@event4u/agent-config 16.1.0 → 16.3.0

package/dist/cli-delegate/cmd_conformance.js

@@ -1,24 +1,43 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
+  readRecentEntries
+} from "./chunk-NYX3L2PZ.js";
+import {
+  NO_RED_EVIDENCE_REASON,
   deriveSessionKey,
+  describeRecordFinding,
   foldRefusal,
+  foldShadow,
+  hasRedThenGreen,
   isCiPoll,
   isVacuousOutput,
+  isVerificationCommand,
   parseRecord,
+  parseShadowRecord,
   pendingCount,
   readInstallBoundary,
+  readRunEvidence,
+  readTurnRunState,
   sessionRefusalFile,
+  sessionShadowFile,
+  shadowSetBy,
   statePathFor,
   validateAssumption
-} from "./chunk-QJWAUMJW.js";
+} from "./chunk-NQ7WT43P.js";
 import {
   readHookStdin
 } from "./chunk-F7DQWYR5.js";
 import {
-  DeadScopeError,
-  assertScanned,
-  reportScanned
-} from "./chunk-I3EIN2YG.js";
+  LexicalIndex,
+  isSqliteAvailableSync,
+  loadSqliteSync,
+  readUserVersion,
+  stampUserVersion,
+  tokenize
+} from "./chunk-ZBZV2G5R.js";
+import {
+  detectToolPresence
+} from "./chunk-A4QJ6ENT.js";
 import {
   ArgparseExit,
   STATUS_SYMBOLS,
@@ -35,16 +54,22 @@ import {
   comparePair,
   frontmatterPaths,
   proseEqual,
+  resolveSessionRole,
   splitFrontmatter
-} from "./chunk-GJCBB2UG.js";
+} from "./chunk-TRI6DQZ6.js";
 import "./chunk-FTAISGDQ.js";
-import "./chunk-M2DPGFZ4.js";
+import "./chunk-6V6TA25H.js";
 import "./chunk-ROYYTEZU.js";
 import "./chunk-BTWUYDGN.js";
 import {
-  projectStoreSlug,
-  resolveSessionRole
-} from "./chunk-FXYUYU4N.js";
+  atomicAppendLine,
+  probeHostCapabilities
+} from "./chunk-S4YWNRKO.js";
+import "./chunk-ULQRUR23.js";
+import {
+  hardenedSpawnEnv,
+  projectStoreSlug
+} from "./chunk-EEHDXSYD.js";
 import {
   atomic_write_json,
   atomic_write_text,
@@ -55,26 +80,22 @@ import {
   prune_stale_session_states,
   session_state_file
 } from "./chunk-E4XIZDIB.js";
-import {
-  artefact_roots
-} from "./chunk-NUHLI2RX.js";
-import {
-  readRecentEntries
-} from "./chunk-5R7HOLAF.js";
-import {
-  detectToolPresence
-} from "./chunk-A4QJ6ENT.js";
-import {
-  atomicAppendLine,
-  probeHostCapabilities
-} from "./chunk-6KM6ORRY.js";
 import "./chunk-T7L2QK3K.js";
 import "./chunk-DMSZHXZS.js";
+import "./chunk-NXEILF2K.js";
+import "./chunk-DEIV7XP7.js";
+import "./chunk-KB5FZ655.js";
+import "./chunk-JQOM7TTM.js";
 import {
   manifest_path,
   read_manifest
-} from "./chunk-4E2W63DA.js";
+} from "./chunk-OKJUIAPS.js";
 import "./chunk-MWRD5YOH.js";
+import {
+  DeadScopeError,
+  assertScanned,
+  reportScanned
+} from "./chunk-I3EIN2YG.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
@@ -83,17 +104,20 @@ import {
 } from "./chunk-MCJYCQPF.js";
 import {
   load_agent_settings
-} from "./chunk-FC75PGJE.js";
+} from "./chunk-JY2I2DXV.js";
 import "./chunk-NDJLNC6Q.js";
+import {
+  artefact_roots
+} from "./chunk-YCU3TIXH.js";
 import {
   __toESM
 } from "./chunk-J55WI3RR.js";
 
 // src/scripts/_cli/cmd_conformance.ts
 var YAML = __toESM(require_dist(), 1);
-import * as fs15 from "node:fs";
+import * as fs20 from "node:fs";
 import * as os7 from "node:os";
-import * as path15 from "node:path";
+import * as path18 from "node:path";
 import process5 from "node:process";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { fileURLToPath as fileURLToPath14, pathToFileURL as pathToFileURL14 } from "node:url";
@@ -109,10 +133,10 @@ var ROUTE_TARGET_TEMPLATES = Object.freeze({
   ])
 });
 function parseRouteTarget(target) {
-  const sep2 = target.indexOf(":");
-  if (sep2 <= 0) return null;
-  const kind = target.slice(0, sep2);
-  const id = target.slice(sep2 + 1);
+  const sep3 = target.indexOf(":");
+  if (sep3 <= 0) return null;
+  const kind = target.slice(0, sep3);
+  const id = target.slice(sep3 + 1);
   if (!id) return null;
   if (!Object.prototype.hasOwnProperty.call(ROUTE_TARGET_TEMPLATES, kind)) return null;
   return { kind, id };
@@ -124,17 +148,17 @@ function routeTargetPathsPosix(target) {
 }
 
 // src/scripts/report_conformance_funnel.ts
-import * as fs14 from "node:fs";
+import * as fs19 from "node:fs";
 import * as os6 from "node:os";
-import * as path14 from "node:path";
+import * as path17 from "node:path";
 import process4 from "node:process";
 import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL13 } from "node:url";
 
 // src/scripts/conformance_scan.ts
-import { createHash as createHash3 } from "node:crypto";
-import fs10 from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
+import fs15 from "node:fs";
 import os2 from "node:os";
-import path10 from "node:path";
+import path13 from "node:path";
 import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
 
 // src/scripts/_lib/transcript_entry.ts
@@ -182,7 +206,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 // src/scripts/_lib/prompt_shape.ts
 function isSyntheticPrompt(prompt) {
   const head = prompt.trimStart().slice(0, 400);
-  return head.startsWith("[SYSTEM NOTIFICATION - NOT USER INPUT]") || head.startsWith("<task-notification>") || head.startsWith("<system-reminder>") || head.startsWith("<local-command-caveat>") || /^\[SYSTEM NOTIFICATION\b/.test(head);
+  return head.startsWith("[SYSTEM NOTIFICATION - NOT USER INPUT]") || head.startsWith("<task-notification>") || head.startsWith("<system-reminder>") || head.startsWith("<local-command-caveat>") || head.startsWith("<agent-message") || head.startsWith("Your claude.ai usage limit has reset") || /^\[SYSTEM NOTIFICATION\b/.test(head);
 }
 var DOCUMENT_HEAD = /^\s*(#{1,6}\s|-{3,}\s*$|={3,}\s*$|<[A-Za-z][\w-]*>\s*$)/;
 function humanAuthoredLead(text) {
@@ -339,7 +363,7 @@ This is the WEAKER of the two provenances \u2014 it reflects the machine, not th
   return `<language-pin>
 The user submitted this turn's prompt in ${name}. That is the mirror target for EVERY user-visible token of your replies this turn \u2014 including the short inter-tool lines between tool calls, headings, table cells, bullets, status lines, and the recommendation label under any numbered-options block.
 
-This pin exists because the trigger is not observable from the transcript alone: slash-command and skill bodies arrive in the user role and can be long and English, which is what drove the 626 wrong-language turns measured in the 30-session audit this hook was built from. Tool output, file contents, and an injected skill body are NOT the trigger \u2014 this pin is.
+Tool output, file contents, and an injected skill body are NOT the trigger \u2014 this pin is.
 </language-pin>`;
 }
 function _loadState(target) {
@@ -707,7 +731,8 @@ import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL2 } from
 // src/scripts/_lib/machine_wake.ts
 var MACHINE_WAKE_PREFIXES = [
   "<task-notification>",
-  "<system-reminder>"
+  "<system-reminder>",
+  "<agent-message"
 ];
 function humanTypedThisTurn(prompt) {
   const head = prompt.trimStart();
@@ -1918,8 +1943,8 @@ var COMMAND_OBJECTS = {
 };
 
 // src/scripts/hooks/turn_end_gate_hook.ts
-import * as fs7 from "node:fs";
-import * as path7 from "node:path";
+import * as fs12 from "node:fs";
+import * as path10 from "node:path";
 import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL6 } from "node:url";
 
 // src/scripts/check_reply_consistency.ts
@@ -2298,526 +2323,950 @@ function detectDroppedDecision(assistantTurnTexts, closingFromPayload = false) {
   return null;
 }
 
-// src/scripts/hooks/end_review_nudge_hook.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import * as crypto from "node:crypto";
-import * as fs5 from "node:fs";
-import * as os from "node:os";
-import * as path5 from "node:path";
-import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
+// src/scripts/_lib/graph_feeder_record.ts
+import * as fs7 from "node:fs";
+import * as path6 from "node:path";
 
-// src/scripts/_lib/review_baseline.ts
-import { spawnSync } from "node:child_process";
+// src/scripts/code_graph/detect.ts
+import { execFileSync } from "node:child_process";
 import * as fs4 from "node:fs";
 import * as path4 from "node:path";
-function currentHeadSha(cwd) {
+
+// src/scripts/code_graph/types.ts
+var GUESS_RESOLVED_VIA = /* @__PURE__ */ new Set([
+  "name-lookup",
+  "dynamic",
+  // The accepted-edge filter is a DENYLIST, so a new value is accepted by
+  // default — which is exactly backwards for this one. `foreign` must be
+  // listed here or a consumer's graph would silently answer the gate verbs
+  // as if this package had resolved its edges.
+  "foreign"
+]);
+function isStatedResolution(resolved_via) {
+  return !GUESS_RESOLVED_VIA.has(resolved_via);
+}
+var SCHEMA_VERSION = 4;
+var EXT_LANG = {
+  ".php": "php",
+  ".ts": "typescript",
+  ".tsx": "typescript",
+  ".mts": "typescript",
+  ".cts": "typescript",
+  ".js": "javascript",
+  ".jsx": "javascript",
+  ".mjs": "javascript",
+  ".cjs": "javascript"
+};
+
+// src/scripts/code_graph/validate.ts
+var RELATIONS = /* @__PURE__ */ new Set(["calls", "imports", "uses", "inherits", "member", "tests"]);
+var CONFIDENCES = /* @__PURE__ */ new Set(["EXTRACTED", "INFERRED", "AMBIGUOUS"]);
+var RESOLVED_VIA = /* @__PURE__ */ new Set([
+  "same-file",
+  "import-specifier",
+  "path-alias",
+  "psr4",
+  "route-table",
+  "test-import",
+  "name-lookup",
+  "dynamic",
+  // Adapted from a consumer's own graph file; see `foreign.ts`.
+  "foreign"
+]);
+var PROVIDERS = /* @__PURE__ */ new Set(["native", "foreign"]);
+var KINDS = /* @__PURE__ */ new Set([
+  "file",
+  "class",
+  "interface",
+  "trait",
+  "function",
+  "method",
+  "constant",
+  "type",
+  "enum",
+  "skipped"
+]);
+function validateGraph(g) {
+  const errors = [];
+  const push = (m) => {
+    if (errors.length < 50) errors.push(m);
+  };
+  if (typeof g !== "object" || g === null) return { ok: false, errors: ["graph is not an object"] };
+  const obj = g;
+  if (typeof obj["schema_version"] !== "number") push("schema_version must be a number");
+  if (typeof obj["source_checksum"] !== "string") push("source_checksum must be a string");
+  if (!Array.isArray(obj["nodes"])) push("nodes must be an array");
+  if (!Array.isArray(obj["edges"])) push("edges must be an array");
+  if (errors.length) return { ok: false, errors };
+  const nodes = obj["nodes"];
+  const ids = /* @__PURE__ */ new Set();
+  nodes.forEach((n, i) => {
+    if (typeof n !== "object" || n === null) return push(`node[${i}] not an object`);
+    const nn = n;
+    if (typeof nn["id"] !== "string") push(`node[${i}].id must be a string`);
+    else ids.add(nn["id"]);
+    if (!KINDS.has(nn["kind"])) push(`node[${i}].kind invalid: ${String(nn["kind"])}`);
+    if (typeof nn["source_file"] !== "string") push(`node[${i}].source_file must be a string`);
+    if (!Array.isArray(nn["source_location"])) push(`node[${i}].source_location must be an array`);
+  });
+  obj["edges"].forEach((e, i) => {
+    if (typeof e !== "object" || e === null) return push(`edge[${i}] not an object`);
+    const ee = e;
+    if (typeof ee["source"] !== "string") push(`edge[${i}].source must be a string`);
+    if (typeof ee["target"] !== "string") push(`edge[${i}].target must be a string`);
+    if (!RELATIONS.has(ee["relation"])) push(`edge[${i}].relation invalid: ${String(ee["relation"])}`);
+    if (!CONFIDENCES.has(ee["confidence"]))
+      push(`edge[${i}].confidence invalid: ${String(ee["confidence"])}`);
+    if (ee["resolved_via"] === void 0) push(`edge[${i}].resolved_via is required`);
+    else if (!RESOLVED_VIA.has(ee["resolved_via"]))
+      push(`edge[${i}].resolved_via invalid: ${String(ee["resolved_via"])}`);
+    if (ee["provider"] === void 0) push(`edge[${i}].provider is required`);
+    else if (!PROVIDERS.has(ee["provider"]))
+      push(`edge[${i}].provider invalid: ${String(ee["provider"])}`);
+    if (typeof ee["source"] === "string" && !ids.has(ee["source"]))
+      push(`edge[${i}].source is not a known node: ${String(ee["source"])}`);
+    if (ee["candidates"] !== void 0 && !Array.isArray(ee["candidates"]))
+      push(`edge[${i}].candidates must be an array when present`);
+  });
+  return { ok: errors.length === 0, errors };
+}
+
+// src/scripts/code_graph/detect.ts
+var CONSUMER_CANDIDATES = ["graph.json", "code-graph.json", ".code-graph/graph.json"];
+function consumerCandidates(root) {
+  let declared;
   try {
-    const r = spawnSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" });
-    if (r.status !== 0) return null;
-    const out = (r.stdout ?? "").trim();
-    return out === "" ? null : out;
+    const settings = load_agent_settings({ cwd: root }) ?? {};
+    const section = settings["code_graph"];
+    declared = section !== null && typeof section === "object" && !Array.isArray(section) ? section["consumer_index_paths"] : void 0;
   } catch {
-    return null;
+    declared = void 0;
   }
+  const extra = Array.isArray(declared) ? declared.filter(
+    (p) => typeof p === "string" && p !== "" && !path4.isAbsolute(p) && !path4.normalize(p).startsWith("..")
+  ) : [];
+  return [...CONSUMER_CANDIDATES, ...extra.filter((p) => !CONSUMER_CANDIDATES.includes(p))];
 }
-var BASELINE_STATE_REL = path4.join("agents", "runtime", "state", "review-baseline");
-function baselineStateDir(workspaceRoot) {
-  return path4.join(workspaceRoot, BASELINE_STATE_REL);
-}
-function baselineStateFile(workspaceRoot, sessionKey) {
-  return path4.join(baselineStateDir(workspaceRoot), `${sessionKey}.json`);
-}
-function parseBaseline(raw) {
-  let decoded;
+function gitLastCommitEpoch(root) {
   try {
-    decoded = JSON.parse(raw);
+    const out = execFileSync("git", ["-C", root, "log", "-1", "--format=%ct"], {
+      env: hardenedSpawnEnv(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const n = Number(out);
+    return Number.isFinite(n) ? n : null;
   } catch {
     return null;
   }
-  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return null;
-  const o = decoded;
-  const lines = o["baseline_lines"];
-  if (typeof lines !== "number" || !Number.isFinite(lines) || lines < 0) return null;
-  const written = o["written_at"];
-  if (typeof written !== "string") return null;
-  const head = o["head_sha"];
-  const measure = o["measure"];
-  return {
-    head_sha: typeof head === "string" && head !== "" ? head : null,
-    baseline_lines: lines,
-    ...measure === "exact" || measure === "capped_approximation" ? { measure } : {},
-    written_at: written
-  };
 }
-function readBaseline(workspaceRoot, sessionKey) {
-  const file = baselineStateFile(workspaceRoot, sessionKey);
-  let raw;
+function commitsBehind(root, sha) {
   try {
-    raw = fs4.readFileSync(file, "utf-8");
-  } catch (exc) {
-    const code = exc?.code;
-    return code === "ENOENT" ? "absent" : "unreadable";
+    const out = execFileSync("git", ["-C", root, "rev-list", "--count", `${sha}..HEAD`], {
+      env: hardenedSpawnEnv(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const n = Number(out);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
   }
-  return parseBaseline(raw) ?? "unreadable";
 }
-function applyBaseline(measuredLines, baseline, headSha, measuredMeasure = "exact") {
-  if (baseline === "absent" || baseline === "unreadable") {
-    return { applied: false, fallback: baseline, lines: measuredLines };
+function freshness(root, file, embeddedSha) {
+  if (embeddedSha) {
+    const behind = commitsBehind(root, embeddedSha);
+    if (behind !== null) return { stale: behind > 0, commits_behind: behind };
   }
-  if (baseline.measure !== "exact" || measuredMeasure !== "exact") {
-    return { applied: false, fallback: "mixed-measure", lines: measuredLines };
+  const last = gitLastCommitEpoch(root);
+  if (last === null) return {};
+  try {
+    const mtime = Math.floor(fs4.statSync(file).mtimeMs / 1e3);
+    return { stale: mtime < last };
+  } catch {
+    return {};
   }
-  if (baseline.head_sha !== headSha()) {
-    return { applied: false, fallback: "head-moved", lines: measuredLines };
+}
+function looksLikeGraph(p) {
+  try {
+    const raw = JSON.parse(fs4.readFileSync(p, "utf-8"));
+    if (validateGraph(raw).ok) return { ok: true, sha: raw["head_at_build"] ?? null };
+    const nodes = raw["nodes"];
+    const edges = raw["edges"] ?? raw["links"];
+    const okShape = Array.isArray(nodes) && Array.isArray(edges) && (edges.length === 0 || typeof edges[0] === "object" && edges[0] !== null && "source" in edges[0] && "target" in edges[0]);
+    return { ok: okShape, sha: raw["head_at_build"] ?? null };
+  } catch {
+    return { ok: false, sha: null };
   }
-  return {
-    applied: true,
-    baseline,
-    lines: Math.max(0, measuredLines - baseline.baseline_lines)
-  };
 }
-
-// src/scripts/_lib/audit_field_provenance.ts
-var MAX_APPLIED_IDS = 32;
-function appliedIds(values) {
+function detectSources(root, nativeCache) {
+  const abs = path4.resolve(root);
   const out = [];
-  for (const raw of values ?? []) {
-    const v = String(raw).trim();
-    if (v === "" || out.includes(v)) continue;
-    out.push(v);
-    if (out.length >= MAX_APPLIED_IDS) break;
+  for (const rel of consumerCandidates(abs)) {
+    const p = path4.join(abs, rel);
+    if (fs4.existsSync(p)) {
+      const { ok, sha } = looksLikeGraph(p);
+      if (ok) out.push({ kind: "consumer", path: p, present: true, ...freshness(abs, p, sha) });
+    }
+  }
+  const scipCandidates = [path4.join(abs, "index.scip")];
+  try {
+    for (const e of fs4.readdirSync(abs)) if (e.endsWith(".scip")) scipCandidates.push(path4.join(abs, e));
+  } catch {
   }
+  const scip = scipCandidates.find((p) => fs4.existsSync(p));
+  if (scip) out.push({ kind: "scip", path: scip, present: true, note: "SCIP detected \u2014 peer tooling required (no owned reader)" });
+  if (fs4.existsSync(nativeCache)) out.push({ kind: "native", path: nativeCache, present: true, ...freshness(abs, nativeCache, null) });
   return out;
 }
-
-// src/scripts/_lib/review_skipped_record.ts
-var BASELINE_APPLICATIONS = [
-  "applied",
-  "absent",
-  "unreadable",
-  "head_moved",
-  "mixed_measure"
-];
-var PRODUCER_PRIVACY_CLASS = "ids-only";
-function isNonNegInt(n) {
-  return typeof n === "number" && Number.isFinite(n) && Number.isInteger(n) && n >= 0;
+function pickSource(verdicts) {
+  const consumer = verdicts.find((v) => v.kind === "consumer" && v.stale !== true);
+  if (consumer) return consumer;
+  const native = verdicts.find((v) => v.kind === "native");
+  if (native) return native;
+  return verdicts.find((v) => v.kind === "consumer") ?? null;
 }
-var HIGH_RISK_DIFF_LINES = 200;
-function buildReviewSkippedLine(input) {
-  const errors = [];
-  if (!isNonNegInt(input.diff_lines)) {
-    errors.push("diff_lines must be a non-negative integer");
+var NATIVE_CACHE_REL = path4.join("agents", "runtime", "state", "code-graph-v1.json");
+function hasUncommittedIndexedEdit(root) {
+  let out;
+  try {
+    out = execFileSync("git", ["-C", root, "status", "--porcelain", "--untracked-files=all"], {
+      env: hardenedSpawnEnv(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      // Both bounds are the review's: Node's 1 MB default would throw
+      // ENOBUFS on a large working tree, the catch below would return
+      // false, and the state would read `fresh` — a second silent
+      // under-report on a probe that runs at PreToolUse and at every stop.
+      // The timeout bounds the other failure: this probe sits in front of
+      // a tool call, so a hung git must not hold one up.
+      maxBuffer: 32 * 1024 * 1024,
+      timeout: 5e3
+    });
+  } catch {
+    return false;
   }
-  if (input.mutation_measure !== "exact" && input.mutation_measure !== "capped_approximation") {
-    errors.push('mutation_measure must be "exact" or "capped_approximation"');
+  for (const raw of out.split("\n")) {
+    if (raw.length < 4) continue;
+    let p = raw.slice(3);
+    const arrow = p.indexOf(" -> ");
+    if (arrow !== -1) p = p.slice(arrow + 4);
+    p = p.trim().replace(/^"|"$/g, "");
+    const dot = p.lastIndexOf(".");
+    if (dot === -1) continue;
+    if (p.slice(dot).toLowerCase() in EXT_LANG) return true;
   }
-  if (!input.ts) errors.push("ts (ISO-8601 UTC) is required");
-  if (!input.id) errors.push("id (ULID, UUID, or content hash) is required");
-  if (input.baseline !== void 0 && !BASELINE_APPLICATIONS.includes(input.baseline)) {
-    errors.push(`baseline must be one of ${BASELINE_APPLICATIONS.join(", ")}`);
+  return false;
+}
+function graphState(root, nativeCache) {
+  const picked = pickSource(detectSources(root, nativeCache ?? path4.join(root, NATIVE_CACHE_REL)));
+  if (!picked) return "absent";
+  if (picked.stale === true) {
+    const behind = picked.commits_behind;
+    return `behind:${typeof behind === "number" ? behind : 0}`;
   }
-  if (errors.length) return { line: null, errors };
-  const line = {
-    schema_version: 1,
-    id: input.id,
-    ts: input.ts,
-    work_id: input.work_id ?? `review-skipped-${input.ts}`,
-    phase: "report",
-    outcome: "skipped",
-    confidence_band: "medium",
-    risk_class: input.diff_lines >= HIGH_RISK_DIFF_LINES ? "high" : "medium",
-    memory: { asks: 0, hits: 0 },
-    verify: { claims: 0, first_try_passes: 0 },
-    // COMPUTED, never a producer constant.
-    rules_applied: appliedIds(input.rules_applied),
-    // MANDATORY on every audit line, same as the orchestration producer.
-    privacy_class: PRODUCER_PRIVACY_CLASS,
-    // `skills_applied` is OMITTED here, deliberately and not by oversight.
-    // audit-log-v1 distinguishes an absent key ("not recorded") from `[]`
-    // ("recorded, none applied"), and this writer observes a review that
-    // did not happen -- it has no skill observation to offer in either
-    // direction. Emitting `[]` would assert "no skills applied" on evidence
-    // this producer never gathered, which is the exact fabrication the
-    // absent/empty split exists to make impossible.
-    persona: null,
-    input_kind: "prompt",
-    type: "note",
-    review_skipped: {
-      diff_lines: input.diff_lines,
-      mutation_measure: input.mutation_measure,
-      // Omitted, not defaulted, when the producer recorded nothing —
-      // audit-log-v1's absent-versus-present split is the same one
-      // `skills_applied` uses above, for the same reason.
-      ...input.baseline === void 0 ? {} : { baseline: input.baseline }
-    }
-  };
-  return { line, errors: [] };
+  return hasUncommittedIndexedEdit(root) ? "edited" : "fresh";
 }
 
