@event4u/agent-config 16.4.0 → 17.0.0

package/dist/cli-delegate/cmd_conformance.js

@@ -1,33 +1,39 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
   THIN_ENTRY_MARKER,
+  TIER_TO_CLAUDE_MODEL,
   readRecentEntries
-} from "./chunk-6YQC2HLF.js";
+} from "./chunk-JHMMWNJ2.js";
+import "./chunk-LF2KKJ4Q.js";
 import {
   detectToolPresence
 } from "./chunk-A4QJ6ENT.js";
 import {
   NO_RED_EVIDENCE_REASON,
+  RENDER_REL,
   deriveSessionKey,
   describeRecordFinding,
   foldRefusal,
   foldShadow,
+  hasInstrumentGap,
   hasRedThenGreen,
   isCiPoll,
+  isPureRender,
   isVacuousOutput,
-  isVerificationCommand,
+  isVerificationAttempt,
   parseRecord,
   parseShadowRecord,
   pendingCount,
+  readAssetRenderRecords,
   readInstallBoundary,
   readRunEvidence,
   readTurnRunState,
+  recordedManifest,
   sessionRefusalFile,
   sessionShadowFile,
   shadowSetBy,
-  statePathFor,
-  validateAssumption
-} from "./chunk-AED2VQGM.js";
+  statePathFor
+} from "./chunk-2CX7NWRB.js";
 import {
   LexicalIndex,
   isSqliteAvailableSync,
@@ -42,7 +48,6 @@ import {
   _classify,
   _collect_manifest_entries,
   _foreign_records,
-  _is_global_only_consumer,
   _jsonDumpsIndentAscii,
   _resolve_project_root,
   _run_checks,
@@ -51,25 +56,38 @@ import {
   censusRuleDir,
   comparePair,
   frontmatterPaths,
+  openRecordStats,
   proseEqual,
   resolveSessionRole,
   splitFrontmatter
-} from "./chunk-5GPULQBE.js";
-import "./chunk-FTAISGDQ.js";
-import "./chunk-6V6TA25H.js";
+} from "./chunk-CAL76ADI.js";
+import {
+  _is_global_only_consumer
+} from "./chunk-2Y5AMLMY.js";
 import "./chunk-ROYYTEZU.js";
 import "./chunk-BTWUYDGN.js";
+import "./chunk-UUYEKXKR.js";
+import "./chunk-FTAISGDQ.js";
+import "./chunk-5VO3RTMV.js";
+import "./chunk-6V6TA25H.js";
+import "./chunk-AX3U3UWJ.js";
 import {
   atomicAppendLine,
   probeHostCapabilities
-} from "./chunk-MDPPKQCQ.js";
-import "./chunk-DMSZHXZS.js";
+} from "./chunk-GOMILC3O.js";
+import "./chunk-7DRWULEQ.js";
 import "./chunk-ULQRUR23.js";
 import {
-  hardenedSpawnEnv,
+  hardenedSpawnEnv
+} from "./chunk-I4KJYVPB.js";
+import {
+  EXIT_ALLOW,
+  EXIT_BLOCK,
+  EXIT_WARN,
   projectStoreSlug
-} from "./chunk-OAFSJBHH.js";
+} from "./chunk-FKYZOWVD.js";
 import "./chunk-IAYTIIQW.js";
+import "./chunk-PV7S5DPJ.js";
 import "./chunk-LQOCRFWT.js";
 import {
   atomic_write_json,
@@ -81,35 +99,42 @@ import {
   prune_stale_session_states,
   session_state_file
 } from "./chunk-7HKRE54K.js";
-import "./chunk-F3QDG2GT.js";
+import {
+  load_agent_settings
+} from "./chunk-XLY5G3CM.js";
+import "./chunk-2SFOOFJJ.js";
+import "./chunk-FIEEOH5C.js";
+import "./chunk-E6XNBVE4.js";
+import {
+  artefact_roots
+} from "./chunk-YCU3TIXH.js";
 import "./chunk-DEIV7XP7.js";
+import "./chunk-J2SJZICO.js";
 import {
   manifest_path,
   read_manifest
-} from "./chunk-OKJUIAPS.js";
-import "./chunk-WQWXGIWB.js";
-import "./chunk-KB5FZ655.js";
+} from "./chunk-4E2W63DA.js";
+import {
+  parseRouteFields,
+  resolveRouteTransport
+} from "./chunk-M6CRG5O6.js";
 import "./chunk-MWRD5YOH.js";
-import "./chunk-JQOM7TTM.js";
+import "./chunk-BMGUGSY6.js";
+import {
+  readHookStdin
+} from "./chunk-RAXQOETZ.js";
+import "./chunk-IDAOTDPE.js";
 import {
   DeadScopeError,
   assertScanned,
   reportScanned
 } from "./chunk-I3EIN2YG.js";
-import {
-  readHookStdin
-} from "./chunk-F7DQWYR5.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
-import "./chunk-LF2KKJ4Q.js";
 import {
-  load_agent_settings
-} from "./chunk-H76PHZBI.js";
-import {
-  artefact_roots
-} from "./chunk-YCU3TIXH.js";
-import "./chunk-T6BP34WI.js";
+  resolve_with_fallback
+} from "./chunk-T6BP34WI.js";
 import {
   resolvePackageRoot
 } from "./chunk-MCJYCQPF.js";
@@ -119,12 +144,12 @@ import {
 
 // src/scripts/_cli/cmd_conformance.ts
 var YAML = __toESM(require_dist(), 1);
-import * as fs20 from "node:fs";
+import * as fs22 from "node:fs";
 import * as os7 from "node:os";
-import * as path18 from "node:path";
+import * as path19 from "node:path";
 import process5 from "node:process";
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { fileURLToPath as fileURLToPath14, pathToFileURL as pathToFileURL14 } from "node:url";
+import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL13 } from "node:url";
 
 // src/scripts/router_target_paths.mjs
 var ROUTE_TARGET_TEMPLATES = Object.freeze({
@@ -137,10 +162,10 @@ var ROUTE_TARGET_TEMPLATES = Object.freeze({
   ])
 });
 function parseRouteTarget(target) {
-  const sep4 = target.indexOf(":");
-  if (sep4 <= 0) return null;
-  const kind = target.slice(0, sep4);
-  const id = target.slice(sep4 + 1);
+  const sep5 = target.indexOf(":");
+  if (sep5 <= 0) return null;
+  const kind = target.slice(0, sep5);
+  const id = target.slice(sep5 + 1);
   if (!id) return null;
   if (!Object.prototype.hasOwnProperty.call(ROUTE_TARGET_TEMPLATES, kind)) return null;
   return { kind, id };
@@ -152,18 +177,18 @@ function routeTargetPathsPosix(target) {
 }
 
 // src/scripts/report_conformance_funnel.ts
-import * as fs19 from "node:fs";
+import * as fs21 from "node:fs";
 import * as os6 from "node:os";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 import process4 from "node:process";
-import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL13 } from "node:url";
+import { fileURLToPath as fileURLToPath12, pathToFileURL as pathToFileURL12 } from "node:url";
 
 // src/scripts/conformance_scan.ts
 import { createHash as createHash4 } from "node:crypto";
-import fs15 from "node:fs";
+import fs17 from "node:fs";
 import os2 from "node:os";
-import path13 from "node:path";
-import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
+import path14 from "node:path";
+import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL8 } from "node:url";
 
 // src/scripts/_lib/transcript_entry.ts
 function _isObject(v) {
@@ -210,8 +235,9 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 // src/scripts/_lib/prompt_shape.ts
 function isSyntheticPrompt(prompt) {
   const head = prompt.trimStart().slice(0, 400);
-  return head.startsWith("[SYSTEM NOTIFICATION - NOT USER INPUT]") || head.startsWith("<task-notification>") || head.startsWith("<system-reminder>") || head.startsWith("<local-command-caveat>") || head.startsWith("<agent-message") || head.startsWith("Your claude.ai usage limit has reset") || /^\[SYSTEM NOTIFICATION\b/.test(head);
+  return head.startsWith("[SYSTEM NOTIFICATION - NOT USER INPUT]") || head.startsWith("<task-notification>") || head.startsWith("<system-reminder>") || head.startsWith("<local-command-caveat>") || head.startsWith("<agent-message") || head.startsWith("Your claude.ai usage limit has reset") || /^\[SYSTEM NOTIFICATION\b/.test(head) || AGENT_MESSAGE_FRAME.test(head);
 }
+var AGENT_MESSAGE_FRAME = /^Another Claude session sent a message:\s*\n\s*<(?:agent-message|cross-session-message)\b/;
 var DOCUMENT_HEAD = /^\s*(#{1,6}\s|-{3,}\s*$|={3,}\s*$|<[A-Za-z][\w-]*>\s*$)/;
 function humanAuthoredLead(text) {
   const kept = [];
@@ -262,8 +288,8 @@ function stripInjectedRegions(text) {
 }
 
 // src/scripts/language_mirror_hook.ts
-var EXIT_ALLOW = 0;
-var EXIT_WARN = 2;
+var EXIT_ALLOW2 = 0;
+var EXIT_WARN2 = 2;
 var STATE_FILE = path.join("agents", "state", "language-mirror.json");
 var STATE_DIR = path.join("agents", "state", "language-mirror");
 var STATE_RETENTION_DAYS = 7;
@@ -463,24 +489,24 @@ function _clearPinLost(consumer_root, session_id) {
 }
 function _reEmitAfterCompaction(consumer_root, session_id, write_json = atomic_write_json) {
   if (!hasStableSessionId(session_id)) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   if (!_pinLost(consumer_root, session_id)) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
-  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW, () => {
+  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW2, () => {
     const previous = _loadState(path.join(consumer_root, statePathFor2(session_id)));
     const language = previous.language;
     const source = previous.source === "system-locale" ? "system-locale" : "prompt";
     _clearPinLost(consumer_root, session_id);
     if (language !== "de" && language !== "en") {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     if (!_ownsPin(previous, session_id)) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     if (!_resetDistance(consumer_root, previous, session_id, write_json)) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     process.stdout.write(
       `${JSON.stringify({
@@ -490,7 +516,7 @@ function _reEmitAfterCompaction(consumer_root, session_id, write_json = atomic_w
       })}
 `
     );
-    return EXIT_WARN;
+    return EXIT_WARN2;
   });
 }
 function _pruneLegacyState(consumer_root) {
@@ -570,19 +596,19 @@ function _resetDistance(consumer_root, expected, session_id, write_json = atomic
 }
 function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_write_json) {
   if (is_replay_mode()) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   if (!hasStableSessionId(session_id)) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
-  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW, () => {
+  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW2, () => {
     const previous = _loadState(path.join(consumer_root, statePathFor2(session_id)));
     const language = previous.language;
     if (language !== "de" && language !== "en") {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     if (!_ownsPin(previous, session_id)) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     const seen = typeof previous.tool_calls_since_pin === "number" && previous.tool_calls_since_pin >= 0 ? previous.tool_calls_since_pin : 0;
     const advanced = seen + 1;
@@ -595,10 +621,10 @@ function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_wri
       write_json
     );
     if (!due) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     if (!written) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     const source = previous.source === "system-locale" ? "system-locale" : "prompt";
     process.stdout.write(
@@ -609,7 +635,7 @@ function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_wri
       })}
 `
     );
-    return EXIT_WARN;
+    return EXIT_WARN2;
   });
 }
 function _onToolUse(consumer_root, session_id, write_json = atomic_write_json) {
@@ -627,24 +653,24 @@ function run(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
   }
   const payload = _isObject2(envelope["payload"]) ? envelope["payload"] : envelope;
   const event = typeof envelope["event"] === "string" ? envelope["event"] : "";
   if (event === "pre_compact") {
     _setPinLost(options.consumer_root, _sessionId(envelope));
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   if (event === "post_tool_use") {
     return _onToolUse(options.consumer_root, _sessionId(envelope), options.write_json);
   }
   const prompt = _extractPrompt(payload);
   if (!prompt) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   if (isSyntheticPrompt(prompt)) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
   const stateful = hasStableSessionId(session_id);
@@ -682,9 +708,9 @@ function run(stdin_text, options) {
       `${JSON.stringify({ decision: "warn", reason: noticeText(effective, effectiveSource), additional_context: pinText(effective, effectiveSource) })}
 `
     );
-    return EXIT_WARN;
+    return EXIT_WARN2;
   }
-  return EXIT_ALLOW;
+  return EXIT_ALLOW2;
 }
 function _errText(err) {
   const t = err instanceof Error ? err.message : String(err);
@@ -871,7 +897,7 @@ function extractObjects(op, text) {
 }
 
 // src/scripts/git_authorization_hook.ts
-var EXIT_ALLOW2 = 0;
+var EXIT_ALLOW3 = 0;
 var STATE_FILE2 = path2.join("agents", "state", "git-authorization.json");
 var STATE_DIR2 = path2.join("agents", "state", "git-authorization");
 var PENDING_DIR = path2.join("agents", "state", "git-authorization-pending");
@@ -1431,7 +1457,7 @@ function run2(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW2;
+      return EXIT_ALLOW3;
     }
   }
   const payload = _isObject3(envelope["payload"]) ? envelope["payload"] : envelope;
@@ -1444,11 +1470,11 @@ function run2(stdin_text, options) {
     }
   }
   if (!prompt) {
-    return EXIT_ALLOW2;
+    return EXIT_ALLOW3;
   }
   const session = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
   if (!humanTypedThisTurn(prompt)) {
-    return EXIT_ALLOW2;
+    return EXIT_ALLOW3;
   }
   const { authorized, evidence } = classifyAuthorization(prompt);
   const pending = takePending(options.consumer_root, session, Date.now());
@@ -1489,7 +1515,7 @@ function run2(stdin_text, options) {
 `
     );
   }
-  return EXIT_ALLOW2;
+  return EXIT_ALLOW3;
 }
 function main2(argv) {
   const args = argv ?? process.argv.slice(2);
@@ -1949,7 +1975,7 @@ var COMMAND_OBJECTS = {
 // src/scripts/hooks/turn_end_gate_hook.ts
 import * as fs12 from "node:fs";
 import * as path10 from "node:path";
-import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL6 } from "node:url";
+import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
 
