@event4u/agent-config 9.30.0 → 9.32.0

package/dist/mcp/server.mjs

@@ -109,6 +109,67 @@ var init_user_global_paths = __esm({
   }
 });
 
+// src/shared/settingsCarveOut.ts
+function carveOutKeys() {
+  return SETTINGS_CARVE_OUT.map((c) => c.key);
+}
+var SETTINGS_CARVE_OUT;
+var init_settingsCarveOut = __esm({
+  "src/shared/settingsCarveOut.ts"() {
+    "use strict";
+    SETTINGS_CARVE_OUT = [
+      {
+        key: "projection.mode",
+        reader: "src/scripts/install.ts:3409 _resolve_scoped_projection",
+        absentResolvesTo: "legacy-all",
+        reason: "The template fallback applies only when NO global settings file exists. Once a file exists, an absent key means legacy-all by documented contract, so an existing install is never silently narrowed on upgrade."
+      },
+      {
+        key: "projection.rule_workspaces",
+        reader: "src/install/rule_scope.ts:96 ruleScopeFromSettings",
+        absentResolvesTo: "null \u2014 LEGACY_ALL, i.e. every rule ships including maintainer-only ones",
+        reason: "Same upgrade contract as projection.mode, and the failure is louder: an absent list widens the projection instead of narrowing it."
+      },
+      {
+        key: "discipline_profile",
+        reader: "work_engine/_lib/agent_settings.ts:1263",
+        absentResolvesTo: "essential, unconditionally",
+        reason: "The template ships `auto`, which resolves to `off` on any measured-null model, any non-Claude host, and any host exposing no model id. Absent skips that resolution entirely and loads the essential tier everywhere."
+      },
+      {
+        key: "chat_history.frequency",
+        reader: "src/scripts/chat_history.ts:1140",
+        absentResolvesTo: "per_phase",
+        reason: "Canonical substitution is `per_turn`. Absent gives coarser capture than the shipped default \u2014 an audit-thinning change, which the class contract's own test 8 (what can the attacker HIDE) names as the severe direction."
+      },
+      {
+        key: "profile.id",
+        reader: "src/scripts/config/profiles.ts:221 resolve_profile",
+        absentResolvesTo: "the id `developer`, but a DEGRADED profile \u2014 packs: [], personas: [], hints: []",
+        reason: "Exactly the projection.mode shape: the template default is honoured only when no settings file exists. With a file present the id resolves but its profile body does not load, so the install silently loses every pack and persona."
+      },
+      {
+        key: "quality.local_auto_run",
+        reader: "src/scripts/lint_roadmap_ci_steps.ts:106",
+        absentResolvesTo: "true \u2014 which DISABLES the CI-step gate",
+        reason: "Inverted polarity, and the most dangerous row in the set: the template ships `false`, which ARMS the gate. Omitting the key would disarm a quality gate for every fresh install while the reference page says it is on."
+      },
+      {
+        key: "onboarding.onboarded",
+        reader: "src/scripts/onboarding_gate_hook.ts:99",
+        absentResolvesTo: "gate skipped, as if onboarding had already completed",
+        reason: "Absent behaves like `onboarded: true`, not like the template default `false`. Omitting it would skip the onboarding gate on precisely the fresh installs the gate exists for."
+      },
+      {
+        key: "chat_history.enabled",
+        reader: "src/scripts/chat_history.ts:1025 _read_chat_history_enabled",
+        absentResolvesTo: "false",
+        reason: "The reader falls back to false while the template ships true. This one is privacy-shaped: fixing the reader would start recording history for every install whose file lacks the key. Writing it explicitly keeps the decision visible in the file the user can read."
+      }
+    ];
+  }
+});
+
 // src/scripts/_lib/agent_settings.ts
 var agent_settings_exports = {};
 __export(agent_settings_exports, {
@@ -131,7 +192,9 @@ __export(agent_settings_exports, {
   ROOT_OVERRIDE_ENV: () => ROOT_OVERRIDE_ENV,
   USER_GLOBAL_CANONICAL_RELATIVE: () => USER_GLOBAL_CANONICAL_RELATIVE,
   USER_GLOBAL_FILENAME: () => USER_GLOBAL_FILENAME,
+  _reset_template_defaults_cache: () => _reset_template_defaults_cache,
   canonical_settings_write_path: () => canonical_settings_write_path,
+  default_template_path: () => default_template_path,
   enumerate_modules: () => enumerate_modules,
   find_project_root: () => find_project_root,
   find_project_root_with_anchor: () => find_project_root_with_anchor,
@@ -142,12 +205,14 @@ __export(agent_settings_exports, {
   logger: () => logger,
   project_settings_path: () => project_settings_path,
   resolve_project_root: () => resolve_project_root,
+  template_defaults: () => template_defaults,
   user_global_settings_paths: () => user_global_settings_paths
 });
 import { createRequire } from "node:module";
 import * as fs3 from "node:fs";
 import * as os2 from "node:os";
 import * as path3 from "node:path";
+import { fileURLToPath } from "node:url";
 function _format(template, args) {
   let i = 0;
   return template.replace(/%s/g, () => {
@@ -209,6 +274,45 @@ function user_global_settings_paths() {
   }
   return paths;
 }
+function default_template_path() {
+  return path3.join(_PACKAGE_ROOT, TEMPLATE_RELATIVE);
+}
+function _is_placeholder(value) {
+  return typeof value === "string" && /^__[A-Z0-9_]+__$/.test(value);
+}
+function _prune_template(tree, excluded, prefix = "") {
+  const out = {};
+  for (const [key, value] of Object.entries(tree)) {
+    const dotted = prefix === "" ? key : `${prefix}.${key}`;
+    if (excluded.has(dotted) || _is_placeholder(value)) {
+      continue;
+    }
+    if (_is_plain_dict(value)) {
+      const child = _prune_template(value, excluded, dotted);
+      if (Object.keys(child).length > 0) {
+        out[key] = child;
+      }
+      continue;
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function template_defaults(template_path) {
+  const use_cache = template_path === void 0;
+  if (use_cache && _template_defaults_cache !== null) {
+    return _deepcopy(_template_defaults_cache);
+  }
+  const parsed = _read_yaml(template_path ?? default_template_path()) ?? {};
+  const pruned = _prune_template(parsed, new Set(carveOutKeys()));
+  if (use_cache) {
+    _template_defaults_cache = pruned;
+  }
+  return _deepcopy(pruned);
+}
+function _reset_template_defaults_cache() {
+  _template_defaults_cache = null;
+}
 function _exists(p) {
   try {
     fs3.lstatSync(p);
@@ -452,6 +556,7 @@ function load_agent_settings(options = {}) {
   const user_global_path = options.user_global_path ?? null;
   const verbose = options.verbose ?? false;
   const cwd = options.cwd ?? null;
+  const template_path = options.template_path ?? null;
   const user_global_raw = {};
   for (const p of user_global_path ? [user_global_path] : user_global_settings_paths()) {
     _deep_merge(user_global_raw, _read_yaml(p) ?? {});
@@ -464,7 +569,7 @@ function load_agent_settings(options = {}) {
     );
   }
   const cascade = _resolve_cascade_paths(cwd, project_path);
-  const merged = _deep_copy_defaults(_DEFAULTS);
+  const merged = template_defaults(template_path ?? void 0);
   _deep_merge(merged, user_global_filtered);
   for (const p of cascade) {
     const layer = _read_yaml(p) ?? {};
@@ -743,11 +848,6 @@ function _deep_merge(dst, src) {
     }
   }
 }
-function _deep_copy_defaults(src) {
-  const out = {};
-  _deep_merge(out, src);
-  return out;
-}
 function _deepcopy(value) {
   if (Array.isArray(value)) {
     return value.map((v) => _deepcopy(v));
@@ -777,11 +877,12 @@ function _relative_to(child, root) {
 function _posix_join(a, b) {
   return `${a.split(path3.sep).join("/")}/${b}`;
 }
-var _require, Logger, logger, DEFAULT_PROJECT_FILE, LOCAL_PROJECT_FILE, LOCAL_PROJECT_SUBDIR, DEFAULT_TEAM_FILE, USER_GLOBAL_FILENAME, USER_GLOBAL_CANONICAL_RELATIVE, MERGEABLE_KEYS, _DEFAULTS, MODULES_DEFAULTS, ANCHOR_AGENT_SETTINGS, ANCHOR_AGENTS_DIR, ANCHOR_GIT, _AGENTS_DIR_MARKERS, _LEGACY_ANCHOR_ENV, ORIGIN_ROOT_FLAG, ORIGIN_EXPLICIT, ORIGIN_ENV, ORIGIN_CWD_FALLBACK, PROJECT_ROOT_ENV, ROOT_OVERRIDE_ENV, ProjectRootError, REMOVED_ALWAYS_ON_KEYS, _warnedRemovedAlwaysOnKeys;
