@event4u/agent-config 14.7.0 → 14.8.0

package/dist/install/globalRuleLayers.js

@@ -0,0 +1,169 @@
+/**
+ * Where each host's GLOBAL rule layer lives on disk, and whether it carries a
+ * given set of rules.
+ *
+ * ## Why this module exists
+ *
+ * ADR-236 partitions rules between the global and the project layer: an artefact
+ * scoped to this package alone stays project-local, everything else is delivered
+ * globally and withheld from the project tree. `partitionEligibility.ts` decides
+ * WHETHER the partition is on, by verifying the claude host layer against
+ * `installed.lock`. Its own docstring then draws the only conclusion that
+ * evidence supports — it "says nothing about `~/.cursor`", so withholding a
+ * cursor artefact on the strength of a claude fingerprint "would deliver it
+ * nowhere".
+ *
+ * That reasoning is right and its scope was too narrow for rules. The rule
+ * filter sits in `condense.ts::_scoped_rule_basenames()`, which is per-RUN and
+ * not per-DIRECTORY, so it already withholds from `.clinerules` on a claude
+ * fingerprint — the exact extrapolation the docstring refuses. Measured
+ * 2026-08-22 in a freshly generated worktree with the partition active:
+ *
+ * ```
+ * .claude/rules      13 files, 13 package-only,   0 global-only
+ * .clinerules        14 files, 13 package-only,   0 global-only
+ * .cursor/rules     126 files, 26 package-only, 100 global-only
+ * .windsurf/rules   113 files, 13 package-only, 100 global-only
+ * .augment/rules    118 files, 15 package-only, 103 global-only
+ * ```
+ *
+ * Two hosts partition on borrowed evidence; three do not partition at all. This
+ * module supplies the evidence per host so neither case has to be guessed:
+ * {@link globalRuleLayerNames} reads the host's own global directory, and
+ * {@link hostLayerCarries} answers the one question a withhold depends on.
+ *
+ * ## Why the paths are written out rather than imported
+ *
+ * `USER_SCOPE_PATHS` in `src/scripts/install.ts` is the authority for a host's
+ * global scope ROOT, and it is the right authority. It is not imported here for
+ * two reasons: `install.ts` is a multi-thousand-line CLI entry point that pulls
+ * in the whole installer graph, and a scope root is not a rules path — cline's
+ * root already IS its rules directory (`~/Documents/Cline/Rules/`) while every
+ * other host appends a subdirectory. So the mapping is stated once here and
+ * PINNED against `USER_SCOPE_PATHS` by `tests/install/global_rule_layers.test.ts`,
+ * which fails if a root moves. A pinned restatement drifts loudly; an import
+ * would have cost the bundle.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+/**
+ * Tool id → its global rule directory, relative to the user's home.
+ *
+ * Keys are the ids `USER_SCOPE_PATHS` and `TOOL_SIGNALS` use, so a row here is
+ * traceable to the installer's own scope table rather than invented.
+ *
+ * The five hosts below are the ones that receive a projected rule TREE. A host
+ * whose rules arrive as a single concatenated file (`.windsurfrules`,
+ * `GEMINI.md`, copilot instructions) has no directory to compare and is
+ * deliberately absent: {@link globalRuleLayerPath} returns null for it, which
+ * reads as "no evidence" and keeps the full projection.
+ */
+export const GLOBAL_RULE_DIRS = {
+    'claude-code': '.claude/rules',
+    cursor: '.cursor/rules',
+    augment: '.augment/rules',
+    // Windsurf's scope root is `~/.codeium/windsurf/`, not `~/.windsurf/`.
+    windsurf: '.codeium/windsurf/rules',
+    // Cline's scope root IS the rules directory — no `rules/` suffix.
+    cline: 'Documents/Cline/Rules',
+};
+/**
+ * Project rule directory → the tool id whose global layer covers it.
+ *
+ * Five entries, because five directories receive a projected rule TREE. Two are
+ * symlink trees (`condense.ts::TOOL_DIRS`); three are written by their own
+ * emitters — `generate_cursor_mdc_rules`, `generate_windsurf_modern_rules`, and
+ * `project_to_augment`. The `.cursor/rules` row covers both the `.mdc` files and
+ * the legacy `.md` symlinks that share that directory.