 // src/scripts/check_reply_consistency.ts
 import * as fs3 from "node:fs";
@@ -2115,11 +2141,11 @@ function _rglobMdSorted(dir) {
   return out;
 }
 function _relToPosixOrAbs(child, root) {
-  const rel = path3.relative(root, child);
-  if (rel === "" || rel.startsWith("..") || path3.isAbsolute(rel)) {
+  const rel2 = path3.relative(root, child);
+  if (rel2 === "" || rel2.startsWith("..") || path3.isAbsolute(rel2)) {
     return child.split(path3.sep).join("/");
   }
-  return rel.split(path3.sep).join("/");
+  return rel2.split(path3.sep).join("/");
 }
 function cmd_scan_dir(root) {
   let roots;
@@ -2506,8 +2532,8 @@ function looksLikeGraph(p) {
 function detectSources(root, nativeCache) {
   const abs = path4.resolve(root);
   const out = [];
-  for (const rel of consumerCandidates(abs)) {
-    const p = path4.join(abs, rel);
+  for (const rel2 of consumerCandidates(abs)) {
+    const p = path4.join(abs, rel2);
     if (fs4.existsSync(p)) {
       const { ok, sha } = looksLikeGraph(p);
       if (ok) out.push({ kind: "consumer", path: p, present: true, ...freshness(abs, p, sha) });
@@ -3159,15 +3185,15 @@ function toRepoRelative(root, paths) {
   });
 }
 function _relativeInside(from, to) {
-  let rel;
+  let rel2;
   try {
-    rel = path6.relative(from, to);
+    rel2 = path6.relative(from, to);
   } catch {
     return null;
   }
-  if (rel === "") return ".";
-  if (rel === ".." || rel.startsWith(`..${path6.sep}`) || path6.isAbsolute(rel)) return null;
-  return rel.split(path6.sep).join("/");
+  if (rel2 === "") return ".";
+  if (rel2 === ".." || rel2.startsWith(`..${path6.sep}`) || path6.isAbsolute(rel2)) return null;
+  return rel2.split(path6.sep).join("/");
 }
 function _resolveReal(p) {
   const abs = path6.resolve(p);
@@ -3278,6 +3304,205 @@ function buildFeederRow(input) {
   };
 }
 
+// src/scripts/hooks/svg_obligation.ts
+import * as crypto from "node:crypto";
+import * as fs8 from "node:fs";
+import * as path7 from "node:path";
+var EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var PLANTED_PREFIXES = [
+  "tests/design-artifacts/fixtures/",
+  "tests/design-artifacts/scenarios/"
+];
+function hasErrorFinding(m) {
+  const f = m.asset?.findings;
+  return Array.isArray(f) && f.some((x) => x?.severity === "error");
+}
+var rel = (root, p) => {
+  const slashed = p.split(path7.sep).join("/");
+  if (!path7.isAbsolute(p)) return path7.posix.normalize(slashed).replace(/^\.\//, "");
+  const inside = path7.relative(root, p).split(path7.sep).join("/");
+  return inside === "" || inside.startsWith("../") ? slashed : inside;
+};
+function isPlantedFixture(relPath, root = "") {
+  const norm = rel(root, relPath);
+  return PLANTED_PREFIXES.some((prefix) => norm.startsWith(prefix));
+}
+function readAssetManifests(root) {
+  const dir = path7.join(root, RENDER_REL);
+  let entries;
+  try {
+    entries = fs8.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of entries) {
+    let raw;
+    try {
+      raw = fs8.readFileSync(path7.join(dir, name, "manifest.json"), "utf8");
+    } catch {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed.profile === "asset") out.push(parsed);
+    } catch {
+    }
+  }
+  return out;
+}
+function dischargeFor(manifests, digest) {
+  let staticOnly = false;
+  for (const m of manifests) {
+    if (m.verification === "verified" && m.asset?.digest === digest && !hasErrorFinding(m)) {
+      return "verified";
+    }
+    if (m.reason === "renderer-absent" && m.static?.digest === digest && m.static.errors === 0) {
+      staticOnly = true;
+    }
+  }
+  return staticOnly ? "static-only" : null;
+}
+var TRANSCRIPT_FALLBACK_REASON = "transcript fallback: no readable `post_tool_use` render record exists for this turn \u2014 no live recorder on this host (`agent-config hooks:status`), or a render whose exit status the host did not report \u2014 so the manifest was read under the transcript rule \u2014 an omission check, not an attestation";
+function recordVerdict(root, abs, digest, records) {
+  let changed = false;
+  for (const r of records) {
+    if (path7.resolve(root, r.file) !== abs || r.file_digest !== digest) continue;
+    const read = recordedManifest(root, r);
+    if (read === null) continue;
+    if ("changed" in read) {
+      changed = true;
+      continue;
+    }
+    const kind = dischargeFor([read.manifest], digest);
+    if (kind !== null) return kind;
+  }
+  return changed ? "the manifest the observed render left has changed since, so it is no longer the record of that render" : "no successful `ui:render --profile asset` of these bytes was observed by the hook this turn with a manifest that discharges them \u2014 a manifest written by any other route discharges nothing";
+}
+function readSvgObligations(root, inputs) {
+  const open = [];
+  const discharged = [];
+  const seen = /* @__PURE__ */ new Set();
+  let manifests = null;
+  for (const { path: raw, rendered } of inputs.edits) {
+    if (!/\.svg$/i.test(raw)) continue;
+    const relPath = rel(root, raw);
+    if (seen.has(relPath)) continue;
+    seen.add(relPath);
+    if (isPlantedFixture(relPath, root)) continue;
+    const abs = path7.isAbsolute(raw) ? raw : path7.join(root, relPath);
+    let bytes;
+    try {
+      bytes = fs8.readFileSync(abs);
+    } catch {
+      continue;
+    }
+    const digest = crypto.createHash("sha256").update(bytes).digest("hex");
+    if (Array.isArray(inputs.recorded)) {
+      const verdict = recordVerdict(root, path7.resolve(root, abs), digest, inputs.recorded);
+      if (verdict === "verified" || verdict === "static-only") discharged.push({ file: relPath, kind: verdict });
+      else open.push({ file: relPath, reason: verdict });
+      continue;
+    }
+    if (!renderNames(rendered, relPath)) {
+      open.push({
+        file: relPath,
+        reason: "no `ui:render --profile asset` naming this file ran after THIS file's last edit, so no manifest on disk can be attributed to it \u2014 a manifest written by any other route, and a render of some other file, both discharge nothing"
+      });
+      continue;
+    }
+    if (inputs.renderDirTampered) {
+      open.push({
+        file: relPath,
+        reason: "this turn wrote into the render directory by a route other than `ui:render`, so no manifest there is evidence of a render \u2014 re-run the render in a turn that does not touch it"
+      });
+      continue;
+    }
+    manifests ??= readAssetManifests(root);
+    const kind = dischargeFor(manifests, digest);
+    if (kind === null) {
+      open.push({
+        file: relPath,
+        reason: "no asset manifest matches this file's current digest \u2014 a render that is `verified`, or a `renderer-absent` one whose static witness reports 0 errors on the same digest, discharges it"
+      });
+      continue;
+    }
+    discharged.push({ file: relPath, kind });
+  }
+  return { open, discharged };
+}
+function renderNames(commands, relPath) {
+  const base = relPath.split("/").pop() ?? relPath;
+  return commands.some((c) => {
+    const slashed = c.split(path7.sep).join("/");
+    const bounded = (needle) => new RegExp(`(^|[\\s/'"])${escapeRe(needle)}(\\s|$|['"])`).test(slashed);
+    return bounded(relPath) || bounded(base);
+  });
+}
+function writesRenderDir(command) {
+  if (isPureRender(command)) return false;
+  const slashed = command.split(path7.sep).join("/");
+  const names = /(^|[\s/'"])(render\/|manifest\.json\b)/.test(slashed) || slashed.includes("state/render");
+  const writes = />(?!&)|\b(tee|sponge)\b|\b(cp|mv|ln|install|rsync|dd)\s|\bsed\s+-i|\bwriteFile|\b(python[\d.]*|perl|ruby|node|deno|bun|php|osascript)\b/.test(
+    slashed.replace(/\s\d?>&\d\b/g, " ").replace(/\s2>\s*\/dev\/null\b/g, " ")
+  );
+  return names && writes;
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function openSvgObligation(workspaceRoot, toolCalls, recordedRaw = null) {
+  const recordedRenders = recordedRaw === null || hasInstrumentGap(recordedRaw) ? null : recordedRaw;
+  const lastEditOf = /* @__PURE__ */ new Map();
+  for (let i = 0; i < toolCalls.length; i += 1) {
+    const c = toolCalls[i];
+    if (!EDIT_TOOLS.has(c.name) || c.path === void 0) continue;
+    lastEditOf.set(c.path, i);
+  }
+  if (lastEditOf.size === 0) return null;
+  const edits = [...lastEditOf].map(([p, at]) => {
+    const rendered = [];
+    for (let i = at + 1; i < toolCalls.length; i += 1) {
+      const c = toolCalls[i];
+      if (c.name === "Bash" && c.command !== void 0 && isPureRender(c.command)) {
+        rendered.push(c.command);
+      }
+    }
+    return { path: p, rendered };
+  });
+  const renderDir = RENDER_REL.split(path7.sep).join("/");
+  const renderDirTampered = toolCalls.some((c) => {
+    if (EDIT_TOOLS.has(c.name) && c.path !== void 0) {
+      return rel(workspaceRoot, c.path).startsWith(`${renderDir}/`);
+    }
+    return c.name === "Bash" && c.command !== void 0 && writesRenderDir(c.command);
+  });
+  let reading;
+  try {
+    reading = readSvgObligations(workspaceRoot, {
+      edits,
+      renderDirTampered,
+      recorded: recordedRenders === null ? null : readAssetRenderRecords(recordedRenders)
+    });
+  } catch {
+    return null;
+  }
+  const first = reading.open[0];
+  if (first === void 0) return null;
+  const more = reading.open.length > 1 ? ` (and ${String(reading.open.length - 1)} more)` : "";
+  return {
+    // Reported under `verification` rather than a seventh detector id: it
+    // IS a verification finding — a file changed and nothing that can fail
+    // ran over it — and a new id would ripple through DETECTOR_IDS, the
+    // per-detector counters and the demotion contract for a distinction the
+    // operator never makes.
+    detector: "verification",
+    mode: "transcript",
+    evidence: first.file,
+    reason: `this turn edited an .svg and no render describes it${more} \u2014 ${first.reason}. A bare \`ui:render --profile asset\` that rendered nothing, and a test or lint run over other files, both discharge nothing: the gate reads the render, never the call.` + (recordedRenders === null ? ` (${TRANSCRIPT_FALLBACK_REASON})` : "")
+  };
+}
+
 // src/scripts/hooks/envelope.ts
 var ENVELOPE_KEYS = [
   "schema_version",
@@ -3332,524 +3557,6 @@ function unwrap(stdin_text, default_platform = "generic") {
   ];
 }
 
