@codacy/verity-cli 0.33.0-experimental.d60f544 → 0.33.1-experimental.1378de3

package/bin/verity.js

@@ -10413,6 +10413,7 @@ var MAX_ITERATIONS = 2;
 var MAX_SPEC_FILES = 6;
 var MAX_SPEC_FILE_BYTES = 512e3;
 var MAX_TOTAL_SPEC_BYTES = 512e3;
+var MAX_EXPLICIT_SPEC_FILE_BYTES = 10240;
 var MAX_PLAN_FILES = 3;
 var MAX_PLAN_FILE_BYTES = 512e3;
 var MAX_INTENT_CHARS = 2e3;
@@ -10969,8 +10970,8 @@ function filterReviewable(files) {
     const ext = (0, import_node_path3.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename4 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename4)) return true;
+    const basename5 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename5)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -12800,12 +12801,50 @@ function resolveGuardMoments(explicit) {
 }
 
 // src/lib/plugin-ownership.ts
-var import_node_fs6 = require("node:fs");
-var import_node_os2 = require("node:os");
+var import_node_fs7 = require("node:fs");
+
+// src/lib/which.ts
+var import_node_fs5 = require("node:fs");
 var import_node_path7 = require("node:path");
+function executableExtensions(platform, pathext) {
+  if (platform !== "win32") return [""];
+  const raw = (pathext ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const out = [];
+  for (const ext of raw) {
+    const lower = ext.toLowerCase();
+    if (!out.includes(lower)) out.push(lower);
+    if (!out.includes(ext)) out.push(ext);
+  }
+  return out;
+}
+function whichSync(bin, opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const rawPath = opts.path ?? process.env.PATH ?? "";
+  if (!rawPath) return null;
+  const exts = executableExtensions(platform, opts.pathext ?? process.env.PATHEXT);
+  const real = opts.real ?? true;
+  for (const dir of rawPath.split(import_node_path7.delimiter)) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = (0, import_node_path7.join)(dir, bin + ext);
+      try {
+        if (!(0, import_node_fs5.statSync)(candidate).isFile()) continue;
+        if (platform !== "win32") (0, import_node_fs5.accessSync)(candidate, import_node_fs5.constants.X_OK);
+        return real ? (0, import_node_fs5.realpathSync)(candidate) : candidate;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return null;
+}
+
+// src/lib/plugin-ownership.ts
+var import_node_os2 = require("node:os");
+var import_node_path8 = require("node:path");
 
 // src/lib/stderr-log.ts
-var import_node_fs5 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var TOKEN_RE2 = /verity_[0-9a-f]{16,}/g;
 var ANSI_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 function scrub(s) {
@@ -12818,9 +12857,9 @@ function append(text) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(STDERR_LOG_FILE);
-    (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs5.appendFileSync)(file, text);
+    (0, import_node_fs6.appendFileSync)(file, text);
   } catch {
   }
 }
@@ -12868,14 +12907,15 @@ function markerPath() {
 }
 function readMarker() {
   try {
-    if (!(0, import_node_fs6.existsSync)(markerPath())) return null;
-    const raw = JSON.parse((0, import_node_fs6.readFileSync)(markerPath(), "utf-8"));
+    if (!(0, import_node_fs7.existsSync)(markerPath())) return null;
+    const raw = JSON.parse((0, import_node_fs7.readFileSync)(markerPath(), "utf-8"));
     const pluginRoot = typeof raw.plugin_root === "string" ? raw.plugin_root : "";
     if (!pluginRoot || CONTROL_CHARS.test(pluginRoot)) return null;
+    const version = typeof raw.version === "string" && !CONTROL_CHARS.test(raw.version) ? raw.version : null;
     return {
       session_id: typeof raw.session_id === "string" ? raw.session_id : null,
       plugin_root: pluginRoot,
-      version: typeof raw.version === "string" ? raw.version : null,
+      version,
       ts: typeof raw.ts === "number" ? raw.ts : 0
     };
   } catch {
@@ -12886,23 +12926,23 @@ function recordPluginOwnership(sessionId) {
   const pluginRoot = process.env.VERITY_PLUGIN_ROOT;
   if (!pluginRoot) return;
   try {
-    (0, import_node_fs6.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs7.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
     const marker = {
       session_id: sessionId,
       plugin_root: pluginRoot,
       version: process.env.VERITY_PLUGIN_VERSION || null,
       ts: Math.floor(Date.now() / 1e3)
     };
-    (0, import_node_fs6.writeFileSync)(markerPath(), JSON.stringify(marker));
+    (0, import_node_fs7.writeFileSync)(markerPath(), JSON.stringify(marker));
   } catch {
   }
 }
 function claudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path8.join)((0, import_node_os2.homedir)(), ".claude");
 }
 function readJsonFile(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -12910,9 +12950,9 @@ function readJsonFile(path) {
 }
 function enabledPluginSetting(key) {
   const files = [
-    projectPath((0, import_node_path7.join)(".claude", "settings.local.json")),
-    projectPath((0, import_node_path7.join)(".claude", "settings.json")),
-    (0, import_node_path7.join)(claudeConfigDir(), "settings.json")
+    projectPath((0, import_node_path8.join)(".claude", "settings.local.json")),
+    projectPath((0, import_node_path8.join)(".claude", "settings.json")),
+    (0, import_node_path8.join)(claudeConfigDir(), "settings.json")
   ];
   for (const file of files) {
     const map = readJsonFile(file)?.enabledPlugins;
@@ -12924,27 +12964,16 @@ function enabledPluginSetting(key) {
 }
 function marketplaceLocations() {
   const out = /* @__PURE__ */ new Map();
-  const known = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   if (!known) return out;
   for (const [name, entry] of Object.entries(known)) {
     const loc2 = entry?.installLocation;
-    if (typeof loc2 === "string" && loc2) out.set(name, (0, import_node_path7.resolve)(loc2));
+    if (typeof loc2 === "string" && loc2) out.set(name, (0, import_node_path8.resolve)(loc2));
   }
   return out;
 }
 function verityPathEntry() {
-  const path = process.env.PATH;
-  if (!path) return null;
-  for (const dir of path.split(import_node_path7.delimiter)) {
-    if (!dir) continue;
-    const candidate = (0, import_node_path7.join)(dir, "verity");
-    try {
-      (0, import_node_fs6.accessSync)(candidate, import_node_fs6.constants.X_OK);
-      return candidate;
-    } catch {
-    }
-  }
-  return null;
+  return whichSync("verity", { real: false });
 }
 function verityOnPath() {
   return verityPathEntry() !== null;
@@ -12953,27 +12982,13 @@ function globalVerityVersion() {
   const entry = verityPathEntry();
   if (!entry) return null;
   try {
-    const pkg = readJsonFile((0, import_node_path7.join)((0, import_node_path7.dirname)((0, import_node_fs6.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJsonFile((0, import_node_path8.join)((0, import_node_path8.dirname)((0, import_node_fs7.realpathSync)(entry)), "..", "package.json"));
     if (pkg?.name !== "@codacy/verity-cli" || typeof pkg.version !== "string") return null;
     return pkg.version;
   } catch {
     return null;
   }
 }
-function pluginCliInvocation() {
-  const root = process.env.VERITY_PLUGIN_ROOT;
-  if (!root) return null;
-  const onPath = globalVerityVersion();
-  if (onPath !== null && onPath === activePluginVersion()) return null;
-  return `node ${JSON.stringify((0, import_node_path7.join)(root, "scripts", "verity.mjs"))}`;
-}
-function cliVersionSkew() {
-  if (!process.env.VERITY_PLUGIN_ROOT) return null;
-  const onPath = globalVerityVersion();
-  const plugin = activePluginVersion();
-  if (!onPath || !plugin || onPath === plugin) return null;
-  return { global: onPath, plugin };
-}
 function activePluginVersion() {
   const fromEnv = process.env.VERITY_PLUGIN_VERSION;
   if (fromEnv) return fromEnv;
@@ -12984,7 +12999,7 @@ var VERITY_MARKETPLACE_REPO = "codacy/verity";
 function marketplaceConflict() {
   const wanted = VERITY_MARKETPLACE;
   for (const file of ["settings.json", "settings.local.json"]) {
-    const path = (0, import_node_path7.join)(claudeConfigDir(), file);
+    const path = (0, import_node_path8.join)(claudeConfigDir(), file);
     const declared = readJsonFile(path)?.extraKnownMarketplaces ?? null;
     const entry2 = declared && typeof declared === "object" ? declared[wanted] : void 0;
     if (entry2 && typeof entry2 === "object") {
@@ -12994,7 +13009,7 @@ function marketplaceConflict() {
       }
     }
   }
-  const known = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   const entry = known?.[wanted];
   if (entry && typeof entry === "object" && !pointsAtVerity(entry.source)) {
     return { name: wanted, declaredAs: describeSource(entry.source) };
@@ -13015,7 +13030,7 @@ function describeSource(src) {
   return target ? `${kind} \u2192 ${target}` : kind;
 }
 function legacyMarketplaceInstall() {
-  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   for (const key of Object.keys(plugins)) {
     const at = key.lastIndexOf("@");
@@ -13027,13 +13042,13 @@ function legacyMarketplaceInstall() {
 }
 function realpathOr(p) {
   try {
-    return import_node_fs6.realpathSync.native(p);
+    return import_node_fs7.realpathSync.native(p);
   } catch {
-    return (0, import_node_path7.resolve)(p);
+    return (0, import_node_path8.resolve)(p);
   }
 }
 function isWithin(want, dir) {
-  return want === dir || want.startsWith(dir + import_node_path7.sep);
+  return want === dir || want.startsWith(dir + import_node_path8.sep);
 }
 function entryAppliesHere(entry, here) {
   const e = entry;
@@ -13043,9 +13058,9 @@ function entryAppliesHere(entry, here) {
   return forProject === here;
 }
 function registrySays(pluginRoot) {
-  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return "unverified";
-  const want = (0, import_node_path7.resolve)(pluginRoot);
+  const want = (0, import_node_path8.resolve)(pluginRoot);
   const here = realpathOr(repoRoot());
   const markets = marketplaceLocations();
   for (const [key, value] of Object.entries(plugins)) {
@@ -13054,15 +13069,15 @@ function registrySays(pluginRoot) {
     const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
     const claims = applicable.some((entry) => {
       const installPath = entry?.installPath;
-      return typeof installPath === "string" && (0, import_node_path7.resolve)(installPath) === want;
+      return typeof installPath === "string" && (0, import_node_path8.resolve)(installPath) === want;
     }) || source !== void 0 && applicable.length > 0 && isWithin(want, source);
     if (claims) {
       if (enabledPluginSetting(key) === false) return "gone";
-      return (0, import_node_fs6.existsSync)(pluginRoot) ? "live" : "gone";
+      return (0, import_node_fs7.existsSync)(pluginRoot) ? "live" : "gone";
     }
   }
-  const managed = (0, import_node_path7.resolve)((0, import_node_path7.join)(claudeConfigDir(), "plugins", "cache"));
-  return want === managed || want.startsWith(managed + import_node_path7.sep) ? "gone" : "unverified";
+  const managed = (0, import_node_path8.resolve)((0, import_node_path8.join)(claudeConfigDir(), "plugins", "cache"));
+  return want === managed || want.startsWith(managed + import_node_path8.sep) ? "gone" : "unverified";
 }
 var _live = /* @__PURE__ */ new Map();
 function pluginLiveness(pluginRoot) {
@@ -13076,7 +13091,7 @@ function clearStalePluginMarker() {
   const marker = readMarker();
   if (!marker || pluginLiveness(marker.plugin_root) !== "gone") return null;
   try {
-    (0, import_node_fs6.rmSync)(markerPath(), { force: true });
+    (0, import_node_fs7.rmSync)(markerPath(), { force: true });
   } catch {
     return null;
   }
@@ -13104,7 +13119,7 @@ function pluginActiveHere() {
   return activePluginInstall() !== null;
 }
 function registeredVerityPlugin() {
-  const plugins = readJsonFile((0, import_node_path7.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path8.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   const here = realpathOr(repoRoot());
   for (const [key, value] of Object.entries(plugins)) {
@@ -13114,7 +13129,7 @@ function registeredVerityPlugin() {
     for (const entry of Array.isArray(value) ? value : []) {
       const e = entry;
       const installPath = typeof e.installPath === "string" ? e.installPath : "";
-      if (!installPath || !(0, import_node_fs6.existsSync)(installPath)) continue;
+      if (!installPath || !(0, import_node_fs7.existsSync)(installPath)) continue;
       if (!entryAppliesHere(entry, here)) continue;
       return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
     }
@@ -13165,6 +13180,150 @@ async function resolveHookWiring() {
   };
 }
 
+// src/lib/cli-provenance.ts
+var import_node_fs8 = require("node:fs");
+var import_node_os3 = require("node:os");
+var import_node_path9 = require("node:path");
+var CLI_PACKAGE = "@codacy/verity-cli";
+var CLI_ENTRY = (0, import_node_path9.join)("node_modules", CLI_PACKAGE, "bin", "verity.js");
+function readJson(path) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(path, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function versionUnder(base) {
+  const entry = (0, import_node_path9.join)(base, CLI_ENTRY);
+  if (!(0, import_node_fs8.existsSync)(entry)) return null;
+  const pkg = readJson((0, import_node_path9.join)(base, "node_modules", CLI_PACKAGE, "package.json"));
+  return typeof pkg?.version === "string" ? pkg.version : null;
+}
+function versionForEntry(entry) {
+  try {
+    const pkg = readJson((0, import_node_path9.join)((0, import_node_path9.dirname)((0, import_node_fs8.realpathSync)(entry)), "..", "package.json"));
+    return typeof pkg?.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+function resolveHooksCli(pluginRoot) {
+  const override = process.env.VERITY_CLI_PATH;
+  if (override && (0, import_node_fs8.existsSync)(override)) {
+    return { version: versionForEntry(override), rung: "override" };
+  }
+  const fromPlugin = versionUnder(pluginRoot);
+  if (fromPlugin !== null) return { version: fromPlugin, rung: "plugin" };
+  if ((0, import_node_fs8.existsSync)((0, import_node_path9.join)(pluginRoot, CLI_ENTRY))) return { version: null, rung: "plugin" };
+  const dataDir = process.env.CLAUDE_PLUGIN_DATA || (0, import_node_path9.join)((0, import_node_os3.homedir)(), ".verity", "plugin-cli");
+  const fromData = versionUnder(dataDir);
+  if (fromData !== null) return { version: fromData, rung: "plugin-data" };
+  if ((0, import_node_fs8.existsSync)((0, import_node_path9.join)(dataDir, CLI_ENTRY))) return { version: null, rung: "plugin-data" };
+  const global = globalVerityVersion();
+  if (global !== null) return { version: global, rung: "global" };
+  return null;
+}
+function compareVersions(a, b) {
+  const parse = (v) => {
+    const [core, ...rest] = v.split("-");
+    const parts = core.split(".");
+    if (parts.length !== 3) return null;
+    const nums = parts.map((p) => /^\d+$/.test(p) ? Number(p) : NaN);
+    if (nums.some(Number.isNaN)) return null;
+    return { nums, pre: rest.join("-") };
+  };
+  const x = parse(a);
+  const y = parse(b);
+  if (!x || !y) return null;
+  for (let i = 0; i < 3; i++) {
+    if (x.nums[i] !== y.nums[i]) return x.nums[i] < y.nums[i] ? -1 : 1;
+  }
+  if (x.pre === y.pre) return 0;
+  if (!x.pre) return 1;
+  if (!y.pre) return -1;
+  return null;
+}
+var PLUGIN_UPDATE_REMEDY = "claude plugin update verity@verity, then /reload-plugins (or restart Claude Code)";
+function globalUpdateRemedy(version) {
+  return `npm install -g ${CLI_PACKAGE}@${version}`;
+}
+function remedyFor(global, hooks) {
+  const order = compareVersions(global, hooks);
+  if (order === -1) return { behind: "global", remedy: globalUpdateRemedy(hooks) };
+  if (order === 1) return { behind: "plugin", remedy: PLUGIN_UPDATE_REMEDY };
+  return {
+    behind: "unknown",
+    remedy: `${globalUpdateRemedy(hooks)} \u2014 or, if the plugin is the older one, ${PLUGIN_UPDATE_REMEDY}`
+  };
+}
+function cliProvenance() {
+  const envRoot = process.env.VERITY_PLUGIN_ROOT;
+  const install = envRoot ? { pluginRoot: envRoot, version: process.env.VERITY_PLUGIN_VERSION || activePluginInstall()?.version || null } : activePluginInstall();
+  const global = globalVerityVersion();
+  if (!install) return { plugin: null, hooksCli: null, global, skew: null };
+  const hooksCli = resolveHooksCli(install.pluginRoot);
+  return {
+    plugin: { root: install.pluginRoot, version: install.version },
+    hooksCli,
+    global,
+    skew: computeSkew(global, hooksCli)
+  };
+}
+function computeSkew(global, hooksCli) {
+  if (!global || !hooksCli?.version) return null;
+  if (global === hooksCli.version) return null;
+  return { global, hooks: hooksCli.version, ...remedyFor(global, hooksCli.version) };
+}
+function cliVersionSkew() {
+  return cliProvenance().skew;
+}
+function versionReport(p = cliProvenance()) {
+  if (!p.plugin) return null;
+  return {
+    plugin: p.plugin.version,
+    hooksCli: p.hooksCli?.version ?? null,
+    hooksCliRung: p.hooksCli?.rung ?? null,
+    global: p.global,
+    skew: p.skew
+  };
+}
+function versionLines(v) {
+  if (!v) return { info: [], warn: [] };
+  const plugin = v.plugin ? `plugin ${v.plugin}` : "plugin (version unreadable)";
+  const rung = v.hooksCliRung && v.hooksCliRung !== "plugin" ? ` via ${RUNG_LABELS[v.hooksCliRung]}` : "";
+  const hooks = v.hooksCli ? `hooks run ${CLI_PACKAGE} ${v.hooksCli}${rung}` : "hooks run a CLI whose version could not be read";
+  if (!v.skew) {
+    const agrees = v.global && v.hooksCli && v.global === v.hooksCli ? " \xB7 `verity` on PATH matches \u2713" : "";
+    return { info: [`  Versions: ${plugin} \xB7 ${hooks}${agrees}`], warn: [] };
+  }
+  return {
+    info: [`  Versions: ${plugin} \xB7 ${hooks}`],
+    warn: [
+      `  \u26A0 \`verity\` on PATH is ${v.skew.global}, which is NOT the CLI the hooks run (${v.skew.hooks}).`,
+      `    The gate and your terminal are different builds. Fix: ${v.skew.remedy}`
+    ]
+  };
+}
+var RUNG_LABELS = {
+  override: "VERITY_CLI_PATH",
+  plugin: "the plugin's node_modules",
+  "plugin-data": "the plugin's data directory",
+  global: "the global install on PATH"
+};
+function pluginCliInvocation() {
+  const root = process.env.VERITY_PLUGIN_ROOT;
+  if (!root) return null;
+  const onPath = globalVerityVersion();
+  if (onPath === null) return resolverCommand(root);
+  const hooksCli = resolveHooksCli(root);
+  if (hooksCli?.version && hooksCli.version === onPath) return null;
+  return resolverCommand(root);
+}
+function resolverCommand(root) {
+  return `node ${JSON.stringify((0, import_node_path9.join)(root, "scripts", "verity.mjs"))}`;
+}
+
 // src/commands/hooks.ts
 var ALL_MOMENTS = ["stop", "pre-commit", "pre-push"];
 function parseMomentSelection(raw) {
@@ -13259,6 +13418,9 @@ function registerHooksCommands(program2) {
       const moments = status.guardOn;
       const inherited = wiring.gitMoments.source === "main-worktree" && wiring.gitMoments.path ? ` (inherited from the main worktree: ${wiring.gitMoments.path})` : "";
       printInfo("Wired by the Verity Claude Code plugin (not .claude/settings.json):");
+      const versionOut = versionLines(versionReport());
+      for (const line of versionOut.info) printInfo(line);
+      for (const line of versionOut.warn) printWarn(line);
       printInfo("  Stop hook (verity analyze): installed");
       printInfo("  Intent hook (verity intent capture): installed");
       printInfo("  Baseline hook (verity baseline capture): installed");
@@ -13299,7 +13461,7 @@ var import_node_crypto8 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_fs7 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_node_child_process5 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
@@ -13335,7 +13497,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs7.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs9.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -13359,7 +13521,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs7.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs9.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
@@ -13652,9 +13814,9 @@ function isCommandOnlyTurn(input) {
 
