@codacy/verity-cli 0.33.2-experimental.0c53bed → 0.33.3-experimental.072d5cb

package/bin/verity.js

@@ -10970,8 +10970,8 @@ function filterReviewable(files) {
     const ext = (0, import_node_path3.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename5 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename5)) return true;
+    const basename6 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename6)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -13457,7 +13457,7 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/intent.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
@@ -14009,8 +14009,8 @@ async function appendEntry(taskId, entry) {
 
 // src/lib/memory-retrieval.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs13 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_path14 = require("node:path");
 
 // src/lib/org-mirror.ts
 var import_node_fs12 = require("node:fs");
@@ -14201,16 +14201,216 @@ async function readOrgMirror(remote = requestRemote()) {
   return out;
 }
 
-// src/lib/memory-retrieval.ts
-var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
-var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
-var DEFAULT_BUDGET_TOKENS = 2e3;
-var MAX_BUDGET_TOKENS = 4e3;
-var MIN_SCORE = 0.5;
-var ORG_MIN_SHARED_TERMS = 2;
+// src/lib/safe-read.ts
+var import_node_fs13 = require("node:fs");
+var import_node_path13 = require("node:path");
+var FLAGS = import_node_fs13.constants;
+var NOFOLLOW = FLAGS.O_NOFOLLOW;
+var NONBLOCK = FLAGS.O_NONBLOCK;
+function closeOpened(fd) {
+  try {
+    (0, import_node_fs13.closeSync)(fd);
+  } catch {
+  }
+}
+function isInsideRoot(realRoot, realPath) {
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path13.sep) ? realRoot : realRoot + import_node_path13.sep);
+}
+function sameOpenedFile(opened, current, nofollowAvailable) {
+  if (!nofollowAvailable && (opened.ino === 0n || current.ino === 0n)) return false;
+  return opened.ino === current.ino && opened.dev === current.dev;
+}
+function openRegularInRoot(root, path) {
+  const full = (0, import_node_path13.isAbsolute)(path) ? path : (0, import_node_path13.join)(root, path);
+  let fd;
+  try {
+    fd = (0, import_node_fs13.openSync)(full, import_node_fs13.constants.O_RDONLY | (NOFOLLOW ?? 0) | (NONBLOCK ?? 0));
+  } catch (err) {
+    const code = err.code;
+    if (code === "ELOOP" || code === "EMLINK" || code === "EFTYPE") return { ok: false, reason: "symlink" };
+    if (code === "ENOENT" || code === "ENOTDIR") return { ok: false, reason: "missing" };
+    return { ok: false, reason: "unreadable" };
+  }
+  try {
+    const opened = (0, import_node_fs13.fstatSync)(fd, { bigint: true });
+    if (!opened.isFile()) {
+      closeOpened(fd);
+      return { ok: false, reason: "not-regular" };
+    }
+    const realRoot = import_node_fs13.realpathSync.native(root);
+    const realPath = import_node_fs13.realpathSync.native(full);
+    if (!isInsideRoot(realRoot, realPath)) {
+      closeOpened(fd);
+      return { ok: false, reason: "outside-root" };
+    }
+    const current = (0, import_node_fs13.statSync)(realPath, { bigint: true });
+    if (!sameOpenedFile(opened, current, NOFOLLOW !== void 0)) {
+      closeOpened(fd);
+      return { ok: false, reason: NOFOLLOW === void 0 ? "unreadable" : "outside-root" };
+    }
+    return { ok: true, fd, size: Number(opened.size), mtimeMs: Number(opened.mtimeMs) };
+  } catch {
+    closeOpened(fd);
+    return { ok: false, reason: "unreadable" };
+  }
+}
+function statRegularInRoot(root, path) {
+  const opened = openRegularInRoot(root, path);
+  if (!opened.ok) return opened;
+  closeOpened(opened.fd);
+  return { ok: true, size: opened.size, mtimeMs: opened.mtimeMs };
+}
+function readOpened(fd, size) {
+  try {
+    const buffer = Buffer.alloc(size);
+    let offset = 0;
+    while (offset < size) {
+      const n = (0, import_node_fs13.readSync)(fd, buffer, offset, size - offset, offset);
+      if (n === 0) break;
+      offset += n;
+    }
+    return buffer.subarray(0, offset);
+  } finally {
+    closeOpened(fd);
+  }
+}
+function readOpenedUtf8(fd, size) {
+  return readOpened(fd, size).toString("utf-8");
+}
+function readRegularFileInRoot(root, path, maxBytes) {
+  const opened = openRegularInRoot(root, path);
+  if (!opened.ok) return opened;
+  if (opened.size > maxBytes) {
+    closeOpened(opened.fd);
+    return { ok: false, reason: "too-large", size: opened.size };
+  }
+  try {
+    return { ok: true, content: readOpenedUtf8(opened.fd, opened.size), size: opened.size };
+  } catch {
+    return { ok: false, reason: "unreadable" };
+  }
+}
+
+// src/lib/knowledge-score.ts
+var KIND_PRIOR_MEAN = {
+  decision: 0.78,
+  pattern: 0.89,
+  security: 0.8,
+  quality: 0.71,
+  integration: 0.71,
+  domain: 0.71,
+  gotcha: 0.53,
+  intent: 0.53
+};
+var DEFAULT_PRIOR_MEAN = 0.6;
+var PRIOR_STRENGTH = 2;
+var RELEVANCE_FLOOR = 0.15;
+var TAG_SATURATION = 1.5;
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "and",
+  "for",
+  "are",
+  "but",
+  "not",
+  "you",
+  "all",
+  "any",
+  "can",
+  "had",
+  "has",
+  "her",
+  "was",
+  "one",
+  "our",
+  "out",
+  "him",
+  "his",
+  "how",
+  "its",
+  "may",
+  "who",
+  "did",
+  "get",
+  "got",
+  "let",
+  "say",
+  "she",
+  "too",
+  "use",
+  "via",
+  "yes",
+  "yet",
+  "now",
+  "new",
+  "also",
+  "been",
+  "both",
+  "does",
+  "each",
+  "from",
+  "have",
+  "here",
+  "into",
+  "just",
+  "like",
+  "make",
+  "more",
+  "most",
+  "much",
+  "must",
+  "need",
+  "only",
+  "over",
+  "same",
+  "some",
+  "such",
+  "than",
+  "that",
+  "them",
+  "then",
+  "there",
+  "these",
+  "they",
+  "this",
+  "those",
+  "very",
+  "want",
+  "were",
+  "what",
+  "when",
+  "where",
+  "which",
+  "while",
+  "will",
+  "with",
+  "would",
+  "your",
+  "about",
+  "after",
+  "again",
+  "being",
+  "could",
+  "other",
+  "should",
+  "their",
+  "because",
+  "before",
+  "doing",
+  "going",
+  "still",
+  "think",
+  "thing",
+  "things",
+  "well",
+  "way",
+  "why",
+  "within",
+  "without"
+]);
 function tokenize(text) {
   return new Set(
-    text.toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2)
+    text.toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !STOPWORDS.has(w))
   );
 }
 function jaccardKeywords(a, b) {
@@ -14220,6 +14420,78 @@ function jaccardKeywords(a, b) {
   const union = a.size + b.size - inter;
   return union === 0 ? 0 : inter / union;
 }
+function relevance(node, ctx) {
+  const globHit = node.globHit === true;
+  let tagScore = 0;
+  const nodeTags = node.context_tags ?? [];
+  if (nodeTags.length > 0 && ctx.changeTags && ctx.changeTags.length > 0) {
+    const change = new Set(ctx.changeTags);
+    let hit = 0;
+    for (const t of nodeTags) {
+      if (!change.has(t)) continue;
+      hit += t.startsWith("pkg:") || t.startsWith("tbl:") ? 1 : t.startsWith("sym:") ? 0.8 : t.startsWith("dir:") ? 0.4 : 0.15;
+    }
+    tagScore = Math.min(1, hit / TAG_SATURATION);
+  }
+  let textScore = 0;
+  if (ctx.promptTokens && ctx.promptTokens.size > 0) {
+    textScore = jaccardKeywords(tokenize(`${node.title} ${node.body}`), ctx.promptTokens);
+    textScore = Math.min(1, textScore * 4);
+  }
+  const distance = node.distance ?? 0;
+  const hopScore = distance > 0 ? Math.min(1, node.hopWeight ?? 1) * 0.45 * Math.pow(0.6, distance - 1) : 0;
+  const globEvidence = globHit && (node.kind !== "integration" || tagScore > 0 || textScore > 0);
+  const evidence2 = [globEvidence ? 0.85 : 0, tagScore * 0.9, textScore * 0.7, hopScore];
+  let miss = 1;
+  for (const e of evidence2) miss *= 1 - Math.max(0, Math.min(1, e));
+  let score = 1 - miss;
+  if (distance > 0) score *= Math.pow(0.85, distance);
+  return { score, via: { glob: globHit, tag: tagScore, text: textScore } };
+}
+var KIND_POOL_STRENGTH = 20;
+function priorFor(kind, pooled) {
+  const base = KIND_PRIOR_MEAN[kind] ?? DEFAULT_PRIOR_MEAN;
+  const a = pooled ? Math.max(0, pooled.alpha) : 0;
+  const b = pooled ? Math.max(0, pooled.beta) : 0;
+  const mean = pooled && kind !== "integration" ? (KIND_POOL_STRENGTH * base + a) / (KIND_POOL_STRENGTH + a + b) : base;
+  return { alpha: mean * PRIOR_STRENGTH, beta: (1 - mean) * PRIOR_STRENGTH };
+}
+function posteriorFor(kind, own, pooled) {
+  const p = priorFor(kind, pooled);
+  if (!own || kind === "integration") return p;
+  return { alpha: p.alpha + Math.max(0, own.alpha), beta: p.beta + Math.max(0, own.beta) };
+}
+function posteriorMean(p) {
+  const n = p.alpha + p.beta;
+  return n <= 0 ? DEFAULT_PRIOR_MEAN : p.alpha / n;
+}
+function scoreCandidates(nodes, ctx, opts = {}) {
+  const floor = opts.relevanceFloor ?? RELEVANCE_FLOOR;
+  const out = [];
+  for (const n of nodes) {
+    const rel = relevance(n, ctx);
+    if (rel.score < floor) continue;
+    const post = posteriorFor(n.kind, opts.posteriors?.get(n.id), opts.kindPosteriors?.get(n.kind));
+    const usefulness = posteriorMean(post);
+    out.push({ id: n.id, score: rel.score * usefulness, relevance: rel.score, usefulness, via: rel.via });
+  }
+  out.sort((a, b) => b.score - a.score || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  return out;
+}
+
+// src/lib/memory-retrieval.ts
+var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
+var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
+var DEFAULT_BUDGET_TOKENS = 2e3;
+var MAX_BUDGET_TOKENS = 4e3;
+var MAX_NODE_FILE_BYTES = 64 * 1024;
+var MIN_SCORE = RELEVANCE_FLOOR * 0.5;
+var ORG_MIN_SHARED_TERMS = 2;
+function orgTerms(text) {
+  return new Set(
+    text.toLowerCase().replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter((w) => w.length > 2)
+  );
+}
 function sharedTerms(a, b) {
   let n = 0;
   for (const w of a) if (b.has(w)) n++;
@@ -14248,34 +14520,27 @@ function globMatch(glob, filePath) {
   return false;
 }
 function scoreNode(node, promptTokens, taskFiles) {
-  let score = 0;
-  score += node.confidence * 0.5;
-  score += Math.log(1 + node.citedCount) * 0.3;
-  const nodeTokens = tokenize(`${node.title} ${node.body}`);
-  score += jaccardKeywords(nodeTokens, promptTokens) * 2;
-  if (node.fileGlobs.length > 0 && taskFiles.length > 0) {
-    for (const glob of node.fileGlobs) {
-      for (const file of taskFiles) {
-        if (globMatch(glob, file)) {
-          score += 1.5;
-          break;
-        }
-      }
-      if (score > 3) break;
-    }
-  }
-  const kindPriors = {
-    security: 0.4,
-    gotcha: 0.4,
-    decision: 0.3,
-    pattern: 0.2,
-    integration: 0.3,
-    domain: 0.2,
-    quality: 0.1,
-    intent: 0.1
-  };
-  score += kindPriors[node.kind] ?? 0;
-  return score;
+  const globHit = node.fileGlobs.length > 0 && taskFiles.length > 0 && node.fileGlobs.some((glob) => taskFiles.some((file) => globMatch(glob, file)));
+  const [scored] = scoreCandidates(
+    [{
+      id: node.nodeId,
+      kind: node.kind,
+      title: node.title,
+      body: node.body,
+      file_globs: node.fileGlobs,
+      // Not yet synced to the client graph; absent means "no tag evidence",
+      // never "excluded" (KL18).
+      context_tags: [],
+      globHit
+    }],
+    { promptTokens }
+    // ⚠ The gate is on RELEVANCE, as on the server. This once passed
+    // `relevanceFloor: 0` and left MIN_SCORE (on the product) as the only
+    // filter, so a sub-floor match rode a strong kind prior past it: 30% of
+    // replayed injections had r < RELEVANCE_FLOOR. MIN_SCORE stays as a second
+    // guard for a very weak kind; it can no longer admit what the gate refused.
+  );
+  return scored?.score ?? 0;
 }
 function parseFrontmatter(content) {
   const match = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
@@ -14315,20 +14580,22 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  const hasRepoGraph = (0, import_node_fs13.existsSync)(memoryDir());
+  const hasRepoGraph = (0, import_node_fs14.existsSync)(memoryDir());
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
+  const orgPromptTerms = orgTerms(promptText);
   const nodes = [];
   for (const domain of hasRepoGraph ? DOMAINS : []) {
-    const domainDir = (0, import_node_path13.join)(memoryDir(), domain);
-    if (!(0, import_node_fs13.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path14.join)(memoryDir(), domain);
+    if (!(0, import_node_fs14.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path13.join)(domainDir, file), "utf-8");
-          const { fm, body } = parseFrontmatter(content);
+          const read = readRegularFileInRoot(memoryDir(), `${domain}/${file}`, MAX_NODE_FILE_BYTES);
+          if (!read.ok) continue;
+          const { fm, body } = parseFrontmatter(read.content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
             path: `${domain}/${file}`,
@@ -14350,7 +14617,7 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
   try {
     for (const claim of await readOrgMirror()) {
       const local = orgNodeToLocal(claim);
-      if (sharedTerms(tokenize(`${local.title} ${local.body}`), promptTokens) >= ORG_MIN_SHARED_TERMS) nodes.push(local);
+      if (sharedTerms(orgTerms(`${local.title} ${local.body}`), orgPromptTerms) >= ORG_MIN_SHARED_TERMS) nodes.push(local);
     }
   } catch {
   }
@@ -14388,19 +14655,216 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
   return {
     nodes: selected,
     contextBlock: lines.join("\n"),
-    tokensUsed
+    tokensUsed,
+    eligible: filtered.length
   };
 }
 
-// src/lib/memory-sync.ts
-var import_promises9 = require("node:fs/promises");
+// src/lib/injection-record.ts
 var import_node_fs16 = require("node:fs");
-var import_node_path15 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
 
