@event4u/agent-config 9.31.0 → 9.33.0

package/dist/cli-delegate/cmd_conformance.js

@@ -13,15 +13,22 @@ import {
   _resolve_project_root,
   _run_checks,
   _run_checks_no_manifest,
-  _scan_foreign
-} from "./chunk-2WCLVDWC.js";
+  _scan_foreign,
+  censusRuleDir,
+  comparePair,
+  frontmatterPaths,
+  proseEqual,
+  splitFrontmatter
+} from "./chunk-PMQ6Z3T3.js";
 import "./chunk-FTAISGDQ.js";
 import {
   atomic_write_json,
   atomic_write_text,
   is_replay_mode
 } from "./chunk-EJITJBJX.js";
-import "./chunk-LVRYBKTI.js";
+import "./chunk-Q26HT4QT.js";
+import "./chunk-YPAWXXXR.js";
+import "./chunk-PZWRPRWP.js";
 import "./chunk-736JCWLM.js";
 import {
   atomicAppendLine,
@@ -47,9 +54,9 @@ import {
 
 // src/scripts/_cli/cmd_conformance.ts
 var YAML = __toESM(require_dist(), 1);
-import * as fs12 from "node:fs";
+import * as fs11 from "node:fs";
 import * as os6 from "node:os";
-import * as path12 from "node:path";
+import * as path11 from "node:path";
 import process5 from "node:process";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
@@ -113,65 +120,19 @@ function routeTargetPathsPosix(target) {
 }
 
 // src/scripts/report_conformance_funnel.ts
-import * as fs11 from "node:fs";
+import * as fs10 from "node:fs";
 import * as os5 from "node:os";
-import * as path11 from "node:path";
+import * as path10 from "node:path";
 import process4 from "node:process";
 import { fileURLToPath as fileURLToPath10, pathToFileURL as pathToFileURL10 } from "node:url";
 
 // src/scripts/conformance_scan.ts
 import { createHash } from "node:crypto";
-import fs7 from "node:fs";
+import fs6 from "node:fs";
 import os from "node:os";
-import path7 from "node:path";
+import path6 from "node:path";
 import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL6 } from "node:url";
 
-// src/scripts/_lib/carrier_divergence.ts
-import * as fs from "node:fs";
-import * as path from "node:path";
-var OWNERSHIP_KEYS = ["package", "source_path"];
-function stripOwnershipKeys(text) {
-  return text.split("\n").filter((line) => !OWNERSHIP_KEYS.some((k) => line.startsWith(`${k}:`))).join("\n");
-}
-function comparePair(a, b) {
-  if (a.equals(b)) {
-    return "identical";
-  }
-  if (stripOwnershipKeys(a.toString("utf-8")) === stripOwnershipKeys(b.toString("utf-8"))) {
-    return "provenance-only";
-  }
-  return "body-diff";
-}
-function stripFrontmatter(text) {
-  if (!text.startsWith("---")) return text;
-  const end = text.indexOf("\n---", 3);
-  if (end === -1) return text;
-  const afterFence = text.indexOf("\n", end + 1);
-  return afterFence === -1 ? "" : text.slice(afterFence + 1);
-}
-function proseEqual(a, b) {
-  return stripFrontmatter(a).trim() === stripFrontmatter(b).trim();
-}
-function censusRuleDir(dir) {
-  let files = 0;
-  let chars = 0;
-  let entries;
-  try {
-    entries = fs.readdirSync(dir);
-  } catch {
-    return { files: 0, chars: 0 };
-  }
-  for (const name of entries) {
-    if (!name.endsWith(".md")) continue;
-    try {
-      chars += fs.statSync(path.join(dir, name)).size;
-      files += 1;
-    } catch {
-    }
-  }
-  return { files, chars };
-}
-
 // src/scripts/_lib/transcript_entry.ts
 function _isObject(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -210,8 +171,8 @@ function toolUses(entry) {
 }
 
 // src/scripts/language_mirror_hook.ts
-import fs2 from "node:fs";
-import path2 from "node:path";
+import fs from "node:fs";
+import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 // src/scripts/_lib/prompt_shape.ts
@@ -234,11 +195,11 @@ function humanAuthoredLead(text) {
 // src/scripts/language_mirror_hook.ts
 var EXIT_ALLOW = 0;
 var EXIT_WARN = 2;
-var STATE_FILE = path2.join("agents", "state", "language-mirror.json");
-var PIN_LOST_DIR = path2.join("agents", "state", "language-mirror.pin-lost");
+var STATE_FILE = path.join("agents", "state", "language-mirror.json");
+var PIN_LOST_DIR = path.join("agents", "state", "language-mirror.pin-lost");
 function pinLostMarker(session_id) {
   const safe = (session_id || "unknown-session").replace(/[^A-Za-z0-9._-]/g, "_");
-  return path2.join(PIN_LOST_DIR, `${safe}.marker`);
+  return path.join(PIN_LOST_DIR, `${safe}.marker`);
 }
 function _isObject2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -334,7 +295,7 @@ This pin exists because the trigger is not observable from the transcript alone:
 }
 function _loadState(target) {
   try {
-    const raw = fs2.readFileSync(target, "utf8");
+    const raw = fs.readFileSync(target, "utf8");
     const decoded = JSON.parse(raw);
     return _isObject2(decoded) ? decoded : {};
   } catch {
@@ -383,10 +344,10 @@ function _sessionId(envelope) {
   return typeof v === "string" && v.trim() !== "" ? v : "unknown-session";
 }
 function _migrateLegacyMarker(consumer_root) {
-  const legacy = path2.join(consumer_root, PIN_LOST_DIR);
+  const legacy = path.join(consumer_root, PIN_LOST_DIR);
   try {
-    if (fs2.statSync(legacy).isFile()) {
-      fs2.rmSync(legacy, { force: true });
+    if (fs.statSync(legacy).isFile()) {
+      fs.rmSync(legacy, { force: true });
     }
   } catch {
   }
@@ -395,13 +356,13 @@ function _setPinLost(consumer_root, session_id) {
   if (is_replay_mode()) return;
   _migrateLegacyMarker(consumer_root);
   try {
-    atomic_write_text(path2.join(consumer_root, pinLostMarker(session_id)), (/* @__PURE__ */ new Date()).toISOString());
+    atomic_write_text(path.join(consumer_root, pinLostMarker(session_id)), (/* @__PURE__ */ new Date()).toISOString());
   } catch {
   }
 }
 function _pinLost(consumer_root, session_id) {
   try {
-    return fs2.existsSync(path2.join(consumer_root, pinLostMarker(session_id)));
+    return fs.existsSync(path.join(consumer_root, pinLostMarker(session_id)));
   } catch {
     return false;
   }
@@ -409,7 +370,7 @@ function _pinLost(consumer_root, session_id) {
 function _clearPinLost(consumer_root, session_id) {
   if (is_replay_mode()) return;
   try {
-    fs2.rmSync(path2.join(consumer_root, pinLostMarker(session_id)), { force: true });
+    fs.rmSync(path.join(consumer_root, pinLostMarker(session_id)), { force: true });
   } catch {
   }
 }
@@ -417,7 +378,7 @@ function _reEmitAfterCompaction(consumer_root, session_id) {
   if (!_pinLost(consumer_root, session_id)) {
     return EXIT_ALLOW;
   }
-  const previous = _loadState(path2.join(consumer_root, STATE_FILE));
+  const previous = _loadState(path.join(consumer_root, STATE_FILE));
   const language = previous.language;
   const source = previous.source === "system-locale" ? "system-locale" : "prompt";
   _clearPinLost(consumer_root, session_id);
@@ -463,7 +424,7 @@ function run(stdin_text, options) {
     return EXIT_ALLOW;
   }
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
-  const target = path2.join(options.consumer_root, STATE_FILE);
+  const target = path.join(options.consumer_root, STATE_FILE);
   const previous = _loadState(target);
   const classification = classify(prompt);
   const next = nextState(
@@ -515,13 +476,13 @@ function _isCliEntry() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL(path2.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs2.realpathSync(fileURLToPath(import.meta.url));
-    const argv = fs2.realpathSync(path2.resolve(process.argv[1]));
+    const here = fs.realpathSync(fileURLToPath(import.meta.url));
+    const argv = fs.realpathSync(path.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -532,11 +493,11 @@ if (_isCliEntry()) {
 }
 
