@event4u/agent-config 16.2.0 → 16.4.0

package/dist/cli-delegate/cmd_conformance.js

@@ -1,4 +1,11 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+import {
+  THIN_ENTRY_MARKER,
+  readRecentEntries
+} from "./chunk-6YQC2HLF.js";
+import {
+  detectToolPresence
+} from "./chunk-A4QJ6ENT.js";
 import {
   NO_RED_EVIDENCE_REASON,
   deriveSessionKey,
@@ -17,17 +24,18 @@ import {
   readTurnRunState,
   sessionRefusalFile,
   sessionShadowFile,
+  shadowSetBy,
   statePathFor,
   validateAssumption
-} from "./chunk-YJ72UIAK.js";
+} from "./chunk-AED2VQGM.js";
 import {
-  readHookStdin
-} from "./chunk-F7DQWYR5.js";
-import {
-  DeadScopeError,
-  assertScanned,
-  reportScanned
-} from "./chunk-I3EIN2YG.js";
+  LexicalIndex,
+  isSqliteAvailableSync,
+  loadSqliteSync,
+  readUserVersion,
+  stampUserVersion,
+  tokenize
+} from "./chunk-ZBZV2G5R.js";
 import {
   ArgparseExit,
   STATUS_SYMBOLS,
@@ -44,16 +52,25 @@ import {
   comparePair,
   frontmatterPaths,
   proseEqual,
+  resolveSessionRole,
   splitFrontmatter
-} from "./chunk-FP36SWJD.js";
+} from "./chunk-5GPULQBE.js";
 import "./chunk-FTAISGDQ.js";
-import "./chunk-M2DPGFZ4.js";
+import "./chunk-6V6TA25H.js";
 import "./chunk-ROYYTEZU.js";
 import "./chunk-BTWUYDGN.js";
 import {
-  projectStoreSlug,
-  resolveSessionRole
-} from "./chunk-JNMVLWLR.js";
+  atomicAppendLine,
+  probeHostCapabilities
+} from "./chunk-MDPPKQCQ.js";
+import "./chunk-DMSZHXZS.js";
+import "./chunk-ULQRUR23.js";
+import {
+  hardenedSpawnEnv,
+  projectStoreSlug
+} from "./chunk-OAFSJBHH.js";
+import "./chunk-IAYTIIQW.js";
+import "./chunk-LQOCRFWT.js";
 import {
   atomic_write_json,
   atomic_write_text,
@@ -63,46 +80,48 @@ import {
   prune_legacy_state_file,
   prune_stale_session_states,
   session_state_file
-} from "./chunk-E4XIZDIB.js";
-import {
-  artefact_roots
-} from "./chunk-NUHLI2RX.js";
-import {
-  readRecentEntries
-} from "./chunk-5R7HOLAF.js";
-import {
-  detectToolPresence
-} from "./chunk-A4QJ6ENT.js";
-import {
-  atomicAppendLine,
-  probeHostCapabilities
-} from "./chunk-6KM6ORRY.js";
-import "./chunk-T7L2QK3K.js";
-import "./chunk-DMSZHXZS.js";
+} from "./chunk-7HKRE54K.js";
+import "./chunk-F3QDG2GT.js";
+import "./chunk-DEIV7XP7.js";
 import {
   manifest_path,
   read_manifest
-} from "./chunk-4E2W63DA.js";
+} from "./chunk-OKJUIAPS.js";
+import "./chunk-WQWXGIWB.js";
+import "./chunk-KB5FZ655.js";
 import "./chunk-MWRD5YOH.js";
+import "./chunk-JQOM7TTM.js";
+import {
+  DeadScopeError,
+  assertScanned,
+  reportScanned
+} from "./chunk-I3EIN2YG.js";
+import {
+  readHookStdin
+} from "./chunk-F7DQWYR5.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
+import "./chunk-LF2KKJ4Q.js";
+import {
+  load_agent_settings
+} from "./chunk-H76PHZBI.js";
+import {
+  artefact_roots
+} from "./chunk-YCU3TIXH.js";
+import "./chunk-T6BP34WI.js";
 import {
   resolvePackageRoot
 } from "./chunk-MCJYCQPF.js";
-import {
-  load_agent_settings
-} from "./chunk-FC75PGJE.js";
-import "./chunk-NDJLNC6Q.js";
 import {
   __toESM
 } from "./chunk-J55WI3RR.js";
 
 // src/scripts/_cli/cmd_conformance.ts
 var YAML = __toESM(require_dist(), 1);
-import * as fs16 from "node:fs";
+import * as fs20 from "node:fs";
 import * as os7 from "node:os";
-import * as path15 from "node:path";
+import * as path18 from "node:path";
 import process5 from "node:process";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { fileURLToPath as fileURLToPath14, pathToFileURL as pathToFileURL14 } from "node:url";
@@ -118,10 +137,10 @@ var ROUTE_TARGET_TEMPLATES = Object.freeze({
   ])
 });
 function parseRouteTarget(target) {
-  const sep2 = target.indexOf(":");
-  if (sep2 <= 0) return null;
-  const kind = target.slice(0, sep2);
-  const id = target.slice(sep2 + 1);
+  const sep4 = target.indexOf(":");
+  if (sep4 <= 0) return null;
+  const kind = target.slice(0, sep4);
+  const id = target.slice(sep4 + 1);
   if (!id) return null;
   if (!Object.prototype.hasOwnProperty.call(ROUTE_TARGET_TEMPLATES, kind)) return null;
   return { kind, id };
@@ -133,17 +152,17 @@ function routeTargetPathsPosix(target) {
 }
 
 // src/scripts/report_conformance_funnel.ts
-import * as fs15 from "node:fs";
+import * as fs19 from "node:fs";
 import * as os6 from "node:os";
-import * as path14 from "node:path";
+import * as path17 from "node:path";
 import process4 from "node:process";
 import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL13 } from "node:url";
 
 // src/scripts/conformance_scan.ts
-import { createHash as createHash3 } from "node:crypto";
-import fs11 from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
+import fs15 from "node:fs";
 import os2 from "node:os";
-import path10 from "node:path";
+import path13 from "node:path";
 import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
 
 // src/scripts/_lib/transcript_entry.ts
@@ -191,7 +210,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 // src/scripts/_lib/prompt_shape.ts
 function isSyntheticPrompt(prompt) {
   const head = prompt.trimStart().slice(0, 400);
-  return head.startsWith("[SYSTEM NOTIFICATION - NOT USER INPUT]") || head.startsWith("<task-notification>") || head.startsWith("<system-reminder>") || head.startsWith("<local-command-caveat>") || /^\[SYSTEM NOTIFICATION\b/.test(head);
+  return head.startsWith("[SYSTEM NOTIFICATION - NOT USER INPUT]") || head.startsWith("<task-notification>") || head.startsWith("<system-reminder>") || head.startsWith("<local-command-caveat>") || head.startsWith("<agent-message") || head.startsWith("Your claude.ai usage limit has reset") || /^\[SYSTEM NOTIFICATION\b/.test(head);
 }
 var DOCUMENT_HEAD = /^\s*(#{1,6}\s|-{3,}\s*$|={3,}\s*$|<[A-Za-z][\w-]*>\s*$)/;
 function humanAuthoredLead(text) {
@@ -348,7 +367,7 @@ This is the WEAKER of the two provenances \u2014 it reflects the machine, not th
   return `<language-pin>
 The user submitted this turn's prompt in ${name}. That is the mirror target for EVERY user-visible token of your replies this turn \u2014 including the short inter-tool lines between tool calls, headings, table cells, bullets, status lines, and the recommendation label under any numbered-options block.
 
-This pin exists because the trigger is not observable from the transcript alone: slash-command and skill bodies arrive in the user role and can be long and English, which is what drove the 626 wrong-language turns measured in the 30-session audit this hook was built from. Tool output, file contents, and an injected skill body are NOT the trigger \u2014 this pin is.
+Tool output, file contents, and an injected skill body are NOT the trigger \u2014 this pin is.
 </language-pin>`;
 }
 function _loadState(target) {
@@ -716,7 +735,8 @@ import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL2 } from
 // src/scripts/_lib/machine_wake.ts
 var MACHINE_WAKE_PREFIXES = [
   "<task-notification>",
-  "<system-reminder>"
+  "<system-reminder>",
+  "<agent-message"
 ];
 function humanTypedThisTurn(prompt) {
   const head = prompt.trimStart();
@@ -1927,8 +1947,8 @@ var COMMAND_OBJECTS = {
 };
 
 // src/scripts/hooks/turn_end_gate_hook.ts
-import * as fs8 from "node:fs";
-import * as path7 from "node:path";
+import * as fs12 from "node:fs";
+import * as path10 from "node:path";
 import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL6 } from "node:url";
 
 // src/scripts/check_reply_consistency.ts
@@ -2307,6 +2327,957 @@ function detectDroppedDecision(assistantTurnTexts, closingFromPayload = false) {
   return null;
 }
 