+// src/lib/safe-write.ts
+var import_node_fs15 = require("node:fs");
+var import_node_path15 = require("node:path");
+var FLAGS2 = import_node_fs15.constants;
+var O_NOFOLLOW = FLAGS2.O_NOFOLLOW ?? 0;
+var NOFOLLOW_AVAILABLE = O_NOFOLLOW !== 0;
+function validateRoot(root) {
+  try {
+    const parentReal = (0, import_node_fs15.realpathSync)((0, import_node_path15.dirname)(root));
+    const expected = (0, import_node_path15.join)(parentReal, (0, import_node_path15.basename)(root));
+    try {
+      (0, import_node_fs15.mkdirSync)(expected);
+    } catch (e) {
+      if (e.code !== "EEXIST") return null;
+    }
+    const st = (0, import_node_fs15.lstatSync)(expected, { bigint: true });
+    if (st.isSymbolicLink() || !st.isDirectory()) return null;
+    if ((0, import_node_fs15.realpathSync)(expected) !== expected) return null;
+    return { real: expected, dev: st.dev, ino: st.ino };
+  } catch {
+    return null;
+  }
+}
+function rootUnchanged(root) {
+  try {
+    const st = (0, import_node_fs15.lstatSync)(root.real, { bigint: true });
+    return !st.isSymbolicLink() && st.isDirectory() && st.dev === root.dev && st.ino === root.ino;
+  } catch {
+    return false;
+  }
+}
+function bareName(name) {
+  return !!name && name === (0, import_node_path15.basename)(name) && name !== "." && name !== ".." && !name.includes("\0");
+}
+function absentOrRegular(path) {
+  try {
+    const st = (0, import_node_fs15.lstatSync)(path);
+    return st.isFile() && !st.isSymbolicLink();
+  } catch (e) {
+    return e.code === "ENOENT";
+  }
+}
+function verifyOpened(fd, path, root) {
+  try {
+    const opened = (0, import_node_fs15.fstatSync)(fd, { bigint: true });
+    if (!opened.isFile() || opened.nlink !== 1n) return false;
+    const real = (0, import_node_fs15.realpathSync)(path);
+    if (!isInsideRoot(root.real, real)) return false;
+    const current = (0, import_node_fs15.statSync)(real, { bigint: true });
+    if (!sameOpenedFile(opened, current, NOFOLLOW_AVAILABLE)) return false;
+    return rootUnchanged(root);
+  } catch {
+    return false;
+  }
+}
+function removeIfOurs(fd, path) {
+  try {
+    const opened = (0, import_node_fs15.fstatSync)(fd, { bigint: true });
+    const at = (0, import_node_fs15.lstatSync)(path, { bigint: true });
+    if (!at.isSymbolicLink() && at.dev === opened.dev && at.ino === opened.ino) (0, import_node_fs15.unlinkSync)(path);
+  } catch {
+  }
+}
+function openTarget(path, append2) {
+  const base = import_node_fs15.constants.O_WRONLY | (append2 ? import_node_fs15.constants.O_APPEND : 0) | O_NOFOLLOW;
+  try {
+    return { fd: (0, import_node_fs15.openSync)(path, base), created: false };
+  } catch (e) {
+    if (e.code !== "ENOENT") return null;
+  }
+  try {
+    return { fd: (0, import_node_fs15.openSync)(path, base | import_node_fs15.constants.O_CREAT | import_node_fs15.constants.O_EXCL, 384), created: true };
+  } catch {
+    return null;
+  }
+}
+function writeVerified(root, name, hooks, append2, write) {
+  const r = validateRoot(root);
+  if (!r || !bareName(name)) return false;
+  const path = (0, import_node_path15.join)(r.real, name);
+  if (!absentOrRegular(path)) return false;
+  if (!runHook(hooks)) return false;
+  const opened = openTarget(path, append2);
+  if (!opened) return false;
+  try {
+    if (!verifyOpened(opened.fd, path, r)) {
+      if (opened.created) removeIfOurs(opened.fd, path);
+      return false;
+    }
+    write(opened.fd);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    try {
+      (0, import_node_fs15.closeSync)(opened.fd);
+    } catch {
+    }
+  }
+}
+function runHook(hooks) {
+  try {
+    hooks.afterRootValidated?.();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function appendInRoot(root, name, text, hooks = {}) {
+  return writeVerified(root, name, hooks, true, (fd) => {
+    (0, import_node_fs15.writeSync)(fd, text);
+  });
+}
+function replaceInRoot(root, name, text, hooks = {}) {
+  return writeVerified(root, name, hooks, false, (fd) => {
+    (0, import_node_fs15.ftruncateSync)(fd, 0);
+    (0, import_node_fs15.writeSync)(fd, text, 0);
+  });
+}
+
+// src/lib/injection-record.ts
+var MAX_PENDING = 200;
+var MAX_RECORD_BYTES = 1024 * 1024;
+var COMPACT_AT_BYTES = 256 * 1024;
+var MAX_NODES = 50;
+var SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var VIA = /^[A-Za-z0-9_+,:.-]{0,40}$/;
+var PROMPT_HASH = /^[0-9a-f]{16}$/;
+var nonNegInt = (v, max) => typeof v === "number" && Number.isInteger(v) && v >= 0 && v <= max;
+function parseInjectionEvent(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const o = raw;
+  if (typeof o.ts !== "number" || !Number.isFinite(o.ts) || o.ts <= 0 || o.ts > 1e13) return null;
+  if (!(o.session_id === null || typeof o.session_id === "string" && SAFE_ID.test(o.session_id))) return null;
+  if (typeof o.prompt_hash !== "string" || !PROMPT_HASH.test(o.prompt_hash)) return null;
+  if (o.arm !== "injected" && o.arm !== "withheld") return null;
+  if (!nonNegInt(o.eligible, 1e5) || !nonNegInt(o.tokens, 1e6)) return null;
+  if (!Array.isArray(o.nodes) || o.nodes.length > MAX_NODES) return null;
+  const nodes = [];
+  for (const n of o.nodes) {
+    if (!n || typeof n !== "object") return null;
+    const r = n;
+    if (typeof r.id !== "string" || !SAFE_ID.test(r.id)) return null;
+    if (typeof r.score !== "number" || !Number.isFinite(r.score) || r.score < 0 || r.score > 10) return null;
+    if (typeof r.via !== "string" || !VIA.test(r.via)) return null;
+    nodes.push({ id: r.id, score: r.score, via: r.via });
+  }
+  return {
+    ts: o.ts,
+    session_id: o.session_id,
+    prompt_hash: o.prompt_hash,
+    arm: o.arm,
+    nodes,
+    eligible: o.eligible,
+    tokens: o.tokens
+  };
+}
+var recordPath = () => projectPath(`${VERITY_DIR}/injections.jsonl`);
+function hashPrompt(prompt) {
+  return (0, import_node_crypto3.createHash)("sha256").update(prompt).digest("hex").slice(0, 16);
+}
+function recordInjection(event) {
+  if (!appendInRoot(projectPath(VERITY_DIR), "injections.jsonl", JSON.stringify(event) + "\n")) return;
+  try {
+    if ((0, import_node_fs16.lstatSync)(recordPath()).size > COMPACT_AT_BYTES) writeEvents(readPendingInjections());
+  } catch {
+  }
+}
+function writeEvents(events) {
+  replaceInRoot(projectPath(VERITY_DIR), "injections.jsonl", events.map((e) => JSON.stringify(e)).join("\n") + (events.length ? "\n" : ""));
+}
+function readPendingInjections() {
+  try {
+    const p = recordPath();
+    if (!(0, import_node_fs16.existsSync)(p)) return [];
+    const read = readRegularFileInRoot(projectPath(VERITY_DIR), "injections.jsonl", MAX_RECORD_BYTES);
+    if (!read.ok) return [];
+    const out = [];
+    for (const line of read.content.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        const e = parseInjectionEvent(JSON.parse(line));
+        if (e) out.push(e);
+      } catch {
+      }
+    }
+    return out.slice(-MAX_PENDING);
+  } catch {
+    return [];
+  }
+}
+
+// src/lib/memory-sync.ts
+var import_promises9 = require("node:fs/promises");
+var import_node_fs19 = require("node:fs");
+var import_node_path17 = require("node:path");
+var import_node_crypto4 = require("node:crypto");
+
 // src/lib/gitignore.ts
 var import_node_child_process6 = require("node:child_process");
-var import_node_fs14 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var VERITY_GITIGNORE_MARKER = "# Verity \u2014 machine-local state.";
 var SETTINGS_LOCAL_IGNORE_ENTRY = ".claude/settings.local.json";
 var VERITY_GITIGNORE_BLOCK = [
@@ -14484,7 +14948,7 @@ function fenceMemoryLines(lines) {
 function ensureVerityGitignore() {
   let content = "";
   try {
-    content = (0, import_node_fs14.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs17.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
@@ -14511,7 +14975,7 @@ function ensureVerityGitignore() {
       const sep4 = text === "" ? "" : text.endsWith("\n") ? "\n" : "\n\n";
       text = text + sep4 + VERITY_GITIGNORE_BLOCK;
     }
-    if (text !== content) (0, import_node_fs14.writeFileSync)(".gitignore", text);
+    if (text !== content) (0, import_node_fs17.writeFileSync)(".gitignore", text);
     return verified(
       memoryIsCommitted ? "memory-tracked" : hasSupersededMemory ? "memory-fenced" : needsRepair ? "repaired" : "added"
     );
@@ -14531,7 +14995,7 @@ function untrackMemory() {
 function writeFencedBlock() {
   let content = "";
   try {
-    content = (0, import_node_fs14.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs17.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   const hasMarker = content.includes(VERITY_GITIGNORE_MARKER);
@@ -14543,7 +15007,7 @@ function writeFencedBlock() {
     text = text + sep4 + VERITY_GITIGNORE_BLOCK;
   }
   try {
-    (0, import_node_fs14.writeFileSync)(".gitignore", text);
+    (0, import_node_fs17.writeFileSync)(".gitignore", text);
     return true;
   } catch {
     return false;
@@ -14552,14 +15016,14 @@ function writeFencedBlock() {
 function fenceMemory() {
   let original = null;
   try {
-    original = (0, import_node_fs14.readFileSync)(".gitignore", "utf-8");
+    original = (0, import_node_fs17.readFileSync)(".gitignore", "utf-8");
   } catch {
     original = null;
   }
   const restore = () => {
     try {
-      if (original === null) (0, import_node_fs14.rmSync)(".gitignore", { force: true });
-      else (0, import_node_fs14.writeFileSync)(".gitignore", original);
+      if (original === null) (0, import_node_fs17.rmSync)(".gitignore", { force: true });
+      else (0, import_node_fs17.writeFileSync)(".gitignore", original);
     } catch {
     }
   };
@@ -14577,7 +15041,7 @@ function fenceMemory() {
 }
 function memoryOptOut() {
   try {
-    return (0, import_node_fs14.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
+    return (0, import_node_fs17.readFileSync)(".gitignore", "utf-8").includes(MEMORY_OPT_OUT_MARKER);
   } catch {
     return false;
   }
@@ -14585,13 +15049,13 @@ function memoryOptOut() {
 function keepMemoryTracked() {
   let content = "";
   try {
-    content = (0, import_node_fs14.readFileSync)(".gitignore", "utf-8");
+    content = (0, import_node_fs17.readFileSync)(".gitignore", "utf-8");
   } catch {
   }
   if (content.includes(MEMORY_OPT_OUT_MARKER)) return "already";
   try {
     const sep4 = content === "" ? "" : content.endsWith("\n") ? "\n" : "\n\n";
-    (0, import_node_fs14.writeFileSync)(".gitignore", content + sep4 + MEMORY_OPT_OUT_STANZA);
+    (0, import_node_fs17.writeFileSync)(".gitignore", content + sep4 + MEMORY_OPT_OUT_STANZA);
   } catch {
     return "failed";
   }
@@ -14626,26 +15090,26 @@ function untrackVerityState() {
 }
 
 // src/lib/safe-path.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path16 = require("node:path");
 function resolveInside(baseDir, candidate) {
   if (typeof candidate !== "string" || candidate.length === 0) return null;
-  if ((0, import_node_path14.isAbsolute)(candidate)) return null;
-  const baseAbs = (0, import_node_path14.resolve)(baseDir);
-  const full = (0, import_node_path14.resolve)(baseAbs, candidate);
-  const baseSep = baseAbs.endsWith(import_node_path14.sep) ? baseAbs : baseAbs + import_node_path14.sep;
+  if ((0, import_node_path16.isAbsolute)(candidate)) return null;
+  const baseAbs = (0, import_node_path16.resolve)(baseDir);
+  const full = (0, import_node_path16.resolve)(baseAbs, candidate);
+  const baseSep = baseAbs.endsWith(import_node_path16.sep) ? baseAbs : baseAbs + import_node_path16.sep;
   if (full !== baseAbs && !full.startsWith(baseSep)) return null;
   try {
-    if ((0, import_node_fs15.existsSync)(baseAbs)) {
-      const realBase = (0, import_node_fs15.realpathSync)(baseAbs);
-      const realBaseSep = realBase.endsWith(import_node_path14.sep) ? realBase : realBase + import_node_path14.sep;
+    if ((0, import_node_fs18.existsSync)(baseAbs)) {
+      const realBase = (0, import_node_fs18.realpathSync)(baseAbs);
+      const realBaseSep = realBase.endsWith(import_node_path16.sep) ? realBase : realBase + import_node_path16.sep;
       let probe = full;
-      while (!(0, import_node_fs15.existsSync)(probe)) {
-        const parent = (0, import_node_path14.dirname)(probe);
+      while (!(0, import_node_fs18.existsSync)(probe)) {
+        const parent = (0, import_node_path16.dirname)(probe);
         if (parent === probe) break;
         probe = parent;
       }
-      const realProbe = (0, import_node_fs15.realpathSync)(probe);
+      const realProbe = (0, import_node_fs18.realpathSync)(probe);
       if (realProbe !== realBase && !realProbe.startsWith(realBaseSep)) return null;
     }
   } catch {
@@ -14653,37 +15117,37 @@ function resolveInside(baseDir, candidate) {
   }
   return full;
 }
-var O_NOFOLLOW = typeof import_node_fs15.constants.O_NOFOLLOW === "number" ? import_node_fs15.constants.O_NOFOLLOW : 0;
+var O_NOFOLLOW2 = typeof import_node_fs18.constants.O_NOFOLLOW === "number" ? import_node_fs18.constants.O_NOFOLLOW : 0;
 function readFileInside(baseDir, candidate, maxBytes) {
   const full = resolveInside(baseDir, candidate);
   if (!full) return null;
   let realParent;
   let realBase;
   try {
-    realParent = (0, import_node_fs15.realpathSync)((0, import_node_path14.dirname)(full));
-    realBase = (0, import_node_fs15.realpathSync)((0, import_node_path14.resolve)(baseDir));
+    realParent = (0, import_node_fs18.realpathSync)((0, import_node_path16.dirname)(full));
+    realBase = (0, import_node_fs18.realpathSync)((0, import_node_path16.resolve)(baseDir));
   } catch {
     return null;
   }
-  const realBaseSep = realBase.endsWith(import_node_path14.sep) ? realBase : realBase + import_node_path14.sep;
+  const realBaseSep = realBase.endsWith(import_node_path16.sep) ? realBase : realBase + import_node_path16.sep;
   if (realParent !== realBase && !realParent.startsWith(realBaseSep)) return null;
-  const target = (0, import_node_path14.join)(realParent, (0, import_node_path14.basename)(full));
+  const target = (0, import_node_path16.join)(realParent, (0, import_node_path16.basename)(full));
   let fd = null;
   try {
-    fd = (0, import_node_fs15.openSync)(target, import_node_fs15.constants.O_RDONLY | O_NOFOLLOW);
-    const st = (0, import_node_fs15.fstatSync)(fd);
+    fd = (0, import_node_fs18.openSync)(target, import_node_fs18.constants.O_RDONLY | O_NOFOLLOW2);
+    const st = (0, import_node_fs18.fstatSync)(fd);
     if (!st.isFile()) return null;
     const cap = Math.min(maxBytes, st.size);
     if (cap <= 0) return "";
     const buf = Buffer.alloc(cap);
-    const bytesRead = (0, import_node_fs15.readSync)(fd, buf, 0, cap, 0);
+    const bytesRead = (0, import_node_fs18.readSync)(fd, buf, 0, cap, 0);
     return buf.subarray(0, bytesRead).toString("utf-8");
   } catch {
     return null;
   } finally {
     if (fd !== null) {
       try {
-        (0, import_node_fs15.closeSync)(fd);
+        (0, import_node_fs18.closeSync)(fd);
       } catch {
       }
     }
@@ -14766,35 +15230,35 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises9.mkdir)((0, import_node_path15.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises9.mkdir)((0, import_node_path17.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs16.existsSync)((0, import_node_path15.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path15.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs19.existsSync)((0, import_node_path17.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path17.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs16.existsSync)((0, import_node_path15.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path15.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs19.existsSync)((0, import_node_path17.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path17.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs16.existsSync)((0, import_node_path15.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path15.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs19.existsSync)((0, import_node_path17.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path17.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
-  if (!(0, import_node_fs16.existsSync)(memoryDir2())) {
+  if (!(0, import_node_fs19.existsSync)(memoryDir2())) {
     return { schema_version: 1, nodes: [], index_hash: null, log_length: 0 };
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path15.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs16.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path17.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs19.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path15.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path17.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
-          const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
+          const hash = (0, import_node_crypto4.createHash)("sha256").update(content).digest("hex").slice(0, 16);
           nodes.push({ path: filePath, content_hash: `sha256:${hash}` });
         } catch {
         }
@@ -14804,32 +15268,32 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises9.readFile)((0, import_node_path15.join)(memoryDir2(), "index.md"), "utf-8");
-    indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
+    const indexContent = await (0, import_promises9.readFile)((0, import_node_path17.join)(memoryDir2(), "index.md"), "utf-8");
+    indexHash = `sha256:${(0, import_node_crypto4.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises9.readFile)((0, import_node_path15.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises9.readFile)((0, import_node_path17.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
   return { schema_version: 1, nodes, index_hash: indexHash, log_length: logLength };
 }
 function hashContent(content) {
-  return `sha256:${(0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
+  return `sha256:${(0, import_node_crypto4.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs16.existsSync)(memoryDir2())) return out;
+  if (!(0, import_node_fs19.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path15.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs16.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path17.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs19.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises9.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path15.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path17.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -14866,7 +15330,7 @@ async function recordSyncedNodePaths() {
   }
 }
 async function writeFileAtomic(path, content) {
-  await (0, import_promises9.mkdir)((0, import_node_path15.dirname)(path), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path17.dirname)(path), { recursive: true });
   const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
   await (0, import_promises9.writeFile)(tmp, content);
   await (0, import_promises9.rename)(tmp, path);
@@ -14880,8 +15344,8 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path15.join)(memoryDir2(), path);
-    if (!(0, import_node_fs16.existsSync)(full)) continue;
+    const full = (0, import_node_path17.join)(memoryDir2(), path);
+    if (!(0, import_node_fs19.existsSync)(full)) continue;
     let content;
     try {
       content = await (0, import_promises9.readFile)(full, "utf-8");
@@ -14925,8 +15389,8 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs16.existsSync)((0, import_node_path15.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path15.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises9.writeFile)((0, import_node_path15.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs19.existsSync)((0, import_node_path17.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path17.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises9.writeFile)((0, import_node_path17.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   if (opts.baseline === "written") await mergeSyncBaseline(synced);
@@ -14936,7 +15400,7 @@ async function applyMemoryWrites(writes, opts = {}) {
 async function mergeSyncBaseline(entries) {
   if (entries.size === 0) return;
   try {
-    if ((0, import_node_fs16.existsSync)(syncStateFile())) {
+    if ((0, import_node_fs19.existsSync)(syncStateFile())) {
       try {
         JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
       } catch {
@@ -14964,7 +15428,7 @@ async function applyOneWrite(write, treePaths, lastServed) {
       notes.push(`${write.path}: dropped unmatched file_globs [${grounded.dropped.join(", ")}]`);
     }
   }
-  if ((0, import_node_fs16.existsSync)(fullPath)) {
+  if ((0, import_node_fs19.existsSync)(fullPath)) {
     let existing = "";
     try {
       existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
@@ -14980,7 +15444,7 @@ async function applyOneWrite(write, treePaths, lastServed) {
       notes.push(`${write.path}: updated from server (untouched here since the server delivered it)`);
     }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path15.dirname)(fullPath), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path17.dirname)(fullPath), { recursive: true });
   await (0, import_promises9.writeFile)(fullPath, content);
   return { written: true, syncedHash: hashContent(content), notes };
 }
@@ -15021,8 +15485,8 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path15.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs16.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path17.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs19.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
@@ -15032,7 +15496,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises9.readFile)((0, import_node_path15.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises9.readFile)((0, import_node_path17.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -15056,7 +15520,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path15.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path17.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
@@ -15453,9 +15917,9 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path15.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path17.join)(cwd, "CLAUDE.md");
   let existing = "";
-  if ((0, import_node_fs16.existsSync)(claudeMdPath)) {
+  if ((0, import_node_fs19.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
@@ -15596,9 +16060,9 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 `;
 
 // src/lib/dossier-session.ts
-var import_node_fs21 = require("node:fs");
-var import_node_crypto7 = require("node:crypto");
-var import_node_path18 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_crypto8 = require("node:crypto");
+var import_node_path20 = require("node:path");
 
 // src/lib/pending-repeat.ts
 var STOP = /* @__PURE__ */ new Set([
@@ -15702,9 +16166,9 @@ function statementAnchorKey(file, patternId) {
 }
 
 // src/lib/dossier/log.ts
-var import_node_crypto4 = require("node:crypto");
-var import_node_fs17 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_crypto5 = require("node:crypto");
+var import_node_fs20 = require("node:fs");
+var import_node_path18 = require("node:path");
 var CRC_TABLE = (() => {
   const t = new Int32Array(256);
   for (let i = 0; i < 256; i++) {
@@ -15723,13 +16187,13 @@ function crc32(s) {
 function openDossier(identity) {
   try {
     const dir = dossierDir(identity);
-    (0, import_node_fs17.mkdirSync)(dir, { recursive: true, mode: 448 });
+    (0, import_node_fs20.mkdirSync)(dir, { recursive: true, mode: 448 });
     return {
       dir,
       identity,
-      eventsPath: (0, import_node_path16.join)(dir, "events.jsonl"),
-      foldPath: (0, import_node_path16.join)(dir, "fold.json"),
-      rotatedDir: (0, import_node_path16.join)(dir, "rotated")
+      eventsPath: (0, import_node_path18.join)(dir, "events.jsonl"),
+      foldPath: (0, import_node_path18.join)(dir, "fold.json"),
+      rotatedDir: (0, import_node_path18.join)(dir, "rotated")
     };
   } catch {
     return null;
@@ -15744,7 +16208,7 @@ function nextSeq() {
 function encodeEvent(ev) {
   const full = {
     v: 1,
-    id: (0, import_node_crypto4.randomBytes)(4).toString("hex"),
+    id: (0, import_node_crypto5.randomBytes)(4).toString("hex"),
     ...ev
   };
   let body = JSON.stringify(full);
@@ -15791,7 +16255,7 @@ function appendEvent(d, ev) {
       at: ev.at ?? (/* @__PURE__ */ new Date()).toISOString(),
       ...ev
     });
-    (0, import_node_fs17.appendFileSync)(d.eventsPath, line, { mode: 384 });
+    (0, import_node_fs20.appendFileSync)(d.eventsPath, line, { mode: 384 });
     return true;
   } catch {
     return false;
@@ -15799,14 +16263,14 @@ function appendEvent(d, ev) {
 }
 function rotateIfNeeded2(d) {
   try {
-    if (!(0, import_node_fs17.existsSync)(d.eventsPath)) return;
-    if ((0, import_node_fs17.statSync)(d.eventsPath).size < ROTATE_BYTES) return;
-    (0, import_node_fs17.mkdirSync)(d.rotatedDir, { recursive: true, mode: 448 });
-    (0, import_node_fs17.renameSync)(d.eventsPath, (0, import_node_path16.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
-    const kept = (0, import_node_fs17.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
+    if (!(0, import_node_fs20.existsSync)(d.eventsPath)) return;
+    if ((0, import_node_fs20.statSync)(d.eventsPath).size < ROTATE_BYTES) return;
+    (0, import_node_fs20.mkdirSync)(d.rotatedDir, { recursive: true, mode: 448 });
+    (0, import_node_fs20.renameSync)(d.eventsPath, (0, import_node_path18.join)(d.rotatedDir, `events.${Date.now()}.jsonl`));
+    const kept = (0, import_node_fs20.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
     for (const stale of kept.slice(0, Math.max(0, kept.length - ROTATE_KEEP))) {
       try {
-        (0, import_node_fs17.renameSync)((0, import_node_path16.join)(d.rotatedDir, stale), (0, import_node_path16.join)(d.rotatedDir, `${stale}.pruned`));
+        (0, import_node_fs20.renameSync)((0, import_node_path18.join)(d.rotatedDir, stale), (0, import_node_path18.join)(d.rotatedDir, `${stale}.pruned`));
       } catch {
       }
     }
@@ -15815,9 +16279,9 @@ function rotateIfNeeded2(d) {
 }
 