-// src/scripts/hooks/subagent_ledger_hook.ts
-import * as crypto from "node:crypto";
-import * as fs8 from "node:fs";
-import * as path7 from "node:path";
-import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
-
-// src/scripts/_lib/subagent_response.ts
-var MAX_SUMMARY_CHARS = 2e3;
-var MAX_RESPONSE_LINE_CHARS = 240;
-var MAX_RESPONSE_ENTRIES = 40;
-var MAX_ARTIFACT_REF_CHARS = 200;
-var MAX_ENVELOPE_CHARS = 12e3;
-var CONFIDENCE = /* @__PURE__ */ new Set(["low", "medium", "high"]);
-var RESPONSE_REQUIRED_FIELDS = [
-  "summary",
-  "handoff",
-  "confidence",
-  "findings",
-  "risks"
-];
-function countContractFields(input) {
-  if (input === null || typeof input !== "object") return 0;
-  const r = input;
-  return RESPONSE_REQUIRED_FIELDS.filter((k) => Object.hasOwn(r, k)).length;
-}
-function validateResponse(input) {
-  const errors = [];
-  if (input === null || typeof input !== "object") {
-    return { valid: false, errors: ["response is not an object"] };
-  }
-  const r = input;
-  if (typeof r.summary !== "string") errors.push("summary missing or not a string");
-  if (typeof r.handoff !== "string") errors.push("handoff missing or not a string");
-  if (!CONFIDENCE.has(r.confidence)) errors.push(`confidence must be low|medium|high (got ${String(r.confidence)})`);
-  if (!Array.isArray(r.findings)) errors.push("findings missing or not an array");
-  if (!Array.isArray(r.risks)) errors.push("risks missing or not an array");
-  if (Array.isArray(r.findings)) {
-    for (const [i, f] of r.findings.entries()) {
-      if (!f || typeof f.title !== "string") errors.push(`finding[${i}] missing title`);
-      const refs = f?.evidence_refs;
-      if (refs && refs.some((x) => typeof x !== "string" || x.includes("\n"))) {
-        errors.push(`finding[${i}] evidence_refs must be ref tokens, not bodies`);
-      }
-    }
-  }
-  if (r.assumptions !== void 0) {
-    if (!Array.isArray(r.assumptions)) {
-      errors.push("assumptions must be an array of {statement, basis, epistemic_state}");
-    } else {
-      for (const [i, a] of r.assumptions.entries()) {
-        errors.push(...validateAssumption(a, `assumptions[${i}]`));
-      }
-    }
-  }
-  if (typeof r.summary === "string" && r.summary.length > MAX_SUMMARY_CHARS) {
-    errors.push(`summary is ${r.summary.length} chars (max ${MAX_SUMMARY_CHARS}) \u2014 the envelope carries a bounded summary; the full result belongs on disk (artifact_paths)`);
-  }
-  if (typeof r.handoff === "string" && r.handoff.length > MAX_RESPONSE_LINE_CHARS) {
-    errors.push(`handoff is ${r.handoff.length} chars (max ${MAX_RESPONSE_LINE_CHARS})`);
-  }
-  for (const [key, arr] of [
-    ["findings", r.findings],
-    ["risks", r.risks],
-    ["artifact_paths", r.artifact_paths]
-  ]) {
-    if (Array.isArray(arr) && arr.length > MAX_RESPONSE_ENTRIES) {
-      errors.push(`${key} carries ${arr.length} entries (max ${MAX_RESPONSE_ENTRIES}) \u2014 an envelope is a handoff, not a transcript`);
-    }
-  }
-  if (Array.isArray(r.risks)) {
-    for (const [i, risk] of r.risks.entries()) {
-      if (typeof risk === "string" && risk.length > MAX_RESPONSE_LINE_CHARS) {
-        errors.push(`risks[${i}] is ${risk.length} chars (max ${MAX_RESPONSE_LINE_CHARS})`);
-      }
-    }
-  }
-  if (Array.isArray(r.findings)) {
-    for (const [i, f] of r.findings.entries()) {
-      if (f && typeof f.title === "string" && f.title.length > MAX_RESPONSE_LINE_CHARS) {
-        errors.push(`finding[${i}] title is ${f.title.length} chars (max ${MAX_RESPONSE_LINE_CHARS})`);
-      }
-    }
-  }
-  if (r.artifact_paths !== void 0) {
-    if (!Array.isArray(r.artifact_paths)) {
-      errors.push("artifact_paths must be an array of path ref tokens");
-    } else {
-      for (const [i, p] of r.artifact_paths.entries()) {
-        if (typeof p !== "string" || p.includes("\n") || p.length > MAX_ARTIFACT_REF_CHARS) {
-          errors.push(`artifact_paths[${i}] must be a single-line path ref \u2264 ${MAX_ARTIFACT_REF_CHARS} chars`);
-        }
-      }
-    }
-  }
-  try {
-    const serialized = JSON.stringify(input);
-    if (serialized.length > MAX_ENVELOPE_CHARS) {
-      errors.push(`envelope serializes to ${serialized.length} chars (max ${MAX_ENVELOPE_CHARS}) \u2014 move content to disk and reference it via artifact_paths`);
-    }
-  } catch {
-    errors.push("envelope is not JSON-serializable");
-  }
-  return { valid: errors.length === 0, errors };
-}
-
-// src/scripts/hooks/exit_codes.ts
-var EXIT_ALLOW3 = 0;
-var EXIT_BLOCK = 1;
-var EXIT_WARN2 = 2;
-var EXIT_ERROR = 3;
-var EXIT_CODES = Object.freeze([
-  Object.freeze({
-    code: EXIT_ALLOW3,
-    name: "allow",
-    meaning: "no objection; the dispatcher passes the call through",
-    owner: "every concern \u2014 the default verdict",
-    authorizedBy: "nothing; allowing needs no authority"
-  }),
-  Object.freeze({
-    code: EXIT_BLOCK,
-    name: "block",
-    meaning: "refuse the call; the dispatcher lowers this onto the host deny channel",
-    owner: "a concern declared `severity: blocking` in hook_manifest.yaml",
-    authorizedBy: "the manifest entry plus its row in the BLOCKING_ALLOWLIST of tests/hooks/concern_severity.test.ts \u2014 an advisory concern emitting this is downgraded to warn by dispatch_hook._is_advisory"
-  }),
-  Object.freeze({
-    code: EXIT_WARN2,
-    name: "warn",
-    meaning: "advisory; the dispatcher exits 0 and surfaces the reason",
-    owner: "any concern",
-    authorizedBy: "nothing; warning is the ceiling for an advisory concern and is always available to a blocking one"
-  }),
-  Object.freeze({
-    code: EXIT_ERROR,
-    name: "error",
-    meaning: "the concern crashed, timed out, or could not decide \u2014 any rc >= 3. The dispatcher resolves it by the concern`s declared severity, never by the number itself",
-    owner: "no concern emits this on purpose; the runtime does",
-    authorizedBy: "hook_manifest.yaml `severity` alone \u2014 blocking refuses, anything else fails open; `fail_closed` is no longer read on this branch. See docs/contracts/hook-architecture-v1.md \xA7 Exit-code semantics"
-  })
-]);
-
-// src/scripts/hooks/subagent_ledger_hook.ts
-function isObject2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-var LEDGER_DIR = path7.join("agents", "runtime", "state", "subagent-ledger");
-var OPEN_SUBDIR = "open";
-var OPEN_RECORD_TTL_MS = 24 * 60 * 60 * 1e3;
-function refFor(agentId) {
-  return crypto.createHash("sha256").update(agentId, "utf8").digest("hex").slice(0, 12);
-}
-function unwrapPayload(envelope) {
-  const inner = envelope["payload"];
-  return isObject2(inner) ? inner : envelope;
-}
-function str(payload, ...keys) {
-  for (const k of keys) {
-    const v = payload[k];
-    if (typeof v === "string" && v) return v;
-  }
-  return null;
-}
-function extractParentId(payload, ownId) {
-  const explicit = str(payload, "parent_agent_id", "parentAgentId");
-  if (explicit) return explicit;
-  const session = payload["session"];
-  if (isObject2(session)) {
-    const sessionAgent = str(session, "agent_id", "agentId");
-    if (sessionAgent && sessionAgent !== ownId) return sessionAgent;
-  }
-  return null;
-}
-function classifyEnvelope(message) {
-  if (message === null || !message.trim()) {
-    return { verdict: "no_message", error_count: 0, field_hits: 0 };
-  }
-  const candidates = _jsonObjectCandidates(message);
-  if (candidates.length === 0) return { verdict: "no_envelope", error_count: 0, field_hits: 0 };
-  let best = null;
-  for (const candidate of candidates) {
-    const result = validateResponse(candidate);
-    const fieldHits = countContractFields(candidate);
-    if (result.valid) return { verdict: "ok", error_count: 0, field_hits: fieldHits };
-    if (best === null || fieldHits > best.field_hits) {
-      best = {
-        verdict: fieldHits === 0 ? "foreign_object" : "fail",
-        error_count: result.errors.length,
-        field_hits: fieldHits
-      };
-    }
-  }
-  return best ?? { verdict: "no_envelope", error_count: 0, field_hits: 0 };
-}
-function _jsonObjectCandidates(message) {
-  const texts = [];
-  for (const match of message.matchAll(/^[ \t]*```[ \t]*(?:json)?[ \t]*\r?\n([\s\S]*?)^[ \t]*```/gm)) {
-    if (match[1]) texts.push(match[1]);
-  }
-  let depth = 0;
-  let start = -1;
-  let inString = false;
-  let escaped = false;
-  for (let i = 0; i < message.length; i++) {
-    const ch = message[i];
-    if (inString) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === '"') inString = false;
-      continue;
-    }
-    if (ch === '"') inString = true;
-    else if (ch === "{") {
-      if (depth === 0) start = i;
-      depth++;
-    } else if (ch === "}") {
-      if (depth > 0) {
-        depth--;
-        if (depth === 0 && start !== -1) {
-          texts.push(message.slice(start, i + 1));
-          start = -1;
-        }
-      }
-    }
-  }
-  const out = [];
-  for (const text of texts) {
-    try {
-      const parsed = JSON.parse(text.trim());
-      if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) out.push(parsed);
-    } catch {
-    }
-  }
-  return out;
-}
-function openDir(root) {
-  return path7.join(root, LEDGER_DIR, OPEN_SUBDIR);
-}
-function openFile(root, ref) {
-  return path7.join(openDir(root), `${ref}.json`);
-}
-var DEPTH_BASES = /* @__PURE__ */ new Set(["observed", "asserted-parent", "assumed-root"]);
-function _asOpenRecord(value, expectedRef) {
-  if (!isObject2(value)) return null;
-  const ref = value["ref"];
-  if (typeof ref !== "string" || ref !== expectedRef) return null;
-  if (typeof value["started_at"] !== "string") return null;
-  if (typeof value["depth"] !== "number" || !Number.isFinite(value["depth"])) return null;
-  if (typeof value["depth_basis"] !== "string" || !DEPTH_BASES.has(value["depth_basis"])) return null;
-  const agentType = value["agent_type"];
-  const parentRef = value["parent_ref"];
-  const sessionId = value["session_id"];
-  return {
-    ref,
-    agent_type: typeof agentType === "string" ? agentType : null,
-    started_at: value["started_at"],
-    parent_ref: typeof parentRef === "string" ? parentRef : null,
-    depth: value["depth"],
-    depth_basis: value["depth_basis"],
-    session_id: typeof sessionId === "string" ? sessionId : null
-  };
-}
-function readOpenRecords(root) {
-  const out = /* @__PURE__ */ new Map();
-  let names;
-  try {
-    names = fs8.readdirSync(openDir(root));
-  } catch {
-    return out;
-  }
-  for (const name of names) {
-    if (!name.endsWith(".json")) continue;
-    const expectedRef = name.slice(0, -".json".length);
-    try {
-      const raw = fs8.readFileSync(path7.join(openDir(root), name), "utf8");
-      const rec = _asOpenRecord(JSON.parse(raw), expectedRef);
-      if (rec) out.set(rec.ref, rec);
-    } catch {
-    }
-  }
-  return out;
-}
-function resolveDepth(parentRef, open) {
-  if (parentRef === null) return { depth: 1, depth_basis: "assumed-root" };
-  const parent = open.get(parentRef);
-  if (!parent) return { depth: 2, depth_basis: "asserted-parent" };
-  return { depth: parent.depth + 1, depth_basis: "observed" };
-}
-function ledgerFileFor2(root, ts) {
-  return path7.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
-}
-function appendLedgerLine(root, ts, line) {
-  if (is_replay_mode()) return;
-  const file = ledgerFileFor2(root, ts);
-  fs8.mkdirSync(path7.dirname(file), { recursive: true });
-  fs8.appendFileSync(file, `${JSON.stringify(line)}
-`, "utf8");
-}
-var WALL_CLOCK_ARMS_MS = [
-  { label: "5m", ms: 5 * 60 * 1e3 },
-  { label: "15m", ms: 15 * 60 * 1e3 },
-  { label: "30m", ms: 30 * 60 * 1e3 },
-  { label: "2h", ms: 2 * 60 * 60 * 1e3 }
-];
-function armsExceeded(elapsedMs) {
-  if (elapsedMs === null || !Number.isFinite(elapsedMs)) return [];
-  return WALL_CLOCK_ARMS_MS.filter((a) => elapsedMs >= a.ms).map((a) => a.label);
-}
-function openRecordStats(root, nowMs = Date.now()) {
-  const ledgerPresent = fs8.existsSync(path7.join(root, LEDGER_DIR));
-  const open = readOpenRecords(root);
-  let maxDepth = 0;
-  let counted = 0;
-  let stale = 0;
-  for (const rec of open.values()) {
-    const started = Date.parse(rec.started_at);
-    const isStale = Number.isFinite(started) && nowMs - started >= OPEN_RECORD_TTL_MS;
-    if (isStale) {
-      stale++;
-      continue;
-    }
-    counted++;
-    if (rec.depth > maxDepth) maxDepth = rec.depth;
-  }
-  return {
-    open_count: counted,
-    max_depth: maxDepth,
-    stale_excluded: stale,
-    ledger_present: ledgerPresent
-  };
-}
-function writeOpenRecord(root, rec) {
-  atomic_write_json(openFile(root, rec.ref), rec);
-}
-function removeOpenRecord(root, ref) {
-  if (is_replay_mode()) return;
-  try {
-    fs8.unlinkSync(openFile(root, ref));
-  } catch {
-  }
-}
-function countOpen(root) {
-  try {
-    return fs8.readdirSync(openDir(root)).filter((n) => n.endsWith(".json")).length;
-  } catch {
-    return 0;
-  }
-}
-function reapStaleOpenRecords(root, nowIso) {
-  const now = Date.parse(nowIso);
-  if (!Number.isFinite(now)) return 0;
-  let reaped = 0;
-  for (const rec of readOpenRecords(root).values()) {
-    const started = Date.parse(rec.started_at);
-    if (!Number.isFinite(started) || now - started < OPEN_RECORD_TTL_MS) continue;
-    removeOpenRecord(root, rec.ref);
-    reaped++;
-    appendLedgerLine(root, nowIso, {
-      event: "subagent_reaped",
-      ts: nowIso,
-      ref: rec.ref,
-      agent_type: rec.agent_type,
-      depth: rec.depth,
-      depth_basis: rec.depth_basis,
-      // R2 round 2, finding 5: the arm list is NOT repeated here. A reap
-      // fires only past OPEN_RECORD_TTL_MS (24 h), which exceeds every
-      // arm (largest: 2 h), so `stop_loss_arms_exceeded` would be a
-      // constant on this line — a field that cannot vary answers no
-      // question. `age_ms` carries strictly more information and is what
-      // a reader should aggregate over.
-      age_ms: now - started,
-      reason: "open record exceeded OPEN_RECORD_TTL_MS without a stop"
-    });
-  }
-  return reaped;
-}
-function appendUnidentified(root, event, nowIso, payload) {
-  appendLedgerLine(root, nowIso, {
-    event,
-    ts: nowIso,
-    ref: null,
-    unidentified: true,
-    // The agent TYPE is an id-shaped enum and may still be present; it is
-    // the only thing salvageable from a payload with no id.
-    agent_type: str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
-    reason: "payload carried no agent id \u2014 nothing to correlate start with stop"
-  });
-}
-function handleStart(root, payload, nowIso, sessionId) {
-  const agentId = str(payload, "agent_id", "agentId");
-  if (agentId === null) {
-    appendUnidentified(root, "subagent_start", nowIso, payload);
-    return;
-  }
-  const ref = refFor(agentId);
-  const parentId = extractParentId(payload, agentId);
-  const parentRef = parentId ? refFor(parentId) : null;
-  const { depth, depth_basis } = resolveDepth(parentRef, readOpenRecords(root));
-  const rec = {
-    ref,
-    agent_type: str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
-    started_at: nowIso,
-    parent_ref: parentRef,
-    depth,
-    depth_basis,
-    session_id: sessionId
-  };
-  writeOpenRecord(root, rec);
-  appendLedgerLine(root, nowIso, {
-    event: "subagent_start",
-    ts: nowIso,
-    ref,
-    // Phase 1 Step 4 correction (b): without this the dispatch denominator
-    // is not per-session. Three sessions share one ledger file, so a rate
-    // computed over the file aggregates strangers — the measured window
-    // held 7 starts against 25 stops, one of them an agent type this
-    // session never dispatched. The open record already carried it; the
-    // appended line did not, and the line is what a rate is computed from.
-    session_id: sessionId,
-    agent_type: rec.agent_type,
-    parent_ref: parentRef,
-    depth,
-    depth_basis,
-    concurrent_open: countOpen(root)
-  });
-}
-function handleStop(root, payload, nowIso, sessionId) {
-  const agentId = str(payload, "agent_id", "agentId");
-  if (agentId === null) {
-    appendUnidentified(root, "subagent_stop", nowIso, payload);
-    return;
-  }
-  const ref = refFor(agentId);
-  const rec = readOpenRecords(root).get(ref) ?? null;
-  let durationMs = null;
-  if (rec) {
-    const started = Date.parse(rec.started_at);
-    if (Number.isFinite(started)) durationMs = Math.max(0, Date.parse(nowIso) - started);
-  }
-  const parse2 = classifyEnvelope(str(payload, "last_assistant_message", "lastAssistantMessage"));
-  removeOpenRecord(root, ref);
-  appendLedgerLine(root, nowIso, {
-    event: "subagent_stop",
-    ts: nowIso,
-    ref,
-    // The session this stop was OBSERVED in, read from the same envelope
-    // position as the start's — never back-filled from `rec`, which would
-    // relabel a cross-session stop as belonging to the dispatching session
-    // and hide exactly the mismatch this field exists to expose.
-    session_id: sessionId,
-    agent_type: rec?.agent_type ?? str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
-    depth: rec?.depth ?? null,
-    depth_basis: rec?.depth_basis ?? null,
-    // `null` = the matching start was never seen. That is a finding about
-    // the instrument's own coverage and is recorded as such, not as 0.
-    duration_ms: durationMs,
-    // Phase 3 Step 3, shadow: which wall-clock arms this dispatch would
-    // have tripped. Recorded, never acted on.
-    stop_loss_arms_exceeded: armsExceeded(durationMs),
-    start_seen: rec !== null,
-    envelope_parse: parse2.verdict,
-    envelope_error_count: parse2.error_count,
-    // Beside the count, never instead of it: the count says how wrong the
-    // candidate was, this says whether it was aimed at the envelope.
-    envelope_field_hits: parse2.field_hits,
-    concurrent_open: countOpen(root)
-  });
-}
-function processEnvelope(envelope, consumerRoot) {
-  try {
-    if (!isObject2(envelope)) return EXIT_ALLOW3;
-    const event = envelope["event"];
-    if (event !== "subagent_start" && event !== "subagent_stop") return EXIT_ALLOW3;
-    const payload = unwrapPayload(envelope);
-    const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-    const sessionId = str(payload, "session_id", "sessionId") ?? str(envelope, "session_id", "sessionId");
-    reapStaleOpenRecords(consumerRoot, nowIso);
-    if (event === "subagent_start") handleStart(consumerRoot, payload, nowIso, sessionId);
-    else handleStop(consumerRoot, payload, nowIso, sessionId);
-  } catch {
-    return EXIT_ALLOW3;
-  }
-  return EXIT_ALLOW3;
-}
-function resolveConsumerRoot(envelope) {
-  if (isObject2(envelope)) {
-    const pr = str(envelope, "workspace_root", "project_root");
-    if (pr) return pr;
-    const payload = unwrapPayload(envelope);
-    const cwd = str(payload, "cwd");
-    if (cwd) return cwd;
-  }
-  return process.cwd();
-}
-function main4() {
-  const raw = readHookStdin();
-  let envelope = {};
-  try {
-    envelope = raw.trim() ? JSON.parse(raw) : {};
-  } catch {
-    return EXIT_ALLOW3;
-  }
-  return processEnvelope(envelope, resolveConsumerRoot(envelope));
-}
-function _isCliEntry4() {
-  if (true) {
-    return false;
-  }
-  if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL4(path7.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) return true;
-  try {
-    return fs8.realpathSync(fileURLToPath4(import.meta.url)) === fs8.realpathSync(path7.resolve(process.argv[1]));
-  } catch {
-    return false;
-  }
-}
-if (_isCliEntry4()) process.exit(main4());
-
 // src/scripts/_lib/turn_end_transcript.ts
 import * as fs11 from "node:fs";
 