+var _require, Logger, logger, DEFAULT_PROJECT_FILE, LOCAL_PROJECT_FILE, LOCAL_PROJECT_SUBDIR, DEFAULT_TEAM_FILE, USER_GLOBAL_FILENAME, USER_GLOBAL_CANONICAL_RELATIVE, MERGEABLE_KEYS, TEMPLATE_RELATIVE, _PACKAGE_ROOT, _template_defaults_cache, MODULES_DEFAULTS, ANCHOR_AGENT_SETTINGS, ANCHOR_AGENTS_DIR, ANCHOR_GIT, _AGENTS_DIR_MARKERS, _LEGACY_ANCHOR_ENV, ORIGIN_ROOT_FLAG, ORIGIN_EXPLICIT, ORIGIN_ENV, ORIGIN_CWD_FALLBACK, PROJECT_ROOT_ENV, ROOT_OVERRIDE_ENV, ProjectRootError, REMOVED_ALWAYS_ON_KEYS, _warnedRemovedAlwaysOnKeys;
 var init_agent_settings = __esm({
   "src/scripts/_lib/agent_settings.ts"() {
     "use strict";
     init_user_global_paths();
+    init_settingsCarveOut();
     _require = createRequire(import.meta.url);
     Logger = class {
       name = "scripts._lib.agent_settings";
@@ -833,7 +934,9 @@ var init_agent_settings = __esm({
       "knowledge.global_sharing.freshness.hypothesis_after_days",
       "knowledge.global_sharing.freshness.stale_after_days"
     ];
-    _DEFAULTS = {};
+    TEMPLATE_RELATIVE = path3.join("src", "config", "agent-settings.template.yml");
+    _PACKAGE_ROOT = path3.resolve(path3.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+    _template_defaults_cache = null;
     MODULES_DEFAULTS = {
       enabled: false,
       root_paths: [],
@@ -897,12 +1000,12 @@ __export(prompts_exports, {
 });
 import * as fs4 from "node:fs";
 import * as path4 from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function _project_root() {
   if (true) {
-    return path4.resolve(fileURLToPath(import.meta.url), "..", "..", "..");
+    return path4.resolve(fileURLToPath2(import.meta.url), "..", "..", "..");
   }
-  return path4.resolve(fileURLToPath(import.meta.url), "..", "..", "..", "..");
+  return path4.resolve(fileURLToPath2(import.meta.url), "..", "..", "..", "..");
 }
 function _strip_frontmatter(text) {
   if (!text.startsWith("---\n")) {
@@ -8981,7 +9084,7 @@ var require_dist = __commonJS({
 // src/scripts/_lib/security_lint.ts
 import * as fs6 from "node:fs";
 import * as path6 from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function is_example_path(rel_path) {
   return _EXAMPLE_PATH.test(rel_path);
 }
@@ -9321,7 +9424,7 @@ var _HERE, ROOT, EXAMPLE_FENCE_LANG, GUIDELINE, GUIDELINE_EPILOG, DEFAULT_SCAN_R
 var init_security_lint = __esm({
   "src/scripts/_lib/security_lint.ts"() {
     "use strict";
-    _HERE = path6.dirname(fileURLToPath2(import.meta.url));
+    _HERE = path6.dirname(fileURLToPath3(import.meta.url));
     ROOT = path6.resolve(_HERE, "..", "..", "..");
     EXAMPLE_FENCE_LANG = "security-example";
     GUIDELINE = "docs/guidelines/agent-infra/security-lint-containment.md";
@@ -9454,7 +9557,7 @@ var init_scan_scope = __esm({
 import * as fs7 from "node:fs";
 import * as path7 from "node:path";
 import { spawnSync } from "node:child_process";
-import { fileURLToPath as fileURLToPath3, pathToFileURL } from "node:url";
+import { fileURLToPath as fileURLToPath4, pathToFileURL } from "node:url";
 function _classify(cp) {
   if (_BIDI.has(cp)) {
     return "bidi-control";
@@ -9701,7 +9804,7 @@ function _isCliEntry() {
     return true;
   }
   try {
-    const here = fs7.realpathSync(fileURLToPath3(import.meta.url));
+    const here = fs7.realpathSync(fileURLToPath4(import.meta.url));
     const argv = fs7.realpathSync(path7.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -10229,7 +10332,7 @@ __export(memory_status_exports, {
 import process2 from "node:process";
 import * as fs8 from "node:fs";
 import * as path8 from "node:path";
-import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL2 } from "node:url";
+import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL2 } from "node:url";
 function status(_refresh = false) {
   return {
     status: "file",
@@ -10358,7 +10461,7 @@ function _isCliEntry2() {
     return true;
   }
   try {
-    const here = fs8.realpathSync(fileURLToPath4(import.meta.url));
+    const here = fs8.realpathSync(fileURLToPath5(import.meta.url));
     const argv = fs8.realpathSync(path8.resolve(process2.argv[1]));
     return here === argv;
   } catch {
@@ -10400,7 +10503,7 @@ var init_memory_status = __esm({
 import * as fs9 from "node:fs";
 import * as path9 from "node:path";
 import process3 from "node:process";
-import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "node:url";
+import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL3 } from "node:url";
 function _setMemoryRoot(p) {
   MEMORY_ROOT = p;
 }
@@ -11032,7 +11135,7 @@ function _isCliEntry3() {
     return true;
   }
   try {
-    const here = fs9.realpathSync(fileURLToPath5(import.meta.url));
+    const here = fs9.realpathSync(fileURLToPath6(import.meta.url));
     const argv = fs9.realpathSync(path9.resolve(process3.argv[1]));
     return here === argv;
   } catch {
@@ -11351,7 +11454,7 @@ import { createHash as createHash2 } from "node:crypto";
 import * as fs11 from "node:fs";
 import * as path11 from "node:path";
 import process4 from "node:process";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 function _parseTsMs(ts) {
   const t = Date.parse(ts);
   return Number.isNaN(t) ? null : t;
@@ -11560,7 +11663,7 @@ var init_learning_sidecar = __esm({
     LESSONS_NAME = "LESSONS.md";
     SCHEMA_VERSION2 = 1;
     _bundled = true;
-    if (!_bundled && fileURLToPath6(import.meta.url) === path11.resolve(process4.argv[1] ?? "")) {
+    if (!_bundled && fileURLToPath7(import.meta.url) === path11.resolve(process4.argv[1] ?? "")) {
       process4.exit(main4(process4.argv.slice(2)));
     }
   }
@@ -11597,7 +11700,7 @@ __export(memory_lookup_exports, {
 import * as fs12 from "node:fs";
 import * as path12 from "node:path";
 import process5 from "node:process";
-import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL4 } from "node:url";
+import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL4 } from "node:url";
 import { createRequire as createRequire3 } from "node:module";
 function _setMemoryRoot2(p) {
   MEMORY_ROOT2 = p;
@@ -12782,7 +12885,7 @@ function _isCliEntry4() {
     return true;
   }
   try {
-    const here = fs12.realpathSync(fileURLToPath7(import.meta.url));
+    const here = fs12.realpathSync(fileURLToPath8(import.meta.url));
     const argv = fs12.realpathSync(path12.resolve(process5.argv[1]));
     return here === argv;
   } catch {
@@ -12895,7 +12998,7 @@ var init_hook_stdin = __esm({
 // src/scripts/_lib/agent_src.ts
 import * as fs17 from "node:fs";
 import * as path16 from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
 function _deriveRoots(root) {
   const packages = path16.join(root, "packages");
   const src = path16.join(root, "src");
@@ -13145,7 +13248,7 @@ var _HERE2, _DEFAULT_ROOT, _roots;
 var init_agent_src = __esm({
   "src/scripts/_lib/agent_src.ts"() {
     "use strict";
-    _HERE2 = path16.dirname(fileURLToPath10(import.meta.url));
+    _HERE2 = path16.dirname(fileURLToPath11(import.meta.url));
     _DEFAULT_ROOT = path16.resolve(_HERE2, "..", "..", "..");
     _roots = _deriveRoots(_DEFAULT_ROOT);
   }
@@ -13258,7 +13361,7 @@ var init_obligation_frequency = __esm({
 import * as fs18 from "node:fs";
 import * as path17 from "node:path";
 import process6 from "node:process";
-import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL6 } from "node:url";
+import { fileURLToPath as fileURLToPath12, pathToFileURL as pathToFileURL6 } from "node:url";
 function parse_frontmatter(text) {
   const match = _FRONTMATTER_RE.exec(text);
   if (!match) {
@@ -14034,7 +14137,7 @@ function _isCliEntry6() {
     return true;
   }
   try {
-    const here = fs18.realpathSync(fileURLToPath11(import.meta.url));
+    const here = fs18.realpathSync(fileURLToPath12(import.meta.url));
     const argv = fs18.realpathSync(path17.resolve(process6.argv[1]));
