@duo-director/cli 0.3.0-rc.3 → 0.3.0-rc.5

package/dist/{cli-DJGVC2WO.js → cli-3KHF55G7.js}

@@ -161,6 +161,8 @@ var DIAGNOSTIC_SEVERITY = {
   DECISION_CONFIRM_PREVIEW_CHANGED: "error",
   /** A confirmed Decision's lock.digest does not match its content fields (a detection aid, not a signature). */
   DECISION_LOCK_MISMATCH: "warning",
+  /** T44 (F-07): a confirm session refused a proposal whose result depends on an earlier proposal of the same session. */
+  DECISION_SESSION_CONFLICT: "error",
   /** T40 (N1): an authoritative operation refused partial Project Truth; the loader errors follow it. */
   PROJECT_TRUTH_INVALID: "error",
   /** A SourceLocation that does not address its canonical source text (a producer bug, T09.1). */
@@ -303,6 +305,7 @@ var DIAGNOSTIC_PERSISTENCE = {
   DECISION_SUPERSEDE_TARGET_INVALID: T,
   DECISION_LOCK_BUSY: T,
   DECISION_CONFIRM_PREVIEW_CHANGED: T,
+  DECISION_SESSION_CONFLICT: T,
   PROJECT_TRUTH_INVALID: T,
   DECISION_LOCK_MISMATCH: P,
   SOURCE_LOCATION_INVALID: P,
@@ -432,10 +435,10 @@ function parseCompatibleBaseUrl(raw) {
     return { problem: "insecure-http" };
   if (isOfficialOpenAIHost(url.hostname))
     return { problem: "official-openai" };
-  const path35 = url.pathname.replace(/\/+$/u, "");
-  if (path35.includes("//"))
+  const path36 = url.pathname.replace(/\/+$/u, "");
+  if (path36.includes("//"))
     return { problem: "empty-path-segment" };
-  return { value: { baseUrl: `${url.origin}${path35}`, origin: url.origin } };
+  return { value: { baseUrl: `${url.origin}${path36}`, origin: url.origin } };
 }
 var COMPATIBLE_BASE_URL_PROBLEMS = {
   "not-absolute": "must be an absolute URL (https://host/path)",
@@ -537,8 +540,8 @@ function compileRepoPattern(pattern) {
   const regex = new RegExp(`${source}$`, "u");
   return (p) => regex.test(p);
 }
-function portablePathKey(path35) {
-  return path35.normalize("NFC").toLowerCase();
+function portablePathKey(path36) {
+  return path36.normalize("NFC").toLowerCase();
 }
 function findPathPortabilityCollisions(paths) {
   const groups = /* @__PURE__ */ new Map();
@@ -582,14 +585,14 @@ function isDefinitionId(value) {
 function definitionRef(type, id3) {
   return { type, id: id3 };
 }
-function fileRef(path35) {
-  return { type: "file", path: path35 };
+function fileRef(path36) {
+  return { type: "file", path: path36 };
 }
-function symbolRef(path35, symbol) {
-  return { type: "symbol", path: path35, symbol };
+function symbolRef(path36, symbol) {
+  return { type: "symbol", path: path36, symbol };
 }
-function testRef(path35, name) {
-  return { type: "test", path: path35, name };
+function testRef(path36, name) {
+  return { type: "test", path: path36, name };
 }
 var ESCAPED = /[%#\u0000-\u001F\u007F]/g;
 var ESCAPED_ONE = /^[%#\u0000-\u001F\u007F]$/;
@@ -640,18 +643,18 @@ function parseNodeId(value) {
   if (type === "project")
     return body === "root" ? PROJECT_REF : void 0;
   if (type === "file") {
-    const path35 = body.includes("#") ? void 0 : decodePath(body);
-    return path35 === void 0 ? void 0 : fileRef(path35);
+    const path36 = body.includes("#") ? void 0 : decodePath(body);
+    return path36 === void 0 ? void 0 : fileRef(path36);
   }
   if (type === "symbol" || type === "test") {
     const parts = body.split("#");
     if (parts.length !== 2)
       return void 0;
-    const path35 = decodePath(parts[0] ?? "");
+    const path36 = decodePath(parts[0] ?? "");
     const name = decodeComponent(parts[1] ?? "");
-    if (path35 === void 0 || name === void 0 || name === "")
+    if (path36 === void 0 || name === void 0 || name === "")
       return void 0;
-    return type === "symbol" ? symbolRef(path35, name) : testRef(path35, name);
+    return type === "symbol" ? symbolRef(path36, name) : testRef(path36, name);
   }
   const id3 = body.includes("#") ? void 0 : decodeComponent(body);
   return id3 !== void 0 && isDefinitionId(id3) ? definitionRef(type, id3) : void 0;
@@ -737,33 +740,33 @@ function checkWriteBoundary(repositoryRoot, targetPath, writeKind, options = {})
     const outside = normalized.diagnostics.some((d) => d.code === "PATH_OUTSIDE_REPOSITORY");
     return failure(outside ? [createDiagnostic("WRITE_OUTSIDE_REPOSITORY", `Refusing to write "${targetPath}": it is outside the repository`)] : normalized.diagnostics);
   }
-  const path35 = normalized.value;
+  const path36 = normalized.value;
   const prefix = `${STATE_DIR_NAME}/`;
   if (writeKind === "agent-integration") {
-    return AGENT_INTEGRATION_FILES.includes(path35) ? success({ path: path35, kind: writeKind, area: path35 }) : failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path35}" as agent-integration: only ${AGENT_INTEGRATION_FILES.join(", ")}`, { path: path35 })]);
+    return AGENT_INTEGRATION_FILES.includes(path36) ? success({ path: path36, kind: writeKind, area: path36 }) : failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path36}" as agent-integration: only ${AGENT_INTEGRATION_FILES.join(", ")}`, { path: path36 })]);
   }
-  if (!path35.startsWith(prefix)) {
-    return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path35}": DUO writes only under ${prefix} and never writes project source code`, { path: path35 })]);
+  if (!path36.startsWith(prefix)) {
+    return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path36}": DUO writes only under ${prefix} and never writes project source code`, { path: path36 })]);
   }
-  const inner = path35.slice(prefix.length);
+  const inner = path36.slice(prefix.length);
   const kinds = Object.keys(WRITE_AREAS);
   const found = kinds.flatMap((kind) => WRITE_AREAS[kind].filter((a) => matches(inner, a)).map((area) => ({ kind, area })))[0];
   if (found === void 0) {
-    return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path35}": not a ${prefix} write area`, { path: path35 })]);
+    return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path36}": not a ${prefix} write area`, { path: path36 })]);
   }
   if (found.kind !== writeKind) {
-    return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path35}" as ${writeKind}: ${prefix}${found.area} holds ${found.kind} data`, { path: path35 })]);
+    return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path36}" as ${writeKind}: ${prefix}${found.area} holds ${found.kind} data`, { path: path36 })]);
   }
   if (options.restrictTo !== void 0) {
     const allowed = options.restrictTo.some((r) => {
       const p = normalizeRepoPattern(r).value;
-      return p !== void 0 && (p.endsWith("/") ? path35.startsWith(p) && path35.length > p.length : path35 === p);
+      return p !== void 0 && (p.endsWith("/") ? path36.startsWith(p) && path36.length > p.length : path36 === p);
     });
     if (!allowed) {
-      return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path35}": outside the paths allowed for this caller`, { path: path35 })]);
+      return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${path36}": outside the paths allowed for this caller`, { path: path36 })]);
     }
   }
-  return success({ path: path35, kind: writeKind, area: prefix + found.area });
+  return success({ path: path36, kind: writeKind, area: prefix + found.area });
 }
 
 // packages/core/dist/fs-guard.js
@@ -898,12 +901,12 @@ function paragraphLines(p) {
     visit2(child);
   return { detect: detect.split("\n"), display: display.split("\n") };
 }
-function parseMarkdown(path35, text4) {
+function parseMarkdown(path36, text4) {
   let tree;
   try {
     tree = fromMarkdown(text4, { extensions: [frontmatter(["yaml"])], mdastExtensions: [frontmatterFromMarkdown(["yaml"])] });
   } catch (error) {
-    return failure([createDiagnostic("MARKDOWN_PARSE_ERROR", String(error), { path: path35 })]);
+    return failure([createDiagnostic("MARKDOWN_PARSE_ERROR", String(error), { path: path36 })]);
   }
   const lineStarts3 = [0];
   for (let i = 0; i < text4.length; i++)
@@ -926,7 +929,7 @@ function parseMarkdown(path35, text4) {
     const stop = Math.max(start2, end2);
     const el = lineAt(stop);
     return {
-      path: path35,
+      path: path36,
       startLine: sl,
       startColumn: start2 - (lineStarts3[sl - 1] ?? 0) + 1,
       endLine: el,
@@ -1022,7 +1025,7 @@ function parseMarkdown(path35, text4) {
   };
   walk3(tree);
   return success({
-    path: path35,
+    path: path36,
     length: text4.length,
     lineCount: lineStarts3.length,
     frontmatter: front,
@@ -1039,16 +1042,16 @@ function parseMarkdown(path35, text4) {
 // packages/core/dist/provenance.js
 var MARKDOWN = /\.(?:md|markdown|mdx)$/iu;
 var SCHEME = /^(?:[A-Za-z][A-Za-z0-9+.-]+:|\/\/)/u;
-function isRemoteSourcePath(path35) {
-  return SCHEME.test(path35);
+function isRemoteSourcePath(path36) {
+  return SCHEME.test(path36);
 }
-function externalSourceSlice(path35, rawText, section) {
+function externalSourceSlice(path36, rawText, section) {
   const text4 = canonicalSourceText(rawText);
   if (section === void 0)
-    return { status: "ok", text: text4, hash: sha256Text(text4), location: { path: path35 } };
-  if (!MARKDOWN.test(path35))
+    return { status: "ok", text: text4, hash: sha256Text(text4), location: { path: path36 } };
+  if (!MARKDOWN.test(path36))
     return { status: "section-unsupported" };
-  const doc = parseMarkdown(path35, text4).value;
+  const doc = parseMarkdown(path36, text4).value;
   if (doc === void 0)
     return { status: "section-missing" };
   const headings = doc.blocks.flatMap((b) => b.kind === "heading" ? [b] : []);
@@ -1143,16 +1146,16 @@ function parseYaml(input) {
   } catch (error) {
     return failure([...diagnostics, createDiagnostic("YAML_SYNTAX_ERROR", String(error), at(0))]);
   }
-  const locate = (path35, target = "value") => {
-    if (target === "key" && path35.length > 0) {
-      const parent = path35.length > 1 ? doc.getIn(path35.slice(0, -1), true) : doc.contents;
-      const key2 = path35[path35.length - 1];
+  const locate = (path36, target = "value") => {
+    if (target === "key" && path36.length > 0) {
+      const parent = path36.length > 1 ? doc.getIn(path36.slice(0, -1), true) : doc.contents;
+      const key2 = path36[path36.length - 1];
       if (!isMap(parent))
         return void 0;
       const pair = parent.items.find((item) => (isScalar(item.key) ? item.key.value : item.key) === key2);
       return pair && isNode(pair.key) ? rangeOf(pair.key) : void 0;
     }
-    const node = path35.length === 0 ? doc.contents : doc.getIn(path35, true);
+    const node = path36.length === 0 ? doc.contents : doc.getIn(path36, true);
     return isNode(node) ? rangeOf(node) : void 0;
   };
   return success({ data, locate }, diagnostics);
@@ -1230,7 +1233,7 @@ var ProjectConfigSchema = z.strictObject({
   extensions
 });
 function checkLlmConfig(llm, ctx) {
-  const issue = (path35, message2) => ctx.addIssue({ code: "custom", path: [path35], message: message2 });
+  const issue = (path36, message2) => ctx.addIssue({ code: "custom", path: [path36], message: message2 });
   if (llm.provider === "openai-compatible") {
     const required = "is required for provider openai-compatible (no default)";
     if (llm.model === void 0 || llm.model === null || llm.model.trim() === "")
@@ -1299,6 +1302,8 @@ var issueShape = {
   requirements: ids().optional(),
   decisions: ids().optional(),
   depends_on: ids().optional(),
+  /** H-78 (T45): the repository path scope this Issue declares it implements (relevance / traceability only). Paths only. */
+  implements: z.strictObject({ paths: texts().optional() }).optional(),
   extensions
 };
 var IssueBlockSchema = z.strictObject({ type: z.literal("issue"), ...issueShape });
@@ -1370,9 +1375,9 @@ var MilestoneFileSchema = z.strictObject({
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function valueAt(data, path35) {
+function valueAt(data, path36) {
   let current = data;
-  for (const key2 of path35) {
+  for (const key2 of path36) {
     if (Array.isArray(current) && typeof key2 === "number")
       current = current[key2];
     else if (isRecord(current) && typeof key2 === "string")
@@ -1382,36 +1387,36 @@ function valueAt(data, path35) {
   }
   return current;
 }
-function describe(path35) {
-  if (path35.length === 0)
+function describe(path36) {
+  if (path36.length === 0)
     return "(root)";
-  return path35.map((k, i) => typeof k === "number" ? `[${k}]` : i === 0 ? k : `.${k}`).join("");
+  return path36.map((k, i) => typeof k === "number" ? `[${k}]` : i === 0 ? k : `.${k}`).join("");
 }
 function validateData(schema, yaml2, fallback) {
   const result = schema.safeParse(yaml2.data);
   if (result.success)
     return success(result.data);
   const diagnostics = [];
-  const where = (path35, target = "value") => yaml2.locate(path35, target) ?? fallback;
+  const where = (path36, target = "value") => yaml2.locate(path36, target) ?? fallback;
   for (const issue of result.error.issues) {
-    const path35 = issue.path.filter((k) => typeof k === "string" || typeof k === "number");
+    const path36 = issue.path.filter((k) => typeof k === "string" || typeof k === "number");
     if (issue.code === "unrecognized_keys") {
       for (const key2 of issue.keys) {
-        diagnostics.push(createDiagnostic("SCHEMA_UNKNOWN_PROPERTY", `Unknown property "${describe([...path35, key2])}". Put custom data under "extensions".`, where([...path35, key2], "key")));
+        diagnostics.push(createDiagnostic("SCHEMA_UNKNOWN_PROPERTY", `Unknown property "${describe([...path36, key2])}". Put custom data under "extensions".`, where([...path36, key2], "key")));
       }
       continue;
     }
-    const value = valueAt(yaml2.data, path35);
-    const parent = valueAt(yaml2.data, path35.slice(0, -1));
-    const last = path35[path35.length - 1];
+    const value = valueAt(yaml2.data, path36);
+    const parent = valueAt(yaml2.data, path36.slice(0, -1));
+    const last = path36[path36.length - 1];
     if (issue.code === "invalid_type" && value === void 0 && typeof last === "string" && isRecord(parent) && !(last in parent)) {
-      diagnostics.push(createDiagnostic("SCHEMA_MISSING_PROPERTY", `Missing required property "${describe(path35)}"`, where(path35.slice(0, -1))));
+      diagnostics.push(createDiagnostic("SCHEMA_MISSING_PROPERTY", `Missing required property "${describe(path36)}"`, where(path36.slice(0, -1))));
     } else if (issue.message === INVALID_ID_MESSAGE) {
-      diagnostics.push(createDiagnostic("INVALID_ID", `${describe(path35)}: "${String(value)}" is not a valid ID`, where(path35)));
-    } else if (path35.length === 0 && !isRecord(yaml2.data)) {
-      diagnostics.push(createDiagnostic("SCHEMA_INVALID_VALUE", "Expected a mapping of properties", where(path35)));
+      diagnostics.push(createDiagnostic("INVALID_ID", `${describe(path36)}: "${String(value)}" is not a valid ID`, where(path36)));
+    } else if (path36.length === 0 && !isRecord(yaml2.data)) {
+      diagnostics.push(createDiagnostic("SCHEMA_INVALID_VALUE", "Expected a mapping of properties", where(path36)));
     } else {
-      diagnostics.push(createDiagnostic("SCHEMA_INVALID_VALUE", `${describe(path35)}: ${issue.message}`, where(path35)));
+      diagnostics.push(createDiagnostic("SCHEMA_INVALID_VALUE", `${describe(path36)}: ${issue.message}`, where(path36)));
     }
   }
   return failure(diagnostics);
@@ -1435,32 +1440,32 @@ var MapContext = class _MapContext {
     this.diagnostics = diagnostics;
     this.base = base;
   }
-  at(path35) {
-    return this.yaml.locate([...this.base, ...path35]) ?? this.fallback;
+  at(path36) {
+    return this.yaml.locate([...this.base, ...path36]) ?? this.fallback;
   }
   child(base) {
     return new _MapContext(this.yaml, this.at(base), this.diagnostics, [...this.base, ...base]);
   }
-  ref(field, path35, target, expected, relation) {
-    this.references.push({ field, target, expected, relation, location: this.at(path35) });
+  ref(field, path36, target, expected, relation) {
+    this.references.push({ field, target, expected, relation, location: this.at(path36) });
   }
-  refs(field, path35, targets, expected, relation) {
+  refs(field, path36, targets, expected, relation) {
     const list3 = targets ?? [];
-    list3.forEach((t2, i) => this.ref(field, [...path35, i], t2, expected, relation));
+    list3.forEach((t2, i) => this.ref(field, [...path36, i], t2, expected, relation));
     return list3;
   }
-  patterns(path35, values) {
+  patterns(path36, values) {
     const out = [];
     (values ?? []).forEach((v, i) => {
       const r = normalizeRepoPattern(v);
       if (r.value !== void 0)
         out.push(r.value);
       for (const d of r.diagnostics)
-        this.diagnostics.push(withSource(d, this.at([...path35, i])));
+        this.diagnostics.push(withSource(d, this.at([...path36, i])));
     });
     return out;
   }
-  sources(path35, values) {
+  sources(path36, values) {
     const out = [];
     (values ?? []).forEach((v, i) => {
       if (typeof v === "string") {
@@ -1469,20 +1474,20 @@ var MapContext = class _MapContext {
       }
       const r = normalizeRepoPath(v.path);
       for (const d of r.diagnostics)
-        this.diagnostics.push(withSource(d, this.at([...path35, i, "path"])));
+        this.diagnostics.push(withSource(d, this.at([...path36, i, "path"])));
       if (r.value !== void 0)
         out.push({ kind: "external", path: r.value, hash: v.hash, section: v.section });
     });
     return out;
   }
-  evidence(path35, values) {
+  evidence(path36, values) {
     const out = [];
     (values ?? []).forEach((v, i) => {
       let repoPath3;
       if (v.path !== void 0) {
         const r = normalizeRepoPath(v.path);
         for (const d of r.diagnostics)
-          this.diagnostics.push(withSource(d, this.at([...path35, i, "path"])));
+          this.diagnostics.push(withSource(d, this.at([...path36, i, "path"])));
         repoPath3 = r.value;
       }
       out.push({
@@ -1576,6 +1581,7 @@ function mapIssue(id3, title, description, location4, d, acceptance, ctx) {
     requirements: ctx.refs("requirements", ["requirements"], d.requirements, "requirement", { type: "TRACKED_BY", direction: "incoming" }),
     decisions: ctx.refs("decisions", ["decisions"], d.decisions, "decision", { type: "GOVERNS", direction: "incoming" }),
     dependsOn: ctx.refs("depends_on", ["depends_on"], d.depends_on, "issue", { type: "REQUIRES", direction: "outgoing" }),
+    implements: { paths: ctx.patterns(["implements", "paths"], d.implements?.paths) },
     references: ctx.references,
     extensions: d.extensions ?? {}
   };
@@ -1817,8 +1823,8 @@ function parseDefinitionDocument(doc) {
   out.gaps.push(...declaredGapsOf(doc, sections));
   return { value: out, diagnostics };
 }
-function parseDefinitionMarkdown(path35, text4) {
-  const md = parseMarkdown(path35, text4);
+function parseDefinitionMarkdown(path36, text4) {
+  const md = parseMarkdown(path36, text4);
   if (md.value === void 0)
     return { diagnostics: md.diagnostics };
   const defs = parseDefinitionDocument(md.value);
@@ -1829,16 +1835,16 @@ function parseDefinitionMarkdown(path35, text4) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function parseFile(path35, text4) {
-  const parsed = parseYaml({ path: path35, text: text4 });
+function parseFile(path36, text4) {
+  const parsed = parseYaml({ path: path36, text: text4 });
   const diagnostics = [...parsed.diagnostics];
   if (parsed.value === void 0)
-    return { diagnostics, whole: { path: path35, startLine: 1 } };
-  const whole = parsed.value.locate([]) ?? { path: path35, startLine: 1 };
+    return { diagnostics, whole: { path: path36, startLine: 1 } };
+  const whole = parsed.value.locate([]) ?? { path: path36, startLine: 1 };
   return { yaml: parsed.value, diagnostics, whole };
 }
-function parseProjectConfig(path35, text4) {
-  const { yaml: yaml2, diagnostics, whole } = parseFile(path35, text4);
+function parseProjectConfig(path36, text4) {
+  const { yaml: yaml2, diagnostics, whole } = parseFile(path36, text4);
   if (yaml2 === void 0)
     return failure(diagnostics);
   const version = isRecord3(yaml2.data) ? yaml2.data["schema_version"] : void 0;
@@ -1853,8 +1859,8 @@ function parseProjectConfig(path35, text4) {
   const config = mapProjectConfig(valid.value, new MapContext(yaml2, whole, diagnostics));
   return { value: config, diagnostics };
 }
-function parseDecisionFile(path35, text4) {
-  const { yaml: yaml2, diagnostics, whole } = parseFile(path35, text4);
+function parseDecisionFile(path36, text4) {
+  const { yaml: yaml2, diagnostics, whole } = parseFile(path36, text4);
   if (yaml2 === void 0)
     return failure(diagnostics);
   const valid = validateData(DecisionSchema, yaml2, whole);
@@ -1863,8 +1869,8 @@ function parseDecisionFile(path35, text4) {
     return failure(diagnostics);
   return { value: mapDecision(valid.value, whole, new MapContext(yaml2, whole, diagnostics)), diagnostics };
 }
-function parseProposalFile(path35, text4) {
-  const { yaml: yaml2, diagnostics, whole } = parseFile(path35, text4);
+function parseProposalFile(path36, text4) {
+  const { yaml: yaml2, diagnostics, whole } = parseFile(path36, text4);
   if (yaml2 === void 0)
     return failure(diagnostics);
   const valid = validateData(ProposalSchema, yaml2, whole);
@@ -1873,8 +1879,8 @@ function parseProposalFile(path35, text4) {
     return failure(diagnostics);
   return { value: mapProposal(valid.value, whole, new MapContext(yaml2, whole, diagnostics)), diagnostics };
 }
-function parseConstraintsFile(path35, text4) {
-  const { yaml: yaml2, diagnostics, whole } = parseFile(path35, text4);
+function parseConstraintsFile(path36, text4) {
+  const { yaml: yaml2, diagnostics, whole } = parseFile(path36, text4);
   if (yaml2 === void 0)
     return failure(diagnostics);
   const valid = validateData(ConstraintsFileSchema, yaml2, whole);
@@ -1885,8 +1891,8 @@ function parseConstraintsFile(path35, text4) {
   const constraints = valid.value.constraints.map((c, i) => mapConstraint(c, root.child(["constraints", i])));
   return { value: constraints, diagnostics };
 }
-function parseMilestoneFile(path35, text4) {
-  const { yaml: yaml2, diagnostics, whole } = parseFile(path35, text4);
+function parseMilestoneFile(path36, text4) {
+  const { yaml: yaml2, diagnostics, whole } = parseFile(path36, text4);
   if (yaml2 === void 0)
     return failure(diagnostics);
   const valid = validateData(MilestoneFileSchema, yaml2, whole);
@@ -1896,17 +1902,17 @@ function parseMilestoneFile(path35, text4) {
   const d = valid.value;
   return { value: mapMilestone(d.id, d.title, d.state, d.issues, whole, d.extensions, new MapContext(yaml2, whole, diagnostics)), diagnostics };
 }
-function parseVisionFile(path35, text4) {
-  const md = parseMarkdown(path35, text4);
+function parseVisionFile(path36, text4) {
+  const md = parseMarkdown(path36, text4);
   const diagnostics = [...md.diagnostics];
   const doc = md.value;
   if (doc === void 0)
     return failure(diagnostics);
   if (doc.frontmatter === void 0) {
-    diagnostics.push(createDiagnostic("SCHEMA_MISSING_PROPERTY", 'vision.md needs YAML frontmatter with "status"', { path: path35, startLine: 1 }));
+    diagnostics.push(createDiagnostic("SCHEMA_MISSING_PROPERTY", 'vision.md needs YAML frontmatter with "status"', { path: path36, startLine: 1 }));
     return failure(diagnostics);
   }
-  const parsed = parseYaml({ path: path35, text: doc.frontmatter.value, startLine: doc.frontmatter.contentStartLine });
+  const parsed = parseYaml({ path: path36, text: doc.frontmatter.value, startLine: doc.frontmatter.contentStartLine });
   diagnostics.push(...parsed.diagnostics);
   if (parsed.value === void 0)
     return failure(diagnostics);
@@ -2408,7 +2414,7 @@ function alive(pid) {
 }
 function createDecisionService(options) {
   const root = options.root;
-  const fs28 = options.fs ?? nodeDecisionFileSystem;
+  const fs29 = options.fs ?? nodeDecisionFileSystem;
   const clock = options.clock ?? (() => /* @__PURE__ */ new Date());
   const now = () => clock().toISOString();
   const forbidden = (actor, op) => {
@@ -2425,18 +2431,18 @@ function createDecisionService(options) {
     const file = lock.value.absolute;
     const deadline = Date.now() + (options.lockTimeoutMs ?? 5e3);
     for (; ; ) {
-      if (await fs28.createExclusive(file, JSON.stringify({ pid: process.pid, host: os.hostname(), acquiredAt: now() })))
+      if (await fs29.createExclusive(file, JSON.stringify({ pid: process.pid, host: os.hostname(), acquiredAt: now() })))
         break;
       let owner;
       try {
-        owner = JSON.parse(await fs28.readText(file) ?? "null");
+        owner = JSON.parse(await fs29.readText(file) ?? "null");
       } catch {
         owner = void 0;
       }
       if (owner === null)
         continue;
       if (typeof owner?.pid === "number" && owner.host === os.hostname() && !alive(owner.pid)) {
-        await fs28.remove(file);
+        await fs29.remove(file);
         continue;
       }
       if (Date.now() >= deadline)
@@ -2446,7 +2452,7 @@ function createDecisionService(options) {
     try {
       return await fn();
     } finally {
-      await fs28.remove(file);
+      await fs29.remove(file);
     }
   }
   function load(complete = true) {
@@ -2455,17 +2461,17 @@ function createDecisionService(options) {
     return loaded.value === void 0 ? failure(loaded.diagnostics) : success(loaded.value.truth, loaded.diagnostics);
   }
   const isServiceFile = (d) => d.location.path === decisionPath(d.id);
-  function traceErrors(truth, id3, path35, change) {
-    const decisions = change.decision === void 0 ? truth.decisions : [...truth.decisions.filter((d) => d.location.path !== path35), change.decision];
-    const proposals = change.proposal === void 0 ? truth.proposals : [...truth.proposals.filter((p) => p.location.path !== path35), change.proposal];
+  function traceErrors(truth, id3, path36, change) {
+    const decisions = change.decision === void 0 ? truth.decisions : [...truth.decisions.filter((d) => d.location.path !== path36), change.decision];
+    const proposals = change.proposal === void 0 ? truth.proposals : [...truth.proposals.filter((p) => p.location.path !== path36), change.proposal];
     const { diagnostics } = analyzeTrace({ ...truth, decisions, proposals, references: truth.config.references });
-    return diagnostics.filter((d) => d.severity === "error" && TRACE_ERRORS.has(d.code) && (d.source?.path === path35 || idTokens(d.message).includes(id3)));
+    return diagnostics.filter((d) => d.severity === "error" && TRACE_ERRORS.has(d.code) && (d.source?.path === path36 || idTokens(d.message).includes(id3)));
   }
   async function updateInPlace(actor, repoPath3, target, allowed, values) {
     const g = guard(actor, repoPath3, target);
     if (g.value === void 0)
       return [...g.diagnostics];
-    const text4 = await fs28.readText(g.value.absolute);
+    const text4 = await fs29.readText(g.value.absolute);
     if (text4 === void 0)
       return [createDiagnostic("FILE_READ_ERROR", `${repoPath3} is missing`, { path: repoPath3 })];
     for (const key2 of Object.keys(values)) {
@@ -2477,7 +2483,7 @@ function createDecisionService(options) {
     const errors = parsed.diagnostics.filter((d) => d.severity === "error");
     if (errors.length > 0)
       return errors;
-    await fs28.writeAtomic(g.value.absolute, next2);
+    await fs29.writeAtomic(g.value.absolute, next2);
     return [];
   }
   async function repairWith(truth) {
@@ -2490,7 +2496,7 @@ function createDecisionService(options) {
       if (pending !== void 0) {
         const g = guard({ kind: "human", name: d.confirmedBy ?? "duo" }, pending.location.path, "proposal");
         if (g.value !== void 0) {
-          await fs28.remove(g.value.absolute);
+          await fs29.remove(g.value.absolute);
           repaired.push(`removed ${pending.location.path} (confirmed as ${d.id})`);
         }
       }
@@ -2540,7 +2546,7 @@ function createDecisionService(options) {
     return truthChanged || changedRefs.length > 0 ? { truthChanged, changedRefs } : void 0;
   }
   async function allocate(prefix, truth) {
-    const names = [...await fs28.list(`${root}/${DECISIONS_DIR}`), ...await fs28.list(`${root}/${PROPOSALS_DIR}`)].map((n) => n.replace(/\.ya?ml$/u, ""));
+    const names = [...await fs29.list(`${root}/${DECISIONS_DIR}`), ...await fs29.list(`${root}/${PROPOSALS_DIR}`)].map((n) => n.replace(/\.ya?ml$/u, ""));
     if (prefix === "D")
       return nextDecisionId([...truth.decisions.map((d) => d.id), ...names]);
     return nextProposalId([...truth.proposals.map((p) => p.id), ...truth.decisions.flatMap((d) => d.proposalId === void 0 ? [] : [d.proposalId]), ...names]);
@@ -2556,7 +2562,7 @@ function createDecisionService(options) {
         return failure(g.diagnostics);
       let created;
       try {
-        created = await fs28.createExclusive(g.value.absolute, render(chosen));
+        created = await fs29.createExclusive(g.value.absolute, render(chosen));
       } catch (error) {
         return failure([createDiagnostic("FILE_WRITE_ERROR", `Cannot create ${g.value.path}: ${error.message}; nothing was confirmed`, { path: g.value.path })]);
       }
@@ -2762,7 +2768,7 @@ function createDecisionService(options) {
     }));
   }
   async function rawData(repoPath3) {
-    const text4 = await fs28.readText(`${root}/${repoPath3}`);
+    const text4 = await fs29.readText(`${root}/${repoPath3}`);
     if (text4 === void 0)
       return void 0;
     return parseYaml({ path: repoPath3, text: text4 }).value?.data ?? {};
@@ -2846,7 +2852,7 @@ function createDecisionService(options) {
       }
       const g = guard(actor, proposal.location.path, "proposal");
       if (g.value !== void 0)
-        await fs28.remove(g.value.absolute);
+        await fs29.remove(g.value.absolute);
     } catch (error) {
       after.push(createDiagnostic("FILE_WRITE_ERROR", `${created.value.id} is confirmed; finishing failed and is repaired by the next operation: ${error.message}`));
     }
@@ -2893,15 +2899,78 @@ function createDecisionService(options) {
   }
 }
 
