@event4u/agent-config 16.5.0 → 17.1.0

package/dist/cli-delegate/cmd_conformance.js

@@ -1,34 +1,40 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
   THIN_ENTRY_MARKER,
+  TIER_TO_CLAUDE_MODEL,
   readRecentEntries
-} from "./chunk-6YQC2HLF.js";
+} from "./chunk-YHAPONWV.js";
+import "./chunk-LF2KKJ4Q.js";
 import {
-  detectToolPresence
-} from "./chunk-A4QJ6ENT.js";
+  detectToolPresence,
+  getLogPath
+} from "./chunk-W5JXMF2T.js";
 import {
   NO_RED_EVIDENCE_REASON,
+  RENDER_REL,
   deriveSessionKey,
   describeRecordFinding,
   foldRefusal,
   foldShadow,
+  hasInstrumentGap,
   hasRedThenGreen,
-  isAssetRenderCommand,
   isCiPoll,
+  isPureRender,
   isVacuousOutput,
   isVerificationAttempt,
   parseRecord,
   parseShadowRecord,
   pendingCount,
+  readAssetRenderRecords,
   readInstallBoundary,
   readRunEvidence,
   readTurnRunState,
+  recordedManifest,
   sessionRefusalFile,
   sessionShadowFile,
   shadowSetBy,
-  statePathFor,
-  validateAssumption
-} from "./chunk-TMWYUOK4.js";
+  statePathFor
+} from "./chunk-2CX7NWRB.js";
 import {
   LexicalIndex,
   isSqliteAvailableSync,
@@ -43,7 +49,6 @@ import {
   _classify,
   _collect_manifest_entries,
   _foreign_records,
-  _is_global_only_consumer,
   _jsonDumpsIndentAscii,
   _resolve_project_root,
   _run_checks,
@@ -52,25 +57,38 @@ import {
   censusRuleDir,
   comparePair,
   frontmatterPaths,
+  openRecordStats,
   proseEqual,
   resolveSessionRole,
   splitFrontmatter
-} from "./chunk-5GPULQBE.js";
-import "./chunk-FTAISGDQ.js";
-import "./chunk-6V6TA25H.js";
+} from "./chunk-CMZEKSNN.js";
+import {
+  _is_global_only_consumer
+} from "./chunk-2Y5AMLMY.js";
 import "./chunk-ROYYTEZU.js";
 import "./chunk-BTWUYDGN.js";
+import "./chunk-UUYEKXKR.js";
+import "./chunk-FTAISGDQ.js";
+import "./chunk-5VO3RTMV.js";
+import "./chunk-6V6TA25H.js";
+import "./chunk-AX3U3UWJ.js";
 import {
   atomicAppendLine,
   probeHostCapabilities
-} from "./chunk-MDPPKQCQ.js";
-import "./chunk-DMSZHXZS.js";
+} from "./chunk-QBHEI5N4.js";
+import "./chunk-7DRWULEQ.js";
 import "./chunk-ULQRUR23.js";
 import {
-  hardenedSpawnEnv,
+  hardenedSpawnEnv
+} from "./chunk-I4KJYVPB.js";
+import {
+  EXIT_ALLOW,
+  EXIT_BLOCK,
+  EXIT_WARN,
   projectStoreSlug
-} from "./chunk-OAFSJBHH.js";
+} from "./chunk-FKYZOWVD.js";
 import "./chunk-IAYTIIQW.js";
+import "./chunk-PV7S5DPJ.js";
 import "./chunk-LQOCRFWT.js";
 import {
   atomic_write_json,
@@ -82,35 +100,42 @@ import {
   prune_stale_session_states,
   session_state_file
 } from "./chunk-7HKRE54K.js";
-import "./chunk-F3QDG2GT.js";
+import {
+  load_agent_settings
+} from "./chunk-XLY5G3CM.js";
+import "./chunk-BZJ4Y3CI.js";
+import "./chunk-FIEEOH5C.js";
+import "./chunk-KR5ZIFPO.js";
+import {
+  artefact_roots
+} from "./chunk-YCU3TIXH.js";
 import "./chunk-DEIV7XP7.js";
+import "./chunk-J2SJZICO.js";
 import {
   manifest_path,
   read_manifest
-} from "./chunk-OKJUIAPS.js";
-import "./chunk-WQWXGIWB.js";
-import "./chunk-KB5FZ655.js";
+} from "./chunk-4E2W63DA.js";
+import {
+  parseRouteFields,
+  resolveRouteTransport
+} from "./chunk-M6CRG5O6.js";
 import "./chunk-MWRD5YOH.js";
-import "./chunk-JQOM7TTM.js";
+import "./chunk-BMGUGSY6.js";
+import {
+  readHookStdin
+} from "./chunk-RAXQOETZ.js";
+import "./chunk-IDAOTDPE.js";
 import {
   DeadScopeError,
   assertScanned,
   reportScanned
 } from "./chunk-I3EIN2YG.js";
-import {
-  readHookStdin
-} from "./chunk-F7DQWYR5.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
-import "./chunk-LF2KKJ4Q.js";
 import {
-  load_agent_settings
-} from "./chunk-H76PHZBI.js";
-import {
-  artefact_roots
-} from "./chunk-YCU3TIXH.js";
-import "./chunk-T6BP34WI.js";
+  resolve_with_fallback
+} from "./chunk-T6BP34WI.js";
 import {
   resolvePackageRoot
 } from "./chunk-MCJYCQPF.js";
@@ -120,12 +145,12 @@ import {
 
 // src/scripts/_cli/cmd_conformance.ts
 var YAML = __toESM(require_dist(), 1);
-import * as fs21 from "node:fs";
+import * as fs22 from "node:fs";
 import * as os7 from "node:os";
 import * as path19 from "node:path";
 import process5 from "node:process";
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { fileURLToPath as fileURLToPath14, pathToFileURL as pathToFileURL14 } from "node:url";
+import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL13 } from "node:url";
 
 // src/scripts/router_target_paths.mjs
 var ROUTE_TARGET_TEMPLATES = Object.freeze({
@@ -153,18 +178,18 @@ function routeTargetPathsPosix(target) {
 }
 
 // src/scripts/report_conformance_funnel.ts
-import * as fs20 from "node:fs";
+import * as fs21 from "node:fs";
 import * as os6 from "node:os";
 import * as path18 from "node:path";
 import process4 from "node:process";
-import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL13 } from "node:url";
+import { fileURLToPath as fileURLToPath12, pathToFileURL as pathToFileURL12 } from "node:url";
 
 // src/scripts/conformance_scan.ts
-import { createHash as createHash5 } from "node:crypto";
-import fs16 from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
+import fs17 from "node:fs";
 import os2 from "node:os";
 import path14 from "node:path";
-import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
+import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL8 } from "node:url";
 
 // src/scripts/_lib/transcript_entry.ts
 function _isObject(v) {
@@ -211,8 +236,9 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 // src/scripts/_lib/prompt_shape.ts
 function isSyntheticPrompt(prompt) {
   const head = prompt.trimStart().slice(0, 400);
-  return head.startsWith("[SYSTEM NOTIFICATION - NOT USER INPUT]") || head.startsWith("<task-notification>") || head.startsWith("<system-reminder>") || head.startsWith("<local-command-caveat>") || head.startsWith("<agent-message") || head.startsWith("Your claude.ai usage limit has reset") || /^\[SYSTEM NOTIFICATION\b/.test(head);
+  return head.startsWith("[SYSTEM NOTIFICATION - NOT USER INPUT]") || head.startsWith("<task-notification>") || head.startsWith("<system-reminder>") || head.startsWith("<local-command-caveat>") || head.startsWith("<agent-message") || head.startsWith("Your claude.ai usage limit has reset") || /^\[SYSTEM NOTIFICATION\b/.test(head) || AGENT_MESSAGE_FRAME.test(head);
 }
+var AGENT_MESSAGE_FRAME = /^Another Claude session sent a message:\s*\n\s*<(?:agent-message|cross-session-message)\b/;
 var DOCUMENT_HEAD = /^\s*(#{1,6}\s|-{3,}\s*$|={3,}\s*$|<[A-Za-z][\w-]*>\s*$)/;
 function humanAuthoredLead(text) {
   const kept = [];
@@ -263,8 +289,8 @@ function stripInjectedRegions(text) {
 }
 
 // src/scripts/language_mirror_hook.ts
-var EXIT_ALLOW = 0;
-var EXIT_WARN = 2;
+var EXIT_ALLOW2 = 0;
+var EXIT_WARN2 = 2;
 var STATE_FILE = path.join("agents", "state", "language-mirror.json");
 var STATE_DIR = path.join("agents", "state", "language-mirror");
 var STATE_RETENTION_DAYS = 7;
@@ -464,24 +490,24 @@ function _clearPinLost(consumer_root, session_id) {
 }
 function _reEmitAfterCompaction(consumer_root, session_id, write_json = atomic_write_json) {
   if (!hasStableSessionId(session_id)) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   if (!_pinLost(consumer_root, session_id)) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
-  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW, () => {
+  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW2, () => {
     const previous = _loadState(path.join(consumer_root, statePathFor2(session_id)));
     const language = previous.language;
     const source = previous.source === "system-locale" ? "system-locale" : "prompt";
     _clearPinLost(consumer_root, session_id);
     if (language !== "de" && language !== "en") {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     if (!_ownsPin(previous, session_id)) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     if (!_resetDistance(consumer_root, previous, session_id, write_json)) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     process.stdout.write(
       `${JSON.stringify({
@@ -491,7 +517,7 @@ function _reEmitAfterCompaction(consumer_root, session_id, write_json = atomic_w
       })}
 `
     );
-    return EXIT_WARN;
+    return EXIT_WARN2;
   });
 }
 function _pruneLegacyState(consumer_root) {
@@ -571,19 +597,19 @@ function _resetDistance(consumer_root, expected, session_id, write_json = atomic
 }
 function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_write_json) {
   if (is_replay_mode()) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   if (!hasStableSessionId(session_id)) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
-  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW, () => {
+  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW2, () => {
     const previous = _loadState(path.join(consumer_root, statePathFor2(session_id)));
     const language = previous.language;
     if (language !== "de" && language !== "en") {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     if (!_ownsPin(previous, session_id)) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     const seen = typeof previous.tool_calls_since_pin === "number" && previous.tool_calls_since_pin >= 0 ? previous.tool_calls_since_pin : 0;
     const advanced = seen + 1;
@@ -596,10 +622,10 @@ function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_wri
       write_json
     );
     if (!due) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     if (!written) {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
     const source = previous.source === "system-locale" ? "system-locale" : "prompt";
     process.stdout.write(
@@ -610,7 +636,7 @@ function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_wri
       })}
 `
     );
-    return EXIT_WARN;
+    return EXIT_WARN2;
   });
 }
 function _onToolUse(consumer_root, session_id, write_json = atomic_write_json) {
@@ -628,24 +654,24 @@ function run(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW;
+      return EXIT_ALLOW2;
     }
   }
   const payload = _isObject2(envelope["payload"]) ? envelope["payload"] : envelope;
   const event = typeof envelope["event"] === "string" ? envelope["event"] : "";
   if (event === "pre_compact") {
     _setPinLost(options.consumer_root, _sessionId(envelope));
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   if (event === "post_tool_use") {
     return _onToolUse(options.consumer_root, _sessionId(envelope), options.write_json);
   }
   const prompt = _extractPrompt(payload);
   if (!prompt) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   if (isSyntheticPrompt(prompt)) {
-    return EXIT_ALLOW;
+    return EXIT_ALLOW2;
   }
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
   const stateful = hasStableSessionId(session_id);
@@ -683,9 +709,9 @@ function run(stdin_text, options) {
       `${JSON.stringify({ decision: "warn", reason: noticeText(effective, effectiveSource), additional_context: pinText(effective, effectiveSource) })}
 `
     );
-    return EXIT_WARN;
+    return EXIT_WARN2;
   }
-  return EXIT_ALLOW;
+  return EXIT_ALLOW2;
 }
 function _errText(err) {
   const t = err instanceof Error ? err.message : String(err);
@@ -872,7 +898,7 @@ function extractObjects(op, text) {
 }
 