+ *
+ * It lives here rather than in either consumer so the gate that reports a
+ * duplicate and the emitters that must stop creating one read the same list. A
+ * sixth host directory added to one and not the other is exactly how a gate goes
+ * green over a tree nobody checks.
+ */
+export const PROJECT_RULE_DIRS = {
+    '.claude/rules': 'claude-code',
+    '.cursor/rules': 'cursor',
+    '.clinerules': 'cline',
+    '.windsurf/rules': 'windsurf',
+    '.augment/rules': 'augment',
+};
+/** The tool id whose global layer covers a project rule directory, or null. */
+export function toolIdForProjectRuleDir(dir) {
+    return PROJECT_RULE_DIRS[dir] ?? null;
+}
+/** Every tool id that has a global rule directory this module can read. */
+export function hostsWithGlobalRuleLayer() {
+    return Object.keys(GLOBAL_RULE_DIRS).sort();
+}
+/**
+ * Absolute path to a host's global rule directory, or null when the host has no
+ * directory-shaped global layer.
+ *
+ * Null is a real answer and not an error: it means this module cannot supply
+ * evidence for that host, and every caller must read that as "do not withhold".
+ */
+export function globalRuleLayerPath(toolId, home = process.env['HOME'] ?? os.homedir()) {
+    const rel = GLOBAL_RULE_DIRS[toolId];
+    return rel === undefined ? null : path.join(home, rel);
+}
+/**
+ * The rule basenames a host's global layer actually holds, normalised to `.md`.
+ *
+ * Returns null when the directory does not exist or cannot be read — the
+ * absent-tolerant contract Phase 1.1 requires. Normalisation matters because
+ * Cursor's tree is `.mdc`: comparing raw filenames would report every rule as
+ * missing there and turn the partition off for the one host whose duplication is
+ * largest.
+ */
+export function globalRuleLayerNames(toolId, home = process.env['HOME'] ?? os.homedir()) {
+    const dir = globalRuleLayerPath(toolId, home);
+    if (dir === null) {
+        return null;
+    }
+    let entries;
+    try {
+        entries = fs.readdirSync(dir);
+    }
+    catch {
+        return null;
+    }
+    return entries
+        .filter((f) => f.endsWith('.md') || f.endsWith('.mdc'))
+        .map((f) => (f.endsWith('.mdc') ? `${f.slice(0, -4)}.md` : f))
+        .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}
+/**
+ * Does this host's global layer carry every rule that would be withheld from its
+ * project directory?
+ *
+ * This is the property `personaPartition`'s docstring states as the precondition
+ * for any withhold — "withholding is only safe once the surviving layer is known
+ * to carry what is withheld" — asked per host instead of inferred from claude.
+ *
+ * Fails safe in all three negative directions: a host with no directory layer, a
+ * directory that is absent, and a directory missing even one name all return
+ * `carries: false`, so the caller keeps the full projection. An empty
+ * `ruleNames` is vacuously carried, which is correct — withholding nothing needs
+ * no evidence.