+// src/scripts/_lib/graph_feeder_record.ts
+import * as fs7 from "node:fs";
+import * as path6 from "node:path";
+
+// src/scripts/code_graph/detect.ts
+import { execFileSync } from "node:child_process";
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+
+// src/scripts/code_graph/types.ts
+var GUESS_RESOLVED_VIA = /* @__PURE__ */ new Set([
+  "name-lookup",
+  "dynamic",
+  // The accepted-edge filter is a DENYLIST, so a new value is accepted by
+  // default — which is exactly backwards for this one. `foreign` must be
+  // listed here or a consumer's graph would silently answer the gate verbs
+  // as if this package had resolved its edges.
+  "foreign"
+]);
+function isStatedResolution(resolved_via) {
+  return !GUESS_RESOLVED_VIA.has(resolved_via);
+}
+var SCHEMA_VERSION = 4;
+var EXT_LANG = {
+  ".php": "php",
+  ".ts": "typescript",
+  ".tsx": "typescript",
+  ".mts": "typescript",
+  ".cts": "typescript",
+  ".js": "javascript",
+  ".jsx": "javascript",
+  ".mjs": "javascript",
+  ".cjs": "javascript"
+};
+
+// src/scripts/code_graph/validate.ts
+var RELATIONS = /* @__PURE__ */ new Set(["calls", "imports", "uses", "inherits", "member", "tests"]);
+var CONFIDENCES = /* @__PURE__ */ new Set(["EXTRACTED", "INFERRED", "AMBIGUOUS"]);
+var RESOLVED_VIA = /* @__PURE__ */ new Set([
+  "same-file",
+  "import-specifier",
+  "path-alias",
+  "psr4",
+  "route-table",
+  "test-import",
+  "name-lookup",
+  "dynamic",
+  // Adapted from a consumer's own graph file; see `foreign.ts`.
+  "foreign"
+]);
+var PROVIDERS = /* @__PURE__ */ new Set(["native", "foreign"]);
+var KINDS = /* @__PURE__ */ new Set([
+  "file",
+  "class",
+  "interface",
+  "trait",
+  "function",
+  "method",
+  "constant",
+  "type",
+  "enum",
+  "skipped"
+]);
+function validateGraph(g) {
+  const errors = [];
+  const push = (m) => {
+    if (errors.length < 50) errors.push(m);
+  };
+  if (typeof g !== "object" || g === null) return { ok: false, errors: ["graph is not an object"] };
+  const obj = g;
+  if (typeof obj["schema_version"] !== "number") push("schema_version must be a number");
+  if (typeof obj["source_checksum"] !== "string") push("source_checksum must be a string");
+  if (!Array.isArray(obj["nodes"])) push("nodes must be an array");
+  if (!Array.isArray(obj["edges"])) push("edges must be an array");
+  if (errors.length) return { ok: false, errors };
+  const nodes = obj["nodes"];
+  const ids = /* @__PURE__ */ new Set();
+  nodes.forEach((n, i) => {
+    if (typeof n !== "object" || n === null) return push(`node[${i}] not an object`);
+    const nn = n;
+    if (typeof nn["id"] !== "string") push(`node[${i}].id must be a string`);
+    else ids.add(nn["id"]);
+    if (!KINDS.has(nn["kind"])) push(`node[${i}].kind invalid: ${String(nn["kind"])}`);
+    if (typeof nn["source_file"] !== "string") push(`node[${i}].source_file must be a string`);
+    if (!Array.isArray(nn["source_location"])) push(`node[${i}].source_location must be an array`);
+  });
+  obj["edges"].forEach((e, i) => {
+    if (typeof e !== "object" || e === null) return push(`edge[${i}] not an object`);
+    const ee = e;
+    if (typeof ee["source"] !== "string") push(`edge[${i}].source must be a string`);
+    if (typeof ee["target"] !== "string") push(`edge[${i}].target must be a string`);
+    if (!RELATIONS.has(ee["relation"])) push(`edge[${i}].relation invalid: ${String(ee["relation"])}`);
+    if (!CONFIDENCES.has(ee["confidence"]))
+      push(`edge[${i}].confidence invalid: ${String(ee["confidence"])}`);
+    if (ee["resolved_via"] === void 0) push(`edge[${i}].resolved_via is required`);
+    else if (!RESOLVED_VIA.has(ee["resolved_via"]))
+      push(`edge[${i}].resolved_via invalid: ${String(ee["resolved_via"])}`);
+    if (ee["provider"] === void 0) push(`edge[${i}].provider is required`);
+    else if (!PROVIDERS.has(ee["provider"]))
+      push(`edge[${i}].provider invalid: ${String(ee["provider"])}`);
+    if (typeof ee["source"] === "string" && !ids.has(ee["source"]))
+      push(`edge[${i}].source is not a known node: ${String(ee["source"])}`);
+    if (ee["candidates"] !== void 0 && !Array.isArray(ee["candidates"]))
+      push(`edge[${i}].candidates must be an array when present`);
+  });
+  return { ok: errors.length === 0, errors };
+}
+
+// src/scripts/code_graph/detect.ts
+var CONSUMER_CANDIDATES = ["graph.json", "code-graph.json", ".code-graph/graph.json"];
+function consumerCandidates(root) {
+  let declared;
+  try {
+    const settings = load_agent_settings({ cwd: root }) ?? {};
+    const section = settings["code_graph"];
+    declared = section !== null && typeof section === "object" && !Array.isArray(section) ? section["consumer_index_paths"] : void 0;
+  } catch {
+    declared = void 0;
+  }
+  const extra = Array.isArray(declared) ? declared.filter(
+    (p) => typeof p === "string" && p !== "" && !path4.isAbsolute(p) && !path4.normalize(p).startsWith("..")
+  ) : [];
+  return [...CONSUMER_CANDIDATES, ...extra.filter((p) => !CONSUMER_CANDIDATES.includes(p))];
+}
+function gitLastCommitEpoch(root) {
+  try {
+    const out = execFileSync("git", ["-C", root, "log", "-1", "--format=%ct"], {
+      env: hardenedSpawnEnv(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const n = Number(out);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+}
+function commitsBehind(root, sha) {
+  try {
+    const out = execFileSync("git", ["-C", root, "rev-list", "--count", `${sha}..HEAD`], {
+      env: hardenedSpawnEnv(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const n = Number(out);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+}
+function freshness(root, file, embeddedSha) {
+  if (embeddedSha) {
+    const behind = commitsBehind(root, embeddedSha);
+    if (behind !== null) return { stale: behind > 0, commits_behind: behind };
+  }
+  const last = gitLastCommitEpoch(root);
+  if (last === null) return {};
+  try {
+    const mtime = Math.floor(fs4.statSync(file).mtimeMs / 1e3);
+    return { stale: mtime < last };
+  } catch {
+    return {};
+  }
+}
+function looksLikeGraph(p) {
+  try {
+    const raw = JSON.parse(fs4.readFileSync(p, "utf-8"));
+    if (validateGraph(raw).ok) return { ok: true, sha: raw["head_at_build"] ?? null };
+    const nodes = raw["nodes"];
+    const edges = raw["edges"] ?? raw["links"];
+    const okShape = Array.isArray(nodes) && Array.isArray(edges) && (edges.length === 0 || typeof edges[0] === "object" && edges[0] !== null && "source" in edges[0] && "target" in edges[0]);
+    return { ok: okShape, sha: raw["head_at_build"] ?? null };
+  } catch {
+    return { ok: false, sha: null };
+  }
+}
+function detectSources(root, nativeCache) {
+  const abs = path4.resolve(root);
+  const out = [];
+  for (const rel of consumerCandidates(abs)) {
+    const p = path4.join(abs, rel);
+    if (fs4.existsSync(p)) {
+      const { ok, sha } = looksLikeGraph(p);
+      if (ok) out.push({ kind: "consumer", path: p, present: true, ...freshness(abs, p, sha) });
+    }
+  }
+  const scipCandidates = [path4.join(abs, "index.scip")];
+  try {
+    for (const e of fs4.readdirSync(abs)) if (e.endsWith(".scip")) scipCandidates.push(path4.join(abs, e));
+  } catch {
+  }
+  const scip = scipCandidates.find((p) => fs4.existsSync(p));
+  if (scip) out.push({ kind: "scip", path: scip, present: true, note: "SCIP detected \u2014 peer tooling required (no owned reader)" });
+  if (fs4.existsSync(nativeCache)) out.push({ kind: "native", path: nativeCache, present: true, ...freshness(abs, nativeCache, null) });
+  return out;
+}
+function pickSource(verdicts) {
+  const consumer = verdicts.find((v) => v.kind === "consumer" && v.stale !== true);
+  if (consumer) return consumer;
+  const native = verdicts.find((v) => v.kind === "native");
+  if (native) return native;
+  return verdicts.find((v) => v.kind === "consumer") ?? null;
+}
+var NATIVE_CACHE_REL = path4.join("agents", "runtime", "state", "code-graph-v1.json");
+function hasUncommittedIndexedEdit(root) {
+  let out;
+  try {
+    out = execFileSync("git", ["-C", root, "status", "--porcelain", "--untracked-files=all"], {
+      env: hardenedSpawnEnv(),
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      // Both bounds are the review's: Node's 1 MB default would throw
+      // ENOBUFS on a large working tree, the catch below would return
+      // false, and the state would read `fresh` — a second silent
+      // under-report on a probe that runs at PreToolUse and at every stop.
+      // The timeout bounds the other failure: this probe sits in front of
+      // a tool call, so a hung git must not hold one up.
+      maxBuffer: 32 * 1024 * 1024,
+      timeout: 5e3
+    });
+  } catch {
+    return false;
+  }
+  for (const raw of out.split("\n")) {
+    if (raw.length < 4) continue;
+    let p = raw.slice(3);
+    const arrow = p.indexOf(" -> ");
+    if (arrow !== -1) p = p.slice(arrow + 4);
+    p = p.trim().replace(/^"|"$/g, "");
+    const dot = p.lastIndexOf(".");
+    if (dot === -1) continue;
+    if (p.slice(dot).toLowerCase() in EXT_LANG) return true;
+  }
+  return false;
+}
+function graphState(root, nativeCache) {
+  const picked = pickSource(detectSources(root, nativeCache ?? path4.join(root, NATIVE_CACHE_REL)));
+  if (!picked) return "absent";
+  if (picked.stale === true) {
+    const behind = picked.commits_behind;
+    return `behind:${typeof behind === "number" ? behind : 0}`;
+  }
+  return hasUncommittedIndexedEdit(root) ? "edited" : "fresh";
+}
+
+// src/scripts/code_graph/query.ts
+import * as fs6 from "node:fs";
+
+// src/scripts/code_graph/sqlite_store.ts
+import * as fs5 from "node:fs";
+var GRAPH_STORE_VERSION = 4;
+var INDEXED_READ_MIN_EDGES = 5e4;
+function sqliteTwinPath(jsonPath) {
+  return jsonPath.endsWith(".json") ? `${jsonPath.slice(0, -5)}.sqlite3` : `${jsonPath}.sqlite3`;
+}
+function emitSqliteTwin(graph, serialized, jsonPath) {
+  if (!isSqliteAvailableSync()) return false;
+  const twin = sqliteTwinPath(jsonPath);
+  const tmp = `${twin}.tmp-${process.pid}`;
+  try {
+    const { DatabaseSync } = loadSqliteSync("code_graph.sqlite_store");
+    let stat;
+    try {
+      stat = fs5.statSync(jsonPath);
+    } catch {
+      return false;
+    }
+    fs5.rmSync(tmp, { force: true });
+    const db = new DatabaseSync(tmp);
+    try {
+      db.exec("PRAGMA journal_mode = MEMORY");
+      db.exec(
+        "CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);CREATE TABLE nodes (id TEXT PRIMARY KEY, label TEXT NOT NULL, kind TEXT, source_file TEXT, l0 INTEGER, l1 INTEGER, l2 INTEGER, l3 INTEGER);CREATE TABLE edges (source TEXT NOT NULL, target TEXT NOT NULL, relation TEXT NOT NULL, confidence TEXT NOT NULL, candidates TEXT, ambiguity_reason TEXT, resolved_via TEXT, provider TEXT);CREATE INDEX edges_source ON edges(source);CREATE INDEX edges_target ON edges(target);CREATE INDEX nodes_label ON nodes(label);CREATE INDEX nodes_source_file ON nodes(source_file);"
+      );
+      const meta = db.prepare("INSERT INTO meta (key, value) VALUES (?, ?)");
+      meta.run("source_checksum", graph.source_checksum);
+      meta.run("json_size", String(stat.size));
+      meta.run("json_mtime_ms", String(stat.mtimeMs));
+      meta.run("graph_json", serialized);
+      meta.run("node_count", String(graph.nodes.length));