+// packages/core/dist/decisions/session.js
+import fs5 from "node:fs";
+import os2 from "node:os";
+import path7 from "node:path";
+var REGENERABLE = /* @__PURE__ */ new Set(["generated", "cache", "runtime"]);
+var PLAN_ACTOR = { kind: "human", name: "confirm-session-plan" };
+var conflict = (id3, reason, more = []) => failure([
+  createDiagnostic("DECISION_SESSION_CONFLICT", `${id3} cannot be confirmed in this session after the proposals before it: ${reason}. Nothing was confirmed; confirm it on its own.`),
+  ...more
+]);
+function sessionOrder(ids2) {
+  return [...ids2].sort(compareUtf8);
+}
+async function planConfirmSession(options, reviewed) {
+  const ids2 = reviewed.map((r) => r.id);
+  if (ids2.length === 0)
+    return failure([createDiagnostic("INVALID_ID", "No proposal was selected")]);
+  if (new Set(ids2).size !== ids2.length)
+    return failure([createDiagnostic("INVALID_ID", "A proposal was selected twice")]);
+  const bad = ids2.find((id3) => !PROPOSAL_ID_PATTERN.test(id3));
+  if (bad !== void 0)
+    return failure([createDiagnostic("INVALID_ID", `"${bad}" is not a proposal ID; a session confirms proposals only`)]);
+  const digestOf = new Map(reviewed.map((r) => [r.id, r.digest]));
+  const order = sessionOrder(ids2);
+  const live = createDecisionService({ root: options.root });
+  for (const id3 of order) {
+    const p = await live.previewConfirm(id3);
+    if (p.value === void 0)
+      return failure(p.diagnostics);
+    if (p.value.sourceKind !== "proposal")
+      return failure([createDiagnostic("INVALID_ID", `${id3} is not a proposal`)]);
+    if (p.value.digest !== digestOf.get(id3)) {
+      return failure([createDiagnostic("DECISION_CONFIRM_PREVIEW_CHANGED", "The Decision changed after you reviewed it. Review the current contents and confirm again.", { path: p.value.sourcePath })]);
+    }
+  }
+  const tmp = fs5.mkdtempSync(path7.join(os2.tmpdir(), "duo-confirm-plan-"));
+  try {
+    fs5.cpSync(path7.join(options.root, STATE_DIR_NAME), path7.join(tmp, STATE_DIR_NAME), {
+      recursive: true,
+      filter: (src) => !REGENERABLE.has(path7.relative(path7.join(options.root, STATE_DIR_NAME), src).split(path7.sep)[0] ?? "")
+    });
+    const sim = createDecisionService({ root: tmp, clock: () => /* @__PURE__ */ new Date(0) });
+    const created = /* @__PURE__ */ new Set();
+    const items = [];
+    for (const id3 of order) {
+      const p = await sim.previewConfirm(id3);
+      if (p.value === void 0)
+        return conflict(id3, "its candidate cannot be read", p.diagnostics);
+      const target = p.value.candidate.supersedes;
+      if (typeof target === "string" && created.has(target))
+        return conflict(id3, `it supersedes ${target}, which this session creates`);
+      const c = await sim.confirm(PLAN_ACTOR, id3, { expectedDigest: p.value.digest });
+      if (c.value === void 0)
+        return conflict(id3, "its confirm would fail", c.diagnostics);
+      created.add(c.value.decisionId);
+      items.push({ id: id3, preview: p.value, changedFromReview: p.value.digest !== digestOf.get(id3) });
+    }
+    return success({ items });
+  } finally {
+    fs5.rmSync(tmp, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+  }
+}
+
 // packages/core/dist/index.js
 var packageInfo = { name: "@duo-director/core", dependsOn: [] };
 
 // packages/analyzer/dist/scan/scanner.js
-import fs5 from "node:fs";
-import path8 from "node:path";
+import fs6 from "node:fs";
+import path9 from "node:path";
 
 // packages/analyzer/dist/git/work-tree.js
-import path7 from "node:path";
+import path8 from "node:path";
 
 // packages/analyzer/dist/git/exec.js
 import { execFile } from "node:child_process";
@@ -2973,7 +3042,7 @@ async function workTreePrefix(rootDir) {
   return result.ok ? { ok: true, value: result.value.replace(/\r?\n$/u, "") } : result;
 }
 function probeWorkTree(root) {
-  const rootDir = path7.resolve(root);
+  const rootDir = path8.resolve(root);
   let asked;
   return { rootDir, prefix: () => asked ??= workTreePrefix(rootDir) };
 }
@@ -2994,8 +3063,8 @@ async function listIndexEntries(root) {
     const m = STAGE_RECORD.exec(record);
     if (m === null)
       return { ok: false, message: `unexpected git ls-files record: ${JSON.stringify(record)}` };
-    const [, mode = "", oid = "", stage = "0", path35 = ""] = m;
-    byPath.set(path35, stage === "0" ? { path: path35, mode, oid } : { path: path35, mode });
+    const [, mode = "", oid = "", stage = "0", path36 = ""] = m;
+    byPath.set(path36, stage === "0" ? { path: path36, mode, oid } : { path: path36, mode });
   }
   return { ok: true, value: [...byPath.values()] };
 }
@@ -3019,8 +3088,8 @@ function compileAll(patterns) {
   });
 }
 var secretMatchers = compileAll(SECRET_FILE_PATTERNS);
-function isSecretFileName(path35) {
-  const name = path35.slice(path35.lastIndexOf("/") + 1).toLowerCase();
+function isSecretFileName(path36) {
+  const name = path36.slice(path36.lastIndexOf("/") + 1).toLowerCase();
   return secretMatchers.some((m) => m(name));
 }
 function createPathPolicy(include = [], exclude = []) {
@@ -3029,20 +3098,20 @@ function createPathPolicy(include = [], exclude = []) {
   const invalidPatterns = [...include, ...exclude].filter((p) => compileRepoPattern(p) === void 0);
   return {
     invalidPatterns,
-    exclusionOf(path35) {
-      if (path35.split("/").some((segment) => segment.toLowerCase() === ".git"))
+    exclusionOf(path36) {
+      if (path36.split("/").some((segment) => segment.toLowerCase() === ".git"))
         return "git-internal";
-      if (DUO_REGENERABLE_PREFIXES.some((prefix) => path35.startsWith(prefix)))
+      if (DUO_REGENERABLE_PREFIXES.some((prefix) => path36.startsWith(prefix)))
         return "duo-regenerable";
-      if (DUO_HISTORY_PREFIXES.some((prefix) => path35.startsWith(prefix)))
+      if (DUO_HISTORY_PREFIXES.some((prefix) => path36.startsWith(prefix)))
         return "duo-history";
-      if (AGENT_INTEGRATION_FILES.includes(path35))
+      if (AGENT_INTEGRATION_FILES.includes(path36))
         return "duo-agent-integration";
-      if (isSecretFileName(path35))
+      if (isSecretFileName(path36))
         return "secret";
-      if (excludeMatchers.some((m) => m(path35)))
+      if (excludeMatchers.some((m) => m(path36)))
         return "index-exclude";
-      if (include.length > 0 && !includeMatchers.some((m) => m(path35)))
+      if (include.length > 0 && !includeMatchers.some((m) => m(path36)))
         return "not-included";
       return void 0;
     }
@@ -3077,8 +3146,8 @@ function buildOutputMatcher(paths) {
     cache.set(dir, v);
     return v;
   };
-  return (path35) => {
-    const segments = path35.split("/");
+  return (path36) => {
+    const segments = path36.split("/");
     for (let i = 1; i < segments.length; i++)
       if (isOutput(segments.slice(0, i).join("/")))
         return true;
@@ -3093,7 +3162,7 @@ var REGULAR_MODES = /* @__PURE__ */ new Set(["100644", "100755"]);
 var MAX_LINK_TEXT = 4096;
 function entryKind(absolute) {
   try {
-    const stat = fs5.lstatSync(absolute);
+    const stat = fs6.lstatSync(absolute);
     if (stat.isSymbolicLink())
       return "symlink";
     if (stat.isFile())
@@ -3106,16 +3175,16 @@ function entryKind(absolute) {
 function linkText(absolute, kind) {
   try {
     if (kind === "symlink")
-      return fs5.readlinkSync(absolute, "utf8");
+      return fs6.readlinkSync(absolute, "utf8");
     if (kind !== "file")
       return void 0;
-    const fd = fs5.openSync(absolute, "r");
+    const fd = fs6.openSync(absolute, "r");
     try {
       const buffer = Buffer.alloc(MAX_LINK_TEXT);
-      const n = fs5.readSync(fd, buffer, 0, MAX_LINK_TEXT, 0);
+      const n = fs6.readSync(fd, buffer, 0, MAX_LINK_TEXT, 0);
       return buffer.subarray(0, n).toString("utf8");
     } finally {
-      fs5.closeSync(fd);
+      fs6.closeSync(fd);
     }
   } catch {
     return void 0;
@@ -3124,15 +3193,15 @@ function linkText(absolute, kind) {
 function pointsOutside(root, link, target) {
   if (target === void 0)
     return true;
-  const resolved = path8.resolve(root, path8.dirname(link), target);
-  const relative = path8.relative(root, resolved);
-  return relative === ".." || relative.startsWith(`..${path8.sep}`) || path8.isAbsolute(relative);
+  const resolved = path9.resolve(root, path9.dirname(link), target);
+  const relative = path9.relative(root, resolved);
+  return relative === ".." || relative.startsWith(`..${path9.sep}`) || path9.isAbsolute(relative);
 }
 function symlinkDiagnostic(root, link, target) {
   return pointsOutside(root, link, target) ? createDiagnostic("SYMLINK_OUTSIDE_REPOSITORY", `Symlink "${link}" points outside the repository; its target is not read`, { path: link }) : createDiagnostic("SYMLINK_SKIPPED", `Symlink "${link}" is not followed`, { path: link });
 }
 async function scanRepository(root, options = {}) {
-  const rootDir = path8.resolve(root);
+  const rootDir = path9.resolve(root);
   const fail = (d) => ({ files: [], excluded: [], typeChanges: [], diagnostics: [d] });
   const prefix = await prefixFor(rootDir, options.workTree);
   if (!prefix.ok) {
@@ -3190,12 +3259,12 @@ async function scanRepository(root, options = {}) {
     if (reportedSymlinks.has(link))
       return;
     reportedSymlinks.add(link);
-    diagnostics.push(symlinkDiagnostic(rootDir, link, linkText(path8.join(rootDir, link), kind)));
+    diagnostics.push(symlinkDiagnostic(rootDir, link, linkText(path9.join(rootDir, link), kind)));
   };
   const directoryKind = (dir) => {
     let kind = directories.get(dir);
     if (kind === void 0) {
-      kind = entryKind(path8.join(rootDir, dir));
+      kind = entryKind(path9.join(rootDir, dir));
       directories.set(dir, kind);
     }
     return kind;
@@ -3224,7 +3293,7 @@ async function scanRepository(root, options = {}) {
       }
       continue;
     }
-    const absolute = path8.join(rootDir, candidate.path);
+    const absolute = path9.join(rootDir, candidate.path);
     const kind = entryKind(absolute);
     const indexMode = candidate.index?.mode;
     const symlinkReplacedByFile = indexMode === MODE_SYMLINK && kind === "file" && gitTypeChanged.has(candidate.path);
@@ -3391,8 +3460,8 @@ var NORMALIZED_TEXT_FILE_NAMES = /* @__PURE__ */ new Set([
   "vagrantfile",
   "jenkinsfile"
 ]);
-function fingerprintModeOf(path35) {
-  const name = path35.slice(path35.lastIndexOf("/") + 1).toLowerCase();
+function fingerprintModeOf(path36) {
+  const name = path36.slice(path36.lastIndexOf("/") + 1).toLowerCase();
   if (NORMALIZED_TEXT_FILE_NAMES.has(name))
     return "normalized-text";
   const dot = name.lastIndexOf(".");
@@ -3426,18 +3495,18 @@ function computeContentHash(bytes, mode) {
 }
 
 // packages/analyzer/dist/fingerprint/fingerprint.js
-import fs6 from "node:fs/promises";
-import path9 from "node:path";
+import fs7 from "node:fs/promises";
+import path10 from "node:path";
 async function fingerprintOne(root, file) {
-  const absolute = path9.join(root, file.path);
+  const absolute = path10.join(root, file.path);
   try {
-    const stat = await fs6.lstat(absolute);
+    const stat = await fs7.lstat(absolute);
     if (stat.isSymbolicLink())
       return createDiagnostic("SYMLINK_SKIPPED", `Symlink "${file.path}" is not followed`, { path: file.path });
     if (!stat.isFile())
       return createDiagnostic("SCAN_ENTRY_SKIPPED", `"${file.path}" is not a regular file`, { path: file.path });
     const fingerprintMode = fingerprintModeOf(file.path);
-    const { contentHash, size } = computeContentHash(await fs6.readFile(absolute), fingerprintMode);
+    const { contentHash, size } = computeContentHash(await fs7.readFile(absolute), fingerprintMode);
     const base = { path: file.path, state: file.state, fingerprintMode, contentHash, size };
     return file.gitBlobOid === void 0 ? base : { ...base, gitBlobOid: file.gitBlobOid };
   } catch (error) {
@@ -3445,7 +3514,7 @@ async function fingerprintOne(root, file) {
   }
 }
 async function fingerprintRepositoryFiles(root, files, options = {}) {
-  const rootDir = path9.resolve(root);
+  const rootDir = path10.resolve(root);
   const results = new Array(files.length);
   let next2 = 0;
   const worker = async () => {
@@ -3471,8 +3540,8 @@ async function fingerprintRepositoryFiles(root, files, options = {}) {
 }
 
 // packages/analyzer/dist/fingerprint/store.js
-import fs7 from "node:fs";
-import path10 from "node:path";
+import fs8 from "node:fs";
+import path11 from "node:path";
 var FINGERPRINT_FILE_PATH = `${STATE_DIR_NAME}/generated/fingerprints.json`;
 var FINGERPRINT_FORMAT = "duo-fingerprints";
 var FINGERPRINT_FORMAT_VERSION = 3;
@@ -3549,7 +3618,7 @@ function symlinkOnPath2(root, repoPath3) {
   for (let i = 1; i <= segments.length; i++) {
     const partial = segments.slice(0, i).join("/");
     try {
-      if (fs7.lstatSync(path10.join(root, partial)).isSymbolicLink())
+      if (fs8.lstatSync(path11.join(root, partial)).isSymbolicLink())
         return partial;
     } catch {
       return void 0;
@@ -3561,12 +3630,12 @@ function asEmpty(result) {
   return success([], result.diagnostics);
 }
 function readFingerprintFile(root) {
-  const rootDir = path10.resolve(root);
+  const rootDir = path11.resolve(root);
   if (symlinkOnPath2(rootDir, FINGERPRINT_FILE_PATH) !== void 0)
     return asEmpty(invalid("the path contains a symlink"));
   let text4;
   try {
-    text4 = fs7.readFileSync(path10.join(rootDir, FINGERPRINT_FILE_PATH), "utf8");
+    text4 = fs8.readFileSync(path11.join(rootDir, FINGERPRINT_FILE_PATH), "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return success([]);
@@ -3576,7 +3645,7 @@ function readFingerprintFile(root) {
   return parsed.value === void 0 ? asEmpty(parsed) : parsed;
 }
 function writeFingerprintFile(root, fingerprints) {
-  const rootDir = path10.resolve(root);
+  const rootDir = path11.resolve(root);
   const allowed = checkWriteBoundary(rootDir, FINGERPRINT_FILE_PATH, "regenerable");
   if (allowed.value === void 0)
     return failure(allowed.diagnostics);
@@ -3585,14 +3654,14 @@ function writeFingerprintFile(root, fingerprints) {
   if (link !== void 0) {
     return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${target}": "${link}" is a symlink`, { path: target })]);
   }
-  const absolute = path10.join(rootDir, target);
+  const absolute = path11.join(rootDir, target);
   const temp = `${absolute}.${process.pid}.tmp`;
   try {
-    fs7.mkdirSync(path10.dirname(absolute), { recursive: true });
-    fs7.writeFileSync(temp, serializeFingerprints(fingerprints), "utf8");
-    fs7.renameSync(temp, absolute);
+    fs8.mkdirSync(path11.dirname(absolute), { recursive: true });
+    fs8.writeFileSync(temp, serializeFingerprints(fingerprints), "utf8");
+    fs8.renameSync(temp, absolute);
   } catch (error) {
-    fs7.rmSync(temp, { force: true });
+    fs8.rmSync(temp, { force: true });
     return failure([createDiagnostic("FILE_WRITE_ERROR", `Cannot write "${target}": ${error.message}`, { path: target })]);
   }
   return success(target);
@@ -3620,8 +3689,8 @@ function compareFingerprints(previous, current) {
 }
 
 // packages/analyzer/dist/git/provider.js
-import fs8 from "node:fs";
-import path11 from "node:path";
+import fs9 from "node:fs";
+import path12 from "node:path";
 