 // src/scripts/git_authorization_hook.ts
-var EXIT_ALLOW2 = 0;
+var EXIT_ALLOW3 = 0;
 var STATE_FILE2 = path2.join("agents", "state", "git-authorization.json");
 var STATE_DIR2 = path2.join("agents", "state", "git-authorization");
 var PENDING_DIR = path2.join("agents", "state", "git-authorization-pending");
@@ -1432,7 +1458,7 @@ function run2(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW2;
+      return EXIT_ALLOW3;
     }
   }
   const payload = _isObject3(envelope["payload"]) ? envelope["payload"] : envelope;
@@ -1445,11 +1471,11 @@ function run2(stdin_text, options) {
     }
   }
   if (!prompt) {
-    return EXIT_ALLOW2;
+    return EXIT_ALLOW3;
   }
   const session = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
   if (!humanTypedThisTurn(prompt)) {
-    return EXIT_ALLOW2;
+    return EXIT_ALLOW3;
   }
   const { authorized, evidence } = classifyAuthorization(prompt);
   const pending = takePending(options.consumer_root, session, Date.now());
@@ -1490,7 +1516,7 @@ function run2(stdin_text, options) {
 `
     );
   }
-  return EXIT_ALLOW2;
+  return EXIT_ALLOW3;
 }
 function main2(argv) {
   const args = argv ?? process.argv.slice(2);
@@ -1948,9 +1974,9 @@ var COMMAND_OBJECTS = {
 };
 
 // src/scripts/hooks/turn_end_gate_hook.ts
-import * as fs13 from "node:fs";
-import * as path11 from "node:path";
-import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL6 } from "node:url";
+import * as fs12 from "node:fs";
+import * as path10 from "node:path";
+import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
 
 // src/scripts/check_reply_consistency.ts
 import * as fs3 from "node:fs";
@@ -3284,7 +3310,6 @@ import * as crypto from "node:crypto";
 import * as fs8 from "node:fs";
 import * as path7 from "node:path";
 var EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-var RENDER_REL = path7.join("agents", "runtime", "state", "render");
 var PLANTED_PREFIXES = [
   "tests/design-artifacts/fixtures/",
   "tests/design-artifacts/scenarios/"
@@ -3339,6 +3364,22 @@ function dischargeFor(manifests, digest) {
   }
   return staticOnly ? "static-only" : null;
 }
+var TRANSCRIPT_FALLBACK_REASON = "transcript fallback: no readable `post_tool_use` render record exists for this turn \u2014 no live recorder on this host (`agent-config hooks:status`), or a render whose exit status the host did not report \u2014 so the manifest was read under the transcript rule \u2014 an omission check, not an attestation";
+function recordVerdict(root, abs, digest, records) {
+  let changed = false;
+  for (const r of records) {
+    if (path7.resolve(root, r.file) !== abs || r.file_digest !== digest) continue;
+    const read = recordedManifest(root, r);
+    if (read === null) continue;
+    if ("changed" in read) {
+      changed = true;
+      continue;
+    }
+    const kind = dischargeFor([read.manifest], digest);
+    if (kind !== null) return kind;
+  }
+  return changed ? "the manifest the observed render left has changed since, so it is no longer the record of that render" : "no successful `ui:render --profile asset` of these bytes was observed by the hook this turn with a manifest that discharges them \u2014 a manifest written by any other route discharges nothing";
+}
 function readSvgObligations(root, inputs) {
   const open = [];
   const discharged = [];
@@ -3358,6 +3399,12 @@ function readSvgObligations(root, inputs) {
       continue;
     }
     const digest = crypto.createHash("sha256").update(bytes).digest("hex");
+    if (Array.isArray(inputs.recorded)) {
+      const verdict = recordVerdict(root, path7.resolve(root, abs), digest, inputs.recorded);
+      if (verdict === "verified" || verdict === "static-only") discharged.push({ file: relPath, kind: verdict });
+      else open.push({ file: relPath, reason: verdict });
+      continue;
+    }
     if (!renderNames(rendered, relPath)) {
       open.push({
         file: relPath,
@@ -3393,12 +3440,6 @@ function renderNames(commands, relPath) {
     return bounded(relPath) || bounded(base);
   });
 }
-function isPureRender(command) {
-  if (!isAssetRenderCommand(command)) return false;
-  const [head, ...pipes] = command.replace(/^\s*cd\s+[^;&|<>`$\n]+&&\s*/, "").replace(/\s\d?>&\d\b/g, " ").replace(/\s2>\s*\/dev\/null\b/g, " ").split("|");
-  if (/[;&<>`\n]|\$\(/.test(head ?? "")) return false;
-  return pipes.every((p) => /^\s*(tail|head|grep|jq|cat|less|wc)\b[^;&<>`|]*$/.test(p) && !/\$\(/.test(p));
-}
 function writesRenderDir(command) {
   if (isPureRender(command)) return false;
   const slashed = command.split(path7.sep).join("/");
@@ -3411,7 +3452,8 @@ function writesRenderDir(command) {
 function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function openSvgObligation(workspaceRoot, toolCalls) {
+function openSvgObligation(workspaceRoot, toolCalls, recordedRaw = null) {
+  const recordedRenders = recordedRaw === null || hasInstrumentGap(recordedRaw) ? null : recordedRaw;
   const lastEditOf = /* @__PURE__ */ new Map();
   for (let i = 0; i < toolCalls.length; i += 1) {
     const c = toolCalls[i];
@@ -3438,7 +3480,11 @@ function openSvgObligation(workspaceRoot, toolCalls) {
   });
   let reading;
   try {
-    reading = readSvgObligations(workspaceRoot, { edits, renderDirTampered });
+    reading = readSvgObligations(workspaceRoot, {
+      edits,
+      renderDirTampered,
+      recorded: recordedRenders === null ? null : readAssetRenderRecords(recordedRenders)
+    });
   } catch {
     return null;
   }
@@ -3454,7 +3500,7 @@ function openSvgObligation(workspaceRoot, toolCalls) {
     detector: "verification",
     mode: "transcript",
     evidence: first.file,
-    reason: `this turn edited an .svg and no render describes it${more} \u2014 ${first.reason}. A bare \`ui:render --profile asset\` that rendered nothing, and a test or lint run over other files, both discharge nothing: the gate reads the render, never the call.`
+    reason: `this turn edited an .svg and no render describes it${more} \u2014 ${first.reason}. A bare \`ui:render --profile asset\` that rendered nothing, and a test or lint run over other files, both discharge nothing: the gate reads the render, never the call.` + (recordedRenders === null ? ` (${TRANSCRIPT_FALLBACK_REASON})` : "")
   };
 }
 
@@ -3512,539 +3558,21 @@ function unwrap(stdin_text, default_platform = "generic") {
   ];
 }
 