 // src/scripts/git_authorization_hook.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
+import fs2 from "node:fs";
+import path2 from "node:path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL2 } from "node:url";
 var EXIT_ALLOW2 = 0;
-var STATE_FILE2 = path3.join("agents", "state", "git-authorization.json");
+var STATE_FILE2 = path2.join("agents", "state", "git-authorization.json");
 function _isObject3(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -658,7 +619,7 @@ function run2(stdin_text, options) {
     prompt_chars: prompt.length
   };
   try {
-    atomic_write_json(path3.join(options.consumer_root, STATE_FILE2), ledger);
+    atomic_write_json(path2.join(options.consumer_root, STATE_FILE2), ledger);
   } catch {
   }
   return EXIT_ALLOW2;
@@ -684,13 +645,13 @@ function _isCliEntry2() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL2(path3.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL2(path2.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs3.realpathSync(fileURLToPath2(import.meta.url));
-    const argv = fs3.realpathSync(path3.resolve(process.argv[1]));
+    const here = fs2.realpathSync(fileURLToPath2(import.meta.url));
+    const argv = fs2.realpathSync(path2.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -701,8 +662,8 @@ if (_isCliEntry2()) {
 }
 
 // src/scripts/hooks/block_unauthorized_git.ts
-import fs4 from "node:fs";
-import path4 from "node:path";
+import fs3 from "node:fs";
+import path3 from "node:path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL3 } from "node:url";
 var EXIT_ALLOW3 = 0;
 var EXIT_BLOCK = 1;
@@ -929,7 +890,7 @@ function commandOp(command) {
 var LEDGER_MAX_AGE_MS = 30 * 60 * 1e3;
 function _loadLedger(consumer_root, session_id, now) {
   try {
-    const raw = fs4.readFileSync(path4.join(consumer_root, STATE_FILE2), "utf8");
+    const raw = fs3.readFileSync(path3.join(consumer_root, STATE_FILE2), "utf8");
     const decoded = JSON.parse(raw);
     if (_isObject4(decoded) && Array.isArray(decoded["authorized"])) {
       const ledgerSession = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
@@ -1020,13 +981,13 @@ function _isCliEntry3() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL3(path4.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL3(path3.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs4.realpathSync(fileURLToPath3(import.meta.url));
-    const argv = fs4.realpathSync(path4.resolve(process.argv[1]));
+    const here = fs3.realpathSync(fileURLToPath3(import.meta.url));
+    const argv = fs3.realpathSync(path3.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -1037,10 +998,10 @@ if (_isCliEntry3()) {
 }
 
 // src/scripts/before_complete_hook.ts
-import fs5 from "node:fs";
-import path5 from "node:path";
+import fs4 from "node:fs";
+import path4 from "node:path";
 import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
-var STATE_FILE3 = path5.join("agents", "state", "verify-before-complete.json");
+var STATE_FILE3 = path4.join("agents", "state", "verify-before-complete.json");
 var COMMAND_TOOLS2 = /* @__PURE__ */ new Set([
   "launch-process",
   "launch_process",
@@ -1082,7 +1043,7 @@ function _empty_state() {
 function _load_state(target) {
   let isFile = false;
   try {
-    isFile = fs5.statSync(target).isFile();
+    isFile = fs4.statSync(target).isFile();
   } catch {
     isFile = false;
   }
@@ -1090,7 +1051,7 @@ function _load_state(target) {
     return _empty_state();
   }
   try {
-    const decoded = JSON.parse(fs5.readFileSync(target, "utf-8"));
+    const decoded = JSON.parse(fs4.readFileSync(target, "utf-8"));
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
       return { ..._empty_state(), ...decoded };
     }
@@ -1266,7 +1227,7 @@ function run4(stdin_text, options) {
     }
   }
   const event = envelope["event"] || "";
-  const target = path5.join(consumer_root, STATE_FILE3);
+  const target = path4.join(consumer_root, STATE_FILE3);
   let state = _load_state(target);
   state = _update(state, event, envelope);
   try {
@@ -1324,13 +1285,13 @@ function _isCliEntry4() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL4(path5.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL4(path4.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs5.realpathSync(fileURLToPath4(import.meta.url));
-    const argv = fs5.realpathSync(path5.resolve(process.argv[1]));
+    const here = fs4.realpathSync(fileURLToPath4(import.meta.url));
+    const argv = fs4.realpathSync(path4.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -1343,12 +1304,12 @@ if (isCliEntry) {
 
 // src/scripts/hooks/evidence_independence.ts
 import crypto from "node:crypto";
-import fs6 from "node:fs";
-import path6 from "node:path";
+import fs5 from "node:fs";
+import path5 from "node:path";
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
 var EXIT_ALLOW4 = 0;
 var EXIT_BLOCK2 = 1;
-var STATE_FILE4 = path6.join("agents", "state", "evidence-dispatch.json");
+var STATE_FILE4 = path5.join("agents", "state", "evidence-dispatch.json");
 function _isObject5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -1416,8 +1377,8 @@ function extractDispatch(envelope) {
 }
 function _ledgerStamp(consumer_root) {
   try {
-    const raw = fs6.readFileSync(
-      path6.join(consumer_root, "agents", "state", "git-authorization.json"),
+    const raw = fs5.readFileSync(
+      path5.join(consumer_root, "agents", "state", "git-authorization.json"),
       "utf8"
     );
     const d = JSON.parse(raw);
@@ -1428,7 +1389,7 @@ function _ledgerStamp(consumer_root) {
 }
 function _load(target) {
   try {
-    const decoded = JSON.parse(fs6.readFileSync(target, "utf8"));
+    const decoded = JSON.parse(fs5.readFileSync(target, "utf8"));
     if (_isObject5(decoded) && Array.isArray(decoded["evaluations"])) {
       return decoded;
     }
@@ -1483,7 +1444,7 @@ function run5(stdin_text, options) {
       return EXIT_ALLOW4;
     }
   }
-  const target = path6.join(options.consumer_root, STATE_FILE4);
+  const target = path5.join(options.consumer_root, STATE_FILE4);
   const state = _load(target);
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
   const turnMarker = `${session_id}:${_ledgerStamp(options.consumer_root)}`;
@@ -1534,13 +1495,13 @@ function _isCliEntry5() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL5(path6.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL5(path5.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs6.realpathSync(fileURLToPath5(import.meta.url));
-    const argv = fs6.realpathSync(path6.resolve(process.argv[1]));
+    const here = fs5.realpathSync(fileURLToPath5(import.meta.url));
+    const argv = fs5.realpathSync(path5.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -1551,7 +1512,7 @@ if (_isCliEntry5()) {
 }
 
