@delorenj/pjangler 1.5.49 → 1.5.50

package/dist/mcp-server.js

@@ -437,7 +437,7 @@ var init_executionBinding = __esm({
 });
 
 // src/project/manifestIndex.ts
-import { basename as basename5, dirname as dirname9, join as join12, resolve as resolve7 } from "node:path";
+import { basename as basename6, dirname as dirname9, join as join13, resolve as resolve7 } from "node:path";
 function normalizeProjectId2(value) {
   try {
     return normalizeProjectId(value);
@@ -484,24 +484,24 @@ var init_manifestIndex = __esm({
 });
 
 // src/lifecycle/preflight.ts
-import { createHash as createHash8 } from "node:crypto";
-import { accessSync, constants, existsSync as existsSync9, lstatSync as lstatSync10, readFileSync as readFileSync11, readdirSync as readdirSync8, realpathSync as realpathSync5, statSync as statSync3 } from "node:fs";
+import { createHash as createHash9 } from "node:crypto";
+import { accessSync, constants as constants2, existsSync as existsSync9, lstatSync as lstatSync11, readFileSync as readFileSync12, readdirSync as readdirSync9, realpathSync as realpathSync5, statSync as statSync3 } from "node:fs";
 import { tmpdir as tmpdir2, userInfo } from "node:os";
-import { basename as basename6, delimiter, dirname as dirname10, isAbsolute as isAbsolute5, join as join13, relative as relative10, resolve as resolve8 } from "node:path";
+import { basename as basename7, delimiter, dirname as dirname10, isAbsolute as isAbsolute5, join as join14, relative as relative10, resolve as resolve8 } from "node:path";
 import YAML5 from "yaml";
 function containedBy(parent, candidate) {
   const rel = relative10(resolve8(parent), resolve8(candidate));
   return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
 }
 function accountMiseShimsDir(home) {
-  return resolve8(join13(home, ".local", "share", "mise", "shims"));
+  return resolve8(join14(home, ".local", "share", "mise", "shims"));
 }
 function inactiveMiseShim(candidate, shimsDir) {
   if (dirname10(candidate) !== shimsDir) return void 0;
   try {
-    if (!lstatSync10(candidate).isSymbolicLink()) return void 0;
+    if (!lstatSync11(candidate).isSymbolicLink()) return void 0;
     const realPath = realpathSync5(candidate);
-    if (basename6(realPath) !== "mise") return void 0;
+    if (basename7(realPath) !== "mise") return void 0;
     return { path: candidate, realPath, reason: "inactive-mise-shim" };
   } catch {
     return void 0;
@@ -513,8 +513,8 @@ function resolveCopierOnPath(env2, shimsDir) {
     const entry = rawEntry || process.cwd();
     const candidate = resolve8(entry, process.platform === "win32" ? "copier.exe" : "copier");
     try {
-      accessSync(candidate, constants.X_OK);
-      const stat = lstatSync10(candidate);
+      accessSync(candidate, constants2.X_OK);
+      const stat = lstatSync11(candidate);
       if (!stat.isFile() && !stat.isSymbolicLink()) continue;
     } catch {
       continue;
@@ -532,7 +532,7 @@ function describeSkipped(skipped) {
   return skipped.map((entry) => `${entry.path} -> ${entry.realPath}`).join(", ");
 }
 function sha256(path) {
-  return createHash8("sha256").update(readFileSync11(path)).digest("base64url");
+  return createHash9("sha256").update(readFileSync12(path)).digest("base64url");
 }
 function fingerprint(path) {
   const absolute = resolve8(path);
@@ -570,7 +570,7 @@ function sameFingerprint(expected) {
 function consoleScriptContract(path) {
   let text;
   try {
-    text = readFileSync11(path, "utf8").slice(0, 32 * 1024);
+    text = readFileSync12(path, "utf8").slice(0, 32 * 1024);
   } catch (error) {
     return { ok: false, error: `cannot read Copier launcher: ${error instanceof Error ? error.message : String(error)}` };
   }
@@ -581,7 +581,7 @@ function consoleScriptContract(path) {
     return { ok: false, error: "Copier launcher must use one absolute Python interpreter" };
   }
   const interpreterPath = resolve8(shebang[0]);
-  const interpreter = basename6(interpreterPath);
+  const interpreter = basename7(interpreterPath);
   if (!/^python(?:\d+(?:\.\d+)*)?$/.test(interpreter)) {
     return { ok: false, error: "Copier launcher is not an absolute Python console script" };
   }
@@ -592,16 +592,16 @@ function consoleScriptContract(path) {
 }
 function defaultUvToolRoots(home) {
   return [
-    join13(home, ".local", "share", "uv", "tools", "copier"),
-    join13(home, "Library", "Application Support", "uv", "tools", "copier")
+    join14(home, ".local", "share", "uv", "tools", "copier"),
+    join14(home, "Library", "Application Support", "uv", "tools", "copier")
   ].map((path) => resolve8(path));
 }
 function locateUvSitePackages(toolRoot) {
-  const lib = join13(toolRoot, "lib");
+  const lib = join14(toolRoot, "lib");
   const candidates = [];
-  for (const entry of readdirSync8(lib, { withFileTypes: true })) {
+  for (const entry of readdirSync9(lib, { withFileTypes: true })) {
     if (!entry.isDirectory() || !/^python\d+(?:\.\d+)*$/.test(entry.name)) continue;
-    const sitePackages = join13(lib, entry.name, "site-packages");
+    const sitePackages = join14(lib, entry.name, "site-packages");
     if (existsSync9(sitePackages)) candidates.push(sitePackages);
   }
   if (candidates.length !== 1) throw new Error(`expected one UV Copier site-packages directory, found ${candidates.length}`);
@@ -618,13 +618,13 @@ function parseRecordLine(line) {
   };
 }
 function attestUvCopier(candidate, realCandidate, home) {
-  const toolRoot = defaultUvToolRoots(home).find((root) => realCandidate === join13(root, "bin", "copier"));
+  const toolRoot = defaultUvToolRoots(home).find((root) => realCandidate === join14(root, "bin", "copier"));
   if (!toolRoot) {
     return { ok: false, error: `refusing untrusted PATH-shadowed Copier executable: ${candidate}` };
   }
   const supportedEntries = new Set([
-    join13(home, ".local", "bin", "copier"),
-    join13(toolRoot, "bin", "copier")
+    join14(home, ".local", "bin", "copier"),
+    join14(toolRoot, "bin", "copier")
   ].map((path) => resolve8(path)));
   if (!supportedEntries.has(resolve8(candidate))) {
     return { ok: false, error: `refusing non-canonical UV Copier entry point: ${candidate}` };
@@ -634,46 +634,46 @@ function attestUvCopier(candidate, realCandidate, home) {
     if (!launcher.ok || !launcher.interpreter) {
       return { ...launcher, executable: realCandidate, realExecutable: realCandidate };
     }
-    const expectedInterpreter = join13(toolRoot, "bin", basename6(launcher.interpreter));
+    const expectedInterpreter = join14(toolRoot, "bin", basename7(launcher.interpreter));
     if (resolve8(launcher.interpreter) !== resolve8(expectedInterpreter)) {
       return { ok: false, error: "UV Copier launcher interpreter is outside the attested tool environment" };
     }
     const interpreterReal = realpathSync5(launcher.interpreter);
     const uvPythonRoots = [
-      join13(home, ".local", "share", "uv", "python"),
-      join13(home, "Library", "Application Support", "uv", "python")
+      join14(home, ".local", "share", "uv", "python"),
+      join14(home, "Library", "Application Support", "uv", "python")
     ];
     if (!uvPythonRoots.some((root) => containedBy(root, interpreterReal))) {
       return { ok: false, error: "UV Copier interpreter is not managed by the canonical UV Python installation" };
     }
-    const receiptPath = join13(toolRoot, "uv-receipt.toml");
-    const receipt = readFileSync11(receiptPath, "utf8");
+    const receiptPath = join14(toolRoot, "uv-receipt.toml");
+    const receipt = readFileSync12(receiptPath, "utf8");
     if (!/requirements\s*=\s*\[[\s\S]*?name\s*=\s*["']copier["']/.test(receipt) || !/entrypoints\s*=\s*\[[\s\S]*?name\s*=\s*["']copier["'][\s\S]*?from\s*=\s*["']copier["']/.test(receipt)) {
       return { ok: false, error: "UV tool receipt does not bind the copier entry point to the Copier package" };
     }
     const sitePackages = locateUvSitePackages(toolRoot);
-    const distInfos = readdirSync8(sitePackages, { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^copier-[^-]+\.dist-info$/i.test(entry.name)).map((entry) => join13(sitePackages, entry.name));
+    const distInfos = readdirSync9(sitePackages, { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^copier-[^-]+\.dist-info$/i.test(entry.name)).map((entry) => join14(sitePackages, entry.name));
     if (distInfos.length !== 1) {
       return { ok: false, error: `expected one installed Copier distribution, found ${distInfos.length}` };
     }
     const distInfo = realpathSync5(distInfos[0]);
-    const metadataPath = join13(distInfo, "METADATA");
-    const entryPointsPath = join13(distInfo, "entry_points.txt");
-    const recordPath = join13(distInfo, "RECORD");
-    const metadata = readFileSync11(metadataPath, "utf8");
+    const metadataPath = join14(distInfo, "METADATA");
+    const entryPointsPath = join14(distInfo, "entry_points.txt");
+    const recordPath = join14(distInfo, "RECORD");
+    const metadata = readFileSync12(metadataPath, "utf8");
     const name = metadata.match(/^Name:\s*(.+)$/mi)?.[1]?.trim();
     const version = metadata.match(/^Version:\s*(.+)$/mi)?.[1]?.trim();
     if (name?.toLowerCase() !== "copier" || !version || !/^9(?:\.|$)/.test(version)) {
       return { ok: false, error: "installed distribution is not a Copier 9 package" };
     }
-    const entryPoints = readFileSync11(entryPointsPath, "utf8");
+    const entryPoints = readFileSync12(entryPointsPath, "utf8");
     if (!/^copier\s*=\s*copier\.__main__:CopierApp\.run\s*$/m.test(entryPoints)) {
       return { ok: false, error: "installed Copier distribution has an unexpected console entry point" };
     }
-    const recordEntries = readFileSync11(recordPath, "utf8").split(/\r?\n/).map(parseRecordLine).filter((entry) => Boolean(entry));
+    const recordEntries = readFileSync12(recordPath, "utf8").split(/\r?\n/).map(parseRecordLine).filter((entry) => Boolean(entry));
     const selected = recordEntries.filter((entry) => {
       const normalized = entry.relativePath.replaceAll("\\", "/");
-      return normalized.startsWith("copier/") || normalized === `${basename6(distInfo)}/METADATA` || normalized === `${basename6(distInfo)}/entry_points.txt` || normalized === "../../../bin/copier";
+      return normalized.startsWith("copier/") || normalized === `${basename7(distInfo)}/METADATA` || normalized === `${basename7(distInfo)}/entry_points.txt` || normalized === "../../../bin/copier";
     });
     if (!selected.some((entry) => entry.relativePath === "../../../bin/copier") || !selected.some((entry) => entry.relativePath.replaceAll("\\", "/") === "copier/__main__.py")) {
       return { ok: false, error: "Copier RECORD does not bind its launcher and package entry point" };
@@ -690,7 +690,7 @@ function attestUvCopier(candidate, realCandidate, home) {
       }
       attestedFiles.set(resolve8(path), fingerprint(path));
     }
-    for (const path of [realCandidate, join13(toolRoot, "pyvenv.cfg"), receiptPath, metadataPath, entryPointsPath, recordPath]) {
+    for (const path of [realCandidate, join14(toolRoot, "pyvenv.cfg"), receiptPath, metadataPath, entryPointsPath, recordPath]) {
       attestedFiles.set(resolve8(path), fingerprint(path));
     }
     const identity = {
@@ -765,18 +765,18 @@ function regularContainedFile(root, path, label) {
     const rootReal = realpathSync5(root);
     const fileReal = realpathSync5(path);
     if (!containedBy(rootReal, fileReal)) return { ok: false, error: `${label} escapes its vendored template root` };
-    if (!lstatSync10(path).isFile()) return { ok: false, error: `${label} is not a regular file` };
+    if (!lstatSync11(path).isFile()) return { ok: false, error: `${label} is not a regular file` };
     return { ok: true };
   } catch (error) {
     return { ok: false, error: `${label} is unavailable: ${error instanceof Error ? error.message : String(error)}` };
   }
 }
 function parseCopierConfig(templateRoot, label) {
-  const configPath = join13(templateRoot, "copier.yml");
+  const configPath = join14(templateRoot, "copier.yml");
   const file = regularContainedFile(templateRoot, configPath, `${label} copier.yml`);
   if (!file.ok) return { result: file };
   try {
-    const parsed = YAML5.parse(readFileSync11(configPath, "utf8"));
+    const parsed = YAML5.parse(readFileSync12(configPath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return { result: { ok: false, error: `${label} copier.yml must contain a mapping` } };
     }
@@ -794,13 +794,13 @@ function parseCopierConfig(templateRoot, label) {
 }
 function requireFiles(templateRoot, files, label) {
   for (const rel of files) {
-    const result2 = regularContainedFile(templateRoot, join13(templateRoot, rel), `${label} ${rel}`);
+    const result2 = regularContainedFile(templateRoot, join14(templateRoot, rel), `${label} ${rel}`);
     if (!result2.ok) return result2;
   }
   return { ok: true };
 }
 function preflightCommonProjectTemplate(pjanglerRoot) {
-  const templateRoot = join13(resolve8(pjanglerRoot), "templates", "commonproject");
+  const templateRoot = join14(resolve8(pjanglerRoot), "templates", "commonproject");
   const parsed = parseCopierConfig(templateRoot, "CommonProject template");
   if (!parsed.result.ok) return parsed.result;
   const files = requireFiles(templateRoot, [
@@ -811,7 +811,7 @@ function preflightCommonProjectTemplate(pjanglerRoot) {
     "template/mise.toml.jinja"
   ], "CommonProject template");
   if (!files.ok) return files;
-  const projectJson = readFileSync11(join13(templateRoot, "template", ".project.json.jinja"), "utf8");
+  const projectJson = readFileSync12(join14(templateRoot, "template", ".project.json.jinja"), "utf8");
   for (const key of ["project_name", "repo_path", "ticket_provider", "agents"]) {
     if (!projectJson.includes(`"${key}"`)) return { ok: false, error: `CommonProject projection is missing ${key}` };
   }
@@ -836,12 +836,12 @@ var init_preflight = __esm({
 });
 
 // src/project/boardUrl.ts
-import { existsSync as existsSync10, readFileSync as readFileSync12, statSync as statSync4 } from "node:fs";
-import { dirname as dirname11, isAbsolute as isAbsolute6, join as join14, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync13, statSync as statSync4 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute6, join as join15, resolve as resolve9 } from "node:path";
 function findProjectRoot(from) {
   let dir = resolve9(from);
   for (; ; ) {
-    if (existsSync10(join14(dir, ".project.json"))) return dir;
+    if (existsSync10(join15(dir, ".project.json"))) return dir;
     const parent = dirname11(dir);
     if (parent === dir) return void 0;
     dir = parent;
@@ -854,8 +854,8 @@ var init_boardUrl = __esm({
 });
 
 // src/utils/version.ts
-import { readFileSync as readFileSync13 } from "node:fs";
-import { dirname as dirname12, join as join15 } from "node:path";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { dirname as dirname12, join as join16 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PJANGLER_VERSION;
 var init_version = __esm({
@@ -866,7 +866,7 @@ var init_version = __esm({
         let dir = dirname12(fileURLToPath(import.meta.url));
         for (let i = 0; i < 4; i++) {
           try {
-            const raw = readFileSync13(join15(dir, "package.json"), "utf8");
+            const raw = readFileSync14(join16(dir, "package.json"), "utf8");
             return JSON.parse(raw).version ?? "0.0.0";
           } catch {
             const parent = dirname12(dir);
@@ -896,9 +896,9 @@ var init_boardQuery = __esm({
 