-// src/scripts/hooks/subagent_ledger_hook.ts
-import * as crypto2 from "node:crypto";
-import * as fs9 from "node:fs";
-import * as path8 from "node:path";
-import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
-
-// src/scripts/_lib/subagent_response.ts
-var MAX_SUMMARY_CHARS = 2e3;
-var MAX_RESPONSE_LINE_CHARS = 240;
-var MAX_RESPONSE_ENTRIES = 40;
-var MAX_ARTIFACT_REF_CHARS = 200;
-var MAX_ENVELOPE_CHARS = 12e3;
-var CONFIDENCE = /* @__PURE__ */ new Set(["low", "medium", "high"]);
-var RESPONSE_REQUIRED_FIELDS = [
-  "summary",
-  "handoff",
-  "confidence",
-  "findings",
-  "risks"
-];
-function countContractFields(input) {
-  if (input === null || typeof input !== "object") return 0;
-  const r = input;
-  return RESPONSE_REQUIRED_FIELDS.filter((k) => Object.hasOwn(r, k)).length;
-}
-function validateResponse(input) {
-  const errors = [];
-  if (input === null || typeof input !== "object") {
-    return { valid: false, errors: ["response is not an object"] };
-  }
-  const r = input;
-  if (typeof r.summary !== "string") errors.push("summary missing or not a string");
-  if (typeof r.handoff !== "string") errors.push("handoff missing or not a string");
-  if (!CONFIDENCE.has(r.confidence)) errors.push(`confidence must be low|medium|high (got ${String(r.confidence)})`);
-  if (!Array.isArray(r.findings)) errors.push("findings missing or not an array");
-  if (!Array.isArray(r.risks)) errors.push("risks missing or not an array");
-  if (Array.isArray(r.findings)) {
-    for (const [i, f] of r.findings.entries()) {
-      if (!f || typeof f.title !== "string") errors.push(`finding[${i}] missing title`);
-      const refs = f?.evidence_refs;
-      if (refs && refs.some((x) => typeof x !== "string" || x.includes("\n"))) {
-        errors.push(`finding[${i}] evidence_refs must be ref tokens, not bodies`);
-      }
-    }
-  }
-  if (r.assumptions !== void 0) {
-    if (!Array.isArray(r.assumptions)) {
-      errors.push("assumptions must be an array of {statement, basis, epistemic_state}");
-    } else {
-      for (const [i, a] of r.assumptions.entries()) {
-        errors.push(...validateAssumption(a, `assumptions[${i}]`));
-      }
-    }
-  }
-  if (typeof r.summary === "string" && r.summary.length > MAX_SUMMARY_CHARS) {
-    errors.push(`summary is ${r.summary.length} chars (max ${MAX_SUMMARY_CHARS}) \u2014 the envelope carries a bounded summary; the full result belongs on disk (artifact_paths)`);
-  }
-  if (typeof r.handoff === "string" && r.handoff.length > MAX_RESPONSE_LINE_CHARS) {
-    errors.push(`handoff is ${r.handoff.length} chars (max ${MAX_RESPONSE_LINE_CHARS})`);
-  }
-  for (const [key, arr] of [
-    ["findings", r.findings],
-    ["risks", r.risks],
-    ["artifact_paths", r.artifact_paths]
-  ]) {
-    if (Array.isArray(arr) && arr.length > MAX_RESPONSE_ENTRIES) {
-      errors.push(`${key} carries ${arr.length} entries (max ${MAX_RESPONSE_ENTRIES}) \u2014 an envelope is a handoff, not a transcript`);
-    }
-  }
-  if (Array.isArray(r.risks)) {
-    for (const [i, risk] of r.risks.entries()) {
-      if (typeof risk === "string" && risk.length > MAX_RESPONSE_LINE_CHARS) {
-        errors.push(`risks[${i}] is ${risk.length} chars (max ${MAX_RESPONSE_LINE_CHARS})`);
-      }
-    }
-  }
-  if (Array.isArray(r.findings)) {
-    for (const [i, f] of r.findings.entries()) {
-      if (f && typeof f.title === "string" && f.title.length > MAX_RESPONSE_LINE_CHARS) {
-        errors.push(`finding[${i}] title is ${f.title.length} chars (max ${MAX_RESPONSE_LINE_CHARS})`);
-      }
-    }
-  }
-  if (r.artifact_paths !== void 0) {
-    if (!Array.isArray(r.artifact_paths)) {
-      errors.push("artifact_paths must be an array of path ref tokens");
-    } else {
-      for (const [i, p] of r.artifact_paths.entries()) {
-        if (typeof p !== "string" || p.includes("\n") || p.length > MAX_ARTIFACT_REF_CHARS) {
-          errors.push(`artifact_paths[${i}] must be a single-line path ref \u2264 ${MAX_ARTIFACT_REF_CHARS} chars`);
-        }
-      }
-    }
-  }
-  try {
-    const serialized = JSON.stringify(input);
-    if (serialized.length > MAX_ENVELOPE_CHARS) {
-      errors.push(`envelope serializes to ${serialized.length} chars (max ${MAX_ENVELOPE_CHARS}) \u2014 move content to disk and reference it via artifact_paths`);
-    }
-  } catch {
-    errors.push("envelope is not JSON-serializable");
-  }
-  return { valid: errors.length === 0, errors };
-}
-
-// src/scripts/hooks/exit_codes.ts
-var EXIT_ALLOW3 = 0;
-var EXIT_BLOCK = 1;
-var EXIT_WARN2 = 2;
-var EXIT_ERROR = 3;
-var EXIT_CODES = Object.freeze([
-  Object.freeze({
-    code: EXIT_ALLOW3,
-    name: "allow",
-    meaning: "no objection; the dispatcher passes the call through",
-    owner: "every concern \u2014 the default verdict",
-    authorizedBy: "nothing; allowing needs no authority"
-  }),
-  Object.freeze({
-    code: EXIT_BLOCK,
-    name: "block",
-    meaning: "refuse the call; the dispatcher lowers this onto the host deny channel",
-    owner: "a concern declared `severity: blocking` in hook_manifest.yaml",
-    authorizedBy: "the manifest entry plus its row in the BLOCKING_ALLOWLIST of tests/hooks/concern_severity.test.ts \u2014 an advisory concern emitting this is downgraded to warn by dispatch_hook._is_advisory"
-  }),
-  Object.freeze({
-    code: EXIT_WARN2,
-    name: "warn",
-    meaning: "advisory; the dispatcher exits 0 and surfaces the reason",
-    owner: "any concern",
-    authorizedBy: "nothing; warning is the ceiling for an advisory concern and is always available to a blocking one"
-  }),
-  Object.freeze({
-    code: EXIT_ERROR,
-    name: "error",
-    meaning: "the concern crashed, timed out, or could not decide \u2014 any rc >= 3. The dispatcher resolves it by the concern`s declared severity, never by the number itself",
-    owner: "no concern emits this on purpose; the runtime does",
-    authorizedBy: "hook_manifest.yaml `severity` alone \u2014 blocking refuses, anything else fails open; `fail_closed` is no longer read on this branch. See docs/contracts/hook-architecture-v1.md \xA7 Exit-code semantics"
-  })
-]);
-
-// src/scripts/hooks/subagent_ledger_hook.ts
-function isObject2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-var LEDGER_DIR = path8.join("agents", "runtime", "state", "subagent-ledger");
-var OPEN_SUBDIR = "open";
-var OPEN_RECORD_TTL_MS = 24 * 60 * 60 * 1e3;
-function refFor(agentId) {
-  return crypto2.createHash("sha256").update(agentId, "utf8").digest("hex").slice(0, 12);
-}
-function unwrapPayload(envelope) {
-  const inner = envelope["payload"];
-  return isObject2(inner) ? inner : envelope;
-}
-function str(payload, ...keys) {
-  for (const k of keys) {
-    const v = payload[k];
-    if (typeof v === "string" && v) return v;
-  }
-  return null;
-}
-function extractParentId(payload, ownId) {
-  const explicit = str(payload, "parent_agent_id", "parentAgentId");
-  if (explicit) return explicit;
-  const session = payload["session"];
-  if (isObject2(session)) {
-    const sessionAgent = str(session, "agent_id", "agentId");
-    if (sessionAgent && sessionAgent !== ownId) return sessionAgent;
-  }
-  return null;
-}
-function classifyEnvelope(message) {
-  if (message === null || !message.trim()) {
-    return { verdict: "no_message", error_count: 0, field_hits: 0 };
-  }
-  const candidates = _jsonObjectCandidates(message);
-  if (candidates.length === 0) return { verdict: "no_envelope", error_count: 0, field_hits: 0 };
-  let best = null;
-  for (const candidate of candidates) {
-    const result = validateResponse(candidate);
-    const fieldHits = countContractFields(candidate);
-    if (result.valid) return { verdict: "ok", error_count: 0, field_hits: fieldHits };
-    if (best === null || fieldHits > best.field_hits) {
-      best = {
-        verdict: fieldHits === 0 ? "foreign_object" : "fail",
-        error_count: result.errors.length,
-        field_hits: fieldHits
-      };
-    }
-  }
-  return best ?? { verdict: "no_envelope", error_count: 0, field_hits: 0 };
-}
-function _jsonObjectCandidates(message) {
-  const texts = [];
-  for (const match of message.matchAll(/^[ \t]*```[ \t]*(?:json)?[ \t]*\r?\n([\s\S]*?)^[ \t]*```/gm)) {
-    if (match[1]) texts.push(match[1]);
-  }
-  let depth = 0;
-  let start = -1;
-  let inString = false;
-  let escaped = false;
-  for (let i = 0; i < message.length; i++) {
-    const ch = message[i];
-    if (inString) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === '"') inString = false;
-      continue;
-    }
-    if (ch === '"') inString = true;
-    else if (ch === "{") {
-      if (depth === 0) start = i;
-      depth++;
-    } else if (ch === "}") {
-      if (depth > 0) {
-        depth--;
-        if (depth === 0 && start !== -1) {
-          texts.push(message.slice(start, i + 1));
-          start = -1;
-        }
-      }
-    }
-  }
-  const out = [];
-  for (const text of texts) {
-    try {
-      const parsed = JSON.parse(text.trim());
-      if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) out.push(parsed);
-    } catch {
-    }
-  }
-  return out;
-}
-function openDir(root) {
-  return path8.join(root, LEDGER_DIR, OPEN_SUBDIR);
-}
-function openFile(root, ref) {
-  return path8.join(openDir(root), `${ref}.json`);
-}
-var DEPTH_BASES = /* @__PURE__ */ new Set(["observed", "asserted-parent", "assumed-root"]);
-function _asOpenRecord(value, expectedRef) {
-  if (!isObject2(value)) return null;
-  const ref = value["ref"];
-  if (typeof ref !== "string" || ref !== expectedRef) return null;
-  if (typeof value["started_at"] !== "string") return null;
-  if (typeof value["depth"] !== "number" || !Number.isFinite(value["depth"])) return null;
-  if (typeof value["depth_basis"] !== "string" || !DEPTH_BASES.has(value["depth_basis"])) return null;
-  const agentType = value["agent_type"];
-  const parentRef = value["parent_ref"];
-  const sessionId = value["session_id"];
-  return {
-    ref,
-    agent_type: typeof agentType === "string" ? agentType : null,
-    started_at: value["started_at"],
-    parent_ref: typeof parentRef === "string" ? parentRef : null,
-    depth: value["depth"],
-    depth_basis: value["depth_basis"],
-    session_id: typeof sessionId === "string" ? sessionId : null
-  };
-}
-function readOpenRecords(root) {
-  const out = /* @__PURE__ */ new Map();
-  let names;
-  try {
-    names = fs9.readdirSync(openDir(root));
-  } catch {
-    return out;
-  }
-  for (const name of names) {
-    if (!name.endsWith(".json")) continue;
-    const expectedRef = name.slice(0, -".json".length);
-    try {
-      const raw = fs9.readFileSync(path8.join(openDir(root), name), "utf8");
-      const rec = _asOpenRecord(JSON.parse(raw), expectedRef);
-      if (rec) out.set(rec.ref, rec);
-    } catch {
-    }
-  }
-  return out;
-}
-function resolveDepth(parentRef, open) {
-  if (parentRef === null) return { depth: 1, depth_basis: "assumed-root" };
-  const parent = open.get(parentRef);
-  if (!parent) return { depth: 2, depth_basis: "asserted-parent" };
-  return { depth: parent.depth + 1, depth_basis: "observed" };
-}
-function ledgerFileFor2(root, ts) {
-  return path8.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
-}
-function appendLedgerLine(root, ts, line) {
-  if (is_replay_mode()) return;
-  const file = ledgerFileFor2(root, ts);
-  fs9.mkdirSync(path8.dirname(file), { recursive: true });
-  fs9.appendFileSync(file, `${JSON.stringify(line)}
-`, "utf8");
-}
-var WALL_CLOCK_ARMS_MS = [
-  { label: "5m", ms: 5 * 60 * 1e3 },
-  { label: "15m", ms: 15 * 60 * 1e3 },
-  { label: "30m", ms: 30 * 60 * 1e3 },
-  { label: "2h", ms: 2 * 60 * 60 * 1e3 }
-];
-function armsExceeded(elapsedMs) {
-  if (elapsedMs === null || !Number.isFinite(elapsedMs)) return [];
-  return WALL_CLOCK_ARMS_MS.filter((a) => elapsedMs >= a.ms).map((a) => a.label);
-}
-function openRecordStats(root, nowMs = Date.now()) {
-  const ledgerPresent = fs9.existsSync(path8.join(root, LEDGER_DIR));
-  const open = readOpenRecords(root);
-  let maxDepth = 0;
-  let counted = 0;
-  let stale = 0;
-  for (const rec of open.values()) {
-    const started = Date.parse(rec.started_at);
-    const isStale = Number.isFinite(started) && nowMs - started >= OPEN_RECORD_TTL_MS;
-    if (isStale) {
-      stale++;
-      continue;
-    }
-    counted++;
-    if (rec.depth > maxDepth) maxDepth = rec.depth;
-  }
-  return {
-    open_count: counted,
-    max_depth: maxDepth,
-    stale_excluded: stale,
-    ledger_present: ledgerPresent
-  };
-}
-function writeOpenRecord(root, rec) {
-  atomic_write_json(openFile(root, rec.ref), rec);
-}
-function removeOpenRecord(root, ref) {
-  if (is_replay_mode()) return;
-  try {
-    fs9.unlinkSync(openFile(root, ref));
-  } catch {
-  }
-}
-function countOpen(root) {
-  try {
-    return fs9.readdirSync(openDir(root)).filter((n) => n.endsWith(".json")).length;
-  } catch {
-    return 0;
-  }
-}
-function reapStaleOpenRecords(root, nowIso) {
-  const now = Date.parse(nowIso);
-  if (!Number.isFinite(now)) return 0;
-  let reaped = 0;
-  for (const rec of readOpenRecords(root).values()) {
-    const started = Date.parse(rec.started_at);
-    if (!Number.isFinite(started) || now - started < OPEN_RECORD_TTL_MS) continue;
-    removeOpenRecord(root, rec.ref);
-    reaped++;
-    appendLedgerLine(root, nowIso, {
-      event: "subagent_reaped",
-      ts: nowIso,
-      ref: rec.ref,
-      agent_type: rec.agent_type,
-      depth: rec.depth,
-      depth_basis: rec.depth_basis,
-      // R2 round 2, finding 5: the arm list is NOT repeated here. A reap
-      // fires only past OPEN_RECORD_TTL_MS (24 h), which exceeds every
-      // arm (largest: 2 h), so `stop_loss_arms_exceeded` would be a
-      // constant on this line — a field that cannot vary answers no
-      // question. `age_ms` carries strictly more information and is what
-      // a reader should aggregate over.
-      age_ms: now - started,
-      reason: "open record exceeded OPEN_RECORD_TTL_MS without a stop"
-    });
-  }
-  return reaped;
-}
-function appendUnidentified(root, event, nowIso, payload) {
-  appendLedgerLine(root, nowIso, {
-    event,
-    ts: nowIso,
-    ref: null,
-    unidentified: true,
-    // The agent TYPE is an id-shaped enum and may still be present; it is
-    // the only thing salvageable from a payload with no id.
-    agent_type: str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
-    reason: "payload carried no agent id \u2014 nothing to correlate start with stop"
-  });
-}
-function handleStart(root, payload, nowIso, sessionId) {
-  const agentId = str(payload, "agent_id", "agentId");
-  if (agentId === null) {
-    appendUnidentified(root, "subagent_start", nowIso, payload);
-    return;
-  }
-  const ref = refFor(agentId);
-  const parentId = extractParentId(payload, agentId);
-  const parentRef = parentId ? refFor(parentId) : null;
-  const { depth, depth_basis } = resolveDepth(parentRef, readOpenRecords(root));
-  const rec = {
-    ref,
-    agent_type: str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
-    started_at: nowIso,
-    parent_ref: parentRef,
-    depth,
-    depth_basis,
-    session_id: sessionId
-  };
-  writeOpenRecord(root, rec);
-  appendLedgerLine(root, nowIso, {
-    event: "subagent_start",
-    ts: nowIso,
-    ref,
-    // Phase 1 Step 4 correction (b): without this the dispatch denominator
-    // is not per-session. Three sessions share one ledger file, so a rate
-    // computed over the file aggregates strangers — the measured window
-    // held 7 starts against 25 stops, one of them an agent type this
-    // session never dispatched. The open record already carried it; the
-    // appended line did not, and the line is what a rate is computed from.
-    session_id: sessionId,
-    agent_type: rec.agent_type,
-    parent_ref: parentRef,
-    depth,
-    depth_basis,
-    concurrent_open: countOpen(root)
-  });
-}
-function handleStop(root, payload, nowIso, sessionId) {
-  const agentId = str(payload, "agent_id", "agentId");
-  if (agentId === null) {
-    appendUnidentified(root, "subagent_stop", nowIso, payload);
-    return;
-  }
-  const ref = refFor(agentId);
-  const rec = readOpenRecords(root).get(ref) ?? null;
-  let durationMs = null;
-  if (rec) {
-    const started = Date.parse(rec.started_at);
-    if (Number.isFinite(started)) durationMs = Math.max(0, Date.parse(nowIso) - started);
-  }
-  const parse2 = classifyEnvelope(str(payload, "last_assistant_message", "lastAssistantMessage"));
-  removeOpenRecord(root, ref);
-  appendLedgerLine(root, nowIso, {
-    event: "subagent_stop",
-    ts: nowIso,
-    ref,
-    // The session this stop was OBSERVED in, read from the same envelope
-    // position as the start's — never back-filled from `rec`, which would
-    // relabel a cross-session stop as belonging to the dispatching session
-    // and hide exactly the mismatch this field exists to expose.
-    session_id: sessionId,
-    agent_type: rec?.agent_type ?? str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
-    depth: rec?.depth ?? null,
-    depth_basis: rec?.depth_basis ?? null,
-    // `null` = the matching start was never seen. That is a finding about
-    // the instrument's own coverage and is recorded as such, not as 0.
-    duration_ms: durationMs,
-    // Phase 3 Step 3, shadow: which wall-clock arms this dispatch would
-    // have tripped. Recorded, never acted on.
-    stop_loss_arms_exceeded: armsExceeded(durationMs),
-    start_seen: rec !== null,
-    envelope_parse: parse2.verdict,
-    envelope_error_count: parse2.error_count,
-    // Beside the count, never instead of it: the count says how wrong the
-    // candidate was, this says whether it was aimed at the envelope.
-    envelope_field_hits: parse2.field_hits,
-    concurrent_open: countOpen(root)
-  });
-}
-function processEnvelope(envelope, consumerRoot) {
-  try {
-    if (!isObject2(envelope)) return EXIT_ALLOW3;
-    const event = envelope["event"];
-    if (event !== "subagent_start" && event !== "subagent_stop") return EXIT_ALLOW3;
-    const payload = unwrapPayload(envelope);
-    const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-    const sessionId = str(payload, "session_id", "sessionId") ?? str(envelope, "session_id", "sessionId");
-    reapStaleOpenRecords(consumerRoot, nowIso);
-    if (event === "subagent_start") handleStart(consumerRoot, payload, nowIso, sessionId);
-    else handleStop(consumerRoot, payload, nowIso, sessionId);
-  } catch {
-    return EXIT_ALLOW3;
-  }
-  return EXIT_ALLOW3;
-}
-function resolveConsumerRoot(envelope) {
-  if (isObject2(envelope)) {
-    const pr = str(envelope, "workspace_root", "project_root");
-    if (pr) return pr;
-    const payload = unwrapPayload(envelope);
-    const cwd = str(payload, "cwd");
-    if (cwd) return cwd;
-  }
-  return process.cwd();
-}
-function main4() {
-  const raw = readHookStdin();
-  let envelope = {};
-  try {
-    envelope = raw.trim() ? JSON.parse(raw) : {};
-  } catch {
-    return EXIT_ALLOW3;
-  }
-  return processEnvelope(envelope, resolveConsumerRoot(envelope));
-}
-function _isCliEntry4() {
-  if (true) {
-    return false;
-  }
-  if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL4(path8.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) return true;
-  try {
-    return fs9.realpathSync(fileURLToPath4(import.meta.url)) === fs9.realpathSync(path8.resolve(process.argv[1]));
-  } catch {
-    return false;
-  }
-}
-if (_isCliEntry4()) process.exit(main4());
-
 // src/scripts/_lib/turn_end_transcript.ts
-import * as fs12 from "node:fs";
+import * as fs11 from "node:fs";
 
