@event4u/agent-config 9.30.0 → 9.32.0

package/dist/cli-delegate/{chunk-66OVWGB5.js → chunk-AG47LAGQ.js}

@@ -2,7 +2,7 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 import {
   DEFAULT_PROJECT_FILE,
   logger
-} from "./chunk-LCFJIQ4J.js";
+} from "./chunk-JEJABGKB.js";
 
 // src/scripts/config/profiles.ts
 import * as fs2 from "node:fs";

package/dist/cli-delegate/{chunk-MP3JT3IU.js → chunk-DS6BLDMG.js}

@@ -1,7 +1,7 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
   resolve_project_root
-} from "./chunk-LCFJIQ4J.js";
+} from "./chunk-JEJABGKB.js";
 import {
   resolvePackageRoot
 } from "./chunk-MCJYCQPF.js";

package/dist/cli-delegate/{chunk-O3CO5BFB.js → chunk-EJITJBJX.js}

@@ -108,6 +108,15 @@ function atomic_write_json(target, payload, options = {}) {
   const body = _py_json_dumps(payload, indent) + "\n";
   _atomic_write_text(targetPath, body);
 }
+function atomic_write_text(target, text) {
+  if (is_replay_mode()) {
+    return;
+  }
+  const targetPath = path.resolve(target);
+  const state_dir = path.dirname(targetPath);
+  fs.mkdirSync(state_dir, { recursive: true });
+  _atomic_write_text(targetPath, text);
+}
 function _acquire_lock(lock_path) {
   const fd = fs.openSync(lock_path, "a", 420);
   const held = lock_path + ".held";
@@ -157,5 +166,7 @@ function _atomic_write_text(target, text) {
 }
 
 export {
-  atomic_write_json
+  is_replay_mode,
+  atomic_write_json,
+  atomic_write_text
 };

package/dist/cli-delegate/{chunk-EQY4FLJB.js → chunk-ITIQSGOQ.js}

@@ -2,10 +2,10 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 import {
   ZodFirstPartyTypeKind,
   settingsSchema
-} from "./chunk-DDUNNFYX.js";
+} from "./chunk-UVKNIJH2.js";
 import {
   main
-} from "./chunk-MP3JT3IU.js";
+} from "./chunk-DS6BLDMG.js";
 import {
   RULE_SOURCE_REL
 } from "./chunk-BKO2AZ7Z.js";
@@ -48,7 +48,7 @@ import {
 import {
   find_project_root_with_anchor,
   load_agent_settings
-} from "./chunk-LCFJIQ4J.js";
+} from "./chunk-JEJABGKB.js";
 import {
   event4u_root,
   legacy_xdg_root,

package/dist/cli-delegate/{chunk-LCFJIQ4J.js → chunk-JEJABGKB.js}

@@ -4,11 +4,67 @@ import {
   write_target
 } from "./chunk-NDJLNC6Q.js";
 