 // src/project/index.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { chmodSync as chmodSync4, closeSync as closeSync2, copyFileSync as copyFileSync2, existsSync as existsSync11, fchmodSync, fsyncSync, lstatSync as lstatSync11, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync14, realpathSync as realpathSync6, renameSync as renameSync5, rmSync as rmSync6, statSync as statSync5, unlinkSync as unlinkSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { chmodSync as chmodSync4, closeSync as closeSync3, copyFileSync as copyFileSync2, existsSync as existsSync11, fchmodSync as fchmodSync2, fsyncSync, lstatSync as lstatSync12, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, openSync as openSync3, readFileSync as readFileSync15, realpathSync as realpathSync6, renameSync as renameSync5, rmSync as rmSync6, statSync as statSync5, unlinkSync as unlinkSync7, writeFileSync as writeFileSync10 } from "node:fs";
 import { homedir as homedir5, tmpdir as tmpdir3 } from "node:os";
-import { basename as basename7, delimiter as delimiter2, dirname as dirname13, isAbsolute as isAbsolute7, join as join16, relative as relative11, resolve as resolve10, sep as sep3, win32 } from "node:path";
+import { basename as basename8, delimiter as delimiter2, dirname as dirname13, isAbsolute as isAbsolute7, join as join17, relative as relative11, resolve as resolve10, sep as sep3, win32 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import YAML6 from "yaml";
 function normalizeProjectType(value, label = "Project type") {
@@ -908,7 +908,7 @@ function normalizeProjectType(value, label = "Project type") {
 }
 function looksLikeObsidianPlugin(dir) {
   try {
-    const manifest = JSON.parse(readFileSync14(join16(dir, "manifest.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync15(join17(dir, "manifest.json"), "utf8"));
     return isRecord2(manifest) && typeof manifest.id === "string" && typeof manifest.minAppVersion === "string";
   } catch {
     return false;
@@ -916,10 +916,10 @@ function looksLikeObsidianPlugin(dir) {
 }
 function assertTemplateOffersProjectType(pjanglerRoot, projectType) {
   if (projectType === "base") return;
-  const copierYml = join16(pjanglerRoot, "templates", "commonproject", "copier.yml");
+  const copierYml = join17(pjanglerRoot, "templates", "commonproject", "copier.yml");
   let choices;
   try {
-    const parsed = YAML6.parse(readFileSync14(copierYml, "utf8"));
+    const parsed = YAML6.parse(readFileSync15(copierYml, "utf8"));
     choices = isRecord2(parsed) && isRecord2(parsed.project_type) ? parsed.project_type.choices : void 0;
   } catch {
     choices = void 0;
@@ -942,9 +942,9 @@ function carriedAutomation(automation) {
   return Object.keys(rest).length ? { automation: rest } : {};
 }
 function synchronizeCopierIdentity(manifestPath, manifest) {
-  const answersPath = join16(dirname13(manifestPath), ".copier-answers.yml");
+  const answersPath = join17(dirname13(manifestPath), ".copier-answers.yml");
   if (!existsSync11(answersPath)) return [];
-  const current = readFileSync14(answersPath, "utf8");
+  const current = readFileSync15(answersPath, "utf8");
   const document = YAML6.parseDocument(current);
   if (document.errors.length) return [];
   const name = String(document.get("project_name") ?? "");
@@ -954,7 +954,7 @@ function synchronizeCopierIdentity(manifestPath, manifest) {
   document.set("project_description", manifest.project_description);
   const next = String(document);
   if (next === current) return [];
-  writeFileSync9(answersPath, next, "utf8");
+  writeFileSync10(answersPath, next, "utf8");
   return [answersPath];
 }
 function projectRegistryPath(env2 = process.env) {
@@ -978,7 +978,7 @@ function loadProjectRegistry(path = projectRegistryPath()) {
     return registry2;
   }
   if (!existsSync11(path)) return emptyProjectRegistry();
-  const raw = YAML6.parse(readFileSync14(path, "utf8"));
+  const raw = YAML6.parse(readFileSync15(path, "utf8"));
   if (raw == null) return emptyProjectRegistry();
   if (!isRecord2(raw)) throw new Error(`Project registry must be a mapping: ${path}`);
   const registry = raw;
@@ -1046,11 +1046,11 @@ function mergeYamlMapping(document, path, desired, ownedKeys = []) {
 }
 function fsyncDirectory(path) {
   try {
-    const fd = openSync2(path, "r");
+    const fd = openSync3(path, "r");
     try {
       fsyncSync(fd);
     } finally {
-      closeSync2(fd);
+      closeSync3(fd);
     }
   } catch {
   }
@@ -1064,14 +1064,14 @@ function saveProjectRegistry(registry, path = projectRegistryPath()) {
     return;
   }
   validateProjectRegistry(registry);
-  mkdirSync7(dirname13(path), { recursive: true });
+  mkdirSync8(dirname13(path), { recursive: true });
   let text;
   let mode = 420;
   if (existsSync11(path)) {
-    const stat = lstatSync11(path);
+    const stat = lstatSync12(path);
     if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`Project registry must be a regular file: ${path}`);
     mode = stat.mode & 511;
-    const current = readFileSync14(path, "utf8");
+    const current = readFileSync15(path, "utf8");
     const document = YAML6.parseDocument(current);
     if (document.errors.length) throw new Error(`Project registry YAML is invalid: ${path}`);
     setYamlLeaf(document, ["schema_version"], registry.schema_version);
@@ -1092,22 +1092,22 @@ function saveProjectRegistry(registry, path = projectRegistryPath()) {
   const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
   let fd;
   try {
-    fd = openSync2(temp, "wx", mode);
-    writeFileSync9(fd, text, "utf8");
-    fchmodSync(fd, mode);
+    fd = openSync3(temp, "wx", mode);
+    writeFileSync10(fd, text, "utf8");
+    fchmodSync2(fd, mode);
     fsyncSync(fd);
-    closeSync2(fd);
+    closeSync3(fd);
     fd = void 0;
     renameSync5(temp, path);
     chmodSync4(path, mode);
     fsyncDirectory(dirname13(path));
   } catch (error) {
     if (fd !== void 0) try {
-      closeSync2(fd);
+      closeSync3(fd);
     } catch {
     }
     try {
-      unlinkSync6(temp);
+      unlinkSync7(temp);
     } catch {
     }
     throw error;
@@ -1215,18 +1215,18 @@ function ticketProviderKeyVars(provider, workspace) {
   return ticketProviderKeyGroups(provider, workspace).flat();
 }
 function ticketProviderSecretsPath(env2 = process.env) {
-  const base = env2.XDG_CONFIG_HOME || join16(env2.HOME || homedir5(), ".config");
-  return join16(base, "zshyzsh", "secrets.zsh");
+  const base = env2.XDG_CONFIG_HOME || join17(env2.HOME || homedir5(), ".config");
+  return join17(base, "zshyzsh", "secrets.zsh");
 }
 function ticketProviderFleetEnvPath(env2 = process.env) {
-  return env2.HERMES_FLEET_ENV?.trim() || join16(env2.HOME || homedir5(), ".hermes", "fleet.env");
+  return env2.HERMES_FLEET_ENV?.trim() || join17(env2.HOME || homedir5(), ".hermes", "fleet.env");
 }
 function readShellAssignments(path, keys) {
   const found = {};
   if (!existsSync11(path)) return found;
   let text;
   try {
-    text = readFileSync14(path, "utf8");
+    text = readFileSync15(path, "utf8");
   } catch {
     return found;
   }
@@ -1262,7 +1262,7 @@ function resolveTicketProviderCredentials(input) {
     }
   }
   const candidates = [];
-  if (input.repoPath) candidates.push(join16(input.repoPath, ".env"));
+  if (input.repoPath) candidates.push(join17(input.repoPath, ".env"));
   candidates.push(ticketProviderFleetEnvPath(env2));
   candidates.push(ticketProviderSecretsPath(env2));
   for (const candidate of candidates) {
@@ -1280,19 +1280,19 @@ function resolveTicketProviderAdapter(provider, env2 = process.env) {
   const file = `${provider}.sh`;
   const candidates = [];
   const override = env2[TICKET_PROVIDER_ADAPTERS_ENV];
-  if (override) candidates.push(join16(override, file));
-  const relativeRoot = join16("krebs", "adapters", "tp");
+  if (override) candidates.push(join17(override, file));
+  const relativeRoot = join17("krebs", "adapters", "tp");
   try {
     let dir = dirname13(fileURLToPath2(import.meta.url));
     for (let depth = 0; depth < 8; depth++) {
-      candidates.push(join16(dir, relativeRoot, file));
+      candidates.push(join17(dir, relativeRoot, file));
       const parent = dirname13(dir);
       if (parent === dir) break;
       dir = parent;
     }
   } catch {
   }
-  candidates.push(join16(homedir5(), "code", "33GOD", relativeRoot, file));
+  candidates.push(join17(homedir5(), "code", "33GOD", relativeRoot, file));
   return candidates.find((candidate) => existsSync11(candidate));
 }
 function provisionTicketProviderBoard(action, env2 = process.env) {
@@ -1310,7 +1310,7 @@ function provisionTicketProviderBoard(action, env2 = process.env) {
       ok: true,
       skipped: true,
       logs: [
-        `ticket-provider: ${names} not set; skipping ${provider} board creation (state stays "planned"). Set it in the environment, ${join16(action.repoPath, ".env")}, ${ticketProviderFleetEnvPath(env2)}, or ${ticketProviderSecretsPath(env2)} \u2014 or pass --board-id to link an existing board.`
+        `ticket-provider: ${names} not set; skipping ${provider} board creation (state stays "planned"). Set it in the environment, ${join17(action.repoPath, ".env")}, ${ticketProviderFleetEnvPath(env2)}, or ${ticketProviderSecretsPath(env2)} \u2014 or pass --board-id to link an existing board.`
       ]
     };
   }
@@ -1324,12 +1324,12 @@ function provisionTicketProviderBoard(action, env2 = process.env) {
     };
   }
   const redact = (text) => Object.values(values).reduce((acc, secret) => secret ? acc.split(secret).join("***") : acc, text);
-  const staging = mkdtempSync2(join16(tmpdir3(), "pjangler-tp-"));
+  const staging = mkdtempSync3(join17(tmpdir3(), "pjangler-tp-"));
   try {
-    const providersDir = join16(staging, ".tp", "adapters");
-    mkdirSync7(providersDir, { recursive: true });
-    writeFileSync9(
-      join16(staging, ".project.json"),
+    const providersDir = join17(staging, ".tp", "adapters");
+    mkdirSync8(providersDir, { recursive: true });
+    writeFileSync10(
+      join17(staging, ".project.json"),
       `${JSON.stringify(
         {
           project_name: action.boardName,
@@ -1348,7 +1348,7 @@ function provisionTicketProviderBoard(action, env2 = process.env) {
 `,
       "utf8"
     );
-    const staged = join16(providersDir, `${provider}.sh`);
+    const staged = join17(providersDir, `${provider}.sh`);
     copyFileSync2(adapter, staged);
     const childEnv = { ...env2, ...values, TICKET_PROVIDER: provider };
     if (provider === "plane" && action.workspace) childEnv.PLANE_WORKSPACE = action.workspace;
@@ -1437,7 +1437,7 @@ function prospectiveRealPath(path) {
   while (!existsSync11(cursor)) {
     const parent = dirname13(cursor);
     if (parent === cursor) return resolve10(path);
-    suffix.unshift(basename7(cursor));
+    suffix.unshift(basename8(cursor));
     cursor = parent;
   }
   return resolve10(realpathSync6(cursor), ...suffix);
@@ -1464,7 +1464,7 @@ function resolveAgentHooksLayer2(input, env2 = process.env) {
   const override = env2.PJ_AGENT_HOOKS_LAYER;
   if (override === "0" || override === "false") return false;
   if (override === "1" || override === "true") return true;
-  return !existsSync11(join16(homedir5(), ".agents", "hooks"));
+  return !existsSync11(join17(homedir5(), ".agents", "hooks"));
 }
 function jsonStable(value) {
   return JSON.stringify(value, (_key, item) => isRecord2(item) ? Object.fromEntries(Object.keys(item).sort().map((key) => [key, item[key]])) : item);
@@ -1497,10 +1497,10 @@ function resolveSourceSkillPath(sourceSkill, env2 = process.env) {
   const expanded = expandHome(sourceSkill);
   const direct = resolve10(expanded);
   if (existsSync11(direct)) return direct;
-  const name = basename7(sourceSkill);
+  const name = basename8(sourceSkill);
   const roots = sourceSkillRoots(env2);
   for (const root of roots) {
-    const candidate = join16(root, name);
+    const candidate = join17(root, name);
     if (existsSync11(candidate)) return candidate;
   }
   const searched = roots.length ? ` Searched roots: ${roots.join(", ")}.` : "";
@@ -1510,8 +1510,8 @@ function resolveSourceSkillPath(sourceSkill, env2 = process.env) {
 function planProjectInit(input) {
   if (!input.name.trim()) throw new Error("Project name is required");
   const targetDir = resolve10(input.targetDir ?? defaultProjectTargetDir(input.name, input.cwd));
-  const localManifestPath = join16(targetDir, ".project.json");
-  const localManifestContent = existsSync11(localManifestPath) ? readFileSync14(localManifestPath, "utf8") : void 0;
+  const localManifestPath = join17(targetDir, ".project.json");
+  const localManifestContent = existsSync11(localManifestPath) ? readFileSync15(localManifestPath, "utf8") : void 0;
   const localManifest = localManifestContent === void 0 ? void 0 : JSON.parse(localManifestContent);
   const localId = localManifest?.project_id ?? localManifest?.project_slug;
   const slug = normalizeProjectId(input.projectSlug ?? localId ?? slugifyProjectName(input.name));
@@ -1539,7 +1539,7 @@ function planProjectInit(input) {
   const recordedTypeValue = existing?.template?.commonproject?.project_type;
   const recordedType = recordedTypeValue === void 0 ? void 0 : normalizeProjectType(recordedTypeValue, `Recorded project type of ${slug}`);
   const requestedType = input.projectType === void 0 ? void 0 : normalizeProjectType(input.projectType);
-  const freshRender = scaffold && localManifest === void 0 && !existsSync11(join16(targetDir, ".copier-answers.yml"));
+  const freshRender = scaffold && localManifest === void 0 && !existsSync11(join17(targetDir, ".copier-answers.yml"));
   if (requestedType && !freshRender && requestedType !== (recordedType ?? "base")) {
     const adoptingPlugin = !scaffold && recordedType === void 0 && requestedType === "obsidian-plugin" && looksLikeObsidianPlugin(targetDir);
     if (!adoptingPlugin) {
@@ -1637,7 +1637,7 @@ function planProjectInit(input) {
     }));
   }
   actions.push(
-    { kind: "project.write-manifest", path: join16(targetDir, ".project.json"), manifest, expectedContent: localManifestContent },
+    { kind: "project.write-manifest", path: join17(targetDir, ".project.json"), manifest, expectedContent: localManifestContent },
     {
       kind: "ticket-provider.create-or-link",
       enabled: boardEnabled,
@@ -1692,12 +1692,12 @@ function linkTicketProviderBoard(plan, action, boardId, identifier, now = /* @__
   plan.manifest.ticket_provider = manifestProvider;
   action.boardId = boardId;
   action.state = manifestProvider.state;
-  const manifestPath = join16(action.repoPath, ".project.json");
+  const manifestPath = join17(action.repoPath, ".project.json");
   let next;
   if (existsSync11(manifestPath)) {
     let existing = {};
     try {
-      const parsed = JSON.parse(readFileSync14(manifestPath, "utf8"));
+      const parsed = JSON.parse(readFileSync15(manifestPath, "utf8"));
       if (isRecord2(parsed)) existing = parsed;
     } catch {
       existing = {};
@@ -1705,13 +1705,13 @@ function linkTicketProviderBoard(plan, action, boardId, identifier, now = /* @__
     const existingProvider = isRecord2(existing.ticket_provider) ? existing.ticket_provider : {};
     next = { ...existing, ticket_provider: { ...existingProvider, ...manifestProvider } };
   } else {
-    mkdirSync7(dirname13(manifestPath), { recursive: true });
+    mkdirSync8(dirname13(manifestPath), { recursive: true });
     next = plan.manifest;
   }
   const text = `${JSON.stringify(next, null, 2)}
 `;
-  if (!existsSync11(manifestPath) || readFileSync14(manifestPath, "utf8") !== text) {
-    writeFileSync9(manifestPath, text, "utf8");
+  if (!existsSync11(manifestPath) || readFileSync15(manifestPath, "utf8") !== text) {
+    writeFileSync10(manifestPath, text, "utf8");
     return [manifestPath];
   }
   return [];
@@ -1739,7 +1739,7 @@ async function executeProjectInitPlan(plan, options = {}) {
       logs.push(
         action.data.agent_hooks_layer === "false" ? "commonproject: agent-hooks layer skipped (global ~/.agents/hooks detected \u2014 no per-user CLI injection)" : "commonproject: agent-hooks layer included"
       );
-      mkdirSync7(dirname13(action.targetDir), { recursive: true });
+      mkdirSync8(dirname13(action.targetDir), { recursive: true });
       const before = snapshotTree(action.targetDir);
       const copierExecutable = options.trustedCopier?.executable ?? action.command[0];
       const copierEnv = { ...process.env };
@@ -1771,22 +1771,22 @@ async function executeProjectInitPlan(plan, options = {}) {
         break;
       }
       const projectType = action.data.project_type ?? "base";
-      const missing = (PROJECT_TYPE_SENTINELS[projectType] ?? []).filter((rel) => !existsSync11(join16(action.targetDir, rel)));
+      const missing = (PROJECT_TYPE_SENTINELS[projectType] ?? []).filter((rel) => !existsSync11(join17(action.targetDir, rel)));
       if (missing.length) {
         errors.push(`copier rendered no ${projectType} project: ${missing.join(", ")} missing from ${action.targetDir}`);
         break;
       }
       if (projectType !== "base") logs.push(`commonproject: rendered as ${projectType}`);
     } else if (action.kind === "project.write-manifest") {
-      if (action.expectedContent !== void 0 && (!existsSync11(action.path) || readFileSync14(action.path, "utf8") !== action.expectedContent)) {
+      if (action.expectedContent !== void 0 && (!existsSync11(action.path) || readFileSync15(action.path, "utf8") !== action.expectedContent)) {
         errors.push(`Manifest changed after planning: ${action.path}; re-plan before applying`);
         break;
       }
-      mkdirSync7(dirname13(action.path), { recursive: true });
+      mkdirSync8(dirname13(action.path), { recursive: true });
       let value = action.manifest;
       if (existsSync11(action.path)) {
         try {
-          const currentValue = JSON.parse(readFileSync14(action.path, "utf8"));
+          const currentValue = JSON.parse(readFileSync15(action.path, "utf8"));
           if (isRecord2(currentValue)) {
             const currentNotebook = isRecord2(currentValue.notebook) ? currentValue.notebook : {};
             const desiredNotebook = isRecord2(value.notebook) ? value.notebook : {};
@@ -1814,9 +1814,9 @@ async function executeProjectInitPlan(plan, options = {}) {
       value.project_id = normalizeProjectId(value.project_id ?? action.manifest.project_id);
       const next = `${JSON.stringify(value, null, 2)}
 `;
-      const current = existsSync11(action.path) ? readFileSync14(action.path, "utf8") : void 0;
+      const current = existsSync11(action.path) ? readFileSync15(action.path, "utf8") : void 0;
       if (current !== next) {
-        writeFileSync9(action.path, next, "utf8");
+        writeFileSync10(action.path, next, "utf8");
         changedFiles.push(action.path);
       }
       changedFiles.push(...synchronizeCopierIdentity(action.path, action.manifest));
@@ -1897,7 +1897,7 @@ function getProject(registry, slug) {
   return project;
 }
 function buildCommonProjectCopierAction(input) {
-  const templateDir = join16(input.pjanglerRoot, "templates", "commonproject");
+  const templateDir = join17(input.pjanglerRoot, "templates", "commonproject");
   const data = {
     project_name: input.projectName,
     project_description: input.projectDescription ?? "",
@@ -1928,7 +1928,7 @@ function buildCommonProjectCopierAction(input) {
 function resolvePjanglerRoot() {
   let dir = dirname13(fileURLToPath2(import.meta.url));
   while (dir !== dirname13(dir)) {
-    if (existsSync11(join16(dir, "package.json")) && existsSync11(join16(dir, "templates", "commonproject", "copier.yml"))) return dir;
+    if (existsSync11(join17(dir, "package.json")) && existsSync11(join17(dir, "templates", "commonproject", "copier.yml"))) return dir;
     dir = dirname13(dir);
   }
   return resolve10(process.cwd());
@@ -2005,7 +2005,7 @@ function validateProjectRecord(project, key) {
 }
 function expandHome(path) {
   if (path === "~") return homedir5();
-  if (path.startsWith("~/")) return join16(homedir5(), path.slice(2));
+  if (path.startsWith("~/")) return join17(homedir5(), path.slice(2));
   return path;
 }
 function isRecord2(value) {
@@ -2032,7 +2032,7 @@ var init_project = __esm({
       "obsidian-plugin": ["typescript", "javascript"]
     };
     PROJECT_TYPE_SENTINELS = {
-      "obsidian-plugin": ["manifest.json", join16("src", "main.ts")]
+      "obsidian-plugin": ["manifest.json", join17("src", "main.ts")]
     };
     BOARD_URL_DEPRECATION_WARNING = "boardUrl is deprecated and ignored; board URLs are derived at runtime and are never persisted.";
     PROJECT_IDENTIFIER_SOURCES = ["provider", "proposed"];
@@ -2041,8 +2041,8 @@ var init_project = __esm({
     IDENTIFIER_REPAIR_COMMAND = "pj project identity --all --apply";
     DEFAULT_SOURCE_SKILL_ROOTS = [
       "/home/delorenj/code/skillex/all-skills",
-      join16(homedir5(), ".agents", "skills"),
-      join16(homedir5(), ".codex", "skills")
+      join17(homedir5(), ".agents", "skills"),
+      join17(homedir5(), ".codex", "skills")
     ];
     PROJECT_REGISTRY_OWNED_KEYS = [
       "name",
@@ -2074,7 +2074,7 @@ var init_project = __esm({
 import { randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { isIP as isIP2 } from "node:net";
-import { closeSync as closeSync3, existsSync as existsSync12, fchmodSync as fchmodSync2, fsyncSync as fsyncSync2, lstatSync as lstatSync12, openSync as openSync3, readFileSync as readFileSync15, realpathSync as realpathSync7, renameSync as renameSync6, writeFileSync as writeFileSync10 } from "node:fs";
+import { closeSync as closeSync4, existsSync as existsSync12, fchmodSync as fchmodSync3, fsyncSync as fsyncSync2, lstatSync as lstatSync13, openSync as openSync4, readFileSync as readFileSync16, realpathSync as realpathSync7, renameSync as renameSync6, writeFileSync as writeFileSync11 } from "node:fs";
 import { dirname as dirname14, resolve as resolve11 } from "node:path";
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -2088,7 +2088,7 @@ function readManifest(repoPath) {
   if (!existsSync12(path)) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync15(path, "utf8"));
+    parsed = JSON.parse(readFileSync16(path, "utf8"));
   } catch {
     throw new NotebookError("INVALID_INPUT", `${path} is not valid JSON`);
   }
@@ -2330,7 +2330,7 @@ function persistProjectNotebookBinding(resolved, binding, policy) {
   const changed = [];
   const manifestPath = resolve11(resolved.project.repo_path, ".project.json");
   if (isRegistryServiceLocation(resolved.registry_path)) {
-    const before = existsSync12(manifestPath) ? readFileSync15(manifestPath, "utf8") : null;
+    const before = existsSync12(manifestPath) ? readFileSync16(manifestPath, "utf8") : null;
     const declaredPolicy = resolved.manifest?.notebook?.policy ?? {};
     const nextProject = {
       ...resolved.project,
@@ -2342,10 +2342,10 @@ function persistProjectNotebookBinding(resolved, binding, policy) {
     resolved.registry = loadProjectRegistry(resolved.registry_path);
     resolved.project = registryProjectBySlug(resolved.registry, nextProject.slug);
     resolved.manifest = readManifest(nextProject.repo_path);
-    const after = existsSync12(manifestPath) ? readFileSync15(manifestPath, "utf8") : null;
+    const after = existsSync12(manifestPath) ? readFileSync16(manifestPath, "utf8") : null;
     return before === after ? [] : [manifestPath];
   }
-  const manifestRaw = existsSync12(manifestPath) ? JSON.parse(readFileSync15(manifestPath, "utf8")) : {};
+  const manifestRaw = existsSync12(manifestPath) ? JSON.parse(readFileSync16(manifestPath, "utf8")) : {};
   if (!isRecord3(manifestRaw)) throw new NotebookError("INVALID_INPUT", `${manifestPath} must contain a JSON object`);
   validateManifestNotebookSurface(manifestRaw.notebook);
   const manifestNotebook2 = isRecord3(manifestRaw.notebook) ? manifestRaw.notebook : {};
@@ -2378,29 +2378,29 @@ function persistProjectNotebookBinding(resolved, binding, policy) {
   };
   const manifestText = `${JSON.stringify(manifestNext, null, 2)}
 `;
-  if (!existsSync12(manifestPath) || readFileSync15(manifestPath, "utf8") !== manifestText) {
+  if (!existsSync12(manifestPath) || readFileSync16(manifestPath, "utf8") !== manifestText) {
     let mode = 420;
     if (existsSync12(manifestPath)) {
-      const current2 = lstatSync12(manifestPath);
+      const current2 = lstatSync13(manifestPath);
       if (!current2.isFile() || current2.isSymbolicLink()) throw new NotebookError("CONFLICT", `${manifestPath} must be a regular non-symlink file`);
       mode = current2.mode & 511;
     }
     const temp = resolve11(dirname14(manifestPath), `.${process.pid}.${randomUUID()}.project.json.tmp`);
-    const fd = openSync3(temp, "wx", mode);
+    const fd = openSync4(temp, "wx", mode);
     try {
-      writeFileSync10(fd, manifestText, "utf8");
-      fchmodSync2(fd, mode);
+      writeFileSync11(fd, manifestText, "utf8");
+      fchmodSync3(fd, mode);
       fsyncSync2(fd);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
     renameSync6(temp, manifestPath);
     try {
-      const directory = openSync3(dirname14(manifestPath), "r");
+      const directory = openSync4(dirname14(manifestPath), "r");
       try {
         fsyncSync2(directory);
       } finally {
-        closeSync3(directory);
+        closeSync4(directory);
       }
     } catch {
     }
@@ -2409,9 +2409,9 @@ function persistProjectNotebookBinding(resolved, binding, policy) {
   const current = resolved.project.notebook;
   resolved.project.notebook = { ...isRecord3(current) ? current : { state: "planned" }, ...binding };
   const fileRegistry = !isRegistryServiceLocation(resolved.registry_path);
-  const registryBefore = fileRegistry && existsSync12(resolved.registry_path) ? readFileSync15(resolved.registry_path, "utf8") : null;
+  const registryBefore = fileRegistry && existsSync12(resolved.registry_path) ? readFileSync16(resolved.registry_path, "utf8") : null;
   saveProjectRegistry(resolved.registry, resolved.registry_path);
-  const registryAfter = fileRegistry && existsSync12(resolved.registry_path) ? readFileSync15(resolved.registry_path, "utf8") : null;
+  const registryAfter = fileRegistry && existsSync12(resolved.registry_path) ? readFileSync16(resolved.registry_path, "utf8") : null;
   if (registryBefore !== registryAfter) changed.push(resolved.registry_path);
   resolved.manifest = manifestNext;
   return changed;
@@ -2444,7 +2444,7 @@ var init_config = __esm({
 });
 
 // src/notebook/notes.ts
-import { createHash as createHash9, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash10, randomUUID as randomUUID2 } from "node:crypto";
 function canonicalJson2(value) {
   if (value === void 0 || typeof value === "function" || typeof value === "symbol" || typeof value === "bigint") throw new NotebookError("INVALID_INPUT", "Canonical JSON value is not JSON-compatible");
   if (value === null || typeof value !== "object") {
@@ -2457,7 +2457,7 @@ function canonicalJson2(value) {
   return `{${Object.keys(record3).filter((key) => record3[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson2(record3[key])}`).join(",")}}`;
 }
 function sha256Hex(value) {
-  return createHash9("sha256").update(value).digest("hex");
+  return createHash10("sha256").update(value).digest("hex");
 }
 function base64UrlEncode(value) {
   return Buffer.from(value, "utf8").toString("base64url");
@@ -2714,27 +2714,27 @@ var init_remote_mutation_schema = __esm({
 });
 