@@ -3859,7 +3566,7 @@ import * as crypto2 from "node:crypto";
 import * as fs10 from "node:fs";
 import * as os from "node:os";
 import * as path9 from "node:path";
-import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
+import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
 
 // src/scripts/_lib/review_baseline.ts
 import { spawnSync } from "node:child_process";
@@ -4020,8 +3727,8 @@ function isSafeTranscriptPath(rawPath, opts = {}) {
   try {
     const realHome = fs10.realpathSync(homeDir);
     const realPath = fs10.realpathSync(rawPath);
-    const relative5 = path9.relative(realHome, realPath);
-    if (relative5 === "" || relative5.startsWith("..") || path9.isAbsolute(relative5)) {
+    const relative6 = path9.relative(realHome, realPath);
+    if (relative6 === "" || relative6.startsWith("..") || path9.isAbsolute(relative6)) {
       return false;
     }
     const { size } = fs10.statSync(realPath);
@@ -4114,10 +3821,10 @@ function totalNonDocMutatedLinesWithMeasure(cwd) {
   );
   return { lines: trackedLines + untrackedLines, measure: "exact" };
 }
-function isObject3(v) {
+function isObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function str2(v) {
+function str(v) {
   return typeof v === "string" ? v : "";
 }
 var DISPATCH_TOOL_RE = /^(agent|task)$/i;
@@ -4134,28 +3841,28 @@ function scanTranscriptForReviewer(transcriptText) {
     } catch {
       continue;
     }
-    if (!isObject3(obj) || obj["type"] !== "assistant") continue;
+    if (!isObject2(obj) || obj["type"] !== "assistant") continue;
     const msg = obj["message"];
-    if (!isObject3(msg)) continue;
+    if (!isObject2(msg)) continue;
     const content = msg["content"];
     if (!Array.isArray(content)) continue;
     for (const blk of content) {
-      if (!isObject3(blk) || blk["type"] !== "tool_use") continue;
-      const name = str2(blk["name"]);
+      if (!isObject2(blk) || blk["type"] !== "tool_use") continue;
+      const name = str(blk["name"]);
       const input = blk["input"];
-      const inputObj = isObject3(input) ? input : {};
+      const inputObj = isObject2(input) ? input : {};
       if (DISPATCH_TOOL_RE.test(name)) {
         const label = [
-          str2(inputObj["description"]),
-          str2(inputObj["subagent_type"])
+          str(inputObj["description"]),
+          str(inputObj["subagent_type"])
         ].filter(Boolean).join(" ");
         if (REVIEW_SHAPED_LABEL_RE.test(label)) return true;
-        const prompt = str2(inputObj["prompt"]);
+        const prompt = str(inputObj["prompt"]);
         if (REVIEW_SHAPED_PROMPT_RE.test(prompt)) return true;
         continue;
       }
       if (/^skill$/i.test(name)) {
-        const skillName = str2(inputObj["skill"]) || str2(inputObj["name"]) || str2(inputObj["command"]);
+        const skillName = str(inputObj["skill"]) || str(inputObj["name"]) || str(inputObj["command"]);
         if (REVIEW_SKILL_NAME_RE.test(skillName)) return true;
         continue;
       }
@@ -4194,7 +3901,7 @@ function sessionStateFile(workspaceRoot, sessionKey) {
   return path9.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
 }
 function deriveSessionKey2(envelope, payload) {
-  const raw = str2(envelope["session_id"]) || str2(payload["transcript_path"] ?? payload["transcriptPath"]);
+  const raw = str(envelope["session_id"]) || str(payload["transcript_path"] ?? payload["transcriptPath"]);
   const material = raw || "unknown-session";
   return crypto2.createHash("sha256").update(material).digest("hex");
 }
@@ -4220,7 +3927,7 @@ var FALLBACK_TO_TELEMETRY = {
   "head-moved": "head_moved",
   "mixed-measure": "mixed_measure"
 };
-function main5() {
+function main4() {
   const [envelope, payload] = unwrap(_read_stdin(), "claude");
   const event = String(envelope["event"] ?? "");
   if (event !== "" && event !== "stop") {
@@ -4256,7 +3963,7 @@ function main5() {
   if (hasFiredThisSession(workspace_root, sessionKey)) {
     return 0;
   }
-  const transcriptPath = str2(
+  const transcriptPath = str(
     payload["transcript_path"] ?? payload["transcriptPath"]
   ).trim();
   let reviewerRan = false;
@@ -4288,29 +3995,29 @@ function main5() {
     })}
 `
   );
-  return EXIT_WARN2;
+  return EXIT_WARN;
 }
-function _isCliEntry5() {
+function _isCliEntry4() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL5(path9.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL4(path9.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs10.realpathSync(fileURLToPath5(import.meta.url));
+    const here = fs10.realpathSync(fileURLToPath4(import.meta.url));
     const argv = fs10.realpathSync(path9.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry5()) {
-  process.exit(main5());
+if (_isCliEntry4()) {
+  process.exit(main4());
 }
 