     return here === argv;
   } catch {
@@ -14074,7 +14177,7 @@ var init_validate_frontmatter = __esm({
     _defaultYaml = (body) => (0, import_yaml3.parse)(body, { version: "1.1" });
     _yaml = _defaultYaml;
     _KEY_RE = /^([\w-]+):\s*([\s\S]*)$/;
-    _HERE3 = path17.dirname(fileURLToPath11(import.meta.url));
+    _HERE3 = path17.dirname(fileURLToPath12(import.meta.url));
     _SCHEMA_DIR = path17.join(_HERE3, "schemas");
     _SCHEMA_CACHE = /* @__PURE__ */ new Map();
     _PROG3 = "validate_frontmatter.py";
@@ -14151,7 +14254,7 @@ var init_counted_probe = __esm({
 // src/scripts/_lib/release_scope.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import path18 from "node:path";
-import { fileURLToPath as fileURLToPath12 } from "node:url";
+import { fileURLToPath as fileURLToPath13 } from "node:url";
 function detectReleaseVersion(patchText) {
   const addedLines = patchText.split("\n").filter((l) => l.startsWith("+") && !l.startsWith("+++")).map((l) => l.slice(1));
   let changelogVersion = null;
@@ -14253,7 +14356,7 @@ var __dirname, REPO_ROOT;
 var init_release_scope = __esm({
   "src/scripts/_lib/release_scope.ts"() {
     "use strict";
-    __dirname = path18.dirname(fileURLToPath12(import.meta.url));
+    __dirname = path18.dirname(fileURLToPath13(import.meta.url));
     REPO_ROOT = path18.resolve(__dirname, "..", "..", "..");
   }
 });
@@ -14308,7 +14411,7 @@ __export(skill_linter_exports, {
 import * as fs19 from "node:fs";
 import * as path19 from "node:path";
 import process7 from "node:process";
-import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL7 } from "node:url";
+import { fileURLToPath as fileURLToPath14, pathToFileURL as pathToFileURL7 } from "node:url";
 function splitlines(text) {
   if (text === "") {
     return [];
@@ -17888,7 +17991,7 @@ function _isCliEntry7() {
     return true;
   }
   try {
-    const here = fs19.realpathSync(fileURLToPath13(import.meta.url));
+    const here = fs19.realpathSync(fileURLToPath14(import.meta.url));
     const argv = fs19.realpathSync(path19.resolve(process7.argv[1]));
     return here === argv;
   } catch {
@@ -17904,7 +18007,7 @@ var init_skill_linter = __esm({
     init_counted_probe();
     init_release_scope();
     init_scan_scope();
-    _HERE4 = path19.dirname(fileURLToPath13(import.meta.url));
+    _HERE4 = path19.dirname(fileURLToPath14(import.meta.url));
     REQUIRED_PERSONA_SECTIONS_CORE = [
       "Focus",
       "Mindset",
@@ -18195,7 +18298,7 @@ import * as crypto3 from "node:crypto";
 import * as fs20 from "node:fs";
 import * as path20 from "node:path";
 import process8 from "node:process";
-import { fileURLToPath as fileURLToPath14, pathToFileURL as pathToFileURL8 } from "node:url";
+import { fileURLToPath as fileURLToPath15, pathToFileURL as pathToFileURL8 } from "node:url";
 function _setIntakeRoot2(p) {
   INTAKE_ROOT3 = p;
 }
@@ -18482,7 +18585,7 @@ function _isCliEntry8() {
     return true;
   }
   try {
-    const here = fs20.realpathSync(fileURLToPath14(import.meta.url));
+    const here = fs20.realpathSync(fileURLToPath15(import.meta.url));
     const argv = fs20.realpathSync(path20.resolve(process8.argv[1]));
     return here === argv;
   } catch {
@@ -18542,7 +18645,7 @@ import { createRequire as createRequire4 } from "node:module";
 import { spawnSync as spawnSync4 } from "node:child_process";
 import * as fs21 from "node:fs";
 import * as path21 from "node:path";
-import { fileURLToPath as fileURLToPath15, pathToFileURL as pathToFileURL9 } from "node:url";
+import { fileURLToPath as fileURLToPath16, pathToFileURL as pathToFileURL9 } from "node:url";
 function _pyRound4(x) {
   const floor = Math.floor(x);
   const diff = x - floor;
@@ -19221,7 +19324,7 @@ function _isCliEntry9() {
     return true;
   }
   try {
-    const here = fs21.realpathSync(fileURLToPath15(import.meta.url));
+    const here = fs21.realpathSync(fileURLToPath16(import.meta.url));
     const argv = fs21.realpathSync(path21.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -19232,7 +19335,7 @@ var _HERE5, _require3, CHECKBOX_RE, PHASE_RE, TITLE_RE, EXCLUDE_NAMES, EXCLUDE_P
 var init_update_roadmap_progress = __esm({
   "src/agent-src/scripts/update_roadmap_progress.ts"() {
     "use strict";
-    _HERE5 = fileURLToPath15(import.meta.url);
+    _HERE5 = fileURLToPath16(import.meta.url);
     _require3 = createRequire4(import.meta.url);
     CHECKBOX_RE = /^[ \t\n\r\f\v]*[-*][ \t\n\r\f\v]+\[([ xX~\-])\][ \t\n\r\f\v]/gm;
     PHASE_RE = /^(#{2,3})[ \t\n\r\f\v]+Phase[ \t\n\r\f\v]+(\d+(?:\.\d+)*[a-z]?|[IVX]+|[A-Z](?:\d+)?)(?:[\s:—\-]+([\s\S]*?))?[ \t\f\v\r]*$/gm;
@@ -19391,7 +19494,7 @@ import { spawnSync as spawnSync5 } from "node:child_process";
 import * as fs22 from "node:fs";
 import * as path22 from "node:path";
 import process9 from "node:process";
-import { fileURLToPath as fileURLToPath16, pathToFileURL as pathToFileURL10 } from "node:url";
+import { fileURLToPath as fileURLToPath17, pathToFileURL as pathToFileURL10 } from "node:url";
 function _run(cmd, cwd) {
   const res = spawnSync5(cmd[0], cmd.slice(1), { cwd, encoding: "utf-8" });
   if (res.error) {
@@ -19671,7 +19774,7 @@ function _isCliEntry10() {
     return true;
   }
   try {
-    const here = fs22.realpathSync(fileURLToPath16(import.meta.url));
+    const here = fs22.realpathSync(fileURLToPath17(import.meta.url));
     const argv = fs22.realpathSync(path22.resolve(process9.argv[1]));
     return here === argv;
   } catch {
@@ -19683,7 +19786,7 @@ var init_archive_completed_roadmaps = __esm({
   "src/agent-src/scripts/archive_completed_roadmaps.ts"() {
     "use strict";
     init_update_roadmap_progress();
-    _HERE6 = fileURLToPath16(import.meta.url);
+    _HERE6 = fileURLToPath17(import.meta.url);
     ArgparseExit2 = class extends Error {
       code;
       constructor(code) {
@@ -19722,7 +19825,7 @@ __export(generate_capabilities_index_exports, {
 import * as fs23 from "node:fs";
 import * as path23 from "node:path";
 import process10 from "node:process";
-import { fileURLToPath as fileURLToPath17, pathToFileURL as pathToFileURL11 } from "node:url";
+import { fileURLToPath as fileURLToPath18, pathToFileURL as pathToFileURL11 } from "node:url";
 function _isFile9(p) {
   try {
     return fs23.statSync(p).isFile();
@@ -20087,7 +20190,7 @@ function _isCliEntry11() {
     return true;
   }
   try {
-    const here = fs23.realpathSync(fileURLToPath17(import.meta.url));
+    const here = fs23.realpathSync(fileURLToPath18(import.meta.url));
     const argv = fs23.realpathSync(path23.resolve(process10.argv[1]));
     return here === argv;
   } catch {
@@ -20101,7 +20204,7 @@ var init_generate_capabilities_index = __esm({
     import_yaml4 = __toESM(require_dist(), 1);
     init_agent_src();
     init_validate_frontmatter();
-    _HERE7 = fileURLToPath17(import.meta.url);
+    _HERE7 = fileURLToPath18(import.meta.url);
     ROOT2 = path23.resolve(path23.dirname(_HERE7), "..", "..");
     OUT = path23.join(ROOT2, "CAPABILITIES.yaml");
     PACKS_YML = path23.join(ROOT2, "src", "config", "discovery", "packs.yml");
@@ -20326,7 +20429,7 @@ var init_claude_settings_hooks = __esm({
 // src/scripts/_lib/cli_wrapper.ts
 import fs26 from "node:fs";
 import path25 from "node:path";
-import { fileURLToPath as fileURLToPath18 } from "node:url";
+import { fileURLToPath as fileURLToPath19 } from "node:url";
 function _is_file2(p) {
   try {
     return fs26.statSync(p).isFile();
@@ -20344,18 +20447,18 @@ function install_cli_wrapper(project_root) {
   fs26.chmodSync(target, 493);
   return target;
 }
-var _PACKAGE_ROOT, _TEMPLATE;
+var _PACKAGE_ROOT2, _TEMPLATE;
 var init_cli_wrapper = __esm({
   "src/scripts/_lib/cli_wrapper.ts"() {
     "use strict";
-    _PACKAGE_ROOT = path25.resolve(
-      path25.dirname(fileURLToPath18(import.meta.url)),
+    _PACKAGE_ROOT2 = path25.resolve(
+      path25.dirname(fileURLToPath19(import.meta.url)),
       "..",
       "..",
       ".."