 // src/notebook/state.ts
-import { createHash as createHash10, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash11, randomUUID as randomUUID3 } from "node:crypto";
 import {
-  closeSync as closeSync4,
-  constants as constants2,
+  closeSync as closeSync5,
+  constants as constants3,
   existsSync as existsSync13,
-  fchmodSync as fchmodSync3,
-  fstatSync,
+  fchmodSync as fchmodSync4,
+  fstatSync as fstatSync2,
   fsyncSync as fsyncSync3,
-  lstatSync as lstatSync13,
-  mkdirSync as mkdirSync8,
-  openSync as openSync4,
+  lstatSync as lstatSync14,
+  mkdirSync as mkdirSync9,
+  openSync as openSync5,
   readSync,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   renameSync as renameSync7,
-  unlinkSync as unlinkSync7,
-  writeFileSync as writeFileSync11
+  unlinkSync as unlinkSync8,
+  writeFileSync as writeFileSync12
 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { basename as basename8, dirname as dirname15, join as join17, parse, relative as relative12, resolve as resolve12, sep as sep4 } from "node:path";
+import { basename as basename9, dirname as dirname15, join as join18, parse, relative as relative12, resolve as resolve12, sep as sep4 } from "node:path";
 function notebookStateRoot(env2 = process.env) {
-  const base = env2.XDG_STATE_HOME || join17(env2.HOME || homedir6(), ".local", "state");
+  const base = env2.XDG_STATE_HOME || join18(env2.HOME || homedir6(), ".local", "state");
   return resolve12(base, "pjangler", "notebook", NOTEBOOK_STATE_VERSION);
 }
 function assertDigest(value, label) {
@@ -2742,7 +2742,7 @@ function assertDigest(value, label) {
 }
 function projectStateDir(root, projectSlug) {
   if (!/^[a-z0-9][a-z0-9._-]{0,127}$/iu.test(projectSlug)) throw new NotebookError("INVALID_INPUT", "Invalid project slug for Notebook state");
-  return join17(resolve12(root), "projects", sha256Hex(`pjangler-project-state-v1\0${projectSlug}`));
+  return join18(resolve12(root), "projects", sha256Hex(`pjangler-project-state-v1\0${projectSlug}`));
 }
 function assertContained(root, candidate) {
   const rel = relative12(resolve12(root), resolve12(candidate));
@@ -2755,33 +2755,33 @@ function openPinnedDirectory(path, root, create) {
   assertContained(absoluteRoot, absolute);
   if (!existsSync13("/proc/self/fd")) throw new NotebookError("INTERNAL_ERROR", "Descriptor-pinned Notebook state requires procfs");
   const parsed = parse(absolute);
-  let fd = openSync4(parsed.root, DIRECTORY_OPEN_FLAGS);
+  let fd = openSync5(parsed.root, DIRECTORY_OPEN_FLAGS);
   let cursor = parsed.root;
   try {
     for (const part of absolute.slice(parsed.root.length).split(sep4).filter(Boolean)) {
       const child = `/proc/self/fd/${fd}/${part}`;
-      cursor = join17(cursor, part);
+      cursor = join18(cursor, part);
       let childFd;
       try {
-        childFd = openSync4(child, DIRECTORY_OPEN_FLAGS);
+        childFd = openSync5(child, DIRECTORY_OPEN_FLAGS);
       } catch (error) {
         if (!create || error.code !== "ENOENT") throw error;
         try {
-          mkdirSync8(child, { mode: 448 });
+          mkdirSync9(child, { mode: 448 });
         } catch (mkdirError) {
           if (mkdirError.code !== "EEXIST") throw mkdirError;
         }
-        childFd = openSync4(child, DIRECTORY_OPEN_FLAGS);
+        childFd = openSync5(child, DIRECTORY_OPEN_FLAGS);
       }
-      closeSync4(fd);
+      closeSync5(fd);
       fd = childFd;
-      const stat = fstatSync(fd);
+      const stat = fstatSync2(fd);
       if (!stat.isDirectory()) throw new NotebookError("INTERNAL_ERROR", "Notebook state path component is not a directory");
       if (cursor === absoluteRoot || relative12(absoluteRoot, cursor).startsWith("..") === false) assertOwned(stat);
     }
     return fd;
   } catch (error) {
-    closeSync4(fd);
+    closeSync5(fd);
     if (error.code === "ELOOP" || error.code === "ENOTDIR") {
       throw new NotebookError("INTERNAL_ERROR", "Notebook state path contains a symlink component");
     }
@@ -2789,7 +2789,7 @@ function openPinnedDirectory(path, root, create) {
   }
 }
 function pinnedLeaf(parentFd, path) {
-  return `/proc/self/fd/${parentFd}/${basename8(path)}`;
+  return `/proc/self/fd/${parentFd}/${basename9(path)}`;
 }
 function assertOwned(stat) {
   if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
@@ -2802,13 +2802,13 @@ function ensureDirectory(path, root) {
   assertContained(absoluteRoot, absolute);
   const fd = openPinnedDirectory(absolute, absoluteRoot, true);
   try {
-    const stat = fstatSync(fd);
+    const stat = fstatSync2(fd);
     if (!stat.isDirectory()) throw new NotebookError("INTERNAL_ERROR", "Notebook state directory is not a real directory");
     assertOwned(stat);
-    fchmodSync3(fd, 448);
+    fchmodSync4(fd, 448);
     fsyncSync3(fd);
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
 }
 function notebookStatePaths(root, projectSlug) {
@@ -2817,18 +2817,18 @@ function notebookStatePaths(root, projectSlug) {
   return {
     root: absoluteRoot,
     project,
-    baselines: join17(project, "baselines"),
-    claims: join17(project, "claims"),
-    receipts: join17(project, "receipts"),
-    refusals: join17(project, "refusals"),
-    journals: join17(project, "journals"),
-    locks: join17(project, "locks")
+    baselines: join18(project, "baselines"),
+    claims: join18(project, "claims"),
+    receipts: join18(project, "receipts"),
+    refusals: join18(project, "refusals"),
+    journals: join18(project, "journals"),
+    locks: join18(project, "locks")
   };
 }
 function ensureNotebookState(root, projectSlug) {
   const paths = notebookStatePaths(root, projectSlug);
   const { root: absoluteRoot, project } = paths;
-  for (const path of [absoluteRoot, join17(absoluteRoot, "projects"), project, paths.baselines, paths.claims, paths.receipts, paths.refusals, paths.journals, paths.locks]) {
+  for (const path of [absoluteRoot, join18(absoluteRoot, "projects"), project, paths.baselines, paths.claims, paths.receipts, paths.refusals, paths.journals, paths.locks]) {
     ensureDirectory(path, absoluteRoot);
   }
   return paths;
@@ -2844,15 +2844,15 @@ function fsyncDirectory2(path) {
     fsyncSync3(fd);
   } catch {
   } finally {
-    if (fd !== void 0) closeSync4(fd);
+    if (fd !== void 0) closeSync5(fd);
   }
 }
 function readStateDirectory(path, root) {
   const fd = openPinnedDirectory(path, root, false);
   try {
-    return readdirSync9(`/proc/self/fd/${fd}`, { withFileTypes: true });
+    return readdirSync10(`/proc/self/fd/${fd}`, { withFileTypes: true });
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
 }
 function readNotebookStateDirectory(path, root) {
@@ -2866,22 +2866,22 @@ function unlinkStateFile(path, root, allowMissing = false) {
   let fileFd;
   try {
     try {
-      fileFd = openSync4(target, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+      fileFd = openSync5(target, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
     } catch (error) {
       if (allowMissing && error.code === "ENOENT") return false;
       throw error;
     }
-    const stat = fstatSync(fileFd);
+    const stat = fstatSync2(fileFd);
     if (!stat.isFile() || (stat.mode & 511) !== 384) {
       throw new NotebookError("CONFLICT", "Refusing to remove a suspect Notebook state entry; run pj notebook audit --json");
     }
     assertOwned(stat);
-    unlinkSync7(target);
+    unlinkSync8(target);
     fsyncSync3(parentFd);
     return true;
   } finally {
-    if (fileFd !== void 0) closeSync4(fileFd);
-    closeSync4(parentFd);
+    if (fileFd !== void 0) closeSync5(fileFd);
+    closeSync5(parentFd);
   }
 }
 function renameStateFile(source, target, root) {
@@ -2891,12 +2891,12 @@ function renameStateFile(source, target, root) {
   const targetPath = pinnedLeaf(parentFd, target);
   let sourceFd;
   try {
-    sourceFd = openSync4(sourcePath, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
-    const stat = fstatSync(sourceFd);
+    sourceFd = openSync5(sourcePath, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+    const stat = fstatSync2(sourceFd);
     if (!stat.isFile() || (stat.mode & 511) !== 384) throw new NotebookError("CONFLICT", "Notebook state rename source has an integrity finding");
     assertOwned(stat);
     try {
-      lstatSync13(targetPath);
+      lstatSync14(targetPath);
       throw new NotebookError("CONFLICT", "Notebook state rename target already exists");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
@@ -2904,8 +2904,8 @@ function renameStateFile(source, target, root) {
     renameSync7(sourcePath, targetPath);
     fsyncSync3(parentFd);
   } finally {
-    if (sourceFd !== void 0) closeSync4(sourceFd);
-    closeSync4(parentFd);
+    if (sourceFd !== void 0) closeSync5(sourceFd);
+    closeSync5(parentFd);
   }
 }
 function atomicWriteJson(path, value, root, afterParentPinned) {
@@ -2914,34 +2914,34 @@ function atomicWriteJson(path, value, root, afterParentPinned) {
   const text = jsonLine(value);
   const parentFd = openPinnedDirectory(dirname15(path), root, false);
   const target = pinnedLeaf(parentFd, path);
-  const tempName = `.${basename8(path)}.${process.pid}.${randomUUID3()}.tmp`;
+  const tempName = `.${basename9(path)}.${process.pid}.${randomUUID3()}.tmp`;
   const temp = `/proc/self/fd/${parentFd}/${tempName}`;
   let existingIdentity = null;
   try {
     afterParentPinned?.();
     try {
-      const existingFd = openSync4(target, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+      const existingFd = openSync5(target, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
       try {
-        const existing = fstatSync(existingFd);
+        const existing = fstatSync2(existingFd);
         if (!existing.isFile()) throw new NotebookError("INTERNAL_ERROR", "Refusing to replace a non-regular Notebook state file");
         assertOwned(existing);
         if ((existing.mode & 511) !== 384) throw new NotebookError("CONFLICT", "Refusing to replace a Notebook state file with unsafe permissions");
         existingIdentity = { dev: existing.dev, ino: existing.ino };
       } finally {
-        closeSync4(existingFd);
+        closeSync5(existingFd);
       }
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
-    const fd = openSync4(temp, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
+    const fd = openSync5(temp, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | (constants3.O_NOFOLLOW ?? 0), 384);
     try {
-      writeFileSync11(fd, text, "utf8");
+      writeFileSync12(fd, text, "utf8");
       fsyncSync3(fd);
     } finally {
-      closeSync4(fd);
+      closeSync5(fd);
     }
     try {
-      const current = lstatSync13(target);
+      const current = lstatSync14(target);
       if (!existingIdentity || !current.isFile() || current.isSymbolicLink() || current.dev !== existingIdentity.dev || current.ino !== existingIdentity.ino) {
         throw new NotebookError("CONFLICT", "Notebook state target changed during atomic update; preserving both entries for audit");
       }
@@ -2952,12 +2952,12 @@ function atomicWriteJson(path, value, root, afterParentPinned) {
     fsyncSync3(parentFd);
   } catch (error) {
     try {
-      unlinkSync7(temp);
+      unlinkSync8(temp);
     } catch {
     }
     throw error;
   } finally {
-    closeSync4(parentFd);
+    closeSync5(parentFd);
   }
   return Buffer.byteLength(text, "utf8");
 }
@@ -2967,22 +2967,22 @@ function exclusiveWrite(path, text, root) {
   const target = pinnedLeaf(parentFd, path);
   let fd;
   try {
-    fd = openSync4(target, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
+    fd = openSync5(target, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | (constants3.O_NOFOLLOW ?? 0), 384);
   } catch (error) {
-    closeSync4(parentFd);
+    closeSync5(parentFd);
     if (error.code === "EEXIST") return false;
     throw error;
   }
   try {
-    writeFileSync11(fd, text, "utf8");
+    writeFileSync12(fd, text, "utf8");
     fsyncSync3(fd);
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
   try {
     fsyncSync3(parentFd);
   } finally {
-    closeSync4(parentFd);
+    closeSync5(parentFd);
   }
   return true;
 }
@@ -3126,13 +3126,13 @@ function safeReadJson(path, maxBytes) {
   }
   let fd;
   try {
-    fd = openSync4(pinnedLeaf(parentFd, path), constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+    fd = openSync5(pinnedLeaf(parentFd, path), constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
   } catch (error) {
-    closeSync4(parentFd);
+    closeSync5(parentFd);
     return { reason: error.code === "ELOOP" ? "non-regular" : "unreadable", bytes: 0 };
   }
   try {
-    const stat = fstatSync(fd);
+    const stat = fstatSync2(fd);
     if (!stat.isFile()) return { reason: "non-regular", bytes: 0 };
     if ((stat.mode & 511) !== 384) return { reason: "unsafe-permissions", bytes: stat.size };
     try {
@@ -3152,14 +3152,14 @@ function safeReadJson(path, maxBytes) {
       if (total > maxBytes) return { reason: "oversize", bytes: total };
       chunks.push(chunk.subarray(0, count));
     }
-    const after = fstatSync(fd);
+    const after = fstatSync2(fd);
     if (after.size !== stat.size || total !== stat.size) return { reason: "unreadable", bytes: total };
     return { value: JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks, total))), bytes: total };
   } catch (error) {
     return { reason: error instanceof SyntaxError || error instanceof TypeError ? "invalid-json" : "unreadable", bytes: 0 };
   } finally {
-    closeSync4(fd);
-    closeSync4(parentFd);
+    closeSync5(fd);
+    closeSync5(parentFd);
   }
 }
 function safeEntryId(kind, name) {
@@ -3176,10 +3176,10 @@ function baselineReceiptByteCeiling(limits) {
 function readSessionBaseline(root, projectSlug, sessionKey, limits) {
   assertDigest(sessionKey, "session key");
   const paths = ensureNotebookState(root, projectSlug);
-  return readBaseline(join17(paths.baselines, `${sessionKey}.json`), baselineReceiptByteCeiling(limits));
+  return readBaseline(join18(paths.baselines, `${sessionKey}.json`), baselineReceiptByteCeiling(limits));
 }
 function acquireLock(paths, maxWaitMs) {
-  const lock = join17(paths.locks, "admission.lock");
+  const lock = join18(paths.locks, "admission.lock");
   const deadline = Date.now() + Math.max(1, maxWaitMs);
   const token = randomUUID3();
   const record3 = () => ({
@@ -3209,7 +3209,7 @@ function acquireLock(paths, maxWaitMs) {
       throw new NotebookError("CONFLICT", "Notebook state lock has an integrity finding; preserve it and run pj notebook audit --json");
     }
     if (Date.now() >= expiresAt) {
-      const recovery = join17(paths.locks, `recovery-${heldToken}.lock`);
+      const recovery = join18(paths.locks, `recovery-${heldToken}.lock`);
       const recoveryRecord = jsonLine({ schema_version: NOTEBOOK_SCHEMA_VERSION, stale_token: heldToken, recovery_token: token, expires_at: new Date(Date.now() + 5e3).toISOString() });
       if (exclusiveWrite(recovery, recoveryRecord, paths.root)) {
         try {
@@ -3217,7 +3217,7 @@ function acquireLock(paths, maxWaitMs) {
           const currentToken = verify.value && typeof verify.value === "object" && !Array.isArray(verify.value) ? verify.value.token : null;
           const currentExpiry = verify.value && typeof verify.value === "object" && !Array.isArray(verify.value) ? Date.parse(String(verify.value.expires_at ?? "")) : Number.NaN;
           if (currentToken === heldToken && Number.isFinite(currentExpiry) && Date.now() >= currentExpiry) {
-            const recovered = join17(paths.locks, `.recovered-${heldToken}-${randomUUID3()}.json`);
+            const recovered = join18(paths.locks, `.recovered-${heldToken}-${randomUUID3()}.json`);
             renameStateFile(lock, recovered, paths.root);
             unlinkStateFile(recovered, paths.root);
           }
@@ -3297,7 +3297,7 @@ function scanAuxiliaryState(paths, limits) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: "non-regular" });
         continue;
       }
-      const read = safeReadJson(join17(specification.dir, entry.name), specification.maxBytes);
+      const read = safeReadJson(join18(specification.dir, entry.name), specification.maxBytes);
       if (read.reason || read.value === void 0) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: read.reason ?? "invalid-json" }, read.bytes);
         continue;
@@ -3322,7 +3322,7 @@ function scanAuxiliaryState(paths, limits) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: "non-regular" });
         continue;
       }
-      const read = safeReadJson(join17(paths.journals, entry.name), limits.receipt_max_bytes);
+      const read = safeReadJson(join18(paths.journals, entry.name), limits.receipt_max_bytes);
       if (read.reason || read.value === void 0) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: read.reason ?? "invalid-json" }, read.bytes);
         continue;
@@ -3351,7 +3351,7 @@ function scanAuxiliaryState(paths, limits) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: "non-regular" });
         continue;
       }
-      const read = safeReadJson(join17(paths.locks, entry.name), 8192);
+      const read = safeReadJson(join18(paths.locks, entry.name), 8192);
       if (read.reason || read.value === void 0) {
         addBoundedIntegrity(scan, limits, { entry_id: entryId, reason: read.reason ?? "invalid-json" }, read.bytes);
         continue;
@@ -3390,7 +3390,7 @@ function scanReceipts(paths, limits) {
   }
   for (const entry of entries) {
     const entryId = safeEntryId("receipts", entry.name);
-    const path = join17(paths.receipts, entry.name);
+    const path = join18(paths.receipts, entry.name);
     if (!entry.isFile() || entry.isSymbolicLink() || !/^[a-f0-9]{64}\.json$/u.test(entry.name)) {
       addIntegrity({ entry_id: entryId, reason: "non-regular" });
       continue;
@@ -3420,7 +3420,7 @@ function scanBaselines(paths, nowMs, limits, referenced) {
   if (!existsSync13(paths.baselines)) return { current, stale };
   for (const entry of readStateDirectory(paths.baselines, paths.root)) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const baseline = readBaseline(join17(paths.baselines, entry.name), baselineReceiptByteCeiling(limits));
+    const baseline = readBaseline(join18(paths.baselines, entry.name), baselineReceiptByteCeiling(limits));
     if (!baseline || referenced.has(baseline.session_key)) continue;
     const expires = Date.parse(baseline.created_at) + limits.receiptless_session_retention_seconds * 1e3;
     if (nowMs >= expires) stale += 1;
@@ -3434,7 +3434,7 @@ function scanRefusals(paths, nowMs, limits, scan) {
   const entries = readStateDirectory(paths.refusals, paths.root).sort((a, b) => a.name.localeCompare(b.name, "en")).slice(0, limits.refusal_max_entries);
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const read = safeReadJson(join17(paths.refusals, entry.name), limits.receipt_max_bytes);
+    const read = safeReadJson(join18(paths.refusals, entry.name), limits.receipt_max_bytes);
     const marker = read.value === void 0 ? null : parseRefusal(read.value);
     if (!marker || `${marker.session_key}.json` !== entry.name) continue;
     if (nowMs >= Date.parse(marker.baseline_created_at) + limits.receiptless_session_retention_seconds * 1e3) continue;
@@ -3517,7 +3517,7 @@ function listCaptureReceipts(root, projectSlug, limits, state) {
 function readCaptureReceipt(root, projectSlug, receiptId, limits) {
   if (!RECEIPT_ID_RE.test(receiptId)) throw new NotebookError("INVALID_INPUT", "Invalid receipt ID");
   const paths = notebookStatePaths(root, projectSlug);
-  const path = join17(paths.receipts, `${receiptId}.json`);
+  const path = join18(paths.receipts, `${receiptId}.json`);
   if (!existsSync13(path)) throw new NotebookError("NOT_FOUND", `Capture receipt not found: ${receiptId}`);
   const read = safeReadJson(path, limits.receipt_max_bytes);
   const receipt = read.value === void 0 ? null : parseReceipt(read.value);
@@ -3530,7 +3530,7 @@ function writeReceipt(paths, receipt, limit) {
     const bytes = Buffer.byteLength(text, "utf8");
     if (bytes > limit) throw new NotebookError("CONFLICT", "Receipt transition exceeds its per-receipt ceiling");
     if (receipt.serialized_bytes === bytes) {
-      atomicWriteJson(join17(paths.receipts, `${receipt.receipt_id}.json`), receipt, paths.root);
+      atomicWriteJson(join18(paths.receipts, `${receipt.receipt_id}.json`), receipt, paths.root);
       return receipt;
     }
     receipt.serialized_bytes = bytes;
@@ -3669,25 +3669,25 @@ function pruneNotebookState(root, projectSlug, limits, now = /* @__PURE__ */ new
     const successCutoff = now.getTime() - limits.receipt_succeeded_retention_days * 864e5;
     for (const receipt of scan.receipts) {
       if (receipt.state !== "succeeded" || Date.parse(receipt.updated_at) > successCutoff) continue;
-      const path = join17(paths.receipts, `${receipt.receipt_id}.json`);
+      const path = join18(paths.receipts, `${receipt.receipt_id}.json`);
       unlinkStateFile(path, paths.root);
-      removed.push(safeEntryId("receipts", basename8(path)));
+      removed.push(safeEntryId("receipts", basename9(path)));
     }
     const remaining = scanReceipts(paths, limits);
     const remainingAuxiliary = scanAuxiliaryState(paths, limits);
     const referenced = /* @__PURE__ */ new Set([...remaining.referencedSessions, ...remainingAuxiliary.referencedSessions]);
     for (const entry of readStateDirectory(paths.baselines, paths.root)) {
       if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-      const path = join17(paths.baselines, entry.name);
+      const path = join18(paths.baselines, entry.name);
       const baseline = readBaseline(path, baselineReceiptByteCeiling(limits));
       if (!baseline || referenced.has(baseline.session_key)) continue;
       if (now.getTime() < Date.parse(baseline.created_at) + limits.receiptless_session_retention_seconds * 1e3) continue;
       unlinkStateFile(path, paths.root);
       removed.push(safeEntryId("baselines", entry.name));
-      const claim = join17(paths.claims, `${baseline.session_key}.overview`);
-      if (unlinkStateFile(claim, paths.root, true)) removed.push(safeEntryId("claims", basename8(claim)));
-      const refusal = join17(paths.refusals, `${baseline.session_key}.json`);
-      if (unlinkStateFile(refusal, paths.root, true)) removed.push(safeEntryId("refusals", basename8(refusal)));
+      const claim = join18(paths.claims, `${baseline.session_key}.overview`);
+      if (unlinkStateFile(claim, paths.root, true)) removed.push(safeEntryId("claims", basename9(claim)));
+      const refusal = join18(paths.refusals, `${baseline.session_key}.json`);
+      if (unlinkStateFile(refusal, paths.root, true)) removed.push(safeEntryId("refusals", basename9(refusal)));
     }
     fsyncDirectory2(paths.project);
     return removed;
@@ -3733,7 +3733,7 @@ var init_state = __esm({
       "REMOTE_PROTOCOL_ERROR",
       "INTERNAL_ERROR"
     ]);
-    DIRECTORY_OPEN_FLAGS = constants2.O_RDONLY | (constants2.O_DIRECTORY ?? 0) | (constants2.O_NOFOLLOW ?? 0);
+    DIRECTORY_OPEN_FLAGS = constants3.O_RDONLY | (constants3.O_DIRECTORY ?? 0) | (constants3.O_NOFOLLOW ?? 0);
   }
 });
 
@@ -4072,8 +4072,8 @@ var init_open_notebook_client = __esm({
 
 // src/notebook/git-evidence.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { closeSync as closeSync5, constants as constants3, fstatSync as fstatSync2, lstatSync as lstatSync14, openSync as openSync5, readSync as readSync2, realpathSync as realpathSync8 } from "node:fs";
-import { extname, join as join19, relative as relative13, resolve as resolve13, sep as sep5 } from "node:path";
+import { closeSync as closeSync6, constants as constants4, fstatSync as fstatSync3, lstatSync as lstatSync15, openSync as openSync6, readSync as readSync2, realpathSync as realpathSync8 } from "node:fs";
+import { extname, join as join20, relative as relative13, resolve as resolve13, sep as sep5 } from "node:path";
 function git(repo, args, maxBuffer = 4 * 1024 * 1024, timeout = 5e3) {
   const result2 = spawnSync8("git", args, { cwd: repo, encoding: "utf8", maxBuffer, timeout, shell: false });
   return { ok: result2.status === 0, stdout: result2.stdout ?? "" };
@@ -4151,9 +4151,9 @@ function hasSymlinkComponent(root, candidate) {
   const rel = relative13(root, candidate);
   let cursor = root;
   for (const part of rel.split(sep5).filter(Boolean)) {
-    cursor = join19(cursor, part);
+    cursor = join20(cursor, part);
     try {
-      if (lstatSync14(cursor).isSymbolicLink()) return true;
+      if (lstatSync15(cursor).isSymbolicLink()) return true;
     } catch {
       return true;
     }
@@ -4165,12 +4165,12 @@ function readSafeEvidenceText(repoPath, relativePath2, maxBytes) {
   if (!safe || hasSymlinkComponent(safe.root, safe.candidate)) return { status: "excluded", reason: "unsafe-path" };
   let fd;
   try {
-    fd = openSync5(safe.candidate, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+    fd = openSync6(safe.candidate, constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0));
   } catch {
     return { status: "excluded", reason: "not-regular" };
   }
   try {
-    const before = fstatSync2(fd);
+    const before = fstatSync3(fd);
     if (!before.isFile()) return { status: "excluded", reason: "not-regular" };
     if (before.size > maxBytes) return { status: "excluded", reason: "oversize" };
     let physical;
@@ -4191,7 +4191,7 @@ function readSafeEvidenceText(repoPath, relativePath2, maxBytes) {
       if (total > maxBytes) return { status: "excluded", reason: "oversize" };
       chunks.push(chunk.subarray(0, count));
     }
-    const after = fstatSync2(fd);
+    const after = fstatSync3(fd);
     if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || total !== before.size) return { status: "excluded", reason: "changed-during-read" };
     const bytes = Buffer.concat(chunks, total);
     if (bytes.includes(0)) return { status: "excluded", reason: "binary" };
@@ -4204,7 +4204,7 @@ function readSafeEvidenceText(repoPath, relativePath2, maxBytes) {
     if (looksSecret(relativePath2, content)) return { status: "excluded", reason: "secret-like" };
     return { status: "present", content, content_sha256: sha256Hex(bytes), bytes: total };
   } finally {
-    closeSync5(fd);
+    closeSync6(fd);
   }
 }
 function looksGenerated(path) {
@@ -4294,10 +4294,10 @@ var init_git_evidence = __esm({
 
 // src/notebook/remote-mutation-journal.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function journalPath(root, projectSlug, operationId) {
   if (!/^[a-f0-9-]{16,64}$/iu.test(operationId)) throw new NotebookError("INVALID_INPUT", "Invalid remote mutation operation ID");
-  return join20(ensureNotebookState(root, projectSlug).journals, `${operationId}.json`);
+  return join21(ensureNotebookState(root, projectSlug).journals, `${operationId}.json`);
 }
 function remoteMutationJournalPath(root, projectSlug, operationId) {
   return journalPath(root, projectSlug, operationId);
@@ -4317,7 +4317,7 @@ function listRemoteMutationJournals(root, projectSlug) {
     if (!entry.isFile() || entry.isSymbolicLink() || !/^[a-f0-9-]{16,64}\.json$/iu.test(entry.name)) {
       throw new NotebookError("CONFLICT", `Remote mutation journal state-integrity finding: journals/${entry.name}`);
     }
-    const read = readNotebookStateJson(join20(paths.journals, entry.name), paths.root, 65536);
+    const read = readNotebookStateJson(join21(paths.journals, entry.name), paths.root, 65536);
     const journal = read.value === void 0 ? null : parseRemoteMutationJournal(read.value);
     if (!journal || `${journal.operation_id}.json` !== entry.name) {
       throw new NotebookError("CONFLICT", `Remote mutation journal state-integrity finding: journals/${entry.name}`);
@@ -4671,7 +4671,7 @@ var init_reconcile = __esm({
 
 // src/notebook/entropy.ts
 import { existsSync as existsSync16 } from "node:fs";
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { resolve as resolve16 } from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 function listAllTrackedDocuments(config) {
@@ -4726,7 +4726,7 @@ async function compactSessionCaptures(input) {
   const toCompact = sessionHeaders.slice(maxRecent);
   const notesToCompact = typeof input.client.hydrateNotes === "function" ? await input.client.hydrateNotes(toCompact) : toCompact;
   const archiveTitle = "Session Captures Archive (Prior Sessions)";
-  const slugHash = createHash13("sha256").update(`session-capture-archive:${input.projectSlug}`).digest("hex").slice(0, 32);
+  const slugHash = createHash14("sha256").update(`session-capture-archive:${input.projectSlug}`).digest("hex").slice(0, 32);
   const archiveLogicalId = `user-note:v1:${slugHash}`;
   let existingArchiveContent = "";
   let existingArchiveId = null;
@@ -5294,7 +5294,7 @@ var init_capture = __esm({
 
 // src/mcp-server.ts
 import { existsSync as existsSync22, statSync as statSync8 } from "node:fs";
-import { dirname as dirname20, join as join31, resolve as resolve22 } from "node:path";
+import { dirname as dirname20, join as join32, resolve as resolve22 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -7274,20 +7274,20 @@ function planSkillRoots(repoRoot, options = {}) {
     for (const name of readdirSync6(real).sort()) {
       const path = join7(real, name);
       const label = `${alias}/${name}`;
-      const entryStat = lstatSync6(path);
+      const entryStat2 = lstatSync6(path);
       const rows = tracked.get(name) ?? [];
-      const candidate = { alias, name, path, label, kind: entryStat.isSymbolicLink() ? "link" : entryStat.isDirectory() ? "directory" : "file", tracked: rows.map((row) => row.path) };
+      const candidate = { alias, name, path, label, kind: entryStat2.isSymbolicLink() ? "link" : entryStat2.isDirectory() ? "directory" : "file", tracked: rows.map((row) => row.path) };
       if (name === ".git") {
         candidate.staticBlock = `${label} is git metadata; refusing to relocate another repository's work tree`;
-      } else if (entryStat.isSymbolicLink()) {
+      } else if (entryStat2.isSymbolicLink()) {
         candidate.text = readlinkSync5(path);
         candidate.resolution = resolveIn(diskLayout, path);
         if (rows.length) candidate.staticBlock = `${label} -> ${candidate.text} is tracked in git; a tracked link cannot be attested BMAD installer output, so it is never untracked, moved or dropped`;
-      } else if (!entryStat.isDirectory() && !entryStat.isFile()) {
+      } else if (!entryStat2.isDirectory() && !entryStat2.isFile()) {
         candidate.staticBlock = `${label} is a special file; refusing to relocate it`;
       } else {
         candidate.staticBlock = entryHazard(path, label);
-        if (!candidate.staticBlock && rootDevice !== void 0 && entryStat.dev !== rootDevice) candidate.staticBlock = `${label} is on a different filesystem than .agents/skills; refusing a copying move`;
+        if (!candidate.staticBlock && rootDevice !== void 0 && entryStat2.dev !== rootDevice) candidate.staticBlock = `${label} is on a different filesystem than .agents/skills; refusing a copying move`;
         const linkRow = rows.find((row) => row.mode === "120000");
         const gitlink = rows.find((row) => row.mode === "160000");
         if (!candidate.staticBlock && gitlink) candidate.staticBlock = `${label} holds a tracked submodule (${gitlink.path}); refusing to relocate it`;
@@ -9194,14 +9194,324 @@ function createG33CompanionCheck() {
 }
 