+      meta.run("edge_count", String(graph.edges.length));
+      const insNode = db.prepare(
+        "INSERT INTO nodes (id, label, kind, source_file, l0, l1, l2, l3) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
+      );
+      for (const n of graph.nodes) {
+        const loc = n.source_location ?? [];
+        insNode.run(
+          n.id,
+          n.label,
+          n.kind ?? null,
+          n.source_file ?? null,
+          loc[0] ?? null,
+          loc[1] ?? null,
+          loc[2] ?? null,
+          loc[3] ?? null
+        );
+      }
+      const insEdge = db.prepare(
+        "INSERT INTO edges (source, target, relation, confidence, candidates, ambiguity_reason, resolved_via, provider) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
+      );
+      for (const e of graph.edges) {
+        insEdge.run(
+          e.source,
+          e.target,
+          e.relation,
+          e.confidence,
+          e.candidates ? JSON.stringify(e.candidates) : null,
+          e.ambiguity_reason ?? null,
+          e.resolved_via,
+          e.provider
+        );
+      }
+      stampUserVersion(db, GRAPH_STORE_VERSION);
+    } finally {
+      db.close();
+    }
+    fs5.renameSync(tmp, twin);
+    return true;
+  } catch {
+    fs5.rmSync(tmp, { force: true });
+    return false;
+  }
+}
+function loadSerializedFromTwin(jsonPath) {
+  if (!isSqliteAvailableSync()) return null;
+  const twin = sqliteTwinPath(jsonPath);
+  if (!fs5.existsSync(twin)) return null;
+  let stat;
+  try {
+    stat = fs5.statSync(jsonPath);
+  } catch {
+    return null;
+  }
+  try {
+    const { DatabaseSync } = loadSqliteSync("code_graph.sqlite_store");
+    const db = new DatabaseSync(twin, { readOnly: true });
+    try {
+      if (readUserVersion(db) !== GRAPH_STORE_VERSION) return null;
+      const rows = db.prepare("SELECT key, value FROM meta").all();
+      const meta = new Map(rows.map((r) => [r.key, r.value]));
+      if (meta.get("json_size") !== String(stat.size)) return null;
+      if (meta.get("json_mtime_ms") !== String(stat.mtimeMs)) return null;
+      const serialized = meta.get("graph_json");
+      return serialized && serialized.length > 0 ? serialized : null;
+    } finally {
+      db.close();
+    }
+  } catch {
+    fs5.rmSync(twin, { force: true });
+    return null;
+  }
+}
+function toNode(r) {
+  const loc = [r.l0, r.l1, r.l2, r.l3].filter((v) => typeof v === "number");
+  return {
+    id: r.id,
+    label: r.label,
+    kind: r.kind ?? "file",
+    source_file: r.source_file ?? "",
+    source_location: loc
+  };
+}
+function toEdge(r) {
+  const e = {
+    source: r.source,
+    target: r.target,
+    relation: r.relation,
+    confidence: r.confidence,
+    // The SQL columns are nullable, the TypeScript fields are not. A null
+    // can only come from a twin emitted before these fields existed, which
+    // GRAPH_STORE_VERSION already refuses — so this coalesce is unreachable
+    // in a healthy tree and is written to fail READABLE rather than to
+    // fabricate: `name-lookup` is the weakest mechanism, so a mislabelled
+    // edge is under-trusted rather than over-trusted by Phase 3's filter.
+    resolved_via: r.resolved_via ?? "name-lookup",
+    provider: r.provider ?? "native"
+  };
+  if (r.candidates) e.candidates = JSON.parse(r.candidates);
+  if (r.ambiguity_reason === "receiver-unknown" || r.ambiguity_reason === "hierarchy-unresolved") {
+    e.ambiguity_reason = r.ambiguity_reason;
+  }
+  return e;
+}
+function openGraphIndex(jsonPath) {
+  if (!isSqliteAvailableSync()) return null;
+  const twin = sqliteTwinPath(jsonPath);
+  if (!fs5.existsSync(twin)) return null;
+  let stat;
+  try {
+    stat = fs5.statSync(jsonPath);
+  } catch {
+    return null;
+  }
+  try {
+    const { DatabaseSync } = loadSqliteSync("code_graph.sqlite_store");
+    const db = new DatabaseSync(twin, { readOnly: true });
+    try {
+      if (readUserVersion(db) !== GRAPH_STORE_VERSION) {
+        db.close();
+        return null;
+      }
+      const rows = db.prepare("SELECT key, value FROM meta").all();
+      const meta = new Map(rows.map((r) => [r.key, r.value]));
+      if (meta.get("json_size") !== String(stat.size) || meta.get("json_mtime_ms") !== String(stat.mtimeMs)) {
+        db.close();
+        return null;
+      }
+      const nodeCount = Number(meta.get("node_count") ?? NaN);
+      const edgeCount = Number(meta.get("edge_count") ?? NaN);
+      if (!Number.isFinite(nodeCount) || !Number.isFinite(edgeCount)) {
+        db.close();
+        return null;
+      }
+      const qNode = db.prepare("SELECT * FROM nodes WHERE id = ?");
+      const qFrom = db.prepare("SELECT * FROM edges WHERE source = ?");
+      const qTo = db.prepare("SELECT * FROM edges WHERE target = ?");
+      const qLabel = db.prepare("SELECT id FROM nodes WHERE label = ? LIMIT ?");
+      return {
+        nodeCount,
+        edgeCount,
+        sourceChecksum: meta.get("source_checksum") ?? "",
+        getNode(id) {
+          const r = qNode.get(id);
+          return r ? toNode(r) : void 0;
+        },
+        hasNode(id) {
+          return qNode.get(id) !== void 0;
+        },
+        edgesFrom(id) {
+          return qFrom.all(id).map(toEdge);
+        },
+        edgesTo(id) {
+          return qTo.all(id).map(toEdge);
+        },
+        idsByLabel(labelText, limit) {
+          return qLabel.all(labelText, limit).map((r) => r.id);
+        },
+        idsInFiles(files) {
+          if (files.length === 0) return [];
+          const out = [];
+          const CHUNK = 400;
+          for (let i = 0; i < files.length; i += CHUNK) {
+            const slice = files.slice(i, i + CHUNK);
+            const marks = slice.map(() => "?").join(",");
+            const stmt = db.prepare(
+              `SELECT id FROM nodes WHERE kind != 'file' AND source_file IN (${marks})`
+            );
+            for (const r of stmt.all(...slice)) out.push(r.id);
+          }
+          return out;
+        },
+        allNodeIds() {
+          return db.prepare("SELECT id FROM nodes ORDER BY id").all().map(
+            (r) => r.id
+          );
+        },
+        lexicalCorpus() {
+          return db.prepare("SELECT id, label FROM nodes").all().map(
+            (r) => ({ id: r.id, text: `${r.label} ${r.id}` })
+          );
+        },
+        close() {
+          db.close();
+        }
+      };
+    } catch (err) {
+      db.close();
+      throw err;
+    }
+  } catch {
+    return null;
+  }
+}
+
+// src/scripts/code_graph/foreign.ts
+import { createHash } from "node:crypto";
+var RELATION_MAP = {
+  calls: "calls",
+  call: "calls",
+  invokes: "calls",
+  imports: "imports",
+  import: "imports",
+  requires: "imports",
+  uses: "uses",
+  use: "uses",
+  references: "uses",
+  inherits: "inherits",
+  extends: "inherits",
+  implements: "inherits",
+  member: "member",
+  contains: "member",
+  tests: "tests",
+  test: "tests"
+};
+var KINDS2 = /* @__PURE__ */ new Set([
+  "file",
+  "class",
+  "interface",
+  "trait",
+  "function",
+  "method",
+  "constant",
+  "type",
+  "enum",
+  "skipped"
+]);
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function looksForeign(doc) {
+  if (!isObject(doc)) return false;
+  if (!Array.isArray(doc["nodes"])) return false;
+  if (Array.isArray(doc["links"])) return true;
+  return Array.isArray(doc["edges"]) && typeof doc["schema_version"] !== "number";
+}
+function adaptForeignGraph(doc) {
+  if (!isObject(doc)) return null;
+  const rawNodes = doc["nodes"];
+  const rawEdges = doc["links"] ?? doc["edges"];
+  if (!Array.isArray(rawNodes) || !Array.isArray(rawEdges)) return null;
+  const nodes = [];
+  const ids = /* @__PURE__ */ new Set();
+  for (const n of rawNodes) {
+    if (!isObject(n)) continue;
+    const id = n["id"];
+    if (typeof id !== "string" || id === "") continue;
+    const kind = typeof n["kind"] === "string" && KINDS2.has(n["kind"]) ? n["kind"] : "skipped";
+    const sourceFile = typeof n["source_file"] === "string" ? n["source_file"] : typeof n["file"] === "string" ? n["file"] : "";
+    nodes.push({
+      id,
+      label: typeof n["label"] === "string" ? n["label"] : id,
+      kind,
+      source_file: sourceFile,
+      // A foreign node rarely carries a span. An empty one is honest —
+      // it says "no location recorded", where a fabricated [1,1] would
+      // point a reader at the top of a file for no reason.
+      source_location: Array.isArray(n["source_location"]) ? n["source_location"] : []
+    });
+    ids.add(id);
+  }
+  const edges = [];
+  const unmapped = {};
+  let malformed = 0;
+  for (const e of rawEdges) {
+    if (!isObject(e)) {
+      malformed += 1;
+      continue;
+    }
+    const source = e["source"];
+    const target = e["target"];
+    if (typeof source !== "string" || typeof target !== "string" || !ids.has(source)) {
+      malformed += 1;
+      continue;
+    }
+    const rawRelation = typeof e["relation"] === "string" ? e["relation"] : "";
+    const relation = RELATION_MAP[rawRelation.toLowerCase()];
+    if (relation === void 0) {
+      const key = rawRelation === "" ? "(none)" : rawRelation;
+      unmapped[key] = (unmapped[key] ?? 0) + 1;
+      continue;
+    }
+    edges.push({
+      source,
+      target,
+      relation,
+      // Not EXTRACTED: this package did not extract it and cannot say
+      // how the tool that did arrived at it.
+      confidence: "AMBIGUOUS",
+      resolved_via: "foreign",
+      provider: "foreign"
+    });
+  }
+  const counts = { EXTRACTED: 0, INFERRED: 0, AMBIGUOUS: edges.length };
+  const graph = {
+    schema_version: SCHEMA_VERSION,
+    source_checksum: createHash("sha256").update(JSON.stringify(doc), "utf-8").digest("hex"),
+    languages: [],
+    grammar_abi: 0,
+    edge_confidence_counts: counts,
+    suppressed_edge_counts: { dynamic_no_candidate: 0 },
+    nodes,
+    edges
+  };
+  return { graph, unmapped_relations: unmapped, malformed_edges: malformed };
+}
+
+// src/scripts/code_graph/query.ts
+function indexBackedGraph(index, source, answeredBy) {
+  const nodeCache = /* @__PURE__ */ new Map();
+  const readNode = (id) => {
+    if (nodeCache.has(id)) return nodeCache.get(id);
+    const n = index.getNode(id);
+    nodeCache.set(id, n);
+    return n;
+  };
+  let lexical = null;
+  return {
+    graph: null,
+    source,
+    answeredBy,
+    byId: { get: readNode, has: (id) => readNode(id) !== void 0 },
+    out: { get: (id) => index.edgesFrom(id) },
+    in: { get: (id) => index.edgesTo(id) },
+    idsByLabel: (labelText, limit) => index.idsByLabel(labelText, limit),
+    idsInFiles: (files) => index.idsInFiles(files),
+    allNodeIds: () => index.allNodeIds(),
+    lex: () => {
+      lexical ??= new LexicalIndex(index.lexicalCorpus());
+      return lexical;
+    },
+    close: () => index.close()
+  };
+}
+function loadGraph(graphPath, source = graphPath) {
+  const index = openGraphIndex(graphPath);
+  if (index) {
+    if (index.edgeCount >= INDEXED_READ_MIN_EDGES) return indexBackedGraph(index, source, graphPath);
+    index.close();
+  }
+  const fromTwin = loadSerializedFromTwin(graphPath);
+  const raw = fromTwin ?? fs6.readFileSync(graphPath, "utf-8");
+  const parsed = JSON.parse(raw);
+  let foreignAdapted = false;
+  let candidate = parsed;
