     } catch (err) {
       debugWrite(`[approve] skipped unreadable file ${posixPath4}: ${err.message}`);
@@ -2377,7 +2409,6 @@ var init_xml_escape = __esm({
 var aspect_verifier_exports = {};
 __export(aspect_verifier_exports, {
   buildPrompt: () => buildPrompt,
-  chunkSourceFiles: () => chunkSourceFiles,
   verifyAspects: () => verifyAspects
 });
 function buildPrompt(aspect, nodeDescription, nodePath, sourceFiles, references = []) {
@@ -2427,31 +2458,6 @@ ${aspect.content}
 ${files}
 </source-files>`;
 }
-function chunkSourceFiles(files, maxTokens) {
-  const overhead = 500;
-  const effectiveMax = Math.max(maxTokens, 1e3);
-  const available = (effectiveMax - overhead) * 4;
-  const chunks = [];
-  let current = [];
-  let currentSize = 0;
-  for (const file of files) {
-    const fileSize = file.path.length + file.content.length + 30;
-    if (fileSize > available) {
-      const truncated = file.content.slice(0, available);
-      chunks.push([{ path: file.path, content: truncated + "\n[... truncated]" }]);
-      continue;
-    }
-    if (currentSize + fileSize > available && current.length > 0) {
-      chunks.push(current);
-      current = [];
-      currentSize = 0;
-    }
-    current.push(file);
-    currentSize += fileSize;
-  }
-  if (current.length > 0) chunks.push(current);
-  return chunks.length > 0 ? chunks : [[]];
-}
 async function verifyWithConsensus(provider, prompt, consensus) {
   if (consensus <= 1) {
     return provider.verifyAspect(prompt);
@@ -2474,29 +2480,12 @@ async function verifyWithConsensus(provider, prompt, consensus) {
   };
 }
 async function verifyAspects(params) {
-  const { provider, aspects, sourceFiles, nodePath, nodeDescription, consensus = 1, maxTokens } = params;
-  if (sourceFiles.length === 0) {
-    return Object.fromEntries(aspects.map((a) => [a.id, { satisfied: true, reason: "No source files", errorSource: "codeViolation" }]));
-  }
-  const tokenBudget = maxTokens ?? 8192;
-  const chunks = chunkSourceFiles(sourceFiles, tokenBudget);
+  const { provider, aspects, sourceFiles, nodePath, nodeDescription, consensus = 1 } = params;
   const results = {};
   for (const aspect of aspects) {
-    let failed = false;
-    let failReason = "";
-    let failErrorSource = "codeViolation";
-    for (const chunk of chunks) {
-      if (chunk.length === 0) continue;
-      const prompt = buildPrompt(aspect, nodeDescription, nodePath, chunk, aspect.references ?? []);
-      const result = await verifyWithConsensus(provider, prompt, consensus);
-      if (!result.satisfied) {
-        failed = true;
-        failReason = result.reason;
-        failErrorSource = result.errorSource;
-        break;
-      }
-    }
-    results[aspect.id] = failed ? { satisfied: false, reason: failReason, errorSource: failErrorSource } : { satisfied: true, reason: `All rules satisfied across ${chunks.length} file group(s)`, errorSource: "codeViolation" };
+    const prompt = buildPrompt(aspect, nodeDescription, nodePath, sourceFiles, aspect.references ?? []);
+    const r = await verifyWithConsensus(provider, prompt, consensus);
+    results[aspect.id] = { satisfied: r.satisfied, reason: r.reason, errorSource: r.errorSource };
   }
   return results;
 }
@@ -2513,11 +2502,6 @@ function resolveApiKey(config) {
   const envVar = ENV_VAR_MAP[config.provider];
   return envVar ? process.env[envVar] : void 0;
 }
-async function resolveMaxTokens(config, provider) {
-  if (typeof config.max_tokens === "number") return config.max_tokens;
-  const detected = await provider.getContextWindowSize();
-  return detected ?? 8192;
-}
 async function apiFetch(url, init2, providerName, timeoutMs = 6e4) {
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
@@ -2640,9 +2624,6 @@ var init_cli_base = __esm({
           return false;
         }
       }
-      async getContextWindowSize() {
-        return void 0;
-      }
       async verifyAspect(prompt) {
         const fallback = { satisfied: false, reason: "Reviewer unavailable", errorSource: "provider" };
         return new Promise((resolve6) => {
@@ -2725,12 +2706,10 @@ var init_ollama = __esm({
       endpoint;
       model;
       temperature;
-      contextLengthField;
       constructor(config) {
         this.endpoint = config.endpoint ?? "http://localhost:11434";
         this.model = config.model;
         this.temperature = config.temperature;
-        this.contextLengthField = config.context_length_field;
       }
       async isAvailable() {
         try {
@@ -2741,25 +2720,6 @@ var init_ollama = __esm({
           return false;
         }
       }
-      async getContextWindowSize() {
-        try {
-          const res = await apiFetch(`${this.endpoint}/api/show`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ name: this.model })
-          }, "ollama", 5e3);
-          if (!res.ok) return void 0;
-          const data = await res.json();
-          const params = data.model_info;
-          if (!params) return void 0;
-          const key = this.contextLengthField ?? Object.keys(params).find((k) => k === "context_length" || k.endsWith(".context_length"));
-          const ctxLength = key ? params[key] : void 0;
-          return ctxLength ?? void 0;
-        } catch (err) {
-          debugWrite(`[ollama] getContextWindowSize: ${err.message}`);
-          return void 0;
-        }
-      }
       async verifyAspect(prompt) {
         const fallback = { satisfied: false, reason: "LLM response could not be parsed", errorSource: "provider" };
         const body = {
@@ -2874,9 +2834,6 @@ var init_openai = __esm({
       async isAvailable() {
         return !!this.apiKey;
       }
-      async getContextWindowSize() {
-        return void 0;
-      }
     };
     registerProvider("openai", (c) => new OpenAIProvider(c));
     registerProvider("openai-compatible", (c) => new OpenAIProvider(c));
@@ -2931,9 +2888,6 @@ var init_anthropic = __esm({
       async isAvailable() {
         return !!this.apiKey;
       }
-      async getContextWindowSize() {
-        return void 0;
-      }
     };
     registerProvider("anthropic", (c) => new AnthropicProvider(c));
   }
@@ -2987,9 +2941,6 @@ var init_google = __esm({
       async isAvailable() {
         return !!this.apiKey;
       }
-      async getContextWindowSize() {
-        return void 0;
-      }
     };
     registerProvider("google", (c) => new GoogleProvider(c));
   }
@@ -3073,6 +3024,7 @@ function buildAspectVerdicts(node, graph, allAspectResults) {
   const carryForward = [];
   for (const [aspectId, status] of statuses) {
     if (status === "draft") continue;
+    if (isAggregateAspect(graph, aspectId)) continue;
     const res = allAspectResults[aspectId];
     if (res === void 0) {
       carryForward.push(aspectId);
@@ -3091,8 +3043,10 @@ function buildAspectVerdicts(node, graph, allAspectResults) {
 function reviewerAborted(node, graph, allAspectResults) {
   if (Object.keys(allAspectResults).length > 0) return false;
   const statuses = computeEffectiveAspectStatuses(node, graph);
-  for (const s of statuses.values()) {
-    if (s !== "draft") return true;
+  for (const [aspectId, s] of statuses) {
+    if (s === "draft") continue;
+    if (isAggregateAspect(graph, aspectId)) continue;
+    return true;
   }
   return false;
 }
@@ -3122,15 +3076,15 @@ var init_approve_verdicts = __esm({
 // src/ast/loader-hook.ts
 import { register } from "module";
 import { pathToFileURL } from "url";
-import path26 from "path";
+import path27 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { existsSync as existsSync3 } from "fs";
 function ensureLoaderRegistered() {
   if (registered) return;
-  let implPath = path26.resolve(__dirname, "./loader-hook-impl.js");
+  let implPath = path27.resolve(__dirname, "./loader-hook-impl.js");
   if (!existsSync3(implPath)) {
-    const pkgRoot = path26.resolve(__dirname, "../../");
-    implPath = path26.resolve(pkgRoot, "dist/loader-hook-impl.js");
+    const pkgRoot = path27.resolve(__dirname, "../../");
+    implPath = path27.resolve(pkgRoot, "dist/loader-hook-impl.js");
   }
   register(pathToFileURL(implPath));
   registered = true;
@@ -3140,14 +3094,14 @@ var init_loader_hook = __esm({
   "src/ast/loader-hook.ts"() {
     "use strict";
     __filename = fileURLToPath3(import.meta.url);
-    __dirname = path26.dirname(__filename);
+    __dirname = path27.dirname(__filename);
     registered = false;
   }
 });
 
 // src/structure/ctx-fs.ts
 import * as fs from "fs";
-import * as path27 from "path";
+import * as path28 from "path";
 function isAllowed(p2, set) {
   if (p2 === "") return false;
   if (set.has(p2)) return true;
@@ -3167,7 +3121,7 @@ function assertRealpathContained(abs, projectRoot, rel) {
   }
   let probe = abs;
   while (!fs.existsSync(probe)) {
-    const parent = path27.dirname(probe);
+    const parent = path28.dirname(probe);
     if (parent === probe) return;
     probe = parent;
   }
@@ -3177,15 +3131,15 @@ function assertRealpathContained(abs, projectRoot, rel) {
   } catch {
     return;
   }
-  const relReal = toPosix(path27.relative(realRoot, realProbe));
-  if (relReal === ".." || relReal.startsWith("../") || path27.isAbsolute(relReal)) {
+  const relReal = toPosix(path28.relative(realRoot, realProbe));
+  if (relReal === ".." || relReal.startsWith("../") || path28.isAbsolute(relReal)) {
     throw new UndeclaredFsReadError(rel);
   }
 }
 function resolveAllowedReadPath(raw, allowedSet, projectRoot) {
-  const abs = path27.resolve(projectRoot, normalizeMappingPath(raw));
-  const rel = toPosix(path27.relative(projectRoot, abs));
-  if (rel === "" || rel.startsWith("..") || path27.isAbsolute(rel)) {
+  const abs = path28.resolve(projectRoot, normalizeMappingPath(raw));
+  const rel = toPosix(path28.relative(projectRoot, abs));
+  if (rel === "" || rel.startsWith("..") || path28.isAbsolute(rel)) {
     throw new UndeclaredFsReadError(normalizeMappingPath(raw));
   }
   if (!isAllowed(rel, allowedSet)) throw new UndeclaredFsReadError(rel);
@@ -3202,7 +3156,7 @@ function createCtxFs(params) {
   return {
     exists(raw) {
       const p2 = assertAllowed(raw);
-      const abs = path27.resolve(projectRoot, p2);
+      const abs = path28.resolve(projectRoot, p2);
       try {
         const stat9 = fs.statSync(abs);
         return stat9.isDirectory() ? "dir" : stat9.isFile() ? "file" : false;
@@ -3212,12 +3166,12 @@ function createCtxFs(params) {
     },
     read(raw) {
       const p2 = assertAllowed(raw);
-      const abs = path27.resolve(projectRoot, p2);
+      const abs = path28.resolve(projectRoot, p2);
       return fs.readFileSync(abs, "utf8");
     },
     list(raw) {
       const p2 = assertAllowed(raw);
-      const abs = path27.resolve(projectRoot, p2);
+      const abs = path28.resolve(projectRoot, p2);
       const entries = fs.readdirSync(abs, { withFileTypes: true });
       return entries.map((e) => ({
         name: e.name,
@@ -3233,9 +3187,9 @@ var init_ctx_fs = __esm({
     init_mapping_path();
     init_posix();
     UndeclaredFsReadError = class extends Error {
-      constructor(path44) {
-        super(`structure-aspect-undeclared-fs-read: ${path44}`);
-        this.path = path44;
+      constructor(path46) {
+        super(`structure-aspect-undeclared-fs-read: ${path46}`);
+        this.path = path46;
         this.name = "UndeclaredFsReadError";
       }
     };
@@ -3263,7 +3217,7 @@ var init_expand_mapping_sync = __esm({
 
 // src/structure/ctx-graph.ts
 import * as fs2 from "fs";
-import * as path28 from "path";
+import * as path29 from "path";
 function computeAllowedNodePaths(currentPath, graph) {
   const allowed = /* @__PURE__ */ new Set([currentPath]);
   const current = graph.nodes.get(currentPath);
@@ -3303,7 +3257,7 @@ function createCtxGraph(params) {
     for (const raw of m.meta.mapping ?? []) {
       const p2 = normalizeMappingPath(raw);
       if (!p2) continue;
-      const abs = path28.resolve(projectRoot, p2);
+      const abs = path29.resolve(projectRoot, p2);
       try {
         const stat9 = fs2.statSync(abs);
         if (stat9.isFile()) {
@@ -3396,7 +3350,7 @@ var init_ctx_graph = __esm({
 
 // src/ast/parser.ts
 import { Parser, Language } from "web-tree-sitter";
-import path29 from "path";
+import path30 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { existsSync as existsSync5 } from "fs";
 import { createRequire as createRequire3 } from "module";
@@ -3407,12 +3361,12 @@ async function init() {
 }
 function resolveWasm(filename, pkg2) {
   for (const dir of GRAMMAR_DIRS) {
-    const p2 = path29.join(dir, filename);
+    const p2 = path30.join(dir, filename);
     if (existsSync5(p2)) return p2;
   }
   try {
-    const pkgDir = path29.dirname(_require.resolve(`${pkg2}/package.json`));
-    for (const candidate of [path29.join(pkgDir, filename), path29.join(pkgDir, "bindings/node", filename)]) {
+    const pkgDir = path30.dirname(_require.resolve(`${pkg2}/package.json`));
+    for (const candidate of [path30.join(pkgDir, filename), path30.join(pkgDir, "bindings/node", filename)]) {
       if (existsSync5(candidate)) return candidate;
     }
   } catch {
@@ -3437,7 +3391,7 @@ async function getParser(extension) {
   return parser;
 }
 async function parseFile(filePath, content14) {
-  const ext = path29.extname(filePath);
+  const ext = path30.extname(filePath);
   const parser = await getParser(ext);
   const tree = parser.parse(content14);
   if (tree === null) {
@@ -3452,10 +3406,10 @@ var init_parser = __esm({
     init_language_registry();
     _require = createRequire3(import.meta.url);
     __filename2 = fileURLToPath4(import.meta.url);
-    __dirname2 = path29.dirname(__filename2);
+    __dirname2 = path30.dirname(__filename2);
     GRAMMAR_DIRS = [
-      path29.resolve(__dirname2, "grammars"),
-      path29.resolve(__dirname2, "..", "grammars")
+      path30.resolve(__dirname2, "grammars"),
+      path30.resolve(__dirname2, "..", "grammars")
     ];
     initialized = false;
     langCache = /* @__PURE__ */ new Map();
@@ -3464,7 +3418,7 @@ var init_parser = __esm({
 
 // src/structure/ctx-parsers.ts
 import * as fs3 from "fs";
-import * as path30 from "path";
+import * as path31 from "path";
 import { extname } from "path";
 import { parse as parseYaml13 } from "yaml";
 import { parse as parseTomlSmol } from "smol-toml";
@@ -3476,7 +3430,7 @@ function createCtxParsers(params) {
       return input;
     }
     const p2 = resolveAllowedReadPath(input, allowedSet, projectRoot);
-    const abs = path30.resolve(projectRoot, p2);
+    const abs = path31.resolve(projectRoot, p2);
     const content14 = fs3.readFileSync(abs, "utf8");
     touchedFiles.push(p2);
     return { path: p2, content: content14 };
@@ -3617,7 +3571,43 @@ var init_allowed_reads = __esm({
   }
 });
 
+// src/ast/find-comments.ts
+import { extname as extname2 } from "path";
+function findComments(target) {
+  const hasAst = "ast" in target;
+  const hasRootNode = "rootNode" in target;
+  if (hasAst && hasRootNode) {
+    throw new Error("AST_FINDCOMMENTS_AMBIGUOUS_TARGET: pass either ast or rootNode, not both");
+  }
+  let language = "language" in target ? target.language : void 0;
+  if (language === void 0 && "path" in target) {
+    language = getLanguageForExtension(extname2(target.path)) ?? void 0;
+  }
+  if (language === void 0) {
+    throw new Error(
+      "AST_FINDCOMMENTS_NO_LANGUAGE: pass a SourceFile whose path has a known extension, or an explicit { language }"
+    );
+  }
+  const def = LANGUAGES[language];
+  if (def === void 0) {
+    throw new Error(`AST_FINDCOMMENTS_UNKNOWN_LANGUAGE: '${language}' not in registry`);
+  }
+  const root = hasAst ? target.ast.rootNode : target.rootNode;
+  const out = [];
+  for (const type of def.commentTypes) {
+    out.push(...root.descendantsOfType(type));
+  }
+  return out;
+}
+var init_find_comments = __esm({
+  "src/ast/find-comments.ts"() {
+    "use strict";
+    init_language_registry();
+  }
+});
+
 // src/ast/suppress.ts
+import { extname as extname3 } from "path";
 function commentBody(text2) {
   if (text2.startsWith("//")) return text2.slice(2).trim();
   if (text2.startsWith("/*")) return text2.replace(/^\/\*+/, "").replace(/\*+\/$/, "").trim();
@@ -3651,7 +3641,10 @@ function parseMarker(commentText, line, file) {
   return null;
 }
 function collectSuppressions(tree, file, totalLines) {
-  const comments = tree.rootNode.descendantsOfType("comment");
+  if (getLanguageForExtension(extname3(file)) === null) {
+    return [];
+  }
+  const comments = findComments({ path: file, ast: tree });
   const markers = [];
   for (const c of comments) {
     const m = parseMarker(c.text, c.startPosition.row + 1, file);
@@ -3702,10 +3695,48 @@ function isLineSuppressed(ranges, aspectId, line) {
     return r.isWildcard || r.aspectIds.has(aspectId);
   });
 }
+function scanSuppressionMarkers(text2) {
+  const lines = text2.split("\n");
+  const result = [];
+  for (let i = 0; i < lines.length; i++) {
+    const lineNum = i + 1;
+    const raw = lines[i];
+    let m;
+    m = raw.match(RE_DISABLE);
+    if (m) {
+      const ids = splitAspectList(m[1]);
+      const reason = (m[2] ?? "").trim();
+      for (const id of ids) {
+        result.push({ line: lineNum, aspectId: id, kind: "disable", wildcard: id === "*", reason });
+      }
+      continue;
+    }
+    m = raw.match(RE_ENABLE);
+    if (m) {
+      const ids = splitAspectList(m[1]);
+      for (const id of ids) {
+        result.push({ line: lineNum, aspectId: id, kind: "enable", wildcard: id === "*", reason: "" });
+      }
+      continue;
+    }
+    m = raw.match(RE_SINGLE);
+    if (m) {
+      const ids = splitAspectList(m[1]);
+      const reason = (m[2] ?? "").trim();
+      for (const id of ids) {
+        result.push({ line: lineNum, aspectId: id, kind: "single", wildcard: id === "*", reason });
+      }
+      continue;
+    }
+  }
+  return result;
+}
 var SuppressMarkerError, RE_SINGLE, RE_DISABLE, RE_ENABLE;
 var init_suppress = __esm({
   "src/ast/suppress.ts"() {
     "use strict";
+    init_find_comments();
+    init_language_registry();
     SuppressMarkerError = class extends Error {
       constructor(message, file, line) {
         super(message);
@@ -3780,66 +3811,37 @@ var init_validate_check_module = __esm({
 