 // src/parity/rules.ts
-import { existsSync as existsSync8, lstatSync as lstatSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync10, readlinkSync as readlinkSync8, readdirSync as readdirSync7, realpathSync as realpathSync4, renameSync as renameSync4, symlinkSync as symlinkSync3, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8, chmodSync as chmodSync3, copyFileSync, rmSync as rmSync5 } from "node:fs";
-import { basename as basename4, dirname as dirname8, join as join11, relative as relative9, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync8, lstatSync as lstatSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync11, readlinkSync as readlinkSync8, readdirSync as readdirSync8, realpathSync as realpathSync4, renameSync as renameSync4, symlinkSync as symlinkSync3, unlinkSync as unlinkSync6, writeFileSync as writeFileSync9, chmodSync as chmodSync3, copyFileSync, rmSync as rmSync5 } from "node:fs";
+
+// src/bmad/setup-scripts.ts
+import { createHash as createHash8 } from "node:crypto";
+import { closeSync as closeSync2, fchmodSync, fstatSync, linkSync, lstatSync as lstatSync9, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync9, readdirSync as readdirSync7, rmdirSync as rmdirSync3, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7, constants } from "node:fs";
+import { basename as basename4, join as join10 } from "node:path";
+function entryStat(path) {
+  try {
+    return lstatSync9(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+var RUNTIME_SCRIPTS = ["config_utils.py", "memlog.py", "render_skill.py", "resolve_config.py", "resolve_customization.py"];
+function manifestRows(text) {
+  const rows = [];
+  let row = [], field2 = "", quoted = false, closed = false, inQuotes = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inQuotes) {
+      if (c === '"' && text[i + 1] === '"') {
+        field2 += '"';
+        i++;
+      } else if (c === '"') {
+        inQuotes = false;
+        closed = true;
+      } else field2 += c;
+    } else if (c === '"' && !field2 && !closed) {
+      inQuotes = true;
+      quoted = true;
+    } else if (c === ",") {
+      row.push(field2);
+      field2 = "";
+      quoted = closed = false;
+    } else if (c === "\n" || c === "\r") {
+      if (c === "\r" && text[i + 1] === "\n") i++;
+      row.push(field2);
+      if (row.length !== 1 || row[0]) rows.push(row);
+      row = [];
+      field2 = "";
+      quoted = closed = false;
+    } else if (closed || c === '"' || quoted && c === "\r") throw new Error("Malformed BMAD file manifest CSV");
+    else field2 += c;
+  }
+  if (inQuotes) throw new Error("Unterminated BMAD file manifest CSV field");
+  if (row.length || field2 || closed) {
+    row.push(field2);
+    rows.push(row);
+  }
+  if (rows.some((r) => r.length !== 5) || rows[0]?.join("\0") !== "type\0name\0module\0path\0hash") {
+    throw new Error("Invalid BMAD file manifest columns");
+  }
+  return rows.slice(1);
+}
+function sameIdentity(a, b) {
+  return !!a && a.dev === b.dev && a.ino === b.ino && a.isDirectory() && !a.isSymbolicLink();
+}
+var DeclinableError = class extends Error {
+  constructor(message, kind) {
+    super(message);
+    this.kind = kind;
+  }
+};
+var FIELD_SEP = String.fromCharCode(0);
+var MANIFEST_UNUSABLE = "Installed BMAD file manifest is missing or not a real file; cannot attest recovered scripts";
+function inspectBmadSetupScripts(repoRoot, version, installedVersion) {
+  const bmadDir = join10(repoRoot, "_bmad");
+  const dest = join10(bmadDir, "scripts");
+  try {
+    const bmad = entryStat(bmadDir);
+    if (!bmad) return { state: "decline", why: "_bmad is absent", missing: [...RUNTIME_SCRIPTS] };
+    if (!bmad.isDirectory() || bmad.isSymbolicLink()) return { state: "unsafe", error: "_bmad is not a real directory" };
+    const destStat = entryStat(dest);
+    if (destStat && (!destStat.isDirectory() || destStat.isSymbolicLink())) return { state: "unsafe", error: "_bmad/scripts is not a real directory" };
+    const missing = [];
+    for (const name of RUNTIME_SCRIPTS) {
+      const existing = destStat ? entryStat(join10(dest, name)) : void 0;
+      if (!existing) missing.push(name);
+      else if (!existing.isFile() || existing.isSymbolicLink()) return { state: "unsafe", error: `Existing _bmad/scripts/${name} is not a regular file; refusing overwrite` };
+    }
+    if (!missing.length) return { state: "present" };
+    const configDir = entryStat(join10(bmadDir, "_config"));
+    if (configDir && (!configDir.isDirectory() || configDir.isSymbolicLink())) return { state: "unsafe", error: MANIFEST_UNUSABLE };
+    const manifestPath = join10(bmadDir, "_config", "files-manifest.csv");
+    const manifestFile = configDir ? entryStat(manifestPath) : void 0;
+    if (!manifestFile) return { state: "decline", why: "_bmad/_config/files-manifest.csv is absent, so recovered scripts cannot be attested", missing };
+    if (!manifestFile.isFile() || manifestFile.isSymbolicLink()) return { state: "unsafe", error: MANIFEST_UNUSABLE };
+    const installed = installedVersion?.();
+    if (installed && installed !== version) {
+      return { state: "decline", why: `this install is bmad-method ${installed}, not the pinned ${version} that recovery restores from`, missing };
+    }
+    const rows = manifestRows(readFileSync9(manifestPath, "utf8"));
+    const unattested = missing.filter((name) => !rows.some((row) => row[3] === `scripts/${name}`));
+    if (unattested.length) {
+      return { state: "decline", why: `_bmad/_config/files-manifest.csv has no row for ${unattested.map((name) => `scripts/${name}`).join(", ")}, so recovered scripts cannot be attested`, missing };
+    }
+    return { state: "missing", missing };
+  } catch (error) {
+    return { state: "unsafe", error: error instanceof Error ? error.message : String(error) };
+  }
+}
+function planBmadSetupScripts(repoRoot, pkg, version) {
+  const dest = join10(repoRoot, "_bmad", "scripts");
+  if (!pkg.root || !pkg.entry || pkg.version !== version) return { files: [], declinable: "package", error: `Pinned bmad-method@${version} package could not be resolved: ${pkg.reason ?? "version mismatch"}` };
+  let fingerprint2;
+  try {
+    fingerprint2 = installerFingerprint(pkg.root);
+  } catch (error) {
+    return { files: [], declinable: "package", error: `Could not fingerprint pinned BMAD installer: ${String(error)}` };
+  }
+  if (VERIFIED_BMAD_INSTALLERS[fingerprint2] !== version) return { files: [], declinable: "package", error: `Unverified BMAD installer fingerprint ${fingerprint2}; refusing script recovery` };
+  const source = join10(pkg.root, "src", "scripts");
+  try {
+    const bmad = lstatSync9(join10(repoRoot, "_bmad"));
+    if (!bmad.isDirectory() || bmad.isSymbolicLink()) throw new Error("_bmad is not a real directory");
+    const destStat = entryStat(dest);
+    if (destStat && (!destStat.isDirectory() || destStat.isSymbolicLink())) throw new Error("_bmad/scripts is not a real directory");
+    const names = readdirSync7(source).filter((name) => !name.startsWith(".") && !name.endsWith(".pyc") && name !== "tests" && name !== "__pycache__" && name !== ".pytest_cache").sort();
+    if (names.join(FIELD_SEP) !== [...RUNTIME_SCRIPTS].sort().join(FIELD_SEP)) throw new DeclinableError("Pinned installer script inventory changed; refusing recovery", "package");
+    const missing = [];
+    for (const name of names) {
+      const existing = entryStat(join10(dest, name));
+      if (!existing) missing.push(name);
+      else if (!existing.isFile() || existing.isSymbolicLink()) throw new Error(`Existing _bmad/scripts/${name} is not a regular file; refusing overwrite`);
+    }
+    const files = [];
+    if (!missing.length) return { files, source };
+    const manifestPath = join10(repoRoot, "_bmad", "_config", "files-manifest.csv");
+    const manifestDir = entryStat(join10(repoRoot, "_bmad", "_config"));
+    const manifestFile = entryStat(manifestPath);
+    if (!manifestDir?.isDirectory() || manifestDir.isSymbolicLink() || !manifestFile?.isFile() || manifestFile.isSymbolicLink()) {
+      throw new Error(MANIFEST_UNUSABLE);
+    }
+    const rows = manifestRows(readFileSync9(manifestPath, "utf8"));
+    for (const name of missing) {
+      const src = join10(source, name);
+      if (!lstatSync9(src).isFile() || lstatSync9(src).isSymbolicLink()) throw new DeclinableError(`Installer script is not a regular file: ${name}`, "package");
+      const matching = rows.filter((row) => row[3] === `scripts/${name}`);
+      const expectedHash = createHash8("sha256").update(readFileSync9(src)).digest("hex");
+      if (matching.length !== 1 || matching[0].join(FIELD_SEP) !== ["py", name.slice(0, -3), "scripts", `scripts/${name}`, expectedHash].join(FIELD_SEP)) {
+        throw new DeclinableError(`Installed file manifest does not attest pinned script ${name}`, "attest");
+      }
+      files.push(join10(dest, name));
+    }
+    return { files, source };
+  } catch (error) {
+    return { files: [], ...error instanceof DeclinableError ? { declinable: error.kind } : {}, error: `BMAD script recovery refused: ${error instanceof Error ? error.message : String(error)}` };
+  }
+}
+function applyBmadSetupScripts(repoRoot, pkg, version, afterPublish) {
+  const plan = planBmadSetupScripts(repoRoot, pkg, version);
+  if (plan.error || !plan.files.length) return { files: [], ...plan.error ? { error: plan.error } : {} };
+  const parent = join10(repoRoot, "_bmad");
+  const dest = join10(parent, "scripts");
+  const expectedParent = entryStat(parent);
+  const expectedDir = entryStat(dest);
+  let stage;
+  let stageFd;
+  let parentFd;
+  const created = [];
+  const stagedIdentities = /* @__PURE__ */ new Map();
+  const published = /* @__PURE__ */ new Map();
+  let ambiguousPublication;
+  const matchesPayload = (path, owned) => {
+    const stat = entryStat(path);
+    return !!stat?.isFile() && !stat.isSymbolicLink() && stat.dev === owned.dev && stat.ino === owned.ino && (stat.mode & 4095) === owned.mode && readFileSync9(path).equals(owned.bytes);
+  };
+  let madeDir = false;
+  let dirFd;
+  let result2 = { files: [] };
+  try {
+    parentFd = openSync2(parent, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    const pinnedParent = fstatSync(parentFd);
+    if (!sameIdentity(expectedParent, pinnedParent) || !sameIdentity(entryStat(parent), pinnedParent)) throw new Error("BMAD parent directory changed before staging");
+    const anchoredParent = `/proc/self/fd/${parentFd}`;
+    stage = mkdtempSync2(join10(anchoredParent, ".scripts-stage-"));
+    stageFd = openSync2(stage, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    const pinnedStage = fstatSync(stageFd);
+    const stageName = basename4(stage);
+    const anchoredStage = `/proc/self/fd/${stageFd}`;
+    if (!sameIdentity(entryStat(join10(anchoredParent, stageName)), pinnedStage)) throw new Error("Staging directory changed during creation");
+    for (const path of plan.files) {
+      const name = basename4(path);
+      const src = join10(plan.source, name);
+      const staged = join10(anchoredStage, name);
+      const fileFd = openSync2(staged, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+      try {
+        const stat = fstatSync(fileFd);
+        const bytes = readFileSync9(src);
+        const mode = lstatSync9(src).mode & 4095;
+        stagedIdentities.set(name, { dev: stat.dev, ino: stat.ino, bytes, mode });
+        writeFileSync7(fileFd, bytes);
+        fchmodSync(fileFd, mode);
+      } finally {
+        closeSync2(fileFd);
+      }
+    }
+    if (!sameIdentity(entryStat(parent), pinnedParent)) throw new Error("BMAD parent directory changed while staging");
+    const current = planBmadSetupScripts(repoRoot, pkg, version);
+    if (current.error || current.files.join("\0") !== plan.files.join("\0")) throw new Error(current.error ?? "Script destination changed while staging");
+    const anchoredDest = join10(anchoredParent, "scripts");
+    if (!entryStat(anchoredDest)) {
+      mkdirSync6(anchoredDest);
+      madeDir = true;
+    }
+    dirFd = openSync2(anchoredDest, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    const pinned = fstatSync(dirFd);
+    if (expectedDir && !sameIdentity(expectedDir, pinned)) throw new Error("Script directory changed while staging");
+    if (!sameIdentity(entryStat(parent), pinnedParent) || !sameIdentity(entryStat(dest), pinned)) throw new Error("Script or parent directory changed during publication");
+    const anchored = `/proc/self/fd/${dirFd}`;
+    for (const path of plan.files) {
+      const name = basename4(path);
+      const staged = join10(anchoredStage, name);
+      const output = join10(anchored, name);
+      const owned = stagedIdentities.get(name);
+      if (!sameIdentity(entryStat(parent), pinnedParent) || !sameIdentity(entryStat(dest), pinned)) throw new Error("Script or parent directory changed during publication");
+      if (!matchesPayload(staged, owned)) throw new Error(`Staged script changed before publication: ${name}`);
+      if (entryStat(output)) {
+        ambiguousPublication = path;
+        throw new Error(`Script destination appeared before publication: ${name}`);
+      }
+      try {
+        linkSync(staged, output);
+      } catch (error) {
+        if (entryStat(output)) ambiguousPublication = path;
+        throw error;
+      }
+      published.set(path, owned);
+      created.push(path);
+      if (!matchesPayload(output, owned)) throw new Error(`Published script changed during publication: ${name}`);
+      afterPublish?.(created.length);
+    }
+    if (!sameIdentity(entryStat(parent), pinnedParent) || !sameIdentity(entryStat(dest), pinned)) throw new Error("Script or parent directory changed during publication");
+    for (const path of created) {
+      if (!matchesPayload(join10(anchored, basename4(path)), stagedIdentities.get(basename4(path)))) throw new Error(`Published script changed before completion: ${basename4(path)}`);
+    }
+    result2 = { files: created };
+  } catch (error) {
+    const recoveryErrors = [];
+    for (const [path, owned] of [...published].reverse()) {
+      try {
+        const anchoredPath = join10(`/proc/self/fd/${dirFd}`, basename4(path));
+        const stat = entryStat(anchoredPath);
+        if (matchesPayload(anchoredPath, owned)) unlinkSync5(anchoredPath);
+        else if (stat) recoveryErrors.push(`Concurrent replacement or mutation retained: ${path}`);
+        else recoveryErrors.push(`Published file absent from pinned directory; ownership unresolved: ${path}`);
+      } catch (recoveryError) {
+        recoveryErrors.push(`Could not restore ${path}: ${String(recoveryError)}`);
+      }
+    }
+    if (ambiguousPublication) recoveryErrors.push(`Publication not confirmed; destination retained or ownership unresolved: ${ambiguousPublication}`);
+    if (madeDir && dirFd !== void 0 && parentFd !== void 0) {
+      try {
+        const pinned = fstatSync(dirFd);
+        const anchoredDest = join10(`/proc/self/fd/${parentFd}`, "scripts");
+        if (sameIdentity(entryStat(anchoredDest), pinned) && readdirSync7(anchoredDest).length === 0) rmdirSync3(anchoredDest);
+        else recoveryErrors.push(`Created script directory moved or retained: ${dest}`);
+      } catch (recoveryError) {
+        recoveryErrors.push(`Could not remove empty script directory: ${String(recoveryError)}`);
+      }
+    }
+    result2 = { files: [], error: `BMAD script recovery failed: ${error instanceof Error ? error.message : String(error)}${recoveryErrors.length ? `; recovery incomplete: ${recoveryErrors.join("; ")}` : ""}` };
+  } finally {
+    const cleanupErrors = [];
+    if (stageFd !== void 0) {
+      try {
+        const pinnedStage = fstatSync(stageFd);
+        const anchoredStage = `/proc/self/fd/${stageFd}`;
+        for (const [name, owned] of stagedIdentities) {
+          const staged = join10(anchoredStage, name);
+          const stat = entryStat(staged);
+          if (stat?.isFile() && !stat.isSymbolicLink() && stat.dev === owned.dev && stat.ino === owned.ino) unlinkSync5(staged);
+          else cleanupErrors.push(`Staged file replaced, modified or absent: ${name}`);
+        }
+        const stagePath = join10(`/proc/self/fd/${parentFd}`, basename4(stage));
+        if (sameIdentity(entryStat(stagePath), pinnedStage) && readdirSync7(anchoredStage).length === 0) rmdirSync3(stagePath);
+        else cleanupErrors.push(`Staging directory moved or contains foreign entries: ${join10(parent, basename4(stage))}`);
+      } catch (cleanupError) {
+        cleanupErrors.push(`Could not clean owned staging directory: ${String(cleanupError)}`);
+      }
+      closeSync2(stageFd);
+    } else if (stage) cleanupErrors.push(`Staging directory identity unavailable: ${join10(parent, basename4(stage))}`);
+    if (cleanupErrors.length && result2.files.length) {
+      for (const [path, owned] of [...published].reverse()) {
+        try {
+          const output = join10(`/proc/self/fd/${dirFd}`, basename4(path));
+          if (matchesPayload(output, owned)) unlinkSync5(output);
+          else cleanupErrors.push(`Concurrent replacement or mutation retained: ${path}`);
+        } catch (error) {
+          cleanupErrors.push(`Could not restore ${path}: ${String(error)}`);
+        }
+      }
+      if (madeDir && dirFd !== void 0 && parentFd !== void 0) {
+        try {
+          const anchoredDest = join10(`/proc/self/fd/${parentFd}`, "scripts");
+          if (sameIdentity(entryStat(anchoredDest), fstatSync(dirFd)) && readdirSync7(anchoredDest).length === 0) rmdirSync3(anchoredDest);
+          else cleanupErrors.push(`Created script directory moved or retained: ${dest}`);
+        } catch (error) {
+          cleanupErrors.push(`Could not remove empty script directory: ${String(error)}`);
+        }
+      }
+    }
+    if (dirFd !== void 0) closeSync2(dirFd);
+    if (parentFd !== void 0) closeSync2(parentFd);
+    if (cleanupErrors.length) result2 = { files: [], error: `${result2.error ? `${result2.error}; ` : "BMAD script staging cleanup incomplete: "}recovery incomplete: ${cleanupErrors.join("; ")}` };
+  }
+  return result2;
+}
+
+// src/parity/rules.ts
+import { basename as basename5, dirname as dirname8, join as join12, relative as relative9, resolve as resolve6 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 import YAML4 from "yaml";
 