 // src/lib/dossier/fold-dossier.ts
-var import_node_crypto5 = require("node:crypto");
-var import_node_fs18 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_crypto6 = require("node:crypto");
+var import_node_fs21 = require("node:fs");
+var import_node_path19 = require("node:path");
 var EMPTY_CAPABILITIES = () => ({
   human_reachable: { value: "unknown", tier: "unknown" },
   authorship_observability: { value: "unknown", tier: "unknown" },
@@ -15868,12 +16332,12 @@ function foldDossier(d, opts = {}) {
     }
   };
   try {
-    if ((0, import_node_fs18.existsSync)(d.rotatedDir)) {
-      const files = (0, import_node_fs18.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
+    if ((0, import_node_fs21.existsSync)(d.rotatedDir)) {
+      const files = (0, import_node_fs21.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).sort();
       state.meta.rotations = files.length;
       for (const f of files) {
         try {
-          ingest((0, import_node_fs18.readFileSync)((0, import_node_path17.join)(d.rotatedDir, f), "utf8"));
+          ingest((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(d.rotatedDir, f), "utf8"));
         } catch {
           state.meta.dropped_lines++;
         }
@@ -15882,9 +16346,9 @@ function foldDossier(d, opts = {}) {
   } catch {
   }
   try {
-    if ((0, import_node_fs18.existsSync)(d.eventsPath)) {
-      state.meta.upto_offset = (0, import_node_fs18.statSync)(d.eventsPath).size;
-      ingest((0, import_node_fs18.readFileSync)(d.eventsPath, "utf8"));
+    if ((0, import_node_fs21.existsSync)(d.eventsPath)) {
+      state.meta.upto_offset = (0, import_node_fs21.statSync)(d.eventsPath).size;
+      ingest((0, import_node_fs21.readFileSync)(d.eventsPath, "utf8"));
     }
   } catch {
   }
@@ -15907,7 +16371,7 @@ function reduce(state, events, now) {
     state.meta.seq = Math.max(state.meta.seq, ev.seq);
     switch (ev.k) {
       case "goal": {
-        const hash = (0, import_node_crypto5.createHash)("sha256").update(ev.text).digest("hex").slice(0, 16);
+        const hash = (0, import_node_crypto6.createHash)("sha256").update(ev.text).digest("hex").slice(0, 16);
         const prev = state.goal[state.goal.length - 1];
         if (prev && prev.hash === hash) {
           prev.repeats = (prev.repeats ?? 0) + 1;
@@ -16155,7 +16619,7 @@ function applyBounds(state, input) {
 }
 
 // src/lib/dossier/cache.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs22 = require("node:fs");
 function compactState(s) {
   const ms = (iso) => Date.parse(iso) || 0;
   return {
@@ -16284,20 +16748,20 @@ function encodeState(s) {
 function writeFoldCache(d, state) {
   try {
     const tmp = `${d.foldPath}.${process.pid}.tmp`;
-    (0, import_node_fs19.writeFileSync)(tmp, encodeState(state), { mode: 384 });
-    (0, import_node_fs19.renameSync)(tmp, d.foldPath);
+    (0, import_node_fs22.writeFileSync)(tmp, encodeState(state), { mode: 384 });
+    (0, import_node_fs22.renameSync)(tmp, d.foldPath);
   } catch {
   }
 }
 function readFoldCache(d) {
   try {
-    if (!(0, import_node_fs19.existsSync)(d.foldPath)) return null;
-    const raw = JSON.parse((0, import_node_fs19.readFileSync)(d.foldPath, "utf8"));
+    if (!(0, import_node_fs22.existsSync)(d.foldPath)) return null;
+    const raw = JSON.parse((0, import_node_fs22.readFileSync)(d.foldPath, "utf8"));
     if (raw?.v !== 1) return null;
     const cached2 = expandState(raw);
     if (!cached2?.meta) return null;
-    const size = (0, import_node_fs19.existsSync)(d.eventsPath) ? (0, import_node_fs19.statSync)(d.eventsPath).size : 0;
-    const rotations = (0, import_node_fs19.existsSync)(d.rotatedDir) ? (0, import_node_fs19.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).length : 0;
+    const size = (0, import_node_fs22.existsSync)(d.eventsPath) ? (0, import_node_fs22.statSync)(d.eventsPath).size : 0;
+    const rotations = (0, import_node_fs22.existsSync)(d.rotatedDir) ? (0, import_node_fs22.readdirSync)(d.rotatedDir).filter((f) => f.endsWith(".jsonl")).length : 0;
     if (cached2.meta.upto_offset !== size || cached2.meta.rotations !== rotations) return null;
     return cached2;
   } catch {
@@ -16347,14 +16811,14 @@ function assessContinuity(i) {
 }
 
 // src/lib/dossier/reanchor.ts
-var import_node_crypto6 = require("node:crypto");
-var import_node_fs20 = require("node:fs");
+var import_node_crypto7 = require("node:crypto");
+var import_node_fs23 = require("node:fs");
 function lineSha(text) {
-  return (0, import_node_crypto6.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
+  return (0, import_node_crypto7.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
 }
 function fileHash(path) {
   try {
-    return (0, import_node_crypto6.createHash)("sha256").update((0, import_node_fs20.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
+    return (0, import_node_crypto7.createHash)("sha256").update((0, import_node_fs23.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
   } catch {
     return null;
   }
@@ -16726,20 +17190,20 @@ function foreignAuthoredPaths(identity, opts = {}) {
   let sessions = 0;
   try {
     const dir = treeDir(identity);
-    if (!(0, import_node_fs21.existsSync)(dir)) return { paths: [], sessions: 0 };
-    for (const entry of (0, import_node_fs21.readdirSync)(dir, { withFileTypes: true })) {
+    if (!(0, import_node_fs24.existsSync)(dir)) return { paths: [], sessions: 0 };
+    for (const entry of (0, import_node_fs24.readdirSync)(dir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       if (entry.name === identity.sessionKey) continue;
-      const log = (0, import_node_path18.join)(dir, entry.name, "events.jsonl");
+      const log = (0, import_node_path20.join)(dir, entry.name, "events.jsonl");
       try {
-        if (!(0, import_node_fs21.existsSync)(log)) continue;
-        if (now - (0, import_node_fs21.statSync)(log).mtimeMs > windowMs) continue;
+        if (!(0, import_node_fs24.existsSync)(log)) continue;
+        if (now - (0, import_node_fs24.statSync)(log).mtimeMs > windowMs) continue;
         const sib = {
-          dir: (0, import_node_path18.join)(dir, entry.name),
+          dir: (0, import_node_path20.join)(dir, entry.name),
           identity,
           eventsPath: log,
-          foldPath: (0, import_node_path18.join)(dir, entry.name, "fold.json"),
-          rotatedDir: (0, import_node_path18.join)(dir, entry.name, "rotated")
+          foldPath: (0, import_node_path20.join)(dir, entry.name, "fold.json"),
+          rotatedDir: (0, import_node_path20.join)(dir, entry.name, "rotated")
         };
         const state = readFoldCache(sib) ?? foldDossier(sib);
         sessions++;
@@ -16767,25 +17231,25 @@ function pruneOldDossiers(identity, maxAgeMs = 7 * 24 * 60 * 60 * 1e3) {
   let removed = 0;
   try {
     const mine = dossierDir(identity);
-    const userDir = (0, import_node_path18.dirname)((0, import_node_path18.dirname)(mine));
-    if (!(0, import_node_fs21.existsSync)(userDir)) return 0;
+    const userDir = (0, import_node_path20.dirname)((0, import_node_path20.dirname)(mine));
+    if (!(0, import_node_fs24.existsSync)(userDir)) return 0;
     const cutoff = Date.now() - maxAgeMs;
-    for (const tree of (0, import_node_fs21.readdirSync)(userDir, { withFileTypes: true })) {
+    for (const tree of (0, import_node_fs24.readdirSync)(userDir, { withFileTypes: true })) {
       if (!tree.isDirectory()) continue;
-      const treePath = (0, import_node_path18.join)(userDir, tree.name);
+      const treePath = (0, import_node_path20.join)(userDir, tree.name);
       let live = 0;
-      for (const entry of (0, import_node_fs21.readdirSync)(treePath, { withFileTypes: true })) {
+      for (const entry of (0, import_node_fs24.readdirSync)(treePath, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const dir = (0, import_node_path18.join)(treePath, entry.name);
+        const dir = (0, import_node_path20.join)(treePath, entry.name);
         if (dir === mine) {
           live++;
           continue;
         }
         try {
-          const log = (0, import_node_path18.join)(dir, "events.jsonl");
-          const at = (0, import_node_fs21.existsSync)(log) ? (0, import_node_fs21.statSync)(log).mtimeMs : (0, import_node_fs21.statSync)(dir).mtimeMs;
+          const log = (0, import_node_path20.join)(dir, "events.jsonl");
+          const at = (0, import_node_fs24.existsSync)(log) ? (0, import_node_fs24.statSync)(log).mtimeMs : (0, import_node_fs24.statSync)(dir).mtimeMs;
           if (at < cutoff) {
-            (0, import_node_fs21.rmSync)(dir, { recursive: true, force: true });
+            (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
             removed++;
           } else {
             live++;
@@ -16795,7 +17259,7 @@ function pruneOldDossiers(identity, maxAgeMs = 7 * 24 * 60 * 60 * 1e3) {
       }
       if (live === 0) {
         try {
-          (0, import_node_fs21.rmSync)(treePath, { recursive: false, force: false });
+          (0, import_node_fs24.rmSync)(treePath, { recursive: false, force: false });
         } catch {
         }
       }
@@ -16812,8 +17276,8 @@ function sessionDossier(token, sessionId) {
 }
 function hasActiveGoal(d) {
   try {
-    if (!(0, import_node_fs21.existsSync)(d.eventsPath)) return false;
-    return (0, import_node_fs21.readFileSync)(d.eventsPath, "utf8").includes('"k":"goal"');
+    if (!(0, import_node_fs24.existsSync)(d.eventsPath)) return false;
+    return (0, import_node_fs24.readFileSync)(d.eventsPath, "utf8").includes('"k":"goal"');
   } catch {
     return false;
   }
@@ -16837,7 +17301,7 @@ function recordTurn(d, t) {
   for (const a of t.authored) {
     const origin = a.owner === "subagent" ? "subagent" : "edit_tool";
     const prior = t.known?.authored?.get(a.p);
-    const hash = fileHash((0, import_node_path18.join)(root, a.p));
+    const hash = fileHash((0, import_node_path20.join)(root, a.p));
     const hunks = Math.max(0, a.h - (prior?.hunks ?? 0));
     const adds = Math.max(0, a.a - (prior?.adds ?? 0));
     const dels = Math.max(0, a.d - (prior?.dels ?? 0));
@@ -16851,7 +17315,7 @@ function recordTurn(d, t) {
       // Identity is the COMMAND, not its category — otherwise `npm test -- a` and
       // `npm test -- b` are one row and the streak counts two different commands
       // as a run of one.
-      cmd_hash: (0, import_node_crypto7.createHash)("sha256").update(c.head || c.class).digest("hex").slice(0, 12),
+      cmd_hash: (0, import_node_crypto8.createHash)("sha256").update(c.head || c.class).digest("hex").slice(0, 12),
       head: c.head || c.class,
       status: toStatus(c.last_status)
     });
@@ -16870,7 +17334,7 @@ function recordTurn(d, t) {
   }
   const seenDivergence = t.known?.divergence ?? /* @__PURE__ */ new Set();
   for (const u of t.unobserved) {
-    const hash = fileHash((0, import_node_path18.join)(root, u.p));
+    const hash = fileHash((0, import_node_path20.join)(root, u.p));
     if (seenDivergence.has(divergenceKey(u.p, hash))) continue;
     appendEvent(d, { k: "divergence", kind: "external_mutation", path: u.p, hash });
   }
@@ -16905,8 +17369,8 @@ function recordVerdict(d, v) {
     if (!sent.has(f.file)) continue;
     if (!lines.has(f.file)) {
       try {
-        const abs = (0, import_node_path18.join)(root, f.file);
-        lines.set(f.file, (0, import_node_fs21.existsSync)(abs) ? (0, import_node_fs21.readFileSync)(abs, "utf8").split("\n") : null);
+        const abs = (0, import_node_path20.join)(root, f.file);
+        lines.set(f.file, (0, import_node_fs24.existsSync)(abs) ? (0, import_node_fs24.readFileSync)(abs, "utf8").split("\n") : null);
       } catch {
         lines.set(f.file, null);
       }
@@ -17006,8 +17470,8 @@ function recallMemory(d, identity, opts) {
       budgetBytes: opts.budgetBytes,
       readFileLines: (file) => {
         try {
-          const abs = (0, import_node_path18.join)(root, file);
-          return (0, import_node_fs21.existsSync)(abs) ? (0, import_node_fs21.readFileSync)(abs, "utf8").split("\n") : null;
+          const abs = (0, import_node_path20.join)(root, file);
+          return (0, import_node_fs24.existsSync)(abs) ? (0, import_node_fs24.readFileSync)(abs, "utf8").split("\n") : null;
         } catch {
           return null;
         }
@@ -17026,6 +17490,9 @@ function recallMemory(d, identity, opts) {
 }
 