-// src/scripts/hooks/envelope.ts
-var ENVELOPE_KEYS = [
-  "schema_version",
-  "platform",
-  "event",
-  "payload"
-];
-function _isObject4(obj) {
-  return typeof obj === "object" && obj !== null && !Array.isArray(obj);
-}
-function looks_like_envelope(obj) {
-  if (!_isObject4(obj)) {
+// src/scripts/code_graph/query.ts
+import * as fs6 from "node:fs";
+
+// src/scripts/code_graph/sqlite_store.ts
+import * as fs5 from "node:fs";
+var GRAPH_STORE_VERSION = 4;
+var INDEXED_READ_MIN_EDGES = 5e4;
+function sqliteTwinPath(jsonPath) {
+  return jsonPath.endsWith(".json") ? `${jsonPath.slice(0, -5)}.sqlite3` : `${jsonPath}.sqlite3`;
+}
+function emitSqliteTwin(graph, serialized, jsonPath) {
+  if (!isSqliteAvailableSync()) return false;
+  const twin = sqliteTwinPath(jsonPath);
+  const tmp = `${twin}.tmp-${process.pid}`;
+  try {
+    const { DatabaseSync } = loadSqliteSync("code_graph.sqlite_store");
+    let stat;
+    try {
+      stat = fs5.statSync(jsonPath);
+    } catch {
+      return false;
+    }
+    fs5.rmSync(tmp, { force: true });
+    const db = new DatabaseSync(tmp);
+    try {
+      db.exec("PRAGMA journal_mode = MEMORY");
+      db.exec(
+        "CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);CREATE TABLE nodes (id TEXT PRIMARY KEY, label TEXT NOT NULL, kind TEXT, source_file TEXT, l0 INTEGER, l1 INTEGER, l2 INTEGER, l3 INTEGER);CREATE TABLE edges (source TEXT NOT NULL, target TEXT NOT NULL, relation TEXT NOT NULL, confidence TEXT NOT NULL, candidates TEXT, ambiguity_reason TEXT, resolved_via TEXT, provider TEXT);CREATE INDEX edges_source ON edges(source);CREATE INDEX edges_target ON edges(target);CREATE INDEX nodes_label ON nodes(label);CREATE INDEX nodes_source_file ON nodes(source_file);"
+      );
+      const meta = db.prepare("INSERT INTO meta (key, value) VALUES (?, ?)");
+      meta.run("source_checksum", graph.source_checksum);
+      meta.run("json_size", String(stat.size));
+      meta.run("json_mtime_ms", String(stat.mtimeMs));
+      meta.run("graph_json", serialized);
+      meta.run("node_count", String(graph.nodes.length));
+      meta.run("edge_count", String(graph.edges.length));
+      const insNode = db.prepare(
+        "INSERT INTO nodes (id, label, kind, source_file, l0, l1, l2, l3) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
+      );
+      for (const n of graph.nodes) {
+        const loc = n.source_location ?? [];
+        insNode.run(
+          n.id,
+          n.label,
+          n.kind ?? null,
+          n.source_file ?? null,
+          loc[0] ?? null,
+          loc[1] ?? null,
+          loc[2] ?? null,
+          loc[3] ?? null
+        );
+      }
+      const insEdge = db.prepare(
+        "INSERT INTO edges (source, target, relation, confidence, candidates, ambiguity_reason, resolved_via, provider) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
+      );
+      for (const e of graph.edges) {
+        insEdge.run(
+          e.source,
+          e.target,
+          e.relation,
+          e.confidence,
+          e.candidates ? JSON.stringify(e.candidates) : null,
+          e.ambiguity_reason ?? null,
+          e.resolved_via,
+          e.provider
+        );
+      }
+      stampUserVersion(db, GRAPH_STORE_VERSION);
+    } finally {
+      db.close();
+    }
+    fs5.renameSync(tmp, twin);
+    return true;
+  } catch {
+    fs5.rmSync(tmp, { force: true });
     return false;
   }
-  return ENVELOPE_KEYS.every((key) => key in obj);
 }
-function unwrap(stdin_text, default_platform = "generic") {
-  const text = (stdin_text ?? "").trim();
-  if (!text) {
-    return [{}, {}, default_platform];
-  }
-  let decoded;
+function loadSerializedFromTwin(jsonPath) {
+  if (!isSqliteAvailableSync()) return null;
+  const twin = sqliteTwinPath(jsonPath);
+  if (!fs5.existsSync(twin)) return null;
+  let stat;
   try {
-    decoded = JSON.parse(text);
+    stat = fs5.statSync(jsonPath);
   } catch {
-    return [{}, {}, default_platform];
+    return null;
   }
-  if (looks_like_envelope(decoded)) {
-    const env = decoded;
-    let payload2 = env["payload"];
-    if (!payload2 || !_isObject4(payload2)) {
-      payload2 = {};
+  try {
+    const { DatabaseSync } = loadSqliteSync("code_graph.sqlite_store");
+    const db = new DatabaseSync(twin, { readOnly: true });
+    try {
+      if (readUserVersion(db) !== GRAPH_STORE_VERSION) return null;
+      const rows = db.prepare("SELECT key, value FROM meta").all();
+      const meta = new Map(rows.map((r) => [r.key, r.value]));
+      if (meta.get("json_size") !== String(stat.size)) return null;
+      if (meta.get("json_mtime_ms") !== String(stat.mtimeMs)) return null;
+      const serialized = meta.get("graph_json");
+      return serialized && serialized.length > 0 ? serialized : null;
+    } finally {
+      db.close();
     }
-    const platRaw = env["platform"];
-    const platform = String(platRaw || default_platform);
-    return [env, payload2, platform];
+  } catch {
+    fs5.rmSync(twin, { force: true });
+    return null;
   }
-  const payload = _isObject4(decoded) ? decoded : {};
-  return [
-    {
-      schema_version: 1,
-      platform: default_platform,
-      event: "",
-      native_event: "",
-      session_id: "",
-      workspace_root: "",
-      payload,
-      settings: {}
-    },
-    payload,
-    default_platform
-  ];
 }
-
-// src/scripts/hooks/end_review_nudge_hook.ts
-var MUTATION_LINE_THRESHOLD = 50;
-var UNTRACKED_FILE_CAP = 20;
-var TRANSCRIPT_SCAN_MAX_BYTES = 50 * 1024 * 1024;
-function isSafeTranscriptPath(rawPath, opts = {}) {
-  if (!rawPath || !/\.jsonl$/i.test(rawPath)) return false;
-  const homeDir = opts.homeDir ?? os.homedir();
-  const maxBytes = opts.maxBytes ?? TRANSCRIPT_SCAN_MAX_BYTES;
-  try {
-    const realHome = fs5.realpathSync(homeDir);
-    const realPath = fs5.realpathSync(rawPath);
-    const relative3 = path5.relative(realHome, realPath);
-    if (relative3 === "" || relative3.startsWith("..") || path5.isAbsolute(relative3)) {
-      return false;
-    }
-    const { size } = fs5.statSync(realPath);
-    return size <= maxBytes;
-  } catch {
-    return false;
-  }
+function toNode(r) {
+  const loc = [r.l0, r.l1, r.l2, r.l3].filter((v) => typeof v === "number");
+  return {
+    id: r.id,
+    label: r.label,
+    kind: r.kind ?? "file",
+    source_file: r.source_file ?? "",
+    source_location: loc
+  };
 }
-var EXIT_WARN2 = 2;
-function parseNumstat(raw) {
-  const rows = [];
-  for (const line of raw.split("\n")) {
-    const m = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
-    if (!m) continue;
-    const addedStr = m[1];
-    const deletedStr = m[2];
-    rows.push({
-      added: addedStr === "-" ? 0 : Number(addedStr),
-      deleted: deletedStr === "-" ? 0 : Number(deletedStr),
-      path: m[3]
-    });
+function toEdge(r) {
+  const e = {
+    source: r.source,
+    target: r.target,
+    relation: r.relation,
+    confidence: r.confidence,
+    // The SQL columns are nullable, the TypeScript fields are not. A null
+    // can only come from a twin emitted before these fields existed, which
+    // GRAPH_STORE_VERSION already refuses — so this coalesce is unreachable
+    // in a healthy tree and is written to fail READABLE rather than to
+    // fabricate: `name-lookup` is the weakest mechanism, so a mislabelled
+    // edge is under-trusted rather than over-trusted by Phase 3's filter.
+    resolved_via: r.resolved_via ?? "name-lookup",
+    provider: r.provider ?? "native"
+  };
+  if (r.candidates) e.candidates = JSON.parse(r.candidates);
+  if (r.ambiguity_reason === "receiver-unknown" || r.ambiguity_reason === "hierarchy-unresolved") {
+    e.ambiguity_reason = r.ambiguity_reason;
   }
-  return rows;
+  return e;
 }
-var DOC_PATH_RE = /\.md$/i;
-function isDocPath(p) {
-  return DOC_PATH_RE.test(p);
-}
-function nonDocMutatedLines(rows) {
-  return rows.filter((r) => !isDocPath(r.path)).reduce((sum, r) => sum + r.added + r.deleted, 0);
-}
-function gitNumstatRows(cwd) {
+function openGraphIndex(jsonPath) {
+  if (!isSqliteAvailableSync()) return null;
+  const twin = sqliteTwinPath(jsonPath);
+  if (!fs5.existsSync(twin)) return null;
+  let stat;
   try {
-    const r = spawnSync2("git", ["diff", "--numstat", "HEAD"], {
-      cwd,
-      encoding: "utf8",
-      maxBuffer: 16 * 1024 * 1024
-    });
-    if (r.status !== 0) return [];
-    return parseNumstat(r.stdout ?? "");
+    stat = fs5.statSync(jsonPath);
   } catch {
-    return [];
+    return null;
   }
-}
-function untrackedNonDocFiles(cwd) {
   try {
-    const r = spawnSync2("git", ["ls-files", "--others", "--exclude-standard"], {
-      cwd,
-      encoding: "utf8",
-      maxBuffer: 16 * 1024 * 1024
-    });
-    if (r.status !== 0) return [];
-    return (r.stdout ?? "").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !isDocPath(l));
+    const { DatabaseSync } = loadSqliteSync("code_graph.sqlite_store");
+    const db = new DatabaseSync(twin, { readOnly: true });
+    try {
+      if (readUserVersion(db) !== GRAPH_STORE_VERSION) {
+        db.close();
+        return null;
+      }
+      const rows = db.prepare("SELECT key, value FROM meta").all();
+      const meta = new Map(rows.map((r) => [r.key, r.value]));
+      if (meta.get("json_size") !== String(stat.size) || meta.get("json_mtime_ms") !== String(stat.mtimeMs)) {
+        db.close();
+        return null;
+      }
+      const nodeCount = Number(meta.get("node_count") ?? NaN);
+      const edgeCount = Number(meta.get("edge_count") ?? NaN);
+      if (!Number.isFinite(nodeCount) || !Number.isFinite(edgeCount)) {
+        db.close();
+        return null;
+      }
+      const qNode = db.prepare("SELECT * FROM nodes WHERE id = ?");
+      const qFrom = db.prepare("SELECT * FROM edges WHERE source = ?");
+      const qTo = db.prepare("SELECT * FROM edges WHERE target = ?");
+      const qLabel = db.prepare("SELECT id FROM nodes WHERE label = ? LIMIT ?");
+      return {
+        nodeCount,
+        edgeCount,
+        sourceChecksum: meta.get("source_checksum") ?? "",
+        getNode(id) {
+          const r = qNode.get(id);
+          return r ? toNode(r) : void 0;
+        },
+        hasNode(id) {
+          return qNode.get(id) !== void 0;
+        },
+        edgesFrom(id) {
+          return qFrom.all(id).map(toEdge);
+        },
+        edgesTo(id) {
+          return qTo.all(id).map(toEdge);
+        },
+        idsByLabel(labelText, limit) {
+          return qLabel.all(labelText, limit).map((r) => r.id);
+        },
+        idsInFiles(files) {
+          if (files.length === 0) return [];
+          const out = [];
+          const CHUNK = 400;
+          for (let i = 0; i < files.length; i += CHUNK) {
+            const slice = files.slice(i, i + CHUNK);
+            const marks = slice.map(() => "?").join(",");
+            const stmt = db.prepare(
+              `SELECT id FROM nodes WHERE kind != 'file' AND source_file IN (${marks})`
+            );
+            for (const r of stmt.all(...slice)) out.push(r.id);
+          }
+          return out;
+        },
+        allNodeIds() {
+          return db.prepare("SELECT id FROM nodes ORDER BY id").all().map(
+            (r) => r.id
+          );
+        },
+        lexicalCorpus() {
+          return db.prepare("SELECT id, label FROM nodes").all().map(
+            (r) => ({ id: r.id, text: `${r.label} ${r.id}` })
+          );
+        },
+        close() {
+          db.close();
+        }
+      };
+    } catch (err) {
+      db.close();
+      throw err;
+    }
   } catch {
-    return [];
+    return null;
   }
 }
-var BINARY_PROBE_BYTES = 8e3;
-var UNTRACKED_FILE_READ_CAP_BYTES = 8 * 1024 * 1024;
-function untrackedFileLineCount(cwd, relPath) {
-  try {
-    const abs = path5.resolve(cwd, relPath);
-    const size = fs5.statSync(abs).size;
-    if (size === 0) return 0;
-    if (size > UNTRACKED_FILE_READ_CAP_BYTES) {
-      return MUTATION_LINE_THRESHOLD + 1;
+
+// src/scripts/code_graph/foreign.ts
+import { createHash } from "node:crypto";
+var RELATION_MAP = {
+  calls: "calls",
+  call: "calls",
+  invokes: "calls",
+  imports: "imports",
+  import: "imports",
+  requires: "imports",
+  uses: "uses",
+  use: "uses",
+  references: "uses",
+  inherits: "inherits",
+  extends: "inherits",
+  implements: "inherits",
+  member: "member",
+  contains: "member",
+  tests: "tests",
+  test: "tests"
+};
+var KINDS2 = /* @__PURE__ */ new Set([
+  "file",
+  "class",
+  "interface",
+  "trait",
+  "function",
+  "method",
+  "constant",
+  "type",
+  "enum",
+  "skipped"
+]);
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function looksForeign(doc) {
+  if (!isObject(doc)) return false;
+  if (!Array.isArray(doc["nodes"])) return false;
+  if (Array.isArray(doc["links"])) return true;
+  return Array.isArray(doc["edges"]) && typeof doc["schema_version"] !== "number";
+}
+function adaptForeignGraph(doc) {
+  if (!isObject(doc)) return null;
+  const rawNodes = doc["nodes"];
+  const rawEdges = doc["links"] ?? doc["edges"];
+  if (!Array.isArray(rawNodes) || !Array.isArray(rawEdges)) return null;
+  const nodes = [];
+  const ids = /* @__PURE__ */ new Set();
+  for (const n of rawNodes) {
+    if (!isObject(n)) continue;
+    const id = n["id"];
+    if (typeof id !== "string" || id === "") continue;
+    const kind = typeof n["kind"] === "string" && KINDS2.has(n["kind"]) ? n["kind"] : "skipped";
+    const sourceFile = typeof n["source_file"] === "string" ? n["source_file"] : typeof n["file"] === "string" ? n["file"] : "";
+    nodes.push({
+      id,
+      label: typeof n["label"] === "string" ? n["label"] : id,
+      kind,
+      source_file: sourceFile,
+      // A foreign node rarely carries a span. An empty one is honest —
+      // it says "no location recorded", where a fabricated [1,1] would
+      // point a reader at the top of a file for no reason.
+      source_location: Array.isArray(n["source_location"]) ? n["source_location"] : []
+    });
+    ids.add(id);
+  }
+  const edges = [];
+  const unmapped = {};
+  let malformed = 0;
+  for (const e of rawEdges) {
+    if (!isObject(e)) {
+      malformed += 1;
+      continue;
     }
-    const buf = fs5.readFileSync(abs);
-    if (buf.length === 0) return 0;
-    const probe = buf.subarray(0, Math.min(buf.length, BINARY_PROBE_BYTES));
-    if (probe.includes(0)) return 0;
-    let lines = 0;
-    for (const byte of buf) {
-      if (byte === 10) lines += 1;
+    const source = e["source"];
+    const target = e["target"];
+    if (typeof source !== "string" || typeof target !== "string" || !ids.has(source)) {
+      malformed += 1;
+      continue;
     }
-    if (buf[buf.length - 1] !== 10) lines += 1;
-    return lines;
-  } catch {
-    return 0;
+    const rawRelation = typeof e["relation"] === "string" ? e["relation"] : "";
+    const relation = RELATION_MAP[rawRelation.toLowerCase()];
+    if (relation === void 0) {
+      const key = rawRelation === "" ? "(none)" : rawRelation;
+      unmapped[key] = (unmapped[key] ?? 0) + 1;
+      continue;
+    }
+    edges.push({
+      source,
+      target,
+      relation,
+      // Not EXTRACTED: this package did not extract it and cannot say
+      // how the tool that did arrived at it.
+      confidence: "AMBIGUOUS",
+      resolved_via: "foreign",
+      provider: "foreign"
+    });
   }
+  const counts = { EXTRACTED: 0, INFERRED: 0, AMBIGUOUS: edges.length };
+  const graph = {
+    schema_version: SCHEMA_VERSION,
+    source_checksum: createHash("sha256").update(JSON.stringify(doc), "utf-8").digest("hex"),
+    languages: [],
+    grammar_abi: 0,
+    edge_confidence_counts: counts,
+    suppressed_edge_counts: { dynamic_no_candidate: 0 },
+    nodes,
+    edges
+  };
+  return { graph, unmapped_relations: unmapped, malformed_edges: malformed };
 }
-function totalNonDocMutatedLinesWithMeasure(cwd) {
-  const trackedLines = nonDocMutatedLines(gitNumstatRows(cwd));
-  const untracked = untrackedNonDocFiles(cwd);
-  if (untracked.length > UNTRACKED_FILE_CAP) {
-    return { lines: MUTATION_LINE_THRESHOLD + 1 + trackedLines, measure: "capped_approximation" };
+
+// src/scripts/code_graph/query.ts
+function indexBackedGraph(index, source, answeredBy) {
+  const nodeCache = /* @__PURE__ */ new Map();
+  const readNode = (id) => {
+    if (nodeCache.has(id)) return nodeCache.get(id);
+    const n = index.getNode(id);
+    nodeCache.set(id, n);
+    return n;
+  };
+  let lexical = null;
+  return {
+    graph: null,
+    source,
+    answeredBy,
+    byId: { get: readNode, has: (id) => readNode(id) !== void 0 },
+    out: { get: (id) => index.edgesFrom(id) },
+    in: { get: (id) => index.edgesTo(id) },
+    idsByLabel: (labelText, limit) => index.idsByLabel(labelText, limit),
+    idsInFiles: (files) => index.idsInFiles(files),
+    allNodeIds: () => index.allNodeIds(),
+    lex: () => {
+      lexical ??= new LexicalIndex(index.lexicalCorpus());
+      return lexical;