 // src/bmad/reserved-modules.ts
-import { existsSync as existsSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join11 } from "node:path";
 import YAML3 from "yaml";
 var BMAD_RESERVED_DIR_NAMES = ["custom", "scripts", "_config", "_memory", "memory", "render"];
 var indentOf = (line) => line.length - line.trimStart().length;
@@ -9258,19 +9568,19 @@ function stripReservedModuleEntries(raw) {
   return { text: lines.filter((_, index) => !drop.has(index)).join(""), evicted };
 }
 function evictReservedModuleEntries(repoRoot, dryRun) {
-  const manifestPath = join10(repoRoot, "_bmad", "_config", "manifest.yaml");
+  const manifestPath = join11(repoRoot, "_bmad", "_config", "manifest.yaml");
   const none = { evicted: [], changedFiles: [], details: [] };
   if (!existsSync7(manifestPath)) return none;
   let original;
   try {
-    original = readFileSync9(manifestPath, "utf8");
+    original = readFileSync10(manifestPath, "utf8");
   } catch {
     return none;
   }
   const stripped = stripReservedModuleEntries(original);
   if (!stripped) return none;
   const names = stripped.evicted.map((name) => `"${name}"`).join(", ");
-  if (!dryRun) writeFileSync7(manifestPath, stripped.text, "utf8");
+  if (!dryRun) writeFileSync8(manifestPath, stripped.text, "utf8");
   return {
     evicted: stripped.evicted,
     changedFiles: [manifestPath],
@@ -9984,17 +10294,17 @@ function normalizeNewlines(value) {
   return value.replace(/\r\n/g, "\n");
 }
 function readText(path) {
-  return normalizeNewlines(readFileSync10(path, "utf8"));
+  return normalizeNewlines(readFileSync11(path, "utf8"));
 }
 function safeReadText2(path) {
   return existsSync8(path) ? readText(path) : null;
 }
 function ensureParent(path) {
-  mkdirSync6(dirname8(path), { recursive: true });
+  mkdirSync7(dirname8(path), { recursive: true });
 }
 function writeText(path, content) {
   ensureParent(path);
-  writeFileSync8(path, content);
+  writeFileSync9(path, content);
 }
 function tryParseJson(text) {
   if (!text) return null;
@@ -10020,12 +10330,12 @@ function readSymlinkTarget(path) {
 }
 function ensureSymlink(path, target, dryRun) {
   if (existsSync8(path)) {
-    const stat = lstatSync9(path);
+    const stat = lstatSync10(path);
     if (stat.isSymbolicLink()) {
       const current = readSymlinkTarget(path);
       if (current === target) return { changed: false };
       if (!dryRun) {
-        unlinkSync5(path);
+        unlinkSync6(path);
         symlinkSync3(target, path);
       }
       return { changed: true };
@@ -10036,12 +10346,12 @@ function ensureSymlink(path, target, dryRun) {
   return { changed: true };
 }
 function bootstrapAgentsFile(repoRoot, dryRun) {
-  const agentsPath = join11(repoRoot, "AGENTS.md");
+  const agentsPath = join12(repoRoot, "AGENTS.md");
   if (existsSync8(agentsPath)) return { changedFiles: [], details: [] };
   for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-    const source = join11(repoRoot, file);
+    const source = join12(repoRoot, file);
     if (!existsSync8(source)) continue;
-    const stat = lstatSync9(source);
+    const stat = lstatSync10(source);
     if (stat.isSymbolicLink()) continue;
     if (stat.isFile()) {
       if (!dryRun) renameSync4(source, agentsPath);
@@ -10049,9 +10359,9 @@ function bootstrapAgentsFile(repoRoot, dryRun) {
     }
     return { changedFiles: [], details: [], blocked: `${file} exists but is not a regular file; cannot promote to AGENTS.md` };
   }
-  const readmePath = join11(repoRoot, "README.md");
+  const readmePath = join12(repoRoot, "README.md");
   if (existsSync8(readmePath)) {
-    const stat = lstatSync9(readmePath);
+    const stat = lstatSync10(readmePath);
     if (!stat.isFile()) return { changedFiles: [], details: [], blocked: "README.md exists but is not a regular file; cannot copy to AGENTS.md" };
     if (!dryRun) copyFileSync(readmePath, agentsPath);
     return { changedFiles: [agentsPath], details: ["Copied README.md to AGENTS.md before wiring agent-file symlinks"] };
@@ -10089,11 +10399,11 @@ function yamlGet(text, keyPath) {
   return "";
 }
 function discoverRoles(repoRoot) {
-  const rolesDir = join11(repoRoot, "agents", "hermes");
+  const rolesDir = join12(repoRoot, "agents", "hermes");
   if (!existsSync8(rolesDir)) return [];
-  return readdirSync7(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const roleDir = join11(rolesDir, entry.name);
-    const roleYamlPath = join11(roleDir, "role.yaml");
+  return readdirSync8(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
+    const roleDir = join12(rolesDir, entry.name);
+    const roleYamlPath = join12(roleDir, "role.yaml");
     if (!existsSync8(roleYamlPath)) return null;
     const text = readText(roleYamlPath);
     const runtimeRepoRaw = yamlGet(text, "runtime.github_repo");
@@ -10126,26 +10436,26 @@ function discoverRoles(repoRoot) {
   }).filter((value) => Boolean(value));
 }
 function templateScript(ctx, name) {
-  const source = join11(ctx.pjanglerRoot, ".mise", "scripts", name);
+  const source = join12(ctx.pjanglerRoot, ".mise", "scripts", name);
   return existsSync8(source) ? readText(source) : void 0;
 }
 function templateVersioningScript(ctx) {
   return templateScript(ctx, "versioning.sh");
 }
 function templateLinkAgentfilesScript(ctx) {
-  const source = join11(ctx.pjanglerRoot, "templates", "commonproject", "template", ".mise", "scripts", "link-agentfiles.sh");
+  const source = join12(ctx.pjanglerRoot, "templates", "commonproject", "template", ".mise", "scripts", "link-agentfiles.sh");
   return existsSync8(source) ? readText(source) : templateScript(ctx, "link-agentfiles.sh");
 }
 function templateMaterializeEnvScript(ctx) {
-  const source = join11(ctx.pjanglerRoot, "templates", "commonproject", "template", MATERIALIZE_ENV_SCRIPT_REL);
+  const source = join12(ctx.pjanglerRoot, "templates", "commonproject", "template", MATERIALIZE_ENV_SCRIPT_REL);
   return existsSync8(source) ? readText(source) : void 0;
 }
 function resolveAgentHooksLayer(ctx) {
   const override = process.env.PJ_AGENT_HOOKS_LAYER;
   if (override === "0" || override === "false") return false;
   if (override === "1" || override === "true") return true;
-  if (existsSync8(join11(ctx.repoRoot, ".agents", "hooks", "sync.py"))) return true;
-  return !existsSync8(join11(ctx.homeDir, ".agents", "hooks"));
+  if (existsSync8(join12(ctx.repoRoot, ".agents", "hooks", "sync.py"))) return true;
+  return !existsSync8(join12(ctx.homeDir, ".agents", "hooks"));
 }
 function evaluateMiseConditionals(template, agentHooksLayer) {
   const out = [];
@@ -10171,13 +10481,13 @@ function evaluateMiseConditionals(template, agentHooksLayer) {
 }
 function renderGeneratedProjectMiseToml(ctx, template) {
   const project = readProjectJson(ctx);
-  const projectName = String(project?.project_name ?? basename4(ctx.repoRoot) ?? "project");
+  const projectName = String(project?.project_name ?? basename5(ctx.repoRoot) ?? "project");
   return evaluateMiseConditionals(template, resolveAgentHooksLayer(ctx)).replace(/\{%\s*raw\s*%\}([\s\S]*?)\{%\s*endraw\s*%\}/g, "$1").replace(/\{\{\s*project_name\s*\}\}/g, projectName);
 }
 function ensureMiseTomlFromTemplate(ctx, changedFiles) {
-  const targetPath = join11(ctx.repoRoot, "mise.toml");
+  const targetPath = join12(ctx.repoRoot, "mise.toml");
   if (existsSync8(targetPath)) return null;
-  const sourcePath = join11(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
+  const sourcePath = join12(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
   if (!existsSync8(sourcePath)) return null;
   const rendered = renderGeneratedProjectMiseToml(ctx, readText(sourcePath));
   changedFiles.push(targetPath);
@@ -10185,12 +10495,12 @@ function ensureMiseTomlFromTemplate(ctx, changedFiles) {
   return rendered;
 }
 function templateCommonProjectText(ctx, rel) {
-  const path = join11(ctx.pjanglerRoot, "templates", "commonproject", "template", rel);
+  const path = join12(ctx.pjanglerRoot, "templates", "commonproject", "template", rel);
   return existsSync8(path) ? readText(path) : void 0;
 }
 function lstatIfPresent(path) {
   try {
-    return lstatSync9(path);
+    return lstatSync10(path);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -10198,7 +10508,7 @@ function lstatIfPresent(path) {
 }
 function templateVersionFilesConf(ctx, repoRoot) {
   if (isObsidianPluginRepo(ctx, repoRoot)) return OBSIDIAN_VERSION_FILES_CONF;
-  const packageJson = join11(repoRoot, "package.json");
+  const packageJson = join12(repoRoot, "package.json");
   return existsSync8(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
 }
 var OBSIDIAN_VERSION_FILES_CONF = "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag obsidian\n# Obsidian plugin: bump with `mise run version:bump`, release with `npm version` (bare X.Y.Z tag).\njson package.json\nobsidian manifest.json\n";
@@ -10208,7 +10518,7 @@ function recordedProjectType(ctx) {
 function isObsidianPluginRepo(ctx, repoRoot) {
   const recorded = recordedProjectType(ctx);
   if (recorded !== void 0) return recorded === "obsidian-plugin";
-  const manifest = record2(tryParseJson(safeReadText2(join11(repoRoot, "manifest.json"))));
+  const manifest = record2(tryParseJson(safeReadText2(join12(repoRoot, "manifest.json"))));
   return typeof manifest.id === "string" && typeof manifest.minAppVersion === "string";
 }
 function unsupportedVersionTypes(conf, script) {
@@ -10669,7 +10979,7 @@ function describeRewrite(before, after) {
   return difference ? `migrate would still rewrite ${difference} in mise.toml` : "migrate would still re-lay out mise.toml (its meaning is unchanged)";
 }
 function readProjectJson(ctx) {
-  return tryParseJson(safeReadText2(join11(ctx.repoRoot, ".project.json")));
+  return tryParseJson(safeReadText2(join12(ctx.repoRoot, ".project.json")));
 }
 function readDeclaredAgents(ctx) {
   const project = readProjectJson(ctx);
@@ -10686,7 +10996,7 @@ function readDeclaredAgents(ctx) {
   });
 }
 function readRoleYamlAt(roleDir) {
-  const roleYamlPath = join11(roleDir, "role.yaml");
+  const roleYamlPath = join12(roleDir, "role.yaml");
   if (!existsSync8(roleYamlPath)) return null;
   const text = readText(roleYamlPath);
   return {
@@ -10698,7 +11008,7 @@ function readRoleYamlAt(roleDir) {
 }
 function declaredRoleIsUnprovisioned(repoRoot, roleDir) {
   if (!roleDir) return true;
-  return !existsSync8(join11(resolve6(repoRoot, roleDir), "role.yaml"));
+  return !existsSync8(join12(resolve6(repoRoot, roleDir), "role.yaml"));
 }
 function validateDeclaredAgent(ctx, declared) {
   const details = [];
@@ -10723,11 +11033,11 @@ function validateDeclaredAgent(ctx, declared) {
     details.push(`agents.${declared.agentId} should map to agent_id ${roleYaml.agentId}`);
   }
   if (roleYaml.providerName) {
-    const dispatcher = join11(roleDir, ".scripts", "lib", "ticket-provider.sh");
+    const dispatcher = join12(roleDir, ".scripts", "lib", "ticket-provider.sh");
     if (!existsSync8(dispatcher)) {
       details.push(`agents.${declared.agentId} provider dispatcher ${relative9(ctx.repoRoot, dispatcher)} missing`);
     }
-    const provider = join11(roleDir, ".scripts", "providers", `${roleYaml.providerName}.sh`);
+    const provider = join12(roleDir, ".scripts", "providers", `${roleYaml.providerName}.sh`);
     if (!existsSync8(provider)) {
       details.push(`agents.${declared.agentId} provider script ${relative9(ctx.repoRoot, provider)} missing`);
     }
@@ -10743,7 +11053,7 @@ function repoPathNamesRoot(value, repoRoot, homeDir) {
 function canonicalProjectJson(ctx) {
   const roles = discoverRoles(ctx.repoRoot);
   const existing = readProjectJson(ctx) ?? {};
-  const slug = normalizeProjectId(existing.project_id ?? existing.project_slug ?? slugifyRepoName(basename4(ctx.repoRoot)));
+  const slug = normalizeProjectId(existing.project_id ?? existing.project_slug ?? slugifyRepoName(basename5(ctx.repoRoot)));
   const firstRole = roles[0];
   const ticketProvider = {
     ...existing.ticket_provider,
@@ -10813,8 +11123,8 @@ function canonicalProjectJson(ctx) {
   };
 }
 function projectJsonFinding(ctx) {
-  const projectPath = join11(ctx.repoRoot, ".project.json");
-  const planeJsonPath = join11(ctx.repoRoot, ".plane.json");
+  const projectPath = join12(ctx.repoRoot, ".project.json");
+  const planeJsonPath = join12(ctx.repoRoot, ".plane.json");
   const details = [];
   const data = readProjectJson(ctx);
   const roles = discoverRoles(ctx.repoRoot);
@@ -10885,7 +11195,7 @@ var BMAD_DIST_TAGS_TTL_MS = 60 * 60 * 1e3;
 var DEFAULT_BMAD_MODULES = ["bmm", "bmb", "cis"];
 var BMAD_INSTALL_TOOLS = SUPPORTED_BMAD_TOOLS;
 function manifestBmadModules(repoRoot) {
-  const manifestPath = join11(repoRoot, "_bmad", "_config", "manifest.yaml");
+  const manifestPath = join12(repoRoot, "_bmad", "_config", "manifest.yaml");
   const raw = safeReadText2(manifestPath);
   if (raw === null) return { status: "absent" };
   try {
@@ -10913,7 +11223,7 @@ function manifestBmadModules(repoRoot) {
   }
 }
 function configuredBmadModuleSelection(repoRoot) {
-  const raw = safeReadText2(join11(repoRoot, "_bmad", "config.toml"));
+  const raw = safeReadText2(join12(repoRoot, "_bmad", "config.toml"));
   if (raw === null) return void 0;
   const modules = [...raw.matchAll(/^\[modules\.([A-Za-z0-9][A-Za-z0-9_-]*)\]\s*$/gm)].map((match) => match[1]);
   return { modules: Array.from(new Set(modules)).filter((name) => name !== "g33"), hasG33: modules.includes("g33") };
@@ -10924,24 +11234,60 @@ function selectedBmadModules(repoRoot) {
   if (manifest.status === "invalid") throw new Error(manifest.error);
   return configuredBmadModuleSelection(repoRoot)?.modules ?? [...DEFAULT_BMAD_MODULES];
 }
-function requiredBmadSentinels(repoRoot, modules = selectedBmadModules(repoRoot)) {
-  return [
-    join11("core", "config.yaml"),
-    join11("config.toml"),
-    join11("_config", "manifest.yaml"),
-    ...modules.map((module) => join11(module, "config.yaml"))
-  ];
+var BMAD_RUNTIME_SCRIPT_SENTINELS = ["resolve_config.py", "config_utils.py"];
+function consolidatedBmadConfig(repoRoot) {
+  const path = join12(repoRoot, "_bmad", "config.yaml");
+  if (!existsSync8(path)) return { status: "absent" };
+  let parsed;
+  try {
+    parsed = YAML4.parse(readText(path));
+  } catch (error) {
+    return { status: "unusable", reason: `could not be parsed: ${error instanceof Error ? error.message.split("\n")[0] : String(error)}` };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { status: "unusable", reason: "is not a YAML mapping" };
+  }
+  return { status: "mapping", sections: new Set(Object.keys(parsed)) };
+}
+function bmadSentinelGaps(repoRoot, modules = selectedBmadModules(repoRoot)) {
+  const bmad = join12(repoRoot, "_bmad");
+  const gaps = [];
+  const absent = (...segments) => !existsSync8(join12(bmad, ...segments));
+  if (absent("config.toml")) gaps.push({ path: "config.toml", detail: "_bmad/config.toml" });
+  for (const script of BMAD_RUNTIME_SCRIPT_SENTINELS) {
+    if (absent("scripts", script)) gaps.push({ path: join12("scripts", script), detail: `_bmad/scripts/${script}` });
+  }
+  if (absent("_config", "manifest.yaml")) {
+    gaps.push({
+      path: join12("_config", "manifest.yaml"),
+      detail: existsSync8(bmad) ? "_bmad/_config/manifest.yaml (the installer's install record). BMB setup's `--also-remove _config` cleanup is the likely cause: it deletes all of _bmad/_config. Restore it with: pj migrate bmad.scaffold" : "_bmad/_config/manifest.yaml"
+    });
+  }
+  let consolidated;
+  for (const module of modules) {
+    if (!absent(module, "config.yaml")) continue;
+    consolidated ??= consolidatedBmadConfig(repoRoot);
+    if (consolidated.status === "mapping" && consolidated.sections.has(module)) continue;
+    const why = consolidated.status === "absent" ? "" : consolidated.status === "unusable" ? ` (and _bmad/config.yaml ${consolidated.reason}, so it cannot supply a ${module} section)` : ` (and _bmad/config.yaml has no ${module} section)`;
+    gaps.push({ path: join12(module, "config.yaml"), detail: `_bmad/${module}/config.yaml${why}` });
+  }
+  return gaps;
+}
+function bmadScaffoldIssues(repoRoot, modules) {
+  const gaps = bmadSentinelGaps(repoRoot, modules);
+  const nameIssues = bmadProjectNameIssues(repoRoot);
+  return { gaps, nameIssues, details: [...gaps.map((gap) => gap.detail), ...nameIssues.details] };
 }
 function canonicalBmadProjectName(repoRoot) {
   const project = readProjectJson({ repoRoot });
   const declared = typeof project?.project_name === "string" ? project.project_name.trim() : "";
-  return declared || basename4(repoRoot);
+  return declared || basename5(repoRoot);
 }
 function bmadProjectNameIssues(repoRoot) {
   const expected = canonicalBmadProjectName(repoRoot);
   const paths = [];
   const details = [];
-  const configToml = join11(repoRoot, "_bmad", "config.toml");
+  const configToml = join12(repoRoot, "_bmad", "config.toml");
   const tomlText = safeReadText2(configToml);
   const tomlMatch = tomlText?.match(/^project_name\s*=\s*"((?:\\.|[^"\\])*)"\s*$/m);
   let tomlName;
@@ -10956,16 +11302,16 @@ function bmadProjectNameIssues(repoRoot) {
     paths.push(configToml);
     details.push(`_bmad/config.toml project_name must be ${JSON.stringify(expected)}`);
   }
-  const bmadRoot = join11(repoRoot, "_bmad");
+  const bmadRoot = join12(repoRoot, "_bmad");
   if (existsSync8(bmadRoot)) {
     let declared;
     try {
       declared = selectedBmadModules(repoRoot);
     } catch {
-      declared = readdirSync7(bmadRoot);
+      declared = readdirSync8(bmadRoot);
     }
     for (const name of new Set(declared)) {
-      const configPath = join11(bmadRoot, name, "config.yaml");
+      const configPath = join12(bmadRoot, name, "config.yaml");
       const raw = safeReadText2(configPath);
       if (raw === null) continue;
       let actual;
@@ -10985,7 +11331,7 @@ function bmadProjectNameIssues(repoRoot) {
 function isCurrentActivation(path, activations) {
   if (activations.owned.has(path)) return true;
   try {
-    if (activations.owned.has(join11(realpathSync4(dirname8(path)), basename4(path)))) return true;
+    if (activations.owned.has(join12(realpathSync4(dirname8(path)), basename5(path)))) return true;
     return activations.targets.has(realpathSync4(path));
   } catch {
     return false;
@@ -10998,26 +11344,26 @@ async function skillActivations(ctx) {
 function evictLegacyBmadPackState(ctx, changedFiles, activations) {
   const details = [];
   const skillDirs = [
-    join11(ctx.repoRoot, ".agents", "skills"),
-    ...SUPPORTED_CLI_ROOTS.map((root) => join11(ctx.repoRoot, root, "skills"))
+    join12(ctx.repoRoot, ".agents", "skills"),
+    ...SUPPORTED_CLI_ROOTS.map((root) => join12(ctx.repoRoot, root, "skills"))
   ];
   for (const dir of skillDirs) {
     const dirStat = lstatIfPresent(dir);
     if (!dirStat || dirStat.isSymbolicLink() || !dirStat.isDirectory()) continue;
     let names;
     try {
-      names = readdirSync7(dir);
+      names = readdirSync8(dir);
     } catch {
       continue;
     }
     for (const name of names) {
       if (!name.startsWith(BMAD_SKILL_NAME_PREFIX)) continue;
-      const path = join11(dir, name);
+      const path = join12(dir, name);
       if (!lstatIfPresent(path)?.isSymbolicLink()) continue;
       if (isCurrentActivation(path, activations)) continue;
       changedFiles.push(path);
       details.push(`removed retired BMAD pack symlink ${relative9(ctx.repoRoot, path)}`);
-      if (!ctx.dryRun) unlinkSync5(path);
+      if (!ctx.dryRun) unlinkSync6(path);
     }
   }
   return details;
@@ -11030,10 +11376,11 @@ function bmadInstallerInvocation(version = BMAD_INSTALLER_VERSION) {
     prefixArgs: ["-y", `${BMAD_NPM_PACKAGE}@${version}`]
   };
 }
-function resolveBmadInstallerPackage(version = BMAD_INSTALLER_VERSION) {
+function resolveBmadInstallerPackage(version = BMAD_INSTALLER_VERSION, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 18e4;
   const packageAt = (dir) => {
     try {
-      const parsed = JSON.parse(readFileSync10(join11(dir, "package.json"), "utf8"));
+      const parsed = JSON.parse(readFileSync11(join12(dir, "package.json"), "utf8"));
       return parsed.name === BMAD_NPM_PACKAGE ? typeof parsed.version === "string" ? parsed.version : "unknown" : void 0;
     } catch {
       return void 0;
@@ -11065,12 +11412,13 @@ function resolveBmadInstallerPackage(version = BMAD_INSTALLER_VERSION) {
     `node -e "process.stdout.write(require('fs').realpathSync(process.argv[1]))" "$(command -v ${BMAD_NPM_PACKAGE})"`
   ], {
     encoding: "utf8",
-    timeout: 18e4,
+    timeout: timeoutMs,
     env: { ...process.env, npm_config_update_notifier: "false", npm_config_fund: "false" }
   });
   const entry = probe.stdout?.trim().split("\n").pop()?.trim();
   if (probe.status !== 0 || !entry) {
-    const detail = String(probe.stderr || probe.error?.message || `exit ${probe.status}`).split("\n").filter((line) => line.trim() && !line.startsWith("npm notice")).slice(-3).join(" ");
+    const timedOut = probe.error?.code === "ETIMEDOUT";
+    const detail = timedOut ? `timed out after ${Math.round(timeoutMs / 1e3)}s` : String(probe.stderr || probe.error?.message || `exit ${probe.status}`).split("\n").filter((line) => line.trim() && !line.startsWith("npm notice")).slice(-3).join(" ");
     return { reason: `could not resolve ${BMAD_NPM_PACKAGE}@${version}: ${detail || "no installer path reported"}` };
   }
   const root = dirname8(dirname8(dirname8(entry)));
@@ -11078,6 +11426,34 @@ function resolveBmadInstallerPackage(version = BMAD_INSTALLER_VERSION) {
   if (!found) return { reason: `${entry} is not inside a ${BMAD_NPM_PACKAGE} package` };
   return { root, entry, version: found };
 }
+var BMAD_SETUP_SCRIPTS_PROBE_TIMEOUT_MS = 1e4;
+var BMAD_SETUP_SCRIPTS_REMEDY = "re-run the BMAD installer (npx bmad-method install) or upgrade via `pj migrate bmad.version`";
+function bmadSetupScriptsState(repoRoot) {
+  const inspection = inspectBmadSetupScripts(repoRoot, BMAD_INSTALLER_VERSION, () => readInstalledBmadVersion(repoRoot));
+  const decline = (why, missing, remedy2) => ({
+    kind: "decline",
+    summary: `Setup script recovery unavailable: ${why}${missing.length ? ` (missing from _bmad/scripts: ${missing.join(", ")})` : ""}; ${remedy2}`
+  });
+  switch (inspection.state) {
+    case "present":
+      return { kind: "present" };
+    case "unsafe":
+      return { kind: "refuse", error: `BMAD script recovery refused: ${inspection.error}` };
+    case "decline":
+      return decline(inspection.why, inspection.missing, BMAD_SETUP_SCRIPTS_REMEDY);
+    case "missing":
+      break;
+  }
+  const override = Boolean(process.env.PJ_BMAD_INSTALLER?.trim());
+  const remedy = override ? "unset PJ_BMAD_INSTALLER to enable recovery from the pinned package" : `retry when npm is reachable, or ${BMAD_SETUP_SCRIPTS_REMEDY}`;
+  const pkg = resolveBmadInstallerPackage(BMAD_INSTALLER_VERSION, { timeoutMs: BMAD_SETUP_SCRIPTS_PROBE_TIMEOUT_MS });
+  if (!pkg.root) return decline(pkg.reason ?? "installer is not a bmad-method package", inspection.missing, remedy);
+  const plan = planBmadSetupScripts(repoRoot, pkg, BMAD_INSTALLER_VERSION);
+  if (plan.error) {
+    return plan.declinable ? decline(plan.error.replace(/^BMAD script recovery refused: /, ""), inspection.missing, plan.declinable === "attest" ? BMAD_SETUP_SCRIPTS_REMEDY : remedy) : { kind: "refuse", error: plan.error };
+  }
+  return plan.files.length ? { kind: "missing", pkg, files: plan.files } : { kind: "present" };
+}
 function bmadInstallerArgs(repoRoot, modules = selectedBmadModules(repoRoot), extraArgs = []) {
   const installerModules = modules.length ? modules.join(",") : "core";
   return [
@@ -11096,7 +11472,7 @@ function bmadInstallerArgs(repoRoot, modules = selectedBmadModules(repoRoot), ex
 }
 function bmadUpgradeChannelArgs(repoRoot, version) {
   if (!/^\d+\.\d+\.\d+$/.test(version)) return [];
-  const raw = safeReadText2(join11(repoRoot, "_bmad", "_config", "manifest.yaml"));
+  const raw = safeReadText2(join12(repoRoot, "_bmad", "_config", "manifest.yaml"));
   if (!raw) return [];
   let modules;
   try {
@@ -11166,7 +11542,7 @@ function bmadChannelTarget(distTags) {
   return next ? { version: next, channel: BMAD_TARGET_CHANNEL } : void 0;
 }
 function readInstalledBmadVersion(repoRoot) {
-  const raw = safeReadText2(join11(repoRoot, "_bmad", "_config", "manifest.yaml"));
+  const raw = safeReadText2(join12(repoRoot, "_bmad", "_config", "manifest.yaml"));
   if (!raw) return void 0;
   try {
     const parsed = YAML4.parse(raw);
@@ -11177,8 +11553,8 @@ function readInstalledBmadVersion(repoRoot) {
   }
 }
 function bmadCachePath(homeDir) {
-  const cacheRoot = process.env.XDG_CACHE_HOME?.trim() || join11(homeDir, ".cache");
-  return join11(cacheRoot, "pjangler", "bmad-dist-tags.json");
+  const cacheRoot = process.env.XDG_CACHE_HOME?.trim() || join12(homeDir, ".cache");
+  return join12(cacheRoot, "pjangler", "bmad-dist-tags.json");
 }
 function readBmadDistTagsCache(homeDir) {
   const raw = safeReadText2(bmadCachePath(homeDir));
@@ -11220,8 +11596,8 @@ function resolveBmadDistTags(homeDir) {
   if (fetched) {
     try {
       const path = bmadCachePath(homeDir);
-      mkdirSync6(dirname8(path), { recursive: true });
-      writeFileSync8(path, JSON.stringify({ fetchedAt: Date.now(), distTags: fetched }, null, 2));
+      mkdirSync7(dirname8(path), { recursive: true });
+      writeFileSync9(path, JSON.stringify({ fetchedAt: Date.now(), distTags: fetched }, null, 2));
     } catch {
     }
     return { distTags: fetched, stale: false };
@@ -11345,8 +11721,8 @@ var UNSUPPORTED_BMAD_ROOTS = {
   ".zencoder": "zencoder"
 };
 function unsupportedRootAttestation(repoRoot, rootName) {
-  const root = join11(repoRoot, rootName);
-  const stat = lstatSync9(root);
+  const root = join12(repoRoot, rootName);
+  const stat = lstatSync10(root);
   if (!stat.isDirectory() || stat.isSymbolicLink()) return { safe: false, reason: `${rootName} is not a regular generated directory` };
   const installerTool = UNSUPPORTED_BMAD_ROOTS[rootName];
   if (!installedBmadTools(repoRoot).has(installerTool)) {
@@ -11365,7 +11741,7 @@ var OPTIONAL_TEMPLATE_SCRIPTS = [
 function optionalTemplateScriptIssues(ctx) {
   const issues = [];
   for (const rel of OPTIONAL_TEMPLATE_SCRIPTS) {
-    const path = join11(ctx.repoRoot, rel);
+    const path = join12(ctx.repoRoot, rel);
     if (!existsSync8(path)) continue;
     const expected = templateCommonProjectText(ctx, rel);
     if (expected === void 0) continue;
@@ -11376,7 +11752,7 @@ function optionalTemplateScriptIssues(ctx) {
 function refreshOptionalTemplateScripts(ctx) {
   const changed = [];
   for (const rel of OPTIONAL_TEMPLATE_SCRIPTS) {
-    const path = join11(ctx.repoRoot, rel);
+    const path = join12(ctx.repoRoot, rel);
     if (!existsSync8(path)) continue;
     const expected = templateCommonProjectText(ctx, rel);
     if (expected === void 0 || safeReadText2(path) === expected) continue;
@@ -11394,13 +11770,13 @@ function createMiseChecks() {
       id: "mise.config-root",
       title: "mise config_root + AGENTS link hooks",
       audit: (ctx) => {
-        const misePath = join11(ctx.repoRoot, "mise.toml");
+        const misePath = join12(ctx.repoRoot, "mise.toml");
         if (!existsSync8(misePath)) {
           return { id: "mise.config-root", title: "mise config_root + AGENTS link hooks", status: "fail", summary: "mise.toml missing", details: [], fixable: true };
         }
         const text = readText(misePath);
         const details = [];
-        const linkAgentfilesPath = join11(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+        const linkAgentfilesPath = join12(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
         if (!existsSync8(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
         const toml = [];
         const manual = [];
@@ -11448,7 +11824,7 @@ function createMiseChecks() {
         };
       },
       migrate: (ctx, finding2) => {
-        const path = join11(ctx.repoRoot, "mise.toml");
+        const path = join12(ctx.repoRoot, "mise.toml");
         const changedFiles = [];
         const details = [];
         if (!existsSync8(path)) {
@@ -11467,7 +11843,7 @@ function createMiseChecks() {
           if (!ctx.dryRun) writeText(path, plan.text);
           text = plan.text;
         }
-        const linkAgentfilesPath = join11(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+        const linkAgentfilesPath = join12(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
         const expectedScript = templateLinkAgentfilesScript(ctx);
         if (expectedScript === void 0) {
           return { id: finding2.id, title: finding2.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/link-agentfiles.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -11505,9 +11881,9 @@ function createMiseChecks() {
       title: "managed mise versioning block",
       audit: (ctx) => {
         const details = [];
-        const misePath = join11(ctx.repoRoot, "mise.toml");
-        const versioningPath = join11(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
-        const manifestPath = join11(ctx.repoRoot, ".mise", "version-files.conf");
+        const misePath = join12(ctx.repoRoot, "mise.toml");
+        const versioningPath = join12(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+        const manifestPath = join12(ctx.repoRoot, ".mise", "version-files.conf");