+ */
+export function hostLayerCarries(toolId, ruleNames, home = process.env['HOME'] ?? os.homedir()) {
+    const layerPath = globalRuleLayerPath(toolId, home);
+    if (layerPath === null) {
+        return { carries: false, layerPath: null, missing: [...ruleNames], reason: 'no-layer-for-host' };
+    }
+    const have = globalRuleLayerNames(toolId, home);
+    if (have === null) {
+        return { carries: false, layerPath, missing: [...ruleNames], reason: 'layer-absent' };
+    }
+    const present = new Set(have);
+    const missing = ruleNames.filter((n) => !present.has(n));
+    return {
+        carries: missing.length === 0,
+        layerPath,
+        missing,
+        reason: missing.length === 0 ? 'carries' : 'missing-names',
+    };
+}
+//# sourceMappingURL=globalRuleLayers.js.map

package/dist/install/globalRuleLayers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalRuleLayers.js","sourceRoot":"","sources":["../../src/install/globalRuleLayers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAC9D,aAAa,EAAE,eAAe;IAC9B,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,gBAAgB;IACzB,uEAAuE;IACvE,QAAQ,EAAE,yBAAyB;IACnC,kEAAkE;IAClE,KAAK,EAAE,uBAAuB;CACjC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IAC/D,eAAe,EAAE,aAAa;IAC9B,eAAe,EAAE,QAAQ;IACzB,aAAa,EAAE,OAAO;IACtB,iBAAiB,EAAE,UAAU;IAC7B,gBAAgB,EAAE,SAAS;CAC9B,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,GAAW;IAC/C,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAC/B,MAAc,EACd,OAAe,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE;IAElD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAChC,MAAc,EACd,OAAe,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE;IAElD,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,OAAO;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC7D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAcD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC5B,MAAc,EACd,SAA4B,EAC5B,OAAe,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE;IAElD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO;QACH,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QAC7B,SAAS;QACT,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;KAC7D,CAAC;AACN,CAAC"}

package/dist/install/partitionEligibility.js

@@ -128,6 +128,31 @@ export function partitionVerdict(inputs) {
  * artefact is NOT package-only, so it is delivered globally and withheld from
  * the project layer. Both defaults resolve toward "the artefact is generally
  * useful"; only one of them is about withholding.
+ *
+ * ## The state space, MEASURED rather than enumerated defensively (2026-08-21)
+ *
+ * Three of this function's branches — unreadable file, absent `workspaces:`,
+ * empty list — all resolve to `false`, and the closure review asked whether one
+ * of them was resolving by accident. Counted over all 119 files in `src/rules/`:
+ *
+ *     absent=0 · empty=0 · maintainer-only=16 · mixed=103 · scalar-or-other=0
+ *
+ * So exactly TWO states occur today, both deliberate, and the 16 is the figure
+ * ADR-236 partitions on.
+ *
+ * **The other three branches are CURRENTLY ABSENT from the generated tree, not
+ * unreachable** — an earlier revision of this note said "the state space is
+ * closed by that count", and a neutral review was right to refuse it. A file can
+ * become unreadable at runtime (permissions, a partial write, a truncated
+ * checkout) and a rule can acquire a malformed `workspaces:` on any commit. The
+ * count is a current inventory, never a proof of impossibility.
+ *
+ * What the count DOES buy is a bound on the defensive work worth doing now:
+ * fixtures for the absent and malformed cases would pin behaviour on inputs no
+ * committed rule produces, so they were not written. All three branches already
+ * resolve to `false` — deliver globally, withhold from the project layer — which
+ * is the over-delivery direction rather than the losing one, so the untested
+ * branches fail safe. Should that count move, this note is the thing that dates.
  */
 export function isExclusivelyPackageOnly(source_path) {
     let meta;
@@ -273,4 +298,135 @@ skip, report) {
         return null;
     }
 }
+/**
+ * Per-tool-directory persona list under the partition — ADR-236's closure for the
+ * one family it never reached.
+ *
+ * The partition shipped for rules and skills and stopped there, so
+ * `<repo>/.claude/personas` kept being written while `~/.claude/personas` was
+ * installed from `_CLAUDE_SKILL_BUNDLE` (`install.ts:1916-1921`). Measured
+ * 2026-08-21 on a freshly regenerated tree with the partition ACTIVE: **29 shared
+ * names**, and neither `check_single_delivery` nor `_lib/layer_overlap_notice`
+ * looked, because `personas` was in neither's `TYPES`.
+ *
+ * ## Two properties the caller depends on
+ *
+ * **Scoped to `.claude/` only.** {@link partitionActive} verifies the CLAUDE host
+ * layer against `installed.lock`. It says nothing about `~/.cursor`, so
+ * withholding a cursor persona on the strength of a claude fingerprint would
+ * deliver it nowhere — the one failure the fail-safe design exists to prevent.
+ * Every other tool directory keeps the full projection.
+ *
+ * **Reconciliation is the empty list, not a second code path.** The caller's
+ * stale-symlink sweep removes any link whose name is absent from the list it was
+ * given for that directory, so returning `[]` empties a directory an earlier
+ * version populated. A gate that only declined to WRITE would leave the existing
+ * duplicate standing — a partition that stops new duplication and keeps the old
+ * is not a partition.