+    },
+    close: () => index.close()
+  };
+}
+function loadGraph(graphPath, source = graphPath) {
+  const index = openGraphIndex(graphPath);
+  if (index) {
+    if (index.edgeCount >= INDEXED_READ_MIN_EDGES) return indexBackedGraph(index, source, graphPath);
+    index.close();
+  }
+  const fromTwin = loadSerializedFromTwin(graphPath);
+  const raw = fromTwin ?? fs6.readFileSync(graphPath, "utf-8");
+  const parsed = JSON.parse(raw);
+  let foreignAdapted = false;
+  let candidate = parsed;
+  if (looksForeign(parsed)) {
+    const adapted = adaptForeignGraph(parsed);
+    if (adapted !== null) {
+      candidate = adapted.graph;
+      foreignAdapted = true;
+    }
+  }
+  const v = validateGraph(candidate);
+  if (!v.ok) throw new Error(`invalid graph at ${graphPath}: ${v.errors.slice(0, 3).join("; ")}`);
+  const graph = candidate;
+  if (fromTwin === null && !foreignAdapted) {
+    emitSqliteTwin(graph, raw, graphPath);
+  }
+  const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+  const outM = /* @__PURE__ */ new Map();
+  const inM = /* @__PURE__ */ new Map();
+  const add = (m, k, e) => {
+    const arr = m.get(k);
+    if (arr) arr.push(e);
+    else m.set(k, [e]);
+  };
+  for (const e of graph.edges) {
+    add(outM, e.source, e);
+    add(inM, e.target, e);
   }
-  const untrackedLines = untracked.reduce(
-    (sum, relPath) => sum + untrackedFileLineCount(cwd, relPath),
-    0
-  );
-  return { lines: trackedLines + untrackedLines, measure: "exact" };
+  const lex = new LexicalIndex(graph.nodes.map((n) => ({ id: n.id, text: `${n.label} ${n.id}` })));
+  return {
+    graph,
+    source,
+    answeredBy: graphPath,
+    byId,
+    out: outM,
+    in: inM,
+    idsByLabel: (labelText, limit) => graph.nodes.filter((n) => n.label === labelText).slice(0, limit).map((n) => n.id),
+    idsInFiles: (files) => {
+      const set = new Set(files);
+      return graph.nodes.filter((n) => set.has(n.source_file) && n.kind !== "file").map((n) => n.id);
+    },
+    allNodeIds: () => graph.nodes.map((n) => n.id).sort((a, b) => a < b ? -1 : a > b ? 1 : 0),
+    lex: () => lex,
+    close: () => {
+    }
+  };
 }
-function isObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
+function resolveSeedsTiered(g, seed, limit = 5) {
+  if (g.byId.has(seed)) return { ids: [seed], weak: false };
+  const exactLabel = g.idsByLabel(seed, limit);
+  if (exactLabel.length) return { ids: exactLabel, weak: false };
+  const ranked = g.lex().rank(tokenize(seed)).filter((r) => r.score > 0);
+  return { ids: ranked.slice(0, limit).map((r) => r.id), weak: true };
 }
-function str(v) {
-  return typeof v === "string" ? v : "";
+function resolveSeeds(g, seed, limit = 5) {
+  return resolveSeedsTiered(g, seed, limit).ids;
 }
-var DISPATCH_TOOL_RE = /^(agent|task)$/i;
-var REVIEW_SHAPED_LABEL_RE = /\b(review|judge|adversarial|critique|second[- ]opinion|blind\s+(pass|review)|cross-model)\b/i;
-var REVIEW_SHAPED_PROMPT_RE = /\b(code\s+review|neutral\s+review|adversarial|judge|critique|second[- ]opinion|blind\s+(pass|review)|cross-model)\b/i;
-var REVIEW_SKILL_NAME_RE = /^(review[-:]changes|judge[-:][a-z0-9-]+|adversarial-review|code-review)$/i;
-function scanTranscriptForReviewer(transcriptText) {
-  for (const raw of transcriptText.split("\n")) {
-    const line = raw.trim();
-    if (!line) continue;
-    let obj;
-    try {
-      obj = JSON.parse(line);
-    } catch {
+
+// src/scripts/code_graph/verbs.ts
+import * as path5 from "node:path";
+function isAcceptedEdge(e) {
+  return isStatedResolution(e.resolved_via);
+}
+function foreignRefusal(g) {
+  const edges = g.graph?.edges ?? [];
+  if (edges.length === 0) return null;
+  if (!edges.every((e) => e.resolved_via === "foreign")) return null;
+  return 'every edge in this graph was read from a file this package did not build, so all of them are guesses and none is gate-grade. A gate verb would accept no edge and report an empty answer, which reads as "nothing found" rather than "nothing trusted". Build a native graph (`agent-config graph build`) to use this verb, or use `query` and `explain`, which answer from foreign edges and say so.';
+}
+function viaHistogram(edges) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const e of edges) counts.set(e.resolved_via, (counts.get(e.resolved_via) ?? 0) + 1);
+  if (counts.size === 0) return "(none)";
+  return [...counts.entries()].sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1)).map(([via, n]) => `${via} ${n}`).join(" \xB7 ");
+}
+function readFor(g, id) {
+  const n = g.byId.get(id);
+  if (!n) return null;
+  const loc = n.source_location;
+  return { path: n.source_file, lines: loc.length >= 3 ? [loc[0], loc[2]] : null };
+}
+function dedupeReads(reads) {
+  const m = /* @__PURE__ */ new Map();
+  for (const r of reads) {
+    if (!r) continue;
+    m.set(r.lines ? `${r.path}:${r.lines[0]}-${r.lines[1]}` : r.path, r);
+  }
+  return [...m.values()];
+}
+function seedsForFiles(g, files) {
+  const symbols = g.idsInFiles(files);
+  const seeds = new Set(symbols);
+  const unresolved = [];
+  const notIndexed = [];
+  for (const f of files) {
+    if (g.byId.has(f)) {
+      seeds.add(f);
       continue;
     }
-    if (!isObject(obj) || obj["type"] !== "assistant") continue;
-    const msg = obj["message"];
-    if (!isObject(msg)) continue;
-    const content = msg["content"];
-    if (!Array.isArray(content)) continue;
-    for (const blk of content) {
-      if (!isObject(blk) || blk["type"] !== "tool_use") continue;
-      const name = str(blk["name"]);
-      const input = blk["input"];
-      const inputObj = isObject(input) ? input : {};
-      if (DISPATCH_TOOL_RE.test(name)) {
-        const label = [
-          str(inputObj["description"]),
-          str(inputObj["subagent_type"])
-        ].filter(Boolean).join(" ");
-        if (REVIEW_SHAPED_LABEL_RE.test(label)) return true;
-        const prompt = str(inputObj["prompt"]);
-        if (REVIEW_SHAPED_PROMPT_RE.test(prompt)) return true;
-        continue;
-      }
-      if (/^skill$/i.test(name)) {
-        const skillName = str(inputObj["skill"]) || str(inputObj["name"]) || str(inputObj["command"]);
-        if (REVIEW_SKILL_NAME_RE.test(skillName)) return true;
+    if (symbols.some((s) => s.startsWith(`${f}#`))) continue;
+    if (EXT_LANG[path5.extname(f).toLowerCase()] === void 0) notIndexed.push(f);
+    else unresolved.push(f);
+  }
+  return {
+    seeds: [...seeds].sort(),
+    unresolved: unresolved.sort(),
+    not_indexed: notIndexed.sort()
+  };
+}
+function testsFor(g, symbol, state) {
+  const seeds = resolveSeeds(g, symbol);
+  const targets = new Set(seeds);
+  for (const s of seeds) {
+    const f = g.byId.get(s)?.source_file;
+    if (f && g.byId.has(f)) targets.add(f);
+  }
+  const accepted = [];
+  const rejected = [];
+  const tests = /* @__PURE__ */ new Set();
+  for (const t of targets) {
+    for (const e of g.in.get(t) ?? []) {
+      if (e.relation !== "tests") continue;
+      if (!isAcceptedEdge(e)) {
+        rejected.push(e);
         continue;
       }
-      if (REVIEW_SKILL_NAME_RE.test(name)) return true;
+      accepted.push(e);
+      tests.add(e.source);
     }
   }
-  return false;
+  const list = [...tests].sort();
+  return {
+    source: g.source,
+    state,
+    accepted_via: viaHistogram(accepted),
+    rejected_via: viaHistogram(rejected),
+    seeds,
+    tests: list,
+    accepted_edges: accepted,
+    rejected_edges: rejected,
+    lines: list,
+    recommended_reads: dedupeReads(list.map((t) => readFor(g, t)))
+  };
 }
-function buildAdvisoryLine(diffLines) {
-  return `this session mutated ${diffLines} lines without a neutral review; spawn a cross-model reviewer before claiming done (delegation-policy / verify-budget)`;
+function untested(g, files, state) {
+  const foreign = foreignRefusal(g);
+  if (foreign !== null) {
+    return {
+      source: g.source,
+      state,
+      accepted_via: "(none)",
+      rejected_via: "(none)",
+      refusal: foreign,
+      refusal_reason: "foreign-edges-not-accepted",
+      seeds: [],
+      unresolved_files: [],
+      not_indexed_files: [],
+      untested: [],
+      tested: [],
+      lines: [],
+      recommended_reads: []
+    };
+  }
+  const { seeds, unresolved, not_indexed } = seedsForFiles(g, files);
+  const accepted = [];
+  const rejected = [];
+  const tested = [];
+  const bare = [];
+  for (const s of seeds) {
+    if (g.byId.get(s)?.kind === "file") continue;
+    const r = testsFor(g, s, state);
+    accepted.push(...r.accepted_edges);
+    rejected.push(...r.rejected_edges);
+    if (r.tests.length) tested.push(s);
+    else bare.push(s);
+  }
+  return {
+    source: g.source,
+    state,
+    accepted_via: viaHistogram(accepted),
+    rejected_via: viaHistogram(rejected),
+    refusal: null,
+    refusal_reason: null,
+    seeds,
+    unresolved_files: unresolved,
+    not_indexed_files: not_indexed,
+    untested: bare.sort(),
+    tested: tested.sort(),
+    lines: bare.sort(),
+    recommended_reads: dedupeReads(bare.map((b) => readFor(g, b)))
+  };
 }
-function appendReviewSkippedTelemetry(workspaceRoot, diffLines, mutationMeasure, baseline) {
-  if (is_replay_mode()) return;
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  const { line, errors } = buildReviewSkippedLine({
-    diff_lines: diffLines,
-    mutation_measure: mutationMeasure,
-    ts,
-    id: crypto.randomUUID(),
-    baseline
-  });
-  if (errors.length || line === null) return;
+
+// src/scripts/_lib/graph_feeder_record.ts
+var MAX_PATHS = 5;
+var MAX_ROWS_PER_SESSION = 200;
+function feederFile(workspaceRoot, sessionKey) {
+  return path6.join(workspaceRoot, "agents", "state", "graph-feeder", `${sessionKey}.jsonl`);
+}
+function graphUntestedVerdict(root, state, paths) {
+  const none = { verdict: null, untested: 0, tested: 0 };
+  if (state !== "fresh" && state !== "edited") return none;
+  if (paths.length === 0) return none;
+  let picked;
   try {
-    const dir = path5.join(workspaceRoot, "agents", "runtime", "state", "audit");
-    fs5.mkdirSync(dir, { recursive: true });
-    const file = path5.join(dir, `${ts.slice(0, 7)}.jsonl`);
-    fs5.appendFileSync(file, `${JSON.stringify(line)}
-`, "utf8");
+    picked = pickSource(detectSources(root, path6.join(root, NATIVE_CACHE_REL)));
   } catch {
+    return none;
   }
-}
-function sessionStateDir(workspaceRoot) {
-  return path5.join(workspaceRoot, "agents", "runtime", "state", "end-review-nudge");
-}
-function sessionStateFile(workspaceRoot, sessionKey) {
-  return path5.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
-}
-function deriveSessionKey2(envelope, payload) {
-  const raw = str(envelope["session_id"]) || str(payload["transcript_path"] ?? payload["transcriptPath"]);
-  const material = raw || "unknown-session";
-  return crypto.createHash("sha256").update(material).digest("hex");
-}
-function hasFiredThisSession(workspaceRoot, sessionKey) {
+  if (!picked || picked.kind === "scip") return none;
+  let g;
   try {
-    return fs5.existsSync(sessionStateFile(workspaceRoot, sessionKey));
+    g = loadGraph(picked.path, `${picked.kind}:${path6.relative(root, picked.path)}`);
   } catch {
-    return false;
+    return none;
   }
-}
-function markFiredThisSession(workspaceRoot, sessionKey, ts) {
   try {
-    atomic_write_json(sessionStateFile(workspaceRoot, sessionKey), { fired_at: ts });
+    const r = untested(g, paths, state);
+    if (r.seeds.length === 0) return { verdict: "no-seeds", untested: 0, tested: 0 };
+    return {
+      verdict: r.untested.length > 0 ? "untested" : "tested",
+      untested: r.untested.length,
+      tested: r.tested.length
+    };
   } catch {
+    return none;
+  } finally {
+    try {
+      g.close();
+    } catch {
+    }
   }
 }
-function _read_stdin() {
-  return readHookStdin();
-}
-var FALLBACK_TO_TELEMETRY = {
-  absent: "absent",
-  unreadable: "unreadable",
-  "head-moved": "head_moved",
-  "mixed-measure": "mixed_measure"
-};
-function main4() {
-  const [envelope, payload] = unwrap(_read_stdin(), "claude");
-  const event = String(envelope["event"] ?? "");
-  if (event !== "" && event !== "stop") {
-    return 0;
-  }
-  const workspace_root = String(envelope["workspace_root"] ?? "").trim() || process.cwd();
-  let measuredLines;
-  let mutationMeasure;
+function appendFeederRow(workspaceRoot, sessionKey, row) {
   try {
-    const measured = totalNonDocMutatedLinesWithMeasure(workspace_root);
-    measuredLines = measured.lines;
-    mutationMeasure = measured.measure;
+    const file = feederFile(workspaceRoot, sessionKey);
+    let existing = 0;
+    try {
+      existing = fs7.readFileSync(file, "utf-8").split("\n").filter((l) => l.trim() !== "").length;
+    } catch {
+    }
+    if (existing >= MAX_ROWS_PER_SESSION) return;
+    fs7.mkdirSync(path6.dirname(file), { recursive: true });
+    fs7.appendFileSync(file, `${JSON.stringify(row)}
+`);
   } catch {
-    return 0;
-  }
-  const sessionKey = deriveSessionKey2(envelope, payload);
-  const baselineOutcome = applyBaseline(
-    measuredLines,
-    readBaseline(workspace_root, sessionKey),
-    // A THUNK, not a value: on the `absent` and `unreadable` branches the
-    // result is discarded, and those two are the steady state on every host
-    // without this nudge and on every session before its first baseline
-    // write. Passing the value eagerly spent an 11-14 ms `git rev-parse` on
-    // each of those stops for nothing.
-    () => currentHeadSha(workspace_root),
-    mutationMeasure
-  );
-  const diffLines = baselineOutcome.lines;
-  const baselineApplication = baselineOutcome.applied ? "applied" : FALLBACK_TO_TELEMETRY[baselineOutcome.fallback];
-  if (diffLines <= MUTATION_LINE_THRESHOLD) {
-    return 0;
   }
-  if (hasFiredThisSession(workspace_root, sessionKey)) {
-    return 0;
-  }
-  const transcriptPath = str(
-    payload["transcript_path"] ?? payload["transcriptPath"]
-  ).trim();
-  let reviewerRan = false;
-  if (transcriptPath && isSafeTranscriptPath(transcriptPath)) {
-    try {
-      reviewerRan = scanTranscriptForReviewer(fs5.readFileSync(transcriptPath, "utf-8"));
-    } catch {
-      reviewerRan = false;
-    }
-  }
-  if (reviewerRan) {
-    return 0;
-  }
-  markFiredThisSession(workspace_root, sessionKey, (/* @__PURE__ */ new Date()).toISOString());
-  try {
-    appendReviewSkippedTelemetry(
-      workspace_root,
-      diffLines,
-      mutationMeasure,
-      baselineApplication
-    );
-  } catch {
-  }
-  process.stdout.write(
-    `${JSON.stringify({
-      decision: "warn",
-      reason: `end-review-nudge: session mutated ${diffLines} non-doc lines without a neutral review`,
-      additional_context: buildAdvisoryLine(diffLines)
-    })}
-`
-  );
-  return EXIT_WARN2;
 }
-function _isCliEntry4() {
-  if (true) {
-    return false;
-  }
-  if (process.argv[1] === void 0) {
+function buildFeederRow(input) {
+  return {
+    at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+    turn: input.turn,
+    layer: input.layer,
+    graph_state: input.state,
+    f: input.fFired,
+    f_mode: input.fMode,
+    graph: input.graph.verdict,
+    graph_untested: input.graph.untested,
+    graph_tested: input.graph.tested,
+    paths: input.paths.slice(0, MAX_PATHS).map((p) => p),
+    path_count: input.paths.length
+  };
+}
+
+// src/scripts/hooks/envelope.ts
+var ENVELOPE_KEYS = [
+  "schema_version",
+  "platform",
+  "event",
+  "payload"
+];
+function _isObject4(obj) {
+  return typeof obj === "object" && obj !== null && !Array.isArray(obj);
+}
+function looks_like_envelope(obj) {
+  if (!_isObject4(obj)) {
     return false;
   }
-  const argvUrl = pathToFileURL4(path5.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) {
-    return true;
+  return ENVELOPE_KEYS.every((key) => key in obj);
+}
+function unwrap(stdin_text, default_platform = "generic") {
+  const text = (stdin_text ?? "").trim();
+  if (!text) {
+    return [{}, {}, default_platform];
   }
+  let decoded;
   try {
-    const here = fs5.realpathSync(fileURLToPath4(import.meta.url));
-    const argv = fs5.realpathSync(path5.resolve(process.argv[1]));
-    return here === argv;
+    decoded = JSON.parse(text);
   } catch {
-    return false;
+    return [{}, {}, default_platform];
   }
-}
-if (_isCliEntry4()) {
-  process.exit(main4());
+  if (looks_like_envelope(decoded)) {
+    const env = decoded;
+    let payload2 = env["payload"];
+    if (!payload2 || !_isObject4(payload2)) {
+      payload2 = {};
+    }
+    const platRaw = env["platform"];
+    const platform = String(platRaw || default_platform);
+    return [env, payload2, platform];
+  }
+  const payload = _isObject4(decoded) ? decoded : {};
+  return [
+    {
+      schema_version: 1,
+      platform: default_platform,
+      event: "",
+      native_event: "",
+      session_id: "",
+      workspace_root: "",
+      payload,
+      settings: {}
+    },
+    payload,
+    default_platform
+  ];
 }
 