 // src/scripts/hooks/end_review_nudge_hook.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import * as crypto3 from "node:crypto";
-import * as fs11 from "node:fs";
+import * as crypto2 from "node:crypto";
+import * as fs10 from "node:fs";
 import * as os from "node:os";
-import * as path10 from "node:path";
-import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
+import * as path9 from "node:path";
+import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
 
 // src/scripts/_lib/review_baseline.ts
 import { spawnSync } from "node:child_process";
-import * as fs10 from "node:fs";
-import * as path9 from "node:path";
+import * as fs9 from "node:fs";
+import * as path8 from "node:path";
 function currentHeadSha(cwd) {
   try {
     const r = spawnSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" });
@@ -4055,12 +3583,12 @@ function currentHeadSha(cwd) {
     return null;
   }
 }
-var BASELINE_STATE_REL = path9.join("agents", "runtime", "state", "review-baseline");
+var BASELINE_STATE_REL = path8.join("agents", "runtime", "state", "review-baseline");
 function baselineStateDir(workspaceRoot) {
-  return path9.join(workspaceRoot, BASELINE_STATE_REL);
+  return path8.join(workspaceRoot, BASELINE_STATE_REL);
 }
 function baselineStateFile(workspaceRoot, sessionKey) {
-  return path9.join(baselineStateDir(workspaceRoot), `${sessionKey}.json`);
+  return path8.join(baselineStateDir(workspaceRoot), `${sessionKey}.json`);
 }
 function parseBaseline(raw) {
   let decoded;
@@ -4088,7 +3616,7 @@ function readBaseline(workspaceRoot, sessionKey) {
   const file = baselineStateFile(workspaceRoot, sessionKey);
   let raw;
   try {
-    raw = fs10.readFileSync(file, "utf-8");
+    raw = fs9.readFileSync(file, "utf-8");
   } catch (exc) {
     const code = exc?.code;
     return code === "ENOENT" ? "absent" : "unreadable";
@@ -4198,13 +3726,13 @@ function isSafeTranscriptPath(rawPath, opts = {}) {
   const homeDir = opts.homeDir ?? os.homedir();
   const maxBytes = opts.maxBytes ?? TRANSCRIPT_SCAN_MAX_BYTES;
   try {
-    const realHome = fs11.realpathSync(homeDir);
-    const realPath = fs11.realpathSync(rawPath);
-    const relative6 = path10.relative(realHome, realPath);
-    if (relative6 === "" || relative6.startsWith("..") || path10.isAbsolute(relative6)) {
+    const realHome = fs10.realpathSync(homeDir);
+    const realPath = fs10.realpathSync(rawPath);
+    const relative6 = path9.relative(realHome, realPath);
+    if (relative6 === "" || relative6.startsWith("..") || path9.isAbsolute(relative6)) {
       return false;
     }
-    const { size } = fs11.statSync(realPath);
+    const { size } = fs10.statSync(realPath);
     return size <= maxBytes;
   } catch {
     return false;
@@ -4262,13 +3790,13 @@ var BINARY_PROBE_BYTES = 8e3;
 var UNTRACKED_FILE_READ_CAP_BYTES = 8 * 1024 * 1024;
 function untrackedFileLineCount(cwd, relPath) {
   try {
-    const abs = path10.resolve(cwd, relPath);
-    const size = fs11.statSync(abs).size;
+    const abs = path9.resolve(cwd, relPath);
+    const size = fs10.statSync(abs).size;
     if (size === 0) return 0;
     if (size > UNTRACKED_FILE_READ_CAP_BYTES) {
       return MUTATION_LINE_THRESHOLD + 1;
     }
-    const buf = fs11.readFileSync(abs);
+    const buf = fs10.readFileSync(abs);
     if (buf.length === 0) return 0;
     const probe = buf.subarray(0, Math.min(buf.length, BINARY_PROBE_BYTES));
     if (probe.includes(0)) return 0;
@@ -4294,10 +3822,10 @@ function totalNonDocMutatedLinesWithMeasure(cwd) {
   );
   return { lines: trackedLines + untrackedLines, measure: "exact" };
 }
-function isObject3(v) {
+function isObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function str2(v) {
+function str(v) {
   return typeof v === "string" ? v : "";
 }
 var DISPATCH_TOOL_RE = /^(agent|task)$/i;
@@ -4314,28 +3842,28 @@ function scanTranscriptForReviewer(transcriptText) {
     } catch {
       continue;
     }
-    if (!isObject3(obj) || obj["type"] !== "assistant") continue;
+    if (!isObject2(obj) || obj["type"] !== "assistant") continue;
     const msg = obj["message"];
-    if (!isObject3(msg)) continue;
+    if (!isObject2(msg)) continue;
     const content = msg["content"];
     if (!Array.isArray(content)) continue;
     for (const blk of content) {
-      if (!isObject3(blk) || blk["type"] !== "tool_use") continue;
-      const name = str2(blk["name"]);
+      if (!isObject2(blk) || blk["type"] !== "tool_use") continue;
+      const name = str(blk["name"]);
       const input = blk["input"];
-      const inputObj = isObject3(input) ? input : {};
+      const inputObj = isObject2(input) ? input : {};
       if (DISPATCH_TOOL_RE.test(name)) {
         const label = [
-          str2(inputObj["description"]),
-          str2(inputObj["subagent_type"])
+          str(inputObj["description"]),
+          str(inputObj["subagent_type"])
         ].filter(Boolean).join(" ");
         if (REVIEW_SHAPED_LABEL_RE.test(label)) return true;
-        const prompt = str2(inputObj["prompt"]);
+        const prompt = str(inputObj["prompt"]);
         if (REVIEW_SHAPED_PROMPT_RE.test(prompt)) return true;
         continue;
       }
       if (/^skill$/i.test(name)) {
-        const skillName = str2(inputObj["skill"]) || str2(inputObj["name"]) || str2(inputObj["command"]);
+        const skillName = str(inputObj["skill"]) || str(inputObj["name"]) || str(inputObj["command"]);
         if (REVIEW_SKILL_NAME_RE.test(skillName)) return true;
         continue;
       }
@@ -4354,33 +3882,33 @@ function appendReviewSkippedTelemetry(workspaceRoot, diffLines, mutationMeasure,
     diff_lines: diffLines,
     mutation_measure: mutationMeasure,
     ts,
-    id: crypto3.randomUUID(),
+    id: crypto2.randomUUID(),
     baseline
   });
   if (errors.length || line === null) return;
   try {
-    const dir = path10.join(workspaceRoot, "agents", "runtime", "state", "audit");
-    fs11.mkdirSync(dir, { recursive: true });
-    const file = path10.join(dir, `${ts.slice(0, 7)}.jsonl`);
-    fs11.appendFileSync(file, `${JSON.stringify(line)}
+    const dir = path9.join(workspaceRoot, "agents", "runtime", "state", "audit");
+    fs10.mkdirSync(dir, { recursive: true });
+    const file = path9.join(dir, `${ts.slice(0, 7)}.jsonl`);
+    fs10.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");
   } catch {
   }
 }
 function sessionStateDir(workspaceRoot) {
-  return path10.join(workspaceRoot, "agents", "runtime", "state", "end-review-nudge");
+  return path9.join(workspaceRoot, "agents", "runtime", "state", "end-review-nudge");
 }
 function sessionStateFile(workspaceRoot, sessionKey) {
-  return path10.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
+  return path9.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
 }
 function deriveSessionKey2(envelope, payload) {
-  const raw = str2(envelope["session_id"]) || str2(payload["transcript_path"] ?? payload["transcriptPath"]);
+  const raw = str(envelope["session_id"]) || str(payload["transcript_path"] ?? payload["transcriptPath"]);
   const material = raw || "unknown-session";
-  return crypto3.createHash("sha256").update(material).digest("hex");
+  return crypto2.createHash("sha256").update(material).digest("hex");
 }
 function hasFiredThisSession(workspaceRoot, sessionKey) {
   try {
-    return fs11.existsSync(sessionStateFile(workspaceRoot, sessionKey));
+    return fs10.existsSync(sessionStateFile(workspaceRoot, sessionKey));
   } catch {
     return false;
   }
@@ -4400,7 +3928,7 @@ var FALLBACK_TO_TELEMETRY = {
   "head-moved": "head_moved",
   "mixed-measure": "mixed_measure"
 };
-function main5() {
+function main4() {
   const [envelope, payload] = unwrap(_read_stdin(), "claude");
   const event = String(envelope["event"] ?? "");
   if (event !== "" && event !== "stop") {
@@ -4436,13 +3964,13 @@ function main5() {
   if (hasFiredThisSession(workspace_root, sessionKey)) {
     return 0;
   }
-  const transcriptPath = str2(
+  const transcriptPath = str(
     payload["transcript_path"] ?? payload["transcriptPath"]
   ).trim();
   let reviewerRan = false;
   if (transcriptPath && isSafeTranscriptPath(transcriptPath)) {
     try {
-      reviewerRan = scanTranscriptForReviewer(fs11.readFileSync(transcriptPath, "utf-8"));
+      reviewerRan = scanTranscriptForReviewer(fs10.readFileSync(transcriptPath, "utf-8"));
     } catch {
       reviewerRan = false;
     }
@@ -4468,29 +3996,29 @@ function main5() {
     })}
 `
   );
-  return EXIT_WARN2;
+  return EXIT_WARN;
 }
-function _isCliEntry5() {
+function _isCliEntry4() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL5(path10.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL4(path9.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs11.realpathSync(fileURLToPath5(import.meta.url));
-    const argv = fs11.realpathSync(path10.resolve(process.argv[1]));
+    const here = fs10.realpathSync(fileURLToPath4(import.meta.url));
+    const argv = fs10.realpathSync(path9.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry5()) {
-  process.exit(main5());
+if (_isCliEntry4()) {
+  process.exit(main4());
 }
 