         const text = safeReadText2(misePath);
         if (!text?.includes("# >>> mise-versioning >>>")) details.push("mise versioning managed block missing");
         if (!existsSync8(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
@@ -11533,7 +11909,7 @@ function createMiseChecks() {
       migrate: (ctx, finding2) => {
         const changedFiles = [];
         const details = [];
-        const misePath = join11(ctx.repoRoot, "mise.toml");
+        const misePath = join12(ctx.repoRoot, "mise.toml");
         if (!existsSync8(misePath)) {
           if (ensureMiseTomlFromTemplate(ctx, changedFiles) === null) {
             return { id: finding2.id, title: finding2.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
@@ -11551,7 +11927,7 @@ function createMiseChecks() {
           if (!changedFiles.includes(misePath)) changedFiles.push(misePath);
           if (!ctx.dryRun) writeText(misePath, versioningPlan.text);
         }
-        const versioningPath = join11(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+        const versioningPath = join12(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
         const expectedScript = templateVersioningScript(ctx);
         if (expectedScript === void 0) {
           return { id: finding2.id, title: finding2.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/versioning.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -11563,7 +11939,7 @@ function createMiseChecks() {
             chmodSync3(versioningPath, 493);
           }
         }
-        const manifestPath = join11(ctx.repoRoot, ".mise", "version-files.conf");
+        const manifestPath = join12(ctx.repoRoot, ".mise", "version-files.conf");
         const expectedManifest = templateVersionFilesConf(ctx, ctx.repoRoot);
         if (safeReadText2(manifestPath) !== expectedManifest) {
           changedFiles.push(manifestPath);
@@ -11625,7 +12001,7 @@ var RETIRED_SKILL_SCRIPTS = [
   ".mise/scripts/unlink-project-skills-from-clis.sh"
 ];
 function retiredSkillsScripts(ctx) {
-  return RETIRED_SKILL_SCRIPTS.map((path) => join11(ctx.repoRoot, path)).filter((path) => Boolean(lstatIfPresent(path)));
+  return RETIRED_SKILL_SCRIPTS.map((path) => join12(ctx.repoRoot, path)).filter((path) => Boolean(lstatIfPresent(path)));
 }
 function skillsWiringFindings(text) {
   if (text === null) return { fixable: [], manual: [] };
@@ -11676,7 +12052,7 @@ function createAgentHooksChecks() {
       title: "Skillex project skills",
       audit: async (ctx) => {
         const finding2 = await auditProjectSkills(ctx);
-        const mise = safeReadText2(join11(ctx.repoRoot, "mise.toml"));
+        const mise = safeReadText2(join12(ctx.repoRoot, "mise.toml"));
         const registryField = await legacyRegistryField(ctx);
         const registryDrop = registryField ? await dropLegacyRegistryField({ ...ctx, dryRun: true }) : void 0;
         const wiring = [...skillsWiringIssues(mise), ...registryField && !registryDrop?.blocked ? [`Drop the legacy "registry" field (${JSON.stringify(registryField.value)}) from .agents/skills.json; it pins resolution to the never-fetched ~/.agents/.cache registry clone`] : []];
@@ -11697,7 +12073,7 @@ function createAgentHooksChecks() {
         const changedFiles = [];
         const details = [];
         const result2 = (status, summary) => ({ id: finding2.id, title: finding2.title, status, summary, changedFiles: [...new Set(changedFiles)], details });
-        let currentMise = safeReadText2(join11(ctx.repoRoot, "mise.toml"));
+        let currentMise = safeReadText2(join12(ctx.repoRoot, "mise.toml"));
         if (currentMise === null) {
           const template = templateCommonProjectText(ctx, "mise.toml.jinja");
           if (template === void 0) return result2("blocked", "Generated-project mise template is unavailable");
@@ -11712,9 +12088,9 @@ function createAgentHooksChecks() {
           const stat = lstatIfPresent(path);
           if (!stat || stat.isDirectory()) continue;
           changedFiles.push(path);
-          if (!ctx.dryRun) unlinkSync5(path);
+          if (!ctx.dryRun) unlinkSync6(path);
         }
-        const misePath = join11(ctx.repoRoot, "mise.toml");
+        const misePath = join12(ctx.repoRoot, "mise.toml");
         const nextMise = upsertLinkAgentfilesBlock(currentMise, ctx);
         if (safeReadText2(misePath) !== nextMise) {
           changedFiles.push(misePath);
@@ -11745,9 +12121,9 @@ function createAgentHooksChecks() {
       id: "sot.agent-symlinks",
       title: "AGENTS/CLAUDE/GEMINI symlink contract",
       audit: (ctx) => {
-        const agentsPath = join11(ctx.repoRoot, "AGENTS.md");
+        const agentsPath = join12(ctx.repoRoot, "AGENTS.md");
         if (!existsSync8(agentsPath)) {
-          const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync8(join11(ctx.repoRoot, file)));
+          const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync8(join12(ctx.repoRoot, file)));
           if (fallbackSources.length === 0) {
             return { id: "sot.agent-symlinks", title: "AGENTS/CLAUDE/GEMINI symlink contract", status: "skip", summary: "AGENTS.md missing; symlink contract not applicable", details: [], fixable: false };
           }
@@ -11762,7 +12138,7 @@ function createAgentHooksChecks() {
         }
         const details = [];
         for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-          const full = join11(ctx.repoRoot, file);
+          const full = join12(ctx.repoRoot, file);
           const target = readSymlinkTarget(full);
           if (target !== "AGENTS.md") details.push(`${file} should be a symlink to AGENTS.md`);
         }
@@ -11786,7 +12162,7 @@ function createAgentHooksChecks() {
           return { id: finding2.id, title: finding2.title, status: "blocked", summary: "AGENTS.md missing; cannot derive canonical agent file", changedFiles, details: [bootstrap.blocked] };
         }
         for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-          const full = join11(ctx.repoRoot, file);
+          const full = join12(ctx.repoRoot, file);
           const result2 = ensureSymlink(full, "AGENTS.md", ctx.dryRun);
           if (result2.blocked) blockedDetails.push(result2.blocked);
           if (result2.changed) changedFiles.push(full);
@@ -11813,7 +12189,7 @@ function createProjectJsonChecks() {
         const changedFiles = [];
         const blockedDetails = [];
         const droppedDetails = [];
-        const path = join11(ctx.repoRoot, ".project.json");
+        const path = join12(ctx.repoRoot, ".project.json");
         const existing = readProjectJson(ctx) ?? {};
         const canonical = canonicalProjectJson(ctx);
         const preservedDetails = [];
@@ -11845,7 +12221,7 @@ function createProjectJsonChecks() {
           changedFiles.push(path);
           if (!ctx.dryRun) writeText(path, expected);
         }
-        const planeJson = join11(ctx.repoRoot, ".plane.json");
+        const planeJson = join12(ctx.repoRoot, ".plane.json");
         if (existsSync8(planeJson)) {
           const backup = `${planeJson}.migrated-backup`;
           if (existsSync8(backup)) {
@@ -11877,10 +12253,10 @@ function createMiseOpInjectChecks() {
         const details = [];
         let envOpNeedsHands = false;
         const optedOut = envMaterializationOptedOut(ctx);
-        const envOpPath = join11(ctx.repoRoot, ".env.op");
+        const envOpPath = join12(ctx.repoRoot, ".env.op");
         const envOpExists = existsSync8(envOpPath);
         const envOp = envOpExists ? readText(envOpPath) : void 0;
-        const gitignore = safeReadText2(join11(ctx.repoRoot, ".gitignore"));
+        const gitignore = safeReadText2(join12(ctx.repoRoot, ".gitignore"));
         if (!envOpExists) {
           details.push(".env.op missing");
         } else if (!envOp?.trim()) {
@@ -11900,7 +12276,7 @@ function createMiseOpInjectChecks() {
         if (!gitignore?.includes(".env\n") && !gitignore?.includes(".env\r\n")) details.push(".gitignore should ignore .env");
         if (!gitignore?.includes(".env.*")) details.push(".gitignore should ignore .env.*");
         if (!gitignore?.includes("!.env.op")) details.push(".gitignore should unignore .env.op");
-        const misePath = join11(ctx.repoRoot, "mise.toml");
+        const misePath = join12(ctx.repoRoot, "mise.toml");
         const miseText = safeReadText2(misePath);
         if (!miseText) {
           details.push("mise.toml missing for .env materialization hook");
@@ -11923,7 +12299,7 @@ function createMiseOpInjectChecks() {
           else if (plan.text !== miseText && !mise.length) mise.push(describeRewrite(miseText, plan.text));
           details.push(...mise);
         }
-        const materializePath = join11(ctx.repoRoot, MATERIALIZE_ENV_SCRIPT_REL);
+        const materializePath = join12(ctx.repoRoot, MATERIALIZE_ENV_SCRIPT_REL);
         const expectedMaterializer = templateMaterializeEnvScript(ctx);
         if (optedOut) {
           if (existsSync8(materializePath)) details.push(`${MATERIALIZE_ENV_SCRIPT_REL} is present, but .project.json declares secrets.materialize_env: false`);
@@ -11931,7 +12307,7 @@ function createMiseOpInjectChecks() {
           details.push("pjangler package is missing the managed materialize-env.sh source");
         } else if (safeReadText2(materializePath) !== expectedMaterializer) {
           details.push(`${MATERIALIZE_ENV_SCRIPT_REL} missing or drifted`);
-        } else if ((lstatSync9(materializePath).mode & 73) === 0) {
+        } else if ((lstatSync10(materializePath).mode & 73) === 0) {
           details.push(`${MATERIALIZE_ENV_SCRIPT_REL} is not executable`);
         }
         return {
@@ -11947,8 +12323,8 @@ function createMiseOpInjectChecks() {
         const changedFiles = [];
         const details = [];
         let envOpNeedsHands = false;
-        const envOpPath = join11(ctx.repoRoot, ".env.op");
-        const canonicalEnvOpPath = join11(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op");
+        const envOpPath = join12(ctx.repoRoot, ".env.op");
+        const canonicalEnvOpPath = join12(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op");
         if (!existsSync8(canonicalEnvOpPath)) {
           return { id: finding2.id, title: finding2.title, status: "blocked", summary: "pjangler package is missing the neutral .env.op template", changedFiles: [], details: [] };
         }
@@ -11977,7 +12353,7 @@ function createMiseOpInjectChecks() {
             }
           }
         }
-        const gitignorePath = join11(ctx.repoRoot, ".gitignore");
+        const gitignorePath = join12(ctx.repoRoot, ".gitignore");
         const gitignore = safeReadText2(gitignorePath) ?? "";
         const requiredBlock = `# Secrets \u2014 .env is materialized from .env.op by \`op inject\` on mise enter,
 # staged through a mktemp file and moved into place only on success.
@@ -11990,7 +12366,7 @@ function createMiseOpInjectChecks() {
           changedFiles.push(gitignorePath);
           if (!ctx.dryRun) writeText(gitignorePath, `${gitignore.replace(/\s*$/, "")}${gitignore.trim() ? "\n\n" : ""}${requiredBlock}`);
         }
-        const misePath = join11(ctx.repoRoot, "mise.toml");
+        const misePath = join12(ctx.repoRoot, "mise.toml");
         let currentMise = safeReadText2(misePath);
         if (currentMise === null) {
           const initialized = ensureMiseTomlFromTemplate(ctx, changedFiles);
@@ -12007,7 +12383,7 @@ function createMiseOpInjectChecks() {
           if (!changedFiles.includes(misePath)) changedFiles.push(misePath);
           if (!ctx.dryRun) writeText(misePath, opPlan.text);
         }
-        const materializePath = join11(ctx.repoRoot, MATERIALIZE_ENV_SCRIPT_REL);
+        const materializePath = join12(ctx.repoRoot, MATERIALIZE_ENV_SCRIPT_REL);
         const expectedMaterializer = templateMaterializeEnvScript(ctx);
         if (optedOut) {
           if (existsSync8(materializePath)) {
@@ -12016,7 +12392,7 @@ function createMiseOpInjectChecks() {
           }
         } else if (!expectedMaterializer) {
           return { id: finding2.id, title: finding2.title, status: "blocked", summary: "pjangler package is missing materialize-env.sh", changedFiles: [], details: [] };
-        } else if (safeReadText2(materializePath) !== expectedMaterializer || existsSync8(materializePath) && (lstatSync9(materializePath).mode & 73) === 0) {
+        } else if (safeReadText2(materializePath) !== expectedMaterializer || existsSync8(materializePath) && (lstatSync10(materializePath).mode & 73) === 0) {
           changedFiles.push(materializePath);
           if (!ctx.dryRun) {
             writeText(materializePath, expectedMaterializer);
@@ -12078,7 +12454,7 @@ function createProjectProvenanceChecks() {
       title: ".copier-answers.yml provenance + drift report",
       audit: (ctx) => {
         const details = [];
-        const path = join11(ctx.repoRoot, ".copier-answers.yml");
+        const path = join12(ctx.repoRoot, ".copier-answers.yml");
         const text = safeReadText2(path);
         const project = readProjectJson(ctx);
         if (!text) {
@@ -12106,11 +12482,11 @@ function createProjectProvenanceChecks() {
       migrate: (ctx, finding2) => {
         const changedFiles = [];
         const project = canonicalProjectJson(ctx);
-        const path = join11(ctx.repoRoot, ".copier-answers.yml");
+        const path = join12(ctx.repoRoot, ".copier-answers.yml");
         const current = safeReadText2(path);
         const existing = current ? YAML4.parseDocument(current) : void 0;
         const document = existing && !existing.errors.length && YAML4.isMap(existing.contents) ? existing : new YAML4.Document({});
-        document.set("_src_path", join11(ctx.pjanglerRoot, "templates", "commonproject"));
+        document.set("_src_path", join12(ctx.pjanglerRoot, "templates", "commonproject"));
         document.set("project_description", String(project.project_description));
         document.set("project_name", String(project.project_name));
         document.set("ticket_provider", String(project.ticket_provider?.type ?? "plane"));
@@ -12135,9 +12511,9 @@ ${body}`;
 }
 function supportedCliProjectionIssues(repoRoot, plan) {
   const issues = [];
-  const managedSkills = join11(repoRoot, ".agents", "skills");
+  const managedSkills = join12(repoRoot, ".agents", "skills");
   for (const rootName of SUPPORTED_CLI_ROOTS) {
-    const root = join11(repoRoot, rootName);
+    const root = join12(repoRoot, rootName);
     const rootStat = lstatIfPresent(root);
     if (!rootStat) {
       issues.push(`${rootName} missing`);
@@ -12147,7 +12523,7 @@ function supportedCliProjectionIssues(repoRoot, plan) {
       issues.push(`${rootName} must be a real configuration directory`);
       continue;
     }
-    const skills = join11(root, "skills");
+    const skills = join12(root, "skills");
     const skillsStat = lstatIfPresent(skills);
     if (!skillsStat) {
       issues.push(`${rootName}/skills missing`);
@@ -12184,9 +12560,9 @@ function supportedCliProjectionIssues(repoRoot, plan) {
       issues.push(`${rootName}/skills is not a directory`);
       continue;
     }
-    const hasGeneratedSkill = existsSync8(projectedSkills) && readdirSync7(projectedSkills).some((name) => {
-      const skillFile = join11(projectedSkills, name, "SKILL.md");
-      return existsSync8(skillFile) && lstatSync9(skillFile).isFile();
+    const hasGeneratedSkill = existsSync8(projectedSkills) && readdirSync8(projectedSkills).some((name) => {
+      const skillFile = join12(projectedSkills, name, "SKILL.md");
+      return existsSync8(skillFile) && lstatSync10(skillFile).isFile();
     });
     if (!hasGeneratedSkill) issues.push(`${rootName}/skills contains no BMAD skill configuration`);
   }
@@ -12212,7 +12588,7 @@ var LEGACY_CLI_GITIGNORE_LINES = /* @__PURE__ */ new Set([
   "# some CLIs get a real directory here and some get a symlink."
 ]);
 function supportedCliGitignoreIssues(repoRoot) {
-  const lines = (safeReadText2(join11(repoRoot, ".gitignore")) ?? "").split(/\r?\n/);
+  const lines = (safeReadText2(join12(repoRoot, ".gitignore")) ?? "").split(/\r?\n/);
   const legacy = lines.filter((line) => LEGACY_CLI_GITIGNORE_LINES.has(line.trim()));
   return [
     ...legacy.length ? [`.gitignore contains ${legacy.length} legacy client-root override line(s); only .agents is canonical`] : [],
@@ -12220,7 +12596,7 @@ function supportedCliGitignoreIssues(repoRoot) {
   ];
 }
 function ensureSupportedCliGitignore(ctx) {
-  const path = join11(ctx.repoRoot, ".gitignore");
+  const path = join12(ctx.repoRoot, ".gitignore");
   const current = safeReadText2(path) ?? "";
   const kept = current.split(/\r?\n/).filter((line) => {
     const trimmed2 = line.trim();
@@ -12262,6 +12638,24 @@ function withInstallerSkillHandoff(check) {
     }
   };
 }
+function withScaffoldPostcondition(check) {
+  if (check.id !== "bmad.scaffold") return check;
+  return {
+    ...check,
+    migrate: async (ctx, finding2) => {
+      const result2 = await check.migrate(ctx, finding2);
+      if (ctx.dryRun || result2.status !== "applied" && result2.status !== "noop") return result2;
+      const after = await check.audit(ctx);
+      if (after.status === "pass" || after.status === "skip") return result2;
+      return {
+        ...result2,
+        status: "partial",
+        summary: after.summary,
+        details: [...result2.details, `still failing after the install: ${after.summary}`, ...after.details]
+      };
+    }
+  };
+}
 function createBmadChecks() {
   return [
     {
@@ -12279,15 +12673,8 @@ function createBmadChecks() {
             fixable: false
           };
         }
-        const targetRoot = join11(ctx.repoRoot, "_bmad");
         const selectedModules = manifestSelection.status === "valid" ? manifestSelection.modules : configuredBmadModuleSelection(ctx.repoRoot)?.modules ?? [...DEFAULT_BMAD_MODULES];
-        const sentinels = requiredBmadSentinels(ctx.repoRoot, selectedModules);
-        const missing = sentinels.filter((file) => !existsSync8(join11(targetRoot, file)));
-        const projectNameIssues = bmadProjectNameIssues(ctx.repoRoot);
-        const details = [
-          ...missing.map((file) => `_bmad/${file}`),
-          ...projectNameIssues.details
-        ];
+        const { details } = bmadScaffoldIssues(ctx.repoRoot, selectedModules);
         return {
           id: "bmad.scaffold",
           title: "BMAD modules/docs scaffold",
@@ -12326,7 +12713,7 @@ function createBmadChecks() {
           bmadCompanion: preservation
         };
         if (ctx.dryRun) {
-          const sentinels = requiredBmadSentinels(ctx.repoRoot, selectedModules);
+          const issues = bmadScaffoldIssues(ctx.repoRoot, selectedModules);
           const companion = installedBmad ? await runG33PreUpdateCompanion(ctx.repoRoot) : await runG33Companion(ctx.repoRoot, true, "bmad-install");
           if (installedBmad && ["unavailable", "conflict", "error"].includes(companion.status)) {
             return {
@@ -12339,8 +12726,8 @@ function createBmadChecks() {
               bmadCompanion: companion
             };
           }
-          changedFiles.push(...sentinels.map((file) => join11(ctx.repoRoot, "_bmad", file)).filter((path) => !existsSync8(path)));
-          changedFiles.push(...bmadProjectNameIssues(ctx.repoRoot).paths);
+          changedFiles.push(...issues.gaps.map((gap) => join12(ctx.repoRoot, "_bmad", gap.path)));
+          changedFiles.push(...issues.nameIssues.paths);
           const reservedPreview = installedBmad ? evictReservedModuleEntries(ctx.repoRoot, true) : void 0;
           changedFiles.push(...reservedPreview?.changedFiles ?? []);
           return {
@@ -12358,9 +12745,10 @@ function createBmadChecks() {
           };
         }
         if (installedBmad && g33CompanionEnabled(ctx.repoRoot)) {
+          const before2 = bmadScaffoldIssues(ctx.repoRoot, selectedModules);
           const expectedChangedPaths2 = [
-            ...requiredBmadSentinels(ctx.repoRoot, selectedModules).map((file) => join11(ctx.repoRoot, "_bmad", file)).filter((path) => !existsSync8(path)),
-            ...bmadProjectNameIssues(ctx.repoRoot).paths
+            ...before2.gaps.map((gap) => join12(ctx.repoRoot, "_bmad", gap.path)),
+            ...before2.nameIssues.paths
           ];
           const pkg = resolveBmadInstallerPackage(BMAD_INSTALLER_VERSION);
           const scope = deriveBmadUpdateScope(ctx.repoRoot, { tools: BMAD_INSTALL_TOOLS, installer: pkg, companionSurfaces: G33_OWNED_SURFACES });
@@ -12401,16 +12789,17 @@ function createBmadChecks() {
             bmadCompanion: update.companion
           };
         }
+        const before = bmadScaffoldIssues(ctx.repoRoot, selectedModules);
         const expectedChangedPaths = [
-          ...requiredBmadSentinels(ctx.repoRoot, selectedModules).map((file) => join11(ctx.repoRoot, "_bmad", file)).filter((path) => !existsSync8(path)),
-          ...bmadProjectNameIssues(ctx.repoRoot).paths
+          ...before.gaps.map((gap) => join12(ctx.repoRoot, "_bmad", gap.path)),
+          ...before.nameIssues.paths
         ];
         const evicted = evictLegacyBmadPackState(ctx, changedFiles, await skillActivations(ctx));
         const reserved = installedBmad ? evictReservedModuleEntries(ctx.repoRoot, false) : void 0;
         if (reserved) evicted.unshift(...reserved.details);
         const install = await runBmadInstall(ctx.repoRoot, selectedModules, BMAD_INSTALLER_VERSION, channelArgs);
         if (!install.ok && reserved?.original !== void 0) {
-          writeFileSync8(reserved.changedFiles[0], reserved.original, "utf8");
+          writeFileSync9(reserved.changedFiles[0], reserved.original, "utf8");
           evicted.push("restored _bmad/_config/manifest.yaml after the failed install");
         }
         if (!install.ok) {
@@ -12435,6 +12824,58 @@ function createBmadChecks() {
         };
       }
     },
+    {
+      id: "bmad.setup-scripts",
+      title: "BMAD ignored installer setup scripts",
+      audit: (ctx) => {
+        if (!isInstalledBmadProject(ctx.repoRoot)) return {
+          id: "bmad.setup-scripts",
+          title: "BMAD ignored installer setup scripts",
+          status: "skip",
+          summary: "No installed BMAD project",
+          details: [],
+          fixable: false
+        };
+        const state = bmadSetupScriptsState(ctx.repoRoot);
+        const id = "bmad.setup-scripts", title = "BMAD ignored installer setup scripts";
+        switch (state.kind) {
+          case "present":
+            return { id, title, status: "pass", summary: "BMAD installer scripts are present", details: [], fixable: false };
+          case "decline":
+            return { id, title, status: "skip", summary: state.summary, details: [], fixable: false };
+          case "refuse":
+            return { id, title, status: "fail", summary: state.error, details: [state.error], fixable: false };
+          case "missing":
+            return {
+              id,
+              title,
+              status: "fail",
+              summary: "Ignored BMAD installer scripts are missing",
+              details: state.files.map((path) => relative9(ctx.repoRoot, path)),
+              fixable: true
+            };
+        }
+      },
+      migrate: (ctx, finding2) => {
+        const title = finding2.title, id = finding2.id;
+        if (finding2.status === "skip") return { id, title, status: "skipped", summary: finding2.summary, details: [], changedFiles: [] };
+        const state = bmadSetupScriptsState(ctx.repoRoot);
+        if (state.kind === "decline") return { id, title, status: "skipped", summary: state.summary, details: [], changedFiles: [] };
+        if (state.kind === "refuse") return { id, title, status: "blocked", summary: state.error, details: [state.error], changedFiles: [] };
+        if (state.kind === "present") return { id, title, status: "noop", summary: "BMAD installer scripts already present", details: [], changedFiles: [] };
+        const { pkg, files } = state;
+        if (ctx.dryRun) return {
+          id,
+          title,
+          status: "applied",
+          summary: "Would restore ignored scripts from verified pinned bmad-method package",
+          details: [`bmad-method@${BMAD_INSTALLER_VERSION} (${pkg.root})`],
+          changedFiles: files
+        };
+        const applied = applyBmadSetupScripts(ctx.repoRoot, pkg, BMAD_INSTALLER_VERSION);
+        return applied.error ? { id, title, status: "blocked", summary: applied.error, details: [applied.error], changedFiles: [] } : { id, title, status: "applied", summary: "Restored ignored BMAD installer scripts", details: [`bmad-method@${BMAD_INSTALLER_VERSION} (${pkg.root})`], changedFiles: applied.files };
+      }
+    },
     {
       id: "bmad.version",
       title: "BMAD version currency",
@@ -12445,7 +12886,7 @@ function createBmadChecks() {
             id: "bmad.version",
             title: "BMAD version currency",
             status: "skip",
-            summary: existsSync8(join11(ctx.repoRoot, "_bmad")) ? "BMAD installed but version manifest unreadable" : "No BMAD install present",
+            summary: existsSync8(join12(ctx.repoRoot, "_bmad")) ? "BMAD installed but version manifest unreadable" : "No BMAD install present",
             details: [],
             fixable: false
           };
@@ -12533,7 +12974,7 @@ function createBmadChecks() {
         }
         const installed = readInstalledBmadVersion(ctx.repoRoot);
         const available = ctx.bmadVersionPin?.trim() ?? bmadChannelTarget(resolveBmadDistTags(ctx.homeDir)?.distTags)?.version;
-        const manifestPath = join11(ctx.repoRoot, "_bmad", "_config", "manifest.yaml");
+        const manifestPath = join12(ctx.repoRoot, "_bmad", "_config", "manifest.yaml");
         const manifestSelection = manifestBmadModules(ctx.repoRoot);
         if (manifestSelection.status === "invalid") {
           return {
@@ -12631,7 +13072,7 @@ function createBmadChecks() {
         const reserved = evictReservedModuleEntries(ctx.repoRoot, false);
         const install = await runBmadInstall(ctx.repoRoot, selectedModules, available ?? BMAD_TARGET_CHANNEL, channelArgs);
         if (!install.ok) {
-          if (reserved.original !== void 0) writeFileSync8(reserved.changedFiles[0], reserved.original, "utf8");
+          if (reserved.original !== void 0) writeFileSync9(reserved.changedFiles[0], reserved.original, "utf8");
           return {
             id: finding2.id,
             title: finding2.title,
@@ -12666,7 +13107,7 @@ function createBmadChecks() {
       title: "Supported BMAD CLI projection roots",
       audit: (ctx) => {
         const unsupportedNames = Object.keys(UNSUPPORTED_BMAD_ROOTS);
-        const present = unsupportedNames.filter((name) => existsSync8(join11(ctx.repoRoot, name)));
+        const present = unsupportedNames.filter((name) => existsSync8(join12(ctx.repoRoot, name)));
         const attestations = present.map((name) => ({ name, ...unsupportedRootAttestation(ctx.repoRoot, name) }));
         const plan = planSkillRoots(ctx.repoRoot);
         const supportedIssues = supportedCliProjectionIssues(ctx.repoRoot, plan);
@@ -12688,7 +13129,7 @@ function createBmadChecks() {
       },
       migrate: (ctx, finding2) => {
         const unsupportedNames = Object.keys(UNSUPPORTED_BMAD_ROOTS);
-        const present = unsupportedNames.filter((name) => existsSync8(join11(ctx.repoRoot, name)));
+        const present = unsupportedNames.filter((name) => existsSync8(join12(ctx.repoRoot, name)));
         const attestations = present.map((name) => ({ name, ...unsupportedRootAttestation(ctx.repoRoot, name) }));
         const blocked = attestations.filter((entry) => !entry.safe);
         if (blocked.length) {
@@ -12713,7 +13154,7 @@ function createBmadChecks() {
           };
         }
         const gitignoreChanges = ensureSupportedCliGitignore(ctx);
-        const removedRoots = attestations.map((entry) => join11(ctx.repoRoot, entry.name));
+        const removedRoots = attestations.map((entry) => join12(ctx.repoRoot, entry.name));
         if (!ctx.dryRun) for (const path of removedRoots) rmSync5(path, { recursive: true, force: true });
         const changedFiles = [.../* @__PURE__ */ new Set([...projectionResult.changedFiles, ...gitignoreChanges, ...removedRoots])].sort();
         return {
@@ -12726,7 +13167,7 @@ function createBmadChecks() {
         };
       }
     }
-  ].map(withInstallerSkillHandoff);
+  ].map(withInstallerSkillHandoff).map(withScaffoldPostcondition);
 }
 function createProjectMomoChecks() {
   return [
@@ -13335,8 +13776,8 @@ var NodeRecipe = class extends Recipe {
 // src/recipes/ProjectRecipe.ts
 init_project();
 import { spawnSync as spawnSync13 } from "node:child_process";
-import { existsSync as existsSync18, lstatSync as lstatSync16, readFileSync as readFileSync20, rmSync as rmSync8 } from "node:fs";
-import { dirname as dirname17, isAbsolute as isAbsolute10, join as join23, relative as relativePath, resolve as resolve18 } from "node:path";
+import { existsSync as existsSync18, lstatSync as lstatSync17, readFileSync as readFileSync21, rmSync as rmSync8 } from "node:fs";
+import { dirname as dirname17, isAbsolute as isAbsolute10, join as join24, relative as relativePath, resolve as resolve18 } from "node:path";
 