 // src/scripts/hooks/subagent_ledger_hook.ts
-import * as crypto2 from "node:crypto";
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
-import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
+import * as crypto from "node:crypto";
+import * as fs8 from "node:fs";
+import * as path7 from "node:path";
+import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
 
 // src/scripts/_lib/subagent_response.ts
 var MAX_SUMMARY_CHARS = 2e3;
@@ -2918,22 +3367,57 @@ function validateResponse(input) {
   return { valid: errors.length === 0, errors };
 }
 
-// src/scripts/hooks/subagent_ledger_hook.ts
+// src/scripts/hooks/exit_codes.ts
 var EXIT_ALLOW3 = 0;
+var EXIT_BLOCK = 1;
+var EXIT_WARN2 = 2;
+var EXIT_ERROR = 3;
+var EXIT_CODES = Object.freeze([
+  Object.freeze({
+    code: EXIT_ALLOW3,
+    name: "allow",
+    meaning: "no objection; the dispatcher passes the call through",
+    owner: "every concern \u2014 the default verdict",
+    authorizedBy: "nothing; allowing needs no authority"
+  }),
+  Object.freeze({
+    code: EXIT_BLOCK,
+    name: "block",
+    meaning: "refuse the call; the dispatcher lowers this onto the host deny channel",
+    owner: "a concern declared `severity: blocking` in hook_manifest.yaml",
+    authorizedBy: "the manifest entry plus its row in the BLOCKING_ALLOWLIST of tests/hooks/concern_severity.test.ts \u2014 an advisory concern emitting this is downgraded to warn by dispatch_hook._is_advisory"
+  }),
+  Object.freeze({
+    code: EXIT_WARN2,
+    name: "warn",
+    meaning: "advisory; the dispatcher exits 0 and surfaces the reason",
+    owner: "any concern",
+    authorizedBy: "nothing; warning is the ceiling for an advisory concern and is always available to a blocking one"
+  }),
+  Object.freeze({
+    code: EXIT_ERROR,
+    name: "error",
+    meaning: "the concern crashed, timed out, or could not decide \u2014 any rc >= 3. The dispatcher resolves it by the concern`s declared severity, never by the number itself",
+    owner: "no concern emits this on purpose; the runtime does",
+    authorizedBy: "hook_manifest.yaml `severity` alone \u2014 blocking refuses, anything else fails open; `fail_closed` is no longer read on this branch. See docs/contracts/hook-architecture-v1.md \xA7 Exit-code semantics"
+  })
+]);
+
+// src/scripts/hooks/subagent_ledger_hook.ts
 function isObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-var LEDGER_DIR = path6.join("agents", "runtime", "state", "subagent-ledger");
+var LEDGER_DIR = path7.join("agents", "runtime", "state", "subagent-ledger");
 var OPEN_SUBDIR = "open";
 var OPEN_RECORD_TTL_MS = 24 * 60 * 60 * 1e3;
 function refFor(agentId) {
-  return crypto2.createHash("sha256").update(agentId, "utf8").digest("hex").slice(0, 12);
+  return crypto.createHash("sha256").update(agentId, "utf8").digest("hex").slice(0, 12);
 }
 function unwrapPayload(envelope) {
   const inner = envelope["payload"];
   return isObject2(inner) ? inner : envelope;
 }
-function str2(payload, ...keys) {
+function str(payload, ...keys) {
   for (const k of keys) {
     const v = payload[k];
     if (typeof v === "string" && v) return v;
@@ -2941,11 +3425,11 @@ function str2(payload, ...keys) {
   return null;
 }
 function extractParentId(payload, ownId) {
-  const explicit = str2(payload, "parent_agent_id", "parentAgentId");
+  const explicit = str(payload, "parent_agent_id", "parentAgentId");
   if (explicit) return explicit;
   const session = payload["session"];
   if (isObject2(session)) {
-    const sessionAgent = str2(session, "agent_id", "agentId");
+    const sessionAgent = str(session, "agent_id", "agentId");
     if (sessionAgent && sessionAgent !== ownId) return sessionAgent;
   }
   return null;
@@ -3013,10 +3497,10 @@ function _jsonObjectCandidates(message) {
   return out;
 }
 function openDir(root) {
-  return path6.join(root, LEDGER_DIR, OPEN_SUBDIR);
+  return path7.join(root, LEDGER_DIR, OPEN_SUBDIR);
 }
 function openFile(root, ref) {
-  return path6.join(openDir(root), `${ref}.json`);
+  return path7.join(openDir(root), `${ref}.json`);
 }
 var DEPTH_BASES = /* @__PURE__ */ new Set(["observed", "asserted-parent", "assumed-root"]);
 function _asOpenRecord(value, expectedRef) {
@@ -3043,7 +3527,7 @@ function readOpenRecords(root) {
   const out = /* @__PURE__ */ new Map();
   let names;
   try {
-    names = fs6.readdirSync(openDir(root));
+    names = fs8.readdirSync(openDir(root));
   } catch {
     return out;
   }
@@ -3051,7 +3535,7 @@ function readOpenRecords(root) {
     if (!name.endsWith(".json")) continue;
     const expectedRef = name.slice(0, -".json".length);
     try {
-      const raw = fs6.readFileSync(path6.join(openDir(root), name), "utf8");
+      const raw = fs8.readFileSync(path7.join(openDir(root), name), "utf8");
       const rec = _asOpenRecord(JSON.parse(raw), expectedRef);
       if (rec) out.set(rec.ref, rec);
     } catch {
@@ -3066,13 +3550,13 @@ function resolveDepth(parentRef, open) {
   return { depth: parent.depth + 1, depth_basis: "observed" };
 }
 function ledgerFileFor2(root, ts) {
-  return path6.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
+  return path7.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
 }
 function appendLedgerLine(root, ts, line) {
   if (is_replay_mode()) return;
   const file = ledgerFileFor2(root, ts);
-  fs6.mkdirSync(path6.dirname(file), { recursive: true });
-  fs6.appendFileSync(file, `${JSON.stringify(line)}
+  fs8.mkdirSync(path7.dirname(file), { recursive: true });
+  fs8.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");
 }
 var WALL_CLOCK_ARMS_MS = [
@@ -3086,7 +3570,7 @@ function armsExceeded(elapsedMs) {
   return WALL_CLOCK_ARMS_MS.filter((a) => elapsedMs >= a.ms).map((a) => a.label);
 }
 function openRecordStats(root, nowMs = Date.now()) {
-  const ledgerPresent = fs6.existsSync(path6.join(root, LEDGER_DIR));
+  const ledgerPresent = fs8.existsSync(path7.join(root, LEDGER_DIR));
   const open = readOpenRecords(root);
   let maxDepth = 0;
   let counted = 0;
@@ -3114,13 +3598,13 @@ function writeOpenRecord(root, rec) {
 function removeOpenRecord(root, ref) {
   if (is_replay_mode()) return;
   try {
-    fs6.unlinkSync(openFile(root, ref));
+    fs8.unlinkSync(openFile(root, ref));
   } catch {
   }
 }
 function countOpen(root) {
   try {
-    return fs6.readdirSync(openDir(root)).filter((n) => n.endsWith(".json")).length;
+    return fs8.readdirSync(openDir(root)).filter((n) => n.endsWith(".json")).length;
   } catch {
     return 0;
   }
@@ -3161,12 +3645,12 @@ function appendUnidentified(root, event, nowIso, payload) {
     unidentified: true,
     // The agent TYPE is an id-shaped enum and may still be present; it is
     // the only thing salvageable from a payload with no id.
-    agent_type: str2(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
+    agent_type: str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
     reason: "payload carried no agent id \u2014 nothing to correlate start with stop"
   });
 }
 function handleStart(root, payload, nowIso, sessionId) {
-  const agentId = str2(payload, "agent_id", "agentId");
+  const agentId = str(payload, "agent_id", "agentId");
   if (agentId === null) {
     appendUnidentified(root, "subagent_start", nowIso, payload);
     return;
@@ -3177,7 +3661,7 @@ function handleStart(root, payload, nowIso, sessionId) {
   const { depth, depth_basis } = resolveDepth(parentRef, readOpenRecords(root));
   const rec = {
     ref,
-    agent_type: str2(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
+    agent_type: str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
     started_at: nowIso,
     parent_ref: parentRef,
     depth,
@@ -3204,7 +3688,7 @@ function handleStart(root, payload, nowIso, sessionId) {
   });
 }
 function handleStop(root, payload, nowIso, sessionId) {
-  const agentId = str2(payload, "agent_id", "agentId");
+  const agentId = str(payload, "agent_id", "agentId");
   if (agentId === null) {
     appendUnidentified(root, "subagent_stop", nowIso, payload);
     return;
@@ -3216,7 +3700,7 @@ function handleStop(root, payload, nowIso, sessionId) {
     const started = Date.parse(rec.started_at);
     if (Number.isFinite(started)) durationMs = Math.max(0, Date.parse(nowIso) - started);
   }
-  const parse2 = classifyEnvelope(str2(payload, "last_assistant_message", "lastAssistantMessage"));
+  const parse2 = classifyEnvelope(str(payload, "last_assistant_message", "lastAssistantMessage"));
   removeOpenRecord(root, ref);
   appendLedgerLine(root, nowIso, {
     event: "subagent_stop",
@@ -3227,7 +3711,7 @@ function handleStop(root, payload, nowIso, sessionId) {
     // relabel a cross-session stop as belonging to the dispatching session
     // and hide exactly the mismatch this field exists to expose.
     session_id: sessionId,
-    agent_type: rec?.agent_type ?? str2(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
+    agent_type: rec?.agent_type ?? str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
     depth: rec?.depth ?? null,
     depth_basis: rec?.depth_basis ?? null,
     // `null` = the matching start was never seen. That is a finding about
@@ -3252,7 +3736,7 @@ function processEnvelope(envelope, consumerRoot) {
     if (event !== "subagent_start" && event !== "subagent_stop") return EXIT_ALLOW3;
     const payload = unwrapPayload(envelope);
     const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-    const sessionId = str2(payload, "session_id", "sessionId") ?? str2(envelope, "session_id", "sessionId");
+    const sessionId = str(payload, "session_id", "sessionId") ?? str(envelope, "session_id", "sessionId");
     reapStaleOpenRecords(consumerRoot, nowIso);
     if (event === "subagent_start") handleStart(consumerRoot, payload, nowIso, sessionId);
     else handleStop(consumerRoot, payload, nowIso, sessionId);
@@ -3263,42 +3747,599 @@ function processEnvelope(envelope, consumerRoot) {
 }
 function resolveConsumerRoot(envelope) {
   if (isObject2(envelope)) {
-    const pr = str2(envelope, "workspace_root", "project_root");
+    const pr = str(envelope, "workspace_root", "project_root");
     if (pr) return pr;
     const payload = unwrapPayload(envelope);
-    const cwd = str2(payload, "cwd");
+    const cwd = str(payload, "cwd");
     if (cwd) return cwd;
   }
-  return process.cwd();
+  return process.cwd();
+}
+function main4() {
+  const raw = readHookStdin();
+  let envelope = {};
+  try {
+    envelope = raw.trim() ? JSON.parse(raw) : {};
+  } catch {
+    return EXIT_ALLOW3;
+  }
+  return processEnvelope(envelope, resolveConsumerRoot(envelope));
+}
+function _isCliEntry4() {
+  if (true) {
+    return false;
+  }
+  if (process.argv[1] === void 0) return false;
+  const argvUrl = pathToFileURL4(path7.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) return true;
+  try {
+    return fs8.realpathSync(fileURLToPath4(import.meta.url)) === fs8.realpathSync(path7.resolve(process.argv[1]));
+  } catch {
+    return false;
+  }
+}
+if (_isCliEntry4()) process.exit(main4());
+
+// src/scripts/_lib/turn_end_transcript.ts
+import * as fs11 from "node:fs";
+
+// src/scripts/hooks/end_review_nudge_hook.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import * as crypto2 from "node:crypto";
+import * as fs10 from "node:fs";
+import * as os from "node:os";
+import * as path9 from "node:path";
+import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
+
+// src/scripts/_lib/review_baseline.ts
+import { spawnSync } from "node:child_process";
+import * as fs9 from "node:fs";
+import * as path8 from "node:path";
+function currentHeadSha(cwd) {
+  try {
+    const r = spawnSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" });
+    if (r.status !== 0) return null;
+    const out = (r.stdout ?? "").trim();
+    return out === "" ? null : out;
+  } catch {
+    return null;
+  }
+}
+var BASELINE_STATE_REL = path8.join("agents", "runtime", "state", "review-baseline");
+function baselineStateDir(workspaceRoot) {
+  return path8.join(workspaceRoot, BASELINE_STATE_REL);
+}
+function baselineStateFile(workspaceRoot, sessionKey) {
+  return path8.join(baselineStateDir(workspaceRoot), `${sessionKey}.json`);
+}
+function parseBaseline(raw) {
+  let decoded;
+  try {
+    decoded = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return null;
+  const o = decoded;
+  const lines = o["baseline_lines"];
+  if (typeof lines !== "number" || !Number.isFinite(lines) || lines < 0) return null;
+  const written = o["written_at"];
+  if (typeof written !== "string") return null;
+  const head = o["head_sha"];
+  const measure = o["measure"];
+  return {
+    head_sha: typeof head === "string" && head !== "" ? head : null,
+    baseline_lines: lines,
+    ...measure === "exact" || measure === "capped_approximation" ? { measure } : {},
+    written_at: written
+  };
+}
+function readBaseline(workspaceRoot, sessionKey) {
+  const file = baselineStateFile(workspaceRoot, sessionKey);
+  let raw;
+  try {
+    raw = fs9.readFileSync(file, "utf-8");
+  } catch (exc) {
+    const code = exc?.code;
+    return code === "ENOENT" ? "absent" : "unreadable";
+  }
+  return parseBaseline(raw) ?? "unreadable";
+}
+function applyBaseline(measuredLines, baseline, headSha, measuredMeasure = "exact") {
+  if (baseline === "absent" || baseline === "unreadable") {
+    return { applied: false, fallback: baseline, lines: measuredLines };
+  }
+  if (baseline.measure !== "exact" || measuredMeasure !== "exact") {
+    return { applied: false, fallback: "mixed-measure", lines: measuredLines };
+  }
+  if (baseline.head_sha !== headSha()) {
+    return { applied: false, fallback: "head-moved", lines: measuredLines };
+  }
+  return {
+    applied: true,
+    baseline,
+    lines: Math.max(0, measuredLines - baseline.baseline_lines)
+  };
+}
+
+// src/scripts/_lib/audit_field_provenance.ts
+var MAX_APPLIED_IDS = 32;
+function appliedIds(values) {
+  const out = [];
+  for (const raw of values ?? []) {
+    const v = String(raw).trim();
+    if (v === "" || out.includes(v)) continue;
+    out.push(v);
+    if (out.length >= MAX_APPLIED_IDS) break;
+  }
+  return out;
+}
+
+// src/scripts/_lib/review_skipped_record.ts
+var BASELINE_APPLICATIONS = [
+  "applied",
+  "absent",
+  "unreadable",
+  "head_moved",
+  "mixed_measure"
+];
+var PRODUCER_PRIVACY_CLASS = "ids-only";
+function isNonNegInt(n) {
+  return typeof n === "number" && Number.isFinite(n) && Number.isInteger(n) && n >= 0;
+}
+var HIGH_RISK_DIFF_LINES = 200;
+function buildReviewSkippedLine(input) {
+  const errors = [];
+  if (!isNonNegInt(input.diff_lines)) {
+    errors.push("diff_lines must be a non-negative integer");
+  }
+  if (input.mutation_measure !== "exact" && input.mutation_measure !== "capped_approximation") {
+    errors.push('mutation_measure must be "exact" or "capped_approximation"');
+  }
+  if (!input.ts) errors.push("ts (ISO-8601 UTC) is required");
+  if (!input.id) errors.push("id (ULID, UUID, or content hash) is required");
+  if (input.baseline !== void 0 && !BASELINE_APPLICATIONS.includes(input.baseline)) {
+    errors.push(`baseline must be one of ${BASELINE_APPLICATIONS.join(", ")}`);
+  }
+  if (errors.length) return { line: null, errors };