 // src/lib/context-identity.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_fs8 = require("node:fs");
-var import_node_os3 = require("node:os");
-var import_node_path8 = require("node:path");
+var import_node_fs10 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path10 = require("node:path");
 var SHARED_SENTINELS = /* @__PURE__ */ new Set([
   "",
   "-",
@@ -13692,7 +13854,7 @@ function contextIdentity(input) {
   if (rawTree && !isSharedSentinel(rawTree)) {
     let resolved = rawTree;
     try {
-      resolved = import_node_fs8.realpathSync.native(rawTree);
+      resolved = import_node_fs10.realpathSync.native(rawTree);
     } catch {
     }
     treeKey = (0, import_node_crypto2.createHash)("sha256").update(resolved).digest("hex").slice(0, 12);
@@ -13708,13 +13870,13 @@ function contextIdentity(input) {
 }
 function verityHome() {
   const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path8.resolve)(override) : (0, import_node_path8.join)((0, import_node_os3.homedir)(), ".verity");
+  return override && override.trim() ? (0, import_node_path10.resolve)(override) : (0, import_node_path10.join)((0, import_node_os4.homedir)(), ".verity");
 }
 function dossierDir(identity) {
-  return (0, import_node_path8.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
+  return (0, import_node_path10.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
 }
 function treeDir(identity) {
-  return (0, import_node_path8.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
+  return (0, import_node_path10.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
 }
 function scopeIdentity(token, sessionId) {
   const t = (token ?? "").trim();
@@ -13729,8 +13891,8 @@ function sessionScopeKey(token, sessionId) {
 
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_fs9 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_path11 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -13769,7 +13931,7 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs9.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs11.existsSync)(filePath)) return null;
   try {
     const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
@@ -13803,12 +13965,12 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs9.existsSync)(TASK_CONTEXT_DIR)) return;
+    if (!(0, import_node_fs11.existsSync)(TASK_CONTEXT_DIR)) return;
     const files = await (0, import_promises6.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path9.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path11.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -13822,13 +13984,13 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path9.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path11.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
     await (0, import_promises6.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs9.existsSync)(filePath)) {
+    if ((0, import_node_fs11.existsSync)(filePath)) {
       const stats = await (0, import_promises6.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
         const content = await (0, import_promises6.readFile)(filePath, "utf-8");
@@ -13839,7 +14001,7 @@ async function appendEntry(taskId, entry) {
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs9.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
+    const existing = (0, import_node_fs11.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
     await (0, import_promises6.writeFile)(filePath, existing + line);
   } catch {
   }
@@ -13847,20 +14009,20 @@ async function appendEntry(taskId, entry) {
 
 // src/lib/memory-retrieval.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs11 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_fs13 = require("node:fs");
+var import_node_path13 = require("node:path");
 
 // src/lib/org-mirror.ts
-var import_node_fs10 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
-var import_node_path10 = require("node:path");
+var import_node_path12 = require("node:path");
 var ORG_KINDS = ["decision", "security", "gotcha", "pattern", "domain", "integration"];
 var STATE_FILE = ".org-pull-state.json";
 var BODY_MAX = 8192;
 function orgMirrorDir(remote = requestRemote()) {
   const parsed = parseRemote(remote);
   if (!parsed) return null;
-  return (0, import_node_path10.join)(verityHome(), "orgs", parsed.host, parsed.owner.toLowerCase(), "memory");
+  return (0, import_node_path12.join)(verityHome(), "orgs", parsed.host, parsed.owner.toLowerCase(), "memory");
 }
 function slugify(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60);
@@ -13926,7 +14088,7 @@ function parseOrgNode(content) {
 }
 async function readState(dir) {
   try {
-    const parsed = JSON.parse(await (0, import_promises7.readFile)((0, import_node_path10.join)(dir, STATE_FILE), "utf-8"));
+    const parsed = JSON.parse(await (0, import_promises7.readFile)((0, import_node_path12.join)(dir, STATE_FILE), "utf-8"));
     return {
       version: typeof parsed?.version === "string" ? parsed.version : null,
       organization: parsed?.organization && typeof parsed.organization.id === "string" ? parsed.organization : null,
@@ -13938,7 +14100,7 @@ async function readState(dir) {
 }
 async function writeState(dir, state) {
   await (0, import_promises7.mkdir)(dir, { recursive: true });
-  await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, STATE_FILE), JSON.stringify({
+  await (0, import_promises7.writeFile)((0, import_node_path12.join)(dir, STATE_FILE), JSON.stringify({
     ...state.version ? { version: state.version } : {},
     organization: state.organization,
     pulled_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -14003,24 +14165,24 @@ async function pullOrgKnowledge(opts) {
   for (const n of nodes) {
     const rel = orgNodePath(n);
     if (written.has(rel)) continue;
-    await (0, import_promises7.mkdir)((0, import_node_path10.join)(dir, rel.split("/")[0]), { recursive: true });
-    await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, rel), renderOrgNode(n, org?.name ?? ""));
+    await (0, import_promises7.mkdir)((0, import_node_path12.join)(dir, rel.split("/")[0]), { recursive: true });
+    await (0, import_promises7.writeFile)((0, import_node_path12.join)(dir, rel), renderOrgNode(n, org?.name ?? ""));
     written.add(rel);
   }
   for (const rel of state.files) {
-    if (!written.has(rel)) await (0, import_promises7.rm)((0, import_node_path10.join)(dir, rel), { force: true });
+    if (!written.has(rel)) await (0, import_promises7.rm)((0, import_node_path12.join)(dir, rel), { force: true });
   }
-  await (0, import_promises7.writeFile)((0, import_node_path10.join)(dir, "index.md"), renderIndex(org?.name ?? "no organization", nodes));
+  await (0, import_promises7.writeFile)((0, import_node_path12.join)(dir, "index.md"), renderIndex(org?.name ?? "no organization", nodes));
   await writeState(dir, { version: org ? page.version : null, organization: org, files: [...written].sort() });
   return { ok: true, status: org ? "pulled" : "none", received: nodes.length, dir };
 }
 async function readOrgMirror(remote = requestRemote()) {
   const dir = orgMirrorDir(remote);
-  if (!dir || !(0, import_node_fs10.existsSync)(dir)) return [];
+  if (!dir || !(0, import_node_fs12.existsSync)(dir)) return [];
   const out = [];
   for (const kind of ORG_KINDS) {
-    const kindDir = (0, import_node_path10.join)(dir, kind);
-    if (!(0, import_node_fs10.existsSync)(kindDir)) continue;
+    const kindDir = (0, import_node_path12.join)(dir, kind);
+    if (!(0, import_node_fs12.existsSync)(kindDir)) continue;
     let files;
     try {
       files = await (0, import_promises7.readdir)(kindDir);
@@ -14030,7 +14192,7 @@ async function readOrgMirror(remote = requestRemote()) {
     for (const file of files) {
       if (!file.endsWith(".md")) continue;
       try {
-        const node = parseOrgNode(await (0, import_promises7.readFile)((0, import_node_path10.join)(kindDir, file), "utf-8"));
+        const node = parseOrgNode(await (0, import_promises7.readFile)((0, import_node_path12.join)(kindDir, file), "utf-8"));
         if (node) out.push(node);
       } catch {
       }
@@ -14153,19 +14315,19 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  const hasRepoGraph = (0, import_node_fs11.existsSync)(memoryDir());
+  const hasRepoGraph = (0, import_node_fs13.existsSync)(memoryDir());
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of hasRepoGraph ? DOMAINS : []) {
-    const domainDir = (0, import_node_path11.join)(memoryDir(), domain);
-    if (!(0, import_node_fs11.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path13.join)(memoryDir(), domain);
+    if (!(0, import_node_fs13.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path11.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -14232,13 +14394,13 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 
 // src/lib/memory-sync.ts
 var import_promises9 = require("node:fs/promises");
-var import_node_fs14 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path15 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
 
 // src/lib/gitignore.ts
 var import_node_child_process6 = require("node:child_process");
-var import_node_fs12 = require("node:fs");
+var import_node_fs14 = require("node:fs");
 var VERITY_GITIGNORE_MARKER = "# Verity \u2014 machine-local state.";
 var SETTINGS_LOCAL_IGNORE_ENTRY = ".claude/settings.local.json";
 var VERITY_GITIGNORE_BLOCK = [
@@ -14322,7 +14484,7 @@ function fenceMemoryLines(lines) {
 function ensureVerityGitignore() {
   let content = "";
   try {
-    content = (0, import_node_fs12.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs14.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
@@ -14349,7 +14511,7 @@ function ensureVerityGitignore() {
       const sep4 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
       text = text + sep4 + VERITY_GITIGNORE_BLOCK;
     }
-    if (text !== content) (0, import_node_fs12.writeFileSync)(".gitignore", text);
+    if (text !== content) (0, import_node_fs14.writeFileSync)(".gitignore", text);
     return verified(
       memoryIsCommitted ? "memory-tracked" : hasSupersededMemory ? "memory-fenced" : needsRepair ? "repaired" : "added"
     );
@@ -14369,7 +14531,7 @@ function untrackMemory() {
 function writeFencedBlock() {
   let content = "";
   try {
-    content = (0, import_node_fs12.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs14.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
@@ -14381,7 +14543,7 @@ function writeFencedBlock() {
     text = text + sep4 + VERITY_GITIGNORE_BLOCK;
   }
   try {
-    (0, import_node_fs12.writeFileSync)(".gitignore", text);
+    (0, import_node_fs14.writeFileSync)(".gitignore", text);
     return true;
   } catch {
     return false;
@@ -14390,14 +14552,14 @@ function writeFencedBlock() {
 function fenceMemory() {
   let original = null;
   try {
-    original = (0, import_node_fs12.readFileSync)(".gitignore", "utf-8");
+    original = (0, import_node_fs14.readFileSync)(".gitignore", "utf-8");
   } catch {
     original = null;
   }
   const restore = () => {
     try {
-      if (original === null) (0, import_node_fs12.rmSync)(".gitignore", { force: true });
-      else (0, import_node_fs12.writeFileSync)(".gitignore", original);
+      if (original === null) (0, import_node_fs14.rmSync)(".gitignore", { force: true });
+      else (0, import_node_fs14.writeFileSync)(".gitignore", original);
     } catch {
     }
   };
@@ -14415,7 +14577,7 @@ function fenceMemory() {
 }
 function memoryOptOut() {
   try {
-    return (0, import_node_fs12.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
+    return (0, import_node_fs14.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
   } catch {
     return false;
   }
@@ -14423,13 +14585,13 @@ function memoryOptOut() {
 function keepMemoryTracked() {
   let content = "";
   try {
-    content = (0, import_node_fs12.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs14.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   if (content.includes(MEMORY_OPT_OUT_MARKER)) return "already";
   try {
     const sep4 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
-    (0, import_node_fs12.writeFileSync)(".gitignore", content + sep4 + MEMORY_OPT_OUT_STANZA);
+    (0, import_node_fs14.writeFileSync)(".gitignore", content + sep4 + MEMORY_OPT_OUT_STANZA);
   } catch {
     return "failed";
   }
@@ -14464,26 +14626,26 @@ function untrackVerityState() {
 }
 
 // src/lib/safe-path.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path14 = require("node:path");
 function resolveInside(baseDir, candidate) {
   if (typeof candidate !== "string" || candidate.length === 0) return null;
-  if ((0, import_node_path12.isAbsolute)(candidate)) return null;
-  const baseAbs = (0, import_node_path12.resolve)(baseDir);
-  const full = (0, import_node_path12.resolve)(baseAbs, candidate);
-  const baseSep = baseAbs.endsWith(import_node_path12.sep) ? baseAbs : baseAbs + import_node_path12.sep;
+  if ((0, import_node_path14.isAbsolute)(candidate)) return null;
+  const baseAbs = (0, import_node_path14.resolve)(baseDir);
+  const full = (0, import_node_path14.resolve)(baseAbs, candidate);
+  const baseSep = baseAbs.endsWith(import_node_path14.sep) ? baseAbs : baseAbs + import_node_path14.sep;
   if (full !== baseAbs && !full.startsWith(baseSep)) return null;
   try {
-    if ((0, import_node_fs13.existsSync)(baseAbs)) {
-      const realBase = (0, import_node_fs13.realpathSync)(baseAbs);
-      const realBaseSep = realBase.endsWith(import_node_path12.sep) ? realBase : realBase + import_node_path12.sep;
+    if ((0, import_node_fs15.existsSync)(baseAbs)) {
+      const realBase = (0, import_node_fs15.realpathSync)(baseAbs);
+      const realBaseSep = realBase.endsWith(import_node_path14.sep) ? realBase : realBase + import_node_path14.sep;
       let probe = full;
-      while (!(0, import_node_fs13.existsSync)(probe)) {
-        const parent = (0, import_node_path12.dirname)(probe);
+      while (!(0, import_node_fs15.existsSync)(probe)) {
+        const parent = (0, import_node_path14.dirname)(probe);
         if (parent === probe) break;
         probe = parent;
       }
-      const realProbe = (0, import_node_fs13.realpathSync)(probe);
+      const realProbe = (0, import_node_fs15.realpathSync)(probe);
       if (realProbe !== realBase && !realProbe.startsWith(realBaseSep)) return null;
     }
   } catch {
@@ -14491,6 +14653,42 @@ function resolveInside(baseDir, candidate) {
   }
   return full;
 }
+var O_NOFOLLOW = typeof import_node_fs15.constants.O_NOFOLLOW === "number" ? import_node_fs15.constants.O_NOFOLLOW : 0;
+function readFileInside(baseDir, candidate, maxBytes) {
+  const full = resolveInside(baseDir, candidate);
+  if (!full) return null;
+  let realParent;
+  let realBase;
+  try {
+    realParent = (0, import_node_fs15.realpathSync)((0, import_node_path14.dirname)(full));
+    realBase = (0, import_node_fs15.realpathSync)((0, import_node_path14.resolve)(baseDir));
+  } catch {
+    return null;
+  }
+  const realBaseSep = realBase.endsWith(import_node_path14.sep) ? realBase : realBase + import_node_path14.sep;
+  if (realParent !== realBase && !realParent.startsWith(realBaseSep)) return null;
+  const target = (0, import_node_path14.join)(realParent, (0, import_node_path14.basename)(full));
+  let fd = null;
+  try {
+    fd = (0, import_node_fs15.openSync)(target, import_node_fs15.constants.O_RDONLY | O_NOFOLLOW);
+    const st = (0, import_node_fs15.fstatSync)(fd);
+    if (!st.isFile()) return null;
+    const cap = Math.min(maxBytes, st.size);
+    if (cap <= 0) return "";
+    const buf = Buffer.alloc(cap);
+    const bytesRead = (0, import_node_fs15.readSync)(fd, buf, 0, cap, 0);
+    return buf.subarray(0, bytesRead).toString("utf-8");
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try {
+        (0, import_node_fs15.closeSync)(fd);
+      } catch {
+      }
+    }
+  }
+}
 
 // src/lib/glob-match.ts
 function globToRegex(glob) {
@@ -14568,32 +14766,32 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises9.mkdir)((0, import_node_path13.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises9.mkdir)((0, import_node_path15.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs16.existsSync)((0, import_node_path15.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path15.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs16.existsSync)((0, import_node_path15.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path15.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs16.existsSync)((0, import_node_path15.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path15.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
-  if (!(0, import_node_fs14.existsSync)(memoryDir2())) {
+  if (!(0, import_node_fs16.existsSync)(memoryDir2())) {
     return { schema_version: 1, nodes: [], index_hash: null, log_length: 0 };
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path15.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs16.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path13.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path15.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
@@ -14606,13 +14804,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises9.readFile)((0, import_node_path15.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises9.readFile)((0, import_node_path15.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -14623,15 +14821,15 @@ function hashContent(content) {
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs14.existsSync)(memoryDir2())) return out;
+  if (!(0, import_node_fs16.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path15.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs16.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises9.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path15.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -14668,7 +14866,7 @@ async function recordSyncedNodePaths() {
   }
 }
 async function writeFileAtomic(path, content) {
-  await (0, import_promises9.mkdir)((0, import_node_path13.dirname)(path), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path15.dirname)(path), { recursive: true });
   const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
   await (0, import_promises9.writeFile)(tmp, content);
   await (0, import_promises9.rename)(tmp, path);
@@ -14682,8 +14880,8 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path13.join)(memoryDir2(), path);
-    if (!(0, import_node_fs14.existsSync)(full)) continue;
+    const full = (0, import_node_path15.join)(memoryDir2(), path);
+    if (!(0, import_node_fs16.existsSync)(full)) continue;
     let content;
     try {
       content = await (0, import_promises9.readFile)(full, "utf-8");
@@ -14727,8 +14925,8 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs14.existsSync)((0, import_node_path13.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises9.writeFile)((0, import_node_path13.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs16.existsSync)((0, import_node_path15.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path15.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises9.writeFile)((0, import_node_path15.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   if (opts.baseline === "written") await mergeSyncBaseline(synced);
@@ -14738,7 +14936,7 @@ async function applyMemoryWrites(writes, opts = {}) {
 async function mergeSyncBaseline(entries) {
   if (entries.size === 0) return;
   try {
-    if ((0, import_node_fs14.existsSync)(syncStateFile())) {
+    if ((0, import_node_fs16.existsSync)(syncStateFile())) {
       try {
         JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
       } catch {
@@ -14766,7 +14964,7 @@ async function applyOneWrite(write, treePaths, lastServed) {
       notes.push(`${write.path}: dropped unmatched file_globs [${grounded.dropped.join(", ")}]`);
     }
   }
-  if ((0, import_node_fs14.existsSync)(fullPath)) {
+  if ((0, import_node_fs16.existsSync)(fullPath)) {
     let existing = "";
     try {
       existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
@@ -14782,7 +14980,7 @@ async function applyOneWrite(write, treePaths, lastServed) {
       notes.push(`${write.path}: updated from server (untouched here since the server delivered it)`);
     }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path13.dirname)(fullPath), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path15.dirname)(fullPath), { recursive: true });
   await (0, import_promises9.writeFile)(fullPath, content);
   return { written: true, syncedHash: hashContent(content), notes };
 }
@@ -14823,8 +15021,8 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path13.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path15.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs16.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
@@ -14834,7 +15032,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises9.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises9.readFile)((0, import_node_path15.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -14858,7 +15056,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path13.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path15.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
@@ -15255,9 +15453,9 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path13.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path15.join)(cwd, "CLAUDE.md");
   let existing = "";
-  if ((0, import_node_fs14.existsSync)(claudeMdPath)) {
+  if ((0, import_node_fs16.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
@@ -15398,9 +15596,9 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 `;
 
 // src/lib/dossier-session.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 var import_node_crypto7 = require("node:crypto");
-var import_node_path16 = require("node:path");
+var import_node_path18 = require("node:path");
 
 // src/lib/pending-repeat.ts
 var STOP = /* @__PURE__ */ new Set([
@@ -15505,8 +15703,8 @@ function statementAnchorKey(file, patternId) {
 