 // src/scripts/conformance_scan.ts
-var REPO_ROOT = path7.resolve(path7.dirname(fileURLToPath6(import.meta.url)), "..", "..");
+var REPO_ROOT = path6.resolve(path6.dirname(fileURLToPath6(import.meta.url)), "..", "..");
 var OBSERVED_BAND = { low: 9.1, high: 39.2 };
 var BAND_MIN_TURNS = 1978;
 function bandVerdict(rate_pct, assistant_turns) {
@@ -1560,6 +1521,46 @@ function bandVerdict(rate_pct, assistant_turns) {
   }
   return rate_pct >= OBSERVED_BAND.low && rate_pct <= OBSERVED_BAND.high ? "inside" : "outside";
 }
+var CHECK_IDS = [
+  "language-pin",
+  "git-authorization",
+  "vacuous-evidence",
+  "evidence-steering"
+];
+var CHECK_MEANINGS = {
+  "language-pin": "An assistant turn whose user-visible prose is not in the language that turn's own pin named. Carries provenance (turns_since_prompt, compaction_since_prompt) so a pin that was ABSENT because compaction removed it stays distinguishable from one that was present and ignored.",
+  "git-authorization": "A gated git operation performed in a session where no authorization for that operation was observed. Authorization is per-operation and never carries from one to the next.",
+  "vacuous-evidence": "A CI poll read as settled without ever observing an in-flight run \u2014 the poll gap that reports a green settle over a window in which nothing was pending yet.",
+  "evidence-steering": "A self-commissioned evaluation whose prompt pre-loaded its own verdict, or a second self-scoped evaluation of the same subject within one turn."
+};
+function renderWhy(report, id) {
+  const hits = report.per_session.flatMap((s) => s.violations.filter((v) => v.check === id));
+  const lines = [
+    `conformance:why \xB7 ${id} \xB7 ${report.sessions} session(s) \xB7 ${report.store}`,
+    "",
+    "  What it detects:",
+    `    ${CHECK_MEANINGS[id]}`,
+    ""
+  ];
+  if (hits.length === 0) {
+    lines.push(`  Did NOT fire in this window (0 hits over ${report.sessions} session(s)).`);
+    lines.push("  A measured zero, not an unmeasured one \u2014 the check ran.");
+    return lines.join("\n");
+  }
+  lines.push(`  Fired ${hits.length} time(s):`);
+  for (const v of hits) {
+    lines.push(`    \xB7 ${v.session} @ ${v.at}`);
+    lines.push(`      ${v.detail}`);
+    const since = v.turns_since_prompt;
+    const compacted = v.compaction_since_prompt;
+    if (since !== void 0 || compacted !== void 0) {
+      lines.push(
+        `      provenance: turns_since_prompt=${since ?? "\u2014"} \xB7 compaction_since_prompt=${compacted ?? "\u2014"}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
 function _isObject6(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -1741,7 +1742,7 @@ function scanSession(sessionId, lines) {
   }
   return report;
 }
-var DEFAULT_RATE_SERIES = path7.join(
+var DEFAULT_RATE_SERIES = path6.join(
   REPO_ROOT,
   "agents",
   "runtime",
@@ -1750,7 +1751,7 @@ var DEFAULT_RATE_SERIES = path7.join(
 );
 function defaultStore(projectDir) {
   const slug = projectDir.replace(/[/.]/g, "-");
-  return path7.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
+  return path6.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
 }
 function _tokens(chars) {
   return Math.round(chars / 4);
@@ -1761,13 +1762,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   return {
     project: {
       dir: projectRulesDir,
-      present: fs7.existsSync(projectRulesDir),
+      present: fs6.existsSync(projectRulesDir),
       files: p.files,
       tokens: _tokens(p.chars)
     },
     global: {
       dir: globalRulesDir,
-      present: fs7.existsSync(globalRulesDir),
+      present: fs6.existsSync(globalRulesDir),
       files: g.files,
       tokens: _tokens(g.chars)
     },
@@ -1775,13 +1776,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   };
 }
 function storeKey(store) {
-  return createHash("sha256").update(path7.resolve(store)).digest("hex").slice(0, 12);
+  return createHash("sha256").update(path6.resolve(store)).digest("hex").slice(0, 12);
 }
 function scanStore(store, limit) {
-  const files = fs7.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs7.statSync(path7.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
+  const files = fs6.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs6.statSync(path6.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
   const per_session = [];
   for (const f of files) {
-    const lines = fs7.readFileSync(path7.join(store, f), "utf8").split("\n");
+    const lines = fs6.readFileSync(path6.join(store, f), "utf8").split("\n");
     const r = scanSession(f.replace(/\.jsonl$/, "").slice(0, 8), lines);
     if (r.assistant_turns > 0) {
       per_session.push(r);
@@ -1802,10 +1803,10 @@ function scanStore(store, limit) {
   const language_pin = totals["language-pin"] ?? 0;
   const rate_pct = assistant_turns === 0 ? 0 : Number((100 * language_pin / assistant_turns).toFixed(1));
   const delivered = measureDelivered(
-    path7.join(REPO_ROOT, ".claude", "rules"),
-    path7.join(process.env["HOME"] ?? os.homedir(), ".claude", "rules")
+    path6.join(REPO_ROOT, ".claude", "rules"),
+    path6.join(process.env["HOME"] ?? os.homedir(), ".claude", "rules")
   );
-  const ownStore = path7.resolve(store) === path7.resolve(defaultStore(REPO_ROOT));
+  const ownStore = path6.resolve(store) === path6.resolve(defaultStore(REPO_ROOT));
   return {
     scanned_at: (/* @__PURE__ */ new Date()).toISOString(),
     store,
@@ -1828,8 +1829,8 @@ function scanStore(store, limit) {
   };
 }
 function recordRate(file, scanned_at, rate) {
-  fs7.mkdirSync(path7.dirname(file), { recursive: true });
-  fs7.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
+  fs6.mkdirSync(path6.dirname(file), { recursive: true });
+  fs6.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
 `, "utf8");
 }
 function render(report) {
@@ -1893,6 +1894,7 @@ function main6(argv) {
   let json = false;
   let out = null;
   let record = null;
+  let why = null;
   for (let i = 0; i < args.length; i += 1) {
     const a = args[i];
     if (a === "--store" && args[i + 1] !== void 0) {
@@ -1903,25 +1905,56 @@ function main6(argv) {
       json = true;
     } else if (a === "--output" && args[i + 1] !== void 0) {
       out = args[++i];
+    } else if (a === "--why" && args[i + 1] !== void 0) {
+      why = args[++i];
     } else if (a === "--record") {
       record = args[i + 1] !== void 0 && !args[i + 1].startsWith("-") ? args[++i] : DEFAULT_RATE_SERIES;
     }
   }
+  if (why !== null && !CHECK_IDS.includes(why)) {
+    process.stderr.write(
+      `conformance:why: unknown check id ${JSON.stringify(why)} \u2014 known ids: ${CHECK_IDS.join(", ")}
+`
+    );
+    return 2;
+  }
   const resolved = store ?? defaultStore(process.cwd());
-  if (!fs7.existsSync(resolved)) {
+  if (!fs6.existsSync(resolved)) {
     process.stderr.write(`conformance:behavior: no transcript store at ${resolved}
 `);
     return 1;
   }
   const report = scanStore(resolved, Number.isFinite(limit) && limit > 0 ? limit : 30);
   if (out) {
-    fs7.writeFileSync(out, `${JSON.stringify(report, null, 2)}
+    fs6.writeFileSync(out, `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   if (record) {
     recordRate(record, report.scanned_at, report.rate);
   }
-  fs7.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
+  if (why !== null) {
+    const id = why;
+    fs6.writeSync(
+      1,
+      json ? `${JSON.stringify(
+        {
+          check: id,
+          meaning: CHECK_MEANINGS[id],
+          store: report.store,
+          sessions: report.sessions,
+          hits: report.per_session.flatMap(
+            (s) => s.violations.filter((v) => v.check === id)
+          )
+        },
+        null,
+        2
+      )}
+` : `${renderWhy(report, id)}
+`
+    );
+    return 0;
+  }
+  fs6.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
 ` : `${render(report)}
 `);
   return 0;
@@ -1933,13 +1966,13 @@ function _isCliEntry6() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL6(path7.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL6(path6.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs7.realpathSync(fileURLToPath6(import.meta.url));
-    const argv = fs7.realpathSync(path7.resolve(process.argv[1]));
+    const here = fs6.realpathSync(fileURLToPath6(import.meta.url));
+    const argv = fs6.realpathSync(path6.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -1950,19 +1983,19 @@ if (_isCliEntry6()) {
 }
 