 // src/commands/intent.ts
+var MAX_PROMPT_EVENT_BYTES = 2 * 1024 * 1024;
+var MAX_PROMPT_CHARS2 = 2e5;
+var SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 function registerIntentCommands(program2) {
   const intent = program2.command("intent").description("Manage intent capture");
   intent.command("capture").description("Capture user intent from stdin (used by UserPromptSubmit hook)").action(async () => {
@@ -17039,16 +17506,24 @@ function registerIntentCommands(program2) {
         process.exit(0);
       }
       const chunks = [];
+      let size = 0;
       for await (const chunk of process.stdin) {
-        chunks.push(chunk);
+        size += chunk.length;
+        if (size <= MAX_PROMPT_EVENT_BYTES) chunks.push(chunk);
       }
-      const input = Buffer.concat(chunks).toString("utf-8").trim();
+      const input = size > MAX_PROMPT_EVENT_BYTES ? "" : Buffer.concat(chunks).toString("utf-8").trim();
       if (!input) {
         process.exit(0);
       }
-      let event;
+      let event = {};
       try {
-        event = JSON.parse(input);
+        const parsed = JSON.parse(input);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) process.exit(0);
+        const o = parsed;
+        event = {
+          prompt: typeof o.prompt === "string" ? o.prompt.slice(0, MAX_PROMPT_CHARS2) : void 0,
+          session_id: typeof o.session_id === "string" && SESSION_ID_RE.test(o.session_id) ? o.session_id : void 0
+        };
       } catch {
         process.exit(0);
       }
@@ -17077,6 +17552,19 @@ function registerIntentCommands(program2) {
         const injection = await retrieveForInjection(prompt);
         if (injection) {
           process.stdout.write(injection.contextBlock);
+          recordInjection({
+            ts: Date.now(),
+            session_id: scopeSession || null,
+            prompt_hash: hashPrompt(prompt),
+            arm: "injected",
+            eligible: injection.eligible,
+            tokens: injection.tokensUsed,
+            nodes: injection.nodes.map((n) => ({
+              id: n.nodeId,
+              score: Math.round(n.score * 1e3) / 1e3,
+              via: `${n.fileGlobs.length ? "g" : ""}${n.scope === "org" ? "o" : ""}x`
+            }))
+          });
         }
       } catch {
       }
@@ -17085,179 +17573,87 @@ function registerIntentCommands(program2) {
           error: err.message?.slice(0, 200) ?? "unknown"
         });
       });
-    } catch {
-    }
-    process.exit(0);
-  });
-  intent.command("classify-body").description("Output JSON body for POST /classify-task (internal, used by hooks)").requiredOption("--session-id <id>", "Session ID").requiredOption("--prompt <text>", "User prompt").requiredOption("--prompt-hash <hash>", "SHA-256 hash of the prompt").action((opts) => {
-    const body = JSON.stringify({
-      session_id: opts.sessionId,
-      user_prompt: opts.prompt.slice(0, 4e3),
-      user_prompt_hash: opts.promptHash
-    });
-    process.stdout.write(body);
-  });
-}
-async function fireClassify(prompt, sessionId, globals) {
-  if (!sessionId) {
-    logEvent("classify_skipped", { reason: "no_session_id" });
-    return;
-  }
-  const tokenResult = await resolveToken(globals?.token);
-  if (!tokenResult.ok) {
-    logEvent("classify_skipped", { reason: "no_token", detail: tokenResult.error });
-    return;
-  }
-  const urlResult = await resolveServiceUrl(globals?.serviceUrl);
-  if (!urlResult.ok) {
-    logEvent("classify_skipped", { reason: "no_service_url", detail: urlResult.error });
-    return;
-  }
-  const promptHash = (0, import_node_crypto8.createHash)("sha256").update(prompt).digest("hex");
-  const result = await apiRequest({
-    method: "POST",
-    path: "/classify-task",
-    serviceUrl: urlResult.data,
-    token: tokenResult.data.token,
-    body: {
-      session_id: sessionId,
-      user_prompt: prompt.slice(0, 4e3),
-      user_prompt_hash: promptHash
-    },
-    timeout: 4e3,
-    cmd: "classify"
-  });
-  if (!result.ok) {
-    logEvent("classify_failed", {
-      category: result.category,
-      http_status: result.http_status ?? null,
-      error: result.error?.slice(0, 200) ?? "unknown",
-      prompt_len: prompt.length
-    });
-    return;
-  }
-  const classificationId = result.data.classification_id;
-  const status = result.data.status;
-  logEvent("classify_accepted", {
-    classification_id: classificationId ?? null,
-    status: status ?? null,
-    prompt_len: prompt.length
-  });
-  const decidedTaskId = result.data.decided_task_id;
-  if (decidedTaskId) {
-    appendPromptToTaskBuffer(decidedTaskId, prompt, sessionId).catch(() => {
-    });
-  }
-}
-
-// src/commands/lifecycle.ts
-var import_node_fs25 = require("node:fs");
-var import_node_path23 = require("node:path");
-
-// src/lib/baseline.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path22 = require("node:path");
-var import_node_crypto9 = require("node:crypto");
-
-// src/lib/snapshot.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path21 = require("node:path");
-var import_node_child_process7 = require("node:child_process");
-
-// src/lib/files.ts
-var import_node_path20 = require("node:path");
-
-// src/lib/safe-read.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path19 = require("node:path");
-var FLAGS = import_node_fs22.constants;
-var NOFOLLOW = FLAGS.O_NOFOLLOW;
-var NONBLOCK = FLAGS.O_NONBLOCK;
-function closeOpened(fd) {
-  try {
-    (0, import_node_fs22.closeSync)(fd);
-  } catch {
-  }
-}
-function isInsideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path19.sep) ? realRoot : realRoot + import_node_path19.sep);
-}
-function sameOpenedFile(opened, current, nofollowAvailable) {
-  if (!nofollowAvailable && (opened.ino === 0n || current.ino === 0n)) return false;
-  return opened.ino === current.ino && opened.dev === current.dev;
-}
-function openRegularInRoot(root, path) {
-  const full = (0, import_node_path19.isAbsolute)(path) ? path : (0, import_node_path19.join)(root, path);
-  let fd;
-  try {
-    fd = (0, import_node_fs22.openSync)(full, import_node_fs22.constants.O_RDONLY | (NOFOLLOW ?? 0) | (NONBLOCK ?? 0));
-  } catch (err) {
-    const code = err.code;
-    if (code === "ELOOP" || code === "EMLINK" || code === "EFTYPE") return { ok: false, reason: "symlink" };
-    if (code === "ENOENT" || code === "ENOTDIR") return { ok: false, reason: "missing" };
-    return { ok: false, reason: "unreadable" };
-  }
-  try {
-    const opened = (0, import_node_fs22.fstatSync)(fd, { bigint: true });
-    if (!opened.isFile()) {
-      closeOpened(fd);
-      return { ok: false, reason: "not-regular" };
-    }
-    const realRoot = import_node_fs22.realpathSync.native(root);
-    const realPath = import_node_fs22.realpathSync.native(full);
-    if (!isInsideRoot(realRoot, realPath)) {
-      closeOpened(fd);
-      return { ok: false, reason: "outside-root" };
-    }
-    const current = (0, import_node_fs22.statSync)(realPath, { bigint: true });
-    if (!sameOpenedFile(opened, current, NOFOLLOW !== void 0)) {
-      closeOpened(fd);
-      return { ok: false, reason: NOFOLLOW === void 0 ? "unreadable" : "outside-root" };
-    }
-    return { ok: true, fd, size: Number(opened.size), mtimeMs: Number(opened.mtimeMs) };
-  } catch {
-    closeOpened(fd);
-    return { ok: false, reason: "unreadable" };
-  }
-}
-function statRegularInRoot(root, path) {
-  const opened = openRegularInRoot(root, path);
-  if (!opened.ok) return opened;
-  closeOpened(opened.fd);
-  return { ok: true, size: opened.size, mtimeMs: opened.mtimeMs };
-}
-function readOpened(fd, size) {
-  try {
-    const buffer = Buffer.alloc(size);
-    let offset = 0;
-    while (offset < size) {
-      const n = (0, import_node_fs22.readSync)(fd, buffer, offset, size - offset, offset);
-      if (n === 0) break;
-      offset += n;
+    } catch {
     }
-    return buffer.subarray(0, offset);
-  } finally {
-    closeOpened(fd);
-  }
-}
-function readOpenedUtf8(fd, size) {
-  return readOpened(fd, size).toString("utf-8");
+    process.exit(0);
+  });
+  intent.command("classify-body").description("Output JSON body for POST /classify-task (internal, used by hooks)").requiredOption("--session-id <id>", "Session ID").requiredOption("--prompt <text>", "User prompt").requiredOption("--prompt-hash <hash>", "SHA-256 hash of the prompt").action((opts) => {
+    const body = JSON.stringify({
+      session_id: opts.sessionId,
+      user_prompt: opts.prompt.slice(0, 4e3),
+      user_prompt_hash: opts.promptHash
+    });
+    process.stdout.write(body);
+  });
 }
-function readRegularFileInRoot(root, path, maxBytes) {
-  const opened = openRegularInRoot(root, path);
-  if (!opened.ok) return opened;
-  if (opened.size > maxBytes) {
-    closeOpened(opened.fd);
-    return { ok: false, reason: "too-large", size: opened.size };
+async function fireClassify(prompt, sessionId, globals) {
+  if (!sessionId) {
+    logEvent("classify_skipped", { reason: "no_session_id" });
+    return;
   }
-  try {
-    return { ok: true, content: readOpenedUtf8(opened.fd, opened.size), size: opened.size };
-  } catch {
-    return { ok: false, reason: "unreadable" };
+  const tokenResult = await resolveToken(globals?.token);
+  if (!tokenResult.ok) {
+    logEvent("classify_skipped", { reason: "no_token", detail: tokenResult.error });
+    return;
+  }
+  const urlResult = await resolveServiceUrl(globals?.serviceUrl);
+  if (!urlResult.ok) {
+    logEvent("classify_skipped", { reason: "no_service_url", detail: urlResult.error });
+    return;
+  }
+  const promptHash = (0, import_node_crypto9.createHash)("sha256").update(prompt).digest("hex");
+  const result = await apiRequest({
+    method: "POST",
+    path: "/classify-task",
+    serviceUrl: urlResult.data,
+    token: tokenResult.data.token,
+    body: {
+      session_id: sessionId,
+      user_prompt: prompt.slice(0, 4e3),
+      user_prompt_hash: promptHash
+    },
+    timeout: 4e3,
+    cmd: "classify"
+  });
+  if (!result.ok) {
+    logEvent("classify_failed", {
+      category: result.category,
+      http_status: result.http_status ?? null,
+      error: result.error?.slice(0, 200) ?? "unknown",
+      prompt_len: prompt.length
+    });
+    return;
+  }
+  const classificationId = result.data.classification_id;
+  const status = result.data.status;
+  logEvent("classify_accepted", {
+    classification_id: classificationId ?? null,
+    status: status ?? null,
+    prompt_len: prompt.length
+  });
+  const decidedTaskId = result.data.decided_task_id;
+  if (decidedTaskId) {
+    appendPromptToTaskBuffer(decidedTaskId, prompt, sessionId).catch(() => {
+    });
   }
 }
 
+// src/commands/lifecycle.ts
+var import_node_fs27 = require("node:fs");
+var import_node_path24 = require("node:path");
+
+// src/lib/baseline.ts
+var import_node_fs26 = require("node:fs");
+var import_node_path23 = require("node:path");
+var import_node_crypto10 = require("node:crypto");
+
+// src/lib/snapshot.ts
+var import_node_fs25 = require("node:fs");
+var import_node_path22 = require("node:path");
+var import_node_child_process7 = require("node:child_process");
+
 // src/lib/files.ts
+var import_node_path21 = require("node:path");
 var LANG_MAP = {
   // Analyzable (static analysis + Gemini)
   ts: "typescript",
@@ -17325,7 +17721,7 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path20.extname)(filepath).slice(1);
+  const ext = (0, import_node_path21.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
@@ -17416,16 +17812,16 @@ function collectCodeDelta(files, opts) {
 
 // src/lib/snapshot.ts
 function generateSnapshotDiffs(files) {
-  if (!(0, import_node_fs23.existsSync)(SNAPSHOT_DIR)) {
+  if (!(0, import_node_fs25.existsSync)(SNAPSHOT_DIR)) {
     return { diffs: [], has_snapshots: false };
   }
   const diffs = [];
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path21.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path22.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
-    if ((0, import_node_fs23.existsSync)(snapshotPath)) {
-      const oldContent = (0, import_node_fs23.readFileSync)(snapshotPath, "utf-8");
+    if ((0, import_node_fs25.existsSync)(snapshotPath)) {
+      const oldContent = (0, import_node_fs25.readFileSync)(snapshotPath, "utf-8");
       if (oldContent === file.content) continue;
       const diff = computeDiff(oldContent, file.content, file.path);
       if (diff) {
@@ -17450,20 +17846,20 @@ function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
     if (!resolveInside(SNAPSHOT_DIR, file.path)) continue;
-    const snapshotPath = (0, import_node_path21.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path22.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs23.mkdirSync)((0, import_node_path21.dirname)(snapshotPath), { recursive: true });
-    (0, import_node_fs23.writeFileSync)(snapshotPath, file.content);
+    (0, import_node_fs25.mkdirSync)((0, import_node_path22.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs25.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path21.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path21.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path22.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path22.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
-    (0, import_node_fs23.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
-    (0, import_node_fs23.writeFileSync)(tmpOld, oldContent);
-    (0, import_node_fs23.writeFileSync)(tmpNew, newContent);
+    (0, import_node_fs25.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
+    (0, import_node_fs25.writeFileSync)(tmpOld, oldContent);
+    (0, import_node_fs25.writeFileSync)(tmpNew, newContent);
     const result = (0, import_node_child_process7.execSync)(
       `git diff --no-index --unified=10 -- "${tmpOld}" "${tmpNew}"`,
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
@@ -17477,32 +17873,32 @@ function computeDiff(oldContent, newContent, filePath) {
     return null;
   } finally {
     try {
-      (0, import_node_fs23.unlinkSync)(tmpOld);
+      (0, import_node_fs25.unlinkSync)(tmpOld);
     } catch {
     }
     try {
-      (0, import_node_fs23.unlinkSync)(tmpNew);
+      (0, import_node_fs25.unlinkSync)(tmpNew);
     } catch {
     }
   }
 }
 function cleanStaleSnapshots(dir, keepSet) {
-  if (!(0, import_node_fs23.existsSync)(dir)) return;
+  if (!(0, import_node_fs25.existsSync)(dir)) return;
   try {
-    const entries = (0, import_node_fs23.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs25.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (dir === SNAPSHOT_DIR && (entry.name === ".diff-old.tmp" || entry.name === ".diff-new.tmp")) continue;
-      const fullPath = (0, import_node_path21.join)(dir, entry.name);
+      const fullPath = (0, import_node_path22.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
-          const remaining = (0, import_node_fs23.readdirSync)(fullPath);
-          if (remaining.length === 0) (0, import_node_fs23.rmdirSync)(fullPath);
+          const remaining = (0, import_node_fs25.readdirSync)(fullPath);
+          if (remaining.length === 0) (0, import_node_fs25.rmdirSync)(fullPath);
         } catch {
         }
       } else if (!keepSet.has(fullPath)) {
         try {
-          (0, import_node_fs23.unlinkSync)(fullPath);
+          (0, import_node_fs25.unlinkSync)(fullPath);
         } catch {
         }
       }
@@ -17518,23 +17914,23 @@ var MIRROR_MAX_BYTES = 2 * 1024 * 1024;
 var DEFAULT_SESSION_KEY = "_default";
 function sessionKey(sessionId) {
   if (!sessionId) return DEFAULT_SESSION_KEY;
-  return (0, import_node_crypto9.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
+  return (0, import_node_crypto10.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path22.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path23.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path22.join)(dir, "manifest.json");
+  return (0, import_node_path23.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path22.join)(dir, "files", repoRelPath);
+  return (0, import_node_path23.join)(dir, "files", repoRelPath);
 }
 var CARRY_FILE = `${BASELINE_DIR}/.carry`;
 var CARRY_WINDOW_MS = 12e4;
 function writeCarry(sessionId, headSha) {
   try {
-    (0, import_node_fs24.mkdirSync)(projectPath(BASELINE_DIR), { recursive: true });
-    (0, import_node_fs24.writeFileSync)(
+    (0, import_node_fs26.mkdirSync)(projectPath(BASELINE_DIR), { recursive: true });
+    (0, import_node_fs26.writeFileSync)(
       projectPath(CARRY_FILE),
       JSON.stringify({ from_key: sessionKey(sessionId), head_sha: headSha, ts: Date.now() })
     );
@@ -17544,10 +17940,10 @@ function writeCarry(sessionId, headSha) {
 function claimCarry(newKey) {
   const carryPath = projectPath(CARRY_FILE);
   try {
-    if (!(0, import_node_fs24.existsSync)(carryPath)) return null;
-    const carry = JSON.parse((0, import_node_fs24.readFileSync)(carryPath, "utf-8"));
+    if (!(0, import_node_fs26.existsSync)(carryPath)) return null;
+    const carry = JSON.parse((0, import_node_fs26.readFileSync)(carryPath, "utf-8"));
     try {
-      (0, import_node_fs24.rmSync)(carryPath, { force: true });
+      (0, import_node_fs26.rmSync)(carryPath, { force: true });
     } catch {
     }
     if (!carry?.from_key || typeof carry.ts !== "number") return null;
@@ -17558,11 +17954,11 @@ function claimCarry(newKey) {
     if (!prior) return null;
     const toDir = sessionDir(newKey);
     try {
-      (0, import_node_fs24.rmSync)(toDir, { recursive: true, force: true });
+      (0, import_node_fs26.rmSync)(toDir, { recursive: true, force: true });
     } catch {
     }
-    (0, import_node_fs24.renameSync)(fromDir, toDir);
-    (0, import_node_fs24.writeFileSync)(manifestPath(toDir), JSON.stringify({ ...prior, session_id: newKey }) + "\n");
+    (0, import_node_fs26.renameSync)(fromDir, toDir);
+    (0, import_node_fs26.writeFileSync)(manifestPath(toDir), JSON.stringify({ ...prior, session_id: newKey }) + "\n");
     return readManifest(toDir);
   } catch {
     return null;
@@ -17586,21 +17982,21 @@ function captureBaseline(opts = {}) {
   const head_sha = getCurrentCommit();
   const dirty = getDirtyFiles();
   try {
-    (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs26.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path22.join)(dir, "files");
+  const filesDir = (0, import_node_path23.join)(dir, "files");
   const mirrored = [];
   try {
-    (0, import_node_fs24.mkdirSync)(filesDir, { recursive: true });
+    (0, import_node_fs26.mkdirSync)(filesDir, { recursive: true });
     for (const p of dirty) {
       if (p.includes("..")) continue;
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs24.mkdirSync)((0, import_node_path22.dirname)(dest), { recursive: true });
-        (0, import_node_fs24.writeFileSync)(dest, content);
+        (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(dest), { recursive: true });
+        (0, import_node_fs26.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
       }
@@ -17615,8 +18011,8 @@ function captureBaseline(opts = {}) {
     version: BASELINE_VERSION
   };
   try {
-    (0, import_node_fs24.mkdirSync)(dir, { recursive: true });
-    (0, import_node_fs24.writeFileSync)(manifestPath(dir), JSON.stringify(baseline));
+    (0, import_node_fs26.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs26.writeFileSync)(manifestPath(dir), JSON.stringify(baseline));
   } catch {
   }
   pruneOldBaselines();
@@ -17627,9 +18023,9 @@ function readBaseline(sessionId) {
 }
 function readManifest(dir) {
   const mp = manifestPath(dir);
-  if (!(0, import_node_fs24.existsSync)(mp)) return null;
+  if (!(0, import_node_fs26.existsSync)(mp)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs24.readFileSync)(mp, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs26.readFileSync)(mp, "utf-8"));
     if (typeof parsed.head_sha !== "string" || typeof parsed.captured_at !== "number" || !Array.isArray(parsed.dirty_paths) || parsed.version !== BASELINE_VERSION) {
       return null;
     }
@@ -17660,9 +18056,9 @@ function preImage(repoRelPath, baseline) {
 function resolvePreImage(repoRelPath, baseline) {
   if (baseline.dirty_paths.includes(repoRelPath)) {
     const mp = mirrorPath(sessionDir(sessionKey(baseline.session_id)), repoRelPath);
-    if ((0, import_node_fs24.existsSync)(mp)) {
+    if ((0, import_node_fs26.existsSync)(mp)) {
       try {
-        return { content: (0, import_node_fs24.readFileSync)(mp, "utf-8"), existed: true };
+        return { content: (0, import_node_fs26.readFileSync)(mp, "utf-8"), existed: true };
       } catch {
       }
     }
@@ -17707,8 +18103,8 @@ function absorbIntoBaseline(paths, sessionId) {
       const content = safeReadForMirror(projectPath(p));
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
-      (0, import_node_fs24.mkdirSync)((0, import_node_path22.dirname)(dest), { recursive: true });
-      (0, import_node_fs24.writeFileSync)(dest, content);
+      (0, import_node_fs26.mkdirSync)((0, import_node_path23.dirname)(dest), { recursive: true });
+      (0, import_node_fs26.writeFileSync)(dest, content);
       dirty.add(p);
       adopted++;
     } catch {
@@ -17717,7 +18113,7 @@ function absorbIntoBaseline(paths, sessionId) {
   if (adopted === 0) return 0;
   try {
     const updated = { ...baseline, dirty_paths: [...dirty] };
-    (0, import_node_fs24.writeFileSync)(manifestPath(dir), JSON.stringify(updated));
+    (0, import_node_fs26.writeFileSync)(manifestPath(dir), JSON.stringify(updated));
     preImageCache.delete(baseline);
   } catch {
     return 0;
@@ -17728,7 +18124,7 @@ function changedSinceBaseline(repoRelPath, baseline) {
   const pre = preImage(repoRelPath, baseline);
   let current;
   try {
-    current = (0, import_node_fs24.readFileSync)(projectPath(repoRelPath), "utf-8");
+    current = (0, import_node_fs26.readFileSync)(projectPath(repoRelPath), "utf-8");
   } catch {
     return pre.existed;
   }
@@ -17737,8 +18133,8 @@ function changedSinceBaseline(repoRelPath, baseline) {
 }
 function safeReadForMirror(absPath) {
   try {
-    if ((0, import_node_fs24.statSync)(absPath).size > MIRROR_MAX_BYTES) return null;
-    const buf = (0, import_node_fs24.readFileSync)(absPath);
+    if ((0, import_node_fs26.statSync)(absPath).size > MIRROR_MAX_BYTES) return null;
+    const buf = (0, import_node_fs26.readFileSync)(absPath);
     if (buf.includes(0)) return null;
     return buf.toString("utf-8");
   } catch {
@@ -17749,18 +18145,18 @@ function pruneOldBaselines() {
   const root = projectPath(BASELINE_DIR);
   let entries;
   try {
-    entries = (0, import_node_fs24.readdirSync)(root);
+    entries = (0, import_node_fs26.readdirSync)(root);
   } catch {
     return;
   }
   const now = Date.now();
   for (const name of entries) {
-    const dir = (0, import_node_path22.join)(root, name);
+    const dir = (0, import_node_path23.join)(root, name);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
-        if (now - (0, import_node_fs24.statSync)(dir).mtimeMs > BASELINE_TTL_MS) {
-          (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
+        if (now - (0, import_node_fs26.statSync)(dir).mtimeMs > BASELINE_TTL_MS) {
+          (0, import_node_fs26.rmSync)(dir, { recursive: true, force: true });
         }
       } catch {
       }
@@ -17768,7 +18164,7 @@ function pruneOldBaselines() {
     }
     if (now - manifest.captured_at <= BASELINE_TTL_MS) continue;
     try {
-      (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs26.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -17943,8 +18339,8 @@ function buildCompactionContext(session) {
     commitsSince: commitsSincePaths(watermark, (state.authored ?? []).map((a) => a.path)),
     readFileLines: (file) => {
       try {
-        const abs = (0, import_node_path23.join)(root, file);
-        return (0, import_node_fs25.existsSync)(abs) ? (0, import_node_fs25.readFileSync)(abs, "utf8").split("\n") : null;
+        const abs = (0, import_node_path24.join)(root, file);
+        return (0, import_node_fs27.existsSync)(abs) ? (0, import_node_fs27.readFileSync)(abs, "utf8").split("\n") : null;
       } catch {
         return null;
       }
@@ -18001,24 +18397,24 @@ async function readHookStdin() {
 