 // src/lib/dossier/log.ts
 var import_node_crypto4 = require("node:crypto");
-var import_node_fs15 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path16 = require("node:path");
 var CRC_TABLE = (() => {
   const t = new Int32Array(256);
   for (let i = 0; i < 256; i++) {
@@ -15525,13 +15723,13 @@ function crc32(s) {
 function openDossier(identity) {
   try {
     const dir = dossierDir(identity);
-    (0, import_node_fs15.mkdirSync)(dir, { recursive: true, mode: 448 });
+    (0, import_node_fs17.mkdirSync)(dir, { recursive: true, mode: 448 });
     return {
       dir,
       identity,
-      eventsPath: (0, import_node_path14.join)(dir, "events.jsonl"),
-      foldPath: (0, import_node_path14.join)(dir, "fold.json"),
-      rotatedDir: (0, import_node_path14.join)(dir, "rotated")
+      eventsPath: (0, import_node_path16.join)(dir, "events.jsonl"),
+      foldPath: (0, import_node_path16.join)(dir, "fold.json"),
+      rotatedDir: (0, import_node_path16.join)(dir, "rotated")
     };
   } catch {
     return null;
@@ -15593,7 +15791,7 @@ function appendEvent(d, ev) {
       at: ev.at ?? (/* @__PURE__ */ new Date()).toISOString(),
       ...ev
     });
-    (0, import_node_fs15.appendFileSync)(d.eventsPath, line, { mode: 384 });
+    (0, import_node_fs17.appendFileSync)(d.eventsPath, line, { mode: 384 });
     return true;
   } catch {
     return false;
@@ -15601,14 +15799,14 @@ function appendEvent(d, ev) {
 }
 function rotateIfNeeded2(d) {
   try {
-    if (!(0, import_node_fs15.existsSync)(d.eventsPath)) return;
-    if ((0, import_node_fs15.statSync)(d.eventsPath).size < ROTATE_BYTES) return;
-    (0, import_node_fs15.mkdirSync)(d.rotatedDir, { recursive: true, mode: 448 });
-    (0, import_node_fs15.renameSync)(d.eventsPath, (0, import_node_path14.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
-    const kept = (0, import_node_fs15.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
+    if (!(0, import_node_fs17.existsSync)(d.eventsPath)) return;
+    if ((0, import_node_fs17.statSync)(d.eventsPath).size < ROTATE_BYTES) return;
+    (0, import_node_fs17.mkdirSync)(d.rotatedDir, { recursive: true, mode: 448 });
+    (0, import_node_fs17.renameSync)(d.eventsPath, (0, import_node_path16.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
+    const kept = (0, import_node_fs17.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
     for (const stale of kept.slice(0, Math.max(0, kept.length - ROTATE_KEEP))) {
       try {
-        (0, import_node_fs15.renameSync)((0, import_node_path14.join)(d.rotatedDir, stale), (0, import_node_path14.join)(d.rotatedDir, `${stale}.pruned`));
+        (0, import_node_fs17.renameSync)((0, import_node_path16.join)(d.rotatedDir, stale), (0, import_node_path16.join)(d.rotatedDir, `${stale}.pruned`));
       } catch {
       }
     }
@@ -15618,8 +15816,8 @@ function rotateIfNeeded2(d) {
 
 // src/lib/dossier/fold-dossier.ts
 var import_node_crypto5 = require("node:crypto");
-var import_node_fs16 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path17 = require("node:path");
 var EMPTY_CAPABILITIES = () => ({
   human_reachable: { value: "unknown", tier: "unknown" },
   authorship_observability: { value: "unknown", tier: "unknown" },
@@ -15670,12 +15868,12 @@ function foldDossier(d, opts = {}) {
     }
   };
   try {
-    if ((0, import_node_fs16.existsSync)(d.rotatedDir)) {
-      const files = (0, import_node_fs16.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
+    if ((0, import_node_fs18.existsSync)(d.rotatedDir)) {
+      const files = (0, import_node_fs18.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
       state.meta.rotations = files.length;
       for (const f of files) {
         try {
-          ingest((0, import_node_fs16.readFileSync)((0, import_node_path15.join)(d.rotatedDir, f), "utf8"));
+          ingest((0, import_node_fs18.readFileSync)((0, import_node_path17.join)(d.rotatedDir, f), "utf8"));
         } catch {
           state.meta.dropped_lines++;
         }
@@ -15684,9 +15882,9 @@ function foldDossier(d, opts = {}) {
   } catch {
   }
   try {
-    if ((0, import_node_fs16.existsSync)(d.eventsPath)) {
-      state.meta.upto_offset = (0, import_node_fs16.statSync)(d.eventsPath).size;
-      ingest((0, import_node_fs16.readFileSync)(d.eventsPath, "utf8"));
+    if ((0, import_node_fs18.existsSync)(d.eventsPath)) {
+      state.meta.upto_offset = (0, import_node_fs18.statSync)(d.eventsPath).size;
+      ingest((0, import_node_fs18.readFileSync)(d.eventsPath, "utf8"));
     }
   } catch {
   }
@@ -15957,7 +16155,7 @@ function applyBounds(state, input) {
 }
 
 // src/lib/dossier/cache.ts
-var import_node_fs17 = require("node:fs");
+var import_node_fs19 = require("node:fs");
 function compactState(s) {
   const ms = (iso) => Date.parse(iso) || 0;
   return {
@@ -16086,20 +16284,20 @@ function encodeState(s) {
 function writeFoldCache(d, state) {
   try {
     const tmp = `${d.foldPath}.${process.pid}.tmp`;
-    (0, import_node_fs17.writeFileSync)(tmp, encodeState(state), { mode: 384 });
-    (0, import_node_fs17.renameSync)(tmp, d.foldPath);
+    (0, import_node_fs19.writeFileSync)(tmp, encodeState(state), { mode: 384 });
+    (0, import_node_fs19.renameSync)(tmp, d.foldPath);
   } catch {
   }
 }
 function readFoldCache(d) {
   try {
-    if (!(0, import_node_fs17.existsSync)(d.foldPath)) return null;
-    const raw = JSON.parse((0, import_node_fs17.readFileSync)(d.foldPath, "utf8"));
+    if (!(0, import_node_fs19.existsSync)(d.foldPath)) return null;
+    const raw = JSON.parse((0, import_node_fs19.readFileSync)(d.foldPath, "utf8"));
     if (raw?.v !== 1) return null;
     const cached2 = expandState(raw);
     if (!cached2?.meta) return null;
-    const size = (0, import_node_fs17.existsSync)(d.eventsPath) ? (0, import_node_fs17.statSync)(d.eventsPath).size : 0;
-    const rotations = (0, import_node_fs17.existsSync)(d.rotatedDir) ? (0, import_node_fs17.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).length : 0;
+    const size = (0, import_node_fs19.existsSync)(d.eventsPath) ? (0, import_node_fs19.statSync)(d.eventsPath).size : 0;
+    const rotations = (0, import_node_fs19.existsSync)(d.rotatedDir) ? (0, import_node_fs19.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).length : 0;
     if (cached2.meta.upto_offset !== size || cached2.meta.rotations !== rotations) return null;
     return cached2;
   } catch {
@@ -16150,13 +16348,13 @@ function assessContinuity(i) {
 
 // src/lib/dossier/reanchor.ts
 var import_node_crypto6 = require("node:crypto");
-var import_node_fs18 = require("node:fs");
+var import_node_fs20 = require("node:fs");
 function lineSha(text) {
   return (0, import_node_crypto6.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
 }
 function fileHash(path) {
   try {
-    return (0, import_node_crypto6.createHash)("sha256").update((0, import_node_fs18.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
+    return (0, import_node_crypto6.createHash)("sha256").update((0, import_node_fs20.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
   } catch {
     return null;
   }
@@ -16528,20 +16726,20 @@ function foreignAuthoredPaths(identity, opts = {}) {
   let sessions = 0;
   try {
     const dir = treeDir(identity);
-    if (!(0, import_node_fs19.existsSync)(dir)) return { paths: [], sessions: 0 };
-    for (const entry of (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true })) {
+    if (!(0, import_node_fs21.existsSync)(dir)) return { paths: [], sessions: 0 };
+    for (const entry of (0, import_node_fs21.readdirSync)(dir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       if (entry.name === identity.sessionKey) continue;
-      const log = (0, import_node_path16.join)(dir, entry.name, "events.jsonl");
+      const log = (0, import_node_path18.join)(dir, entry.name, "events.jsonl");
       try {
-        if (!(0, import_node_fs19.existsSync)(log)) continue;
-        if (now - (0, import_node_fs19.statSync)(log).mtimeMs > windowMs) continue;
+        if (!(0, import_node_fs21.existsSync)(log)) continue;
+        if (now - (0, import_node_fs21.statSync)(log).mtimeMs > windowMs) continue;
         const sib = {
-          dir: (0, import_node_path16.join)(dir, entry.name),
+          dir: (0, import_node_path18.join)(dir, entry.name),
           identity,
           eventsPath: log,
-          foldPath: (0, import_node_path16.join)(dir, entry.name, "fold.json"),
-          rotatedDir: (0, import_node_path16.join)(dir, entry.name, "rotated")
+          foldPath: (0, import_node_path18.join)(dir, entry.name, "fold.json"),
+          rotatedDir: (0, import_node_path18.join)(dir, entry.name, "rotated")
         };
         const state = readFoldCache(sib) ?? foldDossier(sib);
         sessions++;
@@ -16569,25 +16767,25 @@ function pruneOldDossiers(identity, maxAgeMs = 7 * 24 * 60 * 60 * 1e3) {
   let removed = 0;
   try {
     const mine = dossierDir(identity);
-    const userDir = (0, import_node_path16.dirname)((0, import_node_path16.dirname)(mine));
-    if (!(0, import_node_fs19.existsSync)(userDir)) return 0;
+    const userDir = (0, import_node_path18.dirname)((0, import_node_path18.dirname)(mine));
+    if (!(0, import_node_fs21.existsSync)(userDir)) return 0;
     const cutoff = Date.now() - maxAgeMs;
-    for (const tree of (0, import_node_fs19.readdirSync)(userDir, { withFileTypes: true })) {
+    for (const tree of (0, import_node_fs21.readdirSync)(userDir, { withFileTypes: true })) {
       if (!tree.isDirectory()) continue;
-      const treePath = (0, import_node_path16.join)(userDir, tree.name);
+      const treePath = (0, import_node_path18.join)(userDir, tree.name);
       let live = 0;
-      for (const entry of (0, import_node_fs19.readdirSync)(treePath, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs21.readdirSync)(treePath, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const dir = (0, import_node_path16.join)(treePath, entry.name);
+        const dir = (0, import_node_path18.join)(treePath, entry.name);
         if (dir === mine) {
           live++;
           continue;
         }
         try {
-          const log = (0, import_node_path16.join)(dir, "events.jsonl");
-          const at = (0, import_node_fs19.existsSync)(log) ? (0, import_node_fs19.statSync)(log).mtimeMs : (0, import_node_fs19.statSync)(dir).mtimeMs;
+          const log = (0, import_node_path18.join)(dir, "events.jsonl");
+          const at = (0, import_node_fs21.existsSync)(log) ? (0, import_node_fs21.statSync)(log).mtimeMs : (0, import_node_fs21.statSync)(dir).mtimeMs;
           if (at < cutoff) {
-            (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
+            (0, import_node_fs21.rmSync)(dir, { recursive: true, force: true });
             removed++;
           } else {
             live++;
@@ -16597,7 +16795,7 @@ function pruneOldDossiers(identity, maxAgeMs = 7 * 24 * 60 * 60 * 1e3) {
       }
       if (live === 0) {
         try {
-          (0, import_node_fs19.rmSync)(treePath, { recursive: false, force: false });
+          (0, import_node_fs21.rmSync)(treePath, { recursive: false, force: false });
         } catch {
         }
       }
@@ -16614,8 +16812,8 @@ function sessionDossier(token, sessionId) {
 }
 function hasActiveGoal(d) {
   try {
-    if (!(0, import_node_fs19.existsSync)(d.eventsPath)) return false;
-    return (0, import_node_fs19.readFileSync)(d.eventsPath, "utf8").includes('"k":"goal"');
+    if (!(0, import_node_fs21.existsSync)(d.eventsPath)) return false;
+    return (0, import_node_fs21.readFileSync)(d.eventsPath, "utf8").includes('"k":"goal"');
   } catch {
     return false;
   }
@@ -16639,7 +16837,7 @@ function recordTurn(d, t) {
   for (const a of t.authored) {
     const origin = a.owner === "subagent" ? "subagent" : "edit_tool";
     const prior = t.known?.authored?.get(a.p);
-    const hash = fileHash((0, import_node_path16.join)(root, a.p));
+    const hash = fileHash((0, import_node_path18.join)(root, a.p));
     const hunks = Math.max(0, a.h - (prior?.hunks ?? 0));
     const adds = Math.max(0, a.a - (prior?.adds ?? 0));
     const dels = Math.max(0, a.d - (prior?.dels ?? 0));
@@ -16672,7 +16870,7 @@ function recordTurn(d, t) {
   }
   const seenDivergence = t.known?.divergence ?? /* @__PURE__ */ new Set();
   for (const u of t.unobserved) {
-    const hash = fileHash((0, import_node_path16.join)(root, u.p));
+    const hash = fileHash((0, import_node_path18.join)(root, u.p));
     if (seenDivergence.has(divergenceKey(u.p, hash))) continue;
     appendEvent(d, { k: "divergence", kind: "external_mutation", path: u.p, hash });
   }
@@ -16707,8 +16905,8 @@ function recordVerdict(d, v) {
     if (!sent.has(f.file)) continue;
     if (!lines.has(f.file)) {
       try {
-        const abs = (0, import_node_path16.join)(root, f.file);
-        lines.set(f.file, (0, import_node_fs19.existsSync)(abs) ? (0, import_node_fs19.readFileSync)(abs, "utf8").split("\n") : null);
+        const abs = (0, import_node_path18.join)(root, f.file);
+        lines.set(f.file, (0, import_node_fs21.existsSync)(abs) ? (0, import_node_fs21.readFileSync)(abs, "utf8").split("\n") : null);
       } catch {
         lines.set(f.file, null);
       }
@@ -16808,8 +17006,8 @@ function recallMemory(d, identity, opts) {
       budgetBytes: opts.budgetBytes,
       readFileLines: (file) => {
         try {
-          const abs = (0, import_node_path16.join)(root, file);
-          return (0, import_node_fs19.existsSync)(abs) ? (0, import_node_fs19.readFileSync)(abs, "utf8").split("\n") : null;
+          const abs = (0, import_node_path18.join)(root, file);
+          return (0, import_node_fs21.existsSync)(abs) ? (0, import_node_fs21.readFileSync)(abs, "utf8").split("\n") : null;
         } catch {
           return null;
         }
@@ -16953,46 +17151,46 @@ async function fireClassify(prompt, sessionId, globals) {
 }
 
 // src/commands/lifecycle.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_node_path23 = require("node:path");
 
 // src/lib/baseline.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_path22 = require("node:path");
 var import_node_crypto9 = require("node:crypto");
 
 // src/lib/snapshot.ts
-var import_node_fs21 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path21 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
 
 // src/lib/files.ts
-var import_node_path18 = require("node:path");
+var import_node_path20 = require("node:path");
 
 // src/lib/safe-read.ts
-var import_node_fs20 = require("node:fs");
-var import_node_path17 = require("node:path");
-var FLAGS = import_node_fs20.constants;
+var import_node_fs22 = require("node:fs");
+var import_node_path19 = require("node:path");
+var FLAGS = import_node_fs22.constants;
 var NOFOLLOW = FLAGS.O_NOFOLLOW;
 var NONBLOCK = FLAGS.O_NONBLOCK;
 function closeOpened(fd) {
   try {
-    (0, import_node_fs20.closeSync)(fd);
+    (0, import_node_fs22.closeSync)(fd);
   } catch {
   }
 }
 function isInsideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path17.sep) ? realRoot : realRoot + import_node_path17.sep);
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path19.sep) ? realRoot : realRoot + import_node_path19.sep);
 }
 function sameOpenedFile(opened, current, nofollowAvailable) {
   if (!nofollowAvailable && (opened.ino === 0n || current.ino === 0n)) return false;
   return opened.ino === current.ino && opened.dev === current.dev;
 }
 function openRegularInRoot(root, path) {
-  const full = (0, import_node_path17.isAbsolute)(path) ? path : (0, import_node_path17.join)(root, path);
+  const full = (0, import_node_path19.isAbsolute)(path) ? path : (0, import_node_path19.join)(root, path);
   let fd;
   try {
-    fd = (0, import_node_fs20.openSync)(full, import_node_fs20.constants.O_RDONLY | (NOFOLLOW ?? 0) | (NONBLOCK ?? 0));
+    fd = (0, import_node_fs22.openSync)(full, import_node_fs22.constants.O_RDONLY | (NOFOLLOW ?? 0) | (NONBLOCK ?? 0));
   } catch (err) {
     const code = err.code;
     if (code === "ELOOP" || code === "EMLINK" || code === "EFTYPE") return { ok: false, reason: "symlink" };
@@ -17000,18 +17198,18 @@ function openRegularInRoot(root, path) {
     return { ok: false, reason: "unreadable" };
   }
   try {
-    const opened = (0, import_node_fs20.fstatSync)(fd, { bigint: true });
+    const opened = (0, import_node_fs22.fstatSync)(fd, { bigint: true });
     if (!opened.isFile()) {
       closeOpened(fd);
       return { ok: false, reason: "not-regular" };
     }
-    const realRoot = import_node_fs20.realpathSync.native(root);
-    const realPath = import_node_fs20.realpathSync.native(full);
+    const realRoot = import_node_fs22.realpathSync.native(root);
+    const realPath = import_node_fs22.realpathSync.native(full);
     if (!isInsideRoot(realRoot, realPath)) {
       closeOpened(fd);
       return { ok: false, reason: "outside-root" };
     }
-    const current = (0, import_node_fs20.statSync)(realPath, { bigint: true });
+    const current = (0, import_node_fs22.statSync)(realPath, { bigint: true });
     if (!sameOpenedFile(opened, current, NOFOLLOW !== void 0)) {
       closeOpened(fd);
       return { ok: false, reason: NOFOLLOW === void 0 ? "unreadable" : "outside-root" };
@@ -17033,7 +17231,7 @@ function readOpened(fd, size) {
     const buffer = Buffer.alloc(size);
     let offset = 0;
     while (offset < size) {
-      const n = (0, import_node_fs20.readSync)(fd, buffer, offset, size - offset, offset);
+      const n = (0, import_node_fs22.readSync)(fd, buffer, offset, size - offset, offset);
       if (n === 0) break;
       offset += n;
     }
@@ -17127,7 +17325,7 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path18.extname)(filepath).slice(1);
+  const ext = (0, import_node_path20.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
@@ -17218,16 +17416,16 @@ function collectCodeDelta(files, opts) {
 