+  const line = {
+    schema_version: 1,
+    id: input.id,
+    ts: input.ts,
+    work_id: input.work_id ?? `review-skipped-${input.ts}`,
+    phase: "report",
+    outcome: "skipped",
+    confidence_band: "medium",
+    risk_class: input.diff_lines >= HIGH_RISK_DIFF_LINES ? "high" : "medium",
+    memory: { asks: 0, hits: 0 },
+    verify: { claims: 0, first_try_passes: 0 },
+    // COMPUTED, never a producer constant.
+    rules_applied: appliedIds(input.rules_applied),
+    // MANDATORY on every audit line, same as the orchestration producer.
+    privacy_class: PRODUCER_PRIVACY_CLASS,
+    // `skills_applied` is OMITTED here, deliberately and not by oversight.
+    // audit-log-v1 distinguishes an absent key ("not recorded") from `[]`
+    // ("recorded, none applied"), and this writer observes a review that
+    // did not happen -- it has no skill observation to offer in either
+    // direction. Emitting `[]` would assert "no skills applied" on evidence
+    // this producer never gathered, which is the exact fabrication the
+    // absent/empty split exists to make impossible.
+    persona: null,
+    input_kind: "prompt",
+    type: "note",
+    review_skipped: {
+      diff_lines: input.diff_lines,
+      mutation_measure: input.mutation_measure,
+      // Omitted, not defaulted, when the producer recorded nothing —
+      // audit-log-v1's absent-versus-present split is the same one
+      // `skills_applied` uses above, for the same reason.
+      ...input.baseline === void 0 ? {} : { baseline: input.baseline }
+    }
+  };
+  return { line, errors: [] };
+}
+
+// src/scripts/hooks/end_review_nudge_hook.ts
+var MUTATION_LINE_THRESHOLD = 50;
+var UNTRACKED_FILE_CAP = 20;
+var TRANSCRIPT_SCAN_MAX_BYTES = 50 * 1024 * 1024;
+function isSafeTranscriptPath(rawPath, opts = {}) {
+  if (!rawPath || !/\.jsonl$/i.test(rawPath)) return false;
+  const homeDir = opts.homeDir ?? os.homedir();
+  const maxBytes = opts.maxBytes ?? TRANSCRIPT_SCAN_MAX_BYTES;
+  try {
+    const realHome = fs10.realpathSync(homeDir);
+    const realPath = fs10.realpathSync(rawPath);
+    const relative5 = path9.relative(realHome, realPath);
+    if (relative5 === "" || relative5.startsWith("..") || path9.isAbsolute(relative5)) {
+      return false;
+    }
+    const { size } = fs10.statSync(realPath);
+    return size <= maxBytes;
+  } catch {
+    return false;
+  }
+}
+function parseNumstat(raw) {
+  const rows = [];
+  for (const line of raw.split("\n")) {
+    const m = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
+    if (!m) continue;
+    const addedStr = m[1];
+    const deletedStr = m[2];
+    rows.push({
+      added: addedStr === "-" ? 0 : Number(addedStr),
+      deleted: deletedStr === "-" ? 0 : Number(deletedStr),
+      path: m[3]
+    });
+  }
+  return rows;
+}
+var DOC_PATH_RE = /\.md$/i;
+function isDocPath(p) {
+  return DOC_PATH_RE.test(p);
+}
+function nonDocMutatedLines(rows) {
+  return rows.filter((r) => !isDocPath(r.path)).reduce((sum, r) => sum + r.added + r.deleted, 0);
+}
+function gitNumstatRows(cwd) {
+  try {
+    const r = spawnSync2("git", ["diff", "--numstat", "HEAD"], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024
+    });
+    if (r.status !== 0) return [];
+    return parseNumstat(r.stdout ?? "");
+  } catch {
+    return [];
+  }
+}
+function untrackedNonDocFiles(cwd) {
+  try {
+    const r = spawnSync2("git", ["ls-files", "--others", "--exclude-standard"], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024
+    });
+    if (r.status !== 0) return [];
+    return (r.stdout ?? "").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !isDocPath(l));
+  } catch {
+    return [];
+  }
+}
+var BINARY_PROBE_BYTES = 8e3;
+var UNTRACKED_FILE_READ_CAP_BYTES = 8 * 1024 * 1024;
+function untrackedFileLineCount(cwd, relPath) {
+  try {
+    const abs = path9.resolve(cwd, relPath);
+    const size = fs10.statSync(abs).size;
+    if (size === 0) return 0;
+    if (size > UNTRACKED_FILE_READ_CAP_BYTES) {
+      return MUTATION_LINE_THRESHOLD + 1;
+    }
+    const buf = fs10.readFileSync(abs);
+    if (buf.length === 0) return 0;
+    const probe = buf.subarray(0, Math.min(buf.length, BINARY_PROBE_BYTES));
+    if (probe.includes(0)) return 0;
+    let lines = 0;
+    for (const byte of buf) {
+      if (byte === 10) lines += 1;
+    }
+    if (buf[buf.length - 1] !== 10) lines += 1;
+    return lines;
+  } catch {
+    return 0;
+  }
+}
+function totalNonDocMutatedLinesWithMeasure(cwd) {
+  const trackedLines = nonDocMutatedLines(gitNumstatRows(cwd));
+  const untracked = untrackedNonDocFiles(cwd);
+  if (untracked.length > UNTRACKED_FILE_CAP) {
+    return { lines: MUTATION_LINE_THRESHOLD + 1 + trackedLines, measure: "capped_approximation" };
+  }
+  const untrackedLines = untracked.reduce(
+    (sum, relPath) => sum + untrackedFileLineCount(cwd, relPath),
+    0
+  );
+  return { lines: trackedLines + untrackedLines, measure: "exact" };
+}
+function isObject3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function str2(v) {
+  return typeof v === "string" ? v : "";
+}
+var DISPATCH_TOOL_RE = /^(agent|task)$/i;
+var REVIEW_SHAPED_LABEL_RE = /\b(review|judge|adversarial|critique|second[- ]opinion|blind\s+(pass|review)|cross-model)\b/i;
+var REVIEW_SHAPED_PROMPT_RE = /\b(code\s+review|neutral\s+review|adversarial|judge|critique|second[- ]opinion|blind\s+(pass|review)|cross-model)\b/i;
+var REVIEW_SKILL_NAME_RE = /^(review[-:]changes|judge[-:][a-z0-9-]+|adversarial-review|code-review)$/i;
+function scanTranscriptForReviewer(transcriptText) {
+  for (const raw of transcriptText.split("\n")) {
+    const line = raw.trim();
+    if (!line) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!isObject3(obj) || obj["type"] !== "assistant") continue;
+    const msg = obj["message"];
+    if (!isObject3(msg)) continue;
+    const content = msg["content"];
+    if (!Array.isArray(content)) continue;
+    for (const blk of content) {
+      if (!isObject3(blk) || blk["type"] !== "tool_use") continue;
+      const name = str2(blk["name"]);
+      const input = blk["input"];
+      const inputObj = isObject3(input) ? input : {};
+      if (DISPATCH_TOOL_RE.test(name)) {
+        const label = [
+          str2(inputObj["description"]),
+          str2(inputObj["subagent_type"])
+        ].filter(Boolean).join(" ");
+        if (REVIEW_SHAPED_LABEL_RE.test(label)) return true;
+        const prompt = str2(inputObj["prompt"]);
+        if (REVIEW_SHAPED_PROMPT_RE.test(prompt)) return true;
+        continue;
+      }
+      if (/^skill$/i.test(name)) {
+        const skillName = str2(inputObj["skill"]) || str2(inputObj["name"]) || str2(inputObj["command"]);
+        if (REVIEW_SKILL_NAME_RE.test(skillName)) return true;
+        continue;
+      }
+      if (REVIEW_SKILL_NAME_RE.test(name)) return true;
+    }
+  }
+  return false;
+}
+function buildAdvisoryLine(diffLines) {
+  return `this session mutated ${diffLines} lines without a neutral review; spawn a cross-model reviewer before claiming done (delegation-policy / verify-budget)`;
+}
+function appendReviewSkippedTelemetry(workspaceRoot, diffLines, mutationMeasure, baseline) {
+  if (is_replay_mode()) return;
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const { line, errors } = buildReviewSkippedLine({
+    diff_lines: diffLines,
+    mutation_measure: mutationMeasure,
+    ts,
+    id: crypto2.randomUUID(),
+    baseline
+  });
+  if (errors.length || line === null) return;
+  try {
+    const dir = path9.join(workspaceRoot, "agents", "runtime", "state", "audit");
+    fs10.mkdirSync(dir, { recursive: true });
+    const file = path9.join(dir, `${ts.slice(0, 7)}.jsonl`);
+    fs10.appendFileSync(file, `${JSON.stringify(line)}
+`, "utf8");
+  } catch {
+  }
+}
+function sessionStateDir(workspaceRoot) {
+  return path9.join(workspaceRoot, "agents", "runtime", "state", "end-review-nudge");
+}
+function sessionStateFile(workspaceRoot, sessionKey) {
+  return path9.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
+}
+function deriveSessionKey2(envelope, payload) {
+  const raw = str2(envelope["session_id"]) || str2(payload["transcript_path"] ?? payload["transcriptPath"]);
+  const material = raw || "unknown-session";
+  return crypto2.createHash("sha256").update(material).digest("hex");
+}
+function hasFiredThisSession(workspaceRoot, sessionKey) {
+  try {
+    return fs10.existsSync(sessionStateFile(workspaceRoot, sessionKey));
+  } catch {
+    return false;
+  }
+}
+function markFiredThisSession(workspaceRoot, sessionKey, ts) {
+  try {
+    atomic_write_json(sessionStateFile(workspaceRoot, sessionKey), { fired_at: ts });
+  } catch {
+  }
+}
+function _read_stdin() {
+  return readHookStdin();
+}
+var FALLBACK_TO_TELEMETRY = {
+  absent: "absent",
+  unreadable: "unreadable",
+  "head-moved": "head_moved",
+  "mixed-measure": "mixed_measure"
+};
+function main5() {
+  const [envelope, payload] = unwrap(_read_stdin(), "claude");
+  const event = String(envelope["event"] ?? "");
+  if (event !== "" && event !== "stop") {
+    return 0;
+  }
+  const workspace_root = String(envelope["workspace_root"] ?? "").trim() || process.cwd();
+  let measuredLines;
+  let mutationMeasure;
+  try {
+    const measured = totalNonDocMutatedLinesWithMeasure(workspace_root);
+    measuredLines = measured.lines;
+    mutationMeasure = measured.measure;
+  } catch {
+    return 0;
+  }
+  const sessionKey = deriveSessionKey2(envelope, payload);
+  const baselineOutcome = applyBaseline(
+    measuredLines,
+    readBaseline(workspace_root, sessionKey),
+    // A THUNK, not a value: on the `absent` and `unreadable` branches the
+    // result is discarded, and those two are the steady state on every host
+    // without this nudge and on every session before its first baseline
+    // write. Passing the value eagerly spent an 11-14 ms `git rev-parse` on
+    // each of those stops for nothing.
+    () => currentHeadSha(workspace_root),
+    mutationMeasure
+  );
+  const diffLines = baselineOutcome.lines;
+  const baselineApplication = baselineOutcome.applied ? "applied" : FALLBACK_TO_TELEMETRY[baselineOutcome.fallback];
+  if (diffLines <= MUTATION_LINE_THRESHOLD) {
+    return 0;
+  }
+  if (hasFiredThisSession(workspace_root, sessionKey)) {
+    return 0;
+  }
+  const transcriptPath = str2(
+    payload["transcript_path"] ?? payload["transcriptPath"]
+  ).trim();
+  let reviewerRan = false;
+  if (transcriptPath && isSafeTranscriptPath(transcriptPath)) {
+    try {
+      reviewerRan = scanTranscriptForReviewer(fs10.readFileSync(transcriptPath, "utf-8"));
+    } catch {
+      reviewerRan = false;
+    }
+  }
+  if (reviewerRan) {
+    return 0;
+  }
+  markFiredThisSession(workspace_root, sessionKey, (/* @__PURE__ */ new Date()).toISOString());
+  try {
+    appendReviewSkippedTelemetry(
+      workspace_root,
+      diffLines,
+      mutationMeasure,
+      baselineApplication
+    );
+  } catch {
+  }
+  process.stdout.write(
+    `${JSON.stringify({
+      decision: "warn",
+      reason: `end-review-nudge: session mutated ${diffLines} non-doc lines without a neutral review`,
+      additional_context: buildAdvisoryLine(diffLines)
+    })}
+`
+  );
+  return EXIT_WARN2;
+}
+function _isCliEntry5() {
+  if (true) {
+    return false;
+  }
+  if (process.argv[1] === void 0) {
+    return false;
+  }
+  const argvUrl = pathToFileURL5(path9.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) {
+    return true;
+  }
+  try {
+    const here = fs10.realpathSync(fileURLToPath5(import.meta.url));
+    const argv = fs10.realpathSync(path9.resolve(process.argv[1]));
+    return here === argv;
+  } catch {
+    return false;
+  }
+}
+if (_isCliEntry5()) {
+  process.exit(main5());
+}
+
+// src/scripts/_lib/turn_end_transcript.ts
+function readTranscriptTail(transcriptPath, opts = {}) {
+  const empty = {
+    lastAssistant: "",
+    turnOrdinal: 0,
+    toolCalls: [],
+    assistantTurnTexts: []
+  };
+  if (!transcriptPath || !isSafeTranscriptPath(transcriptPath, opts)) return empty;
+  let lines;
+  try {
+    if (opts.maxBytes !== void 0 && fs11.statSync(transcriptPath).size > opts.maxBytes) {
+      return empty;
+    }
+    lines = fs11.readFileSync(transcriptPath, "utf-8").split("\n");
+  } catch {
+    return empty;
+  }
+  let lastAssistant = "";
+  let turnOrdinal = 0;
+  let toolCalls = [];
+  let assistantTurnTexts = [];
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (typeof obj !== "object" || obj === null || Array.isArray(obj)) continue;
+    const entry = obj;
+    if (entry["isSidechain"] === true) continue;
+    const role = entry["type"];
+    if (role !== "assistant" && role !== "user") continue;
+    const msg = entry["message"];
+    if (typeof msg !== "object" || msg === null || Array.isArray(msg)) continue;
+    const content = msg["content"];
+    if (role === "assistant") {
+      toolCalls.push(...extractToolCalls(content));
+    }
+    const text = _messageText(content);
+    if (text === null) continue;
+    if (role === "assistant") {
+      lastAssistant = text;
+      assistantTurnTexts.push(text);
+    } else if (!isSyntheticPrompt(text)) {
+      turnOrdinal += 1;
+      toolCalls = [];
+      assistantTurnTexts = [];
+    }
+  }
+  return {
+    lastAssistant: lastAssistant.trim(),
+    turnOrdinal,
+    toolCalls,
+    assistantTurnTexts
+  };
 }
-function main5() {
-  const raw = readHookStdin();
-  let envelope = {};
-  try {
-    envelope = raw.trim() ? JSON.parse(raw) : {};
-  } catch {
-    return EXIT_ALLOW3;
+function extractToolCalls(content) {
+  if (!Array.isArray(content)) return [];
+  const out = [];
+  for (const blk of content) {
+    if (typeof blk !== "object" || blk === null || Array.isArray(blk)) continue;
+    const b = blk;
+    if (b["type"] !== "tool_use") continue;
+    const name = b["name"];
+    if (typeof name !== "string") continue;
+    const input = b["input"];
+    const call = { name };
+    if (typeof input === "object" && input !== null && !Array.isArray(input)) {
+      const inp = input;
+      const cmd = inp["command"];
+      if (typeof cmd === "string") call.command = cmd;
+      const p = inp["file_path"] ?? inp["path"] ?? inp["notebook_path"];
+      if (typeof p === "string") call.path = p;
+    }
+    out.push(call);
   }
-  return processEnvelope(envelope, resolveConsumerRoot(envelope));
+  return out;
 }
-function _isCliEntry5() {
-  if (true) {
-    return false;
-  }
-  if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL5(path6.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) return true;
-  try {
-    return fs6.realpathSync(fileURLToPath5(import.meta.url)) === fs6.realpathSync(path6.resolve(process.argv[1]));
-  } catch {
-    return false;
+function _messageText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return null;
+  const parts = [];
+  for (const blk of content) {
+    if (typeof blk !== "object" || blk === null || Array.isArray(blk)) continue;
+    const b = blk;
+    if (b["type"] !== "text") continue;
+    const t = b["text"];
+    if (typeof t === "string") parts.push(t);
   }
+  return parts.length > 0 ? parts.join("\n") : null;
 }
-if (_isCliEntry5()) process.exit(main5());
 