+ *
+ * Verified before shipping: every one of the 29 project personas is present in
+ * the global layer (32 there, a strict superset). The partition is a removal and
+ * has no repair path, so withholding is only safe once the surviving layer is
+ * known to carry what is withheld.
+ */
+export function personaPartition(projectRoot, all) {
+    const active = partitionActive(projectRoot);
+    return {
+        all,
+        listFor: (toolDir) => (personaWithheldFor(toolDir, active) ? [] : all),
+        note: active ? ' — .claude/ withheld: ADR-236 partition, personas arrive from ~/.claude' : '',
+        countFor: (toolDir) => (personaWithheldFor(toolDir, active) ? 0 : all.length),
+    };
+}
+/**
+ * The pure half of {@link personaPartition}: withhold iff the partition is active
+ * AND this is a Claude tool directory.
+ *
+ * Split out so the decision is testable in BOTH directions. `personaPartition`
+ * reads `installed.lock` through a memoized `partitionActive`, so a test over it
+ * can only assert whatever this machine happens to be — which is a test that
+ * passes either way and therefore proves nothing. The two properties worth
+ * pinning are exactly the two this signature exposes: `.claude/` is withheld when
+ * active, and NOTHING else ever is.
+ */
+export function personaWithheldFor(toolDir, active) {
+    return active && toolDir.startsWith('.claude/');
+}
+/**
+ * Does the project layer withhold the colon-form `/cluster:sub` commands?
+ *
+ * ## The claim this replaces, and the measurement that revised it
+ *
+ * `generate_claude_project_commands` was written on the reasoning that "Claude
+ * Code dedupes project and user scope by name, so the two copies of
+ * `/cluster:sub` collapse" — a host-behaviour claim with no first-party
+ * observation behind it. Its sibling claim about skills WAS probed under
+ * ADR-236's roadmap (Phase 5.2, `claudeMdExcludes`) and came back negative, so
+ * an unprobed host assumption in the same area was not a safe default.
+ *
+ * **MEASURED 2026-08-21, Claude Code 2.1.238.** Fixture: `/analyze:inbox`
+ * present in BOTH `~/.claude/commands/analyze/` and a temp project's
+ * `.claude/commands/analyze/`. The session reports `COUNT=1`. A control second
+ * entry (`/analyze:inboxctl`, project-only) makes the same probe report
+ * `COUNT=2` — so the 1 is an observation, not a probe that can only say one.
+ *
+ * **The half nobody had checked: the surviving copy is the GLOBAL one.** Asked
+ * for the command's description, the session returned the global body, not the
+ * project fixture's. So the dedup claim holds and its unstated corollary
+ * inverts the value of the project-layer copy: where a verified global layer
+ * exists, those 40 symlinks are written, deduped away, and LOSE. They are dead
+ * weight there — not a second listing, and not a reachability guarantee either.
+ *
+ * ## Why `partitionActive` is the right predicate rather than a new one
+ *
+ * It is true exactly when a global layer is present and verified against
+ * `installed.lock`, which is exactly the case where the project copy loses; and
+ * false on a fresh checkout, an unverified install, or a version mismatch —
+ * every case where the project copy is the only reachable one. So the
+ * fail-safe direction the whole module is built around already matches the
+ * measurement, and withholding needs no separate switch.
+ *
+ * ## Honest limits
+ *
+ * Self-report, n=1 per condition, one host version, one machine. What is NOT
+ * claimed: that older or newer hosts dedupe the same way, or that precedence is
+ * stable across them.
+ *
+ * **And a claim that WAS made here has been withdrawn as false** (neutral review,
+ * 2026-08-21). It read: *"A host that stopped deduping would show up as a
+ * double-listing, and `check_single_delivery` reports the overlap either way."*
+ * It cannot. When this predicate returns true the project copy is never written,
+ * so there is no second copy for the host to double-list or for the gate to
+ * count — it would report zero overlap while the assumption underneath had
+ * failed. Worse, `partitionActive` verifies the INSTALL (version + content
+ * fingerprint), never the HOST version whose behaviour was measured, so a host
+ * upgrade changes the premise and moves nothing this code reads.