 // src/lib/snapshot.ts
 function generateSnapshotDiffs(files) {
-  if (!(0, import_node_fs21.existsSync)(SNAPSHOT_DIR)) {
+  if (!(0, import_node_fs23.existsSync)(SNAPSHOT_DIR)) {
     return { diffs: [], has_snapshots: false };
   }
   const diffs = [];
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path19.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path21.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
-    if ((0, import_node_fs21.existsSync)(snapshotPath)) {
-      const oldContent = (0, import_node_fs21.readFileSync)(snapshotPath, "utf-8");
+    if ((0, import_node_fs23.existsSync)(snapshotPath)) {
+      const oldContent = (0, import_node_fs23.readFileSync)(snapshotPath, "utf-8");
       if (oldContent === file.content) continue;
       const diff = computeDiff(oldContent, file.content, file.path);
       if (diff) {
@@ -17252,20 +17450,20 @@ function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path19.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path21.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs21.mkdirSync)((0, import_node_path19.dirname)(snapshotPath), { recursive: true });
-    (0, import_node_fs21.writeFileSync)(snapshotPath, file.content);
+    (0, import_node_fs23.mkdirSync)((0, import_node_path21.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs23.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path19.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path19.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path21.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path21.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
-    (0, import_node_fs21.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
-    (0, import_node_fs21.writeFileSync)(tmpOld, oldContent);
-    (0, import_node_fs21.writeFileSync)(tmpNew, newContent);
+    (0, import_node_fs23.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
+    (0, import_node_fs23.writeFileSync)(tmpOld, oldContent);
+    (0, import_node_fs23.writeFileSync)(tmpNew, newContent);
     const result = (0, import_node_child_process7.execSync)(
       `git diff --no-index --unified=10 -- "${tmpOld}" "${tmpNew}"`,
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -17279,32 +17477,32 @@ function computeDiff(oldContent, newContent, filePath) {
     return null;
   } finally {
     try {
-      (0, import_node_fs21.unlinkSync)(tmpOld);
+      (0, import_node_fs23.unlinkSync)(tmpOld);
     } catch {
     }
     try {
-      (0, import_node_fs21.unlinkSync)(tmpNew);
+      (0, import_node_fs23.unlinkSync)(tmpNew);
     } catch {
     }
   }
 }
 function cleanStaleSnapshots(dir, keepSet) {
-  if (!(0, import_node_fs21.existsSync)(dir)) return;
+  if (!(0, import_node_fs23.existsSync)(dir)) return;
   try {
-    const entries = (0, import_node_fs21.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs23.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (dir === SNAPSHOT_DIR && (entry.name === ".diff-old.tmp" || entry.name === ".diff-new.tmp")) continue;
-      const fullPath = (0, import_node_path19.join)(dir, entry.name);
+      const fullPath = (0, import_node_path21.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
-          const remaining = (0, import_node_fs21.readdirSync)(fullPath);
-          if (remaining.length === 0) (0, import_node_fs21.rmdirSync)(fullPath);
+          const remaining = (0, import_node_fs23.readdirSync)(fullPath);
+          if (remaining.length === 0) (0, import_node_fs23.rmdirSync)(fullPath);
         } catch {
         }
       } else if (!keepSet.has(fullPath)) {
         try {
-          (0, import_node_fs21.unlinkSync)(fullPath);
+          (0, import_node_fs23.unlinkSync)(fullPath);
         } catch {
         }
       }
@@ -17323,20 +17521,20 @@ function sessionKey(sessionId) {
   return (0, import_node_crypto9.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path20.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path22.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path20.join)(dir, "manifest.json");
+  return (0, import_node_path22.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path20.join)(dir, "files", repoRelPath);
+  return (0, import_node_path22.join)(dir, "files", repoRelPath);
 }
 var CARRY_FILE = `${BASELINE_DIR}/.carry`;
 var CARRY_WINDOW_MS = 12e4;
 function writeCarry(sessionId, headSha) {
   try {
-    (0, import_node_fs22.mkdirSync)(projectPath(BASELINE_DIR), { recursive: true });
-    (0, import_node_fs22.writeFileSync)(
+    (0, import_node_fs24.mkdirSync)(projectPath(BASELINE_DIR), { recursive: true });
+    (0, import_node_fs24.writeFileSync)(
       projectPath(CARRY_FILE),
       JSON.stringify({ from_key: sessionKey(sessionId), head_sha: headSha, ts: Date.now() })
     );
@@ -17346,10 +17544,10 @@ function writeCarry(sessionId, headSha) {
 function claimCarry(newKey) {
   const carryPath = projectPath(CARRY_FILE);
   try {
-    if (!(0, import_node_fs22.existsSync)(carryPath)) return null;
-    const carry = JSON.parse((0, import_node_fs22.readFileSync)(carryPath, "utf-8"));
+    if (!(0, import_node_fs24.existsSync)(carryPath)) return null;
+    const carry = JSON.parse((0, import_node_fs24.readFileSync)(carryPath, "utf-8"));
     try {
-      (0, import_node_fs22.rmSync)(carryPath, { force: true });
+      (0, import_node_fs24.rmSync)(carryPath, { force: true });
     } catch {
     }
     if (!carry?.from_key || typeof carry.ts !== "number") return null;
@@ -17360,11 +17558,11 @@ function claimCarry(newKey) {
     if (!prior) return null;
     const toDir = sessionDir(newKey);
     try {
-      (0, import_node_fs22.rmSync)(toDir, { recursive: true, force: true });
+      (0, import_node_fs24.rmSync)(toDir, { recursive: true, force: true });
     } catch {
     }
-    (0, import_node_fs22.renameSync)(fromDir, toDir);
-    (0, import_node_fs22.writeFileSync)(manifestPath(toDir), JSON.stringify({ ...prior, session_id: newKey }) + "\n");
+    (0, import_node_fs24.renameSync)(fromDir, toDir);
+    (0, import_node_fs24.writeFileSync)(manifestPath(toDir), JSON.stringify({ ...prior, session_id: newKey }) + "\n");
     return readManifest(toDir);
   } catch {
     return null;
@@ -17388,21 +17586,21 @@ function captureBaseline(opts = {}) {
   const head_sha = getCurrentCommit();
   const dirty = getDirtyFiles();
   try {
-    (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path20.join)(dir, "files");
+  const filesDir = (0, import_node_path22.join)(dir, "files");
   const mirrored = [];
   try {
-    (0, import_node_fs22.mkdirSync)(filesDir, { recursive: true });
+    (0, import_node_fs24.mkdirSync)(filesDir, { recursive: true });
     for (const p of dirty) {
       if (p.includes("..")) continue;
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs22.mkdirSync)((0, import_node_path20.dirname)(dest), { recursive: true });
-        (0, import_node_fs22.writeFileSync)(dest, content);
+        (0, import_node_fs24.mkdirSync)((0, import_node_path22.dirname)(dest), { recursive: true });
+        (0, import_node_fs24.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
       }
@@ -17417,8 +17615,8 @@ function captureBaseline(opts = {}) {
     version: BASELINE_VERSION
   };
   try {
-    (0, import_node_fs22.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs22.writeFileSync)(manifestPath(dir), JSON.stringify(baseline));
+    (0, import_node_fs24.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs24.writeFileSync)(manifestPath(dir), JSON.stringify(baseline));
   } catch {
   }
   pruneOldBaselines();
@@ -17429,9 +17627,9 @@ function readBaseline(sessionId) {
 }
 function readManifest(dir) {
   const mp = manifestPath(dir);
-  if (!(0, import_node_fs22.existsSync)(mp)) return null;
+  if (!(0, import_node_fs24.existsSync)(mp)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs22.readFileSync)(mp, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs24.readFileSync)(mp, "utf-8"));
     if (typeof parsed.head_sha !== "string" || typeof parsed.captured_at !== "number" || !Array.isArray(parsed.dirty_paths) || parsed.version !== BASELINE_VERSION) {
       return null;
     }
@@ -17462,9 +17660,9 @@ function preImage(repoRelPath, baseline) {
 function resolvePreImage(repoRelPath, baseline) {
   if (baseline.dirty_paths.includes(repoRelPath)) {
     const mp = mirrorPath(sessionDir(sessionKey(baseline.session_id)), repoRelPath);
-    if ((0, import_node_fs22.existsSync)(mp)) {
+    if ((0, import_node_fs24.existsSync)(mp)) {
       try {
-        return { content: (0, import_node_fs22.readFileSync)(mp, "utf-8"), existed: true };
+        return { content: (0, import_node_fs24.readFileSync)(mp, "utf-8"), existed: true };
       } catch {
       }
     }
@@ -17509,8 +17707,8 @@ function absorbIntoBaseline(paths, sessionId) {
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
-      (0, import_node_fs22.mkdirSync)((0, import_node_path20.dirname)(dest), { recursive: true });
-      (0, import_node_fs22.writeFileSync)(dest, content);
+      (0, import_node_fs24.mkdirSync)((0, import_node_path22.dirname)(dest), { recursive: true });
+      (0, import_node_fs24.writeFileSync)(dest, content);
       dirty.add(p);
       adopted++;
     } catch {
@@ -17519,7 +17717,7 @@ function absorbIntoBaseline(paths, sessionId) {
   if (adopted === 0) return 0;
   try {
     const updated = { ...baseline, dirty_paths: [...dirty] };
-    (0, import_node_fs22.writeFileSync)(manifestPath(dir), JSON.stringify(updated));
+    (0, import_node_fs24.writeFileSync)(manifestPath(dir), JSON.stringify(updated));
     preImageCache.delete(baseline);
   } catch {
     return 0;
@@ -17530,7 +17728,7 @@ function changedSinceBaseline(repoRelPath, baseline) {
   const pre = preImage(repoRelPath, baseline);
   let current;
   try {
-    current = (0, import_node_fs22.readFileSync)(projectPath(repoRelPath), "utf-8");
+    current = (0, import_node_fs24.readFileSync)(projectPath(repoRelPath), "utf-8");
   } catch {
     return pre.existed;
   }
@@ -17539,8 +17737,8 @@ function changedSinceBaseline(repoRelPath, baseline) {
 }
 function safeReadForMirror(absPath) {
   try {
-    if ((0, import_node_fs22.statSync)(absPath).size > MIRROR_MAX_BYTES) return null;
-    const buf = (0, import_node_fs22.readFileSync)(absPath);
+    if ((0, import_node_fs24.statSync)(absPath).size > MIRROR_MAX_BYTES) return null;
+    const buf = (0, import_node_fs24.readFileSync)(absPath);
     if (buf.includes(0)) return null;
     return buf.toString("utf-8");
   } catch {
@@ -17551,18 +17749,18 @@ function pruneOldBaselines() {
   const root = projectPath(BASELINE_DIR);
   let entries;
   try {
-    entries = (0, import_node_fs22.readdirSync)(root);
+    entries = (0, import_node_fs24.readdirSync)(root);
   } catch {
     return;
   }
   const now = Date.now();
   for (const name of entries) {
-    const dir = (0, import_node_path20.join)(root, name);
+    const dir = (0, import_node_path22.join)(root, name);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
-        if (now - (0, import_node_fs22.statSync)(dir).mtimeMs > BASELINE_TTL_MS) {
-          (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
+        if (now - (0, import_node_fs24.statSync)(dir).mtimeMs > BASELINE_TTL_MS) {
+          (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
         }
       } catch {
       }
@@ -17570,7 +17768,7 @@ function pruneOldBaselines() {
     }
     if (now - manifest.captured_at <= BASELINE_TTL_MS) continue;
     try {
-      (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -17745,8 +17943,8 @@ function buildCompactionContext(session) {
     commitsSince: commitsSincePaths(watermark, (state.authored ?? []).map((a) => a.path)),
     readFileLines: (file) => {
       try {
-        const abs = (0, import_node_path21.join)(root, file);
-        return (0, import_node_fs23.existsSync)(abs) ? (0, import_node_fs23.readFileSync)(abs, "utf8").split("\n") : null;
+        const abs = (0, import_node_path23.join)(root, file);
+        return (0, import_node_fs25.existsSync)(abs) ? (0, import_node_fs25.readFileSync)(abs, "utf8").split("\n") : null;
       } catch {
         return null;
       }
@@ -17803,24 +18001,24 @@ async function readHookStdin() {
 
 // src/commands/standard.ts
 var import_promises13 = require("node:fs/promises");
-var import_node_fs30 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var import_yaml3 = __toESM(require_dist());
 
 // src/lib/synthesize.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs26 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 var import_promises10 = require("node:fs/promises");
-var import_node_path24 = require("node:path");
+var import_node_path26 = require("node:path");
 var import_yaml = __toESM(require_dist());
 
 // src/lib/data-dir.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
+var import_node_fs26 = require("node:fs");
+var import_node_path24 = require("node:path");
 function resolveDataDir() {
   const candidates2 = [
-    (0, import_node_path22.join)(__dirname, "..", "data"),
+    (0, import_node_path24.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path22.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path24.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
     // THE COMMITTED SOURCE, for a source checkout that has not been built.
     // cli/data/skills/ is a BUILD ARTIFACT (scripts/build.js copies client/skills
@@ -17829,14 +18027,14 @@ function resolveDataDir() {
     // without this the synthesizer throws "Could not find Verity skill data"
     // for every test and every `verity` run from source. Resolved from this
     // module's own location, never the cwd: see the warning below.
-    (0, import_node_path22.join)(__dirname, "..", "..", "client"),
+    (0, import_node_path24.join)(__dirname, "..", "..", "client"),
     // bundled: cli/bin/ → ../../client
-    (0, import_node_path22.join)(__dirname, "..", "..", "..", "client"),
+    (0, import_node_path24.join)(__dirname, "..", "..", "..", "client"),
     // tsx: cli/src/lib/ → ../../../client
     ...process.env.VERITY_DEV_DATA_DIR ? [process.env.VERITY_DEV_DATA_DIR] : []
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs24.existsSync)((0, import_node_path22.join)(candidate, "skills"))) {
+    if ((0, import_node_fs26.existsSync)((0, import_node_path24.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -17845,13 +18043,13 @@ function resolveDataDir() {
   );
 }
 function setupDataPath(file) {
-  return (0, import_node_path22.join)(resolveDataDir(), "skills", "verity-setup", file);
+  return (0, import_node_path24.join)(resolveDataDir(), "skills", "verity-setup", file);
 }
 
 // src/lib/detect.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs25 = require("node:fs");
-var import_node_path23 = require("node:path");
+var import_node_fs27 = require("node:fs");
+var import_node_path25 = require("node:path");
 var TOOLED_LANGUAGES = /* @__PURE__ */ new Set([
   "typescript",
   "javascript",
@@ -17908,25 +18106,25 @@ function walk(root) {
     if (depth > WALK_MAX_DEPTH || found.length >= WALK_MAX_FILES) return;
     let entries;
     try {
-      entries = (0, import_node_fs25.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs27.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (found.length >= WALK_MAX_FILES) return;
       if (IGNORED_SEGMENTS.includes(entry.name)) continue;
-      const full = (0, import_node_path23.join)(dir, entry.name);
+      const full = (0, import_node_path25.join)(dir, entry.name);
       if (entry.isDirectory()) visit(full, depth + 1);
-      else if (entry.isFile()) found.push((0, import_node_path23.relative)(root, full));
+      else if (entry.isFile()) found.push((0, import_node_path25.relative)(root, full));
     }
   };
   visit(root, 0);
   return found;
 }
 function languageOf(path) {
-  const name = (0, import_node_path23.basename)(path);
+  const name = (0, import_node_path25.basename)(path);
   if (/^Dockerfile(\..+)?$/i.test(name)) return "dockerfile";
-  if (!(0, import_node_path23.extname)(name)) return null;
+  if (!(0, import_node_path25.extname)(name)) return null;
   const lang = detectLanguage(path);
   return lang || null;
 }
@@ -17981,9 +18179,9 @@ var TOOL_CONFIG_MARKERS = [
   ["detekt", ["detekt.yml", "detekt.yaml"]],
   ["Hadolint", [".hadolint.yaml", ".hadolint.yml"]]
 ];
-function readJson(path) {
+function readJson2(path) {
   try {
-    return JSON.parse((0, import_node_fs25.readFileSync)(path, "utf-8"));
+    return JSON.parse((0, import_node_fs27.readFileSync)(path, "utf-8"));
   } catch {
     return null;
   }
@@ -18001,24 +18199,24 @@ var NESTED_MANIFEST_LIMIT = 25;
 function declaredDependencies(root, files) {
   const names2 = [];
   const readPackageJson = (path) => {
-    const pkg = readJson(path);
+    const pkg = readJson2(path);
     if (!pkg) return;
     for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
       const deps = pkg[field];
       if (deps && typeof deps === "object") names2.push(...Object.keys(deps));
     }
   };
-  readPackageJson((0, import_node_path23.join)(root, "package.json"));
-  const nested = files.filter((f) => f.includes("/") && (0, import_node_path23.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
-  for (const rel of nested) readPackageJson((0, import_node_path23.join)(root, rel));
+  readPackageJson((0, import_node_path25.join)(root, "package.json"));
+  const nested = files.filter((f) => f.includes("/") && (0, import_node_path25.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
+  for (const rel of nested) readPackageJson((0, import_node_path25.join)(root, rel));
   const pythonManifests = [
-    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path23.join)(root, f)),
-    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path23.join)(root, f))
+    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path25.join)(root, f)),
+    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path25.join)(root, f))
   ];
   for (const path of pythonManifests) {
-    if (!(0, import_node_fs25.existsSync)(path)) continue;
+    if (!(0, import_node_fs27.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs25.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs27.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/^\s*["']?([A-Za-z][A-Za-z0-9._-]+)/gm)) names2.push(m[1]);
       for (const line of text.split("\n")) {
         if (!/dependencies\s*=/.test(line)) continue;
@@ -18028,13 +18226,13 @@ function declaredDependencies(root, files) {
     }
   }
   const goMods = [
-    (0, import_node_path23.join)(root, "go.mod"),
-    ...files.filter((f) => f.includes("/") && (0, import_node_path23.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path23.join)(root, f))
+    (0, import_node_path25.join)(root, "go.mod"),
+    ...files.filter((f) => f.includes("/") && (0, import_node_path25.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path25.join)(root, f))
   ];
   for (const path of goMods) {
-    if (!(0, import_node_fs25.existsSync)(path)) continue;
+    if (!(0, import_node_fs27.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs25.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs27.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/^\s+([\w.-]+\/[\w./-]+)\s+v/gm)) {
         names2.push(m[1].replace(/^github\.com\//, ""));
       }
@@ -18042,10 +18240,10 @@ function declaredDependencies(root, files) {
     }
   }
   for (const file of ["pom.xml", "build.gradle", "build.gradle.kts", "Gemfile", "Cargo.toml"]) {
-    const path = (0, import_node_path23.join)(root, file);
-    if (!(0, import_node_fs25.existsSync)(path)) continue;
+    const path = (0, import_node_path25.join)(root, file);
+    if (!(0, import_node_fs27.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs25.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs27.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/["'<]([A-Za-z][A-Za-z0-9._-]{2,})["'>]/g)) names2.push(m[1]);
     } catch {
     }
@@ -18053,7 +18251,7 @@ function declaredDependencies(root, files) {
   return names2;
 }
 function detectBuildSystem(root, files) {
-  const has = (f) => (0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, f)) || files.some((p) => (0, import_node_path23.basename)(p) === f);
+  const has = (f) => (0, import_node_fs27.existsSync)((0, import_node_path25.join)(root, f)) || files.some((p) => (0, import_node_path25.basename)(p) === f);
   if (has("pnpm-lock.yaml")) return "pnpm";
   if (has("yarn.lock")) return "yarn";
   if (has("bun.lock") || has("bun.lockb")) return "bun";
@@ -18070,8 +18268,8 @@ function detectBuildSystem(root, files) {
 }
 function detectArchitecture(root, files) {
   const workspaceMarkers = ["lerna.json", "pnpm-workspace.yaml", "nx.json", "turbo.json", "rush.json"];
-  if (workspaceMarkers.some((m) => (0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, m)))) return "monorepo";
-  const pkg = readJson((0, import_node_path23.join)(root, "package.json"));
+  if (workspaceMarkers.some((m) => (0, import_node_fs27.existsSync)((0, import_node_path25.join)(root, m)))) return "monorepo";
+  const pkg = readJson2((0, import_node_path25.join)(root, "package.json"));
   if (pkg && "workspaces" in pkg) return "monorepo";
   const manifests = files.filter((f) => /(^|\/)(package\.json|go\.mod|pyproject\.toml|Cargo\.toml|pom\.xml)$/.test(f));
   const nested = manifests.filter((f) => f.includes("/"));
@@ -18093,10 +18291,10 @@ function measureAvgFileLength(root, files, languages) {
   let total = 0;
   let counted = 0;
   for (let i = 0; i < candidates2.length; i += stride) {
-    const path = (0, import_node_path23.join)(root, candidates2[i]);
+    const path = (0, import_node_path25.join)(root, candidates2[i]);
     try {
-      if ((0, import_node_fs25.statSync)(path).size > 2 * 1024 * 1024) continue;
-      total += (0, import_node_fs25.readFileSync)(path, "utf-8").split("\n").length;
+      if ((0, import_node_fs27.statSync)(path).size > 2 * 1024 * 1024) continue;
+      total += (0, import_node_fs27.readFileSync)(path, "utf-8").split("\n").length;
       counted++;
     } catch {
     }
@@ -18126,14 +18324,14 @@ function detectProject(root = repoRoot()) {
   const existingToolConfigs = [];
   for (const [tool, markers] of TOOL_CONFIG_MARKERS) {
     for (const marker of markers) {
-      if ((0, import_node_fs25.existsSync)((0, import_node_path23.join)(root, marker))) {
+      if ((0, import_node_fs27.existsSync)((0, import_node_path25.join)(root, marker))) {
         existingToolConfigs.push({ tool, path: `./${marker}` });
         break;
       }
     }
   }
   return {
-    projectName: (0, import_node_path23.basename)(root),
+    projectName: (0, import_node_path25.basename)(root),
     languages,
     languageCounts,
     frameworks: matchAll(dependencies, FRAMEWORK_BY_DEPENDENCY),
@@ -18231,8 +18429,8 @@ ${closingNote(input.origin)}
 