 // src/scripts/_lib/turn_end_transcript.ts
@@ -4598,7 +4305,7 @@ function detectUnverifiedEdit(toolCalls, runState = null) {
   }
   for (let i = lastEdit + 1; i < toolCalls.length; i += 1) {
     const c = toolCalls[i];
-    if (c.name === "Bash" && c.command !== void 0 && isVerificationCommand(c.command)) {
+    if (c.name === "Bash" && c.command !== void 0 && isVerificationAttempt(c.command)) {
       return null;
     }
   }
@@ -4607,7 +4314,7 @@ function detectUnverifiedEdit(toolCalls, runState = null) {
     // The path, never the diff: the evidence span is quoted into a refusal,
     // and `ToolCall` is shaped so a file body cannot reach it.
     evidence: edited,
-    reason: "this turn changed a file and then ran no verification command \u2014 no test, type-check, lint or build call follows the last edit (verify-before-complete: a claim without a fresh run is unverified)",
+    reason: "this turn changed a file and then ran no verification command \u2014 no test, type-check, lint, build or asset render follows the last edit (verify-before-complete: a claim without a fresh run is unverified)",
     mode: "transcript"
   };
 }
@@ -4697,17 +4404,17 @@ function markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, detectors, prom
   } catch {
   }
 }
-function str3(v) {
+function str2(v) {
   return typeof v === "string" ? v : "";
 }
 function assembleDetectorInputs(envelope, payload) {
-  const workspaceRoot = str3(envelope["workspace_root"]) || process.cwd();
+  const workspaceRoot = str2(envelope["workspace_root"]) || process.cwd();
   let dispatchOpen = false;
   try {
     dispatchOpen = openRecordStats(workspaceRoot).open_count > 0;
   } catch {
   }
-  const transcriptPath = str3(
+  const transcriptPath = str2(
     payload["transcript_path"] ?? payload["transcriptPath"]
   );
   const { lastAssistant, turnOrdinal, toolCalls, assistantTurnTexts } = readTranscriptTail(
@@ -4715,13 +4422,13 @@ function assembleDetectorInputs(envelope, payload) {
     { maxBytes: TRANSCRIPT_READ_MAX_BYTES }
   );
   if (!lastAssistant) return null;
-  const payloadClosing = str3(
+  const payloadClosing = str2(
     payload["last_assistant_message"] ?? payload["lastAssistantMessage"]
   );
   const closingFromPayload = payloadClosing !== "" && !assistantTurnTexts.includes(payloadClosing);
   const turnTexts = closingFromPayload ? [...assistantTurnTexts, payloadClosing] : assistantTurnTexts;
-  const promptId = str3(payload["prompt_id"] ?? payload["promptId"]);
-  const rawSessionId = str3(envelope["session_id"]) || "";
+  const promptId = str2(payload["prompt_id"] ?? payload["promptId"]);
+  const rawSessionId = str2(envelope["session_id"]) || "";
   const sessionKey = deriveSessionKey(rawSessionId || "unknown-session");
   const runState = readTurnRunState(workspaceRoot, rawSessionId);
   return {
@@ -4771,6 +4478,7 @@ function runDetectors(inputs) {
     // on a completion CLAIM, and a turn waiting on a subagent has not
     // finished — so its closing is not the claim F is about. Same slot,
     // opposite trigger, opposite treatment of `dispatchOpen`.
+    openSvgObligation(workspaceRoot, toolCalls, runState?.asset_renders ?? null),
     dispatchOpen ? null : detectUntestedChange(lastAssistant, toolCalls, runState)
   ]) {
     if (f) findings.push(f);
@@ -4831,13 +4539,13 @@ function recordShadow(inputs, layer) {
   } catch {
   }
 }
-function main6() {
+function main5() {
   let envelope;
   let payload;
   try {
     [envelope, payload] = unwrap(readHookStdin(), "claude");
   } catch {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   if (payload["stop_hook_active"] === true) {
     try {
@@ -4845,17 +4553,17 @@ function main6() {
       if (retryInputs !== null) recordShadow(retryInputs, "stop_hook_active");
     } catch {
     }
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const inputs = assembleDetectorInputs(envelope, payload);
-  if (inputs === null) return EXIT_ALLOW3;
+  if (inputs === null) return EXIT_ALLOW;
   if (alreadyRefusedTurn(inputs.workspaceRoot, inputs.sessionKey, inputs.turnOrdinal)) {
     recordShadow(inputs, "refused_turn");
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const findings = runDetectors(inputs);
   recordGraphFeeder(inputs, findings, "live");
-  if (findings.length === 0) return EXIT_ALLOW3;
+  if (findings.length === 0) return EXIT_ALLOW;
   markRefusedTurn(
     inputs.workspaceRoot,
     inputs.sessionKey,
@@ -4876,27 +4584,27 @@ ${lines.join("\n")}
   );
   return EXIT_BLOCK;
 }
-function _isCliEntry6() {
+function _isCliEntry5() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL6(path10.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL5(path10.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs12.realpathSync(fileURLToPath6(import.meta.url));
+    const here = fs12.realpathSync(fileURLToPath5(import.meta.url));
     const argv = fs12.realpathSync(path10.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry6()) {
-  process.exit(main6());
+if (_isCliEntry5()) {
+  process.exit(main5());
 }
 
 // src/scripts/hooks/evidence_independence.ts
@@ -4904,7 +4612,7 @@ import { spawnSync as spawnSync3 } from "node:child_process";
 import crypto3 from "node:crypto";
 import fs13 from "node:fs";
 import path11 from "node:path";
-import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
+import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL6 } from "node:url";
 
 // src/scripts/_lib/test_delta.ts
 function isCodePath(p) {
@@ -5013,7 +4721,7 @@ function _load(target) {
 var WARN_TEXT = "First evaluation dispatch this turn. Two shapes fabricated a binding honest-null in the audited sessions \u2014 check your prompt for both before it goes out: (1) a verdict pre-loaded into the prompt, and (2) a scope narrowed to files you chose. A review you commissioned on your own work is admissible as gate evidence only when the prompt is recorded alongside the verdict.";
 function decide(tool, prompt, priorEvaluations) {
   if (!isDispatchTool(tool) || !isEvaluationPrompt(prompt)) {
-    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", evaluations: priorEvaluations };
+    return { exit: EXIT_ALLOW, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   const preloaded = preloadedVerdict(prompt);
   if (preloaded !== null) {
@@ -5026,11 +4734,11 @@ function decide(tool, prompt, priorEvaluations) {
     };
   }
   if (!isSelfScoped(prompt)) {
-    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", evaluations: priorEvaluations };
+    return { exit: EXIT_ALLOW, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   if (priorEvaluations >= 1) {
     return {
-      exit: EXIT_ALLOW3,
+      exit: EXIT_ALLOW,
       stdout: `${JSON.stringify({
         decision: "warn",
         reason: `Second evaluation dispatch of your own work in this turn. If both passes judge the SAME subject, that is verdict shopping \u2014 commissioning another with a different prompt or scope selects the answer instead of measuring it. Report what the first pass returned, then re-plan. If this is an implementation fan-out rather than a second review, carry on: this check reads prose and cannot tell the two apart with certainty.`
@@ -5041,7 +4749,7 @@ function decide(tool, prompt, priorEvaluations) {
     };
   }
   return {
-    exit: EXIT_ALLOW3,
+    exit: EXIT_ALLOW,
     stdout: `${JSON.stringify({ decision: "warn", reason: WARN_TEXT })}
 `,
     stderr: "",
@@ -5083,7 +4791,7 @@ function run3(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW3;
+      return EXIT_ALLOW;
     }
   }
   const target = path11.join(options.consumer_root, STATE_FILE3);
@@ -5102,7 +4810,7 @@ function run3(stdin_text, options) {
     if (staged !== null && touchesTestAndCode(staged)) {
       process.stdout.write(`${JSON.stringify({ decision: "warn", reason: flag })}
 `);
-      return EXIT_ALLOW3;
+      return EXIT_ALLOW;
     }
   }
   const decision = decide(tool, prompt, state.evaluations.length);
@@ -5133,7 +4841,7 @@ function _errText3(err) {
   const t = err instanceof Error ? err.message : String(err);
   return t.replace(/\s+/g, " ").trim().slice(0, 200);
 }
-function main7(argv) {
+function main6(argv) {
   const args = argv ?? process.argv.slice(2);
   let consumer_root = process.cwd();
   for (let i = 0; i < args.length; i += 1) {
@@ -5147,33 +4855,33 @@ function main7(argv) {
   }
   return run3(readHookStdin(), { consumer_root });
 }
-function _isCliEntry7() {
+function _isCliEntry6() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL7(path11.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL6(path11.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs13.realpathSync(fileURLToPath7(import.meta.url));
+    const here = fs13.realpathSync(fileURLToPath6(import.meta.url));
     const argv = fs13.realpathSync(path11.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry7()) {
-  process.exit(main7());
+if (_isCliEntry6()) {
+  process.exit(main6());
 }
 
 // src/scripts/hooks/delegation_nudge_hook.ts
-import fs14 from "node:fs";
-import path12 from "node:path";
-import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL8 } from "node:url";
+import fs16 from "node:fs";
+import path13 from "node:path";
+import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
 
 // src/scripts/_lib/auto_dispatch.ts
 var SIZE_FLOOR = 1;
@@ -5243,6 +4951,29 @@ function classifyLookup(taskText, opts = {}) {
     reason: "not lookup-shaped \u2014 regular classification path (never down-guessed)"
   };
 }
+function inferSliceTier(signals) {
+  const guard = signals.exceeds_mechanical_envelope === true;
+  switch (signals.slice_type) {
+    case "read-only-fanout":
+    case "mechanical-covered": {
+      if (guard) {
+        return {
+          tier: "medium",
+          tier_source: "inferred",
+          reason: `${signals.slice_type} slice, but scope exceeds the mechanical envelope \u2014 lite candidacy revoked`
+        };
+      }
+      const cascade = signals.slice_type === "mechanical-covered" ? " (verify-fail escalates to medium)" : "";
+      return { tier: "lite", tier_source: "inferred", reason: `${signals.slice_type} slice${cascade}` };
+    }
+    case "mutating-uncovered":
+      return { tier: "medium", tier_source: "inferred", reason: "mutating slice without test coverage" };
+    case "synthesis":
+      return { tier: "medium", tier_source: "inferred", reason: "synthesis/judgment slice \u2014 judge one tier up" };
+    default:
+      return { tier: "inherit", tier_source: "inherit", reason: "unknown/ambiguous slice type \u2014 session tier, never guess down" };
+  }
+}
 
 // src/scripts/_lib/judgment_ladder.ts
 var RENAME_RE = /\brename\s+\S+\s+to\s+\S+\b/i;
@@ -5452,6 +5183,86 @@ function resolveSubagentRouting(inp) {
   };
 }
 