+  if (looksForeign(parsed)) {
+    const adapted = adaptForeignGraph(parsed);
+    if (adapted !== null) {
+      candidate = adapted.graph;
+      foreignAdapted = true;
+    }
+  }
+  const v = validateGraph(candidate);
+  if (!v.ok) throw new Error(`invalid graph at ${graphPath}: ${v.errors.slice(0, 3).join("; ")}`);
+  const graph = candidate;
+  if (fromTwin === null && !foreignAdapted) {
+    emitSqliteTwin(graph, raw, graphPath);
+  }
+  const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+  const outM = /* @__PURE__ */ new Map();
+  const inM = /* @__PURE__ */ new Map();
+  const add = (m, k, e) => {
+    const arr = m.get(k);
+    if (arr) arr.push(e);
+    else m.set(k, [e]);
+  };
+  for (const e of graph.edges) {
+    add(outM, e.source, e);
+    add(inM, e.target, e);
+  }
+  const lex = new LexicalIndex(graph.nodes.map((n) => ({ id: n.id, text: `${n.label} ${n.id}` })));
+  return {
+    graph,
+    source,
+    answeredBy: graphPath,
+    byId,
+    out: outM,
+    in: inM,
+    idsByLabel: (labelText, limit) => graph.nodes.filter((n) => n.label === labelText).slice(0, limit).map((n) => n.id),
+    idsInFiles: (files) => {
+      const set = new Set(files);
+      return graph.nodes.filter((n) => set.has(n.source_file) && n.kind !== "file").map((n) => n.id);
+    },
+    allNodeIds: () => graph.nodes.map((n) => n.id).sort((a, b) => a < b ? -1 : a > b ? 1 : 0),
+    lex: () => lex,
+    close: () => {
+    }
+  };
+}
+function resolveSeedsTiered(g, seed, limit = 5) {
+  if (g.byId.has(seed)) return { ids: [seed], weak: false };
+  const exactLabel = g.idsByLabel(seed, limit);
+  if (exactLabel.length) return { ids: exactLabel, weak: false };
+  const ranked = g.lex().rank(tokenize(seed)).filter((r) => r.score > 0);
+  return { ids: ranked.slice(0, limit).map((r) => r.id), weak: true };
+}
+function resolveSeeds(g, seed, limit = 5) {
+  return resolveSeedsTiered(g, seed, limit).ids;
+}
+
+// src/scripts/code_graph/verbs.ts
+import * as path5 from "node:path";
+function isAcceptedEdge(e) {
+  return isStatedResolution(e.resolved_via);
+}
+function foreignRefusal(g) {
+  const edges = g.graph?.edges ?? [];
+  if (edges.length === 0) return null;
+  if (!edges.every((e) => e.resolved_via === "foreign")) return null;
+  return 'every edge in this graph was read from a file this package did not build, so all of them are guesses and none is gate-grade. A gate verb would accept no edge and report an empty answer, which reads as "nothing found" rather than "nothing trusted". Build a native graph (`agent-config graph build`) to use this verb, or use `query` and `explain`, which answer from foreign edges and say so.';
+}
+function viaHistogram(edges) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const e of edges) counts.set(e.resolved_via, (counts.get(e.resolved_via) ?? 0) + 1);
+  if (counts.size === 0) return "(none)";
+  return [...counts.entries()].sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1)).map(([via, n]) => `${via} ${n}`).join(" \xB7 ");
+}
+function readFor(g, id) {
+  const n = g.byId.get(id);
+  if (!n) return null;
+  const loc = n.source_location;
+  return { path: n.source_file, lines: loc.length >= 3 ? [loc[0], loc[2]] : null };
+}
+function dedupeReads(reads) {
+  const m = /* @__PURE__ */ new Map();
+  for (const r of reads) {
+    if (!r) continue;
+    m.set(r.lines ? `${r.path}:${r.lines[0]}-${r.lines[1]}` : r.path, r);
+  }
+  return [...m.values()];
+}
+function seedsForFiles(g, files) {
+  const symbols = g.idsInFiles(files);
+  const seeds = new Set(symbols);
+  const unresolved = [];
+  const notIndexed = [];
+  for (const f of files) {
+    if (g.byId.has(f)) {
+      seeds.add(f);
+      continue;
+    }
+    if (symbols.some((s) => s.startsWith(`${f}#`))) continue;
+    if (EXT_LANG[path5.extname(f).toLowerCase()] === void 0) notIndexed.push(f);
+    else unresolved.push(f);
+  }
+  return {
+    seeds: [...seeds].sort(),
+    unresolved: unresolved.sort(),
+    not_indexed: notIndexed.sort()
+  };
+}
+function testsFor(g, symbol, state) {
+  const seeds = resolveSeeds(g, symbol);
+  const targets = new Set(seeds);
+  for (const s of seeds) {
+    const f = g.byId.get(s)?.source_file;
+    if (f && g.byId.has(f)) targets.add(f);
+  }
+  const accepted = [];
+  const rejected = [];
+  const tests = /* @__PURE__ */ new Set();
+  for (const t of targets) {
+    for (const e of g.in.get(t) ?? []) {
+      if (e.relation !== "tests") continue;
+      if (!isAcceptedEdge(e)) {
+        rejected.push(e);
+        continue;
+      }
+      accepted.push(e);
+      tests.add(e.source);
+    }
+  }
+  const list = [...tests].sort();
+  return {
+    source: g.source,
+    state,
+    accepted_via: viaHistogram(accepted),
+    rejected_via: viaHistogram(rejected),
+    seeds,
+    tests: list,
+    accepted_edges: accepted,
+    rejected_edges: rejected,
+    lines: list,
+    recommended_reads: dedupeReads(list.map((t) => readFor(g, t)))
+  };
+}
+function untested(g, files, state) {
+  const foreign = foreignRefusal(g);
+  if (foreign !== null) {
+    return {
+      source: g.source,
+      state,
+      accepted_via: "(none)",
+      rejected_via: "(none)",
+      refusal: foreign,
+      refusal_reason: "foreign-edges-not-accepted",
+      seeds: [],
+      unresolved_files: [],
+      not_indexed_files: [],
+      untested: [],
+      tested: [],
+      lines: [],
+      recommended_reads: []
+    };
+  }
+  const { seeds, unresolved, not_indexed } = seedsForFiles(g, files);
+  const accepted = [];
+  const rejected = [];
+  const tested = [];
+  const bare = [];
+  for (const s of seeds) {
+    if (g.byId.get(s)?.kind === "file") continue;
+    const r = testsFor(g, s, state);
+    accepted.push(...r.accepted_edges);
+    rejected.push(...r.rejected_edges);
+    if (r.tests.length) tested.push(s);
+    else bare.push(s);
+  }
+  return {
+    source: g.source,
+    state,
+    accepted_via: viaHistogram(accepted),
+    rejected_via: viaHistogram(rejected),
+    refusal: null,
+    refusal_reason: null,
+    seeds,
+    unresolved_files: unresolved,
+    not_indexed_files: not_indexed,
+    untested: bare.sort(),
+    tested: tested.sort(),
+    lines: bare.sort(),
+    recommended_reads: dedupeReads(bare.map((b) => readFor(g, b)))
+  };
+}
+
+// src/scripts/_lib/graph_feeder_record.ts
+var MAX_PATHS = 5;
+var OUTSIDE_WORKSPACE = "<outside-workspace>";
+var MAX_ROWS_PER_SESSION = 200;
+function feederFile(workspaceRoot, sessionKey) {
+  return path6.join(workspaceRoot, "agents", "state", "graph-feeder", `${sessionKey}.jsonl`);
+}
+function toRepoRelative(root, paths) {
+  let realRoot = null;
+  return paths.map((p) => {
+    if (!path6.isAbsolute(p)) return p;
+    const raw = _relativeInside(root, p);
+    if (raw !== null) return raw;
+    realRoot ??= _resolveReal(root);
+    return _relativeInside(realRoot, _resolveReal(p)) ?? p;
+  });
+}
+function _relativeInside(from, to) {
+  let rel;
+  try {
+    rel = path6.relative(from, to);
+  } catch {
+    return null;
+  }
+  if (rel === "") return ".";
+  if (rel === ".." || rel.startsWith(`..${path6.sep}`) || path6.isAbsolute(rel)) return null;
+  return rel.split(path6.sep).join("/");
+}
+function _resolveReal(p) {
+  const abs = path6.resolve(p);
+  const tail = [];
+  let cur = abs;
+  for (; ; ) {
+    try {
+      const real = fs7.realpathSync(cur);
+      return tail.length === 0 ? real : path6.join(real, ...[...tail].reverse());
+    } catch {
+      const parent = path6.dirname(cur);
+      if (parent === cur) return abs;
+      tail.push(path6.basename(cur));
+      cur = parent;
+    }
+  }
+}
+function _escapesWorkspace(p) {
+  return path6.isAbsolute(p) || path6.win32.isAbsolute(p) || p === ".." || p.startsWith("../") || p.startsWith(`..${path6.sep}`);
+}
+function graphUntestedVerdict(root, state, paths) {
+  const none = { verdict: null, untested: 0, tested: 0 };
+  if (state !== "fresh" && state !== "edited") return none;
+  if (paths.length === 0) return none;
+  let picked;
+  try {
+    picked = pickSource(detectSources(root, path6.join(root, NATIVE_CACHE_REL)));
+  } catch {
+    return none;
+  }
+  if (!picked || picked.kind === "scip") return none;
+  let g;
+  try {
+    g = loadGraph(picked.path, `${picked.kind}:${path6.relative(root, picked.path)}`);
+  } catch {
+    return none;
+  }
+  try {
+    const r = untested(g, toRepoRelative(root, paths), state);
+    if (r.seeds.length === 0) return { verdict: "no-seeds", untested: 0, tested: 0 };
+    return {
+      verdict: r.untested.length > 0 ? "untested" : "tested",
+      untested: r.untested.length,
+      tested: r.tested.length
+    };
+  } catch {
+    return none;
+  } finally {
+    try {
+      g.close();
+    } catch {
+    }
+  }
+}
+function appendFeederRow(workspaceRoot, sessionKey, row) {
+  try {
+    const file = feederFile(workspaceRoot, sessionKey);
+    let existing = 0;
+    try {
+      existing = fs7.readFileSync(file, "utf-8").split("\n").filter((l) => l.trim() !== "").length;
+    } catch {
+    }
+    if (existing >= MAX_ROWS_PER_SESSION) return;
+    fs7.mkdirSync(path6.dirname(file), { recursive: true });
+    fs7.appendFileSync(file, `${JSON.stringify(row)}
+`);
+  } catch {
+  }
+}
+function buildFeederRow(input) {
+  return {
+    at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+    turn: input.turn,
+    layer: input.layer,
+    graph_state: input.state,
+    f: input.fFired,
+    f_mode: input.fMode,
+    graph: input.graph.verdict,
+    graph_untested: input.graph.untested,
+    graph_tested: input.graph.tested,
+    // An out-of-workspace edit is REDACTED, not dropped and not stored
+    // verbatim. After relativising, a still-absolute path is exactly one
+    // that lay outside the root.
+    //
+    // Verbatim is an egress surface: `paths` is handed to external council
+    // seats at step 3.3's labelling, and a home-rooted path names a real
+    // user and an unrelated project.
+    //
+    // Dropping it looked right and was worse, which a completion review
+    // caught before it shipped. It would have shortened `paths` below
+    // `path_count` and so reused the protocol's truncation signal for a
+    // second, different cause — two meanings on one wire, with no field
+    // separating them. Worse, a turn editing one in-repo file and one file
+    // outside the root would then be excluded from labelling altogether,
+    // losing a perfectly labellable in-repo path from a corpus that is
+    // blocked precisely for want of rows.
+    //
+    // The marker keeps the lengths equal, so truncation stays the only
+    // cause of `path_count > paths.length`; keeps the row honest that an
+    // edit happened outside the tree, so a labeller can answer
+    // `cannot tell` rather than be silently misled; and carries nothing
+    // identifying. The graph's answer is unchanged either way — the probe
+    // sees the real path and resolves no seeds for it.
+    paths: toRepoRelative(input.root, input.paths.slice(0, MAX_PATHS)).map(
+      (p) => _escapesWorkspace(p) ? OUTSIDE_WORKSPACE : p
+    ),
+    path_count: input.paths.length
+  };
+}
+
 // src/scripts/hooks/envelope.ts
 var ENVELOPE_KEYS = [
   "schema_version",
@@ -2363,8 +3334,8 @@ function unwrap(stdin_text, default_platform = "generic") {
 