 // src/lib/synthesize.ts
 function loadCatalog() {
-  const catalog = (0, import_yaml.parse)((0, import_node_fs26.readFileSync)(setupDataPath("patterns-reference.yaml"), "utf-8"));
-  const template = (0, import_yaml.parse)((0, import_node_fs26.readFileSync)(setupDataPath("standard-template.yaml"), "utf-8"));
+  const catalog = (0, import_yaml.parse)((0, import_node_fs28.readFileSync)(setupDataPath("patterns-reference.yaml"), "utf-8"));
+  const template = (0, import_yaml.parse)((0, import_node_fs28.readFileSync)(setupDataPath("standard-template.yaml"), "utf-8"));
   return { catalog, template };
 }
 function selectTools(languages, intensity, catalog) {
@@ -18510,7 +18708,7 @@ function validatePatternIds() {
 }
 async function runSynthesis(opts) {
   const standardPath = projectPath(STANDARD_FILE);
-  if ((0, import_node_fs26.existsSync)(standardPath) && !opts.force) {
+  if ((0, import_node_fs28.existsSync)(standardPath) && !opts.force) {
     return { refused: `${STANDARD_FILE} already exists \u2014 pass --force to replace it.` };
   }
   const detected = opts.detected ?? detectProject();
@@ -18577,9 +18775,9 @@ async function correctVerityMdVersion(opts) {
     origin: { kind: "synthesized", tools: opts.tools }
   }));
 }
-async function writeFileTo(relative2, body) {
-  const target = projectPath(relative2);
-  await (0, import_promises10.mkdir)((0, import_node_path24.dirname)(target), { recursive: true });
+async function writeFileTo(relative3, body) {
+  const target = projectPath(relative3);
+  await (0, import_promises10.mkdir)((0, import_node_path26.dirname)(target), { recursive: true });
   await (0, import_promises10.writeFile)(target, body);
 }
 async function deriveConfigForStandard(standard) {
@@ -18638,11 +18836,11 @@ ${validation.detail}`);
 
 // src/lib/setup-state.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_fs27 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
 async function readSetupState() {
   const path = projectPath(SETUP_STATE_FILE);
-  if (!(0, import_node_fs27.existsSync)(path)) return null;
+  if (!(0, import_node_fs29.existsSync)(path)) return null;
   try {
     const parsed = JSON.parse(await (0, import_promises11.readFile)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
@@ -18658,12 +18856,12 @@ async function writeSetupState(patch) {
 }
 
 // src/lib/push-setup.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_promises12 = require("node:fs/promises");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/verityignore.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var EMPTY = { rules: [], securityOverlap: [], problems: [] };
 var SECURITY_PROBES = [
   ".env",
@@ -18756,9 +18954,9 @@ function isIgnored3(ig, path) {
 }
 function loadVerityIgnore() {
   const file = projectPath(VERITYIGNORE_FILE);
-  if (!(0, import_node_fs28.existsSync)(file)) return EMPTY;
+  if (!(0, import_node_fs30.existsSync)(file)) return EMPTY;
   try {
-    return parseVerityIgnore((0, import_node_fs28.readFileSync)(file, "utf-8"));
+    return parseVerityIgnore((0, import_node_fs30.readFileSync)(file, "utf-8"));
   } catch {
     return EMPTY;
   }
@@ -18796,9 +18994,9 @@ function buildStandardUpload(standard, ignoreRaw) {
 }
 function readVerityIgnoreRaw() {
   const file = projectPath(VERITYIGNORE_FILE);
-  if (!(0, import_node_fs28.existsSync)(file)) return null;
+  if (!(0, import_node_fs30.existsSync)(file)) return null;
   try {
-    return (0, import_node_fs28.readFileSync)(file, "utf-8");
+    return (0, import_node_fs30.readFileSync)(file, "utf-8");
   } catch {
     return null;
   }
@@ -18826,7 +19024,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   }
   let standardVersion = null;
   const standardPath = projectPath(STANDARD_FILE);
-  if (pushStandard && (0, import_node_fs29.existsSync)(standardPath)) {
+  if (pushStandard && (0, import_node_fs31.existsSync)(standardPath)) {
     try {
       const content = (0, import_yaml2.parse)(await (0, import_promises12.readFile)(standardPath, "utf-8"));
       const upload = buildStandardUpload(content, readVerityIgnoreRaw());
@@ -18851,7 +19049,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   }
   let configPushed = false;
   const configPath = projectPath(CODACY_CONFIG_FILE);
-  if (pushConfig && (0, import_node_fs29.existsSync)(configPath)) {
+  if (pushConfig && (0, import_node_fs31.existsSync)(configPath)) {
     try {
       const content = JSON.parse(await (0, import_promises12.readFile)(configPath, "utf-8"));
       const result = await apiRequest({
@@ -18883,7 +19081,7 @@ function registerStandardCommands(program2) {
     const state = await readSetupState();
     if (opts.configOnly) {
       const standardPath = projectPath(STANDARD_FILE);
-      if (!(0, import_node_fs30.existsSync)(standardPath)) {
+      if (!(0, import_node_fs32.existsSync)(standardPath)) {
         printError(`No ${STANDARD_FILE} here \u2014 run "verity standard synthesize" to create one.`);
         process.exit(1);
       }
@@ -19195,7 +19393,9 @@ function formatRunDetail(run2) {
       if (f.description && f.description !== title) lines.push(`      ${f.description}`);
       const fix = f.fix?.description ?? f.suggestion;
       if (fix) lines.push(`      \u21B3 fix: ${fix}`);
-      if (f.scope === "pre-existing") lines.push("      (pre-existing)");
+      if (f.scope === "pre-existing") {
+        lines.push(f.provenance === "caused-elsewhere" ? "      (caused elsewhere \u2014 not by this change)" : "      (pre-existing)");
+      }
     }
   }
   const pending = run2.pending_items ?? [];
@@ -19214,10 +19414,10 @@ function formatRunDetail(run2) {
 }
 
 // src/lib/ignore-declaration.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 
 // src/lib/debounce.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var import_node_crypto10 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
@@ -19225,9 +19425,9 @@ function scopedFile(base, sessionId) {
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs31.existsSync)(file)) return null;
+  if (!(0, import_node_fs33.existsSync)(file)) return null;
   try {
-    const lastTs = parseInt((0, import_node_fs31.readFileSync)(file, "utf-8").trim(), 10);
+    const lastTs = parseInt((0, import_node_fs33.readFileSync)(file, "utf-8").trim(), 10);
     const nowTs = Math.floor(Date.now() / 1e3);
     const elapsed = nowTs - lastTs;
     if (elapsed < debounceSeconds) {
@@ -19240,10 +19440,10 @@ function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
 function checkMtime(files, bypassForRecentCommits, sessionId) {
   if (bypassForRecentCommits) return null;
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs31.existsSync)(file)) return null;
+  if (!(0, import_node_fs33.existsSync)(file)) return null;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs31.statSync)(file).mtimeMs;
+    debounceTime = (0, import_node_fs33.statSync)(file).mtimeMs;
   } catch {
     return null;
   }
@@ -19251,7 +19451,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
     const resolved = resolveFile(f);
     if (!resolved) continue;
     try {
-      const stat3 = (0, import_node_fs31.statSync)(resolved);
+      const stat3 = (0, import_node_fs33.statSync)(resolved);
       if (stat3.mtimeMs > debounceTime) {
         return null;
       }
@@ -19267,8 +19467,8 @@ function computeContentHash(files) {
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
     try {
-      if ((0, import_node_fs31.existsSync)(resolved)) {
-        hash.update((0, import_node_fs31.readFileSync)(resolved));
+      if ((0, import_node_fs33.existsSync)(resolved)) {
+        hash.update((0, import_node_fs33.readFileSync)(resolved));
       }
     } catch {
     }
@@ -19278,9 +19478,9 @@ function computeContentHash(files) {
 function checkContentHash(files, sessionId) {
   const hash = computeContentHash(files);
   const file = scopedFile(HASH_FILE, sessionId);
-  if ((0, import_node_fs31.existsSync)(file)) {
+  if ((0, import_node_fs33.existsSync)(file)) {
     try {
-      const storedHash = (0, import_node_fs31.readFileSync)(file, "utf-8").trim();
+      const storedHash = (0, import_node_fs33.readFileSync)(file, "utf-8").trim();
       if (hash === storedHash) {
         return { skip: "No source changes since last analysis", hash };
       }
@@ -19290,24 +19490,24 @@ function checkContentHash(files, sessionId) {
   return { skip: null, hash };
 }
 function recordAnalysisStart(sessionId) {
-  (0, import_node_fs31.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs31.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
+  (0, import_node_fs33.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs33.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
 }
 function recordPassHash(hash, sessionId) {
-  (0, import_node_fs31.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
+  (0, import_node_fs33.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
 }
 function narrowToRecent(files, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs31.existsSync)(file)) return files;
+  if (!(0, import_node_fs33.existsSync)(file)) return files;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs31.statSync)(file).mtimeMs;
+    debounceTime = (0, import_node_fs33.statSync)(file).mtimeMs;
   } catch {
     return files;
   }
   const recent = files.filter((f) => {
     try {
-      return (0, import_node_fs31.existsSync)(f) && (0, import_node_fs31.statSync)(f).mtimeMs > debounceTime;
+      return (0, import_node_fs33.existsSync)(f) && (0, import_node_fs33.statSync)(f).mtimeMs > debounceTime;
     } catch {
       return false;
     }
@@ -19320,9 +19520,9 @@ function readIteration(currentCommit, _contentHash) {
 var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
 function readBlockState(currentCommit, opts) {
   if (opts?.newUserPrompt) return NO_BLOCKS;
-  if (!(0, import_node_fs31.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
+  if (!(0, import_node_fs33.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
   try {
-    const stored = (0, import_node_fs31.readFileSync)(ITERATION_FILE, "utf-8").trim();
+    const stored = (0, import_node_fs33.readFileSync)(ITERATION_FILE, "utf-8").trim();
     const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
     if (!parsed) return NO_BLOCKS;
     if (parsed.commit !== currentCommit) return NO_BLOCKS;
@@ -19368,8 +19568,8 @@ function isSameProblem(previous, current) {
   return current.split(",").some((k) => prev.has(k));
 }
 function writeBlockState(commit, state) {
-  (0, import_node_fs31.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs31.writeFileSync)(
+  (0, import_node_fs33.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs33.writeFileSync)(
     ITERATION_FILE,
     JSON.stringify({
       v: 2,
@@ -19474,9 +19674,9 @@ function resolveIgnoreState(keys) {
 }
 function readIgnoreState(sessionId) {
   const file = stateFile(sessionId);
-  if (!(0, import_node_fs32.existsSync)(file)) return null;
+  if (!(0, import_node_fs34.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs32.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs34.readFileSync)(file, "utf-8")) ?? {};
     const spent = typeof o.spent === "number" ? o.spent : 0;
     const raw = o.active;
     let active = null;
@@ -19500,8 +19700,8 @@ function readIgnoreState(sessionId) {
 }
 function writeIgnoreState(state, sessionId) {
   try {
-    (0, import_node_fs32.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
-    (0, import_node_fs32.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
+    (0, import_node_fs34.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs34.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
   } catch {
   }
 }
@@ -19884,15 +20084,15 @@ function createRun(opts, globals) {
 }
 
 // src/commands/analyze/index.ts
-var import_node_fs45 = require("node:fs");
+var import_node_fs47 = require("node:fs");
 
 // src/lib/repo-context.ts
 var import_node_child_process10 = require("node:child_process");
-var import_node_os4 = require("node:os");
+var import_node_os5 = require("node:os");
 function rgInvocations(env = process.env) {
   const out = [{ cmd: "rg" }];
   if (env.CLAUDE_CODE_EXECPATH) out.push({ cmd: env.CLAUDE_CODE_EXECPATH, argv0: "rg" });
-  out.push({ cmd: `${(0, import_node_os4.homedir)()}/.local/bin/claude`, argv0: "rg" });
+  out.push({ cmd: `${(0, import_node_os5.homedir)()}/.local/bin/claude`, argv0: "rg" });
   return out;
 }
 function ripgrepEnv(base = process.env) {
@@ -20395,6 +20595,112 @@ function partitionSites(rgLines, symbols, opts) {
   while (callers.length + tests.length > MAX_SITES) callers.pop();
   return { callers, tests, dropped };
 }
+var MAX_IMPORTERS = 12;
+var MAX_IMPORTERS_PER_FILE = 2;
+function moduleKey(path) {
+  return path.replace(/\.(ts|tsx|js|jsx|mjs|cjs|mts|cts)$/i, "").replace(/\/index$/, "");
+}
+function importSpecifier(text) {
+  const m = /(?:\bfrom|\brequire\s*\(|\bimport\s*\(|^\s*import)\s*['"]([^'"\n]+)['"]/.exec(text);
+  return m?.[1] ?? null;
+}
+function resolveSpecifier(fromFile, spec) {
+  if (!spec.startsWith(".")) return null;
+  const dir = fromFile.includes("/") ? fromFile.slice(0, fromFile.lastIndexOf("/")) : "";
+  const out = [];
+  for (const part of (dir ? dir.split("/") : []).concat(spec.split("/"))) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") {
+      if (out.length === 0) return null;
+      out.pop();
+      continue;
+    }
+    out.push(part);
+  }
+  return out.length > 0 ? moduleKey(out.join("/")) : null;
+}
+function partitionImporters(rgLines, changedPaths, opts) {
+  const changedByKey = /* @__PURE__ */ new Map();
+  for (const p of changedPaths) changedByKey.set(moduleKey(p), p);
+  const hits = rgLines.map(parseRgLine).filter((h) => h !== null);
+  hits.sort((a, b) => a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line);
+  const perFile = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const h of hits) {
+    if (out.length >= MAX_IMPORTERS) break;
+    if (opts.sentPaths.has(h.file)) continue;
+    if (opts.isExcluded(h.file)) continue;
+    if (!isCodeSiteFile(h.file)) continue;
+    const spec = importSpecifier(h.text);
+    if (!spec) continue;
+    const resolved = resolveSpecifier(h.file, spec);
+    if (!resolved) continue;
+    const changed = changedByKey.get(resolved);
+    if (!changed) continue;
+    const used = perFile.get(h.file) ?? 0;
+    if (used >= MAX_IMPORTERS_PER_FILE) continue;
+    perFile.set(h.file, used + 1);
+    out.push({ file: h.file, line: h.line, text: h.text.trim().slice(0, SITE_TEXT_MAX), symbol: changed });
+  }
+  return out;
+}
+function runRg(args, cwd, timeoutMs) {
+  let res = null;
+  for (const inv of rgInvocations()) {
+    res = (0, import_node_child_process10.spawnSync)(inv.cmd, args, {
+      ...inv.argv0 ? { argv0: inv.argv0 } : {},
+      cwd,
+      env: ripgrepEnv(),
+      timeout: timeoutMs,
+      maxBuffer: 4 * 1024 * 1024,
+      encoding: "utf8"
+    });
+    if (res.error?.code !== "ENOENT") break;
+  }
+  if (!res || res.error?.code === "ENOENT") {
+    return { ok: false, reason: "no-tool" };
+  }
+  if (res.error) {
+    const code = res.error.code;
+    return { ok: false, reason: code === "ETIMEDOUT" ? "timeout" : "error" };
+  }
+  if (res.signal) return { ok: false, reason: "timeout" };
+  if (res.status !== 0 && res.status !== 1) return { ok: false, reason: "error" };
+  return { ok: true, lines: (res.stdout ?? "").split("\n").map((l) => l.replace(/^\.\//, "")).filter(Boolean) };
+}
+function findImporters(input) {
+  const basenames = [
+    ...new Set(input.changedPaths.map((p) => moduleKey(p).split("/").pop() ?? "").filter((b) => b.length > 0))
+  ].slice(0, MAX_SYMBOLS);
+  if (basenames.length === 0) return [];
+  const res = runRg(
+    [
+      "--no-config",
+      "-n",
+      "-w",
+      "-F",
+      "--no-heading",
+      "--color",
+      "never",
+      "-m",
+      "8",
+      "--max-columns",
+      "300",
+      "--max-columns-preview",
+      ...basenames.flatMap((b) => ["-e", b]),
+      "-g",
+      "!**/{dist,build,out,vendor,node_modules,.git,coverage,target,__pycache__}/**",
+      "./"
+    ],
+    input.cwd,
+    input.timeoutMs
+  );
+  if (!res.ok) return [];
+  return partitionImporters(res.lines, input.changedPaths, {
+    sentPaths: input.sentPaths,
+    isExcluded: input.isExcluded
+  });
+}
 function buildRepoContext(input) {
   const started = Date.now();
   let signalsByPath;
@@ -20429,7 +20735,18 @@ function buildRepoContext(input) {
   const unsupportedExts = [...unsupported].sort().slice(0, 8);
   const audit = unsupportedExts.length > 0 ? { unsupported_exts: unsupportedExts } : {};
   const symbols = rankSymbols([...new Set(collected)]);
+  const changedPaths = [.../* @__PURE__ */ new Set([...signalsByPath.keys(), ...input.deltaFiles.map((f) => f.path)])];
+  const importers = findImporters({
+    changedPaths,
+    sentPaths: input.sentPaths,
+    isExcluded: input.isExcluded,
+    cwd: input.cwd ?? process.cwd(),
+    timeoutMs: input.timeoutMs ?? RG_TIMEOUT_MS
+  });
   if (symbols.length === 0) {
+    if (importers.length > 0) {
+      return { state: "ok", symbols: [], ...audit, callers: [], tests: [], importers, elapsed_ms: Date.now() - started };
+    }
     const everySupportedFileFoundNothing = unsupportedExts.length > 0;
     return {
       state: "absent",
@@ -20468,34 +20785,19 @@ function buildRepoContext(input) {
     "!**/{dist,build,out,vendor,node_modules,.git,coverage,target,__pycache__}/**",
     "./"
   ];
-  let res = null;
-  for (const inv of rgInvocations()) {
-    res = (0, import_node_child_process10.spawnSync)(inv.cmd, args, {
-      ...inv.argv0 ? { argv0: inv.argv0 } : {},
-      cwd: input.cwd ?? process.cwd(),
-      env: ripgrepEnv(),
-      timeout: input.timeoutMs ?? RG_TIMEOUT_MS,
-      maxBuffer: 4 * 1024 * 1024,
-      encoding: "utf8"
-    });
-    if (res.error?.code !== "ENOENT") break;
-  }
-  if (!res || res.error?.code === "ENOENT") {
-    return { state: "absent", reason: "no-tool", symbols, ...audit };
-  }
-  if (res.error) {
-    const code = res.error.code;
-    if (code === "ETIMEDOUT") return { state: "absent", reason: "timeout", symbols, ...audit };
-    return { state: "absent", reason: "error", symbols, ...audit };
+  const res = runRg(args, input.cwd ?? process.cwd(), input.timeoutMs ?? RG_TIMEOUT_MS);
+  if (!res.ok) {
+    if (importers.length > 0) {
+      return { state: "ok", symbols, ...audit, callers: [], tests: [], importers, elapsed_ms: Date.now() - started };
+    }
+    return { state: "absent", reason: res.reason, symbols, ...audit };
   }
-  if (res.signal) return { state: "absent", reason: "timeout", symbols, ...audit };
-  if (res.status !== 0 && res.status !== 1) return { state: "absent", reason: "error", symbols, ...audit };
-  const lines = (res.stdout ?? "").split("\n").map((l) => l.replace(/^\.\//, "")).filter(Boolean);
+  const lines = res.lines;
   const { callers, tests, dropped } = partitionSites(lines, symbols, {
     sentPaths: input.sentPaths,
     isExcluded: input.isExcluded
   });
-  if (callers.length === 0 && tests.length === 0) {
+  if (callers.length === 0 && tests.length === 0 && importers.length === 0) {
     return {
       state: "absent",
       reason: "no-sites",
@@ -20512,6 +20814,7 @@ function buildRepoContext(input) {
     ...audit,
     callers,
     tests,
+    ...importers.length > 0 ? { importers } : {},
     elapsed_ms: Date.now() - started
   };
 }
@@ -20579,12 +20882,17 @@ function upgradeToExcerpts(rc, opts) {
 }
 function describeRepoContext(rc) {
   if (rc.state !== "ok") {
-    const exts = rc.unsupported_exts?.length ? ` \xB7 no rules for: ${rc.unsupported_exts.join(", ")}` : "";
-    return `absent (${rc.reason ?? "unknown"})${exts}`;
+    const bits = [
+      rc.symbols?.length ? `searched: ${rc.symbols.join(", ")}` : "",
+      rc.dropped_symbols?.length ? `dropped too-common: ${rc.dropped_symbols.join(", ")}` : "",
+      rc.unsupported_exts?.length ? `no rules for: ${rc.unsupported_exts.join(", ")}` : ""
+    ].filter(Boolean);
+    return `absent (${rc.reason ?? "unknown"})${bits.length > 0 ? ` \xB7 ${bits.join(" \xB7 ")}` : ""}`;
   }
   const parts = [
     `${rc.symbols?.length ?? 0} symbol(s) \u2192 ${rc.callers?.length ?? 0} caller(s) \xB7 ${rc.tests?.length ?? 0} test(s)`
   ];
+  if (rc.importers?.length) parts.push(`${rc.importers.length} importer(s)`);
   if (rc.excerpts?.length) parts.push(`${rc.excerpts.length} excerpt(s)`);
   if (rc.dropped_symbols?.length) parts.push(`dropped too-common: ${rc.dropped_symbols.join(", ")}`);
   if (rc.unsupported_exts?.length) parts.push(`no rules for: ${rc.unsupported_exts.join(", ")}`);
@@ -20712,10 +21020,10 @@ function installRunEvidence(run2) {
 }
 