 // packages/analyzer/dist/git/parse.js
 var GitOutputError = class extends Error {
@@ -3652,19 +3721,19 @@ var ORDINARY = /^1 (.)(.) (\S{4}) (\d{6}) (\d{6}) (\d{6}) ([0-9a-f]+) ([0-9a-f]+
 var RENAMED = /^2 (.)(.) (\S{4}) (\d{6}) (\d{6}) (\d{6}) ([0-9a-f]+) ([0-9a-f]+) ([RC])(\d+) (.*)$/su;
 var UNMERGED = /^u (..) (\S{4}) (\d{6}) (\d{6}) (\d{6}) (\d{6}) ([0-9a-f]+) ([0-9a-f]+) ([0-9a-f]+) (.*)$/su;
 function parseStatusV2(out, toPath) {
-  const tokens2 = out.split("\0");
+  const tokens3 = out.split("\0");
   let oid;
   let head;
   const changes = [];
   const skipped2 = [];
-  const path35 = (raw) => {
+  const path36 = (raw) => {
     const p = toPath(raw);
     if (p === void 0)
       skipped2.push(raw);
     return p;
   };
-  for (let i = 0; i < tokens2.length; i++) {
-    const t2 = tokens2[i] ?? "";
+  for (let i = 0; i < tokens3.length; i++) {
+    const t2 = tokens3[i] ?? "";
     if (t2 === "")
       continue;
     if (t2.startsWith("# branch.oid ")) {
@@ -3684,7 +3753,7 @@ function parseStatusV2(out, toPath) {
       const nested = raw.endsWith("/");
       if (nested)
         raw = raw.slice(0, -1);
-      const p = path35(raw);
+      const p = path36(raw);
       if (p !== void 0)
         changes.push({ path: p, unstaged: "untracked", submodule: nested });
       continue;
@@ -3692,7 +3761,7 @@ function parseStatusV2(out, toPath) {
     let m = ORDINARY.exec(t2);
     if (m !== null) {
       const [, x = ".", y = ".", sub = "N...", mH = "", mI = "", mW = "", hH = "", hI = "", raw = ""] = m;
-      const p = path35(raw);
+      const p = path36(raw);
       if (p !== void 0) {
         changes.push({
           path: p,
@@ -3711,11 +3780,11 @@ function parseStatusV2(out, toPath) {
     m = RENAMED.exec(t2);
     if (m !== null) {
       const [, x = ".", y = ".", sub = "N...", mH = "", mI = "", mW = "", hH = "", hI = "", , score = "0", raw = ""] = m;
-      const origRaw = tokens2[++i];
+      const origRaw = tokens3[++i];
       if (origRaw === void 0)
         throw new GitOutputError("rename record without original path");
-      const p = path35(raw);
-      const orig = path35(origRaw);
+      const p = path36(raw);
+      const orig = path36(origRaw);
       if (p !== void 0 && orig !== void 0) {
         changes.push({
           path: p,
@@ -3736,7 +3805,7 @@ function parseStatusV2(out, toPath) {
     m = UNMERGED.exec(t2);
     if (m !== null) {
       const [, xy = "UU", sub = "N...", , , , mW = "", , , , raw = ""] = m;
-      const p = path35(raw);
+      const p = path36(raw);
       if (p !== void 0) {
         changes.push({ path: p, staged: "unmerged", unstaged: "unmerged", conflict: xy, submodule: sub.startsWith("S"), ...optional("worktreeMode", modeOf(mW)) });
       }
@@ -3810,8 +3879,8 @@ function parsePatchBlock(block) {
   for (const line of lines4) {
     const h = HUNK.exec(line);
     if (h !== null) {
-      const [, os2 = "0", ol, ns = "0", nl, section = ""] = h;
-      current = { oldStart: Number(os2), oldLines: ol === void 0 ? 1 : Number(ol), newStart: Number(ns), newLines: nl === void 0 ? 1 : Number(nl), section, lines: [] };
+      const [, os3 = "0", ol, ns = "0", nl, section = ""] = h;
+      current = { oldStart: Number(os3), oldLines: ol === void 0 ? 1 : Number(ol), newStart: Number(ns), newLines: nl === void 0 ? 1 : Number(nl), section, lines: [] };
       hunks.push(current);
       continue;
     }
@@ -3857,18 +3926,18 @@ function parseLsFilesStage(out, toPath) {
   return result;
 }
 function parseLogMessages(out) {
-  const tokens2 = out.split("\0");
-  if (tokens2.at(-1) === "")
-    tokens2.pop();
-  if (tokens2.length % 3 !== 0)
+  const tokens3 = out.split("\0");
+  if (tokens3.at(-1) === "")
+    tokens3.pop();
+  if (tokens3.length % 3 !== 0)
     throw new GitOutputError("unexpected git log record count");
   const commits = [];
-  for (let i = 0; i < tokens2.length; i += 3) {
-    const oid = tokens2[i] ?? "";
+  for (let i = 0; i < tokens3.length; i += 3) {
+    const oid = tokens3[i] ?? "";
     if (!/^[0-9a-f]+$/u.test(oid))
       throw new GitOutputError(`unexpected commit id ${JSON.stringify(oid)}`);
-    const parents = (tokens2[i + 1] ?? "").split(" ").filter((p) => p !== "");
-    commits.push({ oid, parents, message: (tokens2[i + 2] ?? "").replace(/\n$/u, "") });
+    const parents = (tokens3[i + 1] ?? "").split(" ").filter((p) => p !== "");
+    commits.push({ oid, parents, message: (tokens3[i + 2] ?? "").replace(/\n$/u, "") });
   }
   return commits;
 }
@@ -4096,7 +4165,7 @@ var Provider = class {
       let newSize = d.newOid === void 0 ? void 0 : sizes.get(d.newOid);
       if (newSize === void 0 && to === "WORKTREE" && d.kind !== "deleted") {
         try {
-          newSize = fs8.lstatSync(path11.join(this.root, d.path)).size;
+          newSize = fs9.lstatSync(path12.join(this.root, d.path)).size;
         } catch {
           newSize = void 0;
         }
@@ -4171,7 +4240,7 @@ var Provider = class {
   }
 };
 async function openGitProvider(root, options = {}) {
-  const rootDir = path11.resolve(root);
+  const rootDir = path12.resolve(root);
   const r = await prefixFor(rootDir, options.workTree);
   if (!r.ok) {
     return failure([r.gitMissing === true ? createDiagnostic("GIT_COMMAND_FAILED", r.message) : createDiagnostic("GIT_REPOSITORY_REQUIRED", `"${rootDir}" is not a Git work tree; DUO requires a Git repository: ${r.message}`)]);
@@ -4183,20 +4252,20 @@ async function openGitProvider(root, options = {}) {
 }
 
 // packages/analyzer/dist/git/identity.js
-import path12 from "node:path";
+import path13 from "node:path";
 async function readGitUserName(root) {
-  const r = await runGit(path12.resolve(root), ["config", "--get", "user.name"]);
+  const r = await runGit(path13.resolve(root), ["config", "--get", "user.name"]);
   if (!r.ok)
     return void 0;
   const name = r.value.trim();
   return name === "" ? void 0 : name;
 }
 async function findGitTopLevel(dir) {
-  const r = await runGit(path12.resolve(dir), ["rev-parse", "--show-toplevel"]);
+  const r = await runGit(path13.resolve(dir), ["rev-parse", "--show-toplevel"]);
   if (!r.ok)
     return void 0;
   const top = r.value.replace(/\r?\n$/u, "");
-  return top === "" ? void 0 : path12.resolve(top);
+  return top === "" ? void 0 : path13.resolve(top);
 }
 
 // packages/analyzer/dist/git/history.js
@@ -4249,12 +4318,12 @@ import { createHash as createHash5 } from "node:crypto";
 var ANALYZER_SELECTION_VERSION = "1";
 var CPP_SOURCES = /* @__PURE__ */ new Set(["cpp", "cc", "cxx"]);
 var CPP_FILES = /* @__PURE__ */ new Set(["cpp", "cc", "cxx", "hpp", "hh", "hxx"]);
-function extensionOf(path35) {
-  const name = path35.slice(path35.lastIndexOf("/") + 1);
+function extensionOf(path36) {
+  const name = path36.slice(path36.lastIndexOf("/") + 1);
   const dot = name.lastIndexOf(".");
   return dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
 }
-var stemOf = (path35) => path35.slice(0, path35.length - extensionOf(path35).length - 1);
+var stemOf = (path36) => path36.slice(0, path36.length - extensionOf(path36).length - 1);
 function headerContext(paths) {
   const exts = paths.map(extensionOf);
   return {
@@ -4263,8 +4332,8 @@ function headerContext(paths) {
     cppStems: new Set(paths.filter((p) => CPP_SOURCES.has(extensionOf(p))).map(stemOf))
   };
 }
-function isCppHeader(path35, context) {
-  return extensionOf(path35) === "h" && (context.uproject || context.cppProject || context.cppStems.has(stemOf(path35)));
+function isCppHeader(path36, context) {
+  return extensionOf(path36) === "h" && (context.uproject || context.cppProject || context.cppStems.has(stemOf(path36)));
 }
 function createAnalyzerRegistry(analyzers) {
   const ids2 = /* @__PURE__ */ new Set();
@@ -4274,7 +4343,7 @@ function createAnalyzerRegistry(analyzers) {
     ids2.add(a.id);
   }
   const list3 = [...analyzers];
-  const analyzerFor = (path35) => list3.find((a) => a.supports(path35));
+  const analyzerFor = (path36) => list3.find((a) => a.supports(path36));
   const identities = Object.fromEntries(list3.map((a) => [a.id, a.identity]).sort(([x], [y]) => x < y ? -1 : 1));
   const digest = `sha256:${createHash5("sha256").update([`selection=${ANALYZER_SELECTION_VERSION}`, ...Object.entries(identities).map(([k, v]) => `${k}=${v}`)].join("\n")).digest("hex")}`;
   return {
@@ -4282,21 +4351,21 @@ function createAnalyzerRegistry(analyzers) {
     analyzerFor,
     scope(paths) {
       const context = headerContext(paths);
-      const selectFor = (path35) => {
-        const own = analyzerFor(path35);
+      const selectFor = (path36) => {
+        const own = analyzerFor(path36);
         if (own !== void 0)
           return own;
-        const ext = extensionOf(path35);
+        const ext = extensionOf(path36);
         const contextual = list3.find((a) => a.contextualExtensions?.includes(ext));
         if (contextual === void 0 || ext !== "h")
           return void 0;
-        return isCppHeader(path35, context) ? contextual : void 0;
+        return isCppHeader(path36, context) ? contextual : void 0;
       };
       return {
         analyzerFor: selectFor,
-        capabilitiesFor: (path35) => selectFor(path35)?.capabilities ?? FILE_ONLY_CAPABILITIES,
-        languageFor(path35) {
-          const a = selectFor(path35);
+        capabilitiesFor: (path36) => selectFor(path36)?.capabilities ?? FILE_ONLY_CAPABILITIES,
+        languageFor(path36) {
+          const a = selectFor(path36);
           if (a === void 0)
             return void 0;
           return a.languages.length === 1 ? a.languages[0] : void 0;
@@ -4325,7 +4394,7 @@ import { createHash as createHash7 } from "node:crypto";
 // packages/analyzer/dist/language/tree-sitter/runtime.js
 import { createRequire } from "node:module";
 import { createHash as createHash6 } from "node:crypto";
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 import { fileURLToPath } from "node:url";
 import { Language, LANGUAGE_VERSION, MIN_COMPATIBLE_VERSION, Parser } from "web-tree-sitter";
 var GRAMMAR_FILES = {
@@ -4341,7 +4410,7 @@ var requireFromHere = createRequire(import.meta.url);
 var fileName = (id3) => GRAMMAR_FILES[id3].slice(GRAMMAR_FILES[id3].lastIndexOf("/") + 1);
 var defaultGrammarLocator = (id3) => {
   const packaged = fileURLToPath(new URL(`./grammars/${fileName(id3)}`, import.meta.url));
-  if (fs9.existsSync(packaged))
+  if (fs10.existsSync(packaged))
     return packaged;
   try {
     return requireFromHere.resolve(GRAMMAR_FILES[id3]);
@@ -4371,7 +4440,7 @@ async function loadGrammarSet(ids2, locate = defaultGrammarLocator) {
     let source;
     try {
       const located = locate(id3);
-      source = typeof located === "string" ? new Uint8Array(fs9.readFileSync(located)) : located;
+      source = typeof located === "string" ? new Uint8Array(fs10.readFileSync(located)) : located;
     } catch (error) {
       diagnostics.push(createDiagnostic("ANALYZER_INIT_FAILED", `Grammar "${id3}" (${GRAMMAR_FILES[id3]}) not found: ${message(error)}`));
       continue;
@@ -4400,8 +4469,8 @@ function createParser(language) {
 // packages/analyzer/dist/language/tree-sitter/analyzer-base.js
 var DEFAULT_PARSE_TIMEOUT_MS = 2e3;
 var decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
-function extensionOf2(path35) {
-  const name = path35.slice(path35.lastIndexOf("/") + 1);
+function extensionOf2(path36) {
+  const name = path36.slice(path36.lastIndexOf("/") + 1);
   const dot = name.lastIndexOf(".");
   return dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
 }
@@ -4447,25 +4516,25 @@ var TreeSitterAnalyzer = class {
     this.capabilities = spec2.capabilities;
     this.callResolution = spec2.callResolution;
   }
-  grammarOf(path35) {
-    const ext = extensionOf2(path35);
+  grammarOf(path36) {
+    const ext = extensionOf2(path36);
     if (Object.hasOwn(this.spec.extensions, ext))
       return this.spec.extensions[ext];
     return this.spec.contextual !== void 0 && Object.hasOwn(this.spec.contextual, ext) ? this.spec.contextual[ext] : void 0;
   }
-  supports(path35) {
-    return Object.hasOwn(this.spec.extensions, extensionOf2(path35));
+  supports(path36) {
+    return Object.hasOwn(this.spec.extensions, extensionOf2(path36));
   }
   analyze(input) {
     if (this.disposed)
       throw new Error(`LanguageAnalyzer "${this.id}" was disposed`);
-    const { path: path35 } = input;
-    const grammar = this.grammarOf(path35);
+    const { path: path36 } = input;
+    const grammar = this.grammarOf(path36);
     const parser = grammar === void 0 ? void 0 : this.parsers.get(grammar);
     if (grammar === void 0 || parser === void 0) {
-      return failure([createDiagnostic("LANGUAGE_UNSUPPORTED", `"${path35}" is not a ${this.id} source file`, { path: path35 })]);
+      return failure([createDiagnostic("LANGUAGE_UNSUPPORTED", `"${path36}" is not a ${this.id} source file`, { path: path36 })]);
     }
-    const mode = fingerprintModeOf(path35);
+    const mode = fingerprintModeOf(path36);
     const { contentHash } = computeContentHash(input.content, mode);
     let text4;
     try {
@@ -4473,7 +4542,7 @@ var TreeSitterAnalyzer = class {
       if (text4.charCodeAt(0) === 65279)
         text4 = text4.slice(1);
     } catch {
-      return failure([createDiagnostic("SOURCE_DECODE_ERROR", `"${path35}" is not valid UTF-8`, { path: path35 })]);
+      return failure([createDiagnostic("SOURCE_DECODE_ERROR", `"${path36}" is not valid UTF-8`, { path: path36 })]);
     }
     const parsed = this.spec.prepare === void 0 ? text4 : this.spec.prepare(text4);
     if (parsed.length !== text4.length)
@@ -4482,12 +4551,12 @@ var TreeSitterAnalyzer = class {
     const tree = parser.parse(parsed, null, { progressCallback: () => performance.now() > deadline });
     if (tree === null) {
       parser.reset();
-      return failure([createDiagnostic("AST_PARSE_TIMEOUT", `Parsing "${path35}" took longer than ${this.parseTimeoutMs} ms`, { path: path35 })]);
+      return failure([createDiagnostic("AST_PARSE_TIMEOUT", `Parsing "${path36}" took longer than ${this.parseTimeoutMs} ms`, { path: path36 })]);
     }
     try {
-      const x = this.spec.extract(path35, tree, text4);
+      const x = this.spec.extract(path36, tree, text4);
       return success({
-        path: path35,
+        path: path36,
         language: grammar,
         contentHash,
         parseStatus: x.partial ? "partial" : "complete",
@@ -4520,7 +4589,7 @@ async function createTreeSitterAnalyzer(spec2, options = {}) {
 }
 
 // packages/analyzer/dist/language/annotations.js
-function parseDuoAnnotations(path35, comment, startLine, startColumn) {
+function parseDuoAnnotations(path36, comment, startLine, startColumn) {
   const annotations = [];
   const diagnostics = [];
   const block = comment.startsWith("/*");
@@ -4550,10 +4619,10 @@ function parseDuoAnnotations(path35, comment, startLine, startColumn) {
     text4 = text4.trimEnd();
     const index = offset2 + (body.length - content.length);
     const column = k === 0 ? startColumn + index : index + 1;
-    const location4 = { path: path35, startLine: startLine + k, startColumn: column, endLine: startLine + k, endColumn: column + text4.length };
-    const tokens2 = text4.slice("duo:".length).split(/[\s,]+/).filter((t2) => t2 !== "");
-    const end2 = tokens2.findIndex((t2) => !isDefinitionId(t2));
-    const ids2 = [...new Set(end2 === -1 ? tokens2 : tokens2.slice(0, end2))];
+    const location4 = { path: path36, startLine: startLine + k, startColumn: column, endLine: startLine + k, endColumn: column + text4.length };
+    const tokens3 = text4.slice("duo:".length).split(/[\s,]+/).filter((t2) => t2 !== "");
+    const end2 = tokens3.findIndex((t2) => !isDefinitionId(t2));
+    const ids2 = [...new Set(end2 === -1 ? tokens3 : tokens3.slice(0, end2))];
     if (ids2.length === 0) {
       diagnostics.push(createDiagnostic("DUO_ANNOTATION_INVALID", `"duo:" comment does not start with a definition ID: ${JSON.stringify(text4)}`, location4));
       return;
@@ -4565,9 +4634,9 @@ function parseDuoAnnotations(path35, comment, startLine, startColumn) {
 
 // packages/analyzer/dist/language/tree-sitter/syntax.js
 var MAX_PARSE_DIAGNOSTICS = 20;
-function location(path35, node) {
+function location(path36, node) {
   return {
-    path: path35,
+    path: path36,
     startLine: node.startPosition.row + 1,
     startColumn: node.startPosition.column + 1,
     endLine: node.endPosition.row + 1,
@@ -4595,9 +4664,9 @@ function parseErrors(tree) {
   visit2(tree.rootNode);
   return out;
 }
-function reportParseErrors(path35, tree, errors) {
+function reportParseErrors(path36, tree, errors) {
   const diagnostics = [];
-  const sorted = errors.map((e) => ({ ...e, location: location(path35, e.node) })).sort((a, b) => compareSourceLocations(a.location, b.location));
+  const sorted = errors.map((e) => ({ ...e, location: location(path36, e.node) })).sort((a, b) => compareSourceLocations(a.location, b.location));
   for (const e of sorted.slice(0, MAX_PARSE_DIAGNOSTICS)) {
     diagnostics.push(createDiagnostic("AST_PARSE_ERROR", e.missing ? `Syntax error: missing "${e.node.type}"` : "Syntax error", e.location));
   }
@@ -4605,7 +4674,7 @@ function reportParseErrors(path35, tree, errors) {
     diagnostics.push(createDiagnostic("AST_PARSE_ERROR", `${sorted.length - MAX_PARSE_DIAGNOSTICS} more syntax errors`, sorted[MAX_PARSE_DIAGNOSTICS]?.location));
   }
   if (sorted.length === 0 && tree.rootNode.hasError)
-    diagnostics.push(createDiagnostic("AST_PARSE_ERROR", "Syntax error", { path: path35 }));
+    diagnostics.push(createDiagnostic("AST_PARSE_ERROR", "Syntax error", { path: path36 }));
   return diagnostics;
 }
 function sortExtraction(x, partial) {
@@ -4635,8 +4704,8 @@ var StructuralCollector = class {
   annotations = [];
   tests = [];
   diagnostics = [];
-  constructor(path35) {
-    this.path = path35;
+  constructor(path36) {
+    this.path = path36;
   }
   /** Adds a declaration; returns the symbol ref calls inside it belong to. */
   symbol(d) {
@@ -4857,12 +4926,12 @@ function parameterName(declarator) {
 function parameterText(p) {
   const name = parameterName(p.childForFieldName("declarator"));
   const defaultValue = p.childForFieldName("default_value");
-  const tokens2 = [];
+  const tokens3 = [];
   const visit2 = (n) => {
     if (n.type === "comment" || same(n, name))
       return;
     if (n.childCount === 0) {
-      tokens2.push(n.text);
+      tokens3.push(n.text);
       return;
     }
     for (const c of n.children)
@@ -4874,7 +4943,7 @@ function parameterText(p) {
       continue;
     visit2(c);
   }
-  return tokens2.join(" ").replace(/\s*([*&,()[\]<>:])\s*/gu, "$1").replace(/\s+/gu, " ").trim();
+  return tokens3.join(" ").replace(/\s*([*&,()[\]<>:])\s*/gu, "$1").replace(/\s+/gu, " ").trim();
 }
 var PARAMETER = /* @__PURE__ */ new Set(["parameter_declaration", "optional_parameter_declaration"]);
 var LIST_PUNCTUATION = /* @__PURE__ */ new Set(["(", ")", ",", "comment"]);
@@ -4929,10 +4998,10 @@ var CppExtractor = class {
   c;
   includes = [];
   testPath;
-  constructor(path35, tree) {
+  constructor(path36, tree) {
     this.tree = tree;
-    this.c = new StructuralCollector(path35);
-    this.testPath = TEST_PATH.test(path35);
+    this.c = new StructuralCollector(path36);
+    this.testPath = TEST_PATH.test(path36);
   }
   run() {
     for (const n of this.tree.rootNode.descendantsOfType("preproc_include"))
@@ -5122,9 +5191,9 @@ var CppExtractor = class {
       if (n.type === "call_expression") {
         const fn = n.childForFieldName("function");
         if (fn !== null) {
-          const path35 = namePath(fn);
+          const path36 = namePath(fn);
           const bare = fn.type === "identifier";
-          this.c.call(n, bare ? "identifier" : "member", fn.text, path35, enclosing, bare && locals.has(fn.text), bare && member);
+          this.c.call(n, bare ? "identifier" : "member", fn.text, path36, enclosing, bare && locals.has(fn.text), bare && member);
         }
       } else if (n.type === "new_expression") {
         const type = n.childForFieldName("type");
@@ -5135,8 +5204,8 @@ var CppExtractor = class {
     });
   }
 };
-function extractCpp(path35, tree) {
-  return new CppExtractor(path35, tree).run();
+function extractCpp(path36, tree) {
+  return new CppExtractor(path36, tree).run();
 }
 
 // packages/analyzer/dist/language/tree-sitter/csharp-extract.js
@@ -5182,9 +5251,9 @@ var CSharpExtractor = class {
   tree;
   c;
   usings = /* @__PURE__ */ new Set();
-  constructor(path35, tree) {
+  constructor(path36, tree) {
     this.tree = tree;
-    this.c = new StructuralCollector(path35);
+    this.c = new StructuralCollector(path36);
   }
   run() {
     let namespace = [];
@@ -5207,10 +5276,10 @@ var CSharpExtractor = class {
     const target = node.namedChildren.filter((c) => c !== null && c !== node.childForFieldName("name") && (c.type === "qualified_name" || c.type === "identifier" || c.type === "generic_name")).at(-1);
     if (target === void 0 || target === null)
       return;
-    const tokens2 = node.children.filter((c) => c !== null && !c.isNamed).map((c) => c?.type);
+    const tokens3 = node.children.filter((c) => c !== null && !c.isNamed).map((c) => c?.type);
     this.c.module(node, target.text, "using", alias === void 0 ? [] : [{ local: alias, imported: target.text, typeOnly: false }], {
-      ...tokens2.includes("static") ? { static: true } : {},
-      ...tokens2.includes("global") ? { global: true } : {},
+      ...tokens3.includes("static") ? { static: true } : {},
+      ...tokens3.includes("global") ? { global: true } : {},
       ...alias === void 0 ? {} : { alias }
     });
     if (alias === void 0)
@@ -5298,8 +5367,8 @@ var CSharpExtractor = class {
     return true;
   }
 };
-function extractCSharp(path35, tree) {
-  return new CSharpExtractor(path35, tree).run();
+function extractCSharp(path36, tree) {
+  return new CSharpExtractor(path36, tree).run();
 }
 
 // packages/analyzer/dist/language/tree-sitter/java-extract.js
@@ -5337,10 +5406,10 @@ var JavaExtractor = class {
   /** Imported names of test annotations → framework, and wildcard-imported packages. */
   annotationImports = /* @__PURE__ */ new Map();
   wildcardImports = /* @__PURE__ */ new Set();
-  constructor(path35, tree) {
-    this.path = path35;
+  constructor(path36, tree) {
+    this.path = path36;
     this.tree = tree;
-    this.c = new StructuralCollector(path35);
+    this.c = new StructuralCollector(path36);
   }
   run() {
     for (const n of this.tree.rootNode.namedChildren)
@@ -5463,8 +5532,8 @@ var JavaExtractor = class {
     return true;
   }
 };
-function extractJava(path35, tree) {
-  return new JavaExtractor(path35, tree).run();
+function extractJava(path36, tree) {
+  return new JavaExtractor(path36, tree).run();
 }
 