 // src/project/ticketScope.ts
 function ticketScope(ticket) {
@@ -13353,8 +13794,8 @@ init_tree_diff();
 
 // src/recipes/NotebookRecipe.ts
 init_project();
-import { existsSync as existsSync17, readFileSync as readFileSync19 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync20 } from "node:fs";
+import { join as join23 } from "node:path";
 
 // src/notebook/checks.ts
 init_config();
@@ -13362,8 +13803,8 @@ init_notes();
 init_output();
 init_state();
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync17 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync18 } from "node:fs";
+import { join as join19 } from "node:path";
 var NOTEBOOK_RULE_IDS = [
   "notebook.configuration",
   "notebook.binding",
@@ -13380,10 +13821,10 @@ function result(check, status, summary, changedFiles = [], details = []) {
   return { id: check.id, title: check.title, status, summary, changedFiles, details };
 }
 function manifestNotebook(repo) {
-  const path = join18(repo, ".project.json");
+  const path = join19(repo, ".project.json");
   if (!existsSync14(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync17(path, "utf8"));
+    const parsed = JSON.parse(readFileSync18(path, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     const notebook = parsed.notebook;
     return notebook && typeof notebook === "object" && !Array.isArray(notebook) ? notebook : null;
@@ -13612,7 +14053,7 @@ function captureAudit(ctx) {
 function overviewMigrate(ctx, current) {
   if (ctx.dryRun) return result(current, "applied", "Would reconcile drifted Project Overview note");
   if (!ctx.live) return result(current, "blocked", "Reconciling the remote Overview note requires --live");
-  const pjanglerEntry = ctx.pjanglerRoot ? join18(ctx.pjanglerRoot, "dist", "index.js") : null;
+  const pjanglerEntry = ctx.pjanglerRoot ? join19(ctx.pjanglerRoot, "dist", "index.js") : null;
   const entry = pjanglerEntry && existsSync14(pjanglerEntry) ? pjanglerEntry : "pj";
   const cmd = entry === "pj" ? ["pj"] : [process.execPath, entry];
   const spawned = spawnSync7(cmd[0], [...cmd.slice(1), "notebook", "overview", ctx.repoRoot], {
@@ -13664,7 +14105,7 @@ import { resolve as resolve17 } from "node:path";
 
 // src/notebook/journal-key.ts
 init_types();
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 function validateJournalPeriodKey(period, key) {
   if (period === "monthly") {
     if (!/^\d{4}-(?:0[1-9]|1[0-2])$/u.test(key)) throw new NotebookError("INVALID_INPUT", "Monthly period key must be YYYY-MM");
@@ -13683,7 +14124,7 @@ function validateJournalPeriodKey(period, key) {
 }
 function journalNoteOperationId(period, key) {
   validateJournalPeriodKey(period, key);
-  const bytes = createHash11("sha256").update(`pjangler-dev-journal-v1\0infra\0${period}\0${key}`).digest().subarray(0, 16);
+  const bytes = createHash12("sha256").update(`pjangler-dev-journal-v1\0infra\0${period}\0${key}`).digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 80;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = bytes.toString("hex");
@@ -13839,15 +14280,15 @@ init_notes();
 init_state();
 init_types();
 import { spawn, spawnSync as spawnSync10 } from "node:child_process";
-import { createHash as createHash12, randomUUID as randomUUID5 } from "node:crypto";
-import { chmodSync as chmodSync6, closeSync as closeSync6, constants as constants4, copyFileSync as copyFileSync3, existsSync as existsSync15, fstatSync as fstatSync3, fsyncSync as fsyncSync4, lstatSync as lstatSync15, mkdirSync as mkdirSync9, openSync as openSync6, readFileSync as readFileSync18, readSync as readSync3, readdirSync as readdirSync10, realpathSync as realpathSync10, renameSync as renameSync8, rmSync as rmSync7, symlinkSync as symlinkSync4, unlinkSync as unlinkSync8, writeFileSync as writeFileSync12 } from "node:fs";
-import { basename as basename9, dirname as dirname16, isAbsolute as isAbsolute8, join as join21, parse as parse3, relative as relative15, resolve as resolve15, sep as sep7 } from "node:path";
+import { createHash as createHash13, randomUUID as randomUUID5 } from "node:crypto";
+import { chmodSync as chmodSync6, closeSync as closeSync7, constants as constants5, copyFileSync as copyFileSync3, existsSync as existsSync15, fstatSync as fstatSync4, fsyncSync as fsyncSync4, lstatSync as lstatSync16, mkdirSync as mkdirSync10, openSync as openSync7, readFileSync as readFileSync19, readSync as readSync3, readdirSync as readdirSync11, realpathSync as realpathSync10, renameSync as renameSync8, rmSync as rmSync7, symlinkSync as symlinkSync4, unlinkSync as unlinkSync9, writeFileSync as writeFileSync13 } from "node:fs";
+import { basename as basename10, dirname as dirname16, isAbsolute as isAbsolute8, join as join22, parse as parse3, relative as relative15, resolve as resolve15, sep as sep7 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function bundledSkillCandidates() {
   const candidates = [];
   let cursor = dirname16(fileURLToPath3(import.meta.url));
   for (let depth = 0; depth < 8; depth++) {
-    candidates.push(join21(cursor, "dist", "assets", "project-notebook-skill"), join21(cursor, "assets", "project-notebook-skill"));
+    candidates.push(join22(cursor, "dist", "assets", "project-notebook-skill"), join22(cursor, "assets", "project-notebook-skill"));
     const parent = dirname16(cursor);
     if (parent === cursor) break;
     cursor = parent;
@@ -13865,14 +14306,14 @@ function assertOwnedSkillTree(source) {
   assertNoSymlinkComponents(source);
   const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
   const walk = (directory) => {
-    const directoryStat = lstatSync15(directory);
+    const directoryStat = lstatSync16(directory);
     if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Project Notebook skill source contains a non-directory component");
     if (uid !== void 0 && directoryStat.uid !== uid) throw new NotebookError("CONFLICT", "Project Notebook skill source is not owned by the current user");
     if (directoryStat.mode & 3586) throw new NotebookError("CONFLICT", "Project Notebook skill source has unsafe directory mode bits");
-    for (const entry of readdirSync10(directory, { withFileTypes: true })) {
+    for (const entry of readdirSync11(directory, { withFileTypes: true })) {
       if (entry.isDirectory() && (entry.name === "__pycache__" || entry.name === ".git" || entry.name === "node_modules")) continue;
-      const path = join21(directory, entry.name);
-      const stat = lstatSync15(path);
+      const path = join22(directory, entry.name);
+      const stat = lstatSync16(path);
       if (stat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Project Notebook skill source contains a symlink");
       if (entry.isDirectory()) walk(path);
       else if (!entry.isFile()) throw new NotebookError("CONFLICT", "Project Notebook skill source contains a non-regular entry");
@@ -13887,18 +14328,18 @@ function assertOwnedSkillTree(source) {
 function enumerateSkillPayload(source) {
   const result2 = [];
   const walk = (directory) => {
-    for (const entry of readdirSync10(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name, "en"))) {
+    for (const entry of readdirSync11(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name, "en"))) {
       if (entry.isDirectory() && (entry.name === "__pycache__" || entry.name === ".git" || entry.name === "node_modules")) continue;
-      const path = join21(directory, entry.name);
+      const path = join22(directory, entry.name);
       const rel = relative15(source, path).split(sep7).join("/");
       if (!rel.includes("/") && (rel === "export-manifest.json" || rel === "SHA256SUMS" || rel === ".source.yaml")) continue;
       if (!safeSkillRelativePath(rel)) throw new NotebookError("CONFLICT", `Project Notebook skill export path is unsafe: ${rel}`);
-      const stat = lstatSync15(path);
+      const stat = lstatSync16(path);
       if (stat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Project Notebook skill export contains a symlink");
       if (entry.isDirectory()) walk(path);
       else if (entry.isFile()) {
         const expectedMode = rel.endsWith(".sh") || rel.startsWith("scripts/") ? "0755" : "0644";
-        result2.push({ path: rel, sha256: createHash12("sha256").update(readFileSync18(path)).digest("hex"), mode: expectedMode });
+        result2.push({ path: rel, sha256: createHash13("sha256").update(readFileSync19(path)).digest("hex"), mode: expectedMode });
       } else throw new NotebookError("CONFLICT", "Project Notebook skill export contains a non-regular entry");
     }
   };
@@ -13906,9 +14347,9 @@ function enumerateSkillPayload(source) {
   return result2.sort((a, b) => a.path.localeCompare(b.path, "en"));
 }
 function parsePackedManifest(source) {
-  const manifestPath = join21(source, "export-manifest.json");
+  const manifestPath = join22(source, "export-manifest.json");
   if (!existsSync15(manifestPath)) return null;
-  const value = JSON.parse(readFileSync18(manifestPath, "utf8"));
+  const value = JSON.parse(readFileSync19(manifestPath, "utf8"));
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new NotebookError("CONFLICT", "Project Notebook skill export manifest is invalid");
   const manifest = value;
   if (manifest.schema_version !== 1 || manifest.skill !== "project-notebook" || !Array.isArray(manifest.files)) throw new NotebookError("CONFLICT", "Project Notebook skill export manifest is incompatible");
@@ -13917,10 +14358,10 @@ function parsePackedManifest(source) {
     if (!entry || typeof entry.path !== "string" || !/^[a-f0-9]{64}$/u.test(entry.sha256) || !/^(?:0644|0755)$/u.test(entry.mode)) throw new NotebookError("CONFLICT", "Project Notebook skill export entry is invalid");
     if (!safeSkillRelativePath(entry.path) || paths.has(entry.path)) throw new NotebookError("CONFLICT", "Project Notebook skill export path is unsafe or duplicated");
     paths.add(entry.path);
-    const path = join21(source, ...entry.path.split("/"));
-    const stat = lstatSync15(path);
+    const path = join22(source, ...entry.path.split("/"));
+    const stat = lstatSync16(path);
     if (!stat.isFile() || stat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Project Notebook skill export contains a non-regular entry");
-    const actual = createHash12("sha256").update(readFileSync18(path)).digest("hex");
+    const actual = createHash13("sha256").update(readFileSync19(path)).digest("hex");
     if (actual !== entry.sha256) throw new NotebookError("CONFLICT", `Project Notebook skill digest mismatch: ${entry.path}`);
     const actualMode = stat.mode & 511;
     const executable = entry.mode === "0755";
@@ -13932,16 +14373,16 @@ function parsePackedManifest(source) {
   if (JSON.stringify(actualPaths) !== JSON.stringify(manifest.files.map((entry) => entry.path))) throw new NotebookError("CONFLICT", "Project Notebook skill manifest does not exactly enumerate its payload");
   const sums = `${manifest.files.map((entry) => `${entry.sha256}  ${entry.path}`).join("\n")}
 `;
-  if (!existsSync15(join21(source, "SHA256SUMS")) || readFileSync18(join21(source, "SHA256SUMS"), "utf8") !== sums) throw new NotebookError("CONFLICT", "Project Notebook skill SHA256SUMS is missing or stale");
+  if (!existsSync15(join22(source, "SHA256SUMS")) || readFileSync19(join22(source, "SHA256SUMS"), "utf8") !== sums) throw new NotebookError("CONFLICT", "Project Notebook skill SHA256SUMS is missing or stale");
   return manifest;
 }
 function expectedPackedSkill() {
   for (const candidate of bundledSkillCandidates()) {
-    if (!existsSync15(join21(candidate, "export-manifest.json"))) continue;
+    if (!existsSync15(join22(candidate, "export-manifest.json"))) continue;
     assertOwnedSkillTree(candidate);
     const manifest = parsePackedManifest(candidate);
     if (!manifest) continue;
-    const digest = createHash12("sha256").update(JSON.stringify(manifest)).digest("hex");
+    const digest = createHash13("sha256").update(JSON.stringify(manifest)).digest("hex");
     return { source: candidate, manifest, digest };
   }
   throw new NotebookError("NOT_CONFIGURED", "PJ\xE1ngler package has no verified Project Notebook skill export");
@@ -14004,13 +14445,13 @@ function verifyProjectNotebookSkillExport(source) {
 function resolveProjectNotebookSkillSource(env2 = process.env) {
   if (env2.PJ_PROJECT_NOTEBOOK_SKILL_ROOT) {
     const explicit = resolve15(env2.PJ_PROJECT_NOTEBOOK_SKILL_ROOT);
-    if (!existsSync15(join21(explicit, "SKILL.md"))) throw new NotebookError("NOT_CONFIGURED", "Configured Project Notebook skill source is unavailable");
+    if (!existsSync15(join22(explicit, "SKILL.md"))) throw new NotebookError("NOT_CONFIGURED", "Configured Project Notebook skill source is unavailable");
     verifyProjectNotebookSkillExport(explicit);
     return explicit;
   }
   if (env2.PJ_SKILLS_REGISTRY_ROOT) {
     const canonical = resolve15(env2.PJ_SKILLS_REGISTRY_ROOT, "all-skills", "project-notebook");
-    if (existsSync15(join21(canonical, "SKILL.md"))) {
+    if (existsSync15(join22(canonical, "SKILL.md"))) {
       verifyProjectNotebookSkillExport(canonical);
       return canonical;
     }
@@ -14025,7 +14466,7 @@ var REPAIR_COMMAND = "pj notebook skill --apply";
 function probeCanonicalSkillexRootProjection(skillsRoot, link) {
   let rootLink;
   try {
-    rootLink = lstatSync15(skillsRoot);
+    rootLink = lstatSync16(skillsRoot);
   } catch (error) {
     if (error.code === "ENOENT") return { state: "absent" };
     throw error;
@@ -14038,15 +14479,15 @@ function probeCanonicalSkillexRootProjection(skillsRoot, link) {
     if (uid !== void 0 && rootLink.uid !== uid) throw new Error("owner");
     const globalRoot = realpathSync10(skillsRoot);
     assertNoSymlinkComponents(globalRoot);
-    const globalStat = lstatSync15(globalRoot);
+    const globalStat = lstatSync16(globalRoot);
     if (!globalStat.isDirectory() || globalStat.isSymbolicLink()) throw new Error("root-type");
     if (uid !== void 0 && globalStat.uid !== uid) throw new Error("root-owner");
     if (globalStat.mode & 3586) throw new Error("root-mode");
     const skillSetsRoot = dirname16(globalRoot);
-    if (basename9(globalRoot) !== "global" || basename9(skillSetsRoot) !== "skill-sets") throw new Error("layout");
+    if (basename10(globalRoot) !== "global" || basename10(skillSetsRoot) !== "skill-sets") throw new Error("layout");
     const checkoutRoot = dirname16(skillSetsRoot);
-    const expectedSource = join21(checkoutRoot, "all-skills", "project-notebook");
-    const linkStat = lstatSync15(link);
+    const expectedSource = join22(checkoutRoot, "all-skills", "project-notebook");
+    const linkStat = lstatSync16(link);
     if (!linkStat.isSymbolicLink()) throw new Error("projection-type");
     if (uid !== void 0 && linkStat.uid !== uid) throw new Error("projection-owner");
     const projectedSource = realpathSync10(link);
@@ -14080,44 +14521,44 @@ function installPackagedProjectNotebookSkill(input = {}) {
   const source = input.source ?? resolveProjectNotebookSkillSource(env2);
   if (!source) throw new NotebookError("NOT_CONFIGURED", "Project Notebook skill source is unavailable");
   const manifest = verifyProjectNotebookSkillExport(source);
-  const digest = createHash12("sha256").update(JSON.stringify(manifest)).digest("hex");
+  const digest = createHash13("sha256").update(JSON.stringify(manifest)).digest("hex");
   const home = env2.HOME;
   if (!home || !resolve15(home).startsWith("/")) throw new NotebookError("NOT_CONFIGURED", "A trusted HOME is required to install the Project Notebook skill");
-  const skillsRoot = join21(home, ".agents", "skills");
-  const link = join21(skillsRoot, "project-notebook");
+  const skillsRoot = join22(home, ".agents", "skills");
+  const link = join22(skillsRoot, "project-notebook");
   const probe = probeCanonicalSkillexRootProjection(skillsRoot, link);
   if (probe.state === "adopted") return { installed: false, path: link, digest };
   if (probe.state === "declined") return { installed: false, path: link, digest, blocked: probe.block };
-  const dataRoot = resolve15(env2.XDG_DATA_HOME || join21(home, ".local", "share"), "pjangler", "skills", "project-notebook");
-  const payload = join21(dataRoot, `${PJANGLER_VERSION}-${digest}`);
+  const dataRoot = resolve15(env2.XDG_DATA_HOME || join22(home, ".local", "share"), "pjangler", "skills", "project-notebook");
+  const payload = join22(dataRoot, `${PJANGLER_VERSION}-${digest}`);
   assertNoSymlinkComponents(dirname16(dataRoot), true);
-  mkdirSync9(dataRoot, { recursive: true, mode: 448 });
+  mkdirSync10(dataRoot, { recursive: true, mode: 448 });
   assertNoSymlinkComponents(dataRoot);
-  const dataStat = lstatSync15(dataRoot);
+  const dataStat = lstatSync16(dataRoot);
   if (!dataStat.isDirectory() || dataStat.isSymbolicLink() || typeof process.getuid === "function" && dataStat.uid !== process.getuid()) throw new NotebookError("CONFLICT", "Project Notebook skill data root is not a current-user directory");
   chmodSync6(dataRoot, 448);
   if (!existsSync15(payload)) {
-    const staging = join21(dataRoot, `.staging-${randomUUID5()}`);
-    mkdirSync9(staging, { recursive: false, mode: 448 });
+    const staging = join22(dataRoot, `.staging-${randomUUID5()}`);
+    mkdirSync10(staging, { recursive: false, mode: 448 });
     try {
       for (const entry of manifest.files) {
-        const destination = join21(staging, ...entry.path.split("/"));
-        mkdirSync9(dirname16(destination), { recursive: true, mode: 493 });
-        copyFileSync3(join21(source, ...entry.path.split("/")), destination);
+        const destination = join22(staging, ...entry.path.split("/"));
+        mkdirSync10(dirname16(destination), { recursive: true, mode: 493 });
+        copyFileSync3(join22(source, ...entry.path.split("/")), destination);
         const mode = entry.mode === "0755" ? 493 : 420;
         chmodSync6(destination, mode);
-        const fd = openSync6(destination, constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0));
+        const fd = openSync7(destination, constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0));
         try {
-          const current = fstatSync3(fd);
+          const current = fstatSync4(fd);
           if (!current.isFile()) throw new NotebookError("CONFLICT", `Installed skill entry is not regular: ${entry.path}`);
           fsyncSync4(fd);
         } finally {
-          closeSync6(fd);
+          closeSync7(fd);
         }
       }
-      writeFileSync12(join21(staging, "export-manifest.json"), `${JSON.stringify(manifest, null, 2)}
+      writeFileSync13(join22(staging, "export-manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, { mode: 420, flag: "wx" });
-      writeFileSync12(join21(staging, "SHA256SUMS"), `${manifest.files.map((entry) => `${entry.sha256}  ${entry.path}`).join("\n")}
+      writeFileSync13(join22(staging, "SHA256SUMS"), `${manifest.files.map((entry) => `${entry.sha256}  ${entry.path}`).join("\n")}
 `, { mode: 420, flag: "wx" });
       verifyProjectNotebookSkillExport(staging);
       renameSync8(staging, payload);
@@ -14125,17 +14566,17 @@ function installPackagedProjectNotebookSkill(input = {}) {
       if (existsSync15(staging)) rmSync7(staging, { recursive: true, force: true });
     }
   } else {
-    const stat = lstatSync15(payload);
+    const stat = lstatSync16(payload);
     if (!stat.isDirectory() || stat.isSymbolicLink()) throw new NotebookError("CONFLICT", "Installed Project Notebook payload is not a real directory");
     verifyProjectNotebookSkillExport(payload);
   }
   assertNoSymlinkComponents(skillsRoot, true);
-  mkdirSync9(skillsRoot, { recursive: true, mode: 448 });
+  mkdirSync10(skillsRoot, { recursive: true, mode: 448 });
   assertNoSymlinkComponents(skillsRoot);
   let linkExists = existsSync15(link);
   if (!linkExists) {
     try {
-      lstatSync15(link);
+      lstatSync16(link);
       linkExists = true;
     } catch {
     }
@@ -14152,7 +14593,7 @@ function installPackagedProjectNotebookSkill(input = {}) {
         repair: REPAIR_COMMAND
       }
     });
-    const stat = lstatSync15(link);
+    const stat = lstatSync16(link);
     if (!stat.isSymbolicLink()) return foreign(["the path is a real file or directory, not a PJ\xE1ngler-owned link"]);
     const target = realpathSync10(link);
     if (target !== realpathSync10(payload) && !isVerifiedCanonicalSkillexProjection(target)) {
@@ -14180,15 +14621,15 @@ function collectSupersededPayloads(dataRoot, keep) {
   const removed = [];
   let entries;
   try {
-    entries = readdirSync10(dataRoot);
+    entries = readdirSync11(dataRoot);
   } catch {
     return removed;
   }
   for (const name of entries) {
     if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?-[0-9a-f]{64}$/u.test(name)) continue;
-    const candidate = join21(dataRoot, name);
+    const candidate = join22(dataRoot, name);
     try {
-      const stat = lstatSync15(candidate);
+      const stat = lstatSync16(candidate);
       if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
       if (kept.has(realpathSync10(candidate))) continue;
       rmSync7(candidate, { recursive: true, force: true });
@@ -14202,8 +14643,8 @@ function repairProjectNotebookSkillProjection(input = {}) {
   const env2 = input.env ?? process.env;
   const home = env2.HOME;
   if (!home || !resolve15(home).startsWith("/")) throw new NotebookError("NOT_CONFIGURED", "A trusted HOME is required to repair the Project Notebook skill projection");
-  const skillsRoot = join21(home, ".agents", "skills");
-  const link = join21(skillsRoot, "project-notebook");
+  const skillsRoot = join22(home, ".agents", "skills");
+  const link = join22(skillsRoot, "project-notebook");
   const probe = probeCanonicalSkillexRootProjection(skillsRoot, link);
   if (probe.state === "adopted") return { status: "clean", summary: "Canonical Skillex projection already matches the version-pinned export", source: probe.source, drift: [], changed_files: [] };
   if (probe.state !== "declined") {
@@ -14216,8 +14657,8 @@ function repairProjectNotebookSkillProjection(input = {}) {
   assertOwnedSkillTree(source);
   const present = [];
   const walk = (directory) => {
-    for (const entry of readdirSync10(directory, { withFileTypes: true })) {
-      const path = join21(directory, entry.name);
+    for (const entry of readdirSync11(directory, { withFileTypes: true })) {
+      const path = join22(directory, entry.name);
       const rel = relative15(source, path).split(sep7).join("/");
       if (entry.isDirectory()) {
         walk(path);
@@ -14231,11 +14672,11 @@ function repairProjectNotebookSkillProjection(input = {}) {
   walk(source);
   const stale = present.filter((rel) => !wanted.has(rel)).sort();
   const changed = expected.manifest.files.filter((entry) => {
-    const path = join21(source, ...entry.path.split("/"));
+    const path = join22(source, ...entry.path.split("/"));
     if (!existsSync15(path)) return true;
-    const stat = lstatSync15(path);
+    const stat = lstatSync16(path);
     if (!stat.isFile()) return true;
-    if (createHash12("sha256").update(readFileSync18(path)).digest("hex") !== entry.sha256) return true;
+    if (createHash13("sha256").update(readFileSync19(path)).digest("hex") !== entry.sha256) return true;
     const mode = stat.mode & 511;
     const executable = entry.mode === "0755";
     return executable && (mode & 64) === 0 || !executable && (mode & 73) !== 0;
@@ -14250,15 +14691,15 @@ function repairProjectNotebookSkillProjection(input = {}) {
       summary: `Would restore ${affected.length} file(s) in ${source} from the version-pinned export`,
       source,
       drift: probe.block.details,
-      changed_files: affected.map((rel) => join21(source, ...rel.split("/")))
+      changed_files: affected.map((rel) => join22(source, ...rel.split("/")))
     };
   }
-  for (const rel of stale) rmSync7(join21(source, ...rel.split("/")), { force: true });
+  for (const rel of stale) rmSync7(join22(source, ...rel.split("/")), { force: true });
   for (const rel of changed) {
-    const destination = join21(source, ...rel.split("/"));
+    const destination = join22(source, ...rel.split("/"));
     const entry = expected.manifest.files.find((item) => item.path === rel);
-    mkdirSync9(dirname16(destination), { recursive: true, mode: 493 });
-    copyFileSync3(join21(expected.source, ...rel.split("/")), destination);
+    mkdirSync10(dirname16(destination), { recursive: true, mode: 493 });
+    copyFileSync3(join22(expected.source, ...rel.split("/")), destination);
     chmodSync6(destination, entry.mode === "0755" ? 493 : 420);
   }
   verifyProjectNotebookSkillExport(source);
@@ -14267,21 +14708,21 @@ function repairProjectNotebookSkillProjection(input = {}) {
     summary: `Restored ${affected.length} file(s) in ${source} from the version-pinned export; commit the change in the Skillex checkout`,
     source,
     drift: probe.block.details,
-    changed_files: affected.map((rel) => join21(source, ...rel.split("/")))
+    changed_files: affected.map((rel) => join22(source, ...rel.split("/")))
   };
 }
 function inspectProjectNotebookIntegration(env2 = process.env) {
   const home = env2.HOME;
   if (!home) return { skill_installed: false, hooks_projected: false, details: ["HOME is unavailable"] };
-  const skillsRoot = join21(home, ".agents", "skills");
-  const link = join21(skillsRoot, "project-notebook");
+  const skillsRoot = join22(home, ".agents", "skills");
+  const link = join22(skillsRoot, "project-notebook");
   try {
     const expected = expectedPackedSkill();
-    const dataRoot = resolve15(env2.XDG_DATA_HOME || join21(home, ".local", "share"), "pjangler", "skills", "project-notebook");
-    const expectedPayload = join21(dataRoot, `${PJANGLER_VERSION}-${expected.digest}`);
+    const dataRoot = resolve15(env2.XDG_DATA_HOME || join22(home, ".local", "share"), "pjangler", "skills", "project-notebook");
+    const expectedPayload = join22(dataRoot, `${PJANGLER_VERSION}-${expected.digest}`);
     const probe = probeCanonicalSkillexRootProjection(skillsRoot, link);
     if (probe.state === "declined") return { skill_installed: false, hooks_projected: false, details: probe.block.details, blocked: probe.block };
-    const stat = lstatSync15(link);
+    const stat = lstatSync16(link);
     if (!stat.isSymbolicLink()) {
       return {
         skill_installed: false,
@@ -14318,8 +14759,8 @@ function inspectProjectNotebookIntegration(env2 = process.env) {
   }
 }
 function projectorArguments(source, command, input) {
-  const script = join21(source, "scripts", "project-hooks.py");
-  const args = [script, command, "--master", join21(source, "hooks", "hooks.master.json"), "--fragment", join21(source, "hooks", "claude.settings.json"), "--target", input.target];
+  const script = join22(source, "scripts", "project-hooks.py");
+  const args = [script, command, "--master", join22(source, "hooks", "hooks.master.json"), "--fragment", join22(source, "hooks", "claude.settings.json"), "--target", input.target];
   if (command === "check") args.push("--json");
   else if (input.stateHome) args.push("--state-home", input.stateHome);
   return args;
@@ -14341,7 +14782,7 @@ function checkProjectNotebookHooks(input = {}) {
   verifyProjectNotebookSkillExport(source);
   const home = env2.HOME;
   if (!home) throw new NotebookError("NOT_CONFIGURED", "HOME is required to check Project Notebook hooks");
-  const target = resolve15(input.target ?? env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS ?? join21(home, ".claude", "settings.json"));
+  const target = resolve15(input.target ?? env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS ?? join22(home, ".claude", "settings.json"));
   const result2 = spawnSync10("/usr/bin/python3", ["-I", ...projectorArguments(source, "check", { target })], { encoding: "utf8", env: projectorEnvironment(env2), timeout: 5e3, maxBuffer: 1048576 });
   if (result2.status !== 0 && result2.status !== 1) throw new NotebookError("CONFLICT", (result2.stderr || "Project Notebook projector check failed").trim().slice(0, 512));
   try {
@@ -14359,14 +14800,14 @@ function installProjectNotebookIntegration(input = {}) {
   const source = realpathSync10(skill.path);
   const home = env2.HOME;
   if (!home) throw new NotebookError("NOT_CONFIGURED", "HOME is required to install Project Notebook hooks");
-  const target = resolve15(input.target ?? env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS ?? join21(home, ".claude", "settings.json"));
-  const stateHome = resolve15(env2.XDG_STATE_HOME || join21(home, ".local", "state"));
+  const target = resolve15(input.target ?? env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS ?? join22(home, ".claude", "settings.json"));
+  const stateHome = resolve15(env2.XDG_STATE_HOME || join22(home, ".local", "state"));
   const result2 = spawnSync10("/usr/bin/python3", ["-I", ...projectorArguments(source, "install", { target, stateHome })], { encoding: "utf8", env: projectorEnvironment(env2), timeout: 5e3, maxBuffer: 1048576 });
   if (result2.status !== 0) {
     if (skill.installed) {
       try {
-        const stat = lstatSync15(skill.path);
-        if (stat.isSymbolicLink() && realpathSync10(skill.path) === source) unlinkSync8(skill.path);
+        const stat = lstatSync16(skill.path);
+        if (stat.isSymbolicLink() && realpathSync10(skill.path) === source) unlinkSync9(skill.path);
       } catch {
       }
     }
@@ -14383,10 +14824,10 @@ function assertNoSymlinkComponents(path, allowMissing = false) {
   const root = parse3(absolute).root;
   let cursor = root;
   for (const component of absolute.slice(root.length).split(sep7).filter(Boolean)) {
-    cursor = join21(cursor, component);
+    cursor = join22(cursor, component);
     let stat;
     try {
-      stat = lstatSync15(cursor);
+      stat = lstatSync16(cursor);
     } catch (error) {
       if (allowMissing && error.code === "ENOENT") return;
       throw error;
@@ -14992,17 +15433,17 @@ init_remote_mutation_journal();
 function integrationEnvironment(module, ctx) {
   const env2 = { ...module.environment, HOME: ctx.homeDir };
   if (module.environment.HOME !== ctx.homeDir) {
-    env2.XDG_DATA_HOME = join22(ctx.homeDir, ".local", "share");
-    env2.XDG_STATE_HOME = join22(ctx.homeDir, ".local", "state");
-    env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS = join22(ctx.homeDir, ".claude", "settings.json");
+    env2.XDG_DATA_HOME = join23(ctx.homeDir, ".local", "share");
+    env2.XDG_STATE_HOME = join23(ctx.homeDir, ".local", "state");
+    env2.PJ_PROJECT_NOTEBOOK_CLAUDE_SETTINGS = join23(ctx.homeDir, ".claude", "settings.json");
   }
   return env2;
 }
 function resolvedForPlan(plan) {
-  const manifestPath = join22(plan.project.repo_path, ".project.json");
+  const manifestPath = join23(plan.project.repo_path, ".project.json");
   let manifest = plan.manifest;
   if (existsSync17(manifestPath)) {
-    const parsed = JSON.parse(readFileSync19(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync20(manifestPath, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${manifestPath} must contain a JSON object`);
     manifest = parsed;
   }
@@ -15163,7 +15604,7 @@ function unsafeToRemove(targetDir) {
   while (!seen.has(cursor)) {
     seen.add(cursor);
     try {
-      const stat = lstatSync16(cursor);
+      const stat = lstatSync17(cursor);
       if (stat.isSymbolicLink()) {
         return cursor === absolute ? `${absolute} is a symlink; removing it would leave the tree it points at orphaned` : `${cursor} is a symlink on the path to ${absolute}; a recursive remove would traverse it`;
       }
@@ -15191,12 +15632,12 @@ function publicMigration(report) {
   };
 }
 function hasGitRepository(runtime, targetDir) {
-  if (!existsSync18(join23(targetDir, ".git"))) return false;
+  if (!existsSync18(join24(targetDir, ".git"))) return false;
   return runtime.runGit(targetDir, ["rev-parse", "--is-inside-work-tree"]).status === 0;
 }
 function refreshPlanFromCanonicalManifest(plan) {
-  const manifestPath = join23(plan.project.repo_path, ".project.json");
-  const manifest = JSON.parse(readFileSync20(manifestPath, "utf8"));
+  const manifestPath = join24(plan.project.repo_path, ".project.json");
+  const manifest = JSON.parse(readFileSync21(manifestPath, "utf8"));
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
     throw new Error(`${manifestPath} must contain a JSON object`);
   }
@@ -15427,7 +15868,7 @@ var ProjectRecipe = class extends Recipe {
         if (hasGitRepository(this.runtime, targetDir)) {
           phases.push({ id: "project.git", status: "unchanged", changedFiles: [], message: "Git repository already initialized" });
         } else {
-          const gitPath = join23(targetDir, ".git");
+          const gitPath = join24(targetDir, ".git");
           for (const { args, label, options } of [
             { args: ["init", "--initial-branch=main"], label: "git init" },
             { args: ["add", "-A"], label: "git add" },
@@ -15638,12 +16079,12 @@ var ProjectRecipe = class extends Recipe {
 };
 