 // src/structure/runner.ts
 import * as fs4 from "fs";
-import * as path31 from "path";
+import * as path32 from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
-function buildOwnFiles(node, projectRoot, touchedFiles) {
-  const childMappings = /* @__PURE__ */ new Set();
+async function buildOwnFiles(node, projectRoot, touchedFiles) {
+  const childMappingEntries = [];
   for (const child of node.children) {
     for (const raw of child.meta.mapping ?? []) {
       const p2 = normalizeMappingPath(raw);
-      if (p2) childMappings.add(p2);
+      if (p2) childMappingEntries.push(p2);
     }
   }
+  const rawMapping = (node.meta.mapping ?? []).map(normalizeMappingPath).filter((p2) => p2 !== "");
+  const expanded = await expandMappingPaths(projectRoot, rawMapping);
   const result = [];
-  for (const raw of node.meta.mapping ?? []) {
-    const p2 = normalizeMappingPath(raw);
-    if (!p2 || childMappings.has(p2)) continue;
-    const abs = path31.resolve(projectRoot, p2);
+  for (const p2 of expanded) {
+    if (childMappingEntries.length > 0 && isPathInMapping(p2, childMappingEntries)) continue;
+    if (BINARY_EXTENSIONS2.has(path32.extname(p2).toLowerCase())) continue;
+    const abs = path32.resolve(projectRoot, p2);
+    let content14;
     try {
-      const stat9 = fs4.statSync(abs);
-      if (stat9.isFile()) {
-        const content14 = fs4.readFileSync(abs, "utf8");
-        result.push({ path: p2, content: content14 });
-        touchedFiles.push(p2);
-      }
+      content14 = fs4.readFileSync(abs, "utf8");
     } catch {
+      continue;
     }
+    result.push({ path: p2, content: content14 });
+    touchedFiles.push(p2);
   }
   return result;
 }
-function enumerateMappedFilesSync(mappingPaths, projectRoot) {
-  const out = [];
-  for (const raw of mappingPaths) {
-    const rel = normalizeMappingPath(raw);
-    if (!rel) continue;
-    const abs = path31.resolve(projectRoot, rel);
-    try {
-      const stat9 = fs4.statSync(abs);
-      if (stat9.isFile()) {
-        out.push(rel);
-      } else if (stat9.isDirectory()) {
-        for (const sub of walkDirSync(abs)) {
-          const relSub = path31.relative(projectRoot, sub).split(/[\\/]/).join("/");
-          out.push(relSub);
-        }
-      }
-    } catch {
-    }
-  }
-  return out;
-}
-function* walkDirSync(dir) {
-  let entries;
-  try {
-    entries = fs4.readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const e of entries) {
-    const child = path31.join(dir, e.name);
-    if (e.isDirectory()) yield* walkDirSync(child);
-    else if (e.isFile()) yield child;
-  }
+async function enumerateMappedFilesAsync(mappingPaths, projectRoot) {
+  const normalized = mappingPaths.map(normalizeMappingPath).filter((p2) => p2 !== "");
+  return expandMappingPaths(projectRoot, normalized);
 }
 async function runStructureAspect(params) {
   ensureLoaderRegistered();
@@ -3854,8 +3856,8 @@ async function runStructureAspect(params) {
       next: `Pass an existing node path, or add the node to the graph.`
     });
   }
-  const aspectDirAbs = path31.isAbsolute(aspectDir) ? aspectDir : path31.resolve(projectRoot, aspectDir);
-  const checkPath = path31.join(aspectDirAbs, "check.mjs");
+  const aspectDirAbs = path32.isAbsolute(aspectDir) ? aspectDir : path32.resolve(projectRoot, aspectDir);
+  const checkPath = path32.join(aspectDirAbs, "check.mjs");
   let mod;
   try {
     mod = await import(pathToFileURL2(checkPath).href);
@@ -3878,7 +3880,7 @@ async function runStructureAspect(params) {
   const ctxFs = createCtxFs({ allowedSet, projectRoot, touchedFiles });
   const ctxGraph = createCtxGraph({ currentNodePath: nodePath, graph, projectRoot, touchedFiles });
   const parsers = createCtxParsers({ allowedSet, projectRoot, touchedFiles, astCache });
-  const ownFiles = buildOwnFiles(node, projectRoot, touchedFiles);
+  const ownFiles = await buildOwnFiles(node, projectRoot, touchedFiles);
   await prewarmupAstCache({ astCache, projectRoot, files: ownFiles });
   const ownFilesEnriched = enrichFilesWithAst(ownFiles, astCache);
   const ctx = {
@@ -3901,8 +3903,8 @@ async function runStructureAspect(params) {
   for (const rel of node.meta.relations ?? []) {
     const target = graph.nodes.get(rel.target);
     if (!target) continue;
-    for (const p2 of enumerateMappedFilesSync(target.meta.mapping ?? [], projectRoot)) {
-      const abs = path31.resolve(projectRoot, p2);
+    for (const p2 of await enumerateMappedFilesAsync(target.meta.mapping ?? [], projectRoot)) {
+      const abs = path32.resolve(projectRoot, p2);
       try {
         const content14 = fs4.readFileSync(abs, "utf8");
         astInputSet.push({ path: p2, content: content14 });
@@ -4007,7 +4009,7 @@ ${err.stack ?? ""}`,
   });
   return { violations: visible, touchedFiles, succeeded: true };
 }
-var StructureRunnerError;
+var StructureRunnerError, BINARY_EXTENSIONS2;
 var init_runner = __esm({
   "src/structure/runner.ts"() {
     "use strict";
@@ -4017,6 +4019,7 @@ var init_runner = __esm({
     init_ctx_parsers();
     init_allowed_reads();
     init_expand_mapping_sync();
+    init_hash();
     init_suppress();
     init_validate_check_module();
     StructureRunnerError = class extends Error {
@@ -4030,6 +4033,35 @@ ${data.next}`);
       }
       messageData;
     };
+    BINARY_EXTENSIONS2 = /* @__PURE__ */ new Set([
+      ".gif",
+      ".png",
+      ".jpg",
+      ".jpeg",
+      ".webp",
+      ".bmp",
+      ".ico",
+      ".svgz",
+      ".woff",
+      ".woff2",
+      ".ttf",
+      ".otf",
+      ".eot",
+      ".zip",
+      ".gz",
+      ".tgz",
+      ".tar",
+      ".bz2",
+      ".7z",
+      ".pdf",
+      ".mp4",
+      ".mov",
+      ".webm",
+      ".mp3",
+      ".wav",
+      ".wasm",
+      ".bin"
+    ]);
   }
 });
 
@@ -4043,15 +4075,12 @@ __export(approve_reviewer_exports, {
   reviewerAborted: () => reviewerAborted,
   runApproveWithReviewer: () => runApproveWithReviewer
 });
-import path32 from "path";
-function hasAnyCheckTouched(identity) {
-  return Object.values(identity.aspects).some((a) => a.checkTouched && Object.keys(a.checkTouched).length > 0);
-}
+import path33 from "path";
 async function dispatchStructureAspects(plan, node, graph, result, projectRoot, parseCache, results, violations) {
   for (const entry of plan.resolved) {
     if (entry.kind !== "deterministic") continue;
     const aspect = entry.aspect;
-    const aspectDirAbs = path32.join(projectRoot, ".yggdrasil/aspects", aspect.id);
+    const aspectDirAbs = path33.join(projectRoot, ".yggdrasil/aspects", aspect.id);
     try {
       const structResult = await runStructureAspect({
         aspectDir: aspectDirAbs,
@@ -4072,7 +4101,7 @@ async function dispatchStructureAspects(plan, node, graph, result, projectRoot,
         const p2 = toPosixPath(raw);
         let hash = result.pendingDriftState?.state.files[p2];
         if (!hash) {
-          const abs = path32.resolve(projectRoot, p2);
+          const abs = path33.resolve(projectRoot, p2);
           try {
             hash = await hashFile(abs);
           } catch (e) {
@@ -4122,6 +4151,23 @@ async function commitApprovalAndCleanDrafts(rootPath, result, node, graph) {
     await clearDraftAspectsFromDriftState(rootPath, node.path, draftIds);
   }
 }
+async function recomputeFinalHash(result, node, graph, projectRoot) {
+  if (!result.pendingDriftState) return;
+  if (result.action !== "initial" && result.action !== "approved") return;
+  const { trackedFiles: recomputeTracked, identity: recomputeIdentity } = collectTrackedFiles(node, graph, result.pendingDriftState.state);
+  const recomputeExclusions = getChildMappingExclusions(graph, node.path);
+  const { canonicalHash } = await hashTrackedFiles(
+    projectRoot,
+    recomputeTracked,
+    void 0,
+    recomputeExclusions,
+    recomputeIdentity,
+    result.pendingDriftState.state.aspectVerdicts
+  );
+  result.pendingDriftState.state.identity = recomputeIdentity;
+  result.pendingDriftState.state.hash = canonicalHash;
+  result.currentHash = canonicalHash;
+}
 function partitionCodeViolationsByStatus(codeViolations, statuses) {
   const enforced = [];
   const advisory = [];
@@ -4160,7 +4206,7 @@ async function loadAndIsolateReferences(params) {
   if (refs.length === 0) return { ok: true, references: [] };
   const out = [];
   for (const ref of refs) {
-    const absPath = path32.join(params.projectRoot, ref.path);
+    const absPath = path33.join(params.projectRoot, ref.path);
     try {
       let content14 = params.cache.get(absPath);
       if (content14 === void 0) {
@@ -4187,7 +4233,9 @@ async function runApproveWithReviewer(input) {
   const allAspectIds = computeEffectiveAspects(node, graph);
   const allAspects = [...allAspectIds].map((id) => graph.aspects.find((a) => a.id === id)).filter((a) => a !== void 0);
   const statuses = computeEffectiveAspectStatuses(node, graph);
-  const nonDraft = allAspects.filter((a) => statuses.get(a.id) !== "draft");
+  const nonDraft = allAspects.filter(
+    (a) => statuses.get(a.id) !== "draft" && a.reviewer.type !== "aggregate"
+  );
   const skippedDraftAspects = allAspects.filter((a) => statuses.get(a.id) === "draft").map((a) => a.id);
   for (const id of skippedDraftAspects) {
     process.stdout.write(`[draft] node '${node.path}': aspect '${id}' skipped (status: draft)
@@ -4197,6 +4245,7 @@ async function runApproveWithReviewer(input) {
   const aspectViolations = [];
   const allAspectResults = {};
   const referencesCache = /* @__PURE__ */ new Map();
+  const projectRoot = toPosixPath(path33.dirname(rootPath));
   const finalizeAndReturn = async (extras, infra = false) => {
     const { verdicts, carryForward } = buildAspectVerdicts(node, graph, allAspectResults);
     applyAspectVerdictsToResult(result, verdicts, carryForward, storedEntry?.aspectVerdicts, filterAspectId, reviewerAborted(node, graph, allAspectResults));
@@ -4210,6 +4259,7 @@ async function runApproveWithReviewer(input) {
           delete result.pendingDriftState.state.log;
         }
       }
+      await recomputeFinalHash(result, node, graph, projectRoot);
       await commitApprovalAndCleanDrafts(rootPath, result, node, graph);
     }
     const out = { ...result, ...extras, skippedDraftAspects };
@@ -4232,12 +4282,24 @@ async function runApproveWithReviewer(input) {
       }
     }, true);
   }
-  const projectRoot = toPosixPath(path32.dirname(rootPath));
   const { trackedFiles } = collectTrackedFiles(node, graph);
   const { fileHashes } = await hashTrackedFiles(projectRoot, trackedFiles, void 0, []);
-  const yggPrefix = toPosixPath(path32.relative(projectRoot, rootPath));
+  const yggPrefix = toPosixPath(path33.relative(projectRoot, rootPath));
   const sourceFilePaths = Object.keys(fileHashes).map((f) => toPosixPath(f)).filter((f) => !f.startsWith(yggPrefix));
   const sourceFiles = await loadSourceFiles(sourceFilePaths, projectRoot);
+  if (hasLlmAspects && sourceFilePaths.length === 0) {
+    const llmIds = filtered.filter((a) => a.reviewer.type === "llm").map((a) => a.id).join(", ");
+    const normalizedNodePath2 = toPosixPath(nodePath);
+    return finalizeAndReturn({
+      action: "refused",
+      llmSkipped: "unavailable",
+      refuseReasonData: {
+        what: `No readable source files found for node '${normalizedNodePath2}', but it has effective non-draft LLM aspect(s): ${llmIds}.`,
+        why: "An LLM aspect needs source files to verify \u2014 approving with no files would record a verdict over code the reviewer never saw.",
+        next: `Add source files that satisfy the node mapping, or remove the LLM aspect(s), then re-run: yg approve --node ${normalizedNodePath2}`
+      }
+    }, true);
+  }
   const nodeDescription = node.meta.description ?? "";
   const plan = graph.config.reviewer ? resolveExecutionPlan(filtered, graph.config.reviewer) : {
     resolved: filtered.filter((a) => a.reviewer.type === "deterministic").map((a) => ({ kind: "deterministic", aspect: a })),
@@ -4279,14 +4341,6 @@ async function runApproveWithReviewer(input) {
       debugWrite(`[d8.3] preserved checkTouched for ${preserved} non-evaluated deterministic aspect(s) on node ${node.path}`);
     }
   }
-  if (result.pendingDriftState && (result.action === "initial" || result.action === "approved") && hasAnyCheckTouched(result.pendingDriftState.state.identity)) {
-    const { trackedFiles: recomputeTracked, identity: recomputeIdentity } = collectTrackedFiles(node, graph, result.pendingDriftState.state);
-    const recomputeExclusions = getChildMappingExclusions(graph, node.path);
-    const { canonicalHash } = await hashTrackedFiles(projectRoot, recomputeTracked, void 0, recomputeExclusions, recomputeIdentity);
-    result.pendingDriftState.state.identity = recomputeIdentity;
-    result.pendingDriftState.state.hash = canonicalHash;
-    result.currentHash = canonicalHash;
-  }
   if (aspectViolations.length > 0) {
     const astInfraErrors = aspectViolations.filter((v) => v.errorSource !== "codeViolation");
     const astCodeViolations = aspectViolations.filter((v) => v.errorSource === "codeViolation");
@@ -4357,7 +4411,6 @@ async function runApproveWithReviewer(input) {
         aspectResults: allAspectResults
       }, true);
     }
-    const maxTokens = merged.max_tokens === "auto" ? await resolveMaxTokens(merged, provider) : merged.max_tokens;
     const aspectsForTier = [];
     for (const e of entries) {
       const loaded = await loadAndIsolateReferences({
@@ -4386,8 +4439,7 @@ async function runApproveWithReviewer(input) {
       sourceFiles,
       nodePath,
       nodeDescription,
-      consensus: merged.consensus,
-      maxTokens
+      consensus: merged.consensus
     });
     for (const [aspectId, res] of Object.entries(llmResults)) {
       allAspectResults[aspectId] = res;
@@ -4454,7 +4506,6 @@ var init_approve_reviewer = __esm({
   "src/core/approve-reviewer.ts"() {
     "use strict";
     init_aspect_verifier();
-    init_api_utils();
     init_llm();
     init_approve();
     init_aspects();
@@ -4479,7 +4530,7 @@ import { Command as Command2 } from "commander";
 import chalk2 from "chalk";
 import { existsSync as existsSync2 } from "fs";
 import { mkdir as mkdir3, writeFile as writeFile7, readdir as readdir9, readFile as readFile18, stat as stat6 } from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import * as p from "@clack/prompts";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
@@ -4542,9 +4593,11 @@ The CLI (\`yg\`) reads and validates \u2014 it never modifies files. You create
 
 **Nodes** \u2014 components. \`model/<path>/yg-node.yaml\`. Nodes nest by directory \u2014 children inherit parent aspects. Schema: \`schemas/yg-node.yaml\`.
 
-**Aspects** \u2014 enforceable rules. \`aspects/<id>/yg-aspect.yaml\` + either \`content.md\` (LLM reviewer) or \`check.mjs\` (deterministic reviewer). The \`yg-aspect.yaml\` requires a \`reviewer:\` mapping: \`reviewer.type\` is \`llm\` or \`deterministic\`. LLM aspects may also set \`reviewer.tier:\` to pick a named tier from \`yg-config.yaml\` (otherwise the configured default tier is used). An aspect can declare \`implies: [other-aspect]\` \u2014 implied aspects are included recursively (must be acyclic). LLM aspects may declare \`references:\` \u2014 supporting files (lookup tables, catalogues) included in the reviewer prompt and exposed to the agent under \`read:\`. Schema: \`schemas/yg-aspect.yaml\`. Aspects also carry a \`status:\` field (default \`enforced\`) \u2014 three levels \`draft / advisory / enforced\` control whether the reviewer runs and whether violations block.
+**Aspects** \u2014 enforceable rules. \`aspects/<id>/yg-aspect.yaml\` + zero or one rule source files. The reviewer kind is inferred from which rule source is present: \`content.md\` \u2192 LLM reviewer; \`check.mjs\` \u2192 deterministic reviewer; neither file but \`implies:\` declared \u2192 aggregating aspect (a named bundle with no own reviewer). The \`reviewer:\` block in \`yg-aspect.yaml\` is optional \u2014 kind is inferred automatically. If present, an explicit \`reviewer.type\` must agree with the inferred kind. LLM aspects may set \`reviewer.tier:\` to pick a named tier from \`yg-config.yaml\` (otherwise the configured default tier is used). An aspect can declare \`implies: [other-aspect]\` \u2014 implied aspects are included recursively (must be acyclic). LLM aspects may declare \`references:\` \u2014 supporting files (lookup tables, catalogues) included in the reviewer prompt and exposed to the agent under \`read:\`. Schema: \`schemas/yg-aspect.yaml\`. Aspects also carry a \`status:\` field (default \`enforced\`) \u2014 three levels \`draft / advisory / enforced\` control whether the reviewer runs and whether violations block.
+
+Deterministic aspects ship \`check.mjs\` instead of \`content.md\` \u2014 the CLI runs the check locally at zero LLM cost and the returned violations are the verdict. A check may scope to a single file (parsing it with tree-sitter) or to the whole graph (reading the node's files, related nodes, and graph metadata through a context object). Deterministic aspects must NOT set \`reviewer.tier:\` \u2014 tiers apply only to LLM aspects. See \`yg knowledge read writing-deterministic-aspects\`.
 