 // src/scripts/hooks/subagent_ledger_hook.ts
 import * as crypto from "node:crypto";
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
+import * as fs8 from "node:fs";
+import * as path7 from "node:path";
 import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
 
 // src/scripts/_lib/subagent_response.ts
@@ -2498,15 +3469,15 @@ var EXIT_CODES = Object.freeze([
     name: "error",
     meaning: "the concern crashed, timed out, or could not decide \u2014 any rc >= 3. The dispatcher resolves it by the concern`s declared severity, never by the number itself",
     owner: "no concern emits this on purpose; the runtime does",
-    authorizedBy: "hook_manifest.yaml `fail_closed` and `severity` together \u2014 see docs/contracts/hook-architecture-v1.md \xA7 Exit-code semantics"
+    authorizedBy: "hook_manifest.yaml `severity` alone \u2014 blocking refuses, anything else fails open; `fail_closed` is no longer read on this branch. See docs/contracts/hook-architecture-v1.md \xA7 Exit-code semantics"
   })
 ]);
 
 // src/scripts/hooks/subagent_ledger_hook.ts
-function isObject(v) {
+function isObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-var LEDGER_DIR = path4.join("agents", "runtime", "state", "subagent-ledger");
+var LEDGER_DIR = path7.join("agents", "runtime", "state", "subagent-ledger");
 var OPEN_SUBDIR = "open";
 var OPEN_RECORD_TTL_MS = 24 * 60 * 60 * 1e3;
 function refFor(agentId) {
@@ -2514,7 +3485,7 @@ function refFor(agentId) {
 }
 function unwrapPayload(envelope) {
   const inner = envelope["payload"];
-  return isObject(inner) ? inner : envelope;
+  return isObject2(inner) ? inner : envelope;
 }
 function str(payload, ...keys) {
   for (const k of keys) {
@@ -2527,7 +3498,7 @@ function extractParentId(payload, ownId) {
   const explicit = str(payload, "parent_agent_id", "parentAgentId");
   if (explicit) return explicit;
   const session = payload["session"];
-  if (isObject(session)) {
+  if (isObject2(session)) {
     const sessionAgent = str(session, "agent_id", "agentId");
     if (sessionAgent && sessionAgent !== ownId) return sessionAgent;
   }
@@ -2596,14 +3567,14 @@ function _jsonObjectCandidates(message) {
   return out;
 }
 function openDir(root) {
-  return path4.join(root, LEDGER_DIR, OPEN_SUBDIR);
+  return path7.join(root, LEDGER_DIR, OPEN_SUBDIR);
 }
 function openFile(root, ref) {
-  return path4.join(openDir(root), `${ref}.json`);
+  return path7.join(openDir(root), `${ref}.json`);
 }
 var DEPTH_BASES = /* @__PURE__ */ new Set(["observed", "asserted-parent", "assumed-root"]);
 function _asOpenRecord(value, expectedRef) {
-  if (!isObject(value)) return null;
+  if (!isObject2(value)) return null;
   const ref = value["ref"];
   if (typeof ref !== "string" || ref !== expectedRef) return null;
   if (typeof value["started_at"] !== "string") return null;
@@ -2626,7 +3597,7 @@ function readOpenRecords(root) {
   const out = /* @__PURE__ */ new Map();
   let names;
   try {
-    names = fs4.readdirSync(openDir(root));
+    names = fs8.readdirSync(openDir(root));
   } catch {
     return out;
   }
@@ -2634,7 +3605,7 @@ function readOpenRecords(root) {
     if (!name.endsWith(".json")) continue;
     const expectedRef = name.slice(0, -".json".length);
     try {
-      const raw = fs4.readFileSync(path4.join(openDir(root), name), "utf8");
+      const raw = fs8.readFileSync(path7.join(openDir(root), name), "utf8");
       const rec = _asOpenRecord(JSON.parse(raw), expectedRef);
       if (rec) out.set(rec.ref, rec);
     } catch {
@@ -2649,13 +3620,13 @@ function resolveDepth(parentRef, open) {
   return { depth: parent.depth + 1, depth_basis: "observed" };
 }
 function ledgerFileFor2(root, ts) {
-  return path4.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
+  return path7.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
 }
 function appendLedgerLine(root, ts, line) {
   if (is_replay_mode()) return;
   const file = ledgerFileFor2(root, ts);
-  fs4.mkdirSync(path4.dirname(file), { recursive: true });
-  fs4.appendFileSync(file, `${JSON.stringify(line)}
+  fs8.mkdirSync(path7.dirname(file), { recursive: true });
+  fs8.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");
 }
 var WALL_CLOCK_ARMS_MS = [
@@ -2669,7 +3640,7 @@ function armsExceeded(elapsedMs) {
   return WALL_CLOCK_ARMS_MS.filter((a) => elapsedMs >= a.ms).map((a) => a.label);
 }
 function openRecordStats(root, nowMs = Date.now()) {
-  const ledgerPresent = fs4.existsSync(path4.join(root, LEDGER_DIR));
+  const ledgerPresent = fs8.existsSync(path7.join(root, LEDGER_DIR));
   const open = readOpenRecords(root);
   let maxDepth = 0;
   let counted = 0;
@@ -2697,13 +3668,13 @@ function writeOpenRecord(root, rec) {
 function removeOpenRecord(root, ref) {
   if (is_replay_mode()) return;
   try {
-    fs4.unlinkSync(openFile(root, ref));
+    fs8.unlinkSync(openFile(root, ref));
   } catch {
   }
 }
 function countOpen(root) {
   try {
-    return fs4.readdirSync(openDir(root)).filter((n) => n.endsWith(".json")).length;
+    return fs8.readdirSync(openDir(root)).filter((n) => n.endsWith(".json")).length;
   } catch {
     return 0;
   }
@@ -2830,7 +3801,7 @@ function handleStop(root, payload, nowIso, sessionId) {
 }
 function processEnvelope(envelope, consumerRoot) {
   try {
-    if (!isObject(envelope)) return EXIT_ALLOW3;
+    if (!isObject2(envelope)) return EXIT_ALLOW3;
     const event = envelope["event"];
     if (event !== "subagent_start" && event !== "subagent_stop") return EXIT_ALLOW3;
     const payload = unwrapPayload(envelope);
@@ -2845,7 +3816,7 @@ function processEnvelope(envelope, consumerRoot) {
   return EXIT_ALLOW3;
 }
 function resolveConsumerRoot(envelope) {
-  if (isObject(envelope)) {
+  if (isObject2(envelope)) {
     const pr = str(envelope, "workspace_root", "project_root");
     if (pr) return pr;
     const payload = unwrapPayload(envelope);
@@ -2869,10 +3840,10 @@ function _isCliEntry4() {
     return false;
   }
   if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL4(path4.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL4(path7.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) return true;
   try {
-    return fs4.realpathSync(fileURLToPath4(import.meta.url)) === fs4.realpathSync(path4.resolve(process.argv[1]));
+    return fs8.realpathSync(fileURLToPath4(import.meta.url)) === fs8.realpathSync(path7.resolve(process.argv[1]));
   } catch {
     return false;
   }
@@ -2880,20 +3851,20 @@ function _isCliEntry4() {
 if (_isCliEntry4()) process.exit(main4());
 
 // src/scripts/_lib/turn_end_transcript.ts
-import * as fs7 from "node:fs";
+import * as fs11 from "node:fs";
 
 // src/scripts/hooks/end_review_nudge_hook.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import * as crypto2 from "node:crypto";
-import * as fs6 from "node:fs";
+import * as fs10 from "node:fs";
 import * as os from "node:os";
-import * as path6 from "node:path";
+import * as path9 from "node:path";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
 
 // src/scripts/_lib/review_baseline.ts
 import { spawnSync } from "node:child_process";
-import * as fs5 from "node:fs";
-import * as path5 from "node:path";
+import * as fs9 from "node:fs";
+import * as path8 from "node:path";
 function currentHeadSha(cwd) {
   try {
     const r = spawnSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" });
@@ -2904,12 +3875,12 @@ function currentHeadSha(cwd) {
     return null;
   }
 }
-var BASELINE_STATE_REL = path5.join("agents", "runtime", "state", "review-baseline");
+var BASELINE_STATE_REL = path8.join("agents", "runtime", "state", "review-baseline");
 function baselineStateDir(workspaceRoot) {
-  return path5.join(workspaceRoot, BASELINE_STATE_REL);
+  return path8.join(workspaceRoot, BASELINE_STATE_REL);
 }
 function baselineStateFile(workspaceRoot, sessionKey) {
-  return path5.join(baselineStateDir(workspaceRoot), `${sessionKey}.json`);
+  return path8.join(baselineStateDir(workspaceRoot), `${sessionKey}.json`);
 }
 function parseBaseline(raw) {
   let decoded;
@@ -2937,7 +3908,7 @@ function readBaseline(workspaceRoot, sessionKey) {
   const file = baselineStateFile(workspaceRoot, sessionKey);
   let raw;
   try {
-    raw = fs5.readFileSync(file, "utf-8");
+    raw = fs9.readFileSync(file, "utf-8");
   } catch (exc) {
     const code = exc?.code;
     return code === "ENOENT" ? "absent" : "unreadable";
@@ -3047,13 +4018,13 @@ function isSafeTranscriptPath(rawPath, opts = {}) {
   const homeDir = opts.homeDir ?? os.homedir();
   const maxBytes = opts.maxBytes ?? TRANSCRIPT_SCAN_MAX_BYTES;
   try {
-    const realHome = fs6.realpathSync(homeDir);
-    const realPath = fs6.realpathSync(rawPath);
-    const relative3 = path6.relative(realHome, realPath);
-    if (relative3 === "" || relative3.startsWith("..") || path6.isAbsolute(relative3)) {
+    const realHome = fs10.realpathSync(homeDir);
+    const realPath = fs10.realpathSync(rawPath);
+    const relative5 = path9.relative(realHome, realPath);
+    if (relative5 === "" || relative5.startsWith("..") || path9.isAbsolute(relative5)) {
       return false;
     }
-    const { size } = fs6.statSync(realPath);
+    const { size } = fs10.statSync(realPath);
     return size <= maxBytes;
   } catch {
     return false;
@@ -3111,13 +4082,13 @@ var BINARY_PROBE_BYTES = 8e3;
 var UNTRACKED_FILE_READ_CAP_BYTES = 8 * 1024 * 1024;
 function untrackedFileLineCount(cwd, relPath) {
   try {
-    const abs = path6.resolve(cwd, relPath);
-    const size = fs6.statSync(abs).size;
+    const abs = path9.resolve(cwd, relPath);
+    const size = fs10.statSync(abs).size;
     if (size === 0) return 0;
     if (size > UNTRACKED_FILE_READ_CAP_BYTES) {
       return MUTATION_LINE_THRESHOLD + 1;
     }
-    const buf = fs6.readFileSync(abs);
+    const buf = fs10.readFileSync(abs);
     if (buf.length === 0) return 0;
     const probe = buf.subarray(0, Math.min(buf.length, BINARY_PROBE_BYTES));
     if (probe.includes(0)) return 0;
@@ -3143,7 +4114,7 @@ function totalNonDocMutatedLinesWithMeasure(cwd) {
   );
   return { lines: trackedLines + untrackedLines, measure: "exact" };
 }
-function isObject2(v) {
+function isObject3(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function str2(v) {
@@ -3163,16 +4134,16 @@ function scanTranscriptForReviewer(transcriptText) {
     } catch {
       continue;
     }
-    if (!isObject2(obj) || obj["type"] !== "assistant") continue;
+    if (!isObject3(obj) || obj["type"] !== "assistant") continue;
     const msg = obj["message"];
-    if (!isObject2(msg)) continue;
+    if (!isObject3(msg)) continue;
     const content = msg["content"];
     if (!Array.isArray(content)) continue;
     for (const blk of content) {
-      if (!isObject2(blk) || blk["type"] !== "tool_use") continue;
+      if (!isObject3(blk) || blk["type"] !== "tool_use") continue;
       const name = str2(blk["name"]);
       const input = blk["input"];
-      const inputObj = isObject2(input) ? input : {};
+      const inputObj = isObject3(input) ? input : {};
       if (DISPATCH_TOOL_RE.test(name)) {
         const label = [
           str2(inputObj["description"]),
@@ -3208,19 +4179,19 @@ function appendReviewSkippedTelemetry(workspaceRoot, diffLines, mutationMeasure,
   });
   if (errors.length || line === null) return;
   try {
-    const dir = path6.join(workspaceRoot, "agents", "runtime", "state", "audit");
-    fs6.mkdirSync(dir, { recursive: true });
-    const file = path6.join(dir, `${ts.slice(0, 7)}.jsonl`);
-    fs6.appendFileSync(file, `${JSON.stringify(line)}
+    const dir = path9.join(workspaceRoot, "agents", "runtime", "state", "audit");
+    fs10.mkdirSync(dir, { recursive: true });
+    const file = path9.join(dir, `${ts.slice(0, 7)}.jsonl`);
+    fs10.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");
   } catch {
   }
 }
 function sessionStateDir(workspaceRoot) {
-  return path6.join(workspaceRoot, "agents", "runtime", "state", "end-review-nudge");
+  return path9.join(workspaceRoot, "agents", "runtime", "state", "end-review-nudge");
 }
 function sessionStateFile(workspaceRoot, sessionKey) {
-  return path6.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
+  return path9.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
 }
 function deriveSessionKey2(envelope, payload) {
   const raw = str2(envelope["session_id"]) || str2(payload["transcript_path"] ?? payload["transcriptPath"]);
@@ -3229,7 +4200,7 @@ function deriveSessionKey2(envelope, payload) {
 }
 function hasFiredThisSession(workspaceRoot, sessionKey) {
   try {
-    return fs6.existsSync(sessionStateFile(workspaceRoot, sessionKey));
+    return fs10.existsSync(sessionStateFile(workspaceRoot, sessionKey));
   } catch {
     return false;
   }
@@ -3291,7 +4262,7 @@ function main5() {
   let reviewerRan = false;
   if (transcriptPath && isSafeTranscriptPath(transcriptPath)) {
     try {
-      reviewerRan = scanTranscriptForReviewer(fs6.readFileSync(transcriptPath, "utf-8"));
+      reviewerRan = scanTranscriptForReviewer(fs10.readFileSync(transcriptPath, "utf-8"));
     } catch {
       reviewerRan = false;
     }
@@ -3326,13 +4297,13 @@ function _isCliEntry5() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL5(path6.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL5(path9.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs6.realpathSync(fileURLToPath5(import.meta.url));
-    const argv = fs6.realpathSync(path6.resolve(process.argv[1]));
+    const here = fs10.realpathSync(fileURLToPath5(import.meta.url));
+    const argv = fs10.realpathSync(path9.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -3353,10 +4324,10 @@ function readTranscriptTail(transcriptPath, opts = {}) {
   if (!transcriptPath || !isSafeTranscriptPath(transcriptPath, opts)) return empty;
   let lines;
   try {
-    if (opts.maxBytes !== void 0 && fs7.statSync(transcriptPath).size > opts.maxBytes) {
+    if (opts.maxBytes !== void 0 && fs11.statSync(transcriptPath).size > opts.maxBytes) {
       return empty;
     }
-    lines = fs7.readFileSync(transcriptPath, "utf-8").split("\n");
+    lines = fs11.readFileSync(transcriptPath, "utf-8").split("\n");
   } catch {
     return empty;
   }
@@ -3543,7 +4514,7 @@ function detectPromissory(reply) {
 function readCiSettled(workspaceRoot, session_id) {
   if (!hasStableSessionId(session_id)) return { seen: false, settled: false };
   try {
-    const raw = fs8.readFileSync(path7.join(workspaceRoot, statePathFor(session_id)), "utf-8");
+    const raw = fs12.readFileSync(path10.join(workspaceRoot, statePathFor(session_id)), "utf-8");
     const decoded = JSON.parse(raw);
     if (!owns_session_state(decoded, session_id)) return { seen: false, settled: false };
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
@@ -3579,8 +4550,8 @@ function detectCompletionClaim(reply, ci) {
 function readLanguagePin(workspaceRoot, session_id) {
   if (!hasStableSessionId(session_id)) return "und";
   try {
-    const raw = fs8.readFileSync(
-      path7.join(workspaceRoot, statePathFor2(session_id)),
+    const raw = fs12.readFileSync(
+      path10.join(workspaceRoot, statePathFor2(session_id)),
       "utf-8"
     );
     const decoded = JSON.parse(raw);
@@ -3689,7 +4660,7 @@ function sessionStateFile2(workspaceRoot, sessionKey) {
 }
 function alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal) {
   try {
-    const raw = fs8.readFileSync(sessionStateFile2(workspaceRoot, sessionKey), "utf-8");
+    const raw = fs12.readFileSync(sessionStateFile2(workspaceRoot, sessionKey), "utf-8");
     const decoded = JSON.parse(raw);
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
       return decoded["refused_turn"] === turnOrdinal;
@@ -3703,7 +4674,7 @@ function markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, detectors, prom
   const file = sessionStateFile2(workspaceRoot, sessionKey);
   let prev = null;
   try {
-    prev = parseRecord(fs8.readFileSync(file, "utf-8"));
+    prev = parseRecord(fs12.readFileSync(file, "utf-8"));
   } catch {
   }
   let version;
@@ -3806,14 +4777,45 @@ function runDetectors(inputs) {
   }
   return findings;
 }
+function recordGraphFeeder(inputs, findings, layer) {
+  if (is_replay_mode()) return;
+  try {
+    let state;
+    try {
+      state = graphState(inputs.workspaceRoot);
+    } catch {
+      return;
+    }
+    if (state === "absent") return;
+    const paths = inputs.toolCalls.filter((c) => _EDIT_TOOLS.has(c.name) && c.path !== void 0).map((c) => c.path).filter(_isProductionSource);
+    const f = findings.find((x) => x.detector === "untested");
+    appendFeederRow(
+      inputs.workspaceRoot,
+      inputs.sessionKey,
+      buildFeederRow({
+        root: inputs.workspaceRoot,
+        turn: inputs.turnOrdinal,
+        layer,
+        state,
+        fFired: f !== void 0,
+        fMode: f?.mode ?? null,
+        paths,
+        graph: graphUntestedVerdict(inputs.workspaceRoot, state, paths)
+      })
+    );
+  } catch {
+  }
+}
 function recordShadow(inputs, layer) {
   if (is_replay_mode()) return;
   try {
     const findings = runDetectors(inputs);
+    const setBy = layer === "refused_turn" ? "ours" : shadowSetBy(inputs.workspaceRoot, inputs.sessionKey);
+    recordGraphFeeder(inputs, findings, layer);
     const file = sessionShadowFile(inputs.workspaceRoot, inputs.sessionKey);
     let prev = null;
     try {
-      prev = parseShadowRecord(fs8.readFileSync(file, "utf-8"));
+      prev = parseShadowRecord(fs12.readFileSync(file, "utf-8"));
     } catch {
     }
     atomic_write_json(
@@ -3822,7 +4824,8 @@ function recordShadow(inputs, layer) {
         detectors: findings.map((f) => f.detector),
         turnOrdinal: inputs.turnOrdinal,
         at: (/* @__PURE__ */ new Date()).toISOString(),
-        layer
+        layer,
+        setBy
       })
     );
   } catch {
@@ -3851,6 +4854,7 @@ function main6() {
     return EXIT_ALLOW3;
   }
   const findings = runDetectors(inputs);
+  recordGraphFeeder(inputs, findings, "live");
   if (findings.length === 0) return EXIT_ALLOW3;
   markRefusedTurn(
     inputs.workspaceRoot,
@@ -3879,13 +4883,13 @@ function _isCliEntry6() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL6(path7.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL6(path10.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs8.realpathSync(fileURLToPath6(import.meta.url));
-    const argv = fs8.realpathSync(path7.resolve(process.argv[1]));
+    const here = fs12.realpathSync(fileURLToPath6(import.meta.url));
+    const argv = fs12.realpathSync(path10.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -3898,8 +4902,8 @@ if (_isCliEntry6()) {
 // src/scripts/hooks/evidence_independence.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import crypto3 from "node:crypto";
-import fs9 from "node:fs";
-import path8 from "node:path";
+import fs13 from "node:fs";
+import path11 from "node:path";
 import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
 