 // src/lib/git-frame.ts
-var import_node_fs33 = require("node:fs");
-var import_node_os5 = require("node:os");
-var import_node_path25 = require("node:path");
-var import_node_path26 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_os6 = require("node:os");
+var import_node_path27 = require("node:path");
+var import_node_path28 = require("node:path");
 
 // src/lib/hardened-git.ts
 var import_node_child_process11 = require("node:child_process");
@@ -20870,15 +21178,15 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     if (!m) continue;
     named = true;
     if (m[1] === void 0) {
-      dir = (0, import_node_os5.homedir)();
+      dir = (0, import_node_os6.homedir)();
       continue;
     }
     const raw = unquote(m[1]);
     if (SHELL_DYNAMIC.test(raw) || raw === "-") {
       return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
     }
-    const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path26.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
-    dir = (0, import_node_path25.isAbsolute)(expanded) ? expanded : (0, import_node_path25.resolve)(dir, expanded);
+    const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path28.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
+    dir = (0, import_node_path27.isAbsolute)(expanded) ? expanded : (0, import_node_path27.resolve)(dir, expanded);
   }
   const seg = segments[segmentIndex];
   const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
@@ -20896,8 +21204,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
       if (SHELL_DYNAMIC.test(raw)) {
         return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
       }
-      const expanded = raw === "~" ? (0, import_node_os5.homedir)() : raw.startsWith("~/") ? (0, import_node_path26.join)((0, import_node_os5.homedir)(), raw.slice(2)) : raw;
-      dir = (0, import_node_path25.isAbsolute)(expanded) ? expanded : (0, import_node_path25.resolve)(dir, expanded);
+      const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path28.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
+      dir = (0, import_node_path27.isAbsolute)(expanded) ? expanded : (0, import_node_path27.resolve)(dir, expanded);
     }
   }
   return { dir, named, unresolvable: null };
@@ -20957,14 +21265,14 @@ function gitAt(dir, args) {
 }
 function realpathOr2(p) {
   try {
-    return import_node_fs33.realpathSync.native(p);
+    return import_node_fs35.realpathSync.native(p);
   } catch {
-    return (0, import_node_path25.resolve)(p);
+    return (0, import_node_path27.resolve)(p);
   }
 }
 function resolveFrame(input) {
   const found = findMomentSegment(input.command, input.on);
-  const hookDirUsable = !!input.hookCwd && (0, import_node_fs33.existsSync)(input.hookCwd);
+  const hookDirUsable = !!input.hookCwd && (0, import_node_fs35.existsSync)(input.hookCwd);
   const baseDir = hookDirUsable ? input.hookCwd : process.cwd();
   let anchor = hookDirUsable ? "hook-cwd" : "process-cwd";
   const refuse = (refusal) => ({
@@ -20987,7 +21295,7 @@ function resolveFrame(input) {
     if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
     const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
     if (targetDir !== baseDir) {
-      if (!(0, import_node_fs33.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      if (!(0, import_node_fs35.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
       dir = targetDir;
     }
   }
@@ -20998,7 +21306,7 @@ function resolveFrame(input) {
   const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
   const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
   const gitDir = gitDirRaw ? realpathOr2(gitDirRaw) : null;
-  const commonDir = commonRaw ? realpathOr2((0, import_node_path25.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path25.resolve)(dir, commonRaw)) : null;
+  const commonDir = commonRaw ? realpathOr2((0, import_node_path27.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path27.resolve)(dir, commonRaw)) : null;
   const branchRaw = gitAt(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   return {
     moment: found?.moment ?? null,
@@ -21173,8 +21481,8 @@ function stagedRange(frame, command) {
   if (plan.kind === "unpredictable") {
     return { kind: "staged", base: "HEAD", head: "INDEX", via: "staged-in-command", refusal: plan.reason };
   }
-  const mergeHead = frame.gitDir ? (0, import_node_path26.join)(frame.gitDir, "MERGE_HEAD") : null;
-  if (mergeHead && (0, import_node_fs33.existsSync)(mergeHead)) {
+  const mergeHead = frame.gitDir ? (0, import_node_path28.join)(frame.gitDir, "MERGE_HEAD") : null;
+  if (mergeHead && (0, import_node_fs35.existsSync)(mergeHead)) {
     const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
     const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
     const resolutions = new Set([...vsHead].filter((f) => vsMerge.has(f) && !isVerityOwnedPath(f)));
@@ -21308,7 +21616,7 @@ function truthy(v) {
 }
 
 // src/lib/transcript.ts
-var import_node_fs34 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
 var SMALL_FILE_BYTES = 64 * 1024;
 var MAX_FILES_LIST = 20;
@@ -21335,7 +21643,7 @@ async function extractActionSummary(transcriptPath) {
 function readTurnLines(transcriptPath) {
   let size;
   try {
-    size = (0, import_node_fs34.statSync)(transcriptPath).size;
+    size = (0, import_node_fs36.statSync)(transcriptPath).size;
   } catch {
     return null;
   }
@@ -21343,7 +21651,7 @@ function readTurnLines(transcriptPath) {
   let raw;
   let windowed = false;
   if (size <= SMALL_FILE_BYTES) {
-    raw = (0, import_node_fs34.readFileSync)(transcriptPath, "utf-8");
+    raw = (0, import_node_fs36.readFileSync)(transcriptPath, "utf-8");
   } else {
     windowed = true;
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
@@ -21851,7 +22159,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.0-experimental.d60f544" : "dev";
+    return true ? "0.33.1-experimental.1378de3" : "dev";
   } catch {
     return "dev";
   }
@@ -21892,7 +22200,7 @@ async function sendSkipBeacon(ctx, reason) {
 
 // src/lib/static-analysis.ts
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs35 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 var SEVERITY_ORDER = {
   Error: 0,
   Critical: 0,
@@ -21903,12 +22211,10 @@ var SEVERITY_ORDER = {
   Low: 3
 };
 function isCodacyAvailable() {
-  try {
-    (0, import_node_child_process12.execSync)("which codacy-analysis", { stdio: "pipe" });
-    return true;
-  } catch {
-    return false;
-  }
+  return codacyAnalysisPath() !== null;
+}
+function codacyAnalysisPath() {
+  return whichSync("codacy-analysis");
 }
 function buildAnalyzerArgv(files) {
   return [
@@ -21935,18 +22241,29 @@ function withFailure(kind, detail) {
     summary: { ...EMPTY_RESULT.summary, failure: { kind, detail: detail.slice(0, 300) } }
   };
 }
+function runCodacyAnalysisIfAvailable(files) {
+  if (files.length === 0) return EMPTY_RESULT;
+  if (!isCodacyAvailable()) {
+    return withFailure(
+      "analyzer_unavailable",
+      "@codacy/analysis-cli was not found on PATH \u2014 no static analysis ran"
+    );
+  }
+  return runCodacyAnalysis(files);
+}
 function runCodacyAnalysis(files) {
   const empty = EMPTY_RESULT;
   if (files.length === 0) return empty;
   const existingFiles = files.filter((f) => {
     try {
-      return (0, import_node_fs35.existsSync)(f);
+      return (0, import_node_fs37.existsSync)(f);
     } catch {
       return false;
     }
   });
   if (existingFiles.length === 0) return empty;
-  const proc = (0, import_node_child_process12.spawnSync)("codacy-analysis", buildAnalyzerArgv(existingFiles), {
+  const analyzer = codacyAnalysisPath() ?? "codacy-analysis";
+  const proc = (0, import_node_child_process12.spawnSync)(analyzer, buildAnalyzerArgv(existingFiles), {
     encoding: "utf-8",
     maxBuffer: 10 * 1024 * 1024
   });
@@ -22114,11 +22431,10 @@ var EMPTY_STATIC = {
   summary: { total_findings: 0, by_severity: {}, tools_run: [] }
 };
 function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
-  if (skipStatic || !isCodacyAvailable()) return EMPTY_STATIC;
+  if (skipStatic) return EMPTY_STATIC;
   let scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
   if (baseline) scannable = scannable.filter((f) => changedSinceBaseline(f, baseline));
-  if (scannable.length === 0) return EMPTY_STATIC;
-  return runCodacyAnalysis(scannable);
+  return runCodacyAnalysisIfAvailable(scannable);
 }
 function localOnlyAndExit(staticResults) {
   printJsonCompact({
@@ -22209,8 +22525,8 @@ async function scope(run2) {
 }
 
 // src/lib/specs.ts
-var import_node_fs36 = require("node:fs");
-var import_node_path27 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_path29 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -22229,6 +22545,16 @@ var SPEC_CANDIDATES = [
 var DOC_EXT = /\.(md|mdx|ya?ml|txt|rst|adoc)$/i;
 var UNCONSULTED_FILE_BYTES = 10240;
 var UNCONSULTED_TOTAL_BYTES = 30720;
+function readSpecFiles(specsOpt, root) {
+  const out = [];
+  for (const raw of specsOpt.split(",").map((f) => f.trim()).filter(Boolean)) {
+    const candidate = (0, import_node_path29.isAbsolute)(raw) ? (0, import_node_path29.relative)(root, raw) : raw;
+    const content = readFileInside(root, candidate, MAX_EXPLICIT_SPEC_FILE_BYTES);
+    if (content === null) continue;
+    out.push({ path: raw, content });
+  }
+  return out;
+}
 function discoverSpecs(consulted = []) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
@@ -22241,7 +22567,7 @@ function discoverSpecs(consulted = []) {
     const totalCap = relevant ? MAX_TOTAL_SPEC_BYTES : UNCONSULTED_TOTAL_BYTES;
     if (totalBytes >= totalCap) return false;
     if (seen.has(specPath)) return true;
-    if (!(0, import_node_fs36.existsSync)(specPath)) return true;
+    if (!(0, import_node_fs38.existsSync)(specPath)) return true;
     seen.add(specPath);
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
@@ -22264,7 +22590,7 @@ function discoverSpecs(consulted = []) {
     if (!addSpec(candidate)) break;
   }
   for (const dir of ["spec", "docs"]) {
-    if (!(0, import_node_fs36.existsSync)(dir)) continue;
+    if (!(0, import_node_fs38.existsSync)(dir)) continue;
     try {
       const mdFiles = findMdFiles(dir, 2).sort();
       for (const mdFile of mdFiles) {
@@ -22279,9 +22605,9 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   if (depth >= maxDepth) return [];
   const result = [];
   try {
-    const entries = (0, import_node_fs36.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs38.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path27.join)(dir, entry.name);
+      const fullPath = (0, import_node_path29.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -22294,25 +22620,25 @@ function findMdFiles(dir, maxDepth, depth = 0) {
 }
 function discoverPlans() {
   const home = process.env.HOME ?? "";
-  const homePlansDir = (0, import_node_path27.join)(home, ".claude", "plans");
+  const homePlansDir = (0, import_node_path29.join)(home, ".claude", "plans");
   const sources = [];
   if (isRealDirectoryChain(process.cwd(), [".claude", "plans"])) {
-    sources.push({ root: process.cwd(), prefix: (0, import_node_path27.join)(".claude", "plans") });
+    sources.push({ root: process.cwd(), prefix: (0, import_node_path29.join)(".claude", "plans") });
   }
-  if (home && (0, import_node_fs36.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
+  if (home && (0, import_node_fs38.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
   const candidates2 = [];
   const seen = /* @__PURE__ */ new Set();
   for (const source of sources) {
     let names2;
     try {
-      names2 = (0, import_node_fs36.readdirSync)(source.prefix ? (0, import_node_path27.join)(source.root, source.prefix) : source.root);
+      names2 = (0, import_node_fs38.readdirSync)(source.prefix ? (0, import_node_path29.join)(source.root, source.prefix) : source.root);
     } catch {
       continue;
     }
     for (const f of names2) {
       if (!f.endsWith(".md") || seen.has(f)) continue;
       seen.add(f);
-      const relPath = source.prefix ? (0, import_node_path27.join)(source.prefix, f) : f;
+      const relPath = source.prefix ? (0, import_node_path29.join)(source.prefix, f) : f;
       const stat3 = statRegularInRoot(source.root, relPath);
       if (!stat3.ok) continue;
       candidates2.push({ name: f, root: source.root, relPath, mtime: stat3.mtimeMs, size: stat3.size });
@@ -22330,9 +22656,9 @@ function discoverPlans() {
 function isRealDirectoryChain(root, parts) {
   let current = root;
   for (const part of parts) {
-    current = (0, import_node_path27.join)(current, part);
+    current = (0, import_node_path29.join)(current, part);
     try {
-      if (!(0, import_node_fs36.lstatSync)(current).isDirectory()) return false;
+      if (!(0, import_node_fs38.lstatSync)(current).isDirectory()) return false;
     } catch {
       return false;
     }
@@ -22347,7 +22673,7 @@ function discoverGuardDocs(rangeFiles2) {
     if (result.length >= MAX_SPEC_FILES) break;
     if (!GUARD_DOC_EXT.test(path)) continue;
     if (path.startsWith("/") || path.includes("..")) continue;
-    if (!(0, import_node_fs36.existsSync)(path)) continue;
+    if (!(0, import_node_fs38.existsSync)(path)) continue;
     const opened = openRegularInRoot(process.cwd(), path);
     if (!opened.ok) continue;
     if (opened.size > MAX_PLAN_FILE_BYTES || totalBytes + opened.size > MAX_TOTAL_SPEC_BYTES) {
@@ -22533,8 +22859,8 @@ async function mode(run2) {
 }
 
 // src/lib/fold.ts
-var import_node_fs37 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path30 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -22671,7 +22997,7 @@ function candidateRoots(repoRoot2) {
   const norm = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
   const out = [norm];
   try {
-    const real = import_node_fs37.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
+    const real = import_node_fs39.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
     if (real !== norm) out.push(real);
   } catch {
   }
@@ -22759,31 +23085,31 @@ function fold(transcriptPath, opts = {}) {
     }
   };
   try {
-    if (!(0, import_node_fs37.existsSync)(transcriptPath)) return result;
-    ingest((0, import_node_fs37.readFileSync)(transcriptPath, "utf8"), "agent");
+    if (!(0, import_node_fs39.existsSync)(transcriptPath)) return result;
+    ingest((0, import_node_fs39.readFileSync)(transcriptPath, "utf8"), "agent");
     result.coverage.complete = true;
   } catch {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path28.join)(
-      (0, import_node_path28.dirname)(transcriptPath),
-      (0, import_node_path28.basename)(transcriptPath).replace(/\.jsonl$/, ""),
+    const sidecarDir = (0, import_node_path30.join)(
+      (0, import_node_path30.dirname)(transcriptPath),
+      (0, import_node_path30.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
-    if ((0, import_node_fs37.existsSync)(sidecarDir)) {
+    if ((0, import_node_fs39.existsSync)(sidecarDir)) {
       const maxFiles = opts.maxSidecars ?? 200;
       const maxBytes = opts.maxSidecarBytes ?? 16 * 1024 * 1024;
       const found = [];
       const walk2 = (d, depth) => {
         if (depth > 4) return;
-        for (const e of (0, import_node_fs37.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path28.join)(d, e.name);
+        for (const e of (0, import_node_fs39.readdirSync)(d, { withFileTypes: true })) {
+          const p = (0, import_node_path30.join)(d, e.name);
           if (e.isDirectory()) {
             walk2(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
             try {
-              const st = (0, import_node_fs37.statSync)(p);
+              const st = (0, import_node_fs39.statSync)(p);
               found.push({ path: p, size: st.size, mtimeMs: st.mtimeMs });
             } catch {
               result.coverage.malformed++;
@@ -22800,7 +23126,7 @@ function fold(transcriptPath, opts = {}) {
           continue;
         }
         try {
-          ingest((0, import_node_fs37.readFileSync)(f.path, "utf8"), "subagent");
+          ingest((0, import_node_fs39.readFileSync)(f.path, "utf8"), "subagent");
           bytes += f.size;
           result.coverage.subagentFiles++;
         } catch {
@@ -22835,7 +23161,7 @@ function fold(transcriptPath, opts = {}) {
 }
 function classifyUnobserved(path) {
   try {
-    const st = (0, import_node_fs37.statSync)(path);
+    const st = (0, import_node_fs39.statSync)(path);
     if (!st.isFile()) return "unreadable";
   } catch {
     return "unreadable";
@@ -23102,14 +23428,12 @@ async function evidence(run2) {
           authorshipWasObservable
         });
         const recentForReview = narrowToRecent(baseForReview, baselineSessionId);
-        if (!opts.skipStatic && isCodacyAvailable()) {
+        if (!opts.skipStatic) {
           let allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
           if (baseline) {
             allScannable = allScannable.filter((f) => changedSinceBaseline(f, baseline));
           }
-          if (allScannable.length > 0) {
-            staticResults = runCodacyAnalysis(allScannable);
-          }
+          staticResults = runCodacyAnalysisIfAvailable(allScannable);
         }
         const deltaSet = baseline ? recentForReview.filter((f) => changedSinceBaseline(f, baseline)) : recentForReview;
         codeDelta = collectCodeDelta(deltaSet, {
@@ -23152,20 +23476,20 @@ async function evidence(run2) {
 }
 
 // src/lib/cache-cleanup.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_fs40 = require("node:fs");
+var import_node_path31 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
     const dir = projectPath(CACHE_DIR);
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
-    for (const entry of (0, import_node_fs38.readdirSync)(dir)) {
+    for (const entry of (0, import_node_fs40.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path29.join)(dir, entry);
+      const path = (0, import_node_path31.join)(dir, entry);
       try {
-        const stat3 = (0, import_node_fs38.statSync)(path);
+        const stat3 = (0, import_node_fs40.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
-          (0, import_node_fs38.unlinkSync)(path);
+          (0, import_node_fs40.unlinkSync)(path);
           logEvent("cache_entry_pruned", {
             path: entry,
             age_days: Math.round((Date.now() - stat3.mtimeMs) / 864e5)
@@ -23179,8 +23503,8 @@ function pruneStaleCache() {
 }
 