-Deterministic aspects (\`reviewer.type: deterministic\`) ship \`check.mjs\` instead of \`content.md\` \u2014 the CLI runs the check locally at zero LLM cost and the returned violations are the verdict. A check may scope to a single file (parsing it with tree-sitter) or to the whole graph (reading the node's files, related nodes, and graph metadata through a context object). Deterministic aspects must NOT set \`reviewer.tier:\` \u2014 tiers apply only to LLM aspects. See \`yg knowledge read writing-deterministic-aspects\`.
+Aggregating aspects ship neither \`content.md\` nor \`check.mjs\` but declare \`implies:\`. They act as named bundles: they expand their implied aspects onto every node where the aggregate is effective, but they have no own reviewer and produce no own verdict. Use them to group a multi-rule contract into one named attach point (the aggregate) backed by N atomic child aspects (each with its own \`content.md\` or \`check.mjs\` and one clean verdict). See \`yg knowledge read aspects-overview\`.
 
 **Flows** \u2014 business processes. \`flows/<name>/yg-flow.yaml\` with name, description, nodes (participants), aspects. Flow-level aspects propagate to all participants. Descendants of a declared participant are automatically included \u2014 adding a parent node to a flow covers all its children. Deep dive: \`yg knowledge read flows\`.
 
@@ -4633,13 +4686,14 @@ When \`yg check\` emits both errors AND warnings, \`suggestedNext\` points at th
 | \`yg log add --node <path> --reason <text>\` | Append per-node business-context entry (multi-line via \`--reason-file <path>\`) |
 | \`yg log read --node <path> [--top N \\| --all]\` | Read log entries (default top 10, newest first) |
 | \`yg log merge-resolve --node <path>\` | Reconcile log.md after a git merge (validates byte-exact ancestor + union of new entries) |
+| \`yg suppressions\` | Read-only inventory of active \`yg-suppress\` markers; warns on unknown aspect-id, wildcard, or unbounded range. Exit 0. |
 | \`yg knowledge list\` / \`yg knowledge read <name>\` | Browse deep-reference topics |
 
-Full command reference (\`yg aspects\`, \`yg flows\`, \`yg owner\`, \`yg deterministic-test\`, \`yg type-suggest\`, \`yg init\`, \`yg log merge-resolve\`, all option flags): \`yg knowledge read cli-reference\`.
+Full command reference (\`yg aspects\`, \`yg flows\`, \`yg owner\`, \`yg suppressions\`, \`yg deterministic-test\`, \`yg type-suggest\`, \`yg init\`, \`yg log merge-resolve\`, all option flags): \`yg knowledge read cli-reference\`.
 
 ### Impact and Cost
 
-Every graph change has blast radius. \`yg impact\` shows how many nodes are affected. For an LLM aspect, each affected node re-runs just the changed aspect \u2014 one LLM request (multiplied by the tier's consensus count and by the number of prompt chunks) \u2014 so an LLM aspect touching 20 nodes is at least 20 LLM calls = real cost. (A source-code edit, by contrast, is node-global: it re-runs every effective non-draft LLM aspect on that one node.) Deterministic aspects run locally and cost zero LLM calls regardless of how many nodes they touch.
+Every graph change has blast radius. \`yg impact\` shows how many nodes are affected. For an LLM aspect, each affected node re-runs just the changed aspect \u2014 one LLM request per node (multiplied by the tier's consensus count) \u2014 so an LLM aspect touching 20 nodes is at least 20 LLM calls = real cost. (A source-code edit, by contrast, is node-global: it re-runs every effective non-draft LLM aspect on that one node.) Deterministic aspects run locally and cost zero LLM calls regardless of how many nodes they touch.
 
 When code doesn't match an aspect, five options:
 
@@ -4658,7 +4712,7 @@ var DECISIONS = `## DECISIONS
 
 **Start of conversation:** \`yg check\`. If errors \u2014 fix before any other work. \`yg check\` failures block commits and CI. Nothing passes until check is clean.
 
-**Before touching a source file:** \`yg context --file <path>\`. Read the files listed under \`read:\` \u2014 these are the rules the reviewer will check your code against. For LLM aspects, \`read:\` points to \`content.md\`. For deterministic aspects (\`reviewer.type: deterministic\`), \`read:\` points to \`check.mjs\` \u2014 read it to know what rules will be enforced. For blast radius: \`yg impact --file <path>\`.
+**Before touching a source file:** \`yg context --file <path>\`. Read the files listed under \`read:\` \u2014 these are the rules the reviewer will check your code against. For LLM aspects, \`read:\` points to \`content.md\`. For deterministic aspects, \`read:\` points to \`check.mjs\` \u2014 read it to know what rules will be enforced. Aggregating aspects have no \`read:\` of their own; their implied children each carry their own \`read:\` paths. For blast radius: \`yg impact --file <path>\`.
 
 **After modifying code:** \`yg check\` \u2192 fix errors \u2192 \`yg log add\` (per affected node) \u2192 \`yg approve --node <path>\`. Approve is part of the change \u2014 the change is not done until approve passes. Do not defer approval.
 
@@ -4926,7 +4980,7 @@ context.
 
 ### When to Create Graph Elements
 
-**Aspect** \u2014 when the same pattern appears in 3+ files AND the reviewer can verify it against source code. Both conditions. "Every handler logs audit trail" \u2014 pattern + verifiable = aspect. "Code should be readable" \u2014 not verifiable, not an aspect. Read \`schemas/yg-aspect.yaml\` before creating. For reviewer choice (LLM or deterministic), aspect format, cost model: \`yg knowledge read aspects-overview\`. To write the rules: \`yg knowledge read writing-llm-aspects\` (or \`writing-deterministic-aspects\`). Content \`.md\` files state WHAT must be satisfied and WHY \u2014 use the user's words, never invent rationale. Things that do NOT become aspects: knowledge already visible in source code (imports, config), non-enforceable knowledge (business strategy, personas, pricing), and conventions the reviewer cannot check against code. Choose initial status: \`draft\` if content.md is still being authored or the rule is unclear (no enforcement, no cost); \`advisory\` if content.md is complete but you want to gather signal across the repo without blocking CI; \`enforced\` if the rule is vetted on a small set and you want repo-wide enforcement immediately.
+**Aspect** \u2014 when the same pattern appears in 3+ files AND the reviewer can verify it against source code. Both conditions. "Every handler logs audit trail" \u2014 pattern + verifiable = aspect. "Code should be readable" \u2014 not verifiable, not an aspect. Read \`schemas/yg-aspect.yaml\` before creating. For reviewer kind (LLM, deterministic, or aggregating), aspect format, cost model: \`yg knowledge read aspects-overview\`. To write the rules: \`yg knowledge read writing-llm-aspects\` (or \`writing-deterministic-aspects\`). Content \`.md\` files state WHAT must be satisfied and WHY \u2014 use the user's words, never invent rationale. Things that do NOT become aspects: knowledge already visible in source code (imports, config), non-enforceable knowledge (business strategy, personas, pricing), and conventions the reviewer cannot check against code. Choose initial status: \`draft\` if content.md is still being authored or the rule is unclear (no enforcement, no cost); \`advisory\` if content.md is complete but you want to gather signal across the repo without blocking CI; \`enforced\` if the rule is vetted on a small set and you want repo-wide enforcement immediately.
 
 **Flow** \u2014 when you see a sequence of steps toward a business goal. Not code call sequences \u2014 real-world processes. "User places an order" = flow. "Handler calls service" = relation between nodes. Read \`schemas/yg-flow.yaml\` and \`yg knowledge read flows\` before creating.
 
@@ -5607,7 +5661,7 @@ import chalk from "chalk";
 
 // src/core/graph-loader.ts
 init_graph_fs();
-import path9 from "path";
+import path10 from "path";
 import { gt as gt3, lt, valid as valid3 } from "semver";
 
 // src/io/config-parser.ts
@@ -5639,6 +5693,50 @@ var DEFAULT_QUALITY = {
   max_direct_relations: 10,
   max_node_chars: 4e4
 };
+var DEFAULT_COVERAGE = { required: ["/"], excluded: [] };
+function parseStringArray(raw, field, filename) {
+  if (raw === void 0) return [];
+  if (!Array.isArray(raw) || raw.some((x) => typeof x !== "string")) {
+    throw new ConfigParseError({
+      what: `${filename}: ${field} must be a list of strings (got ${JSON.stringify(raw)}).`,
+      why: "Coverage roots are repo-relative path prefixes; a non-list value cannot be matched against files.",
+      next: `Set ${field} to a YAML list, e.g.
+  ${field.split(".").pop()}:
+    - services/`
+    }, "config-invalid");
+  }
+  return raw;
+}
+function parseCoverage(raw, filename) {
+  if (raw === void 0) return DEFAULT_COVERAGE;
+  if (typeof raw !== "object" || Array.isArray(raw) || raw === null) {
+    throw new ConfigParseError({
+      what: `${filename}: coverage must be a mapping`,
+      why: "coverage holds the required/excluded root lists",
+      next: 'replace with `coverage: { required: ["/"], excluded: [] }`'
+    }, "config-invalid");
+  }
+  const cov = raw;
+  const required = cov.required === void 0 ? ["/"] : parseStringArray(cov.required, "coverage.required", filename);
+  const excluded = parseStringArray(cov.excluded, "coverage.excluded", filename);
+  if (required.length === 0) {
+    throw new ConfigParseError({
+      what: `${filename}: coverage.required must list at least one root.`,
+      why: "An empty required list silently turns every unmapped file into a non-blocking warning, disabling coverage enforcement.",
+      next: "Omit the coverage block to require the whole repo, or list real roots (e.g. - services/)."
+    }, "config-invalid");
+  }
+  for (const root of [...required, ...excluded]) {
+    if (root.split("/").includes("..")) {
+      throw new ConfigParseError({
+        what: `${filename}: coverage root '${root}' contains a '..' segment.`,
+        why: "'..' is not a valid repo-relative prefix and will never match any git-tracked path, silently mis-scoping coverage enforcement.",
+        next: 'Use a repo-relative path prefix without any ".." segments (e.g. - services/ instead of - services/../other/).'
+      }, "config-invalid");
+    }
+  }
+  return { required, excluded };
+}
 function parseMaxNodeChars(raw, filename) {
   if (raw === void 0) return DEFAULT_QUALITY.max_node_chars ?? 4e4;
   if (typeof raw !== "number" || !Number.isInteger(raw) || raw <= 0) {
@@ -5716,7 +5814,8 @@ async function parseConfig(filePath) {
     quality,
     reviewer,
     parallel,
-    debug
+    debug,
+    coverage: parseCoverage(raw.coverage, filename)
   };
 }
 function parseReviewer(raw, filename) {
@@ -5863,14 +5962,6 @@ function parseTier(name, raw, filename) {
       }, "config-tier-unknown-key");
     }
   }
-  const maxTokens = c.max_tokens ?? "auto";
-  if (maxTokens !== "auto" && (typeof maxTokens !== "number" || maxTokens < 1)) {
-    throw new ConfigParseError({
-      what: `${filename}: tier '${name}' config.max_tokens must be 'auto' or a positive number`,
-      why: "max_tokens controls the LLM response budget; invalid values cause runtime errors",
-      next: "set to 'auto' or a positive integer (e.g. 4096)"
-    }, "config-tier-config-invalid");
-  }
   let references;
   if (t.references !== void 0) {
     if (t.references === null || typeof t.references !== "object" || Array.isArray(t.references)) {
@@ -5925,8 +6016,6 @@ function parseTier(name, raw, filename) {
     endpoint: typeof c.endpoint === "string" ? c.endpoint : void 0,
     temperature: typeof c.temperature === "number" ? c.temperature : 0,
     consensus: consensusRaw,
-    max_tokens: maxTokens,
-    context_length_field: typeof c.context_length_field === "string" ? c.context_length_field : void 0,
     timeout: typeof c.timeout === "number" ? c.timeout * 1e3 : void 0,
     ...references !== void 0 ? { references } : {}
   };
@@ -6380,8 +6469,10 @@ function parsePorts(rawPorts, filePath) {
 }
 
 // src/io/aspect-parser.ts
+init_graph_fs();
 init_graph();
 import { readFile as readFile6 } from "fs/promises";
+import path6 from "path";
 import { parse as parseYaml4 } from "yaml";
 
 // src/io/artifact-reader.ts
@@ -6543,7 +6634,10 @@ async function parseAspect(aspectDir, aspectYamlPath, id) {
     };
   }
   const description = typeof raw.description === "string" ? raw.description.trim() : void 0;
-  const reviewerResult = parseReviewer2(raw.reviewer, idTrimmed);
+  const hasContentMd = fileExistsSync(path6.join(aspectDir, "content.md"));
+  const hasCheckMjs = fileExistsSync(path6.join(aspectDir, "check.mjs"));
+  const hasImplies = Array.isArray(raw.implies) && raw.implies.length > 0;
+  const reviewerResult = parseReviewer2(raw.reviewer, idTrimmed, { hasContentMd, hasCheckMjs, hasImplies });
   if (!reviewerResult.ok) {
     return { ok: false, aspectId: idTrimmed, errors: reviewerResult.errors };
   }
@@ -6657,6 +6751,20 @@ async function parseAspect(aspectDir, aspectYamlPath, id) {
         }]
       };
     }
+    if (reviewer.type === "aggregate") {
+      return {
+        ok: false,
+        aspectId: idTrimmed,
+        errors: [{
+          code: "aspect-references-on-aggregate",
+          messageData: {
+            what: `Aspect '${idTrimmed}' declares 'references:' but it is an aggregating aspect (no content.md, no check.mjs).`,
+            why: "reference files are passed to the LLM reviewer in the prompt. An aggregating aspect has no own reviewer \u2014 it only bundles implied aspects, so references would never be read.",
+            next: `remove 'references:' from .yggdrasil/aspects/${idTrimmed}/yg-aspect.yaml, or add a content.md and move the references onto that LLM aspect.`
+          }
+        }]
+      };
+    }
     references = [];
     const seenPaths = /* @__PURE__ */ new Set();
     for (let i = 0; i < raw.references.length; i++) {
@@ -6777,16 +6885,25 @@ async function parseAspect(aspectDir, aspectYamlPath, id) {
     }
   };
 }
-function parseReviewer2(raw, aspectId) {
+function parseReviewer2(raw, aspectId, files) {
   if (raw === void 0 || raw === null) {
+    if (files.hasContentMd && !files.hasCheckMjs) {
+      return { ok: true, value: { type: "llm" } };
+    }
+    if (files.hasCheckMjs && !files.hasContentMd) {
+      return { ok: true, value: { type: "deterministic" } };
+    }
+    if (!files.hasContentMd && !files.hasCheckMjs && files.hasImplies) {
+      return { ok: true, value: { type: "aggregate" } };
+    }
     return {
       ok: false,
       errors: [{
         code: "aspect-reviewer-missing",
         messageData: {
-          what: `aspect '${aspectId}' has no reviewer: block (field absent or null)`,
-          why: "every aspect must declare its reviewer explicitly (no implicit default)",
-          next: "add `reviewer:\\n  type: llm` or `reviewer:\\n  type: deterministic`"
+          what: `aspect '${aspectId}' has no reviewer: block and no rule source to infer one from`,
+          why: "an aspect must ship content.md (llm), check.mjs (deterministic), or declare implies (aggregating bundle); otherwise it does nothing",
+          next: "add `reviewer:\\n  type: llm` with a content.md, add a check.mjs, or add `implies:` to make this an aggregating aspect"
         }
       }]
     };
@@ -6878,7 +6995,7 @@ function parseReviewer2(raw, aspectId) {
 
 // src/io/flow-parser.ts
 import { readFile as readFile7 } from "fs/promises";
-import path6 from "path";
+import path7 from "path";
 import { parse as parseYaml5 } from "yaml";
 async function parseFlow(flowDir, flowYamlPath) {
   const content14 = await readFile7(flowYamlPath, "utf-8");
@@ -6927,7 +7044,7 @@ async function parseFlow(flowDir, flowYamlPath) {
     }
   }
   return {
-    path: path6.basename(flowDir),
+    path: path7.basename(flowDir),
     name: raw.name.trim(),
     description,
     nodes: nodePaths,
@@ -6939,16 +7056,16 @@ async function parseFlow(flowDir, flowYamlPath) {
 