 // src/scripts/hooks/turn_end_gate_hook.ts
-var EXIT_BLOCK = 1;
-var EXIT_ALLOW4 = 0;
 var TRANSCRIPT_READ_MAX_BYTES = 8 * 1024 * 1024;
 function stripFencedBlocks(text) {
   const out = [];
@@ -3403,7 +4444,7 @@ function detectPromissory(reply) {
 function readCiSettled(workspaceRoot, session_id) {
   if (!hasStableSessionId(session_id)) return { seen: false, settled: false };
   try {
-    const raw = fs7.readFileSync(path7.join(workspaceRoot, statePathFor(session_id)), "utf-8");
+    const raw = fs12.readFileSync(path10.join(workspaceRoot, statePathFor(session_id)), "utf-8");
     const decoded = JSON.parse(raw);
     if (!owns_session_state(decoded, session_id)) return { seen: false, settled: false };
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
@@ -3439,8 +4480,8 @@ function detectCompletionClaim(reply, ci) {
 function readLanguagePin(workspaceRoot, session_id) {
   if (!hasStableSessionId(session_id)) return "und";
   try {
-    const raw = fs7.readFileSync(
-      path7.join(workspaceRoot, statePathFor2(session_id)),
+    const raw = fs12.readFileSync(
+      path10.join(workspaceRoot, statePathFor2(session_id)),
       "utf-8"
     );
     const decoded = JSON.parse(raw);
@@ -3466,29 +4507,38 @@ function detectLanguage(reply, pinned) {
   };
 }
 var _EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-var _VERIFY_RE = /\b(test|tests|vitest|jest|pytest|phpunit|pest|tsc|eslint|ruff|mypy|pyright|clippy|phpstan|typecheck|lint[-_:a-z]*|build|ci|preflight|smoke[-_:a-z]*|check[-_:a-z]*|validate[-_:a-z]*)\b|\b(task|npm|pnpm|yarn|composer|cargo|go|make|php artisan|bun)\s+(run\s+)?\S*(test|check|lint|build|ci|typecheck)/i;
-function isVerificationCommand(command) {
-  return _VERIFY_RE.test(command);
-}
-function detectUnverifiedEdit(toolCalls) {
+function detectUnverifiedEdit(toolCalls, runState = null) {
   let lastEdit = -1;
   for (let i = 0; i < toolCalls.length; i += 1) {
     if (_EDIT_TOOLS.has(toolCalls[i].name)) lastEdit = i;
   }
   if (lastEdit === -1) return null;
+  const edited = toolCalls[lastEdit].path ?? toolCalls[lastEdit].name;
+  if (runState !== null) {
+    const reading = readRunEvidence(runState);
+    if (reading.passed) return null;
+    if (!reading.instrumentGap) {
+      return {
+        detector: "verification",
+        evidence: edited,
+        reason: describeRecordFinding(reading.failed, reading.reasons),
+        mode: "record"
+      };
+    }
+  }
   for (let i = lastEdit + 1; i < toolCalls.length; i += 1) {
     const c = toolCalls[i];
     if (c.name === "Bash" && c.command !== void 0 && isVerificationCommand(c.command)) {
       return null;
     }
   }
-  const edited = toolCalls[lastEdit].path;
   return {
     detector: "verification",
     // The path, never the diff: the evidence span is quoted into a refusal,
     // and `ToolCall` is shaped so a file body cannot reach it.
-    evidence: edited ?? toolCalls[lastEdit].name,
-    reason: "this turn changed a file and then ran no verification command \u2014 no test, type-check, lint or build call follows the last edit (verify-before-complete: a claim without a fresh run is unverified)"
+    evidence: edited,
+    reason: "this turn changed a file and then ran no verification command \u2014 no test, type-check, lint or build call follows the last edit (verify-before-complete: a claim without a fresh run is unverified)",
+    mode: "transcript"
   };
 }
 var _SOURCE_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs|vue|svelte|php|py|rb|go|rs|java|kt|swift|cs|scala|ex|exs)$/i;
@@ -3500,18 +4550,37 @@ function _isTestPath(p) {
 function _isProductionSource(p) {
   return _SOURCE_RE.test(p) && !_isTestPath(p);
 }
-function detectUntestedChange(reply, toolCalls) {
+function detectUntestedChange(reply, toolCalls, runState = null) {
   const edited = toolCalls.filter((c) => _EDIT_TOOLS.has(c.name) && c.path !== void 0).map((c) => c.path);
   const source = edited.filter(_isProductionSource);
   if (source.length === 0) return null;
-  if (edited.some(_isTestPath)) return null;
+  const wroteNewTest = toolCalls.some(
+    (c) => c.name === "Write" && c.path !== void 0 && _isTestPath(c.path)
+  );
+  let noRedEvidence = false;
+  if (edited.some(_isTestPath)) {
+    if (!wroteNewTest) return null;
+    if (runState === null) return null;
+    if (hasRedThenGreen(runState)) return null;
+    if (readRunEvidence(runState).instrumentGap) return null;
+    noRedEvidence = true;
+  }
   const prose = visibleProse(reply);
   const m = _COMPLETION_RE.exec(prose);
   if (!m) return null;
   if (_NEGATED_CLAIM_RE.test(_lineAround(prose, m.index))) return null;
   const shown = source.slice(0, 3).join(", ");
+  if (noRedEvidence) {
+    return {
+      detector: "untested",
+      evidence: shown + (source.length > 3 ? ` (+${String(source.length - 3)} more)` : ""),
+      mode: "record",
+      reason: NO_RED_EVIDENCE_REASON
+    };
+  }
   return {
     detector: "untested",
+    mode: "transcript",
     evidence: shown + (source.length > 3 ? ` (+${String(source.length - 3)} more)` : ""),
     reason: "a completion claim over production code this turn changed, with NO test file touched anywhere in the turn \u2014 running a linter is not evidence the change works. Write the test that would have caught the failure, and enumerate the states the change actually has (every view, every CRUD path, the empty and error states) rather than the happy one. If a test genuinely does not belong here, say which file carries the coverage instead"
   };
@@ -3521,7 +4590,7 @@ function sessionStateFile2(workspaceRoot, sessionKey) {
 }
 function alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal) {
   try {
-    const raw = fs7.readFileSync(sessionStateFile2(workspaceRoot, sessionKey), "utf-8");
+    const raw = fs12.readFileSync(sessionStateFile2(workspaceRoot, sessionKey), "utf-8");
     const decoded = JSON.parse(raw);
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
       return decoded["refused_turn"] === turnOrdinal;
@@ -3535,7 +4604,7 @@ function markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, detectors, prom
   const file = sessionStateFile2(workspaceRoot, sessionKey);
   let prev = null;
   try {
-    prev = parseRecord(fs7.readFileSync(file, "utf-8"));
+    prev = parseRecord(fs12.readFileSync(file, "utf-8"));
   } catch {
   }
   let version;
@@ -3558,112 +4627,10 @@ function markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, detectors, prom
   } catch {
   }
 }
-function readTranscriptTail(transcriptPath, opts = {}) {
-  const empty = {
-    lastAssistant: "",
-    turnOrdinal: 0,
-    toolCalls: [],
-    assistantTurnTexts: []
-  };
-  if (!transcriptPath || !isSafeTranscriptPath(transcriptPath, opts)) return empty;
-  let lines;
-  try {
-    if (opts.maxBytes !== void 0 && fs7.statSync(transcriptPath).size > opts.maxBytes) {
-      return empty;
-    }
-    lines = fs7.readFileSync(transcriptPath, "utf-8").split("\n");
-  } catch {
-    return empty;
-  }
-  let lastAssistant = "";
-  let turnOrdinal = 0;
-  let toolCalls = [];
-  let assistantTurnTexts = [];
-  for (const rawLine of lines) {
-    const line = rawLine.trim();
-    if (!line) continue;
-    let obj;
-    try {
-      obj = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (typeof obj !== "object" || obj === null || Array.isArray(obj)) continue;
-    const entry = obj;
-    if (entry["isSidechain"] === true) continue;
-    const role = entry["type"];
-    if (role !== "assistant" && role !== "user") continue;
-    const msg = entry["message"];
-    if (typeof msg !== "object" || msg === null || Array.isArray(msg)) continue;
-    const content = msg["content"];
-    if (role === "assistant") {
-      toolCalls.push(...extractToolCalls(content));
-    }
-    const text = _messageText(content);
-    if (text === null) continue;
-    if (role === "assistant") {
-      lastAssistant = text;
-      assistantTurnTexts.push(text);
-    } else if (!isSyntheticPrompt(text)) {
-      turnOrdinal += 1;
-      toolCalls = [];
-      assistantTurnTexts = [];
-    }
-  }
-  return {
-    lastAssistant: lastAssistant.trim(),
-    turnOrdinal,
-    toolCalls,
-    assistantTurnTexts
-  };
-}
-function extractToolCalls(content) {
-  if (!Array.isArray(content)) return [];
-  const out = [];
-  for (const blk of content) {
-    if (typeof blk !== "object" || blk === null || Array.isArray(blk)) continue;
-    const b = blk;
-    if (b["type"] !== "tool_use") continue;
-    const name = b["name"];
-    if (typeof name !== "string") continue;
-    const input = b["input"];
-    const call = { name };
-    if (typeof input === "object" && input !== null && !Array.isArray(input)) {
-      const inp = input;
-      const cmd = inp["command"];
-      if (typeof cmd === "string") call.command = cmd;
-      const p = inp["file_path"] ?? inp["path"] ?? inp["notebook_path"];
-      if (typeof p === "string") call.path = p;
-    }
-    out.push(call);
-  }
-  return out;
-}
-function _messageText(content) {
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return null;
-  const parts = [];
-  for (const blk of content) {
-    if (typeof blk !== "object" || blk === null || Array.isArray(blk)) continue;
-    const b = blk;
-    if (b["type"] !== "text") continue;
-    const t = b["text"];
-    if (typeof t === "string") parts.push(t);
-  }
-  return parts.length > 0 ? parts.join("\n") : null;
-}
 function str3(v) {
   return typeof v === "string" ? v : "";
 }
-function main6() {
-  let envelope;
-  let payload;
-  try {
-    [envelope, payload] = unwrap(readHookStdin(), "claude");
-  } catch {
-    return EXIT_ALLOW4;
-  }
-  if (payload["stop_hook_active"] === true) return EXIT_ALLOW4;
+function assembleDetectorInputs(envelope, payload) {
   const workspaceRoot = str3(envelope["workspace_root"]) || process.cwd();
   let dispatchOpen = false;
   try {
@@ -3677,18 +4644,32 @@ function main6() {
     transcriptPath,
     { maxBytes: TRANSCRIPT_READ_MAX_BYTES }
   );
-  if (!lastAssistant) return EXIT_ALLOW4;
+  if (!lastAssistant) return null;
   const payloadClosing = str3(
     payload["last_assistant_message"] ?? payload["lastAssistantMessage"]
   );
   const closingFromPayload = payloadClosing !== "" && !assistantTurnTexts.includes(payloadClosing);
   const turnTexts = closingFromPayload ? [...assistantTurnTexts, payloadClosing] : assistantTurnTexts;
-  const promptId = str3(
-    payload["prompt_id"] ?? payload["promptId"]
-  );
+  const promptId = str3(payload["prompt_id"] ?? payload["promptId"]);
   const rawSessionId = str3(envelope["session_id"]) || "";
   const sessionKey = deriveSessionKey(rawSessionId || "unknown-session");
-  if (alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal)) return EXIT_ALLOW4;
+  const runState = readTurnRunState(workspaceRoot, rawSessionId);
+  return {
+    workspaceRoot,
+    rawSessionId,
+    sessionKey,
+    turnOrdinal,
+    promptId,
+    lastAssistant,
+    toolCalls,
+    turnTexts,
+    closingFromPayload,
+    dispatchOpen,
+    runState
+  };
+}
+function runDetectors(inputs) {
+  const { dispatchOpen, lastAssistant, workspaceRoot, rawSessionId, toolCalls, runState } = inputs;
   const findings = [];
   for (const f of [
     // A and D are the completion-adjacent pair a pending dispatch excuses
@@ -3696,17 +4677,14 @@ function main6() {
     // excused by anything about a dispatch and run unchanged.
     dispatchOpen ? null : detectPromissory(lastAssistant),
     detectLanguage(lastAssistant, readLanguagePin(workspaceRoot, rawSessionId)),
-    detectUnverifiedEdit(toolCalls),
-    // Round 7 § Phase 1 — detector D. It is NOT unconditional, and this
-    // comment said it was while sitting one line above the `dispatchOpen`
-    // ternary that conditions it: A and D are both excused by an open
-    // dispatch, per the note at the top of this loop. Corrected 2026-08-18.
-    // It shipped with its own settings flag one commit earlier
-    // and that flag is gone: `hooks.turn_end_gate.*` was deleted on
-    // 2026-08-12 because a default-off safety gate is an absent one. Its
-    // gating is where the comment above says gating belongs — inside the
-    // detector: no CI observed, or a settled read, or no completion claim
-    // ⇒ no finding.
+    detectUnverifiedEdit(toolCalls, runState),
+    // Round 7 § Phase 1 — detector D. It is NOT unconditional: A and D are
+    // both excused by an open dispatch, per the note above. It shipped with
+    // its own settings flag one commit earlier and that flag is gone:
+    // `hooks.turn_end_gate.*` was deleted on 2026-08-12 because a
+    // default-off safety gate is an absent one. Its gating is where the
+    // note above says gating belongs — inside the detector: no CI observed,
+    // or a settled read, or no completion claim ⇒ no finding.
     dispatchOpen ? null : detectCompletionClaim(lastAssistant, readCiSettled(workspaceRoot, rawSessionId)),
     // Detector E is UNCONDITIONAL, and that is the opposite choice from A
     // and D one line above rather than an oversight. An open dispatch
@@ -3716,24 +4694,103 @@ function main6() {
     // that produced the measured failure — IS the continuation that drops
     // the decision, so narrowing E the same way would silence it in exactly
     // the case it exists for.
-    detectDroppedDecision(turnTexts, closingFromPayload),
+    detectDroppedDecision(inputs.turnTexts, inputs.closingFromPayload),
     // Detector F takes the OTHER side of that same question, and the two
     // sitting adjacent is the clearest place to say why. E fires on a
     // question already asked, which an open dispatch cannot excuse. F fires
     // on a completion CLAIM, and a turn waiting on a subagent has not
     // finished — so its closing is not the claim F is about. Same slot,
     // opposite trigger, opposite treatment of `dispatchOpen`.
-    dispatchOpen ? null : detectUntestedChange(lastAssistant, toolCalls)
+    dispatchOpen ? null : detectUntestedChange(lastAssistant, toolCalls, runState)
   ]) {
     if (f) findings.push(f);
   }
-  if (findings.length === 0) return EXIT_ALLOW4;
+  return findings;
+}
+function recordGraphFeeder(inputs, findings, layer) {
+  if (is_replay_mode()) return;
+  try {
+    let state;
+    try {
+      state = graphState(inputs.workspaceRoot);
+    } catch {
+      return;
+    }
+    if (state === "absent") return;
+    const paths = inputs.toolCalls.filter((c) => _EDIT_TOOLS.has(c.name) && c.path !== void 0).map((c) => c.path).filter(_isProductionSource);
+    const f = findings.find((x) => x.detector === "untested");
+    appendFeederRow(
+      inputs.workspaceRoot,
+      inputs.sessionKey,
+      buildFeederRow({
+        turn: inputs.turnOrdinal,
+        layer,
+        state,
+        fFired: f !== void 0,
+        fMode: f?.mode ?? null,
+        paths,
+        graph: graphUntestedVerdict(inputs.workspaceRoot, state, paths)
+      })
+    );
+  } catch {
+  }
+}
+function recordShadow(inputs, layer) {
+  if (is_replay_mode()) return;
+  try {
+    const findings = runDetectors(inputs);
+    const setBy = layer === "refused_turn" ? "ours" : shadowSetBy(inputs.workspaceRoot, inputs.sessionKey);
+    recordGraphFeeder(inputs, findings, layer);
+    const file = sessionShadowFile(inputs.workspaceRoot, inputs.sessionKey);
+    let prev = null;
+    try {
+      prev = parseShadowRecord(fs12.readFileSync(file, "utf-8"));
+    } catch {
+    }
+    atomic_write_json(
+      file,
+      foldShadow(prev, {
+        detectors: findings.map((f) => f.detector),
+        turnOrdinal: inputs.turnOrdinal,
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        layer,
+        setBy
+      })
+    );
+  } catch {
+  }
+}
+function main6() {
+  let envelope;
+  let payload;
+  try {
+    [envelope, payload] = unwrap(readHookStdin(), "claude");
+  } catch {
+    return EXIT_ALLOW3;
+  }
+  if (payload["stop_hook_active"] === true) {
+    try {
+      const retryInputs = assembleDetectorInputs(envelope, payload);
+      if (retryInputs !== null) recordShadow(retryInputs, "stop_hook_active");
+    } catch {
+    }
+    return EXIT_ALLOW3;
+  }
+  const inputs = assembleDetectorInputs(envelope, payload);
+  if (inputs === null) return EXIT_ALLOW3;
+  if (alreadyRefusedTurn(inputs.workspaceRoot, inputs.sessionKey, inputs.turnOrdinal)) {
+    recordShadow(inputs, "refused_turn");
+    return EXIT_ALLOW3;
+  }
+  const findings = runDetectors(inputs);
+  recordGraphFeeder(inputs, findings, "live");
+  if (findings.length === 0) return EXIT_ALLOW3;
   markRefusedTurn(
-    workspaceRoot,
-    sessionKey,
-    turnOrdinal,
+    inputs.workspaceRoot,
+    inputs.sessionKey,
+    inputs.turnOrdinal,
     findings.map((f) => f.detector),
-    promptId
+    inputs.promptId
   );
   const lines = findings.map(
     (f) => `  \xB7 ${f.detector}: ${f.reason}
@@ -3755,13 +4812,13 @@ function _isCliEntry6() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL6(path7.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL6(path10.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs7.realpathSync(fileURLToPath6(import.meta.url));
-    const argv = fs7.realpathSync(path7.resolve(process.argv[1]));
+    const here = fs12.realpathSync(fileURLToPath6(import.meta.url));
+    const argv = fs12.realpathSync(path10.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -3774,8 +4831,8 @@ if (_isCliEntry6()) {
 // src/scripts/hooks/evidence_independence.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import crypto3 from "node:crypto";
-import fs8 from "node:fs";
-import path8 from "node:path";
+import fs13 from "node:fs";
+import path11 from "node:path";
 import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
 