 // src/scripts/_lib/turn_end_transcript.ts
@@ -4504,10 +4032,10 @@ function readTranscriptTail(transcriptPath, opts = {}) {
   if (!transcriptPath || !isSafeTranscriptPath(transcriptPath, opts)) return empty;
   let lines;
   try {
-    if (opts.maxBytes !== void 0 && fs12.statSync(transcriptPath).size > opts.maxBytes) {
+    if (opts.maxBytes !== void 0 && fs11.statSync(transcriptPath).size > opts.maxBytes) {
       return empty;
     }
-    lines = fs12.readFileSync(transcriptPath, "utf-8").split("\n");
+    lines = fs11.readFileSync(transcriptPath, "utf-8").split("\n");
   } catch {
     return empty;
   }
@@ -4694,7 +4222,7 @@ function detectPromissory(reply) {
 function readCiSettled(workspaceRoot, session_id) {
   if (!hasStableSessionId(session_id)) return { seen: false, settled: false };
   try {
-    const raw = fs13.readFileSync(path11.join(workspaceRoot, statePathFor(session_id)), "utf-8");
+    const raw = fs12.readFileSync(path10.join(workspaceRoot, statePathFor(session_id)), "utf-8");
     const decoded = JSON.parse(raw);
     if (!owns_session_state(decoded, session_id)) return { seen: false, settled: false };
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
@@ -4730,8 +4258,8 @@ function detectCompletionClaim(reply, ci) {
 function readLanguagePin(workspaceRoot, session_id) {
   if (!hasStableSessionId(session_id)) return "und";
   try {
-    const raw = fs13.readFileSync(
-      path11.join(workspaceRoot, statePathFor2(session_id)),
+    const raw = fs12.readFileSync(
+      path10.join(workspaceRoot, statePathFor2(session_id)),
       "utf-8"
     );
     const decoded = JSON.parse(raw);
@@ -4840,7 +4368,7 @@ function sessionStateFile2(workspaceRoot, sessionKey) {
 }
 function alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal) {
   try {
-    const raw = fs13.readFileSync(sessionStateFile2(workspaceRoot, sessionKey), "utf-8");
+    const raw = fs12.readFileSync(sessionStateFile2(workspaceRoot, sessionKey), "utf-8");
     const decoded = JSON.parse(raw);
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
       return decoded["refused_turn"] === turnOrdinal;
@@ -4854,7 +4382,7 @@ function markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, detectors, prom
   const file = sessionStateFile2(workspaceRoot, sessionKey);
   let prev = null;
   try {
-    prev = parseRecord(fs13.readFileSync(file, "utf-8"));
+    prev = parseRecord(fs12.readFileSync(file, "utf-8"));
   } catch {
   }
   let version;
@@ -4877,17 +4405,17 @@ function markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, detectors, prom
   } catch {
   }
 }
-function str3(v) {
+function str2(v) {
   return typeof v === "string" ? v : "";
 }
 function assembleDetectorInputs(envelope, payload) {
-  const workspaceRoot = str3(envelope["workspace_root"]) || process.cwd();
+  const workspaceRoot = str2(envelope["workspace_root"]) || process.cwd();
   let dispatchOpen = false;
   try {
     dispatchOpen = openRecordStats(workspaceRoot).open_count > 0;
   } catch {
   }
-  const transcriptPath = str3(
+  const transcriptPath = str2(
     payload["transcript_path"] ?? payload["transcriptPath"]
   );
   const { lastAssistant, turnOrdinal, toolCalls, assistantTurnTexts } = readTranscriptTail(
@@ -4895,13 +4423,13 @@ function assembleDetectorInputs(envelope, payload) {
     { maxBytes: TRANSCRIPT_READ_MAX_BYTES }
   );
   if (!lastAssistant) return null;
-  const payloadClosing = str3(
+  const payloadClosing = str2(
     payload["last_assistant_message"] ?? payload["lastAssistantMessage"]
   );
   const closingFromPayload = payloadClosing !== "" && !assistantTurnTexts.includes(payloadClosing);
   const turnTexts = closingFromPayload ? [...assistantTurnTexts, payloadClosing] : assistantTurnTexts;
-  const promptId = str3(payload["prompt_id"] ?? payload["promptId"]);
-  const rawSessionId = str3(envelope["session_id"]) || "";
+  const promptId = str2(payload["prompt_id"] ?? payload["promptId"]);
+  const rawSessionId = str2(envelope["session_id"]) || "";
   const sessionKey = deriveSessionKey(rawSessionId || "unknown-session");
   const runState = readTurnRunState(workspaceRoot, rawSessionId);
   return {
@@ -4951,7 +4479,7 @@ function runDetectors(inputs) {
     // on a completion CLAIM, and a turn waiting on a subagent has not
     // finished — so its closing is not the claim F is about. Same slot,
     // opposite trigger, opposite treatment of `dispatchOpen`.
-    openSvgObligation(workspaceRoot, toolCalls),
+    openSvgObligation(workspaceRoot, toolCalls, runState?.asset_renders ?? null),
     dispatchOpen ? null : detectUntestedChange(lastAssistant, toolCalls, runState)
   ]) {
     if (f) findings.push(f);
@@ -4996,7 +4524,7 @@ function recordShadow(inputs, layer) {
     const file = sessionShadowFile(inputs.workspaceRoot, inputs.sessionKey);
     let prev = null;
     try {
-      prev = parseShadowRecord(fs13.readFileSync(file, "utf-8"));
+      prev = parseShadowRecord(fs12.readFileSync(file, "utf-8"));
     } catch {
     }
     atomic_write_json(
@@ -5012,13 +4540,13 @@ function recordShadow(inputs, layer) {
   } catch {
   }
 }
-function main6() {
+function main5() {
   let envelope;
   let payload;
   try {
     [envelope, payload] = unwrap(readHookStdin(), "claude");
   } catch {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   if (payload["stop_hook_active"] === true) {
     try {
@@ -5026,17 +4554,17 @@ function main6() {
       if (retryInputs !== null) recordShadow(retryInputs, "stop_hook_active");
     } catch {
     }
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const inputs = assembleDetectorInputs(envelope, payload);
-  if (inputs === null) return EXIT_ALLOW3;
+  if (inputs === null) return EXIT_ALLOW;
   if (alreadyRefusedTurn(inputs.workspaceRoot, inputs.sessionKey, inputs.turnOrdinal)) {
     recordShadow(inputs, "refused_turn");
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const findings = runDetectors(inputs);
   recordGraphFeeder(inputs, findings, "live");
-  if (findings.length === 0) return EXIT_ALLOW3;
+  if (findings.length === 0) return EXIT_ALLOW;
   markRefusedTurn(
     inputs.workspaceRoot,
     inputs.sessionKey,
@@ -5057,35 +4585,35 @@ ${lines.join("\n")}
   );
   return EXIT_BLOCK;
 }
-function _isCliEntry6() {
+function _isCliEntry5() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL6(path11.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL5(path10.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs13.realpathSync(fileURLToPath6(import.meta.url));
-    const argv = fs13.realpathSync(path11.resolve(process.argv[1]));
+    const here = fs12.realpathSync(fileURLToPath5(import.meta.url));
+    const argv = fs12.realpathSync(path10.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry6()) {
-  process.exit(main6());
+if (_isCliEntry5()) {
+  process.exit(main5());
 }
 
 // src/scripts/hooks/evidence_independence.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import crypto4 from "node:crypto";
-import fs14 from "node:fs";
-import path12 from "node:path";
-import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
+import crypto3 from "node:crypto";
+import fs13 from "node:fs";
+import path11 from "node:path";
+import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL6 } from "node:url";
 
 // src/scripts/_lib/test_delta.ts
 function isCodePath(p) {
@@ -5103,7 +4631,7 @@ function isTestPath(p) {
 }
 
 // src/scripts/hooks/evidence_independence.ts
-var STATE_FILE3 = path12.join("agents", "state", "evidence-dispatch.json");
+var STATE_FILE3 = path11.join("agents", "state", "evidence-dispatch.json");
 function _isObject5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -5171,8 +4699,8 @@ function extractDispatch(envelope) {
 }
 function _ledgerStamp(consumer_root, session_id) {
   try {
-    const raw = fs14.readFileSync(
-      path12.join(consumer_root, ledgerFileFor(session_id)),
+    const raw = fs13.readFileSync(
+      path11.join(consumer_root, ledgerFileFor(session_id)),
       "utf8"
     );
     const d = JSON.parse(raw);
@@ -5183,7 +4711,7 @@ function _ledgerStamp(consumer_root, session_id) {
 }
 function _load(target) {
   try {
-    const decoded = JSON.parse(fs14.readFileSync(target, "utf8"));
+    const decoded = JSON.parse(fs13.readFileSync(target, "utf8"));
     if (_isObject5(decoded) && Array.isArray(decoded["evaluations"])) {
       return decoded;
     }
@@ -5194,7 +4722,7 @@ function _load(target) {
 var WARN_TEXT = "First evaluation dispatch this turn. Two shapes fabricated a binding honest-null in the audited sessions \u2014 check your prompt for both before it goes out: (1) a verdict pre-loaded into the prompt, and (2) a scope narrowed to files you chose. A review you commissioned on your own work is admissible as gate evidence only when the prompt is recorded alongside the verdict.";
 function decide(tool, prompt, priorEvaluations) {
   if (!isDispatchTool(tool) || !isEvaluationPrompt(prompt)) {
-    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", evaluations: priorEvaluations };
+    return { exit: EXIT_ALLOW, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   const preloaded = preloadedVerdict(prompt);
   if (preloaded !== null) {
@@ -5207,11 +4735,11 @@ function decide(tool, prompt, priorEvaluations) {
     };
   }
   if (!isSelfScoped(prompt)) {
-    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", evaluations: priorEvaluations };
+    return { exit: EXIT_ALLOW, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   if (priorEvaluations >= 1) {
     return {
-      exit: EXIT_ALLOW3,
+      exit: EXIT_ALLOW,
       stdout: `${JSON.stringify({
         decision: "warn",
         reason: `Second evaluation dispatch of your own work in this turn. If both passes judge the SAME subject, that is verdict shopping \u2014 commissioning another with a different prompt or scope selects the answer instead of measuring it. Report what the first pass returned, then re-plan. If this is an implementation fan-out rather than a second review, carry on: this check reads prose and cannot tell the two apart with certainty.`
@@ -5222,7 +4750,7 @@ function decide(tool, prompt, priorEvaluations) {
     };
   }
   return {
-    exit: EXIT_ALLOW3,
+    exit: EXIT_ALLOW,
     stdout: `${JSON.stringify({ decision: "warn", reason: WARN_TEXT })}
 `,
     stderr: "",
@@ -5264,10 +4792,10 @@ function run3(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW3;
+      return EXIT_ALLOW;
     }
   }
-  const target = path12.join(options.consumer_root, STATE_FILE3);
+  const target = path11.join(options.consumer_root, STATE_FILE3);
   const state = _load(target);
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
   const turnMarker = `${session_id}:${_ledgerStamp(options.consumer_root, session_id)}`;
@@ -5283,14 +4811,14 @@ function run3(stdin_text, options) {
     if (staged !== null && touchesTestAndCode(staged)) {
       process.stdout.write(`${JSON.stringify({ decision: "warn", reason: flag })}
 `);
-      return EXIT_ALLOW3;
+      return EXIT_ALLOW;
     }
   }
   const decision = decide(tool, prompt, state.evaluations.length);
   if (decision.evaluations > state.evaluations.length) {
     state.evaluations.push({
       at: (/* @__PURE__ */ new Date()).toISOString(),
-      digest: crypto4.createHash("sha256").update(prompt).digest("hex").slice(0, 16),
+      digest: crypto3.createHash("sha256").update(prompt).digest("hex").slice(0, 16),
       prompt_chars: prompt.length
     });
     try {
@@ -5314,7 +4842,7 @@ function _errText3(err) {
   const t = err instanceof Error ? err.message : String(err);
   return t.replace(/\s+/g, " ").trim().slice(0, 200);
 }
-function main7(argv) {
+function main6(argv) {
   const args = argv ?? process.argv.slice(2);
   let consumer_root = process.cwd();
   for (let i = 0; i < args.length; i += 1) {
@@ -5328,33 +4856,33 @@ function main7(argv) {
   }
   return run3(readHookStdin(), { consumer_root });
 }
-function _isCliEntry7() {
+function _isCliEntry6() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL7(path12.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL6(path11.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs14.realpathSync(fileURLToPath7(import.meta.url));
-    const argv = fs14.realpathSync(path12.resolve(process.argv[1]));
+    const here = fs13.realpathSync(fileURLToPath6(import.meta.url));
+    const argv = fs13.realpathSync(path11.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry7()) {
-  process.exit(main7());
+if (_isCliEntry6()) {
+  process.exit(main6());
 }
 
 // src/scripts/hooks/delegation_nudge_hook.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 import path13 from "node:path";
-import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL8 } from "node:url";
+import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
 