 // src/commands/standard.ts
 var import_promises13 = require("node:fs/promises");
-var import_node_fs32 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_yaml3 = __toESM(require_dist());
 
 // src/lib/synthesize.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs28 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var import_promises10 = require("node:fs/promises");
-var import_node_path26 = require("node:path");
+var import_node_path27 = require("node:path");
 var import_yaml = __toESM(require_dist());
 
 // src/lib/data-dir.ts
-var import_node_fs26 = require("node:fs");
-var import_node_path24 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_path25 = require("node:path");
 function resolveDataDir() {
   const candidates2 = [
-    (0, import_node_path24.join)(__dirname, "..", "data"),
+    (0, import_node_path25.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path24.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path25.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
     // THE COMMITTED SOURCE, for a source checkout that has not been built.
     // cli/data/skills/ is a BUILD ARTIFACT (scripts/build.js copies client/skills
@@ -18027,14 +18423,14 @@ function resolveDataDir() {
     // without this the synthesizer throws "Could not find Verity skill data"
     // for every test and every `verity` run from source. Resolved from this
     // module's own location, never the cwd: see the warning below.
-    (0, import_node_path24.join)(__dirname, "..", "..", "client"),
+    (0, import_node_path25.join)(__dirname, "..", "..", "client"),
     // bundled: cli/bin/ → ../../client
-    (0, import_node_path24.join)(__dirname, "..", "..", "..", "client"),
+    (0, import_node_path25.join)(__dirname, "..", "..", "..", "client"),
     // tsx: cli/src/lib/ → ../../../client
     ...process.env.VERITY_DEV_DATA_DIR ? [process.env.VERITY_DEV_DATA_DIR] : []
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs26.existsSync)((0, import_node_path24.join)(candidate, "skills"))) {
+    if ((0, import_node_fs28.existsSync)((0, import_node_path25.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -18043,13 +18439,13 @@ function resolveDataDir() {
   );
 }
 function setupDataPath(file) {
-  return (0, import_node_path24.join)(resolveDataDir(), "skills", "verity-setup", file);
+  return (0, import_node_path25.join)(resolveDataDir(), "skills", "verity-setup", file);
 }
 
 // src/lib/detect.ts
 var import_node_child_process8 = require("node:child_process");
-var import_node_fs27 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_fs29 = require("node:fs");
+var import_node_path26 = require("node:path");
 var TOOLED_LANGUAGES = /* @__PURE__ */ new Set([
   "typescript",
   "javascript",
@@ -18106,25 +18502,25 @@ function walk(root) {
     if (depth > WALK_MAX_DEPTH || found.length >= WALK_MAX_FILES) return;
     let entries;
     try {
-      entries = (0, import_node_fs27.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs29.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (found.length >= WALK_MAX_FILES) return;
       if (IGNORED_SEGMENTS.includes(entry.name)) continue;
-      const full = (0, import_node_path25.join)(dir, entry.name);
+      const full = (0, import_node_path26.join)(dir, entry.name);
       if (entry.isDirectory()) visit(full, depth + 1);
-      else if (entry.isFile()) found.push((0, import_node_path25.relative)(root, full));
+      else if (entry.isFile()) found.push((0, import_node_path26.relative)(root, full));
     }
   };
   visit(root, 0);
   return found;
 }
 function languageOf(path) {
-  const name = (0, import_node_path25.basename)(path);
+  const name = (0, import_node_path26.basename)(path);
   if (/^Dockerfile(\..+)?$/i.test(name)) return "dockerfile";
-  if (!(0, import_node_path25.extname)(name)) return null;
+  if (!(0, import_node_path26.extname)(name)) return null;
   const lang = detectLanguage(path);
   return lang || null;
 }
@@ -18181,7 +18577,7 @@ var TOOL_CONFIG_MARKERS = [
 ];
 function readJson2(path) {
   try {
-    return JSON.parse((0, import_node_fs27.readFileSync)(path, "utf-8"));
+    return JSON.parse((0, import_node_fs29.readFileSync)(path, "utf-8"));
   } catch {
     return null;
   }
@@ -18206,17 +18602,17 @@ function declaredDependencies(root, files) {
       if (deps && typeof deps === "object") names2.push(...Object.keys(deps));
     }
   };
-  readPackageJson((0, import_node_path25.join)(root, "package.json"));
-  const nested = files.filter((f) => f.includes("/") && (0, import_node_path25.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
-  for (const rel of nested) readPackageJson((0, import_node_path25.join)(root, rel));
+  readPackageJson((0, import_node_path26.join)(root, "package.json"));
+  const nested = files.filter((f) => f.includes("/") && (0, import_node_path26.basename)(f) === "package.json").slice(0, NESTED_MANIFEST_LIMIT);
+  for (const rel of nested) readPackageJson((0, import_node_path26.join)(root, rel));
   const pythonManifests = [
-    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path25.join)(root, f)),
-    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path25.join)(root, f))
+    ...["pyproject.toml", "requirements.txt", "Pipfile", "setup.py"].map((f) => (0, import_node_path26.join)(root, f)),
+    ...files.filter((f) => f.includes("/") && /(^|\/)(pyproject\.toml|requirements\.txt)$/.test(f)).slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path26.join)(root, f))
   ];
   for (const path of pythonManifests) {
-    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    if (!(0, import_node_fs29.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs27.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs29.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/^\s*["']?([A-Za-z][A-Za-z0-9._-]+)/gm)) names2.push(m[1]);
       for (const line of text.split("\n")) {
         if (!/dependencies\s*=/.test(line)) continue;
@@ -18226,13 +18622,13 @@ function declaredDependencies(root, files) {
     }
   }
   const goMods = [
-    (0, import_node_path25.join)(root, "go.mod"),
-    ...files.filter((f) => f.includes("/") && (0, import_node_path25.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path25.join)(root, f))
+    (0, import_node_path26.join)(root, "go.mod"),
+    ...files.filter((f) => f.includes("/") && (0, import_node_path26.basename)(f) === "go.mod").slice(0, NESTED_MANIFEST_LIMIT).map((f) => (0, import_node_path26.join)(root, f))
   ];
   for (const path of goMods) {
-    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    if (!(0, import_node_fs29.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs27.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs29.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/^\s+([\w.-]+\/[\w./-]+)\s+v/gm)) {
         names2.push(m[1].replace(/^github\.com\//, ""));
       }
@@ -18240,10 +18636,10 @@ function declaredDependencies(root, files) {
     }
   }
   for (const file of ["pom.xml", "build.gradle", "build.gradle.kts", "Gemfile", "Cargo.toml"]) {
-    const path = (0, import_node_path25.join)(root, file);
-    if (!(0, import_node_fs27.existsSync)(path)) continue;
+    const path = (0, import_node_path26.join)(root, file);
+    if (!(0, import_node_fs29.existsSync)(path)) continue;
     try {
-      const text = (0, import_node_fs27.readFileSync)(path, "utf-8");
+      const text = (0, import_node_fs29.readFileSync)(path, "utf-8");
       for (const m of text.matchAll(/["'<]([A-Za-z][A-Za-z0-9._-]{2,})["'>]/g)) names2.push(m[1]);
     } catch {
     }
@@ -18251,7 +18647,7 @@ function declaredDependencies(root, files) {
   return names2;
 }
 function detectBuildSystem(root, files) {
-  const has = (f) => (0, import_node_fs27.existsSync)((0, import_node_path25.join)(root, f)) || files.some((p) => (0, import_node_path25.basename)(p) === f);
+  const has = (f) => (0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, f)) || files.some((p) => (0, import_node_path26.basename)(p) === f);
   if (has("pnpm-lock.yaml")) return "pnpm";
   if (has("yarn.lock")) return "yarn";
   if (has("bun.lock") || has("bun.lockb")) return "bun";
@@ -18268,8 +18664,8 @@ function detectBuildSystem(root, files) {
 }
 function detectArchitecture(root, files) {
   const workspaceMarkers = ["lerna.json", "pnpm-workspace.yaml", "nx.json", "turbo.json", "rush.json"];
-  if (workspaceMarkers.some((m) => (0, import_node_fs27.existsSync)((0, import_node_path25.join)(root, m)))) return "monorepo";
-  const pkg = readJson2((0, import_node_path25.join)(root, "package.json"));
+  if (workspaceMarkers.some((m) => (0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, m)))) return "monorepo";
+  const pkg = readJson2((0, import_node_path26.join)(root, "package.json"));
   if (pkg && "workspaces" in pkg) return "monorepo";
   const manifests = files.filter((f) => /(^|\/)(package\.json|go\.mod|pyproject\.toml|Cargo\.toml|pom\.xml)$/.test(f));
   const nested = manifests.filter((f) => f.includes("/"));
@@ -18291,10 +18687,10 @@ function measureAvgFileLength(root, files, languages) {
   let total = 0;
   let counted = 0;
   for (let i = 0; i < candidates2.length; i += stride) {
-    const path = (0, import_node_path25.join)(root, candidates2[i]);
+    const path = (0, import_node_path26.join)(root, candidates2[i]);
     try {
-      if ((0, import_node_fs27.statSync)(path).size > 2 * 1024 * 1024) continue;
-      total += (0, import_node_fs27.readFileSync)(path, "utf-8").split("\n").length;
+      if ((0, import_node_fs29.statSync)(path).size > 2 * 1024 * 1024) continue;
+      total += (0, import_node_fs29.readFileSync)(path, "utf-8").split("\n").length;
       counted++;
     } catch {
     }
@@ -18324,14 +18720,14 @@ function detectProject(root = repoRoot()) {
   const existingToolConfigs = [];
   for (const [tool, markers] of TOOL_CONFIG_MARKERS) {
     for (const marker of markers) {
-      if ((0, import_node_fs27.existsSync)((0, import_node_path25.join)(root, marker))) {
+      if ((0, import_node_fs29.existsSync)((0, import_node_path26.join)(root, marker))) {
         existingToolConfigs.push({ tool, path: `./${marker}` });
         break;
       }
     }
   }
   return {
-    projectName: (0, import_node_path25.basename)(root),
+    projectName: (0, import_node_path26.basename)(root),
     languages,
     languageCounts,
     frameworks: matchAll(dependencies, FRAMEWORK_BY_DEPENDENCY),
@@ -18429,8 +18825,8 @@ ${closingNote(input.origin)}
 
 // src/lib/synthesize.ts
 function loadCatalog() {
-  const catalog = (0, import_yaml.parse)((0, import_node_fs28.readFileSync)(setupDataPath("patterns-reference.yaml"), "utf-8"));
-  const template = (0, import_yaml.parse)((0, import_node_fs28.readFileSync)(setupDataPath("standard-template.yaml"), "utf-8"));
+  const catalog = (0, import_yaml.parse)((0, import_node_fs30.readFileSync)(setupDataPath("patterns-reference.yaml"), "utf-8"));
+  const template = (0, import_yaml.parse)((0, import_node_fs30.readFileSync)(setupDataPath("standard-template.yaml"), "utf-8"));
   return { catalog, template };
 }
 function selectTools(languages, intensity, catalog) {
@@ -18708,7 +19104,7 @@ function validatePatternIds() {
 }
 async function runSynthesis(opts) {
   const standardPath = projectPath(STANDARD_FILE);
-  if ((0, import_node_fs28.existsSync)(standardPath) && !opts.force) {
+  if ((0, import_node_fs30.existsSync)(standardPath) && !opts.force) {
     return { refused: `${STANDARD_FILE} already exists \u2014 pass --force to replace it.` };
   }
   const detected = opts.detected ?? detectProject();
@@ -18777,7 +19173,7 @@ async function correctVerityMdVersion(opts) {
 }
 async function writeFileTo(relative3, body) {
   const target = projectPath(relative3);
-  await (0, import_promises10.mkdir)((0, import_node_path26.dirname)(target), { recursive: true });
+  await (0, import_promises10.mkdir)((0, import_node_path27.dirname)(target), { recursive: true });
   await (0, import_promises10.writeFile)(target, body);
 }
 async function deriveConfigForStandard(standard) {
@@ -18836,11 +19232,11 @@ ${validation.detail}`);
 
 // src/lib/setup-state.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_fs29 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var SETUP_STATE_FILE = `${VERITY_DIR}/setup.json`;
 async function readSetupState() {
   const path = projectPath(SETUP_STATE_FILE);
-  if (!(0, import_node_fs29.existsSync)(path)) return null;
+  if (!(0, import_node_fs31.existsSync)(path)) return null;
   try {
     const parsed = JSON.parse(await (0, import_promises11.readFile)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
@@ -18856,12 +19252,12 @@ async function writeSetupState(patch) {
 }
 
 // src/lib/push-setup.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var import_promises12 = require("node:fs/promises");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/verityignore.ts
-var import_node_fs30 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var EMPTY = { rules: [], securityOverlap: [], problems: [] };
 var SECURITY_PROBES = [
   ".env",
@@ -18954,9 +19350,9 @@ function isIgnored3(ig, path) {
 }
 function loadVerityIgnore() {
   const file = projectPath(VERITYIGNORE_FILE);
-  if (!(0, import_node_fs30.existsSync)(file)) return EMPTY;
+  if (!(0, import_node_fs32.existsSync)(file)) return EMPTY;
   try {
-    return parseVerityIgnore((0, import_node_fs30.readFileSync)(file, "utf-8"));
+    return parseVerityIgnore((0, import_node_fs32.readFileSync)(file, "utf-8"));
   } catch {
     return EMPTY;
   }
@@ -18994,9 +19390,9 @@ function buildStandardUpload(standard, ignoreRaw) {
 }
 function readVerityIgnoreRaw() {
   const file = projectPath(VERITYIGNORE_FILE);
-  if (!(0, import_node_fs30.existsSync)(file)) return null;
+  if (!(0, import_node_fs32.existsSync)(file)) return null;
   try {
-    return (0, import_node_fs30.readFileSync)(file, "utf-8");
+    return (0, import_node_fs32.readFileSync)(file, "utf-8");
   } catch {
     return null;
   }
@@ -19024,7 +19420,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   }
   let standardVersion = null;
   const standardPath = projectPath(STANDARD_FILE);
-  if (pushStandard && (0, import_node_fs31.existsSync)(standardPath)) {
+  if (pushStandard && (0, import_node_fs33.existsSync)(standardPath)) {
     try {
       const content = (0, import_yaml2.parse)(await (0, import_promises12.readFile)(standardPath, "utf-8"));
       const upload = buildStandardUpload(content, readVerityIgnoreRaw());
@@ -19049,7 +19445,7 @@ async function pushStandardAndConfig(globals, what = {}) {
   }
   let configPushed = false;
   const configPath = projectPath(CODACY_CONFIG_FILE);
-  if (pushConfig && (0, import_node_fs31.existsSync)(configPath)) {
+  if (pushConfig && (0, import_node_fs33.existsSync)(configPath)) {
     try {
       const content = JSON.parse(await (0, import_promises12.readFile)(configPath, "utf-8"));
       const result = await apiRequest({
@@ -19081,7 +19477,7 @@ function registerStandardCommands(program2) {
     const state = await readSetupState();
     if (opts.configOnly) {
       const standardPath = projectPath(STANDARD_FILE);
-      if (!(0, import_node_fs32.existsSync)(standardPath)) {
+      if (!(0, import_node_fs34.existsSync)(standardPath)) {
         printError(`No ${STANDARD_FILE} here \u2014 run "verity standard synthesize" to create one.`);
         process.exit(1);
       }
@@ -19414,20 +19810,20 @@ function formatRunDetail(run2) {
 }
 
 // src/lib/ignore-declaration.ts
-var import_node_fs34 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 
 // src/lib/debounce.ts
-var import_node_fs33 = require("node:fs");
-var import_node_crypto10 = require("node:crypto");
+var import_node_fs35 = require("node:fs");
+var import_node_crypto11 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
-  return `${base}.${(0, import_node_crypto10.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
+  return `${base}.${(0, import_node_crypto11.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs33.existsSync)(file)) return null;
+  if (!(0, import_node_fs35.existsSync)(file)) return null;
   try {
-    const lastTs = parseInt((0, import_node_fs33.readFileSync)(file, "utf-8").trim(), 10);
+    const lastTs = parseInt((0, import_node_fs35.readFileSync)(file, "utf-8").trim(), 10);
     const nowTs = Math.floor(Date.now() / 1e3);
     const elapsed = nowTs - lastTs;
     if (elapsed < debounceSeconds) {
@@ -19440,10 +19836,10 @@ function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
 function checkMtime(files, bypassForRecentCommits, sessionId) {
   if (bypassForRecentCommits) return null;
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs33.existsSync)(file)) return null;
+  if (!(0, import_node_fs35.existsSync)(file)) return null;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs33.statSync)(file).mtimeMs;
+    debounceTime = (0, import_node_fs35.statSync)(file).mtimeMs;
   } catch {
     return null;
   }
@@ -19451,7 +19847,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
     const resolved = resolveFile(f);
     if (!resolved) continue;
     try {
-      const stat3 = (0, import_node_fs33.statSync)(resolved);
+      const stat3 = (0, import_node_fs35.statSync)(resolved);
       if (stat3.mtimeMs > debounceTime) {
         return null;
       }
@@ -19462,13 +19858,13 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
   return "No files modified since last analysis";
 }
 function computeContentHash(files) {
-  const hash = (0, import_node_crypto10.createHash)("sha1");
+  const hash = (0, import_node_crypto11.createHash)("sha1");
   const sorted = [...files].sort();
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
     try {
-      if ((0, import_node_fs33.existsSync)(resolved)) {
-        hash.update((0, import_node_fs33.readFileSync)(resolved));
+      if ((0, import_node_fs35.existsSync)(resolved)) {
+        hash.update((0, import_node_fs35.readFileSync)(resolved));
       }
     } catch {
     }
@@ -19478,9 +19874,9 @@ function computeContentHash(files) {
 function checkContentHash(files, sessionId) {
   const hash = computeContentHash(files);
   const file = scopedFile(HASH_FILE, sessionId);
-  if ((0, import_node_fs33.existsSync)(file)) {
+  if ((0, import_node_fs35.existsSync)(file)) {
     try {
-      const storedHash = (0, import_node_fs33.readFileSync)(file, "utf-8").trim();
+      const storedHash = (0, import_node_fs35.readFileSync)(file, "utf-8").trim();
       if (hash === storedHash) {
         return { skip: "No source changes since last analysis", hash };
       }
@@ -19490,24 +19886,24 @@ function checkContentHash(files, sessionId) {
   return { skip: null, hash };
 }
 function recordAnalysisStart(sessionId) {
-  (0, import_node_fs33.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs33.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
+  (0, import_node_fs35.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs35.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
 }
 function recordPassHash(hash, sessionId) {
-  (0, import_node_fs33.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
+  (0, import_node_fs35.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
 }
 function narrowToRecent(files, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
-  if (!(0, import_node_fs33.existsSync)(file)) return files;
+  if (!(0, import_node_fs35.existsSync)(file)) return files;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs33.statSync)(file).mtimeMs;
+    debounceTime = (0, import_node_fs35.statSync)(file).mtimeMs;
   } catch {
     return files;
   }
   const recent = files.filter((f) => {
     try {
-      return (0, import_node_fs33.existsSync)(f) && (0, import_node_fs33.statSync)(f).mtimeMs > debounceTime;
+      return (0, import_node_fs35.existsSync)(f) && (0, import_node_fs35.statSync)(f).mtimeMs > debounceTime;
     } catch {
       return false;
     }
@@ -19520,9 +19916,9 @@ function readIteration(currentCommit, _contentHash) {
 var NO_BLOCKS = { attempts: 0, blocks: 0, fingerprint: null };
 function readBlockState(currentCommit, opts) {
   if (opts?.newUserPrompt) return NO_BLOCKS;
-  if (!(0, import_node_fs33.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
+  if (!(0, import_node_fs35.existsSync)(ITERATION_FILE)) return NO_BLOCKS;
   try {
-    const stored = (0, import_node_fs33.readFileSync)(ITERATION_FILE, "utf-8").trim();
+    const stored = (0, import_node_fs35.readFileSync)(ITERATION_FILE, "utf-8").trim();
     const parsed = stored.startsWith("{") ? parseJsonState(stored) : parseLegacyState(stored);
     if (!parsed) return NO_BLOCKS;
     if (parsed.commit !== currentCommit) return NO_BLOCKS;
@@ -19568,8 +19964,8 @@ function isSameProblem(previous, current) {
   return current.split(",").some((k) => prev.has(k));
 }
 function writeBlockState(commit, state) {
-  (0, import_node_fs33.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs33.writeFileSync)(
+  (0, import_node_fs35.mkdirSync)(VERITY_DIR, { recursive: true });
+  (0, import_node_fs35.writeFileSync)(
     ITERATION_FILE,
     JSON.stringify({
       v: 2,
@@ -19674,9 +20070,9 @@ function resolveIgnoreState(keys) {
 }
 function readIgnoreState(sessionId) {
   const file = stateFile(sessionId);
-  if (!(0, import_node_fs34.existsSync)(file)) return null;
+  if (!(0, import_node_fs36.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs34.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs36.readFileSync)(file, "utf-8")) ?? {};
     const spent = typeof o.spent === "number" ? o.spent : 0;
     const raw = o.active;
     let active = null;
@@ -19700,8 +20096,8 @@ function readIgnoreState(sessionId) {
 }
 function writeIgnoreState(state, sessionId) {
   try {
-    (0, import_node_fs34.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
-    (0, import_node_fs34.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
+    (0, import_node_fs36.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs36.writeFileSync)(stateFile(sessionId), JSON.stringify({ v: 1, active: state.active, spent: state.spent }));
   } catch {
   }
 }
@@ -20084,7 +20480,7 @@ function createRun(opts, globals) {
 }
 