+// src/shared/settingsCarveOut.ts
+var SETTINGS_CARVE_OUT = [
+  {
+    key: "projection.mode",
+    reader: "src/scripts/install.ts:3409 _resolve_scoped_projection",
+    absentResolvesTo: "legacy-all",
+    reason: "The template fallback applies only when NO global settings file exists. Once a file exists, an absent key means legacy-all by documented contract, so an existing install is never silently narrowed on upgrade."
+  },
+  {
+    key: "projection.rule_workspaces",
+    reader: "src/install/rule_scope.ts:96 ruleScopeFromSettings",
+    absentResolvesTo: "null \u2014 LEGACY_ALL, i.e. every rule ships including maintainer-only ones",
+    reason: "Same upgrade contract as projection.mode, and the failure is louder: an absent list widens the projection instead of narrowing it."
+  },
+  {
+    key: "discipline_profile",
+    reader: "work_engine/_lib/agent_settings.ts:1263",
+    absentResolvesTo: "essential, unconditionally",
+    reason: "The template ships `auto`, which resolves to `off` on any measured-null model, any non-Claude host, and any host exposing no model id. Absent skips that resolution entirely and loads the essential tier everywhere."
+  },
+  {
+    key: "chat_history.frequency",
+    reader: "src/scripts/chat_history.ts:1140",
+    absentResolvesTo: "per_phase",
+    reason: "Canonical substitution is `per_turn`. Absent gives coarser capture than the shipped default \u2014 an audit-thinning change, which the class contract's own test 8 (what can the attacker HIDE) names as the severe direction."
+  },
+  {
+    key: "profile.id",
+    reader: "src/scripts/config/profiles.ts:221 resolve_profile",
+    absentResolvesTo: "the id `developer`, but a DEGRADED profile \u2014 packs: [], personas: [], hints: []",
+    reason: "Exactly the projection.mode shape: the template default is honoured only when no settings file exists. With a file present the id resolves but its profile body does not load, so the install silently loses every pack and persona."
+  },
+  {
+    key: "quality.local_auto_run",
+    reader: "src/scripts/lint_roadmap_ci_steps.ts:106",
+    absentResolvesTo: "true \u2014 which DISABLES the CI-step gate",
+    reason: "Inverted polarity, and the most dangerous row in the set: the template ships `false`, which ARMS the gate. Omitting the key would disarm a quality gate for every fresh install while the reference page says it is on."
+  },
+  {
+    key: "onboarding.onboarded",
+    reader: "src/scripts/onboarding_gate_hook.ts:99",
+    absentResolvesTo: "gate skipped, as if onboarding had already completed",
+    reason: "Absent behaves like `onboarded: true`, not like the template default `false`. Omitting it would skip the onboarding gate on precisely the fresh installs the gate exists for."
+  },
+  {
+    key: "chat_history.enabled",
+    reader: "src/scripts/chat_history.ts:1025 _read_chat_history_enabled",
+    absentResolvesTo: "false",
+    reason: "The reader falls back to false while the template ships true. This one is privacy-shaped: fixing the reader would start recording history for every install whose file lacks the key. Writing it explicitly keeps the decision visible in the file the user can read."
+  }
+];
+function carveOutKeys() {
+  return SETTINGS_CARVE_OUT.map((c) => c.key);
+}
+
 // src/scripts/_lib/agent_settings.ts
 import { createRequire } from "node:module";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 var _require = createRequire(import.meta.url);
 var Logger = class {
   name = "scripts._lib.agent_settings";
@@ -117,7 +173,45 @@ var MERGEABLE_KEYS = [
   "knowledge.global_sharing.freshness.hypothesis_after_days",
   "knowledge.global_sharing.freshness.stale_after_days"
 ];
-var _DEFAULTS = {};
+var TEMPLATE_RELATIVE = path.join("src", "config", "agent-settings.template.yml");
+var _PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+function default_template_path() {
+  return path.join(_PACKAGE_ROOT, TEMPLATE_RELATIVE);
+}
+function _is_placeholder(value) {
+  return typeof value === "string" && /^__[A-Z0-9_]+__$/.test(value);
+}
+function _prune_template(tree, excluded, prefix = "") {
+  const out = {};
+  for (const [key, value] of Object.entries(tree)) {
+    const dotted = prefix === "" ? key : `${prefix}.${key}`;
+    if (excluded.has(dotted) || _is_placeholder(value)) {
+      continue;
+    }
+    if (_is_plain_dict(value)) {
+      const child = _prune_template(value, excluded, dotted);
+      if (Object.keys(child).length > 0) {
+        out[key] = child;
+      }
+      continue;
+    }
+    out[key] = value;
+  }
+  return out;
+}
+var _template_defaults_cache = null;
+function template_defaults(template_path) {
+  const use_cache = template_path === void 0;
+  if (use_cache && _template_defaults_cache !== null) {
+    return _deepcopy(_template_defaults_cache);
+  }
+  const parsed = _read_yaml(template_path ?? default_template_path()) ?? {};
+  const pruned = _prune_template(parsed, new Set(carveOutKeys()));
+  if (use_cache) {
+    _template_defaults_cache = pruned;
+  }
+  return _deepcopy(pruned);
+}
 var ANCHOR_AGENT_SETTINGS = "agent-settings";
 var ANCHOR_AGENTS_DIR = "agents-dir";
 var ANCHOR_GIT = "git";
@@ -386,6 +480,7 @@ function load_agent_settings(options = {}) {
   const user_global_path = options.user_global_path ?? null;
   const verbose = options.verbose ?? false;
   const cwd = options.cwd ?? null;
+  const template_path = options.template_path ?? null;
   const user_global_raw = {};
   for (const p of user_global_path ? [user_global_path] : user_global_settings_paths()) {
     _deep_merge(user_global_raw, _read_yaml(p) ?? {});
@@ -398,7 +493,7 @@ function load_agent_settings(options = {}) {
     );
   }
   const cascade = _resolve_cascade_paths(cwd, project_path);
-  const merged = _deep_copy_defaults(_DEFAULTS);
+  const merged = template_defaults(template_path ?? void 0);
   _deep_merge(merged, user_global_filtered);
   for (const p of cascade) {
     const layer = _read_yaml(p) ?? {};
@@ -555,16 +650,25 @@ function _deep_merge(dst, src) {
     }
   }
 }
-function _deep_copy_defaults(src) {
-  const out = {};
-  _deep_merge(out, src);
-  return out;
+function _deepcopy(value) {
+  if (Array.isArray(value)) {
+    return value.map((v) => _deepcopy(v));
+  }
+  if (_is_plain_dict(value)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = _deepcopy(v);
+    }
+    return out;
+  }
+  return value;
 }
 function _is_plain_dict(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 export {
+  SETTINGS_CARVE_OUT,
   logger,
   DEFAULT_PROJECT_FILE,
   LOCAL_PROJECT_FILE,