 // src/scripts/_lib/test_delta.ts
@@ -3794,9 +4851,7 @@ function isTestPath(p) {
 }
 
 // src/scripts/hooks/evidence_independence.ts
-var EXIT_ALLOW5 = 0;
-var EXIT_BLOCK2 = 1;
-var STATE_FILE3 = path8.join("agents", "state", "evidence-dispatch.json");
+var STATE_FILE3 = path11.join("agents", "state", "evidence-dispatch.json");
 function _isObject5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -3864,8 +4919,8 @@ function extractDispatch(envelope) {
 }
 function _ledgerStamp(consumer_root) {
   try {
-    const raw = fs8.readFileSync(
-      path8.join(consumer_root, "agents", "state", "git-authorization.json"),
+    const raw = fs13.readFileSync(
+      path11.join(consumer_root, "agents", "state", "git-authorization.json"),
       "utf8"
     );
     const d = JSON.parse(raw);
@@ -3876,7 +4931,7 @@ function _ledgerStamp(consumer_root) {
 }
 function _load(target) {
   try {
-    const decoded = JSON.parse(fs8.readFileSync(target, "utf8"));
+    const decoded = JSON.parse(fs13.readFileSync(target, "utf8"));
     if (_isObject5(decoded) && Array.isArray(decoded["evaluations"])) {
       return decoded;
     }
@@ -3887,12 +4942,12 @@ function _load(target) {
 var WARN_TEXT = "First evaluation dispatch this turn. Two shapes fabricated a binding honest-null in the audited sessions \u2014 check your prompt for both before it goes out: (1) a verdict pre-loaded into the prompt, and (2) a scope narrowed to files you chose. A review you commissioned on your own work is admissible as gate evidence only when the prompt is recorded alongside the verdict.";
 function decide(tool, prompt, priorEvaluations) {
   if (!isDispatchTool(tool) || !isEvaluationPrompt(prompt)) {
-    return { exit: EXIT_ALLOW5, stdout: "", stderr: "", evaluations: priorEvaluations };
+    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   const preloaded = preloadedVerdict(prompt);
   if (preloaded !== null) {
     return {
-      exit: EXIT_BLOCK2,
+      exit: EXIT_BLOCK,
       stdout: "",
       stderr: `Blocked: this evaluation prompt pre-loads its verdict ("${preloaded}"). That is the construct that produced a fabricated NO-FINDINGS committed as binding gate evidence, over a delta an unsteered pass then found a live critical in. Remove the expectation from the prompt and let the evaluator reach its own verdict.
 `,
@@ -3900,11 +4955,11 @@ function decide(tool, prompt, priorEvaluations) {
     };
   }
   if (!isSelfScoped(prompt)) {
-    return { exit: EXIT_ALLOW5, stdout: "", stderr: "", evaluations: priorEvaluations };
+    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   if (priorEvaluations >= 1) {
     return {
-      exit: EXIT_ALLOW5,
+      exit: EXIT_ALLOW3,
       stdout: `${JSON.stringify({
         decision: "warn",
         reason: `Second evaluation dispatch of your own work in this turn. If both passes judge the SAME subject, that is verdict shopping \u2014 commissioning another with a different prompt or scope selects the answer instead of measuring it. Report what the first pass returned, then re-plan. If this is an implementation fan-out rather than a second review, carry on: this check reads prose and cannot tell the two apart with certainty.`
@@ -3915,7 +4970,7 @@ function decide(tool, prompt, priorEvaluations) {
     };
   }
   return {
-    exit: EXIT_ALLOW5,
+    exit: EXIT_ALLOW3,
     stdout: `${JSON.stringify({ decision: "warn", reason: WARN_TEXT })}
 `,
     stderr: "",
@@ -3957,10 +5012,10 @@ function run3(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW5;
+      return EXIT_ALLOW3;
     }
   }
-  const target = path8.join(options.consumer_root, STATE_FILE3);
+  const target = path11.join(options.consumer_root, STATE_FILE3);
   const state = _load(target);
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
   const turnMarker = `${session_id}:${_ledgerStamp(options.consumer_root)}`;
@@ -3976,7 +5031,7 @@ function run3(stdin_text, options) {
     if (staged !== null && touchesTestAndCode(staged)) {
       process.stdout.write(`${JSON.stringify({ decision: "warn", reason: flag })}
 `);
-      return EXIT_ALLOW5;
+      return EXIT_ALLOW3;
     }
   }
   const decision = decide(tool, prompt, state.evaluations.length);
@@ -4028,13 +5083,13 @@ function _isCliEntry7() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL7(path8.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL7(path11.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs8.realpathSync(fileURLToPath7(import.meta.url));
-    const argv = fs8.realpathSync(path8.resolve(process.argv[1]));
+    const here = fs13.realpathSync(fileURLToPath7(import.meta.url));
+    const argv = fs13.realpathSync(path11.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -4045,8 +5100,8 @@ if (_isCliEntry7()) {
 }
 
 // src/scripts/hooks/delegation_nudge_hook.ts
-import fs9 from "node:fs";
-import path9 from "node:path";
+import fs14 from "node:fs";
+import path12 from "node:path";
 import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL8 } from "node:url";
 
 // src/scripts/_lib/auto_dispatch.ts
@@ -4327,8 +5382,6 @@ function resolveSubagentRouting(inp) {
 }
 
 // src/scripts/hooks/delegation_nudge_hook.ts
-var EXIT_ALLOW6 = 0;
-var EXIT_WARN3 = 2;
 function _isObject6(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -4508,28 +5561,28 @@ function main8() {
     const raw = readHookStdin();
     envelope = raw.trim() ? JSON.parse(raw) : {};
   } catch {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   const env = _isObject6(envelope) ? envelope : {};
   const event = env["event"];
   const slot = typeof event === "string" && event !== "" ? event : "user_prompt_submit";
   if (slot !== "user_prompt_submit") {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   const payload = _isObject6(env["payload"]) ? env["payload"] : env;
   const prompt = _extractPrompt2(payload);
   if (!prompt) {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   if (isSyntheticPrompt(prompt)) {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   const root = _workspaceRoot(env);
   const platform = env["platform"];
   const hostId = typeof platform === "string" && platform ? platform : null;
   const result = classifyPrompt(prompt, root, hostId);
   if (!result) {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   process.stdout.write(
     `${JSON.stringify({
@@ -4539,7 +5592,7 @@ function main8() {
     })}
 `
   );
-  return EXIT_WARN3;
+  return EXIT_WARN2;
 }
 function _isCliEntry8() {
   if (true) {
@@ -4548,13 +5601,13 @@ function _isCliEntry8() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL8(path9.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL8(path12.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs9.realpathSync(fileURLToPath8(import.meta.url));
-    const argv = fs9.realpathSync(path9.resolve(process.argv[1]));
+    const here = fs14.realpathSync(fileURLToPath8(import.meta.url));
+    const argv = fs14.realpathSync(path12.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -4565,7 +5618,7 @@ if (_isCliEntry8()) {
 }
 
 // src/scripts/conformance_scan.ts
-var REPO_ROOT = path10.resolve(path10.dirname(fileURLToPath9(import.meta.url)), "..", "..");
+var REPO_ROOT = path13.resolve(path13.dirname(fileURLToPath9(import.meta.url)), "..", "..");
 var OBSERVED_BAND = { low: 9.1, high: 39.2 };
 var BAND_MIN_TURNS = 1978;
 var CARRIER_CHANGES = [
@@ -4931,7 +5984,7 @@ function scanSession(sessionId, lines) {
   closeWindow();
   return report;
 }
-var DEFAULT_RATE_SERIES = path10.join(
+var DEFAULT_RATE_SERIES = path13.join(
   REPO_ROOT,
   "agents",
   "runtime",
@@ -4940,7 +5993,7 @@ var DEFAULT_RATE_SERIES = path10.join(
 );
 function defaultStore(projectDir) {
   const slug = projectStoreSlug(projectDir);
-  return path10.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
+  return path13.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
 }
 function _tokens(chars) {
   return Math.round(chars / 4);
@@ -4951,13 +6004,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   return {
     project: {
       dir: projectRulesDir,
-      present: fs10.existsSync(projectRulesDir),
+      present: fs15.existsSync(projectRulesDir),
       files: p.files,
       tokens: _tokens(p.chars)
     },
     global: {
       dir: globalRulesDir,
-      present: fs10.existsSync(globalRulesDir),
+      present: fs15.existsSync(globalRulesDir),
       files: g.files,
       tokens: _tokens(g.chars)
     },
@@ -4965,13 +6018,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   };
 }
 function storeKey(store) {
-  return createHash3("sha256").update(path10.resolve(store)).digest("hex").slice(0, 12);
+  return createHash4("sha256").update(path13.resolve(store)).digest("hex").slice(0, 12);
 }
 function scanStore(store, limit) {
-  const files = fs10.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs10.statSync(path10.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
+  const files = fs15.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs15.statSync(path13.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
   const per_session = [];
   for (const f of files) {
-    const lines = fs10.readFileSync(path10.join(store, f), "utf8").split("\n");
+    const lines = fs15.readFileSync(path13.join(store, f), "utf8").split("\n");
     const r = scanSession(f.replace(/\.jsonl$/, "").slice(0, 8), lines);
     if (r.assistant_turns > 0) {
       per_session.push(r);
@@ -4999,10 +6052,10 @@ function scanStore(store, limit) {
   const task_completeness_rate_pct = completeness_windows === 0 ? 0 : Number((100 * task_completeness / completeness_windows).toFixed(1));
   const era = spansCarrierChange(per_session.map((s) => s.first_at));
   const delivered = measureDelivered(
-    path10.join(REPO_ROOT, ".claude", "rules"),
-    path10.join(process.env["HOME"] ?? os2.homedir(), ".claude", "rules")
+    path13.join(REPO_ROOT, ".claude", "rules"),
+    path13.join(process.env["HOME"] ?? os2.homedir(), ".claude", "rules")
   );
-  const ownStore = path10.resolve(store) === path10.resolve(defaultStore(REPO_ROOT));
+  const ownStore = path13.resolve(store) === path13.resolve(defaultStore(REPO_ROOT));
   return {
     scanned_at: (/* @__PURE__ */ new Date()).toISOString(),
     store,
@@ -5032,8 +6085,8 @@ function scanStore(store, limit) {
   };
 }
 function recordRate(file, scanned_at, rate) {
-  fs10.mkdirSync(path10.dirname(file), { recursive: true });
-  fs10.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
+  fs15.mkdirSync(path13.dirname(file), { recursive: true });
+  fs15.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
 `, "utf8");
 }
 function render(report) {
@@ -5164,14 +6217,14 @@ function main9(argv) {
     return 2;
   }
   const resolved = store ?? defaultStore(process.cwd());
-  if (!fs10.existsSync(resolved)) {
+  if (!fs15.existsSync(resolved)) {
     process.stderr.write(`conformance:behavior: no transcript store at ${resolved}
 `);
     return 1;
   }
   const report = scanStore(resolved, Number.isFinite(limit) && limit > 0 ? limit : 30);
   if (out) {
-    fs10.writeFileSync(out, `${JSON.stringify(report, null, 2)}
+    fs15.writeFileSync(out, `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   if (record) {
@@ -5179,7 +6232,7 @@ function main9(argv) {
   }
   if (why !== null) {
     const id = why;
-    fs10.writeSync(
+    fs15.writeSync(
       1,
       json ? `${JSON.stringify(
         {
@@ -5199,7 +6252,7 @@ function main9(argv) {
     );
     return 0;
   }
-  fs10.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
+  fs15.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
 ` : `${render(report)}
 `);
   return 0;
@@ -5211,13 +6264,13 @@ function _isCliEntry9() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL9(path10.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL9(path13.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs10.realpathSync(fileURLToPath9(import.meta.url));
-    const argv = fs10.realpathSync(path10.resolve(process.argv[1]));
+    const here = fs15.realpathSync(fileURLToPath9(import.meta.url));
+    const argv = fs15.realpathSync(path13.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -5228,19 +6281,19 @@ if (_isCliEntry9()) {
 }
 
 // src/scripts/report_carrier_divergence.ts
-import * as fs11 from "node:fs";
+import * as fs16 from "node:fs";
 import * as os3 from "node:os";
-import * as path11 from "node:path";
+import * as path14 from "node:path";
 import process2 from "node:process";
 import { fileURLToPath as fileURLToPath10, pathToFileURL as pathToFileURL10 } from "node:url";
 var _HERE2 = fileURLToPath10(import.meta.url);
-var REPO_ROOT2 = path11.resolve(path11.dirname(_HERE2), "..", "..");
-var PROJECT_RULES = path11.join(".claude", "rules");
-var PROJECTION_SOURCE = path11.join("dist", "agent-src", "rules");
-var GLOBAL_RULES = path11.join(".claude", "rules");
+var REPO_ROOT2 = path14.resolve(path14.dirname(_HERE2), "..", "..");
+var PROJECT_RULES = path14.join(".claude", "rules");
+var PROJECTION_SOURCE = path14.join("dist", "agent-src", "rules");
+var GLOBAL_RULES = path14.join(".claude", "rules");
 function _listRules(dir) {
   try {
-    return fs11.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    return fs16.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
@@ -5248,7 +6301,7 @@ function _listRules(dir) {
 function _ruleType(file) {
   let text;
   try {
-    text = fs11.readFileSync(file, "utf-8");
+    text = fs16.readFileSync(file, "utf-8");
   } catch {
     return "";
   }
@@ -5259,8 +6312,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
   const out = {
     projectDir,
     globalDir,
-    globalPresent: fs11.existsSync(globalDir),
-    projectPresent: fs11.existsSync(projectDir),
+    globalPresent: fs16.existsSync(globalDir),
+    projectPresent: fs16.existsSync(projectDir),
     shared: 0,
     identical: [],
     provenanceOnly: [],
@@ -5283,7 +6336,7 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     if (!inP && inG) {
       out.globalOnly.push(rule);
-      if (sourceDir !== void 0 && _ruleType(path11.join(sourceDir, rule)) === "manual") {
+      if (sourceDir !== void 0 && _ruleType(path14.join(sourceDir, rule)) === "manual") {
         out.manualOnlyGlobal.push(rule);
       }
       continue;
@@ -5293,8 +6346,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     let projectCopy;
     let globalCopy;
     try {
-      projectCopy = fs11.readFileSync(path11.join(projectDir, rule));
-      globalCopy = fs11.readFileSync(path11.join(globalDir, rule));
+      projectCopy = fs16.readFileSync(path14.join(projectDir, rule));
+      globalCopy = fs16.readFileSync(path14.join(globalDir, rule));
       verdict = comparePair(projectCopy, globalCopy);
     } catch {
       out.shared -= 1;
@@ -5441,9 +6494,9 @@ function render2(d) {
 }
 function main10(argv) {
   const args = argv ?? process2.argv.slice(2);
-  let projectDir = path11.join(REPO_ROOT2, PROJECT_RULES);
-  let globalDir = path11.join(os3.homedir(), GLOBAL_RULES);
-  let sourceDir = path11.join(REPO_ROOT2, PROJECTION_SOURCE);
+  let projectDir = path14.join(REPO_ROOT2, PROJECT_RULES);
+  let globalDir = path14.join(os3.homedir(), GLOBAL_RULES);
+  let sourceDir = path14.join(REPO_ROOT2, PROJECTION_SOURCE);
   const value = (i) => {
     const v = args[i + 1];
     return v === void 0 || v.startsWith("-") ? null : v;
@@ -5457,7 +6510,7 @@ function main10(argv) {
 `);
         return 1;
       }
-      const resolved = path11.resolve(v);
+      const resolved = path14.resolve(v);
       if (a === "--project") projectDir = resolved;
       else if (a === "--global") globalDir = resolved;
       else sourceDir = resolved;
@@ -5479,9 +6532,9 @@ function main10(argv) {
 }
 function _isCliEntry10() {
   if (process2.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL10(path11.resolve(process2.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL10(path14.resolve(process2.argv[1])).href) return true;
   try {
-    return fs11.realpathSync(_HERE2) === fs11.realpathSync(path11.resolve(process2.argv[1]));
+    return fs16.realpathSync(_HERE2) === fs16.realpathSync(path14.resolve(process2.argv[1]));
   } catch {
     return false;
   }
@@ -5491,12 +6544,12 @@ if (_isCliEntry10()) {
 }
 