+// src/scripts/_lib/hand_kinds.ts
+var HAND_KINDS = [
+  "classify",
+  "extract",
+  "summarise-given-text",
+  "draft-candidate",
+  "test-candidates",
+  "finding-proposal"
+];
+var HEAD_ONLY_KINDS = ["plan", "decide", "chair", "final-review", "write"];
+var _KINDS = new Set(HAND_KINDS);
+var _HEAD_ONLY = new Set(HEAD_ONLY_KINDS);
+var KIND_FROM_PROMPT = [
+  [/^\s*(?:propose|suggest|draft|write)\s+(?:unit\s+)?test(?:s|\s+cases?|\s+candidates?)?\b/i, "test-candidates"],
+  [/^\s*(?:propose|list)\s+(?:review\s+)?findings?\b/i, "finding-proposal"],
+  [/^\s*(?:classify|categori[sz]e|label)\b/i, "classify"],
+  [/^\s*extract\b/i, "extract"],
+  [/^\s*summari[sz]e\b/i, "summarise-given-text"],
+  [/^\s*draft\b/i, "draft-candidate"]
+];
+function handKindFromPrompt(text) {
+  for (const [re, kind] of KIND_FROM_PROMPT) if (re.test(text)) return kind;
+  return null;
+}
+
+// src/scripts/ai_council/free_rung.ts
+var import_yaml = __toESM(require_dist(), 1);
+import * as fs15 from "node:fs";
+
+// src/scripts/ai_council/kind_flip_state.ts
+import * as fs14 from "node:fs";
+import * as path12 from "node:path";
+var KIND_FLIPS_RELPATH = path12.join("agents", "runtime", "state", "hand-kind-flips.json");
+function isKindFlipped(stateRoot, kind) {
+  try {
+    const raw = JSON.parse(fs14.readFileSync(path12.join(stateRoot, KIND_FLIPS_RELPATH), "utf8"));
+    return raw.kinds?.[kind]?.route === "free";
+  } catch {
+    return false;
+  }
+}
+
+// src/scripts/ai_council/free_rung.ts
+var COUNCIL_CONFIG_ENV = "AI_COUNCIL_CONFIG";
+var COUNCIL_CONFIG_REL = "settings/.ai-council.yml";
+function keyPresent(ref) {
+  if (ref === void 0 || ref === null) return true;
+  if (typeof ref !== "string" || !ref.startsWith("env:")) return false;
+  return (process.env[ref.slice(4)] ?? "") !== "";
+}
+function freeRouteAvailable(configPath) {
+  let raw;
+  try {
+    raw = (0, import_yaml.parse)(fs15.readFileSync(configPath, "utf-8"), { version: "1.1" });
+  } catch {
+    return false;
+  }
+  const members = raw?.members;
+  if (members === null || typeof members !== "object") return false;
+  for (const [name, value] of Object.entries(members)) {
+    if (value === null || typeof value !== "object") continue;
+    const cfg = value;
+    if (cfg["enabled"] !== true) continue;
+    const parsed = parseRouteFields(name, cfg, false);
+    if ("error" in parsed || parsed.route === null) continue;
+    const model = typeof cfg["model"] === "string" ? cfg["model"] : "";
+    const t = resolveRouteTransport({ name, route: parsed.route, model, contentClass: "public-artifact", keyPresent: keyPresent(cfg["api_key_ref"]) });
+    if (t.available && t.billing !== "per-token") return true;
+  }
+  return false;
+}
+function councilConfigPath() {
+  const override = process.env[COUNCIL_CONFIG_ENV];
+  if (override) return override.startsWith("~/") ? `${process.env["HOME"] ?? ""}${override.slice(1)}` : override;
+  return resolve_with_fallback(COUNCIL_CONFIG_REL, { env: null });
+}
+function freeRungFor(stateRoot, kind, configPath) {
+  return isKindFlipped(stateRoot, kind) && configPath !== null && freeRouteAvailable(configPath);
+}
+
 // src/scripts/hooks/delegation_nudge_hook.ts
 function _isObject6(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -5544,10 +5355,10 @@ function resolveActivation(workspace_root, hostId) {
     agentTeams: host_manifest.agent_teams
   };
 }
-function recommendSliceTier(downshift, separate_quota_pool) {
+function recommendSliceTier(downshift, separate_quota_pool, sliceKind = "unknown") {
   const decision = resolveSubagentRouting({
-    task_tier: "lite",
-    session_tier: "high",
+    task_tier: inferSliceTier({ slice_type: sliceKind }).tier,
+    session_tier: "inherit",
     downshift,
     quota_arbitrage: false,
     model_map: {},
@@ -5555,9 +5366,18 @@ function recommendSliceTier(downshift, separate_quota_pool) {
   });
   return decision.tier;
 }
-function buildNudgeLine(rung, classification, sliceCount, tier) {
+var READ_ONLY_FANOUT_RE = /\b(find|locate|search|grep|list|inventor(?:y|ise|ize)|enumerate|count|which files|where (?:is|are)|finde|suche|liste|z(?:ä|ae)hle|wo (?:ist|sind))\b/i;
+var MUTATING_RE = /\b(fix|implement|edit|write|refactor|change|add|create|remove|delete|update|rename|migrate|build|move|replace|mach|bau|implementier\w*|(?:ä|ae)nder\w*|erstell\w*|l(?:ö|oe)sch\w*|f(?:ü|ue)g\w*|schreib\w*)\b/i;
+function sliceKindFromPrompt(prompt) {
+  return READ_ONLY_FANOUT_RE.test(prompt) && !MUTATING_RE.test(prompt) ? "read-only-fanout" : "unknown";
+}
+var LEG_COLD_START_UNCACHED_TOKENS = 182257;
+function buildNudgeLine(rung, classification, sliceCount, tier, sliceKind, handKind) {
   const unit = sliceCount === 1 ? "slice" : "slices";
   const rungLabel = rung === null ? "rung-?" : `rung-${rung}`;
+  if (rung === 0.5 && handKind !== void 0) {
+    return `<delegation-nudge>rung-0.5: free rung. This slice is a typed \`${handKind}\` task and an unpaid route is admissible \u2014 you may send it as ONE call via \`./scripts-run src/scripts/ask_transport --kind ${handKind} --content-class public-artifact "<slice>"\` (public-artifact text only; project content stays on a paid route). The return is a proposal: verify it before acting on it. Nothing was sent for you \u2014 ${classification.reason}.</delegation-nudge>`;
+  }
   if (rung === 0.5) {
     return `<delegation-nudge>rung-0.5: ask, est. <1k tokens. This is a single bounded question \u2014 answer it via ONE completion (\`./scripts-run src/scripts/ask_transport "<question>"\`) instead of a subagent spawn (measured spawn floor: ~251k tokens) \u2014 ${classification.reason}.</delegation-nudge>`;
   }
@@ -5568,9 +5388,12 @@ function buildNudgeLine(rung, classification, sliceCount, tier) {
     return `<delegation-nudge>rung-3: team. These slices must see each other's state during the run, so a set of independent subagent spawns cannot express it \u2014 use the host teams primitive, or fall back to \`./scripts-run src/scripts/ask_transport "<question>"\` for a bounded sub-question. Not a spawn, and not run for you \u2014 ${classification.reason}.</delegation-nudge>`;
   }
   const modeLabel = classification.mode ?? "single-slice";
-  return `<delegation-nudge>${rungLabel}: dispatch ${modeLabel} (${sliceCount} ${unit}, ${tier} tier recommended). Consider dispatching via subagent-orchestration instead of doing every slice in-session \u2014 ${classification.reason}.</delegation-nudge>`;
+  const coldStart = rung === 1 ? ` A leg starts cold (~${Math.round(LEG_COLD_START_UNCACHED_TOKENS / 1e3)}k uncached tokens): a slice of one to three direct reads does not amortise it.` : "";
+  const model = tier === "lite" && sliceKind !== void 0 && sliceKind !== "unknown" ? TIER_TO_CLAUDE_MODEL[tier] : void 0;
+  const carrier = model ? ` Pass \`model: "${model}"\` on each Agent call (${sliceKind} slices earn lite).` : "";
+  return `<delegation-nudge>${rungLabel}: dispatch ${modeLabel} (${sliceCount} ${unit}, ${tier} tier recommended). Consider dispatching via subagent-orchestration instead of doing every slice in-session \u2014 ${classification.reason}.${carrier}${coldStart}</delegation-nudge>`;
 }
-function classifyPrompt(prompt, workspace_root, hostId) {
+function classifyPrompt(prompt, workspace_root, hostId, opts = {}) {
   try {
     const { signals, sliceCountForLine } = extractTaskSignals(prompt);
     const { activation, downshift, separate_quota_pool, agentTeams } = resolveActivation(
@@ -5590,13 +5413,28 @@ function classifyPrompt(prompt, workspace_root, hostId) {
         classification: { delegable: false, action: "ask", mode: null, reason: ladder.reason },
         sliceCount: 0,
         tier: recommendSliceTier(downshift, separate_quota_pool),
+        sliceKind: "unknown",
         rung: ladder.rung
       };
     }
+    if (ladder.rung === 0.5 && opts.freeRouteAdmissible !== void 0) {
+      const handKind = handKindFromPrompt(prompt);
+      if (handKind !== null && opts.freeRouteAdmissible(handKind)) {
+        return {
+          classification: { delegable: false, action: "ask", mode: null, reason: ladder.reason },
+          sliceCount: 0,
+          tier: recommendSliceTier(downshift, separate_quota_pool),
+          sliceKind: "unknown",
+          rung: ladder.rung,
+          handKind
+        };
+      }
+    }
     if (ladder.verdict !== "subagent") {
       return null;
     }
-    const tier = recommendSliceTier(downshift, separate_quota_pool);
+    const sliceKind = sliceKindFromPrompt(prompt);
+    const tier = recommendSliceTier(downshift, separate_quota_pool, sliceKind);
     const sliceCount = ladder.rung === 1 ? 1 : sliceCountForLine;
     const classification = {
       delegable: true,
@@ -5604,7 +5442,7 @@ function classifyPrompt(prompt, workspace_root, hostId) {
       mode: ladder.mode ?? null,
       reason: ladder.reason
     };
-    return { classification, sliceCount, tier, rung: ladder.rung };
+    return { classification, sliceCount, tier, sliceKind, rung: ladder.rung };
   } catch {
     return null;
   }
@@ -5625,70 +5463,79 @@ function _workspaceRoot(envelope) {
   }
   return process.cwd();
 }
-function main8() {
+function main7() {
   let envelope = {};
   try {
     const raw = readHookStdin();
     envelope = raw.trim() ? JSON.parse(raw) : {};
   } catch {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const env = _isObject6(envelope) ? envelope : {};
   const event = env["event"];
   const slot = typeof event === "string" && event !== "" ? event : "user_prompt_submit";
   if (slot !== "user_prompt_submit") {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const payload = _isObject6(env["payload"]) ? env["payload"] : env;
   const prompt = _extractPrompt2(payload);
   if (!prompt) {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   if (isSyntheticPrompt(prompt)) {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const root = _workspaceRoot(env);
   const platform = env["platform"];
   const hostId = typeof platform === "string" && platform ? platform : null;
-  const result = classifyPrompt(prompt, root, hostId);
+  const result = classifyPrompt(prompt, root, hostId, {
+    freeRouteAdmissible: (kind) => freeRungFor(root, kind, councilConfigPath())
+  });
   if (!result) {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   process.stdout.write(
     `${JSON.stringify({
       decision: "warn",
       reason: `delegation-nudge: rung-${result.rung} verdict (${result.sliceCount} slices, ${result.tier} tier)`,
-      additional_context: buildNudgeLine(result.rung, result.classification, result.sliceCount, result.tier)
+      additional_context: buildNudgeLine(
+        result.rung,
+        result.classification,
+        result.sliceCount,
+        result.tier,
+        result.sliceKind,
+        result.handKind
+      )
     })}
 `
   );
-  return EXIT_WARN2;
+  return EXIT_WARN;
 }
-function _isCliEntry8() {
+function _isCliEntry7() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL8(path12.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL7(path13.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs14.realpathSync(fileURLToPath8(import.meta.url));
-    const argv = fs14.realpathSync(path12.resolve(process.argv[1]));
+    const here = fs16.realpathSync(fileURLToPath7(import.meta.url));
+    const argv = fs16.realpathSync(path13.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry8()) {
-  process.exit(main8());
+if (_isCliEntry7()) {
+  process.exit(main7());
 }
 
 // src/scripts/conformance_scan.ts
-var REPO_ROOT = path13.resolve(path13.dirname(fileURLToPath9(import.meta.url)), "..", "..");
+var REPO_ROOT = path14.resolve(path14.dirname(fileURLToPath8(import.meta.url)), "..", "..");
 var OBSERVED_BAND = { low: 9.1, high: 39.2 };
 var BAND_MIN_TURNS = 1978;
 var CARRIER_CHANGES = [
@@ -6054,7 +5901,7 @@ function scanSession(sessionId, lines) {
   closeWindow();
   return report;
 }
-var DEFAULT_RATE_SERIES = path13.join(
+var DEFAULT_RATE_SERIES = path14.join(
   REPO_ROOT,
   "agents",
   "runtime",
@@ -6063,7 +5910,7 @@ var DEFAULT_RATE_SERIES = path13.join(
 );
 function defaultStore(projectDir) {
   const slug = projectStoreSlug(projectDir);
-  return path13.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
+  return path14.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
 }
 function _tokens(chars) {
   return Math.round(chars / 4);
@@ -6074,13 +5921,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   return {
     project: {
       dir: projectRulesDir,
-      present: fs15.existsSync(projectRulesDir),
+      present: fs17.existsSync(projectRulesDir),
       files: p.files,
       tokens: _tokens(p.chars)
     },
     global: {
       dir: globalRulesDir,
-      present: fs15.existsSync(globalRulesDir),
+      present: fs17.existsSync(globalRulesDir),
       files: g.files,
       tokens: _tokens(g.chars)
     },
@@ -6088,13 +5935,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   };
 }
 function storeKey(store) {
-  return createHash4("sha256").update(path13.resolve(store)).digest("hex").slice(0, 12);
+  return createHash4("sha256").update(path14.resolve(store)).digest("hex").slice(0, 12);
 }
 function scanStore(store, limit) {
-  const files = fs15.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs15.statSync(path13.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
+  const files = fs17.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs17.statSync(path14.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
   const per_session = [];
   for (const f of files) {
-    const lines = fs15.readFileSync(path13.join(store, f), "utf8").split("\n");
+    const lines = fs17.readFileSync(path14.join(store, f), "utf8").split("\n");
     const r = scanSession(f.replace(/\.jsonl$/, "").slice(0, 8), lines);
     if (r.assistant_turns > 0) {
       per_session.push(r);
@@ -6122,10 +5969,10 @@ function scanStore(store, limit) {
   const task_completeness_rate_pct = completeness_windows === 0 ? 0 : Number((100 * task_completeness / completeness_windows).toFixed(1));
   const era = spansCarrierChange(per_session.map((s) => s.first_at));
   const delivered = measureDelivered(
-    path13.join(REPO_ROOT, ".claude", "rules"),
-    path13.join(process.env["HOME"] ?? os2.homedir(), ".claude", "rules")
+    path14.join(REPO_ROOT, ".claude", "rules"),
+    path14.join(process.env["HOME"] ?? os2.homedir(), ".claude", "rules")
   );
-  const ownStore = path13.resolve(store) === path13.resolve(defaultStore(REPO_ROOT));
+  const ownStore = path14.resolve(store) === path14.resolve(defaultStore(REPO_ROOT));
   return {
     scanned_at: (/* @__PURE__ */ new Date()).toISOString(),
     store,
@@ -6155,8 +6002,8 @@ function scanStore(store, limit) {
   };
 }
 function recordRate(file, scanned_at, rate) {
-  fs15.mkdirSync(path13.dirname(file), { recursive: true });
-  fs15.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
+  fs17.mkdirSync(path14.dirname(file), { recursive: true });
+  fs17.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
 `, "utf8");
 }
 function render(report) {
@@ -6255,7 +6102,7 @@ function render(report) {
   lines.push("    checkbox batching                     \u2014 measured NOWHERE. ~5 low-severity findings.");
   return lines.join("\n");
 }
-function main9(argv) {
+function main8(argv) {
   const args = argv ?? process.argv.slice(2);
   let store = null;
   let limit = 30;
@@ -6287,14 +6134,14 @@ function main9(argv) {
     return 2;
   }
   const resolved = store ?? defaultStore(process.cwd());
-  if (!fs15.existsSync(resolved)) {
+  if (!fs17.existsSync(resolved)) {
     process.stderr.write(`conformance:behavior: no transcript store at ${resolved}
 `);
     return 1;
   }
   const report = scanStore(resolved, Number.isFinite(limit) && limit > 0 ? limit : 30);
   if (out) {
-    fs15.writeFileSync(out, `${JSON.stringify(report, null, 2)}
+    fs17.writeFileSync(out, `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   if (record) {
@@ -6302,7 +6149,7 @@ function main9(argv) {
   }
   if (why !== null) {
     const id = why;
-    fs15.writeSync(
+    fs17.writeSync(
       1,
       json ? `${JSON.stringify(
         {
@@ -6322,48 +6169,48 @@ function main9(argv) {
     );
     return 0;
   }
-  fs15.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
+  fs17.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
 ` : `${render(report)}
 `);
   return 0;
 }
-function _isCliEntry9() {
+function _isCliEntry8() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL9(path13.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL8(path14.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs15.realpathSync(fileURLToPath9(import.meta.url));
-    const argv = fs15.realpathSync(path13.resolve(process.argv[1]));
+    const here = fs17.realpathSync(fileURLToPath8(import.meta.url));
+    const argv = fs17.realpathSync(path14.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry9()) {
-  process.exit(main9());
+if (_isCliEntry8()) {
+  process.exit(main8());
 }
 