package/dist/cli-delegate/chunk-PZWRPRWP.js

@@ -0,0 +1,38 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/scripts/_lib/git_common_dir.ts
+import fs from "node:fs";
+import path from "node:path";
+function realpath_or_self(p) {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+function git_common_dir(project_root) {
+  const dot_git = path.join(project_root, ".git");
+  try {
+    const st = fs.statSync(dot_git);
+    if (st.isDirectory()) {
+      return realpath_or_self(dot_git);
+    }
+    const m = fs.readFileSync(dot_git, "utf-8").match(/^gitdir:\s*(.+)\s*$/m);
+    if (m === null) {
+      return null;
+    }
+    const gitdir = path.resolve(project_root, m[1].trim());
+    const commondir_file = path.join(gitdir, "commondir");
+    if (fs.existsSync(commondir_file)) {
+      const common = path.resolve(gitdir, fs.readFileSync(commondir_file, "utf-8").trim());
+      return realpath_or_self(common);
+    }
+    return realpath_or_self(gitdir);
+  } catch {
+    return null;
+  }
+}
+
+export {
+  git_common_dir
+};

package/dist/cli-delegate/{chunk-BTJNRUX3.js → chunk-QEEB4LHO.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-MMJL4TIX.js";
 import {
   load_agent_settings
-} from "./chunk-LCFJIQ4J.js";
+} from "./chunk-JEJABGKB.js";
 
 // src/scripts/chat_history.ts
 import { createHash } from "node:crypto";