 // src/scripts/_lib/auto_dispatch.ts
 var SIZE_FLOOR = 1;
@@ -5424,6 +4952,29 @@ function classifyLookup(taskText, opts = {}) {
     reason: "not lookup-shaped \u2014 regular classification path (never down-guessed)"
   };
 }
+function inferSliceTier(signals) {
+  const guard = signals.exceeds_mechanical_envelope === true;
+  switch (signals.slice_type) {
+    case "read-only-fanout":
+    case "mechanical-covered": {
+      if (guard) {
+        return {
+          tier: "medium",
+          tier_source: "inferred",
+          reason: `${signals.slice_type} slice, but scope exceeds the mechanical envelope \u2014 lite candidacy revoked`
+        };
+      }
+      const cascade = signals.slice_type === "mechanical-covered" ? " (verify-fail escalates to medium)" : "";
+      return { tier: "lite", tier_source: "inferred", reason: `${signals.slice_type} slice${cascade}` };
+    }
+    case "mutating-uncovered":
+      return { tier: "medium", tier_source: "inferred", reason: "mutating slice without test coverage" };
+    case "synthesis":
+      return { tier: "medium", tier_source: "inferred", reason: "synthesis/judgment slice \u2014 judge one tier up" };
+    default:
+      return { tier: "inherit", tier_source: "inherit", reason: "unknown/ambiguous slice type \u2014 session tier, never guess down" };
+  }
+}
 
 // src/scripts/_lib/judgment_ladder.ts
 var RENAME_RE = /\brename\s+\S+\s+to\s+\S+\b/i;
@@ -5633,6 +5184,86 @@ function resolveSubagentRouting(inp) {
   };
 }
 
+// src/scripts/_lib/hand_kinds.ts
+var HAND_KINDS = [
+  "classify",
+  "extract",
+  "summarise-given-text",
+  "draft-candidate",
+  "test-candidates",
+  "finding-proposal"
+];
+var HEAD_ONLY_KINDS = ["plan", "decide", "chair", "final-review", "write"];
+var _KINDS = new Set(HAND_KINDS);
+var _HEAD_ONLY = new Set(HEAD_ONLY_KINDS);
+var KIND_FROM_PROMPT = [
+  [/^\s*(?:propose|suggest|draft|write)\s+(?:unit\s+)?test(?:s|\s+cases?|\s+candidates?)?\b/i, "test-candidates"],
+  [/^\s*(?:propose|list)\s+(?:review\s+)?findings?\b/i, "finding-proposal"],
+  [/^\s*(?:classify|categori[sz]e|label)\b/i, "classify"],
+  [/^\s*extract\b/i, "extract"],
+  [/^\s*summari[sz]e\b/i, "summarise-given-text"],
+  [/^\s*draft\b/i, "draft-candidate"]
+];
+function handKindFromPrompt(text) {
+  for (const [re, kind] of KIND_FROM_PROMPT) if (re.test(text)) return kind;
+  return null;
+}
+
+// src/scripts/ai_council/free_rung.ts
+var import_yaml = __toESM(require_dist(), 1);
+import * as fs15 from "node:fs";
+
+// src/scripts/ai_council/kind_flip_state.ts
+import * as fs14 from "node:fs";
+import * as path12 from "node:path";
+var KIND_FLIPS_RELPATH = path12.join("agents", "runtime", "state", "hand-kind-flips.json");
+function isKindFlipped(stateRoot, kind) {
+  try {
+    const raw = JSON.parse(fs14.readFileSync(path12.join(stateRoot, KIND_FLIPS_RELPATH), "utf8"));
+    return raw.kinds?.[kind]?.route === "free";
+  } catch {
+    return false;
+  }
+}
+
+// src/scripts/ai_council/free_rung.ts
+var COUNCIL_CONFIG_ENV = "AI_COUNCIL_CONFIG";
+var COUNCIL_CONFIG_REL = "settings/.ai-council.yml";
+function keyPresent(ref) {
+  if (ref === void 0 || ref === null) return true;
+  if (typeof ref !== "string" || !ref.startsWith("env:")) return false;
+  return (process.env[ref.slice(4)] ?? "") !== "";
+}
+function freeRouteAvailable(configPath) {
+  let raw;
+  try {
+    raw = (0, import_yaml.parse)(fs15.readFileSync(configPath, "utf-8"), { version: "1.1" });
+  } catch {
+    return false;
+  }
+  const members = raw?.members;
+  if (members === null || typeof members !== "object") return false;
+  for (const [name, value] of Object.entries(members)) {
+    if (value === null || typeof value !== "object") continue;
+    const cfg = value;
+    if (cfg["enabled"] !== true) continue;
+    const parsed = parseRouteFields(name, cfg, false);
+    if ("error" in parsed || parsed.route === null) continue;
+    const model = typeof cfg["model"] === "string" ? cfg["model"] : "";
+    const t = resolveRouteTransport({ name, route: parsed.route, model, contentClass: "public-artifact", keyPresent: keyPresent(cfg["api_key_ref"]) });
+    if (t.available && t.billing !== "per-token") return true;
+  }
+  return false;
+}
+function councilConfigPath() {
+  const override = process.env[COUNCIL_CONFIG_ENV];
+  if (override) return override.startsWith("~/") ? `${process.env["HOME"] ?? ""}${override.slice(1)}` : override;
+  return resolve_with_fallback(COUNCIL_CONFIG_REL, { env: null });
+}
+function freeRungFor(stateRoot, kind, configPath) {
+  return isKindFlipped(stateRoot, kind) && configPath !== null && freeRouteAvailable(configPath);
+}
+
 // src/scripts/hooks/delegation_nudge_hook.ts
 function _isObject6(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -5725,10 +5356,10 @@ function resolveActivation(workspace_root, hostId) {
     agentTeams: host_manifest.agent_teams
   };
 }
-function recommendSliceTier(downshift, separate_quota_pool) {
+function recommendSliceTier(downshift, separate_quota_pool, sliceKind = "unknown") {
   const decision = resolveSubagentRouting({
-    task_tier: "lite",
-    session_tier: "high",
+    task_tier: inferSliceTier({ slice_type: sliceKind }).tier,
+    session_tier: "inherit",
     downshift,
     quota_arbitrage: false,
     model_map: {},
@@ -5736,9 +5367,18 @@ function recommendSliceTier(downshift, separate_quota_pool) {
   });
   return decision.tier;
 }
-function buildNudgeLine(rung, classification, sliceCount, tier) {
+var READ_ONLY_FANOUT_RE = /\b(find|locate|search|grep|list|inventor(?:y|ise|ize)|enumerate|count|which files|where (?:is|are)|finde|suche|liste|z(?:ä|ae)hle|wo (?:ist|sind))\b/i;
+var MUTATING_RE = /\b(fix|implement|edit|write|refactor|change|add|create|remove|delete|update|rename|migrate|build|move|replace|mach|bau|implementier\w*|(?:ä|ae)nder\w*|erstell\w*|l(?:ö|oe)sch\w*|f(?:ü|ue)g\w*|schreib\w*)\b/i;
+function sliceKindFromPrompt(prompt) {
+  return READ_ONLY_FANOUT_RE.test(prompt) && !MUTATING_RE.test(prompt) ? "read-only-fanout" : "unknown";
+}
+var LEG_COLD_START_UNCACHED_TOKENS = 182257;
+function buildNudgeLine(rung, classification, sliceCount, tier, sliceKind, handKind) {
   const unit = sliceCount === 1 ? "slice" : "slices";
   const rungLabel = rung === null ? "rung-?" : `rung-${rung}`;
+  if (rung === 0.5 && handKind !== void 0) {
+    return `<delegation-nudge>rung-0.5: free rung. This slice is a typed \`${handKind}\` task and an unpaid route is admissible \u2014 you may send it as ONE call via \`./scripts-run src/scripts/ask_transport --kind ${handKind} --content-class public-artifact "<slice>"\` (public-artifact text only; project content stays on a paid route). The return is a proposal: verify it before acting on it. Nothing was sent for you \u2014 ${classification.reason}.</delegation-nudge>`;
+  }
   if (rung === 0.5) {
     return `<delegation-nudge>rung-0.5: ask, est. <1k tokens. This is a single bounded question \u2014 answer it via ONE completion (\`./scripts-run src/scripts/ask_transport "<question>"\`) instead of a subagent spawn (measured spawn floor: ~251k tokens) \u2014 ${classification.reason}.</delegation-nudge>`;
   }
@@ -5749,9 +5389,12 @@ function buildNudgeLine(rung, classification, sliceCount, tier) {
     return `<delegation-nudge>rung-3: team. These slices must see each other's state during the run, so a set of independent subagent spawns cannot express it \u2014 use the host teams primitive, or fall back to \`./scripts-run src/scripts/ask_transport "<question>"\` for a bounded sub-question. Not a spawn, and not run for you \u2014 ${classification.reason}.</delegation-nudge>`;
   }
   const modeLabel = classification.mode ?? "single-slice";
-  return `<delegation-nudge>${rungLabel}: dispatch ${modeLabel} (${sliceCount} ${unit}, ${tier} tier recommended). Consider dispatching via subagent-orchestration instead of doing every slice in-session \u2014 ${classification.reason}.</delegation-nudge>`;
+  const coldStart = rung === 1 ? ` A leg starts cold (~${Math.round(LEG_COLD_START_UNCACHED_TOKENS / 1e3)}k uncached tokens): a slice of one to three direct reads does not amortise it.` : "";
+  const model = tier === "lite" && sliceKind !== void 0 && sliceKind !== "unknown" ? TIER_TO_CLAUDE_MODEL[tier] : void 0;
+  const carrier = model ? ` Pass \`model: "${model}"\` on each Agent call (${sliceKind} slices earn lite).` : "";
+  return `<delegation-nudge>${rungLabel}: dispatch ${modeLabel} (${sliceCount} ${unit}, ${tier} tier recommended). Consider dispatching via subagent-orchestration instead of doing every slice in-session \u2014 ${classification.reason}.${carrier}${coldStart}</delegation-nudge>`;
 }
-function classifyPrompt(prompt, workspace_root, hostId) {
+function classifyPrompt(prompt, workspace_root, hostId, opts = {}) {
   try {
     const { signals, sliceCountForLine } = extractTaskSignals(prompt);
     const { activation, downshift, separate_quota_pool, agentTeams } = resolveActivation(
@@ -5771,13 +5414,28 @@ function classifyPrompt(prompt, workspace_root, hostId) {
         classification: { delegable: false, action: "ask", mode: null, reason: ladder.reason },
         sliceCount: 0,
         tier: recommendSliceTier(downshift, separate_quota_pool),
+        sliceKind: "unknown",
         rung: ladder.rung
       };
     }
+    if (ladder.rung === 0.5 && opts.freeRouteAdmissible !== void 0) {
+      const handKind = handKindFromPrompt(prompt);
+      if (handKind !== null && opts.freeRouteAdmissible(handKind)) {
+        return {
+          classification: { delegable: false, action: "ask", mode: null, reason: ladder.reason },
+          sliceCount: 0,
+          tier: recommendSliceTier(downshift, separate_quota_pool),
+          sliceKind: "unknown",
+          rung: ladder.rung,
+          handKind
+        };
+      }
+    }
     if (ladder.verdict !== "subagent") {
       return null;
     }
-    const tier = recommendSliceTier(downshift, separate_quota_pool);
+    const sliceKind = sliceKindFromPrompt(prompt);
+    const tier = recommendSliceTier(downshift, separate_quota_pool, sliceKind);
     const sliceCount = ladder.rung === 1 ? 1 : sliceCountForLine;
     const classification = {
       delegable: true,
@@ -5785,7 +5443,7 @@ function classifyPrompt(prompt, workspace_root, hostId) {
       mode: ladder.mode ?? null,
       reason: ladder.reason
     };
-    return { classification, sliceCount, tier, rung: ladder.rung };
+    return { classification, sliceCount, tier, sliceKind, rung: ladder.rung };
   } catch {
     return null;
   }
@@ -5806,70 +5464,79 @@ function _workspaceRoot(envelope) {
   }
   return process.cwd();
 }
-function main8() {
+function main7() {
   let envelope = {};
   try {
     const raw = readHookStdin();
     envelope = raw.trim() ? JSON.parse(raw) : {};
   } catch {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const env = _isObject6(envelope) ? envelope : {};
   const event = env["event"];
   const slot = typeof event === "string" && event !== "" ? event : "user_prompt_submit";
   if (slot !== "user_prompt_submit") {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const payload = _isObject6(env["payload"]) ? env["payload"] : env;
   const prompt = _extractPrompt2(payload);
   if (!prompt) {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   if (isSyntheticPrompt(prompt)) {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   const root = _workspaceRoot(env);
   const platform = env["platform"];
   const hostId = typeof platform === "string" && platform ? platform : null;
-  const result = classifyPrompt(prompt, root, hostId);
+  const result = classifyPrompt(prompt, root, hostId, {
+    freeRouteAdmissible: (kind) => freeRungFor(root, kind, councilConfigPath())
+  });
   if (!result) {
-    return EXIT_ALLOW3;
+    return EXIT_ALLOW;
   }
   process.stdout.write(
     `${JSON.stringify({
       decision: "warn",
       reason: `delegation-nudge: rung-${result.rung} verdict (${result.sliceCount} slices, ${result.tier} tier)`,
-      additional_context: buildNudgeLine(result.rung, result.classification, result.sliceCount, result.tier)
+      additional_context: buildNudgeLine(
+        result.rung,
+        result.classification,
+        result.sliceCount,
+        result.tier,
+        result.sliceKind,
+        result.handKind
+      )
     })}
 `
   );
-  return EXIT_WARN2;
+  return EXIT_WARN;
 }
-function _isCliEntry8() {
+function _isCliEntry7() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL8(path13.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL7(path13.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs15.realpathSync(fileURLToPath8(import.meta.url));
-    const argv = fs15.realpathSync(path13.resolve(process.argv[1]));
+    const here = fs16.realpathSync(fileURLToPath7(import.meta.url));
+    const argv = fs16.realpathSync(path13.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry8()) {
-  process.exit(main8());
+if (_isCliEntry7()) {
+  process.exit(main7());
 }
 