 // packages/analyzer/dist/language/tree-sitter/python-extract.js
@@ -5537,10 +5606,10 @@ var PythonExtractor = class {
   /** Module-level names bound by something other than an import (def, class, assignment, del, ...). */
   moduleOtherBound = /* @__PURE__ */ new Set();
   definitions = [];
-  constructor(path35, tree) {
+  constructor(path36, tree) {
     this.tree = tree;
-    this.c = new StructuralCollector(path35);
-    this.testFile = PYTEST_FILE.test(path35);
+    this.c = new StructuralCollector(path36);
+    this.testFile = PYTEST_FILE.test(path36);
   }
   run() {
     const defs = /* @__PURE__ */ new Map();
@@ -5633,12 +5702,12 @@ var PythonExtractor = class {
   }
   isUnittestCase(cls) {
     for (const base of cls.childForFieldName("superclasses")?.namedChildren ?? []) {
-      const path35 = base === null ? void 0 : namePath4(base);
-      if (path35 === void 0)
+      const path36 = base === null ? void 0 : namePath4(base);
+      if (path36 === void 0)
         continue;
-      if (path35.length === 1 && this.testCaseNames.has(path35[0]))
+      if (path36.length === 1 && this.testCaseNames.has(path36[0]))
         return true;
-      if (path35.length === 2 && this.unittestModules.has(path35[0]) && path35[1] === "TestCase")
+      if (path36.length === 2 && this.unittestModules.has(path36[0]) && path36[1] === "TestCase")
         return true;
     }
     return false;
@@ -5832,8 +5901,8 @@ var PythonExtractor = class {
     }
   }
 };
-function extractPython(path35, tree) {
-  return new PythonExtractor(path35, tree).run();
+function extractPython(path36, tree) {
+  return new PythonExtractor(path36, tree).run();
 }
 
 // packages/analyzer/dist/language/tree-sitter/languages.js
@@ -5912,9 +5981,9 @@ var TEST_FRAMEWORKS = {
 var GLOBAL_TEST_FUNCTIONS = { test: "test", it: "test", describe: "suite", suite: "suite" };
 var TEST_MODIFIERS = /* @__PURE__ */ new Set(["skip", "only", "todo"]);
 var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/i;
-function location2(path35, node) {
+function location2(path36, node) {
   return {
-    path: path35,
+    path: path36,
     startLine: node.startPosition.row + 1,
     startColumn: node.startPosition.column + 1,
     endLine: node.endPosition.row + 1,
@@ -6000,10 +6069,10 @@ var Extractor = class {
   /** Local names bound by imports or declarations: a global test function name bound here is not a test function. */
   localNames = /* @__PURE__ */ new Set();
   testFile;
-  constructor(path35, tree) {
-    this.path = path35;
+  constructor(path36, tree) {
+    this.path = path36;
     this.tree = tree;
-    this.testFile = TEST_FILE.test(path35);
+    this.testFile = TEST_FILE.test(path36);
   }
   run() {
     for (const statement of this.tree.rootNode.namedChildren)
@@ -6606,8 +6675,8 @@ var Extractor = class {
     }
   }
 };
-function extractTypeScriptJavaScript(path35, tree) {
-  return new Extractor(path35, tree).run();
+function extractTypeScriptJavaScript(path36, tree) {
+  return new Extractor(path36, tree).run();
 }
 
 // packages/analyzer/dist/language/tree-sitter/ts-js-analyzer.js
@@ -6688,30 +6757,30 @@ var GraphStoreError = class extends Error {
 };
 
 // packages/graph/dist/store/node-sqlite/node-sqlite-graph-store.js
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import { DatabaseSync } from "node:sqlite";
 
 // packages/graph/dist/store/json.js
-function canonical2(value, path35) {
+function canonical2(value, path36) {
   if (value === null || typeof value === "boolean" || typeof value === "string")
     return value;
   if (typeof value === "number") {
     if (!Number.isFinite(value))
-      throw new GraphStoreError("INVALID_INPUT", `${path35}: ${value} is not a finite JSON number`);
+      throw new GraphStoreError("INVALID_INPUT", `${path36}: ${value} is not a finite JSON number`);
     return value;
   }
   if (Array.isArray(value))
-    return value.map((v, i) => canonical2(v, `${path35}[${i}]`));
+    return value.map((v, i) => canonical2(v, `${path36}[${i}]`));
   if (typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
     const out = {};
     for (const key2 of Object.keys(value).sort(compareUtf8))
-      out[key2] = canonical2(value[key2], `${path35}.${key2}`);
+      out[key2] = canonical2(value[key2], `${path36}.${key2}`);
     return out;
   }
-  throw new GraphStoreError("INVALID_INPUT", `${path35}: ${typeof value} is not a JSON value`);
+  throw new GraphStoreError("INVALID_INPUT", `${path36}: ${typeof value} is not a JSON value`);
 }
-function canonicalJson(value, path35) {
-  return JSON.stringify(canonical2(value ?? {}, path35));
+function canonicalJson(value, path36) {
+  return JSON.stringify(canonical2(value ?? {}, path36));
 }
 
 // packages/graph/dist/store/node-sqlite/schema.js
@@ -7031,9 +7100,9 @@ function inspectSchema(db) {
     return { kind: "unsupported", found: "missing", duoGraph: true };
   return row.value === String(GRAPH_SCHEMA_VERSION) ? { kind: "ok" } : { kind: "unsupported", found: row.value, duoGraph: true };
 }
-function removeDatabaseFiles(path35) {
+function removeDatabaseFiles(path36) {
   for (const suffix of ["", "-wal", "-shm", "-journal"])
-    fs10.rmSync(path35 + suffix, { force: true });
+    fs11.rmSync(path36 + suffix, { force: true });
 }
 function openNodeSqliteGraphStore(options) {
   const source = { path: options.path };
@@ -7154,7 +7223,7 @@ function traverse(store, seeds, options) {
 var EDGE_ENDPOINTS = {
   CONTAINS: [["project", "milestone"], ["project", "file"], ["file", "symbol"], ["symbol", "symbol"], ["file", "test"]],
   REQUIRES: [["milestone", "requirement"], ["requirement", "requirement"], ["issue", "issue"]],
-  IMPLEMENTS: [["symbol", "requirement"], ["file", "requirement"]],
+  IMPLEMENTS: [["symbol", "requirement"], ["file", "requirement"], ["file", "issue"]],
   CALLS: [["symbol", "symbol"]],
   IMPORTS: [["file", "file"]],
   GOVERNS: [["decision", "requirement"], ["decision", "issue"], ["decision", "file"], ["decision", "symbol"]],
@@ -7647,7 +7716,7 @@ function readDeclarationLinks(graph) {
 var TEST_FILE2 = /\.(?:test|spec)\.[cm]?[jt]sx?$/iu;
 var STATE_PREFIX = `${STATE_DIR_NAME}/`;
 var CALL_RESOLUTION_VERSION = 1;
-var RELATION_RULES_VERSION = 1;
+var RELATION_RULES_VERSION = 2;
 var json = (value) => JSON.parse(JSON.stringify(value));
 var clean = (value) => json(Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0)));
 var PROVENANCE_RANK = { declared: 3, static: 2, git: 1, heuristic: 0 };
@@ -7945,7 +8014,7 @@ var Builder = class {
         bindings.set(binding.local, { ref, binding });
     this.contexts.set(analysis.path, { analysis, analyzerVersion, bindings, byIdentity, topLevel, tests, strategy });
   }
-  // ---- declared code relations (Requirement.implements / tests, Decision.governs) ----
+  // ---- declared code relations (Requirement.implements / tests, Issue.implements, Decision.governs) ----
   symbolsNamed(qualifiedName, paths) {
     const matchers = paths.flatMap((p) => compileRepoPattern(p) ?? []);
     const out = [];
@@ -8053,6 +8122,13 @@ var Builder = class {
         }
       }
     }
+    for (const i of truth.issues) {
+      const iss = definitionRef("issue", i.id);
+      if (!this.has(iss))
+        continue;
+      for (const f of this.filesMatching(i.implements.paths))
+        this.addEdge(fileRef(f), "IMPLEMENTS", iss, "project-truth", { provenance: "declared", basis: ["implements.paths"] });
+    }
     for (const d of truth.decisions) {
       const dec = definitionRef("decision", d.id);
       if (!this.has(dec))
@@ -8075,43 +8151,43 @@ var Builder = class {
   }
   /** Module results for every analyzed file: stored results when the Indexer allows it, else TypeScript resolution. */
   resolveModules() {
-    for (const [path35, ctx] of [...this.contexts].sort(([a], [b]) => compareUtf8(a, b))) {
+    for (const [path36, ctx] of [...this.contexts].sort(([a], [b]) => compareUtf8(a, b))) {
       const refs = ctx.analysis.moduleReferences;
-      const previous = this.memo?.previous.get(path35);
+      const previous = this.memo?.previous.get(path36);
       let results;
       let configFiles;
-      if (previous !== void 0 && this.memo?.reusableModules.has(path35) === true && previous.modules.length === refs.length) {
+      if (previous !== void 0 && this.memo?.reusableModules.has(path36) === true && previous.modules.length === refs.length) {
         results = previous.modules;
         configFiles = previous.configFiles;
         this.work.modulesReused += refs.length;
       } else {
-        results = refs.map((ref) => this.input.moduleResolver.resolve(this.request(path35, ref)));
-        configFiles = this.input.moduleResolver.configFiles(path35);
+        results = refs.map((ref) => this.input.moduleResolver.resolve(this.request(path36, ref)));
+        configFiles = this.input.moduleResolver.configFiles(path36);
         this.work.modulesRecomputed += refs.length;
         this.work.filesModulesRecomputed++;
       }
-      this.moduleResults.set(path35, new Map(refs.map((ref, i) => [ref, results[i]])));
-      this.resolution.set(path35, { modules: results, calls: [], exportDependencies: [], configFiles });
+      this.moduleResults.set(path36, new Map(refs.map((ref, i) => [ref, results[i]])));
+      this.resolution.set(path36, { modules: results, calls: [], exportDependencies: [], configFiles });
     }
   }
-  sameModules(path35) {
-    const previous = this.memo?.previous.get(path35);
-    const current = this.resolution.get(path35);
+  sameModules(path36) {
+    const previous = this.memo?.previous.get(path36);
+    const current = this.resolution.get(path36);
     return previous !== void 0 && current !== void 0 && canonicalJson(json({ m: previous.modules }), "modules") === canonicalJson(json({ m: current.modules }), "modules");
   }
   /** A file whose export surface a stored call result may have read has changed. */
-  surfaceChanged(path35) {
-    return this.memo === void 0 || this.memo.changedFiles.has(path35) || !this.sameModules(path35);
+  surfaceChanged(path36) {
+    return this.memo === void 0 || this.memo.changedFiles.has(path36) || !this.sameModules(path36);
   }
-  callFreshnessOf(path35, ctx) {
-    const previous = this.memo?.previous.get(path35);
+  callFreshnessOf(path36, ctx) {
+    const previous = this.memo?.previous.get(path36);
     if (this.memo === void 0 || previous === void 0)
       return "missing";
     if (this.memo.callVersionChanged)
       return "stale-version";
-    if (this.memo.changedFiles.has(path35))
+    if (this.memo.changedFiles.has(path36))
       return "stale-source";
-    if (!this.sameModules(path35))
+    if (!this.sameModules(path36))
       return "stale-modules";
     if (previous.exportDependencies.some((d) => this.surfaceChanged(d)))
       return "stale-dependency";
@@ -8135,12 +8211,12 @@ var Builder = class {
   modulesAndCalls() {
     this.resolveModules();
     this.reportConfigDiagnostics();
-    for (const [path35, ctx] of [...this.contexts].sort(([a], [b]) => compareUtf8(a, b))) {
-      const file = fileRef(path35);
+    for (const [path36, ctx] of [...this.contexts].sort(([a], [b]) => compareUtf8(a, b))) {
+      const file = fileRef(path36);
       for (const ref of ctx.analysis.moduleReferences) {
-        const result = this.moduleResult(path35, ref);
-        this.moduleResolutions.push({ from: path35, specifier: ref.specifier, kind: ref.kind, location: ref.location, result });
-        if (result.status === "resolved" && result.path !== path35 && this.filePaths.has(result.path)) {
+        const result = this.moduleResult(path36, ref);
+        this.moduleResolutions.push({ from: path36, specifier: ref.specifier, kind: ref.kind, location: ref.location, result });
+        if (result.status === "resolved" && result.path !== path36 && this.filePaths.has(result.path)) {
           const kinds = [ref.kind];
           this.addEdge(file, "IMPORTS", fileRef(result.path), "module-resolution", json({ provenance: "static", resolution: result.claim, kinds, typeOnly: ref.typeOnly, declarationOnly: result.declarationOnly, extensionSubstituted: result.extensionSubstituted }), (old) => json({
             ...old,
@@ -8154,29 +8230,29 @@ var Builder = class {
         }
       }
     }
-    for (const [path35, ctx] of [...this.contexts].sort(([a], [b]) => compareUtf8(a, b))) {
+    for (const [path36, ctx] of [...this.contexts].sort(([a], [b]) => compareUtf8(a, b))) {
       const sites = ctx.analysis.callSites;
-      let freshness = this.callFreshnessOf(path35, ctx);
-      const previous = this.memo?.previous.get(path35);
+      let freshness = this.callFreshnessOf(path36, ctx);
+      const previous = this.memo?.previous.get(path36);
       let outcomes = freshness === "fresh" && previous !== void 0 ? this.rehydrate(previous.calls) : void 0;
       if (freshness === "fresh" && outcomes === void 0)
         freshness = "stale-dependency";
       let exportDependencies = previous?.exportDependencies ?? [];
       if (outcomes === void 0) {
         const deps = /* @__PURE__ */ new Set();
-        outcomes = sites.map((call) => this.resolveByStrategy(path35, ctx, call, deps));
-        deps.delete(path35);
+        outcomes = sites.map((call) => this.resolveByStrategy(path36, ctx, call, deps));
+        deps.delete(path36);
         exportDependencies = [...deps].sort(compareUtf8);
         this.work.callsRecomputed += sites.length;
         this.work.filesCallsRecomputed++;
       } else {
         this.work.callsReused += sites.length;
       }
-      this.callFreshness.set(path35, freshness);
+      this.callFreshness.set(path36, freshness);
       const resolved = outcomes;
-      const current = this.resolution.get(path35);
+      const current = this.resolution.get(path36);
       if (current !== void 0) {
-        this.resolution.set(path35, {
+        this.resolution.set(path36, {
           ...current,
           calls: resolved.map((o) => ({
             status: o.status,
@@ -8192,7 +8268,7 @@ var Builder = class {
         this.calls[outcome.status]++;
         const target = outcome.target;
         this.callResolutions.push({
-          path: path35,
+          path: path36,
           calleeText: call.calleeText,
           location: call.location,
           status: outcome.status,
@@ -8213,7 +8289,7 @@ var Builder = class {
         const declarationOnly = /\.d\.[cm]?ts$/u.test(target.file);
         this.addEdge(call.enclosingSymbol, "CALLS", target.symbol.ref, "call-resolution", json({ provenance: "static", resolution: "exact", callSites: 1, declarationOnly }), (old) => json({ ...old, callSites: (typeof old.callSites === "number" ? old.callSites : 0) + 1 }));
       });
-      this.validatedByCalls(path35, ctx, exactTargets);
+      this.validatedByCalls(path36, ctx, exactTargets);
     }
   }
   /**
@@ -8234,7 +8310,7 @@ var Builder = class {
     }
   }
   /** VALIDATED_BY Symbol → Test: exact calls inside the test's range to code outside test files. */
-  validatedByCalls(path35, ctx, exact) {
+  validatedByCalls(path36, ctx, exact) {
     for (const { call, target } of exact) {
       const test = this.innermostTest(ctx.tests, call.location);
       if (test === void 0)
@@ -8242,7 +8318,7 @@ var Builder = class {
       const targetCtx = this.contexts.get(target.file);
       if (TEST_FILE2.test(target.file) || (targetCtx?.analysis.tests.length ?? 0) > 0)
         continue;
-      this.addEdge(target.symbol.ref, "VALIDATED_BY", testRef(path35, test.fullName), "test", { provenance: "static", basis: ["exact-call"] });
+      this.addEdge(target.symbol.ref, "VALIDATED_BY", testRef(path36, test.fullName), "test", { provenance: "static", basis: ["exact-call"] });
     }
   }
   innermostTest(tests, at) {
@@ -8268,11 +8344,11 @@ var Builder = class {
       deps.add(d);
     return r.result;
   }
-  viaImport(path35, entry, member, kind, deps) {
+  viaImport(path36, entry, member, kind, deps) {
     const { ref, binding } = entry;
     if (binding.typeOnly)
       return { status: "unresolved", reason: "type-only-binding" };
-    const module = this.moduleResult(path35, ref);
+    const module = this.moduleResult(path36, ref);
     if (module.status !== "resolved")
       return { status: "unresolved", reason: module.status === "external" ? "external-module" : "module-unresolved" };
     if (binding.imported === "*") {
@@ -8292,19 +8368,19 @@ var Builder = class {
     return symbol?.kind === "method" ? { status: "exact", target: { file, symbol } } : { status: "unresolved", reason: "static-member-not-found" };
   }
   /** Exact resolution from syntax facts only (no type checker). Anything else is unresolved or ambiguous. */
-  resolveByStrategy(path35, ctx, call, deps) {
+  resolveByStrategy(path36, ctx, call, deps) {
     if (ctx.strategy === "module-bindings")
-      return this.resolveCall(path35, ctx, call, deps);
+      return this.resolveCall(path36, ctx, call, deps);
     if (ctx.strategy === "none")
       return { status: "unresolved", reason: "call-resolution-unavailable" };
-    return this.sameFileFunction(path35, ctx, call);
+    return this.sameFileFunction(path36, ctx, call);
   }
   /**
    * same-file-functions (T18.0): a bare-name call, not bound locally and not possibly a class member,
    * to the only function of that name at module or namespace scope in the same file. Everything else
    * stays unresolved: another file, a member, an overload set or a macro is not guessed.
    */
-  sameFileFunction(path35, ctx, call) {
+  sameFileFunction(path36, ctx, call) {
     const names = call.calleePath;
     if (call.kind !== "identifier" || names === void 0 || names.length !== 1)
       return { status: "unresolved", reason: "receiver-type-unknown" };
@@ -8323,9 +8399,9 @@ var Builder = class {
       return { status: "unresolved", reason: all.length > 0 ? "target-not-callable" : "no-candidate" };
     if (all.length > 1)
       return { status: "ambiguous", reason: "same-file-candidates" };
-    return { status: "exact", target: { file: path35, symbol: only } };
+    return { status: "exact", target: { file: path36, symbol: only } };
   }
-  resolveCall(path35, ctx, call, deps) {
+  resolveCall(path36, ctx, call, deps) {
     const names = call.calleePath;
     if (names === void 0 || names.length === 0)
       return { status: "unresolved", reason: "computed-callee" };
@@ -8343,18 +8419,18 @@ var Builder = class {
       if (enclosing?.memberScope !== "instance" || enclosing.parent === void 0)
         return { status: "unresolved", reason: "this-receiver-unknown" };
       const target = ctx.byIdentity.get(`${enclosing.parent}.${second}`);
-      return target?.kind === "method" ? { status: "exact", target: { file: path35, symbol: target } } : { status: "unresolved", reason: "member-not-found" };
+      return target?.kind === "method" ? { status: "exact", target: { file: path36, symbol: target } } : { status: "unresolved", reason: "member-not-found" };
     }
     const imported = ctx.bindings.get(root);
     if (imported !== void 0)
-      return this.viaImport(path35, imported, second, call.kind, deps);
+      return this.viaImport(path36, imported, second, call.kind, deps);
     const local = ctx.topLevel.get(root) ?? [];
     if (second === void 0) {
       const callable = local.filter((s) => CALLABLE_BY_KIND[call.kind].has(s.kind));
       if (callable.length > 1)
         return { status: "ambiguous", reason: "same-file-candidates" };
       const only = callable[0];
-      return only === void 0 ? { status: "unresolved", reason: local.length > 0 ? "target-not-callable" : "no-candidate" } : { status: "exact", target: { file: path35, symbol: only } };
+      return only === void 0 ? { status: "unresolved", reason: local.length > 0 ? "target-not-callable" : "no-candidate" } : { status: "exact", target: { file: path36, symbol: only } };
     }
     const classes = local.filter((s) => s.kind === "class");
     if (classes.length > 1)
@@ -8362,18 +8438,18 @@ var Builder = class {
     const cls = classes[0];
     if (cls === void 0 || local.length !== 1)
       return { status: "unresolved", reason: "receiver-type-unknown" };
-    return this.staticMember(path35, cls, second);
+    return this.staticMember(path36, cls, second);
   }
   // ---- annotations ----
   annotationRelations() {
-    for (const [path35, ctx] of [...this.contexts].sort(([a], [b]) => compareUtf8(a, b))) {
+    for (const [path36, ctx] of [...this.contexts].sort(([a], [b]) => compareUtf8(a, b))) {
       if (ctx.analysis.annotations.length === 0)
         continue;
       const candidates3 = [
         ...ctx.analysis.symbols.flatMap((s) => [s.location, ...s.additionalLocations ?? []].map((location4) => ({ value: { kind: "symbol", ref: s.ref }, location: location4 }))),
         ...ctx.tests.map((t2) => ({ value: { kind: "test", fullName: t2.fullName }, location: t2.location }))
       ];
-      const text4 = this.input.sourceText(path35);
+      const text4 = this.input.sourceText(path36);
       for (const annotation of ctx.analysis.annotations) {
         const attached = attachAnnotation(annotation.location, candidates3, text4);
         const target = attached.kind === "file" ? { kind: "file" } : attached.value;
@@ -8393,9 +8469,9 @@ var Builder = class {
           if (target.kind === "symbol")
             this.addEdge(target.ref, "IMPLEMENTS", entity.ref, "annotation", metadata);
           else if (target.kind === "test")
-            this.addEdge(entity.ref, "VALIDATED_BY", testRef(path35, target.fullName), "annotation", metadata);
+            this.addEdge(entity.ref, "VALIDATED_BY", testRef(path36, target.fullName), "annotation", metadata);
           else
-            this.addEdge(fileRef(path35), "IMPLEMENTS", entity.ref, "annotation", metadata);
+            this.addEdge(fileRef(path36), "IMPLEMENTS", entity.ref, "annotation", metadata);
           this.annotations[target.kind]++;
         }
       }
@@ -8478,8 +8554,8 @@ var TRUTH_SCOPE = "truth";
 function codeFileOf(ref) {
   return ref.type === "file" || ref.type === "symbol" || ref.type === "test" ? ref.path : void 0;
 }
-function fileScope(path35) {
-  return `file:${path35}`;
+function fileScope(path36) {
+  return `file:${path36}`;
 }
 function nodeScope(ref) {
   const file = codeFileOf(ref);
@@ -8618,7 +8694,7 @@ function resolvePython(request, files, roots = discoverPythonRoots(files)) {
     return { status: "ambiguous", candidates: found.sort(compareUtf8) };
   return { status: "resolved", path: found[0], claim: "python-local", declarationOnly: false, extensionSubstituted: false };
 }
-var isPythonMetadataFile = (path35) => METADATA_FILE.test(baseOf(path35));
+var isPythonMetadataFile = (path36) => METADATA_FILE.test(baseOf(path36));
 
 // packages/graph/dist/build/resolve/languages.js
 var PYTHON_RESOLUTION_VERSION = "2";
@@ -8664,21 +8740,21 @@ function createLanguageModuleResolver(options) {
 }
 
 // packages/graph/dist/incremental/indexer.js
-import fs13 from "node:fs";
-import path15 from "node:path";
+import fs14 from "node:fs";
+import path16 from "node:path";
 
 // packages/graph/dist/incremental/analysis-cache.js
 import { createHash as createHash10 } from "node:crypto";
 