package/dist/cli-delegate/{chunk-DDUNNFYX.js → chunk-UVKNIJH2.js}

@@ -4549,10 +4549,10 @@ var settingsSchema = external_exports.object({
         "Stop-slot turn-end gate (road-to-conformance-round5 Phase 3). Default off, and it is the only concern that can REFUSE a turn-end rather than a tool call \u2014 so it soaks behind an explicit opt-in before it binds. Round 5 measured the reason: both blocking carriers reached zero violations, neither advisory carrier did, and 19 wrong-language replies survived a pin that had fired 26-35 seconds earlier. A refused turn continues in the SAME turn and is never refused twice."
       ),
       promissory: external_exports.boolean().default(true).describe(
-        "Detector A of the turn-end gate: refuse a turn whose closing paragraph promises work not yet performed while asking the user nothing (20 measured occurrences). Inert while hooks.turn_end_gate.enabled is false."
+        "Detector A of the turn-end gate: refuse a turn whose closing paragraph promises work not yet performed while asking the user nothing (20 measured occurrences). No fire rate is quoted here on purpose: the measured rate moved twice while the instrument itself was being corrected, so a number in a shipped description would be a moving target. Re-derive it with `measure-turn-end-gate --store <transcript dir>` against your own corpus before arming the gate. Inert while hooks.turn_end_gate.enabled is false."
       ),
       language: external_exports.boolean().default(true).describe(
-        "Detector B of the turn-end gate: refuse a turn whose user-visible prose is not in the pinned language, with fenced code, inline code, quoted tool output, tables, URLs, paths and identifiers excluded first (19 measured occurrences). Fires 18.0% of turns on the measured corpus, which is why the master switch is off by default. Inert while hooks.turn_end_gate.enabled is false."
+        "Detector B of the turn-end gate: refuse a turn whose reply is not in the pinned language (19 measured occurrences). Fenced code, inline code, quoted tool output, tables, URLs and paths are stripped first, and the remainder is then scored LEAD-FIRST by the same classifier that sets the pin \u2014 so the verdict usually comes from the reply opening, not from all of it. Sharing that classifier is deliberate: it stops the pin and the detector disagreeing about a turn. Accepted opt-in spellings for the switches below include YAML true/false and yes/no/on/off. Inert while hooks.turn_end_gate.enabled is false."
       )
     }).default({})
   }),

package/dist/cli-delegate/cmd_analyze_session.js

@@ -7,7 +7,7 @@ import {
 import {
   ProjectRootError,
   resolve_project_root
-} from "./chunk-LCFJIQ4J.js";
+} from "./chunk-JEJABGKB.js";
 import "./chunk-NDJLNC6Q.js";
 import "./chunk-J55WI3RR.js";
 

package/dist/cli-delegate/cmd_brand_status.js

@@ -1,7 +1,7 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
   resolve_project_root
-} from "./chunk-LCFJIQ4J.js";
+} from "./chunk-JEJABGKB.js";
 import "./chunk-NDJLNC6Q.js";
 import "./chunk-J55WI3RR.js";
 