 // src/scripts/conformance_scan.ts
-var REPO_ROOT = path14.resolve(path14.dirname(fileURLToPath9(import.meta.url)), "..", "..");
+var REPO_ROOT = path14.resolve(path14.dirname(fileURLToPath8(import.meta.url)), "..", "..");
 var OBSERVED_BAND = { low: 9.1, high: 39.2 };
 var BAND_MIN_TURNS = 1978;
 var CARRIER_CHANGES = [
@@ -6255,13 +5922,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   return {
     project: {
       dir: projectRulesDir,
-      present: fs16.existsSync(projectRulesDir),
+      present: fs17.existsSync(projectRulesDir),
       files: p.files,
       tokens: _tokens(p.chars)
     },
     global: {
       dir: globalRulesDir,
-      present: fs16.existsSync(globalRulesDir),
+      present: fs17.existsSync(globalRulesDir),
       files: g.files,
       tokens: _tokens(g.chars)
     },
@@ -6269,13 +5936,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   };
 }
 function storeKey(store) {
-  return createHash5("sha256").update(path14.resolve(store)).digest("hex").slice(0, 12);
+  return createHash4("sha256").update(path14.resolve(store)).digest("hex").slice(0, 12);
 }
 function scanStore(store, limit) {
-  const files = fs16.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs16.statSync(path14.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
+  const files = fs17.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs17.statSync(path14.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
   const per_session = [];
   for (const f of files) {
-    const lines = fs16.readFileSync(path14.join(store, f), "utf8").split("\n");
+    const lines = fs17.readFileSync(path14.join(store, f), "utf8").split("\n");
     const r = scanSession(f.replace(/\.jsonl$/, "").slice(0, 8), lines);
     if (r.assistant_turns > 0) {
       per_session.push(r);
@@ -6336,8 +6003,8 @@ function scanStore(store, limit) {
   };
 }
 function recordRate(file, scanned_at, rate) {
-  fs16.mkdirSync(path14.dirname(file), { recursive: true });
-  fs16.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
+  fs17.mkdirSync(path14.dirname(file), { recursive: true });
+  fs17.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
 `, "utf8");
 }
 function render(report) {
@@ -6436,7 +6103,7 @@ function render(report) {
   lines.push("    checkbox batching                     \u2014 measured NOWHERE. ~5 low-severity findings.");
   return lines.join("\n");
 }
-function main9(argv) {
+function main8(argv) {
   const args = argv ?? process.argv.slice(2);
   let store = null;
   let limit = 30;
@@ -6468,14 +6135,14 @@ function main9(argv) {
     return 2;
   }
   const resolved = store ?? defaultStore(process.cwd());
-  if (!fs16.existsSync(resolved)) {
+  if (!fs17.existsSync(resolved)) {
     process.stderr.write(`conformance:behavior: no transcript store at ${resolved}
 `);
     return 1;
   }
   const report = scanStore(resolved, Number.isFinite(limit) && limit > 0 ? limit : 30);
   if (out) {
-    fs16.writeFileSync(out, `${JSON.stringify(report, null, 2)}
+    fs17.writeFileSync(out, `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   if (record) {
@@ -6483,7 +6150,7 @@ function main9(argv) {
   }
   if (why !== null) {
     const id = why;
-    fs16.writeSync(
+    fs17.writeSync(
       1,
       json ? `${JSON.stringify(
         {
@@ -6503,48 +6170,48 @@ function main9(argv) {
     );
     return 0;
   }
-  fs16.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
+  fs17.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
 ` : `${render(report)}
 `);
   return 0;
 }
-function _isCliEntry9() {
+function _isCliEntry8() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL9(path14.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL8(path14.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs16.realpathSync(fileURLToPath9(import.meta.url));
-    const argv = fs16.realpathSync(path14.resolve(process.argv[1]));
+    const here = fs17.realpathSync(fileURLToPath8(import.meta.url));
+    const argv = fs17.realpathSync(path14.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry9()) {
-  process.exit(main9());
+if (_isCliEntry8()) {
+  process.exit(main8());
 }
 
 // src/scripts/report_carrier_divergence.ts
-import * as fs17 from "node:fs";
+import * as fs18 from "node:fs";
 import * as os3 from "node:os";
 import * as path15 from "node:path";
 import process2 from "node:process";
-import { fileURLToPath as fileURLToPath10, pathToFileURL as pathToFileURL10 } from "node:url";
-var _HERE2 = fileURLToPath10(import.meta.url);
+import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
+var _HERE2 = fileURLToPath9(import.meta.url);
 var REPO_ROOT2 = path15.resolve(path15.dirname(_HERE2), "..", "..");
 var PROJECT_RULES = path15.join(".claude", "rules");
 var PROJECTION_SOURCE = path15.join("dist", "agent-src", "rules");
 var GLOBAL_RULES = path15.join(".claude", "rules");
 function _listRules(dir) {
   try {
-    return fs17.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    return fs18.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
@@ -6552,7 +6219,7 @@ function _listRules(dir) {
 function _ruleType(file) {
   let text;
   try {
-    text = fs17.readFileSync(file, "utf-8");
+    text = fs18.readFileSync(file, "utf-8");
   } catch {
     return "";
   }
@@ -6563,8 +6230,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
   const out = {
     projectDir,
     globalDir,
-    globalPresent: fs17.existsSync(globalDir),
-    projectPresent: fs17.existsSync(projectDir),
+    globalPresent: fs18.existsSync(globalDir),
+    projectPresent: fs18.existsSync(projectDir),
     shared: 0,
     identical: [],
     provenanceOnly: [],
@@ -6597,8 +6264,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     let projectCopy;
     let globalCopy;
     try {
-      projectCopy = fs17.readFileSync(path15.join(projectDir, rule));
-      globalCopy = fs17.readFileSync(path15.join(globalDir, rule));
+      projectCopy = fs18.readFileSync(path15.join(projectDir, rule));
+      globalCopy = fs18.readFileSync(path15.join(globalDir, rule));
       verdict = comparePair(projectCopy, globalCopy);
     } catch {
       out.shared -= 1;
@@ -6743,7 +6410,7 @@ function render2(d) {
   }
   return lines.join("\n");
 }
-function main10(argv) {
+function main9(argv) {
   const args = argv ?? process2.argv.slice(2);
   let projectDir = path15.join(REPO_ROOT2, PROJECT_RULES);
   let globalDir = path15.join(os3.homedir(), GLOBAL_RULES);
@@ -6781,25 +6448,25 @@ function main10(argv) {
 `);
   return 0;
 }
-function _isCliEntry10() {
+function _isCliEntry9() {
   if (process2.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL10(path15.resolve(process2.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL9(path15.resolve(process2.argv[1])).href) return true;
   try {
-    return fs17.realpathSync(_HERE2) === fs17.realpathSync(path15.resolve(process2.argv[1]));
+    return fs18.realpathSync(_HERE2) === fs18.realpathSync(path15.resolve(process2.argv[1]));
   } catch {
     return false;
   }
 }
-if (_isCliEntry10()) {
-  process2.exit(main10());
+if (_isCliEntry9()) {
+  process2.exit(main9());
 }
 
 // src/scripts/report_skill_activation.ts
-import * as fs18 from "node:fs";
+import * as fs19 from "node:fs";
 import * as os4 from "node:os";
 import * as path16 from "node:path";
-import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
-var _HERE3 = fileURLToPath11(import.meta.url);
+import { fileURLToPath as fileURLToPath10, pathToFileURL as pathToFileURL10 } from "node:url";
+var _HERE3 = fileURLToPath10(import.meta.url);
 var REPO_ROOT3 = path16.resolve(path16.dirname(_HERE3), "..", "..");
 var SKILLS_ROOT = "src/skills";
 var TRIGGER_KEYS = ["triggers:", "trigger_description:", "file_pattern:", "path_prefix:"];
@@ -6811,25 +6478,25 @@ function censusSkills(root) {
     withTriggerCorpus: [],
     withDeterministicObligation: []
   };
-  if (!fs18.existsSync(root)) {
+  if (!fs19.existsSync(root)) {
     return out;
   }
-  for (const entry of fs18.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const entry of fs19.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory()) {
       continue;
     }
     const file = path16.join(root, entry.name, "SKILL.md");
-    if (!fs18.existsSync(file)) {
+    if (!fs19.existsSync(file)) {
       continue;
     }
     out.total += 1;
-    const text = fs18.readFileSync(file, "utf8");
+    const text = fs19.readFileSync(file, "utf8");
     const fmEnd = text.startsWith("---") ? text.indexOf("\n---", 3) : -1;
     const fm = fmEnd === -1 ? "" : text.slice(0, fmEnd);
     if (TRIGGER_KEYS.some((k) => new RegExp(`^${k}`, "m").test(fm))) {
       out.withTriggerKey.push(entry.name);
     }
-    if (fs18.existsSync(path16.join(root, entry.name, "evals", "triggers.json"))) {
+    if (fs19.existsSync(path16.join(root, entry.name, "evals", "triggers.json"))) {
       out.withTriggerCorpus.push(entry.name);
     }
     const body = fmEnd === -1 ? text : text.slice(fmEnd + 4);
@@ -6844,13 +6511,13 @@ function defaultStore2(cwd) {
 }
 function measureUsage(store, limit) {
   const rep = { store, sessions: 0, assistantTurns: 0, invocations: 0, bySkill: {} };
-  if (!fs18.existsSync(store)) {
+  if (!fs19.existsSync(store)) {
     return rep;
   }
-  const files = fs18.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path16.join(store, f)).sort((a, b) => fs18.statSync(b).mtimeMs - fs18.statSync(a).mtimeMs).slice(0, limit);
+  const files = fs19.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path16.join(store, f)).sort((a, b) => fs19.statSync(b).mtimeMs - fs19.statSync(a).mtimeMs).slice(0, limit);
   rep.sessions = files.length;
   for (const file of files) {
-    for (const line of fs18.readFileSync(file, "utf8").split("\n")) {
+    for (const line of fs19.readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) {
         continue;
       }
@@ -6928,10 +6595,10 @@ function buildRecord(census, usage, today) {
 }
 function readRecord(repoRoot) {
   const file = path16.join(repoRoot, RECORD_PATH);
-  if (!fs18.existsSync(file)) {
+  if (!fs19.existsSync(file)) {
     return null;
   }
-  return JSON.parse(fs18.readFileSync(file, "utf8"));
+  return JSON.parse(fs19.readFileSync(file, "utf8"));
 }
 function render3(census, usage, published = null) {
   const lines = [];
@@ -7037,7 +6704,7 @@ function render3(census, usage, published = null) {
   return lines.join("\n");
 }
 var USAGE2 = "usage: report_skill_activation [--root DIR] [--limit N] [--store PATH]... [--emit] [--allow-empty-store]\n";
-function main11(argv) {
+function main10(argv) {
   let limit = 30;
   let emit = false;
   let allowEmpty = false;
@@ -7092,25 +6759,25 @@ function main11(argv) {
   }
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const file = path16.join(root, RECORD_PATH);
-  fs18.mkdirSync(path16.dirname(file), { recursive: true });
-  fs18.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
+  fs19.mkdirSync(path16.dirname(file), { recursive: true });
+  fs19.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
 `);
   process.stdout.write(`
 wrote ${RECORD_PATH} (measured ${today})
 `);
   return 0;
 }
-if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL11(path16.resolve(process.argv[1])).href) {
-  process.exit(main11(process.argv.slice(2)));
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL10(path16.resolve(process.argv[1])).href) {
+  process.exit(main10(process.argv.slice(2)));
 }
 