 // src/scripts/report_carrier_divergence.ts
-import * as fs8 from "node:fs";
+import * as fs7 from "node:fs";
 import * as os2 from "node:os";
-import * as path8 from "node:path";
+import * as path7 from "node:path";
 import process2 from "node:process";
 import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
 var _HERE = fileURLToPath7(import.meta.url);
-var REPO_ROOT2 = path8.resolve(path8.dirname(_HERE), "..", "..");
-var PROJECT_RULES = path8.join(".claude", "rules");
-var PROJECTION_SOURCE = path8.join("dist", "agent-src", "rules");
-var GLOBAL_RULES = path8.join(".claude", "rules");
+var REPO_ROOT2 = path7.resolve(path7.dirname(_HERE), "..", "..");
+var PROJECT_RULES = path7.join(".claude", "rules");
+var PROJECTION_SOURCE = path7.join("dist", "agent-src", "rules");
+var GLOBAL_RULES = path7.join(".claude", "rules");
 function _listRules(dir) {
   try {
-    return fs8.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    return fs7.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
@@ -1970,26 +2003,24 @@ function _listRules(dir) {
 function _ruleType(file) {
   let text;
   try {
-    text = fs8.readFileSync(file, "utf-8");
+    text = fs7.readFileSync(file, "utf-8");
   } catch {
     return "";
   }
-  if (!text.startsWith("---")) return "";
-  const end = text.indexOf("\n---", 3);
-  const fm = end === -1 ? text : text.slice(0, end);
-  const m = /^type:\s*"?([a-z]+)"?/m.exec(fm);
+  const m = /^type:\s*"?([a-z]+)"?/m.exec(splitFrontmatter(text).frontmatter);
   return m === null ? "" : m[1];
 }
 function compareCarriers(projectDir, globalDir, sourceDir) {
   const out = {
     projectDir,
     globalDir,
-    globalPresent: fs8.existsSync(globalDir),
-    projectPresent: fs8.existsSync(projectDir),
+    globalPresent: fs7.existsSync(globalDir),
+    projectPresent: fs7.existsSync(projectDir),
     shared: 0,
     identical: [],
     provenanceOnly: [],
     frontmatterOnly: [],
+    pathsScopeDiff: [],
     bodyDiff: [],
     projectOnly: [],
     globalOnly: [],
@@ -2007,19 +2038,19 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     if (!inP && inG) {
       out.globalOnly.push(rule);
-      if (sourceDir !== void 0 && _ruleType(path8.join(sourceDir, rule)) === "manual") {
+      if (sourceDir !== void 0 && _ruleType(path7.join(sourceDir, rule)) === "manual") {
         out.manualOnlyGlobal.push(rule);
       }
       continue;
     }
     out.shared += 1;
     let verdict;
-    let proseSame;
+    let projectCopy;
+    let globalCopy;
     try {
-      const projectCopy = fs8.readFileSync(path8.join(projectDir, rule));
-      const globalCopy = fs8.readFileSync(path8.join(globalDir, rule));
+      projectCopy = fs7.readFileSync(path7.join(projectDir, rule));
+      globalCopy = fs7.readFileSync(path7.join(globalDir, rule));
       verdict = comparePair(projectCopy, globalCopy);
-      proseSame = proseEqual(projectCopy.toString("utf-8"), globalCopy.toString("utf-8"));
     } catch {
       out.shared -= 1;
       out.unreadable.push(rule);
@@ -2027,8 +2058,16 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     }
     if (verdict === "identical") out.identical.push(rule);
     else if (verdict === "provenance-only") out.provenanceOnly.push(rule);
-    else if (proseSame) out.frontmatterOnly.push(rule);
-    else out.bodyDiff.push(rule);
+    else {
+      const projectText = projectCopy.toString("utf-8");
+      const globalText = globalCopy.toString("utf-8");
+      if (proseEqual(projectText, globalText)) {
+        out.frontmatterOnly.push(rule);
+        if (frontmatterPaths(projectText) !== frontmatterPaths(globalText)) {
+          out.pathsScopeDiff.push(rule);
+        }
+      } else out.bodyDiff.push(rule);
+    }
   }
   return out;
 }
@@ -2057,6 +2096,7 @@ function render2(d) {
   lines.push(`    byte-identical                     ${d.identical.length}`);
   lines.push(`    differ ONLY in the install stamp   ${d.provenanceOnly.length}`);
   lines.push(`    differ ONLY in frontmatter         ${d.frontmatterOnly.length}`);
+  lines.push(`      of which disagree on \`paths:\`    ${d.pathsScopeDiff.length}  \u2190 ACTIONABLE`);
   lines.push(`    differ in PROSE                    ${d.bodyDiff.length}`);
   if (d.unreadable.length > 0) {
     lines.push(`    unreadable on one side             ${d.unreadable.length}  (${d.unreadable.join(", ")})`);
@@ -2081,16 +2121,27 @@ function render2(d) {
     for (const r of d.bodyDiff) lines.push(`    - ${r}`);
     lines.push("");
   }
-  if (d.frontmatterOnly.length > 0) {
-    lines.push(`  ${String(d.frontmatterOnly.length)} pair(s) differ ONLY in the frontmatter block \u2014 prose byte-identical.`);
-    lines.push("  Not a governed-text difference and nothing to act on: the host delivers the");
-    lines.push("  prose without that block, and none of the keys in it is one this host reads");
-    lines.push("  (claude-code-rules-dir-contract.md: it reads `paths`, and agent-config's own");
-    lines.push("  vocabulary is not read at all). Two writers, two frontmatter policies \u2014");
-    lines.push("  `generate-tools` emits `paths` where a rule is path-scoped and nothing");
-    lines.push("  otherwise; `install.ts` writes the full vocabulary plus its ownership stamp.");
-    lines.push("  Reported as a count on purpose: naming every pair would bury the class");
-    lines.push("  above, which is the one a reader must act on.");
+  if (d.pathsScopeDiff.length > 0) {
+    lines.push(`  \`paths:\` SCOPE DISAGREEMENT (${String(d.pathsScopeDiff.length)}) \u2014 same prose, different load schedule.`);
+    lines.push("  ACT ON THESE. `paths` is the one frontmatter key this host reads: with it, a");
+    lines.push("  rule fires when a matching file is read and is NOT re-injected after");
+    lines.push("  /compact; without it, the rule loads unconditionally at launch. So the copy");
+    lines.push("  that lacks `paths` DEFEATS the other copy's scoping \u2014 the rule the project");
+    lines.push("  layer meant to deliver conditionally is delivered always, and an obligation");
+    lines.push("  a maintainer deliberately scoped is silently unscoped on any machine that");
+    lines.push("  carries both. Identical prose does not make this inert.");
+    for (const r of d.pathsScopeDiff) lines.push(`    - ${r}`);
+    lines.push("");
+  }
+  const inert = d.frontmatterOnly.length - d.pathsScopeDiff.length;
+  if (inert > 0) {
+    lines.push(`  ${String(inert)} further pair(s) differ ONLY in frontmatter the host does not read \u2014`);
+    lines.push("  prose byte-identical, `paths` in agreement, nothing to act on. Two writers,");
+    lines.push("  two policies: `generate-tools` emits `paths` where a rule is path-scoped and");
+    lines.push("  nothing otherwise; `install.ts` writes agent-config's own vocabulary plus its");
+    lines.push("  ownership stamp, and none of those keys is one this host reads");
+    lines.push("  (claude-code-rules-dir-contract.md). Reported as a count on purpose: naming");
+    lines.push("  every pair would bury the two classes above, which are the actionable ones.");
     lines.push("");
   }
   if (d.provenanceOnly.length > 0) {
@@ -2129,6 +2180,10 @@ function render2(d) {
   if (d.bodyDiff.length === 0) {
     lines.push("");
     lines.push("  No prose divergence \u2014 no rule's governed text differs between the carriers.");
+    if (d.pathsScopeDiff.length > 0) {
+      lines.push("  NOT an all-clear: the `paths:` disagreements above are still open, and they");
+      lines.push("  change when a rule loads rather than what it says.");
+    }
     lines.push("  The condition is transient \u2014 it returns whenever the checkout moves ahead of");
     lines.push("  the installed release \u2014 so this is a reading of right now, not a property of");
     lines.push("  the repo. Re-run it, do not cite it. That holds doubly here: the reading also");
@@ -2141,9 +2196,9 @@ function render2(d) {
 }
 function main7(argv) {
   const args = argv ?? process2.argv.slice(2);
-  let projectDir = path8.join(REPO_ROOT2, PROJECT_RULES);
-  let globalDir = path8.join(os2.homedir(), GLOBAL_RULES);
-  let sourceDir = path8.join(REPO_ROOT2, PROJECTION_SOURCE);
+  let projectDir = path7.join(REPO_ROOT2, PROJECT_RULES);
+  let globalDir = path7.join(os2.homedir(), GLOBAL_RULES);
+  let sourceDir = path7.join(REPO_ROOT2, PROJECTION_SOURCE);
   const value = (i) => {
     const v = args[i + 1];
     return v === void 0 || v.startsWith("-") ? null : v;
@@ -2157,7 +2212,7 @@ function main7(argv) {
 `);
         return 1;
       }
-      const resolved = path8.resolve(v);
+      const resolved = path7.resolve(v);
       if (a === "--project") projectDir = resolved;
       else if (a === "--global") globalDir = resolved;
       else sourceDir = resolved;
@@ -2179,9 +2234,9 @@ function main7(argv) {
 }
 function _isCliEntry7() {
   if (process2.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL7(path8.resolve(process2.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL7(path7.resolve(process2.argv[1])).href) return true;
   try {
-    return fs8.realpathSync(_HERE) === fs8.realpathSync(path8.resolve(process2.argv[1]));
+    return fs7.realpathSync(_HERE) === fs7.realpathSync(path7.resolve(process2.argv[1]));
   } catch {
     return false;
   }
@@ -2191,30 +2246,30 @@ if (_isCliEntry7()) {
 }
 