package/dist/cli-delegate/cmd_conformance.js

@@ -14,12 +14,15 @@ import {
   _run_checks,
   _run_checks_no_manifest,
   _scan_foreign
-} from "./chunk-IYTGIG2Y.js";
+} from "./chunk-542DZR4P.js";
 import "./chunk-FTAISGDQ.js";
 import {
-  atomic_write_json
-} from "./chunk-O3CO5BFB.js";
+  atomic_write_json,
+  atomic_write_text,
+  is_replay_mode
+} from "./chunk-EJITJBJX.js";
 import "./chunk-LVRYBKTI.js";
+import "./chunk-PZWRPRWP.js";
 import "./chunk-736JCWLM.js";
 import {
   atomicAppendLine,
@@ -28,7 +31,7 @@ import {
 } from "./chunk-63WSP6YZ.js";
 import "./chunk-GRRPEPRN.js";
 import "./chunk-NXFWFAYV.js";
-import "./chunk-LCFJIQ4J.js";
+import "./chunk-JEJABGKB.js";
 import "./chunk-NDJLNC6Q.js";
 import {
   detectToolPresence
@@ -140,6 +143,37 @@ function comparePair(a, b) {
   }
   return "body-diff";
 }
+function splitFrontmatter(text) {
+  if (!text.startsWith("---")) return { hadFrontmatter: false, frontmatter: "", body: text };
+  const end = text.indexOf("\n---", 3);
+  if (end === -1) return { hadFrontmatter: false, frontmatter: "", body: text };
+  const afterFence = text.indexOf("\n", end + 1);
+  return {
+    hadFrontmatter: true,
+    frontmatter: text.slice(3, end),
+    body: afterFence === -1 ? "" : text.slice(afterFence + 1)
+  };
+}
+function proseEqual(a, b) {
+  const sa = splitFrontmatter(a);
+  const sb = splitFrontmatter(b);
+  if (!sa.hadFrontmatter && !sb.hadFrontmatter) return false;
+  const leading = /^\n+/;
+  return sa.body.replace(leading, "") === sb.body.replace(leading, "");
+}
+function frontmatterPaths(text) {
+  const { hadFrontmatter, frontmatter } = splitFrontmatter(text);
+  if (!hadFrontmatter) return null;
+  const lines = frontmatter.split("\n");
+  const start = lines.findIndex((l) => /^paths:/.test(l));
+  if (start === -1) return null;
+  const block = [lines[start]];
+  for (const line of lines.slice(start + 1)) {
+    if (/^\s/.test(line) && line.trim() !== "") block.push(line);
+    else break;
+  }
+  return block.map((l) => l.trim()).join(" ");
+}
 function censusRuleDir(dir) {
   let files = 0;
   let chars = 0;
@@ -223,7 +257,11 @@ function humanAuthoredLead(text) {
 var EXIT_ALLOW = 0;
 var EXIT_WARN = 2;
 var STATE_FILE = path2.join("agents", "state", "language-mirror.json");
-var PIN_LOST_MARKER = path2.join("agents", "state", "language-mirror.pin-lost");
+var PIN_LOST_DIR = path2.join("agents", "state", "language-mirror.pin-lost");
+function pinLostMarker(session_id) {
+  const safe = (session_id || "unknown-session").replace(/[^A-Za-z0-9._-]/g, "_");
+  return path2.join(PIN_LOST_DIR, `${safe}.marker`);
+}
 function _isObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -362,35 +400,49 @@ function _extractPrompt(payload) {
   }
   return "";
 }
-function _setPinLost(consumer_root) {
+function _sessionId(envelope) {
+  const v = envelope["session_id"];
+  return typeof v === "string" && v.trim() !== "" ? v : "unknown-session";
+}
+function _migrateLegacyMarker(consumer_root) {
+  const legacy = path2.join(consumer_root, PIN_LOST_DIR);
+  try {
+    if (fs2.statSync(legacy).isFile()) {
+      fs2.rmSync(legacy, { force: true });
+    }
+  } catch {
+  }
+}
+function _setPinLost(consumer_root, session_id) {
+  if (is_replay_mode()) return;
+  _migrateLegacyMarker(consumer_root);
   try {
-    const target = path2.join(consumer_root, PIN_LOST_MARKER);
-    fs2.mkdirSync(path2.dirname(target), { recursive: true });
-    fs2.writeFileSync(target, (/* @__PURE__ */ new Date()).toISOString());
+    atomic_write_text(path2.join(consumer_root, pinLostMarker(session_id)), (/* @__PURE__ */ new Date()).toISOString());
   } catch {
   }
 }
-function _pinLost(consumer_root) {
+function _pinLost(consumer_root, session_id) {
   try {
-    return fs2.existsSync(path2.join(consumer_root, PIN_LOST_MARKER));
+    return fs2.existsSync(path2.join(consumer_root, pinLostMarker(session_id)));
   } catch {
     return false;
   }
 }
-function _clearPinLost(consumer_root) {
+function _clearPinLost(consumer_root, session_id) {
+  if (is_replay_mode()) return;
   try {
-    fs2.rmSync(path2.join(consumer_root, PIN_LOST_MARKER), { force: true });