     );
     _TEMPLATE = path25.join(
-      _PACKAGE_ROOT,
+      _PACKAGE_ROOT2,
       "src",
       "templates",
       "agent-config-wrapper.sh"
@@ -20387,7 +20490,7 @@ __export(sync_gitignore_exports, {
 import * as fs27 from "node:fs";
 import * as path26 from "node:path";
 import process12 from "node:process";
-import { fileURLToPath as fileURLToPath19, pathToFileURL as pathToFileURL12 } from "node:url";
+import { fileURLToPath as fileURLToPath20, pathToFileURL as pathToFileURL12 } from "node:url";
 function _strip4(ln) {
   return ln.replace(/\n+$/, "").replace(/\s+$/, "");
 }
@@ -20814,7 +20917,7 @@ function _isCliEntry12() {
     return true;
   }
   try {
-    const here = fs27.realpathSync(fileURLToPath19(import.meta.url));
+    const here = fs27.realpathSync(fileURLToPath20(import.meta.url));
     const argv = fs27.realpathSync(path26.resolve(process12.argv[1]));
     return here === argv;
   } catch {
@@ -20828,7 +20931,7 @@ var init_sync_gitignore = __esm({
     SECTION_HEADER = "# event4u/agent-config";
     SECTION_FOOTER = "# event4u/agent-config \u2014 END";
     DEFAULT_GITIGNORE = ".gitignore";
-    _HERE8 = fileURLToPath19(import.meta.url);
+    _HERE8 = fileURLToPath20(import.meta.url);
     DEFAULT_TEMPLATE = path26.join(
       path26.dirname(_HERE8),
       "..",
@@ -20887,7 +20990,7 @@ __export(sync_gitattributes_exports, {
 import * as fs28 from "node:fs";
 import * as path27 from "node:path";
 import process13 from "node:process";
-import { fileURLToPath as fileURLToPath20, pathToFileURL as pathToFileURL13 } from "node:url";
+import { fileURLToPath as fileURLToPath21, pathToFileURL as pathToFileURL13 } from "node:url";
 function _strip5(ln) {
   return ln.replace(/\n+$/, "").replace(/\s+$/, "");
 }
@@ -21079,7 +21182,7 @@ function _isCliEntry13() {
     return true;
   }
   try {
-    const here = fs28.realpathSync(fileURLToPath20(import.meta.url));
+    const here = fs28.realpathSync(fileURLToPath21(import.meta.url));
     const argv = fs28.realpathSync(path27.resolve(process13.argv[1]));
     return here === argv;
   } catch {
@@ -21093,7 +21196,7 @@ var init_sync_gitattributes = __esm({
     SECTION_HEADER2 = "# --- BEGIN agent-config managed: memory merge attributes ---";
     SECTION_FOOTER2 = "# --- END agent-config managed: memory merge attributes ---";
     DEFAULT_GITATTRIBUTES = ".gitattributes";
-    _HERE9 = fileURLToPath20(import.meta.url);
+    _HERE9 = fileURLToPath21(import.meta.url);
     DEFAULT_TEMPLATE2 = path27.join(
       path27.dirname(_HERE9),
       "..",
@@ -21118,9 +21221,9 @@ var init_sync_gitattributes = __esm({
 // src/scripts/_lib/package_root.ts
 import * as fs29 from "node:fs";
 import * as path28 from "node:path";
-import { fileURLToPath as fileURLToPath21 } from "node:url";
+import { fileURLToPath as fileURLToPath22 } from "node:url";
 function resolvePackageRoot(fromUrlOrPath, legacyHops = 3) {
-  const start = fromUrlOrPath.startsWith("file:") ? fileURLToPath21(fromUrlOrPath) : fromUrlOrPath;
+  const start = fromUrlOrPath.startsWith("file:") ? fileURLToPath22(fromUrlOrPath) : fromUrlOrPath;
   const startDir = path28.dirname(start);
   let dir = startDir;
   for (let i = 0; i < MAX_ASCENT; i++) {
@@ -21156,7 +21259,7 @@ import * as fs30 from "node:fs";
 import * as path29 from "node:path";
 import { spawnSync as spawnSync6 } from "node:child_process";
 import process14 from "node:process";
-import { fileURLToPath as fileURLToPath22, pathToFileURL as pathToFileURL14 } from "node:url";
+import { fileURLToPath as fileURLToPath23, pathToFileURL as pathToFileURL14 } from "node:url";
 function _print2(out, line = "") {
   out.write(line + "\n");
 }
@@ -21410,7 +21513,7 @@ function _isCliEntry14() {
     return true;
   }
   try {
-    const here = fs30.realpathSync(fileURLToPath22(import.meta.url));
+    const here = fs30.realpathSync(fileURLToPath23(import.meta.url));
     const argv = fs30.realpathSync(path29.resolve(process14.argv[1]));
     return here === argv;
   } catch {
@@ -21426,7 +21529,7 @@ var init_cmd_refresh = __esm({
     init_sync_gitattributes();
     init_package_root();
     PACKAGE_ROOT = resolvePackageRoot(import.meta.url);
-    _HERE10 = fileURLToPath22(import.meta.url);
+    _HERE10 = fileURLToPath23(import.meta.url);
     ArgparseExit3 = class extends Error {
       constructor(code) {
         super(`argparse-exit-${code}`);
@@ -22619,7 +22722,7 @@ var init_session_role = __esm({
 import * as crypto4 from "node:crypto";
 import * as fs37 from "node:fs";
 import * as path35 from "node:path";
-import { fileURLToPath as fileURLToPath23 } from "node:url";
+import { fileURLToPath as fileURLToPath24 } from "node:url";
 function _hash_original_ask(originalAsk) {
   if (!originalAsk) {
     return "0".repeat(12);
@@ -22813,7 +22916,7 @@ var init_events_log = __esm({
       "block_quota"
     ]);
     _KILL_SWITCH_ENV = "AGENT_CONFIG_NO_EVENTS_LOG";
-    _HERE11 = fileURLToPath23(import.meta.url);
+    _HERE11 = fileURLToPath24(import.meta.url);
     _REPO_ROOT = path35.resolve(path35.dirname(_HERE11), "..", "..", "..");
     _DEFAULT_LOG_PATH = path35.join(
       _REPO_ROOT,
@@ -26968,6 +27071,15 @@ function atomic_write_json(target, payload, options = {}) {
   const body = _py_json_dumps(payload, indent) + "\n";
   _atomic_write_text2(targetPath, body);
 }
+function atomic_write_text(target, text) {
+  if (is_replay_mode()) {
+    return;
+  }
+  const targetPath = path40.resolve(target);
+  const state_dir = path40.dirname(targetPath);
+  fs41.mkdirSync(state_dir, { recursive: true });
+  _atomic_write_text2(targetPath, text);
+}
 function _acquire_lock(lock_path) {
   const fd = fs41.openSync(lock_path, "a", 420);
   const held = lock_path + ".held";
@@ -27457,7 +27569,7 @@ import * as fs46 from "node:fs";
 import * as os11 from "node:os";
 import * as path44 from "node:path";
 import process15 from "node:process";
-import { fileURLToPath as fileURLToPath24, pathToFileURL as pathToFileURL15 } from "node:url";
+import { fileURLToPath as fileURLToPath25, pathToFileURL as pathToFileURL15 } from "node:url";
 function expanduser5(p) {
   if (p === "~") return os11.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\")) {
@@ -29937,7 +30049,7 @@ function _isCliEntry15() {
     return true;
   }
   try {
-    const here = fs46.realpathSync(fileURLToPath24(import.meta.url));
+    const here = fs46.realpathSync(fileURLToPath25(import.meta.url));
     const argv = fs46.realpathSync(path44.resolve(process15.argv[1]));
     return here === argv;
   } catch {
@@ -29967,7 +30079,7 @@ var init_cmd_doctor = __esm({
     init_review_gate();
     init_package_root();
     init_rule_scope();
-    _HERE12 = fileURLToPath24(import.meta.url);
+    _HERE12 = fileURLToPath25(import.meta.url);
     ArgparseExit4 = class extends Error {
       constructor(code) {
         super(`argparse-exit-${code}`);
@@ -30206,6 +30318,37 @@ function comparePair(a, b) {
   }
   return "body-diff";
 }
+function splitFrontmatter(text) {
+  if (!text.startsWith("---")) return { hadFrontmatter: false, frontmatter: "", body: text };
+  const end = text.indexOf("\n---", 3);
+  if (end === -1) return { hadFrontmatter: false, frontmatter: "", body: text };
+  const afterFence = text.indexOf("\n", end + 1);
+  return {
+    hadFrontmatter: true,
+    frontmatter: text.slice(3, end),
+    body: afterFence === -1 ? "" : text.slice(afterFence + 1)
+  };
+}
+function proseEqual(a, b) {
+  const sa = splitFrontmatter(a);
+  const sb = splitFrontmatter(b);
+  if (!sa.hadFrontmatter && !sb.hadFrontmatter) return false;
+  const leading = /^\n+/;
+  return sa.body.replace(leading, "") === sb.body.replace(leading, "");
+}
+function frontmatterPaths(text) {