+ *
+ * What actually holds: reachability survives a dedup change either way, because
+ * the global copy is delivered regardless. What is lost is only the project
+ * copy's redundancy, and nothing detects that. A real detector would have to
+ * pin the host version this measurement was taken against and re-probe when it
+ * moves — not built here, and named as absent rather than implied away.
+ */
+export function commandsWithheld(projectRoot) {
+    return partitionActive(projectRoot);
+}
+/**
+ * ## The caller's early return, flagged by review and kept
+ *
+ * `generate_claude_project_commands` applies this predicate and then returns
+ * early when `src/domains/` is absent — BEFORE its stale-link sweep. So a tree
+ * with no `src/domains` keeps whatever `.claude/commands` it already had, even
+ * when the commands are now withheld.
+ *
+ * Invariant rather than oversight: this package always ships `src/domains/`, the
+ * generator only runs from a checkout that has it, and a consumer never reaches
+ * this path. Documented rather than reordered, because hoisting the sweep above
+ * the guard would make a non-package tree lose a directory this code did not
+ * write — a worse failure than the one being avoided, and on a tree we do not own.
+ *
+ * The transition that DOES occur is covered: `partition_delivery_topology.test.ts`
+ * runs inactive→active over a fixture that has `src/domains`, and asserts both
+ * the links and the empty cluster directories are gone after one run.
+ */
 //# sourceMappingURL=partitionEligibility.js.map

package/dist/install/partitionEligibility.js.map

@@ -1 +1 @@
-{"version":3,"file":"partitionEligibility.js","sourceRoot":"","sources":["../../src/install/partitionEligibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EACH,uBAAuB,EACvB,aAAa,EACb,cAAc,GACjB,MAAM,mCAAmC,CAAC;AAE3C,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAgC9D;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAuB;IACpD,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,sCAAsC;SACjD,CAAC;IACN,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,kEAAkE;SAC7E,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,mCAAmC;SAC9C,CAAC;IACN,CAAC;IACD,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,QAAQ,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,+BAA+B,QAAQ,cAAc,MAAM,CAAC,cAAc,GAAG;SACxF,CAAC;IACN,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,oGAAoG;SAC/G,CAAC;IACN,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,uDAAuD;SAClE,CAAC;IACN,CAAC;IACD,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,+EAA+E;SAC1F,CAAC;IACN,CAAC;IACD,OAAO;QACH,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,0BAA0B,QAAQ,iBAAiB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;KACzF,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IACxD,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACD,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC,CAAC,qDAAqD;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC;AAChE,CAAC;AAKD,IAAI,KAAK,GAA4B,IAAI,CAAC;AAC1C,IAAI,SAAS,GAAa,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAY;IAC7C,SAAS,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,6BAA6B;IACzC,KAAK,GAAG,IAAI,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IAC/C,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACvD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,IAAI,CAAC;YACD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAyB,IAAI,CAAC;IACtC,IAAI,CAAC;QACD,IAAI,GAAG,aAAa,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,GAAG,IAAI,CAAC,CAAC,gCAAgC;IACjD,CAAC;IACD,KAAK,GAAG,gBAAgB,CAAC;QACrB,cAAc,EAAE,uBAAuB,CAAC,WAAW,CAAC;QACpD,QAAQ,EAAE,IAAI;QACd,gBAAgB,EAAE,OAAO;QACzB,mBAAmB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;KACvD,CAAC,CAAC;IACH,SAAS,CAAC,oBAAoB,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACrC,gBAAwB,EACxB,KAAwB,EACxB,YAAoB;AACpB,sEAAsE;AACtE,IAAa,EACb,MAAgB;IAEhB,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrE,cAAc,CAAC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE;YACzC,IAAI,EAAE,YAAY;YAClB,sBAAsB,EAAE,WAAW;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,oCAAoC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,CAAC;QACjG,OAAO,WAAW,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,CACF,wCAAwC,MAAM,CAAC,CAAC,CAAC,kDAAkD,CACtG,CAAC;QACF,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}