 // src/commands/analyze/index.ts
-var import_node_fs47 = require("node:fs");
+var import_node_fs49 = require("node:fs");
 
 // src/lib/repo-context.ts
 var import_node_child_process10 = require("node:child_process");
@@ -21020,10 +21416,10 @@ function installRunEvidence(run2) {
 }
 
 // src/lib/git-frame.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 var import_node_os6 = require("node:os");
-var import_node_path27 = require("node:path");
 var import_node_path28 = require("node:path");
+var import_node_path29 = require("node:path");
 
 // src/lib/hardened-git.ts
 var import_node_child_process11 = require("node:child_process");
@@ -21185,8 +21581,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
     if (SHELL_DYNAMIC.test(raw) || raw === "-") {
       return { dir: null, named: true, unresolvable: `cd target not statically resolvable: ${raw}` };
     }
-    const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path28.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
-    dir = (0, import_node_path27.isAbsolute)(expanded) ? expanded : (0, import_node_path27.resolve)(dir, expanded);
+    const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path29.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
+    dir = (0, import_node_path28.isAbsolute)(expanded) ? expanded : (0, import_node_path28.resolve)(dir, expanded);
   }
   const seg = segments[segmentIndex];
   const overrideMatch = /--(?:git-dir|work-tree)(?:=|\s)|\bGIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(seg);
@@ -21204,8 +21600,8 @@ function extractCommandTarget(command, segmentIndex, baseDir) {
       if (SHELL_DYNAMIC.test(raw)) {
         return { dir: null, named: true, unresolvable: `-C target not statically resolvable: ${raw}` };
       }
-      const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path28.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
-      dir = (0, import_node_path27.isAbsolute)(expanded) ? expanded : (0, import_node_path27.resolve)(dir, expanded);
+      const expanded = raw === "~" ? (0, import_node_os6.homedir)() : raw.startsWith("~/") ? (0, import_node_path29.join)((0, import_node_os6.homedir)(), raw.slice(2)) : raw;
+      dir = (0, import_node_path28.isAbsolute)(expanded) ? expanded : (0, import_node_path28.resolve)(dir, expanded);
     }
   }
   return { dir, named, unresolvable: null };
@@ -21265,14 +21661,14 @@ function gitAt(dir, args) {
 }
 function realpathOr2(p) {
   try {
-    return import_node_fs35.realpathSync.native(p);
+    return import_node_fs37.realpathSync.native(p);
   } catch {
-    return (0, import_node_path27.resolve)(p);
+    return (0, import_node_path28.resolve)(p);
   }
 }
 function resolveFrame(input) {
   const found = findMomentSegment(input.command, input.on);
-  const hookDirUsable = !!input.hookCwd && (0, import_node_fs35.existsSync)(input.hookCwd);
+  const hookDirUsable = !!input.hookCwd && (0, import_node_fs37.existsSync)(input.hookCwd);
   const baseDir = hookDirUsable ? input.hookCwd : process.cwd();
   let anchor = hookDirUsable ? "hook-cwd" : "process-cwd";
   const refuse = (refusal) => ({
@@ -21295,7 +21691,7 @@ function resolveFrame(input) {
     if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
     const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
     if (targetDir !== baseDir) {
-      if (!(0, import_node_fs35.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      if (!(0, import_node_fs37.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
       dir = targetDir;
     }
   }
@@ -21306,7 +21702,7 @@ function resolveFrame(input) {
   const gitDirRaw = gitAt(dir, ["rev-parse", "--absolute-git-dir"]);
   const commonRaw = gitAt(dir, ["rev-parse", "--git-common-dir"]);
   const gitDir = gitDirRaw ? realpathOr2(gitDirRaw) : null;
-  const commonDir = commonRaw ? realpathOr2((0, import_node_path27.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path27.resolve)(dir, commonRaw)) : null;
+  const commonDir = commonRaw ? realpathOr2((0, import_node_path28.isAbsolute)(commonRaw) ? commonRaw : (0, import_node_path28.resolve)(dir, commonRaw)) : null;
   const branchRaw = gitAt(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   return {
     moment: found?.moment ?? null,
@@ -21481,8 +21877,8 @@ function stagedRange(frame, command) {
   if (plan.kind === "unpredictable") {
     return { kind: "staged", base: "HEAD", head: "INDEX", via: "staged-in-command", refusal: plan.reason };
   }
-  const mergeHead = frame.gitDir ? (0, import_node_path28.join)(frame.gitDir, "MERGE_HEAD") : null;
-  if (mergeHead && (0, import_node_fs35.existsSync)(mergeHead)) {
+  const mergeHead = frame.gitDir ? (0, import_node_path29.join)(frame.gitDir, "MERGE_HEAD") : null;
+  if (mergeHead && (0, import_node_fs37.existsSync)(mergeHead)) {
     const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
     const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
     const resolutions = new Set([...vsHead].filter((f) => vsMerge.has(f) && !isVerityOwnedPath(f)));
@@ -21616,7 +22012,7 @@ function truthy(v) {
 }
 
 // src/lib/transcript.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
 var SMALL_FILE_BYTES = 64 * 1024;
 var MAX_FILES_LIST = 20;
@@ -21643,7 +22039,7 @@ async function extractActionSummary(transcriptPath) {
 function readTurnLines(transcriptPath) {
   let size;
   try {
-    size = (0, import_node_fs36.statSync)(transcriptPath).size;
+    size = (0, import_node_fs38.statSync)(transcriptPath).size;
   } catch {
     return null;
   }
@@ -21651,7 +22047,7 @@ function readTurnLines(transcriptPath) {
   let raw;
   let windowed = false;
   if (size <= SMALL_FILE_BYTES) {
-    raw = (0, import_node_fs36.readFileSync)(transcriptPath, "utf-8");
+    raw = (0, import_node_fs38.readFileSync)(transcriptPath, "utf-8");
   } else {
     windowed = true;
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
@@ -22042,6 +22438,52 @@ function partitionVerityOwned(paths) {
   return { kept, owned };
 }
 
+// src/lib/knowledge-note-state.ts
+var stateDir = () => projectPath(VERITY_DIR);
+var STATE_FILE2 = "knowledge-note-state.json";
+function parseKnowledgeNote(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const o = raw;
+  const node_id = typeof o.node_id === "string" ? o.node_id.trim() : "";
+  const text = typeof o.text === "string" ? o.text.trim() : "";
+  if (!node_id || !text) return null;
+  if (text.length > 1e3) return null;
+  return {
+    node_id,
+    text,
+    file: typeof o.file === "string" && o.file ? o.file : null,
+    line: typeof o.line === "number" && Number.isFinite(o.line) && o.line > 0 ? Math.floor(o.line) : null
+  };
+}
+function recordNoteOutcome(runId, delivered) {
+  replaceInRoot(stateDir(), STATE_FILE2, JSON.stringify({ run_id: runId, delivered }));
+}
+function peekNoteOutcome() {
+  try {
+    const read = readRegularFileInRoot(stateDir(), STATE_FILE2, 4096);
+    if (!read.ok || !read.content.trim()) return null;
+    const parsed = JSON.parse(read.content);
+    if (!parsed || typeof parsed !== "object") return null;
+    const o = parsed;
+    if (typeof o.run_id !== "string" || !/^run-\d{14}-[0-9a-f]{8}$/.test(o.run_id)) return null;
+    if (typeof o.delivered !== "boolean") return null;
+    return { run_id: o.run_id, delivered: o.delivered };
+  } catch {
+    return null;
+  }
+}
+function clearNoteOutcome() {
+  replaceInRoot(stateDir(), STATE_FILE2, "");
+}
+function episodeForWire(e, humanSpoke) {
+  return {
+    delivered: e?.delivered ?? 0,
+    tasks_completed: e?.tasksCompleted ?? 0,
+    ts: e?.ts ?? 0,
+    human_spoke: humanSpoke
+  };
+}
+
 // src/lib/channel.ts
 var MAX_AGENT_CONTEXT_CHARS = 1500;
 var MAX_AGENT_ITEMS = 5;
@@ -22063,7 +22505,14 @@ function channelInputFrom(response, intentRepeat = 0, priorPendingFingerprints =
     reviewStatus: metadata.review_status,
     coverage: metadata.coverage,
     intentVerdict: intent.verdict,
-    intentGaps: intent.gaps
+    intentGaps: intent.gaps,
+    // Phase 5. Parsed defensively: a malformed or oversized note degrades to
+    // silence rather than to a broken agent message, and an old server simply
+    // sends nothing — which is indistinguishable from a server that chose to
+    // stay quiet, as it should be.
+    knowledgeNote: parseKnowledgeNote(
+      response.knowledge_note ?? metadata.knowledge_note
+    )?.text
   };
 }
 function classifyChannelContent(input) {
@@ -22071,7 +22520,13 @@ function classifyChannelContent(input) {
   const intentFlag = input.intentVerdict === "misaligned" || input.intentVerdict === "partial";
   const advisory = (input.findings ?? []).some((f) => f.scope !== "pre-existing") || (input.pendingItems ?? []).some(
     (p) => p.pattern_id !== "intent-misalignment" && !!(p.description ?? p.title ?? p.reason)
-  );
+  ) || // ⚠ A KNOWLEDGE NOTE IS ADVISORY CONTENT, and it must be classified as such
+  // or the invariant above breaks: `buildAgentContext` would return a message
+  // on a run where all three classes are false, which is exactly the drift
+  // this pair is written to prevent. It is advisory rather than refusal or
+  // intent because it costs the agent a turn — the same cost the episode
+  // budget exists to bound.
+  !!input.knowledgeNote;
   return { refusal, intentFlag, advisory };
 }
 function buildAgentContext(input) {
@@ -22098,6 +22553,9 @@ function buildAgentContext(input) {
       );
     }
   }
+  if (input.knowledgeNote && lines.length < MAX_AGENT_ITEMS) {
+    lines.push(`- ${input.knowledgeNote}`);
+  }
   const agentFindings = (input.findings ?? []).filter((f) => f.scope !== "pre-existing");
   for (const f of agentFindings) {
     if (lines.length >= MAX_AGENT_ITEMS) break;
@@ -22159,7 +22617,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.33.2-experimental.0c53bed" : "dev";
+    return true ? "0.33.3-experimental.072d5cb" : "dev";
   } catch {
     return "dev";
   }
@@ -22200,7 +22658,7 @@ async function sendSkipBeacon(ctx, reason) {
 
 // src/lib/static-analysis.ts
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs37 = require("node:fs");
+var import_node_fs39 = require("node:fs");
 var SEVERITY_ORDER = {
   Error: 0,
   Critical: 0,
@@ -22256,7 +22714,7 @@ function runCodacyAnalysis(files) {
   if (files.length === 0) return empty;
   const existingFiles = files.filter((f) => {
     try {
-      return (0, import_node_fs37.existsSync)(f);
+      return (0, import_node_fs39.existsSync)(f);
     } catch {
       return false;
     }
@@ -22525,8 +22983,8 @@ async function scope(run2) {
 }
 
 // src/lib/specs.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_fs40 = require("node:fs");
+var import_node_path30 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -22548,7 +23006,7 @@ var UNCONSULTED_TOTAL_BYTES = 30720;
 function readSpecFiles(specsOpt, root) {
   const out = [];
   for (const raw of specsOpt.split(",").map((f) => f.trim()).filter(Boolean)) {
-    const candidate = (0, import_node_path29.isAbsolute)(raw) ? (0, import_node_path29.relative)(root, raw) : raw;
+    const candidate = (0, import_node_path30.isAbsolute)(raw) ? (0, import_node_path30.relative)(root, raw) : raw;
     const content = readFileInside(root, candidate, MAX_EXPLICIT_SPEC_FILE_BYTES);
     if (content === null) continue;
     out.push({ path: raw, content });
@@ -22567,7 +23025,7 @@ function discoverSpecs(consulted = []) {
     const totalCap = relevant ? MAX_TOTAL_SPEC_BYTES : UNCONSULTED_TOTAL_BYTES;
     if (totalBytes >= totalCap) return false;
     if (seen.has(specPath)) return true;
-    if (!(0, import_node_fs38.existsSync)(specPath)) return true;
+    if (!(0, import_node_fs40.existsSync)(specPath)) return true;
     seen.add(specPath);
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
@@ -22590,7 +23048,7 @@ function discoverSpecs(consulted = []) {
     if (!addSpec(candidate)) break;
   }
   for (const dir of ["spec", "docs"]) {
-    if (!(0, import_node_fs38.existsSync)(dir)) continue;
+    if (!(0, import_node_fs40.existsSync)(dir)) continue;
     try {
       const mdFiles = findMdFiles(dir, 2).sort();
       for (const mdFile of mdFiles) {
@@ -22605,9 +23063,9 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   if (depth >= maxDepth) return [];
   const result = [];
   try {
-    const entries = (0, import_node_fs38.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path29.join)(dir, entry.name);
+      const fullPath = (0, import_node_path30.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -22620,25 +23078,25 @@ function findMdFiles(dir, maxDepth, depth = 0) {
 }
 function discoverPlans() {
   const home = process.env.HOME ?? "";
-  const homePlansDir = (0, import_node_path29.join)(home, ".claude", "plans");
+  const homePlansDir = (0, import_node_path30.join)(home, ".claude", "plans");
   const sources = [];
   if (isRealDirectoryChain(process.cwd(), [".claude", "plans"])) {
-    sources.push({ root: process.cwd(), prefix: (0, import_node_path29.join)(".claude", "plans") });
+    sources.push({ root: process.cwd(), prefix: (0, import_node_path30.join)(".claude", "plans") });
   }
-  if (home && (0, import_node_fs38.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
+  if (home && (0, import_node_fs40.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
   const candidates2 = [];
   const seen = /* @__PURE__ */ new Set();
   for (const source of sources) {
     let names2;
     try {
-      names2 = (0, import_node_fs38.readdirSync)(source.prefix ? (0, import_node_path29.join)(source.root, source.prefix) : source.root);
+      names2 = (0, import_node_fs40.readdirSync)(source.prefix ? (0, import_node_path30.join)(source.root, source.prefix) : source.root);
     } catch {
       continue;
     }
     for (const f of names2) {
       if (!f.endsWith(".md") || seen.has(f)) continue;
       seen.add(f);
-      const relPath = source.prefix ? (0, import_node_path29.join)(source.prefix, f) : f;
+      const relPath = source.prefix ? (0, import_node_path30.join)(source.prefix, f) : f;
       const stat3 = statRegularInRoot(source.root, relPath);
       if (!stat3.ok) continue;
       candidates2.push({ name: f, root: source.root, relPath, mtime: stat3.mtimeMs, size: stat3.size });
@@ -22656,9 +23114,9 @@ function discoverPlans() {
 function isRealDirectoryChain(root, parts) {
   let current = root;
   for (const part of parts) {
-    current = (0, import_node_path29.join)(current, part);
+    current = (0, import_node_path30.join)(current, part);
     try {
-      if (!(0, import_node_fs38.lstatSync)(current).isDirectory()) return false;
+      if (!(0, import_node_fs40.lstatSync)(current).isDirectory()) return false;
     } catch {
       return false;
     }
@@ -22673,7 +23131,7 @@ function discoverGuardDocs(rangeFiles2) {
     if (result.length >= MAX_SPEC_FILES) break;
     if (!GUARD_DOC_EXT.test(path)) continue;
     if (path.startsWith("/") || path.includes("..")) continue;
-    if (!(0, import_node_fs38.existsSync)(path)) continue;
+    if (!(0, import_node_fs40.existsSync)(path)) continue;
     const opened = openRegularInRoot(process.cwd(), path);
     if (!opened.ok) continue;
     if (opened.size > MAX_PLAN_FILE_BYTES || totalBytes + opened.size > MAX_TOTAL_SPEC_BYTES) {
@@ -22859,8 +23317,8 @@ async function mode(run2) {
 }
 
 // src/lib/fold.ts
-var import_node_fs39 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path31 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
   "assistant",
@@ -22997,7 +23455,7 @@ function candidateRoots(repoRoot2) {
   const norm = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
   const out = [norm];
   try {
-    const real = import_node_fs39.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
+    const real = import_node_fs41.realpathSync.native(norm).replace(/\\/g, "/").replace(/\/+$/, "");
     if (real !== norm) out.push(real);
   } catch {
   }
@@ -23085,31 +23543,31 @@ function fold(transcriptPath, opts = {}) {
     }
   };
   try {
-    if (!(0, import_node_fs39.existsSync)(transcriptPath)) return result;
-    ingest((0, import_node_fs39.readFileSync)(transcriptPath, "utf8"), "agent");
+    if (!(0, import_node_fs41.existsSync)(transcriptPath)) return result;
+    ingest((0, import_node_fs41.readFileSync)(transcriptPath, "utf8"), "agent");
     result.coverage.complete = true;
   } catch {
     return result;
   }
   try {
-    const sidecarDir = (0, import_node_path30.join)(
-      (0, import_node_path30.dirname)(transcriptPath),
-      (0, import_node_path30.basename)(transcriptPath).replace(/\.jsonl$/, ""),
+    const sidecarDir = (0, import_node_path31.join)(
+      (0, import_node_path31.dirname)(transcriptPath),
+      (0, import_node_path31.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
-    if ((0, import_node_fs39.existsSync)(sidecarDir)) {
+    if ((0, import_node_fs41.existsSync)(sidecarDir)) {
       const maxFiles = opts.maxSidecars ?? 200;
       const maxBytes = opts.maxSidecarBytes ?? 16 * 1024 * 1024;
       const found = [];
       const walk2 = (d, depth) => {
         if (depth > 4) return;
-        for (const e of (0, import_node_fs39.readdirSync)(d, { withFileTypes: true })) {
-          const p = (0, import_node_path30.join)(d, e.name);
+        for (const e of (0, import_node_fs41.readdirSync)(d, { withFileTypes: true })) {
+          const p = (0, import_node_path31.join)(d, e.name);
           if (e.isDirectory()) {
             walk2(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
             try {
-              const st = (0, import_node_fs39.statSync)(p);
+              const st = (0, import_node_fs41.statSync)(p);
               found.push({ path: p, size: st.size, mtimeMs: st.mtimeMs });
             } catch {
               result.coverage.malformed++;
@@ -23126,7 +23584,7 @@ function fold(transcriptPath, opts = {}) {
           continue;
         }
         try {
-          ingest((0, import_node_fs39.readFileSync)(f.path, "utf8"), "subagent");
+          ingest((0, import_node_fs41.readFileSync)(f.path, "utf8"), "subagent");
           bytes += f.size;
           result.coverage.subagentFiles++;
         } catch {
@@ -23161,7 +23619,7 @@ function fold(transcriptPath, opts = {}) {
 }
 function classifyUnobserved(path) {
   try {
-    const st = (0, import_node_fs39.statSync)(path);
+    const st = (0, import_node_fs41.statSync)(path);
     if (!st.isFile()) return "unreadable";
   } catch {
     return "unreadable";
@@ -23476,20 +23934,20 @@ async function evidence(run2) {
 }
 