 // src/scripts/report_skill_obligation_violations.ts
-import * as fs19 from "node:fs";
+import * as fs20 from "node:fs";
 import * as os5 from "node:os";
 import * as path17 from "node:path";
 import process3 from "node:process";
-import { fileURLToPath as fileURLToPath12, pathToFileURL as pathToFileURL12 } from "node:url";
-var _HERE4 = fileURLToPath12(import.meta.url);
+import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
+var _HERE4 = fileURLToPath11(import.meta.url);
 var REPO_ROOT4 = path17.resolve(path17.dirname(_HERE4), "..", "..");
 var OBLIGATION_LINE_RE = new RegExp(`${DETERMINISTIC_RE.source}.*`, "gm");
 var PATH_RE = /`([A-Za-z0-9_./-]*\/[A-Za-z0-9_.-]+\.[a-z]{2,6})`/g;
@@ -7163,7 +6830,7 @@ function extractObligations(repoRoot) {
   for (const skill of census.withDeterministicObligation) {
     let text;
     try {
-      text = fs19.readFileSync(path17.join(skillsRoot, skill, "SKILL.md"), "utf-8");
+      text = fs20.readFileSync(path17.join(skillsRoot, skill, "SKILL.md"), "utf-8");
     } catch {
       continue;
     }
@@ -7292,13 +6959,13 @@ function scanStore2(repoRoot, store, limit) {
   };
   let files;
   try {
-    files = fs19.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path17.join(store, f), m: fs19.statSync(path17.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
+    files = fs20.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path17.join(store, f), m: fs20.statSync(path17.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
   } catch {
     return report;
   }
   report.sessions = files.length;
   for (const file of files) {
-    const lines = fs19.readFileSync(file, "utf-8").split("\n");
+    const lines = fs20.readFileSync(file, "utf-8").split("\n");
     const id = path17.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
     const entries = _parseSession(lines);
     if (loadedSkillsFrom(entries).size > 0) report.sessionsWithASkill += 1;
@@ -7369,7 +7036,7 @@ function render4(r) {
   lines.push("  ships as detection-only, and this one says so.");
   return lines.join("\n");
 }
-function main12(argv) {
+function main11(argv) {
   const args = argv ?? process3.argv.slice(2);
   let limit = 30;
   let json = false;
@@ -7422,21 +7089,21 @@ function main12(argv) {
   }
   return 0;
 }
-function _isCliEntry11() {
+function _isCliEntry10() {
   if (process3.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL12(path17.resolve(process3.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL11(path17.resolve(process3.argv[1])).href) return true;
   try {
-    return fs19.realpathSync(_HERE4) === fs19.realpathSync(path17.resolve(process3.argv[1]));
+    return fs20.realpathSync(_HERE4) === fs20.realpathSync(path17.resolve(process3.argv[1]));
   } catch {
     return false;
   }
 }
-if (_isCliEntry11()) {
-  process3.exit(main12());
+if (_isCliEntry10()) {
+  process3.exit(main11());
 }
 
 // src/scripts/report_conformance_funnel.ts
-var _HERE5 = fileURLToPath13(import.meta.url);
+var _HERE5 = fileURLToPath12(import.meta.url);
 var REPO_ROOT5 = path18.resolve(path18.dirname(_HERE5), "..", "..");
 function buildFunnel(opts = {}) {
   const repoRoot = opts.repoRoot ?? REPO_ROOT5;
@@ -7450,7 +7117,7 @@ function buildFunnel(opts = {}) {
     divergence: compareCarriers(projectRulesDir, globalRulesDir, sourceDir),
     skills: censusSkills(path18.join(repoRoot, SKILLS_ROOT)),
     usage: measureUsage(store, limit),
-    storePresent: fs20.existsSync(store),
+    storePresent: fs21.existsSync(store),
     sk2: scanStore2(repoRoot, store, limit)
   };
 }
@@ -7575,7 +7242,7 @@ function render5(r) {
   lines.push("workflow without a measured false-positive rate first (locked policy).");
   return lines.join("\n");
 }
-function main13(argv) {
+function main12(argv) {
   const args = argv ?? process4.argv.slice(2);
   const opts = {};
   const value = (i) => {
@@ -7621,21 +7288,21 @@ function main13(argv) {
 `);
   return 0;
 }
-function _isCliEntry12() {
+function _isCliEntry11() {
   if (process4.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL13(path18.resolve(process4.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL12(path18.resolve(process4.argv[1])).href) return true;
   try {
-    return fs20.realpathSync(_HERE5) === fs20.realpathSync(path18.resolve(process4.argv[1]));
+    return fs21.realpathSync(_HERE5) === fs21.realpathSync(path18.resolve(process4.argv[1]));
   } catch {
     return false;
   }
 }
-if (_isCliEntry12()) {
-  process4.exit(main13());
+if (_isCliEntry11()) {
+  process4.exit(main12());
 }
 
 // src/scripts/_cli/cmd_conformance.ts
-var _HERE6 = fileURLToPath14(import.meta.url);
+var _HERE6 = fileURLToPath13(import.meta.url);
 var PACKAGE_ROOT = resolvePackageRoot(import.meta.url);
 var CONFORMANCE_CHECK_IDS = [
   "txlog-clean",
@@ -7669,13 +7336,13 @@ function installLogPath() {
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path19.join(os7.homedir(), ".event4u", "agent-config", "install-log.jsonl");
+  return getLogPath();
 }
 function _installLogExpected(projectRoot) {
-  return fs21.existsSync(manifest_path(projectRoot));
+  return fs22.existsSync(manifest_path(projectRoot));
 }
 function _check_txlog_clean(logPath = installLogPath(), projectRoot = null) {
-  const entries = fs21.existsSync(logPath) ? readRecentEntries(logPath) : [];
+  const entries = fs22.existsSync(logPath) ? readRecentEntries(logPath) : [];
   if (entries.length === 0) {
     if (projectRoot !== null && _installLogExpected(projectRoot)) {
       return {
@@ -7713,7 +7380,7 @@ function routeTargetPaths(target) {
 }
 function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   const routerPath = path19.join(packageRoot, "dist", "router.json");
-  if (!fs21.existsSync(routerPath)) {
+  if (!fs22.existsSync(routerPath)) {
     return {
       id: "router-pointers",
       status: "fail",
@@ -7723,7 +7390,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   }
   let router;
   try {
-    router = JSON.parse(fs21.readFileSync(routerPath, "utf8"));
+    router = JSON.parse(fs22.readFileSync(routerPath, "utf8"));
   } catch (exc) {
     return {
       id: "router-pointers",
@@ -7738,7 +7405,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   let targets = 0;
   for (const kernelId of router["kernel"] ?? []) {
     ids += 1;
-    if (!fs21.existsSync(path19.join(rulesDir, `${kernelId}.md`))) {
+    if (!fs22.existsSync(path19.join(rulesDir, `${kernelId}.md`))) {
       broken.push(`kernel:${kernelId} \u2192 rules/${kernelId}.md missing`);
     }
   }
@@ -7746,7 +7413,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
     for (const entry of router[tier] ?? []) {
       const ruleId = String(entry["id"] ?? "");
       ids += 1;
-      if (!fs21.existsSync(path19.join(rulesDir, `${ruleId}.md`))) {
+      if (!fs22.existsSync(path19.join(rulesDir, `${ruleId}.md`))) {
         broken.push(`${tier}:${ruleId} \u2192 rules/${ruleId}.md missing`);
       }
       for (const target of entry["routes_to"] ?? []) {
@@ -7756,7 +7423,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
           broken.push(`${ruleId} \u2192 unparseable routes_to ${JSON.stringify(target)}`);
           continue;
         }
-        if (!candidates.some((rel2) => fs21.existsSync(path19.join(packageRoot, rel2)))) {
+        if (!candidates.some((rel2) => fs22.existsSync(path19.join(packageRoot, rel2)))) {
           broken.push(`${ruleId} \u2192 ${target} (${candidates[0]} missing)`);
         }
       }
@@ -7790,7 +7457,7 @@ function detectSmokePlatform(projectRoot) {
 function dispatcherRunner(packageRoot) {
   const localTsx = path19.join(packageRoot, "node_modules", ".bin", "tsx");
   const script = path19.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
-  if (fs21.existsSync(localTsx)) {
+  if (fs22.existsSync(localTsx)) {
     return [localTsx, script];
   }
   return ["npx", "tsx", script];
@@ -7841,11 +7508,11 @@ function _check_hook_dispatcher(projectRoot, packageRoot = PACKAGE_ROOT, opts =
 }
 function readSettingsMode(projectRoot) {
   const settingsPath = path19.join(projectRoot, ".agent-settings.yml");
-  if (!fs21.existsSync(settingsPath)) {
+  if (!fs22.existsSync(settingsPath)) {
     return "eager-all";
   }
   try {
-    const parsed = YAML.parse(fs21.readFileSync(settingsPath, "utf8"));
+    const parsed = YAML.parse(fs22.readFileSync(settingsPath, "utf8"));
     const lean = parsed?.["lean_projection"] ?? null;
     const mode = lean?.["mode"];
     return typeof mode === "string" && mode.length > 0 ? mode : "eager-all";
@@ -7856,7 +7523,7 @@ function readSettingsMode(projectRoot) {
 function kernelIdsFromRouter(packageRoot) {
   try {
     const router = JSON.parse(
-      fs21.readFileSync(path19.join(packageRoot, "dist", "router.json"), "utf8")
+      fs22.readFileSync(path19.join(packageRoot, "dist", "router.json"), "utf8")
     );
     return new Set((router["kernel"] ?? []).map(String));
   } catch {
@@ -7874,7 +7541,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
     };
   }
   const rulesDir = projectedRulesDir ?? path19.join(projectRoot, ".augment", "rules");
-  if (!fs21.existsSync(rulesDir)) {
+  if (!fs22.existsSync(rulesDir)) {
     return {
       id: "lean-projection",
       status: "skipped",
@@ -7883,7 +7550,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
     };
   }
   const kernel = kernelIdsFromRouter(packageRoot);
-  const files = fs21.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
+  const files = fs22.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
   const nonKernel = files.filter((f) => !kernel.has(f.replace(/\.md$/, "")));
   if (nonKernel.length === 0) {
     return {
@@ -7897,7 +7564,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
   for (const f of nonKernel) {
     let text = "";
     try {
-      text = fs21.readFileSync(path19.join(rulesDir, f), "utf8");
+      text = fs22.readFileSync(path19.join(rulesDir, f), "utf8");
     } catch {
       continue;
     }
@@ -7929,7 +7596,7 @@ function _check_host_manifest(projectRoot) {
   const detected = Object.entries(detectToolPresence(projectRoot)).filter(([, v]) => v === true).map(([k]) => k);
   const detectedNote = detected.length > 0 ? `detected surfaces: ${detected.join(", ")}` : "no surfaces detected";
   const settingsPath = path19.join(projectRoot, ".agent-settings.yml");
-  if (!fs21.existsSync(settingsPath)) {
+  if (!fs22.existsSync(settingsPath)) {
     return {
       id: "host-manifest",
       status: "ok",
@@ -7939,7 +7606,7 @@ function _check_host_manifest(projectRoot) {
   }
   let parsed = null;
   try {
-    parsed = YAML.parse(fs21.readFileSync(settingsPath, "utf8"));
+    parsed = YAML.parse(fs22.readFileSync(settingsPath, "utf8"));
   } catch (exc) {
     return {
       id: "host-manifest",
@@ -8038,7 +7705,7 @@ function _parse(argv) {
   }
   return opts;
 }
-function main14(argv = null) {
+function main13(argv = null) {
   const opts = _parse(argv !== null ? Array.from(argv) : process5.argv.slice(2));
   if (opts.funnel) {
     print(render5(buildFunnel()));
@@ -8109,25 +7776,25 @@ function main14(argv = null) {
   }
   return failed ? 1 : 0;
 }
-function _isCliEntry13() {
+function _isCliEntry12() {
   if (process5.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL14(path19.resolve(process5.argv[1])).href;
+  const argvUrl = pathToFileURL13(path19.resolve(process5.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs21.realpathSync(fileURLToPath14(import.meta.url));
-    const argv = fs21.realpathSync(path19.resolve(process5.argv[1]));
+    const here = fs22.realpathSync(fileURLToPath13(import.meta.url));
+    const argv = fs22.realpathSync(path19.resolve(process5.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-if (_isCliEntry13() || process5.argv[1] === _HERE6) {
+if (_isCliEntry12() || process5.argv[1] === _HERE6) {
   try {
-    process5.exitCode = main14(process5.argv.slice(2));
+    process5.exitCode = main13(process5.argv.slice(2));
   } catch (e) {
     if (e instanceof ArgparseExit) {
       process5.exitCode = e.code;
@@ -8151,7 +7818,7 @@ export {
   conformanceLogPath,
   detectSmokePlatform,
   installLogPath,
-  main14 as main,
+  main13 as main,
   routeTargetPaths,
   runConformanceChecks
 };