+{"version":3,"file":"partitionEligibility.js","sourceRoot":"","sources":["../../src/install/partitionEligibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EACH,uBAAuB,EACvB,aAAa,EACb,cAAc,GACjB,MAAM,mCAAmC,CAAC;AAE3C,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAgC9D;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAuB;IACpD,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,sCAAsC;SACjD,CAAC;IACN,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,kEAAkE;SAC7E,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,mCAAmC;SAC9C,CAAC;IACN,CAAC;IACD,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,QAAQ,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,+BAA+B,QAAQ,cAAc,MAAM,CAAC,cAAc,GAAG;SACxF,CAAC;IACN,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,oGAAoG;SAC/G,CAAC;IACN,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,uDAAuD;SAClE,CAAC;IACN,CAAC;IACD,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACH,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,+EAA+E;SAC1F,CAAC;IACN,CAAC;IACD,OAAO;QACH,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,0BAA0B,QAAQ,iBAAiB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;KACzF,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IACxD,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACD,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC,CAAC,qDAAqD;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC;AAChE,CAAC;AAKD,IAAI,KAAK,GAA4B,IAAI,CAAC;AAC1C,IAAI,SAAS,GAAa,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAY;IAC7C,SAAS,GAAG,EAAE,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,6BAA6B;IACzC,KAAK,GAAG,IAAI,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IAC/C,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACvD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,IAAI,CAAC;YACD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAyB,IAAI,CAAC;IACtC,IAAI,CAAC;QACD,IAAI,GAAG,aAAa,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,GAAG,IAAI,CAAC,CAAC,gCAAgC;IACjD,CAAC;IACD,KAAK,GAAG,gBAAgB,CAAC;QACrB,cAAc,EAAE,uBAAuB,CAAC,WAAW,CAAC;QACpD,QAAQ,EAAE,IAAI;QACd,gBAAgB,EAAE,OAAO;QACzB,mBAAmB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;KACvD,CAAC,CAAC;IACH,SAAS,CAAC,oBAAoB,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACrC,gBAAwB,EACxB,KAAwB,EACxB,YAAoB;AACpB,sEAAsE;AACtE,IAAa,EACb,MAAgB;IAEhB,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrE,cAAc,CAAC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE;YACzC,IAAI,EAAE,YAAY;YAClB,sBAAsB,EAAE,WAAW;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,oCAAoC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,CAAC;QACjG,OAAO,WAAW,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,CACF,wCAAwC,MAAM,CAAC,CAAC,CAAC,kDAAkD,CACtG,CAAC;QACF,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,gBAAgB,CAC5B,WAAmB,EACnB,GAAsB;IAgBtB,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO;QACH,GAAG;QACH,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACtE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC,CAAC,EAAE;QAC7F,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;KAChF,CAAC;AACN,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAe;IAC/D,OAAO,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAChD,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/install/ruleLayerPartition.js

@@ -0,0 +1,157 @@
+/**
+ * The ADR-236 rule partition, decided per HOST directory on that host's own
+ * evidence.
+ *
+ * ## Why the decision moved from per-run to per-directory
+ *
+ * The filter used to sit in `condense.ts::_scoped_rule_basenames()`, which runs
+ * once per generation, so `partitionActive` — a claude-only fingerprint against
+ * `installed.lock` — decided for every host at once. That contradicted
+ * `partitionEligibility.ts`'s own fail-safe reasoning, which refuses to withhold a
+ * cursor artefact on claude's evidence because it "would deliver it nowhere", and
+ * it was measurably wrong in both directions on 2026-08-22 (partition ACTIVE,
+ * freshly generated worktree):
+ *
+ * ```
+ *   .claude/rules      13 files, 13 package-only,   0 global-only
+ *   .clinerules        14 files, 13 package-only,   0 global-only   ← narrowed on
+ *                                                                     borrowed evidence
+ *   .cursor/rules     126 files, 26 package-only, 100 global-only   ← never narrowed
+ *   .windsurf/rules   113 files, 13 package-only, 100 global-only   ← never narrowed
+ *   .augment/rules    118 files, 15 package-only, 103 global-only   ← never narrowed
+ * ```
+ *
+ * So the narrowing is per directory and gated on real evidence:
+ * {@link hostLayerCarries} reads that host's global directory and answers whether
+ * every name about to be withheld is actually there. No layer, an unreadable layer,
+ * or one missing a single name → the full projection is returned. A withhold now
+ * costs a directory read; the alternative cost a rule.