 // src/scripts/report_skill_activation.ts
-import * as fs9 from "node:fs";
+import * as fs8 from "node:fs";
 import * as os3 from "node:os";
-import * as path9 from "node:path";
+import * as path8 from "node:path";
 import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL8 } from "node:url";
 var _HERE2 = fileURLToPath8(import.meta.url);
-var REPO_ROOT3 = path9.resolve(path9.dirname(_HERE2), "..", "..");
+var REPO_ROOT3 = path8.resolve(path8.dirname(_HERE2), "..", "..");
 var SKILLS_ROOT = "src/skills";
 var TRIGGER_KEYS = ["triggers:", "trigger_description:", "file_pattern:", "path_prefix:"];
 var DETERMINISTIC_RE = /^\s*(?:[-*]\s*)?(?:\*\*)?(MUST|NEVER|ALWAYS)\b/m;
 function censusSkills(root) {
   const out = { total: 0, withTriggerKey: [], withDeterministicObligation: [] };
-  if (!fs9.existsSync(root)) {
+  if (!fs8.existsSync(root)) {
     return out;
   }
-  for (const entry of fs9.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const entry of fs8.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const file = path9.join(root, entry.name, "SKILL.md");
-    if (!fs9.existsSync(file)) {
+    const file = path8.join(root, entry.name, "SKILL.md");
+    if (!fs8.existsSync(file)) {
       continue;
     }
     out.total += 1;
-    const text = fs9.readFileSync(file, "utf8");
+    const text = fs8.readFileSync(file, "utf8");
     const fmEnd = text.startsWith("---") ? text.indexOf("\n---", 3) : -1;
     const fm = fmEnd === -1 ? "" : text.slice(0, fmEnd);
     if (TRIGGER_KEYS.some((k) => new RegExp(`^${k}`, "m").test(fm))) {
@@ -2228,17 +2283,17 @@ function censusSkills(root) {
   return out;
 }
 function defaultStore2(cwd) {
-  return path9.join(os3.homedir(), ".claude", "projects", cwd.replace(/\//g, "-"));
+  return path8.join(os3.homedir(), ".claude", "projects", cwd.replace(/\//g, "-"));
 }
 function measureUsage(store, limit) {
   const rep = { store, sessions: 0, assistantTurns: 0, invocations: 0, bySkill: {} };
-  if (!fs9.existsSync(store)) {
+  if (!fs8.existsSync(store)) {
     return rep;
   }
-  const files = fs9.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path9.join(store, f)).sort((a, b) => fs9.statSync(b).mtimeMs - fs9.statSync(a).mtimeMs).slice(0, limit);
+  const files = fs8.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path8.join(store, f)).sort((a, b) => fs8.statSync(b).mtimeMs - fs8.statSync(a).mtimeMs).slice(0, limit);
   rep.sessions = files.length;
   for (const file of files) {
-    for (const line of fs9.readFileSync(file, "utf8").split("\n")) {
+    for (const line of fs8.readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) {
         continue;
       }
@@ -2301,7 +2356,7 @@ function render3(census, usage) {
     }
     totalInv += u.invocations;
     lines.push(
-      `  ${path9.basename(u.store).slice(-38).padEnd(38)} sessions=${String(u.sessions).padStart(3)} asst=${String(u.assistantTurns).padStart(6)} Skill calls=${String(u.invocations).padStart(3)}`
+      `  ${path8.basename(u.store).slice(-38).padEnd(38)} sessions=${String(u.sessions).padStart(3)} asst=${String(u.assistantTurns).padStart(6)} Skill calls=${String(u.invocations).padStart(3)}`
     );
   }
   lines.push("");
@@ -2349,24 +2404,24 @@ function main8(argv) {
   if (stores.length === 0) {
     stores.push(defaultStore2(REPO_ROOT3));
   }
-  const census = censusSkills(path9.join(REPO_ROOT3, SKILLS_ROOT));
+  const census = censusSkills(path8.join(REPO_ROOT3, SKILLS_ROOT));
   const usage = stores.map((s) => measureUsage(s, limit));
   process.stdout.write(`${render3(census, usage)}
 `);
   return 0;
 }
-if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL8(path9.resolve(process.argv[1])).href) {
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL8(path8.resolve(process.argv[1])).href) {
   process.exit(main8(process.argv.slice(2)));
 }
 