 // src/recipes/registry.ts
-import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join24 } from "node:path";
+import { readFileSync as readFileSync22 } from "node:fs";
+import { join as join25 } from "node:path";
 function projectWaivers(repoRoot) {
   let waive;
   try {
-    waive = JSON.parse(readFileSync21(join24(repoRoot, ".project.json"), "utf8"))?.parity?.waive;
+    waive = JSON.parse(readFileSync22(join25(repoRoot, ".project.json"), "utf8"))?.parity?.waive;
   } catch {
     return /* @__PURE__ */ new Map();
   }
@@ -15984,8 +16425,8 @@ var recipeRegistry = new RecipeRegistry([
 
 // src/commands/AgentHooksCommands.ts
 import { homedir as homedir8 } from "node:os";
-import { join as join25, dirname as dirname18 } from "node:path";
-import { existsSync as existsSync19, cpSync, mkdirSync as mkdirSync10, readFileSync as readFileSync22, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join26, dirname as dirname18 } from "node:path";
+import { existsSync as existsSync19, cpSync, mkdirSync as mkdirSync11, readFileSync as readFileSync23, writeFileSync as writeFileSync14 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 init_project();
 import { parse as parseToml4 } from "smol-toml";
@@ -15998,16 +16439,16 @@ function resolveTemplateRoot() {
   try {
     let dir = dirname18(fileURLToPath4(import.meta.url));
     for (let i = 0; i < 8; i++) {
-      candidates.push(join25(dir, "templates", "commonproject", "template"));
+      candidates.push(join26(dir, "templates", "commonproject", "template"));
       const parent = dirname18(dir);
       if (parent === dir) break;
       dir = parent;
     }
   } catch {
   }
-  candidates.push(join25(homedir8(), "code", "pjangler", "templates", "commonproject", "template"));
+  candidates.push(join26(homedir8(), "code", "pjangler", "templates", "commonproject", "template"));
   for (const c of candidates) {
-    if (existsSync19(join25(c, ".agents", "hooks", "hooks.master.json"))) return c;
+    if (existsSync19(join26(c, ".agents", "hooks", "hooks.master.json"))) return c;
   }
   throw new Error(
     "Could not locate the CommonProject template. Set PJANGLER_COMMONPROJECT_TEMPLATE to <repo>/templates/commonproject/template."
@@ -16033,15 +16474,15 @@ var CopyAgentHooksTree = class extends Command {
     const created = [];
     const skipped = [];
     for (const { rel, dir } of items) {
-      const src = join25(templateRoot, rel);
-      const dest = join25(this.context.targetDir, rel);
+      const src = join26(templateRoot, rel);
+      const dest = join26(this.context.targetDir, rel);
       if (!existsSync19(src)) continue;
       if (existsSync19(dest) && !this.context.force) {
         skipped.push(rel);
         continue;
       }
       if (!this.context.dryRun) {
-        mkdirSync10(dirname18(dest), { recursive: true });
+        mkdirSync11(dirname18(dest), { recursive: true });
         cpSync(src, dest, { recursive: dir, force: true });
       }
       created.push(rel);
@@ -16062,14 +16503,14 @@ var WireMiseAgentHooks = class _WireMiseAgentHooks extends Command {
     if (!resolveAgentHooksLayer2()) {
       return { success: true, message: this.formatMessage(AGENT_HOOKS_SKIP_MESSAGE) };
     }
-    const misePath = join25(this.context.targetDir, "mise.toml");
+    const misePath = join26(this.context.targetDir, "mise.toml");
     if (!existsSync19(misePath)) {
       return {
         success: false,
         message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pj add mise` first, then re-run."
       };
     }
-    let content = readFileSync22(misePath, "utf8");
+    let content = readFileSync23(misePath, "utf8");
     if (content.includes(_WireMiseAgentHooks.MARKER)) {
       return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for agent-hooks") };
     }
@@ -16153,7 +16594,7 @@ ${leaveBlock}`);
     if (!verdict.ok) {
       return { success: false, message: `\u26A0\uFE0F  mise.toml was not rewritten: ${verdict.reason}. Add the agent-hooks tasks by hand.` };
     }
-    if (!this.context.dryRun) writeFileSync13(misePath, content);
+    if (!this.context.dryRun) writeFileSync14(misePath, content);
     if (wiredHooks) {
       return { success: true, message: this.formatMessage("\u2705 Wired mise.toml ([hooks] enter/leave + tasks)") };
     }
@@ -16284,7 +16725,7 @@ if __name__ == "__main__":
 
 // src/commands/AddMiseCodegraphScript.ts
 import { chmodSync as chmodSync7 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var AddMiseCodegraphScript = class extends Command {
   async invoke() {
     const filePath = ".mise/scripts/codegraph.sh";
@@ -16338,7 +16779,7 @@ fi
 `;
     this.writeFile(filePath, content);
     if (!this.context.dryRun) {
-      chmodSync7(join26(this.context.targetDir, filePath), 493);
+      chmodSync7(join27(this.context.targetDir, filePath), 493);
     }
     return {
       success: true,
@@ -16376,12 +16817,12 @@ SECRET_KEY=""
 // src/parity/index.ts
 import { existsSync as existsSync20 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname19, join as join27, resolve as resolve19 } from "node:path";
+import { dirname as dirname19, join as join28, resolve as resolve19 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function resolvePjanglerRoot2() {
   let dir = dirname19(fileURLToPath5(import.meta.url));
   while (dir !== dirname19(dir)) {
-    if (existsSync20(join27(dir, "package.json")) && existsSync20(join27(dir, "templates", "commonproject", "copier.yml"))) return dir;
+    if (existsSync20(join28(dir, "package.json")) && existsSync20(join28(dir, "templates", "commonproject", "copier.yml"))) return dir;
     dir = dirname19(dir);
   }
   return resolve19(process.cwd());
@@ -16556,13 +16997,13 @@ init_version();
 // src/project/info.ts
 init_boardUrl();
 init_project();
-import { readFileSync as readFileSync23 } from "node:fs";
-import { join as join28, resolve as resolve20 } from "node:path";
+import { readFileSync as readFileSync24 } from "node:fs";
+import { join as join29, resolve as resolve20 } from "node:path";
 function readManifest2(root) {
-  const path = join28(root, ".project.json");
+  const path = join29(root, ".project.json");
   let manifest;
   try {
-    const value = JSON.parse(readFileSync23(path, "utf8"));
+    const value = JSON.parse(readFileSync24(path, "utf8"));
     if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("expected a JSON object");
     manifest = value;
   } catch (error) {
@@ -16603,7 +17044,7 @@ function readProjectInfo(input = {}) {
     ok: true,
     project_id: projectId,
     repo_path: resolve20(root),
-    manifest_path: join28(resolve20(root), ".project.json"),
+    manifest_path: join29(resolve20(root), ".project.json"),
     manifest,
     registry: { location, status: "indexed" }
   };
@@ -16631,14 +17072,14 @@ function readProjectInfo(input = {}) {
 }
 
 // src/describe/index.ts
-import { existsSync as existsSync21, readFileSync as readFileSync24, readdirSync as readdirSync11, statSync as statSync7 } from "node:fs";
-import { join as join30, resolve as resolve21 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync25, readdirSync as readdirSync12, statSync as statSync7 } from "node:fs";
+import { join as join31, resolve as resolve21 } from "node:path";
 init_project();
 
 // src/describe/activity.ts
 import { spawn as spawn2, spawnSync as spawnSync14 } from "node:child_process";
 import { statSync as statSync6 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 var ACTIVE_WINDOW_SECONDS = 24 * 60 * 60;
 var MAX_DIRTY_STATS = 500;
 var GIT_TIMEOUT_MS = 5e3;
@@ -16767,7 +17208,7 @@ function uncommittedSource(repo, paths) {
   let newest = 0;
   for (const path of paths.slice(0, MAX_DIRTY_STATS)) {
     try {
-      const mtime = Math.floor(statSync6(join29(repo, path)).mtimeMs / 1e3);
+      const mtime = Math.floor(statSync6(join30(repo, path)).mtimeMs / 1e3);
       if (mtime > newest) newest = mtime;
     } catch {
     }
@@ -16876,7 +17317,7 @@ var CONFIG_FILES = [
 ];
 function readJson(path) {
   try {
-    const parsed = JSON.parse(readFileSync24(path, "utf8"));
+    const parsed = JSON.parse(readFileSync25(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return void 0;
@@ -16898,23 +17339,23 @@ function describeType(repo) {
   const evidence = [];
   const note = (signal, file) => evidence.push(`${signal} (${file})`);
   for (const marker of LANGUAGE_MARKERS) {
-    if (!existsSync21(join30(repo, marker.file))) continue;
+    if (!existsSync21(join31(repo, marker.file))) continue;
     if (!languages.includes(marker.language)) {
       languages.push(marker.language);
       note(marker.language, marker.file);
     }
   }
   try {
-    const dotnet = readdirSync11(repo).find((entry) => entry.endsWith(".csproj") || entry.endsWith(".sln"));
+    const dotnet = readdirSync12(repo).find((entry) => entry.endsWith(".csproj") || entry.endsWith(".sln"));
     if (dotnet && !languages.includes("dotnet")) {
       languages.push("dotnet");
       note("dotnet", dotnet);
     }
   } catch {
   }
-  const pkg = readJson(join30(repo, "package.json"));
+  const pkg = readJson(join31(repo, "package.json"));
   if (pkg) {
-    if (existsSync21(join30(repo, "tsconfig.json"))) {
+    if (existsSync21(join31(repo, "tsconfig.json"))) {
       const index = languages.indexOf("javascript");
       if (index >= 0) languages.splice(index, 1);
       if (!languages.includes("typescript")) {
@@ -16948,14 +17389,14 @@ function describeType(repo) {
     ["hermes-fleet-host", "agents/hermes"]
   ];
   for (const [role, marker] of roleMarkers) {
-    if (!existsSync21(join30(repo, marker))) continue;
+    if (!existsSync21(join31(repo, marker))) continue;
     roles.push(role);
     note(role, marker);
   }
   return { primaryLanguage: languages[0], languages, roles, evidence };
 }
 function describeIdentity(repo, registryPath) {
-  const manifestPath = join30(repo, ".project.json");
+  const manifestPath = join31(repo, ".project.json");
   const manifest = readJson(manifestPath);
   const drift = [];
   let record3;
@@ -17048,12 +17489,12 @@ function describeSubsystems(repo, findings) {
     const markers = SUBSYSTEM_MARKERS[metadata.id] ?? [];
     const evidence = metadata.id === "notebook" ? (() => {
       try {
-        const manifest = JSON.parse(readFileSync24(join30(repo, ".project.json"), "utf8"));
+        const manifest = JSON.parse(readFileSync25(join31(repo, ".project.json"), "utf8"));
         return manifest.notebook && typeof manifest.notebook === "object" ? [".project.json#notebook"] : [];
       } catch {
         return [];
       }
-    })() : markers.filter((marker) => existsSync21(join30(repo, marker)));
+    })() : markers.filter((marker) => existsSync21(join31(repo, marker)));
     const rules = (byRecipe.get(metadata.id) ?? []).map((finding2) => ({
       id: finding2.id,
       title: finding2.title,
@@ -17072,7 +17513,7 @@ function describeNotebook(repo, registryPath) {
   try {
     const registry = loadProjectRegistry(registryPath);
     const project = Object.values(registry.projects).find((entry) => resolve21(entry.repo_path) === resolve21(repo));
-    const manifest = existsSync21(join30(repo, ".project.json")) ? JSON.parse(readFileSync24(join30(repo, ".project.json"), "utf8")) : void 0;
+    const manifest = existsSync21(join31(repo, ".project.json")) ? JSON.parse(readFileSync25(join31(repo, ".project.json"), "utf8")) : void 0;
     const declared = Boolean(project?.notebook || manifest?.notebook && typeof manifest.notebook === "object");
     if (!declared) return { declared: false, bindingState: null, notebookId: null, overviewNoteId: null, health: null, remoteCheck: "skip", captureAdmission: null };
     const config = loadEffectiveNotebookConfig(repo, registryPath);
@@ -17090,7 +17531,7 @@ function describeNotebook(repo, registryPath) {
   }
 }
 function describeConfigFiles(repo) {
-  return CONFIG_FILES.filter((spec) => existsSync21(join30(repo, spec.path))).map((spec) => ({ path: spec.path, purpose: spec.purpose, subsystem: spec.subsystem }));
+  return CONFIG_FILES.filter((spec) => existsSync21(join31(repo, spec.path))).map((spec) => ({ path: spec.path, purpose: spec.purpose, subsystem: spec.subsystem }));
 }
 function describeNextSteps(description, findings) {
   const steps = [];
@@ -17369,7 +17810,7 @@ function resolveTargetDir(targetDir) {
 function resolvePjanglerRoot3() {
   let dir = dirname20(fileURLToPath6(import.meta.url));
   while (dir !== dirname20(dir)) {
-    if (existsSync22(join31(dir, "package.json")) && existsSync22(join31(dir, "templates", "commonproject", "copier.yml"))) {
+    if (existsSync22(join32(dir, "package.json")) && existsSync22(join32(dir, "templates", "commonproject", "copier.yml"))) {
       return dir;
     }
     dir = dirname20(dir);
@@ -17669,7 +18110,7 @@ server.registerTool(
       if (!existsSync22(parentDir) || !statSync8(parentDir).isDirectory()) throw new Error(`Parent directory does not exist: ${parentDir}`);
       const targetDir = resolveContainedPath(
         parentDir,
-        explicitTargetDir ?? join31(parentDir, projectSlug),
+        explicitTargetDir ?? join32(parentDir, projectSlug),
         "Bootstrap target"
       );
       const overwrite = input.overwrite ?? input.force ?? false;
@@ -17792,7 +18233,7 @@ server.registerTool(
         registryPath: input.registryPath,
         force: input.force ?? false,
         overwrite: input.force ?? false,
-        scaffold: !(input.targetDir && existsSync22(join31(resolve22(input.targetDir), ".git")))
+        scaffold: !(input.targetDir && existsSync22(join32(resolve22(input.targetDir), ".git")))
       });
       if (!input.apply) return asText(publicCompositeProjectResponse(publicProjectPlan(plan), plan));
       const preflight = await preflightProjectApply(plan, resolvePjanglerRoot3());