+ *
+ * ## Why it lives here rather than in condense.ts
+ *
+ * Four call sites consume it — the symlink emit plan, the cursor `.mdc` emitter,
+ * the windsurf emitter, the augment projector — and four sites deciding this
+ * separately is exactly how three of them came to disagree. It is in `src/install/`
+ * beside {@link partitionActive} and {@link hostLayerCarries}, the two predicates
+ * it composes, rather than in the 2,700-line generator that calls it.
+ *
+ * ## The classification source is the PROJECTION, not the authored tree
+ *
+ * `rulesSource` is `dist/agent-src/rules` at every call site, deliberately. A rule
+ * absent from `dist/` is compile-disabled and never projected, so it can be neither
+ * withheld nor duplicated — classifying from `src/rules` would count
+ * `telegraph-speak.md` (compile-disabled: 119 rules / 16 package-only in `src/`,
+ * 118 / 15 in `dist/`) and disagree with the emitter by exactly one file.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { isExclusivelyPackageOnly, partitionActive } from './partitionEligibility.js';
+import { hostLayerCarries, toolIdForProjectRuleDir } from './globalRuleLayers.js';
+/**
+ * Narrow one directory's rule list to the package-only set — but only when THIS
+ * host's global layer is verified to carry what would be withheld.
+ *
+ * Returns a copy of `rules` unchanged in every uncertain case. That direction is
+ * the whole design: an unnecessary duplicate costs context, a wrong withhold costs
+ * the rule.
+ */
+export function partitionRulesForDir(opts) {
+    const { toolDir, rules, projectRoot, rulesSource } = opts;
+    const active = opts.active ?? partitionActive(projectRoot);
+    if (!active) {
+        return [...rules];
+    }
+    const toolId = toolIdForProjectRuleDir(toolDir);
+    if (toolId === null) {
+        // An unmapped directory has no global layer this code can point at, so
+        // there is no evidence to withhold on.
+        return [...rules];
+    }
+    const packageOnly = rules.filter((r) => isExclusivelyPackageOnly(path.join(rulesSource, r)));
+    const keep = new Set(packageOnly);
+    const withheld = rules.filter((r) => !keep.has(r));
+    const home = opts.userHome ?? process.env['HOME'] ?? os.homedir();
+    const verdict = hostLayerCarries(toolId, withheld, home);
+    if (!verdict.carries) {
+        opts.announce?.(`  ⚠️  ${toolDir}: full projection kept — ${toolId}'s global layer ${verdict.reason}` +
+            (verdict.missing.length > 0
+                ? ` (${String(verdict.missing.length)} rule(s) not there, e.g. ` +
+                    `${verdict.missing.slice(0, 3).join(', ')})`
+                : ''));
+        return [...rules];
+    }
+    return packageOnly;
+}
+// ── The older, weaker duplicate-avoidance mechanism ──────────────────────────
+//
+// `projection.scope_dedup` (default OFF) predates the partition and solves the
+// same problem with a narrower method: skip a project copy only when its
+// user-scope twin is BYTE-IDENTICAL. It moved here from condense.ts alongside the
+// partition because the two are one subject — a reader deciding how a duplicate is
+// avoided should find both in one file rather than one here and one in a
+// 2,700-line generator. Behaviour is unchanged; only `MODULE_STATE` reads became
+// parameters.
+/** `fs.statSync(p).isFile()`, false on any error — condense.ts's `_isFile`. */
+function isFile(p) {
+    try {
+        return fs.statSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Per-tool user-scope rule directory, for the scope-dedup below. Only tools
+ * whose host reads a user-scope rules directory can have a redundant twin;
+ * everything else has nothing to de-duplicate against.