+    fs2.rmSync(path2.join(consumer_root, pinLostMarker(session_id)), { force: true });
   } catch {
   }
 }
-function _reEmitAfterCompaction(consumer_root) {
-  if (!_pinLost(consumer_root)) {
+function _reEmitAfterCompaction(consumer_root, session_id) {
+  if (!_pinLost(consumer_root, session_id)) {
     return EXIT_ALLOW;
   }
   const previous = _loadState(path2.join(consumer_root, STATE_FILE));
   const language = previous.language;
   const source = previous.source === "system-locale" ? "system-locale" : "prompt";
-  _clearPinLost(consumer_root);
+  _clearPinLost(consumer_root, session_id);
   if (language !== "de" && language !== "en") {
     return EXIT_ALLOW;
   }
@@ -419,11 +471,11 @@ function run(stdin_text, options) {
   const payload = _isObject2(envelope["payload"]) ? envelope["payload"] : envelope;
   const event = typeof envelope["event"] === "string" ? envelope["event"] : "";
   if (event === "pre_compact") {
-    _setPinLost(options.consumer_root);
+    _setPinLost(options.consumer_root, _sessionId(envelope));
     return EXIT_ALLOW;
   }
   if (event === "post_tool_use") {
-    return _reEmitAfterCompaction(options.consumer_root);
+    return _reEmitAfterCompaction(options.consumer_root, _sessionId(envelope));
   }
   const prompt = _extractPrompt(payload);
   if (!prompt) {
@@ -1944,10 +1996,7 @@ function _ruleType(file) {
   } catch {
     return "";
   }
-  if (!text.startsWith("---")) return "";
-  const end = text.indexOf("\n---", 3);
-  const fm = end === -1 ? text : text.slice(0, end);
-  const m = /^type:\s*"?([a-z]+)"?/m.exec(fm);
+  const m = /^type:\s*"?([a-z]+)"?/m.exec(splitFrontmatter(text).frontmatter);
   return m === null ? "" : m[1];
 }
 function compareCarriers(projectDir, globalDir, sourceDir) {
@@ -1959,6 +2008,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     shared: 0,
     identical: [],
     provenanceOnly: [],
+    frontmatterOnly: [],
+    pathsScopeDiff: [],
     bodyDiff: [],
     projectOnly: [],
     globalOnly: [],
@@ -1983,11 +2034,12 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     out.shared += 1;
     let verdict;
+    let projectCopy;
+    let globalCopy;
     try {
-      verdict = comparePair(
-        fs8.readFileSync(path8.join(projectDir, rule)),
-        fs8.readFileSync(path8.join(globalDir, rule))
-      );
+      projectCopy = fs8.readFileSync(path8.join(projectDir, rule));
+      globalCopy = fs8.readFileSync(path8.join(globalDir, rule));
+      verdict = comparePair(projectCopy, globalCopy);
     } catch {
       out.shared -= 1;
       out.unreadable.push(rule);
@@ -1995,7 +2047,16 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     if (verdict === "identical") out.identical.push(rule);
     else if (verdict === "provenance-only") out.provenanceOnly.push(rule);
-    else out.bodyDiff.push(rule);
+    else {
+      const projectText = projectCopy.toString("utf-8");
+      const globalText = globalCopy.toString("utf-8");
+      if (proseEqual(projectText, globalText)) {
+        out.frontmatterOnly.push(rule);
+        if (frontmatterPaths(projectText) !== frontmatterPaths(globalText)) {
+          out.pathsScopeDiff.push(rule);
+        }
+      } else out.bodyDiff.push(rule);
+    }
   }
   return out;
 }
@@ -2023,7 +2084,9 @@ function render2(d) {
   lines.push(`  shared rule names                    ${d.shared}`);
   lines.push(`    byte-identical                     ${d.identical.length}`);
   lines.push(`    differ ONLY in the install stamp   ${d.provenanceOnly.length}`);
-  lines.push(`    differ in BODY                     ${d.bodyDiff.length}`);
+  lines.push(`    differ ONLY in frontmatter         ${d.frontmatterOnly.length}`);
+  lines.push(`      of which disagree on \`paths:\`    ${d.pathsScopeDiff.length}  \u2190 ACTIONABLE`);
+  lines.push(`    differ in PROSE                    ${d.bodyDiff.length}`);
   if (d.unreadable.length > 0) {
     lines.push(`    unreadable on one side             ${d.unreadable.length}  (${d.unreadable.join(", ")})`);
     lines.push("      Not counted as shared and NOT a body difference \u2014 a dangling entry is");
@@ -2033,15 +2096,43 @@ function render2(d) {