 // src/scripts/report_skill_obligation_violations.ts
-import * as fs10 from "node:fs";
+import * as fs9 from "node:fs";
 import * as os4 from "node:os";
-import * as path10 from "node:path";
+import * as path9 from "node:path";
 import process3 from "node:process";
 import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
 var _HERE3 = fileURLToPath9(import.meta.url);
-var REPO_ROOT4 = path10.resolve(path10.dirname(_HERE3), "..", "..");
+var REPO_ROOT4 = path9.resolve(path9.dirname(_HERE3), "..", "..");
 var OBLIGATION_LINE_RE = new RegExp(`${DETERMINISTIC_RE.source}.*`, "gm");
 var PATH_RE = /`([A-Za-z0-9_./-]*\/[A-Za-z0-9_.-]+\.[a-z]{2,6})`/g;
 var CMD_RE = /`([a-z][a-z0-9-]*(?: [a-z][a-z0-9:._-]*){1,3})`/g;
@@ -2404,7 +2459,7 @@ function _artefacts(line) {
   return out;
 }
 function extractObligations(repoRoot) {
-  const skillsRoot = path10.join(repoRoot, SKILLS_ROOT);
+  const skillsRoot = path9.join(repoRoot, SKILLS_ROOT);
   const census = censusSkills(skillsRoot);
   const out = {
     skills: census.withDeterministicObligation,
@@ -2418,7 +2473,7 @@ function extractObligations(repoRoot) {
   for (const skill of census.withDeterministicObligation) {
     let text;
     try {
-      text = fs10.readFileSync(path10.join(skillsRoot, skill, "SKILL.md"), "utf-8");
+      text = fs9.readFileSync(path9.join(skillsRoot, skill, "SKILL.md"), "utf-8");
     } catch {
       continue;
     }
@@ -2534,7 +2589,7 @@ function scanSessionForViolations(session, lines, forbidden, parsed) {
   return flags;
 }
 function defaultStore3(cwd) {
-  return path10.join(os4.homedir(), ".claude", "projects", cwd.replace(/[/.]/g, "-"));
+  return path9.join(os4.homedir(), ".claude", "projects", cwd.replace(/[/.]/g, "-"));
 }
 function scanStore2(repoRoot, store, limit) {
   const census = extractObligations(repoRoot);
@@ -2547,14 +2602,14 @@ function scanStore2(repoRoot, store, limit) {
   };
   let files;
   try {
-    files = fs10.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path10.join(store, f), m: fs10.statSync(path10.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
+    files = fs9.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path9.join(store, f), m: fs9.statSync(path9.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
   } catch {
     return report;
   }
   report.sessions = files.length;
   for (const file of files) {
-    const lines = fs10.readFileSync(file, "utf-8").split("\n");
-    const id = path10.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
+    const lines = fs9.readFileSync(file, "utf-8").split("\n");
+    const id = path9.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
     const entries = _parseSession(lines);
     if (loadedSkillsFrom(entries).size > 0) report.sessionsWithASkill += 1;
     report.flags.push(...scanSessionForViolations(id, lines, census.forbidden, entries));
@@ -2679,9 +2734,9 @@ function main9(argv) {
 }
 function _isCliEntry8() {
   if (process3.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL9(path10.resolve(process3.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL9(path9.resolve(process3.argv[1])).href) return true;
   try {
-    return fs10.realpathSync(_HERE3) === fs10.realpathSync(path10.resolve(process3.argv[1]));
+    return fs9.realpathSync(_HERE3) === fs9.realpathSync(path9.resolve(process3.argv[1]));
   } catch {
     return false;
   }
@@ -2692,20 +2747,20 @@ if (_isCliEntry8()) {
 