 // src/scripts/report_skill_activation.ts
-import * as fs12 from "node:fs";
+import * as fs17 from "node:fs";
 import * as os4 from "node:os";
-import * as path12 from "node:path";
+import * as path15 from "node:path";
 import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
 var _HERE3 = fileURLToPath11(import.meta.url);
-var REPO_ROOT3 = path12.resolve(path12.dirname(_HERE3), "..", "..");
+var REPO_ROOT3 = path15.resolve(path15.dirname(_HERE3), "..", "..");
 var SKILLS_ROOT = "src/skills";
 var TRIGGER_KEYS = ["triggers:", "trigger_description:", "file_pattern:", "path_prefix:"];
 var DETERMINISTIC_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?(MUST|NEVER|ALWAYS)\b/m;
@@ -5507,25 +6560,25 @@ function censusSkills(root) {
     withTriggerCorpus: [],
     withDeterministicObligation: []
   };
-  if (!fs12.existsSync(root)) {
+  if (!fs17.existsSync(root)) {
     return out;
   }
-  for (const entry of fs12.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const entry of fs17.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const file = path12.join(root, entry.name, "SKILL.md");
-    if (!fs12.existsSync(file)) {
+    const file = path15.join(root, entry.name, "SKILL.md");
+    if (!fs17.existsSync(file)) {
       continue;
     }
     out.total += 1;
-    const text = fs12.readFileSync(file, "utf8");
+    const text = fs17.readFileSync(file, "utf8");
     const fmEnd = text.startsWith("---") ? text.indexOf("\n---", 3) : -1;
     const fm = fmEnd === -1 ? "" : text.slice(0, fmEnd);
     if (TRIGGER_KEYS.some((k) => new RegExp(`^${k}`, "m").test(fm))) {
       out.withTriggerKey.push(entry.name);
     }
-    if (fs12.existsSync(path12.join(root, entry.name, "evals", "triggers.json"))) {
+    if (fs17.existsSync(path15.join(root, entry.name, "evals", "triggers.json"))) {
       out.withTriggerCorpus.push(entry.name);
     }
     const body = fmEnd === -1 ? text : text.slice(fmEnd + 4);
@@ -5536,17 +6589,17 @@ function censusSkills(root) {
   return out;
 }
 function defaultStore2(cwd) {
-  return path12.join(os4.homedir(), ".claude", "projects", projectStoreSlug(cwd));
+  return path15.join(os4.homedir(), ".claude", "projects", projectStoreSlug(cwd));
 }
 function measureUsage(store, limit) {
   const rep = { store, sessions: 0, assistantTurns: 0, invocations: 0, bySkill: {} };
-  if (!fs12.existsSync(store)) {
+  if (!fs17.existsSync(store)) {
     return rep;
   }
-  const files = fs12.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path12.join(store, f)).sort((a, b) => fs12.statSync(b).mtimeMs - fs12.statSync(a).mtimeMs).slice(0, limit);
+  const files = fs17.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path15.join(store, f)).sort((a, b) => fs17.statSync(b).mtimeMs - fs17.statSync(a).mtimeMs).slice(0, limit);
   rep.sessions = files.length;
   for (const file of files) {
-    for (const line of fs12.readFileSync(file, "utf8").split("\n")) {
+    for (const line of fs17.readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) {
         continue;
       }
@@ -5619,15 +6672,15 @@ function buildRecord(census, usage, today) {
     assistant_turns: usage.reduce((a, u) => a + u.assistantTurns, 0),
     invocations: usage.reduce((a, u) => a + u.invocations, 0),
     distinct_skills_invoked: distinct.size,
-    stores: usage.map((u) => path12.basename(u.store))
+    stores: usage.map((u) => path15.basename(u.store))
   };
 }
 function readRecord(repoRoot) {
-  const file = path12.join(repoRoot, RECORD_PATH);
-  if (!fs12.existsSync(file)) {
+  const file = path15.join(repoRoot, RECORD_PATH);
+  if (!fs17.existsSync(file)) {
     return null;
   }
-  return JSON.parse(fs12.readFileSync(file, "utf8"));
+  return JSON.parse(fs17.readFileSync(file, "utf8"));
 }
 function render3(census, usage, published = null) {
   const lines = [];
@@ -5662,7 +6715,7 @@ function render3(census, usage, published = null) {
     }
     totalInv += u.invocations;
     lines.push(
-      `  ${path12.basename(u.store).slice(-38).padEnd(38)} sessions=${String(u.sessions).padStart(3)} asst=${String(u.assistantTurns).padStart(6)} Skill calls=${String(u.invocations).padStart(3)}`
+      `  ${path15.basename(u.store).slice(-38).padEnd(38)} sessions=${String(u.sessions).padStart(3)} asst=${String(u.assistantTurns).padStart(6)} Skill calls=${String(u.invocations).padStart(3)}`
     );
   }
   lines.push("");
@@ -5766,7 +6819,7 @@ function main11(argv) {
   if (stores.length === 0) {
     stores.push(defaultStore2(REPO_ROOT3));
   }
-  const census = censusSkills(path12.join(root, SKILLS_ROOT));
+  const census = censusSkills(path15.join(root, SKILLS_ROOT));
   const usage = stores.map((s) => measureUsage(s, limit));
   process.stdout.write(`${render3(census, usage, readRecord(root))}
 `);
@@ -5787,27 +6840,27 @@ function main11(argv) {
     return 1;
   }
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const file = path12.join(root, RECORD_PATH);
-  fs12.mkdirSync(path12.dirname(file), { recursive: true });
-  fs12.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
+  const file = path15.join(root, RECORD_PATH);
+  fs17.mkdirSync(path15.dirname(file), { recursive: true });
+  fs17.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
 `);
   process.stdout.write(`
 wrote ${RECORD_PATH} (measured ${today})
 `);
   return 0;
 }
-if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL11(path12.resolve(process.argv[1])).href) {
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL11(path15.resolve(process.argv[1])).href) {
   process.exit(main11(process.argv.slice(2)));
 }
 
 // src/scripts/report_skill_obligation_violations.ts
-import * as fs13 from "node:fs";
+import * as fs18 from "node:fs";
 import * as os5 from "node:os";
-import * as path13 from "node:path";
+import * as path16 from "node:path";
 import process3 from "node:process";
 import { fileURLToPath as fileURLToPath12, pathToFileURL as pathToFileURL12 } from "node:url";
 var _HERE4 = fileURLToPath12(import.meta.url);
-var REPO_ROOT4 = path13.resolve(path13.dirname(_HERE4), "..", "..");
+var REPO_ROOT4 = path16.resolve(path16.dirname(_HERE4), "..", "..");
 var OBLIGATION_LINE_RE = new RegExp(`${DETERMINISTIC_RE.source}.*`, "gm");
 var PATH_RE = /`([A-Za-z0-9_./-]*\/[A-Za-z0-9_.-]+\.[a-z]{2,6})`/g;
 var CMD_RE = /`([a-z][a-z0-9-]*(?: [a-z][a-z0-9:._-]*){1,3})`/g;
@@ -5845,7 +6898,7 @@ function _artefacts(line) {
   return out;
 }
 function extractObligations(repoRoot) {
-  const skillsRoot = path13.join(repoRoot, SKILLS_ROOT);
+  const skillsRoot = path16.join(repoRoot, SKILLS_ROOT);
   const census = censusSkills(skillsRoot);
   const out = {
     skills: census.withDeterministicObligation,
@@ -5859,7 +6912,7 @@ function extractObligations(repoRoot) {
   for (const skill of census.withDeterministicObligation) {
     let text;
     try {
-      text = fs13.readFileSync(path13.join(skillsRoot, skill, "SKILL.md"), "utf-8");
+      text = fs18.readFileSync(path16.join(skillsRoot, skill, "SKILL.md"), "utf-8");
     } catch {
       continue;
     }
@@ -5975,7 +7028,7 @@ function scanSessionForViolations(session, lines, forbidden, parsed) {
   return flags;
 }
 function defaultStore3(cwd) {
-  return path13.join(os5.homedir(), ".claude", "projects", projectStoreSlug(cwd));
+  return path16.join(os5.homedir(), ".claude", "projects", projectStoreSlug(cwd));
 }
 function scanStore2(repoRoot, store, limit) {
   const census = extractObligations(repoRoot);
@@ -5988,14 +7041,14 @@ function scanStore2(repoRoot, store, limit) {
   };
   let files;
   try {
-    files = fs13.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path13.join(store, f), m: fs13.statSync(path13.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
+    files = fs18.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path16.join(store, f), m: fs18.statSync(path16.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
   } catch {
     return report;
   }
   report.sessions = files.length;
   for (const file of files) {
-    const lines = fs13.readFileSync(file, "utf-8").split("\n");
-    const id = path13.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
+    const lines = fs18.readFileSync(file, "utf-8").split("\n");
+    const id = path16.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
     const entries = _parseSession(lines);
     if (loadedSkillsFrom(entries).size > 0) report.sessionsWithASkill += 1;
     report.flags.push(...scanSessionForViolations(id, lines, census.forbidden, entries));
@@ -6120,9 +7173,9 @@ function main12(argv) {
 }
 function _isCliEntry11() {
   if (process3.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL12(path13.resolve(process3.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL12(path16.resolve(process3.argv[1])).href) return true;
   try {
-    return fs13.realpathSync(_HERE4) === fs13.realpathSync(path13.resolve(process3.argv[1]));
+    return fs18.realpathSync(_HERE4) === fs18.realpathSync(path16.resolve(process3.argv[1]));
   } catch {
     return false;
   }
@@ -6133,20 +7186,20 @@ if (_isCliEntry11()) {
 
 // src/scripts/report_conformance_funnel.ts
 var _HERE5 = fileURLToPath13(import.meta.url);
-var REPO_ROOT5 = path14.resolve(path14.dirname(_HERE5), "..", "..");
+var REPO_ROOT5 = path17.resolve(path17.dirname(_HERE5), "..", "..");
 function buildFunnel(opts = {}) {
   const repoRoot = opts.repoRoot ?? REPO_ROOT5;
-  const projectRulesDir = opts.projectRulesDir ?? path14.join(repoRoot, PROJECT_RULES);
-  const globalRulesDir = opts.globalRulesDir ?? path14.join(os6.homedir(), GLOBAL_RULES);
-  const sourceDir = opts.sourceDir ?? path14.join(repoRoot, PROJECTION_SOURCE);
+  const projectRulesDir = opts.projectRulesDir ?? path17.join(repoRoot, PROJECT_RULES);
+  const globalRulesDir = opts.globalRulesDir ?? path17.join(os6.homedir(), GLOBAL_RULES);
+  const sourceDir = opts.sourceDir ?? path17.join(repoRoot, PROJECTION_SOURCE);
   const store = opts.store ?? defaultStore(repoRoot);
   const limit = opts.limit ?? 30;
   return {
     delivered: measureDelivered(projectRulesDir, globalRulesDir),
     divergence: compareCarriers(projectRulesDir, globalRulesDir, sourceDir),
-    skills: censusSkills(path14.join(repoRoot, SKILLS_ROOT)),
+    skills: censusSkills(path17.join(repoRoot, SKILLS_ROOT)),
     usage: measureUsage(store, limit),
-    storePresent: fs14.existsSync(store),
+    storePresent: fs19.existsSync(store),
     sk2: scanStore2(repoRoot, store, limit)
   };
 }
@@ -6287,7 +7340,7 @@ function main13(argv) {
 `);
         return 1;
       }
-      const resolved = path14.resolve(v);
+      const resolved = path17.resolve(v);
       if (a === "--store") opts.store = resolved;
       else if (a === "--project") opts.projectRulesDir = resolved;
       else if (a === "--global") opts.globalRulesDir = resolved;
@@ -6319,9 +7372,9 @@ function main13(argv) {
 }
 function _isCliEntry12() {
   if (process4.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL13(path14.resolve(process4.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL13(path17.resolve(process4.argv[1])).href) return true;
   try {
-    return fs14.realpathSync(_HERE5) === fs14.realpathSync(path14.resolve(process4.argv[1]));
+    return fs19.realpathSync(_HERE5) === fs19.realpathSync(path17.resolve(process4.argv[1]));
   } catch {
     return false;
   }
@@ -6358,20 +7411,20 @@ function conformanceLogPath() {
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path15.join(os7.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
+  return path18.join(os7.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
 }
 function installLogPath() {
   const override = process5.env["AGENT_CONFIG_INSTALL_LOG"];
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path15.join(os7.homedir(), ".event4u", "agent-config", "install-log.jsonl");
+  return path18.join(os7.homedir(), ".event4u", "agent-config", "install-log.jsonl");
 }
 function _installLogExpected(projectRoot) {
-  return fs15.existsSync(manifest_path(projectRoot));
+  return fs20.existsSync(manifest_path(projectRoot));
 }
 function _check_txlog_clean(logPath = installLogPath(), projectRoot = null) {
-  const entries = fs15.existsSync(logPath) ? readRecentEntries(logPath) : [];
+  const entries = fs20.existsSync(logPath) ? readRecentEntries(logPath) : [];
   if (entries.length === 0) {
     if (projectRoot !== null && _installLogExpected(projectRoot)) {
       return {
@@ -6405,11 +7458,11 @@ function _check_txlog_clean(logPath = installLogPath(), projectRoot = null) {
   };
 }
 function routeTargetPaths(target) {
-  return routeTargetPathsPosix(target).map((rel) => path15.join(...rel.split("/")));
+  return routeTargetPathsPosix(target).map((rel) => path18.join(...rel.split("/")));
 }
 function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
-  const routerPath = path15.join(packageRoot, "dist", "router.json");
-  if (!fs15.existsSync(routerPath)) {
+  const routerPath = path18.join(packageRoot, "dist", "router.json");
+  if (!fs20.existsSync(routerPath)) {
     return {
       id: "router-pointers",
       status: "fail",
@@ -6419,7 +7472,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   }
   let router;
   try {
-    router = JSON.parse(fs15.readFileSync(routerPath, "utf8"));
+    router = JSON.parse(fs20.readFileSync(routerPath, "utf8"));
   } catch (exc) {
     return {
       id: "router-pointers",
@@ -6428,13 +7481,13 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
       remedy: "reinstall the package \u2014 dist/router.json is corrupt"
     };
   }
-  const rulesDir = path15.join(packageRoot, "dist", "agent-src", "rules");
+  const rulesDir = path18.join(packageRoot, "dist", "agent-src", "rules");
   const broken = [];
   let ids = 0;
   let targets = 0;
   for (const kernelId of router["kernel"] ?? []) {
     ids += 1;
-    if (!fs15.existsSync(path15.join(rulesDir, `${kernelId}.md`))) {
+    if (!fs20.existsSync(path18.join(rulesDir, `${kernelId}.md`))) {
       broken.push(`kernel:${kernelId} \u2192 rules/${kernelId}.md missing`);
     }
   }
@@ -6442,7 +7495,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
     for (const entry of router[tier] ?? []) {
       const ruleId = String(entry["id"] ?? "");
       ids += 1;
-      if (!fs15.existsSync(path15.join(rulesDir, `${ruleId}.md`))) {
+      if (!fs20.existsSync(path18.join(rulesDir, `${ruleId}.md`))) {
         broken.push(`${tier}:${ruleId} \u2192 rules/${ruleId}.md missing`);
       }
       for (const target of entry["routes_to"] ?? []) {
@@ -6452,7 +7505,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
           broken.push(`${ruleId} \u2192 unparseable routes_to ${JSON.stringify(target)}`);
           continue;
         }
-        if (!candidates.some((rel) => fs15.existsSync(path15.join(packageRoot, rel)))) {
+        if (!candidates.some((rel) => fs20.existsSync(path18.join(packageRoot, rel)))) {
           broken.push(`${ruleId} \u2192 ${target} (${candidates[0]} missing)`);
         }
       }
@@ -6484,9 +7537,9 @@ function detectSmokePlatform(projectRoot) {
   return "claude";
 }
 function dispatcherRunner(packageRoot) {
-  const localTsx = path15.join(packageRoot, "node_modules", ".bin", "tsx");
-  const script = path15.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
-  if (fs15.existsSync(localTsx)) {
+  const localTsx = path18.join(packageRoot, "node_modules", ".bin", "tsx");
+  const script = path18.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
+  if (fs20.existsSync(localTsx)) {
     return [localTsx, script];
   }
   return ["npx", "tsx", script];
@@ -6536,12 +7589,12 @@ function _check_hook_dispatcher(projectRoot, packageRoot = PACKAGE_ROOT, opts =
   };
 }
 function readSettingsMode(projectRoot) {
-  const settingsPath = path15.join(projectRoot, ".agent-settings.yml");
-  if (!fs15.existsSync(settingsPath)) {
+  const settingsPath = path18.join(projectRoot, ".agent-settings.yml");
+  if (!fs20.existsSync(settingsPath)) {
     return "eager-all";
   }
   try {
-    const parsed = YAML.parse(fs15.readFileSync(settingsPath, "utf8"));
+    const parsed = YAML.parse(fs20.readFileSync(settingsPath, "utf8"));
     const lean = parsed?.["lean_projection"] ?? null;
     const mode = lean?.["mode"];
     return typeof mode === "string" && mode.length > 0 ? mode : "eager-all";
@@ -6552,7 +7605,7 @@ function readSettingsMode(projectRoot) {
 function kernelIdsFromRouter(packageRoot) {
   try {
     const router = JSON.parse(
-      fs15.readFileSync(path15.join(packageRoot, "dist", "router.json"), "utf8")
+      fs20.readFileSync(path18.join(packageRoot, "dist", "router.json"), "utf8")
     );
     return new Set((router["kernel"] ?? []).map(String));
   } catch {
@@ -6569,8 +7622,8 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
       remedy: "set lean_projection.mode to 'eager-all' or 'thin' in .agent-settings.yml"
     };
   }
-  const rulesDir = projectedRulesDir ?? path15.join(projectRoot, ".augment", "rules");
-  if (!fs15.existsSync(rulesDir)) {
+  const rulesDir = projectedRulesDir ?? path18.join(projectRoot, ".augment", "rules");
+  if (!fs20.existsSync(rulesDir)) {
     return {
       id: "lean-projection",
       status: "skipped",
@@ -6579,7 +7632,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
     };
   }
   const kernel = kernelIdsFromRouter(packageRoot);
-  const files = fs15.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
+  const files = fs20.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
   const nonKernel = files.filter((f) => !kernel.has(f.replace(/\.md$/, "")));
   if (nonKernel.length === 0) {
     return {
@@ -6593,7 +7646,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
   for (const f of nonKernel) {
     let text = "";
     try {
-      text = fs15.readFileSync(path15.join(rulesDir, f), "utf8");
+      text = fs20.readFileSync(path18.join(rulesDir, f), "utf8");
     } catch {
       continue;
     }
@@ -6624,8 +7677,8 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
 function _check_host_manifest(projectRoot) {
   const detected = Object.entries(detectToolPresence(projectRoot)).filter(([, v]) => v === true).map(([k]) => k);
   const detectedNote = detected.length > 0 ? `detected surfaces: ${detected.join(", ")}` : "no surfaces detected";
-  const settingsPath = path15.join(projectRoot, ".agent-settings.yml");
-  if (!fs15.existsSync(settingsPath)) {
+  const settingsPath = path18.join(projectRoot, ".agent-settings.yml");
+  if (!fs20.existsSync(settingsPath)) {
     return {
       id: "host-manifest",
       status: "ok",
@@ -6635,7 +7688,7 @@ function _check_host_manifest(projectRoot) {
   }
   let parsed = null;
   try {
-    parsed = YAML.parse(fs15.readFileSync(settingsPath, "utf8"));
+    parsed = YAML.parse(fs20.readFileSync(settingsPath, "utf8"));
   } catch (exc) {
     return {
       id: "host-manifest",
@@ -6809,13 +7862,13 @@ function _isCliEntry13() {
   if (process5.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL14(path15.resolve(process5.argv[1])).href;
+  const argvUrl = pathToFileURL14(path18.resolve(process5.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs15.realpathSync(fileURLToPath14(import.meta.url));
-    const argv = fs15.realpathSync(path15.resolve(process5.argv[1]));
+    const here = fs20.realpathSync(fileURLToPath14(import.meta.url));
+    const argv = fs20.realpathSync(path18.resolve(process5.argv[1]));
     return here === argv;
   } catch {
     return false;