 // src/lib/context-files.ts
-var import_node_fs39 = require("node:fs");
-var import_node_os6 = require("node:os");
+var import_node_fs41 = require("node:fs");
+var import_node_os7 = require("node:os");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
 var MAX_CONTEXT_TOTAL_BYTES = 24576;
@@ -23188,7 +23512,7 @@ function readSetContextPaths(summary, deltaFiles) {
   const reads = summary?.files_read ?? [];
   if (reads.length === 0) return [];
   const root = process.cwd().replace(/\/+$/, "");
-  const home = (0, import_node_os6.homedir)();
+  const home = (0, import_node_os7.homedir)();
   const toRepoRelative2 = (p) => {
     if (!p) return null;
     let abs;
@@ -23237,7 +23561,7 @@ function gatherContextFiles(contextPaths, deltaFiles, opts) {
       continue;
     }
     try {
-      const content = (0, import_node_fs39.readFileSync)(safePath, "utf8");
+      const content = (0, import_node_fs41.readFileSync)(safePath, "utf8");
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_CONTEXT_FILE_BYTES) {
         logEvent("context_file_skipped", { path: filePath, reason: "too_large", bytes });
@@ -23322,14 +23646,15 @@ async function repoContext(run2) {
     dropped: run2.repoContext.dropped_symbols?.length ?? 0,
     callers: run2.repoContext.callers?.length ?? 0,
     tests: run2.repoContext.tests?.length ?? 0,
+    importers: run2.repoContext.importers?.length ?? 0,
     elapsed_ms: run2.repoContext.elapsed_ms ?? null
   });
 }
 
 // src/lib/seed-runner.ts
 var import_promises15 = require("node:fs/promises");
-var import_node_fs40 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path32 = require("node:path");
 var import_yaml4 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -23568,7 +23893,7 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   return fm;
 }
 async function runSeed(opts) {
-  if (!(0, import_node_fs40.existsSync)(STANDARD_FILE)) {
+  if (!(0, import_node_fs42.existsSync)(STANDARD_FILE)) {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   let standardDoc;
@@ -23580,7 +23905,7 @@ async function runSeed(opts) {
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
   let readmeContent;
-  if ((0, import_node_fs40.existsSync)("README.md")) {
+  if ((0, import_node_fs42.existsSync)("README.md")) {
     try {
       readmeContent = await (0, import_promises15.readFile)("README.md", "utf-8");
     } catch {
@@ -23588,7 +23913,7 @@ async function runSeed(opts) {
   }
   let claudeMdContent;
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
-    if ((0, import_node_fs40.existsSync)(p)) {
+    if ((0, import_node_fs42.existsSync)(p)) {
       try {
         claudeMdContent = await (0, import_promises15.readFile)(p, "utf-8");
         break;
@@ -23611,8 +23936,8 @@ async function runSeed(opts) {
   if (candidates2.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path30.join)(MEMORY_DIR, "domain", "project-overview.md");
-  if ((0, import_node_fs40.existsSync)(overviewPath) && !opts.force) {
+  const overviewPath = (0, import_node_path32.join)(MEMORY_DIR, "domain", "project-overview.md");
+  if ((0, import_node_fs42.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
   }
   if (opts.dryRun) {
@@ -23654,7 +23979,7 @@ async function runSeed(opts) {
       continue;
     }
     try {
-      await (0, import_promises15.mkdir)((0, import_node_path30.dirname)(targetPath), { recursive: true });
+      await (0, import_promises15.mkdir)((0, import_node_path32.dirname)(targetPath), { recursive: true });
       await (0, import_promises15.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
@@ -23667,8 +23992,8 @@ async function runSeed(opts) {
 }
 
 // src/commands/analyze/phases/08-memory-manifest.ts
-var import_node_fs41 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_path33 = require("node:path");
 async function memoryManifest(run2) {
   const { globals } = run2;
   const { serviceUrl, token } = run2;
@@ -23678,9 +24003,9 @@ async function memoryManifest(run2) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path31.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs41.existsSync)(STANDARD_FILE);
-    const alreadyTried = (0, import_node_fs41.existsSync)(seedMarker);
+    const seedMarker = (0, import_node_path33.join)(VERITY_DIR, ".seeded");
+    const hasStandard = (0, import_node_fs43.existsSync)(STANDARD_FILE);
+    const alreadyTried = (0, import_node_fs43.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
@@ -23693,7 +24018,7 @@ async function memoryManifest(run2) {
             dryRun: false
           });
           if (seedResult.created > 0) {
-            (0, import_node_fs41.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
+            (0, import_node_fs43.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
 `);
             autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
             logEvent("auto_seed_ran", {
@@ -23701,7 +24026,7 @@ async function memoryManifest(run2) {
               failed: seedResult.failed
             });
           } else if (seedResult.skipped === "already_seeded") {
-            (0, import_node_fs41.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
+            (0, import_node_fs43.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
 `);
           } else {
             logEvent("auto_seed_noop", {
@@ -23796,7 +24121,7 @@ function computeIncrement(reviewedPaths, hashOf, priorAuthored) {
 }
 
 // src/commands/analyze/phases/10-working-memory.ts
-var import_node_path32 = require("node:path");
+var import_node_path34 = require("node:path");
 async function workingMemory(run2) {
   const { opts } = run2;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run2;
@@ -23808,7 +24133,7 @@ async function workingMemory(run2) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path32.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path34.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -23890,7 +24215,7 @@ async function workingMemory(run2) {
 }
 
 // src/lib/note-budget.ts
-var import_node_fs42 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
 var EPISODE_STALE_SECONDS = 30 * 60;
 var FRESH = { delivered: 0, tasksCompleted: 0, ts: 0 };
@@ -23912,9 +24237,9 @@ function advisoryBudgetSpent(episode, rawDecision) {
 }
 function readAdvisoryEpisode(sessionId) {
   const file = scopedFile(ADVISORY_EPISODE_FILE, sessionId);
-  if (!(0, import_node_fs42.existsSync)(file)) return null;
+  if (!(0, import_node_fs44.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs42.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs44.readFileSync)(file, "utf-8")) ?? {};
     const delivered = typeof o.delivered === "number" ? o.delivered : NaN;
     if (isNaN(delivered)) return null;
     return {
@@ -23928,8 +24253,8 @@ function readAdvisoryEpisode(sessionId) {
 }
 function writeAdvisoryEpisode(episode, sessionId) {
   try {
-    (0, import_node_fs42.mkdirSync)(VERITY_DIR, { recursive: true });
-    (0, import_node_fs42.writeFileSync)(
+    (0, import_node_fs44.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs44.writeFileSync)(
       scopedFile(ADVISORY_EPISODE_FILE, sessionId),
       JSON.stringify({ v: 1, ...episode })
     );
@@ -24237,14 +24562,14 @@ async function buildRequest(run2) {
 }
 
 // src/lib/offline.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs45 = require("node:fs");
 var import_node_crypto11 = require("node:crypto");
 function cacheRequest(body) {
   try {
-    (0, import_node_fs43.mkdirSync)(CACHE_DIR, { recursive: true });
+    (0, import_node_fs45.mkdirSync)(CACHE_DIR, { recursive: true });
     const suffix = (0, import_node_crypto11.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
-    (0, import_node_fs43.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
+    (0, import_node_fs45.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
   } catch {
   }
 }
@@ -24363,8 +24688,8 @@ async function transmit(run2) {
 }
 
 // src/commands/analyze/phases/13-reconcile.ts
-var import_node_fs44 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_fs46 = require("node:fs");
+var import_node_path35 = require("node:path");
 async function reconcile(run2) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run2;
   const sentPaths = codeDelta.files.map((f) => f.path);
@@ -24393,7 +24718,7 @@ async function reconcile(run2) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
         try {
-          const src = (0, import_node_fs44.readFileSync)((0, import_node_path33.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs46.readFileSync)((0, import_node_path35.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -24679,12 +25004,20 @@ async function pullRepoMemory(opts) {
   let version = null;
   let cursor = null;
   let pages = 0;
-  const remember = (complete) => writePullState({
-    version: complete ? version : null,
-    // A complete pull saw every file the server holds, so its ledger replaces the
-    // old one (a path that stopped arriving was archived). A partial one only adds.
-    served: complete ? served : new Map([...state.served, ...served])
-  });
+  const remember = async (complete) => {
+    const onDisk = await readPullState();
+    const meanwhile = /* @__PURE__ */ new Map();
+    for (const [path, hash] of onDisk.served) {
+      if (state.served.get(path) !== hash) meanwhile.set(path, hash);
+    }
+    await writePullState({
+      version: complete ? version : null,
+      // A complete pull saw every file the server holds, so its ledger replaces
+      // the old one (a path that stopped arriving was archived) — except for what
+      // another writer recorded while it ran. A partial one only adds.
+      served: complete ? new Map([...served, ...meanwhile]) : new Map([...state.served, ...served, ...meanwhile])
+    });
+  };
   do {
     const params = new URLSearchParams({ limit: String(PAGE_SIZE) });
     if (cursor) params.set("cursor", cursor);
@@ -24757,7 +25090,7 @@ async function readPullState() {
 async function writePullState(state) {
   try {
     await (0, import_promises16.mkdir)(projectPath(VERITY_DIR), { recursive: true });
-    await (0, import_promises16.writeFile)(pullStateFile(), JSON.stringify({
+    await writeFileAtomic(pullStateFile(), JSON.stringify({
       ...state.version ? { version: state.version } : {},
       pulled_at: (/* @__PURE__ */ new Date()).toISOString(),
       served: Object.fromEntries(state.served)
@@ -25200,7 +25533,7 @@ function registerAnalyzeCommand(program2) {
 var tracing = () => process.env.VERITY_TRACE_PHASES === "1";
 async function runAnalyze(opts, globals) {
   if (!verityConfigured()) {
-    (0, import_node_fs45.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
+    (0, import_node_fs47.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
     process.exit(0);
   }
   const run2 = createRun(opts, globals);
@@ -25221,11 +25554,11 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs47 = require("node:fs");
+var import_node_fs49 = require("node:fs");
 
 // src/lib/project-skills.ts
-var import_node_fs46 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_fs48 = require("node:fs");
+var import_node_path36 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -25250,14 +25583,14 @@ var LEGACY_SKILL_NAMES = [
 var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
-  if (!(0, import_node_fs46.existsSync)(root)) return [];
-  return ALL.filter((name) => (0, import_node_fs46.existsSync)((0, import_node_path34.join)(root, name)));
+  if (!(0, import_node_fs48.existsSync)(root)) return [];
+  return ALL.filter((name) => (0, import_node_fs48.existsSync)((0, import_node_path36.join)(root, name)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name of staleProjectSkills()) {
-    (0, import_node_fs46.rmSync)((0, import_node_path34.join)(root, name), { recursive: true, force: true });
+    (0, import_node_fs48.rmSync)((0, import_node_path36.join)(root, name), { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
@@ -25285,10 +25618,10 @@ function registerBaselineCommands(program2) {
       const session = sessionId ?? validSessionId(process.env.CLAUDE_SESSION_ID);
       const cli = pluginCliInvocation();
       const skew = cliVersionSkew();
-      const why = skew ? `the \`verity\` on PATH is ${skew.global} but this plugin runs ${skew.plugin}, so it is not the CLI the hooks use` : verityOnPath() ? "the `verity` on PATH is a separate install whose version could not be read" : "this machine has no `verity` on PATH \u2014 the plugin carries its own copy";
+      const why = skew ? `the \`verity\` on PATH is ${skew.global} but the hooks run ${skew.hooks}, so it is not the CLI they use` : verityOnPath() ? "the `verity` on PATH is a separate install whose version could not be read" : "this machine has no `verity` on PATH \u2014 the plugin carries its own copy";
       const cliLine = cli ? `Verity CLI: ${why}. When a Verity skill tells you to run \`verity <args>\`, run \`${cli} <args>\` instead. Everything else about the command is identical.` : null;
-      const skewMsg = skew ? `Verity: your global \`verity\` CLI is ${skew.global} but the plugin runs ${skew.plugin}. Update it before using \`verity\` in a terminal: npm install -g @codacy/verity-cli@${skew.plugin}` : null;
-      const skewNote = skew ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the plugin runs ${skew.plugin}, and \`npm install -g @codacy/verity-cli@${skew.plugin}\` fixes it. Until they have, do not send them to run \`verity login\` in a terminal: that runs the global one, which can sign this machine in to a different server.` : null;
+      const skewMsg = skew ? `Verity: your global \`verity\` CLI is ${skew.global} but the hooks run ${skew.hooks}. Fix it before using \`verity\` in a terminal: ${skew.remedy}` : null;
+      const skewNote = skew ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. Until they have, do not send them to run \`verity login\` in a terminal: that runs the global one, which can sign this machine in to a different server.` : null;
       if (!verityConfigured()) {
         const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
@@ -25322,13 +25655,13 @@ function registerBaselineCommands(program2) {
       let memoryMsg = null;
       let memoryAgentLine = null;
       const memoryNotice = projectPath(`${VERITY_DIR}/.memory-fence-notice`);
-      if (realStart && !(0, import_node_fs47.existsSync)(memoryNotice)) {
+      if (realStart && !(0, import_node_fs49.existsSync)(memoryNotice)) {
         const trackedGraph = memoryOptOut() ? 0 : committedMemoryFiles().length;
         if (trackedGraph > 0) {
           memoryMsg = `Verity: this project commits its knowledge base (${trackedGraph} files under .verity/memory/), so Verity's generated notes show up in every diff and pull request. Run \`verity memory untrack\` to keep them on disk but out of git, or \`verity memory track\` to keep committing them on purpose.`;
           memoryAgentLine = `This project has ${trackedGraph} knowledge-graph files tracked in git under .verity/memory/. As of Verity 0.32.6 the graph is machine-local by default \u2014 it is rebuilt from the service, and committing it puts generated notes in every pull request. If the user wants that stopped, run \`verity memory untrack\` for them: it keeps every file on disk and stages their removal from the index, so they only need to commit \u2014 and their teammates' working copies will vanish on the next pull and re-sync from the service, which is expected. If they would rather keep committing it, \`verity memory track\` records that and nothing will offer again.`;
           try {
-            (0, import_node_fs47.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
+            (0, import_node_fs49.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
           } catch {
           }
         }
@@ -25429,7 +25762,7 @@ function hookSource(value) {
 }
 
 // src/commands/review.ts
-var import_node_fs48 = require("node:fs");
+var import_node_fs50 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars)").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -25446,45 +25779,22 @@ async function runReview(opts, globals) {
   const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  let staticResults;
-  if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs48.existsSync)(f) || resolveFile(f) !== null);
-    staticResults = runCodacyAnalysis(scannable);
-  } else {
-    staticResults = {
-      tool: "@codacy/analysis-cli",
-      findings: [],
-      summary: { total_findings: 0, by_severity: {}, tools_run: [] }
-    };
-  }
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs50.existsSync)(f) || resolveFile(f) !== null);
+  const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) {
+    const staticFailure = staticResults.summary.failure;
     printJsonCompact({
-      gate_decision: "PASS",
-      systemMessage: "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
+      gate_decision: "WARN",
+      systemMessage: staticFailure ? `Verity: not authenticated, and local static analysis did not run (${staticFailure.kind}) \u2014 nothing was examined. Run \`verity init\` to authenticate and unlock the full review.` : "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
       unauthenticated: true,
       static_results: staticResults
     });
     process.exit(0);
   }
-  let specs;
-  if (opts.specs) {
-    const specPaths = opts.specs.split(",").map((f) => f.trim()).filter(Boolean);
-    specs = [];
-    for (const p of specPaths) {
-      if (!(0, import_node_fs48.existsSync)(p)) continue;
-      try {
-        const { readFileSync: readFileSync26 } = await import("node:fs");
-        const content = readFileSync26(p, "utf-8");
-        specs.push({ path: p, content: content.slice(0, 10240) });
-      } catch {
-      }
-    }
-  } else {
-    specs = discoverSpecs();
-  }
+  const specs = opts.specs ? readSpecFiles(opts.specs, repoRoot()) : discoverSpecs();
   const plans = discoverPlans();
   const requestBody = {
     static_results: staticResults,
@@ -25517,9 +25827,10 @@ async function runReview(opts, globals) {
   });
   if (!result.ok) {
     printError(`Service error: ${result.error}`);
+    const staticFailure = staticResults.summary.failure;
     printJsonCompact({
-      gate_decision: "PASS",
-      systemMessage: "Verity: Service unavailable \u2014 showing static results only",
+      gate_decision: "WARN",
+      systemMessage: staticFailure ? `Verity: service unavailable, and local static analysis did not run (${staticFailure.kind}) \u2014 nothing was examined` : "Verity: service unavailable \u2014 showing local static results only",
       offline: true,
       static_results: staticResults
     });
@@ -25534,8 +25845,8 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs49 = require("node:fs");
-var import_node_path35 = require("node:path");
+var import_node_fs51 = require("node:fs");
+var import_node_path37 = require("node:path");
 
 // src/lib/terminal-text.ts
 var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g;
@@ -25910,7 +26221,7 @@ async function buildAgentDiffs(ctx, paths, limits = { perFileChars: 24e3, totalC
 // src/commands/guard.ts
 var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path35.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path37.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve6) => {
@@ -25955,7 +26266,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs49.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs51.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -25975,10 +26286,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs49.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs51.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs49.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs51.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -25988,10 +26299,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs49.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs49.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs51.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs51.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs49.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs49.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs51.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs51.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -26061,13 +26372,8 @@ function hasBlockingFinding(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  let staticResults;
-  if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs49.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
-    staticResults = runCodacyAnalysis(scannable);
-  } else {
-    staticResults = { tool: "@codacy/analysis-cli", findings: [], summary: { total_findings: 0, by_severity: {}, tools_run: [] } };
-  }
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs51.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
     static_results: staticResults,
@@ -26143,6 +26449,9 @@ function worstGate(...gates) {
   };
   return GATES[Math.max(...gates.map(rank2))];
 }
+function oneShotLostOutcome(input) {
+  return input.agentGate === "FAIL" && input.agentBlocking ? "block" : "allow-without-review";
+}
 function withAgentVerdict(oneShot, agent) {
   if (agent.one_shot_source === "none" && typeof oneShot.gate_decision === "string") {
     const added = agent.findings.filter((f) => f.agent_added === true);
@@ -26311,6 +26620,7 @@ async function runGuard(opts, globals) {
       symbols: repoContext2.symbols?.length ?? 0,
       callers: repoContext2.callers?.length ?? 0,
       tests: repoContext2.tests?.length ?? 0,
+      importers: repoContext2.importers?.length ?? 0,
       excerpts: repoContext2.excerpts?.length ?? 0,
       elapsed_ms: repoContext2.elapsed_ms ?? null
     });
@@ -26357,13 +26667,6 @@ async function runGuard(opts, globals) {
   const agentOutcome = agent ? await agent : null;
   const agentVerdict = agentOutcome?.kind === "finished" && agentOutcome.response.gate_decision ? agentOutcome.response : null;
   const reviewSecs = Math.max(1, Math.round((Date.now() - reviewStart) / 1e3));
-  if (!result.ok && !agentVerdict) {
-    const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
-    emitAllowNotice(
-      `\u26A0 Verity ${moment}: ${authRemedy ? "not authorized" : "service offline"} \u2014 ${verb}ed WITHOUT review${authRemedy}`,
-      `Verity ${moment}: ${authRemedy ? "not authorized" : "service unavailable"} (${result.error}); the ${verb} was allowed WITHOUT a Verity review.${authRemedy}`
-    );
-  }
   const oneShotResponse = result.ok ? result.data : {};
   const response = agentVerdict ? withAgentVerdict(oneShotResponse, agentVerdict) : oneShotResponse;
   if (opts.json) process.stderr.write(JSON.stringify(response) + "\n");
@@ -26375,6 +26678,19 @@ async function runGuard(opts, globals) {
   const covDetail = agentLine ? `${coverageBlock(coverage)}
   ${agentLine}` : coverageBlock(coverage);
   const witnessed = [...codeDelta.files.map((f) => f.path), ...agentVerdict?.witnessed_files ?? []];
+  if (!result.ok) {
+    const authRemedy = result.error.startsWith("STALE_VERIFICATION") ? " Your GitHub verification expired \u2014 run `verity login` to re-verify." : result.error.startsWith("FORBIDDEN") ? " No access grant for this repository \u2014 run `verity login` to refresh your grants." : result.error.startsWith("INVALID_TOKEN") ? " Your Verity login expired or was revoked \u2014 run `verity login` to sign in again." : "";
+    if (oneShotLostOutcome({ agentGate: decision, agentBlocking: hasBlockingFinding(response, witnessed) }) === "block") {
+      writeIter(moment, iter + 1);
+      writeBlockMessage(moment, response, covDetail);
+      process.exit(2);
+    }
+    const agentNote = agentLine ? ` ${agentLine}, but it reviewed only part of the change.` : "";
+    emitAllowNotice(
+      `\u26A0 Verity ${moment}: ${authRemedy ? "not authorized" : "no single-pass review"} \u2014 ${verb}ed WITHOUT review${authRemedy}`,
+      `Verity ${moment}: the single-pass review did not come back (${result.error}); the ${verb} was allowed WITHOUT a Verity review.${agentNote}${authRemedy}`
+    );
+  }
   if (decision === "FAIL" && hasBlockingFinding(response, witnessed)) {
     writeIter(moment, iter + 1);
     writeBlockMessage(moment, response, covDetail);
@@ -26566,7 +26882,7 @@ function registerIgnoreCommand(program2) {
 