 // src/scripts/_lib/test_delta.ts
@@ -3918,7 +4922,7 @@ function isTestPath(p) {
 }
 
 // src/scripts/hooks/evidence_independence.ts
-var STATE_FILE3 = path8.join("agents", "state", "evidence-dispatch.json");
+var STATE_FILE3 = path11.join("agents", "state", "evidence-dispatch.json");
 function _isObject5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -3984,10 +4988,10 @@ function extractDispatch(envelope) {
   }
   return [tool, ""];
 }
-function _ledgerStamp(consumer_root) {
+function _ledgerStamp(consumer_root, session_id) {
   try {
-    const raw = fs9.readFileSync(
-      path8.join(consumer_root, "agents", "state", "git-authorization.json"),
+    const raw = fs13.readFileSync(
+      path11.join(consumer_root, ledgerFileFor(session_id)),
       "utf8"
     );
     const d = JSON.parse(raw);
@@ -3998,7 +5002,7 @@ function _ledgerStamp(consumer_root) {
 }
 function _load(target) {
   try {
-    const decoded = JSON.parse(fs9.readFileSync(target, "utf8"));
+    const decoded = JSON.parse(fs13.readFileSync(target, "utf8"));
     if (_isObject5(decoded) && Array.isArray(decoded["evaluations"])) {
       return decoded;
     }
@@ -4082,10 +5086,10 @@ function run3(stdin_text, options) {
       return EXIT_ALLOW3;
     }
   }
-  const target = path8.join(options.consumer_root, STATE_FILE3);
+  const target = path11.join(options.consumer_root, STATE_FILE3);
   const state = _load(target);
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
-  const turnMarker = `${session_id}:${_ledgerStamp(options.consumer_root)}`;
+  const turnMarker = `${session_id}:${_ledgerStamp(options.consumer_root, session_id)}`;
   if (state.session_id !== turnMarker) {
     state.session_id = turnMarker;
     state.turn_started_at = (/* @__PURE__ */ new Date()).toISOString();
@@ -4150,13 +5154,13 @@ function _isCliEntry7() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL7(path8.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL7(path11.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs9.realpathSync(fileURLToPath7(import.meta.url));
-    const argv = fs9.realpathSync(path8.resolve(process.argv[1]));
+    const here = fs13.realpathSync(fileURLToPath7(import.meta.url));
+    const argv = fs13.realpathSync(path11.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -4167,8 +5171,8 @@ if (_isCliEntry7()) {
 }
 
 // src/scripts/hooks/delegation_nudge_hook.ts
-import fs10 from "node:fs";
-import path9 from "node:path";
+import fs14 from "node:fs";
+import path12 from "node:path";
 import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL8 } from "node:url";
 
 // src/scripts/_lib/auto_dispatch.ts
@@ -4532,11 +5536,10 @@ function resolveActivation(workspace_root, hostId) {
   const emergency = settings["emergency"] ?? {};
   const halted = emergency["orchestration_halt"] === true;
   const host_manifest = probeHostCapabilities(hostId);
-  const sub = settings["subagents"] ?? {};
-  const downshift = sub["downshift"] !== false;
   return {
     activation: { halted, subagent_spawn: host_manifest.subagent_spawn },
-    downshift,
+    // Fixed on: the `subagents.downshift` key was retired with this default.
+    downshift: true,
     separate_quota_pool: host_manifest.separate_quota_pool,
     agentTeams: host_manifest.agent_teams
   };
@@ -4668,13 +5671,13 @@ function _isCliEntry8() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL8(path9.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL8(path12.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs10.realpathSync(fileURLToPath8(import.meta.url));
-    const argv = fs10.realpathSync(path9.resolve(process.argv[1]));
+    const here = fs14.realpathSync(fileURLToPath8(import.meta.url));
+    const argv = fs14.realpathSync(path12.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -4685,7 +5688,7 @@ if (_isCliEntry8()) {
 }
 
 // src/scripts/conformance_scan.ts
-var REPO_ROOT = path10.resolve(path10.dirname(fileURLToPath9(import.meta.url)), "..", "..");
+var REPO_ROOT = path13.resolve(path13.dirname(fileURLToPath9(import.meta.url)), "..", "..");
 var OBSERVED_BAND = { low: 9.1, high: 39.2 };
 var BAND_MIN_TURNS = 1978;
 var CARRIER_CHANGES = [
@@ -5051,7 +6054,7 @@ function scanSession(sessionId, lines) {
   closeWindow();
   return report;
 }
-var DEFAULT_RATE_SERIES = path10.join(
+var DEFAULT_RATE_SERIES = path13.join(
   REPO_ROOT,
   "agents",
   "runtime",
@@ -5060,7 +6063,7 @@ var DEFAULT_RATE_SERIES = path10.join(
 );
 function defaultStore(projectDir) {
   const slug = projectStoreSlug(projectDir);
-  return path10.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
+  return path13.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
 }
 function _tokens(chars) {
   return Math.round(chars / 4);
@@ -5071,13 +6074,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   return {
     project: {
       dir: projectRulesDir,
-      present: fs11.existsSync(projectRulesDir),
+      present: fs15.existsSync(projectRulesDir),
       files: p.files,
       tokens: _tokens(p.chars)
     },
     global: {
       dir: globalRulesDir,
-      present: fs11.existsSync(globalRulesDir),
+      present: fs15.existsSync(globalRulesDir),
       files: g.files,
       tokens: _tokens(g.chars)
     },
@@ -5085,13 +6088,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   };
 }
 function storeKey(store) {
-  return createHash3("sha256").update(path10.resolve(store)).digest("hex").slice(0, 12);
+  return createHash4("sha256").update(path13.resolve(store)).digest("hex").slice(0, 12);
 }
 function scanStore(store, limit) {
-  const files = fs11.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs11.statSync(path10.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
+  const files = fs15.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs15.statSync(path13.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
   const per_session = [];
   for (const f of files) {
-    const lines = fs11.readFileSync(path10.join(store, f), "utf8").split("\n");
+    const lines = fs15.readFileSync(path13.join(store, f), "utf8").split("\n");
     const r = scanSession(f.replace(/\.jsonl$/, "").slice(0, 8), lines);
     if (r.assistant_turns > 0) {
       per_session.push(r);
@@ -5119,10 +6122,10 @@ function scanStore(store, limit) {
   const task_completeness_rate_pct = completeness_windows === 0 ? 0 : Number((100 * task_completeness / completeness_windows).toFixed(1));
   const era = spansCarrierChange(per_session.map((s) => s.first_at));
   const delivered = measureDelivered(
-    path10.join(REPO_ROOT, ".claude", "rules"),
-    path10.join(process.env["HOME"] ?? os2.homedir(), ".claude", "rules")
+    path13.join(REPO_ROOT, ".claude", "rules"),
+    path13.join(process.env["HOME"] ?? os2.homedir(), ".claude", "rules")
   );
-  const ownStore = path10.resolve(store) === path10.resolve(defaultStore(REPO_ROOT));
+  const ownStore = path13.resolve(store) === path13.resolve(defaultStore(REPO_ROOT));
   return {
     scanned_at: (/* @__PURE__ */ new Date()).toISOString(),
     store,
@@ -5152,8 +6155,8 @@ function scanStore(store, limit) {
   };
 }
 function recordRate(file, scanned_at, rate) {
-  fs11.mkdirSync(path10.dirname(file), { recursive: true });
-  fs11.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
+  fs15.mkdirSync(path13.dirname(file), { recursive: true });
+  fs15.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
 `, "utf8");
 }
 function render(report) {
@@ -5284,14 +6287,14 @@ function main9(argv) {
     return 2;
   }
   const resolved = store ?? defaultStore(process.cwd());
-  if (!fs11.existsSync(resolved)) {
+  if (!fs15.existsSync(resolved)) {
     process.stderr.write(`conformance:behavior: no transcript store at ${resolved}
 `);
     return 1;
   }
   const report = scanStore(resolved, Number.isFinite(limit) && limit > 0 ? limit : 30);
   if (out) {
-    fs11.writeFileSync(out, `${JSON.stringify(report, null, 2)}
+    fs15.writeFileSync(out, `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   if (record) {
@@ -5299,7 +6302,7 @@ function main9(argv) {
   }
   if (why !== null) {
     const id = why;
-    fs11.writeSync(
+    fs15.writeSync(
       1,
       json ? `${JSON.stringify(
         {
@@ -5319,7 +6322,7 @@ function main9(argv) {
     );
     return 0;
   }
-  fs11.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
+  fs15.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
 ` : `${render(report)}
 `);
   return 0;
@@ -5331,13 +6334,13 @@ function _isCliEntry9() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL9(path10.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL9(path13.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs11.realpathSync(fileURLToPath9(import.meta.url));
-    const argv = fs11.realpathSync(path10.resolve(process.argv[1]));
+    const here = fs15.realpathSync(fileURLToPath9(import.meta.url));
+    const argv = fs15.realpathSync(path13.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -5348,19 +6351,19 @@ if (_isCliEntry9()) {
 }
 