+  const { hadFrontmatter, frontmatter } = splitFrontmatter(text);
+  if (!hadFrontmatter) return null;
+  const lines = frontmatter.split("\n");
+  const start = lines.findIndex((l) => /^paths:/.test(l));
+  if (start === -1) return null;
+  const block = [lines[start]];
+  for (const line of lines.slice(start + 1)) {
+    if (/^\s/.test(line) && line.trim() !== "") block.push(line);
+    else break;
+  }
+  return block.map((l) => l.trim()).join(" ");
+}
 function censusRuleDir(dir) {
   let files = 0;
   let chars = 0;
@@ -30301,7 +30444,11 @@ var init_prompt_shape = __esm({
 // src/scripts/language_mirror_hook.ts
 import fs48 from "node:fs";
 import path46 from "node:path";
-import { fileURLToPath as fileURLToPath25, pathToFileURL as pathToFileURL16 } from "node:url";
+import { fileURLToPath as fileURLToPath26, pathToFileURL as pathToFileURL16 } from "node:url";
+function pinLostMarker(session_id) {
+  const safe = (session_id || "unknown-session").replace(/[^A-Za-z0-9._-]/g, "_");
+  return path46.join(PIN_LOST_DIR, `${safe}.marker`);
+}
 function _isObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -30432,35 +30579,49 @@ function _extractPrompt(payload) {
   }
   return "";
 }
-function _setPinLost(consumer_root) {
+function _sessionId(envelope) {
+  const v = envelope["session_id"];
+  return typeof v === "string" && v.trim() !== "" ? v : "unknown-session";
+}
+function _migrateLegacyMarker(consumer_root) {
+  const legacy = path46.join(consumer_root, PIN_LOST_DIR);
+  try {
+    if (fs48.statSync(legacy).isFile()) {
+      fs48.rmSync(legacy, { force: true });
+    }
+  } catch {
+  }
+}
+function _setPinLost(consumer_root, session_id) {
+  if (is_replay_mode()) return;
+  _migrateLegacyMarker(consumer_root);
   try {
-    const target = path46.join(consumer_root, PIN_LOST_MARKER);
-    fs48.mkdirSync(path46.dirname(target), { recursive: true });
-    fs48.writeFileSync(target, (/* @__PURE__ */ new Date()).toISOString());
+    atomic_write_text(path46.join(consumer_root, pinLostMarker(session_id)), (/* @__PURE__ */ new Date()).toISOString());
   } catch {
   }
 }
-function _pinLost(consumer_root) {
+function _pinLost(consumer_root, session_id) {
   try {
-    return fs48.existsSync(path46.join(consumer_root, PIN_LOST_MARKER));
+    return fs48.existsSync(path46.join(consumer_root, pinLostMarker(session_id)));
   } catch {
     return false;
   }
 }
-function _clearPinLost(consumer_root) {
+function _clearPinLost(consumer_root, session_id) {
+  if (is_replay_mode()) return;
   try {
-    fs48.rmSync(path46.join(consumer_root, PIN_LOST_MARKER), { force: true });
+    fs48.rmSync(path46.join(consumer_root, pinLostMarker(session_id)), { force: true });
   } catch {
   }
 }
-function _reEmitAfterCompaction(consumer_root) {
-  if (!_pinLost(consumer_root)) {
+function _reEmitAfterCompaction(consumer_root, session_id) {
+  if (!_pinLost(consumer_root, session_id)) {
     return EXIT_ALLOW;
   }
   const previous = _loadState(path46.join(consumer_root, STATE_FILE));
   const language = previous.language;
   const source = previous.source === "system-locale" ? "system-locale" : "prompt";
-  _clearPinLost(consumer_root);
+  _clearPinLost(consumer_root, session_id);
   if (language !== "de" && language !== "en") {
     return EXIT_ALLOW;
   }
@@ -30489,11 +30650,11 @@ function run(stdin_text, options) {
   const payload = _isObject2(envelope["payload"]) ? envelope["payload"] : envelope;
   const event = typeof envelope["event"] === "string" ? envelope["event"] : "";
   if (event === "pre_compact") {
-    _setPinLost(options.consumer_root);
+    _setPinLost(options.consumer_root, _sessionId(envelope));
     return EXIT_ALLOW;
   }
   if (event === "post_tool_use") {
-    return _reEmitAfterCompaction(options.consumer_root);
+    return _reEmitAfterCompaction(options.consumer_root, _sessionId(envelope));
   }
   const prompt = _extractPrompt(payload);
   if (!prompt) {
@@ -30560,14 +30721,14 @@ function _isCliEntry16() {
     return true;
   }
   try {
-    const here = fs48.realpathSync(fileURLToPath25(import.meta.url));
+    const here = fs48.realpathSync(fileURLToPath26(import.meta.url));
     const argv = fs48.realpathSync(path46.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
-var EXIT_ALLOW, EXIT_WARN, STATE_FILE, PIN_LOST_MARKER, DE_MARKERS, EN_MARKERS, MIN_MARKERS, LANGUAGE_NAME, LOCALE_ENV_KEYS;
+var EXIT_ALLOW, EXIT_WARN, STATE_FILE, PIN_LOST_DIR, DE_MARKERS, EN_MARKERS, MIN_MARKERS, LANGUAGE_NAME, LOCALE_ENV_KEYS;
 var init_language_mirror_hook = __esm({
   "src/scripts/language_mirror_hook.ts"() {
     "use strict";
@@ -30577,7 +30738,7 @@ var init_language_mirror_hook = __esm({
     EXIT_ALLOW = 0;
     EXIT_WARN = 2;
     STATE_FILE = path46.join("agents", "state", "language-mirror.json");
-    PIN_LOST_MARKER = path46.join("agents", "state", "language-mirror.pin-lost");
+    PIN_LOST_DIR = path46.join("agents", "state", "language-mirror.pin-lost");
     DE_MARKERS = /\b(der|die|das|den|dem|und|ist|sind|nicht|kein|keine|mach|mache|bitte|warum|wieso|weshalb|weiter|kannst|sollst|soll|musst|muss|hast|habe|haben|wir|ich|du|dann|noch|auch|schon|wenn|aber|alle|mit|ohne|damit|dass|wurde|werden|gibt|nochmal|erstell|erstelle|erstelle|fehler|regeln|arbeite|analysiere|fixe|nimm|lege|prüfe|pruefe|schau|zeig|mir|dir|sich|eine|einen|einem|einer|vom|zum|zur|beim|im)\b|[äöüÄÖÜß]/gi;
     EN_MARKERS = /\b(the|and|is|are|was|were|not|please|why|because|should|would|could|there|these|those|with|from|about|which|that|this|will|have|has|been|they|them|their|your|our|what|when|where|make|need|want|does|doesn't|don't|it's|let's)\b/gi;
     MIN_MARKERS = 2;
@@ -30595,7 +30756,7 @@ var init_language_mirror_hook = __esm({
 // src/scripts/git_authorization_hook.ts
 import fs49 from "node:fs";
 import path47 from "node:path";
-import { fileURLToPath as fileURLToPath26, pathToFileURL as pathToFileURL17 } from "node:url";
+import { fileURLToPath as fileURLToPath27, pathToFileURL as pathToFileURL17 } from "node:url";
 function _isObject3(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -30716,7 +30877,7 @@ function _isCliEntry17() {
     return true;
   }
   try {
-    const here = fs49.realpathSync(fileURLToPath26(import.meta.url));
+    const here = fs49.realpathSync(fileURLToPath27(import.meta.url));
     const argv = fs49.realpathSync(path47.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -30772,7 +30933,7 @@ var init_git_authorization_hook = __esm({
 // src/scripts/hooks/block_unauthorized_git.ts
 import fs50 from "node:fs";
 import path48 from "node:path";
-import { fileURLToPath as fileURLToPath27, pathToFileURL as pathToFileURL18 } from "node:url";
+import { fileURLToPath as fileURLToPath28, pathToFileURL as pathToFileURL18 } from "node:url";
 function _isObject4(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -31051,7 +31212,7 @@ function _isCliEntry18() {
     return true;
   }
   try {
-    const here = fs50.realpathSync(fileURLToPath27(import.meta.url));
+    const here = fs50.realpathSync(fileURLToPath28(import.meta.url));
     const argv = fs50.realpathSync(path48.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -31116,7 +31277,7 @@ var init_block_unauthorized_git = __esm({
 // src/scripts/before_complete_hook.ts
 import fs51 from "node:fs";
 import path49 from "node:path";
-import { fileURLToPath as fileURLToPath28, pathToFileURL as pathToFileURL19 } from "node:url";
+import { fileURLToPath as fileURLToPath29, pathToFileURL as pathToFileURL19 } from "node:url";
 function _now2() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "+00:00");
 }
@@ -31370,7 +31531,7 @@ function _isCliEntry19() {
     return true;
   }
   try {
-    const here = fs51.realpathSync(fileURLToPath28(import.meta.url));