 // packages/graph/dist/incremental/files.js
-import fs11 from "node:fs";
-import path13 from "node:path";
+import fs12 from "node:fs";
+import path14 from "node:path";
 function symlinkOnPath3(root, repoPath3) {
   const segments = repoPath3.split("/");
   for (let i = 1; i <= segments.length; i++) {
     const partial = segments.slice(0, i).join("/");
     try {
-      if (fs11.lstatSync(path13.join(root, partial)).isSymbolicLink())
+      if (fs12.lstatSync(path14.join(root, partial)).isSymbolicLink())
         return partial;
     } catch {
       return void 0;
@@ -8690,7 +8766,7 @@ function readRegenerable(root, repoPath3) {
   if (symlinkOnPath3(root, repoPath3) !== void 0)
     return { error: "the path contains a symlink" };
   try {
-    return { text: fs11.readFileSync(path13.join(root, repoPath3), "utf8") };
+    return { text: fs12.readFileSync(path14.join(root, repoPath3), "utf8") };
   } catch (error) {
     return error.code === "ENOENT" ? {} : { error: error.message };
   }
@@ -8700,7 +8776,7 @@ async function symlinkOnPathAsync(root, repoPath3) {
   for (let i = 1; i <= segments.length; i++) {
     const partial = segments.slice(0, i).join("/");
     try {
-      if ((await fs11.promises.lstat(path13.join(root, partial))).isSymbolicLink())
+      if ((await fs12.promises.lstat(path14.join(root, partial))).isSymbolicLink())
         return partial;
     } catch {
       return void 0;
@@ -8712,7 +8788,7 @@ async function readRegenerableAsync(root, repoPath3) {
   if (await symlinkOnPathAsync(root, repoPath3) !== void 0)
     return { error: "the path contains a symlink" };
   try {
-    return { text: await fs11.promises.readFile(path13.join(root, repoPath3), "utf8") };
+    return { text: await fs12.promises.readFile(path14.join(root, repoPath3), "utf8") };
   } catch (error) {
     return error.code === "ENOENT" ? {} : { error: error.message };
   }
@@ -8725,14 +8801,14 @@ function writeRegenerable(root, repoPath3, text4) {
   const link = symlinkOnPath3(root, target);
   if (link !== void 0)
     return failure([createDiagnostic("WRITE_NOT_ALLOWED", `Refusing to write "${target}": "${link}" is a symlink`, { path: target })]);
-  const absolute = path13.join(root, target);
+  const absolute = path14.join(root, target);
   const temp = `${absolute}.${process.pid}.tmp`;
   try {
-    fs11.mkdirSync(path13.dirname(absolute), { recursive: true });
-    fs11.writeFileSync(temp, text4, "utf8");
-    fs11.renameSync(temp, absolute);
+    fs12.mkdirSync(path14.dirname(absolute), { recursive: true });
+    fs12.writeFileSync(temp, text4, "utf8");
+    fs12.renameSync(temp, absolute);
   } catch (error) {
-    fs11.rmSync(temp, { force: true });
+    fs12.rmSync(temp, { force: true });
     return failure([createDiagnostic("FILE_WRITE_ERROR", `Cannot write "${target}": ${error.message}`, { path: target })]);
   }
   return success(target);
@@ -8743,14 +8819,14 @@ function pruneRegenerableDirectory(root, repoDir, keep) {
   let removed = 0;
   let entries;
   try {
-    entries = fs11.readdirSync(path13.join(root, repoDir), { withFileTypes: true });
+    entries = fs12.readdirSync(path14.join(root, repoDir), { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
     if (!entry.isFile() || keep.has(entry.name))
       continue;
-    fs11.rmSync(path13.join(root, repoDir, entry.name), { force: true });
+    fs12.rmSync(path14.join(root, repoDir, entry.name), { force: true });
     removed++;
   }
   return removed;
@@ -8806,8 +8882,8 @@ function pruneAnalysisCache(root, keep) {
 }
 
 // packages/graph/dist/incremental/assess.js
-import fs12 from "node:fs";
-import path14 from "node:path";
+import fs13 from "node:fs";
+import path15 from "node:path";
 
 // packages/graph/dist/incremental/state.js
 import { createHash as createHash11 } from "node:crypto";
@@ -8969,7 +9045,7 @@ function isResolutionConfigFile(repoPath3) {
 }
 function hashOnDisk(root, repoPath3) {
   try {
-    return computeContentHash(fs12.readFileSync(path14.join(root, repoPath3)), fingerprintModeOf(repoPath3)).contentHash;
+    return computeContentHash(fs13.readFileSync(path15.join(root, repoPath3)), fingerprintModeOf(repoPath3)).contentHash;
   } catch {
     return void 0;
   }
@@ -9026,8 +9102,8 @@ function readScope(store, scope) {
   if (scope === TRUTH_SCOPE)
     nodes = TRUTH_TYPES.flatMap((type) => listAll(store, { type }));
   else {
-    const path35 = scope.slice("file:".length);
-    nodes = [...store.getNodes([fileRef(path35)]), ...listAll(store, { ownerFile: path35 })];
+    const path36 = scope.slice("file:".length);
+    nodes = [...store.getNodes([fileRef(path36)]), ...listAll(store, { ownerFile: path36 })];
   }
   const edges = /* @__PURE__ */ new Map();
   for (let i = 0; i < nodes.length; i += REF_CHUNK) {
@@ -9106,17 +9182,17 @@ function applyGraphDiff(tx, diff) {
 // packages/graph/dist/incremental/indexer.js
 var GRAPH_DB_FILE_PATH = `${STATE_DIR_NAME}/generated/graph.db`;
 function openProjectGraphStore(root) {
-  const rootDir = path15.resolve(root);
+  const rootDir = path16.resolve(root);
   const allowed = checkWriteBoundary(rootDir, GRAPH_DB_FILE_PATH, "regenerable");
   if (allowed.value === void 0)
     return { diagnostics: allowed.diagnostics, regenerable: false };
-  const file = path15.join(rootDir, allowed.value.path);
-  fs13.mkdirSync(path15.dirname(file), { recursive: true });
+  const file = path16.join(rootDir, allowed.value.path);
+  fs14.mkdirSync(path16.dirname(file), { recursive: true });
   return openNodeSqliteGraphStore({ path: file, onUnsupportedSchema: "recreate" });
 }
 function openProjectGraphReader(root) {
-  const file = path15.join(path15.resolve(root), GRAPH_DB_FILE_PATH);
-  if (!fs13.existsSync(file))
+  const file = path16.join(path16.resolve(root), GRAPH_DB_FILE_PATH);
+  if (!fs14.existsSync(file))
     return openNodeSqliteGraphStore({ path: ":memory:" });
   return openNodeSqliteGraphStore({ path: file, readOnly: true });
 }
@@ -9128,7 +9204,7 @@ async function indexRepository(root, options) {
     options.onPhase?.(name, now - phaseStart);
     phaseStart = now;
   };
-  const rootDir = path15.resolve(root);
+  const rootDir = path16.resolve(root);
   const { store } = options;
   const window = options.historyWindow ?? HISTORY_WINDOW;
   const diagnostics = [];
@@ -9218,7 +9294,7 @@ async function indexRepository(root, options) {
         continue;
       }
       changedFiles.add(f.path);
-      const content2 = fs13.readFileSync(path15.join(rootDir, f.path));
+      const content2 = fs14.readFileSync(path16.join(rootDir, f.path));
       analyzed++;
       const started = performance.now();
       const r = analyzer.analyze({ path: f.path, content: content2 });
@@ -9295,7 +9371,7 @@ async function indexRepository(root, options) {
       if (known !== void 0)
         return known;
       try {
-        return fs13.readFileSync(path15.join(rootDir, p), "utf8");
+        return fs14.readFileSync(path16.join(rootDir, p), "utf8");
       } catch {
         return void 0;
       }
@@ -9464,7 +9540,7 @@ function graphChanged(diff) {
 }
 
 // packages/graph/dist/incremental/inspect.js
-import path16 from "node:path";
+import path17 from "node:path";
 async function inspectIndex(root, options) {
   let phaseStart = performance.now();
   const phase = (name) => {
@@ -9472,7 +9548,7 @@ async function inspectIndex(root, options) {
     options.onPhase?.(name, now - phaseStart);
     phaseStart = now;
   };
-  const rootDir = path16.resolve(root);
+  const rootDir = path17.resolve(root);
   const window = options.historyWindow ?? HISTORY_WINDOW;
   const diagnostics = [];
   const loaded = loadProjectTruth(rootDir);
@@ -9635,35 +9711,35 @@ function sameFingerprint(a, b) {
 async function readIndexedModuleReferences(root, paths) {
   const read2 = readIndexState(root);
   if (read2.state === void 0)
-    return paths.map((path35) => ({ status: "unavailable", path: path35, reason: read2.problem ?? "index state" }));
+    return paths.map((path36) => ({ status: "unavailable", path: path36, reason: read2.problem ?? "index state" }));
   const files = new Map(read2.state.files.map((f) => [f.path, f]));
-  const keys = paths.map((path35) => {
-    const f = files.get(path35);
-    return f?.analysis === void 0 || f.analysis.status !== "ok" || f.resolution === void 0 ? void 0 : { path: path35, contentHash: f.contentHash, analyzer: f.analysis.analyzer, analyzerIdentity: f.analysis.identity };
+  const keys = paths.map((path36) => {
+    const f = files.get(path36);
+    return f?.analysis === void 0 || f.analysis.status !== "ok" || f.resolution === void 0 ? void 0 : { path: path36, contentHash: f.contentHash, analyzer: f.analysis.analyzer, analyzerIdentity: f.analysis.identity };
   });
   const present = keys.filter((k) => k !== void 0);
   const cached = await readCachedAnalyses(root, present);
   const byPath = new Map(present.map((k, i) => [k.path, cached[i]]));
-  return paths.map((path35, i) => {
-    const f = files.get(path35);
+  return paths.map((path36, i) => {
+    const f = files.get(path36);
     if (f === void 0)
-      return { status: "not-indexed", path: path35 };
+      return { status: "not-indexed", path: path36 };
     if (keys[i] === void 0)
-      return { status: "not-analyzed", path: path35 };
-    const entry = byPath.get(path35);
+      return { status: "not-analyzed", path: path36 };
+    const entry = byPath.get(path36);
     const modules = f.resolution?.modules ?? [];
     if (entry === void 0)
-      return { status: "unavailable", path: path35, reason: "analysis cache entry missing" };
+      return { status: "unavailable", path: path36, reason: "analysis cache entry missing" };
     const refs = entry.analysis.moduleReferences;
     if (refs.length !== modules.length)
-      return { status: "unavailable", path: path35, reason: "analysis and resolution do not match" };
+      return { status: "unavailable", path: path36, reason: "analysis and resolution do not match" };
     return {
       status: "ok",
-      path: path35,
+      path: path36,
       language: entry.analysis.language,
       references: refs.map((r, j) => {
         const resolution = modules[j];
-        const target = resolution.status === "resolved" && resolution.path !== path35 && files.has(resolution.path) ? resolution.path : void 0;
+        const target = resolution.status === "resolved" && resolution.path !== path36 && files.has(resolution.path) ? resolution.path : void 0;
         return { kind: r.kind, specifier: r.specifier, typeOnly: r.typeOnly, location: r.location, resolution, ...target === void 0 ? {} : { target } };
       })
     };
@@ -9676,13 +9752,14 @@ var STEPS = {
   symbol: [
     { edge: "CALLS", direction: "incoming", relation: "direct" },
     { edge: "VALIDATED_BY", direction: "outgoing", relation: "direct" },
-    { edge: "IMPLEMENTS", direction: "outgoing", relation: "direct" },
+    // IMPLEMENTS also links Issues (H-78); impact reports Requirements here, as before.
+    { edge: "IMPLEMENTS", direction: "outgoing", relation: "direct", to: "requirement" },
     { edge: "GOVERNS", direction: "incoming", relation: "direct" },
     { edge: "CONTAINS", direction: "incoming", relation: "structural" }
   ],
   file: [
     { edge: "IMPORTS", direction: "incoming", relation: "direct" },
-    { edge: "IMPLEMENTS", direction: "outgoing", relation: "direct" },
+    { edge: "IMPLEMENTS", direction: "outgoing", relation: "direct", to: "requirement" },
     { edge: "GOVERNS", direction: "incoming", relation: "direct" },
     { edge: "CONTAINS", direction: "outgoing", relation: "structural", seedOnly: true },
     { edge: "CHANGED_WITH", direction: "outgoing", relation: "historical" }
@@ -9729,6 +9806,8 @@ function impact(store, seeds, options = {}) {
         const other = step2.direction === "incoming" ? e.from : e.to;
         if (seedSet.has(other))
           continue;
+        if (step2.to !== void 0 && refOf3(other).type !== step2.to)
+          continue;
         const relation = RANK[step2.relation] > RANK[current.relation] ? step2.relation : current.relation;
         const item = { id: other, ref: refOf3(other), depth: current.depth + 1, relation, via: { from: current.id, edge: step2.edge, direction: step2.direction } };
         const known = best.get(other);
@@ -9755,13 +9834,13 @@ function trace(store, seed, options = {}) {
 
 // packages/graph/dist/query/locations.js
 var KEYS = ["startLine", "startColumn", "endLine", "endColumn"];
-function asLocation(v, path35) {
+function asLocation(v, path36) {
   if (typeof v !== "object" || v === null || Array.isArray(v))
     return void 0;
   const o = v;
-  if (o.path !== path35)
+  if (o.path !== path36)
     return void 0;
-  const out = { path: path35 };
+  const out = { path: path36 };
   for (const k of KEYS) {
     const n = o[k];
     if (n === void 0)
@@ -9798,12 +9877,12 @@ var packageInfo3 = {
 
 // packages/director/dist/adoption/baseline.js
 import { createHash as createHash12 } from "node:crypto";
-import fs14 from "node:fs";
-import path18 from "node:path";
+import fs15 from "node:fs";
+import path19 from "node:path";
 
 // packages/director/dist/review/record.js
 import fsp3 from "node:fs/promises";
-import path17 from "node:path";
+import path18 from "node:path";
 var REVIEW_RECORD_FORMAT = "duo.review-record/1";
 var REVIEW_ASSIST_FORMAT = "duo.review-assist/1";
 var ADOPTION_BASELINE_FORMAT = "duo.adoption-baseline/2";
@@ -9897,15 +9976,15 @@ function assistBody(reviewId, result) {
     skippedChecks: a.skippedChecks
   };
 }
-function verifyReviewRecord(text4, path35 = "record") {
+function verifyReviewRecord(text4, path36 = "record") {
   let parsed;
   try {
     parsed = JSON.parse(text4);
   } catch (error) {
-    return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path35} is not valid JSON: ${error.message}`, { path: path35 })]);
+    return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path36} is not valid JSON: ${error.message}`, { path: path36 })]);
   }
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
-    return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path35} is not a record object`, { path: path35 })]);
+    return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path36} is not a record object`, { path: path36 })]);
   const body = { ...parsed };
   const id3 = body.id;
   delete body.id;
@@ -9913,29 +9992,29 @@ function verifyReviewRecord(text4, path35 = "record") {
   const format = body.format;
   const prefix = typeof format === "string" ? ID_PREFIX[format] : void 0;
   if (prefix === void 0)
-    return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path35} has format ${String(format)}`, { path: path35 })]);
+    return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path36} has format ${String(format)}`, { path: path36 })]);
   const expected = hexId(prefix, body);
   if (id3 !== expected)
-    return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path35}: id ${String(id3)} does not match its content (${expected})`, { path: path35 })]);
+    return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path36}: id ${String(id3)} does not match its content (${expected})`, { path: path36 })]);
   return success({ id: expected, body });
 }
-async function writeHistoryRecord(root, path35, file, id3, body) {
-  const guarded2 = guardWrite(root, path35, "human-history", { restrictTo: [`${REVIEWS_DIR}/`] });
+async function writeHistoryRecord(root, path36, file, id3, body) {
+  const guarded2 = guardWrite(root, path36, "human-history", { restrictTo: [`${REVIEWS_DIR}/`] });
   if (guarded2.value === void 0)
     return failure(guarded2.diagnostics);
   try {
     if (await createFileExclusive(guarded2.value.absolute, `${JSON.stringify(file, null, 2)}
 `))
-      return success({ id: id3, path: path35, status: "created" });
-    const existing = verifyReviewRecord(await fsp3.readFile(guarded2.value.absolute, "utf8"), path35);
+      return success({ id: id3, path: path36, status: "created" });
+    const existing = verifyReviewRecord(await fsp3.readFile(guarded2.value.absolute, "utf8"), path36);
     if (existing.value === void 0)
       return failure(existing.diagnostics);
     if (stableJson(existing.value.body) !== stableJson(body)) {
-      return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path35} exists with other content under the same ID; it is not overwritten`, { path: path35 })]);
+      return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", `${path36} exists with other content under the same ID; it is not overwritten`, { path: path36 })]);
     }
-    return success({ id: id3, path: path35, status: "unchanged" });
+    return success({ id: id3, path: path36, status: "unchanged" });
   } catch (error) {
-    return failure([createDiagnostic("FILE_WRITE_ERROR", `Cannot record ${path35}: ${error.message}`, { path: path35 })]);
+    return failure([createDiagnostic("FILE_WRITE_ERROR", `Cannot record ${path36}: ${error.message}`, { path: path36 })]);
   }
 }
 async function recordReview(result, options) {
@@ -9959,10 +10038,10 @@ async function recordReview(result, options) {
   return assist.value === void 0 ? failure(diagnostics) : success({ ...main.value, assist: assist.value }, diagnostics);
 }
 async function listReviewRecords(root) {
-  const dir = path17.join(root, REVIEWS_DIR);
+  const dir = path18.join(root, REVIEWS_DIR);
   let names;
   try {
-    for (const part of [path17.dirname(dir), dir]) {
+    for (const part of [path18.dirname(dir), dir]) {
       const stat = await fsp3.lstat(part);
       if (!stat.isDirectory() || stat.isSymbolicLink()) {
         return failure([createDiagnostic("REVIEW_RECORD_INTEGRITY", "Review history directory is not a real project directory")]);
@@ -9976,10 +10055,10 @@ async function listReviewRecords(root) {
   const read2 = async (name) => {
     const rel = `${REVIEWS_DIR}/${name}`;
     try {
-      const stat = await fsp3.lstat(path17.join(dir, name));
+      const stat = await fsp3.lstat(path18.join(dir, name));
       if (!stat.isFile())
         return void 0;
-      const text4 = await fsp3.readFile(path17.join(dir, name), "utf8");
+      const text4 = await fsp3.readFile(path18.join(dir, name), "utf8");
       const verified = verifyReviewRecord(text4, rel);
       diagnostics.push(...verified.diagnostics);
       if (verified.value === void 0)
@@ -10358,6 +10437,16 @@ function seedEvidence(ctx, seed) {
 function isActive(d) {
   return d.state === "confirmed" && d.supersededBy === null;
 }
+function withDecisionAuthority(truth, claims) {
+  const decisions = new Map(truth.decisions.map((d) => [d.id, d]));
+  return claims.map((c) => {
+    const d = c.subject.kind === "decision" ? decisions.get(c.subject.id) : void 0;
+    if (d === void 0)
+      return c;
+    const decisionAuthority = { state: d.state, active: isActive(d), supersedes: d.supersedes, supersededBy: d.supersededBy };
+    return { ...c, decisionAuthority };
+  });
+}
 
 // packages/director/dist/review/scope.js
 var TEST_NAME = /(?:\.|^)(?:test|spec|e2e|stories|story|bench)\.[cm]?[jt]sx?$/u;
@@ -10388,10 +10477,10 @@ var GENERATED_DIRS = /* @__PURE__ */ new Set([
 ]);
 var GENERATED_NAME = /\.(?:generated|gen|min)\.[cm]?[jt]sx?$|\.(?:g|g\.i|designer)\.cs$|\.generated\.h$|_pb2(?:_grpc)?\.py$|\.pb\.(?:h|cc)$/iu;
 var DOC_DIRS = /* @__PURE__ */ new Set(["docs", "doc", "examples", "example"]);
-function nonApplicationReason(path35) {
-  if (path35 === STATE_DIR_NAME || path35.startsWith(`${STATE_DIR_NAME}/`))
+function nonApplicationReason(path36) {
+  if (path36 === STATE_DIR_NAME || path36.startsWith(`${STATE_DIR_NAME}/`))
     return "project-truth";
-  const segments = path35.split("/");
+  const segments = path36.split("/");
   const name = segments[segments.length - 1] ?? "";
   const dirs = segments.slice(0, -1).map((s) => s.toLowerCase());
   if (TEST_NAME.test(name) || OTHER_TEST_NAME.test(name) || SETUP_NAME.test(name) || dirs.some((d) => TEST_DIRS.has(d)))
@@ -10427,7 +10516,7 @@ function unlinkedAdditions(ctx) {
       continue;
     const owned2 = ctx.graph.listNodes({ ownerFile: f.path, limit: 1e4 }).map((n) => n.ref);
     const from = [fileRef(f.path), ...seeds.map((s) => s.entity), ...owned2];
-    if (ctx.graph.adjacentEdges(from, { direction: "outgoing", types: ["IMPLEMENTS"], limit: 1 }).edges.length > 0)
+    if (ctx.graph.adjacentEdges(from, { direction: "outgoing", types: ["IMPLEMENTS"], limit: 1e4 }).edges.some((e) => e.to.startsWith("req:")))
       continue;
     const c = makeClaim(ctx, {
       rule: "unlinked-addition",
@@ -10455,14 +10544,14 @@ ${governing}
 ${offending}`).slice(7, 23)}`;
 }
 var dependencyOffending = (manifest, name) => `dep:${manifest}#${name}`;
-var sourceOffending = (path35, section) => `src:${path35}#${section ?? ""}`;
+var sourceOffending = (path36, section) => `src:${path36}#${section ?? ""}`;
 function declaredReferenceParts(message2) {
   const m = /^(\S+) (\S+) "(.*)" matches /u.exec(message2);
   return m === null ? void 0 : { governing: m[1] ?? "", offending: `ref:${m[2] ?? ""}:${m[3] ?? ""}` };
 }
 
 // packages/director/dist/context/policy.js
-var CONTEXT_POLICY_VERSION = "3";
+var CONTEXT_POLICY_VERSION = "8";
 var EDGE_WEIGHTS = {
   GOVERNS: 1,
   IMPLEMENTS: 0.9,
@@ -10646,11 +10735,11 @@ function overlaps(loc2, range) {
   const end2 = loc2.endLine ?? loc2.startLine;
   return range[0] <= end2 && range[1] >= loc2.startLine;
 }
-function owned(graph, path35) {
+function owned(graph, path36) {
   const out = [];
   let afterId;
   for (; ; ) {
-    const page = graph.listNodes({ ownerFile: path35, limit: 1e3, ...afterId === void 0 ? {} : { afterId } });
+    const page = graph.listNodes({ ownerFile: path36, limit: 1e3, ...afterId === void 0 ? {} : { afterId } });
     out.push(...page);
     if (page.length < 1e3)
       return out;
@@ -10669,11 +10758,11 @@ function truthDefinitions(truth) {
 }
 function diffSeeds(files, graph, truth) {
   const seeds = /* @__PURE__ */ new Map();
-  const put = (entity, reason, path35, evidenceId2) => {
+  const put = (entity, reason, path36, evidenceId2) => {
     if (graph.getNode(entity) === void 0)
       return;
     const id3 = nodeId(entity);
-    const s = seeds.get(id3) ?? { entity, reason, path: path35, evidence: /* @__PURE__ */ new Set() };
+    const s = seeds.get(id3) ?? { entity, reason, path: path36, evidence: /* @__PURE__ */ new Set() };
     s.evidence.add(evidenceId2);
     seeds.set(id3, s);
   };
@@ -10951,7 +11040,7 @@ async function decisionForbids(ctx) {
 function implemented(ctx) {
   const out = /* @__PURE__ */ new Map();
   for (const s of codeSeeds(ctx)) {
-    const edges = ctx.graph.adjacentEdges([s.entity], { direction: "outgoing", types: ["IMPLEMENTS"], limit: 1e3 }).edges;
+    const edges = ctx.graph.adjacentEdges([s.entity], { direction: "outgoing", types: ["IMPLEMENTS"], limit: 1e3 }).edges.filter((e) => e.to.startsWith("req:"));
     for (const e of edges) {
       const id3 = e.to.slice("req:".length);
       out.set(id3, [...out.get(id3) ?? [], s]);
@@ -11491,10 +11580,10 @@ async function observeWorkingTree(git, cap = 1e3) {
 var ADOPTION_FILE = /^adoption-[0-9a-f]{16}\.json$/u;
 function fileHash(root, p) {
   try {
-    const abs = path18.join(root, p);
-    if (!fs14.lstatSync(abs).isFile())
+    const abs = path19.join(root, p);
+    if (!fs15.lstatSync(abs).isFile())
       return void 0;
-    return `sha256:${createHash12("sha256").update(fs14.readFileSync(abs)).digest("hex")}`;
+    return `sha256:${createHash12("sha256").update(fs15.readFileSync(abs)).digest("hex")}`;
   } catch {
     return void 0;
   }
@@ -11513,10 +11602,10 @@ async function bootstrapTruthOf(root, git) {
   return out.sort((a, b) => compareUtf8(a.path, b.path));
 }
 function loadAdoptionBaseline(root) {
-  const dir = path18.join(root, REVIEWS_DIR);
+  const dir = path19.join(root, REVIEWS_DIR);
   let names;
   try {
-    names = fs14.readdirSync(dir).filter((n) => ADOPTION_FILE.test(n)).sort(compareUtf8);
+    names = fs15.readdirSync(dir).filter((n) => ADOPTION_FILE.test(n)).sort(compareUtf8);
   } catch {
     return { status: "missing" };
   }
@@ -11527,7 +11616,7 @@ function loadAdoptionBaseline(root) {
   const rel = `${REVIEWS_DIR}/${names[0] ?? ""}`;
   let text4;
   try {
-    text4 = fs14.readFileSync(path18.join(root, rel), "utf8");
+    text4 = fs15.readFileSync(path19.join(root, rel), "utf8");
   } catch (error) {
     return { status: "incompatible", path: rel, reason: error.message };
   }
@@ -11716,15 +11805,15 @@ function codePoints(text4) {
   return n;
 }
 function truncateToTokens(text4, maxTokens) {
-  const tokens2 = encode(text4, PLAIN_TEXT);
-  if (tokens2.length <= maxTokens)
+  const tokens3 = encode(text4, PLAIN_TEXT);
+  if (tokens3.length <= maxTokens)
     return { text: text4, truncated: false };
-  return { text: decode(tokens2.slice(0, Math.max(0, maxTokens))).replace(/\uFFFD+$/u, ""), truncated: true };
+  return { text: decode(tokens3.slice(0, Math.max(0, maxTokens))).replace(/\uFFFD+$/u, ""), truncated: true };
 }
 