 // src/scripts/report_carrier_divergence.ts
-import * as fs12 from "node:fs";
+import * as fs16 from "node:fs";
 import * as os3 from "node:os";
-import * as path11 from "node:path";
+import * as path14 from "node:path";
 import process2 from "node:process";
 import { fileURLToPath as fileURLToPath10, pathToFileURL as pathToFileURL10 } from "node:url";
 var _HERE2 = fileURLToPath10(import.meta.url);
-var REPO_ROOT2 = path11.resolve(path11.dirname(_HERE2), "..", "..");
-var PROJECT_RULES = path11.join(".claude", "rules");
-var PROJECTION_SOURCE = path11.join("dist", "agent-src", "rules");
-var GLOBAL_RULES = path11.join(".claude", "rules");
+var REPO_ROOT2 = path14.resolve(path14.dirname(_HERE2), "..", "..");
+var PROJECT_RULES = path14.join(".claude", "rules");
+var PROJECTION_SOURCE = path14.join("dist", "agent-src", "rules");
+var GLOBAL_RULES = path14.join(".claude", "rules");
 function _listRules(dir) {
   try {
-    return fs12.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    return fs16.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
@@ -5368,7 +6371,7 @@ function _listRules(dir) {
 function _ruleType(file) {
   let text;
   try {
-    text = fs12.readFileSync(file, "utf-8");
+    text = fs16.readFileSync(file, "utf-8");
   } catch {
     return "";
   }
@@ -5379,8 +6382,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
   const out = {
     projectDir,
     globalDir,
-    globalPresent: fs12.existsSync(globalDir),
-    projectPresent: fs12.existsSync(projectDir),
+    globalPresent: fs16.existsSync(globalDir),
+    projectPresent: fs16.existsSync(projectDir),
     shared: 0,
     identical: [],
     provenanceOnly: [],
@@ -5403,7 +6406,7 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     if (!inP && inG) {
       out.globalOnly.push(rule);
-      if (sourceDir !== void 0 && _ruleType(path11.join(sourceDir, rule)) === "manual") {
+      if (sourceDir !== void 0 && _ruleType(path14.join(sourceDir, rule)) === "manual") {
         out.manualOnlyGlobal.push(rule);
       }
       continue;
@@ -5413,8 +6416,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     let projectCopy;
     let globalCopy;
     try {
-      projectCopy = fs12.readFileSync(path11.join(projectDir, rule));
-      globalCopy = fs12.readFileSync(path11.join(globalDir, rule));
+      projectCopy = fs16.readFileSync(path14.join(projectDir, rule));
+      globalCopy = fs16.readFileSync(path14.join(globalDir, rule));
       verdict = comparePair(projectCopy, globalCopy);
     } catch {
       out.shared -= 1;
@@ -5561,9 +6564,9 @@ function render2(d) {
 }
 function main10(argv) {
   const args = argv ?? process2.argv.slice(2);
-  let projectDir = path11.join(REPO_ROOT2, PROJECT_RULES);
-  let globalDir = path11.join(os3.homedir(), GLOBAL_RULES);
-  let sourceDir = path11.join(REPO_ROOT2, PROJECTION_SOURCE);
+  let projectDir = path14.join(REPO_ROOT2, PROJECT_RULES);
+  let globalDir = path14.join(os3.homedir(), GLOBAL_RULES);
+  let sourceDir = path14.join(REPO_ROOT2, PROJECTION_SOURCE);
   const value = (i) => {
     const v = args[i + 1];
     return v === void 0 || v.startsWith("-") ? null : v;
@@ -5577,7 +6580,7 @@ function main10(argv) {
 `);
         return 1;
       }
-      const resolved = path11.resolve(v);
+      const resolved = path14.resolve(v);
       if (a === "--project") projectDir = resolved;
       else if (a === "--global") globalDir = resolved;
       else sourceDir = resolved;
@@ -5599,9 +6602,9 @@ function main10(argv) {
 }
 function _isCliEntry10() {
   if (process2.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL10(path11.resolve(process2.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL10(path14.resolve(process2.argv[1])).href) return true;
   try {
-    return fs12.realpathSync(_HERE2) === fs12.realpathSync(path11.resolve(process2.argv[1]));
+    return fs16.realpathSync(_HERE2) === fs16.realpathSync(path14.resolve(process2.argv[1]));
   } catch {
     return false;
   }
@@ -5611,12 +6614,12 @@ if (_isCliEntry10()) {
 }
 
 // src/scripts/report_skill_activation.ts
-import * as fs13 from "node:fs";
+import * as fs17 from "node:fs";
 import * as os4 from "node:os";
-import * as path12 from "node:path";
+import * as path15 from "node:path";
 import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
 var _HERE3 = fileURLToPath11(import.meta.url);
-var REPO_ROOT3 = path12.resolve(path12.dirname(_HERE3), "..", "..");
+var REPO_ROOT3 = path15.resolve(path15.dirname(_HERE3), "..", "..");
 var SKILLS_ROOT = "src/skills";
 var TRIGGER_KEYS = ["triggers:", "trigger_description:", "file_pattern:", "path_prefix:"];
 var DETERMINISTIC_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?(MUST|NEVER|ALWAYS)\b/m;
@@ -5627,25 +6630,25 @@ function censusSkills(root) {
     withTriggerCorpus: [],
     withDeterministicObligation: []
   };
-  if (!fs13.existsSync(root)) {
+  if (!fs17.existsSync(root)) {
     return out;
   }
-  for (const entry of fs13.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const entry of fs17.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const file = path12.join(root, entry.name, "SKILL.md");
-    if (!fs13.existsSync(file)) {
+    const file = path15.join(root, entry.name, "SKILL.md");
+    if (!fs17.existsSync(file)) {
       continue;
     }
     out.total += 1;
-    const text = fs13.readFileSync(file, "utf8");
+    const text = fs17.readFileSync(file, "utf8");
     const fmEnd = text.startsWith("---") ? text.indexOf("\n---", 3) : -1;
     const fm = fmEnd === -1 ? "" : text.slice(0, fmEnd);
     if (TRIGGER_KEYS.some((k) => new RegExp(`^${k}`, "m").test(fm))) {
       out.withTriggerKey.push(entry.name);
     }
-    if (fs13.existsSync(path12.join(root, entry.name, "evals", "triggers.json"))) {
+    if (fs17.existsSync(path15.join(root, entry.name, "evals", "triggers.json"))) {
       out.withTriggerCorpus.push(entry.name);
     }
     const body = fmEnd === -1 ? text : text.slice(fmEnd + 4);
@@ -5656,17 +6659,17 @@ function censusSkills(root) {
   return out;
 }
 function defaultStore2(cwd) {
-  return path12.join(os4.homedir(), ".claude", "projects", projectStoreSlug(cwd));
+  return path15.join(os4.homedir(), ".claude", "projects", projectStoreSlug(cwd));
 }
 function measureUsage(store, limit) {
   const rep = { store, sessions: 0, assistantTurns: 0, invocations: 0, bySkill: {} };
-  if (!fs13.existsSync(store)) {
+  if (!fs17.existsSync(store)) {
     return rep;
   }
-  const files = fs13.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path12.join(store, f)).sort((a, b) => fs13.statSync(b).mtimeMs - fs13.statSync(a).mtimeMs).slice(0, limit);
+  const files = fs17.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path15.join(store, f)).sort((a, b) => fs17.statSync(b).mtimeMs - fs17.statSync(a).mtimeMs).slice(0, limit);
   rep.sessions = files.length;
   for (const file of files) {
-    for (const line of fs13.readFileSync(file, "utf8").split("\n")) {
+    for (const line of fs17.readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) {
         continue;
       }
@@ -5739,15 +6742,15 @@ function buildRecord(census, usage, today) {
     assistant_turns: usage.reduce((a, u) => a + u.assistantTurns, 0),
     invocations: usage.reduce((a, u) => a + u.invocations, 0),
     distinct_skills_invoked: distinct.size,
-    stores: usage.map((u) => path12.basename(u.store))
+    stores: usage.map((u) => path15.basename(u.store))
   };
 }
 function readRecord(repoRoot) {
-  const file = path12.join(repoRoot, RECORD_PATH);
-  if (!fs13.existsSync(file)) {
+  const file = path15.join(repoRoot, RECORD_PATH);
+  if (!fs17.existsSync(file)) {
     return null;
   }
-  return JSON.parse(fs13.readFileSync(file, "utf8"));
+  return JSON.parse(fs17.readFileSync(file, "utf8"));
 }
 function render3(census, usage, published = null) {
   const lines = [];
@@ -5782,7 +6785,7 @@ function render3(census, usage, published = null) {
     }
     totalInv += u.invocations;
     lines.push(
-      `  ${path12.basename(u.store).slice(-38).padEnd(38)} sessions=${String(u.sessions).padStart(3)} asst=${String(u.assistantTurns).padStart(6)} Skill calls=${String(u.invocations).padStart(3)}`
+      `  ${path15.basename(u.store).slice(-38).padEnd(38)} sessions=${String(u.sessions).padStart(3)} asst=${String(u.assistantTurns).padStart(6)} Skill calls=${String(u.invocations).padStart(3)}`
     );
   }
   lines.push("");
@@ -5886,7 +6889,7 @@ function main11(argv) {
   if (stores.length === 0) {
     stores.push(defaultStore2(REPO_ROOT3));
   }
-  const census = censusSkills(path12.join(root, SKILLS_ROOT));
+  const census = censusSkills(path15.join(root, SKILLS_ROOT));
   const usage = stores.map((s) => measureUsage(s, limit));
   process.stdout.write(`${render3(census, usage, readRecord(root))}
 `);
@@ -5907,27 +6910,27 @@ function main11(argv) {
     return 1;
   }
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const file = path12.join(root, RECORD_PATH);
-  fs13.mkdirSync(path12.dirname(file), { recursive: true });
-  fs13.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
+  const file = path15.join(root, RECORD_PATH);
+  fs17.mkdirSync(path15.dirname(file), { recursive: true });
+  fs17.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
 `);
   process.stdout.write(`
 wrote ${RECORD_PATH} (measured ${today})
 `);
   return 0;
 }
-if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL11(path12.resolve(process.argv[1])).href) {
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL11(path15.resolve(process.argv[1])).href) {
   process.exit(main11(process.argv.slice(2)));
 }
 
 // src/scripts/report_skill_obligation_violations.ts
-import * as fs14 from "node:fs";
+import * as fs18 from "node:fs";
 import * as os5 from "node:os";
-import * as path13 from "node:path";
+import * as path16 from "node:path";
 import process3 from "node:process";
 import { fileURLToPath as fileURLToPath12, pathToFileURL as pathToFileURL12 } from "node:url";
 var _HERE4 = fileURLToPath12(import.meta.url);
-var REPO_ROOT4 = path13.resolve(path13.dirname(_HERE4), "..", "..");
+var REPO_ROOT4 = path16.resolve(path16.dirname(_HERE4), "..", "..");
 var OBLIGATION_LINE_RE = new RegExp(`${DETERMINISTIC_RE.source}.*`, "gm");
 var PATH_RE = /`([A-Za-z0-9_./-]*\/[A-Za-z0-9_.-]+\.[a-z]{2,6})`/g;
 var CMD_RE = /`([a-z][a-z0-9-]*(?: [a-z][a-z0-9:._-]*){1,3})`/g;
@@ -5965,7 +6968,7 @@ function _artefacts(line) {
   return out;
 }
 function extractObligations(repoRoot) {
-  const skillsRoot = path13.join(repoRoot, SKILLS_ROOT);
+  const skillsRoot = path16.join(repoRoot, SKILLS_ROOT);
   const census = censusSkills(skillsRoot);
   const out = {
     skills: census.withDeterministicObligation,
@@ -5979,7 +6982,7 @@ function extractObligations(repoRoot) {
   for (const skill of census.withDeterministicObligation) {
     let text;
     try {
-      text = fs14.readFileSync(path13.join(skillsRoot, skill, "SKILL.md"), "utf-8");
+      text = fs18.readFileSync(path16.join(skillsRoot, skill, "SKILL.md"), "utf-8");
     } catch {
       continue;
     }
@@ -6095,7 +7098,7 @@ function scanSessionForViolations(session, lines, forbidden, parsed) {
   return flags;
 }
 function defaultStore3(cwd) {
-  return path13.join(os5.homedir(), ".claude", "projects", projectStoreSlug(cwd));
+  return path16.join(os5.homedir(), ".claude", "projects", projectStoreSlug(cwd));
 }
 function scanStore2(repoRoot, store, limit) {
   const census = extractObligations(repoRoot);
@@ -6108,14 +7111,14 @@ function scanStore2(repoRoot, store, limit) {
   };
   let files;
   try {
-    files = fs14.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path13.join(store, f), m: fs14.statSync(path13.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
+    files = fs18.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path16.join(store, f), m: fs18.statSync(path16.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
   } catch {
     return report;
   }
   report.sessions = files.length;
   for (const file of files) {
-    const lines = fs14.readFileSync(file, "utf-8").split("\n");
-    const id = path13.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
+    const lines = fs18.readFileSync(file, "utf-8").split("\n");
+    const id = path16.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
     const entries = _parseSession(lines);
     if (loadedSkillsFrom(entries).size > 0) report.sessionsWithASkill += 1;
     report.flags.push(...scanSessionForViolations(id, lines, census.forbidden, entries));
@@ -6240,9 +7243,9 @@ function main12(argv) {
 }
 function _isCliEntry11() {
   if (process3.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL12(path13.resolve(process3.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL12(path16.resolve(process3.argv[1])).href) return true;
   try {
-    return fs14.realpathSync(_HERE4) === fs14.realpathSync(path13.resolve(process3.argv[1]));
+    return fs18.realpathSync(_HERE4) === fs18.realpathSync(path16.resolve(process3.argv[1]));
   } catch {
     return false;
   }
@@ -6253,20 +7256,20 @@ if (_isCliEntry11()) {
 