 // src/scripts/report_conformance_funnel.ts
 var _HERE4 = fileURLToPath10(import.meta.url);
-var REPO_ROOT5 = path11.resolve(path11.dirname(_HERE4), "..", "..");
+var REPO_ROOT5 = path10.resolve(path10.dirname(_HERE4), "..", "..");
 function buildFunnel(opts = {}) {
   const repoRoot = opts.repoRoot ?? REPO_ROOT5;
-  const projectRulesDir = opts.projectRulesDir ?? path11.join(repoRoot, PROJECT_RULES);
-  const globalRulesDir = opts.globalRulesDir ?? path11.join(os5.homedir(), GLOBAL_RULES);
-  const sourceDir = opts.sourceDir ?? path11.join(repoRoot, PROJECTION_SOURCE);
+  const projectRulesDir = opts.projectRulesDir ?? path10.join(repoRoot, PROJECT_RULES);
+  const globalRulesDir = opts.globalRulesDir ?? path10.join(os5.homedir(), GLOBAL_RULES);
+  const sourceDir = opts.sourceDir ?? path10.join(repoRoot, PROJECTION_SOURCE);
   const store = opts.store ?? defaultStore(repoRoot);
   const limit = opts.limit ?? 30;
   return {
     delivered: measureDelivered(projectRulesDir, globalRulesDir),
     divergence: compareCarriers(projectRulesDir, globalRulesDir, sourceDir),
-    skills: censusSkills(path11.join(repoRoot, SKILLS_ROOT)),
+    skills: censusSkills(path10.join(repoRoot, SKILLS_ROOT)),
     usage: measureUsage(store, limit),
-    storePresent: fs11.existsSync(store),
+    storePresent: fs10.existsSync(store),
     sk2: scanStore2(repoRoot, store, limit)
   };
 }
@@ -2736,7 +2791,7 @@ function render5(r) {
     lines.push("    substituted with dist/, which would answer a different question.");
   } else {
     lines.push(
-      `    Divergence: ${d.shared} shared \xB7 ${d.bodyDiff.length} prose-diff \xB7 ${d.frontmatterOnly.length} frontmatter-only \xB7 ${d.provenanceOnly.length} provenance-only \xB7 ${d.projectOnly.length} project-only \xB7 ${d.globalOnly.length} global-only` + (d.manualOnlyGlobal.length > 0 ? ` (${d.manualOnlyGlobal.length} by design, ADR-004 manual)` : "")
+      `    Divergence: ${d.shared} shared \xB7 ${d.bodyDiff.length} prose-diff \xB7 ${d.frontmatterOnly.length} frontmatter-only (${d.pathsScopeDiff.length} on \`paths:\`) \xB7 ${d.provenanceOnly.length} provenance-only \xB7 ${d.projectOnly.length} project-only \xB7 ${d.globalOnly.length} global-only` + (d.manualOnlyGlobal.length > 0 ? ` (${d.manualOnlyGlobal.length} by design, ADR-004 manual)` : "")
     );
     if (d.bodyDiff.length > 0) {
       lines.push(`    PROSE DIVERGENCE \u2014 both copies reach the model: ${d.bodyDiff.join(", ")}`);
@@ -2745,15 +2800,41 @@ function render5(r) {
       lines.push("    (claude-code-rules-dir-contract.md). The project copy is merely the");
       lines.push("    newer one \u2014 recency, not precedence.");
     }
-    if (d.frontmatterOnly.length > 0) {
-      lines.push(`    ${String(d.frontmatterOnly.length)} pair(s) differ only in frontmatter \u2014 prose byte-identical, nothing`);
-      lines.push("    to act on; the host delivers the prose without that block.");
+    if (d.pathsScopeDiff.length > 0) {
+      lines.push(`    \`paths:\` SCOPE DISAGREEMENT (${String(d.pathsScopeDiff.length)}) \u2014 same prose, different load`);
+      lines.push("    schedule. `paths` is the one frontmatter key the host reads, so the copy");
+      lines.push("    without it defeats the other copy's scoping: a deliberately scoped");
+      lines.push("    obligation is delivered unconditionally. Act on these.");
+    }
+    const inertFm = d.frontmatterOnly.length - d.pathsScopeDiff.length;
+    if (inertFm > 0) {
+      lines.push(`    ${String(inertFm)} further pair(s) differ only in frontmatter the host does not read \u2014`);
+      lines.push("    prose byte-identical, `paths` in agreement, nothing to act on.");
     }
     if (d.unreadable.length > 0) {
       lines.push(`    Unreadable on one side (${d.unreadable.length}) \u2014 a broken install, not a disagreement.`);
     }
   }
   lines.push("");
+  lines.push("OPPORTUNITY \u2014 in how many sessions could a skill fire at all?");
+  if (!r.storePresent) {
+    lines.push("    NO DATA: no transcript store \u2014 opportunity is not measurable here.");
+    lines.push("    An absent store is an answer, not a zero.");
+  } else {
+    lines.push(`    sessions scanned                      ${r.sk2.sessions}`);
+    lines.push(
+      `    with a skill in context               ${r.sk2.sessionsWithASkill} (${_pct3(r.sk2.sessionsWithASkill, r.sk2.sessions)})`
+    );
+    lines.push(
+      "    Skill invocations per such session     " + (r.sk2.sessionsWithASkill === 0 ? "n/a" : (r.usage.invocations / r.sk2.sessionsWithASkill).toFixed(2))
+    );
+  }
+  lines.push(`    Honest scope: "in context" is the SK-2 scan's reading \u2014 a skill was`);
+  lines.push("    LOADED, not that the task needed it. So this bounds activation from");
+  lines.push("    above; it never claims a missed invocation was a defect. Report-only and");
+  lines.push("    deliberately without a threshold: a joined funnel with a denominator");
+  lines.push("    invites one, and the activation red-baseline null is terminal.");
+  lines.push("");
   lines.push("ACTIVATION \u2014 are the delivered skills invoked?");
   lines.push(`    skills shipped                        ${r.skills.total}`);
   lines.push(
@@ -2820,7 +2901,7 @@ function main10(argv) {
 `);
         return 1;
       }
-      const resolved = path11.resolve(v);
+      const resolved = path10.resolve(v);
       if (a === "--store") opts.store = resolved;
       else if (a === "--project") opts.projectRulesDir = resolved;
       else if (a === "--global") opts.globalRulesDir = resolved;
@@ -2852,9 +2933,9 @@ function main10(argv) {
 }
 function _isCliEntry9() {
   if (process4.argv[1] === void 0) return false;
-  if (import.meta.url === pathToFileURL10(path11.resolve(process4.argv[1])).href) return true;
+  if (import.meta.url === pathToFileURL10(path10.resolve(process4.argv[1])).href) return true;
   try {
-    return fs11.realpathSync(_HERE4) === fs11.realpathSync(path11.resolve(process4.argv[1]));
+    return fs10.realpathSync(_HERE4) === fs10.realpathSync(path10.resolve(process4.argv[1]));
   } catch {
     return false;
   }
@@ -2887,17 +2968,17 @@ function conformanceLogPath() {
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path12.join(os6.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
+  return path11.join(os6.homedir(), ".event4u", "agent-config", "conformance-log.jsonl");
 }
 function installLogPath() {
   const override = process5.env["AGENT_CONFIG_INSTALL_LOG"];
   if (override && override.trim().length > 0) {
     return override;
   }
-  return path12.join(os6.homedir(), ".event4u", "agent-config", "install-log.jsonl");
+  return path11.join(os6.homedir(), ".event4u", "agent-config", "install-log.jsonl");
 }
 function _check_txlog_clean(logPath = installLogPath()) {
-  if (!fs12.existsSync(logPath)) {
+  if (!fs11.existsSync(logPath)) {
     return {
       id: "txlog-clean",
       status: "ok",