   lines.push(`  present at global scope only         ${d.globalOnly.length}`);
   lines.push("");
   if (d.bodyDiff.length > 0) {
-    lines.push("  BODY DIVERGENCE \u2014 the two carriers deliver different text for these rules.");
-    lines.push("  Both copies reach the model, with no precedence marker between them, so a");
-    lines.push("  claim one copy retracts can be re-asserted by the other. PRECEDENCE: the");
-    lines.push("  project projection is generated from src/ at this commit and wins; the");
-    lines.push("  global install is a release snapshot. Close it by reinstalling the global");
-    lines.push("  copy, or by reading the project copy as authoritative.");
+    lines.push("  PROSE DIVERGENCE \u2014 the two carriers deliver different governed text for");
+    lines.push("  these rules. Both copies reach the model, and the host resolves NOTHING:");
+    lines.push("  rules without a `paths` key load at launch with the same priority as");
+    lines.push("  CLAUDE.md, with no precedence marker between the layers, so a claim one");
+    lines.push("  copy retracts can be re-asserted by the other and which text binds is");
+    lines.push("  UNDEFINED. Cited, not inferred \u2014 agents/evidence/analysis/");
+    lines.push("  claude-code-rules-dir-contract.md (host 2.1.226, the host's own docs plus");
+    lines.push("  a first-party observation). The project copy is the NEWER text, which is a");
+    lines.push("  fact about recency and NOT a host precedence rule: close the divergence by");
+    lines.push("  reinstalling the global copy, or decide which text binds \u2014 do not assume");
+    lines.push("  the newer one already won.");
     for (const r of d.bodyDiff) lines.push(`    - ${r}`);
     lines.push("");
   }
+  if (d.pathsScopeDiff.length > 0) {
+    lines.push(`  \`paths:\` SCOPE DISAGREEMENT (${String(d.pathsScopeDiff.length)}) \u2014 same prose, different load schedule.`);
+    lines.push("  ACT ON THESE. `paths` is the one frontmatter key this host reads: with it, a");
+    lines.push("  rule fires when a matching file is read and is NOT re-injected after");
+    lines.push("  /compact; without it, the rule loads unconditionally at launch. So the copy");
+    lines.push("  that lacks `paths` DEFEATS the other copy's scoping \u2014 the rule the project");
+    lines.push("  layer meant to deliver conditionally is delivered always, and an obligation");
+    lines.push("  a maintainer deliberately scoped is silently unscoped on any machine that");
+    lines.push("  carries both. Identical prose does not make this inert.");
+    for (const r of d.pathsScopeDiff) lines.push(`    - ${r}`);
+    lines.push("");
+  }
+  const inert = d.frontmatterOnly.length - d.pathsScopeDiff.length;
+  if (inert > 0) {
+    lines.push(`  ${String(inert)} further pair(s) differ ONLY in frontmatter the host does not read \u2014`);
+    lines.push("  prose byte-identical, `paths` in agreement, nothing to act on. Two writers,");
+    lines.push("  two policies: `generate-tools` emits `paths` where a rule is path-scoped and");
+    lines.push("  nothing otherwise; `install.ts` writes agent-config's own vocabulary plus its");
+    lines.push("  ownership stamp, and none of those keys is one this host reads");
+    lines.push("  (claude-code-rules-dir-contract.md). Reported as a count on purpose: naming");
+    lines.push("  every pair would bury the two classes above, which are the actionable ones.");
+    lines.push("");
+  }
   if (d.provenanceOnly.length > 0) {
     lines.push(`  ${String(d.provenanceOnly.length)} pair(s) differ only by the installer's package:/source_path: stamp.`);
     lines.push("  Not a content difference and NOT a defect: install.ts stamps every installed");
@@ -2077,9 +2168,18 @@ function render2(d) {
   }
   if (d.bodyDiff.length === 0) {
     lines.push("");
-    lines.push("  No body divergence. The condition is transient \u2014 it returns whenever the");
-    lines.push("  checkout moves ahead of the installed release \u2014 so this is a reading of");
-    lines.push("  right now, not a property of the repo. Re-run it, do not cite it.");