 // src/scripts/report_conformance_funnel.ts
 var _HERE5 = fileURLToPath13(import.meta.url);
-var REPO_ROOT5 = path14.resolve(path14.dirname(_HERE5), "..", "..");
+var REPO_ROOT5 = path17.resolve(path17.dirname(_HERE5), "..", "..");
 function buildFunnel(opts = {}) {
   const repoRoot = opts.repoRoot ?? REPO_ROOT5;
-  const projectRulesDir = opts.projectRulesDir ?? path14.join(repoRoot, PROJECT_RULES);
-  const globalRulesDir = opts.globalRulesDir ?? path14.join(os6.homedir(), GLOBAL_RULES);
-  const sourceDir = opts.sourceDir ?? path14.join(repoRoot, PROJECTION_SOURCE);
+  const projectRulesDir = opts.projectRulesDir ?? path17.join(repoRoot, PROJECT_RULES);
+  const globalRulesDir = opts.globalRulesDir ?? path17.join(os6.homedir(), GLOBAL_RULES);
+  const sourceDir = opts.sourceDir ?? path17.join(repoRoot, PROJECTION_SOURCE);
   const store = opts.store ?? defaultStore(repoRoot);
   const limit = opts.limit ?? 30;
   return {
     delivered: measureDelivered(projectRulesDir, globalRulesDir),
     divergence: compareCarriers(projectRulesDir, globalRulesDir, sourceDir),
-    skills: censusSkills(path14.join(repoRoot, SKILLS_ROOT)),
+    skills: censusSkills(path17.join(repoRoot, SKILLS_ROOT)),
     usage: measureUsage(store, limit),
-    storePresent: fs15.existsSync(store),
+    storePresent: fs19.existsSync(store),
     sk2: scanStore2(repoRoot, store, limit)
   };
 }
@@ -6407,7 +7410,7 @@ function main13(argv) {
 `);
         return 1;
       }
-      const resolved = path14.resolve(v);
+      const resolved = path17.resolve(v);
       if (a === "--store") opts.store = resolved;
       else if (a === "--project") opts.projectRulesDir = resolved;
       else if (a === "--global") opts.globalRulesDir = resolved;
@@ -6439,9 +7442,9 @@ function main13(argv) {
 }
 function _isCliEntry12() {
   if (process4.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL13(path14.resolve(process4.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL13(path17.resolve(process4.argv[1])).href) return true;
   try {
-    return fs15.realpathSync(_HERE5) === fs15.realpathSync(path14.resolve(process4.argv[1]));
+    return fs19.realpathSync(_HERE5) === fs19.realpathSync(path17.resolve(process4.argv[1]));
   } catch {
     return false;
   }
@@ -6460,7 +7463,7 @@ var CONFORMANCE_CHECK_IDS = [
   "lean-projection",
   "host-manifest"
 ];
-var THIN_STUB_MARKER = "Routed rule \u2014 load the body on trigger-match";
+var THIN_STUB_MARKER = THIN_ENTRY_MARKER;
 var CONFORMANCE_STATUS_SYMBOLS = {
   ...STATUS_SYMBOLS,
   unknown: "\u2754"
@@ -6478,20 +7481,20 @@ function conformanceLogPath() {
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path15.join(os7.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
+  return path18.join(os7.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
 }
 function installLogPath() {
   const override = process5.env["AGENT_CONFIG_INSTALL_LOG"];
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path15.join(os7.homedir(), ".event4u", "agent-config", "install-log.jsonl");
+  return path18.join(os7.homedir(), ".event4u", "agent-config", "install-log.jsonl");
 }
 function _installLogExpected(projectRoot) {
-  return fs16.existsSync(manifest_path(projectRoot));
+  return fs20.existsSync(manifest_path(projectRoot));
 }
 function _check_txlog_clean(logPath = installLogPath(), projectRoot = null) {
-  const entries = fs16.existsSync(logPath) ? readRecentEntries(logPath) : [];
+  const entries = fs20.existsSync(logPath) ? readRecentEntries(logPath) : [];
   if (entries.length === 0) {
     if (projectRoot !== null && _installLogExpected(projectRoot)) {
       return {
@@ -6525,11 +7528,11 @@ function _check_txlog_clean(logPath = installLogPath(), projectRoot = null) {
   };
 }
 function routeTargetPaths(target) {
-  return routeTargetPathsPosix(target).map((rel) => path15.join(...rel.split("/")));
+  return routeTargetPathsPosix(target).map((rel) => path18.join(...rel.split("/")));
 }
 function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
-  const routerPath = path15.join(packageRoot, "dist", "router.json");
-  if (!fs16.existsSync(routerPath)) {
+  const routerPath = path18.join(packageRoot, "dist", "router.json");
+  if (!fs20.existsSync(routerPath)) {
     return {
       id: "router-pointers",
       status: "fail",
@@ -6539,7 +7542,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   }
   let router;
   try {
-    router = JSON.parse(fs16.readFileSync(routerPath, "utf8"));
+    router = JSON.parse(fs20.readFileSync(routerPath, "utf8"));
   } catch (exc) {
     return {
       id: "router-pointers",
@@ -6548,13 +7551,13 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
       remedy: "reinstall the package \u2014 dist/router.json is corrupt"
     };
   }
-  const rulesDir = path15.join(packageRoot, "dist", "agent-src", "rules");
+  const rulesDir = path18.join(packageRoot, "dist", "agent-src", "rules");
   const broken = [];
   let ids = 0;
   let targets = 0;
   for (const kernelId of router["kernel"] ?? []) {
     ids += 1;
-    if (!fs16.existsSync(path15.join(rulesDir, `${kernelId}.md`))) {
+    if (!fs20.existsSync(path18.join(rulesDir, `${kernelId}.md`))) {
       broken.push(`kernel:${kernelId} \u2192 rules/${kernelId}.md missing`);
     }
   }
@@ -6562,7 +7565,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
     for (const entry of router[tier] ?? []) {
       const ruleId = String(entry["id"] ?? "");
       ids += 1;
-      if (!fs16.existsSync(path15.join(rulesDir, `${ruleId}.md`))) {
+      if (!fs20.existsSync(path18.join(rulesDir, `${ruleId}.md`))) {
         broken.push(`${tier}:${ruleId} \u2192 rules/${ruleId}.md missing`);
       }
       for (const target of entry["routes_to"] ?? []) {
@@ -6572,7 +7575,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
           broken.push(`${ruleId} \u2192 unparseable routes_to ${JSON.stringify(target)}`);
           continue;
         }
-        if (!candidates.some((rel) => fs16.existsSync(path15.join(packageRoot, rel)))) {
+        if (!candidates.some((rel) => fs20.existsSync(path18.join(packageRoot, rel)))) {
           broken.push(`${ruleId} \u2192 ${target} (${candidates[0]} missing)`);
         }
       }
@@ -6604,9 +7607,9 @@ function detectSmokePlatform(projectRoot) {
   return "claude";
 }
 function dispatcherRunner(packageRoot) {
-  const localTsx = path15.join(packageRoot, "node_modules", ".bin", "tsx");
-  const script = path15.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
-  if (fs16.existsSync(localTsx)) {
+  const localTsx = path18.join(packageRoot, "node_modules", ".bin", "tsx");
+  const script = path18.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
+  if (fs20.existsSync(localTsx)) {
     return [localTsx, script];
   }
   return ["npx", "tsx", script];
@@ -6656,12 +7659,12 @@ function _check_hook_dispatcher(projectRoot, packageRoot = PACKAGE_ROOT, opts =
   };
 }
 function readSettingsMode(projectRoot) {
-  const settingsPath = path15.join(projectRoot, ".agent-settings.yml");
-  if (!fs16.existsSync(settingsPath)) {
+  const settingsPath = path18.join(projectRoot, ".agent-settings.yml");
+  if (!fs20.existsSync(settingsPath)) {
     return "eager-all";
   }
   try {
-    const parsed = YAML.parse(fs16.readFileSync(settingsPath, "utf8"));
+    const parsed = YAML.parse(fs20.readFileSync(settingsPath, "utf8"));
     const lean = parsed?.["lean_projection"] ?? null;
     const mode = lean?.["mode"];
     return typeof mode === "string" && mode.length > 0 ? mode : "eager-all";
@@ -6672,7 +7675,7 @@ function readSettingsMode(projectRoot) {
 function kernelIdsFromRouter(packageRoot) {
   try {
     const router = JSON.parse(
-      fs16.readFileSync(path15.join(packageRoot, "dist", "router.json"), "utf8")
+      fs20.readFileSync(path18.join(packageRoot, "dist", "router.json"), "utf8")
     );
     return new Set((router["kernel"] ?? []).map(String));
   } catch {
@@ -6689,8 +7692,8 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
       remedy: "set lean_projection.mode to 'eager-all' or 'thin' in .agent-settings.yml"
     };
   }
-  const rulesDir = projectedRulesDir ?? path15.join(projectRoot, ".augment", "rules");
-  if (!fs16.existsSync(rulesDir)) {
+  const rulesDir = projectedRulesDir ?? path18.join(projectRoot, ".augment", "rules");
+  if (!fs20.existsSync(rulesDir)) {
     return {
       id: "lean-projection",
       status: "skipped",
@@ -6699,7 +7702,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
     };
   }
   const kernel = kernelIdsFromRouter(packageRoot);
-  const files = fs16.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
+  const files = fs20.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
   const nonKernel = files.filter((f) => !kernel.has(f.replace(/\.md$/, "")));
   if (nonKernel.length === 0) {
     return {
@@ -6713,7 +7716,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
   for (const f of nonKernel) {
     let text = "";
     try {
-      text = fs16.readFileSync(path15.join(rulesDir, f), "utf8");
+      text = fs20.readFileSync(path18.join(rulesDir, f), "utf8");
     } catch {
       continue;
     }
@@ -6744,8 +7747,8 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
 function _check_host_manifest(projectRoot) {
   const detected = Object.entries(detectToolPresence(projectRoot)).filter(([, v]) => v === true).map(([k]) => k);
   const detectedNote = detected.length > 0 ? `detected surfaces: ${detected.join(", ")}` : "no surfaces detected";
-  const settingsPath = path15.join(projectRoot, ".agent-settings.yml");
-  if (!fs16.existsSync(settingsPath)) {
+  const settingsPath = path18.join(projectRoot, ".agent-settings.yml");
+  if (!fs20.existsSync(settingsPath)) {
     return {
       id: "host-manifest",
       status: "ok",
@@ -6755,7 +7758,7 @@ function _check_host_manifest(projectRoot) {
   }
   let parsed = null;
   try {
-    parsed = YAML.parse(fs16.readFileSync(settingsPath, "utf8"));
+    parsed = YAML.parse(fs20.readFileSync(settingsPath, "utf8"));
   } catch (exc) {
     return {
       id: "host-manifest",
@@ -6929,13 +7932,13 @@ function _isCliEntry13() {
   if (process5.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL14(path15.resolve(process5.argv[1])).href;
+  const argvUrl = pathToFileURL14(path18.resolve(process5.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs16.realpathSync(fileURLToPath14(import.meta.url));
-    const argv = fs16.realpathSync(path15.resolve(process5.argv[1]));
+    const here = fs20.realpathSync(fileURLToPath14(import.meta.url));
+    const argv = fs20.realpathSync(path18.resolve(process5.argv[1]));
     return here === argv;
   } catch {
     return false;