 // src/lib/cache-cleanup.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path32 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
     const dir = projectPath(CACHE_DIR);
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
-    for (const entry of (0, import_node_fs40.readdirSync)(dir)) {
+    for (const entry of (0, import_node_fs42.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path31.join)(dir, entry);
+      const path = (0, import_node_path32.join)(dir, entry);
       try {
-        const stat3 = (0, import_node_fs40.statSync)(path);
+        const stat3 = (0, import_node_fs42.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
-          (0, import_node_fs40.unlinkSync)(path);
+          (0, import_node_fs42.unlinkSync)(path);
           logEvent("cache_entry_pruned", {
             path: entry,
             age_days: Math.round((Date.now() - stat3.mtimeMs) / 864e5)
@@ -23503,7 +23961,7 @@ function pruneStaleCache() {
 }
 
 // src/lib/context-files.ts
-var import_node_fs41 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_node_os7 = require("node:os");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
@@ -23561,7 +24019,7 @@ function gatherContextFiles(contextPaths, deltaFiles, opts) {
       continue;
     }
     try {
-      const content = (0, import_node_fs41.readFileSync)(safePath, "utf8");
+      const content = (0, import_node_fs43.readFileSync)(safePath, "utf8");
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_CONTEXT_FILE_BYTES) {
         logEvent("context_file_skipped", { path: filePath, reason: "too_large", bytes });
@@ -23653,8 +24111,8 @@ async function repoContext(run2) {
 
 // src/lib/seed-runner.ts
 var import_promises15 = require("node:fs/promises");
-var import_node_fs42 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_fs44 = require("node:fs");
+var import_node_path33 = require("node:path");
 var import_yaml4 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -23870,6 +24328,73 @@ _Seeded from CLAUDE.md. Edit or archive if outdated._`,
 }
 
 // src/lib/seed-runner.ts
+var NODE_DIRS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
+function normalizeTitle(title) {
+  return title.trim().replace(/\s+/g, " ").toLowerCase();
+}
+async function localSeedTitles(memoryDir3 = MEMORY_DIR) {
+  const titles = /* @__PURE__ */ new Set();
+  for (const dir of NODE_DIRS) {
+    const full = (0, import_node_path33.join)(memoryDir3, dir);
+    if (!(0, import_node_fs44.existsSync)(full)) continue;
+    let files;
+    try {
+      files = await (0, import_promises15.readdir)(full);
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      if (!file.endsWith(".md")) continue;
+      let content;
+      try {
+        content = await (0, import_promises15.readFile)((0, import_node_path33.join)(full, file), "utf-8");
+      } catch {
+        continue;
+      }
+      if (!isSeedNodeMarkdown(content)) continue;
+      const title = pickFrontmatterTitle(content);
+      if (title) titles.add(normalizeTitle(title));
+    }
+  }
+  return titles;
+}
+function frontmatterOf(content) {
+  if (!content.startsWith("---")) return null;
+  const end = content.indexOf("\n---", 3);
+  return end === -1 ? content : content.slice(0, end);
+}
+function isSeedNodeMarkdown(content) {
+  const frontmatter = frontmatterOf(content);
+  return frontmatter !== null && /^created_by:\s*["']?seed["']?\s*$/m.test(frontmatter);
+}
+function pickFrontmatterTitle(content) {
+  const frontmatter = frontmatterOf(content);
+  const match = frontmatter?.match(/^title:[ \t]*(.*)$/m);
+  if (!match) return null;
+  const raw = match[1].trim();
+  if (raw.startsWith('"')) {
+    try {
+      return String(JSON.parse(raw));
+    } catch {
+      return raw.slice(1, raw.endsWith('"') ? -1 : void 0).replace(/\\"/g, '"');
+    }
+  }
+  return raw;
+}
+async function serverSeedTitles(opts) {
+  const res = await apiRequest({
+    method: "GET",
+    path: "/compound/memory/nodes?created_by=seed&status=active&limit=100",
+    serviceUrl: opts.serviceUrl,
+    token: opts.token,
+    verbose: opts.verbose,
+    cmd: "memory_seed"
+  });
+  if (!res.ok || !Array.isArray(res.data.nodes)) return null;
+  const titles = /* @__PURE__ */ new Set();
+  for (const n of res.data.nodes) if (typeof n?.title === "string") titles.add(normalizeTitle(n.title));
+  return titles;
+}
 function renderNodeMarkdown(candidate, nodeId, createdAt) {
   const fm = [
     "---",
@@ -23893,19 +24418,19 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   return fm;
 }
 async function runSeed(opts) {
-  if (!(0, import_node_fs42.existsSync)(STANDARD_FILE)) {
-    return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
+  if (!(0, import_node_fs44.existsSync)(STANDARD_FILE)) {
+    return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   let standardDoc;
   try {
     const raw = await (0, import_promises15.readFile)(STANDARD_FILE, "utf-8");
     standardDoc = (0, import_yaml4.parse)(raw);
   } catch {
-    return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
+    return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
   let readmeContent;
-  if ((0, import_node_fs42.existsSync)("README.md")) {
+  if ((0, import_node_fs44.existsSync)("README.md")) {
     try {
       readmeContent = await (0, import_promises15.readFile)("README.md", "utf-8");
     } catch {
@@ -23913,7 +24438,7 @@ async function runSeed(opts) {
   }
   let claudeMdContent;
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
-    if ((0, import_node_fs42.existsSync)(p)) {
+    if ((0, import_node_fs44.existsSync)(p)) {
       try {
         claudeMdContent = await (0, import_promises15.readFile)(p, "utf-8");
         break;
@@ -23934,19 +24459,33 @@ async function runSeed(opts) {
     claudeMdContent
   });
   if (candidates2.length === 0) {
-    return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
+    return { created: 0, existing: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path32.join)(MEMORY_DIR, "domain", "project-overview.md");
-  if ((0, import_node_fs42.existsSync)(overviewPath) && !opts.force) {
-    return { created: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
+  let toPost = candidates2;
+  if (!opts.force) {
+    const local = await localSeedTitles();
+    toPost = toPost.filter((c) => !local.has(normalizeTitle(c.title)));
+    if (toPost.length === 0) {
+      return { created: 0, existing: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
+    }
+    if (!opts.dryRun) {
+      const remote = await serverSeedTitles(opts);
+      if (remote) {
+        toPost = toPost.filter((c) => !remote.has(normalizeTitle(c.title)));
+        if (toPost.length === 0) {
+          return { created: 0, existing: 0, failed: 0, skipped: "already_seeded", candidates: candidates2 };
+        }
+      }
+    }
   }
   if (opts.dryRun) {
-    return { created: 0, failed: 0, skipped: null, candidates: candidates2 };
+    return { created: 0, existing: 0, failed: 0, skipped: null, candidates: candidates2 };
   }
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   let created = 0;
+  let existing = 0;
   let failed = 0;
-  for (const c of candidates2) {
+  for (const c of toPost) {
     const res = await apiRequest({
       method: "POST",
       path: "/compound/memory/nodes",
@@ -23978,22 +24517,31 @@ async function runSeed(opts) {
       failed++;
       continue;
     }
+    const deduplicated = res.data.deduplicated === true;
+    if (deduplicated && (0, import_node_fs44.existsSync)(targetPath)) {
+      existing++;
+      continue;
+    }
+    const content = typeof res.data.content === "string" && res.data.content.length > 0 ? res.data.content : renderNodeMarkdown(c, nodeId, createdAt);
     try {
-      await (0, import_promises15.mkdir)((0, import_node_path32.dirname)(targetPath), { recursive: true });
-      await (0, import_promises15.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
-      created++;
-      opts.onCreated?.(nodeId, filePathRel, c);
+      await (0, import_promises15.mkdir)((0, import_node_path33.dirname)(targetPath), { recursive: true });
+      await (0, import_promises15.writeFile)(targetPath, content);
+      if (deduplicated) existing++;
+      else {
+        created++;
+        opts.onCreated?.(nodeId, filePathRel, c);
+      }
     } catch (err) {
       opts.onFailed?.(c, `Server accepted "${c.title}" but couldn't write local file: ${err.message}`);
       failed++;
     }
   }
-  return { created, failed, skipped: null, candidates: candidates2 };
+  return { created, existing, failed, skipped: null, candidates: candidates2 };
 }
 
 // src/commands/analyze/phases/08-memory-manifest.ts
-var import_node_fs43 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path34 = require("node:path");
 async function memoryManifest(run2) {
   const { globals } = run2;
   const { serviceUrl, token } = run2;
@@ -24003,9 +24551,9 @@ async function memoryManifest(run2) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path33.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs43.existsSync)(STANDARD_FILE);
-    const alreadyTried = (0, import_node_fs43.existsSync)(seedMarker);
+    const seedMarker = (0, import_node_path34.join)(VERITY_DIR, ".seeded");
+    const hasStandard = (0, import_node_fs45.existsSync)(STANDARD_FILE);
+    const alreadyTried = (0, import_node_fs45.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
@@ -24017,16 +24565,19 @@ async function memoryManifest(run2) {
             force: false,
             dryRun: false
           });
-          if (seedResult.created > 0) {
-            (0, import_node_fs43.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
+          if (seedResult.created > 0 || seedResult.existing > 0) {
+            (0, import_node_fs45.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created} existing=${seedResult.existing}
 `);
-            autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
+            if (seedResult.created > 0) {
+              autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
+            }
             logEvent("auto_seed_ran", {
               created: seedResult.created,
+              existing: seedResult.existing,
               failed: seedResult.failed
             });
           } else if (seedResult.skipped === "already_seeded") {
-            (0, import_node_fs43.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
+            (0, import_node_fs45.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
 `);
           } else {
             logEvent("auto_seed_noop", {
@@ -24121,7 +24672,7 @@ function computeIncrement(reviewedPaths, hashOf, priorAuthored) {
 }
 
 // src/commands/analyze/phases/10-working-memory.ts
-var import_node_path34 = require("node:path");
+var import_node_path35 = require("node:path");
 async function workingMemory(run2) {
   const { opts } = run2;
   const { allForReview, baseline, conversation, foldResult, sessionId, token, transcriptPath } = run2;
@@ -24133,7 +24684,7 @@ async function workingMemory(run2) {
     const priorState = foldForMarks(memorySession.d);
     incrementReport = computeIncrement(
       allForReview,
-      (p) => fileHash((0, import_node_path34.join)(repoRoot(), p)),
+      (p) => fileHash((0, import_node_path35.join)(repoRoot(), p)),
       priorState.authored_all.map((a) => ({
         path: a.path,
         hash_at_last_verdict: a.hash_at_last_verdict
@@ -24215,7 +24766,7 @@ async function workingMemory(run2) {
 }
 
 // src/lib/note-budget.ts
-var import_node_fs44 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
 var EPISODE_STALE_SECONDS = 30 * 60;
 var FRESH = { delivered: 0, tasksCompleted: 0, ts: 0 };
@@ -24237,9 +24788,9 @@ function advisoryBudgetSpent(episode, rawDecision) {
 }
 function readAdvisoryEpisode(sessionId) {
   const file = scopedFile(ADVISORY_EPISODE_FILE, sessionId);
-  if (!(0, import_node_fs44.existsSync)(file)) return null;
+  if (!(0, import_node_fs46.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs44.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs46.readFileSync)(file, "utf-8")) ?? {};
     const delivered = typeof o.delivered === "number" ? o.delivered : NaN;
     if (isNaN(delivered)) return null;
     return {
@@ -24253,8 +24804,8 @@ function readAdvisoryEpisode(sessionId) {
 }
 function writeAdvisoryEpisode(episode, sessionId) {
   try {
-    (0, import_node_fs44.mkdirSync)(VERITY_DIR, { recursive: true });
-    (0, import_node_fs44.writeFileSync)(
+    (0, import_node_fs46.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs46.writeFileSync)(
       scopedFile(ADVISORY_EPISODE_FILE, sessionId),
       JSON.stringify({ v: 1, ...episode })
     );
@@ -24323,6 +24874,11 @@ var MAX_ASSISTANT_RESPONSE_CHARS_PLAN = 32768;
 var MAX_ASSISTANT_RESPONSE_CHARS_DEFAULT = 8e3;
 async function buildRequest(run2) {
   const { actionSummary, allChanged, allForReview, analysisMode, analyzable, assistantResponse, codeDelta, conversation, deletedNodePaths, editedUploads, foldConservation, foldResult, incrementReport, iteration, memory, memoryManifest: memoryManifest2, memorySession, plans, reachability, reviewable, securityFiles, sessionId, snapshotResult, specs, staticResults, stopReason, turnId } = run2;
+  const advisoryEpisode = episodeForWire(
+    readAdvisoryEpisode(run2.baselineSessionId),
+    (conversation?.prompts?.length ?? 0) > 0
+  );
+  const noteConfirmation = peekNoteOutcome();
   const excludedByReason = {};
   for (const e of codeDelta.excluded ?? []) {
     excludedByReason[e.reason] = (excludedByReason[e.reason] ?? 0) + 1;
@@ -24493,7 +25049,26 @@ async function buildRequest(run2) {
     },
     ...memoryManifest2 && { memory_manifest: memoryManifest2 },
     ...deletedNodePaths.length > 0 && { deleted_node_paths: deletedNodePaths },
-    ...editedUploads.length > 0 && { memory_files_upload: editedUploads }
+    ...editedUploads.length > 0 && { memory_files_upload: editedUploads },
+    // --- KNOWLEDGE-LOOP phase 5 -------------------------------------------
+    //
+    // The server decides whether to speak a memory node, and needs the episode
+    // state to apply the SAME budget the client applies to its own advisory
+    // content (`note-budget.ts`, ported and parity-tested). Sending it is not a
+    // request for a note: it is what lets the budget be evaluated before the
+    // ε-coin, which is what keeps the two holdout arms comparable.
+    //
+    // Absent on an old CLI, and the server answers `no_episode_state` rather
+    // than guessing — silence is the safe direction when a forced turn cannot
+    // be accounted for.
+    advisory_episode: advisoryEpisode,
+    // What the PREVIOUS run did with the note it was sent. The server decides,
+    // but only the client knows whether the sentence actually reached the
+    // agent, and an undelivered note must be voided rather than counted.
+    ...noteConfirmation && {
+      knowledge_note_run_id: noteConfirmation.run_id,
+      knowledge_note_delivered: noteConfirmation.delivered
+    }
   };
   if (snapshotResult.has_snapshots && snapshotResult.diffs.length > 0) {
     requestBody.snapshot_diffs = snapshotResult.diffs;
@@ -24562,14 +25137,14 @@ async function buildRequest(run2) {
 }
 
 // src/lib/offline.ts
-var import_node_fs45 = require("node:fs");
-var import_node_crypto11 = require("node:crypto");
+var import_node_fs47 = require("node:fs");
+var import_node_crypto12 = require("node:crypto");
 function cacheRequest(body) {
   try {
-    (0, import_node_fs45.mkdirSync)(CACHE_DIR, { recursive: true });
-    const suffix = (0, import_node_crypto11.randomBytes)(4).toString("hex");
+    (0, import_node_fs47.mkdirSync)(CACHE_DIR, { recursive: true });
+    const suffix = (0, import_node_crypto12.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
-    (0, import_node_fs45.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
+    (0, import_node_fs47.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body)));
   } catch {
   }
 }
@@ -24688,8 +25263,8 @@ async function transmit(run2) {
 }
 
 // src/commands/analyze/phases/13-reconcile.ts
-var import_node_fs46 = require("node:fs");
-var import_node_path35 = require("node:path");
+var import_node_fs48 = require("node:fs");
+var import_node_path36 = require("node:path");
 async function reconcile(run2) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory, memorySession, response, reviewable, securityFiles, turnId } = run2;
   const sentPaths = codeDelta.files.map((f) => f.path);
@@ -24718,7 +25293,7 @@ async function reconcile(run2) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line) => {
         try {
-          const src = (0, import_node_fs46.readFileSync)((0, import_node_path35.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs48.readFileSync)((0, import_node_path36.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -25171,7 +25746,14 @@ function screenRemediation(fix, findingFile) {
 
 // src/commands/analyze/phases/14-render.ts
 function agentContextFor(response, intentRepeat = 0, priorPendingFingerprints = []) {
-  return buildAgentContext(channelInputFrom(response, intentRepeat, priorPendingFingerprints));
+  const built = buildAgentContext(channelInputFrom(response, intentRepeat, priorPendingFingerprints));
+  clearNoteOutcome();
+  const note = parseKnowledgeNote(response.knowledge_note);
+  if (note) {
+    const runId = typeof response.run_id === "string" ? response.run_id : null;
+    if (runId) recordNoteOutcome(runId, !!built && built.includes(note.text));
+  }
+  return built;
 }
 async function render(run2) {
   const { opts, globals } = run2;
@@ -25533,7 +26115,7 @@ function registerAnalyzeCommand(program2) {
 var tracing = () => process.env.VERITY_TRACE_PHASES === "1";
 async function runAnalyze(opts, globals) {
   if (!verityConfigured()) {
-    (0, import_node_fs47.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
+    (0, import_node_fs49.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
     process.exit(0);
   }
   const run2 = createRun(opts, globals);
@@ -25554,11 +26136,11 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs49 = require("node:fs");
+var import_node_fs51 = require("node:fs");
 