 // src/io/schema-parser.ts
 import { readFile as readFile8 } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 import { parse as parseYaml6 } from "yaml";
 async function parseSchema(filePath) {
-  const filename = path7.basename(filePath);
+  const filename = path8.basename(filePath);
   const content14 = await readFile8(filePath, "utf-8");
   const raw = parseYaml6(content14);
   if (raw != null && (typeof raw !== "object" || Array.isArray(raw))) {
     throw new Error(`${filename} at ${filePath}: expected YAML mapping or empty document`);
   }
-  const rawName = path7.basename(filePath, path7.extname(filePath));
+  const rawName = path8.basename(filePath, path8.extname(filePath));
   const schemaType = rawName.startsWith("yg-") ? rawName.slice(3) : rawName;
   return { schemaType };
 }
@@ -7186,7 +7303,7 @@ var OutdatedSchemaVersionError = class extends Error {
   }
 };
 function toModelPath(absolutePath, modelDir) {
-  return toPosixPath(path9.relative(modelDir, absolutePath));
+  return toPosixPath(path10.relative(modelDir, absolutePath));
 }
 var FALLBACK_CONFIG = {};
 async function loadGraph(projectRoot, options = {}) {
@@ -7203,7 +7320,7 @@ async function loadGraph(projectRoot, options = {}) {
   let configErrorMessage;
   let config = FALLBACK_CONFIG;
   try {
-    config = await parseConfig(path9.join(yggRoot, "yg-config.yaml"));
+    config = await parseConfig(path10.join(yggRoot, "yg-config.yaml"));
   } catch (error) {
     if (error instanceof ConfigParseError) {
       configErrorMessage = error.messageData;
@@ -7216,7 +7333,7 @@ async function loadGraph(projectRoot, options = {}) {
     }
   }
   const { architecture, error: architectureError } = await loadArchitecture(yggRoot);
-  const modelDir = path9.join(yggRoot, "model");
+  const modelDir = path10.join(yggRoot, "model");
   const nodes = /* @__PURE__ */ new Map();
   const nodeParseErrors = [];
   try {
@@ -7229,9 +7346,9 @@ async function loadGraph(projectRoot, options = {}) {
     }
     throw err;
   }
-  const aspectsLoad = await loadAspects(path9.join(yggRoot, "aspects"));
-  const flows = await loadFlows(path9.join(yggRoot, "flows"));
-  const schemas = await loadSchemas(path9.join(yggRoot, "schemas"));
+  const aspectsLoad = await loadAspects(path10.join(yggRoot, "aspects"));
+  const flows = await loadFlows(path10.join(yggRoot, "flows"));
+  const schemas = await loadSchemas(path10.join(yggRoot, "schemas"));
   return {
     config,
     architecture,
@@ -7249,7 +7366,7 @@ async function loadGraph(projectRoot, options = {}) {
   };
 }
 async function loadArchitecture(yggRoot) {
-  const architectureFilePath = path9.join(yggRoot, "yg-architecture.yaml");
+  const architectureFilePath = path10.join(yggRoot, "yg-architecture.yaml");
   const emptyArch = { node_types: {} };
   try {
     const architecture = await parseArchitecture(architectureFilePath);
@@ -7287,7 +7404,7 @@ async function scanModelDirectory(dirPath, modelDir, parent, nodes, nodeParseErr
   }
   if (hasNodeYaml) {
     const graphPath = toModelPath(dirPath, modelDir);
-    const nodeYamlPath = path9.join(dirPath, "yg-node.yaml");
+    const nodeYamlPath = path10.join(dirPath, "yg-node.yaml");
     let meta;
     let nodeYamlRaw;
     try {
@@ -7319,7 +7436,7 @@ async function scanModelDirectory(dirPath, modelDir, parent, nodes, nodeParseErr
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".")) continue;
       await scanModelDirectory(
-        path9.join(dirPath, entry.name),
+        path10.join(dirPath, entry.name),
         modelDir,
         node,
         nodes,
@@ -7331,7 +7448,7 @@ async function scanModelDirectory(dirPath, modelDir, parent, nodes, nodeParseErr
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".")) continue;
       await scanModelDirectory(
-        path9.join(dirPath, entry.name),
+        path10.join(dirPath, entry.name),
         modelDir,
         null,
         nodes,
@@ -7353,8 +7470,8 @@ async function scanAspectsDirectory(dirPath, aspectsRoot, aspects, parseErrors)
   const entries = await readSortedDir(dirPath);
   const hasAspectYaml = entries.some((e) => e.isFile() && e.name === "yg-aspect.yaml");
   if (hasAspectYaml) {
-    const id = toPosixPath(path9.relative(aspectsRoot, dirPath));
-    const aspectYamlPath = path9.join(dirPath, "yg-aspect.yaml");
+    const id = toPosixPath(path10.relative(aspectsRoot, dirPath));
+    const aspectYamlPath = path10.join(dirPath, "yg-aspect.yaml");
     const result = await parseAspect(dirPath, aspectYamlPath, id);
     if (result.ok) {
       aspects.push(result.aspect);
@@ -7367,7 +7484,7 @@ async function scanAspectsDirectory(dirPath, aspectsRoot, aspects, parseErrors)
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith(".")) continue;
-    await scanAspectsDirectory(path9.join(dirPath, entry.name), aspectsRoot, aspects, parseErrors);
+    await scanAspectsDirectory(path10.join(dirPath, entry.name), aspectsRoot, aspects, parseErrors);
   }
 }
 async function loadFlows(flowsDir) {
@@ -7376,8 +7493,8 @@ async function loadFlows(flowsDir) {
   const flows = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const flowYamlPath = path9.join(flowsDir, entry.name, "yg-flow.yaml");
-    const flow = await parseFlow(path9.join(flowsDir, entry.name), flowYamlPath);
+    const flowYamlPath = path10.join(flowsDir, entry.name, "yg-flow.yaml");
+    const flow = await parseFlow(path10.join(flowsDir, entry.name), flowYamlPath);
     flows.push(flow);
   }
   return flows;
@@ -7388,7 +7505,7 @@ async function loadSchemas(schemasDir) {
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     if (!entry.name.endsWith(".yaml") && !entry.name.endsWith(".yml")) continue;
-    const s = await parseSchema(path9.join(schemasDir, entry.name));
+    const s = await parseSchema(path10.join(schemasDir, entry.name));
     schemas.push(s);
   }
   return schemas;
@@ -7455,7 +7572,7 @@ async function loadGraphOrAbort(rootPath, options = {}) {
 // src/migrations/to-4.0.0.ts
 init_posix();
 import { readdir as readdir4, readFile as readFile11, writeFile as writeFile4, rm as rm3, stat as stat4 } from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 import { parse as parseYaml8, stringify as stringifyYaml } from "yaml";
 var NODE_ARTIFACTS = ["responsibility.md", "interface.md", "internals.md"];
 function posix(p2) {
@@ -7466,19 +7583,19 @@ async function migrateTo4(yggRoot) {
   const warnings = [];
   await splitArchitecture(yggRoot, actions);
   await cleanConfig(yggRoot, actions);
-  const modelDir = path12.join(yggRoot, "model");
+  const modelDir = path13.join(yggRoot, "model");
   if (await dirExists(modelDir)) {
     await processNodesRecursive(modelDir, actions, warnings);
   }
-  const flowsDir = path12.join(yggRoot, "flows");
+  const flowsDir = path13.join(yggRoot, "flows");
   if (await dirExists(flowsDir)) {
     await processFlows(flowsDir, actions);
   }
-  const aspectsDir = path12.join(yggRoot, "aspects");
+  const aspectsDir = path13.join(yggRoot, "aspects");
   if (await dirExists(aspectsDir)) {
     await processAspects(aspectsDir, actions);
   }
-  const driftDir = path12.join(yggRoot, ".drift-state");
+  const driftDir = path13.join(yggRoot, ".drift-state");
   if (await dirExists(driftDir)) {
     await resetDriftState(driftDir, actions);
   }
@@ -7496,18 +7613,18 @@ async function dirExists(dir) {
   }
 }
 async function splitArchitecture(yggRoot, actions) {
-  const configPath = path12.join(yggRoot, "yg-config.yaml");
+  const configPath = path13.join(yggRoot, "yg-config.yaml");
   const content14 = await readFile11(configPath, "utf-8");
   const config = parseYaml8(content14);
   if (config.node_types) {
     const archData = { node_types: config.node_types };
-    const archPath = path12.join(yggRoot, "yg-architecture.yaml");
+    const archPath = path13.join(yggRoot, "yg-architecture.yaml");
     await writeFile4(archPath, stringifyYaml(archData, { lineWidth: 0 }), "utf-8");
     actions.push("Extracted node_types to yg-architecture.yaml");
   }
 }
 async function cleanConfig(yggRoot, actions) {
-  const configPath = path12.join(yggRoot, "yg-config.yaml");
+  const configPath = path13.join(yggRoot, "yg-config.yaml");
   const content14 = await readFile11(configPath, "utf-8");
   const config = parseYaml8(content14);
   let dirty = false;
@@ -7546,7 +7663,7 @@ async function cleanConfig(yggRoot, actions) {
 async function processNodesRecursive(dir, actions, warnings) {
   const entries = await readdir4(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path12.join(dir, entry.name);
+    const fullPath = path13.join(dir, entry.name);
     if (entry.isDirectory()) {
       await processNodesRecursive(fullPath, actions, warnings);
       continue;
@@ -7631,7 +7748,7 @@ async function processFlows(dir, actions) {
   const entries = await readdir4(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const descPath = path12.join(dir, entry.name, "description.md");
+    const descPath = path13.join(dir, entry.name, "description.md");
     try {
       await rm3(descPath);
       actions.push(`Deleted flow artifact: ${posix(descPath)}`);
@@ -7643,7 +7760,7 @@ async function processAspects(dir, actions) {
   const entries = await readdir4(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const aspectPath = path12.join(dir, entry.name, "yg-aspect.yaml");
+    const aspectPath = path13.join(dir, entry.name, "yg-aspect.yaml");
     try {
       const content14 = await readFile11(aspectPath, "utf-8");
       const aspect = parseYaml8(content14);
@@ -7662,7 +7779,7 @@ async function resetDriftState(dir, actions) {
 async function resetDriftStateRecursive(dir, actions) {
   const entries = await readdir4(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path12.join(dir, entry.name);
+    const fullPath = path13.join(dir, entry.name);
     if (entry.isDirectory()) {
       await resetDriftStateRecursive(fullPath, actions);
     } else if (entry.isFile() && entry.name.endsWith(".json")) {
@@ -7674,12 +7791,12 @@ async function resetDriftStateRecursive(dir, actions) {
 
 // src/migrations/to-4.3.0.ts
 import { readFile as readFile12, writeFile as writeFile5 } from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 import { parse as parseYaml9, stringify as stringifyYaml2 } from "yaml";
 async function migrateTo43(yggRoot) {
   const actions = [];
   const warnings = [];
-  const archPath = path13.join(yggRoot, "yg-architecture.yaml");
+  const archPath = path14.join(yggRoot, "yg-architecture.yaml");
   let raw;
   try {
     raw = await readFile12(archPath, "utf-8");
@@ -7724,7 +7841,7 @@ See: yg knowledge read working-with-architecture`
 
 // src/migrations/to-5.0.0.ts
 import { readFile as readFile17, writeFile as writeFile6, readdir as readdir8, rm as rm4 } from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 import { parse as parseYaml12, stringify as stringifyYaml3 } from "yaml";
 