 // packages/director/dist/context/cache.js
-import fs15 from "node:fs";
-import path19 from "node:path";
+import fs16 from "node:fs";
+import path20 from "node:path";
 var PACKET_CACHE_DIR = `${STATE_DIR_NAME}/cache/packets`;
 var FORMAT2 = "duo.packet-cache/1";
 function fileOf(digest) {
@@ -11734,10 +11823,10 @@ function readCachedPacket(root, digest) {
   if (!/^sha256:[0-9a-f]{64}$/u.test(digest))
     return void 0;
   try {
-    const target = path19.join(root, fileOf(digest));
-    if (fs15.lstatSync(target).isSymbolicLink())
+    const target = path20.join(root, fileOf(digest));
+    if (fs16.lstatSync(target).isSymbolicLink())
       return void 0;
-    const entry = JSON.parse(fs15.readFileSync(target, "utf8"));
+    const entry = JSON.parse(fs16.readFileSync(target, "utf8"));
     if (entry.format !== FORMAT2 || entry.digest !== digest || entry.packet?.dependencyDigest !== digest || entry.packet.format !== "duo.context-packet/1")
       return void 0;
     return entry.packet;
@@ -11749,15 +11838,15 @@ function writeCachedPacket(root, packet) {
   const allowed = checkWriteBoundary(root, fileOf(packet.dependencyDigest), "regenerable");
   if (allowed.value === void 0)
     return false;
-  const target = path19.join(root, allowed.value.path);
+  const target = path20.join(root, allowed.value.path);
   const temp = `${target}.${process.pid}.tmp`;
   try {
-    fs15.mkdirSync(path19.dirname(target), { recursive: true });
-    fs15.writeFileSync(temp, JSON.stringify({ format: FORMAT2, digest: packet.dependencyDigest, packet }));
-    fs15.renameSync(temp, target);
+    fs16.mkdirSync(path20.dirname(target), { recursive: true });
+    fs16.writeFileSync(temp, JSON.stringify({ format: FORMAT2, digest: packet.dependencyDigest, packet }));
+    fs16.renameSync(temp, target);
     return true;
   } catch {
-    fs15.rmSync(temp, { force: true });
+    fs16.rmSync(temp, { force: true });
     return false;
   }
 }
@@ -11845,11 +11934,11 @@ var EXT_LANG = [
   [/\.(?:cpp|cc|cxx|hpp|hh|hxx|h)$/u, "cpp"],
   [/\.py$/u, "python"]
 ];
-function langOf(path35) {
-  return EXT_LANG.find(([re]) => re.test(path35))?.[1] ?? "";
+function langOf(path36) {
+  return EXT_LANG.find(([re]) => re.test(path36))?.[1] ?? "";
 }
-var extensionOf3 = (path35) => {
-  const name = path35.slice(path35.lastIndexOf("/") + 1);
+var extensionOf3 = (path36) => {
+  const name = path36.slice(path36.lastIndexOf("/") + 1);
   const dot = name.lastIndexOf(".");
   return dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
 };
@@ -11965,7 +12054,7 @@ function candidateScope(expansion, seeds, task) {
     taskText: task,
     entries: expansion.candidates.map((x) => {
       const ref = x.node.ref;
-      const path35 = ref.type === "symbol" || ref.type === "file" ? ref.path : void 0;
+      const path36 = ref.type === "symbol" || ref.type === "file" ? ref.path : void 0;
       const qn = x.node.payload.qualifiedName;
       return {
         id: x.node.id,
@@ -11974,7 +12063,7 @@ function candidateScope(expansion, seeds, task) {
         hops: x.depth,
         ...bySeed.has(x.node.id) ? { seed: SEED_PROVENANCE[bySeed.get(x.node.id)?.match ?? "keyword"] } : {},
         ...bySeed.has(x.seed) ? { origin: SEED_PROVENANCE[bySeed.get(x.seed)?.match ?? "keyword"], originRef: displayRef(x.seed) } : {},
-        ...path35 === void 0 ? {} : { path: path35 },
+        ...path36 === void 0 ? {} : { path: path36 },
         ...typeof qn === "string" ? { qualifiedName: qn } : {}
       };
     })
@@ -12007,9 +12096,9 @@ function planContext(input) {
   };
   const via = (c, extra = []) => ({ seed: displayRef(c.seed), steps: [...c.steps, ...extra] });
   const fileLanguages = /* @__PURE__ */ new Map();
-  const analyzedPath = (path35) => {
-    if (!fileLanguages.has(path35))
-      fileLanguages.set(path35, DEFAULT_EXTENSION_LANGUAGES[extensionOf3(path35)]);
+  const analyzedPath = (path36) => {
+    if (!fileLanguages.has(path36))
+      fileLanguages.set(path36, DEFAULT_EXTENSION_LANGUAGES[extensionOf3(path36)]);
   };
   const requirementItem = (r, c) => {
     const head = `${r.id} ${r.title} (${[r.status, r.milestone, r.priority].filter((x) => x !== null && x !== void 0).join(", ")})`;
@@ -12474,16 +12563,16 @@ var TokenMeter = class {
 };
 
 // packages/director/dist/context/metrics.js
-import fs16 from "node:fs";
-import path20 from "node:path";
+import fs17 from "node:fs";
+import path21 from "node:path";
 var TOKEN_COUNT_CACHE_PATH = `${STATE_DIR_NAME}/cache/token-counts.json`;
 var FORMAT3 = "duo.token-counts/1";
 function readCounts(root) {
   try {
-    const entry = JSON.parse(fs16.readFileSync(path20.join(root, TOKEN_COUNT_CACHE_PATH), "utf8"));
+    const entry = JSON.parse(fs17.readFileSync(path21.join(root, TOKEN_COUNT_CACHE_PATH), "utf8"));
     if (entry.format !== FORMAT3 || entry.estimator !== TOKEN_ESTIMATOR_ID || entry.counts === void 0)
       return /* @__PURE__ */ new Map();
-    return new Map(Object.entries(entry.counts).map(([k, [tokens2, chars]]) => [k, { tokens: tokens2, chars }]));
+    return new Map(Object.entries(entry.counts).map(([k, [tokens3, chars]]) => [k, { tokens: tokens3, chars }]));
   } catch {
     return /* @__PURE__ */ new Map();
   }
@@ -12492,15 +12581,15 @@ function writeCounts(root, counts) {
   const allowed = checkWriteBoundary(root, TOKEN_COUNT_CACHE_PATH, "regenerable");
   if (allowed.value === void 0)
     return;
-  const target = path20.join(root, allowed.value.path);
+  const target = path21.join(root, allowed.value.path);
   const temp = `${target}.${process.pid}.tmp`;
   const sorted = Object.fromEntries([...counts].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => [k, [v.tokens, v.chars]]));
   try {
-    fs16.mkdirSync(path20.dirname(target), { recursive: true });
-    fs16.writeFileSync(temp, JSON.stringify({ format: FORMAT3, estimator: TOKEN_ESTIMATOR_ID, counts: sorted }));
-    fs16.renameSync(temp, target);
+    fs17.mkdirSync(path21.dirname(target), { recursive: true });
+    fs17.writeFileSync(temp, JSON.stringify({ format: FORMAT3, estimator: TOKEN_ESTIMATOR_ID, counts: sorted }));
+    fs17.renameSync(temp, target);
   } catch {
-    fs16.rmSync(temp, { force: true });
+    fs17.rmSync(temp, { force: true });
   }
 }
 function repositoryTokens(root, meter, useCache, memo) {
@@ -12508,7 +12597,7 @@ function repositoryTokens(root, meter, useCache, memo) {
   const cached = useCache ? readCounts(root) : /* @__PURE__ */ new Map();
   const next2 = /* @__PURE__ */ new Map();
   const perFile = /* @__PURE__ */ new Map();
-  let tokens2 = 0, bytes = 0, chars = 0, binaryFiles = 0;
+  let tokens3 = 0, bytes = 0, chars = 0, binaryFiles = 0;
   for (const f of fingerprints) {
     bytes += f.size;
     if (f.fingerprintMode !== "normalized-text") {
@@ -12524,7 +12613,7 @@ function repositoryTokens(root, meter, useCache, memo) {
     }
     next2.set(f.contentHash, v);
     perFile.set(f.path, v.tokens);
-    tokens2 += v.tokens;
+    tokens3 += v.tokens;
     chars += v.chars;
   }
   if (useCache && (next2.size !== cached.size || [...next2.keys()].some((k) => !cached.has(k))))
@@ -12534,7 +12623,7 @@ function repositoryTokens(root, meter, useCache, memo) {
     for (const [k, v] of next2)
       memo.set(k, v);
   }
-  return { files: fingerprints.length, binaryFiles, tokens: tokens2, bytes, chars, perFile };
+  return { files: fingerprints.length, binaryFiles, tokens: tokens3, bytes, chars, perFile };
 }
 function reduction(selected, base) {
   return base <= 0 ? null : Math.round((1 - selected / base) * 1e4) / 100;
@@ -12821,12 +12910,12 @@ var SourceReader = class {
   constructor(root) {
     this.root = root;
   }
-  text(path35) {
+  text(path36) {
     const t0 = performance3.now();
-    let r = this.files.get(path35);
+    let r = this.files.get(path36);
     if (r === void 0) {
-      r = readSourceFile(this.root, path35);
-      this.files.set(path35, r);
+      r = readSourceFile(this.root, path36);
+      this.files.set(path36, r);
     }
     this.ms += performance3.now() - t0;
     return r;
@@ -12862,8 +12951,8 @@ var SourceReader = class {
     return r.value === void 0 ? { diagnostics: r.diagnostics } : success({ text: r.value, startLine: start2 });
   }
   /** The first whole lines of a file within both bounds (T18.0 generic files); undefined when it cannot be read as text. */
-  headWindow(path35, bounds) {
-    const text4 = this.text(path35).value;
+  headWindow(path36, bounds) {
+    const text4 = this.text(path36).value;
     if (text4 === void 0 || text4.trim() === "")
       return void 0;
     const all = text4.split("\n");
@@ -12899,18 +12988,40 @@ function refOfNode(node) {
       return ref.id;
   }
 }
+function keywordQueryTokens(tokens3, idTokens2, exactTokens) {
+  return tokens3.filter((t2) => !idTokens2.has(t2) && !exactTokens.has(t2));
+}
+var SEPARATORS = /[\s,;:!?()[\]{}<>"'`]+/u;
 function rawTokens(task) {
-  return task.split(/[\s,;:!?()[\]{}<>"'`]+/u).map((t2) => t2.replace(/^[.]+|[.]+$/gu, "")).filter((t2) => t2.length > 0);
+  return taskWords(task).map((w) => w.token);
+}
+function taskWords(task) {
+  return task.split(SEPARATORS).map((w) => {
+    const token = w.replace(/^[.]+|[.]+$/gu, "");
+    const trimmed = w.replace(/[.]+$/u, "");
+    return { token, pathText: trimmed };
+  }).filter((w) => w.token.length > 0);
+}
+function pathOf(pathText) {
+  if (!pathText.includes("/") && !pathText.includes("\\"))
+    return void 0;
+  return normalizeRepoPath(pathText).value;
+}
+function rootFileOf(pathText) {
+  if (pathText.includes("/") || pathText.includes("\\") || !pathText.includes("."))
+    return void 0;
+  const p = normalizeRepoPath(pathText).value;
+  return p === void 0 || p !== pathText ? void 0 : { path: p, leadingDot: pathText.startsWith(".") };
 }
 var NAME_TOKEN = /^[A-Za-z_$][\w$]*(?:\.#?[A-Za-z_$][\w$]*)*$/u;
-function isPathSignal(path35) {
-  const tokens2 = rawTokens(path35);
-  return tokens2.length === 1 && tokens2[0] === path35 && path35.includes("/") && normalizeRepoPath(path35).value === path35;
+function isPathSignal(path36) {
+  const words = taskWords(path36);
+  return words.length === 1 && words[0]?.pathText === path36 && pathOf(path36) !== void 0;
 }
 function isNameSignal(name) {
-  const tokens2 = rawTokens(name);
+  const tokens3 = rawTokens(name);
   const upper = name.toUpperCase();
-  return tokens2.length === 1 && tokens2[0] === name && NAME_TOKEN.test(name) && name.length >= 3 && !isDefinitionId(upper) && !PROPOSAL_ID_PATTERN.test(upper);
+  return tokens3.length === 1 && tokens3[0] === name && NAME_TOKEN.test(name) && name.length >= 3 && !isDefinitionId(upper) && !PROPOSAL_ID_PATTERN.test(upper);
 }
 function listAll2(store, type) {
   const out = [];
@@ -12999,9 +13110,10 @@ function resolveSeeds(task, truth, store, explicit = [], groups = NO_CALLABLE_GR
       exact++;
     }
   }
-  const tokens2 = rawTokens(task);
+  const words = taskWords(task);
+  const tokens3 = words.map((w) => w.token);
   const idTokens2 = /* @__PURE__ */ new Set();
-  for (const token of tokens2) {
+  for (const token of tokens3) {
     const upper = token.toUpperCase();
     if (PROPOSAL_ID_PATTERN.test(upper)) {
       proposalIds.add(upper);
@@ -13021,25 +13133,43 @@ function resolveSeeds(task, truth, store, explicit = [], groups = NO_CALLABLE_GR
   }
   const symbols = listAll2(store, "symbol");
   const files = listAll2(store, "file");
-  for (const token of tokens2) {
+  const exactTokens = /* @__PURE__ */ new Set();
+  for (const { token, pathText } of words) {
     if (idTokens2.has(token))
       continue;
-    if (token.includes("/")) {
-      const p = normalizeRepoPath(token.replace(/^\.\//u, "")).value;
-      const node = p === void 0 ? void 0 : store.getNode(fileRef(p));
-      if (node !== void 0) {
-        add(node, "path", token, SEED_STRENGTH.path);
+    const p = pathOf(pathText);
+    const node = p === void 0 ? void 0 : store.getNode(fileRef(p));
+    if (node !== void 0) {
+      add(node, "path", pathText, SEED_STRENGTH.path);
+      exact++;
+      exactTokens.add(token);
+      continue;
+    }
+    const root = rootFileOf(pathText);
+    const rootNode = root === void 0 ? void 0 : store.getNode(fileRef(root.path));
+    const asRootFile = () => {
+      if (rootNode !== void 0) {
+        add(rootNode, "path", pathText, SEED_STRENGTH.path);
         exact++;
+        exactTokens.add(token);
       }
+    };
+    if (rootNode !== void 0 && root?.leadingDot === true) {
+      asRootFile();
       continue;
     }
+    if (token.includes("/"))
+      continue;
     const name = token.replace(/\(\)$/u, "");
-    if (!NAME_TOKEN.test(name) || name.length < 3)
+    if (!NAME_TOKEN.test(name) || name.length < 3) {
+      asRootFile();
       continue;
+    }
     const qualified = symbols.filter((s) => s.payload.qualifiedName === name);
     if (qualified.length === 1 && qualified[0] !== void 0) {
       add(qualified[0], "symbol", token, SEED_STRENGTH.symbol);
       exact++;
+      exactTokens.add(token);
       continue;
     }
     if (qualified.length > 1 && name.includes(".")) {
@@ -13047,6 +13177,7 @@ function resolveSeeds(task, truth, store, explicit = [], groups = NO_CALLABLE_GR
         for (const n of qualified)
           add(n, "symbol", token, SEED_STRENGTH.symbol);
         exact++;
+        exactTokens.add(token);
         continue;
       }
       if (qualified.length <= SYMBOL_NAME_MAX_MATCHES)
@@ -13054,17 +13185,23 @@ function resolveSeeds(task, truth, store, explicit = [], groups = NO_CALLABLE_GR
       continue;
     }
     const named = qualified.length > 1 ? qualified : symbols.filter((s) => s.payload.name === name);
+    if (qualified.length === 0 && named.length === 0) {
+      asRootFile();
+      continue;
+    }
     if (named.length === 1 && named[0] !== void 0) {
       add(named[0], "symbol-name", token, SEED_STRENGTH["symbol-name"]);
       exact++;
+      exactTokens.add(token);
     } else if (oneGroup(groups, named)) {
       for (const n of named)
         add(n, "symbol-name", token, SEED_STRENGTH["symbol-name"]);
       exact++;
+      exactTokens.add(token);
     } else if (named.length > 1 && named.length <= SYMBOL_NAME_MAX_MATCHES)
       ambiguities.push({ term: name, reason: "symbol-name", options: named.map(option) });
   }
-  const ranked = bm25(keywordDocs(truth, store, symbols, files), searchTerms(tokens2.filter((t2) => !idTokens2.has(t2)).join(" ")));
+  const ranked = bm25(keywordDocs(truth, store, symbols, files), searchTerms(keywordQueryTokens(tokens3, idTokens2, exactTokens).join(" ")));
   const best = ranked[0]?.score ?? 0;
   const keyword = ranked.filter((r) => r.score >= best * KEYWORD.minFraction).slice(0, KEYWORD.top);
   if (exact === 0 && ambiguities.length === 0) {
@@ -13580,8 +13717,8 @@ function renderGapQuestions(assessment, options = {}) {
 }
 
 // packages/director/dist/init/documents.js
-import fs17 from "node:fs";
-import path21 from "node:path";
+import fs18 from "node:fs";
+import path22 from "node:path";
 var DOC_EXT = /\.(?:md|markdown|mdx|rst|adoc|txt)$/iu;
 var KEYWORDS = ["architecture", "design", "spec", "specification", "specs", "requirements", "requirement", "prd", "rfc", "adr", "decisions", "decision", "roadmap", "vision", "overview", "plan", "\uAE30\uD68D", "\uC124\uACC4", "\uC694\uAD6C\uC0AC\uD56D"];
 var LEGAL = /^(?:license|licence|copying|notice|code_of_conduct|code-of-conduct|security|changelog|changes|history)(?:\.|$)/iu;
@@ -13644,7 +13781,7 @@ function rank2(p) {
 }
 function readBounded(root, p, maxBytes) {
   try {
-    if (fs17.statSync(path21.join(root, p)).size > maxBytes)
+    if (fs18.statSync(path22.join(root, p)).size > maxBytes)
       return void 0;
   } catch {
     return void 0;
@@ -13701,21 +13838,21 @@ function discoverDocuments(root, files, rootDescription, options = {}) {
 
 // packages/director/dist/init/inspect.js
 import { createHash as createHash15 } from "node:crypto";
-import fs18 from "node:fs";
-import path22 from "node:path";
-var REGENERABLE = new Set(WRITE_AREAS.regenerable.map((a) => a.replace(/\/$/u, "")));
+import fs19 from "node:fs";
+import path23 from "node:path";
+var REGENERABLE2 = new Set(WRITE_AREAS.regenerable.map((a) => a.replace(/\/$/u, "")));
 var PROJECT_FILE = `${STATE_DIR_NAME}/${PROJECT_FILE_NAME}`;
 function typeOf(stat) {
   return stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : stat.isFile() ? "file" : "other";
 }
 function walk2(root, dir, out) {
-  for (const name of fs18.readdirSync(path22.join(root, dir)).sort(compareUtf8)) {
+  for (const name of fs19.readdirSync(path23.join(root, dir)).sort(compareUtf8)) {
     const rel = `${dir}/${name}`;
-    if (dir === STATE_DIR_NAME && REGENERABLE.has(name))
+    if (dir === STATE_DIR_NAME && REGENERABLE2.has(name))
       continue;
-    const type = typeOf(fs18.lstatSync(path22.join(root, rel)));
+    const type = typeOf(fs19.lstatSync(path23.join(root, rel)));
     if (type === "file") {
-      out.push({ path: rel, type, hash: `sha256:${createHash15("sha256").update(fs18.readFileSync(path22.join(root, rel))).digest("hex")}` });
+      out.push({ path: rel, type, hash: `sha256:${createHash15("sha256").update(fs19.readFileSync(path23.join(root, rel))).digest("hex")}` });
     } else {
       out.push({ path: rel, type });
       if (type === "directory")
@@ -13727,7 +13864,7 @@ function inspectStateDirectory(root) {
   const entries = [];
   let top;
   try {
-    top = typeOf(fs18.lstatSync(path22.join(root, STATE_DIR_NAME)));
+    top = typeOf(fs19.lstatSync(path23.join(root, STATE_DIR_NAME)));
   } catch {
     top = void 0;
   }
@@ -13793,12 +13930,12 @@ var INIT_DIRECTORIES = [
 var GITIGNORE_TEXT = "generated/\ncache/\nruntime/\n";
 
 // packages/director/dist/init/observe.js
-import fs20 from "node:fs";
-import path24 from "node:path";
+import fs21 from "node:fs";
+import path25 from "node:path";
 
 // packages/director/dist/init/stack.js
-import fs19 from "node:fs";
-import path23 from "node:path";
+import fs20 from "node:fs";
+import path24 from "node:path";
 var MAX_MANIFEST_BYTES = 1024 * 1024;
 var MAX_DEPTH = 4;
 var CAP = 20;
@@ -13825,7 +13962,7 @@ function stackManifestKind(p) {
 }
 function read(root, file) {
   try {
-    if (fs19.statSync(path23.join(root, file)).size > MAX_MANIFEST_BYTES)
+    if (fs20.statSync(path24.join(root, file)).size > MAX_MANIFEST_BYTES)
       return void 0;
   } catch {
     return void 0;
@@ -13975,7 +14112,7 @@ var extensionOf4 = (p) => {
 var baseName2 = (p) => p.slice(p.lastIndexOf("/") + 1);
 function readJson(root, file) {
   try {
-    if (fs20.statSync(path24.join(root, file)).size > MAX_MANIFEST_BYTES2)
+    if (fs21.statSync(path25.join(root, file)).size > MAX_MANIFEST_BYTES2)
       return void 0;
   } catch {
     return void 0;
@@ -14085,7 +14222,7 @@ function observeRepository(root, scan, git, workingTree) {
     technical.push({ manifest: "package.json", field: "packageManager", value: declaredPm });
   const pkgName = str(rootPkg?.name);
   const pkgDescription = str(rootPkg?.description);
-  const name = pkgName !== void 0 ? { value: pkgName, source: { path: "package.json", field: "name", kind: "manifest" } } : { value: path24.basename(path24.resolve(root)), source: { kind: "directory" } };
+  const name = pkgName !== void 0 ? { value: pkgName, source: { path: "package.json", field: "name", kind: "manifest" } } : { value: path25.basename(path25.resolve(root)), source: { kind: "directory" } };
   return {
     provenance: "observed",
     name,
@@ -14220,9 +14357,9 @@ async function planInit(root, options = {}) {
 
 // packages/director/dist/init/apply.js
 import { randomBytes as randomBytes2 } from "node:crypto";
-import fs21 from "node:fs";
+import fs22 from "node:fs";
 import fsp4 from "node:fs/promises";
-import path25 from "node:path";
+import path26 from "node:path";
 