 // src/lib/project-skills.ts
-var import_node_fs48 = require("node:fs");
-var import_node_path36 = require("node:path");
+var import_node_fs50 = require("node:fs");
+var import_node_path37 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -25583,14 +26165,14 @@ var LEGACY_SKILL_NAMES = [
 var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
-  if (!(0, import_node_fs48.existsSync)(root)) return [];
-  return ALL.filter((name) => (0, import_node_fs48.existsSync)((0, import_node_path36.join)(root, name)));
+  if (!(0, import_node_fs50.existsSync)(root)) return [];
+  return ALL.filter((name) => (0, import_node_fs50.existsSync)((0, import_node_path37.join)(root, name)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name of staleProjectSkills()) {
-    (0, import_node_fs48.rmSync)((0, import_node_path36.join)(root, name), { recursive: true, force: true });
+    (0, import_node_fs50.rmSync)((0, import_node_path37.join)(root, name), { recursive: true, force: true });
     removed.push(name);
   }
   return removed;
@@ -25655,13 +26237,13 @@ function registerBaselineCommands(program2) {
       let memoryMsg = null;
       let memoryAgentLine = null;
       const memoryNotice = projectPath(`${VERITY_DIR}/.memory-fence-notice`);
-      if (realStart && !(0, import_node_fs49.existsSync)(memoryNotice)) {
+      if (realStart && !(0, import_node_fs51.existsSync)(memoryNotice)) {
         const trackedGraph = memoryOptOut() ? 0 : committedMemoryFiles().length;
         if (trackedGraph > 0) {
           memoryMsg = `Verity: this project commits its knowledge base (${trackedGraph} files under .verity/memory/), so Verity's generated notes show up in every diff and pull request. Run \`verity memory untrack\` to keep them on disk but out of git, or \`verity memory track\` to keep committing them on purpose.`;
           memoryAgentLine = `This project has ${trackedGraph} knowledge-graph files tracked in git under .verity/memory/. As of Verity 0.32.6 the graph is machine-local by default \u2014 it is rebuilt from the service, and committing it puts generated notes in every pull request. If the user wants that stopped, run \`verity memory untrack\` for them: it keeps every file on disk and stages their removal from the index, so they only need to commit \u2014 and their teammates' working copies will vanish on the next pull and re-sync from the service, which is expected. If they would rather keep committing it, \`verity memory track\` records that and nothing will offer again.`;
           try {
-            (0, import_node_fs49.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
+            (0, import_node_fs51.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
           } catch {
           }
         }
@@ -25732,7 +26314,7 @@ function registerBaselineCommands(program2) {
 }
 var MAX_HOOK_EVENT_BYTES = 64 * 1024;
 var HOOK_SOURCES = /* @__PURE__ */ new Set(["startup", "resume", "clear", "compact"]);
-var SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var SESSION_ID_RE2 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 async function readStdin() {
   const chunks = [];
   let size = 0;
@@ -25754,7 +26336,7 @@ function parseHookEvent(input) {
   return { sessionId: validSessionId(id), source: hookSource(source) };
 }
 function validSessionId(value) {
-  return typeof value === "string" && SESSION_ID_RE.test(value) ? value : void 0;
+  return typeof value === "string" && SESSION_ID_RE2.test(value) ? value : void 0;
 }
 function hookSource(value) {
   if (typeof value !== "string") return void 0;
@@ -25762,7 +26344,7 @@ function hookSource(value) {
 }
 
 // src/commands/review.ts
-var import_node_fs50 = require("node:fs");
+var import_node_fs52 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars)").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -25779,7 +26361,7 @@ async function runReview(opts, globals) {
   const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs50.existsSync)(f) || resolveFile(f) !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs52.existsSync)(f) || resolveFile(f) !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
@@ -25845,8 +26427,8 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs51 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs53 = require("node:fs");
+var import_node_path38 = require("node:path");
 
 // src/lib/terminal-text.ts
 var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g;
@@ -26221,7 +26803,7 @@ async function buildAgentDiffs(ctx, paths, limits = { perFileChars: 24e3, totalC
 // src/commands/guard.ts
 var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path37.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path38.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve6) => {
@@ -26266,7 +26848,7 @@ function readPreToolUseStdin() {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs51.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs53.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -26286,10 +26868,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs51.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs53.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs51.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs53.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -26299,10 +26881,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs51.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs51.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs53.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs53.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs51.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs51.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs53.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs53.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -26372,7 +26954,7 @@ function hasBlockingFinding(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs51.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs53.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
@@ -26881,8 +27463,8 @@ function registerIgnoreCommand(program2) {
 }
 
 // src/commands/waive.ts
-var import_node_crypto12 = require("node:crypto");
-var import_node_fs52 = require("node:fs");
+var import_node_crypto13 = require("node:crypto");
+var import_node_fs54 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -26911,7 +27493,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body.file = opts.file;
       try {
-        body.file_sha256 = (0, import_node_crypto12.createHash)("sha256").update((0, import_node_fs52.readFileSync)(opts.file)).digest("hex");
+        body.file_sha256 = (0, import_node_crypto13.createHash)("sha256").update((0, import_node_fs54.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -26936,10 +27518,10 @@ function registerWaiveCommand(program2) {
 }
 
 // src/commands/init.ts
-var import_node_fs56 = require("node:fs");
+var import_node_fs58 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
 var import_yaml6 = __toESM(require_dist());
-var import_node_path40 = require("node:path");
+var import_node_path41 = require("node:path");
 var import_node_child_process17 = require("node:child_process");
 
 // src/lib/banner.ts
@@ -27018,7 +27600,7 @@ function printPhase(n, of, title, subtitle) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs53 = require("node:fs");
+var import_node_fs55 = require("node:fs");
 
 // src/lib/prereqs.ts
 var import_node_child_process15 = require("node:child_process");
@@ -27226,11 +27808,11 @@ async function buildReport() {
   const hooks = wiring.status;
   const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
-  const hasConfig = (0, import_node_fs53.existsSync)(projectPath(CODACY_CONFIG_FILE));
+  const hasConfig = (0, import_node_fs55.existsSync)(projectPath(CODACY_CONFIG_FILE));
   const artifacts = {
-    standard: (0, import_node_fs53.existsSync)(projectPath(STANDARD_FILE)),
+    standard: (0, import_node_fs55.existsSync)(projectPath(STANDARD_FILE)),
     analysisConfig: hasConfig,
-    verityMd: (0, import_node_fs53.existsSync)(projectPath(VERITY_MD_FILE)),
+    verityMd: (0, import_node_fs55.existsSync)(projectPath(VERITY_MD_FILE)),
     analysisConfigIds: hasConfig ? validatePatternIds().status : "absent"
   };
   const next = [];
@@ -27371,8 +27953,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs54 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_fs56 = require("node:fs");
+var import_node_path39 = require("node:path");
 var import_node_child_process16 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -27409,12 +27991,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path38.join)(root, ".gate");
-  const verityDir = (0, import_node_path38.join)(root, ".verity");
-  if ((0, import_node_fs54.existsSync)(gateDir) && !(0, import_node_fs54.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path39.join)(root, ".gate");
+  const verityDir = (0, import_node_path39.join)(root, ".verity");
+  if ((0, import_node_fs56.existsSync)(gateDir) && !(0, import_node_fs56.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs54.existsSync)(gateDir) && (0, import_node_fs54.existsSync)(verityDir)) {
+  if ((0, import_node_fs56.existsSync)(gateDir) && (0, import_node_fs56.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -27435,13 +28017,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs54.existsSync)(gateDir)) {
+    if ((0, import_node_fs56.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs54.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs56.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -27457,18 +28039,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs54.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs56.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path38.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path38.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs54.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs54.existsSync)(verityCreds)) {
-    (0, import_node_fs54.mkdirSync)((0, import_node_path38.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path39.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path39.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs56.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs56.existsSync)(verityCreds)) {
+    (0, import_node_fs56.mkdirSync)((0, import_node_path39.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -27490,8 +28072,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path38.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs54.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path39.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs56.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -27501,9 +28083,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path38.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path38.join)(root, "VERITY.md");
-  if (!(0, import_node_fs54.existsSync)(gateMd) || (0, import_node_fs54.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path39.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path39.join)(root, "VERITY.md");
+  if (!(0, import_node_fs56.existsSync)(gateMd) || (0, import_node_fs56.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -27515,12 +28097,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs54.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs56.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path38.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs54.existsSync)(file)) return;
+  const file = (0, import_node_path39.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs56.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -27568,14 +28150,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep4 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs54.writeFileSync)(verityCreds, verityContent + sep4 + toAppend.join("\n") + "\n");
+    (0, import_node_fs56.writeFileSync)(verityCreds, verityContent + sep4 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs54.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs56.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs54.readFileSync)(path, "utf-8");
+    return (0, import_node_fs56.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -27590,35 +28172,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs54.renameSync)(from, to);
+    (0, import_node_fs56.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs54.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs54.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs56.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs56.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs54.renameSync)(from, to);
+    (0, import_node_fs56.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs54.cpSync)(from, to);
-    (0, import_node_fs54.rmSync)(from, { force: true });
+    (0, import_node_fs56.cpSync)(from, to);
+    (0, import_node_fs56.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path38.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs54.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path38.join)(relDir, entry) : entry;
-      const src = (0, import_node_path38.join)(gateDir, rel);
-      const dest = (0, import_node_path38.join)(verityDir, rel);
-      if ((0, import_node_fs54.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path39.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs56.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path39.join)(relDir, entry) : entry;
+      const src = (0, import_node_path39.join)(gateDir, rel);
+      const dest = (0, import_node_path39.join)(verityDir, rel);
+      if ((0, import_node_fs56.statSync)(src).isDirectory()) {
         walk2(rel);
-      } else if (!(0, import_node_fs54.existsSync)(dest)) {
-        (0, import_node_fs54.mkdirSync)((0, import_node_path38.dirname)(dest), { recursive: true });
-        (0, import_node_fs54.cpSync)(src, dest);
+      } else if (!(0, import_node_fs56.existsSync)(dest)) {
+        (0, import_node_fs56.mkdirSync)((0, import_node_path39.dirname)(dest), { recursive: true });
+        (0, import_node_fs56.cpSync)(src, dest);
         copied++;
       }
     }
@@ -27627,22 +28209,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path38.join)(root, ".gate");
-  const verityDir = (0, import_node_path38.join)(root, ".verity");
-  if ((0, import_node_fs54.existsSync)(gateDir) && !(0, import_node_fs54.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs54.existsSync)(gateDir) && (0, import_node_fs54.existsSync)(verityDir)) {
-    if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(gateDir, "credentials")) && !(0, import_node_fs54.existsSync)((0, import_node_path38.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path39.join)(root, ".gate");
+  const verityDir = (0, import_node_path39.join)(root, ".verity");
+  if ((0, import_node_fs56.existsSync)(gateDir) && !(0, import_node_fs56.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs56.existsSync)(gateDir) && (0, import_node_fs56.existsSync)(verityDir)) {
+    if ((0, import_node_fs56.existsSync)((0, import_node_path39.join)(gateDir, "credentials")) && !(0, import_node_fs56.existsSync)((0, import_node_path39.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(gateDir, "memory")) && !(0, import_node_fs54.existsSync)((0, import_node_path38.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs56.existsSync)((0, import_node_path39.join)(gateDir, "memory")) && !(0, import_node_fs56.existsSync)((0, import_node_path39.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path38.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs54.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path39.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs56.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs54.existsSync)((0, import_node_path38.join)(root, "GATE.md")) && !(0, import_node_fs54.existsSync)((0, import_node_path38.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs56.existsSync)((0, import_node_path39.join)(root, "GATE.md")) && !(0, import_node_fs56.existsSync)((0, import_node_path39.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -27923,9 +28505,9 @@ async function promptMultiSelect(question, choices, fallback) {
 }
 
 // src/lib/remote-config.ts
-var import_node_fs55 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 var import_promises18 = require("node:fs/promises");
-var import_node_path39 = require("node:path");
+var import_node_path40 = require("node:path");
 var import_yaml5 = __toESM(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -27970,7 +28552,7 @@ async function adoptRemoteSetup(found, opts) {
   written.push(STANDARD_FILE);
   if (rider !== null) {
     const localIgnore = projectPath(VERITYIGNORE_FILE);
-    if (!(0, import_node_fs55.existsSync)(localIgnore)) {
+    if (!(0, import_node_fs57.existsSync)(localIgnore)) {
       await writeOut(VERITYIGNORE_FILE, rider);
       written.push(VERITYIGNORE_FILE);
     } else {
@@ -28003,7 +28585,7 @@ async function adoptRemoteSetup(found, opts) {
 }
 async function writeOut(relative3, body) {
   const target = projectPath(relative3);
-  await (0, import_promises18.mkdir)((0, import_node_path39.dirname)(target), { recursive: true });
+  await (0, import_promises18.mkdir)((0, import_node_path40.dirname)(target), { recursive: true });
   await (0, import_promises18.writeFile)(target, body);
 }
 function describeRemote(found) {
@@ -28120,15 +28702,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path40.join)(__dirname, "..", "data"),
+    (0, import_node_path41.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path40.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path41.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path40.join)(process.cwd(), "cli", "data")
+    (0, import_node_path41.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs56.existsSync)((0, import_node_path40.join)(candidate, "skills"))) {
+    if ((0, import_node_fs58.existsSync)((0, import_node_path41.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -28144,9 +28726,9 @@ async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out = [];
     const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs56.readdirSync)(d, { withFileTypes: true })) {
+      for (const e of (0, import_node_fs58.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path40.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path41.join)(d, e.name), rel);
         else if (e.isFile()) out.push(rel);
       }
     };
@@ -28157,8 +28739,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises19.readFile)((0, import_node_path40.join)(src, rel), "utf-8");
-      const b = await (0, import_promises19.readFile)((0, import_node_path40.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises19.readFile)((0, import_node_path41.join)(src, rel), "utf-8");
+      const b = await (0, import_promises19.readFile)((0, import_node_path41.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -28339,7 +28921,7 @@ async function synthesizeLocally(opts) {
 async function healStaleAnalysisConfig(globals) {
   const configPath = projectPath(CODACY_CONFIG_FILE);
   const standardPath = projectPath(STANDARD_FILE);
-  if (!(0, import_node_fs56.existsSync)(configPath) || !(0, import_node_fs56.existsSync)(standardPath)) return;
+  if (!(0, import_node_fs58.existsSync)(configPath) || !(0, import_node_fs58.existsSync)(standardPath)) return;
   const validation = validatePatternIds();
   if (validation.status !== "invalid") return;
   printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
@@ -28436,17 +29018,17 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path40.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path41.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path40.join)(skillsSource, skill);
-    const dest = (0, import_node_path40.join)(skillsDest, skill);
-    if (!(0, import_node_fs56.existsSync)(src)) {
+    const src = (0, import_node_path41.join)(skillsSource, skill);
+    const dest = (0, import_node_path41.join)(skillsDest, skill);
+    if (!(0, import_node_fs58.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
     }
-    if ((0, import_node_fs56.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
+    if ((0, import_node_fs58.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
       skillsInstalled++;
       continue;
     }
@@ -28585,7 +29167,7 @@ function registerInitCommand(program2) {
     const staleMarker = clearStalePluginMarker();
     const pluginMode = opts.plugin === false ? false : opts.pluginMode ?? pluginActiveHere();
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs56.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs58.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -28675,7 +29257,7 @@ function registerInitCommand(program2) {
       printInfo(`  intensity: ${intensity} \xB7 moments: ${moments.join(", ") || "none"} (no questions asked)`);
     }
     await scaffoldProject(step, defaultsOnly);
-    const globalVerityDir = (0, import_node_path40.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path41.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises19.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -28744,7 +29326,7 @@ function registerInitCommand(program2) {
     }
     step("Your project's Standard");
     let haveStandard = false;
-    if ((0, import_node_fs56.existsSync)(projectPath(STANDARD_FILE))) {
+    if ((0, import_node_fs58.existsSync)(projectPath(STANDARD_FILE))) {
       printInfo("  This project already has .verity/standard.yaml \u2014 keeping it.");
       haveStandard = true;
     } else {
@@ -28774,7 +29356,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.33.2-experimental.0c53bed" : "dev"
+          cli_version: true ? "0.33.3-experimental.072d5cb" : "dev"
         }
       });
     } catch (err) {
@@ -28824,8 +29406,8 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs57 = require("node:fs");
-var import_node_path41 = require("node:path");
+var import_node_fs59 = require("node:fs");
+var import_node_path42 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -28834,11 +29416,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path41.join)(skillsRoot, name);
-      if ((0, import_node_fs57.existsSync)(dir)) {
+      const dir = (0, import_node_path42.join)(skillsRoot, name);
+      if ((0, import_node_fs59.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
-          apply: () => (0, import_node_fs57.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs59.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -28852,24 +29434,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs57.existsSync)(verityDir)) {
+    if ((0, import_node_fs59.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs57.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs59.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs57.existsSync)(verityMd)) {
+      if ((0, import_node_fs59.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs57.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs59.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs57.existsSync)(path) && (0, import_node_fs57.statSync)(path).isDirectory() && (0, import_node_fs57.readdirSync)(path).length === 0) {
-        (0, import_node_fs57.rmdirSync)(path);
+      if ((0, import_node_fs59.existsSync)(path) && (0, import_node_fs59.statSync)(path).isDirectory() && (0, import_node_fs59.readdirSync)(path).length === 0) {
+        (0, import_node_fs59.rmdirSync)(path);
       }
     };
     actions.push({
@@ -28880,11 +29462,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path41.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs57.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path42.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs59.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs57.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs59.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -29078,8 +29660,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs58 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_fs60 = require("node:fs");
+var import_node_path43 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -29116,11 +29698,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs58.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs58.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs60.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs60.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs58.unlinkSync)((0, import_node_path42.join)(cacheDir, entry));
+            (0, import_node_fs60.unlinkSync)((0, import_node_path43.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -29135,19 +29717,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs58.existsSync)(file)) {
+      if ((0, import_node_fs60.existsSync)(file)) {
         try {
-          (0, import_node_fs58.writeFileSync)(file, "");
+          (0, import_node_fs60.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs58.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs58.readdirSync)(logsDir)) {
+      if ((0, import_node_fs60.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs60.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs58.unlinkSync)((0, import_node_path42.join)(logsDir, entry));
+            (0, import_node_fs60.unlinkSync)((0, import_node_path43.join)(logsDir, entry));
           } catch {
           }
         }
@@ -29159,7 +29741,7 @@ function registerResetCommand(program2) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs59 = require("node:fs");
+var import_node_fs61 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -29197,7 +29779,7 @@ async function writeNodeToDisk(args) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs59.existsSync)(projectPath(`${VERITY_DIR}/memory/${args.filePath}`));
+    return (0, import_node_fs61.existsSync)(projectPath(`${VERITY_DIR}/memory/${args.filePath}`));
   } catch {
     return false;
   }
@@ -29400,7 +29982,7 @@ function registerMemoryCommand(program2) {
       process.exit(0);
     }
     if (result.skipped === "already_seeded") {
-      printInfo("Memory graph already seeded (.verity/memory/domain/project-overview.md exists). Use --force to re-seed.");
+      printInfo("Memory graph already seeded \u2014 this project has seed nodes (locally or on the server). Use --force to re-materialize them.");
       process.exit(0);
     }
     if (opts.dryRun) {
@@ -29411,10 +29993,11 @@ function registerMemoryCommand(program2) {
       process.exit(0);
     }
     console.log("");
+    const existingNote = result.existing > 0 ? ` ${result.existing} already existed on the server and were not duplicated.` : "";
     if (result.failed === 0) {
-      printInfo(`Seeded ${result.created} knowledge node(s) from the Standard into .verity/memory/.`);
+      printInfo(`Seeded ${result.created} knowledge node(s) from the Standard into .verity/memory/.${existingNote}`);
     } else {
-      printWarn(`Seeded ${result.created} node(s); ${result.failed} failed. See messages above.`);
+      printWarn(`Seeded ${result.created} node(s); ${result.failed} failed.${existingNote} See messages above.`);
     }
     process.exit(result.failed === 0 ? 0 : 1);
   });
@@ -29696,8 +30279,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.33.2-experimental.0c53bed").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.2-experimental.0c53bed");
+program.name("verity").description("CLI for Verity quality gate service").version("0.33.3-experimental.072d5cb").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.33.3-experimental.072d5cb");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();