 // src/core/format-detect.ts
@@ -7742,7 +7859,7 @@ init_secrets_parser();
 // src/migrations/aspect-status-defaults.ts
 init_posix();
 import { readFile as readFile14, readdir as readdir5 } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 import { parse as parseYaml11 } from "yaml";
 var STATUS_RANK = {
   draft: 0,
@@ -7766,14 +7883,14 @@ function parseAttachmentEntry(raw) {
   return { id, status: parseStatus(obj.status), statusInherit };
 }
 async function walkGraphDirs(rootDir, relPath, yamlName, visit) {
-  const dir = path14.join(rootDir, relPath);
+  const dir = path15.join(rootDir, relPath);
   let entries;
   try {
     entries = await readdir5(dir, { withFileTypes: true });
   } catch {
     return;
   }
-  const yamlPath = path14.join(dir, yamlName);
+  const yamlPath = path15.join(dir, yamlName);
   const relativeId = toPosix(relPath);
   try {
     await readFile14(yamlPath, "utf-8");
@@ -7782,12 +7899,12 @@ async function walkGraphDirs(rootDir, relPath, yamlName, visit) {
   }
   for (const entry of entries) {
     if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
-    await walkGraphDirs(rootDir, path14.join(relPath, entry.name), yamlName, visit);
+    await walkGraphDirs(rootDir, path15.join(relPath, entry.name), yamlName, visit);
   }
 }
 async function loadAspects2(yggRoot) {
   const result = /* @__PURE__ */ new Map();
-  const aspectsDir = path14.join(yggRoot, "aspects");
+  const aspectsDir = path15.join(yggRoot, "aspects");
   await walkGraphDirs(aspectsDir, "", "yg-aspect.yaml", async (aspectId, yamlPath) => {
     let raw;
     try {
@@ -7815,7 +7932,7 @@ async function loadAttachSitesAndNodeAspects(yggRoot) {
   const bump = (id) => {
     nodeAspectCounts.set(id, (nodeAspectCounts.get(id) ?? 0) + 1);
   };
-  const modelDir = path14.join(yggRoot, "model");
+  const modelDir = path15.join(yggRoot, "model");
   await walkGraphDirs(modelDir, "", "yg-node.yaml", async (nodePath, yamlPath) => {
     let raw;
     try {
@@ -7857,7 +7974,7 @@ async function loadAttachSitesAndNodeAspects(yggRoot) {
       }
     }
   });
-  const archPath = path14.join(yggRoot, "yg-architecture.yaml");
+  const archPath = path15.join(yggRoot, "yg-architecture.yaml");
   let nodeTypes;
   try {
     const archRaw = parseYaml11(await readFile14(archPath, "utf-8"));
@@ -7882,7 +7999,7 @@ async function loadAttachSitesAndNodeAspects(yggRoot) {
       });
     }
   }
-  const flowsDir = path14.join(yggRoot, "flows");
+  const flowsDir = path15.join(yggRoot, "flows");
   let flowEntries = [];
   try {
     flowEntries = await readdir5(flowsDir, { withFileTypes: true });
@@ -7890,7 +8007,7 @@ async function loadAttachSitesAndNodeAspects(yggRoot) {
   }
   for (const fe of flowEntries) {
     if (!fe.isDirectory()) continue;
-    const flowYaml = path14.join(flowsDir, fe.name, "yg-flow.yaml");
+    const flowYaml = path15.join(flowsDir, fe.name, "yg-flow.yaml");
     let flowRaw;
     try {
       const content14 = await readFile14(flowYaml, "utf-8");
@@ -8012,8 +8129,11 @@ function rekeyDriftBaseline(oldFlat) {
   const aspectVerdicts = oldFlat.aspectVerdicts ?? {};
   const state = {
     schemaVersion: DRIFT_STATE_SCHEMA_VERSION,
-    // Recompute with the NEW canonical scheme over the SAME logical inputs.
-    hash: computeCanonicalHash(realFiles, identity),
+    // Recompute with the NEW canonical scheme over the SAME logical inputs:
+    // files + typed identity + the (possibly synthesized-empty) verdict set that
+    // is also stored below. The verdict fold must use the SAME aspectVerdicts the
+    // baseline persists, so a fresh `yg check` over unchanged source sees no drift.
+    hash: computeCanonicalHash(realFiles, identity, aspectVerdicts),
     files: realFiles,
     identity,
     aspectVerdicts
@@ -8141,7 +8261,7 @@ function transformAspectReviewer(raw) {
   return { value: void 0, warnings, changed: false };
 }
 async function migrateConfigFile(yggRoot, actions, warnings) {
-  const configPath = path16.join(yggRoot, "yg-config.yaml");
+  const configPath = path17.join(yggRoot, "yg-config.yaml");
   let content14;
   try {
     content14 = await readFile17(configPath, "utf-8");
@@ -8191,7 +8311,7 @@ async function migrateConfigFile(yggRoot, actions, warnings) {
   return { proceedWithAspects: true };
 }
 async function migrateAllAspects(yggRoot, actions, warnings) {
-  const aspectsDir = path16.join(yggRoot, "aspects");
+  const aspectsDir = path17.join(yggRoot, "aspects");
   try {
     await scanAspectsDir(aspectsDir, "", actions, warnings);
   } catch (e) {
@@ -8199,7 +8319,7 @@ async function migrateAllAspects(yggRoot, actions, warnings) {
   }
 }
 async function scanAspectsDir(rootDir, relPath, actions, warnings) {
-  const dir = path16.join(rootDir, relPath);
+  const dir = path17.join(rootDir, relPath);
   let entries;
   try {
     entries = await readdir8(dir, { withFileTypes: true });
@@ -8208,7 +8328,7 @@ async function scanAspectsDir(rootDir, relPath, actions, warnings) {
     throw e;
   }
   const aspectId = toPosix(relPath);
-  const aspectYamlPath = path16.join(dir, "yg-aspect.yaml");
+  const aspectYamlPath = path17.join(dir, "yg-aspect.yaml");
   let hasAspectYaml = false;
   try {
     await readFile17(aspectYamlPath, "utf-8");
@@ -8221,7 +8341,7 @@ async function scanAspectsDir(rootDir, relPath, actions, warnings) {
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (entry.name.startsWith(".")) continue;
-    await scanAspectsDir(rootDir, path16.join(relPath, entry.name), actions, warnings);
+    await scanAspectsDir(rootDir, path17.join(relPath, entry.name), actions, warnings);
   }
 }
 async function migrateOneAspect(aspectYamlPath, aspectId, actions, warnings) {
@@ -8265,7 +8385,7 @@ async function migrateSecretsFile(yggRoot, _actions, warnings) {
 }
 var DRIFT_STATE_DIR2 = ".drift-state";
 async function scanDriftBaselineNodePaths(driftDir, relDir) {
-  const absDir = path16.join(driftDir, relDir);
+  const absDir = path17.join(driftDir, relDir);
   let entries;
   try {
     entries = await readdir8(absDir, { withFileTypes: true });
@@ -8285,8 +8405,8 @@ async function scanDriftBaselineNodePaths(driftDir, relDir) {
   return results;
 }
 async function migrateOneDriftBaseline(yggRoot, driftDir, nodePath, actions, warnings) {
-  const filePath = path16.join(driftDir, `${nodePath}.json`);
-  const displayPath = toPosix(path16.join(DRIFT_STATE_DIR2, `${nodePath}.json`));
+  const filePath = path17.join(driftDir, `${nodePath}.json`);
+  const displayPath = toPosix(path17.join(DRIFT_STATE_DIR2, `${nodePath}.json`));
   let parsed;
   try {
     const content14 = await readFile17(filePath, "utf-8");
@@ -8330,7 +8450,7 @@ async function migrateOneDriftBaseline(yggRoot, driftDir, nodePath, actions, war
   actions.push(`${displayPath}: re-keyed drift-state baseline to typed format.`);
 }
 async function migrateDriftState(yggRoot, actions, warnings) {
-  const driftDir = path16.join(yggRoot, DRIFT_STATE_DIR2);
+  const driftDir = path17.join(yggRoot, DRIFT_STATE_DIR2);
   const nodePaths = await scanDriftBaselineNodePaths(driftDir, "");
   for (const nodePath of nodePaths.sort()) {
     await migrateOneDriftBaseline(yggRoot, driftDir, nodePath, actions, warnings);
@@ -8381,34 +8501,34 @@ init_message_builder();
 init_debug_log();
 init_posix();
 function getPackageRoot() {
-  let dir = path17.dirname(fileURLToPath2(import.meta.url));
-  while (dir !== path17.dirname(dir)) {
-    if (existsSync2(path17.join(dir, "package.json"))) {
+  let dir = path18.dirname(fileURLToPath2(import.meta.url));
+  while (dir !== path18.dirname(dir)) {
+    if (existsSync2(path18.join(dir, "package.json"))) {
       return dir;
     }
-    dir = path17.dirname(dir);
+    dir = path18.dirname(dir);
   }
   throw new Error("Could not locate package root (no package.json found walking up from init module).");
 }
 function getGraphSchemasDir() {
-  return path17.join(getPackageRoot(), "graph-schemas");
+  return path18.join(getPackageRoot(), "graph-schemas");
 }
 async function getCliVersion() {
-  const pkgPath = path17.join(getPackageRoot(), "package.json");
+  const pkgPath = path18.join(getPackageRoot(), "package.json");
   const pkg2 = JSON.parse(await readFile18(pkgPath, "utf-8"));
   return pkg2.version;
 }
 async function refreshSchemas(yggRoot) {
-  const schemasDir = path17.join(yggRoot, "schemas");
+  const schemasDir = path18.join(yggRoot, "schemas");
   await mkdir3(schemasDir, { recursive: true });
   const graphSchemasDir = getGraphSchemasDir();
   try {
     const entries = await readdir9(graphSchemasDir, { withFileTypes: true });
     const schemaFiles = entries.filter((e) => e.isFile()).map((e) => e.name);
     for (const file of schemaFiles) {
-      const srcPath = path17.join(graphSchemasDir, file);
+      const srcPath = path18.join(graphSchemasDir, file);
       const content14 = await readFile18(srcPath, "utf-8");
-      await writeFile7(path17.join(schemasDir, file), content14, "utf-8");
+      await writeFile7(path18.join(schemasDir, file), content14, "utf-8");
     }
   } catch (e) {
     debugWrite(`[init] refreshSchemas schema copy failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -8593,7 +8713,7 @@ async function runReviewerConfigFlow() {
   return { provider, model, apiKey: apiKey || void 0, endpoint };
 }
 async function writeReviewerConfig(yggRoot, config) {
-  const configPath = path17.join(yggRoot, "yg-config.yaml");
+  const configPath = path18.join(yggRoot, "yg-config.yaml");
   let raw = {};
   try {
     const content14 = await readFile18(configPath, "utf-8");
@@ -8624,7 +8744,7 @@ async function writeReviewerConfig(yggRoot, config) {
   await writeFile7(configPath, yamlStringify(raw), "utf-8");
 }
 async function writeSecretsFile(yggRoot, provider, apiKey) {
-  const secretsPath = path17.join(yggRoot, "yg-secrets.yaml");
+  const secretsPath = path18.join(yggRoot, "yg-secrets.yaml");
   let raw = {};
   try {
     const content14 = await readFile18(secretsPath, "utf-8");
@@ -8647,7 +8767,7 @@ async function writeSecretsFile(yggRoot, provider, apiKey) {
   await writeFile7(secretsPath, yamlStringify(raw), { encoding: "utf-8", mode: 384 });
 }
 async function freshInit(projectRoot) {
-  const yggRoot = path17.join(projectRoot, ".yggdrasil");
+  const yggRoot = path18.join(projectRoot, ".yggdrasil");
   if (!isTTY()) {
     process.stderr.write(chalk2.red(`Error: ${buildIssueMessage({
       what: "yg init requires an interactive terminal.",
@@ -8677,19 +8797,19 @@ async function freshInit(projectRoot) {
   p.outro(chalk2.green("Yggdrasil initialized. Run yg check to get started."));
 }
 async function createYggdrasilStructure(projectRoot, yggRoot, platform) {
-  await mkdir3(path17.join(yggRoot, "model"), { recursive: true });
-  await mkdir3(path17.join(yggRoot, "aspects"), { recursive: true });
-  await mkdir3(path17.join(yggRoot, "flows"), { recursive: true });
-  const schemasDir = path17.join(yggRoot, "schemas");
+  await mkdir3(path18.join(yggRoot, "model"), { recursive: true });
+  await mkdir3(path18.join(yggRoot, "aspects"), { recursive: true });
+  await mkdir3(path18.join(yggRoot, "flows"), { recursive: true });
+  const schemasDir = path18.join(yggRoot, "schemas");
   await mkdir3(schemasDir, { recursive: true });
   const graphSchemasDir = getGraphSchemasDir();
   try {
     const entries = await readdir9(graphSchemasDir, { withFileTypes: true });
     const schemaFiles = entries.filter((e) => e.isFile()).map((e) => e.name);
     for (const file of schemaFiles) {
-      const srcPath = path17.join(graphSchemasDir, file);
+      const srcPath = path18.join(graphSchemasDir, file);
       const content14 = await readFile18(srcPath, "utf-8");
-      await writeFile7(path17.join(schemasDir, file), content14, "utf-8");
+      await writeFile7(path18.join(schemasDir, file), content14, "utf-8");
     }
   } catch (err) {
     debugWrite(`[init] createYggdrasilStructure schema copy failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -8698,9 +8818,9 @@ async function createYggdrasilStructure(projectRoot, yggRoot, platform) {
 `)
     );
   }
-  await writeFile7(path17.join(yggRoot, "yg-config.yaml"), DEFAULT_CONFIG, "utf-8");
-  await writeFile7(path17.join(yggRoot, "yg-architecture.yaml"), DEFAULT_ARCHITECTURE, "utf-8");
-  await writeFile7(path17.join(yggRoot, ".gitignore"), GITIGNORE_CONTENT, "utf-8");
+  await writeFile7(path18.join(yggRoot, "yg-config.yaml"), DEFAULT_CONFIG, "utf-8");
+  await writeFile7(path18.join(yggRoot, "yg-architecture.yaml"), DEFAULT_ARCHITECTURE, "utf-8");
+  await writeFile7(path18.join(yggRoot, ".gitignore"), GITIGNORE_CONTENT, "utf-8");
   await installRulesForPlatform(projectRoot, platform);
 }
 async function runVersionUpgrade2(projectRoot, yggRoot, platform) {
@@ -8709,7 +8829,7 @@ async function runVersionUpgrade2(projectRoot, yggRoot, platform) {
     migrations: MIGRATIONS
   });
   await refreshSchemas(yggRoot);
-  const architecturePath = path17.join(yggRoot, "yg-architecture.yaml");
+  const architecturePath = path18.join(yggRoot, "yg-architecture.yaml");
   try {
     await stat6(architecturePath);
   } catch (e) {
@@ -8721,7 +8841,7 @@ async function runVersionUpgrade2(projectRoot, yggRoot, platform) {
   return { rulesPath, migrationActions, migrationWarnings, withheld };
 }
 async function existingInit(projectRoot) {
-  const yggRoot = path17.join(projectRoot, ".yggdrasil");
+  const yggRoot = path18.join(projectRoot, ".yggdrasil");
   if (!isTTY()) {
     process.stderr.write(chalk2.yellow(buildIssueMessage({
       what: ".yggdrasil/ already exists.",
@@ -8753,7 +8873,7 @@ async function existingInit(projectRoot) {
     p.log.info("2. Run yg approve on all nodes to establish baselines");
     p.outro(
       chalk2.green(
-        `Migrated from ${currentVersion} to ${landedVersion}. Rules installed: ${toPosixPath(path17.relative(projectRoot, result.rulesPath))}`
+        `Migrated from ${currentVersion} to ${landedVersion}. Rules installed: ${toPosixPath(path18.relative(projectRoot, result.rulesPath))}`
       )
     );
     return;
@@ -8771,7 +8891,7 @@ async function existingInit(projectRoot) {
     case "upgrade": {
       const platform = await promptPlatform();
       const result = await runVersionUpgrade2(projectRoot, yggRoot, platform);
-      p.outro(chalk2.green(`Rules and schemas refreshed: ${toPosixPath(path17.relative(projectRoot, result.rulesPath))}`));
+      p.outro(chalk2.green(`Rules and schemas refreshed: ${toPosixPath(path18.relative(projectRoot, result.rulesPath))}`));
       break;
     }
     case "reviewer": {
@@ -8786,7 +8906,7 @@ async function existingInit(projectRoot) {
     case "platform": {
       const platform = await promptPlatform();
       const rulesPath = await installRulesForPlatform(projectRoot, platform);
-      p.outro(chalk2.green(`Platform changed: ${toPosixPath(path17.relative(projectRoot, rulesPath))}`));
+      p.outro(chalk2.green(`Platform changed: ${toPosixPath(path18.relative(projectRoot, rulesPath))}`));
       break;
     }
   }
@@ -8795,7 +8915,7 @@ function registerInitCommand(program2) {
   program2.command("init").description("Initialize Yggdrasil graph in current project").option("--upgrade", "Non-interactive: refresh rules and schemas").option("--platform <name>", `Platform for rules file (${PLATFORMS.join(", ")})`).action(async (options) => {
     try {
       const projectRoot = process.cwd();
-      const yggRoot = path17.join(projectRoot, ".yggdrasil");
+      const yggRoot = path18.join(projectRoot, ".yggdrasil");
       if (options.upgrade) {
         if (!options.platform) {
           process.stderr.write(
@@ -8875,7 +8995,7 @@ function registerInitCommand(program2) {
           );
         }
         process.stdout.write(
-          `Rules and schemas refreshed: ${toPosixPath(path17.relative(projectRoot, result.rulesPath))}
+          `Rules and schemas refreshed: ${toPosixPath(path18.relative(projectRoot, result.rulesPath))}
 `
         );
         return;
@@ -8927,7 +9047,7 @@ init_paths();
 init_graph_fs();
 init_aspects();
 init_posix();
-import path19 from "path";
+import path20 from "path";
 
 // src/core/graph/index.ts
 init_traversal();
@@ -8956,11 +9076,11 @@ function normPath(p2) {
 }
 function countDependents(graph, nodePath) {
   const paths = [];
-  for (const [path44, node] of graph.nodes) {
+  for (const [path46, node] of graph.nodes) {
     const hasRelation = (node.meta.relations ?? []).some(
       (r) => r.target === nodePath && (STRUCTURAL_RELATION_TYPES2.has(r.type) || EVENT_RELATION_TYPES.has(r.type))
     );
-    if (hasRelation) paths.push(path44);
+    if (hasRelation) paths.push(path46);
   }
   return { count: paths.length, paths };
 }
@@ -8982,7 +9102,7 @@ function buildNodeContextData(graph, nodePath) {
       name: aspectDef?.name ?? aspectId,
       description: aspectDef?.description ?? "",
       source,
-      verifiedAgainst: aspectDef?.reviewer?.type === "deterministic" ? `.yggdrasil/aspects/${aspectId}/check.mjs` : `.yggdrasil/aspects/${aspectId}/content.md`,
+      verifiedAgainst: aspectDef?.reviewer?.type === "deterministic" ? `.yggdrasil/aspects/${aspectId}/check.mjs` : aspectDef?.reviewer?.type === "aggregate" ? `.yggdrasil/aspects/${aspectId}/yg-aspect.yaml` : `.yggdrasil/aspects/${aspectId}/content.md`,
       implies: aspectDef?.implies,
       status,
       ...refs && { references: refs }
@@ -9039,7 +9159,7 @@ function buildFileContextData(graph, filePath, ownerPath) {
     return {
       aspectId,
       aspectDescription: aspectDef?.description ?? aspectDef?.name ?? aspectId,
-      verifiedAgainst: aspectDef?.reviewer?.type === "deterministic" ? `.yggdrasil/aspects/${aspectId}/check.mjs` : `.yggdrasil/aspects/${aspectId}/content.md`,
+      verifiedAgainst: aspectDef?.reviewer?.type === "deterministic" ? `.yggdrasil/aspects/${aspectId}/check.mjs` : aspectDef?.reviewer?.type === "aggregate" ? `.yggdrasil/aspects/${aspectId}/yg-aspect.yaml` : `.yggdrasil/aspects/${aspectId}/content.md`,
       status,
       ...refs && { references: refs }
     };
@@ -9304,7 +9424,7 @@ function issueMsg(data) {
 init_posix();
 
 // src/core/checks/architecture.ts
-import path20 from "path";
+import path21 from "path";
 