+    const here = fs51.realpathSync(fileURLToPath29(import.meta.url));
     const argv = fs51.realpathSync(path49.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -31430,7 +31591,7 @@ var init_before_complete_hook = __esm({
 import crypto7 from "node:crypto";
 import fs52 from "node:fs";
 import path50 from "node:path";
-import { fileURLToPath as fileURLToPath29, pathToFileURL as pathToFileURL20 } from "node:url";
+import { fileURLToPath as fileURLToPath30, pathToFileURL as pathToFileURL20 } from "node:url";
 function _isObject5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -31589,7 +31750,7 @@ function _isCliEntry20() {
     return true;
   }
   try {
-    const here = fs52.realpathSync(fileURLToPath29(import.meta.url));
+    const here = fs52.realpathSync(fileURLToPath30(import.meta.url));
     const argv = fs52.realpathSync(path50.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -31648,7 +31809,7 @@ import { createHash as createHash8 } from "node:crypto";
 import fs53 from "node:fs";
 import os12 from "node:os";
 import path51 from "node:path";
-import { fileURLToPath as fileURLToPath30, pathToFileURL as pathToFileURL21 } from "node:url";
+import { fileURLToPath as fileURLToPath31, pathToFileURL as pathToFileURL21 } from "node:url";
 function bandVerdict(rate_pct, assistant_turns) {
   if (assistant_turns < BAND_MIN_TURNS) {
     return "corpus-too-small";
@@ -32024,7 +32185,7 @@ function _isCliEntry21() {
     return true;
   }
   try {
-    const here = fs53.realpathSync(fileURLToPath30(import.meta.url));
+    const here = fs53.realpathSync(fileURLToPath31(import.meta.url));
     const argv = fs53.realpathSync(path51.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -32043,7 +32204,7 @@ var init_conformance_scan = __esm({
     init_block_unauthorized_git();
     init_before_complete_hook();
     init_evidence_independence();
-    REPO_ROOT2 = path51.resolve(path51.dirname(fileURLToPath30(import.meta.url)), "..", "..");
+    REPO_ROOT2 = path51.resolve(path51.dirname(fileURLToPath31(import.meta.url)), "..", "..");
     OBSERVED_BAND = { low: 9.1, high: 39.2 };
     BAND_MIN_TURNS = 1978;
     HARNESS_TEXT = /^(API Error:|Request (timed out|was aborted)|\[Request interrupted|Error: |Credit balance is too low|You've hit your|Prompt is too long)/i;
@@ -32066,7 +32227,7 @@ import * as fs54 from "node:fs";
 import * as os13 from "node:os";
 import * as path52 from "node:path";
 import process16 from "node:process";
-import { fileURLToPath as fileURLToPath31, pathToFileURL as pathToFileURL22 } from "node:url";
+import { fileURLToPath as fileURLToPath32, pathToFileURL as pathToFileURL22 } from "node:url";
 function _listRules(dir) {
   try {
     return fs54.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
@@ -32081,10 +32242,7 @@ function _ruleType(file) {
   } catch {
     return "";
   }
-  if (!text.startsWith("---")) return "";
-  const end = text.indexOf("\n---", 3);
-  const fm = end === -1 ? text : text.slice(0, end);
-  const m = /^type:\s*"?([a-z]+)"?/m.exec(fm);
+  const m = /^type:\s*"?([a-z]+)"?/m.exec(splitFrontmatter(text).frontmatter);
   return m === null ? "" : m[1];
 }
 function compareCarriers(projectDir, globalDir, sourceDir) {
@@ -32096,6 +32254,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     shared: 0,
     identical: [],
     provenanceOnly: [],
+    frontmatterOnly: [],
+    pathsScopeDiff: [],
     bodyDiff: [],
     projectOnly: [],
     globalOnly: [],
@@ -32120,11 +32280,12 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     out.shared += 1;
     let verdict;
+    let projectCopy;
+    let globalCopy;
     try {
-      verdict = comparePair(
-        fs54.readFileSync(path52.join(projectDir, rule)),
-        fs54.readFileSync(path52.join(globalDir, rule))
-      );
+      projectCopy = fs54.readFileSync(path52.join(projectDir, rule));
+      globalCopy = fs54.readFileSync(path52.join(globalDir, rule));
+      verdict = comparePair(projectCopy, globalCopy);
     } catch {
       out.shared -= 1;
       out.unreadable.push(rule);
@@ -32132,7 +32293,16 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     if (verdict === "identical") out.identical.push(rule);
     else if (verdict === "provenance-only") out.provenanceOnly.push(rule);
-    else out.bodyDiff.push(rule);
+    else {
+      const projectText = projectCopy.toString("utf-8");
+      const globalText = globalCopy.toString("utf-8");
+      if (proseEqual(projectText, globalText)) {
+        out.frontmatterOnly.push(rule);
+        if (frontmatterPaths(projectText) !== frontmatterPaths(globalText)) {
+          out.pathsScopeDiff.push(rule);
+        }
+      } else out.bodyDiff.push(rule);
+    }
   }
   return out;
 }
@@ -32160,7 +32330,9 @@ function render3(d) {
   lines.push(`  shared rule names                    ${d.shared}`);
   lines.push(`    byte-identical                     ${d.identical.length}`);
   lines.push(`    differ ONLY in the install stamp   ${d.provenanceOnly.length}`);
-  lines.push(`    differ in BODY                     ${d.bodyDiff.length}`);
+  lines.push(`    differ ONLY in frontmatter         ${d.frontmatterOnly.length}`);
+  lines.push(`      of which disagree on \`paths:\`    ${d.pathsScopeDiff.length}  \u2190 ACTIONABLE`);
+  lines.push(`    differ in PROSE                    ${d.bodyDiff.length}`);
   if (d.unreadable.length > 0) {
     lines.push(`    unreadable on one side             ${d.unreadable.length}  (${d.unreadable.join(", ")})`);
     lines.push("      Not counted as shared and NOT a body difference \u2014 a dangling entry is");
@@ -32170,15 +32342,43 @@ function render3(d) {
   lines.push(`  present at global scope only         ${d.globalOnly.length}`);
   lines.push("");
   if (d.bodyDiff.length > 0) {
-    lines.push("  BODY DIVERGENCE \u2014 the two carriers deliver different text for these rules.");
-    lines.push("  Both copies reach the model, with no precedence marker between them, so a");
-    lines.push("  claim one copy retracts can be re-asserted by the other. PRECEDENCE: the");
-    lines.push("  project projection is generated from src/ at this commit and wins; the");
-    lines.push("  global install is a release snapshot. Close it by reinstalling the global");
-    lines.push("  copy, or by reading the project copy as authoritative.");
+    lines.push("  PROSE DIVERGENCE \u2014 the two carriers deliver different governed text for");
+    lines.push("  these rules. Both copies reach the model, and the host resolves NOTHING:");
+    lines.push("  rules without a `paths` key load at launch with the same priority as");
+    lines.push("  CLAUDE.md, with no precedence marker between the layers, so a claim one");
+    lines.push("  copy retracts can be re-asserted by the other and which text binds is");
+    lines.push("  UNDEFINED. Cited, not inferred \u2014 agents/evidence/analysis/");
+    lines.push("  claude-code-rules-dir-contract.md (host 2.1.226, the host's own docs plus");
+    lines.push("  a first-party observation). The project copy is the NEWER text, which is a");
+    lines.push("  fact about recency and NOT a host precedence rule: close the divergence by");
+    lines.push("  reinstalling the global copy, or decide which text binds \u2014 do not assume");
+    lines.push("  the newer one already won.");
     for (const r of d.bodyDiff) lines.push(`    - ${r}`);
     lines.push("");
   }
+  if (d.pathsScopeDiff.length > 0) {
+    lines.push(`  \`paths:\` SCOPE DISAGREEMENT (${String(d.pathsScopeDiff.length)}) \u2014 same prose, different load schedule.`);
+    lines.push("  ACT ON THESE. `paths` is the one frontmatter key this host reads: with it, a");
+    lines.push("  rule fires when a matching file is read and is NOT re-injected after");