 // packages/director/dist/init/render.js
 var OPEN_TEXT = {
@@ -14278,13 +14415,13 @@ var nodeInitFileSystem = {
       await fsp4.mkdir(absolute);
       return true;
     } catch (error) {
-      if (error.code === "EEXIST" && fs21.lstatSync(absolute).isDirectory())
+      if (error.code === "EEXIST" && fs22.lstatSync(absolute).isDirectory())
         return false;
       throw error;
     }
   },
   writeFile: (absolute, text4) => fsp4.writeFile(absolute, text4, { encoding: "utf8", flag: "wx" }),
-  copyFile: (from, to) => fsp4.copyFile(from, to, fs21.constants.COPYFILE_EXCL),
+  copyFile: (from, to) => fsp4.copyFile(from, to, fs22.constants.COPYFILE_EXCL),
   async place(staged, target) {
     try {
       await fsp4.link(staged, target);
@@ -14292,7 +14429,7 @@ var nodeInitFileSystem = {
       const code = error.code;
       if (code !== "EPERM" && code !== "ENOTSUP" && code !== "ENOSYS" && code !== "EXDEV")
         throw error;
-      await fsp4.copyFile(staged, target, fs21.constants.COPYFILE_EXCL);
+      await fsp4.copyFile(staged, target, fs22.constants.COPYFILE_EXCL);
     }
   },
   removeFile: (absolute) => fsp4.rm(absolute, { force: true }),
@@ -14394,7 +14531,7 @@ async function applyInitPlan(root, plan, answers, options = {}) {
   const createdFiles = [];
   const runtimeRel = `${STATE_DIR_NAME}/runtime`;
   const stagingRel = `${runtimeRel}/init-${randomBytes2(6).toString("hex")}`;
-  const stagingAbs = path25.join(root, stagingRel);
+  const stagingAbs = path26.join(root, stagingRel);
   let stagingMade = false;
   const rollback = async () => {
     for (const f of [...createdFiles].reverse())
@@ -14424,13 +14561,13 @@ async function applyInitPlan(root, plan, answers, options = {}) {
     }
     await io.mkdir(stagingAbs);
     stagingMade = true;
-    const stageAbs = (p) => path25.join(stagingAbs, ...p.split("/"));
+    const stageAbs = (p) => path26.join(stagingAbs, ...p.split("/"));
     const ensureStageDir = async (p) => {
-      await fsp4.mkdir(path25.dirname(stageAbs(p)), { recursive: true });
+      await fsp4.mkdir(path26.dirname(stageAbs(p)), { recursive: true });
     };
     for (const p of inspection.existing.filter(isTruthFile)) {
       await ensureStageDir(p);
-      await io.copyFile(path25.join(root, p), stageAbs(p));
+      await io.copyFile(path26.join(root, p), stageAbs(p));
     }
     for (const [p, f] of files) {
       await ensureStageDir(p);
@@ -14445,10 +14582,10 @@ async function applyInitPlan(root, plan, answers, options = {}) {
       return failure([createDiagnostic("INIT_VALIDATION_FAILED", `The planned Project Truth does not load cleanly: ${(ours.length > 0 ? ours : errors).map((d) => `${d.code} ${d.source?.path ?? ""}`.trim()).join("; ")}`), ...ours.length > 0 ? ours : errors]);
     }
     for (const d of plan.directories)
-      await mkdir(path25.join(root, d));
+      await mkdir(path26.join(root, d));
     const order = [...files].sort(([a], [b]) => a === INIT_FILES.project ? 1 : b === INIT_FILES.project ? -1 : compareUtf8(a, b));
     for (const [p] of order) {
-      const target = path25.join(root, p);
+      const target = path26.join(root, p);
       await io.place(stageAbs(p), target);
       createdFiles.push(target);
     }
@@ -14476,8 +14613,8 @@ async function applyInitPlan(root, plan, answers, options = {}) {
 import { performance as performance5 } from "node:perf_hooks";
 
 // packages/director/dist/llm/contract/cache.js
-import fs22 from "node:fs";
-import path26 from "node:path";
+import fs23 from "node:fs";
+import path27 from "node:path";
 var LLM_CACHE_DIR = `${STATE_DIR_NAME}/cache/llm`;
 var FORMAT4 = "duo.llm-cache/1";
 function responseCacheKey(identity, request) {
@@ -14494,10 +14631,10 @@ function responseCacheKey(identity, request) {
 var fileOf2 = (key2) => `${LLM_CACHE_DIR}/${key2.replace(/^sha256:/u, "")}.json`;
 function readCachedResponse(root, key2) {
   try {
-    const target = path26.join(root, fileOf2(key2));
-    if (fs22.lstatSync(target).isSymbolicLink())
+    const target = path27.join(root, fileOf2(key2));
+    if (fs23.lstatSync(target).isSymbolicLink())
       return void 0;
-    const entry = JSON.parse(fs22.readFileSync(target, "utf8"));
+    const entry = JSON.parse(fs23.readFileSync(target, "utf8"));
     return entry.format === FORMAT4 && entry.key === key2 && entry.response?.status === "success" ? entry.response : void 0;
   } catch {
     return void 0;
@@ -14507,14 +14644,14 @@ function writeCachedResponse(root, key2, response) {
   const allowed = checkWriteBoundary(root, fileOf2(key2), "regenerable");
   if (allowed.value === void 0)
     return;
-  const target = path26.join(root, allowed.value.path);
+  const target = path27.join(root, allowed.value.path);
   const temp = `${target}.${process.pid}.tmp`;
   try {
-    fs22.mkdirSync(path26.dirname(target), { recursive: true });
-    fs22.writeFileSync(temp, JSON.stringify({ format: FORMAT4, key: key2, response }));
-    fs22.renameSync(temp, target);
+    fs23.mkdirSync(path27.dirname(target), { recursive: true });
+    fs23.writeFileSync(temp, JSON.stringify({ format: FORMAT4, key: key2, response }));
+    fs23.renameSync(temp, target);
   } catch {
-    fs22.rmSync(temp, { force: true });
+    fs23.rmSync(temp, { force: true });
   }
 }
 
@@ -15199,10 +15336,11 @@ async function reviewChanges(root, request, options) {
     baseline,
     freshness,
     diff: { identity: diff.value.identity, from: diff.value.from, to: diff.value.to, files: allFiles },
+    // C241: lifecycle facts are added after the verdict and the semantic step, so neither sees them.
     seeds,
     verdict: verdict.verdict,
     verdictBasis: verdict.basis,
-    claims,
+    claims: withDecisionAuthority(truth, claims),
     evidence,
     ...gaps === void 0 ? {} : { gaps },
     context: {
@@ -15255,10 +15393,27 @@ function provenanceLabel(value, locale = "en") {
   return PROVENANCE_LABELS[locale][value];
 }
 
+// packages/director/dist/review/authority-label.js
+var AUTHORITY_LABELS = {
+  en: { current: "current authority", superseded: "superseded", inactive: "not current authority ({state})", supersedes: "supersedes {id}", supersededBy: "superseded by {id}" },
+  ko: { current: "\uD604\uC7AC authority", superseded: "\uB300\uCCB4\uB428", inactive: "\uD604\uC7AC authority \uC544\uB2D8({state})", supersedes: "\uB300\uCCB4 \uB300\uC0C1 {id}", supersededBy: "\uB300\uCCB4\uD55C Decision {id}" }
+};
+function decisionAuthorityParts(a, locale = "en") {
+  const l = AUTHORITY_LABELS[locale];
+  return [
+    a.active ? l.current : a.state === "superseded" ? l.superseded : l.inactive.replace("{state}", a.state),
+    ...a.supersedes === null ? [] : [l.supersedes.replace("{id}", a.supersedes)],
+    ...a.supersededBy === null ? [] : [l.supersededBy.replace("{id}", a.supersededBy)]
+  ];
+}
+function decisionAuthorityLabel(a, locale = "en") {
+  return decisionAuthorityParts(a, locale).join(" \xB7 ");
+}
+
 // packages/director/dist/runtime/metrics.js
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 import fsp5 from "node:fs/promises";
-import path27 from "node:path";
+import path28 from "node:path";
 var METRICS_PATH = `${STATE_DIR_NAME}/runtime/metrics.jsonl`;
 function reviewLlmMetric(r) {
   const a = r.semanticAssist;
@@ -15273,13 +15428,13 @@ function reviewLlmMetric(r) {
   };
 }
 async function appendRuntimeMetric(root, metric) {
-  if (!fs23.existsSync(path27.join(root, STATE_DIR_NAME, PROJECT_FILE_NAME)))
+  if (!fs24.existsSync(path28.join(root, STATE_DIR_NAME, PROJECT_FILE_NAME)))
     return success("skipped");
   const guarded2 = guardWrite(root, METRICS_PATH, "regenerable");
   if (guarded2.value === void 0)
     return failure(guarded2.diagnostics);
   try {
-    await fsp5.mkdir(path27.dirname(guarded2.value.absolute), { recursive: true });
+    await fsp5.mkdir(path28.dirname(guarded2.value.absolute), { recursive: true });
     await fsp5.appendFile(guarded2.value.absolute, `${JSON.stringify(metric)}
 `, "utf8");
     return success("written");
@@ -15290,7 +15445,7 @@ async function appendRuntimeMetric(root, metric) {
 function readRuntimeMetrics(root, options = {}) {
   let text4;
   try {
-    text4 = fs23.readFileSync(path27.join(root, METRICS_PATH), "utf8");
+    text4 = fs24.readFileSync(path28.join(root, METRICS_PATH), "utf8");
   } catch {
     return [];
   }
@@ -16070,8 +16225,8 @@ function getDecision(root, id3) {
 }
 
 // packages/integration/dist/operations/search.js
-import fs24 from "node:fs";
-import path28 from "node:path";
+import fs25 from "node:fs";
+import path29 from "node:path";
 var EVIDENCE_SEARCH_FORMAT = "duo.evidence-search/1";
 var SEARCH_NOTICE = "Evidence candidates found by exact or lexical match. They are not confirmed intent, Decisions or Requirements.";
 function searchEvidence(root, query, limit) {
@@ -16123,12 +16278,12 @@ function searchEvidence(root, query, limit) {
         }
       }
     });
-    const dir = path28.join(root, REVIEWS_DIR);
-    const names = fs24.existsSync(dir) ? fs24.readdirSync(dir).filter((n) => /^review-[0-9a-f]{16}\.json$/u.test(n)).sort(compareUtf8) : [];
+    const dir = path29.join(root, REVIEWS_DIR);
+    const names = fs25.existsSync(dir) ? fs25.readdirSync(dir).filter((n) => /^review-[0-9a-f]{16}\.json$/u.test(n)).sort(compareUtf8) : [];
     for (const name of names) {
       let record;
       try {
-        record = JSON.parse(fs24.readFileSync(path28.join(dir, name), "utf8"));
+        record = JSON.parse(fs25.readFileSync(path29.join(dir, name), "utf8"));
       } catch {
         continue;
       }
@@ -16181,13 +16336,13 @@ function proposeDecision(root, agentName, input) {
 }
 
 // packages/integration/dist/operations/doctor.js
-import path32 from "node:path";
+import path33 from "node:path";
 
 // packages/integration/dist/agents/integration.js
 import { createHash as createHash16 } from "node:crypto";
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 import fsp6 from "node:fs/promises";
-import path31 from "node:path";
+import path32 from "node:path";
 
 // packages/integration/dist/mcp/probe.js
 import { Client } from "@modelcontextprotocol/client";
@@ -16350,7 +16505,7 @@ var TOOLS = {
     name: "duo_get_context",
     title: "Project direction context for a task",
     readOnly: true,
-    description: "Returns project direction context for a task: confirmed intent, relevant code and tests, pending decisions and Knowledge Gaps. Does not modify or index the repository. If the index is stale, returns status index-required (run duoctl index). Surfaced gaps are open questions, not instructions; ask the human only when gaps.requiresHumanInput is true. Pending proposals are not confirmed decisions.",
+    description: 'Returns project direction context for a task: confirmed intent, relevant code and tests, pending decisions and Knowledge Gaps. Does not modify or index the repository. If the index is stale, returns status index-required (run duoctl index). Surfaced gaps are open questions, not instructions; ask the human only when gaps.requiresHumanInput is true. Pending proposals are not confirmed decisions. If the task names only an Issue ID and you know which files you will change, include their repository paths in the task (for example "TASK-015 apps/desktop/src/main.ts").',
     run: async (args, ctx) => {
       const op = await projectContext(ctx.root, { task: args.task, ...args.budget === void 0 ? {} : { budget: args.budget }, ...args.profile === void 0 ? {} : { profile: args.profile } }, {
         signal: ctx.signal,
@@ -16393,7 +16548,8 @@ ${advice.join("\n")}`);
       const r = p;
       if (r.status === "index-required")
         return "INDEX_REQUIRED: the DUO index is not current. Run duoctl index, then review again.";
-      const lines4 = r.claims.filter((c) => c.alignment !== "ALIGNED").map((c) => `- ${c.alignment} ${c.rule} ${c.subject.id}: ${c.reason}${c.provenance === void 0 ? "" : ` (${provenanceLabel(c.provenance)})`}${c.blockEligible ? " [blocking]" : ""}`);
+      const tags = (c) => [...c.blockEligible ? ["blocking"] : [], ...c.decisionAuthority === void 0 ? [] : decisionAuthorityParts(c.decisionAuthority)];
+      const lines4 = r.claims.filter((c) => c.alignment !== "ALIGNED").map((c) => `- ${c.alignment} ${c.rule} ${c.subject.id}: ${c.reason}${c.provenance === void 0 ? "" : ` (${provenanceLabel(c.provenance)})`}${tags(c).length === 0 ? "" : ` [${tags(c).join("; ")}]`}`);
       const a = r.semanticAssist;
       const semantic = a.status === "not-requested" ? [] : [
         `Semantic assistance (supplemental, never blocks): ${a.status}${a.failure === void 0 ? "" : ` (${a.failure})`}`,
@@ -16465,7 +16621,7 @@ ${advice.join("\n")}`);
 };
 
 // packages/integration/dist/agents/adapter.js
-import path29 from "node:path";
+import path30 from "node:path";
 var SERVER_NAME = "duo-director";
 function isDuoLaunch(entry) {
   if (entry === null || typeof entry !== "object")
@@ -16474,7 +16630,7 @@ function isDuoLaunch(entry) {
   if (typeof e.command !== "string" || !Array.isArray(e.args))
     return false;
   const args = e.args.filter((a) => typeof a === "string");
-  const base = path29.basename(e.command.replaceAll("\\", "/")).toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/u, "");
+  const base = path30.basename(e.command.replaceAll("\\", "/")).toLowerCase().replace(/\.(exe|cmd|bat|ps1)$/u, "");
   return args.includes("mcp") && (base === "duoctl" || args.includes("duoctl"));
 }
 var sameLaunch = (a, b) => a.command === b.command && a.args.length === b.args.length && a.args.every((x, i) => x === b.args[i]);
@@ -16734,8 +16890,8 @@ var codexAdapter = {
 };
 
 // packages/integration/dist/agents/launcher.js
-import fs25 from "node:fs";
-import path30 from "node:path";
+import fs26 from "node:fs";
+import path31 from "node:path";
 var PATH_LAUNCHER = { kind: "path", command: "duoctl", argsPrefix: [] };
 var NPX_LAUNCHER = { kind: "npx", command: "npx", argsPrefix: ["--no-install", "duoctl"] };
 var currentHost = () => ({ env: process.env, platform: process.platform });
@@ -16749,21 +16905,21 @@ function pathValue(host2) {
 }
 function candidates2(dir, name, host2) {
   if (host2.platform !== "win32")
-    return [path30.join(dir, name)];
+    return [path31.join(dir, name)];
   const exts = (host2.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((e) => e !== "").map((e) => e.toLowerCase());
-  return path30.extname(name) !== "" ? [path30.join(dir, name)] : exts.map((e) => path30.join(dir, name + e));
+  return path31.extname(name) !== "" ? [path31.join(dir, name)] : exts.map((e) => path31.join(dir, name + e));
 }
 function findOnPath(name, host2 = currentHost()) {
   for (const dir of pathValue(host2).split(host2.platform === "win32" ? ";" : ":")) {
-    if (dir === "" || !path30.isAbsolute(dir))
+    if (dir === "" || !path31.isAbsolute(dir))
       continue;
     for (const file of candidates2(dir, name, host2)) {
       try {
-        const st = fs25.statSync(file);
+        const st = fs26.statSync(file);
         if (!st.isFile())
           continue;
         if (host2.platform !== "win32")
-          fs25.accessSync(file, fs25.constants.X_OK);
+          fs26.accessSync(file, fs26.constants.X_OK);
         return file;
       } catch {
       }
@@ -16774,7 +16930,7 @@ function findOnPath(name, host2 = currentHost()) {
 function shadowing(root, command2) {
   let names;
   try {
-    names = fs25.readdirSync(root);
+    names = fs26.readdirSync(root);
   } catch {
     return [];
   }
@@ -16788,12 +16944,12 @@ function checkLauncher(root, launcher, host2 = currentHost()) {
   const diagnostics = [];
   const warnings = [];
   const { command: command2 } = launcher;
-  if (!BARE.test(command2) && !path30.isAbsolute(command2)) {
+  if (!BARE.test(command2) && !path31.isAbsolute(command2)) {
     return { available: false, warnings, diagnostics: [createDiagnostic("AGENT_LAUNCHER_UNAVAILABLE", `launcher command "${command2}" must be a bare command name on PATH or an absolute path; relative paths are refused`)] };
   }
-  if (path30.isAbsolute(command2)) {
+  if (path31.isAbsolute(command2)) {
     warnings.push(`launcher "${command2}" is an absolute path: the configuration will not work on other machines or after a move`);
-    const ok = fs25.existsSync(command2);
+    const ok = fs26.existsSync(command2);
     if (!ok)
       diagnostics.push(createDiagnostic("AGENT_LAUNCHER_UNAVAILABLE", `launcher "${command2}" does not exist`));
     return { available: ok, ...ok ? { resolved: command2 } : {}, diagnostics, warnings };
@@ -16808,8 +16964,8 @@ function checkLauncher(root, launcher, host2 = currentHost()) {
   }
   let localBin;
   if (launcher.kind === "npx") {
-    const bin = ["duoctl", "duoctl.cmd"].map((n) => path30.join(root, "node_modules", ".bin", n));
-    localBin = bin.find((b) => fs25.existsSync(b));
+    const bin = ["duoctl", "duoctl.cmd"].map((n) => path31.join(root, "node_modules", ".bin", n));
+    localBin = bin.find((b) => fs26.existsSync(b));
     if (localBin === void 0)
       diagnostics.push(createDiagnostic("AGENT_LAUNCHER_UNAVAILABLE", "node_modules/.bin/duoctl is missing: the npx launcher needs @duo-director/cli installed in this project (npx --no-install never downloads it)"));
   }
@@ -16828,13 +16984,13 @@ var EXPECTED_MCP_TOOLS = Object.keys(TOOLS).sort();
 var BACKUP_DIR = `${STATE_DIR_NAME}/runtime/backup`;
 function readTarget(root, rel) {
   const guarded2 = guardWrite(root, rel, "agent-integration");
-  const abs = path31.join(root, rel);
+  const abs = path32.join(root, rel);
   let bytes;
   try {
-    const st = fs26.lstatSync(abs);
+    const st = fs27.lstatSync(abs);
     if (!st.isFile())
       return { hash: "not-a-file", problem: `${rel} is not a regular file` };
-    bytes = fs26.readFileSync(abs);
+    bytes = fs27.readFileSync(abs);
   } catch {
     return guarded2.value === void 0 ? { hash: null, problem: guarded2.diagnostics.map((d) => d.message).join("; ") } : { hash: null };
   }
@@ -16843,7 +16999,7 @@ function readTarget(root, rel) {
     return { hash: hash2, problem: guarded2.diagnostics.map((d) => d.message).join("; ") };
   return { text: bytes.toString("utf8"), hash: hash2 };
 }
-var initialized = (root) => fs26.existsSync(path31.join(root, STATE_DIR_NAME, PROJECT_FILE_NAME));
+var initialized = (root) => fs27.existsSync(path32.join(root, STATE_DIR_NAME, PROJECT_FILE_NAME));
 function launcherOf(entry) {
   if (!isDuoLaunch(entry))
     return void 0;
@@ -17058,8 +17214,8 @@ async function applyAgentIntegration(root, plan, options = {}) {
       if (text4 === null) {
         await fsp6.rm(g.value.absolute, { force: true });
         changed.push({ path: rel, action: "delete" });
-        const dir = path31.dirname(g.value.absolute);
-        if (dir !== root && fs26.readdirSync(dir).length === 0)
+        const dir = path32.dirname(g.value.absolute);
+        if (dir !== root && fs27.readdirSync(dir).length === 0)
           await fsp6.rmdir(dir);
       } else {
         await writeFileAtomic(g.value.absolute, text4);
@@ -17069,7 +17225,7 @@ async function applyAgentIntegration(root, plan, options = {}) {
   } catch (error) {
     for (const c of changed) {
       const original = originals.get(c.path);
-      const abs = path31.join(root, c.path);
+      const abs = path32.join(root, c.path);
       if (original === void 0)
         await fsp6.rm(abs, { force: true }).catch(() => void 0);
       else
@@ -17175,7 +17331,7 @@ function scrub(value) {
   return value;
 }
 async function projectDoctor(rootArg, options) {
-  const root = path32.resolve(rootArg);
+  const root = path33.resolve(rootArg);
   const host2 = options.host ?? currentHost();
   const results = /* @__PURE__ */ new Map();
   const set = (id3, status, reason, facts = {}, actions = []) => {
@@ -17465,8 +17621,8 @@ function createDuoMcpServer(options) {
         return { isError: true, content: [{ type: "text", text: run2.op.diagnostics.map((d) => `${d.code}: ${d.message}`).join("\n") || "operation failed" }] };
       }
       const payload = run2.op.kind === "ok" ? run2.op.payload : { format: NOT_INITIALIZED_FORMAT, status: "not-initialized", message: "Not a DUO project yet (no .duo-project/project.yaml). A human runs duoctl init." };
-      const summary = run2.op.kind === "ok" ? tool.summarize(payload) : String(payload.message);
-      return { content: [{ type: "text", text: summary }], structuredContent: payload };
+      const summary2 = run2.op.kind === "ok" ? tool.summarize(payload) : String(payload.message);
+      return { content: [{ type: "text", text: summary2 }], structuredContent: payload };
     });
   }
   return server;
@@ -17506,7 +17662,7 @@ async function serveDuoMcp(options) {
 }
 
 // packages/integration/dist/mcp/root.js
-import path33 from "node:path";
+import path34 from "node:path";
 var ROOT_FROM_GIT_CWD = "git-cwd";
 var ROOT_FROM_ENV_PREFIX = "env:";
 var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/u;
@@ -17517,7 +17673,7 @@ async function resolveMcpRoot(spec2, host2) {
   if (spec2.root !== void 0 && spec2.rootFrom !== void 0)
     return failure([createDiagnostic("CLI_USAGE_INVALID", "--root and --root-from cannot be combined")]);
   if (spec2.rootFrom === void 0)
-    return success(path33.resolve(host2.cwd, spec2.root ?? "."));
+    return success(path34.resolve(host2.cwd, spec2.root ?? "."));
   if (!isRootFrom(spec2.rootFrom))
     return failure([createDiagnostic("CLI_USAGE_INVALID", `--root-from must be ${ROOT_FROM_GIT_CWD} or ${ROOT_FROM_ENV_PREFIX}<NAME>`)]);
   if (spec2.rootFrom === ROOT_FROM_GIT_CWD) {
@@ -17528,16 +17684,16 @@ async function resolveMcpRoot(spec2, host2) {
   const value = host2.env[name];
   if (value === void 0 || value === "")
     return failure([createDiagnostic("MCP_ROOT_UNRESOLVED", `environment variable ${name} is not set (--root-from ${spec2.rootFrom})`)]);
-  if (!path33.isAbsolute(value))
+  if (!path34.isAbsolute(value))
     return failure([createDiagnostic("MCP_ROOT_UNRESOLVED", `environment variable ${name} is not an absolute path (--root-from ${spec2.rootFrom})`)]);
-  return success(path33.resolve(value));
+  return success(path34.resolve(value));
 }
 
 // packages/integration/dist/http/server.js
 import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
-import fs27 from "node:fs";
+import fs28 from "node:fs";
 import http from "node:http";
-import path34 from "node:path";
+import path35 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { z as z5 } from "zod";
 