 // src/core/file-when-evaluator.ts
 import { minimatch } from "minimatch";
@@ -9527,19 +9647,19 @@ function checkArchitectureParentCycles(graph) {
   const color = new Map(typeIds.map((id) => [id, WHITE]));
   const backEdges = /* @__PURE__ */ new Set();
   const recordedCycles = [];
-  function dfs(typeId, path44) {
+  function dfs(typeId, path46) {
     if (color.get(typeId) === GRAY) {
-      const cycleStart = path44.indexOf(typeId);
-      if (cycleStart !== -1) recordedCycles.push([...path44.slice(cycleStart), typeId]);
-      const from = path44[path44.length - 1];
+      const cycleStart = path46.indexOf(typeId);
+      if (cycleStart !== -1) recordedCycles.push([...path46.slice(cycleStart), typeId]);
+      const from = path46[path46.length - 1];
       if (from !== void 0) backEdges.add(`${from}->${typeId}`);
       return;
     }
     if (color.get(typeId) === BLACK) return;
     color.set(typeId, GRAY);
-    path44.push(typeId);
-    for (const parent of types[typeId]?.parents ?? []) dfs(parent, path44);
-    path44.pop();
+    path46.push(typeId);
+    for (const parent of types[typeId]?.parents ?? []) dfs(parent, path46);
+    path46.pop();
     color.set(typeId, BLACK);
   }
   for (const id of typeIds) {
@@ -9642,13 +9762,13 @@ ${preview}${ellipsis}`,
 async function checkTypeWhenMismatch(graph, cache) {
   const issues = [];
   const unreadable = [];
-  const projectRoot = path20.dirname(graph.rootPath);
+  const projectRoot = path21.dirname(graph.rootPath);
   for (const [nodePath, node] of graph.nodes) {
     const typeDef = graph.architecture.node_types[node.meta.type];
     if (typeDef === void 0 || typeDef.when === void 0) continue;
     const mapping = node.meta.mapping ?? [];
     for (const relPath of mapping) {
-      const absPath = path20.join(projectRoot, relPath);
+      const absPath = path21.join(projectRoot, relPath);
       const result = await evaluateFileWhen(typeDef.when, {
         absPath,
         repoRelPath: relPath,
@@ -9876,7 +9996,7 @@ function checkDanglingAspectRefs(graph) {
           ...issueMsg({
             what: `Aspect '${aspectId}' is referenced by this node but not defined in aspects/.`,
             why: `Node declares an aspect that does not exist \u2014 aspect requirements cannot be verified.`,
-            next: `Create aspects/${aspectId}/ with yg-aspect.yaml and content.md.`
+            next: `Create the aspects/${aspectId} directory with yg-aspect.yaml and content.md.`
           })
         });
       }
@@ -9893,7 +10013,7 @@ function checkDanglingAspectRefs(graph) {
               ...issueMsg({
                 what: `Aspect '${aspectId}' is referenced by port '${portName}' but not defined in aspects/.`,
                 why: `Port declares a required aspect that does not exist \u2014 port contracts cannot be enforced.`,
-                next: `Create aspects/${aspectId}/ with yg-aspect.yaml and content.md.`
+                next: `Create the aspects/${aspectId} directory with yg-aspect.yaml and content.md.`
               })
             });
           }
@@ -9911,7 +10031,7 @@ function checkDanglingAspectRefs(graph) {
           ...issueMsg({
             what: `Aspect '${aspectId}' is referenced by architecture type '${typeId}' but not defined in aspects/.`,
             why: `Architecture declares a required aspect that does not exist.`,
-            next: `Create aspects/${aspectId}/ with yg-aspect.yaml and content.md.`
+            next: `Create the aspects/${aspectId} directory with yg-aspect.yaml and content.md.`
           })
         });
       }
@@ -9927,7 +10047,7 @@ function checkDanglingAspectRefs(graph) {
           ...issueMsg({
             what: `Aspect '${aspectId}' is referenced by flow '${flow.name}' but not defined in aspects/.`,
             why: `Flow declares an aspect that does not exist \u2014 flow requirements cannot propagate.`,
-            next: `Create aspects/${aspectId}/ with yg-aspect.yaml and content.md.`
+            next: `Create the aspects/${aspectId} directory with yg-aspect.yaml and content.md.`
           })
         });
       }
@@ -10223,17 +10343,45 @@ init_graph();
 init_graph_fs();
 init_aspects();
 init_tier_selection();
-import path21 from "path";
+import path22 from "path";
 init_posix();
 function checkAspectRuleSources(graph) {
   const issues = [];
-  const projectRoot = path21.dirname(graph.rootPath);
+  const projectRoot = path22.dirname(graph.rootPath);
   for (const aspect of graph.aspects) {
     const reviewer = aspect.reviewer.type;
+    const aspectDir = path22.join(projectRoot, ".yggdrasil", "aspects", aspect.id);
+    const hasContentMd = fileExistsSync(path22.join(aspectDir, "content.md"));
+    const hasCheckMjs = fileExistsSync(path22.join(aspectDir, "check.mjs"));
+    if (reviewer === "aggregate") {
+      if (hasContentMd || hasCheckMjs) {
+        const present = [hasContentMd ? "content.md" : null, hasCheckMjs ? "check.mjs" : null].filter((f) => f !== null).join(" and ");
+        issues.push({
+          severity: "error",
+          code: "aspect-unexpected-rule-source",
+          rule: "aspect-rule-sources",
+          ...issueMsg({
+            what: `Aspect '${aspect.id}' is an aggregating aspect (no reviewer.type declared, only implies) but ships ${present}.`,
+            why: `Aggregating aspects bundle implied aspects and have no own reviewer; a rule source here is never read.`,
+            next: `Remove .yggdrasil/aspects/${aspect.id}/${present} to keep it aggregating, or declare reviewer.type explicitly to make it an LLM/deterministic aspect.`
+          })
+        });
+      }
+      if (!aspect.implies || aspect.implies.length === 0) {
+        issues.push({
+          severity: "error",
+          code: "aspect-empty",
+          rule: "aspect-rule-sources",
+          ...issueMsg({
+            what: `Aspect '${aspect.id}' has no content.md, no check.mjs, and no implies \u2014 it does nothing.`,
+            why: `An aspect must ship a rule source (content.md or check.mjs) or aggregate others via implies; an empty aspect can never produce a verdict.`,
+            next: `Add a content.md (llm) or check.mjs (deterministic), or add 'implies:' to .yggdrasil/aspects/${aspect.id}/yg-aspect.yaml to bundle existing aspects.`
+          })
+        });
+      }
+      continue;
+    }
     if (reviewer !== "deterministic" && reviewer !== "llm") continue;
-    const aspectDir = path21.join(projectRoot, ".yggdrasil", "aspects", aspect.id);
-    const hasContentMd = fileExistsSync(path21.join(aspectDir, "content.md"));
-    const hasCheckMjs = fileExistsSync(path21.join(aspectDir, "check.mjs"));
     if (hasContentMd && hasCheckMjs) {
       issues.push({
         severity: "error",
@@ -10361,7 +10509,7 @@ function formatBytes(n) {
   return `${Math.round(n / 1024)} KiB`;
 }
 async function checkAspectReferences(graph) {
-  const projectRoot = path21.dirname(graph.rootPath);
+  const projectRoot = path22.dirname(graph.rootPath);
   const issues = [];
   for (const aspect of graph.aspects) {
     if (aspect.reviewer.type !== "llm") continue;
@@ -10395,7 +10543,7 @@ async function checkAspectReferences(graph) {
     const tierLabel = tierName != null ? `for tier '${tierName}'` : "for the resolved tier";
     let totalBytes = 0;
     for (const ref of aspect.references) {
-      const absPath = path21.join(projectRoot, ref.path);
+      const absPath = path22.join(projectRoot, ref.path);
       const refPath = toPosixPath(ref.path);
       let stats;
       try {
@@ -10542,16 +10690,16 @@ init_hash();
 init_graph_fs();
 init_repo_scanner();
 init_aspects();
-import path22 from "path";
+import path23 from "path";
 init_posix();
 async function checkFileMappingGitignored(graph) {
-  const projectRoot = path22.dirname(graph.rootPath);
+  const projectRoot = path23.dirname(graph.rootPath);
   const tracked = new Set(await walkRepoFiles(projectRoot));
   const issues = [];
   for (const [nodePath, node] of graph.nodes) {
     const mapping = node.meta.mapping ?? [];
     for (const relPath of mapping) {
-      const absPath = path22.join(projectRoot, relPath);
+      const absPath = path23.join(projectRoot, relPath);
       let st;
       try {
         st = await statPath(absPath);
@@ -10585,7 +10733,7 @@ async function checkStrictBackwardCoverage(graph, cache) {
     ([, def]) => def.enforce === "strict" && def.when !== void 0
   );
   if (strictTypes.length === 0) return { issues: [], unreadable: [] };
-  const projectRoot = path22.dirname(graph.rootPath);
+  const projectRoot = path23.dirname(graph.rootPath);
   const fileToOwner = /* @__PURE__ */ new Map();
   for (const [nodePath, node] of graph.nodes) {
     for (const relPath of node.meta.mapping ?? []) {
@@ -10598,7 +10746,7 @@ async function checkStrictBackwardCoverage(graph, cache) {
   const overlapPairsSeen = /* @__PURE__ */ new Set();
   for (const rawRel of repoFiles) {
     const relPath = normalizePathForCompare(rawRel);
-    const absPath = path22.join(projectRoot, relPath);
+    const absPath = path23.join(projectRoot, relPath);
     const matchingTypes = [];
     let fileSkipped = false;
     for (const [typeId2, def] of strictTypes) {
@@ -10749,11 +10897,11 @@ function checkMappingOverlap(graph) {
 }
 async function checkMappingPathsExist(graph) {
   const issues = [];
-  const projectRoot = path22.dirname(graph.rootPath);
+  const projectRoot = path23.dirname(graph.rootPath);
   for (const [nodePath, node] of graph.nodes) {
     const mappingPaths = normalizeMappingPaths(node.meta.mapping).map(normalizePathForCompare);
     for (const mp of mappingPaths) {
-      const absPath = path22.join(projectRoot, mp);
+      const absPath = path23.join(projectRoot, mp);
       try {
         await fileAccess(absPath);
       } catch {
@@ -10775,13 +10923,13 @@ async function checkMappingPathsExist(graph) {
 }
 function checkMappingEscapesRepo(graph) {
   const issues = [];
-  const projectRoot = path22.dirname(graph.rootPath);
+  const projectRoot = path23.dirname(graph.rootPath);
   for (const [nodePath, node] of graph.nodes) {
     for (const raw of node.meta.mapping ?? []) {
       const norm = normalizePathForCompare(raw);
-      const resolved = path22.resolve(projectRoot, norm);
-      const rel = normalizePathForCompare(path22.relative(projectRoot, resolved));
-      if (path22.isAbsolute(norm) || rel === ".." || rel.startsWith("../")) {
+      const resolved = path23.resolve(projectRoot, norm);
+      const rel = normalizePathForCompare(path23.relative(projectRoot, resolved));
+      if (path23.isAbsolute(norm) || rel === ".." || rel.startsWith("../")) {
         issues.push({
           severity: "error",
           code: "mapping-escapes-repo",
@@ -10830,7 +10978,7 @@ var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
 async function checkOversizedNodes(graph, cache) {
   const issues = [];
   const maxChars = graph.config.quality?.max_node_chars ?? 4e4;
-  const projectRoot = path22.dirname(graph.rootPath);
+  const projectRoot = path23.dirname(graph.rootPath);
   const refsByAspect = /* @__PURE__ */ new Map();
   for (const aspect of graph.aspects) {
     if (aspect.references?.length) {
@@ -10838,8 +10986,8 @@ async function checkOversizedNodes(graph, cache) {
     }
   }
   async function charsOf(repoRelPath) {
-    if (BINARY_EXTENSIONS.has(path22.extname(repoRelPath).toLowerCase())) return 0;
-    const abs = path22.resolve(projectRoot, repoRelPath);
+    if (BINARY_EXTENSIONS.has(path23.extname(repoRelPath).toLowerCase())) return 0;
+    const abs = path23.resolve(projectRoot, repoRelPath);
     const res = await cache.read(abs);
     if (res.content !== void 0) return res.content.length;
     if (res.tooLarge) {
@@ -10886,7 +11034,7 @@ async function checkOversizedNodes(graph, cache) {
 }
 async function checkDirectoriesHaveNodeYaml(graph) {
   const issues = [];
-  const modelDir = path22.join(graph.rootPath, "model");
+  const modelDir = path23.join(graph.rootPath, "model");
   async function scanDir(dirPath, segments) {
     const entries = await readSortedDir(dirPath);
     const hasNodeYaml = entries.some((e) => e.isFile() && e.name === "yg-node.yaml");
@@ -10910,7 +11058,7 @@ async function checkDirectoriesHaveNodeYaml(graph) {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".")) continue;
-      await scanDir(path22.join(dirPath, entry.name), [...segments, entry.name]);
+      await scanDir(path23.join(dirPath, entry.name), [...segments, entry.name]);
     }
   }
   try {
@@ -10918,7 +11066,7 @@ async function checkDirectoriesHaveNodeYaml(graph) {
     for (const entry of rootEntries) {
       if (!entry.isDirectory()) continue;
       if (entry.name.startsWith(".")) continue;
-      await scanDir(path22.join(modelDir, entry.name), [entry.name]);
+      await scanDir(path23.join(modelDir, entry.name), [entry.name]);
     }
   } catch {
   }
@@ -11366,7 +11514,7 @@ async function validate(graph, scope = "all") {
 }
 
 // src/cli/owner.ts
-import path23 from "path";
+import path24 from "path";
 import { access as access2 } from "fs/promises";
 init_debug_log();
 init_message_builder();
@@ -11402,7 +11550,7 @@ function registerOwnerCommand(program2) {
       const repoRelative = resolveFileArg(repoRoot, options.file);
       const result = findOwner(graph, repoRoot, repoRelative);
       if (!result.nodePath) {
-        const absPath = path23.resolve(repoRoot, result.file);
+        const absPath = path24.resolve(repoRoot, result.file);
         let exists = true;
         try {
           await access2(absPath);
@@ -11599,7 +11747,7 @@ ${errorList}`
 
 // src/cli/approve.ts
 import chalk4 from "chalk";
-import path34 from "path";
+import path35 from "path";
 init_debug_log();
 init_approve();
 init_approve_reviewer();
@@ -11615,7 +11763,7 @@ init_paths();
 init_aspects();
 init_graph_fs();
 init_log_integrity();
-import path33 from "path";
+import path34 from "path";
 
 // src/core/check-codes.ts
 var STRUCTURAL_CODES = /* @__PURE__ */ new Set([
@@ -11645,8 +11793,10 @@ var STRUCTURAL_CODES = /* @__PURE__ */ new Set([
   "when-unknown-port",
   "aspect-unexpected-rule-source",
   "aspect-missing-rule-source",
+  "aspect-empty",
   "file-unreadable",
   "aspect-references-on-deterministic",
+  "aspect-references-on-aggregate",
   "aspect-reference-broken",
   "aspect-reference-too-large",
   "aspect-references-total-too-large",
@@ -11655,15 +11805,103 @@ var STRUCTURAL_CODES = /* @__PURE__ */ new Set([
   "aspect-reference-escape",
   "aspect-reference-duplicate",
   "aspect-tier-unknown",
-  "mapping-escapes-repo"
+  "mapping-escapes-repo",
+  // Drift-state integrity: the recorded baseline hash for a node does not match
+  // a recompute over its files, typed identity, and stored verdicts, yet no file
+  // or identity change explains the divergence (the stored verdicts were tampered
+  // or the baseline predates a hash-scheme change). Structural because it blocks
+  // CI regardless of source-file drift — the baseline itself is untrustworthy.
+  "baseline-integrity"
 ]);
 var COMPLETENESS_CODES = /* @__PURE__ */ new Set(["description-missing"]);
 