@@ -2931,11 +3012,11 @@ function _check_txlog_clean(logPath = installLogPath()) {
   };
 }
 function routeTargetPaths(target) {
-  return routeTargetPathsPosix(target).map((rel) => path12.join(...rel.split("/")));
+  return routeTargetPathsPosix(target).map((rel) => path11.join(...rel.split("/")));
 }
 function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
-  const routerPath = path12.join(packageRoot, "dist", "router.json");
-  if (!fs12.existsSync(routerPath)) {
+  const routerPath = path11.join(packageRoot, "dist", "router.json");
+  if (!fs11.existsSync(routerPath)) {
     return {
       id: "router-pointers",
       status: "fail",
@@ -2945,7 +3026,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   }
   let router;
   try {
-    router = JSON.parse(fs12.readFileSync(routerPath, "utf8"));
+    router = JSON.parse(fs11.readFileSync(routerPath, "utf8"));
   } catch (exc) {
     return {
       id: "router-pointers",
@@ -2954,13 +3035,13 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
       remedy: "reinstall the package \u2014 dist/router.json is corrupt"
     };
   }
-  const rulesDir = path12.join(packageRoot, "dist", "agent-src", "rules");
+  const rulesDir = path11.join(packageRoot, "dist", "agent-src", "rules");
   const broken = [];
   let ids = 0;
   let targets = 0;
   for (const kernelId of router["kernel"] ?? []) {
     ids += 1;
-    if (!fs12.existsSync(path12.join(rulesDir, `${kernelId}.md`))) {
+    if (!fs11.existsSync(path11.join(rulesDir, `${kernelId}.md`))) {
       broken.push(`kernel:${kernelId} \u2192 rules/${kernelId}.md missing`);
     }
   }
@@ -2968,7 +3049,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
     for (const entry of router[tier] ?? []) {
       const ruleId = String(entry["id"] ?? "");
       ids += 1;
-      if (!fs12.existsSync(path12.join(rulesDir, `${ruleId}.md`))) {
+      if (!fs11.existsSync(path11.join(rulesDir, `${ruleId}.md`))) {
         broken.push(`${tier}:${ruleId} \u2192 rules/${ruleId}.md missing`);
       }
       for (const target of entry["routes_to"] ?? []) {
@@ -2978,7 +3059,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
           broken.push(`${ruleId} \u2192 unparseable routes_to ${JSON.stringify(target)}`);
           continue;
         }
-        if (!candidates.some((rel) => fs12.existsSync(path12.join(packageRoot, rel)))) {
+        if (!candidates.some((rel) => fs11.existsSync(path11.join(packageRoot, rel)))) {
           broken.push(`${ruleId} \u2192 ${target} (${candidates[0]} missing)`);
         }
       }
@@ -3010,9 +3091,9 @@ function detectSmokePlatform(projectRoot) {
   return "claude";
 }
 function dispatcherRunner(packageRoot) {
-  const localTsx = path12.join(packageRoot, "node_modules", ".bin", "tsx");
-  const script = path12.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
-  if (fs12.existsSync(localTsx)) {
+  const localTsx = path11.join(packageRoot, "node_modules", ".bin", "tsx");
+  const script = path11.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
+  if (fs11.existsSync(localTsx)) {
     return [localTsx, script];
   }
   return ["npx", "tsx", script];
@@ -3062,12 +3143,12 @@ function _check_hook_dispatcher(projectRoot, packageRoot = PACKAGE_ROOT, opts =
   };
 }
 function readSettingsMode(projectRoot) {
-  const settingsPath = path12.join(projectRoot, ".agent-settings.yml");
-  if (!fs12.existsSync(settingsPath)) {
+  const settingsPath = path11.join(projectRoot, ".agent-settings.yml");
+  if (!fs11.existsSync(settingsPath)) {
     return "eager-all";
   }
   try {
-    const parsed = YAML.parse(fs12.readFileSync(settingsPath, "utf8"));
+    const parsed = YAML.parse(fs11.readFileSync(settingsPath, "utf8"));
     const lean = parsed?.["lean_projection"] ?? null;
     const mode = lean?.["mode"];
     return typeof mode === "string" && mode.length > 0 ? mode : "eager-all";
@@ -3078,7 +3159,7 @@ function readSettingsMode(projectRoot) {
 function kernelIdsFromRouter(packageRoot) {
   try {
     const router = JSON.parse(
-      fs12.readFileSync(path12.join(packageRoot, "dist", "router.json"), "utf8")
+      fs11.readFileSync(path11.join(packageRoot, "dist", "router.json"), "utf8")
     );
     return new Set((router["kernel"] ?? []).map(String));
   } catch {
@@ -3095,8 +3176,8 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
       remedy: "set lean_projection.mode to 'eager-all' or 'thin' in .agent-settings.yml"
     };
   }
-  const rulesDir = projectedRulesDir ?? path12.join(projectRoot, ".augment", "rules");
-  if (!fs12.existsSync(rulesDir)) {
+  const rulesDir = projectedRulesDir ?? path11.join(projectRoot, ".augment", "rules");
+  if (!fs11.existsSync(rulesDir)) {
     return {
       id: "lean-projection",
       status: "skipped",
@@ -3105,7 +3186,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
     };
   }
   const kernel = kernelIdsFromRouter(packageRoot);
-  const files = fs12.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
+  const files = fs11.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
   const nonKernel = files.filter((f) => !kernel.has(f.replace(/\.md$/, "")));
   if (nonKernel.length === 0) {
     return {
@@ -3119,7 +3200,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
   for (const f of nonKernel) {
     let text = "";
     try {
-      text = fs12.readFileSync(path12.join(rulesDir, f), "utf8");
+      text = fs11.readFileSync(path11.join(rulesDir, f), "utf8");
     } catch {
       continue;
     }
@@ -3150,8 +3231,8 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
 function _check_host_manifest(projectRoot) {
   const detected = Object.entries(detectToolPresence(projectRoot)).filter(([, v]) => v === true).map(([k]) => k);
   const detectedNote = detected.length > 0 ? `detected surfaces: ${detected.join(", ")}` : "no surfaces detected";
-  const settingsPath = path12.join(projectRoot, ".agent-settings.yml");
-  if (!fs12.existsSync(settingsPath)) {
+  const settingsPath = path11.join(projectRoot, ".agent-settings.yml");
+  if (!fs11.existsSync(settingsPath)) {
     return {
       id: "host-manifest",
       status: "ok",
@@ -3161,7 +3242,7 @@ function _check_host_manifest(projectRoot) {
   }
   let parsed = null;
   try {
-    parsed = YAML.parse(fs12.readFileSync(settingsPath, "utf8"));
+    parsed = YAML.parse(fs11.readFileSync(settingsPath, "utf8"));
   } catch (exc) {
     return {
       id: "host-manifest",
@@ -3335,13 +3416,13 @@ function _isCliEntry10() {
   if (process5.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL11(path12.resolve(process5.argv[1])).href;
+  const argvUrl = pathToFileURL11(path11.resolve(process5.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs12.realpathSync(fileURLToPath11(import.meta.url));
-    const argv = fs12.realpathSync(path12.resolve(process5.argv[1]));
+    const here = fs11.realpathSync(fileURLToPath11(import.meta.url));
+    const argv = fs11.realpathSync(path11.resolve(process5.argv[1]));
     return here === argv;
   } catch {
     return false;