 // src/scripts/report_carrier_divergence.ts
-import * as fs16 from "node:fs";
+import * as fs18 from "node:fs";
 import * as os3 from "node:os";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 import process2 from "node:process";
-import { fileURLToPath as fileURLToPath10, pathToFileURL as pathToFileURL10 } from "node:url";
-var _HERE2 = fileURLToPath10(import.meta.url);
-var REPO_ROOT2 = path14.resolve(path14.dirname(_HERE2), "..", "..");
-var PROJECT_RULES = path14.join(".claude", "rules");
-var PROJECTION_SOURCE = path14.join("dist", "agent-src", "rules");
-var GLOBAL_RULES = path14.join(".claude", "rules");
+import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
+var _HERE2 = fileURLToPath9(import.meta.url);
+var REPO_ROOT2 = path15.resolve(path15.dirname(_HERE2), "..", "..");
+var PROJECT_RULES = path15.join(".claude", "rules");
+var PROJECTION_SOURCE = path15.join("dist", "agent-src", "rules");
+var GLOBAL_RULES = path15.join(".claude", "rules");
 function _listRules(dir) {
   try {
-    return fs16.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    return fs18.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
@@ -6371,7 +6218,7 @@ function _listRules(dir) {
 function _ruleType(file) {
   let text;
   try {
-    text = fs16.readFileSync(file, "utf-8");
+    text = fs18.readFileSync(file, "utf-8");
   } catch {
     return "";
   }
@@ -6382,8 +6229,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
   const out = {
     projectDir,
     globalDir,
-    globalPresent: fs16.existsSync(globalDir),
-    projectPresent: fs16.existsSync(projectDir),
+    globalPresent: fs18.existsSync(globalDir),
+    projectPresent: fs18.existsSync(projectDir),
     shared: 0,
     identical: [],
     provenanceOnly: [],
@@ -6406,7 +6253,7 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     if (!inP && inG) {
       out.globalOnly.push(rule);
-      if (sourceDir !== void 0 && _ruleType(path14.join(sourceDir, rule)) === "manual") {
+      if (sourceDir !== void 0 && _ruleType(path15.join(sourceDir, rule)) === "manual") {
         out.manualOnlyGlobal.push(rule);
       }
       continue;
@@ -6416,8 +6263,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     let projectCopy;
     let globalCopy;
     try {
-      projectCopy = fs16.readFileSync(path14.join(projectDir, rule));
-      globalCopy = fs16.readFileSync(path14.join(globalDir, rule));
+      projectCopy = fs18.readFileSync(path15.join(projectDir, rule));
+      globalCopy = fs18.readFileSync(path15.join(globalDir, rule));
       verdict = comparePair(projectCopy, globalCopy);
     } catch {
       out.shared -= 1;
@@ -6562,11 +6409,11 @@ function render2(d) {
   }
   return lines.join("\n");
 }
-function main10(argv) {
+function main9(argv) {
   const args = argv ?? process2.argv.slice(2);
-  let projectDir = path14.join(REPO_ROOT2, PROJECT_RULES);
-  let globalDir = path14.join(os3.homedir(), GLOBAL_RULES);
-  let sourceDir = path14.join(REPO_ROOT2, PROJECTION_SOURCE);
+  let projectDir = path15.join(REPO_ROOT2, PROJECT_RULES);
+  let globalDir = path15.join(os3.homedir(), GLOBAL_RULES);
+  let sourceDir = path15.join(REPO_ROOT2, PROJECTION_SOURCE);
   const value = (i) => {
     const v = args[i + 1];
     return v === void 0 || v.startsWith("-") ? null : v;
@@ -6580,7 +6427,7 @@ function main10(argv) {
 `);
         return 1;
       }
-      const resolved = path14.resolve(v);
+      const resolved = path15.resolve(v);
       if (a === "--project") projectDir = resolved;
       else if (a === "--global") globalDir = resolved;
       else sourceDir = resolved;
@@ -6600,26 +6447,26 @@ function main10(argv) {
 `);
   return 0;
 }
-function _isCliEntry10() {
+function _isCliEntry9() {
   if (process2.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL10(path14.resolve(process2.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL9(path15.resolve(process2.argv[1])).href) return true;
   try {
-    return fs16.realpathSync(_HERE2) === fs16.realpathSync(path14.resolve(process2.argv[1]));
+    return fs18.realpathSync(_HERE2) === fs18.realpathSync(path15.resolve(process2.argv[1]));
   } catch {
     return false;
   }
 }
-if (_isCliEntry10()) {
-  process2.exit(main10());
+if (_isCliEntry9()) {
+  process2.exit(main9());
 }
 
 // src/scripts/report_skill_activation.ts
-import * as fs17 from "node:fs";
+import * as fs19 from "node:fs";
 import * as os4 from "node:os";
-import * as path15 from "node:path";
-import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
-var _HERE3 = fileURLToPath11(import.meta.url);
-var REPO_ROOT3 = path15.resolve(path15.dirname(_HERE3), "..", "..");
+import * as path16 from "node:path";
+import { fileURLToPath as fileURLToPath10, pathToFileURL as pathToFileURL10 } from "node:url";
+var _HERE3 = fileURLToPath10(import.meta.url);
+var REPO_ROOT3 = path16.resolve(path16.dirname(_HERE3), "..", "..");
 var SKILLS_ROOT = "src/skills";
 var TRIGGER_KEYS = ["triggers:", "trigger_description:", "file_pattern:", "path_prefix:"];
 var DETERMINISTIC_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?(MUST|NEVER|ALWAYS)\b/m;
@@ -6630,25 +6477,25 @@ function censusSkills(root) {
     withTriggerCorpus: [],
     withDeterministicObligation: []
   };
-  if (!fs17.existsSync(root)) {
+  if (!fs19.existsSync(root)) {
     return out;
   }
-  for (const entry of fs17.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const entry of fs19.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const file = path15.join(root, entry.name, "SKILL.md");
-    if (!fs17.existsSync(file)) {
+    const file = path16.join(root, entry.name, "SKILL.md");
+    if (!fs19.existsSync(file)) {
       continue;
     }
     out.total += 1;
-    const text = fs17.readFileSync(file, "utf8");
+    const text = fs19.readFileSync(file, "utf8");
     const fmEnd = text.startsWith("---") ? text.indexOf("\n---", 3) : -1;
     const fm = fmEnd === -1 ? "" : text.slice(0, fmEnd);
     if (TRIGGER_KEYS.some((k) => new RegExp(`^${k}`, "m").test(fm))) {
       out.withTriggerKey.push(entry.name);
     }
-    if (fs17.existsSync(path15.join(root, entry.name, "evals", "triggers.json"))) {
+    if (fs19.existsSync(path16.join(root, entry.name, "evals", "triggers.json"))) {
       out.withTriggerCorpus.push(entry.name);
     }
     const body = fmEnd === -1 ? text : text.slice(fmEnd + 4);
@@ -6659,17 +6506,17 @@ function censusSkills(root) {
   return out;
 }
 function defaultStore2(cwd) {
-  return path15.join(os4.homedir(), ".claude", "projects", projectStoreSlug(cwd));
+  return path16.join(os4.homedir(), ".claude", "projects", projectStoreSlug(cwd));
 }
 function measureUsage(store, limit) {
   const rep = { store, sessions: 0, assistantTurns: 0, invocations: 0, bySkill: {} };
-  if (!fs17.existsSync(store)) {
+  if (!fs19.existsSync(store)) {
     return rep;
   }
-  const files = fs17.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path15.join(store, f)).sort((a, b) => fs17.statSync(b).mtimeMs - fs17.statSync(a).mtimeMs).slice(0, limit);
+  const files = fs19.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path16.join(store, f)).sort((a, b) => fs19.statSync(b).mtimeMs - fs19.statSync(a).mtimeMs).slice(0, limit);
   rep.sessions = files.length;
   for (const file of files) {
-    for (const line of fs17.readFileSync(file, "utf8").split("\n")) {
+    for (const line of fs19.readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) {
         continue;
       }
@@ -6742,15 +6589,15 @@ function buildRecord(census, usage, today) {
     assistant_turns: usage.reduce((a, u) => a + u.assistantTurns, 0),
     invocations: usage.reduce((a, u) => a + u.invocations, 0),
     distinct_skills_invoked: distinct.size,
-    stores: usage.map((u) => path15.basename(u.store))
+    stores: usage.map((u) => path16.basename(u.store))
   };
 }
 function readRecord(repoRoot) {
-  const file = path15.join(repoRoot, RECORD_PATH);
-  if (!fs17.existsSync(file)) {
+  const file = path16.join(repoRoot, RECORD_PATH);
+  if (!fs19.existsSync(file)) {
     return null;
   }
-  return JSON.parse(fs17.readFileSync(file, "utf8"));
+  return JSON.parse(fs19.readFileSync(file, "utf8"));
 }
 function render3(census, usage, published = null) {
   const lines = [];
@@ -6785,7 +6632,7 @@ function render3(census, usage, published = null) {
     }
     totalInv += u.invocations;
     lines.push(
-      `  ${path15.basename(u.store).slice(-38).padEnd(38)} sessions=${String(u.sessions).padStart(3)} asst=${String(u.assistantTurns).padStart(6)} Skill calls=${String(u.invocations).padStart(3)}`
+      `  ${path16.basename(u.store).slice(-38).padEnd(38)} sessions=${String(u.sessions).padStart(3)} asst=${String(u.assistantTurns).padStart(6)} Skill calls=${String(u.invocations).padStart(3)}`
     );
   }
   lines.push("");
@@ -6856,7 +6703,7 @@ function render3(census, usage, published = null) {
   return lines.join("\n");
 }
 var USAGE2 = "usage: report_skill_activation [--root DIR] [--limit N] [--store PATH]... [--emit] [--allow-empty-store]\n";
-function main11(argv) {
+function main10(argv) {
   let limit = 30;
   let emit = false;
   let allowEmpty = false;
@@ -6889,7 +6736,7 @@ function main11(argv) {
   if (stores.length === 0) {
     stores.push(defaultStore2(REPO_ROOT3));
   }
-  const census = censusSkills(path15.join(root, SKILLS_ROOT));
+  const census = censusSkills(path16.join(root, SKILLS_ROOT));
   const usage = stores.map((s) => measureUsage(s, limit));
   process.stdout.write(`${render3(census, usage, readRecord(root))}
 `);
@@ -6910,27 +6757,27 @@ function main11(argv) {
     return 1;
   }
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const file = path15.join(root, RECORD_PATH);
-  fs17.mkdirSync(path15.dirname(file), { recursive: true });
-  fs17.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
+  const file = path16.join(root, RECORD_PATH);
+  fs19.mkdirSync(path16.dirname(file), { recursive: true });
+  fs19.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
 `);
   process.stdout.write(`
 wrote ${RECORD_PATH} (measured ${today})
 `);
   return 0;
 }
-if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL11(path15.resolve(process.argv[1])).href) {
-  process.exit(main11(process.argv.slice(2)));
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL10(path16.resolve(process.argv[1])).href) {
+  process.exit(main10(process.argv.slice(2)));
 }
 
 // src/scripts/report_skill_obligation_violations.ts
-import * as fs18 from "node:fs";
+import * as fs20 from "node:fs";
 import * as os5 from "node:os";
-import * as path16 from "node:path";
+import * as path17 from "node:path";
 import process3 from "node:process";
-import { fileURLToPath as fileURLToPath12, pathToFileURL as pathToFileURL12 } from "node:url";
-var _HERE4 = fileURLToPath12(import.meta.url);
-var REPO_ROOT4 = path16.resolve(path16.dirname(_HERE4), "..", "..");
+import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
+var _HERE4 = fileURLToPath11(import.meta.url);
+var REPO_ROOT4 = path17.resolve(path17.dirname(_HERE4), "..", "..");
 var OBLIGATION_LINE_RE = new RegExp(`${DETERMINISTIC_RE.source}.*`, "gm");
 var PATH_RE = /`([A-Za-z0-9_./-]*\/[A-Za-z0-9_.-]+\.[a-z]{2,6})`/g;
 var CMD_RE = /`([a-z][a-z0-9-]*(?: [a-z][a-z0-9:._-]*){1,3})`/g;
@@ -6968,7 +6815,7 @@ function _artefacts(line) {
   return out;
 }
 function extractObligations(repoRoot) {
-  const skillsRoot = path16.join(repoRoot, SKILLS_ROOT);
+  const skillsRoot = path17.join(repoRoot, SKILLS_ROOT);
   const census = censusSkills(skillsRoot);
   const out = {
     skills: census.withDeterministicObligation,
@@ -6982,7 +6829,7 @@ function extractObligations(repoRoot) {
   for (const skill of census.withDeterministicObligation) {
     let text;
     try {
-      text = fs18.readFileSync(path16.join(skillsRoot, skill, "SKILL.md"), "utf-8");
+      text = fs20.readFileSync(path17.join(skillsRoot, skill, "SKILL.md"), "utf-8");
     } catch {
       continue;
     }
@@ -7098,7 +6945,7 @@ function scanSessionForViolations(session, lines, forbidden, parsed) {
   return flags;
 }
 function defaultStore3(cwd) {
-  return path16.join(os5.homedir(), ".claude", "projects", projectStoreSlug(cwd));
+  return path17.join(os5.homedir(), ".claude", "projects", projectStoreSlug(cwd));
 }
 function scanStore2(repoRoot, store, limit) {
   const census = extractObligations(repoRoot);
@@ -7111,14 +6958,14 @@ function scanStore2(repoRoot, store, limit) {
   };
   let files;
   try {
-    files = fs18.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path16.join(store, f), m: fs18.statSync(path16.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
+    files = fs20.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path17.join(store, f), m: fs20.statSync(path17.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
   } catch {
     return report;
   }
   report.sessions = files.length;
   for (const file of files) {
-    const lines = fs18.readFileSync(file, "utf-8").split("\n");
-    const id = path16.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
+    const lines = fs20.readFileSync(file, "utf-8").split("\n");
+    const id = path17.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
     const entries = _parseSession(lines);
     if (loadedSkillsFrom(entries).size > 0) report.sessionsWithASkill += 1;
     report.flags.push(...scanSessionForViolations(id, lines, census.forbidden, entries));
@@ -7188,7 +7035,7 @@ function render4(r) {
   lines.push("  ships as detection-only, and this one says so.");
   return lines.join("\n");
 }
-function main12(argv) {
+function main11(argv) {
   const args = argv ?? process3.argv.slice(2);
   let limit = 30;
   let json = false;
@@ -7241,35 +7088,35 @@ function main12(argv) {
   }
   return 0;
 }
-function _isCliEntry11() {
+function _isCliEntry10() {
   if (process3.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL12(path16.resolve(process3.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL11(path17.resolve(process3.argv[1])).href) return true;
   try {
-    return fs18.realpathSync(_HERE4) === fs18.realpathSync(path16.resolve(process3.argv[1]));
+    return fs20.realpathSync(_HERE4) === fs20.realpathSync(path17.resolve(process3.argv[1]));
   } catch {
     return false;
   }
 }
-if (_isCliEntry11()) {
-  process3.exit(main12());
+if (_isCliEntry10()) {
+  process3.exit(main11());
 }
 