 // src/core/check.ts
 init_log_format();
 init_posix();
+init_repo_scanner();
+
+// src/core/check-coverage-tiers.ts
+init_posix();
+function normalizeRoot(root) {
+  return toPosixPath(root.trim()).replace(/^\/+/, "").replace(/\/+$/, "").replace(/\/{2,}/g, "/");
+}
+function matchesRoot(file, normRoot) {
+  return normRoot === "" || file === normRoot || file.startsWith(normRoot + "/");
+}
+function partitionByCoverageTier(uncovered, coverage) {
+  const req = coverage.required.map(normalizeRoot);
+  const exc = coverage.excluded.map(normalizeRoot);
+  const required = [];
+  const middle = [];
+  for (const f of uncovered) {
+    let best = { len: -1, tier: "middle" };
+    for (const r of req) if (matchesRoot(f, r) && r.length > best.len) best = { len: r.length, tier: "required" };
+    for (const r of exc) if (matchesRoot(f, r) && r.length >= best.len) best = { len: r.length, tier: "excluded" };
+    if (best.tier === "required") required.push(f);
+    else if (best.tier === "middle") middle.push(f);
+  }
+  return { required, middle };
+}
+function buildCoverageIssue(uncoveredFiles, totalGitFiles) {
+  if (uncoveredFiles.length === 0) return null;
+  const sampleSize = 5;
+  const sample = uncoveredFiles.slice(0, sampleSize);
+  const remaining = uncoveredFiles.length - sample.length;
+  const coveragePct = totalGitFiles > 0 ? (totalGitFiles - uncoveredFiles.length) / totalGitFiles * 100 : 100;
+  let coverageMd;
+  if (uncoveredFiles.length <= sampleSize) {
+    coverageMd = {
+      what: `${uncoveredFiles.length} source file${uncoveredFiles.length === 1 ? "" : "s"} not covered by any node.
+${sample.map((f) => "  " + f).join("\n")}`,
+      why: "Files without graph coverage cannot be modified under the protocol.",
+      next: `Check ownership candidates: yg context --file <path>
+Then: add to existing node mapping, or create a new node.`
+    };
+  } else {
+    const guidance = coveragePct < 50 ? "Establish coverage: create nodes for active areas first, expand coverage incrementally." : "Add to an existing node mapping, or create a new node.";
+    coverageMd = {
+      what: `${uncoveredFiles.length} source files have no graph coverage.
+Examples:
+${sample.map((f) => "  " + f).join("\n")}
+... and ${remaining} more`,
+      why: "Files without graph coverage cannot be modified under the protocol.",
+      next: `${guidance}
+Check ownership candidates: yg context --file <path>`
+    };
+  }
+  return {
+    severity: "error",
+    code: "unmapped-files",
+    rule: "unmapped-file",
+    messageData: coverageMd,
+    uncoveredFiles,
+    uncoveredCount: uncoveredFiles.length
+  };
+}
+function buildCoverageAdvisoryIssue(uncoveredFiles) {
+  if (uncoveredFiles.length === 0) return null;
+  const sample = uncoveredFiles.slice(0, 5);
+  const remaining = uncoveredFiles.length - sample.length;
+  const body = uncoveredFiles.length <= 5 ? sample.map((f) => "  " + f).join("\n") : `${sample.map((f) => "  " + f).join("\n")}
+... and ${remaining} more`;
+  return {
+    severity: "warning",
+    code: "uncovered-advisory",
+    rule: "uncovered-advisory",
+    messageData: {
+      what: `${uncoveredFiles.length} tracked file${uncoveredFiles.length === 1 ? "" : "s"} outside any required coverage root.
+${body}`,
+      why: "Not under a coverage.required root \u2014 visible but non-blocking. Bring an area under graph coverage to enforce it.",
+      next: "Map these files to a node, or add their root to coverage.required to make this an error."
+    },
+    uncoveredFiles,
+    uncoveredCount: uncoveredFiles.length
+  };
+}
+
+// src/core/check.ts
 async function classifyDrift(graph) {
-  const projectRoot = path33.dirname(graph.rootPath);
+  const projectRoot = path34.dirname(graph.rootPath);
   const issues = [];
   for (const [nodePath, node] of graph.nodes) {
     const mappingPaths = normalizeMappingPaths(node.meta.mapping);
@@ -11733,7 +11971,10 @@ ${mappingPaths.map((p2) => "  " + p2).join("\n")}`,
     trackedFiles,
     storedFileData,
     excludePrefixes,
-    identity
+    identity,
+    storedEntry.aspectVerdicts,
+    false
+    // never reuse stored hashes by mtime in the check gate — always re-hash content
   );
   if (canonicalHash === storedEntry.hash) return;
   const resolveLayer = buildLayerResolver(trackedFiles);
@@ -11791,6 +12032,21 @@ ${mappingPaths.map((p2) => "  " + p2).join("\n")}`,
       }
     }
   }
+  if (directChanges.length === 0 && cascadeCauses.length === 0) {
+    const baselineIntegrityMd = {
+      what: `Recorded baseline hash for '${nodePath}' does not match a recompute over its files, identity, and verdicts.`,
+      why: "The drift-state was edited or is stale (a stored verdict may have been tampered, or the baseline predates a hash-scheme change). The recorded hash can no longer be trusted.",
+      next: `yg approve --node ${nodePath} to re-establish the baseline, or restore it from git: git checkout HEAD -- .yggdrasil/.drift-state/${nodePath}.json`
+    };
+    issues.push({
+      severity: "error",
+      code: "baseline-integrity",
+      rule: "baseline-integrity",
+      messageData: baselineIntegrityMd,
+      nodePath
+    });
+    return;
+  }
   if (directChanges.length > 0) {
     const sourceFiles = directChanges.filter((f) => f.category === "source").map((f) => f.filePath);
     const sourceDriftMd = {
@@ -11842,7 +12098,7 @@ Verify source compliance, update if needed, then: yg approve --node ${nodePath}`
 async function classifyLogState(graph, projectRoot, issues) {
   for (const [nodePath] of graph.nodes) {
     const logRel = `.yggdrasil/model/${nodePath}/log.md`;
-    const logAbs = path33.join(projectRoot, logRel);
+    const logAbs = path34.join(projectRoot, logRel);
     let logContent = null;
     try {
       logContent = await readTextFile(logAbs);
@@ -11896,10 +12152,11 @@ function scanUncoveredFiles(graph, gitTrackedFiles) {
     const paths = normalizeMappingPaths(node.meta.mapping);
     allMappings.push(...paths);
   }
-  const projectRoot = path33.dirname(graph.rootPath);
-  const yggPrefix = toPosixPath(path33.relative(projectRoot, graph.rootPath));
+  const projectRoot = path34.dirname(graph.rootPath);
+  const yggPrefix = toPosixPath(path34.relative(projectRoot, graph.rootPath));
   const uncovered = [];
-  for (const file of gitTrackedFiles) {
+  const tracked = excludeNestedGraphSubtrees(gitTrackedFiles);
+  for (const file of tracked) {
     const normalized = toPosixPath(file.trim());
     if (normalized.startsWith(yggPrefix + "/") || normalized === yggPrefix) continue;
     let covered = false;
@@ -11916,42 +12173,6 @@ function scanUncoveredFiles(graph, gitTrackedFiles) {
   }
   return uncovered.sort();
 }
-function buildCoverageIssue(uncoveredFiles, totalGitFiles) {
-  if (uncoveredFiles.length === 0) return null;
-  const sampleSize = 5;
-  const sample = uncoveredFiles.slice(0, sampleSize);
-  const remaining = uncoveredFiles.length - sample.length;
-  const coveragePct = totalGitFiles > 0 ? (totalGitFiles - uncoveredFiles.length) / totalGitFiles * 100 : 100;
-  let coverageMd;
-  if (uncoveredFiles.length <= sampleSize) {
-    coverageMd = {
-      what: `${uncoveredFiles.length} source file${uncoveredFiles.length === 1 ? "" : "s"} not covered by any node.
-${sample.map((f) => "  " + f).join("\n")}`,
-      why: "Files without graph coverage cannot be modified under the protocol.",
-      next: `Check ownership candidates: yg context --file <path>
-Then: add to existing node mapping, or create a new node.`
-    };
-  } else {
-    const guidance = coveragePct < 50 ? "Establish coverage: create nodes for active areas first, expand coverage incrementally." : "Add to an existing node mapping, or create a new node.";
-    coverageMd = {
-      what: `${uncoveredFiles.length} source files have no graph coverage.
-Examples:
-${sample.map((f) => "  " + f).join("\n")}
-... and ${remaining} more`,
-      why: "Files without graph coverage cannot be modified under the protocol.",
-      next: `${guidance}
-Check ownership candidates: yg context --file <path>`
-    };
-  }
-  return {
-    severity: "error",
-    code: "unmapped-files",
-    rule: "unmapped-file",
-    messageData: coverageMd,
-    uncoveredFiles,
-    uncoveredCount: uncoveredFiles.length
-  };
-}
 async function detectOrphanedDriftState(graph) {
   const driftState = await readDriftState(graph.rootPath);
   const validNodePaths = new Set(graph.nodes.keys());
@@ -11961,20 +12182,25 @@ async function runCheck(graph, gitTrackedFiles) {
   const validation = await validate(graph);
   const validationIssues = validation.issues.filter((vi) => vi.code).map((vi) => ({ ...vi, code: vi.code }));
   const driftIssues = await classifyDrift(graph);
-  let coverageIssue = null;
+  let coverageIssues = [];
   let coveredFiles = 0;
   let totalFiles = 0;
   if (gitTrackedFiles !== null) {
-    const projectRoot = path33.dirname(graph.rootPath);
-    const yggPrefix = toPosixPath(path33.relative(projectRoot, graph.rootPath));
-    const sourceFiles = gitTrackedFiles.filter((f) => {
+    const projectRoot = path34.dirname(graph.rootPath);
+    const yggPrefix = toPosixPath(path34.relative(projectRoot, graph.rootPath));
+    const sourceFiles = excludeNestedGraphSubtrees(gitTrackedFiles).filter((f) => {
       const normalized = toPosixPath(f.trim());
       return !normalized.startsWith(yggPrefix + "/") && normalized !== yggPrefix;
     });
     totalFiles = sourceFiles.length;
     const uncovered = scanUncoveredFiles(graph, gitTrackedFiles);
-    coveredFiles = totalFiles - uncovered.length;
-    coverageIssue = buildCoverageIssue(uncovered, totalFiles);
+    const coverage = graph.config.coverage ?? DEFAULT_COVERAGE;
+    const tiers = partitionByCoverageTier(uncovered, coverage);
+    coveredFiles = totalFiles - (tiers.required.length + tiers.middle.length);
+    coverageIssues = [
+      buildCoverageIssue(tiers.required, totalFiles),
+      buildCoverageAdvisoryIssue(tiers.middle)
+    ].filter((x) => x !== null);
   }
   const orphanedPaths = await detectOrphanedDriftState(graph);
   await garbageCollectDriftState(
@@ -11985,7 +12211,7 @@ async function runCheck(graph, gitTrackedFiles) {
       return n ? hasNonDraftEffectiveAspects(n, graph) : false;
     }
   );
-  const yggRelative = toPosixPath(path33.relative(path33.dirname(graph.rootPath), graph.rootPath));
+  const yggRelative = toPosixPath(path34.relative(path34.dirname(graph.rootPath), graph.rootPath));
   const orphanWarnings = orphanedPaths.map((p2) => {
     const orphanMd = {
       what: `Drift state file exists for '${p2}' but node is no longer in the graph.`,
@@ -12003,7 +12229,7 @@ async function runCheck(graph, gitTrackedFiles) {
   const allIssues = [
     ...driftIssues,
     ...validationIssues,
-    ...coverageIssue ? [coverageIssue] : [],
+    ...coverageIssues,
     ...orphanWarnings
   ];
   const nodeTypeCounts = /* @__PURE__ */ new Map();
@@ -12015,7 +12241,7 @@ async function runCheck(graph, gitTrackedFiles) {
   const advisoryWarnings = allIssues.filter((i) => i.code === "aspect-violation-advisory").length;
   const draftSkipped = countDraftAspectsAcrossGraph(graph);
   return {
-    projectName: path33.basename(path33.dirname(graph.rootPath)),
+    projectName: path34.basename(path34.dirname(graph.rootPath)),
     nodeCount: graph.nodes.size,
     nodeTypeCounts,
     aspectCount: graph.aspects.length,
@@ -12033,6 +12259,7 @@ function emitPerAspectIssues(node, graph, baseline, issues) {
   const storedVerdicts = baseline.aspectVerdicts;
   for (const [aspectId, status] of statuses) {
     if (status === "draft") continue;
+    if (isAggregateAspect(graph, aspectId)) continue;
     const verdict = storedVerdicts[aspectId];
     if (!verdict) {
       const md = aspectNewlyActiveMessage({
@@ -12106,7 +12333,7 @@ function getChildMappingExclusions2(graph, nodePath) {
 async function allPathsMissing(projectRoot, mappingPaths) {
   for (const mp of mappingPaths) {
     try {
-      await fileAccess(path33.join(projectRoot, mp));
+      await fileAccess(path34.join(projectRoot, mp));
       return false;
     } catch {
     }
@@ -12115,7 +12342,7 @@ async function allPathsMissing(projectRoot, mappingPaths) {
 }
 function groupCascadeByCause(cascadeErrors, graph) {
   const groups = /* @__PURE__ */ new Map();
-  const yggPrefix = graph ? toPosixPath(path33.relative(path33.dirname(graph.rootPath), graph.rootPath)) : ".yggdrasil";
+  const yggPrefix = graph ? toPosixPath(path34.relative(path34.dirname(graph.rootPath), graph.rootPath)) : ".yggdrasil";
   const escPrefix = yggPrefix.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   for (const issue of cascadeErrors) {
     if (!issue.nodePath || !issue.cascadeCauses) continue;
@@ -12534,7 +12761,7 @@ async function runDryRunForNode(params) {
   const { buildPrompt: buildPrompt2 } = await Promise.resolve().then(() => (init_aspect_verifier(), aspect_verifier_exports));
   const aspects = resolveAspects(node, graph);
   const statuses = computeEffectiveAspectStatuses(node, graph);
-  const projectRoot = path34.dirname(graph.rootPath);
+  const projectRoot = path35.dirname(graph.rootPath);
   const { trackedFiles } = collectTrackedFiles(node, graph);
   const { fileHashes } = await hashTrackedFiles(projectRoot, trackedFiles, void 0, []);
   const sourceFilePaths = Object.keys(fileHashes).filter((f) => {
@@ -12565,7 +12792,7 @@ async function runDryRunForNode(params) {
     }
     try {
       const structResult = await runStructureAspect({
-        aspectDir: path34.join(".yggdrasil/aspects", aspect.id),
+        aspectDir: path35.join(".yggdrasil/aspects", aspect.id),
         aspectId: aspect.id,
         nodePath,
         graph,
@@ -12754,7 +12981,7 @@ function registerApproveCommand(program2) {
       }
       const graph = await loadGraphOrAbort(process.cwd());
       initDebugLog(graph.rootPath, graph.config.debug ?? false, appendToDebugLog);
-      const yggPrefix = toPosixPath(path34.relative(path34.dirname(graph.rootPath), graph.rootPath));
+      const yggPrefix = toPosixPath(path35.relative(path35.dirname(graph.rootPath), graph.rootPath));
       if (options.dryRun && options.node) {
         let allFound = true;
         for (const rawPath of options.node) {
@@ -12883,11 +13110,11 @@ function registerTreeCommand(program2) {
       initDebugLog(graph.rootPath, graph.config.debug ?? false, appendToDebugLog);
       let roots;
       if (options.root?.trim()) {
-        const path44 = options.root.trim().replace(/\/$/, "");
-        const node = graph.nodes.get(path44);
+        const path46 = options.root.trim().replace(/\/$/, "");
+        const node = graph.nodes.get(path46);
         if (!node) {
           process.stderr.write(chalk5.red(buildIssueMessage({
-            what: `Node '${path44}' not found.`,
+            what: `Node '${path46}' not found.`,
             why: `The --root path must be a valid node path in the graph.`,
             next: `Run yg tree (no --root) to list all nodes, then pick a valid path.`
           }) + "\n"));
@@ -12987,14 +13214,14 @@ function buildTransitiveChains(targetNode, direct, allDependents, reverse) {
   }
   const chains = [];
   for (const node of transitiveOnly) {
-    const path44 = [];
+    const path46 = [];
     let current = node;
     while (current) {
-      path44.unshift(current);
+      path46.unshift(current);
       current = parent.get(current);
     }
-    if (path44.length >= 3) {
-      chains.push(path44.slice(1).map((p2) => `<- ${p2}`).join(" "));
+    if (path46.length >= 3) {
+      chains.push(path46.slice(1).map((p2) => `<- ${p2}`).join(" "));
     }
   }
   return chains.sort();
@@ -13026,14 +13253,14 @@ function collectIndirectDependents(graph, directlyAffected) {
     }
     for (const [node] of parent) {
       if (directSet.has(node)) continue;
-      const path44 = [node];
+      const path46 = [node];
       let current = node;
       while (parent.has(current)) {
         current = parent.get(current);
-        path44.push(current);
+        path46.push(current);
       }
-      const chain = path44.map((p2) => `<- ${p2}`).join(" ");
-      const depth = path44.length;
+      const chain = path46.map((p2) => `<- ${p2}`).join(" ");
+      const depth = path46.length;
       const existing = bestChain.get(node);
       if (!existing || depth < existing.depth) {
         bestChain.set(node, { chain, depth });
@@ -13773,7 +14000,7 @@ import chalk8 from "chalk";
 init_debug_log();
 init_message_builder();
 import { execFileSync } from "child_process";
-import path35 from "path";
+import path36 from "path";
 function registerCheckCommand(program2) {
   program2.command("check").description("Unified graph gate \u2014 errors, drift, coverage, completeness").action(async () => {
     try {
@@ -13782,7 +14009,7 @@ function registerCheckCommand(program2) {
       initDebugLog(graph.rootPath, graph.config.debug ?? false, appendToDebugLog);
       let gitFiles = null;
       try {
-        const projectRoot = path35.dirname(graph.rootPath);
+        const projectRoot = path36.dirname(graph.rootPath);
         const output = execFileSync("git", ["ls-files", "."], {
           cwd: projectRoot,
           encoding: "utf-8",
@@ -13903,10 +14130,16 @@ function renderErrorSection(errors) {
 }
 function renderWarningSection(warnings) {
   const lines = [chalk8.yellow(`Warnings (${warnings.length}):`)];
-  for (const issue of sortByNodePath(warnings)) {
+  const coverage = warnings.filter((i) => i.code === "uncovered-advisory");
+  const rest = warnings.filter((i) => i.code !== "uncovered-advisory");
+  for (const issue of sortByNodePath(rest)) {
     lines.push("");
     renderIssueBlock(issue, lines, "warning");
   }
+  for (const issue of coverage) {
+    lines.push("");
+    renderUnmappedBlock(issue, lines, "uncovered");
+  }
   return lines.join("\n");
 }
 function renderIssueBlock(issue, lines, mode) {
@@ -13924,14 +14157,12 @@ function renderIssueBlock(issue, lines, mode) {
     lines.push(`            Fix: ${md.next}${fixSuffix}`);
   }
 }
-function renderUnmappedBlock(issue, lines) {
+function renderUnmappedBlock(issue, lines, label = "unmapped") {
   const md = issue.messageData;
   const files = issue.uncoveredFiles ?? [];
-  const whatFirstLine = md.what.split("\n")[0];
-  const countMatch = whatFirstLine.match(/^(\d[\d,]*)/);
   const count = issue.uncoveredCount ?? files.length;
-  const countLabel = countMatch ? countMatch[1] : String(count);
-  lines.push(`  unmapped (${countLabel})`);
+  const countLabel = String(count);
+  lines.push(`  ${label} (${countLabel})`);
   const shown = files.slice(0, 10);
   for (const f of shown) {
     lines.push(`            ${f}`);
@@ -14010,7 +14241,7 @@ function sortByNodePath(issues) {
 }
 
 // src/cli/deterministic-test.ts
-import path37 from "path";
+import path38 from "path";
 init_debug_log();
 
 // src/ast/runner.ts
@@ -14018,7 +14249,7 @@ init_loader_hook();
 init_parser();
 init_suppress();
 init_validate_check_module();
-import path36 from "path";
+import path37 from "path";
 import { readFile as readFile20 } from "fs/promises";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var AstRunnerError = class extends Error {
@@ -14034,7 +14265,7 @@ ${data.next}`);
 };
 async function runAstAspect(params) {
   ensureLoaderRegistered();
-  const checkPath = path36.resolve(params.projectRoot, params.aspectDir, "check.mjs");
+  const checkPath = path37.resolve(params.projectRoot, params.aspectDir, "check.mjs");
   let mod;
   try {
     mod = await import(pathToFileURL3(checkPath).href);
@@ -14064,7 +14295,7 @@ async function runAstAspect(params) {
       sourceFiles.push({ path: f.path, content: cached.content, ast: cached.ast });
       continue;
     }
-    const content14 = await readFile20(path36.resolve(params.projectRoot, f.path), "utf-8");
+    const content14 = await readFile20(path37.resolve(params.projectRoot, f.path), "utf-8");
     let ast;
     try {
       ast = await parseFile(f.path, content14);
@@ -14196,7 +14427,7 @@ function registerDeterministicTestCommand(program2) {
         process.exit(1);
         return;
       }
-      const aspectDir = path37.join(".yggdrasil", "aspects", aspect.id);
+      const aspectDir = path38.join(".yggdrasil", "aspects", aspect.id);
       if (hasNode) {
         const nodePath = opts.node.trim().replace(/\/$/, "");
         const node = graph.nodes.get(nodePath);
@@ -14324,12 +14555,12 @@ function printStructureViolations(violations) {
 // src/cli/log.ts
 import chalk9 from "chalk";
 import { readFile as readFile22, stat as stat8 } from "fs/promises";
-import path41 from "path";
+import path42 from "path";
 init_debug_log();
 init_message_builder();
 
 // src/core/log/log-add.ts
-import path38 from "path";
+import path39 from "path";
 
 // src/utils/node-path-validator.ts
 init_posix();
@@ -14450,7 +14681,7 @@ async function logAdd(input) {
       }
     };
   }
-  const logPath2 = path38.join(graph.rootPath, "model", nodePath, "log.md");
+  const logPath2 = path39.join(graph.rootPath, "model", nodePath, "log.md");
   const stats = await statLogFile(logPath2);
   if (stats !== null) {
     if (stats.isSymbolicLink) {
@@ -14519,7 +14750,7 @@ function reasonHasLevel2HeaderOutsideFence(reason) {
 }
 
 // src/core/log/log-read.ts
-import path39 from "path";
+import path40 from "path";
 init_log_parser();
 init_log_format();
 init_posix();
@@ -14568,7 +14799,7 @@ async function logRead(input) {
       }
     };
   }
-  const logPath2 = path39.join(graph.rootPath, "model", nodePath, "log.md");
+  const logPath2 = path40.join(graph.rootPath, "model", nodePath, "log.md");
   const content14 = await readLogSafe(logPath2);
   if (content14 === "") {
     return { ok: true, entries: [] };
@@ -14592,7 +14823,7 @@ async function logRead(input) {
 
 // src/core/log/log-merge-resolve.ts
 import { createHash as createHash5 } from "crypto";
-import path40 from "path";
+import path41 from "path";
 init_log_parser();
 
 // src/utils/git-introspect.ts
@@ -14679,7 +14910,7 @@ async function logMergeResolve(input) {
       }
     };
   }
-  const logPath2 = path40.join(yggRoot, "model", nodePath, "log.md");
+  const logPath2 = path41.join(yggRoot, "model", nodePath, "log.md");
   let currentLog;
   try {
     currentLog = await readTextFile(logPath2);
@@ -14885,7 +15116,7 @@ ${entry.body}`);
   log2.command("merge-resolve").description("Reconcile log.md after a git merge (HEAD must be a merge commit)").requiredOption("--node <path>", "Node path (relative to .yggdrasil/model/)").action(async (opts) => {
     try {
       const graph = await loadGraphOrAbort(process.cwd(), { tolerateInvalidConfig: true });
-      const repoRoot = path41.dirname(graph.rootPath);
+      const repoRoot = path42.dirname(graph.rootPath);
       const nodePath = toPosix(opts.node.trim()).replace(/\/$/, "");
       const result = await logMergeResolve({ graph, nodePath, repoRoot });
       if (!result.ok) {
@@ -14912,15 +15143,15 @@ import chalk10 from "chalk";
 // src/io/find-index.ts
 init_debug_log();
 import { readFile as readFile23, lstat as lstat3 } from "fs/promises";
-import path42 from "path";
+import path43 from "path";
 import MiniSearch from "minisearch";
 var MAX_BODY_BYTES = 1048576;
 async function buildIndex(graph) {
-  const projectRoot = path42.dirname(graph.rootPath);
+  const projectRoot = path43.dirname(graph.rootPath);
   const docs = [];
   for (const [nodePath, node] of graph.nodes) {
     const displayPath = `model/${nodePath}/`;
-    const logPath2 = path42.join(graph.rootPath, "model", nodePath, "log.md");
+    const logPath2 = path43.join(graph.rootPath, "model", nodePath, "log.md");
     let body = "";
     try {
       const st = await lstat3(logPath2);
@@ -14937,7 +15168,7 @@ This does not affect append-only integrity. No action required.
         }
         body = truncated;
       } else if (st.isSymbolicLink()) {
-        process.stderr.write(`Warning: skipping symlinked log.md at ${path42.relative(projectRoot, logPath2)}
+        process.stderr.write(`Warning: skipping symlinked log.md at ${path43.relative(projectRoot, logPath2)}
 `);
       } else {
       }
@@ -15094,14 +15325,14 @@ import { existsSync as existsSync6 } from "fs";
 import { resolve as resolve5 } from "path";
 
 // src/core/type-classifier.ts
-import path43 from "path";
+import path44 from "path";
 async function classifyFile(absPath, repoRelPath, graph, cache) {
   const matches = [];
   const partialScores = [];
   const ctx = {
     absPath,
     repoRelPath,
-    projectRoot: path43.dirname(graph.rootPath),
+    projectRoot: path44.dirname(graph.rootPath),
     cache
   };
   for (const [typeId, def] of Object.entries(graph.architecture.node_types)) {
@@ -15389,7 +15620,7 @@ See: \`yg knowledge read aspect-status\`.
 `;
 
 // src/templates/knowledge/aspects-overview.ts
-var summary2 = "What aspects are, when to create, LLM vs deterministic reviewer choice, cost model";
+var summary2 = "What aspects are, when to create, LLM vs deterministic vs aggregating reviewer choice, cost model";
 var content2 = `# Aspects overview
 
 Aspects are enforceable rules attached to nodes. A reviewer (LLM or
@@ -15428,12 +15659,33 @@ While the rule is still being authored or is unclear, give the aspect
 \`status: draft\` \u2014 a draft aspect is WIP, so the reviewer never runs on it
 and it costs zero.
 
-## LLM vs deterministic
+## Three reviewer kinds
+
+Three reviewer kinds exist: LLM, deterministic, and aggregating. The kind is
+**inferred** from which rule source file is present in the aspect directory:
+\`content.md\` \u2192 LLM; \`check.mjs\` \u2192 deterministic; neither file but \`implies:\`
+declared \u2192 aggregating. The \`reviewer:\` block in \`yg-aspect.yaml\` is optional;
+if present, an explicit \`reviewer.type\` must agree with the inferred kind.
+
+### Aggregating aspects
+
+An aggregating aspect ships neither \`content.md\` nor \`check.mjs\`. It exists
+purely to bundle other aspects under one named attach point. When an aggregating
+aspect is effective on a node, all aspects in its \`implies:\` list are expanded
+and verified individually. The aggregate itself has no own reviewer and produces
+no own verdict. It never dispatches to an LLM and never runs \`check.mjs\`.
 