 // src/commands/waive.ts
 var import_node_crypto12 = require("node:crypto");
-var import_node_fs50 = require("node:fs");
+var import_node_fs52 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -26595,7 +26911,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body.file = opts.file;
       try {
-        body.file_sha256 = (0, import_node_crypto12.createHash)("sha256").update((0, import_node_fs50.readFileSync)(opts.file)).digest("hex");
+        body.file_sha256 = (0, import_node_crypto12.createHash)("sha256").update((0, import_node_fs52.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -26620,10 +26936,10 @@ function registerWaiveCommand(program2) {
 }
 
 // src/commands/init.ts
-var import_node_fs54 = require("node:fs");
+var import_node_fs56 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
 var import_yaml6 = __toESM(require_dist());
-var import_node_path38 = require("node:path");
+var import_node_path40 = require("node:path");
 var import_node_child_process17 = require("node:child_process");
 
 // src/lib/banner.ts
@@ -26702,18 +27018,13 @@ function printPhase(n, of, title, subtitle) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs51 = require("node:fs");
+var import_node_fs53 = require("node:fs");
 
 // src/lib/prereqs.ts
 var import_node_child_process15 = require("node:child_process");
 var MIN_NODE_MAJOR = 20;
 function which(bin) {
-  try {
-    const out = (0, import_node_child_process15.execSync)(`command -v ${bin}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-    return out || null;
-  } catch {
-    return null;
-  }
+  return whichSync(bin, { real: false });
 }
 function checkNode() {
   const version = process.version;
@@ -26913,12 +27224,13 @@ async function buildReport() {
   const state = await readSetupState();
   const wiring = await resolveHookWiring();
   const hooks = wiring.status;
+  const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
-  const hasConfig = (0, import_node_fs51.existsSync)(projectPath(CODACY_CONFIG_FILE));
+  const hasConfig = (0, import_node_fs53.existsSync)(projectPath(CODACY_CONFIG_FILE));
   const artifacts = {
-    standard: (0, import_node_fs51.existsSync)(projectPath(STANDARD_FILE)),
+    standard: (0, import_node_fs53.existsSync)(projectPath(STANDARD_FILE)),
     analysisConfig: hasConfig,
-    verityMd: (0, import_node_fs51.existsSync)(projectPath(VERITY_MD_FILE)),
+    verityMd: (0, import_node_fs53.existsSync)(projectPath(VERITY_MD_FILE)),
     analysisConfigIds: hasConfig ? validatePatternIds().status : "absent"
   };
   const next = [];
@@ -26956,6 +27268,12 @@ async function buildReport() {
       'Duplicate Verity hooks also exist in .claude/settings.json. They stand down at run time under the plugin, but remove them with "verity init --plugin-mode" so the wiring says what it does.'
     );
   }
+  const versions = versionReport(provenance);
+  if (provenance.skew) {
+    next.push(
+      `The \`verity\` on PATH is ${provenance.skew.global}, but the plugin's hooks run ${provenance.skew.hooks} \u2014 so the gate and your terminal are different builds. Fix: ${provenance.skew.remedy}.`
+    );
+  }
   if (state?.telemetry === "deferred") {
     next.push('Telemetry was requested but needs a token \u2014 run "verity login", then "verity telemetry install".');
   }
@@ -26993,7 +27311,8 @@ async function buildReport() {
       source: wiring.source,
       ...hooks,
       duplicateSettingsHooks: wiring.duplicateSettingsHooks,
-      noAnalysisMoment
+      noAnalysisMoment,
+      versions
     },
     telemetry: { enabled: telemetry.enabled, endpoint: telemetry.endpoint },
     artifacts,
@@ -27024,6 +27343,9 @@ function registerDoctorCommand(program2) {
     printInfo(`  intensity: ${report.answers.intensity ?? "\u2014"}    moments: ${report.answers.moments?.join(", ") ?? "\u2014"}`);
     const plugin = report.hooks.source === "plugin";
     printInfo(plugin ? "Hooks: wired by the Verity Claude Code plugin (not .claude/settings.json)" : "Hooks:");
+    const versionOut = versionLines(report.hooks.versions);
+    for (const line of versionOut.info) printInfo(line);
+    for (const line of versionOut.warn) printWarn(line);
     printInfo(`  Stop (verity analyze): ${report.hooks.stop ? plugin ? "on (plugin)" : "on" : "off"}`);
     printInfo(`  Git-moment gate: ${report.hooks.guardOn.length ? report.hooks.guardOn.join(", ") : "off"}`);
     printInfo(`  Infra (intent/baseline/compact/session-end): ${[report.hooks.intent, report.hooks.baseline, report.hooks.compact, report.hooks.sessionEnd].filter(Boolean).length}/4`);
@@ -27049,8 +27371,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs52 = require("node:fs");
-var import_node_path36 = require("node:path");
+var import_node_fs54 = require("node:fs");
+var import_node_path38 = require("node:path");
 var import_node_child_process16 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -27087,12 +27409,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path36.join)(root, ".gate");
-  const verityDir = (0, import_node_path36.join)(root, ".verity");
-  if ((0, import_node_fs52.existsSync)(gateDir) && !(0, import_node_fs52.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path38.join)(root, ".gate");
+  const verityDir = (0, import_node_path38.join)(root, ".verity");
+  if ((0, import_node_fs54.existsSync)(gateDir) && !(0, import_node_fs54.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs52.existsSync)(gateDir) && (0, import_node_fs52.existsSync)(verityDir)) {
+  if ((0, import_node_fs54.existsSync)(gateDir) && (0, import_node_fs54.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -27113,13 +27435,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs52.existsSync)(gateDir)) {
+    if ((0, import_node_fs54.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs52.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs54.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -27135,18 +27457,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs52.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs54.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path36.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path36.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs52.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs52.existsSync)(verityCreds)) {
-    (0, import_node_fs52.mkdirSync)((0, import_node_path36.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path38.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path38.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs54.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs54.existsSync)(verityCreds)) {
+    (0, import_node_fs54.mkdirSync)((0, import_node_path38.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -27168,8 +27490,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path36.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs52.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path38.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs54.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -27179,9 +27501,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path36.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path36.join)(root, "VERITY.md");
-  if (!(0, import_node_fs52.existsSync)(gateMd) || (0, import_node_fs52.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path38.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path38.join)(root, "VERITY.md");
+  if (!(0, import_node_fs54.existsSync)(gateMd) || (0, import_node_fs54.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -27193,12 +27515,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs52.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs54.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path36.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs52.existsSync)(file)) return;
+  const file = (0, import_node_path38.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs54.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -27246,14 +27568,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep4 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs52.writeFileSync)(verityCreds, verityContent + sep4 + toAppend.join("\n") + "\n");
+    (0, import_node_fs54.writeFileSync)(verityCreds, verityContent + sep4 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs52.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs54.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs52.readFileSync)(path, "utf-8");
+    return (0, import_node_fs54.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -27268,35 +27590,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs52.renameSync)(from, to);
+    (0, import_node_fs54.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs52.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs52.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs54.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs54.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs52.renameSync)(from, to);
+    (0, import_node_fs54.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs52.cpSync)(from, to);
-    (0, import_node_fs52.rmSync)(from, { force: true });
+    (0, import_node_fs54.cpSync)(from, to);
+    (0, import_node_fs54.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path36.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs52.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path36.join)(relDir, entry) : entry;
-      const src = (0, import_node_path36.join)(gateDir, rel);
-      const dest = (0, import_node_path36.join)(verityDir, rel);
-      if ((0, import_node_fs52.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path38.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs54.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path38.join)(relDir, entry) : entry;
+      const src = (0, import_node_path38.join)(gateDir, rel);
+      const dest = (0, import_node_path38.join)(verityDir, rel);
+      if ((0, import_node_fs54.statSync)(src).isDirectory()) {
         walk2(rel);
-      } else if (!(0, import_node_fs52.existsSync)(dest)) {
-        (0, import_node_fs52.mkdirSync)((0, import_node_path36.dirname)(dest), { recursive: true });
-        (0, import_node_fs52.cpSync)(src, dest);
+      } else if (!(0, import_node_fs54.existsSync)(dest)) {
+        (0, import_node_fs54.mkdirSync)((0, import_node_path38.dirname)(dest), { recursive: true });
+        (0, import_node_fs54.cpSync)(src, dest);
         copied++;
       }
     }
@@ -27305,22 +27627,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path36.join)(root, ".gate");
-  const verityDir = (0, import_node_path36.join)(root, ".verity");
-  if ((0, import_node_fs52.existsSync)(gateDir) && !(0, import_node_fs52.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs52.existsSync)(gateDir) && (0, import_node_fs52.existsSync)(verityDir)) {
-    if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(gateDir, "credentials")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path38.join)(root, ".gate");
+  const verityDir = (0, import_node_path38.join)(root, ".verity");
+  if ((0, import_node_fs54.existsSync)(gateDir) && !(0, import_node_fs54.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs54.existsSync)(gateDir) && (0, import_node_fs54.existsSync)(verityDir)) {
+    if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(gateDir, "credentials")) && !(0, import_node_fs54.existsSync)((0, import_node_path38.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(gateDir, "memory")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(gateDir, "memory")) && !(0, import_node_fs54.existsSync)((0, import_node_path38.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path36.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs52.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path38.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs54.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs52.existsSync)((0, import_node_path36.join)(root, "GATE.md")) && !(0, import_node_fs52.existsSync)((0, import_node_path36.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(root, "GATE.md")) && !(0, import_node_fs54.existsSync)((0, import_node_path38.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -27601,9 +27923,9 @@ async function promptMultiSelect(question, choices, fallback) {
 }
 
 // src/lib/remote-config.ts
-var import_node_fs53 = require("node:fs");
+var import_node_fs55 = require("node:fs");
 var import_promises18 = require("node:fs/promises");
-var import_node_path37 = require("node:path");
+var import_node_path39 = require("node:path");
 var import_yaml5 = __toESM(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -27648,7 +27970,7 @@ async function adoptRemoteSetup(found, opts) {
   written.push(STANDARD_FILE);
   if (rider !== null) {
     const localIgnore = projectPath(VERITYIGNORE_FILE);
-    if (!(0, import_node_fs53.existsSync)(localIgnore)) {
+    if (!(0, import_node_fs55.existsSync)(localIgnore)) {
       await writeOut(VERITYIGNORE_FILE, rider);
       written.push(VERITYIGNORE_FILE);
     } else {
@@ -27679,9 +28001,9 @@ async function adoptRemoteSetup(found, opts) {
   written.push(VERITY_MD_FILE);
   return { written, notes };
 }
-async function writeOut(relative2, body) {
-  const target = projectPath(relative2);
-  await (0, import_promises18.mkdir)((0, import_node_path37.dirname)(target), { recursive: true });
+async function writeOut(relative3, body) {
+  const target = projectPath(relative3);
+  await (0, import_promises18.mkdir)((0, import_node_path39.dirname)(target), { recursive: true });
   await (0, import_promises18.writeFile)(target, body);
 }
 function describeRemote(found) {
@@ -27798,15 +28120,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path38.join)(__dirname, "..", "data"),
+    (0, import_node_path40.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path38.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path40.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path38.join)(process.cwd(), "cli", "data")
+    (0, import_node_path40.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(candidate, "skills"))) {
+    if ((0, import_node_fs56.existsSync)((0, import_node_path40.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -27822,9 +28144,9 @@ async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out = [];
     const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs54.readdirSync)(d, { withFileTypes: true })) {
+      for (const e of (0, import_node_fs56.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path38.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path40.join)(d, e.name), rel);
         else if (e.isFile()) out.push(rel);
       }
     };
@@ -27835,8 +28157,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises19.readFile)((0, import_node_path38.join)(src, rel), "utf-8");
-      const b = await (0, import_promises19.readFile)((0, import_node_path38.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises19.readFile)((0, import_node_path40.join)(src, rel), "utf-8");
+      const b = await (0, import_promises19.readFile)((0, import_node_path40.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -28017,7 +28339,7 @@ async function synthesizeLocally(opts) {
 async function healStaleAnalysisConfig(globals) {
   const configPath = projectPath(CODACY_CONFIG_FILE);
   const standardPath = projectPath(STANDARD_FILE);
-  if (!(0, import_node_fs54.existsSync)(configPath) || !(0, import_node_fs54.existsSync)(standardPath)) return;
+  if (!(0, import_node_fs56.existsSync)(configPath) || !(0, import_node_fs56.existsSync)(standardPath)) return;
   const validation = validatePatternIds();
   if (validation.status !== "invalid") return;
   printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
@@ -28114,17 +28436,17 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path38.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path40.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path38.join)(skillsSource, skill);
-    const dest = (0, import_node_path38.join)(skillsDest, skill);
-    if (!(0, import_node_fs54.existsSync)(src)) {
+    const src = (0, import_node_path40.join)(skillsSource, skill);
+    const dest = (0, import_node_path40.join)(skillsDest, skill);
+    if (!(0, import_node_fs56.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
     }
-    if ((0, import_node_fs54.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
+    if ((0, import_node_fs56.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
       skillsInstalled++;
       continue;
     }
@@ -28263,7 +28585,7 @@ function registerInitCommand(program2) {
     const staleMarker = clearStalePluginMarker();
     const pluginMode = opts.plugin === false ? false : opts.pluginMode ?? pluginActiveHere();
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs54.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs56.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -28353,7 +28675,7 @@ function registerInitCommand(program2) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
     await scaffoldProject(step, defaultsOnly);
-    const globalVerityDir = (0, import_node_path38.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path40.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises19.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -28422,7 +28744,7 @@ function registerInitCommand(program2) {
     }
     step("Your project's Standard");
     let haveStandard = false;
-    if ((0, import_node_fs54.existsSync)(projectPath(STANDARD_FILE))) {
+    if ((0, import_node_fs56.existsSync)(projectPath(STANDARD_FILE))) {
       printInfo("  This project already has .verity/standard.yaml \u2014 keeping it.");
       haveStandard = true;
     } else {
@@ -28452,7 +28774,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.0-experimental.d60f544" : "dev"
+          cli_version: true ? "0.33.1-experimental.1378de3" : "dev"
         }
       });
     } catch (err) {
@@ -28502,8 +28824,8 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs55 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_fs57 = require("node:fs");
+var import_node_path41 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -28512,11 +28834,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path39.join)(skillsRoot, name);
-      if ((0, import_node_fs55.existsSync)(dir)) {
+      const dir = (0, import_node_path41.join)(skillsRoot, name);
+      if ((0, import_node_fs57.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
-          apply: () => (0, import_node_fs55.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs57.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -28530,24 +28852,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs55.existsSync)(verityDir)) {
+    if ((0, import_node_fs57.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs55.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs57.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs55.existsSync)(verityMd)) {
+      if ((0, import_node_fs57.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs55.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs57.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs55.existsSync)(path) && (0, import_node_fs55.statSync)(path).isDirectory() && (0, import_node_fs55.readdirSync)(path).length === 0) {
-        (0, import_node_fs55.rmdirSync)(path);
+      if ((0, import_node_fs57.existsSync)(path) && (0, import_node_fs57.statSync)(path).isDirectory() && (0, import_node_fs57.readdirSync)(path).length === 0) {
+        (0, import_node_fs57.rmdirSync)(path);
       }
     };
     actions.push({
@@ -28558,11 +28880,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path39.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs55.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path41.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs57.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs55.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs57.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -28756,8 +29078,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs56 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs58 = require("node:fs");
+var import_node_path42 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -28794,11 +29116,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs56.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs56.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs58.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs58.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs56.unlinkSync)((0, import_node_path40.join)(cacheDir, entry));
+            (0, import_node_fs58.unlinkSync)((0, import_node_path42.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -28813,19 +29135,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs56.existsSync)(file)) {
+      if ((0, import_node_fs58.existsSync)(file)) {
         try {
-          (0, import_node_fs56.writeFileSync)(file, "");
+          (0, import_node_fs58.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs56.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs56.readdirSync)(logsDir)) {
+      if ((0, import_node_fs58.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs58.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs56.unlinkSync)((0, import_node_path40.join)(logsDir, entry));
+            (0, import_node_fs58.unlinkSync)((0, import_node_path42.join)(logsDir, entry));
           } catch {
           }
         }
@@ -28837,7 +29159,7 @@ function registerResetCommand(program2) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs57 = require("node:fs");
+var import_node_fs59 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -28875,7 +29197,7 @@ async function writeNodeToDisk(args) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs57.existsSync)(projectPath(`${VERITY_DIR}/memory/${args.filePath}`));
+    return (0, import_node_fs59.existsSync)(projectPath(`${VERITY_DIR}/memory/${args.filePath}`));
   } catch {
     return false;
   }
@@ -28954,7 +29276,7 @@ function registerReflectCommand(program2) {
       const fileGlobs = explicitGlobs.length > 0 ? explicitGlobs : derivedGlobs.length > 0 ? derivedGlobs : inheritedGlobs;
       const result = await apiRequest({
         method: "POST",
-        path: "/compound/memory/nodes",
+        path: "/compound/reflect",
         serviceUrl,
         token,
         body: {
@@ -28987,6 +29309,8 @@ function registerReflectCommand(program2) {
       const nodeId = result.data.node_id;
       const filePath = result.data.file_path;
       const viewUrl = typeof result.data.view_url === "string" ? result.data.view_url : null;
+      const recordedSource = typeof result.data.source === "string" ? result.data.source : source;
+      const recordedAsUser = recordedSource === "user";
       const content = typeof result.data.content === "string" ? result.data.content : null;
       const synced = content !== null && await writeNodeToDisk({ filePath, content, nodeId });
       printInfo(
@@ -28994,8 +29318,13 @@ function registerReflectCommand(program2) {
       );
       if (viewUrl) printInfo(`  ${viewUrl}`);
       printInfo(
-        confirmed ? "  Recorded as yours (source: user)." : "  Auto-recorded from this task \u2014 nobody reviewed it. Edit or delete the file if it is wrong."
+        recordedAsUser ? "  Recorded as yours (source: user)." : "  Auto-recorded from this task \u2014 nobody reviewed it. Edit or delete the file if it is wrong."
       );
+      if (recordedSource !== source) {
+        printWarn(
+          `Provenance mismatch: sent source "${source}", the service recorded "${recordedSource}". Correct ${nodeId} on the dashboard \u2014 a draft stored as human-authored cannot be told apart later.`
+        );
+      }
       if (fileGlobs.length === 0) {
         printWarn(
           'No files matched \u2014 this reflection will not surface in future reviews. Cite a path in the text, or pass --file-globs "<path or glob>".'
@@ -29367,8 +29696,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.0-experimental.d60f544").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.0-experimental.d60f544");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.1-experimental.1378de3").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.1-experimental.1378de3");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();