 // src/scripts/report_conformance_funnel.ts
-var _HERE5 = fileURLToPath13(import.meta.url);
-var REPO_ROOT5 = path17.resolve(path17.dirname(_HERE5), "..", "..");
+var _HERE5 = fileURLToPath12(import.meta.url);
+var REPO_ROOT5 = path18.resolve(path18.dirname(_HERE5), "..", "..");
 function buildFunnel(opts = {}) {
   const repoRoot = opts.repoRoot ?? REPO_ROOT5;
-  const projectRulesDir = opts.projectRulesDir ?? path17.join(repoRoot, PROJECT_RULES);
-  const globalRulesDir = opts.globalRulesDir ?? path17.join(os6.homedir(), GLOBAL_RULES);
-  const sourceDir = opts.sourceDir ?? path17.join(repoRoot, PROJECTION_SOURCE);
+  const projectRulesDir = opts.projectRulesDir ?? path18.join(repoRoot, PROJECT_RULES);
+  const globalRulesDir = opts.globalRulesDir ?? path18.join(os6.homedir(), GLOBAL_RULES);
+  const sourceDir = opts.sourceDir ?? path18.join(repoRoot, PROJECTION_SOURCE);
   const store = opts.store ?? defaultStore(repoRoot);
   const limit = opts.limit ?? 30;
   return {
     delivered: measureDelivered(projectRulesDir, globalRulesDir),
     divergence: compareCarriers(projectRulesDir, globalRulesDir, sourceDir),
-    skills: censusSkills(path17.join(repoRoot, SKILLS_ROOT)),
+    skills: censusSkills(path18.join(repoRoot, SKILLS_ROOT)),
     usage: measureUsage(store, limit),
-    storePresent: fs19.existsSync(store),
+    storePresent: fs21.existsSync(store),
     sk2: scanStore2(repoRoot, store, limit)
   };
 }
@@ -7394,7 +7241,7 @@ function render5(r) {
   lines.push("workflow without a measured false-positive rate first (locked policy).");
   return lines.join("\n");
 }
-function main13(argv) {
+function main12(argv) {
   const args = argv ?? process4.argv.slice(2);
   const opts = {};
   const value = (i) => {
@@ -7410,7 +7257,7 @@ function main13(argv) {
 `);
         return 1;
       }
-      const resolved = path17.resolve(v);
+      const resolved = path18.resolve(v);
       if (a === "--store") opts.store = resolved;
       else if (a === "--project") opts.projectRulesDir = resolved;
       else if (a === "--global") opts.globalRulesDir = resolved;
@@ -7440,21 +7287,21 @@ function main13(argv) {
 `);
   return 0;
 }
-function _isCliEntry12() {
+function _isCliEntry11() {
   if (process4.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL13(path17.resolve(process4.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL12(path18.resolve(process4.argv[1])).href) return true;
   try {
-    return fs19.realpathSync(_HERE5) === fs19.realpathSync(path17.resolve(process4.argv[1]));
+    return fs21.realpathSync(_HERE5) === fs21.realpathSync(path18.resolve(process4.argv[1]));
   } catch {
     return false;
   }
 }
-if (_isCliEntry12()) {
-  process4.exit(main13());
+if (_isCliEntry11()) {
+  process4.exit(main12());
 }
 
 // src/scripts/_cli/cmd_conformance.ts
-var _HERE6 = fileURLToPath14(import.meta.url);
+var _HERE6 = fileURLToPath13(import.meta.url);
 var PACKAGE_ROOT = resolvePackageRoot(import.meta.url);
 var CONFORMANCE_CHECK_IDS = [
   "txlog-clean",
@@ -7481,20 +7328,20 @@ function conformanceLogPath() {
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path18.join(os7.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
+  return path19.join(os7.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
 }
 function installLogPath() {
   const override = process5.env["AGENT_CONFIG_INSTALL_LOG"];
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path18.join(os7.homedir(), ".event4u", "agent-config", "install-log.jsonl");
+  return path19.join(os7.homedir(), ".event4u", "agent-config", "install-log.jsonl");
 }
 function _installLogExpected(projectRoot) {
-  return fs20.existsSync(manifest_path(projectRoot));
+  return fs22.existsSync(manifest_path(projectRoot));
 }
 function _check_txlog_clean(logPath = installLogPath(), projectRoot = null) {
-  const entries = fs20.existsSync(logPath) ? readRecentEntries(logPath) : [];
+  const entries = fs22.existsSync(logPath) ? readRecentEntries(logPath) : [];
   if (entries.length === 0) {
     if (projectRoot !== null && _installLogExpected(projectRoot)) {
       return {
@@ -7528,11 +7375,11 @@ function _check_txlog_clean(logPath = installLogPath(), projectRoot = null) {
   };
 }
 function routeTargetPaths(target) {
-  return routeTargetPathsPosix(target).map((rel) => path18.join(...rel.split("/")));
+  return routeTargetPathsPosix(target).map((rel2) => path19.join(...rel2.split("/")));
 }
 function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
-  const routerPath = path18.join(packageRoot, "dist", "router.json");
-  if (!fs20.existsSync(routerPath)) {
+  const routerPath = path19.join(packageRoot, "dist", "router.json");
+  if (!fs22.existsSync(routerPath)) {
     return {
       id: "router-pointers",
       status: "fail",
@@ -7542,7 +7389,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   }
   let router;
   try {
-    router = JSON.parse(fs20.readFileSync(routerPath, "utf8"));
+    router = JSON.parse(fs22.readFileSync(routerPath, "utf8"));
   } catch (exc) {
     return {
       id: "router-pointers",
@@ -7551,13 +7398,13 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
       remedy: "reinstall the package \u2014 dist/router.json is corrupt"
     };
   }
-  const rulesDir = path18.join(packageRoot, "dist", "agent-src", "rules");
+  const rulesDir = path19.join(packageRoot, "dist", "agent-src", "rules");
   const broken = [];
   let ids = 0;
   let targets = 0;
   for (const kernelId of router["kernel"] ?? []) {
     ids += 1;
-    if (!fs20.existsSync(path18.join(rulesDir, `${kernelId}.md`))) {
+    if (!fs22.existsSync(path19.join(rulesDir, `${kernelId}.md`))) {
       broken.push(`kernel:${kernelId} \u2192 rules/${kernelId}.md missing`);
     }
   }
@@ -7565,7 +7412,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
     for (const entry of router[tier] ?? []) {
       const ruleId = String(entry["id"] ?? "");
       ids += 1;
-      if (!fs20.existsSync(path18.join(rulesDir, `${ruleId}.md`))) {
+      if (!fs22.existsSync(path19.join(rulesDir, `${ruleId}.md`))) {
         broken.push(`${tier}:${ruleId} \u2192 rules/${ruleId}.md missing`);
       }
       for (const target of entry["routes_to"] ?? []) {
@@ -7575,7 +7422,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
           broken.push(`${ruleId} \u2192 unparseable routes_to ${JSON.stringify(target)}`);
           continue;
         }
-        if (!candidates.some((rel) => fs20.existsSync(path18.join(packageRoot, rel)))) {
+        if (!candidates.some((rel2) => fs22.existsSync(path19.join(packageRoot, rel2)))) {
           broken.push(`${ruleId} \u2192 ${target} (${candidates[0]} missing)`);
         }
       }
@@ -7607,9 +7454,9 @@ function detectSmokePlatform(projectRoot) {
   return "claude";
 }
 function dispatcherRunner(packageRoot) {
-  const localTsx = path18.join(packageRoot, "node_modules", ".bin", "tsx");
-  const script = path18.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
-  if (fs20.existsSync(localTsx)) {
+  const localTsx = path19.join(packageRoot, "node_modules", ".bin", "tsx");
+  const script = path19.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
+  if (fs22.existsSync(localTsx)) {
     return [localTsx, script];
   }
   return ["npx", "tsx", script];
@@ -7659,12 +7506,12 @@ function _check_hook_dispatcher(projectRoot, packageRoot = PACKAGE_ROOT, opts =
   };
 }
 function readSettingsMode(projectRoot) {
-  const settingsPath = path18.join(projectRoot, ".agent-settings.yml");
-  if (!fs20.existsSync(settingsPath)) {
+  const settingsPath = path19.join(projectRoot, ".agent-settings.yml");
+  if (!fs22.existsSync(settingsPath)) {
     return "eager-all";
   }
   try {
-    const parsed = YAML.parse(fs20.readFileSync(settingsPath, "utf8"));
+    const parsed = YAML.parse(fs22.readFileSync(settingsPath, "utf8"));
     const lean = parsed?.["lean_projection"] ?? null;
     const mode = lean?.["mode"];
     return typeof mode === "string" && mode.length > 0 ? mode : "eager-all";
@@ -7675,7 +7522,7 @@ function readSettingsMode(projectRoot) {
 function kernelIdsFromRouter(packageRoot) {
   try {
     const router = JSON.parse(
-      fs20.readFileSync(path18.join(packageRoot, "dist", "router.json"), "utf8")
+      fs22.readFileSync(path19.join(packageRoot, "dist", "router.json"), "utf8")
     );
     return new Set((router["kernel"] ?? []).map(String));
   } catch {
@@ -7692,8 +7539,8 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
       remedy: "set lean_projection.mode to 'eager-all' or 'thin' in .agent-settings.yml"
     };
   }
-  const rulesDir = projectedRulesDir ?? path18.join(projectRoot, ".augment", "rules");
-  if (!fs20.existsSync(rulesDir)) {
+  const rulesDir = projectedRulesDir ?? path19.join(projectRoot, ".augment", "rules");
+  if (!fs22.existsSync(rulesDir)) {
     return {
       id: "lean-projection",
       status: "skipped",
@@ -7702,7 +7549,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
     };
   }
   const kernel = kernelIdsFromRouter(packageRoot);
-  const files = fs20.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
+  const files = fs22.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
   const nonKernel = files.filter((f) => !kernel.has(f.replace(/\.md$/, "")));
   if (nonKernel.length === 0) {
     return {
@@ -7716,7 +7563,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
   for (const f of nonKernel) {
     let text = "";
     try {
-      text = fs20.readFileSync(path18.join(rulesDir, f), "utf8");
+      text = fs22.readFileSync(path19.join(rulesDir, f), "utf8");
     } catch {
       continue;
     }
@@ -7747,8 +7594,8 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
 function _check_host_manifest(projectRoot) {
   const detected = Object.entries(detectToolPresence(projectRoot)).filter(([, v]) => v === true).map(([k]) => k);
   const detectedNote = detected.length > 0 ? `detected surfaces: ${detected.join(", ")}` : "no surfaces detected";
-  const settingsPath = path18.join(projectRoot, ".agent-settings.yml");
-  if (!fs20.existsSync(settingsPath)) {
+  const settingsPath = path19.join(projectRoot, ".agent-settings.yml");
+  if (!fs22.existsSync(settingsPath)) {
     return {
       id: "host-manifest",
       status: "ok",
@@ -7758,7 +7605,7 @@ function _check_host_manifest(projectRoot) {
   }
   let parsed = null;
   try {
-    parsed = YAML.parse(fs20.readFileSync(settingsPath, "utf8"));
+    parsed = YAML.parse(fs22.readFileSync(settingsPath, "utf8"));
   } catch (exc) {
     return {
       id: "host-manifest",
@@ -7857,7 +7704,7 @@ function _parse(argv) {
   }
   return opts;
 }
-function main14(argv = null) {
+function main13(argv = null) {
   const opts = _parse(argv !== null ? Array.from(argv) : process5.argv.slice(2));
   if (opts.funnel) {
     print(render5(buildFunnel()));
@@ -7928,25 +7775,25 @@ function main14(argv = null) {
   }
   return failed ? 1 : 0;
 }
-function _isCliEntry13() {
+function _isCliEntry12() {
   if (process5.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL14(path18.resolve(process5.argv[1])).href;
+  const argvUrl = pathToFileURL13(path19.resolve(process5.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs20.realpathSync(fileURLToPath14(import.meta.url));
-    const argv = fs20.realpathSync(path18.resolve(process5.argv[1]));
+    const here = fs22.realpathSync(fileURLToPath13(import.meta.url));
+    const argv = fs22.realpathSync(path19.resolve(process5.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry13() || process5.argv[1] === _HERE6) {
+if (_isCliEntry12() || process5.argv[1] === _HERE6) {
   try {
-    process5.exitCode = main14(process5.argv.slice(2));
+    process5.exitCode = main13(process5.argv.slice(2));
   } catch (e) {
     if (e instanceof ArgparseExit) {
       process5.exitCode = e.code;
@@ -7970,7 +7817,7 @@ export {
   conformanceLogPath,
   detectSmokePlatform,
   installLogPath,
-  main14 as main,
+  main13 as main,
   routeTargetPaths,
   runConformanceChecks
 };