@@ -17735,16 +17891,16 @@ var TYPES = {
 var PAGES = /^\/(?:|overview|direction|graph|context|review|reviews(?:\/[\w.-]+)?|decisions|coverage|search|entity\/.+)$/u;
 function locateUiAssets() {
   const candidates3 = [new URL("./ui/", import.meta.url), new URL("../../../ui/dist/app/", import.meta.url)].map((u) => fileURLToPath2(u));
-  return candidates3.find((d) => fs27.existsSync(path34.join(d, "index.html")));
+  return candidates3.find((d) => fs28.existsSync(path35.join(d, "index.html")));
 }
 function loadAssets(dir) {
   const out = /* @__PURE__ */ new Map();
-  for (const name of fs27.readdirSync(dir)) {
-    const type = TYPES[path34.extname(name).toLowerCase()];
-    const file = path34.join(dir, name);
-    if (type === void 0 || !fs27.lstatSync(file).isFile() || name.endsWith(".map"))
+  for (const name of fs28.readdirSync(dir)) {
+    const type = TYPES[path35.extname(name).toLowerCase()];
+    const file = path35.join(dir, name);
+    if (type === void 0 || !fs28.lstatSync(file).isFile() || name.endsWith(".map"))
       continue;
-    out.set(name, { type, body: fs27.readFileSync(file) });
+    out.set(name, { type, body: fs28.readFileSync(file) });
   }
   return out;
 }
@@ -17886,7 +18042,7 @@ async function startDuoUiServer(options) {
     switch (route) {
       case "session":
         only("GET");
-        return { name: "session", body: { csrf, version: options.version, apiVersion: UI_API_VERSION, root: path34.basename(root) } };
+        return { name: "session", body: { csrf, version: options.version, apiVersion: UI_API_VERSION, root: path35.basename(root) } };
       case "overview":
         only("GET");
         return { name: "overview", body: data(await projectOverview(root, shared)) };
@@ -18127,6 +18283,7 @@ var EN = {
   "review.semantic-verdict": "  with semantic assistance: {verdict}",
   "review.pass": "PASS means: no project-direction violation found in the available evidence (not: no bugs).",
   "review.aligned": "{n} aligned claims (--verbose to list)",
+  "review.authority": "authority: {label}",
   "review.bootstrap": "{n} Truth files exactly as init wrote them (adoption-bootstrap, not reviewed until changed)",
   "review.gaps": "Knowledge gaps:",
   "review.limitations": "Limitations:",
@@ -18157,6 +18314,27 @@ var EN = {
   "decision.preview.none": "(none)",
   "decision.preview.forbids-scope": "repository-wide (governs does not narrow forbids)",
   "decision.index-hint": "Run duoctl index so review and context see it.",
+  "decision.session.header": "Review: {n} pending proposal(s) in ID order: {ids}. Nothing is confirmed until you choose and type the IDs.",
+  "decision.session.item": "[{i}/{n}]",
+  "decision.session.select": "Confirm which proposals? Type their IDs (e.g. {example}), 'all', 'one' to decide one by one, or press Enter to cancel: ",
+  "decision.session.cancelled": "Nothing confirmed. The proposals stay pending.",
+  "decision.session.select-invalid": "{reason}; nothing confirmed.",
+  "decision.session.unknown-id": "{id} is not a pending proposal of this review",
+  "decision.session.duplicate-id": "{id} is listed twice",
+  "decision.session.mixed": "'all', 'one' and 'cancel' cannot be combined with IDs",
+  "decision.session.plan": "Confirm plan, in ID order (each confirm is bound to the candidate shown):",
+  "decision.session.plan-item": "  {id} \u2192 {decision} (expected)",
+  "decision.session.changed": "{id} at the moment of its confirm (the proposals before it in this session are confirmed first):",
+  "decision.session.final": "Type the IDs to confirm, exactly as listed ({ids}), or press Enter to cancel: ",
+  "decision.session.final-mismatch": "The IDs do not match; nothing confirmed.",
+  "decision.session.nothing": "Nothing confirmed.",
+  "decision.session.one-prompt": "Type {id} to confirm it (expected {expected}), 'skip' to leave it pending, or press Enter to stop: ",
+  "decision.session.one-changed": "{id} changed since the review above (an earlier confirm in this session); these rows are now:",
+  "decision.session.skipped": "{id} skipped, still pending",
+  "decision.session.failed-item": "{id} was not confirmed:",
+  "decision.session.confirmed-item": "{from} confirmed as {id} \xB7 {path}",
+  "decision.session.summary": "Confirmed {done} of {selected}. Still pending: {pending}.",
+  "decision.session.stopped": "Stopped; the remaining proposals stay pending.",
   "decision.truth-errors": "Not listed: {n} Truth error(s). These files could not be read; confirm and reject refuse to run until they are fixed:",
   "stats.none": "No metrics yet.",
   "not-initialized": "Not a DUO project (no .duo-project/project.yaml). Run duoctl init.",
@@ -18337,6 +18515,7 @@ var KO = {
   "review.semantic-verdict": "  \uC758\uBBF8 \uBCF4\uC870 \uD310\uC815 \uBC18\uC601 \uC2DC: {verdict}",
   "review.pass": "PASS\uB294 \uD604\uC7AC Evidence \uBC94\uC704\uC5D0\uC11C \uD504\uB85C\uC81D\uD2B8 \uBC29\uD5A5 \uC704\uBC18\uC744 \uCC3E\uC9C0 \uBABB\uD588\uB2E4\uB294 \uB73B\uC785\uB2C8\uB2E4(\uBC84\uADF8 \uC5C6\uC74C\uC774 \uC544\uB2D8).",
   "review.aligned": "ALIGNED claim {n}\uAC1C(--verbose\uB85C \uBAA9\uB85D)",
+  "review.authority": "Decision \uC0C1\uD0DC: {label}",
   "review.bootstrap": "init\uC774 \uB9CC\uB4E0 \uADF8\uB300\uB85C\uC758 Truth \uD30C\uC77C {n}\uAC1C(adoption-bootstrap, \uBC14\uB00C\uAE30 \uC804\uC5D0\uB294 \uAC80\uC218\uD558\uC9C0 \uC54A\uC74C)",
   "review.gaps": "Knowledge gap:",
   "review.limitations": "\uD55C\uACC4:",
@@ -18367,6 +18546,27 @@ var KO = {
   "decision.preview.none": "(\uBE44\uC5B4 \uC788\uC74C)",
   "decision.preview.forbids-scope": "\uC800\uC7A5\uC18C \uC804\uCCB4(governs\uB294 forbids\uC758 \uBC94\uC704\uB97C \uC881\uD788\uC9C0 \uC54A\uC74C)",
   "decision.index-hint": "review\uC640 context\uC5D0 \uBC18\uC601\uD558\uB824\uBA74 duoctl index\uB97C \uC2E4\uD589\uD558\uC138\uC694.",
+  "decision.session.header": "\uAC80\uD1A0: pending proposal {n}\uAC1C, ID \uC21C\uC11C: {ids}. \uC120\uD0DD\uD558\uACE0 ID\uB97C \uC785\uB825\uD558\uAE30 \uC804\uC5D0\uB294 \uC544\uBB34\uAC83\uB3C4 \uD655\uC815\uB418\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.",
+  "decision.session.item": "[{i}/{n}]",
+  "decision.session.select": "\uC5B4\uB5A4 proposal\uC744 \uD655\uC815\uD560\uAE4C\uC694? ID(\uC608: {example}), 'all', \uD558\uB098\uC529 \uACB0\uC815\uD558\uB824\uBA74 'one'\uC744 \uC785\uB825\uD558\uAC70\uB098 Enter\uB85C \uCDE8\uC18C\uD558\uC138\uC694: ",
+  "decision.session.cancelled": "\uD655\uC815\uD558\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. proposal\uC740 pending\uC73C\uB85C \uB0A8\uC2B5\uB2C8\uB2E4.",
+  "decision.session.select-invalid": "{reason}. \uD655\uC815\uD558\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.",
+  "decision.session.unknown-id": "{id}\uB294 \uC774 \uAC80\uD1A0\uC758 pending proposal\uC774 \uC544\uB2D9\uB2C8\uB2E4",
+  "decision.session.duplicate-id": "{id}\uAC00 \uB450 \uBC88 \uC788\uC2B5\uB2C8\uB2E4",
+  "decision.session.mixed": "'all', 'one', 'cancel'\uC740 ID\uC640 \uD568\uAED8 \uC4F8 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4",
+  "decision.session.plan": "\uD655\uC815 \uACC4\uD68D(ID \uC21C\uC11C, \uAC01 \uD655\uC815\uC740 \uBCF4\uC778 candidate\uC5D0 \uBB36\uC785\uB2C8\uB2E4):",
+  "decision.session.plan-item": "  {id} \u2192 {decision} (\uC608\uC0C1)",
+  "decision.session.changed": "{id}\uC758 \uD655\uC815 \uC2DC\uC810 \uB0B4\uC6A9(\uC774 session\uC5D0\uC11C \uC55E\uC758 proposal\uC774 \uBA3C\uC800 \uD655\uC815\uB429\uB2C8\uB2E4):",
+  "decision.session.final": "\uD655\uC815\uD560 ID\uB97C \uBCF4\uC778 \uADF8\uB300\uB85C \uC785\uB825\uD558\uC138\uC694({ids}). Enter\uB294 \uCDE8\uC18C: ",
+  "decision.session.final-mismatch": "ID\uAC00 \uB2E4\uB985\uB2C8\uB2E4. \uD655\uC815\uD558\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.",
+  "decision.session.nothing": "\uD655\uC815\uD558\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.",
+  "decision.session.one-prompt": "\uD655\uC815\uD558\uB824\uBA74 {id}(\uC608\uC0C1 {expected}), pending\uC73C\uB85C \uB450\uB824\uBA74 'skip', \uBA48\uCD94\uB824\uBA74 Enter: ",
+  "decision.session.one-changed": "{id}\uB294 \uC704 \uAC80\uD1A0 \uB4A4 \uBC14\uB00C\uC5C8\uC2B5\uB2C8\uB2E4(\uC774 session\uC758 \uC55E\uC120 \uD655\uC815). \uC9C0\uAE08 \uAC12:",
+  "decision.session.skipped": "{id} \uAC74\uB108\uB700, pending \uC720\uC9C0",
+  "decision.session.failed-item": "{id}\uB294 \uD655\uC815\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4:",
+  "decision.session.confirmed-item": "{from} \u2192 {id}\uB85C \uD655\uC815 \xB7 {path}",
+  "decision.session.summary": "{selected}\uAC1C \uC911 {done}\uAC1C \uD655\uC815. \uB0A8\uC740 pending: {pending}.",
+  "decision.session.stopped": "\uBA48\uCDC4\uC2B5\uB2C8\uB2E4. \uB0A8\uC740 proposal\uC740 pending\uC73C\uB85C \uB0A8\uC2B5\uB2C8\uB2E4.",
   "decision.truth-errors": "\uBAA9\uB85D\uC5D0 \uC5C6\uC74C: Truth \uC624\uB958 {n}\uAC1C. \uC544\uB798 \uD30C\uC77C\uC744 \uC77D\uC9C0 \uBABB\uD588\uC73C\uBA70, \uACE0\uCE60 \uB54C\uAE4C\uC9C0 \uD655\uC815\uACFC \uAC70\uC808\uC740 \uC2E4\uD589\uB418\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4:",
   "stats.none": "\uC9C0\uD45C\uAC00 \uC544\uC9C1 \uC5C6\uC2B5\uB2C8\uB2E4.",
   "not-initialized": "DUO project\uAC00 \uC544\uB2D9\uB2C8\uB2E4(.duo-project/project.yaml \uC5C6\uC74C). duoctl init\uC744 \uC2E4\uD589\uD558\uC138\uC694.",
@@ -18628,8 +18828,7 @@ function ambiguityHint(L, a) {
   return [t(L, key2, { term: a.term }), ...r.definitionIdAlso ? [t(L, "context.ambiguous.id-also")] : []].map((line) => redactSecrets(line).text);
 }
 
-// apps/cli/dist/commands/decision.js
-var DECISION_ID2 = /^D-\d+$/u;
+// apps/cli/dist/commands/decision-preview.js
 var LABEL_WIDTH = 13;
 function show(L, value, nested = false) {
   if (value === void 0 || value === null)
@@ -18682,10 +18881,175 @@ function previewLines(L, p, op) {
   lines4.push(row("File", p.sourcePath));
   return lines4;
 }
+
+// apps/cli/dist/commands/decision-session.js
+var tokens2 = (input) => input.split(/[\s,]+/u).filter((x) => x !== "").map((x) => /^p-/iu.test(x) ? x.toUpperCase() : x.toLowerCase());
+function parseSelection(input, pending) {
+  const list3 = tokens2(input ?? "");
+  if (list3.length === 0)
+    return { kind: "cancel" };
+  if (list3.length === 1 && (list3[0] === "all" || list3[0] === "one" || list3[0] === "cancel"))
+    return { kind: list3[0] };
+  if (list3.some((x) => x === "all" || x === "one" || x === "cancel"))
+    return { kind: "error", reason: "mixed" };
+  const seen = /* @__PURE__ */ new Set();
+  for (const id3 of list3) {
+    if (seen.has(id3))
+      return { kind: "error", reason: "duplicate-id", id: id3 };
+    seen.add(id3);
+    if (!pending.includes(id3))
+      return { kind: "error", reason: "unknown-id", id: id3 };
+  }
+  return { kind: "ids", ids: sessionOrder(list3) };
+}
+function matchesSelection(input, selected) {
+  const list3 = tokens2(input ?? "");
+  return list3.length === selected.length && list3.every((x, i) => x === selected[i]);
+}
+function changedRows(before, after) {
+  const key2 = (line) => line.startsWith("  ") ? line.slice(2, 15).trim() : "";
+  const rows = (lines4) => new Map(lines4.slice(1).map((l) => [key2(l), l]).filter(([k]) => k !== "" && k !== "Expected ID"));
+  const a = rows(before);
+  const b = rows(after);
+  const out = [];
+  for (const [k, line] of b) {
+    const old = a.get(k);
+    if (old !== line)
+      out.push(...old === void 0 ? [] : ["  - " + old.trim()], "  + " + line.trim());
+  }
+  for (const [k, line] of a)
+    if (!b.has(k))
+      out.push("  - " + line.trim());
+  return out;
+}
+async function reviewPendingCommand(env, project2) {
+  const L = env.locale;
+  if (!env.io.isTTY || env.nonInteractive) {
+    return failed4("decision", EXIT.ERROR, [createDiagnostic("CLI_TTY_REQUIRED", t("en", "decision.tty"))], [t(L, "decision.tty")]);
+  }
+  const pendingIds = listDecisionProposals(project2.truth).filter((e) => e.status === "pending").map((e) => e.id);
+  const service = createDecisionService({ root: env.root, clock: () => env.io.now() });
+  const res = { mode: "cancel", reviewed: [], selected: [], confirmed: [], skipped: [], failed: [], pending: [] };
+  const outcome = (exitCode, human, diagnostics = [], status) => {
+    const confirmedIds = new Set(res.confirmed.map((c) => c.proposalId));
+    res.pending = res.reviewed.filter((id3) => !confirmedIds.has(id3));
+    const st = status ?? (res.failed.length > 0 ? "partial" : res.confirmed.length > 0 ? "confirmed" : "cancelled");
+    return { command: "decision", exitCode, diagnostics, human, result: { status: st, session: res }, metric: { status: st } };
+  };
+  if (pendingIds.length === 0)
+    return outcome(EXIT.OK, [t(L, "decision.none")], [], "none");
+  const reviewed = /* @__PURE__ */ new Map();
+  for (const id3 of pendingIds) {
+    const p = await service.previewConfirm(id3);
+    if (p.value === void 0)
+      return failed4("decision", EXIT.ERROR, p.diagnostics, diagLines(p.diagnostics), null, { status: "failed" });
+    reviewed.set(id3, p.value);
+  }
+  res.reviewed = [...pendingIds];
+  env.io.err(t(L, "decision.session.header", { n: pendingIds.length, ids: pendingIds.join(", ") }));
+  pendingIds.forEach((id3, i) => {
+    env.io.err("");
+    env.io.err(t(L, "decision.session.item", { i: i + 1, n: pendingIds.length }));
+    for (const line of previewLines(L, reviewed.get(id3), "confirm"))
+      env.io.err(line);
+  });
+  env.io.err("");
+  const sel = parseSelection(await env.io.prompt(t(L, "decision.session.select", { example: pendingIds.slice(0, 2).join(" ") })), pendingIds);
+  if (sel.kind === "cancel")
+    return outcome(EXIT.OK, [t(L, "decision.session.cancelled")]);
+  if (sel.kind === "error") {
+    const reason = sel.reason === "mixed" ? t(L, "decision.session.mixed") : t(L, sel.reason === "unknown-id" ? "decision.session.unknown-id" : "decision.session.duplicate-id", { id: sel.id ?? "" });
+    return outcome(EXIT.ERROR, [t(L, "decision.session.select-invalid", { reason })], [], "failed");
+  }
+  const actor = await humanActor(env.root);
+  if (sel.kind === "one") {
+    res.mode = "one";
+    res.selected = [...pendingIds];
+    for (const id3 of pendingIds) {
+      const p = await service.previewConfirm(id3);
+      if (p.value === void 0) {
+        res.failed.push({ proposalId: id3, diagnostics: p.diagnostics.map((d) => d.code) });
+        return outcome(EXIT.ERROR, [...diagLines(p.diagnostics), t(L, "decision.session.stopped")], p.diagnostics);
+      }
+      const rows = changedRows(previewLines(L, reviewed.get(id3), "confirm"), previewLines(L, p.value, "confirm"));
+      if (p.value.digest !== reviewed.get(id3)?.digest) {
+        env.io.err(t(L, "decision.session.one-changed", { id: id3 }));
+        for (const r2 of rows)
+          env.io.err(r2);
+      }
+      const answer = (await env.io.prompt(t(L, "decision.session.one-prompt", { id: id3, expected: p.value.expectedDecisionId })))?.trim() ?? "";
+      if (answer === "")
+        return outcome(res.failed.length > 0 ? EXIT.ERROR : EXIT.OK, [...summary(L, res), t(L, "decision.session.stopped")]);
+      if (answer.toLowerCase() === "skip") {
+        res.skipped.push(id3);
+        env.io.err(t(L, "decision.session.skipped", { id: id3 }));
+        continue;
+      }
+      if (answer.toUpperCase() !== id3)
+        return outcome(EXIT.ERROR, [...summary(L, res), t(L, "decision.mismatch"), t(L, "decision.session.stopped")]);
+      const r = await service.confirm(actor, id3, { expectedDigest: p.value.digest });
+      if (r.value === void 0) {
+        res.failed.push({ proposalId: id3, diagnostics: r.diagnostics.map((d) => d.code) });
+        for (const line of [t(L, "decision.session.failed-item", { id: id3 }), ...diagLines(r.diagnostics)])
+          env.io.err(line);
+        continue;
+      }
+      res.confirmed.push({ proposalId: id3, decisionId: r.value.decisionId, path: r.value.path });
+      env.io.err(t(L, "decision.confirmed", { id: r.value.decisionId, path: r.value.path }));
+    }
+    return outcome(res.failed.length > 0 ? EXIT.ERROR : EXIT.OK, summary(L, res));
+  }
+  res.mode = sel.kind;
+  const selected = sel.kind === "all" ? [...pendingIds] : [...sel.ids];
+  res.selected = selected;
+  const plan = await planConfirmSession({ root: env.root }, selected.map((id3) => ({ id: id3, digest: reviewed.get(id3).digest })));
+  if (plan.value === void 0)
+    return outcome(EXIT.ERROR, [...diagLines(plan.diagnostics), t(L, "decision.session.nothing")], plan.diagnostics, "failed");
+  env.io.err(t(L, "decision.session.plan"));
+  for (const item of plan.value.items)
+    env.io.err(t(L, "decision.session.plan-item", { id: item.id, decision: item.preview.expectedDecisionId }));
+  for (const item of plan.value.items.filter((x) => x.changedFromReview)) {
+    env.io.err("");
+    env.io.err(t(L, "decision.session.changed", { id: item.id }));
+    for (const r of changedRows(previewLines(L, reviewed.get(item.id), "confirm"), previewLines(L, item.preview, "confirm")))
+      env.io.err(r);
+  }
+  env.io.err("");
+  const typed = await env.io.prompt(t(L, "decision.session.final", { ids: selected.join(" ") }));
+  if ((typed ?? "").trim() === "")
+    return outcome(EXIT.OK, [t(L, "decision.session.cancelled")]);
+  if (!matchesSelection(typed, selected))
+    return outcome(EXIT.ERROR, [t(L, "decision.session.final-mismatch")], [], "failed");
+  for (const item of plan.value.items) {
+    const r = await service.confirm(actor, item.id, { expectedDigest: item.preview.digest });
+    if (r.value === void 0) {
+      res.failed.push({ proposalId: item.id, diagnostics: r.diagnostics.map((d) => d.code) });
+      for (const line of [t(L, "decision.session.failed-item", { id: item.id }), ...diagLines(r.diagnostics)])
+        env.io.err(line);
+      continue;
+    }
+    res.confirmed.push({ proposalId: item.id, decisionId: r.value.decisionId, path: r.value.path });
+  }
+  return outcome(res.failed.length > 0 ? EXIT.ERROR : EXIT.OK, summary(L, res));
+}
+function summary(L, res) {
+  const done = new Set(res.confirmed.map((c) => c.proposalId));
+  const pending = res.reviewed.filter((id3) => !done.has(id3));
+  return [
+    ...res.confirmed.map((c) => t(L, "decision.session.confirmed-item", { from: c.proposalId, id: c.decisionId, path: c.path })),
+    t(L, "decision.session.summary", { done: res.confirmed.length, selected: res.selected.length, pending: pending.length === 0 ? t(L, "decision.preview.none") : pending.join(", ") }),
+    ...res.confirmed.length > 0 ? [t(L, "decision.index-hint")] : []
+  ];
+}
+
+// apps/cli/dist/commands/decision.js
+var DECISION_ID2 = /^D-\d+$/u;
 async function decisionCommand(env, sub, id3, reason) {
   const project2 = requireProject(env, "decision");
   if (project2.value === void 0)
     return project2.outcome;
+  if (sub === "review-pending")
+    return reviewPendingCommand(env, project2.value);
   const truth = project2.value.truth;
   const entries = listDecisionProposals(truth);
   if (sub === "list" || sub === void 0) {
@@ -18699,7 +19063,7 @@ async function decisionCommand(env, sub, id3, reason) {
     return { command: "decision", exitCode: EXIT.OK, diagnostics: unread, human, result: { pending: pending.map((e) => ({ id: e.id, title: e.proposal.title, question: e.proposal.question, answer: e.proposal.answer })), proposedDecisions: proposedDecisions.map((d) => ({ id: d.id, title: d.title })) } };
   }
   if (sub !== "confirm" && sub !== "reject")
-    return usage("decision", "usage: duoctl decision list | confirm <id> | reject <id> [--reason <text>]");
+    return usage("decision", "usage: duoctl decision list | confirm <id> | reject <id> [--reason <text>] | review-pending");
   if (id3 === void 0)
     return usage("decision", `duoctl decision ${sub} needs an ID`);
   if (!env.io.isTTY || env.nonInteractive) {
@@ -19253,6 +19617,8 @@ function renderReview(env, r) {
   for (const c of shown) {
     const tags = [c.blockEligible ? "blocking" : "", c.provenance === void 0 ? "" : provenanceLabel(c.provenance, L), c.drift ? "drift" : ""].filter((x) => x !== "").join(", ");
     out.push(`  ${c.alignment.padEnd(9)} ${c.rule.padEnd(26)} ${c.subject.id} \xB7 ${c.reason}${tags === "" ? "" : ` [${tags}]`}`);
+    if (c.decisionAuthority !== void 0)
+      out.push(`            ${t(L, "review.authority", { label: decisionAuthorityLabel(c.decisionAuthority, L) })}`);
     const pointers = c.evidenceIds.map((id3) => ev.get(id3)?.pointer).filter((p) => p?.path !== void 0).slice(0, 3).map((p) => `${p?.path ?? ""}${p?.lines === void 0 ? "" : `:${p.lines[0]}-${p.lines[1]}`}`);
     if (pointers.length > 0)
       out.push(`            evidence: ${pointers.join(", ")}`);
@@ -19490,7 +19856,7 @@ var HELP = [
   "  review      review changes (--staged, --from, --to, --files, --task, --budget, --refresh, --record, --fail-on block|ask|warn, --strict = --fail-on warn, --semantic: optional LLM assistance)",
   "  trace       trace a node (--depth 1-3)",
   "  impact      Graph-recorded impact of a node (--depth 1-3)",
-  "  decision    list | confirm <id> | reject <id> [--reason <text>] (terminal only)",
+  "  decision    list | confirm <id> | reject <id> [--reason <text>] | review-pending (terminal only, a human: review-pending previews every pending proposal, then confirms the ones you choose)",
   "  stats       runtime metrics summary (--last n)",
   "  mcp         serve the duo-director MCP server over stdio (--root <path> | --root-from git-cwd|env:<NAME>, --agent <label>)",
   "  install     connect an agent: install codex|claude-code [--launcher path|npx] [--yes] \xB7 install status [agent] \xB7 install remove <agent>",