+ */
+const USER_SCOPE_RULE_DIRS = {
+    '.claude/rules': path.join('.claude', 'rules'),
+};
+export function dedupableRules(opts) {
+    const { toolDir: tool_dir, rules, userHome, rulesSource } = opts;
+    const relative = USER_SCOPE_RULE_DIRS[tool_dir];
+    if (relative === undefined) {
+        return new Set();
+    }
+    // A hostile or simply absent $HOME must make the dedup inert, not
+    // adventurous. In a container `$HOME` is often unset (so `homedir()` can
+    // resolve to `/`) or world-writable, and this function decides which rules
+    // to STOP emitting — reading an unexpected tree there is how a projection
+    // silently loses a rule. Council review of PR #1055 raised exactly this.
+    let userDirStat;
+    const userDir = path.join(userHome, relative);
+    try {
+        userDirStat = fs.statSync(userDir);
+    }
+    catch {
+        return new Set();
+    }
+    if (!userDirStat.isDirectory()) {
+        return new Set();
+    }
+    // World-writable user scope: anyone on the box could plant a byte-identical
+    // twin and thereby delete a rule from the project projection. Refuse.
+    if ((userDirStat.mode & 0o002) !== 0) {
+        opts.announce?.(`  ⚠️  ${tool_dir}: user-scope rules dir is world-writable — scope-dedup skipped`);
+        return new Set();
+    }
+    const skip = new Set();
+    for (const rule of rules) {
+        const twin = path.join(userDir, rule);
+        const source = path.join(rulesSource, rule);
+        try {
+            if (!isFile(twin) || !isFile(source))
+                continue;
+            if (fs.readFileSync(twin).equals(fs.readFileSync(source))) {
+                skip.add(rule);
+            }
+        }
+        catch {
+            // An unreadable twin is simply not de-duplicable — emit the project copy.
+        }
+    }
+    return skip;
+}
+//# sourceMappingURL=ruleLayerPartition.js.map

package/dist/install/ruleLayerPartition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleLayerPartition.js","sourceRoot":"","sources":["../../src/install/ruleLayerPartition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AA+BlF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC5D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClB,uEAAuE;QACvE,uCAAuC;QACvC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,EAAE,CACX,SAAS,OAAO,4BAA4B,MAAM,mBAAmB,OAAO,CAAC,MAAM,EAAE;YACjF,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACvB,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,2BAA2B;oBAC9D,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC9C,CAAC,CAAC,EAAE,CAAC,CAChB,CAAC;QACF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,kFAAkF;AAClF,mFAAmF;AACnF,yEAAyE;AACzE,iFAAiF;AACjF,cAAc;AAEd,+EAA+E;AAC/E,SAAS,MAAM,CAAC,CAAS;IACrB,IAAI,CAAC;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAqC;IAC3D,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;CACjD,CAAC;AAwBF,MAAM,UAAU,cAAc,CAAC,IAAkB;IAC7C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,kEAAkE;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,WAAqB,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC;QACD,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7B,OAAO,IAAI,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,QAAQ,gEAAgE,CAAC,CAAC;QACnG,OAAO,IAAI,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC/C,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,0EAA0E;QAC9E,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/mcp/registry-manifest.json

@@ -1,15 +1,15 @@
 {
   "discovery": {
-    "artefact_count": 611,
+    "artefact_count": 612,
     "scanner_version": "de0a22b4ac4c"
   },
-  "generated_at": "2026-08-21",
+  "generated_at": "2026-08-22",
   "package": {
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) \u2014 every claim machine-checked, including \"zero runtime daemon\".",
     "homepage": "https://event4u-app.github.io/agent-config",
     "name": "@event4u/agent-config",
     "repository": "https://github.com/event4u-app/agent-config",
-    "version": "14.7.0"
+    "version": "14.8.0"
   },
   "registries": [
     {

package/dist/mcp/server.json

@@ -9,12 +9,12 @@
       "transport": {
         "type": "stdio"
       },
-      "version": "14.7.0"
+      "version": "14.8.0"
     }
   ],
   "repository": {
     "source": "github",
     "url": "https://github.com/event4u-app/agent-config"
   },
-  "version": "14.7.0"
+  "version": "14.8.0"
 }