-Two reviewer types exist: LLM and deterministic. The deterministic reviewer runs
-\`check.mjs\` locally \u2014 it covers both per-file syntactic rules
-(single-file style) and cross-node graph-shape rules (graph-aware style), all in
-one reviewer. LLM and deterministic each have a distinct sweet spot.
+Use aggregating aspects to decompose a multi-rule contract: attach the aggregate
+once (per node, per flow, per architecture type) and let each implied child carry
+one concrete, independently-verdicted rule. An aspect with neither rule source
+and no \`implies:\` is rejected by the validator.
+
+### LLM and deterministic sweet spots
+
+The deterministic reviewer runs \`check.mjs\` locally \u2014 it covers both per-file
+syntactic rules (single-file style) and cross-node graph-shape rules
+(graph-aware style), all in one reviewer. LLM and deterministic each have a
+distinct sweet spot.
 
 \`check.mjs\` runs in the main Node process with full privileges \u2014 there is no
 security sandbox. The graph-aware allow-list (below) is a read *discipline* that
@@ -15500,10 +15752,12 @@ To author a \`check.mjs\` (both single-file and graph-aware styles):
 ## Cost model
 
 Every effective non-draft LLM aspect on a node = at least one reviewer call
-during \`yg approve\`, multiplied by the tier's consensus count AND by the
-number of prompt chunks. Deterministic aspects run locally at zero LLM
-cost. A node with 5 LLM aspects = at least 5 reviewer calls. An LLM aspect
-touching 20 nodes = at least 20 calls when you run \`yg approve --aspect <id>\`.
+during \`yg approve\`, multiplied by the tier's consensus count. The reviewer
+always sends the full node in a single prompt \u2014 there is no chunking.
+Deterministic aspects run locally at zero LLM cost. Aggregating aspects have no
+own reviewer call. A node with 5 LLM aspects = at least 5 reviewer calls. An LLM
+aspect touching 20 nodes = at least 20 calls when you run
+\`yg approve --aspect <id>\`.
 
 Use \`yg impact --aspect <id>\` before creating or modifying a widely-used
 aspect to assess the re-approval cost.
@@ -15837,9 +16091,9 @@ The runner raises typed runtime errors when the contract is broken:
 
 ## Iterating over the files
 
-Today every mapped file (TypeScript/JavaScript family) arrives in a single
-\`check.mjs\` invocation via \`ctx.files\`. Iterate the array and inspect each
-file's AST:
+A node's mapping may include non-parseable files (e.g. \`.md\`, \`.sh\`,
+\`.json\`). For those files \`file.ast\` is \`undefined\`. **Always guard
+before touching \`file.ast\`**:
 
 \`\`\`javascript
 import { walk, report, inFile, closest } from '@chrisdudek/yg/ast';
@@ -15847,6 +16101,7 @@ import { walk, report, inFile, closest } from '@chrisdudek/yg/ast';
 export function check(ctx) {
   const violations = [];
   for (const file of ctx.files) {
+    if (!file.ast) continue;  // skip non-parseable files (no tree-sitter AST)
     walk(file.ast.rootNode, node => {
       // ... inspect node, push report(file, node, ...) on a hit ...
     });
@@ -15855,6 +16110,10 @@ export function check(ctx) {
 }
 \`\`\`
 
+Content/regex checks that only use \`file.content\` (and never touch
+\`file.ast\`) do **not** need this guard \u2014 they should iterate all files
+including non-parseable ones.
+
 If a rule should apply only to a subset of files, filter on \`file.path\`
 (for example with \`inFile(file, { glob: 'src/api/**' })\`) \u2014 there is no
 \`ctx.language\` and no per-language invocation today; every mapped file
@@ -15886,13 +16145,19 @@ Each \`node\` object from the AST exposes:
 ### Reading node-types.json
 
 To learn the grammar's node types and field names, inspect the
-\`node-types.json\` shipped by the tree-sitter grammar package:
+\`node-types.json\` files shipped inside the installed package under
+\`dist/grammars/\`.  Each file is named after its grammar:
 
 \`\`\`
-node_modules/tree-sitter-typescript/typescript/node-types.json
-node_modules/tree-sitter-javascript/node-types.json
+<yg install>/dist/grammars/tree-sitter-typescript.node-types.json
+<yg install>/dist/grammars/tree-sitter-tsx.node-types.json
+<yg install>/dist/grammars/tree-sitter-javascript.node-types.json
+<yg install>/dist/grammars/tree-sitter-python.node-types.json
 \`\`\`
 
+(and so on for every other shipped grammar \u2014 one \`.node-types.json\`
+per \`.wasm\` file in the same directory.)
+
 Each entry lists its \`type\`, whether it is \`named\`, and the \`fields\`
 object whose keys are the field names usable with \`childForFieldName\`.
 
@@ -15904,6 +16169,7 @@ import { walk, report, inFile } from '@chrisdudek/yg/ast';
 export function check(ctx) {
   const violations = [];
   for (const file of ctx.files) {
+    if (!file.ast) continue;  // skip non-parseable files (no tree-sitter AST)
     if (!inFile(file, { glob: 'src/api/**' })) continue;
     walk(file.ast.rootNode, node => {
       if (node.type !== 'import_statement') return;
@@ -16746,8 +17012,13 @@ files, a typed \`identity\` block holding the node's upstream identity (its own
 aspect-relevant metadata, a per-aspect identity for every effective aspect, and
 per-dependency port-aspect hashes), and a per-aspect verdict map recording the
 reviewer's last judgment for each non-draft aspect. The canonical drift hash is
-computed over the real-file hashes together with that typed identity, so any
-upstream identity change cascades exactly like a source change.
+computed over the real-file hashes, that typed identity, AND the per-aspect
+verdict map, so any upstream identity change cascades exactly like a source
+change \u2014 and a hand-edited verdict in \`.drift-state/*.json\` (e.g. flipping a
+committed \`refused\` to \`approved\`) changes the recomputed hash too. \`yg check\`
+blocks on any such divergence it cannot attribute to a file or identity change,
+reporting a \`baseline-integrity\` error; the fix is to re-approve the node (or
+restore the drift-state from git).
 
 Aspect \`status\` is deliberately NOT part of the identity: flipping an aspect
 between \`advisory\` and \`enforced\` does not drift the node (the recorded verdict
@@ -16886,11 +17157,15 @@ reviewer:
         model: qwen3              # Model identifier for this provider
         temperature: 0            # Sampling temperature (0 = deterministic)
         endpoint: http://localhost:11434   # Required for ollama and openai-compatible
-        max_tokens: auto          # Response budget: 'auto' or positive integer
       # references:                         # optional caps on aspect reference files
       #   max_bytes_per_file: 65536         # default: 64 KiB per reference file
       #   max_total_bytes_per_aspect: 262144  # default: 256 KiB total per aspect
 
+coverage:                           # Optional \u2014 controls which files must be mapped
+  required:                         # Unmapped files under these roots are a blocking error
+    - "/"                           # Default: whole repo (previous always-map-everything behavior)
+  excluded: []                      # Files under these roots are silently ignored
+
 quality:
   max_direct_relations: 10        # Max out-edges per node before high-fan-out warning
   max_node_chars: 40000           # Per-node character budget (source + aspect refs) before oversized-node error
@@ -16961,8 +17236,6 @@ Provider-specific options passed to the LLM client:
 | \`model\` | string | Required. Provider-specific model identifier. |
 | \`temperature\` | number | Defaults to 0. Higher = more varied responses. |
 | \`endpoint\` | string | Required for \`ollama\` and \`openai-compatible\`. |
-| \`max_tokens\` | number\\|'auto' | Response budget. 'auto' queries the provider. |
-| \`context_length_field\` | string | Ollama: field name in model info for context length. |
 | \`timeout\` | number | Timeout in seconds. Default 300. Applies to CLI providers only \u2014 non-CLI/API providers ignore it. |
 
 API keys do NOT live here \u2014 they belong in \`yg-secrets.yaml\` (api_key only).
@@ -17028,6 +17301,24 @@ the provider's standard \`*_API_KEY\`) as a fallback when not present in
 \`yg-config.yaml\` itself must never contain credentials. Commit it to the
 repository \u2014 it is safe to share.
 
+## Coverage config
+
+\`\`\`yaml
+coverage:
+  required:
+    - src/       # unmapped files under src/ are a blocking error
+  excluded:
+    - vendor/    # silently ignored
+\`\`\`
+
+Controls which git-tracked files must be mapped to a node.
+
+- \`required\` \u2014 path roots where unmapped files are a blocking \`unmapped-files\` error. Default: \`["/"]\` (whole repo \u2014 the previous always-map-everything behavior).
+- \`excluded\` \u2014 path roots that are silently ignored. Default: \`[]\`.
+- Files that match neither a required nor an excluded root produce a non-blocking \`uncovered-advisory\` warning.
+- Subtrees containing their own nested \`.yggdrasil/\` are auto-skipped by all repo-walking checks (they are governed by their own graph).
+- Longest-match wins; on a tie between required and excluded, excluded wins.
+
 ## Quality thresholds
 
 \`\`\`yaml
@@ -17235,6 +17526,24 @@ Use \`--reason-file <path>\` instead of \`--reason\` to supply multi-line entry
 content from a file. On \`yg log read\`, \`--top\` and \`--all\` are mutually
 exclusive \u2014 you cannot combine them.
 
+## yg suppressions
+
+Read-only inventory of all active \`yg-suppress\` markers in the repository's
+source files. Lists each marker's aspect path, location, reason, and kind
+(single-line, bracket, or wildcard). Exits 0 always \u2014 it is a read-only
+inspection tool.
+
+\`\`\`bash
+yg suppressions
+\`\`\`
+
+Emits non-blocking warnings for:
+- **Unknown aspect-id** \u2014 the aspect path in the marker does not match any known aspect.
+- **Wildcard suppress** (\`*\`) \u2014 suppresses all aspects in range; any aspect added later is also silently waived.
+- **Unbounded range** \u2014 a \`yg-suppress-disable\` marker with no matching \`yg-suppress-enable\`; the suppression extends to end of file.
+
+Use \`yg suppressions\` to audit accumulated waivers before a release or a new aspect rollout. It does not affect \`yg check\` or any baseline.
+
 ## yg type-suggest
 
 Suggest which node_type a file fits based on architecture \`when\` predicates.
@@ -17910,13 +18219,176 @@ function registerKnowledgeCommand(program2) {
   });
 }
 
+// src/cli/suppressions.ts
+import chalk13 from "chalk";
+import { readFileSync as readFileSync5, existsSync as existsSync7 } from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
+import path45 from "path";
+init_debug_log();
+init_suppress();
+init_message_builder();
+init_posix();
+function isBinaryContent(buf) {
+  const checkLen = Math.min(buf.length, 8192);
+  for (let i = 0; i < checkLen; i++) {
+    if (buf[i] === 0) return true;
+  }
+  return false;
+}
+function isNoiseFile(relFile) {
+  const p2 = toPosixPath(relFile);
+  if (p2 === ".yggdrasil" || p2.startsWith(".yggdrasil/")) return true;
+  if (p2.startsWith(".cursor/")) return true;
+  if (p2.startsWith(".github/copilot")) return true;
+  const base = p2.includes("/") ? p2.slice(p2.lastIndexOf("/") + 1) : p2;
+  if (base === ".windsurfrules" || base === ".clinerules") return true;
+  if (base === "log.md") return true;
+  const lower = base.toLowerCase();
+  if (lower.endsWith(".md") || lower.endsWith(".mdc") || lower.endsWith(".markdown") || lower.endsWith(".txt")) {
+    return true;
+  }
+  return false;
+}
+function runSuppressionsScan(projectRoot, gitTrackedFiles, knownAspectIds) {
+  const fileEntries = [];
+  const warnings = [];
+  let totalMarkers = 0;
+  const openDisables = /* @__PURE__ */ new Map();
+  for (const relFile of gitTrackedFiles) {
+    if (isNoiseFile(relFile)) continue;
+    const absFile = path45.join(projectRoot, relFile);
+    if (!existsSync7(absFile)) continue;
+    let buf;
+    try {
+      buf = readFileSync5(absFile);
+    } catch (error) {
+      debugWrite(`[suppressions] read fallback: ${relFile}: ${error instanceof Error ? error.message : String(error)}`);
+      continue;
+    }
+    if (isBinaryContent(buf)) continue;
+    const text2 = buf.toString("utf-8");
+    const markers = scanSuppressionMarkers(text2);
+    if (markers.length === 0) continue;
+    fileEntries.push({ file: toPosixPath(relFile), markers });
+    totalMarkers += markers.length;
+    const disableStack = /* @__PURE__ */ new Map();
+    for (const m of markers) {
+      if (m.kind === "disable") {
+        const stack = disableStack.get(m.aspectId) ?? [];
+        stack.push(m.line);
+        disableStack.set(m.aspectId, stack);
+      } else if (m.kind === "enable") {
+        const stack = disableStack.get(m.aspectId);
+        if (stack && stack.length > 0) {
+          stack.pop();
+          if (stack.length === 0) disableStack.delete(m.aspectId);
+        }
+      }
+    }
+    if (disableStack.size > 0) {
+      openDisables.set(toPosixPath(relFile), disableStack);
+    }
+  }
+  const seenWildcard = /* @__PURE__ */ new Set();
+  for (const { file, markers } of fileEntries) {
+    for (const m of markers) {
+      if (!m.wildcard && !knownAspectIds.has(m.aspectId)) {
+        const msg = buildIssueMessage({
+          what: `Unknown aspect id "${m.aspectId}" in suppress marker at ${file}:${m.line}.`,
+          why: "The aspect does not exist in the graph. The suppression has no effect and likely refers to a renamed or deleted aspect.",
+          next: `Run \`yg aspects\` to list defined aspect ids, then update or remove this marker.`
+        });
+        warnings.push(msg);
+      }
+      if (m.wildcard && !seenWildcard.has(`${file}:${m.line}`)) {
+        seenWildcard.add(`${file}:${m.line}`);
+        const msg = buildIssueMessage({
+          what: `Wildcard suppression "*" at ${file}:${m.line} silences ALL aspects.`,
+          why: "A wildcard suppresses every current and future aspect check on the affected code \u2014 including ones not yet written. This masks problems broadly and is hard to audit.",
+          next: `Replace "*" with the specific aspect id(s) you intend to suppress.`
+        });
+        warnings.push(msg);
+      }
+    }
+  }
+  for (const [file, disableMap] of openDisables) {
+    for (const [aspectId, lines] of disableMap) {
+      for (const lineNum of lines) {
+        const msg = buildIssueMessage({
+          what: `Unbounded yg-suppress-disable("${aspectId}") at ${file}:${lineNum} has no matching yg-suppress-enable.`,
+          why: "Without a closing enable marker the suppression covers the rest of the file, which is almost always broader than intended and hides future violations added below this line.",
+          next: `Add \`yg-suppress-enable(${aspectId})\` at the end of the suppressed block, or convert to a single-line \`yg-suppress(${aspectId}) <reason>\` if only one line needs suppression.`
+        });
+        warnings.push(msg);
+      }
+    }
+  }
+  return { fileEntries, totalMarkers, warnings };
+}
+function formatSuppressionsOutput(report) {
+  const lines = [];
+  if (report.fileEntries.length === 0) {
+    lines.push("No active suppression markers found.");
+    return lines.join("\n") + "\n";
+  }
+  lines.push("Active suppression markers:");
+  lines.push("");
+  for (const { file, markers } of report.fileEntries) {
+    lines.push(`  ${file}`);
+    for (const m of markers) {
+      const wildcardTag = m.wildcard ? chalk13.yellow(" [wildcard]") : "";
+      const kindTag = m.kind === "single" ? "single" : m.kind === "disable" ? "disable" : "enable";
+      const reasonPart = m.reason ? `  \u2014 ${m.reason}` : "";
+      lines.push(`    line ${m.line}: ${kindTag}(${m.aspectId})${wildcardTag}${reasonPart}`);
+    }
+    lines.push("");
+  }
+  const fileCount = report.fileEntries.length;
+  lines.push(`Total: ${report.totalMarkers} marker${report.totalMarkers === 1 ? "" : "s"} across ${fileCount} file${fileCount === 1 ? "" : "s"}.`);
+  if (report.warnings.length > 0) {
+    lines.push("");
+    lines.push(chalk13.yellow(`Warnings (${report.warnings.length}):`));
+    for (const w of report.warnings) {
+      const indented = w.split("\n").map((l) => `  ${l}`).join("\n");
+      lines.push(chalk13.yellow(indented));
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+function registerSuppressionsCommand(program2) {
+  program2.command("suppressions").description("Inventory active yg-suppress waivers and warn about footguns").action(async () => {
+    try {
+      const cwd = process.cwd();
+      const graph = await loadGraphOrAbort(cwd);
+      initDebugLog(graph.rootPath, graph.config.debug ?? false, appendToDebugLog);
+      const projectRoot = path45.dirname(graph.rootPath);
+      let gitFiles = [];
+      try {
+        const output = execFileSync2("git", ["ls-files", "."], {
+          cwd: projectRoot,
+          encoding: "utf-8",
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        gitFiles = output.trim().split("\n").filter((f) => f.length > 0);
+      } catch (error) {
+        debugWrite(`[suppressions] git ls-files fallback: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      const knownAspectIds = new Set(graph.aspects.map((a) => a.id));
+      const report = runSuppressionsScan(projectRoot, gitFiles, knownAspectIds);
+      process.stdout.write(formatSuppressionsOutput(report));
+    } catch (error) {
+      abortOnUnexpectedError(error, "scanning suppressions");
+    }
+  });
+}
+
 // src/bin.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname2, join as join5 } from "path";
 var __filename3 = fileURLToPath5(import.meta.url);
 var __dirname3 = dirname2(__filename3);
-var pkg = JSON.parse(readFileSync5(join5(__dirname3, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync6(join5(__dirname3, "..", "package.json"), "utf-8"));
 var program = new Command2();
 program.name("yg").description("Yggdrasil \u2014 architectural knowledge infrastructure for AI agents").version(pkg.version);
 registerInitCommand(program);
@@ -17933,6 +18405,7 @@ registerLogCommand(program);
 registerFindCommand(program);
 registerTypeSuggestCommand(program);
 registerKnowledgeCommand(program);
+registerSuppressionsCommand(program);
 process.on("unhandledRejection", (reason) => {
   const msg = reason instanceof Error ? reason.message : String(reason);
   process.stderr.write(`Error: ${msg}