+    lines.push("  /compact; without it, the rule loads unconditionally at launch. So the copy");
+    lines.push("  that lacks `paths` DEFEATS the other copy's scoping \u2014 the rule the project");
+    lines.push("  layer meant to deliver conditionally is delivered always, and an obligation");
+    lines.push("  a maintainer deliberately scoped is silently unscoped on any machine that");
+    lines.push("  carries both. Identical prose does not make this inert.");
+    for (const r of d.pathsScopeDiff) lines.push(`    - ${r}`);
+    lines.push("");
+  }
+  const inert = d.frontmatterOnly.length - d.pathsScopeDiff.length;
+  if (inert > 0) {
+    lines.push(`  ${String(inert)} further pair(s) differ ONLY in frontmatter the host does not read \u2014`);
+    lines.push("  prose byte-identical, `paths` in agreement, nothing to act on. Two writers,");
+    lines.push("  two policies: `generate-tools` emits `paths` where a rule is path-scoped and");
+    lines.push("  nothing otherwise; `install.ts` writes agent-config's own vocabulary plus its");
+    lines.push("  ownership stamp, and none of those keys is one this host reads");
+    lines.push("  (claude-code-rules-dir-contract.md). Reported as a count on purpose: naming");
+    lines.push("  every pair would bury the two classes above, which are the actionable ones.");
+    lines.push("");
+  }
   if (d.provenanceOnly.length > 0) {
     lines.push(`  ${String(d.provenanceOnly.length)} pair(s) differ only by the installer's package:/source_path: stamp.`);
     lines.push("  Not a content difference and NOT a defect: install.ts stamps every installed");
@@ -32214,9 +32414,18 @@ function render3(d) {
   }
   if (d.bodyDiff.length === 0) {
     lines.push("");
-    lines.push("  No body divergence. The condition is transient \u2014 it returns whenever the");
-    lines.push("  checkout moves ahead of the installed release \u2014 so this is a reading of");
-    lines.push("  right now, not a property of the repo. Re-run it, do not cite it.");
+    lines.push("  No prose divergence \u2014 no rule's governed text differs between the carriers.");
+    if (d.pathsScopeDiff.length > 0) {
+      lines.push("  NOT an all-clear: the `paths:` disagreements above are still open, and they");
+      lines.push("  change when a rule loads rather than what it says.");
+    }
+    lines.push("  The condition is transient \u2014 it returns whenever the checkout moves ahead of");
+    lines.push("  the installed release \u2014 so this is a reading of right now, not a property of");
+    lines.push("  the repo. Re-run it, do not cite it. That holds doubly here: the reading also");
+    lines.push("  depends on WHICH GENERATION of the emitter produced the project tree (a");
+    lines.push("  frontmatter-carrying symlink tree and a frontmatter-less real-file tree");
+    lines.push("  classify the same commit differently), so a number from another checkout is");
+    lines.push("  not comparable to this one.");
   }
   return lines.join("\n");
 }
@@ -32272,7 +32481,7 @@ var init_report_carrier_divergence = __esm({
   "src/scripts/report_carrier_divergence.ts"() {
     "use strict";
     init_carrier_divergence();
-    _HERE13 = fileURLToPath31(import.meta.url);
+    _HERE13 = fileURLToPath32(import.meta.url);
     REPO_ROOT3 = path52.resolve(path52.dirname(_HERE13), "..", "..");
     PROJECT_RULES = path52.join(".claude", "rules");
     PROJECTION_SOURCE = path52.join("dist", "agent-src", "rules");
@@ -32287,7 +32496,7 @@ var init_report_carrier_divergence = __esm({
 import * as fs55 from "node:fs";
 import * as os14 from "node:os";
 import * as path53 from "node:path";
-import { fileURLToPath as fileURLToPath32, pathToFileURL as pathToFileURL23 } from "node:url";
+import { fileURLToPath as fileURLToPath33, pathToFileURL as pathToFileURL23 } from "node:url";
 function censusSkills(root) {
   const out = { total: 0, withTriggerKey: [], withDeterministicObligation: [] };
   if (!fs55.existsSync(root)) {
@@ -32447,7 +32656,7 @@ var _HERE14, REPO_ROOT4, SKILLS_ROOT, TRIGGER_KEYS, DETERMINISTIC_RE;
 var init_report_skill_activation = __esm({
   "src/scripts/report_skill_activation.ts"() {
     "use strict";
-    _HERE14 = fileURLToPath32(import.meta.url);
+    _HERE14 = fileURLToPath33(import.meta.url);
     REPO_ROOT4 = path53.resolve(path53.dirname(_HERE14), "..", "..");
     SKILLS_ROOT = "src/skills";
     TRIGGER_KEYS = ["triggers:", "trigger_description:", "file_pattern:", "path_prefix:"];
@@ -32463,7 +32672,7 @@ import * as fs56 from "node:fs";
 import * as os15 from "node:os";
 import * as path54 from "node:path";
 import process17 from "node:process";
-import { fileURLToPath as fileURLToPath33, pathToFileURL as pathToFileURL24 } from "node:url";
+import { fileURLToPath as fileURLToPath34, pathToFileURL as pathToFileURL24 } from "node:url";
 function _verb(line) {
   const m = /\b(NEVER|MUST|ALWAYS)\b/.exec(line);
   return m?.[1] ?? "NEVER";
@@ -32756,7 +32965,7 @@ var init_report_skill_obligation_violations = __esm({
     "use strict";
     init_transcript_entry();
     init_report_skill_activation();
-    _HERE15 = fileURLToPath33(import.meta.url);
+    _HERE15 = fileURLToPath34(import.meta.url);
     REPO_ROOT5 = path54.resolve(path54.dirname(_HERE15), "..", "..");
     OBLIGATION_LINE_RE = new RegExp(`${DETERMINISTIC_RE.source}.*`, "gm");
     PATH_RE = /`([A-Za-z0-9_./-]*\/[A-Za-z0-9_.-]+\.[a-z]{2,6})`/g;
@@ -32802,7 +33011,7 @@ import * as fs57 from "node:fs";
 import * as os16 from "node:os";
 import * as path55 from "node:path";
 import process18 from "node:process";
-import { fileURLToPath as fileURLToPath34, pathToFileURL as pathToFileURL25 } from "node:url";
+import { fileURLToPath as fileURLToPath35, pathToFileURL as pathToFileURL25 } from "node:url";
 function buildFunnel(opts = {}) {
   const repoRoot = opts.repoRoot ?? REPO_ROOT6;
   const projectRulesDir = opts.projectRulesDir ?? path55.join(repoRoot, PROJECT_RULES);
@@ -32846,12 +33055,25 @@ function render6(r) {
     lines.push("    substituted with dist/, which would answer a different question.");
   } else {
     lines.push(
-      `    Divergence: ${d.shared} shared \xB7 ${d.bodyDiff.length} body-diff \xB7 ${d.provenanceOnly.length} provenance-only \xB7 ${d.projectOnly.length} project-only \xB7 ${d.globalOnly.length} global-only` + (d.manualOnlyGlobal.length > 0 ? ` (${d.manualOnlyGlobal.length} by design, ADR-004 manual)` : "")
+      `    Divergence: ${d.shared} shared \xB7 ${d.bodyDiff.length} prose-diff \xB7 ${d.frontmatterOnly.length} frontmatter-only (${d.pathsScopeDiff.length} on \`paths:\`) \xB7 ${d.provenanceOnly.length} provenance-only \xB7 ${d.projectOnly.length} project-only \xB7 ${d.globalOnly.length} global-only` + (d.manualOnlyGlobal.length > 0 ? ` (${d.manualOnlyGlobal.length} by design, ADR-004 manual)` : "")
     );
     if (d.bodyDiff.length > 0) {
-      lines.push(`    BODY DIVERGENCE \u2014 both copies reach the model: ${d.bodyDiff.join(", ")}`);
-      lines.push("    Precedence: the project projection is generated from src/ at this commit");
-      lines.push("    and wins; the global install is a release snapshot.");
+      lines.push(`    PROSE DIVERGENCE \u2014 both copies reach the model: ${d.bodyDiff.join(", ")}`);
+      lines.push("    The host resolves nothing: both layers load at launch at the same");
+      lines.push("    priority with no precedence marker, so which text binds is UNDEFINED");
+      lines.push("    (claude-code-rules-dir-contract.md). The project copy is merely the");
+      lines.push("    newer one \u2014 recency, not precedence.");
+    }
+    if (d.pathsScopeDiff.length > 0) {