+    lines.push("  No prose divergence \u2014 no rule's governed text differs between the carriers.");
+    if (d.pathsScopeDiff.length > 0) {
+      lines.push("  NOT an all-clear: the `paths:` disagreements above are still open, and they");
+      lines.push("  change when a rule loads rather than what it says.");
+    }
+    lines.push("  The condition is transient \u2014 it returns whenever the checkout moves ahead of");
+    lines.push("  the installed release \u2014 so this is a reading of right now, not a property of");
+    lines.push("  the repo. Re-run it, do not cite it. That holds doubly here: the reading also");
+    lines.push("  depends on WHICH GENERATION of the emitter produced the project tree (a");
+    lines.push("  frontmatter-carrying symlink tree and a frontmatter-less real-file tree");
+    lines.push("  classify the same commit differently), so a number from another checkout is");
+    lines.push("  not comparable to this one.");
   }
   return lines.join("\n");
 }
@@ -2680,12 +2780,25 @@ function render5(r) {
     lines.push("    substituted with dist/, which would answer a different question.");
   } else {
     lines.push(
-      `    Divergence: ${d.shared} shared \xB7 ${d.bodyDiff.length} body-diff \xB7 ${d.provenanceOnly.length} provenance-only \xB7 ${d.projectOnly.length} project-only \xB7 ${d.globalOnly.length} global-only` + (d.manualOnlyGlobal.length > 0 ? ` (${d.manualOnlyGlobal.length} by design, ADR-004 manual)` : "")
+      `    Divergence: ${d.shared} shared \xB7 ${d.bodyDiff.length} prose-diff \xB7 ${d.frontmatterOnly.length} frontmatter-only (${d.pathsScopeDiff.length} on \`paths:\`) \xB7 ${d.provenanceOnly.length} provenance-only \xB7 ${d.projectOnly.length} project-only \xB7 ${d.globalOnly.length} global-only` + (d.manualOnlyGlobal.length > 0 ? ` (${d.manualOnlyGlobal.length} by design, ADR-004 manual)` : "")
     );
     if (d.bodyDiff.length > 0) {
-      lines.push(`    BODY DIVERGENCE \u2014 both copies reach the model: ${d.bodyDiff.join(", ")}`);
-      lines.push("    Precedence: the project projection is generated from src/ at this commit");
-      lines.push("    and wins; the global install is a release snapshot.");
+      lines.push(`    PROSE DIVERGENCE \u2014 both copies reach the model: ${d.bodyDiff.join(", ")}`);
+      lines.push("    The host resolves nothing: both layers load at launch at the same");
+      lines.push("    priority with no precedence marker, so which text binds is UNDEFINED");
+      lines.push("    (claude-code-rules-dir-contract.md). The project copy is merely the");
+      lines.push("    newer one \u2014 recency, not precedence.");
+    }
+    if (d.pathsScopeDiff.length > 0) {
+      lines.push(`    \`paths:\` SCOPE DISAGREEMENT (${String(d.pathsScopeDiff.length)}) \u2014 same prose, different load`);
+      lines.push("    schedule. `paths` is the one frontmatter key the host reads, so the copy");
+      lines.push("    without it defeats the other copy's scoping: a deliberately scoped");
+      lines.push("    obligation is delivered unconditionally. Act on these.");
+    }
+    const inertFm = d.frontmatterOnly.length - d.pathsScopeDiff.length;
+    if (inertFm > 0) {
+      lines.push(`    ${String(inertFm)} further pair(s) differ only in frontmatter the host does not read \u2014`);
+      lines.push("    prose byte-identical, `paths` in agreement, nothing to act on.");
     }
     if (d.unreadable.length > 0) {
       lines.push(`    Unreadable on one side (${d.unreadable.length}) \u2014 a broken install, not a disagreement.`);

package/dist/cli-delegate/cmd_doctor.js

@@ -66,15 +66,16 @@ import {
   _wizard_state_path,
   main,
   shutilWhich
-} from "./chunk-IYTGIG2Y.js";
+} from "./chunk-542DZR4P.js";
 import "./chunk-FTAISGDQ.js";
-import "./chunk-O3CO5BFB.js";
+import "./chunk-EJITJBJX.js";
 import "./chunk-LVRYBKTI.js";
+import "./chunk-PZWRPRWP.js";
 import "./chunk-736JCWLM.js";
 import "./chunk-63WSP6YZ.js";
 import "./chunk-GRRPEPRN.js";
 import "./chunk-NXFWFAYV.js";
-import "./chunk-LCFJIQ4J.js";
+import "./chunk-JEJABGKB.js";
 import "./chunk-NDJLNC6Q.js";
 import "./chunk-OY53J6II.js";
 import "./chunk-MCJYCQPF.js";