+      lines.push(`    \`paths:\` SCOPE DISAGREEMENT (${String(d.pathsScopeDiff.length)}) \u2014 same prose, different load`);
+      lines.push("    schedule. `paths` is the one frontmatter key the host reads, so the copy");
+      lines.push("    without it defeats the other copy's scoping: a deliberately scoped");
+      lines.push("    obligation is delivered unconditionally. Act on these.");
+    }
+    const inertFm = d.frontmatterOnly.length - d.pathsScopeDiff.length;
+    if (inertFm > 0) {
+      lines.push(`    ${String(inertFm)} further pair(s) differ only in frontmatter the host does not read \u2014`);
+      lines.push("    prose byte-identical, `paths` in agreement, nothing to act on.");
     }
     if (d.unreadable.length > 0) {
       lines.push(`    Unreadable on one side (${d.unreadable.length}) \u2014 a broken install, not a disagreement.`);
@@ -32971,7 +33193,7 @@ var init_report_conformance_funnel = __esm({
     init_report_carrier_divergence();
     init_report_skill_activation();
     init_report_skill_obligation_violations();
-    _HERE16 = fileURLToPath34(import.meta.url);
+    _HERE16 = fileURLToPath35(import.meta.url);
     REPO_ROOT6 = path55.resolve(path55.dirname(_HERE16), "..", "..");
     if (_isCliEntry24()) {
       process18.exit(main25());
@@ -33004,7 +33226,7 @@ import * as os17 from "node:os";
 import * as path56 from "node:path";
 import process19 from "node:process";
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { fileURLToPath as fileURLToPath35, pathToFileURL as pathToFileURL26 } from "node:url";
+import { fileURLToPath as fileURLToPath36, pathToFileURL as pathToFileURL26 } from "node:url";
 function print2(s = "") {
   process19.stdout.write(`${s}
 `);
@@ -33470,7 +33692,7 @@ function _isCliEntry25() {
     return true;
   }
   try {
-    const here = fs58.realpathSync(fileURLToPath35(import.meta.url));
+    const here = fs58.realpathSync(fileURLToPath36(import.meta.url));
     const argv = fs58.realpathSync(path56.resolve(process19.argv[1]));
     return here === argv;
   } catch {
@@ -33490,7 +33712,7 @@ var init_cmd_conformance = __esm({
     init_router_target_paths();
     init_report_conformance_funnel();
     init_cmd_doctor();
-    _HERE17 = fileURLToPath35(import.meta.url);
+    _HERE17 = fileURLToPath36(import.meta.url);
     PACKAGE_ROOT2 = resolvePackageRoot(import.meta.url);
     CONFORMANCE_CHECK_IDS = [
       "txlog-clean",
@@ -37660,7 +37882,7 @@ __export(pricing_exports, {
 });
 import * as fs65 from "node:fs";
 import * as path59 from "node:path";
-import { fileURLToPath as fileURLToPath36 } from "node:url";
+import { fileURLToPath as fileURLToPath37 } from "node:url";
 function prices_file_for(repo_root) {
   return path59.join(repo_root, "agents", "runtime", ".agent-prices.md");
 }
@@ -37887,7 +38109,7 @@ var init_pricing = __esm({
   "src/scripts/ai_council/pricing.ts"() {
     "use strict";
     init_default_prices();
-    _HERE18 = fileURLToPath36(import.meta.url);
+    _HERE18 = fileURLToPath37(import.meta.url);
     REPO_ROOT7 = path59.resolve(path59.dirname(_HERE18), "..", "..", "..");
     PRICES_FILE = path59.join(REPO_ROOT7, "agents", "runtime", ".agent-prices.md");
     _CHARS_PER_TOKEN = 4;
@@ -40960,7 +41182,7 @@ __export(council_cli_exports, {
 });
 import * as fs68 from "node:fs";
 import * as path61 from "node:path";
-import { fileURLToPath as fileURLToPath37, pathToFileURL as pathToFileURL27 } from "node:url";
+import { fileURLToPath as fileURLToPath38, pathToFileURL as pathToFileURL27 } from "node:url";
 function _pyFixed6(x, ndigits) {
   if (!Number.isFinite(x)) {
     return String(x);
@@ -43708,7 +43930,7 @@ function _isCliEntry26() {
     return true;
   }
   try {
-    const here = fs68.realpathSync(fileURLToPath37(import.meta.url));
+    const here = fs68.realpathSync(fileURLToPath38(import.meta.url));
     const argv = fs68.realpathSync(path61.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -43767,7 +43989,7 @@ var init_council_cli = __esm({
       "xai",
       "perplexity"
     ]);
-    _HERE19 = path61.dirname(fileURLToPath37(import.meta.url));
+    _HERE19 = path61.dirname(fileURLToPath38(import.meta.url));
     [REPO_ROOT8] = resolve_project_root(null);
     SETTINGS_FILE2 = project_settings_path(REPO_ROOT8);
     AI_COUNCIL_FILE = resolve_config_path(REPO_ROOT8);
@@ -43876,7 +44098,7 @@ var init_safety_envelope = __esm({
 
 // src/scripts/mcp_server/__main__.ts
 import * as path63 from "node:path";
-import { fileURLToPath as fileURLToPath39 } from "node:url";
+import { fileURLToPath as fileURLToPath40 } from "node:url";
 
 // src/scripts/mcp_server/index.ts
 var __version__ = "0.1.0";
@@ -43925,7 +44147,7 @@ init_resources();
 // src/scripts/mcp_server/tools.ts
 import * as fs69 from "node:fs";
 import * as path62 from "node:path";
-import { fileURLToPath as fileURLToPath38 } from "node:url";
+import { fileURLToPath as fileURLToPath39 } from "node:url";
 
 // src/scripts/chat_history.ts
 init_memory_lookup();
@@ -43934,7 +44156,7 @@ init_hook_stdin();
 import { createHash as createHash3 } from "node:crypto";
 import * as fs14 from "node:fs";
 import * as path13 from "node:path";
-import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL5 } from "node:url";
+import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL5 } from "node:url";
 var DEFAULT_FILE = "agents/runtime/.agent-chat-history";
 var DEFAULT_SETTINGS_FILE = ".agent-settings.yml";
 var SCHEMA_VERSION3 = 4;
@@ -45951,7 +46173,7 @@ function _isCliEntry5() {
     return true;
   }
   try {
-    const here = fs14.realpathSync(fileURLToPath8(import.meta.url));
+    const here = fs14.realpathSync(fileURLToPath9(import.meta.url));
     const argv = fs14.realpathSync(path13.resolve(process.argv[1]));
     return here === argv;
   } catch {
@@ -45976,16 +46198,16 @@ if (_invokedDirectly) {
 // src/scripts/mcp_server/catalog.ts
 import * as fs15 from "node:fs";
 import * as path14 from "node:path";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
 var _CATALOG_FILE = path14.join(
   true ? path14.resolve(
-    path14.dirname(fileURLToPath9(import.meta.url)),
+    path14.dirname(fileURLToPath10(import.meta.url)),
     "..",
     "..",
     "src",
     "scripts",
     "mcp_server"
-  ) : path14.dirname(fileURLToPath9(import.meta.url)),
+  ) : path14.dirname(fileURLToPath10(import.meta.url)),
   "consumer_tool_catalog.json"
 );
 var NOT_IMPLEMENTED_CODE = "not_implemented";
@@ -46431,8 +46653,8 @@ async function _memoryStatusHandler(_args, consumerRoot) {
   }
   return result;
 }
-var _PACKAGE_ROOT2 = path62.resolve(
-  path62.dirname(fileURLToPath38(import.meta.url)),
+var _PACKAGE_ROOT3 = path62.resolve(
+  path62.dirname(fileURLToPath39(import.meta.url)),
   "..",
   "..",
   ".."
@@ -46535,7 +46757,7 @@ async function _roadmapArchiveHandler(_args, consumerRoot) {
 async function _capabilitiesIndexHandler(args, consumerRoot) {
   const check = _pyTruthy6(args.check ?? false);
   const cap = await Promise.resolve().then(() => (init_generate_capabilities_index(), generate_capabilities_index_exports));
-  const out = path62.join(_PACKAGE_ROOT2, "CAPABILITIES.yaml");
+  const out = path62.join(_PACKAGE_ROOT3, "CAPABILITIES.yaml");
   const content = cap.build();
   const onDisk = fs69.existsSync(out) ? fs69.readFileSync(out, "utf-8") : "";
   const drift = onDisk !== content;
@@ -47556,7 +47778,7 @@ function main28() {
 }
 
 // src/scripts/mcp_server/__main__.ts
-var _selfPath = fileURLToPath39(import.meta.url);
+var _selfPath = fileURLToPath40(import.meta.url);
 var _invokedDirectly2 = globalThis.__AC_MCP_BUNDLE_DIRECT === true || process.argv[1] !== void 0 && path63.resolve(process.argv[1]) === path63.resolve(_selfPath);
 if (_invokedDirectly2) {
   main28();